CVEs published July 14, 2025
127 CVEs were published on July 14, 2025: 9 critical, 27 high.
- Published
- 127
- Critical
- 9
- High
- 27
- Medium
- 87
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 36
Most affected products
- PHPGurukul Online Fire Reporting System
- 9
- code-projects Voting System
- 6
- PHPGurukul Dairy Farm Shop Management System
- 6
- LabRedesCefetRJ WeGIA
- 5
- directus
- 4
- Hewlett Packard Enterprise HPE AutoPass License Server
- 4
- YiJiuSmile kkFileViewOfficeEdit
- 4
- Avid NEXIS E-series · Avid NEXIS F-series +2
- 3
- code-projects Job Diary
- 3
- code-projects Simple Shopping Cart
- 3
Critical 9
- CVE-2025-53890pyLoad vulnerable to remote code execution through js2py onCaptchaResultpyload · pyload-ng
- CVE-2025-53836XWiki Rendering is vulnerable to RCE attacks when processing nested macrosxwiki-rendering · org.xwiki.rendering:xwiki-rendering-trans…
- CVE-2025-53835XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntaxxwiki-rendering · org.xwiki.rendering:xwiki-rendering-synta…
- CVE-2025-53833LaRecipe is vulnerable to Server-Side Template Injection attackssaleem-hadad larecipe · binarytorch/larecipe
- CVE-2025-53825Dokploy's Preview Deployments are vulnerable to Remote Code Executiondokploy
- CVE-2025-53823WeGIA vulnerable to SQL Injection (Blind Time-Based) in `processa_deletar_socio.php` parameter `id_socio`LabRedesCefetRJ WeGIA
- CVE-2025-7574LB-LINK BL-WR9000 Web Interface lighttpd.cgi restore improper authenticationLB-LINK BL-AC1900 · LB-LINK BL-AC2100_AZ3 +4
- CVE-2025-7451Hgiga｜iSherlock - OS Command InjectionHgiga iSherlock-maillog-4.5 · Hgiga iSherlock-smtp-4.5 +2
- CVE-2025-50756Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the newpass parameter.
High 27
- CVE-2025-53819Nix's privilege dropping to build user broke for macOSNixOS nix
- CVE-2025-53818github-kanban-mcp-server Command Injection vulnerabilitySunwood-ai-labs github-kanban-mcp-server · @sunwood-ai-labs…
- CVE-2025-53623Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator classShopify job-iteration · job-iteration
- CVE-2025-53101ImageMagick has Stack Buffer Overflow in image.cImageMagick · Magick.NET-Q16-AnyCPU +17
- CVE-2025-53015ImageMagick has XMP profile write that triggers hang due to unbounded loopImageMagick · Magick.NET-Q8-AnyCPU +18
- CVE-2025-7603D-Link DI-8100 HTTP Request jingx.asp stack-based overflowD-Link DI-8100
- CVE-2025-7602D-Link DI-8100 HTTP Request arp_sys.asp stack-based overflowD-Link DI-8100
- CVE-2025-7598Tenda AX1803 setWifiFilterCfg formSetWifiMacFilterCfg stack-based overflowTenda AX1803
- CVE-2025-7597Tenda AX1803 setMacFilterCfg formSetMacFilterCfg stack-based overflowTenda AX1803
- CVE-2024-51770An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17.Hewlett Packard Enterprise HPE AutoPass License Server
- CVE-2025-7596Tenda FH1205 WifiExtraSet formWifiExtraSet stack-based overflowTenda FH1205
- CVE-2024-51769An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17.Hewlett Packard Enterprise HPE AutoPass License Server
- CVE-2024-51768An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17.Hewlett Packard Enterprise HPE AutoPass License Server
- CVE-2024-51767An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17.Hewlett Packard Enterprise HPE AutoPass License Server
- CVE-2024-26293Unauthenticated Path Traversal affecting Avid NEXISAvid NEXIS E-series · Avid NEXIS F-series +2
- CVE-2025-53689Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commonsApache Software Foundation Apache Jackrabbit · org.apach… +1
- CVE-2024-26292Authenticated Arbitrary File Deletion affecting Avid NEXISAvid NEXIS E-series · Avid NEXIS F-series +2
- CVE-2024-26291Authenticated Arbitrary File Read affecting Avid NEXISAvid NEXIS E-series · Avid NEXIS F-series +2
- CVE-2025-7586Tenda AC500 setWtpData formSetAPCfg stack-based overflowTenda AC500
- CVE-2025-7571UTT HiPER 840G aspApBasicConfigUrcp buffer overflowUTT HiPER
- CVE-2025-7570UTT HiPER 840G aspRemoteApConfTempSend buffer overflowUTT HiPER
- CVE-2025-7620DSIC｜Cross-browser Components for Official Document Creation - Remote Code ExecutionDSIC Cross-browser Components for Official Document Creation
- CVE-2025-7619WellChoose｜BatchSignCS - Arbitrary File Write through Path TraversalWellChoose BatchSignCS
- CVE-2025-7564LB-LINK BL-AC3600 shadow hard-coded credentialsLB-LINK BL-AC3600
- CVE-2025-25180GPU DDK - Insufficient validation in RGXCREATEFREELIST creates corrupt freelistImagination Technologies Graphics DDK
- CVE-2024-42646A segmentation fault in NanoMQ v0.21.10 allows attackers to cause a Denial of Service (DoS) via crafted messages.
