CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
- arm mbed tls, mbed mbedtls +1 moreMbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are...8.9 High
- phpgurukul apartment visitors management systemPHPGurukul Apartment Visitors Management System HTTP POST Request admin-profile.php cross site scripting5.1 Medium
- phpgurukul apartment visitors management systemPHPGurukul Apartment Visitors Management System HTTP POST Request bwdates-passreports-details.php cross site scripting5.1 Medium
- phpgurukul apartment visitors management systemPHPGurukul Apartment Visitors Management System HTTP POST Request pass-details.php cross site scripting5.1 Medium
- tenda fh451, fh451 firmware +1 moreTenda FH451 qossetting fromqossetting stack-based overflow8.7 High
- tenda fh451, fh451 firmware +1 moreTenda FH451 VirtualSer fromVirtualSer stack-based overflow8.7 High
- tenda fh451, fh451 firmware +1 moreTenda FH451 SetIpBind fromSetIpBind stack-based overflow8.7 High
- campcodes online movie theater seat reservation systemCampcodes Online Movie Theater Seat Reservation System Reserve Your Seat Page index.php cross site scripting5.1 Medium
- campcodes online movie theater seat reservation systemCampcodes Online Movie Theater Seat Reservation System manage_seat.php sql injection6.9 Medium
- totolink t6, t6 firmware +1 moreTOTOLINK T6 MQTT Service recvSlaveStaInfo buffer overflow8.7 High
- d-link dir-816l, dlink dir-816l firmware +1 moreD-Link DIR-816L Environment Variable cgibin lxmldbc_system command injection5.3 Medium
- phpgurukul complaint management systemPHPGurukul Complaint Management System cross-site request forgery5.3 Medium
- carmelo church donation systemcode-projects Church Donation System giving.php sql injection6.9 Medium
- carmelo church donation systemcode-projects Church Donation System offering.php sql injection6.9 Medium
- carmelo church donation systemcode-projects Church Donation System Tithes.php sql injection6.9 Medium
- carmelo church donation systemcode-projects Church Donation System reg.php sql injection6.9 Medium
- carmelo church donation systemcode-projects Church Donation System login.php sql injection6.9 Medium
- jinher oaJinher OA XmlHttp.aspx xml external entity reference6.9 Medium
- jinher oaJinher OA ProjectScheduleDelete.aspx xml external entity reference6.9 Medium
- phpgurukul apartment visitors management systemPHPGurukul Apartment Visitors Management System HTTP POST Request create-pass.php cross site scripting4.8 Medium
- phpgurukul apartment visitors management systemPHPGurukul Apartment Visitors Management System HTTP POST Request category.php cross site scripting5.1 Medium
- linux, linux kernel +1 moreKVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush5.5 Medium
- phpgurukul apartment visitors management systemPHPGurukul Apartment Visitors Management System HTTP POST Request bwdates-reports.php cross site scripting5.1 Medium
- lynton reed work the flow file uploadWork The Flow File Upload <= 2.5.2 - Arbitrary File Upload9.8 Critical
- vibethemes wplms learning management system for wordpress, wordpress lms, wordpress learning management system +1 moreWPLMS Learning Management System for WordPress, WordPress LMS <= 1.8.4.1 - Privilege Escalation8.8 High
- phpgurukul apartment visitors management systemPHPGurukul Apartment Visitors Management System HTTP POST Request visitor-detail.php cross site scripting5.1 Medium
- phpgurukul apartment visitors management systemPHPGurukul Apartment Visitors Management System HTTP POST Request manage-newvisitors.php cross site scripting4.8 Medium
- markjaquith subscribe to commentsSubscribe to Comments <= 2.1.2 - Local File Includion7.2 High
- websitez.com, llc wp mobile detector, wp mobile detector project mobile detector +1 moreWP Mobile Detector <= 3.5 - Arbitrary File Upload9.8 Critical
- eoxia wpshop 2 – e-commerce, wpshop 2 +1 moreWPshop 2 – E-Commerce < 1.3.9.6 - Arbitrary File Upload9.8 Critical
- scribu front-end editorFront-end Editor < 2.3 - Arbitrary File Upload9.8 Critical
- zishanj gi-media library, gi-media-library +1 moreGI-Media Library < 3.0 - Directory Traversal7.5 High
- mywebsiteadvisor simple backupSimple Backup <= 2.7.10 - Arbitrary File Download via Path Traversal7.5 High
- themerex addonsThemeREX Addons <= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file Function6.4 Medium
- debian linux, linux kernel, siemens ruggedcom rst2428p +18 more +20 morenet/sched: Always pass notifications when child class becomes empty7.8 High
- bandido morkva vchasno kasa integrationVchasno Kasa <= 1.0.3 - Unauthenticated Log File Clearing5.3 Medium
- bandido morkva vchasno kasa integrationVchasno Kasa <= 1.0.3 - Missing Authorization to Unauthenticated Invoice Generation5.3 Medium
- growatt https://oss.growatt.com, https://server.growatt.com +1 moreAn incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud...9.4 Critical
- crmperks integration for google sheets and contact form 7, wpforms, elementor, ninja formsIntegration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 - Unauthenticated PHP Object Injection via verify_field_val Function9.8 Critical
- crmperks integration for pipedrive and contact form 7, wpforms, elementor, ninja formsIntegration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.2.3 - Unauthenticated PHP Object Injection via verify_field_val Function9.8 Critical
- avishika avishi wp paypal payment buttonAvishi WP PayPal Payment Button <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- vloo epay.bg paymentsEPay.bg Payments <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- maxomatos partnerský systém martinusPartnerský systém Martinus <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- codents temporarily hidden contentTemporarily Hidden Content <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- tkrivickas live stream badgerLive Stream Badger <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- prettier eslint-config-prettier, eslint-plugin-prettier, un-ts napi-postinstall +4 more +6 moreeslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code7.5 High
- one identity oneloginIn One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on...4.0 Medium
- nodejs node, nodejs +1 moreAn incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting...7.5 High
- nodejs nodeThe V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash...7.5 High
- wolfsslCurve25519 Blinding5.6 Medium
- Show moreLoading…