Exploited and new serious CVEs: July 2025

End-of-Train and Head-of-Train Remote Linking Protocol Weak Authentication

• Pre-auth
• Auth bypass

end-of-train and head-of-train remote linking protocol · end-of-train and head-of-train remote linking protocolJul 10, 2025

Premium Age Verification / Restriction for WordPress <= 3.0.2 - Unauthenticated Arbitrary File Read and Write via remote_tunnel.php

• pre-auth RCE
• Hard-coded credentials

aa-team · premium age verification / restriction for wordpressJul 11, 2025

Broken Link Notifier <= 1.3.0 - Unauthenticated Server-Side Request Forgery

• Pre-auth
• SSRF

pluginrx · broken link notifierJul 11, 2025

A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause u

• pre-auth RCE
• Command injection

schneider electric · ecostruxure™ it data center expertJul 11, 2025

A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via inj

• Pre-auth
• SSRF

Jul 11, 2025

Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs

• Pre-auth
• Denial of service

apache · commons langJul 11, 2025

A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenticated attacker to ex

• pre-auth RCE
• Auth bypass

totolink · n300rb firmwareJul 11, 2025

SMM Arbitrary Write via Unchecked RBX Pointer in CommandRcx0

• Local privilege escalation

gigabyte · uefi-genericcomponentsmmentryJul 11, 2025

SMM Arbitrary Write via Unchecked OcHeader Buffer in Platform Configuration Handler

• Local privilege escalation

gigabyte · uefi-overclocksmihandlerJul 11, 2025

Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell met

• pre-auth RCE
• Command injection

linksys · e1000Jul 11, 2025

WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload

• pre-auth RCE
• File upload

iqonic · wpbookitJul 12, 2025

code-projects Modern Bag action.php sql injection

• Pre-auth
• SQL injection

code-projects · modern bagJul 12, 2025

Simple File List < 4.2.3 - Remote Code Execution

• pre-auth RCE
• File upload

simplefilelist · simple file listJul 12, 2025

Total Upkeep by BoldGrid <= 1.14.9 - Unauthenticated Backup Download

• Pre-auth
• Info leak

boldgrid · total upkeepJul 12, 2025

AIT CSV import/export <= 3.0.3 - Unauthenticated Arbitrary File Upload

• pre-auth RCE
• File upload

ait-themes · csv import \/ exportJul 12, 2025

SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.

• pre-auth RCE
• SSRF

sugarcrm · sugarcrmJul 13, 2025

code-projects Voting System positions_add.php sql injection

• SQL injection

fabian · voting systemJul 13, 2025

GNU Binutils objcopy.c copy_section heap-based overflow

• Memory safety

gnu · binutilsJul 13, 2025

Authenticated Arbitrary File Read affecting Avid NEXIS

• Pre-auth
• Broken access control (IDOR)

avid · avid nexis e-seriesJul 14, 2025

code-projects AVL Rooms profile.php sql injection

• Pre-auth
• SQL injection

anisha · avl roomsJul 14, 2025

code-projects AVL Rooms city.php sql injection

• Pre-auth
• SQL injection

anisha · avl roomsJul 14, 2025

Indico vulnerable to user enumeration via API endpoint

• Info leak

cern · indicoJul 14, 2025

LaRecipe is vulnerable to Server-Side Template Injection attacks

• pre-auth RCE
• SSTI

saleem-hadad · larecipeJul 14, 2025

Directus's exact version number is exposed by the OpenAPI Spec

• Pre-auth
• Auth bypass
• Info leak

monospace · directusJul 14, 2025

Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation

• pre-auth RCE
• File upload
• Broken access control (IDOR)

bearsthemes · alone – charity multipurpose non-profit wordpress themeJul 15, 2025

HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload

• pre-auth RCE
• File upload

hasthemes · download contact form 7 widget for elementor page builder \& gutenberg blocksJul 15, 2025

