# CVEs published 2025-07-21

232 CVEs were published on July 21, 2025: 23 critical, 138 high. Days are UTC.

- [CVE-2025-7945](https://cve.now/CVE-2025-7945.md): D-Link DIR-513 formSetWanDhcpplus buffer overflow (CVSS 8.7, D-Link DIR-513)
- [CVE-2025-7944](https://cve.now/CVE-2025-7944.md): PHPGurukul Taxi Stand Management System search.php cross site scripting (CVSS 5.3, PHPGurukul Taxi Stand Management System)
- [CVE-2025-7943](https://cve.now/CVE-2025-7943.md): PHPGurukul Taxi Stand Management System search-autoortaxi.php cross site scripting (CVSS 5.3, PHPGurukul Taxi Stand Management System)
- [CVE-2025-7486](https://cve.now/CVE-2025-7486.md): Ebook Store \<= 5.8012 - Authenticated (Administrator+) Stored Cross-Site Scripting via Order Details (CVSS 4.4, motovnet Ebook Store)
- [CVE-2025-7942](https://cve.now/CVE-2025-7942.md): PHPGurukul Taxi Stand Management System admin-profile.php cross site scripting (CVSS 5.1, PHPGurukul Taxi Stand Management System)
- [CVE-2025-7941](https://cve.now/CVE-2025-7941.md): PHPGurukul Time Table Generator System profile.php cross site scripting (CVSS 5.1, PHPGurukul Time Table Generator System)
- [CVE-2025-7940](https://cve.now/CVE-2025-7940.md): Genshin Albedo Cat House App com.house.auscat AndroidManifest.xml improper export of android application components (CVSS 4.8, Genshin Albedo Cat House App)
- [CVE-2025-54134](https://cve.now/CVE-2025-54134.md): HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service (CVSS 7.1, haxtheweb issues · @haxtheweb/haxcms-nodejs)
- [CVE-2025-54129](https://cve.now/CVE-2025-54129.md): HAXiam allows for User Enumeration (CVSS 4.3, haxtheweb issues)
- [CVE-2025-54128](https://cve.now/CVE-2025-54128.md): HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting (CVSS 7.2, haxtheweb issues · @haxtheweb/haxcms-nodejs)
- [CVE-2025-54127](https://cve.now/CVE-2025-54127.md): HAXcms's Insecure Default Configuration Leads to Unauthenticated Access (CVSS 9.3, haxtheweb issues · @haxtheweb/haxcms-nodejs)
- [CVE-2025-7939](https://cve.now/CVE-2025-7939.md): jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java addGoods unrestricted upload (CVSS 5.3, jerryshensjf JPACookieShop 蛋糕商城JPA版)
- [CVE-2025-54122](https://cve.now/CVE-2025-54122.md): Manager-io/Manager allows unauthenticated full read server-side request forgery in "proxy" endpoint (CVSS 10.0, Manager-io Manager)
- [CVE-2025-53832](https://cve.now/CVE-2025-53832.md): @translated/lara-mcp vulnerable to command injection in import\_tmx tool (CVSS 7.5, translated lara-mcp · @translated/lara-mcp)
- [CVE-2025-53528](https://cve.now/CVE-2025-53528.md): Cadwyn is vulnerable to an XSS attack through its docs page (CVSS 7.6, zmievsa cadwyn · cadwyn)
- [CVE-2025-54071](https://cve.now/CVE-2025-54071.md): RomM's authenticated arbitrary file write vulnerability can lead to Remote Code Execution (CVSS 9.4, rommapp romm)
- [CVE-2025-54121](https://cve.now/CVE-2025-54121.md): Starlette has possible denial-of-service vector when parsing large files in multipart forms (CVSS 5.3, encode starlette · starlette)
- [CVE-2025-7299](https://cve.now/CVE-2025-7299.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7325](https://cve.now/CVE-2025-7325.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7324](https://cve.now/CVE-2025-7324.md): IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7323](https://cve.now/CVE-2025-7323.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7322](https://cve.now/CVE-2025-7322.md): IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7321](https://cve.now/CVE-2025-7321.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7320](https://cve.now/CVE-2025-7320.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7319](https://cve.now/CVE-2025-7319.md): IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7318](https://cve.now/CVE-2025-7318.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7317](https://cve.now/CVE-2025-7317.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7316](https://cve.now/CVE-2025-7316.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7315](https://cve.now/CVE-2025-7315.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7314](https://cve.now/CVE-2025-7314.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7313](https://cve.now/CVE-2025-7313.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7938](https://cve.now/CVE-2025-7938.md): jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java updateGoods authorization (CVSS 5.3, jerryshensjf JPACookieShop 蛋糕商城JPA版)
