# CVEs published 2025-07-20

66 CVEs were published on July 20, 2025: 1 critical, 11 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-7913](https://cve.now/CVE-2025-7913.md): TOTOLINK T6 MQTT Service updateWifiInfo buffer overflow (CVSS 8.7, TOTOLINK T6)
- [CVE-2025-7912](https://cve.now/CVE-2025-7912.md): TOTOLINK T6 MQTT Service recvSlaveUpgstatus buffer overflow (CVSS 8.7, TOTOLINK T6)
- [CVE-2025-7911](https://cve.now/CVE-2025-7911.md): D-Link DI-8100 jhttpd upnp\_ctrl.asp sprintf stack-based overflow (CVSS 8.7, D-Link DI-8100)
- [CVE-2025-53771](https://cve.now/CVE-2025-53771.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 6.5, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2025-7910](https://cve.now/CVE-2025-7910.md): D-Link DIR-513 Boa Webserver formSetWanNonLogin sprintf stack-based overflow (CVSS 8.7, D-Link DIR-513)
- [CVE-2025-7909](https://cve.now/CVE-2025-7909.md): D-Link DIR-513 Boa Webserver formLanSetupRouterSettings sprintf stack-based overflow (CVSS 8.7, D-Link DIR-513)
- [CVE-2025-7908](https://cve.now/CVE-2025-7908.md): D-Link DI-8100 jhttpd ddns.asp sprintf stack-based overflow (CVSS 8.7, D-Link DI-8100)
- [CVE-2025-7907](https://cve.now/CVE-2025-7907.md): yangzongzhuan RuoYi Druid application-druid.yml default credentials (CVSS 5.3, yangzongzhuan RuoYi)
- [CVE-2025-7906](https://cve.now/CVE-2025-7906.md): yangzongzhuan RuoYi CommonController.java uploadFile unrestricted upload (CVSS 5.3, yangzongzhuan RuoYi)
- [CVE-2025-7905](https://cve.now/CVE-2025-7905.md): itsourcecode Insurance Management System insertPayment.php sql injection (CVSS 5.3, itsourcecode Insurance Management System)
- [CVE-2025-7904](https://cve.now/CVE-2025-7904.md): itsourcecode Insurance Management System insertNominee.php sql injection (CVSS 5.3, itsourcecode Insurance Management System)
- [CVE-2025-7903](https://cve.now/CVE-2025-7903.md): yangzongzhuan RuoYi Image Source ui layer (CVSS 5.3, yangzongzhuan RuoYi)
- [CVE-2025-7902](https://cve.now/CVE-2025-7902.md): yangzongzhuan RuoYi SysNoticeController.java addSave cross site scripting (CVSS 5.1, yangzongzhuan RuoYi)
- [CVE-2025-7901](https://cve.now/CVE-2025-7901.md): yangzongzhuan RuoYi Swagger UI index.html cross site scripting (CVSS 5.3, yangzongzhuan RuoYi)
- [CVE-2025-7898](https://cve.now/CVE-2025-7898.md): Codecanyon iDentSoft Account Setting Page updateSetting unrestricted upload (CVSS 5.1, Codecanyon iDentSoft)
- [CVE-2025-7897](https://cve.now/CVE-2025-7897.md): harry0703 MoneyPrinterTurbo API Endpoint base.py verify\_token missing authentication (CVSS 6.9, harry0703 MoneyPrinterTurbo)
- [CVE-2025-7896](https://cve.now/CVE-2025-7896.md): harry0703 MoneyPrinterTurbo video.py delete\_video path traversal (CVSS 5.3, harry0703 MoneyPrinterTurbo)
- [CVE-2025-46385](https://cve.now/CVE-2025-46385.md): CWE-918 Server-Side Request Forgery (SSRF) (CVSS 8.6, Emby Windows)
- [CVE-2025-46384](https://cve.now/CVE-2025-46384.md): CWE-434 Unrestricted Upload of File with Dangerous Type (CVSS 8.8, Emby Windows)
- [CVE-2025-46383](https://cve.now/CVE-2025-46383.md): CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (CVSS 6.1, Emby Windows)
- [CVE-2025-7895](https://cve.now/CVE-2025-7895.md): harry0703 MoneyPrinterTurbo File Extension video.py upload\_bgm\_file unrestricted upload (CVSS 5.3, harry0703 MoneyPrinterTurbo)
- [CVE-2025-46382](https://cve.now/CVE-2025-46382.md): CWE-200 Exposure of Sensitive Information to an Unauthorized Actor (CVSS 5.3, CyberArk IDP)
