---
title: "Security digest: July 14, 2025"
url: https://erroneo.us/security/2025-07-14/
description: "July 14, 2025 vulnerability digest: 1 CISA KEV addition (Wing FTP Server); 4 critical advisories (Maven, Composer (PHP)…). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2025-07-14
date_modified: 2025-07-14
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: July 14, 2025

1 known exploited (cisa kev) addition and 4 critical advisories.

## Take stock

- Do you run any of these? Wing FTP Server Wing FTP Server. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-08-04.
- Maven: 2 critical advisories ( org.xwiki.rendering:xwiki-rendering-syntax-xhtml , org.xwiki.rendering:xwiki-rendering-transformation-macro ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- Composer (PHP): 1 critical advisory ( binarytorch/larecipe ). Check with composer audit .
- RubyGems: 1 critical advisory ( job-iteration ). Check with bundle audit check --update .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2025-47812](https://erroneo.us/security/cve/CVE-2025-47812/index.md) Wing FTP Server Wing FTP Server: Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability (CISA due 2025-08-04)

## Critical advisories

- [CVE-2025-53835](https://erroneo.us/security/cve/CVE-2025-53835/index.md) XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax — Maven org.xwiki.rendering:xwiki-rendering-syntax-xhtml >= 5.4.5, < 14.10 → 14.10
- [CVE-2025-53833](https://erroneo.us/security/cve/CVE-2025-53833/index.md) LaRecipe is vulnerable to Server-Side Template Injection attacks — Composer (PHP) binarytorch/larecipe < 2.8.1 → 2.8.1
- [CVE-2025-53623](https://erroneo.us/security/cve/CVE-2025-53623/index.md) Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class — RubyGems job-iteration < 1.11 → 1.11
- [CVE-2025-53836](https://erroneo.us/security/cve/CVE-2025-53836/index.md) XWiki Rendering is vulnerable to RCE attacks when processing nested macros — Maven org.xwiki.rendering:xwiki-rendering-transformation-macro >= 4.2-milestone-1, < 13.10.11 → 13.10.11; Maven org.xwiki.rendering:xwiki-rendering-transformation-macro >= 14.0, < 14.4.7 → 14.4.7; Maven org.xwiki.rendering:xwiki-rendering-transformation-macro >= 14.5, < 14.10 → 14.10

---
Source page: https://erroneo.us/security/2025-07-14/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt