# CVEs published 2025-07-14

127 CVEs were published on July 14, 2025: 9 critical, 27 high. Days are UTC.

- [CVE-2025-53890](https://cve.now/CVE-2025-53890.md): pyLoad vulnerable to remote code execution through js2py onCaptchaResult (CVSS 9.8, pyload · pyload-ng)
- [CVE-2025-53889](https://cve.now/CVE-2025-53889.md): Directus missing permission checks for manual trigger Flows (CVSS 6.5, directus)
- [CVE-2025-53887](https://cve.now/CVE-2025-53887.md): Directus's exact version number is exposed by the OpenAPI Spec (CVSS 5.3, directus)
- [CVE-2025-53886](https://cve.now/CVE-2025-53886.md): Directus doesn't redact tokens in Flow logs (CVSS 4.5, directus)
- [CVE-2025-53885](https://cve.now/CVE-2025-53885.md): Directus doesn't redact sensitive user data when logging via event hooks (CVSS 4.2, directus)
- [CVE-2025-53839](https://cve.now/CVE-2025-53839.md): DRACOON Branding Service vulnerable to Cross-site Scripting (CVSS 4.0, dracoon security-advisories)
- [CVE-2025-53836](https://cve.now/CVE-2025-53836.md): XWiki Rendering is vulnerable to RCE attacks when processing nested macros (CVSS 10.0, xwiki-rendering · org.xwiki.rendering:xwiki-rendering-trans…)
- [CVE-2025-53835](https://cve.now/CVE-2025-53835.md): XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax (CVSS 9.1, xwiki-rendering · org.xwiki.rendering:xwiki-rendering-synta…)
- [CVE-2025-53833](https://cve.now/CVE-2025-53833.md): LaRecipe is vulnerable to Server-Side Template Injection attacks (CVSS 10.0, saleem-hadad larecipe · binarytorch/larecipe)
- [CVE-2025-53834](https://cve.now/CVE-2025-53834.md): Caido Toast Vulnerable to Reflected Cross-site Scripting (CVSS 6.3, caido)
- [CVE-2025-53825](https://cve.now/CVE-2025-53825.md): Dokploy's Preview Deployments are vulnerable to Remote Code Execution (CVSS 9.4, dokploy)
- [CVE-2025-53824](https://cve.now/CVE-2025-53824.md): WeGIA ReflectedCross-Site Scripting (XSS) vulnerability in endpoint 'cadastro\_pet.php' parameter 'msg' (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-53823](https://cve.now/CVE-2025-53823.md): WeGIA vulnerable to SQL Injection (Blind Time-Based) in \`processa\_deletar\_socio.php\` parameter \`id\_socio\` (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-53822](https://cve.now/CVE-2025-53822.md): WeGIA vulnerable to Reflected Cross-Site Scripting in endpoint 'relatorio\_geracao.php' parameter 'tipo\_relatorio' (CVSS 6.5, LabRedesCefetRJ WeGIA)
- [CVE-2025-53821](https://cve.now/CVE-2025-53821.md): WeGIA vulnerable to Open Redirect in endpoint 'control.php' parameter 'nextPage' (CVSS 4.7, LabRedesCefetRJ WeGIA)
- [CVE-2025-53820](https://cve.now/CVE-2025-53820.md): WeGIA vulnerable to Cross-Site Scripting (XSS) Reflected via endpoint 'index.php' parameter 'erro' (CVSS 6.5, LabRedesCefetRJ WeGIA)
- [CVE-2025-53819](https://cve.now/CVE-2025-53819.md): Nix's privilege dropping to build user broke for macOS (CVSS 7.9, NixOS nix)
- [CVE-2025-53818](https://cve.now/CVE-2025-53818.md): github-kanban-mcp-server Command Injection vulnerability (CVSS 8.9, Sunwood-ai-labs github-kanban-mcp-server · @sunwood-ai-labs…)
- [CVE-2025-53643](https://cve.now/CVE-2025-53643.md): AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections (CVSS 1.7, aio-libs aiohttp · aiohttp)
- [CVE-2025-53640](https://cve.now/CVE-2025-53640.md): Indico vulnerable to user enumeration via API endpoint (CVSS 5.3, indico)
- [CVE-2025-53639](https://cve.now/CVE-2025-53639.md): Metersphere has SQL Injection Vulnerability in Sorting Field (CVSS 5.1, metersphere)