- [CVE-2025-7312](https://cve.now/CVE-2025-7312.md): IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7311](https://cve.now/CVE-2025-7311.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7309](https://cve.now/CVE-2025-7309.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7310](https://cve.now/CVE-2025-7310.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7308](https://cve.now/CVE-2025-7308.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7307](https://cve.now/CVE-2025-7307.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7306](https://cve.now/CVE-2025-7306.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7305](https://cve.now/CVE-2025-7305.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7304](https://cve.now/CVE-2025-7304.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7303](https://cve.now/CVE-2025-7303.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7302](https://cve.now/CVE-2025-7302.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7301](https://cve.now/CVE-2025-7301.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7300](https://cve.now/CVE-2025-7300.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7296](https://cve.now/CVE-2025-7296.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7297](https://cve.now/CVE-2025-7297.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7295](https://cve.now/CVE-2025-7295.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7294](https://cve.now/CVE-2025-7294.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7298](https://cve.now/CVE-2025-7298.md): IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7293](https://cve.now/CVE-2025-7293.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7292](https://cve.now/CVE-2025-7292.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7291](https://cve.now/CVE-2025-7291.md): IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7290](https://cve.now/CVE-2025-7290.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7285](https://cve.now/CVE-2025-7285.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7284](https://cve.now/CVE-2025-7284.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7289](https://cve.now/CVE-2025-7289.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7288](https://cve.now/CVE-2025-7288.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7287](https://cve.now/CVE-2025-7287.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7286](https://cve.now/CVE-2025-7286.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7283](https://cve.now/CVE-2025-7283.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7282](https://cve.now/CVE-2025-7282.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7281](https://cve.now/CVE-2025-7281.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7280](https://cve.now/CVE-2025-7280.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7279](https://cve.now/CVE-2025-7279.md): IrfanView CADImage Plugin CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7278](https://cve.now/CVE-2025-7278.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7274](https://cve.now/CVE-2025-7274.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7277](https://cve.now/CVE-2025-7277.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7276](https://cve.now/CVE-2025-7276.