CVEs published July 31, 2025
111 CVEs were published on July 31, 2025: 17 critical, 24 high.
- Published
- 111
- Critical
- 17
- High
- 24
- Medium
- 64
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- code-projects Vehicle Management
- 7
- Portabilis i-Educar
- 7
- Alfasado PowerCMS
- 6
- Campcodes Online Hotel Reservation System
- 5
- AcademySoftwareFoundation openexr · openexr
- 3
- devitemsllc HT Mega Addons for Elementor – Elementor Widget…
- 3
- Hewlett Packard Enterprise HPE Telco Network Function Virtu…
- 3
- OPEXUS FOIAXpress Public Access Link
- 3
- code-projects Exam Form Submission
- 2
- code-projects Intern Membership Management System
- 2
Critical 17
- CVE-2025-8286Güralp Systems FMUS Series and MIN Series DevicesGüralp Systems Güralp FMUS Series · Güralp Systems MIN Seri…
- CVE-2025-8426Marvell QConvergeConsole compressConfigFiles Directory Traversal Information Disclosure and Denial-of-Service VulnerabilityMarvell QConvergeConsole
- CVE-2013-10037WebTester 5.x install2.php Unauthenticated Command ExecutionEppler Software WebTester
- CVE-2014-125126Simple E-Document Arbitrary File Upload RCESimple E-Document
- CVE-2014-125124Pandora FMS <= 5.0RC1 Anyterm Unauthenticated Command InjectionArtica ST Pandora FMS
- CVE-2014-125123Kloxo < 6.1.12 Unauthenticated SQL Injection RCELXCenter Kloxo
- CVE-2013-10033Kimai 0.9.2 db_restore.php SQL InjectionKimai Project Kimai
- CVE-2013-10034Kaseya < 6.3.0.2 uploadImage.asp Arbitrary File Upload RCEKaseya KServer
- CVE-2013-10042freeFTPd <= 1.0.10 PASS Command Stack-Based Buffer OverflowfreeFTPd
- CVE-2013-10038FlashChat Arbitrary File Upload RCETUFaT FlashChat
- CVE-2012-10021D-Link DIR-605L Captcha Handling Buffer OverflowD-Link DIR-605L
- CVE-2013-10040ClipBucket <= 2.6 ofc_upload_image.php Arbitrary File Upload RCEClipBucket
- CVE-2013-10043Astium VOIP PBX <= 2.1 SQL Injection File Upload RCEAstium VoIP PBX
- CVE-2014-125121Array Networks vAPV and vxAG Default Credential Privilege EscalationArray Networks vAPV · Array Networks vxAG
- CVE-2025-26062An access control issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to access the router's settings file
- CVE-2025-26063An issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to execute arbitrary code via injecting a crafted pa
- CVE-2025-50475An OS command injection vulnerability exists in Russound MBX-PRE-D67F firmware version 3.1.6, allowing unauthenticated attackers to execute
High 24
- CVE-2025-48071OpenEXR's Forged Unpacked Size can Lead to Heap-Based Buffer Overflow in Deep Scanline ParsingAcademySoftwareFoundation openexr · openexr
- CVE-2013-10035ProcessMaker Open Source < 2.5.2 neoclassic Skin PHP Code ExecutionProcessMaker Open Source
- CVE-2025-34146nyariv sandboxjs 0.8.23 Prototype Pollution Sandbox Escape DoSnyariv sandboxjs · @nyariv/sandboxjs
- CVE-2011-10008MPlayer Lite r33064 M3U Stack-Based Buffer OverflowMPlayer Project MPlayer Lite
- CVE-2013-10039GestioIP 3.0 ip_checkhost.cgi RCEGestioIP IPAM
- CVE-2013-10036Beetel Connection Manager NetConfig.ini Stack-Based Buffer OverflowBeetel Teletech Connection Manager
- CVE-2014-125125A10 Networks AX Loadbalancer Path TraversalA10 Networks AX Series Loadbalancer
- CVE-2025-8213NinjaScanner – Virus & Malware scan <= 3.2.5 - Authenticated (Administrator+) Arbitrary File Deletionnintechnet NinjaScanner – Virus & Malware scan
- CVE-2025-2813HTTP Service DoS VulnerabilityPhoenix Contact AXL F BK PN TPS · Phoenix Contact AXL F… +7
- CVE-2025-41688High Privilege RCE via LUA Sandbox EscapeMB connect line mbNET HW1 · MB connect line mbNET/mbNET.… +1
- CVE-2025-24853Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processingApache Software Foundation Apache JSPWiki · org.apache.j… +1
- CVE-2025-46359A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS.Alfasado PowerCMS
- CVE-2025-53558ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K.ZTE Japan. K.K. ZXHN-F660T · ZTE Japan. K.K. ZXHN-F660A
- CVE-2025-7847AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Uploadtigroumeow AI Engine
- CVE-2025-26064A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts o
- CVE-2025-29556ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control.
