# CVEs published 2025-07-16

188 CVEs were published on July 16, 2025: 23 critical, 70 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-34132](https://cve.now/CVE-2025-34132.md): LILIN DVR Command Injection via NTPUpdate in dvr\_box (CVSS 9.3, Merit LILIN DVR Firmware)
- [CVE-2025-34130](https://cve.now/CVE-2025-34130.md): LILIN DVR Arbitrary File Read via net\_html.cgi (CVSS 8.7, Merit LILIN DVR Firmware)
- [CVE-2025-34129](https://cve.now/CVE-2025-34129.md): LILIN DVR RCE via Malicious FTP/NTP Configuration (CVSS 8.7, Merit LILIN DVR Firmware)
- [CVE-2025-34128](https://cve.now/CVE-2025-34128.md): X360 VideoPlayer ActiveX Control Buffer Overflow via ConvertFile() (CVSS 8.6, X360Soft X360 VideoPlayer ActiveX Control)
- [CVE-2025-34127](https://cve.now/CVE-2025-34127.md): Achat v0.150 SEH Buffer Overflow via UDP (CVSS 9.3, Achat Software Achat Chat Server)
- [CVE-2025-34126](https://cve.now/CVE-2025-34126.md): RIPS Scanner v0.54 Path Traversal (CVSS 8.7, RIPS Technologies RIPS Scanner)
- [CVE-2025-34125](https://cve.now/CVE-2025-34125.md): D-Link DSP-W110A1 Cookie Command Injection (CVSS 9.3, D-Link DSP-W110A1)
- [CVE-2025-34124](https://cve.now/CVE-2025-34124.md): Heroes of Might and Magic III .h3m Map File Buffer Overflow (CVSS 8.4, The 3DO Company Heroes of Might and Magic III)
- [CVE-2025-34123](https://cve.now/CVE-2025-34123.md): VideoCharge Studio 2.12.3.685 SEH Buffer Overflow via .VSC File (CVSS 8.4, VideoCharge Software Studio)
- [CVE-2025-34121](https://cve.now/CVE-2025-34121.md): Idera Up.Time ≤ 7.2 post2file.php Arbitrary File Upload RCE (CVSS 9.3, Idera Up.Time Monitoring Station)
- [CVE-2025-34120](https://cve.now/CVE-2025-34120.md): LimeSurvey 2.0+ - 2.06+ Unauthenticated Arbitrary File Download via Serialized Backup Payload (CVSS 8.7, LimeSurvey)
- [CVE-2025-34119](https://cve.now/CVE-2025-34119.md): EasyCafe Server 2.2.14 Remote File Disclosure via Opcode 0x43 (CVSS 8.8, Tinasoft EasyCafe Server)
- [CVE-2025-34118](https://cve.now/CVE-2025-34118.md): Linknat VOS Manager Path Traversal File Disclosure (CVSS 8.7, Linknat Technology VOS Manager)
- [CVE-2025-34117](https://cve.now/CVE-2025-34117.md): Netcore / Netis Routers RCE via UDP Port 53413 Backdoor (CVSS 9.3, Netcore Technology Router firmware · Netis Router firmware)
- [CVE-2025-6983](https://cve.now/CVE-2025-6983.md): Clickjacking vulnerability on the management web application of TP-LINK Archer C1200 (CVSS 5.1, TP-Link System Archer C1200)
- [CVE-2025-6982](https://cve.now/CVE-2025-6982.md): Hardcoded DES Decryption Keys in TP-Link Archer C50 V3/V4/V5 and C20 V5 (CVSS 6.9, TP-Link Systems Archer C50 · TP-Link Systems Archer C20)
- [CVE-2025-53908](https://cve.now/CVE-2025-53908.md): RomM vulnerable to Authenticated Path Traversal (CVSS 8.3, rommapp romm)
- [CVE-2025-37107](https://cve.now/CVE-2025-37107.md): An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. (CVSS 7.3, Hewlett Packard Enterprise HPE AutoPass License Server)
- [CVE-2025-37106](https://cve.now/CVE-2025-37106.md): An authentication bypass and disclosure of information vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. (CVSS 7.3, Hewlett Packard Enterprise HPE AutoPass License Server)
- [CVE-2025-36097](https://cve.now/CVE-2025-36097.md): IBM WebSphere Application Server denial of service (CVSS 7.5, IBM WebSphere Application Server)
- [CVE-2025-37105](https://cve.now/CVE-2025-37105.md): An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. (CVSS 7.5, Hewlett Packard Enterprise HPE AutoPass License Server)
- [CVE-2025-40777](https://cve.now/CVE-2025-40777.md): A possible assertion failure when 'stale-answer-client-timeout' is set to '0' (CVSS 7.5, ISC BIND)
- [CVE-2025-53904](https://cve.now/CVE-2025-53904.md): The Scratch Channel Has Potential Reflected Cross-Site Scripting (XSS) Vulnerability (CVSS 1.3, the-scratch-channel.github.io)
- [CVE-2025-20337](https://cve.now/CVE-2025-20337.md): Cisco ISE API Unauthenticated Remote Code Execution Vulnerability (CVSS 10.0, KEV, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2025-20285](https://cve.now/CVE-2025-20285.md): Cisco Identity Services Engine IP Filter Access Restriction for Admin Access Configuration Bypass Vulnerability (CVSS 4.1, Cisco Identity Services Engine Software)