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7275](https://cve.now/CVE-2025-7275.md): IrfanView CADImage Plugin CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7272](https://cve.now/CVE-2025-7272.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7271](https://cve.now/CVE-2025-7271.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7273](https://cve.now/CVE-2025-7273.md): IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7270](https://cve.now/CVE-2025-7270.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7269](https://cve.now/CVE-2025-7269.md): IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7268](https://cve.now/CVE-2025-7268.md): IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7267](https://cve.now/CVE-2025-7267.md): IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7266](https://cve.now/CVE-2025-7266.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7265](https://cve.now/CVE-2025-7265.md): IrfanView CADImage Plugin CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7264](https://cve.now/CVE-2025-7264.md): IrfanView CADImage Plugin CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7263](https://cve.now/CVE-2025-7263.md): IrfanView CADImage Plugin CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7262](https://cve.now/CVE-2025-7262.md): IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7261](https://cve.now/CVE-2025-7261.md): IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7260](https://cve.now/CVE-2025-7260.md): IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7258](https://cve.now/CVE-2025-7258.md): IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7239](https://cve.now/CVE-2025-7239.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7238](https://cve.now/CVE-2025-7238.md): IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7237](https://cve.now/CVE-2025-7237.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7257](https://cve.now/CVE-2025-7257.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7256](https://cve.now/CVE-2025-7256.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7248](https://cve.now/CVE-2025-7248.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7255](https://cve.now/CVE-2025-7255.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7247](https://cve.now/CVE-2025-7247.md): IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7246](https://cve.now/CVE-2025-7246.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7244](https://cve.now/CVE-2025-7244.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7254](https://cve.now/CVE-2025-7254.md): IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7234](https://cve.now/CVE-2025-7234.md): IrfanView CADImage Plugin CGM File Parsing Out-of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7233](https://cve.now/CVE-2025-7233.md): IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, IrfanView)
- [CVE-2025-7253](https://cve.now/CVE-2025-7253.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7249](https://cve.now/CVE-2025-7249.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7243](https://cve.now/CVE-2025-7243.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7242](https://cve.now/CVE-2025-7242.md): IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7241](https://cve.now/CVE-2025-7241.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7240](https://cve.now/CVE-2025-7240.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7236](https://cve.now/CVE-2025-7236.md): IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7250](https://cve.now/CVE-2025-7250.md): IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7235](https://cve.now/CVE-2025-7235.md): IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7252](https://cve.now/CVE-2025-7252.md): IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7251](https://cve.now/CVE-2025-7251.md): IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2025-7231](https://cve.now/CVE-2025-7231.md): INVT VT-Designer PM3 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, INVT VT-Designer)
