CVEs published July 20, 2025
66 CVEs were published on July 20, 2025: 1 critical, 11 high. 1 is now in CISA KEV.
- Published
- 66
- Critical
- 1
- High
- 11
- Medium
- 52
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 15
Most affected products
- Metasoft 美特软件 MetaCRM
- 8
- yangzongzhuan RuoYi
- 5
- Portabilis i-Educar
- 4
- code-projects Church Donation System
- 3
- Emby Windows
- 3
- harry0703 MoneyPrinterTurbo
- 3
- mbedtls
- 3
- Portabilis i-Diario
- 3
- thinkgem JeeSite
- 3
- TOTOLINK T6
- 3
Critical 1
High 11
- CVE-2025-7913TOTOLINK T6 MQTT Service updateWifiInfo buffer overflowTOTOLINK T6
- CVE-2025-7912TOTOLINK T6 MQTT Service recvSlaveUpgstatus buffer overflowTOTOLINK T6
- CVE-2025-7911D-Link DI-8100 jhttpd upnp_ctrl.asp sprintf stack-based overflowD-Link DI-8100
- CVE-2025-7910D-Link DIR-513 Boa Webserver formSetWanNonLogin sprintf stack-based overflowD-Link DIR-513
- CVE-2025-7909D-Link DIR-513 Boa Webserver formLanSetupRouterSettings sprintf stack-based overflowD-Link DIR-513
- CVE-2025-7908D-Link DI-8100 jhttpd ddns.asp sprintf stack-based overflowD-Link DI-8100
- CVE-2025-46385CWE-918 Server-Side Request Forgery (SSRF)Emby Windows
- CVE-2025-46384CWE-434 Unrestricted Upload of File with Dangerous TypeEmby Windows
- CVE-2025-7883Eluktronics Control Center Powershell Script Command command injectionEluktronics Control Center
- CVE-2025-47917Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation.mbedtls
- CVE-2025-54317An issue was discovered in Logpoint before 7.6.0.Logpoint
Medium, low and unrated 54
- CVE-2025-53771Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2025-7907yangzongzhuan RuoYi Druid application-druid.yml default credentialsyangzongzhuan RuoYi
- CVE-2025-7906yangzongzhuan RuoYi CommonController.java uploadFile unrestricted uploadyangzongzhuan RuoYi
- CVE-2025-7905itsourcecode Insurance Management System insertPayment.php sql injectionitsourcecode Insurance Management System
- CVE-2025-7904itsourcecode Insurance Management System insertNominee.php sql injectionitsourcecode Insurance Management System
- CVE-2025-7903yangzongzhuan RuoYi Image Source ui layeryangzongzhuan RuoYi
- CVE-2025-7902yangzongzhuan RuoYi SysNoticeController.java addSave cross site scriptingyangzongzhuan RuoYi
- CVE-2025-7901yangzongzhuan RuoYi Swagger UI index.html cross site scriptingyangzongzhuan RuoYi
- CVE-2025-7898Codecanyon iDentSoft Account Setting Page updateSetting unrestricted uploadCodecanyon iDentSoft
- CVE-2025-7897harry0703 MoneyPrinterTurbo API Endpoint base.py verify_token missing authenticationharry0703 MoneyPrinterTurbo
- CVE-2025-7896harry0703 MoneyPrinterTurbo video.py delete_video path traversalharry0703 MoneyPrinterTurbo
- CVE-2025-46383CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')Emby Windows
- CVE-2025-7895harry0703 MoneyPrinterTurbo File Extension video.py upload_bgm_file unrestricted uploadharry0703 MoneyPrinterTurbo
- CVE-2025-46382CWE-200 Exposure of Sensitive Information to an Unauthorized ActorCyberArk IDP
- CVE-2025-7894Onyx Chat Interface a3_generate_simple_sql.py generate_simple_sql sql injectionOnyx
- CVE-2025-7893Foresight News App pro.foresightnews.appa AndroidManifest.xml improper export of android application componentsForesight News App
- CVE-2025-7892IDnow App de.idnow AndroidManifest.xml improper export of android application componentsIDnow App
- CVE-2025-7891InstantBits Web Video Cast App com.instantbits.cast.webvideo AndroidManifest.xml improper export of android application componentsInstantBits Web Video Cast App
- CVE-2025-7890Dunamu StockPlus App com.dunamu.stockplus AndroidManifest.xml improper export of android application componentsDunamu StockPlus App
