# CVEs published 2025-06-27

223 CVEs were published on June 27, 2025: 22 critical, 90 high. Days are UTC.

- [CVE-2024-36347](https://cve.now/CVE-2024-36347.md): Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load… (CVSS 6.4, AMD EPYC™ 7001 Series · AMD EPYC™ 7002 Series +36)
- [CVE-2025-53098](https://cve.now/CVE-2025-53098.md): Roo Code Vulnerable to Potential Remote Code Execution via Model Context Protocol (CVSS 8.1, RooCodeInc Roo-Code)
- [CVE-2025-53097](https://cve.now/CVE-2025-53097.md): Roo Code extension vulnerable to Potential Information Leakage via JSON Schema (CVSS 5.9, RooCodeInc Roo-Code)
- [CVE-2025-6778](https://cve.now/CVE-2025-6778.md): code-projects Food Distributor Site save\_settings.php cross site scripting (CVSS 4.8, code-projects Food Distributor Site)
- [CVE-2025-6777](https://cve.now/CVE-2025-6777.md): code-projects Food Distributor Site process\_login.php sql injection (CVSS 6.9, code-projects Food Distributor Site)
- [CVE-2025-6776](https://cve.now/CVE-2025-6776.md): xiaoyunjie openvpn-cms-flask File Upload controller.py upload path traversal (CVSS 6.9, xiaoyunjie openvpn-cms-flask)
- [CVE-2025-6775](https://cve.now/CVE-2025-6775.md): xiaoyunjie openvpn-cms-flask User Creation Endpoint openvpn.py create\_user command injection (CVSS 5.3, xiaoyunjie openvpn-cms-flask)
- [CVE-2025-53094](https://cve.now/CVE-2025-53094.md): ESPAsyncWebServer Vulnerable to CRLF Injection in AsyncWebHeader.cpp (CVSS 8.7, ESP32Async ESPAsyncWebServer)
- [CVE-2025-6774](https://cve.now/CVE-2025-6774.md): gooaclok819 sublinkX template.go AddTemp path traversal (CVSS 5.3, gooaclok819 sublinkX)
- [CVE-2025-6773](https://cve.now/CVE-2025-6773.md): HKUDS LightRAG File Upload document\_routes.py upload\_to\_input\_dir path traversal (CVSS 4.8, HKUDS LightRAG · lightrag-hku)
- [CVE-2025-6772](https://cve.now/CVE-2025-6772.md): eosphoros-ai db-gpt import import\_flow path traversal (CVSS 6.9, eosphoros-ai db-gpt)
- [CVE-2025-53093](https://cve.now/CVE-2025-53093.md): TabberNeue vulnerable to Stored XSS through wikitext (CVSS 8.6, StarCitizenTools mediawiki-extensions-TabberNeue · starciti…)
- [CVE-2025-5310](https://cve.now/CVE-2025-5310.md): Dover Fueling Solutions ProGauge MagLink LX Consoles Missing Authentication for Critical Function (CVSS 9.8, Dover Fueling Solutions ProGauge MagLink LX)
- [CVE-2025-6522](https://cve.now/CVE-2025-6522.md): TrendMakers Sight Bulb Pro Command Injection (CVSS 5.4, TrendMakers Sight Bulb Pro Firmware ZJ\_CG32-2201)
- [CVE-2025-6521](https://cve.now/CVE-2025-6521.md): TrendMakers Sight Bulb Pro Use of a Broken or Risky Cryptographic Algorithm (CVSS 7.6, TrendMakers Sight Bulb Pro Firmware ZJ\_CG32-2201)
- [CVE-2025-46708](https://cve.now/CVE-2025-46708.md): GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs (CVSS 4.3, Imagination Technologies Graphics DDK)
- [CVE-2024-12143](https://cve.now/CVE-2024-12143.md): SQLi in Mobilteg Mobile Informatics' Mikro Hand Terminal - MikroDB (CVSS 9.8, Mobilteg Mobile Informatics Mikro Hand Terminal - MikroDB)
- [CVE-2025-46707](https://cve.now/CVE-2025-46707.md): GPU DDK - Guest VM can override its own FW VZ connection state after the FW has close it (CVSS 5.2, Imagination Technologies Graphics DDK)
- [CVE-2024-12150](https://cve.now/CVE-2024-12150.md): SQLi in Eron Software's Wowwo CRM (CVSS 9.8, Eron Software Wowwo CRM)
- [CVE-2024-12364](https://cve.now/CVE-2024-12364.md): SQLi in Mavi Yeşil Software's Guest Tracking Software (CVSS 9.8, Mavi Yeşil Software Guest Tracking Software)
- [CVE-2024-11739](https://cve.now/CVE-2024-11739.md): SQLi in Case Informatics' Case ERP (CVSS 9.8, Case Informatics Case ERP)