- [CVE-2025-7894](https://cve.now/CVE-2025-7894.md): Onyx Chat Interface a3\_generate\_simple\_sql.py generate\_simple\_sql sql injection (CVSS 5.3, Onyx)
- [CVE-2025-7893](https://cve.now/CVE-2025-7893.md): Foresight News App pro.foresightnews.appa AndroidManifest.xml improper export of android application components (CVSS 4.8, Foresight News App)
- [CVE-2025-7892](https://cve.now/CVE-2025-7892.md): IDnow App de.idnow AndroidManifest.xml improper export of android application components (CVSS 4.8, IDnow App)
- [CVE-2025-7891](https://cve.now/CVE-2025-7891.md): InstantBits Web Video Cast App com.instantbits.cast.webvideo AndroidManifest.xml improper export of android application components (CVSS 4.8, InstantBits Web Video Cast App)
- [CVE-2025-7890](https://cve.now/CVE-2025-7890.md): Dunamu StockPlus App com.dunamu.stockplus AndroidManifest.xml improper export of android application components (CVSS 4.8, Dunamu StockPlus App)
- [CVE-2025-7889](https://cve.now/CVE-2025-7889.md): CallApp Caller ID App caller.id.phone.number.block AndroidManifest.xml improper export of android application components (CVSS 4.8, CallApp Caller ID App)
- [CVE-2025-7888](https://cve.now/CVE-2025-7888.md): TDuckCloud tduck-platform UserFormDataMapper.java UserFormDataMapper sql injection (CVSS 5.3, TDuckCloud tduck-platform)
- [CVE-2025-7887](https://cve.now/CVE-2025-7887.md): Zavy86 WikiDocs template.inc.php cross site scripting (CVSS 5.3, Zavy86 WikiDocs)
- [CVE-2025-7886](https://cve.now/CVE-2025-7886.md): pmTicket Project-Management-Software class.database.php getUserLanguage sql injection (CVSS 6.9, pmTicket Project-Management-Software)
- [CVE-2025-7885](https://cve.now/CVE-2025-7885.md): Huashengdun WebSSH Login Page cross site scripting (CVSS 5.3, Huashengdun WebSSH · webssh)
- [CVE-2025-7884](https://cve.now/CVE-2025-7884.md): Eluktronics Control Center REG File data authenticity (CVSS 4.8, Eluktronics Control Center)
- [CVE-2025-7883](https://cve.now/CVE-2025-7883.md): Eluktronics Control Center Powershell Script Command command injection (CVSS 8.5, Eluktronics Control Center)
- [CVE-2025-7882](https://cve.now/CVE-2025-7882.md): Mercusys MW301R Login excessive authentication (CVSS 2.3, Mercusys MW301R)
- [CVE-2025-7881](https://cve.now/CVE-2025-7881.md): Mercusys MW301R Web Interface password recovery (CVSS 5.1, Mercusys MW301R)
- [CVE-2025-7880](https://cve.now/CVE-2025-7880.md): Metasoft 美特软件 MetaCRM sendsms.jsp unrestricted upload (CVSS 5.3, Metasoft 美特软件 MetaCRM)
- [CVE-2025-7879](https://cve.now/CVE-2025-7879.md): Metasoft 美特软件 MetaCRM mobileupload.jsp unrestricted upload (CVSS 5.3, Metasoft 美特软件 MetaCRM)
- [CVE-2025-7878](https://cve.now/CVE-2025-7878.md): Metasoft 美特软件 MetaCRM upload2.jsp unrestricted upload (CVSS 5.3, Metasoft 美特软件 MetaCRM)
- [CVE-2025-7877](https://cve.now/CVE-2025-7877.md): Metasoft 美特软件 MetaCRM sendfile.jsp unrestricted upload (CVSS 5.3, Metasoft 美特软件 MetaCRM)
- [CVE-2025-7876](https://cve.now/CVE-2025-7876.md): Metasoft 美特软件 MetaCRM download.jsp AnalyzeParam deserialization (CVSS 5.3, Metasoft 美特软件 MetaCRM)
- [CVE-2025-7875](https://cve.now/CVE-2025-7875.md): Metasoft 美特软件 MetaCRM debug.jsp improper authentication (CVSS 6.9, Metasoft 美特软件 MetaCRM)
- [CVE-2025-7874](https://cve.now/CVE-2025-7874.md): Metasoft 美特软件 MetaCRM env.jsp information disclosure (CVSS 6.9, Metasoft 美特软件 MetaCRM)
- [CVE-2025-7873](https://cve.now/CVE-2025-7873.md): Metasoft 美特软件 MetaCRM mcc\_login.jsp sql injection (CVSS 5.3, Metasoft 美特软件 MetaCRM)
