# CVEs published 2025-07-31

111 CVEs were published on July 31, 2025: 17 critical, 24 high. Days are UTC.

- [CVE-2023-32251](https://cve.now/CVE-2023-32251.md): Kernel: ksmbd brute force delay bypass via asynchronous requests (CVSS 3.7, linux · Red Hat Enterprise Linux)
- [CVE-2025-23289](https://cve.now/CVE-2025-23289.md): NVIDIA Omniverse Launcher for Windows and Linux contains a vulnerability in the launcher logs, where a user could cause sensitive informatio (CVSS 5.5, NVIDIA Omniverse Launcher)
- [CVE-2025-48073](https://cve.now/CVE-2025-48073.md): OpenEXR ScanLineProcess::run\_fill NULL Pointer Write In "reduceMemory" Mode (CVSS 4.6, AcademySoftwareFoundation openexr · openexr)
- [CVE-2025-48072](https://cve.now/CVE-2025-48072.md): OpenEXR's Inaccurate Pointer Arithmetic can Cause an Out of Bounds Heap (CVSS 6.8, AcademySoftwareFoundation openexr · openexr)
- [CVE-2025-48071](https://cve.now/CVE-2025-48071.md): OpenEXR's Forged Unpacked Size can Lead to Heap-Based Buffer Overflow in Deep Scanline Parsing (CVSS 8.4, AcademySoftwareFoundation openexr · openexr)
- [CVE-2025-37112](https://cve.now/CVE-2025-37112.md): Hard-Coded Encryption Keys found in System (CVSS 6.0, Hewlett Packard Enterprise HPE Telco Network Function Virtu…)
- [CVE-2025-37111](https://cve.now/CVE-2025-37111.md): Hard-Coded Authentication Keys found in System (CVSS 6.0, Hewlett Packard Enterprise HPE Telco Network Function Virtu…)
- [CVE-2025-37110](https://cve.now/CVE-2025-37110.md): Sensitive Credential Information stored insecurely in System Database (CVSS 6.0, Hewlett Packard Enterprise HPE Telco Network Function Virtu…)
- [CVE-2025-8286](https://cve.now/CVE-2025-8286.md): Güralp Systems FMUS Series and MIN Series Devices (CVSS 9.3, Güralp Systems Güralp FMUS Series · Güralp Systems MIN Seri…)
- [CVE-2025-37109](https://cve.now/CVE-2025-37109.md): HPE Telco Service Activator, Protection Mechanism Failure (CVSS 3.5, Hewlett Packard Enterprise (HPE) HPE Telco Service Activator)
- [CVE-2025-37108](https://cve.now/CVE-2025-37108.md): HPE Telco Service Activator, Protection Mechanism Failure (CVSS 3.5, Hewlett Packard Enterprise (HPE) HPE Telco Service Activator)
- [CVE-2025-8426](https://cve.now/CVE-2025-8426.md): Marvell QConvergeConsole compressConfigFiles Directory Traversal Information Disclosure and Denial-of-Service Vulnerability (CVSS 9.4, Marvell QConvergeConsole)
- [CVE-2025-54833](https://cve.now/CVE-2025-54833.md): OPEXUS FOIAXpress Public Access Link (PAL) account-lockout and CAPTCHA protection bypass (CVSS 5.3, OPEXUS FOIAXpress Public Access Link)
- [CVE-2025-54834](https://cve.now/CVE-2025-54834.md): OPEXUS FOIAXpress Public Access Link (PAL) unauthenticated username enumeration (CVSS 5.3, OPEXUS FOIAXpress Public Access Link)
- [CVE-2025-54832](https://cve.now/CVE-2025-54832.md): OPEXUS FOIAXpress Public Access Link (PAL) state and territory list unauthorized modification (CVSS 4.3, OPEXUS FOIAXpress Public Access Link)
- [CVE-2025-8409](https://cve.now/CVE-2025-8409.md): code-projects Vehicle Management filter.php sql injection (CVSS 6.9, code-projects Vehicle Management)
- [CVE-2025-46809](https://cve.now/CVE-2025-46809.md): Multi Linux Manager epxoses the plain text HTTP Proxy user:password in logs (CVSS 6.9, Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1 ·… +11)
- [CVE-2025-8408](https://cve.now/CVE-2025-8408.md): code-projects Vehicle Management filter1.php sql injection (CVSS 6.9, code-projects Vehicle Management)
- [CVE-2013-10037](https://cve.now/CVE-2013-10037.md): WebTester 5.x install2.php Unauthenticated Command Execution (CVSS 9.3, Eppler Software WebTester)
- [CVE-2014-125126](https://cve.now/CVE-2014-125126.md): Simple E-Document Arbitrary File Upload RCE (CVSS 9.2, Simple E-Document)