- [CVE-2025-53623](https://cve.now/CVE-2025-53623.md): Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class (CVSS 8.1, Shopify job-iteration · job-iteration)
- [CVE-2025-53101](https://cve.now/CVE-2025-53101.md): ImageMagick has Stack Buffer Overflow in image.c (CVSS 7.4, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2025-53019](https://cve.now/CVE-2025-53019.md): ImageMagick has Memory Leak in magick stream (CVSS 3.7, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2025-53015](https://cve.now/CVE-2025-53015.md): ImageMagick has XMP profile write that triggers hang due to unbounded loop (CVSS 7.5, ImageMagick · Magick.NET-Q8-AnyCPU +18)
- [CVE-2025-7628](https://cve.now/CVE-2025-7628.md): YiJiuSmile kkFileViewOfficeEdit deleteFile path traversal (CVSS 5.3, YiJiuSmile kkFileViewOfficeEdit)
- [CVE-2025-53014](https://cve.now/CVE-2025-53014.md): ImageMagick has Heap Buffer Overflow in InterpretImageFilename (CVSS 3.7, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2025-7627](https://cve.now/CVE-2025-7627.md): YiJiuSmile kkFileViewOfficeEdit fileUpload unrestricted upload (CVSS 5.3, YiJiuSmile kkFileViewOfficeEdit)
- [CVE-2025-7626](https://cve.now/CVE-2025-7626.md): YiJiuSmile kkFileViewOfficeEdit onlinePreview path traversal (CVSS 5.3, YiJiuSmile kkFileViewOfficeEdit)
- [CVE-2025-7625](https://cve.now/CVE-2025-7625.md): YiJiuSmile kkFileViewOfficeEdit download path traversal (CVSS 5.3, YiJiuSmile kkFileViewOfficeEdit)
- [CVE-2025-7616](https://cve.now/CVE-2025-7616.md): gmg137 snap7-rs Public API pthread\_cond\_destroy memory corruption (CVSS 5.1, gmg137 snap7-rs)
- [CVE-2025-7615](https://cve.now/CVE-2025-7615.md): TOTOLINK T6 HTTP POST Request cstecgi.cgi clearPairCfg command injection (CVSS 5.3, TOTOLINK T6)
- [CVE-2025-7614](https://cve.now/CVE-2025-7614.md): TOTOLINK T6 HTTP POST Request cstecgi.cgi delDevice command injection (CVSS 5.3, TOTOLINK T6)
- [CVE-2025-7613](https://cve.now/CVE-2025-7613.md): TOTOLINK T6 HTTP POST Request cstecgi.cgi CloudSrvVersionCheck command injection (CVSS 5.3, TOTOLINK T6)
- [CVE-2025-7612](https://cve.now/CVE-2025-7612.md): code-projects Mobile Shop login.php sql injection (CVSS 6.9, code-projects Mobile Shop)
- [CVE-2025-7611](https://cve.now/CVE-2025-7611.md): code-projects Wedding Reservation global.php sql injection (CVSS 6.9, code-projects Wedding Reservation)
- [CVE-2025-7610](https://cve.now/CVE-2025-7610.md): code-projects Electricity Billing System change\_password.php sql injection (CVSS 6.9, code-projects Electricity Billing System)
- [CVE-2025-7609](https://cve.now/CVE-2025-7609.md): code-projects Simple Shopping Cart register.php sql injection (CVSS 6.9, code-projects Simple Shopping Cart)
- [CVE-2025-7519](https://cve.now/CVE-2025-7519.md): Polkit: xml policy file with a large number of nested elements may lead to out-of-bounds write (CVSS 6.7, polkit · Red Hat Enterprise Linux +1)
- [CVE-2025-7608](https://cve.now/CVE-2025-7608.md): code-projects Simple Shopping Cart userlogin.php sql injection (CVSS 6.9, code-projects Simple Shopping Cart)
- [CVE-2025-7607](https://cve.now/CVE-2025-7607.md): code-projects Simple Shopping Cart save\_order.php sql injection (CVSS 6.9, code-projects Simple Shopping Cart)
- [CVE-2025-7606](https://cve.now/CVE-2025-7606.md): code-projects AVL Rooms city.php sql injection (CVSS 6.9, code-projects AVL Rooms)
