# CVEs published 2025-07-19

46 CVEs were published on July 19, 2025: 7 critical, 10 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-7858](https://cve.now/CVE-2025-7858.md): PHPGurukul Apartment Visitors Management System HTTP POST Request admin-profile.php cross site scripting (CVSS 5.1, PHPGurukul Apartment Visitors Management System)
- [CVE-2025-7857](https://cve.now/CVE-2025-7857.md): PHPGurukul Apartment Visitors Management System HTTP POST Request bwdates-passreports-details.php cross site scripting (CVSS 5.1, PHPGurukul Apartment Visitors Management System)
- [CVE-2025-7856](https://cve.now/CVE-2025-7856.md): PHPGurukul Apartment Visitors Management System HTTP POST Request pass-details.php cross site scripting (CVSS 5.1, PHPGurukul Apartment Visitors Management System)
- [CVE-2025-7855](https://cve.now/CVE-2025-7855.md): Tenda FH451 qossetting fromqossetting stack-based overflow (CVSS 8.7, Tenda FH451)
- [CVE-2025-7854](https://cve.now/CVE-2025-7854.md): Tenda FH451 VirtualSer fromVirtualSer stack-based overflow (CVSS 8.7, Tenda FH451)
- [CVE-2025-7853](https://cve.now/CVE-2025-7853.md): Tenda FH451 SetIpBind fromSetIpBind stack-based overflow (CVSS 8.7, Tenda FH451)
- [CVE-2025-7840](https://cve.now/CVE-2025-7840.md): Campcodes Online Movie Theater Seat Reservation System Reserve Your Seat Page index.php cross site scripting (CVSS 5.1, Campcodes Online Movie Theater Seat Reservation System)
- [CVE-2025-7838](https://cve.now/CVE-2025-7838.md): Campcodes Online Movie Theater Seat Reservation System manage\_seat.php sql injection (CVSS 6.9, Campcodes Online Movie Theater Seat Reservation System)
- [CVE-2025-7837](https://cve.now/CVE-2025-7837.md): TOTOLINK T6 MQTT Service recvSlaveStaInfo buffer overflow (CVSS 8.7, TOTOLINK T6)
- [CVE-2025-7836](https://cve.now/CVE-2025-7836.md): D-Link DIR-816L Environment Variable cgibin lxmldbc\_system command injection (CVSS 5.3, D-Link DIR-816L)
- [CVE-2025-7834](https://cve.now/CVE-2025-7834.md): PHPGurukul Complaint Management System cross-site request forgery (CVSS 5.3, PHPGurukul Complaint Management System)
- [CVE-2025-7833](https://cve.now/CVE-2025-7833.md): code-projects Church Donation System giving.php sql injection (CVSS 6.9, code-projects Church Donation System)
- [CVE-2025-7832](https://cve.now/CVE-2025-7832.md): code-projects Church Donation System offering.php sql injection (CVSS 6.9, code-projects Church Donation System)
- [CVE-2025-7831](https://cve.now/CVE-2025-7831.md): code-projects Church Donation System Tithes.php sql injection (CVSS 6.9, code-projects Church Donation System)
- [CVE-2025-7830](https://cve.now/CVE-2025-7830.md): code-projects Church Donation System reg.php sql injection (CVSS 6.9, code-projects Church Donation System)
- [CVE-2025-7829](https://cve.now/CVE-2025-7829.md): code-projects Church Donation System login.php sql injection (CVSS 6.9, code-projects Church Donation System)
- [CVE-2025-7824](https://cve.now/CVE-2025-7824.md): Jinher OA XmlHttp.aspx xml external entity reference (CVSS 6.9, Jinher OA)
- [CVE-2025-7823](https://cve.now/CVE-2025-7823.md): Jinher OA ProjectScheduleDelete.aspx xml external entity reference (CVSS 6.9, Jinher OA)
- [CVE-2025-7819](https://cve.now/CVE-2025-7819.md): PHPGurukul Apartment Visitors Management System HTTP POST Request create-pass.php cross site scripting (CVSS 4.8, PHPGurukul Apartment Visitors Management System)
- [CVE-2025-7818](https://cve.now/CVE-2025-7818.md): PHPGurukul Apartment Visitors Management System HTTP POST Request category.php cross site scripting (CVSS 5.1, PHPGurukul Apartment Visitors Management System)
- [CVE-2025-38351](https://cve.now/CVE-2025-38351.md): KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (no CVSS, Linux)
- [CVE-2025-7817](https://cve.now/CVE-2025-7817.md): PHPGurukul Apartment Visitors Management System HTTP POST Request bwdates-reports.php cross site scripting (CVSS 5.1, PHPGurukul Apartment Visitors Management System)
- [CVE-2015-10138](https://cve.now/CVE-2015-10138.md): Work The Flow File Upload \<= 2.5.2 - Arbitrary File Upload (CVSS 9.8, lynton\_reed Work The Flow File Upload)