- [CVE-2025-7230](https://cve.now/CVE-2025-7230.md): INVT VT-Designer PM3 File Parsing Type Confusion Remote Code Execution Vulnerability (CVSS 7.8, INVT VT-Designer)
- [CVE-2025-7229](https://cve.now/CVE-2025-7229.md): INVT VT-Designer PM3 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, INVT VT-Designer)
- [CVE-2025-7228](https://cve.now/CVE-2025-7228.md): INVT VT-Designer PM3 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, INVT VT-Designer)
- [CVE-2025-7227](https://cve.now/CVE-2025-7227.md): INVT VT-Designer PM3 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, INVT VT-Designer)
- [CVE-2025-7226](https://cve.now/CVE-2025-7226.md): INVT HMITool VPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, INVT HMITool)
- [CVE-2025-7225](https://cve.now/CVE-2025-7225.md): INVT HMITool VPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, INVT HMITool)
- [CVE-2025-7224](https://cve.now/CVE-2025-7224.md): INVT HMITool VPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, INVT HMITool)
- [CVE-2025-7223](https://cve.now/CVE-2025-7223.md): INVT HMITool VPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, INVT HMITool)
- [CVE-2025-7222](https://cve.now/CVE-2025-7222.md): Luxion KeyShot 3DM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Luxion KeyShot)
- [CVE-2025-7936](https://cve.now/CVE-2025-7936.md): fuyang\_lipengjun platform ScheduleJobLogController.java queryPage sql injection (CVSS 5.3, fuyang\_lipengjun platform)
- [CVE-2025-7935](https://cve.now/CVE-2025-7935.md): fuyang\_lipengjun platform SysLogController.java SysLogController sql injection (CVSS 5.3, fuyang\_lipengjun platform)
- [CVE-2025-7934](https://cve.now/CVE-2025-7934.md): fuyang\_lipengjun platform ScheduleJobController.java queryPage sql injection (CVSS 5.3, fuyang\_lipengjun platform)
- [CVE-2025-36057](https://cve.now/CVE-2025-36057.md): IBM Cognos Analytics Mobile (iOS) authentication bypass (CVSS 5.2, IBM Cognos Analytics Mobile)
- [CVE-2025-36062](https://cve.now/CVE-2025-36062.md): IBM Cognos Analytics Mobile (iOS) information disclosure (CVSS 5.9, IBM Cognos Analytics Mobile)
- [CVE-2025-36106](https://cve.now/CVE-2025-36106.md): IBM Cognos Analytics Mobile (iOS) information disclosure (CVSS 6.5, IBM Cognos Analytics Mobile)
- [CVE-2025-36107](https://cve.now/CVE-2025-36107.md): IBM Cognos Analytics Mobile (iOS) information disclosure (CVSS 5.9, IBM Cognos Analytics Mobile)
- [CVE-2025-7933](https://cve.now/CVE-2025-7933.md): Campcodes Sales and Inventory System Setting settings\_update.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-52575](https://cve.now/CVE-2025-52575.md): EspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special Elements (CVSS 6.5, espocrm)
- [CVE-2025-7962](https://cve.now/CVE-2025-7962.md): In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \\r and \\n UTF-8 characters to separate (CVSS 6.0, Eclipse Foundation Jakarta Mail · org.eclipse.angus:smtp +1)
- [CVE-2025-7932](https://cve.now/CVE-2025-7932.md): D-Link DIR‑817L ssdpcgi lxmldbc\_system command injection (CVSS 5.3, D-Link DIR‑817L)
- [CVE-2025-7717](https://cve.now/CVE-2025-7717.md): File Download - Moderately critical - Access bypass - SA-CONTRIB-2025-089 (CVSS 7.5, Drupal File Download · drupal/file\_download)
- [CVE-2025-7716](https://cve.now/CVE-2025-7716.md): Real-time SEO for Drupal - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-091 (CVSS 6.1, Real-time SEO for Drupal · drupal/yoast\_seo)
- [CVE-2025-7715](https://cve.now/CVE-2025-7715.md): Block Attributes - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-090 (CVSS 6.1, Drupal Block Attributes · drupal/block\_attributes)
- [CVE-2025-7392](https://cve.now/CVE-2025-7392.md): Cookies Addons - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-087 (CVSS 6.1, Drupal Cookies Addons · drupal/cookies\_addons)
- [CVE-2025-7393](https://cve.now/CVE-2025-7393.md): Mail Login - Critical - Access bypass - SA-CONTRIB-2025-088 (CVSS 9.8, Drupal Mail Login · drupal/mail\_login)