- [CVE-2025-7605](https://cve.now/CVE-2025-7605.md): code-projects AVL Rooms profile.php sql injection (CVSS 6.9, code-projects AVL Rooms)
- [CVE-2025-7604](https://cve.now/CVE-2025-7604.md): PHPGurukul Hospital Management System user-login.php sql injection (CVSS 6.9, PHPGurukul Hospital Management System)
- [CVE-2025-7603](https://cve.now/CVE-2025-7603.md): D-Link DI-8100 HTTP Request jingx.asp stack-based overflow (CVSS 8.6, D-Link DI-8100)
- [CVE-2025-7602](https://cve.now/CVE-2025-7602.md): D-Link DI-8100 HTTP Request arp\_sys.asp stack-based overflow (CVSS 8.6, D-Link DI-8100)
- [CVE-2025-7601](https://cve.now/CVE-2025-7601.md): PHPGurukul Online Library Management System student-history.php cross site scripting (CVSS 5.1, PHPGurukul Online Library Management System)
- [CVE-2025-7600](https://cve.now/CVE-2025-7600.md): PHPGurukul Online Library Management System student-history.php sql injection (CVSS 5.3, PHPGurukul Online Library Management System)
- [CVE-2025-7599](https://cve.now/CVE-2025-7599.md): PHPGurukul Dairy Farm Shop Management System invoice.php sql injection (CVSS 5.3, PHPGurukul Dairy Farm Shop Management System)
- [CVE-2025-7598](https://cve.now/CVE-2025-7598.md): Tenda AX1803 setWifiFilterCfg formSetWifiMacFilterCfg stack-based overflow (CVSS 8.7, Tenda AX1803)
- [CVE-2025-7597](https://cve.now/CVE-2025-7597.md): Tenda AX1803 setMacFilterCfg formSetMacFilterCfg stack-based overflow (CVSS 8.7, Tenda AX1803)
- [CVE-2024-51770](https://cve.now/CVE-2024-51770.md): An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. (CVSS 7.5, Hewlett Packard Enterprise HPE AutoPass License Server)
- [CVE-2025-7596](https://cve.now/CVE-2025-7596.md): Tenda FH1205 WifiExtraSet formWifiExtraSet stack-based overflow (CVSS 8.7, Tenda FH1205)
- [CVE-2024-51769](https://cve.now/CVE-2024-51769.md): An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. (CVSS 7.5, Hewlett Packard Enterprise HPE AutoPass License Server)
- [CVE-2024-51768](https://cve.now/CVE-2024-51768.md): An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. (CVSS 8.0, Hewlett Packard Enterprise HPE AutoPass License Server)
- [CVE-2024-51767](https://cve.now/CVE-2024-51767.md): An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. (CVSS 7.3, Hewlett Packard Enterprise HPE AutoPass License Server)
- [CVE-2025-7618](https://cve.now/CVE-2025-7618.md): A stored Cross-Site Scripting (XSS) vulnerability exists in the File Explorer and Text Editor of ADM (CVSS 4.8, ASUSTOR ADM)
- [CVE-2025-7595](https://cve.now/CVE-2025-7595.md): code-projects Job Diary view-cad.php sql injection (CVSS 6.9, code-projects Job Diary)
- [CVE-2025-7594](https://cve.now/CVE-2025-7594.md): code-projects Job Diary view-emp.php sql injection (CVSS 6.9, code-projects Job Diary)
- [CVE-2025-7593](https://cve.now/CVE-2025-7593.md): code-projects Job Diary view-all.php sql injection (CVSS 6.9, code-projects Job Diary)
- [CVE-2025-7592](https://cve.now/CVE-2025-7592.md): PHPGurukul Dairy Farm Shop Management System invoices.php sql injection (CVSS 5.3, PHPGurukul Dairy Farm Shop Management System)
- [CVE-2024-26293](https://cve.now/CVE-2024-26293.md): Unauthenticated Path Traversal affecting Avid NEXIS (CVSS 8.7, Avid NEXIS E-series · Avid NEXIS F-series +2)
- [CVE-2025-53689](https://cve.now/CVE-2025-53689.md): Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons (CVSS 8.8, Apache Software Foundation Apache Jackrabbit · org.apach… +1)
