# CVEs published 2025-07-24

78 CVEs were published on July 24, 2025: 14 critical, 16 high. Days are UTC.

- [CVE-2025-8124](https://cve.now/CVE-2025-8124.md): deerwms deer-wms-2 unallocatedList sql injection (CVSS 5.3, deerwms deer-wms-2)
- [CVE-2025-7742](https://cve.now/CVE-2025-7742.md): Authentication Bypass in LG Innotek Camera (CVSS 8.3, LG Innotek Camera Model LNV5110R)
- [CVE-2025-0250](https://cve.now/CVE-2025-0250.md): HCL IEM is affected by an authorization token sent in cookie vulnerability (CVSS 2.2, HCL Software IEM)
- [CVE-2025-0249](https://cve.now/CVE-2025-0249.md): HCL IEM is affected by an improper invalidation of access or JWT token vulnerability (CVSS 3.3, HCL Software IEM)
- [CVE-2025-22165](https://cve.now/CVE-2025-22165.md): This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac. (CVSS 5.9, Atlassian Sourcetree for Mac)
- [CVE-2025-54379](https://cve.now/CVE-2025-54379.md): eKuiper API endpoints handling SQL queries with user-controlled table names. (CVSS 8.9, lf-edge ekuiper · ekuiper +2)
- [CVE-2025-53940](https://cve.now/CVE-2025-53940.md): Quiet uses insecure, inconsistent verification on local backend token (CVSS 8.5, TryQuiet quiet)
- [CVE-2025-3614](https://cve.now/CVE-2025-3614.md): ElementsKit Elementor Addons and Templates \<= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Widget (CVSS 6.4, roxnor ElementsKit Elementor Addons – Advanced Widgets & Te…)
- [CVE-2025-32429](https://cve.now/CVE-2025-32429.md): XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter (CVSS 9.3, xwiki-platform · org.xwiki.platform:xwiki-platform-distribu…)
- [CVE-2025-8123](https://cve.now/CVE-2025-8123.md): deerwms deer-wms-2 edit sql injection (CVSS 5.3, deerwms deer-wms-2)
- [CVE-2025-31952](https://cve.now/CVE-2025-31952.md): HCL iAutomate is affected by an insufficient session expiration (CVSS 7.1, HCL Software iAutomate)
- [CVE-2025-31955](https://cve.now/CVE-2025-31955.md): HCL iAutomate is affected by a sensitive data exposure vulnerability (CVSS 7.6, HCL Software iAutomate)
- [CVE-2025-6260](https://cve.now/CVE-2025-6260.md): Network Thermostat X-Series WiFi Thermostats Missing Authentication for Critical Function (CVSS 9.3, Network Thermostat X-Series WiFi thermostats)
- [CVE-2025-7404](https://cve.now/CVE-2025-7404.md): Calibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind C (CVSS 5.9, Calibre Web · Autocaliweb +1)
- [CVE-2025-31953](https://cve.now/CVE-2025-31953.md): HCL iAutomate is affected by hardcoded credentials (CVSS 7.1, HCL Software iAutomate)
- [CVE-2025-6998](https://cve.now/CVE-2025-6998.md): Calibre Web 0.6.24 & Autocaliweb 0.7.0 - ReDoS (CVSS 8.7, Calibre Web · Autocaliweb +1)
- [CVE-2025-8115](https://cve.now/CVE-2025-8115.md): PHPGurukul Taxi Stand Management System new-autoortaxi-entry-form.php cross site scripting (CVSS 5.1, PHPGurukul Taxi Stand Management System)
- [CVE-2025-5039](https://cve.now/CVE-2025-5039.md): Privilege Ecalation due to Untrusted Search Path Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk RealDWG +1)
- [CVE-2025-46993](https://cve.now/CVE-2025-46993.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-46996](https://cve.now/CVE-2025-46996.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-47061](https://cve.now/CVE-2025-47061.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-46410](https://cve.now/CVE-2025-46410.md): A cross-site scripting (xss) vulnerability exists in the managerPlaylists PlaylistOwnerUsersId parameter functionality of WWBN AVideo 14.4 a (CVSS 9.6, WWBN AVideo)