- CVE-2025-45768pyjwt v2.10.1 was discovered to contain weak encryption.pyjwt
- CVE-2025-45770jwt v5.4.3 was discovered to contain weak encryption.
- CVE-2025-50572Archer 6.11.00204.10014 allows attackers to execute arbitrary code via crafted system inputs that would be exported into the CSV and be exec
- CVE-2025-50849CS Cart 4.18.3 is vulnerable to Insecure Direct Object Reference (IDOR).
- CVE-2025-50850An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verificati
- CVE-2025-51503A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fieldmicroweber/microweber
- CVE-2025-52203A stored cross-site scripting (XSS) vulnerability exists in DevaslanPHP project-management v1.2.4.
- CVE-2025-52289A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a craf
Medium, low and unrated 70
- CVE-2023-32251Kernel: ksmbd brute force delay bypass via asynchronous requestslinux · Red Hat Enterprise Linux
- CVE-2025-23289NVIDIA Omniverse Launcher for Windows and Linux contains a vulnerability in the launcher logs, where a user could cause sensitive informatioNVIDIA Omniverse Launcher
- CVE-2025-48073OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" ModeAcademySoftwareFoundation openexr · openexr
- CVE-2025-48072OpenEXR's Inaccurate Pointer Arithmetic can Cause an Out of Bounds HeapAcademySoftwareFoundation openexr · openexr
- CVE-2025-37112Hard-Coded Encryption Keys found in SystemHewlett Packard Enterprise HPE Telco Network Function Virtu…
- CVE-2025-37111Hard-Coded Authentication Keys found in SystemHewlett Packard Enterprise HPE Telco Network Function Virtu…
- CVE-2025-37110Sensitive Credential Information stored insecurely in System DatabaseHewlett Packard Enterprise HPE Telco Network Function Virtu…
- CVE-2025-37109HPE Telco Service Activator, Protection Mechanism FailureHewlett Packard Enterprise (HPE) HPE Telco Service Activator
- CVE-2025-37108HPE Telco Service Activator, Protection Mechanism FailureHewlett Packard Enterprise (HPE) HPE Telco Service Activator
- CVE-2025-54833OPEXUS FOIAXpress Public Access Link (PAL) account-lockout and CAPTCHA protection bypassOPEXUS FOIAXpress Public Access Link
- CVE-2025-54834OPEXUS FOIAXpress Public Access Link (PAL) unauthenticated username enumerationOPEXUS FOIAXpress Public Access Link
- CVE-2025-54832OPEXUS FOIAXpress Public Access Link (PAL) state and territory list unauthorized modificationOPEXUS FOIAXpress Public Access Link
- CVE-2025-8409code-projects Vehicle Management filter.php sql injectioncode-projects Vehicle Management
- CVE-2025-46809Multi Linux Manager epxoses the plain text HTTP Proxy user:password in logsContainer suse/manager/4.3/proxy-httpd:4.3.16.9.67.1 ·… +11
- CVE-2025-8408code-projects Vehicle Management filter1.php sql injectioncode-projects Vehicle Management
- CVE-2014-125122Linksys WRT120N tmUnblock.cgi Stack-Based Buffer Overflow Admin Password ResetLinksys WRT120N
- CVE-2025-7738Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aapdjango-ansible-base · Red Hat Ansible Automation Platform 2…
- CVE-2025-8407code-projects Vehicle Management filter2.php sql injectioncode-projects Vehicle Management
- CVE-2025-54589copyparty Reflected XSS via Filter Parameter9001 copyparty · copyparty
- CVE-2025-8382Campcodes Online Hotel Reservation System edit_room.php sql injectionCampcodes Online Hotel Reservation System
- CVE-2025-8381Campcodes Online Hotel Reservation System add_reserve.php sql injectionCampcodes Online Hotel Reservation System
- CVE-2025-8068HT Mega – Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actionsdevitemsllc HT Mega Addons for Elementor – Elementor Widget…
- CVE-2025-8401HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposuredevitemsllc HT Mega Addons for Elementor – Elementor Widget…
- CVE-2025-8151HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actionsdevitemsllc HT Mega Addons for Elementor – Elementor Widget…
- CVE-2025-8380Campcodes Online Hotel Reservation System add_query_account.php cross site scriptingCampcodes Online Hotel Reservation System
- CVE-2025-8379Campcodes Online Hotel Reservation System edit_room.php unrestricted uploadCampcodes Online Hotel Reservation System
- CVE-2025-8378Campcodes Online Hotel Reservation System Login index.php sql injectionCampcodes Online Hotel Reservation System
- CVE-2025-40980dddUltimateFosters UltimatePOS
- CVE-2025-8376code-projects Vehicle Management updatebal.php sql injectioncode-projects Vehicle Management
- CVE-2025-8375code-projects Vehicle Management addvehicle.php sql injectioncode-projects Vehicle Management
- CVE-2025-24854Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image pluginApache Software Foundation Apache JSPWiki · org.apache.jspw…