- [CVE-2013-10035](https://cve.now/CVE-2013-10035.md): ProcessMaker Open Source \< 2.5.2 neoclassic Skin PHP Code Execution (CVSS 8.7, ProcessMaker Open Source)
- [CVE-2014-125124](https://cve.now/CVE-2014-125124.md): Pandora FMS \<= 5.0RC1 Anyterm Unauthenticated Command Injection (CVSS 10.0, Artica ST Pandora FMS)
- [CVE-2025-34146](https://cve.now/CVE-2025-34146.md): nyariv sandboxjs 0.8.23 Prototype Pollution Sandbox Escape DoS (CVSS 7.0, nyariv sandboxjs · @nyariv/sandboxjs)
- [CVE-2011-10008](https://cve.now/CVE-2011-10008.md): MPlayer Lite r33064 M3U Stack-Based Buffer Overflow (CVSS 8.6, MPlayer Project MPlayer Lite)
- [CVE-2014-125122](https://cve.now/CVE-2014-125122.md): Linksys WRT120N tmUnblock.cgi Stack-Based Buffer Overflow Admin Password Reset (CVSS 5.3, Linksys WRT120N)
- [CVE-2014-125123](https://cve.now/CVE-2014-125123.md): Kloxo \< 6.1.12 Unauthenticated SQL Injection RCE (CVSS 10.0, LXCenter Kloxo)
- [CVE-2013-10033](https://cve.now/CVE-2013-10033.md): Kimai 0.9.2 db\_restore.php SQL Injection (CVSS 9.3, Kimai Project Kimai)
- [CVE-2013-10034](https://cve.now/CVE-2013-10034.md): Kaseya \< 6.3.0.2 uploadImage.asp Arbitrary File Upload RCE (CVSS 9.3, Kaseya KServer)
- [CVE-2013-10039](https://cve.now/CVE-2013-10039.md): GestioIP 3.0 ip\_checkhost.cgi RCE (CVSS 8.7, GestioIP IPAM)
- [CVE-2013-10042](https://cve.now/CVE-2013-10042.md): freeFTPd \<= 1.0.10 PASS Command Stack-Based Buffer Overflow (CVSS 9.3, freeFTPd)
- [CVE-2013-10038](https://cve.now/CVE-2013-10038.md): FlashChat Arbitrary File Upload RCE (CVSS 9.3, TUFaT FlashChat)
- [CVE-2012-10021](https://cve.now/CVE-2012-10021.md): D-Link DIR-605L Captcha Handling Buffer Overflow (CVSS 9.3, D-Link DIR-605L)
- [CVE-2013-10040](https://cve.now/CVE-2013-10040.md): ClipBucket \<= 2.6 ofc\_upload\_image.php Arbitrary File Upload RCE (CVSS 10.0, ClipBucket)
- [CVE-2013-10036](https://cve.now/CVE-2013-10036.md): Beetel Connection Manager NetConfig.ini Stack-Based Buffer Overflow (CVSS 8.4, Beetel Teletech Connection Manager)
- [CVE-2013-10043](https://cve.now/CVE-2013-10043.md): Astium VOIP PBX \<= 2.1 SQL Injection File Upload RCE (CVSS 9.5, Astium VoIP PBX)
- [CVE-2014-125121](https://cve.now/CVE-2014-125121.md): Array Networks vAPV and vxAG Default Credential Privilege Escalation (CVSS 10.0, Array Networks vAPV · Array Networks vxAG)
- [CVE-2014-125125](https://cve.now/CVE-2014-125125.md): A10 Networks AX Loadbalancer Path Traversal (CVSS 8.8, A10 Networks AX Series Loadbalancer)
- [CVE-2025-7738](https://cve.now/CVE-2025-7738.md): Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aap (CVSS 4.4, django-ansible-base · Red Hat Ansible Automation Platform 2…)
- [CVE-2025-8407](https://cve.now/CVE-2025-8407.md): code-projects Vehicle Management filter2.php sql injection (CVSS 6.9, code-projects Vehicle Management)
- [CVE-2025-54589](https://cve.now/CVE-2025-54589.md): copyparty Reflected XSS via Filter Parameter (CVSS 6.3, 9001 copyparty · copyparty)
- [CVE-2025-8213](https://cve.now/CVE-2025-8213.md): NinjaScanner – Virus & Malware scan \<= 3.2.5 - Authenticated (Administrator+) Arbitrary File Deletion (CVSS 7.2, nintechnet NinjaScanner – Virus & Malware scan)
- [CVE-2025-8382](https://cve.now/CVE-2025-8382.md): Campcodes Online Hotel Reservation System edit\_room.php sql injection (CVSS 5.3, Campcodes Online Hotel Reservation System)
- [CVE-2025-8381](https://cve.now/CVE-2025-8381.md): Campcodes Online Hotel Reservation System add\_reserve.php sql injection (CVSS 5.3, Campcodes Online Hotel Reservation System)