- [CVE-2025-53084](https://cve.now/CVE-2025-53084.md): A cross-site scripting (xss) vulnerability exists in the videosList page parameter functionality of WWBN AVideo 14.4 and dev master commit 8 (CVSS 9.0, WWBN AVideo)
- [CVE-2025-50128](https://cve.now/CVE-2025-50128.md): A cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg parameter functionality of WWBN AVideo 14.4 and dev maste (CVSS 9.6, WWBN AVideo)
- [CVE-2025-36548](https://cve.now/CVE-2025-36548.md): A cross-site scripting (xss) vulnerability exists in the LoginWordPress loginForm cancelUri parameter functionality of WWBN AVideo 14.4 and (CVSS 8.3, WWBN AVideo)
- [CVE-2025-41420](https://cve.now/CVE-2025-41420.md): A cross-site scripting (xss) vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master comm (CVSS 9.6, WWBN AVideo)
- [CVE-2025-25214](https://cve.now/CVE-2025-25214.md): A race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. (CVSS 8.8, WWBN AVideo)
- [CVE-2025-48732](https://cve.now/CVE-2025-48732.md): An incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit 8a8954ff. (CVSS 7.3, WWBN AVideo)
- [CVE-2025-33109](https://cve.now/CVE-2025-33109.md): IBM i privilege escalation (CVSS 7.5, IBM i)
- [CVE-2025-33013](https://cve.now/CVE-2025-33013.md): IBM MQ Operator information disclosure (CVSS 6.2, IBM MQ Operator)
- [CVE-2025-36005](https://cve.now/CVE-2025-36005.md): IBM MQ Operator information disclosure (CVSS 5.9, IBM MQ Operator)
- [CVE-2025-8114](https://cve.now/CVE-2025-8114.md): Libssh: null pointer dereference in libssh kex session id calculation (CVSS 4.7, libssh · Red Hat Enterprise Linux +1)
- [CVE-2025-4784](https://cve.now/CVE-2025-4784.md): SQLi in Moderec's Tourtella (CVSS 9.8, Moderec Tourtella)
- [CVE-2025-4822](https://cve.now/CVE-2025-4822.md): SQLi in Bayraktar Solar Energies' ScadaWatt Otopilot (CVSS 9.8, Bayraktar Solar Energies ScadaWatt Otopilot)
- [CVE-2025-5243](https://cve.now/CVE-2025-5243.md): Arbitrary File Upload in SMG Software's Information Portal (CVSS 10.0, SMG Software Information Portal)
- [CVE-2025-40680](https://cve.now/CVE-2025-40680.md): Encryption of sensitive data in CapillaryScope missing (CVSS 6.9, Capillary io CapillaryScope)
- [CVE-2025-7959](https://cve.now/CVE-2025-7959.md): Station Pro \<= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width and height Parameters (CVSS 6.4, marviorocha Station Pro – Advanced Audio Streaming & Player…)
- [CVE-2025-7690](https://cve.now/CVE-2025-7690.md): Affiliate Plus \<= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, mindnl Affiliate Plus)
- [CVE-2025-7835](https://cve.now/CVE-2025-7835.md): iThoughts Advanced Code Editor \<= 1.2.10 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, gerkin iThoughts Advanced Code Editor)
- [CVE-2025-6588](https://cve.now/CVE-2025-6588.md): FunnelCockpit \<= 1.4.3 - Reflected Cross-Site Scripting via \`error\` Parameter (CVSS 6.1, FunnelCockpit)
- [CVE-2025-7695](https://cve.now/CVE-2025-7695.md): Dataverse Integration 2.77 - 2.81 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via reset\_password\_link REST Route (CVSS 8.8, alexacrm Dataverse Integration)