- [CVE-2025-20288](https://cve.now/CVE-2025-20288.md): Cisco Unified Intelligence Center Server-Side Request Forgery Vulnerability (CVSS 5.8, Cisco Unified Contact Center Express · Cisco Unified Intell…)
- [CVE-2025-20284](https://cve.now/CVE-2025-20284.md): Cisco Identity Services Engine Authenticated Remote Code Execution Vulnerability (CVSS 6.5, Cisco Identity Services Engine Software)
- [CVE-2025-20283](https://cve.now/CVE-2025-20283.md): Cisco Identity Services Engine Authenticated Remote Code Execution Vulnerability (CVSS 6.5, Cisco Identity Services Engine Software)
- [CVE-2025-20272](https://cve.now/CVE-2025-20272.md): Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Blind SQL Injection Vulnerability (CVSS 4.3, Cisco Evolved Programmable Network Manager · Cisco Prime In…)
- [CVE-2025-20274](https://cve.now/CVE-2025-20274.md): Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability (CVSS 6.3, Cisco Unified Contact Center Express · Cisco Unified Intell…)
- [CVE-2025-53943](https://cve.now/CVE-2025-53943.md): VoidBot Open-Source Has Improper Permission Check That Allows Unauthorized Command Execution (CVSS 8.7, Death1Clown VoidBot\_open-source)
- [CVE-2025-53938](https://cve.now/CVE-2025-53938.md): WeGIA vulnerable to Authentication Bypass due to Missing Session Validation in multiple endpoints (CVSS 6.9, LabRedesCefetRJ WeGIA)
- [CVE-2025-53937](https://cve.now/CVE-2025-53937.md): WeGIA has SQL Injection (Blind Time-Based) Vulnerability in \`cargo\` Parameter on \`control.php\` Endpoint (CVSS 9.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-53936](https://cve.now/CVE-2025-53936.md): WeGIA vulnerable to Reflected Cross-Site Scripting via endpoint \`personalizacao\_selecao.php\` parameter \`nome\_car\` (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-53935](https://cve.now/CVE-2025-53935.md): WeGIA vulnerable to Reflected Cross-Site Scripting via endpoint \`personalizacao\_selecao.php\` parameter \`id\` (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-53934](https://cve.now/CVE-2025-53934.md): WeGIA vulnerable to Stored Cross-Site Scripting via endpoint 'control.php' parameter 'descricao\_emergencia' (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-47053](https://cve.now/CVE-2025-47053.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-53933](https://cve.now/CVE-2025-53933.md): WeGIA vulnerable to Stored Cross-Site Scripting via endpoint 'adicionar\_enfermidade.php' parameter 'nome' (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-7357](https://cve.now/CVE-2025-7357.md): Plaintext Storage of a Password in LITEON IC48A and IC80A EV Chargers (CVSS 8.7, LITEON IC48A EV Charger · LITEON IC80A EV Charger)
- [CVE-2025-53932](https://cve.now/CVE-2025-53932.md): WeGIA vulnerable to Reflected Cross-Site Scripting via endpoint 'cadastro\_adotante.php' parameter 'cpf' (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-46959](https://cve.now/CVE-2025-46959.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-53931](https://cve.now/CVE-2025-53931.md): WeGIA vulnerable to Stored Cross-Site Scripting via endpoint \`adicionar\_raca.php\` parameter \`raca\` (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-53930](https://cve.now/CVE-2025-53930.md): WeGIA vulnerable to Stored Cross-Site Scripting (XSS) via endpoint 'adicionar\_especie.php' parameter 'especie' (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-53929](https://cve.now/CVE-2025-53929.md): WeGIA vulnerable to Stored Cross-Site Scripting (XSS) via endpoint \`adicionar\_cor.php\` parameter \`cor\` (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-53926](https://cve.now/CVE-2025-53926.md): Emlog has Stored Cross-site Scripting vulnerability due to error (CVSS 6.1, emlog)
- [CVE-2025-5994](https://cve.now/CVE-2025-5994.md): Cache poisoning via the ECS-enabled Rebirthday Attack (CVSS 8.7, NLnet Labs Unbound)
- [CVE-2025-53925](https://cve.now/CVE-2025-53925.md): Emlog has Stored Cross-site Scripting vulnerability in file upload functionality (CVSS 5.4, emlog)
- [CVE-2025-37104](https://cve.now/CVE-2025-37104.md): HPE Telco Service Orchestrator Software, Authenticated SQL Injection (CVSS 7.1, Hewlett Packard Enterprise (HPE) HPE Telco Service Orchestr…)
- [CVE-2025-40913](https://cve.now/CVE-2025-40913.md): Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow (CVSS 6.5, ATRODO Net::Dropbear)