- [CVE-2025-8068](https://cve.now/CVE-2025-8068.md): HT Mega – Absolute Addons For Elementor \<= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions (CVSS 4.3, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2025-8401](https://cve.now/CVE-2025-8401.md): HT Mega – Absolute Addons For Elementor \<= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure (CVSS 4.3, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2025-8151](https://cve.now/CVE-2025-8151.md): HT Mega – Absolute Addons For Elementor \<= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions (CVSS 4.3, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2025-8380](https://cve.now/CVE-2025-8380.md): Campcodes Online Hotel Reservation System add\_query\_account.php cross site scripting (CVSS 5.1, Campcodes Online Hotel Reservation System)
- [CVE-2025-8379](https://cve.now/CVE-2025-8379.md): Campcodes Online Hotel Reservation System edit\_room.php unrestricted upload (CVSS 5.1, Campcodes Online Hotel Reservation System)
- [CVE-2025-2813](https://cve.now/CVE-2025-2813.md): HTTP Service DoS Vulnerability (CVSS 7.5, Phoenix Contact AXL F BK PN TPS · Phoenix Contact AXL F… +7)
- [CVE-2025-41688](https://cve.now/CVE-2025-41688.md): High Privilege RCE via LUA Sandbox Escape (CVSS 7.2, MB connect line mbNET HW1 · MB connect line mbNET/mbNET.… +1)
- [CVE-2025-8378](https://cve.now/CVE-2025-8378.md): Campcodes Online Hotel Reservation System Login index.php sql injection (CVSS 6.9, Campcodes Online Hotel Reservation System)
- [CVE-2025-40980](https://cve.now/CVE-2025-40980.md): ddd (CVSS 5.1, UltimateFosters UltimatePOS)
- [CVE-2025-8376](https://cve.now/CVE-2025-8376.md): code-projects Vehicle Management updatebal.php sql injection (CVSS 6.9, code-projects Vehicle Management)
- [CVE-2025-8375](https://cve.now/CVE-2025-8375.md): code-projects Vehicle Management addvehicle.php sql injection (CVSS 6.9, code-projects Vehicle Management)
- [CVE-2025-24854](https://cve.now/CVE-2025-24854.md): Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image plugin (CVSS 6.1, Apache Software Foundation Apache JSPWiki · org.apache.jspw…)
- [CVE-2025-24853](https://cve.now/CVE-2025-24853.md): Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing (CVSS 7.5, Apache Software Foundation Apache JSPWiki · org.apache.j… +1)
- [CVE-2025-8374](https://cve.now/CVE-2025-8374.md): code-projects Vehicle Management addcompany.php sql injection (CVSS 6.9, code-projects Vehicle Management)
- [CVE-2025-8192](https://cve.now/CVE-2025-8192.md): Race condition in AndroidTV TvSettings (CVSS 6.9, Android TV)
- [CVE-2025-8373](https://cve.now/CVE-2025-8373.md): code-projects Vehicle Management print.php sql injection (CVSS 6.9, code-projects Vehicle Management)
- [CVE-2025-8372](https://cve.now/CVE-2025-8372.md): code-projects Exam Form Submission update\_s7.php sql injection (CVSS 6.9, code-projects Exam Form Submission)
- [CVE-2025-36563](https://cve.now/CVE-2025-36563.md): Reflected cross-site scripting vulnerability exists in multiple versions of PowerCMS. (CVSS 6.1, Alfasado PowerCMS)
- [CVE-2025-41391](https://cve.now/CVE-2025-41391.md): Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS. (CVSS 5.4, Alfasado PowerCMS)
- [CVE-2025-7205](https://cve.now/CVE-2025-7205.md): GiveWP – Donation Plugin and Fundraising Platform \<= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting (CVSS 5.4, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2025-41396](https://cve.now/CVE-2025-41396.md): A path traversal issue exists in file uploading feature of multiple versions of PowerCMS. (CVSS 5.4, Alfasado PowerCMS)
- [CVE-2025-46359](https://cve.now/CVE-2025-46359.md): A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS. (CVSS 7.2, Alfasado PowerCMS)
- [CVE-2025-54752](https://cve.now/CVE-2025-54752.md): Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. (CVSS 6.5, Alfasado PowerCMS)
- [CVE-2025-54757](https://cve.now/CVE-2025-54757.md): Multiple versions of PowerCMS allow unrestricted upload of dangerous files. (CVSS 6.5, Alfasado PowerCMS)