- [CVE-2025-7872](https://cve.now/CVE-2025-7872.md): Portabilis i-Diario justificativas-de-falta cross site scripting (CVSS 5.1, Portabilis i-Diario)
- [CVE-2025-7871](https://cve.now/CVE-2025-7871.md): Portabilis i-Diario conteudos cross site scripting (CVSS 5.1, Portabilis i-Diario)
- [CVE-2025-7870](https://cve.now/CVE-2025-7870.md): Portabilis i-Diario justificativas-de-falta Endpoint doc\_uploader.rb cross site scripting (CVSS 5.1, Portabilis i-Diario)
- [CVE-2025-7869](https://cve.now/CVE-2025-7869.md): Portabilis i-Educar Turma Module educar\_turma\_tipo\_det.php cross site scripting (CVSS 5.1, Portabilis i-Educar)
- [CVE-2025-7868](https://cve.now/CVE-2025-7868.md): Portabilis i-Educar Calendar educar\_calendario\_dia\_motivo\_cad.php cross site scripting (CVSS 5.1, Portabilis i-Educar)
- [CVE-2025-7867](https://cve.now/CVE-2025-7867.md): Portabilis i-Educar Agenda agenda.php cross site scripting (CVSS 5.1, Portabilis i-Educar)
- [CVE-2025-7866](https://cve.now/CVE-2025-7866.md): Portabilis i-Educar Disabilities Module educar\_deficiencia\_lst.php cross site scripting (CVSS 5.1, Portabilis i-Educar)
- [CVE-2025-7865](https://cve.now/CVE-2025-7865.md): thinkgem JeeSite XSS Filter EncodeUtils.java xssFilter cross site scripting (CVSS 5.1, thinkgem JeeSite)
- [CVE-2025-7864](https://cve.now/CVE-2025-7864.md): thinkgem JeeSite FileUploadController.java upload unrestricted upload (CVSS 5.3, thinkgem JeeSite)
- [CVE-2025-7863](https://cve.now/CVE-2025-7863.md): thinkgem JeeSite ServletUtils.java redirectUrl (CVSS 5.1, thinkgem JeeSite)
- [CVE-2025-7862](https://cve.now/CVE-2025-7862.md): TOTOLINK T6 Telnet Service cstecgi.cgi setTelnetCfg missing authentication (CVSS 6.9, TOTOLINK T6)
- [CVE-2025-53770](https://cve.now/CVE-2025-53770.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 9.8, KEV, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2025-7861](https://cve.now/CVE-2025-7861.md): code-projects Church Donation System search.php sql injection (CVSS 6.9, code-projects Church Donation System)
- [CVE-2025-7860](https://cve.now/CVE-2025-7860.md): code-projects Church Donation System login\_admin.php sql injection (CVSS 6.9, code-projects Church Donation System)
- [CVE-2025-7859](https://cve.now/CVE-2025-7859.md): code-projects Church Donation System update\_password\_admin.php sql injection (CVSS 6.9, code-projects Church Donation System)
- [CVE-2025-47917](https://cve.now/CVE-2025-47917.md): Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. (CVSS 8.9, mbedtls)
- [CVE-2025-48965](https://cve.now/CVE-2025-48965.md): Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls\_asn1\_store\_named\_data can trigger conflicting data with val.p of NULL b (CVSS 4.0, mbedtls)
- [CVE-2025-49087](https://cve.now/CVE-2025-49087.md): In Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing discrepancy in block cipher padding removal allows an attacker to recover the plainte (CVSS 4.0, mbedtls)
- [CVE-2025-54314](https://cve.now/CVE-2025-54314.md): Thor before 1.4.0 can construct an unsafe shell command from library input. (CVSS 2.8, rubyonrails Thor)
- [CVE-2025-54316](https://cve.now/CVE-2025-54316.md): An issue was discovered in Logpoint before 7.6.0. (CVSS 4.9, Logpoint)
- [CVE-2025-54317](https://cve.now/CVE-2025-54317.md): An issue was discovered in Logpoint before 7.6.0. (CVSS 8.4, Logpoint)
- [CVE-2025-54319](https://cve.now/CVE-2025-54319.md): An issue was discovered in Westermo WeOS 5 (5.24 through 5.24.4). (CVSS 6.3, Westermo WeOS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.