Skip to content
OpenAdvisories

Archive

July 2025

Vulnerabilities first published in this month (UTC), newest first.

← June 2025 2025 / July August 2025 →
  1. 189
  2. 284
  3. 3149
  4. 4187
  5. 58
  6. 628
  7. 7175
  8. 8440
  9. 9110
  10. 10214
  11. 1196
  12. 1249
  13. 1349
  14. 14127
  15. 15156
  16. 16190
  17. 1789
  18. 18110
  19. 1946
  20. 2066
  21. 21237
  22. 22119
  23. 2394
  24. 2478
  25. 25219
  26. 2645
  27. 2741
  28. 28124
  29. 29175
  30. 3088
  31. 31114
All Critical High Medium Low Exploited only Public exploit

1,456 results · Clear filters · Feed

  • Medium 6.0
    CVE-2025-7962

    Jakarta Mail vulnerable to SMTP Injection

    In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.

    Eclipse Foundation Jakarta Mail thingsboard-tb-node apache-nifi Debian Ubuntu Wolfi Maven
  • Medium 6.3
    CVE-2025-7932

    D-Link DIR‑817L ssdpcgi lxmldbc_system command injection

    A vulnerability classified as critical has been found in D-Link DIR‑817L up to 1.04B01. This affects the function lxmldbc_system of the file ssdpcgi. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit has …

    D-Link DIR‑817L Network devices
  • Medium 6.1
    CVE-2025-7716

    Real-time SEO for Drupal - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-091

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Real-time SEO for Drupal allows Cross-Site Scripting (XSS).This issue affects Real-time SEO for Drupal: from 2.0.0 before 2.2.0.

    Drupal Real-time SEO for Drupal drupal/yoast_seo Web / CMS Packagist
  • Medium 6.1
    CVE-2025-7715

    Block Attributes - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-090

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Attributes allows Cross-Site Scripting (XSS).This issue affects Block Attributes: from 0.0.0 before 1.1.0, from 2.0.0 before 2.0.1.

    Drupal Block Attributes drupal/block_attributes Packagist
  • Medium 6.1
    CVE-2025-7392

    Cookies Addons - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-087

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookies Addons allows Cross-Site Scripting (XSS).This issue affects Cookies Addons: from 1.0.0 before 1.2.4.

    Drupal Cookies Addons drupal/cookies_addons Packagist
  • Medium 4.4
    CVE-2025-30477

    Dell PowerScale OneFS, versions prior to 9.11.0.0, contains a use of a broken or risky cryptographic algorithm vulnerab…

    Dell PowerScale OneFS
  • Medium 6.6
    CVE-2025-32744

    Dell AppSync, version(s) 4.6.0.0, contains an Unrestricted Upload of File with Dangerous Type vulnerability. A high pri…

    Dell AppSync
  • Medium 4.2
    CVE-2025-36603

    Dell AppSync, version(s) 4.6.0.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A lo…

    Dell AppSync
  • Medium 6.3
    CVE-2025-7927

    PHPGurukul Online Banquet Booking System view-user-queries.php sql injection

    A vulnerability has been found in PHPGurukul Online Banquet Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/view-user-queries.php. The manipulation of the argument viewid leads to sql injection. The at…

    PHPGurukul Online Banquet Booking System
  • Medium 5.3
    CVE-2025-6235

    ExtremeControl (NAC) 'onmouseover' XSS

    In ExtremeControl before 25.5.12, a cross-site scripting (XSS) vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject …

    Extreme Networks ExtremeControl
  • Medium 6.8
    CVE-2024-13973 EPSS 12%

    A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potent…

    Sophos Sophos Firewall Network devices
  • Medium 5.9
    CVE-2025-41100

    Incorrect authentication in ParkingDoor

    Incorrect authentication vulnerability in ParkingDoor. Through this vulnerability it is possible to operate the device without the access being logged in the application and even if the access permissions have been revoked.

    ParkingDoor ParkingDoor
  • Medium 4.3
    CVE-2025-7925

    PHPGurukul Online Banquet Booking System login.php cross site scripting

    A vulnerability, which was classified as problematic, has been found in PHPGurukul Online Banquet Booking System 1.0. Affected by this issue is some unknown functionality of the file /admin/login.php. The manipulation of the argument user_login/userpassword l…

    PHPGurukul Online Banquet Booking System
  • Medium 4.4
    CVE-2025-2301 Public exploit

    IDOR in Akbim Software's Online Exam Registration

    Authorization Bypass Through User-Controlled Key vulnerability in Akbim Software Online Exam Registration allows Exploitation of Trusted Identifiers. This issue affects Online Exam Registration: before 14.03.2025.