- [CVE-2025-8371](https://cve.now/CVE-2025-8371.md): code-projects Exam Form Submission update\_s5.php sql injection (CVSS 6.9, code-projects Exam Form Submission)
- [CVE-2025-8370](https://cve.now/CVE-2025-8370.md): Portabilis i-Educar educar\_escolaridade\_lst.php cross site scripting (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-8369](https://cve.now/CVE-2025-8369.md): Portabilis i-Educar educar\_avaliacao\_desempenho\_lst.php cross site scripting (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-53558](https://cve.now/CVE-2025-53558.md): ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. (CVSS 8.8, ZTE Japan. K.K. ZXHN-F660T · ZTE Japan. K.K. ZXHN-F660A)
- [CVE-2025-8368](https://cve.now/CVE-2025-8368.md): Portabilis i-Educar pesquisa\_pessoa\_lst.php cross site scripting (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-8367](https://cve.now/CVE-2025-8367.md): Portabilis i-Educar funcionario\_vinculo\_lst.php cross site scripting (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-8366](https://cve.now/CVE-2025-8366.md): Portabilis i-Educar educar\_servidor\_lst.php cross site scripting (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-5720](https://cve.now/CVE-2025-5720.md): Customer Reviews for WooCommerce \<= 5.80.2 - Unauthenticated Stored Cross-Site Scripting via \`author\` Parameter (CVSS 6.4, ivole Customer Reviews for WooCommerce)
- [CVE-2025-7847](https://cve.now/CVE-2025-7847.md): AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, tigroumeow AI Engine)
- [CVE-2025-8365](https://cve.now/CVE-2025-8365.md): Portabilis i-Educar atendidos\_cad.php cross site scripting (CVSS 5.1, Portabilis i-Educar)
- [CVE-2025-8348](https://cve.now/CVE-2025-8348.md): Kehua Charging Pile Cloud Platform home improper authentication (CVSS 6.9, Kehua Charging Pile Cloud Platform)
- [CVE-2025-8347](https://cve.now/CVE-2025-8347.md): Kehua Charging Pile Cloud Platform findAllTask sql injection (CVSS 5.3, Kehua Charging Pile Cloud Platform)
- [CVE-2025-8346](https://cve.now/CVE-2025-8346.md): Portabilis i-Educar educar\_aluno\_lst.php cross site scripting (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-8345](https://cve.now/CVE-2025-8345.md): Shanghai Lingdang Information Technology Lingdang CRM yunzhijiaApi.php delete\_user sql injection (CVSS 5.3, Shanghai Lingdang Information Technology Lingdang CRM)
- [CVE-2025-8344](https://cve.now/CVE-2025-8344.md): openviglet shio ShStaticFileAPI.java shStaticFileUpload unrestricted upload (CVSS 5.3, openviglet shio)
- [CVE-2025-8343](https://cve.now/CVE-2025-8343.md): openviglet shio ShStaticFileAPI.java shStaticFilePreUpload path traversal (CVSS 5.3, openviglet shio)
- [CVE-2025-8340](https://cve.now/CVE-2025-8340.md): code-projects Intern Membership Management System Error Message fill\_details.php cross site scripting (CVSS 5.3, code-projects Intern Membership Management System)
- [CVE-2025-8339](https://cve.now/CVE-2025-8339.md): code-projects Intern Membership Management System student\_login.php sql injection (CVSS 6.9, code-projects Intern Membership Management System)
- [CVE-2024-34327](https://cve.now/CVE-2024-34327.md): Sielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the password reset form. (CVSS 6.5)
- [CVE-2024-34328](https://cve.now/CVE-2024-34328.md): An open redirect in Sielox AnyWare v2.1.2 allows attackers to execute a man-in-the-middle attack via a crafted URL. (CVSS 6.3)
- [CVE-2025-26062](https://cve.now/CVE-2025-26062.md): An access control issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to access the router's settings file (CVSS 9.8)
- [CVE-2025-26063](https://cve.now/CVE-2025-26063.md): An issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to execute arbitrary code via injecting a crafted pa (CVSS 9.8)