- [CVE-2025-40919](https://cve.now/CVE-2025-40919.md): Authen::DigestMD5 versions 0.01 through 0.04 for Perl generate the cnonce insecurely (CVSS 6.5, SALVA Authen::DigestMD5)
- [CVE-2025-3871](https://cve.now/CVE-2025-3871.md): Broken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlier (CVSS 5.3, Fortra GoAnywhere MFT)
- [CVE-2025-40918](https://cve.now/CVE-2025-40918.md): Authen::SASL::Perl::DIGEST\_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely (CVSS 6.5, EHUELS Authen::SASL::Perl::DIGEST\_MD5)
- [CVE-2025-53924](https://cve.now/CVE-2025-53924.md): Emlog vulnerable to stored Cross-site Scripting in links functionality (CVSS 6.9, emlog)
- [CVE-2025-53923](https://cve.now/CVE-2025-53923.md): Emlog vulnerable to reflected Cross-site Scripting in admin panel (CVSS 8.2, emlog)
- [CVE-2025-53892](https://cve.now/CVE-2025-53892.md): Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror (CVSS 5.3, intlify vue-i18n · vue-i18n +4)
- [CVE-2025-40776](https://cve.now/CVE-2025-40776.md): Birthday Attack against Resolvers supporting ECS (CVSS 8.6, ISC BIND)
- [CVE-2025-53840](https://cve.now/CVE-2025-53840.md): Icinga DB Web Exposure of Sensitive Information to an Unauthorized Actor vulnerability (CVSS 2.4, icingadb-web)
- [CVE-2025-40923](https://cve.now/CVE-2025-40923.md): Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely (CVSS 7.3, MIYAGAWA Plack::Middleware::Session)
- [CVE-2025-34300](https://cve.now/CVE-2025-34300.md): Sawtooth Software Lighthouse Studio \< 9.16.14 Pre-Authentication RCE (CVSS 10.0, Sawtooth Software Lighthouse Studio)
- [CVE-2025-53758](https://cve.now/CVE-2025-53758.md): Default Credential Vulnerability in Digisol DG-GR6821AC Router (CVSS 5.1, Digisol XPON ONU Wi-Fi Router)
- [CVE-2025-24759](https://cve.now/CVE-2025-24759.md): WordPress WP-BusinessDirectory \<= 3.1.5 - SQL Injection vulnerability (CVSS 9.3, CMSJunkie - WordPress Business Directory Plugins WP-Busines…)
- [CVE-2025-24777](https://cve.now/CVE-2025-24777.md): WordPress Hillter theme \<= 3.0.7 - PHP Object Injection Vulnerability (CVSS 8.8, awethemes Hillter)
- [CVE-2025-24779](https://cve.now/CVE-2025-24779.md): WordPress Yogi theme \< 2.9.3 - PHP Object Injection Vulnerability (CVSS 8.8, NooTheme Yogi)
- [CVE-2025-28955](https://cve.now/CVE-2025-28955.md): WordPress Easy Video Player Wordpress & WooCommerce plugin \<= 10.0 - Arbitrary File Download Vulnerability (CVSS 7.5, FWDesign Easy Video Player Wordpress & WooCommerce)
- [CVE-2025-28959](https://cve.now/CVE-2025-28959.md): WordPress URL Shortener \<= 3.0.7 - SQL Injection Vulnerability (CVSS 9.3, Md Yeasin Ul Haider URL Shortener)
- [CVE-2025-28961](https://cve.now/CVE-2025-28961.md): WordPress URL Shortener \<= 3.0.7 - PHP Object Injection Vulnerability (CVSS 9.8, Md Yeasin Ul Haider URL Shortener)
- [CVE-2025-28965](https://cve.now/CVE-2025-28965.md): WordPress URL Shortener \<= 3.0.7 - Broken Access Control Vulnerability (CVSS 8.6, Md Yeasin Ul Haider URL Shortener)
- [CVE-2025-28982](https://cve.now/CVE-2025-28982.md): WordPress WP Pipes plugin \<= 1.4.3 - SQL Injection Vulnerability (CVSS 9.3, ThimPress WP Pipes)
- [CVE-2025-29000](https://cve.now/CVE-2025-29000.md): WordPress Multi-language Responsive Contact Form plugin \<= 2.8 - Broken Access Control Vulnerability (CVSS 7.5, August Infotech Multi-language Responsive Contact Form)
- [CVE-2025-29009](https://cve.now/CVE-2025-29009.md): WordPress Medical Prescription Attachment Plugin for WooCommerce \<= 1.2.3 - Arbitrary File Upload Vulnerability (CVSS 10.0, Webkul Medical Prescription Attachment Plugin for WooCommer…)
- [CVE-2025-30936](https://cve.now/CVE-2025-30936.md): WordPress Torod plugin \<= 2.1 - SQL Injection vulnerability (CVSS 9.3, Torod Company for Information Technology Torod)
- [CVE-2025-30949](https://cve.now/CVE-2025-30949.md): WordPress Site Chat on Telegram plugin \<= 1.0.4 - PHP Object Injection Vulnerability (CVSS 9.8, Guru Team Site Chat on Telegram)
- [CVE-2025-30955](https://cve.now/CVE-2025-30955.md): WordPress ListingEasy theme \<= 1.9.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, GT3themes ListingEasy)
