CVEs published July 19, 2025
46 CVEs were published on July 19, 2025: 7 critical, 10 high. 1 is now in CISA KEV.
- Published
- 46
- Critical
- 7
- High
- 10
- Medium
- 28
- Low
- 0
- Unrated
- 1
- Now in CISA KEV
- 1
- Fix available
- 8
Most affected products
- PHPGurukul Apartment Visitors Management System
- 8
- code-projects Church Donation System
- 5
- Tenda FH451
- 3
- bandido MORKVA Vchasno Kasa Integration
- 2
- Campcodes Online Movie Theater Seat Reservation System
- 2
- Jinher OA
- 2
- Linux
- 2
- avishika Avishi WP PayPal Payment Button
- 1
- codents Temporarily Hidden Content
- 1
- crmperks Integration for Google Sheets and Contact Form 7,…
- 1
Critical 7
- CVE-2015-10138Work The Flow File Upload <= 2.5.2 - Arbitrary File Uploadlynton_reed Work The Flow File Upload
- CVE-2012-10019Front-end Editor < 2.3 - Arbitrary File Uploadscribu Front-end Editor
- CVE-2016-15043WP Mobile Detector <= 3.5 - Arbitrary File UploadWebsitez.com WP Mobile Detector
- CVE-2015-10135WPshop 2 – E-Commerce < 1.3.9.6 - Arbitrary File Uploadeoxia WPshop 2 – E-Commerce
- CVE-2025-29757An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid https://oss.growatt.com · https://server.growatt.com
- CVE-2025-7697Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 - Unauthenticated PHP Object Injection via verify_field_val Functioncrmperks Integration for Google Sheets and Contact Form 7,…
- CVE-2025-7696Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.2.3 - Unauthenticated PHP Object Injection via verify_field_val Functioncrmperks Integration for Pipedrive and Contact Form 7, WPFo…
High 10
- CVE-2025-7855Tenda FH451 qossetting fromqossetting stack-based overflowTenda FH451
- CVE-2025-7854Tenda FH451 VirtualSer fromVirtualSer stack-based overflowTenda FH451
- CVE-2025-7853Tenda FH451 SetIpBind fromSetIpBind stack-based overflowTenda FH451
- CVE-2025-7837TOTOLINK T6 MQTT Service recvSlaveStaInfo buffer overflowTOTOLINK T6
- CVE-2015-10139WPLMS Learning Management System for WordPress, WordPress LMS <= 1.8.4.1 - Privilege EscalationVibeThemes WPLMS Learning Management System for WordPress,…
- CVE-2015-10133Subscribe to Comments <= 2.1.2 - Local File Includionmarkjaquith Subscribe to Comments
- CVE-2015-10136GI-Media Library < 3.0 - Directory Traversalzishanj GI-Media Library
- CVE-2015-10134Simple Backup <= 2.7.10 - Arbitrary File Download via Path Traversalmywebsiteadvisor Simple Backup
- CVE-2025-38350net/sched: Always pass notifications when child class becomes emptyLinux
- CVE-2025-54313eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise.eslint-config-prettier · eslint-plugin-prettier +4
Medium, low and unrated 29
- CVE-2025-7858PHPGurukul Apartment Visitors Management System HTTP POST Request admin-profile.php cross site scriptingPHPGurukul Apartment Visitors Management System
- CVE-2025-7857PHPGurukul Apartment Visitors Management System HTTP POST Request bwdates-passreports-details.php cross site scriptingPHPGurukul Apartment Visitors Management System
- CVE-2025-7856PHPGurukul Apartment Visitors Management System HTTP POST Request pass-details.php cross site scriptingPHPGurukul Apartment Visitors Management System
- CVE-2025-7840Campcodes Online Movie Theater Seat Reservation System Reserve Your Seat Page index.php cross site scriptingCampcodes Online Movie Theater Seat Reservation System
- CVE-2025-7838Campcodes Online Movie Theater Seat Reservation System manage_seat.php sql injectionCampcodes Online Movie Theater Seat Reservation System
- CVE-2025-7836D-Link DIR-816L Environment Variable cgibin lxmldbc_system command injectionD-Link DIR-816L
- CVE-2025-7834PHPGurukul Complaint Management System cross-site request forgeryPHPGurukul Complaint Management System
- CVE-2025-7833code-projects Church Donation System giving.php sql injectioncode-projects Church Donation System
- CVE-2025-7832code-projects Church Donation System offering.php sql injectioncode-projects Church Donation System
- CVE-2025-7831code-projects Church Donation System Tithes.php sql injectioncode-projects Church Donation System
- CVE-2025-7830code-projects Church Donation System reg.php sql injectioncode-projects Church Donation System
- CVE-2025-7829code-projects Church Donation System login.php sql injectioncode-projects Church Donation System
- CVE-2025-7824Jinher OA XmlHttp.aspx xml external entity referenceJinher OA
- CVE-2025-7823Jinher OA ProjectScheduleDelete.aspx xml external entity referenceJinher OA
- CVE-2025-7819PHPGurukul Apartment Visitors Management System HTTP POST Request create-pass.php cross site scriptingPHPGurukul Apartment Visitors Management System
- CVE-2025-7818PHPGurukul Apartment Visitors Management System HTTP POST Request category.php cross site scriptingPHPGurukul Apartment Visitors Management System
- CVE-2025-38351KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flushLinux
- CVE-2025-7817PHPGurukul Apartment Visitors Management System HTTP POST Request bwdates-reports.php cross site scriptingPHPGurukul Apartment Visitors Management System
- CVE-2025-7816PHPGurukul Apartment Visitors Management System HTTP POST Request visitor-detail.php cross site scriptingPHPGurukul Apartment Visitors Management System
- CVE-2025-7815PHPGurukul Apartment Visitors Management System HTTP POST Request manage-newvisitors.php cross site scriptingPHPGurukul Apartment Visitors Management System
- CVE-2025-6997ThemeREX Addons <= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file FunctionThemeREX Addons
- CVE-2025-6720Vchasno Kasa <= 1.0.3 - Unauthenticated Log File Clearingbandido MORKVA Vchasno Kasa Integration
- CVE-2025-6721Vchasno Kasa <= 1.0.3 - Missing Authorization to Unauthenticated Invoice Generationbandido MORKVA Vchasno Kasa Integration
- CVE-2025-7669Avishi WP PayPal Payment Button <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scriptingavishika Avishi WP PayPal Payment Button
- CVE-2025-7653EPay.bg Payments <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingvloo EPay.bg Payments
- CVE-2025-7658Temporarily Hidden Content <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingcodents Temporarily Hidden Content
- CVE-2025-7661Partnerský systém Martinus <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingmaxomatos Partnerský systém Martinus
- CVE-2025-7655Live Stream Badger <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingtkrivickas Live Stream Badger
- CVE-2025-52924In One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP rOne Identity OneLogin