- [CVE-2025-26064](https://cve.now/CVE-2025-26064.md): A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts o (CVSS 7.3)
- [CVE-2025-29556](https://cve.now/CVE-2025-29556.md): ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control. (CVSS 7.3)
- [CVE-2025-29557](https://cve.now/CVE-2025-29557.md): ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where users with operator-leve (CVSS 5.4)
- [CVE-2025-45768](https://cve.now/CVE-2025-45768.md): pyjwt v2.10.1 was discovered to contain weak encryption. (CVSS 7.0, pyjwt)
- [CVE-2025-45769](https://cve.now/CVE-2025-45769.md): php-jwt v6.11.0 was discovered to contain weak encryption. (CVSS 6.5, firebase/php-jwt)
- [CVE-2025-45770](https://cve.now/CVE-2025-45770.md): jwt v5.4.3 was discovered to contain weak encryption. (CVSS 7.0)
- [CVE-2025-50270](https://cve.now/CVE-2025-50270.md): A stored Cross Site Scripting (xss) vulnerability in the "content management" feature in AnQiCMS v.3.4.11 allows a remote attacker to execut (CVSS 6.1)
- [CVE-2025-50475](https://cve.now/CVE-2025-50475.md): An OS command injection vulnerability exists in Russound MBX-PRE-D67F firmware version 3.1.6, allowing unauthenticated attackers to execute (CVSS 9.8)
- [CVE-2025-50572](https://cve.now/CVE-2025-50572.md): Archer 6.11.00204.10014 allows attackers to execute arbitrary code via crafted system inputs that would be exported into the CSV and be exec (CVSS 8.8)
- [CVE-2025-50847](https://cve.now/CVE-2025-50847.md): Cross Site Request Forgery (CSRF) vulnerability in CS Cart 4.18.3, allows attackers to add products to a user's comparison list via a crafte (CVSS 6.5)
- [CVE-2025-50848](https://cve.now/CVE-2025-50848.md): A file upload vulnerability was discovered in CS Cart 4.18.3, allows attackers to execute arbitrary code. (CVSS 6.1)
- [CVE-2025-50849](https://cve.now/CVE-2025-50849.md): CS Cart 4.18.3 is vulnerable to Insecure Direct Object Reference (IDOR). (CVSS 8.0)
- [CVE-2025-50850](https://cve.now/CVE-2025-50850.md): An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verificati (CVSS 8.6)
- [CVE-2025-50866](https://cve.now/CVE-2025-50866.md): CloudClassroom-PHP-Project 1.0 contains a reflected Cross-site Scripting (XSS) vulnerability in the email parameter of the postquerypublic e (CVSS 6.1)
- [CVE-2025-50867](https://cve.now/CVE-2025-50867.md): A SQL Injection vulnerability exists in the takeassessment2.php endpoint of the CloudClassroom-PHP-Project 1.0, where the Q5 POST parameter (CVSS 6.5)
- [CVE-2025-51383](https://cve.now/CVE-2025-51383.md): D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec\_road\_asp function via the host\_ip parameter. (CVSS 3.5)
- [CVE-2025-51384](https://cve.now/CVE-2025-51384.md): D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec\_net\_asp function via the remot\_ip parameter. (CVSS 3.5)
- [CVE-2025-51385](https://cve.now/CVE-2025-51385.md): D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the yyxz\_dlink\_asp function via the id parameter. (CVSS 3.5)
- [CVE-2025-51503](https://cve.now/CVE-2025-51503.md): A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile field (CVSS 7.6, microweber/microweber)
- [CVE-2025-51569](https://cve.now/CVE-2025-51569.md): A cross-site scripting (XSS) vulnerability exists in the LB-Link BL-CPE300M 01.01.02P42U14\_06 router's web interface. (CVSS 6.1)
- [CVE-2025-52203](https://cve.now/CVE-2025-52203.md): A stored cross-site scripting (XSS) vulnerability exists in DevaslanPHP project-management v1.2.4. (CVSS 7.6)
- [CVE-2025-52289](https://cve.now/CVE-2025-52289.md): A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a craf (CVSS 8.0)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.