- [CVE-2025-53091](https://cve.now/CVE-2025-53091.md): WeGIA has Unauthenticated Time-Based Blind SQL Injection in almox Parameter (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-52553](https://cve.now/CVE-2025-52553.md): authentik has Insufficient Session verification for Remote Access Control endpoint access (CVSS 5.5, goauthentik authentik)
- [CVE-2025-6705](https://cve.now/CVE-2025-6705.md): A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. (CVSS 7.6, Eclipse Foundation Eclipse Open VSX Registry)
- [CVE-2023-38007](https://cve.now/CVE-2023-38007.md): IBM Cloud Pak System HTML injection (CVSS 5.4, IBM Cloud Pak System)
- [CVE-2025-36595](https://cve.now/CVE-2025-36595.md): Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Directives in Statically Saved Code… (CVSS 7.2, Dell Unisphere for PowerMax vApp)
- [CVE-2025-6768](https://cve.now/CVE-2025-6768.md): sfturing hosp\_order HospitalServiceImpl.java findAllHosByCondition sql injection (CVSS 5.3, sfturing hosp\_order)
- [CVE-2025-53339](https://cve.now/CVE-2025-53339.md): WordPress Devnex Addons For Elementor plugin \<= 1.0.9 - Local File Inclusion Vulnerability (CVSS 7.5, Devnex Addons For Elementor)
- [CVE-2025-53338](https://cve.now/CVE-2025-53338.md): WordPress re.place plugin \<= 0.2.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, dor re.place)
- [CVE-2025-53336](https://cve.now/CVE-2025-53336.md): WordPress My Resume Builder plugin \<= 1.0.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, abditsori My Resume Builder)
- [CVE-2025-53332](https://cve.now/CVE-2025-53332.md): WordPress Track Everything plugin \<= 2.0.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, ethoseo Track Everything)
- [CVE-2025-53331](https://cve.now/CVE-2025-53331.md): WordPress RSS Digest plugin \<= 1.5 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, samcharrington RSS Digest)
- [CVE-2025-53329](https://cve.now/CVE-2025-53329.md): WordPress Społecznościowa 6 PL 2013 plugin \<= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, szajenw Społecznościowa 6 PL)
- [CVE-2025-53327](https://cve.now/CVE-2025-53327.md): WordPress Aioseo Multibyte Descriptions plugin \<= 0.0.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, rui\_mashita Aioseo Multibyte Descriptions)
- [CVE-2025-53325](https://cve.now/CVE-2025-53325.md): WordPress Beauty Contact Popup Form plugin \<= 6.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Dilip kumar Beauty Contact Popup Form)
- [CVE-2025-53323](https://cve.now/CVE-2025-53323.md): WordPress Pre-Publish Post Checklist plugin \<= 3.1 - Broken Access Control Vulnerability (CVSS 4.3, danbriapps Pre-Publish Post Checklist)
- [CVE-2025-53322](https://cve.now/CVE-2025-53322.md): WordPress Accept Authorize.NET Payments Using Contact Form 7 plugin \<= 2.5 - Sensitive Data Exposure Vulnerability (CVSS 5.3, ZealousWeb Accept Authorize.NET Payments Using Contact Form)
- [CVE-2025-53321](https://cve.now/CVE-2025-53321.md): WordPress Raise The Money plugin \<= 5.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Raise The Money)
- [CVE-2025-53320](https://cve.now/CVE-2025-53320.md): WordPress Free Downloads EDD plugin \<= 1.0.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Wp Enhanced Free Downloads EDD)
- [CVE-2025-53318](https://cve.now/CVE-2025-53318.md): WordPress WP DB Booster plugin \<= 1.0.1 - Broken Access Control Vulnerability (CVSS 5.4, WPManiax WP DB Booster)
- [CVE-2025-53317](https://cve.now/CVE-2025-53317.md): WordPress WPShapere Lite plugin \<= 1.4.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, AcmeeDesign WPShapere - WordPress admin theme)
- [CVE-2025-53315](https://cve.now/CVE-2025-53315.md): WordPress Relocate Upload plugin \<= 0.24.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, alanft Relocate Upload)