WePresent WiPG-1000 Unauthenticated Command Injection in via rdfs.cgi

• pre-auth RCE
• Command injection

wepresent (barco) · wipg-1000Jul 15, 2025

Piwik Authenticated RCE via Custom Plugin Upload

• RCE
• Auth bypass

piwik (now matomo) · web analytics platformJul 15, 2025

DiskBoss Enterprise Stack-Based Buffer Overflow RCE

• pre-auth RCE

flexense · diskboss enterpriseJul 15, 2025

PDF Shaper v3.5/3.6 Buffer Overflow via Convert to Image Feature

• RCE
• Memory safety

burnaware · pdf shaperJul 15, 2025

WinaXe 7.7 FTP Client Remote Buffer Overflow

• pre-auth RCE
• Memory safety

labf · winaxe ftp clientJul 15, 2025

Disk Pulse Enterprise 9.0.34 Login Stack Buffer Overflow

• pre-auth RCE

falconstor software · disk pulse enterpriseJul 15, 2025

Panda Security PSEvents.exe Insecure DLL Loading Privilege Escalation

• RCE
• Local privilege escalation

panda security · panda global protection 2016Jul 15, 2025

ColoradoFTP Server <= 1.3 Build 8 Path Traversal Information Disclosure

• Pre-auth
• Path traversal

coloradoftp · serverJul 15, 2025

Tiki Wiki <= 15.1 ELFinder Unauthenticated File Upload RCE

• pre-auth RCE
• File upload

tiki · tikiwiki cms\/groupwareJul 15, 2025

Riverbed SteelCentral NetProfiler / NetExpress 10.8.7 RCE

• pre-auth RCE
• SQL injection
• Command injection

riverbed technology · steelcentral netexpressJul 15, 2025

Tiki Wiki CMS Authenticated Command Injection in Calendar Module

• RCE
• Command injection

tiki software community association · wiki cms groupwareJul 15, 2025

OP5 Monitor <= 7.1.9 Authenticated Command Execution via command_test.php

• RCE
• Command injection

itrs group · op5 monitorJul 15, 2025

IPFire < 2.19 Core Update 101 proxy.cgi RCE

• RCE

ipfire project · ipfireJul 15, 2025

An authentication bypass vulnerability in the /web/um_open_telnet.cgi endpoint in Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and

• pre-auth RCE
• Auth bypass
• Hard-coded credentials

Jul 15, 2025

Command injection vulnerability in Nexxt Solutions NCM-X1800 Mesh Router versions UV1.2.7 and below, allowing authenticated attackers to exe

• RCE
• Command injection

Jul 15, 2025

Cross-Site Scripting (XSS) vulnerability in Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below allowing attackers to inject Ja

• XSS

Jul 15, 2025

Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below contains an authenticated command injection vulnerability in the firmware u

• RCE
• Command injection

Jul 15, 2025

Integer overflow in V8 in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a craft

• Pre-auth

google · chromeJul 15, 2025

Integer Truncation on SQLite

sqlite · sqliteJul 15, 2025

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).

• Pre-auth

oracle · jreJul 15, 2025

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

• Local privilege escalation

oracle · vm virtualboxJul 15, 2025

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentiall

• Pre-auth

google · chromeJul 15, 2025

Command Injection Vulnerability in the OmniAccess Stellar Web Management Interface

• pre-auth RCE
• Command injection

alcatel-lucent · omniaccess stellar productsJul 16, 2025

Weak Session ID Check in the OmniAccess Stellar Web Management Interface

• Pre-auth

alcatel-lucent · omniaccess stellar productsJul 16, 2025

Command Injection Vulnerability in the OmniAccess Stellar over UDP Service

• pre-auth RCE
• Command injection

alcatel-lucent · omniaccess stellar productsJul 16, 2025

WordPress Medical Prescription Attachment Plugin for WooCommerce <= 1.2.3 - Arbitrary File Upload Vulnerability

• Pre-auth
• File upload

webkul · medical prescription attachment plugin for woocommerceJul 16, 2025

Sawtooth Software Lighthouse Studio < 9.16.14 Pre-Authentication RCE

• pre-auth RCE
• SSTI

sawtooth software · lighthouse studioJul 16, 2025

Cisco Identity Services Engine Authenticated Remote Code Execution Vulnerability

• RCE

cisco · identity services engineJul 16, 2025

Cisco Identity Services Engine Authenticated Remote Code Execution Vulnerability

• RCE

cisco · identity services engineJul 16, 2025

Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

• pre-auth RCE

cisco · identity services engineJul 16, 2025

Netcore / Netis Routers RCE via UDP Port 53413 Backdoor

• pre-auth RCE
• Command injection

netcore technology · router firmwareJul 16, 2025

Linknat VOS Manager Path Traversal File Disclosure

• Pre-auth
• Path traversal

linknat technology · vos managerJul 16, 2025

EasyCafe Server 2.2.14 Remote File Disclosure via Opcode 0x43

• Pre-auth
• Auth bypass

tinasoft · easycafe serverJul 16, 2025

LimeSurvey 2.0+ - 2.06+ Unauthenticated Arbitrary File Download via Serialized Backup Payload

• Pre-auth
• Auth bypass
• Path traversal

limesurvey gmbh · limesurveyJul 16, 2025

Idera Up.Time ≤ 7.2 post2file.php Arbitrary File Upload RCE

• pre-auth RCE
• Auth bypass
• File upload

idera · up.time monitoring stationJul 16, 2025

VideoCharge Studio 2.12.3.685 SEH Buffer Overflow via .VSC File

• RCE

videocharge software · studioJul 16, 2025

Heroes of Might and Magic III .h3m Map File Buffer Overflow

• RCE

the 3do company · heroes of might and magic iiiJul 16, 2025

D-Link DSP-W110A1 Cookie Command Injection

• pre-auth RCE
• Command injection

d-link · dsp-w110a1Jul 16, 2025

RIPS Scanner v0.54 Path Traversal

• Pre-auth
• Path traversal

rips technologies · rips scannerJul 16, 2025

Achat v0.150 SEH Buffer Overflow via UDP

• pre-auth RCE

achat software · achat chat serverJul 16, 2025

X360 VideoPlayer ActiveX Control Buffer Overflow via ConvertFile()

• pre-auth RCE

x360soft · x360 videoplayer activex controlJul 16, 2025

Stop User Enumeration < 1.7.3 - Protection Bypass

• Pre-auth

fullworksplugins · stop user enumerationJul 17, 2025

Grafana is an open-source platform for monitoring and observability.