- [CVE-2025-7591](https://cve.now/CVE-2025-7591.md): PHPGurukul Dairy Farm Shop Management System view-invoice.php sql injection (CVSS 5.3, PHPGurukul Dairy Farm Shop Management System)
- [CVE-2025-7590](https://cve.now/CVE-2025-7590.md): PHPGurukul Dairy Farm Shop Management System edit-category.php sql injection (CVSS 5.3, PHPGurukul Dairy Farm Shop Management System)
- [CVE-2025-7589](https://cve.now/CVE-2025-7589.md): PHPGurukul Dairy Farm Shop Management System edit-company.php sql injection (CVSS 5.3, PHPGurukul Dairy Farm Shop Management System)
- [CVE-2025-7588](https://cve.now/CVE-2025-7588.md): PHPGurukul Dairy Farm Shop Management System edit-product.php sql injection (CVSS 5.3, PHPGurukul Dairy Farm Shop Management System)
- [CVE-2024-26292](https://cve.now/CVE-2024-26292.md): Authenticated Arbitrary File Deletion affecting Avid NEXIS (CVSS 7.1, Avid NEXIS E-series · Avid NEXIS F-series +2)
- [CVE-2025-24391](https://cve.now/CVE-2025-24391.md): Possible user enumeration (CVSS 5.3, OTRS AG OTRS)
- [CVE-2025-7587](https://cve.now/CVE-2025-7587.md): code-projects Online Appointment Booking System cover.php sql injection (CVSS 6.9, code-projects Online Appointment Booking System)
- [CVE-2024-26291](https://cve.now/CVE-2024-26291.md): Authenticated Arbitrary File Read affecting Avid NEXIS (CVSS 8.7, Avid NEXIS E-series · Avid NEXIS F-series +2)
- [CVE-2025-7586](https://cve.now/CVE-2025-7586.md): Tenda AC500 setWtpData formSetAPCfg stack-based overflow (CVSS 8.7, Tenda AC500)
- [CVE-2025-7585](https://cve.now/CVE-2025-7585.md): PHPGurukul Online Fire Reporting System manage-site.php sql injection (CVSS 5.3, PHPGurukul Online Fire Reporting System)
- [CVE-2025-7584](https://cve.now/CVE-2025-7584.md): PHPGurukul Online Fire Reporting System add-team.php sql injection (CVSS 5.3, PHPGurukul Online Fire Reporting System)
- [CVE-2025-7583](https://cve.now/CVE-2025-7583.md): PHPGurukul Online Fire Reporting System all-requests.php sql injection (CVSS 5.3, PHPGurukul Online Fire Reporting System)
- [CVE-2025-7582](https://cve.now/CVE-2025-7582.md): PHPGurukul Online Fire Reporting System assigned-requests.php sql injection (CVSS 5.3, PHPGurukul Online Fire Reporting System)
- [CVE-2025-7581](https://cve.now/CVE-2025-7581.md): code-projects Voting System positions\_edit.php sql injection (CVSS 5.3, code-projects Voting System)
- [CVE-2025-7580](https://cve.now/CVE-2025-7580.md): code-projects Voting System positions\_row.php sql injection (CVSS 5.3, code-projects Voting System)
- [CVE-2025-7579](https://cve.now/CVE-2025-7579.md): chinese-poetry server.js redos (CVSS 5.3, chinese-poetry)
- [CVE-2025-7578](https://cve.now/CVE-2025-7578.md): Teledyne FLIR FB-Series O/FLIR FH-Series ID runcmd.sh sendCommand command injection (CVSS 2.3, Teledyne FLIR FB-Series O · Teledyne FLIR FH-Series ID)
- [CVE-2025-7577](https://cve.now/CVE-2025-7577.md): Teledyne FLIR FB-Series O/FLIR FH-Series ID hard-coded password (CVSS 6.3, Teledyne FLIR FB-Series O · Teledyne FLIR FH-Series ID)
- [CVE-2025-7380](https://cve.now/CVE-2025-7380.md): A stored Cross-Site Scripting (XSS) vulnerability exists in the Access Control of ADM (CVSS 4.8, ASUSTOR ADM)
- [CVE-2025-7576](https://cve.now/CVE-2025-7576.md): Teledyne FLIR FB-Series O/FLIR FH-Series ID Production Tools production.html access control (CVSS 6.9, Teledyne FLIR FB-Series O · Teledyne FLIR FH-Series ID)
- [CVE-2025-7575](https://cve.now/CVE-2025-7575.md): Zavy86 WikiDocs submit.php image\_delete\_ajax path traversal (CVSS 5.1, Zavy86 WikiDocs)