- [CVE-2025-4608](https://cve.now/CVE-2025-4608.md): Structured Content \<= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc\_fs\_local\_business Shortcode (CVSS 6.4, gorbo Structured Content (JSON-LD) #wpsc)
- [CVE-2025-6382](https://cve.now/CVE-2025-6382.md): Taeggie Feed \<= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Attribute (CVSS 6.4, Taeggie Feed)
- [CVE-2025-6539](https://cve.now/CVE-2025-6539.md): Voltax Video Player \<= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4, minutemedia Voltax Video Player)
- [CVE-2025-3669](https://cve.now/CVE-2025-3669.md): Supreme Addons for Beaver Builder \<= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto\_qrcodesabb Shortcode (CVSS 6.4, ullakalim8 Supreme Addons for Beaver Builder –)
- [CVE-2025-6387](https://cve.now/CVE-2025-6387.md): WP Get The Table \<= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter (CVSS 6.4, jonsisk WP Get The Table)
- [CVE-2025-6262](https://cve.now/CVE-2025-6262.md): muse.ai video embedding \<= 0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via muse-ai Shortcode (CVSS 6.4, museai skiv video embedding)
- [CVE-2025-6385](https://cve.now/CVE-2025-6385.md): WP Applink \<= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter (CVSS 6.4, ejointjp WP Applink)
- [CVE-2025-7822](https://cve.now/CVE-2025-7822.md): WP Wallcreeper \<= 1.6.1 - Missing Authorization to Authenticated (Susbcriber+) Cache Enable/Disable (CVSS 4.3, alexalouit WP Wallcreeper)
- [CVE-2025-6380](https://cve.now/CVE-2025-6380.md): ONLYOFFICE Docs 1.1.0 - 2.2.0 - Missing Authorization to Unauthenticated Privilege Escalation via callback Function (CVSS 9.8, ONLYOFFICE Docs)
- [CVE-2025-8071](https://cve.now/CVE-2025-8071.md): Mine CloudVod \<= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via audio Parameter (CVSS 6.4, 995525477-1 Mine CloudVod LMS)
- [CVE-2025-7966](https://cve.now/CVE-2025-7966.md): Get Youtube Subs \<= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via subscribe\_link\_att Function (CVSS 6.4, zohaib167 Get Youtube Subs)
- [CVE-2025-6441](https://cve.now/CVE-2025-6441.md): Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition \<= 4.03.32 - Unauthenticated Login Token Generation to Authentication Bypass (CVSS 9.8, tobias\_conrad WebinarIgnition – Live, Automated & Evergreen…)
- [CVE-2025-7780](https://cve.now/CVE-2025-7780.md): AI Engine \<= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get\_audio Functions (CVSS 6.5, tigroumeow AI Engine – The Chatbot, AI Framework & MCP for…)
- [CVE-2025-7640](https://cve.now/CVE-2025-7640.md): hiWeb Export Posts \<= 0.9.0.0 - Cross-Site Request Forgery to Arbitrary File Deletion (CVSS 8.1, den-media hiWeb Export Posts)
- [CVE-2025-5084](https://cve.now/CVE-2025-5084.md): Post Grid Master \<= 3.4.13 - Reflected Cross-Site Scripting via argsArray\['read\_more\_text'\] (CVSS 6.1, mdshuvo Post Grid Master — Post Grids & AJAX Filters)
- [CVE-2025-26397](https://cve.now/CVE-2025-26397.md): SolarWinds Observability Self-Hosted Deserialization of Untrusted Data Local Privilege Escalation Vulnerability (CVSS 7.8, SolarWinds Observability Self-Hosted)
- [CVE-2025-8009](https://cve.now/CVE-2025-8009.md): Security Ninja – Secure Firewall & Secure Malware Scanner - 5.201 - 5.242 - Authenticated (Administrator+) Arbitrary File Read (CVSS 4.9, cleverplugins Security Ninja – WordPress Security Plugin &…)