- CVE-2025-27582The Secure Password extension in One Identity Password Manager before 5.14.4 allows local privilege escalation.One Identity Password Manager
Medium, low and unrated 91
- CVE-2025-53889Directus missing permission checks for manual trigger Flowsdirectus
- CVE-2025-53887Directus's exact version number is exposed by the OpenAPI Specdirectus
- CVE-2025-53886Directus doesn't redact tokens in Flow logsdirectus
- CVE-2025-53885Directus doesn't redact sensitive user data when logging via event hooksdirectus
- CVE-2025-53839DRACOON Branding Service vulnerable to Cross-site Scriptingdracoon security-advisories
- CVE-2025-53834Caido Toast Vulnerable to Reflected Cross-site Scriptingcaido
- CVE-2025-53824WeGIA ReflectedCross-Site Scripting (XSS) vulnerability in endpoint 'cadastro_pet.php' parameter 'msg'LabRedesCefetRJ WeGIA
- CVE-2025-53822WeGIA vulnerable to Reflected Cross-Site Scripting in endpoint 'relatorio_geracao.php' parameter 'tipo_relatorio'LabRedesCefetRJ WeGIA
- CVE-2025-53821WeGIA vulnerable to Open Redirect in endpoint 'control.php' parameter 'nextPage'LabRedesCefetRJ WeGIA
- CVE-2025-53820WeGIA vulnerable to Cross-Site Scripting (XSS) Reflected via endpoint 'index.php' parameter 'erro'LabRedesCefetRJ WeGIA
- CVE-2025-53643AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sectionsaio-libs aiohttp · aiohttp
- CVE-2025-53640Indico vulnerable to user enumeration via API endpointindico
- CVE-2025-53639Metersphere has SQL Injection Vulnerability in Sorting Fieldmetersphere
- CVE-2025-53019ImageMagick has Memory Leak in magick streamImageMagick · Magick.NET-Q16-AnyCPU +17
- CVE-2025-7628YiJiuSmile kkFileViewOfficeEdit deleteFile path traversalYiJiuSmile kkFileViewOfficeEdit
- CVE-2025-53014ImageMagick has Heap Buffer Overflow in InterpretImageFilenameImageMagick · Magick.NET-Q16-AnyCPU +17
- CVE-2025-7627YiJiuSmile kkFileViewOfficeEdit fileUpload unrestricted uploadYiJiuSmile kkFileViewOfficeEdit
- CVE-2025-7626YiJiuSmile kkFileViewOfficeEdit onlinePreview path traversalYiJiuSmile kkFileViewOfficeEdit
- CVE-2025-7625YiJiuSmile kkFileViewOfficeEdit download path traversalYiJiuSmile kkFileViewOfficeEdit
- CVE-2025-7616gmg137 snap7-rs Public API pthread_cond_destroy memory corruptiongmg137 snap7-rs
- CVE-2025-7615TOTOLINK T6 HTTP POST Request cstecgi.cgi clearPairCfg command injectionTOTOLINK T6
- CVE-2025-7614TOTOLINK T6 HTTP POST Request cstecgi.cgi delDevice command injectionTOTOLINK T6
- CVE-2025-7613TOTOLINK T6 HTTP POST Request cstecgi.cgi CloudSrvVersionCheck command injectionTOTOLINK T6
- CVE-2025-7612code-projects Mobile Shop login.php sql injectioncode-projects Mobile Shop
- CVE-2025-7611code-projects Wedding Reservation global.php sql injectioncode-projects Wedding Reservation
- CVE-2025-7610code-projects Electricity Billing System change_password.php sql injectioncode-projects Electricity Billing System
- CVE-2025-7609code-projects Simple Shopping Cart register.php sql injectioncode-projects Simple Shopping Cart
- CVE-2025-7519Polkit: xml policy file with a large number of nested elements may lead to out-of-bounds writepolkit · Red Hat Enterprise Linux +1
- CVE-2025-7608code-projects Simple Shopping Cart userlogin.php sql injectioncode-projects Simple Shopping Cart
- CVE-2025-7607code-projects Simple Shopping Cart save_order.php sql injectioncode-projects Simple Shopping Cart