• Info leak

grafana · grafanaJul 17, 2025

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet For

• Pre-auth
• SQL injection

fortinet · fortiwebJul 17, 2025

Multer vulnerable to Denial of Service via unhandled exception from malformed request

• Pre-auth
• Denial of service

expressjs · multerJul 17, 2025

Livewire vulnerable to remote command execution during property update hydration

• pre-auth RCE

laravel · livewireJul 17, 2025

An incorrect permissions vulnerability was reported in Elliptic Labs Virtual Lock Sensor that could allow a local, authenticated user to esc

• Local privilege escalation

lenovo · elliptic virtual lock sensor service for thinkpad p1 gen 6 (type 21fv, 21fw)Jul 17, 2025

NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could

• RCE

nvidia · container toolkitJul 17, 2025

GoldenDict 1.5.0 and 1.5.1 has an exposed dangerous method that allows reading and modifying files when a user adds a crafted dictionary and

• Pre-auth

goldendict · goldendictJul 17, 2025

code-projects Online Appointment Booking System adddoctor.php sql injection

• Pre-auth
• SQL injection

anisha · online appointment booking systemJul 17, 2025

Knowledge Base <= 2.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Slug

• XSS

ajay · knowledge baseJul 17, 2025

An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks.

• Pre-auth
• Path traversal
• XSS

grafana · grafanaJul 18, 2025

An open redirect vulnerability has been identified in Grafana OSS organization switching functionality.

• Pre-auth
• Open redirect

grafana · grafanaJul 18, 2025

Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.1 for Joomla

• RCE
• SQL injection

joomsky.com · js jobs component for joomlaJul 18, 2025

mcp-package-docs vulnerable to command injection in several tools

• pre-auth RCE
• Command injection

sammcj · mcp-package-docsJul 18, 2025

Usage of unsafe random function in form-data for choosing boundary

• Pre-auth
• Weak crypto

Jul 18, 2025

Tenda FH451 P2pListFilter fromP2pListFilter stack-based overflow

• Memory safety

tenda · fh451 firmwareJul 18, 2025

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows

• Pre-auth

crushftp · crushftpJul 18, 2025

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX.

• Pre-auth
• Path traversal

nodejs · nodeJul 18, 2025

Front-end Editor < 2.3 - Arbitrary File Upload

• pre-auth RCE
• File upload

scribu · front-end editorJul 19, 2025

Subscribe to Comments <= 2.1.2 - Local File Includion

• RCE

markjaquith · subscribe to commentsJul 19, 2025

Simple Backup <= 2.7.10 - Arbitrary File Download via Path Traversal

• Pre-auth
• Path traversal

mywebsiteadvisor · simple backupJul 19, 2025

WPshop 2 – E-Commerce < 1.3.9.6 - Arbitrary File Upload

• pre-auth RCE
• File upload

eoxia · wpshop 2Jul 19, 2025

GI-Media Library < 3.0 - Directory Traversal

• Pre-auth
• Path traversal

zishanj · gi-media-libraryJul 19, 2025

WP Mobile Detector <= 3.5 - Arbitrary File Upload

• pre-auth RCE
• File upload

wp mobile detector project · wp mobile detectorJul 19, 2025

Work The Flow File Upload <= 2.5.2 - Arbitrary File Upload

• pre-auth RCE
• File upload

lyntonreed · work the flow file uploadJul 19, 2025

WPLMS Learning Management System for WordPress, WordPress LMS <= 1.8.4.1 - Privilege Escalation

vibethemes · wordpress learning management system Jul 19, 2025

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise.

• Pre-auth

prettier · eslint-config-prettierJul 19, 2025

Campcodes Online Movie Theater Seat Reservation System Reserve Your Seat Page index.php cross site scripting

• XSS

campcodes · online movie theater seat reservation systemJul 19, 2025

Microsoft SharePoint Server Remote Code Execution Vulnerability

• pre-auth RCE
• Deserialization

microsoft · sharepoint serverJul 19, 2025

IDnow App de.idnow AndroidManifest.xml improper export of android application components

idnow · idnowJul 20, 2025

yangzongzhuan RuoYi Swagger UI index.html cross site scripting

• Pre-auth
• XSS

ruoyi · ruoyiJul 20, 2025

Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation.

• Pre-auth
• Memory safety

arm · mbed tlsJul 20, 2025

Microsoft SharePoint Server Spoofing Vulnerability

• Pre-auth
• Auth bypass

microsoft · sharepoint serverJul 20, 2025