- [CVE-2025-7574](https://cve.now/CVE-2025-7574.md): LB-LINK BL-WR9000 Web Interface lighttpd.cgi restore improper authentication (CVSS 9.3, LB-LINK BL-AC1900 · LB-LINK BL-AC2100\_AZ3 +4)
- [CVE-2025-7573](https://cve.now/CVE-2025-7573.md): LB-LINK BL-WR9000 lighttpd.cgi bs\_GetManPwd information disclosure (CVSS 6.9, LB-LINK BL-AC1900 · LB-LINK BL-AC2100\_AZ3 +4)
- [CVE-2025-7572](https://cve.now/CVE-2025-7572.md): LB-LINK BL-WR9000 lighttpd.cgi bs\_GetHostInfo information disclosure (CVSS 6.9, LB-LINK BL-AC1900 · LB-LINK BL-AC2100\_AZ3 +4)
- [CVE-2025-7571](https://cve.now/CVE-2025-7571.md): UTT HiPER 840G aspApBasicConfigUrcp buffer overflow (CVSS 8.7, UTT HiPER)
- [CVE-2025-7570](https://cve.now/CVE-2025-7570.md): UTT HiPER 840G aspRemoteApConfTempSend buffer overflow (CVSS 8.7, UTT HiPER)
- [CVE-2025-7569](https://cve.now/CVE-2025-7569.md): Bigotry OneBase think\_exception.tpl parse\_args cross site scripting (CVSS 5.1, Bigotry OneBase)
- [CVE-2025-7568](https://cve.now/CVE-2025-7568.md): qianfox FoxCMS Video.php batchCope sql injection (CVSS 5.3, qianfox FoxCMS)
- [CVE-2025-7620](https://cve.now/CVE-2025-7620.md): DSIC｜Cross-browser Components for Official Document Creation - Remote Code Execution (CVSS 8.8, DSIC Cross-browser Components for Official Document Creation)
- [CVE-2025-7567](https://cve.now/CVE-2025-7567.md): ShopXO header.html cross site scripting (CVSS 5.3, ShopXO)
- [CVE-2025-7566](https://cve.now/CVE-2025-7566.md): jshERP SystemConfigController.java exportExcelByParam path traversal (CVSS 5.1, jshERP)
- [CVE-2025-7619](https://cve.now/CVE-2025-7619.md): WellChoose｜BatchSignCS - Arbitrary File Write through Path Traversal (CVSS 8.8, WellChoose BatchSignCS)
- [CVE-2025-7565](https://cve.now/CVE-2025-7565.md): LB-LINK BL-AC3600 Web Management Interface lighttpd.cgi geteasycfg information disclosure (CVSS 6.9, LB-LINK BL-AC3600)
- [CVE-2025-7451](https://cve.now/CVE-2025-7451.md): Hgiga｜iSherlock - OS Command Injection (CVSS 9.8, Hgiga iSherlock-maillog-4.5 · Hgiga iSherlock-smtp-4.5 +2)
- [CVE-2025-7564](https://cve.now/CVE-2025-7564.md): LB-LINK BL-AC3600 shadow hard-coded credentials (CVSS 8.5, LB-LINK BL-AC3600)
- [CVE-2025-7563](https://cve.now/CVE-2025-7563.md): PHPGurukul Online Fire Reporting System completed-requests.php sql injection (CVSS 5.3, PHPGurukul Online Fire Reporting System)
- [CVE-2025-7562](https://cve.now/CVE-2025-7562.md): PHPGurukul Online Fire Reporting System new-requests.php sql injection (CVSS 5.3, PHPGurukul Online Fire Reporting System)
- [CVE-2025-7561](https://cve.now/CVE-2025-7561.md): PHPGurukul Online Fire Reporting System team-ontheway-requests.php sql injection (CVSS 5.3, PHPGurukul Online Fire Reporting System)
- [CVE-2025-25180](https://cve.now/CVE-2025-25180.md): GPU DDK - Insufficient validation in RGXCREATEFREELIST creates corrupt freelist (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2025-7560](https://cve.now/CVE-2025-7560.md): PHPGurukul Online Fire Reporting System workin-progress-requests.php sql injection (CVSS 5.3, PHPGurukul Online Fire Reporting System)
- [CVE-2025-7559](https://cve.now/CVE-2025-7559.md): PHPGurukul Online Fire Reporting System bwdates-report-result.php sql injection (CVSS 5.3, PHPGurukul Online Fire Reporting System)
- [CVE-2025-7558](https://cve.now/CVE-2025-7558.md): code-projects Voting System positions\_add.php sql injection (CVSS 5.3, code-projects Voting System)
