IT-Sentinel

> CVE-2025-54359

[PUBLISHED: 2025-07-22]

Rejected reason: Not used

> CVE-2025-54358

[PUBLISHED: 2025-07-22]

Rejected reason: Not used

> CVE-2025-54357

[PUBLISHED: 2025-07-22]

Rejected reason: Not used

> CVE-2025-54356

[PUBLISHED: 2025-07-22]

Rejected reason: Not used

> CVE-2025-54355

[PUBLISHED: 2025-07-22]

Rejected reason: Not used

> CVE-2025-54354

[PUBLISHED: 2025-07-22]

Rejected reason: Not used

> CVE-2025-7949 [LOW 3.5]

[PUBLISHED: 2025-07-22] [EPSS 0.37%]

A vulnerability was found in Sanluan PublicCMS up to 5.202506.a. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file publiccms-parent/publiccms/src/main/resources/templates/admin/cmsDiy/preview.html. The manipulation of the argument url leads t...

AFFECTED_PRODUCTS: Publiccms Publiccms

> CVE-2025-6831 [MEDIUM 6.4]

[PUBLISHED: 2025-07-22] [EPSS 0.37%]

The User Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's urcr_restrict shortcode in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

> CVE-2025-5240 [MEDIUM 6.4]

[PUBLISHED: 2025-07-22] [EPSS 0.37%]

The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor...

> CVE-2015-10137 [CRITICAL 9.8]

[PUBLISHED: 2025-07-22] [EPSS 5.42%]

The Website Contact Form With File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_file()' function in versions up to, and including, 1.3.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the af...

> CVE-2012-10020 [CRITICAL 9.8]

[PUBLISHED: 2025-07-22] [EPSS 4.78%]

The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in versions up to, and including, 0.4.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may ma...

> CVE-2025-7948 [MEDIUM 4.3]

[PUBLISHED: 2025-07-22] [EPSS 0.43%]

A vulnerability classified as problematic was found in jshERP up to 3.5. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/user/updatePwd. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed to the pu...

AFFECTED_PRODUCTS: Jishenghua Jsherp

> CVE-2025-7947 [MEDIUM 5.4]

[PUBLISHED: 2025-07-22] [EPSS 0.46%]

A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Handler. The manipulation of the argument ID leads to improper authorization. It is possible to launch the attack remotely. The exploit has bee...

AFFECTED_PRODUCTS: Jishenghua Jsherp

> CVE-2025-7946 [MEDIUM 4.3]

[PUBLISHED: 2025-07-22] [EPSS 0.54%]

A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /search-visitor.php of the component HTTP POST Request Handler. The manipulation of the argument searchdata leads to cross site s...

AFFECTED_PRODUCTS: Phpgurukul Apartment Visitors Management System

> CVE-2025-7945 [HIGH 8.8]

[PUBLISHED: 2025-07-22] [EPSS 7.15%]

A vulnerability was found in D-Link DIR-513 up to 20190831. It has been declared as critical. This vulnerability affects the function formSetWanDhcpplus of the file /goform/formSetWanDhcpplus. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. Th...

> CVE-2025-7944 [MEDIUM 4.3]

[PUBLISHED: 2025-07-21] [EPSS 0.43%]

A vulnerability was found in PHPGurukul Taxi Stand Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /search.php. The manipulation of the argument searchdata leads to cross site scripting. It is possible to initiate the attack remotely. The exploi...

AFFECTED_PRODUCTS: Phpgurukul Auto\/taxi Stand Management System

> CVE-2025-7943 [MEDIUM 4.3]

[PUBLISHED: 2025-07-21] [EPSS 0.40%]

A vulnerability was found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/search-autoortaxi.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be launched...

AFFECTED_PRODUCTS: Phpgurukul Auto\/taxi Stand Management System

> CVE-2025-7486 [MEDIUM 4.4]

[PUBLISHED: 2025-07-21] [EPSS 0.26%]

The Ebook Store plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Order Details in all versions up to, and including, 5.8012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inj...

> CVE-2025-7942 [LOW 3.5]

[PUBLISHED: 2025-07-21] [EPSS 0.29%]

A vulnerability has been found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/admin-profile.php. The manipulation of the argument adminname leads to cross site scripting. The attack can be la...