- [CVE-2025-30959](https://cve.now/CVE-2025-30959.md): WordPress Product XML Feed Manager for WooCommerce \<= 2.9.2 - Broken Access Control Vulnerability (CVSS 6.5, WPFactory Product XML Feed Manager for WooCommerce)
- [CVE-2025-30973](https://cve.now/CVE-2025-30973.md): WordPress CoSchool LMS plugin \<= 1.4.3 - PHP Object Injection Vulnerability (CVSS 9.8, Codexpert CoSchool LMS)
- [CVE-2025-31055](https://cve.now/CVE-2025-31055.md): WordPress Electrician - Electrical Service WordPress theme \<= 1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, vergatheme Electrician - Electrical Service WordPress)
- [CVE-2025-31070](https://cve.now/CVE-2025-31070.md): WordPress HTML5 Radio Player - WPBakery Page Builder Addon plugin \<= 2.5 - Arbitrary File Download vulnerability (CVSS 7.5, LambertGroup HTML5 Radio Player - WPBakery Page Builder Add…)
- [CVE-2025-31072](https://cve.now/CVE-2025-31072.md): WordPress Ofiz - Business Consulting Theme plugin \<= 2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, designthemes Ofiz - WordPress Business Consulting Theme)
- [CVE-2025-31422](https://cve.now/CVE-2025-31422.md): WordPress Visual Art | Gallery WordPress Theme \<= 2.4 - PHP Object Injection Vulnerability (CVSS 8.8, designthemes Visual Art | Gallery WordPress Theme)
- [CVE-2025-31427](https://cve.now/CVE-2025-31427.md): WordPress Invico - WordPress Consulting Business Theme \<= 1.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, designthemes Invico - WordPress Consulting Business Theme)
- [CVE-2025-32574](https://cve.now/CVE-2025-32574.md): WordPress WPGYM plugin \<= 65.0 - SQL Injection vulnerability (CVSS 8.5, mojoomla WPGYM)
- [CVE-2025-46500](https://cve.now/CVE-2025-46500.md): WordPress Wordpress Auto Spinner plugin \<= 3.26.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ValvePress Wordpress Auto Spinner)
- [CVE-2025-47554](https://cve.now/CVE-2025-47554.md): WordPress CSS3 Compare Pricing Tables for WordPress plugin \<= 11.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, QuanticaLabs CSS3 Compare Pricing Tables for WordPress)
- [CVE-2025-47645](https://cve.now/CVE-2025-47645.md): WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin \<= 1.4.9 - Subscriber+ SQL Injection vulnerability (CVSS 8.5, ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products,…)
- [CVE-2025-47652](https://cve.now/CVE-2025-47652.md): WordPress Infility Global plugin \<= 2.13.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Infility Global)
- [CVE-2025-48291](https://cve.now/CVE-2025-48291.md): WordPress Contest Gallery \<= 26.0.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Wasiliy Strecker / ContestGallery developer Contest Gallery)
- [CVE-2025-48300](https://cve.now/CVE-2025-48300.md): WordPress Groundhogg plugin \<= 4.2.1 - Arbitrary File Upload vulnerability (CVSS 9.1, Adrian Tobey Groundhogg)
- [CVE-2025-48339](https://cve.now/CVE-2025-48339.md): WordPress Profiler - What Slowing Down Your WP \<= 1.0.0 - Broken Access Control Vulnerability (CVSS 6.5, activity-log.com Profiler - What Slowing Down Your WP)
- [CVE-2025-48345](https://cve.now/CVE-2025-48345.md): WordPress Contact Form 7 Editor Button plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, arisoft Contact Form 7 Editor Button)
- [CVE-2025-49031](https://cve.now/CVE-2025-49031.md): WordPress SMu Manual DoFollow plugin \<= 1.8.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Stefan M. SMu Manual DoFollow)
- [CVE-2025-49034](https://cve.now/CVE-2025-49034.md): WordPress Funnel Builder by FunnelKit plugin \<= 3.10.2 - SQL Injection vulnerability (CVSS 7.6, Aman Funnel Builder by FunnelKit)
- [CVE-2025-49319](https://cve.now/CVE-2025-49319.md): WordPress Wishlist for WooCommerce \<= 3.2.3 - Broken Access Control Vulnerability (CVSS 6.5, WPFactory Wishlist for WooCommerce)
- [CVE-2025-49876](https://cve.now/CVE-2025-49876.md): WordPress ProfileGrid plugin \<= 5.9.5.2 - SQL Injection vulnerability (CVSS 8.5, Metagauss ProfileGrid)
- [CVE-2025-49884](https://cve.now/CVE-2025-49884.md): WordPress Internal Linking of Related Contents plugin \<= 1.1.8 - Broken Access Control Vulnerability (CVSS 6.5, alexvtn Internal Linking of Related Contents)
- [CVE-2025-49888](https://cve.now/CVE-2025-49888.md): WordPress PW WooCommerce On Sale! plugin \<= 1.39 - Broken Access Control Vulnerability (CVSS 7.1, pimwick PW WooCommerce On Sale!)