- [CVE-2025-7557](https://cve.now/CVE-2025-7557.md): code-projects Voting System voters\_row.php sql injection (CVSS 5.3, code-projects Voting System)
- [CVE-2025-7556](https://cve.now/CVE-2025-7556.md): code-projects Voting System voters\_edit.php sql injection (CVSS 5.3, code-projects Voting System)
- [CVE-2025-7555](https://cve.now/CVE-2025-7555.md): code-projects Voting System voters\_add.php sql injection (CVSS 5.3, code-projects Voting System)
- [CVE-2025-7554](https://cve.now/CVE-2025-7554.md): Sapido RB-1802 URL Filtering Page urlfilter.asp cross site scripting (CVSS 4.8, Sapido RB-1802)
- [CVE-2024-42646](https://cve.now/CVE-2024-42646.md): A segmentation fault in NanoMQ v0.21.10 allows attackers to cause a Denial of Service (DoS) via crafted messages. (CVSS 7.5)
- [CVE-2024-42648](https://cve.now/CVE-2024-42648.md): NanoMQ v0.22.10 was discovered to contain a heap overflow which allows attackers to cause a Denial of Service (DoS) via a crafted CONNECT me (CVSS 6.5)
- [CVE-2024-42649](https://cve.now/CVE-2024-42649.md): NanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a crafted PUBLISH mess (CVSS 6.5)
- [CVE-2025-27582](https://cve.now/CVE-2025-27582.md): The Secure Password extension in One Identity Password Manager before 5.14.4 allows local privilege escalation. (CVSS 7.6, One Identity Password Manager)
- [CVE-2025-29606](https://cve.now/CVE-2025-29606.md): py-libp2p before 0.2.3 allows a peer to cause a denial of service (resource consumption) via a large RSA key. (CVSS 4.3, py-libp2p · libp2p)
- [CVE-2025-50756](https://cve.now/CVE-2025-50756.md): Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set\_sys\_adm function via the newpass parameter. (CVSS 9.8)
- [CVE-2025-51650](https://cve.now/CVE-2025-51650.md): An arbitrary file upload vulnerability in the component /controller/PicManager.php of FoxCMS v1.2.6 allows attackers to execute arbitrary co (CVSS 5.6)
- [CVE-2025-51651](https://cve.now/CVE-2025-51651.md): An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbi (CVSS 5.5)
- [CVE-2025-51652](https://cve.now/CVE-2025-51652.md): SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS\_Categories.php. (CVSS 5.4)
- [CVE-2025-51653](https://cve.now/CVE-2025-51653.md): SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS\_ct.php. (CVSS 5.4)
- [CVE-2025-51654](https://cve.now/CVE-2025-51654.md): SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS\_Infocategories.php. (CVSS 5.4)
- [CVE-2025-51655](https://cve.now/CVE-2025-51655.md): SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS\_Quanxian.php. (CVSS 5.4)
- [CVE-2025-51656](https://cve.now/CVE-2025-51656.md): SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS\_Link.php. (CVSS 5.4)
- [CVE-2025-51657](https://cve.now/CVE-2025-51657.md): SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS\_Link.php. (CVSS 5.4)
- [CVE-2025-51658](https://cve.now/CVE-2025-51658.md): SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS\_InquiryView.php. (CVSS 5.4)
- [CVE-2025-51659](https://cve.now/CVE-2025-51659.md): SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS\_Products.php. (CVSS 5.4)
- [CVE-2025-51660](https://cve.now/CVE-2025-51660.md): SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS\_Products.php. (CVSS 5.4)
- [CVE-2025-52363](https://cve.now/CVE-2025-52363.md): Tenda CP3 Pro Firmware V22.5.4.93 contains a hardcoded root password hash in the /etc/passwd file and /etc/passwd-. (CVSS 6.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.