- CVE-2025-7606code-projects AVL Rooms city.php sql injectioncode-projects AVL Rooms
- CVE-2025-7605code-projects AVL Rooms profile.php sql injectioncode-projects AVL Rooms
- CVE-2025-7604PHPGurukul Hospital Management System user-login.php sql injectionPHPGurukul Hospital Management System
- CVE-2025-7601PHPGurukul Online Library Management System student-history.php cross site scriptingPHPGurukul Online Library Management System
- CVE-2025-7600PHPGurukul Online Library Management System student-history.php sql injectionPHPGurukul Online Library Management System
- CVE-2025-7599PHPGurukul Dairy Farm Shop Management System invoice.php sql injectionPHPGurukul Dairy Farm Shop Management System
- CVE-2025-7618A stored Cross-Site Scripting (XSS) vulnerability exists in the File Explorer and Text Editor of ADMASUSTOR ADM
- CVE-2025-7595code-projects Job Diary view-cad.php sql injectioncode-projects Job Diary
- CVE-2025-7594code-projects Job Diary view-emp.php sql injectioncode-projects Job Diary
- CVE-2025-7593code-projects Job Diary view-all.php sql injectioncode-projects Job Diary
- CVE-2025-7592PHPGurukul Dairy Farm Shop Management System invoices.php sql injectionPHPGurukul Dairy Farm Shop Management System
- CVE-2025-7591PHPGurukul Dairy Farm Shop Management System view-invoice.php sql injectionPHPGurukul Dairy Farm Shop Management System
- CVE-2025-7590PHPGurukul Dairy Farm Shop Management System edit-category.php sql injectionPHPGurukul Dairy Farm Shop Management System
- CVE-2025-7589PHPGurukul Dairy Farm Shop Management System edit-company.php sql injectionPHPGurukul Dairy Farm Shop Management System
- CVE-2025-7588PHPGurukul Dairy Farm Shop Management System edit-product.php sql injectionPHPGurukul Dairy Farm Shop Management System
- CVE-2025-24391Possible user enumerationOTRS AG OTRS
- CVE-2025-7587code-projects Online Appointment Booking System cover.php sql injectioncode-projects Online Appointment Booking System
- CVE-2025-7585PHPGurukul Online Fire Reporting System manage-site.php sql injectionPHPGurukul Online Fire Reporting System
- CVE-2025-7584PHPGurukul Online Fire Reporting System add-team.php sql injectionPHPGurukul Online Fire Reporting System
- CVE-2025-7583PHPGurukul Online Fire Reporting System all-requests.php sql injectionPHPGurukul Online Fire Reporting System
- CVE-2025-7582PHPGurukul Online Fire Reporting System assigned-requests.php sql injectionPHPGurukul Online Fire Reporting System
- CVE-2025-7581code-projects Voting System positions_edit.php sql injectioncode-projects Voting System
- CVE-2025-7580code-projects Voting System positions_row.php sql injectioncode-projects Voting System
- CVE-2025-7579chinese-poetry server.js redoschinese-poetry
- CVE-2025-7578Teledyne FLIR FB-Series O/FLIR FH-Series ID runcmd.sh sendCommand command injectionTeledyne FLIR FB-Series O · Teledyne FLIR FH-Series ID
- CVE-2025-7577Teledyne FLIR FB-Series O/FLIR FH-Series ID hard-coded passwordTeledyne FLIR FB-Series O · Teledyne FLIR FH-Series ID
- CVE-2025-7380A stored Cross-Site Scripting (XSS) vulnerability exists in the Access Control of ADMASUSTOR ADM
- CVE-2025-7576Teledyne FLIR FB-Series O/FLIR FH-Series ID Production Tools production.html access controlTeledyne FLIR FB-Series O · Teledyne FLIR FH-Series ID
- CVE-2025-7575Zavy86 WikiDocs submit.php image_delete_ajax path traversalZavy86 WikiDocs