- [CVE-2025-50028](https://cve.now/CVE-2025-50028.md): WordPress Ultimate Push Notifications plugin \<= 1.2.0 - Broken Access Control Vulnerability (CVSS 6.5, CodeSolz Ultimate Push Notifications)
- [CVE-2025-52714](https://cve.now/CVE-2025-52714.md): WordPress Traveler theme \< 3.2.2 - SQL Injection Vulnerability (CVSS 9.3, shinetheme Traveler)
- [CVE-2025-52777](https://cve.now/CVE-2025-52777.md): WordPress Pay with Contact Form 7 plugin \<= 1.0.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, cmsMinds Pay with Contact Form)
- [CVE-2025-52779](https://cve.now/CVE-2025-52779.md): WordPress Dot html,php,xml etc pages plugin \<= 1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, karimmughal Dot html,php,xml etc pages)
- [CVE-2025-52786](https://cve.now/CVE-2025-52786.md): WordPress Media Folder plugin \<= 1.0.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Kingdom Creation Media Folder)
- [CVE-2025-52787](https://cve.now/CVE-2025-52787.md): WordPress Tennis Court Bookings plugin \<= 1.2.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, EZiHosting Tennis Court Bookings)
- [CVE-2025-52803](https://cve.now/CVE-2025-52803.md): WordPress Sala theme \<= 1.1.3 - Broken Access Control Vulnerability (CVSS 7.5, uxper Sala)
- [CVE-2025-52804](https://cve.now/CVE-2025-52804.md): WordPress Nuss theme \<= 1.3.7.1 - Broken Access Control Vulnerability (CVSS 7.5, uxper Nuss)
- [CVE-2025-52819](https://cve.now/CVE-2025-52819.md): WordPress Pakke Envíos plugin \<= 1.0.2 - SQL Injection Vulnerability (CVSS 8.5, pakkemx Pakke Envíos)
- [CVE-2025-52836](https://cve.now/CVE-2025-52836.md): WordPress The E-Commerce ERP \<= 2.1.1.3 - Privilege Escalation Vulnerability (CVSS 9.8, Unity Business Technology Pty The E-Commerce ERP)
- [CVE-2025-53757](https://cve.now/CVE-2025-53757.md): Insecure Cookie Flags Vulnerability in Digisol DG-GR6821AC Router (CVSS 8.7, Digisol XPON ONU Wi-Fi Router)
- [CVE-2025-53756](https://cve.now/CVE-2025-53756.md): Cleartext Transmission Vulnerability in Digisol DG-GR6821AC Router (CVSS 8.7, Digisol XPON ONU Wi-Fi Router)
- [CVE-2025-53755](https://cve.now/CVE-2025-53755.md): Cleartext Storage Vulnerability in Digisol DG-GR6821AC Router (CVSS 5.1, Digisol XPON ONU Wi-Fi Router)
- [CVE-2024-9408](https://cve.now/CVE-2024-9408.md): In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints. (CVSS 8.9, Eclipse Foundation Eclipse Glassfish · org.glassfish.main.a…)
- [CVE-2025-53754](https://cve.now/CVE-2025-53754.md): Hard-coded Credentials Vulnerability in Digisol DG-GR6821AC Router (CVSS 5.1, Digisol XPON ONU Wi-Fi Router)
- [CVE-2024-10032](https://cve.now/CVE-2024-10032.md): In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console. (CVSS 6.1, Eclipse Foundation Eclipse Glassfish · org.glassfish.main.a…)
- [CVE-2024-10031](https://cve.now/CVE-2024-10031.md): In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the un (CVSS 5.8, Eclipse Foundation Eclipse Glassfish · org.glassfish.main.a…)
- [CVE-2024-10029](https://cve.now/CVE-2024-10029.md): In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console. (CVSS 4.5, Eclipse Foundation Eclipse Glassfish · org.glassfish.mai… +1)
- [CVE-2024-9343](https://cve.now/CVE-2024-9343.md): In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console. (CVSS 6.1, Eclipse Foundation Eclipse Glassfish · org.glassfish.main.a…)
- [CVE-2025-48150](https://cve.now/CVE-2025-48150.md): WordPress Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin plugin \<= 4.48 - Broken Access Control Vulnerability (CVSS 4.3, sminozzi Real Estate Property 2024 Create Your Own Fields a…)
- [CVE-2025-48153](https://cve.now/CVE-2025-48153.md): WordPress Import CDN-Remote Images plugin \<= 2.1.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Atakan Au Import CDN-Remote Images)
- [CVE-2025-48155](https://cve.now/CVE-2025-48155.md): WordPress Residential Address Detection plugin \<= 2.5.9 - Broken Access Control Vulnerability (CVSS 5.3, enituretechnology Residential Address Detection)
- [CVE-2025-48156](https://cve.now/CVE-2025-48156.md): WordPress Image Wall plugin \<= 3.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Parakoos Image Wall)
- [CVE-2025-48161](https://cve.now/CVE-2025-48161.md): WordPress YaySMTP plugin \<= 1.3 - SQL Injection Vulnerability (CVSS 7.6, YayCommerce YaySMTP)