- [CVE-2025-8107](https://cve.now/CVE-2025-8107.md): In OceanBase's Oracle tenant mode, a malicious user with specific privileges can achieve privilege escalation to SYS-level access by executi (CVSS 6.3, OB OceanBase Server)
- [CVE-2025-7745](https://cve.now/CVE-2025-7745.md): Modbus TCP buffer overread (CVSS 5.8, ABB AC500)
- [CVE-2025-41240](https://cve.now/CVE-2025-41240.md): Mounted Kubernetes Secrets under a predictable path located within the web server document root (CVSS 10.0, VMware bitnamicharts/appsmith · VMware bitnamicharts/dru… +1)
- [CVE-2025-0765](https://cve.now/CVE-2025-0765.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-1299](https://cve.now/CVE-2025-1299.md): Missing Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-4976](https://cve.now/CVE-2025-4976.md): Exposure of Sensitive Information Due to Incompatible Policies in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-7001](https://cve.now/CVE-2025-7001.md): Insufficient Granularity of Access Control in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-7437](https://cve.now/CVE-2025-7437.md): Ebook Store \<= 5.8012 - Unauthenticated Arbitrary File Upload (CVSS 9.8, motovnet Ebook Store)
- [CVE-2025-7852](https://cve.now/CVE-2025-7852.md): WPBookit \<= 1.0.6 - Unauthenticated Arbitrary File Upload via image\_upload\_handle Function (CVSS 9.8, iqonicdesign WPBookit)
- [CVE-2025-4968](https://cve.now/CVE-2025-4968.md): WPBakery Page Builder \<= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements (CVSS 6.4, WPBakery Page Builder)
- [CVE-2025-4395](https://cve.now/CVE-2025-4395.md): Medtronic MyCareLink Patient Monitor Empty Password Vulnerability (CVSS 6.8, Medtronic MyCareLink Patient Monitor)
- [CVE-2025-4394](https://cve.now/CVE-2025-4394.md): Medtronic MyCareLink Patient Monitor Unencrypted Filesystem Vulnerability (CVSS 6.8, Medtronic MyCareLink Patient Monitor)
- [CVE-2025-4393](https://cve.now/CVE-2025-4393.md): Medtronic MyCareLink Patient Monitor Deserialization Vulnerability (CVSS 6.5, Medtronic MyCareLink Patient Monitor)
- [CVE-2025-45702](https://cve.now/CVE-2025-45702.md): SoftPerfect Pty Ltd Connection Quality Monitor v1.1 was discovered to store all credentials in plaintext. (CVSS 6.5)
- [CVE-2025-45731](https://cve.now/CVE-2025-45731.md): A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned accounts when a group is deleted while other opera (CVSS 6.5)
- [CVE-2025-51082](https://cve.now/CVE-2025-51082.md): Tenda AC8V4 V16.03.34.06\` was discovered to contain stack overflow at /goform/fast\_setting\_wifi\_set. (CVSS 5.3)
- [CVE-2025-51085](https://cve.now/CVE-2025-51085.md): Tenda AC8V4 V16.03.34.06\` was discovered to contain stack overflow at /goform/SetSysTimeCfg. (CVSS 5.3)
- [CVE-2025-51087](https://cve.now/CVE-2025-51087.md): Tenda AC8V4 V16.03.34.06\` was discovered to contain stack overflow at /goform/saveParentControlInfo. (CVSS 8.6)
- [CVE-2025-51088](https://cve.now/CVE-2025-51088.md): Tenda AC8V4 V16.03.34.06\` was discovered to contain stack overflow at /goform/WifiGuestSet. (CVSS 5.3)
- [CVE-2025-51089](https://cve.now/CVE-2025-51089.md): Tenda AC8V4 V16.03.34.06\` was discovered to contain heap overflow at /goform/GetParentControlInfo.The manipulation of the argument \`mac\` lea (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.