- [CVE-2025-53314](https://cve.now/CVE-2025-53314.md): WordPress WP Optimizer plugin \<= 2.5.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 9.6, sh1zen WP Optimizer)
- [CVE-2025-53313](https://cve.now/CVE-2025-53313.md): WordPress Twitch TV Embed Suite plugin \<= 2.1.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, plumwd Twitch TV Embed Suite)
- [CVE-2025-53312](https://cve.now/CVE-2025-53312.md): WordPress OnionBuzz plugin \<= 1.0.7 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Looks Awesome OnionBuzz)
- [CVE-2025-53311](https://cve.now/CVE-2025-53311.md): WordPress Navayan Subscribe plugin \<= 1.13 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Amol Nirmala Waman Navayan Subscribe)
- [CVE-2025-53310](https://cve.now/CVE-2025-53310.md): WordPress HidePost plugin \<= 2.3.8 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Funnnny HidePost)
- [CVE-2025-53309](https://cve.now/CVE-2025-53309.md): WordPress Accept Stripe Payments Using Contact Form 7 plugin \<= 3.0 - Sensitive Data Exposure Vulnerability (CVSS 5.3, ZealousWeb Accept Stripe Payments Using Contact Form)
- [CVE-2025-53308](https://cve.now/CVE-2025-53308.md): WordPress Image Slider With Description plugin \<= 9.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, gopi\_plus Image Slider With Description)
- [CVE-2025-53306](https://cve.now/CVE-2025-53306.md): WordPress WP Forum Server plugin \<= 1.8.2 - SQL Injection Vulnerability (CVSS 7.6, lucidcrew WP Forum Server)
- [CVE-2025-53305](https://cve.now/CVE-2025-53305.md): WordPress WP Forum Server plugin \<= 1.8.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, lucidcrew WP Forum Server)
- [CVE-2025-53304](https://cve.now/CVE-2025-53304.md): WordPress Contact Form – 7 : Hide Success Message plugin \<= 1.1.4 - Broken Access Control Vulnerability (CVSS 5.3, Rohil Contact Form – 7 : Hide Success Message)
- [CVE-2025-53301](https://cve.now/CVE-2025-53301.md): WordPress Theme Junkie Team Content plugin \<= 0.1.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Theme Junkie Team Content)
- [CVE-2025-53300](https://cve.now/CVE-2025-53300.md): WordPress Podcast Feed Player Widget and Shortcode plugin \<= 2.2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, douglaskarr Podcast Feed Player Widget and Shortcode)
- [CVE-2025-53298](https://cve.now/CVE-2025-53298.md): WordPress Plugin Inspector plugin \<= 1.5 - Arbitrary File Download Vulnerability (CVSS 4.9, gioni Plugin Inspector)
- [CVE-2025-53296](https://cve.now/CVE-2025-53296.md): WordPress EC Stars Rating plugin \<= 1.0.11 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, ecoal95 EC Stars Rating)
- [CVE-2025-53295](https://cve.now/CVE-2025-53295.md): WordPress iCount Payment Gateway plugin \<= 2.0.7 - Broken Access Control Vulnerability (CVSS 5.3, iCount Payment Gateway)
- [CVE-2025-53294](https://cve.now/CVE-2025-53294.md): WordPress Smart Agenda plugin \<= 4.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Smart Agenda)
- [CVE-2025-53293](https://cve.now/CVE-2025-53293.md): WordPress Dashboard Widget Sidebar plugin \<= 1.2.3 - Broken Access Control Vulnerability (CVSS 4.3, Morten Dalgaard Johansen Dashboard Widget Sidebar)
- [CVE-2025-53292](https://cve.now/CVE-2025-53292.md): WordPress WP DataTable plugin \<= 0.2.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, samsk WP DataTable)
- [CVE-2025-53290](https://cve.now/CVE-2025-53290.md): WordPress WP Visual Sitemap plugin \<= 1.0.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, MS WP Visual Sitemap)
- [CVE-2025-53288](https://cve.now/CVE-2025-53288.md): WordPress PlatiOnline Payments plugin \<= 7.0.0 - Broken Access Control vulnerability (CVSS 4.3, Adrian Ladó PlatiOnline Payments)