- [CVE-2025-48166](https://cve.now/CVE-2025-48166.md): WordPress Stop and Block bots plugin Anti bots \<= 1.48 - Broken Access Control Vulnerability (CVSS 5.3, sminozzi Stop and Block bots plugin Anti bots)
- [CVE-2025-48167](https://cve.now/CVE-2025-48167.md): WordPress Chatbox Manager plugin \<= 1.2.5 - Broken Access Control Vulnerability (CVSS 5.4, alexvtn Chatbox Manager)
- [CVE-2025-48294](https://cve.now/CVE-2025-48294.md): WordPress FG Drupal to WordPress plugin \<= 3.90.0 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.4, Kerfred FG Drupal to WordPress)
- [CVE-2025-48295](https://cve.now/CVE-2025-48295.md): WordPress Easy Elementor Addons plugin \<= 2.2.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, hashthemes Easy Elementor Addons)
- [CVE-2025-48299](https://cve.now/CVE-2025-48299.md): WordPress YayExtra plugin \<= 1.5.5 - SQL Injection Vulnerability (CVSS 7.6, YayCommerce YayExtra)
- [CVE-2025-48301](https://cve.now/CVE-2025-48301.md): WordPress SMTP for SendGrid – YaySMTP plugin \<= 1.5 - SQL Injection Vulnerability (CVSS 7.6, YayCommerce SMTP for SendGrid – YaySMTP)
- [CVE-2025-54051](https://cve.now/CVE-2025-54051.md): WordPress LightBox Block plugin \<= 1.1.30 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, bPlugins LightBox Block)
- [CVE-2025-54050](https://cve.now/CVE-2025-54050.md): WordPress Responsive Addons for Elementor plugin \<= 1.7.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, CyberChimps Responsive Addons for Elementor)
- [CVE-2025-54047](https://cve.now/CVE-2025-54047.md): WordPress Cost Calculator plugin \<= 7.4 - Broken Access Control Vulnerability (CVSS 4.3, QuanticaLabs Cost Calculator)
- [CVE-2025-54043](https://cve.now/CVE-2025-54043.md): WordPress SMTP for Amazon SES plugin \<= 1.9 - SQL Injection Vulnerability (CVSS 7.6, YayCommerce SMTP for Amazon SES)
- [CVE-2025-54042](https://cve.now/CVE-2025-54042.md): WordPress WP Post Hide plugin \<= 1.0.9 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Xfinitysoft WP Post Hide)
- [CVE-2025-54041](https://cve.now/CVE-2025-54041.md): WordPress Wallet System for WooCommerce plugin \<= 2.6.7 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, WP Swings Wallet System for WooCommerce)
- [CVE-2025-54039](https://cve.now/CVE-2025-54039.md): WordPress Animator plugin \<= 3.0.16 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Toast Plugins Animator)
- [CVE-2025-54038](https://cve.now/CVE-2025-54038.md): WordPress Restaurant Menu by MotoPress plugin \<= 2.4.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, jetmonsters Restaurant Menu by MotoPress)
- [CVE-2025-54037](https://cve.now/CVE-2025-54037.md): WordPress News Kit Elementor Addons plugin \<= 1.3.4 - Broken Access Control Vulnerability (CVSS 5.4, blazethemes News Kit Elementor Addons)
- [CVE-2025-54036](https://cve.now/CVE-2025-54036.md): WordPress Webba Booking plugin \<= 5.1.20 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Webba Appointment Booking Webba Booking)
- [CVE-2025-54035](https://cve.now/CVE-2025-54035.md): WordPress Newsletters plugin \<= 4.10 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Tribulant Software Newsletters)
- [CVE-2025-54033](https://cve.now/CVE-2025-54033.md): WordPress Theme Builder For Elementor plugin \<= 1.2.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 6.5, BlocksWP Theme Builder For Elementor)
- [CVE-2025-54030](https://cve.now/CVE-2025-54030.md): WordPress WooCommerce Google Sheet Connector plugin \<= 1.3.20 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, WesternDeal WooCommerce Google Sheet Connector)
- [CVE-2025-54026](https://cve.now/CVE-2025-54026.md): WordPress GymBase Theme Classes plugin \<= 1.4 - SQL Injection Vulnerability (CVSS 8.5, QuanticaLabs GymBase Theme Classes)
- [CVE-2025-54024](https://cve.now/CVE-2025-54024.md): WordPress WPAdverts plugin \<= 2.2.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Greg Winiarski WPAdverts)
- [CVE-2025-54023](https://cve.now/CVE-2025-54023.md): WordPress WP Delicious plugin \<= 1.8.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WP Delicious)
- [CVE-2025-54022](https://cve.now/CVE-2025-54022.md): WordPress Coupon Affiliates plugin \<= 6.4.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 6.5, Elliot Sowersby / RelyWP Coupon Affiliates)