- [CVE-2025-30477](https://cve.now/CVE-2025-30477.md): Dell PowerScale OneFS, versions prior to 9.11.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. (CVSS 4.4, Dell PowerScale OneFS)
- [CVE-2025-7931](https://cve.now/CVE-2025-7931.md): code-projects Church Donation System admin\_pic.php unrestricted upload (CVSS 6.9, code-projects Church Donation System)
- [CVE-2025-32744](https://cve.now/CVE-2025-32744.md): Dell AppSync, version(s) 4.6.0.0, contains an Unrestricted Upload of File with Dangerous Type vulnerability. (CVSS 6.6, Dell AppSync)
- [CVE-2025-54082](https://cve.now/CVE-2025-54082.md): nova-tiptap has an Unauthenticated Arbitrary File Upload Vulnerability (CVSS 8.1, marshmallow-packages nova-tiptap · marshmallow/nova-tipt… +1)
- [CVE-2025-36603](https://cve.now/CVE-2025-36603.md): Dell AppSync, version(s) 4.6.0.0, contains an Improper Restriction of XML External Entity Reference vulnerability. (CVSS 4.2, Dell AppSync)
- [CVE-2025-7930](https://cve.now/CVE-2025-7930.md): code-projects Church Donation System add\_members.php sql injection (CVSS 6.9, code-projects Church Donation System)
- [CVE-2025-7929](https://cve.now/CVE-2025-7929.md): code-projects Church Donation System edit\_Members.php sql injection (CVSS 6.9, code-projects Church Donation System)
- [CVE-2025-7928](https://cve.now/CVE-2025-7928.md): code-projects Church Donation System edit\_user.php sql injection (CVSS 6.9, code-projects Church Donation System)
- [CVE-2025-7927](https://cve.now/CVE-2025-7927.md): PHPGurukul Online Banquet Booking System view-user-queries.php sql injection (CVSS 5.3, PHPGurukul Online Banquet Booking System)
- [CVE-2025-6235](https://cve.now/CVE-2025-6235.md): ExtremeControl (NAC) 'onmouseover' XSS (CVSS 5.3, Extreme Networks ExtremeControl)
- [CVE-2025-4130](https://cve.now/CVE-2025-4130.md): Hardcoded Credentials in PAVO Inc.'s PAVO Pay (CVSS 7.5, PAVO Pay)
- [CVE-2025-4129](https://cve.now/CVE-2025-4129.md): IDOR in PAVO Inc.'s PAVO Pay (CVSS 7.5, PAVO Pay)
- [CVE-2024-13973](https://cve.now/CVE-2024-13973.md): A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to adminis (CVSS 6.8, Sophos Firewall)
- [CVE-2024-13974](https://cve.now/CVE-2024-13974.md): A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers contro (CVSS 8.1, Sophos Firewall)
- [CVE-2025-7926](https://cve.now/CVE-2025-7926.md): PHPGurukul Online Banquet Booking System booking-search.php cross site scripting (CVSS 5.1, PHPGurukul Online Banquet Booking System)
- [CVE-2025-7382](https://cve.now/CVE-2025-7382.md): A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achiev (CVSS 8.8, Sophos Firewall)
- [CVE-2025-7624](https://cve.now/CVE-2025-7624.md): An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to r (CVSS 9.8, Sophos Firewall)
- [CVE-2025-6704](https://cve.now/CVE-2025-6704.md): An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) ca (CVSS 9.8, Sophos Firewall)
- [CVE-2025-30192](https://cve.now/CVE-2025-30192.md): A Recursor configured to send out ECS enabled queries can be sensitive to spoofing attempts (CVSS 7.5, PowerDNS Recursor)
- [CVE-2025-41100](https://cve.now/CVE-2025-41100.md): Incorrect authentication in ParkingDoor (CVSS 5.9, ParkingDoor)
- [CVE-2025-7925](https://cve.now/CVE-2025-7925.md): PHPGurukul Online Banquet Booking System login.php cross site scripting (CVSS 5.3, PHPGurukul Online Banquet Booking System)
- [CVE-2025-4040](https://cve.now/CVE-2025-4040.md): IDOR in Turpak's Automatic Station Monitoring System (CVSS 7.1, Turpak Automatic Station Monitoring System)
- [CVE-2025-2301](https://cve.now/CVE-2025-2301.md): IDOR in Akbim Software's Online Exam Registration (CVSS 4.4, Akbim Software Online Exam Registration)
- [CVE-2025-5681](https://cve.now/CVE-2025-5681.md): IDOR in Turtek Software's Eyotek (CVSS 6.5, Turtek Software Eyotek)
- [CVE-2025-7924](https://cve.now/CVE-2025-7924.md): PHPGurukul Online Banquet Booking System admin-profile.php cross site scripting (CVSS 5.1, PHPGurukul Online Banquet Booking System)
