CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
- mia4 birth chart compatibilityBirth Chart Compatibility <= 2.0 - Unauthenticated Full Path Exposure5.3 Medium
- gsayed786 orion login with smsOrion Login with SMS <= 1.0.5 - Authentication Bypass via Weak OTP8.1 High
- anop-goswami latest post accordian sliderLatest Post Accordian Slider <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- debian linux, linux kernel +1 moreposix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()7.8 High
- htplugins extensions for cf7 (contact form 7 database, conditional fields and redirection)Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.2.8 - Unauthenticated Arbitrary File Deletion Triggered via Admin Form Submission Deletion8.1 High
- gift pad co.,ltd. "region pay" app for androidInsertion of sensitive information into log file issue exists in "region PAY" App for Android...2.4 Low
- No product listedWP JobHunt <= 7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Account Deletion8.1 High
- bdthemes pixel gallery addons for elementor – easy grid, creative gallery, drag and drop grid, custom grid layout, portfolio galleryPixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- cbutlerjr wp-members membership pluginWP-Members <= 3.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- publiccmsSanluan PublicCMS viewer.html redirect5.1 Medium
- totolink t6, t6 firmware +1 moreTOTOLINK T6 MQTT Packet wireless.so ckeckKeepAlive command injection5.3 Medium
- code-projects public chat roomcode-projects Public Chat Room send_message.php cross site scripting5.1 Medium
- code-projects public chat roomcode-projects Public Chat Room login.php sql injection6.9 Medium
- webmovementllc foxypressFoxyPress <= 0.4.2.1 - Arbitrary File Upload9.8 Critical
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderUser Registration <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode6.4 Medium
- n-media website contact form with file uploadWebsite Contact Form With File Upload <= 1.3.4 - Arbitrary File Upload9.8 Critical
- vcita crm and lead management by vcitaCRM and Lead Management by vcita <= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter6.4 Medium
- publiccmsSanluan PublicCMS preview.html redirect5.1 Medium
- jishenghua jsherpjshERP updatePwd password recovery5.3 Medium
- jishenghua jsherpjshERP Account delete improper authorization5.3 Medium
- phpgurukul apartment visitors management systemPHPGurukul Apartment Visitors Management System HTTP POST Request search-visitor.php cross site scripting5.3 Medium
- No product listedInsecure Direct Object Reference (IDOR) vulnerability in Deepfiction AI (deepfiction.ai) thru...6.5 Medium
- No product listedAi2 playground web service (playground.allenai.org) LLM chat through 2025-06-03 is vulnerable to...8.8 High
- No product listedA reflected cross-site scripting (XSS) vulnerability exists in AIBOX LLM chat (chat.aibox365.cn)...6.5 Medium
- No product listedSelf Cross Site Scripting (XSS) vulnerability in ChatGPT Unli (ChatGPTUnli.com) thru 2025-05-26...6.1 Medium
- No product listedInsecure Direct Object Reference (IDOR) vulnerability in TelegAI (telegai.com) thru 2025-05-26 in...6.1 Medium
- No product listedStored Cross-Site Scripting (XSS) in TelegAI (telegai.com) 2025-05-26 in its chat component and...6.1 Medium
- No product listedStored Cross-Site Scripting (XSS) vulnerability in Chaindesk thru 2025-05-26 in its agent chat...6.5 Medium
- No product listedSelf Cross-Site Scripting (XSS) vulnerability in ChatPlayground.ai through 2025-05-24, allows...6.1 Medium
- lettaRemote Code Execution in letta.server.rest_api.routers.v1.tools.run_tool_from_source in letta-ai...8.8 High
- dagsterlabs dagsterDagster Local File Inclusion vulnerability6.6 Medium
- onyxAuthorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows...5.4 Medium
- superagiArbitrary File Overwrite (AFO) in superagi.controllers.resources.upload in TransformerOptimus...5.0 Medium
- superagiCode Injection in AgentTemplate.eval_agent_config in TransformerOptimus SuperAGI 0.0.14 allows...6.5 Medium
- ollamaOllama vulnerable to Cross-Domain Token Exposure6.9 Medium
- aimstack aimAim vulnerable to Cross-site Scripting8.8 High
- aimstack aimPath Traversal in restore_run_backup() in AIM 3.28.0 allows remote attackers to write arbitrary...7.0 High
- infiniflow ragflowStored Cross-site Scripting (XSS) vulnerability in api.apps.dialog_app.set_dialog in RAGFlow 0.17...6.1 Medium
- dbgpt db-gptFile Upload vulnerability in agent.hub.controller.refresh_plugins in eosphoros-ai DB-GPT 0.7.0...6.5 Medium
- dbgpt db-gptSQL Injection in editor_sql_run and query_ex in eosphoros-ai DB-GPT 0.7.0 allows remote attackers...6.5 Medium
- No product listedAn issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can elevate to...6.5 Medium
- No product listedAn issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can bypass manager approval...7.3 High
- No product listedAn issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can bypass manager approval...7.3 High
- d-link dir-513D-Link DIR-513 formSetWanDhcpplus buffer overflow8.7 High
- phpgurukul taxi stand management system, auto\/taxi stand management system +1 morePHPGurukul Taxi Stand Management System search.php cross site scripting5.3 Medium
- phpgurukul taxi stand management system, auto\/taxi stand management system +1 morePHPGurukul Taxi Stand Management System search-autoortaxi.php cross site scripting5.3 Medium
- motovnet ebook storeEbook Store <= 5.8012 - Authenticated (Administrator+) Stored Cross-Site Scripting via Order Details4.4 Medium
- phpgurukul taxi stand management system, auto\/taxi stand management system +1 morePHPGurukul Taxi Stand Management System admin-profile.php cross site scripting5.1 Medium
- phpgurukul time table generator systemPHPGurukul Time Table Generator System profile.php cross site scripting5.1 Medium
- pyloadpyLoad has Path Traversal Vulnerability in json/upload Endpoint that allows Arbitrary File Write7.5 High
- Show moreLoading…