- [CVE-2025-54020](https://cve.now/CVE-2025-54020.md): WordPress AntiSpam for Contact Form 7 plugin \<= 0.6.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, Erik AntiSpam for Contact Form)
- [CVE-2025-54018](https://cve.now/CVE-2025-54018.md): WordPress CM Pop-Up banners plugin \<= 1.8.4 - Broken Access Control Vulnerability (CVSS 4.3, CreativeMindsSolutions CM Pop-Up banners)
- [CVE-2025-54016](https://cve.now/CVE-2025-54016.md): WordPress Videopack plugin \<= 4.10.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Kyle Gilman Videopack)
- [CVE-2025-54015](https://cve.now/CVE-2025-54015.md): WordPress HT Contact Form 7 plugin \<= 2.0.0 - Local File Inclusion Vulnerability (CVSS 6.6, HT Plugins HT Contact Form)
- [CVE-2025-54013](https://cve.now/CVE-2025-54013.md): WordPress Welcart e-Commerce plugin \<= 2.11.16 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, info@welcart Welcart e-Commerce)
- [CVE-2025-54011](https://cve.now/CVE-2025-54011.md): WordPress SMTP2GO plugin \<= 1.12.1 - Broken Access Control Vulnerability (CVSS 4.3, SMTP2GO)
- [CVE-2025-54010](https://cve.now/CVE-2025-54010.md): WordPress FluentSnippets plugin \<= 10.50 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 9.6, Shahjahan Jewel FluentSnippets)
- [CVE-2025-54009](https://cve.now/CVE-2025-54009.md): WordPress JetSmartFilters plugin \<= 3.6.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Crocoblock JetSmartFilters)
- [CVE-2025-54006](https://cve.now/CVE-2025-54006.md): WordPress Bold Page Builder plugin \<= 5.4.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, boldthemes Bold Page Builder)
- [CVE-2025-53997](https://cve.now/CVE-2025-53997.md): WordPress Houzez theme \<= 4.0.4 - Broken Access Control Vulnerability (CVSS 4.3, favethemes Houzez)
- [CVE-2025-53996](https://cve.now/CVE-2025-53996.md): WordPress JetSearch plugin \<= 3.5.10.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Crocoblock JetSearch)
- [CVE-2025-53995](https://cve.now/CVE-2025-53995.md): WordPress JetPopup plugin \<= 2.0.15.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Crocoblock JetPopup)
- [CVE-2025-53994](https://cve.now/CVE-2025-53994.md): WordPress JetPopup plugin \<= 2.0.15 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Crocoblock JetPopup)
- [CVE-2025-53991](https://cve.now/CVE-2025-53991.md): WordPress JetTricks plugin \<= 1.5.4.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Crocoblock JetTricks)
- [CVE-2025-53990](https://cve.now/CVE-2025-53990.md): WordPress JetFormBuilder plugin \<= 3.5.1.2 - PHP Object Injection Vulnerability (CVSS 7.2, jetmonsters JetFormBuilder)
- [CVE-2025-53989](https://cve.now/CVE-2025-53989.md): WordPress JetBlocks For Elementor plugin \<= 1.3.19 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Crocoblock JetBlocks For Elementor)
- [CVE-2025-53986](https://cve.now/CVE-2025-53986.md): WordPress Hestia theme \<= 3.2.10 - Broken Access Control Vulnerability (CVSS 5.3, themeisle Hestia)
- [CVE-2025-53984](https://cve.now/CVE-2025-53984.md): WordPress JetTabs plugin \<= 2.2.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Crocoblock JetTabs)
- [CVE-2025-53982](https://cve.now/CVE-2025-53982.md): WordPress JetElements For Elementor plugin \<= 2.7.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Crocoblock JetElements For Elementor)
- [CVE-2024-9342](https://cve.now/CVE-2024-9342.md): In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of fa (CVSS 6.3, Eclipse Foundation Eclipse Glassfish · org.glassfish.main.a…)
- [CVE-2025-7699](https://cve.now/CVE-2025-7699.md): An improper access control vulnerability was found in the EZ Sync Manager of ADM (CVSS 7.1, ASUSTOR ADM)
- [CVE-2025-22227](https://cve.now/CVE-2025-22227.md): CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client (CVSS 6.1, VMware Reactor Netty · io.projectreactor.netty:reactor-nett…)
- [CVE-2025-40985](https://cve.now/CVE-2025-40985.md): SQL Injection in SCATI Vision Web (CVSS 8.3, SCATI Vision Web)
- [CVE-2025-40724](https://cve.now/CVE-2025-40724.md): Stored Cross-Site Scripting (XSS) in Pharmacy POS PHP Script (CVSS 5.1, Pharmacy POS PHP Script)