- [CVE-2025-41459](https://cve.now/CVE-2025-41459.md): Insecure authentication due to missing bruteforce protection and runtime manipulation in Two App Studio Journey 5.5.6 for iOS (CVSS 7.8, Two App Studio Journey)
- [CVE-2025-41458](https://cve.now/CVE-2025-41458.md): Insecure data storage vulnerability in Two App Studio Journey v5.5.9 for iOS (CVSS 5.5, Two App Studio Journey)
- [CVE-2025-50151](https://cve.now/CVE-2025-50151.md): Apache Jena: Configuration files uploaded by administrative users are not check properly (CVSS 8.8, Apache Software Foundation Apache Jena · org.apache.jena:je…)
- [CVE-2025-41681](https://cve.now/CVE-2025-41681.md): Persistent Cross-Site Scripting via POST Requests Due to Improper Neutralization of Input (CVSS 4.8, MB connect line mbNET.mini · Helmholz REX)
- [CVE-2025-41679](https://cve.now/CVE-2025-41679.md): Unauthenticated Buffer Overflow in Conftool Service Leading to Denial of Service (CVSS 5.3, MB connect line mbNET.mini · Helmholz REX)
- [CVE-2025-41678](https://cve.now/CVE-2025-41678.md): SQL Injection via POST Requests Allowing Configuration Database Manipulation (CVSS 6.5, MB connect line mbNET.mini · Helmholz REX)
- [CVE-2025-49656](https://cve.now/CVE-2025-49656.md): Apache Jena: Administrative users can create files outside the server directory space via the admin UI (CVSS 7.5, Apache Software Foundation Apache Jena · org.apache.jena:je…)
- [CVE-2025-41677](https://cve.now/CVE-2025-41677.md): Resource Exhaustion via POST Requests to send-mail Action (CVSS 4.9, MB connect line mbNET.mini · Helmholz REX)
- [CVE-2025-41676](https://cve.now/CVE-2025-41676.md): Resource Exhaustion via POST Requests to send-sms Action (CVSS 4.9, MB connect line mbNET.mini · Helmholz REX)
- [CVE-2025-41675](https://cve.now/CVE-2025-41675.md): Remote Command Injection via GET in Cloud Server Communication Script Due to Improper Input Neutralization (CVSS 7.2, MB connect line mbNET.mini · Helmholz REX)
- [CVE-2025-41674](https://cve.now/CVE-2025-41674.md): Remote Command Injection in diagnostic Action Due to Improper Input Neutralization (CVSS 7.2, MB connect line mbNET.mini · Helmholz REX)
- [CVE-2025-41673](https://cve.now/CVE-2025-41673.md): Remote Command Injection in send\_sms Action Due to Improper Input Neutralization (CVSS 7.2, MB connect line mbNET.mini · Helmholz REX)
- [CVE-2024-6107](https://cve.now/CVE-2024-6107.md): Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. (CVSS 9.6, Canonical MAAS)
- [CVE-2025-1469](https://cve.now/CVE-2025-1469.md): IDOR in Turtek Software's Eyotek (CVSS 7.5, Turtek Software Eyotek)
- [CVE-2025-4570](https://cve.now/CVE-2025-4570.md): An insecure sensitive key storage issue was found in MyASUS. (CVSS 6.9, MyASUS)
- [CVE-2025-4569](https://cve.now/CVE-2025-4569.md): An insecure sensitive key storage issue was found in MyASUS. (CVSS 7.7, MyASUS)
- [CVE-2025-4049](https://cve.now/CVE-2025-4049.md): Hardcoded SQLite password in FARA (CVSS 8.6, SIGNUM-NET FARA)
- [CVE-2025-7354](https://cve.now/CVE-2025-7354.md): WP Shortcodes Plugin — Shortcodes Ultimate \<= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes (CVSS 6.4, gn\_themes WP Shortcodes Plugin — Shortcodes Ultimate)
- [CVE-2025-7369](https://cve.now/CVE-2025-7369.md): Shortcodes Ultimate \<= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution (CVSS 6.1, gn\_themes WP Shortcodes Plugin — Shortcodes Ultimate)
- [CVE-2025-4685](https://cve.now/CVE-2025-4685.md): Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor \<= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Ed…)
- [CVE-2025-0664](https://cve.now/CVE-2025-0664.md): A locally authenticated, privileged user can craft a malicious OpenSSL configuration file, potentially leading the agent to load an arbitrar (CVSS 6.7, Trellix Endpoint Security (HX) Agent)