    Akbim Software Online Exam Registration
  • Medium 6.5
    CVE-2025-5681

    IDOR in Turtek Software's Eyotek

    Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This issue affects Eyotek: before 23.06.2025.

    Turtek Software Eyotek
  • Medium 5.5
    CVE-2025-41458

    Insecure data storage vulnerability in Two App Studio Journey v5.5.9 for iOS

    Unencrypted storage in the database in Two App Studio Journey v5.5.9 for iOS allows local attackers to extract sensitive data via direct access to the app’s filesystem.

    Two App Studio Journey
  • Medium 4.8
    CVE-2025-41681

    Persistent Cross-Site Scripting via POST Requests Due to Improper Neutralization of Input

    A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content.

    MB connect line Helmholz mbNET.mini REX 100
  • Medium 5.3
    CVE-2025-41679

    Unauthenticated Buffer Overflow in Conftool Service Leading to Denial of Service

    An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initializing wizard (Conftool) service.

    MB connect line Helmholz mbNET.mini REX 100
  • Medium 6.5
    CVE-2025-41678

    SQL Injection via POST Requests Allowing Configuration Database Manipulation

    A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements used in a SQL statement.

    MB connect line Helmholz mbNET.mini REX 100
  • Medium 4.9
    CVE-2025-41677

    Resource Exhaustion via POST Requests to send-mail Action

    A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast succession.

    MB connect line Helmholz mbNET.mini REX 100
  • Medium 4.9
    CVE-2025-41676

    Resource Exhaustion via POST Requests to send-sms Action

    A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action in fast succession.

    MB connect line Helmholz mbNET.mini REX 100
  • Medium 6.9
    CVE-2025-4570

    An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token …

    ASUS MyASUS
  • Medium 6.4
    CVE-2025-7354

    WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes

    The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping on user supplie…

    gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Web / CMS
  • Medium 6.1
    CVE-2025-7369

    Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution

    The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. This is due to missing or incorrect nonce validation on the preview function. This makes it possible f…

    gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Web / CMS
  • Medium 6.4
    CVE-2025-4685

    Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

    The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML data attributes of multiple widgets, in all versions up to, and including, 3.4.8 due to insufficient input sanit…

    gutentor Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor Web / CMS
  • Medium 6.7
    CVE-2025-0664

    A locally authenticated, privileged user can craft a malicious OpenSSL configuration file, potentially leading the agen…

    Trellix Trellix Endpoint Security (HX) Agent
  • Medium 6.1
    CVE-2025-7920

    Simopro Technology｜WinMatrix3 Web package - Reflected Cross-Site Scripting

    WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.

    Simopro Technology WinMatrix3 Web package
  • Medium 6.5
    CVE-2025-7919

    Simopro Technology｜WinMatrix3 Web package - SQL Injection

    WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

    Simopro Technology WinMatrix3 Web package
  • Medium 6.1
    CVE-2024-55040 Public exploit

    Cross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6.5.H and before allows a remote attacker…

  • Medium 5.3
    CVE-2025-46118

    An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139 and in Ruckus ZoneDir…

  • Medium 6.3
    CVE-2025-46119

    An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDi…

  • Medium 5.1
    CVE-2025-52372

    An issue in hMailServer v.5.8.6 allows a local attacker to obtain sensitive information via the hmailserver/installatio…

  • Medium 4.6
    CVE-2025-52373

    Use of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passw…

  • Medium 4.6
    CVE-2025-52374

    Use of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt pass…

  • Medium 5.4
    CVE-2025-51396 Public exploit

    A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web s…

  • Medium 5.4
    CVE-2025-51398 Public exploit

    A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows at…

  • Medium 5.4
    CVE-2025-51397 Public exploit

    A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attacker…

  • Medium 5.4
    CVE-2025-51401 Public exploit

    A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attack…

  • Medium 5.4
    CVE-2025-51400 Public exploit

    A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows atta…

  • Medium 6.5
    CVE-2025-51403 Public exploit

    A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4…