- CVE-2025-7889CallApp Caller ID App caller.id.phone.number.block AndroidManifest.xml improper export of android application componentsCallApp Caller ID App
- CVE-2025-7888TDuckCloud tduck-platform UserFormDataMapper.java UserFormDataMapper sql injectionTDuckCloud tduck-platform
- CVE-2025-7887Zavy86 WikiDocs template.inc.php cross site scriptingZavy86 WikiDocs
- CVE-2025-7886pmTicket Project-Management-Software class.database.php getUserLanguage sql injectionpmTicket Project-Management-Software
- CVE-2025-7885Huashengdun WebSSH Login Page cross site scriptingHuashengdun WebSSH · webssh
- CVE-2025-7884Eluktronics Control Center REG File data authenticityEluktronics Control Center
- CVE-2025-7882Mercusys MW301R Login excessive authenticationMercusys MW301R
- CVE-2025-7881Mercusys MW301R Web Interface password recoveryMercusys MW301R
- CVE-2025-7880Metasoft 美特软件 MetaCRM sendsms.jsp unrestricted uploadMetasoft 美特软件 MetaCRM
- CVE-2025-7879Metasoft 美特软件 MetaCRM mobileupload.jsp unrestricted uploadMetasoft 美特软件 MetaCRM
- CVE-2025-7878Metasoft 美特软件 MetaCRM upload2.jsp unrestricted uploadMetasoft 美特软件 MetaCRM
- CVE-2025-7877Metasoft 美特软件 MetaCRM sendfile.jsp unrestricted uploadMetasoft 美特软件 MetaCRM
- CVE-2025-7876Metasoft 美特软件 MetaCRM download.jsp AnalyzeParam deserializationMetasoft 美特软件 MetaCRM
- CVE-2025-7875Metasoft 美特软件 MetaCRM debug.jsp improper authenticationMetasoft 美特软件 MetaCRM
- CVE-2025-7874Metasoft 美特软件 MetaCRM env.jsp information disclosureMetasoft 美特软件 MetaCRM
- CVE-2025-7873Metasoft 美特软件 MetaCRM mcc_login.jsp sql injectionMetasoft 美特软件 MetaCRM
- CVE-2025-7872Portabilis i-Diario justificativas-de-falta cross site scriptingPortabilis i-Diario
- CVE-2025-7871Portabilis i-Diario conteudos cross site scriptingPortabilis i-Diario
- CVE-2025-7870Portabilis i-Diario justificativas-de-falta Endpoint doc_uploader.rb cross site scriptingPortabilis i-Diario
- CVE-2025-7869Portabilis i-Educar Turma Module educar_turma_tipo_det.php cross site scriptingPortabilis i-Educar
- CVE-2025-7868Portabilis i-Educar Calendar educar_calendario_dia_motivo_cad.php cross site scriptingPortabilis i-Educar
- CVE-2025-7867Portabilis i-Educar Agenda agenda.php cross site scriptingPortabilis i-Educar
- CVE-2025-7866Portabilis i-Educar Disabilities Module educar_deficiencia_lst.php cross site scriptingPortabilis i-Educar
- CVE-2025-7865thinkgem JeeSite XSS Filter EncodeUtils.java xssFilter cross site scriptingthinkgem JeeSite
- CVE-2025-7864thinkgem JeeSite FileUploadController.java upload unrestricted uploadthinkgem JeeSite
- CVE-2025-7863thinkgem JeeSite ServletUtils.java redirectUrlthinkgem JeeSite
- CVE-2025-7862TOTOLINK T6 Telnet Service cstecgi.cgi setTelnetCfg missing authenticationTOTOLINK T6
- CVE-2025-7861code-projects Church Donation System search.php sql injectioncode-projects Church Donation System
- CVE-2025-7860code-projects Church Donation System login_admin.php sql injectioncode-projects Church Donation System
- CVE-2025-7859code-projects Church Donation System update_password_admin.php sql injectioncode-projects Church Donation System
- CVE-2025-48965Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL bmbedtls
- CVE-2025-49087In Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing discrepancy in block cipher padding removal allows an attacker to recover the plaintembedtls
- CVE-2025-54314Thor before 1.4.0 can construct an unsafe shell command from library input.rubyonrails Thor
- CVE-2025-54316An issue was discovered in Logpoint before 7.6.0.Logpoint
- CVE-2025-54319An issue was discovered in Westermo WeOS 5 (5.24 through 5.24.4).Westermo WeOS