- [CVE-2025-7920](https://cve.now/CVE-2025-7920.md): Simopro Technology｜WinMatrix3 Web package - Reflected Cross-Site Scripting (CVSS 6.1, Simopro Technology WinMatrix3 Web package)
- [CVE-2025-7344](https://cve.now/CVE-2025-7344.md): Digiwin｜EAI - Privilege Escalation (CVSS 8.7, Digiwin EAI)
- [CVE-2025-7343](https://cve.now/CVE-2025-7343.md): Digiwin｜SFT - SQL Injection (CVSS 9.3, Digiwin SFT)
- [CVE-2025-7921](https://cve.now/CVE-2025-7921.md): ASKEY｜modem - Stack-based Buffer Overflow (CVSS 9.3, ASKEY RTF8207w · ASKEY RTF8217)
- [CVE-2025-24938](https://cve.now/CVE-2025-24938.md): Insufficient Validation of Input while user creation (CVSS 8.4, Nokia WaveSuite NOC)
- [CVE-2025-24937](https://cve.now/CVE-2025-24937.md): Access to local file system and its content (CVSS 9.0, Nokia WaveSuite NOC)
- [CVE-2025-24936](https://cve.now/CVE-2025-24936.md): Insufficient Validation of Input in the URL (CVSS 9.0, Nokia WaveSuite NOC)
- [CVE-2025-7919](https://cve.now/CVE-2025-7919.md): Simopro Technology｜WinMatrix3 Web package - SQL Injection (CVSS 7.1, Simopro Technology WinMatrix3 Web package)
- [CVE-2025-7918](https://cve.now/CVE-2025-7918.md): Simopro Technology｜WinMatrix3 Web package - SQL Injection (CVSS 9.3, Simopro Technology WinMatrix3 Web package)
- [CVE-2025-7917](https://cve.now/CVE-2025-7917.md): Simopro Technology｜WinMatrix3 Web package - Arbitrary File Upload (CVSS 8.6, Simopro Technology WinMatrix3 Web package)
- [CVE-2025-7916](https://cve.now/CVE-2025-7916.md): Simopro Technology｜WinMatrix3 - Insecure Deserialization (CVSS 9.3, Simopro Technology WinMatrix3)
- [CVE-2025-7915](https://cve.now/CVE-2025-7915.md): Chanjet CRM Login Page mailinactive.php sql injection (CVSS 6.9, Chanjet CRM)
- [CVE-2025-7914](https://cve.now/CVE-2025-7914.md): Tenda AC6 httpd setparentcontrolinfo buffer overflow (CVSS 8.7, Tenda AC6)
- [CVE-2020-26799](https://cve.now/CVE-2020-26799.md): A reflected cross-site scripting (XSS) vulnerability was discovered in index.php on Luxcal 4.5.2 which allows an unauthenticated attacker to (CVSS 9.8)
- [CVE-2024-55040](https://cve.now/CVE-2024-55040.md): Cross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6.5.H and before allows a remote attacker to execute arbitrary (CVSS 6.1)
- [CVE-2025-36845](https://cve.now/CVE-2025-36845.md): An issue was discovered in Eveo URVE Web Manager 27.02.2025. (CVSS 8.6)
- [CVE-2025-36846](https://cve.now/CVE-2025-36846.md): An issue was discovered in Eveo URVE Web Manager 27.02.2025. (CVSS 9.8)
- [CVE-2025-43720](https://cve.now/CVE-2025-43720.md): Headwind MDM before 5.33.1 makes configuration details accessible to unauthorized users. (CVSS 6.5)
- [CVE-2025-43976](https://cve.now/CVE-2025-43976.md): The com.enflick.android.tn2ndLine application through 24.17.1.0 for Android enables any installed application (with no permissions) to place (CVSS 4.3)
- [CVE-2025-43977](https://cve.now/CVE-2025-43977.md): The com.skt.prod.dialer application through 12.5.0 for Android enables any installed application (with no permissions) to place phone calls (CVSS 4.3)
- [CVE-2025-44647](https://cve.now/CVE-2025-44647.md): In TRENDnet TEW-WLC100P 2.03b03, the i\_dont\_care\_about\_security\_and\_use\_aggressive\_mode\_psk option is enabled in the strongSwan configuratio (CVSS 7.3)
- [CVE-2025-44649](https://cve.now/CVE-2025-44649.md): In the configuration file of racoon in the TRENDnet TEW-WLC100P 2.03b03, the first item of exchage\_mode is set to aggressive. (CVSS 7.5)
- [CVE-2025-44650](https://cve.now/CVE-2025-44650.md): In Netgear R7000 V1.3.1.64\_10.1.36 and EAX80 V1.0.1.70\_1.0.2, the USERLIMIT\_GLOBAL option is set to 0 in the bftpd.conf configuration file. (CVSS 7.5)
- [CVE-2025-44651](https://cve.now/CVE-2025-44651.md): In TRENDnet TPL-430AP FW1.0, the USERLIMIT\_GLOBAL option is set to 0 in the bftpd-related configuration file. (CVSS 7.5)
- [CVE-2025-44652](https://cve.now/CVE-2025-44652.md): In Netgear RAX30 V1.0.10.94\_3, the USERLIMIT\_GLOBAL option is set to 0 in multiple bftpd-related configuration files. (CVSS 7.5)
