CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
- nmedia frontend file manager pluginFrontend File Manager <= 21.5 - Missing Authorization to Unauthenticated Arbitrary Post Deletion7.5 High
- totolink a702r, a702r firmware +1 moreTOTOLINK A702R HTTP POST Request formOneKeyAccessButton buffer overflow8.7 High
- totolink a702r, a702r firmware +1 moreTOTOLINK A702R HTTP POST Request formIpQoS buffer overflow8.7 High
- totolink a702r, a702r firmware +1 moreTOTOLINK A702R HTTP POST Request formFilter buffer overflow8.7 High
- droipDroip <= 2.2.6 - Missing Authorization to Authenticated (Subscriber+) Many Actions8.8 High
- droipDroip < 2.5.2 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- angeljudesuarez insurance management systemitsourcecode Insurance Management System updateAgent.php sql injection5.3 Medium
- phpgurukul bp monitoring management systemPHPGurukul BP Monitoring Management System bwdates-report-result.php sql injection5.3 Medium
- unknown my reservation systemMy Reservation System <= 2.3 - Reflected XSS6.1 Medium
- chancmsyanyutao0402 ChanCMS gather.js getArticle server-side request forgery5.3 Medium
- chancmsyanyutao0402 ChanCMS utils.js delfile path traversal5.3 Medium
- tenda ac20, ac20 firmware +1 moreTenda AC20 SetStaticRouteCfg stack-based overflow8.7 High
- koajs koaKoaJS Koa HTTP Header response.js back redirect5.1 Medium
- zhousg letaozhousg letao product.js unrestricted upload5.3 Medium
- deerwms deer-wms-2deerwms deer-wms-2 list sql injection5.3 Medium
- wpseeds wp database backup, databasebackup wp database backup – unlimited database & files backup by backup for wp +1 moreWP Database Backup < 5.2 - Unauthenticated OS Command Injection9.8 Critical
- pagelines platform, platform theme +1 morePlatform < 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Options Update9.8 Critical
- i13websolution thumbnail carousel sliderResponsive Thumbnail Slider < 1.0.1 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- deerwms deer-wms-2deerwms deer-wms-2 export sql injection5.3 Medium
- deerwms deer-wms-2deerwms deer-wms-2 allocatedList sql injection5.3 Medium
- hcl software iem, hcltech intelliops event management +1 moreHCL IEM is affected by a cookie attribute not set vulnerability2.0 Low
- hcl software iem, hcltech intelliops event management +1 moreHCL IEM is affected by a password in cleartext vulnerability2.6 Low
- hcl software iem, hcltech intelliops event management +1 moreHCL IEM is affected by a concurrent login vulnerability2.6 Low
- abnormal ai securityAbnormal Security /v1.0/rbac/users_v2/{USER_ID}/ before 2025-02-19 allows downgrading the...4.3 Medium
- akamai rate controlAkamai Rate Control alpha before 2025 allows attackers to send requests above the stipulated...3.7 Low
- qemuhw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related...4.2 Medium
- qemuhw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue...4.2 Medium
- openai codex cliOpenAI Codex CLI before 0.9.0 auto-approves ripgrep (aka rg) execution even with the --pre or -...4.1 Medium
- No product listedA Cross-Site Scripting (XSS) vulnerability exists in the OPAC search feature of Koha Library...8.8 High
- vishalmathur institute-of-current-studentsA reflected cross-site scripting (XSS) vulnerability exists in Institute-of-Current-Students v1.0...6.1 Medium
- getgrav gravCross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute...9.8 Critical
- getgrav gravCross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to...8.8 High
- tawk tawk.toCross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to...6.1 Medium
- apwide goliveApwide Golive 10.2.0 Jira plugin allows Server-Side Request Forgery (SSRF) via the test webhook...6.5 Medium
- opencartOpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file...6.1 Medium
- opencartOpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via the blog...6.1 Medium
- abeltechsoft chavara matrimonyAn issue in the OTP mechanism of Chavara Family Welfare Centre Chavara Matrimony Site v2.0 allows...9.8 Critical
- unitree go1 firmwareUnitree Go1 <= Go1_2022_05_11 is vulnerable to Insecure Permissions as the firmware update...7.1 High
- unitree go1 firmwareUnitree Go1 <= Go1_2022_05_11 is vulnerale to Incorrect Access Control due to authentication...8.8 High
- No product listedWithdrawn Advisory: CodeIgniter4 Cross-Site Scripting Vulnerability in debugbar_time Parameter6.1 Medium
- vishalmathur cloudclassroom-php projectCloudClassroom-PHP Project v1.0 was discovered to contain a SQL injection vulnerability via the...6.5 Medium
- jhipsterWithdrawn Advisory: JHipster allows privilege escalation via a modified authorities parameter2.9 Low
- iroadau fx2 firmwareAn issue was discovered on IROAD Dashcam FX2 devices. Dumping Files Over HTTP and RTSP Without...9.4 Critical
- gardyn home kit firmwareAn issue in Gardyn 4 allows a remote attacker execute arbitrary code9.8 Critical
- gardyn home kit firmwareAn issue in Gardyn 4 allows a remote attacker to obtain sensitive information and execute...9.1 Critical
- gardyn home kit firmwareAn issue in Gardyn 4 allows a remote attacker to obtain sensitive information and execute...9.4 Critical
- No product listedAn issue in ETSI Open-Source MANO (OSM) v.14.x, v.15.x allows a remote attacker to escalate...6.5 Medium
- No product listedAn issue in ETSI Open-Source MANO (OSM) v.14.x, v.15.x allows a remote attacker to escalate...7.1 High
- embedthis goaheadgoform/formTest in EmbedThis GoAhead 2.5 allows HTML injection via the name parameter.7.2 High
- deerwms deer-wms-2deerwms deer-wms-2 unallocatedList sql injection5.3 Medium
- Show moreLoading…