- [CVE-2025-7035](https://cve.now/CVE-2025-7035.md): Media Library Assistant \<= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla\_tag\_cloud and mla\_term\_list Shortcodes (CVSS 6.4, dglingren Media Library Assistant)
- [CVE-2025-6993](https://cve.now/CVE-2025-6993.md): Ultimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get\_email\_log\_details Function (CVSS 7.5, rustaurius Ultimate WP Mail)
- [CVE-2025-5284](https://cve.now/CVE-2025-5284.md): Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations \<= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, litonice13 Master Addons For Elementor – Widgets, Extension…)
- [CVE-2025-7703](https://cve.now/CVE-2025-7703.md): Authentication vulnerability in the mobile application（tech.palm.id）may lead to the risk of information leakage. (CVSS 3.1, TECNO tech.palm.id)
- [CVE-2025-27465](https://cve.now/CVE-2025-27465.md): x86: Incorrect stubs exception handling for flags recovery (CVSS 4.3, Xen)
- [CVE-2025-7673](https://cve.now/CVE-2025-7673.md): A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50(ABOM.5)C0 (CVSS 9.8, Zyxel VMG8825-T50K firmware)
- [CVE-2025-6747](https://cve.now/CVE-2025-6747.md): Avada (Fusion) Builder \<= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, themefusion Avada (Fusion) Builder)
- [CVE-2025-6043](https://cve.now/CVE-2025-6043.md): Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal \<= 17.0 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.1, Malcure Malware Shield — Removal, Repair, Monitor)
- [CVE-2025-5845](https://cve.now/CVE-2025-5845.md): Affiliate Reviews \<= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via numColumns Parameter (CVSS 6.4, wpchop Affiliate Reviews)
- [CVE-2025-5843](https://cve.now/CVE-2025-5843.md): Brandfolder \<= 5.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4, Brandfolder – Digital Asset Management Simplified.)
- [CVE-2025-7359](https://cve.now/CVE-2025-7359.md): Counter live visitors for WooCommerce \<= 1.3.6 - Unauthenticated Arbitrary File Deletion in wcvisitor\_get\_block (CVSS 8.2, danielriera Counter live visitors for WooCommerce)
- [CVE-2025-52690](https://cve.now/CVE-2025-52690.md): Command Injection Vulnerability in the OmniAccess Stellar over UDP Service (CVSS 8.1, Alcatel-Lucent OmniAccess Stellar Products)
- [CVE-2025-52689](https://cve.now/CVE-2025-52689.md): Weak Session ID Check in the OmniAccess Stellar Web Management Interface (CVSS 9.8, Alcatel-Lucent OmniAccess Stellar Products)
- [CVE-2025-52688](https://cve.now/CVE-2025-52688.md): Command Injection Vulnerability in the OmniAccess Stellar Web Management Interface (CVSS 9.8, Alcatel-Lucent OmniAccess Stellar Products)
- [CVE-2025-52687](https://cve.now/CVE-2025-52687.md): JavaScript Injection Vulnerability in the OmniAccess Stellar Web Management Interface (CVSS 2.4, Alcatel-Lucent OmniAccess Stellar)
- [CVE-2025-2799](https://cve.now/CVE-2025-2799.md): WP Event Manager \<= 3.1.49 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, wpeventmanager WP Event Manager – Events Calendar, Registra…)
- [CVE-2025-2800](https://cve.now/CVE-2025-2800.md): WP Event Manager \<= 3.1.50 - Unauthenticated Stored Cross-Site Scripting via 'organizer\_name' (CVSS 7.2, wpeventmanager WP Event Manager – Events Calendar, Registra…)
- [CVE-2025-53842](https://cve.now/CVE-2025-53842.md): Use of hard-coded credentials issue exists in ZWX-2000CSW2-HN prior to 0.3.19 and ZWX-2000CS2-HN firmware all versions. (CVSS 4.5, ZEXELON CO. ZWX-2000CSW2-HN · ZEXELON CO. ZWX-2000CS2-HN)
- [CVE-2025-6977](https://cve.now/CVE-2025-6977.md): ProfileGrid – User Profiles, Groups and Communities \<= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm\_get\_messenger\_notification' function (CVSS 6.1, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2024-42912](https://cve.now/CVE-2024-42912.md): A cross-site scripting (XSS) vulnerability in META-INF Kft. (CVSS 5.4)
- [CVE-2025-32353](https://cve.now/CVE-2025-32353.md): Kaseya Rapid Fire Tools Network Detective 2.0.16.0 has Unencrypted Credentials (for privileged access) stored in the collector.txt configura (CVSS 8.2)
- [CVE-2025-32874](https://cve.now/CVE-2025-32874.md): An issue was discovered in Kaseya Rapid Fire Tools Network Detective through 2.0.16.0. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.