AFFECTED_PRODUCTS: Phpgurukul Auto\/taxi Stand Management System

> CVE-2025-7941 [LOW 3.5]

[PUBLISHED: 2025-07-21] [EPSS 0.30%]

A vulnerability, which was classified as problematic, was found in PHPGurukul Time Table Generator System 1.0. Affected is an unknown function of the file /admin/profile.php. The manipulation of the argument adminname leads to cross site scripting. It is possible to launch the attack remotely. The e...

AFFECTED_PRODUCTS: Phpgurukul Time Table Generator System

> CVE-2025-7940 [MEDIUM 5.3]

[PUBLISHED: 2025-07-21] [EPSS 0.16%]

A vulnerability was found in Genshin Albedo Cat House App 1.0.2 on Android. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.house.auscat. The manipulation leads to improper export of android applicat...

> CVE-2025-7939 [MEDIUM 6.3]

[PUBLISHED: 2025-07-21] [EPSS 0.47%]

A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0. It has been classified as critical. Affected is the function addGoods of the file GoodsController.java. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely.

> CVE-2025-54134 [MEDIUM 6.5]

[PUBLISHED: 2025-07-21] [EPSS 0.47%]

HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when an authenticated attacker provides an API request lacking required URL parameters. This vulnerability affects the listFiles and saveFiles en...

AFFECTED_PRODUCTS: Psu Haxcms Nodejs

> CVE-2025-54129 [MEDIUM 4.3]

[PUBLISHED: 2025-07-21] [EPSS 0.32%]

HAXiam is a packaging wrapper for HAXcms which allows anyone to spawn their own microsite management platform. In versions 11.0.4 and below, the application returns a 200 response when requesting the data of a valid user and a 404 response when requesting the data of an invalid user. This can be use...

AFFECTED_PRODUCTS: Psu Haxiam

> CVE-2025-54128 [MEDIUM 6.1]

[PUBLISHED: 2025-07-21] [EPSS 0.23%]

HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.7 and below, the NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-s...

AFFECTED_PRODUCTS: Psu Haxcms Nodejs

> CVE-2025-54127 [CRITICAL 9.8]

[PUBLISHED: 2025-07-21] [EPSS 0.46%]

HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses an insecure default configuration designed for local development. The default configuration does not perform authorization or authentication...

AFFECTED_PRODUCTS: Psu Haxcms Nodejs

> CVE-2025-54122 [CRITICAL 10.0]

[PUBLISHED: 2025-07-21] [EPSS 0.89%]

Manager-io/Manager is accounting software. A critical unauthenticated full read Server-Side Request Forgery (SSRF) vulnerability has been identified in the proxy handler component of both manager Desktop and Server edition versions up to and including 25.7.18.2519. This vulnerability allows an unaut...

> CVE-2025-53832 [HIGH 7.5]

[PUBLISHED: 2025-07-21] [⚡ EPSS 10.9%]

Lara Translate MCP Server is a Model Context Protocol (MCP) Server for Lara Translate API. Versions 0.0.11 and below contain a command injection vulnerability which exists in the @translated/lara-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to...

> CVE-2025-53528 [HIGH 7.6]

[PUBLISHED: 2025-07-21] [EPSS 0.28%]

Cadwyn creates production-ready community-driven modern Stripe-like API versioning in FastAPI. In versions before 5.4.3, the version parameter of the "/docs" endpoint is vulnerable to a Reflected XSS (Cross-Site Scripting) attack. This XSS would notably allow an attacker to execute JavaScript code o...

> CVE-2025-7938 [MEDIUM 4.3]

[PUBLISHED: 2025-07-21] [EPSS 0.43%]

A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0 and classified as critical. This issue affects the function updateGoods of the file GoodsController.java. The manipulation leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to...

> CVE-2025-7936 [MEDIUM 6.3]

[PUBLISHED: 2025-07-21] [EPSS 0.43%]

A vulnerability has been found in fuyang_lipengjun platform up to ca9aceff6902feb7b0b6bf510842aea88430796a and classified as critical. Affected by this vulnerability is the function queryPage of the file com/platform/controller/ScheduleJobLogController.java. The manipulation of the argument beanName...

AFFECTED_PRODUCTS: Fuyang Lipengjun Platform

> CVE-2025-7325 [HIGH 7.8]

[PUBLISHED: 2025-07-21] [EPSS 0.25%]

IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target...