- CVE-2025-7573LB-LINK BL-WR9000 lighttpd.cgi bs_GetManPwd information disclosureLB-LINK BL-AC1900 · LB-LINK BL-AC2100_AZ3 +4
- CVE-2025-7572LB-LINK BL-WR9000 lighttpd.cgi bs_GetHostInfo information disclosureLB-LINK BL-AC1900 · LB-LINK BL-AC2100_AZ3 +4
- CVE-2025-7569Bigotry OneBase think_exception.tpl parse_args cross site scriptingBigotry OneBase
- CVE-2025-7568qianfox FoxCMS Video.php batchCope sql injectionqianfox FoxCMS
- CVE-2025-7567ShopXO header.html cross site scriptingShopXO
- CVE-2025-7566jshERP SystemConfigController.java exportExcelByParam path traversaljshERP
- CVE-2025-7565LB-LINK BL-AC3600 Web Management Interface lighttpd.cgi geteasycfg information disclosureLB-LINK BL-AC3600
- CVE-2025-7563PHPGurukul Online Fire Reporting System completed-requests.php sql injectionPHPGurukul Online Fire Reporting System
- CVE-2025-7562PHPGurukul Online Fire Reporting System new-requests.php sql injectionPHPGurukul Online Fire Reporting System
- CVE-2025-7561PHPGurukul Online Fire Reporting System team-ontheway-requests.php sql injectionPHPGurukul Online Fire Reporting System
- CVE-2025-7560PHPGurukul Online Fire Reporting System workin-progress-requests.php sql injectionPHPGurukul Online Fire Reporting System
- CVE-2025-7559PHPGurukul Online Fire Reporting System bwdates-report-result.php sql injectionPHPGurukul Online Fire Reporting System
- CVE-2025-7558code-projects Voting System positions_add.php sql injectioncode-projects Voting System
- CVE-2025-7557code-projects Voting System voters_row.php sql injectioncode-projects Voting System
- CVE-2025-7556code-projects Voting System voters_edit.php sql injectioncode-projects Voting System
- CVE-2025-7555code-projects Voting System voters_add.php sql injectioncode-projects Voting System
- CVE-2025-7554Sapido RB-1802 URL Filtering Page urlfilter.asp cross site scriptingSapido RB-1802
- CVE-2024-42648NanoMQ v0.22.10 was discovered to contain a heap overflow which allows attackers to cause a Denial of Service (DoS) via a crafted CONNECT me
- CVE-2024-42649NanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a crafted PUBLISH mess
- CVE-2025-29606py-libp2p before 0.2.3 allows a peer to cause a denial of service (resource consumption) via a large RSA key.py-libp2p · libp2p
- CVE-2025-51650An arbitrary file upload vulnerability in the component /controller/PicManager.php of FoxCMS v1.2.6 allows attackers to execute arbitrary co
- CVE-2025-51651An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbi
- CVE-2025-51652SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Categories.php.
- CVE-2025-51653SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_ct.php.
- CVE-2025-51654SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Infocategories.php.
- CVE-2025-51655SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Quanxian.php.
- CVE-2025-51656SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Link.php.
- CVE-2025-51657SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Link.php.
- CVE-2025-51658SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_InquiryView.php.
- CVE-2025-51659SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Products.php.
- CVE-2025-51660SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Products.php.
- CVE-2025-52363Tenda CP3 Pro Firmware V22.5.4.93 contains a hardcoded root password hash in the /etc/passwd file and /etc/passwd-.