- CVE-2025-8374code-projects Vehicle Management addcompany.php sql injectioncode-projects Vehicle Management
- CVE-2025-8192Race condition in AndroidTV TvSettingsAndroid TV
- CVE-2025-8373code-projects Vehicle Management print.php sql injectioncode-projects Vehicle Management
- CVE-2025-8372code-projects Exam Form Submission update_s7.php sql injectioncode-projects Exam Form Submission
- CVE-2025-36563Reflected cross-site scripting vulnerability exists in multiple versions of PowerCMS.Alfasado PowerCMS
- CVE-2025-41391Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS.Alfasado PowerCMS
- CVE-2025-7205GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scriptingstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2025-41396A path traversal issue exists in file uploading feature of multiple versions of PowerCMS.Alfasado PowerCMS
- CVE-2025-54752Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file.Alfasado PowerCMS
- CVE-2025-54757Multiple versions of PowerCMS allow unrestricted upload of dangerous files.Alfasado PowerCMS
- CVE-2025-8371code-projects Exam Form Submission update_s5.php sql injectioncode-projects Exam Form Submission
- CVE-2025-8370Portabilis i-Educar educar_escolaridade_lst.php cross site scriptingPortabilis i-Educar
- CVE-2025-8369Portabilis i-Educar educar_avaliacao_desempenho_lst.php cross site scriptingPortabilis i-Educar
- CVE-2025-8368Portabilis i-Educar pesquisa_pessoa_lst.php cross site scriptingPortabilis i-Educar
- CVE-2025-8367Portabilis i-Educar funcionario_vinculo_lst.php cross site scriptingPortabilis i-Educar
- CVE-2025-8366Portabilis i-Educar educar_servidor_lst.php cross site scriptingPortabilis i-Educar
- CVE-2025-5720Customer Reviews for WooCommerce <= 5.80.2 - Unauthenticated Stored Cross-Site Scripting via `author` Parameterivole Customer Reviews for WooCommerce
- CVE-2025-8365Portabilis i-Educar atendidos_cad.php cross site scriptingPortabilis i-Educar
- CVE-2025-8348Kehua Charging Pile Cloud Platform home improper authenticationKehua Charging Pile Cloud Platform
- CVE-2025-8347Kehua Charging Pile Cloud Platform findAllTask sql injectionKehua Charging Pile Cloud Platform
- CVE-2025-8346Portabilis i-Educar educar_aluno_lst.php cross site scriptingPortabilis i-Educar
- CVE-2025-8345Shanghai Lingdang Information Technology Lingdang CRM yunzhijiaApi.php delete_user sql injectionShanghai Lingdang Information Technology Lingdang CRM
- CVE-2025-8344openviglet shio ShStaticFileAPI.java shStaticFileUpload unrestricted uploadopenviglet shio
- CVE-2025-8343openviglet shio ShStaticFileAPI.java shStaticFilePreUpload path traversalopenviglet shio
- CVE-2025-8340code-projects Intern Membership Management System Error Message fill_details.php cross site scriptingcode-projects Intern Membership Management System
- CVE-2025-8339code-projects Intern Membership Management System student_login.php sql injectioncode-projects Intern Membership Management System
- CVE-2024-34327Sielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the password reset form.
- CVE-2024-34328An open redirect in Sielox AnyWare v2.1.2 allows attackers to execute a man-in-the-middle attack via a crafted URL.
- CVE-2025-29557ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where users with operator-leve
- CVE-2025-45769php-jwt v6.11.0 was discovered to contain weak encryption.firebase/php-jwt
- CVE-2025-50270A stored Cross Site Scripting (xss) vulnerability in the "content management" feature in AnQiCMS v.3.4.11 allows a remote attacker to execut
- CVE-2025-50847Cross Site Request Forgery (CSRF) vulnerability in CS Cart 4.18.3, allows attackers to add products to a user's comparison list via a crafte
- CVE-2025-50848A file upload vulnerability was discovered in CS Cart 4.18.3, allows attackers to execute arbitrary code.
- CVE-2025-50866CloudClassroom-PHP-Project 1.0 contains a reflected Cross-site Scripting (XSS) vulnerability in the email parameter of the postquerypublic e
- CVE-2025-50867A SQL Injection vulnerability exists in the takeassessment2.php endpoint of the CloudClassroom-PHP-Project 1.0, where the Q5 POST parameter
- CVE-2025-51383D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_road_asp function via the host_ip parameter.
- CVE-2025-51384D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_net_asp function via the remot_ip parameter.
- CVE-2025-51385D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the yyxz_dlink_asp function via the id parameter.
- CVE-2025-51569A cross-site scripting (XSS) vulnerability exists in the LB-Link BL-CPE300M 01.01.02P42U14_06 router's web interface.