- [CVE-2015-10139](https://cve.now/CVE-2015-10139.md): WPLMS Learning Management System for WordPress, WordPress LMS \<= 1.8.4.1 - Privilege Escalation (CVSS 8.8, VibeThemes WPLMS Learning Management System for WordPress,…)
- [CVE-2025-7816](https://cve.now/CVE-2025-7816.md): PHPGurukul Apartment Visitors Management System HTTP POST Request visitor-detail.php cross site scripting (CVSS 5.1, PHPGurukul Apartment Visitors Management System)
- [CVE-2025-7815](https://cve.now/CVE-2025-7815.md): PHPGurukul Apartment Visitors Management System HTTP POST Request manage-newvisitors.php cross site scripting (CVSS 4.8, PHPGurukul Apartment Visitors Management System)
- [CVE-2015-10133](https://cve.now/CVE-2015-10133.md): Subscribe to Comments \<= 2.1.2 - Local File Includion (CVSS 7.2, markjaquith Subscribe to Comments)
- [CVE-2012-10019](https://cve.now/CVE-2012-10019.md): Front-end Editor \< 2.3 - Arbitrary File Upload (CVSS 9.8, scribu Front-end Editor)
- [CVE-2016-15043](https://cve.now/CVE-2016-15043.md): WP Mobile Detector \<= 3.5 - Arbitrary File Upload (CVSS 9.8, Websitez.com WP Mobile Detector)
- [CVE-2015-10135](https://cve.now/CVE-2015-10135.md): WPshop 2 – E-Commerce \< 1.3.9.6 - Arbitrary File Upload (CVSS 9.8, eoxia WPshop 2 – E-Commerce)
- [CVE-2015-10136](https://cve.now/CVE-2015-10136.md): GI-Media Library \< 3.0 - Directory Traversal (CVSS 7.5, zishanj GI-Media Library)
- [CVE-2015-10134](https://cve.now/CVE-2015-10134.md): Simple Backup \<= 2.7.10 - Arbitrary File Download via Path Traversal (CVSS 7.5, mywebsiteadvisor Simple Backup)
- [CVE-2025-6997](https://cve.now/CVE-2025-6997.md): ThemeREX Addons \<= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx\_addons\_get\_svg\_from\_file Function (CVSS 6.4, ThemeREX Addons)
- [CVE-2025-38350](https://cve.now/CVE-2025-38350.md): net/sched: Always pass notifications when child class becomes empty (CVSS 7.8, Linux)
- [CVE-2025-6720](https://cve.now/CVE-2025-6720.md): Vchasno Kasa \<= 1.0.3 - Unauthenticated Log File Clearing (CVSS 5.3, bandido MORKVA Vchasno Kasa Integration)
- [CVE-2025-6721](https://cve.now/CVE-2025-6721.md): Vchasno Kasa \<= 1.0.3 - Missing Authorization to Unauthenticated Invoice Generation (CVSS 5.3, bandido MORKVA Vchasno Kasa Integration)
- [CVE-2025-29757](https://cve.now/CVE-2025-29757.md): An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid (CVSS 9.4, https://oss.growatt.com · https://server.growatt.com)
- [CVE-2025-7697](https://cve.now/CVE-2025-7697.md): Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms \<= 1.1.1 - Unauthenticated PHP Object Injection via verify\_field\_val Function (CVSS 9.8, crmperks Integration for Google Sheets and Contact Form 7,…)
- [CVE-2025-7696](https://cve.now/CVE-2025-7696.md): Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms \<= 1.2.3 - Unauthenticated PHP Object Injection via verify\_field\_val Function (CVSS 9.8, crmperks Integration for Pipedrive and Contact Form 7, WPFo…)
- [CVE-2025-7669](https://cve.now/CVE-2025-7669.md): Avishi WP PayPal Payment Button \<= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, avishika Avishi WP PayPal Payment Button)
- [CVE-2025-7653](https://cve.now/CVE-2025-7653.md): EPay.bg Payments \<= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, vloo EPay.bg Payments)
- [CVE-2025-7658](https://cve.now/CVE-2025-7658.md): Temporarily Hidden Content \<= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, codents Temporarily Hidden Content)
- [CVE-2025-7661](https://cve.now/CVE-2025-7661.md): Partnerský systém Martinus \<= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, maxomatos Partnerský systém Martinus)
- [CVE-2025-7655](https://cve.now/CVE-2025-7655.md): Live Stream Badger \<= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, tkrivickas Live Stream Badger)
- [CVE-2025-52924](https://cve.now/CVE-2025-52924.md): In One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP r (CVSS 4.0, One Identity OneLogin)
- [CVE-2025-54313](https://cve.now/CVE-2025-54313.md): eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. (CVSS 7.5, KEV, eslint-config-prettier · eslint-plugin-prettier +4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.