CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
- harry0703 moneyprinterturboharry0703 MoneyPrinterTurbo API Endpoint base.py verify_token missing authentication6.9 Medium
- harry0703 moneyprinterturboharry0703 MoneyPrinterTurbo video.py delete_video path traversal5.3 Medium
- emby windowsCWE-918 Server-Side Request Forgery (SSRF)8.6 High
- emby windowsCWE-434 Unrestricted Upload of File with Dangerous Type8.8 High
- emby windowsCWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')6.1 Medium
- harry0703 moneyprinterturboharry0703 MoneyPrinterTurbo File Extension video.py upload_bgm_file unrestricted upload5.3 Medium
- cyberark idpCWE-200 Exposure of Sensitive Information to an Unauthorized Actor5.3 Medium
- onyxOnyx Chat Interface a3_generate_simple_sql.py generate_simple_sql sql injection5.3 Medium
- caixin news app, foresightnews foresight news +1 moreForesight News App pro.foresightnews.appa AndroidManifest.xml improper export of android application components4.8 Medium
- idnowIDnow App de.idnow AndroidManifest.xml improper export of android application components4.8 Medium
- instantbits web video cast app, web video cast +1 moreInstantBits Web Video Cast App com.instantbits.cast.webvideo AndroidManifest.xml improper export of android application components4.8 Medium
- dunamu stockplus, stockplus app +1 moreDunamu StockPlus App com.dunamu.stockplus AndroidManifest.xml improper export of android application components4.8 Medium
- callapp, callapp caller id app +1 moreCallApp Caller ID App caller.id.phone.number.block AndroidManifest.xml improper export of android application components4.8 Medium
- tduckcloud tduck-platformTDuckCloud tduck-platform UserFormDataMapper.java UserFormDataMapper sql injection5.3 Medium
- wikidocsZavy86 WikiDocs template.inc.php cross site scripting5.3 Medium
- pmticket project-management-softwarepmTicket Project-Management-Software class.database.php getUserLanguage sql injection6.9 Medium
- huashengdun websshHuashengdun WebSSH Login Page cross site scripting5.3 Medium
- eluktronics control centerEluktronics Control Center REG File data authenticity4.8 Medium
- eluktronics control centerEluktronics Control Center Powershell Script Command command injection8.5 High
- mercusys mw301rMercusys MW301R Login excessive authentication2.3 Low
- mercusys mw301rMercusys MW301R Web Interface password recovery5.1 Medium
- metasoft metacrmMetasoft 美特软件 MetaCRM sendsms.jsp unrestricted upload5.3 Medium
- metasoft metacrmMetasoft 美特软件 MetaCRM mobileupload.jsp unrestricted upload5.3 Medium
- metasoft metacrmMetasoft 美特软件 MetaCRM upload2.jsp unrestricted upload5.3 Medium
- metasoft metacrmMetasoft 美特软件 MetaCRM sendfile.jsp unrestricted upload5.3 Medium
- metasoft metacrmMetasoft 美特软件 MetaCRM download.jsp AnalyzeParam deserialization5.3 Medium
- metasoft metacrmMetasoft 美特软件 MetaCRM debug.jsp improper authentication6.9 Medium
- metasoft metacrmMetasoft 美特软件 MetaCRM env.jsp information disclosure6.9 Medium
- metasoft metacrmMetasoft 美特软件 MetaCRM mcc_login.jsp sql injection5.3 Medium
- portabilis i-diarioPortabilis i-Diario justificativas-de-falta cross site scripting5.1 Medium
- portabilis i-diarioPortabilis i-Diario conteudos cross site scripting5.1 Medium
- portabilis i-diarioPortabilis i-Diario justificativas-de-falta Endpoint doc_uploader.rb cross site scripting5.1 Medium
- portabilis i-educarPortabilis i-Educar Turma Module educar_turma_tipo_det.php cross site scripting5.1 Medium
- portabilis i-educarPortabilis i-Educar Calendar educar_calendario_dia_motivo_cad.php cross site scripting5.1 Medium
- portabilis i-educarPortabilis i-Educar Agenda agenda.php cross site scripting5.1 Medium
- portabilis i-educarPortabilis i-Educar Disabilities Module educar_deficiencia_lst.php cross site scripting5.1 Medium
- jeesitethinkgem JeeSite XSS Filter EncodeUtils.java xssFilter cross site scripting5.1 Medium
- jeesitethinkgem JeeSite FileUploadController.java upload unrestricted upload5.3 Medium
- jeesitethinkgem JeeSite ServletUtils.java redirectUrl5.1 Medium
- totolink t6, t6 firmware +1 moreTOTOLINK T6 Telnet Service cstecgi.cgi setTelnetCfg missing authentication6.9 Medium
- microsoft sharepoint, sharepoint server, sharepoint enterprise server 2016 +2 more +4 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability9.8 Critical
- carmelo church donation systemcode-projects Church Donation System search.php sql injection6.9 Medium
- carmelo church donation systemcode-projects Church Donation System login_admin.php sql injection6.9 Medium
- carmelo church donation systemcode-projects Church Donation System update_password_admin.php sql injection6.9 Medium
- westermo weosAn issue was discovered in Westermo WeOS 5 (5.24 through 5.24.4). A threat actor potentially can...6.3 Medium
- logpointAn issue was discovered in Logpoint before 7.6.0. An attacker with operator privileges can...8.4 High
- logpointAn issue was discovered in Logpoint before 7.6.0. When creating reports, attackers can create...4.9 Medium
- rubyonrails thorWithdrawn Advisory: Thor can construct an unsafe shell command from library input.2.8 Low
- trustedfirmware mbed tls, mbed mbedtls +1 moreIn Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing discrepancy in block cipher padding...4.0 Medium
- arm mbed tls, mbed mbedtls +1 moreMbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can...4.0 Medium
- Show moreLoading…