- [CVE-2025-44653](https://cve.now/CVE-2025-44653.md): In H3C GR2200 MiniGR1A0V100R016, the USERLIMIT\_GLOBAL option is set to 0 in the /etc/bftpd.conf. (CVSS 7.5)
- [CVE-2025-44654](https://cve.now/CVE-2025-44654.md): In Linksys E2500 3.0.04.002, the chroot\_local\_user option is enabled in the vsftpd configuration file. (CVSS 9.8)
- [CVE-2025-44655](https://cve.now/CVE-2025-44655.md): In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot\_local\_user option is enabled in the vsftpd.conf. (CVSS 9.8)
- [CVE-2025-44657](https://cve.now/CVE-2025-44657.md): In Linksys EA6350 V2.1.2, the chroot\_local\_user option is enabled in the dynamically generated vsftpd configuration file. (CVSS 3.9)
- [CVE-2025-44658](https://cve.now/CVE-2025-44658.md): In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php (CVSS 9.8)
- [CVE-2025-46116](https://cve.now/CVE-2025-46116.md): An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5. (CVSS 8.8)
- [CVE-2025-46117](https://cve.now/CVE-2025-46117.md): An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5. (CVSS 9.1)
- [CVE-2025-46118](https://cve.now/CVE-2025-46118.md): An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139 and in Ruckus ZoneDirector prior to 10.5.1 (CVSS 5.3)
- [CVE-2025-46119](https://cve.now/CVE-2025-46119.md): An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5. (CVSS 6.3)
- [CVE-2025-46120](https://cve.now/CVE-2025-46120.md): An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5. (CVSS 9.8)
- [CVE-2025-46121](https://cve.now/CVE-2025-46121.md): An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the functions \`stamgr\_cfg\_adpt\_addS (CVSS 9.8)
- [CVE-2025-46122](https://cve.now/CVE-2025-46122.md): An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the authenticated diagnostics API e (CVSS 9.1)
- [CVE-2025-46123](https://cve.now/CVE-2025-46123.md): An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5. (CVSS 7.2)
- [CVE-2025-51396](https://cve.now/CVE-2025-51396.md): A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via in (CVSS 5.4)
- [CVE-2025-51397](https://cve.now/CVE-2025-51397.md): A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrar (CVSS 5.4)
- [CVE-2025-51398](https://cve.now/CVE-2025-51398.md): A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute ar (CVSS 5.4)
- [CVE-2025-51400](https://cve.now/CVE-2025-51400.md): A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbi (CVSS 5.4)
- [CVE-2025-51401](https://cve.now/CVE-2025-51401.md): A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitr (CVSS 5.4)
- [CVE-2025-51403](https://cve.now/CVE-2025-51403.md): A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers (CVSS 6.5)
- [CVE-2025-51868](https://cve.now/CVE-2025-51868.md): Insecure Direct Object Reference (IDOR) vulnerability in Dippy (chat.dippy.ai) v2 allows attackers to gain sensitive information via the con (CVSS 7.5)
- [CVE-2025-51869](https://cve.now/CVE-2025-51869.md): Insecure Direct Object Reference (IDOR) vulnerability in Liner thru 2025-06-03 allows attackers to gain sensitive information via crafted sp (CVSS 7.5)
- [CVE-2025-52362](https://cve.now/CVE-2025-52362.md): Server-Side Request Forgery (SSRF) vulnerability exists in the URL processing functionality of PHProxy version 1.1.1 and prior. (CVSS 9.1)
- [CVE-2025-52372](https://cve.now/CVE-2025-52372.md): An issue in hMailServer v.5.8.6 allows a local attacker to obtain sensitive information via the hmailserver/installation/hMailServerInnoExte (CVSS 5.1)
- [CVE-2025-52373](https://cve.now/CVE-2025-52373.md): Use of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in database (CVSS 4.6)
- [CVE-2025-52374](https://cve.now/CVE-2025-52374.md): Use of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords to other server (CVSS 4.6)
- [CVE-2025-54352](https://cve.now/CVE-2025-54352.md): WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. (CVSS 3.7, WordPress)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.