- [CVE-2025-53287](https://cve.now/CVE-2025-53287.md): WordPress Quick Favicon plugin \<= 0.22.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Robert Cummings Quick Favicon)
- [CVE-2025-53285](https://cve.now/CVE-2025-53285.md): WordPress Add & Replace Affiliate Links for Amazon plugin \<= 1.0.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, The Website Flip Add & Replace Affiliate Links for Amazon)
- [CVE-2025-53284](https://cve.now/CVE-2025-53284.md): WordPress CMS Blocks plugin \<= 1.1 - Broken Access Control Vulnerability (CVSS 6.5, pankaj.sakaria CMS Blocks)
- [CVE-2025-53282](https://cve.now/CVE-2025-53282.md): WordPress Thumbnail Editor plugin \<= 2.3.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, aviplugins.com Thumbnail Editor)
- [CVE-2025-53281](https://cve.now/CVE-2025-53281.md): WordPress WPB Category Slider for WooCommerce plugin \<= 1.71 - Local File Inclusion Vulnerability (CVSS 7.5, WPBean WPB Category Slider for WooCommerce)
- [CVE-2025-53280](https://cve.now/CVE-2025-53280.md): WordPress Football Pool plugin \<= 2.12.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, AntoineH Football Pool)
- [CVE-2025-53279](https://cve.now/CVE-2025-53279.md): WordPress Popup addon for Ninja Forms plugin \<= 3.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Aman Popup addon for Ninja Forms)
- [CVE-2025-53278](https://cve.now/CVE-2025-53278.md): WordPress WP AdCenter plugin \<= 2.6.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPeka WP AdCenter)
- [CVE-2025-53277](https://cve.now/CVE-2025-53277.md): WordPress IS-theme-companion plugin \<= 1.59 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8, Infigo Software IS-theme-companion)
- [CVE-2025-53276](https://cve.now/CVE-2025-53276.md): WordPress Omnipress plugin \<= 1.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, omnipressteam Omnipress)
- [CVE-2025-53275](https://cve.now/CVE-2025-53275.md): WordPress Leyka plugin \<= 3.32.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, VaultDweller Leyka)
- [CVE-2025-53274](https://cve.now/CVE-2025-53274.md): WordPress WP Permalink Translator plugin \<= 1.7.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Hossin Asaadi WP Permalink Translator)
- [CVE-2025-53273](https://cve.now/CVE-2025-53273.md): WordPress Slickstream plugin \<= 2.0.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Slickstream)
- [CVE-2025-53272](https://cve.now/CVE-2025-53272.md): WordPress Image Cleanup plugin \<= 1.9.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, opicron Image Cleanup)
- [CVE-2025-53271](https://cve.now/CVE-2025-53271.md): WordPress Additional Order Filters for WooCommerce plugin \<= 1.22 - Cross Site Request Forgery (CSRF) to Stored XSS Vulnerability (CVSS 7.1, Anton Bond Additional Order Filters for WooCommerce)
- [CVE-2025-53270](https://cve.now/CVE-2025-53270.md): WordPress CTA plugin \<= 1.7.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Blend Media WordPress CTA)
- [CVE-2025-53269](https://cve.now/CVE-2025-53269.md): WordPress My Wp Brand plugin \<= 1.1.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, imw3 My Wp Brand)
- [CVE-2025-53268](https://cve.now/CVE-2025-53268.md): WordPress Import external attachments plugin \<= 1.5.12 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, ryanpcmcquen Import external attachments)
- [CVE-2025-53267](https://cve.now/CVE-2025-53267.md): WordPress Hide Admin Bar From Front End plugin \<= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Aftab Husain Hide Admin Bar From Front End)
- [CVE-2025-53266](https://cve.now/CVE-2025-53266.md): WordPress Cron Logger plugin \<= 1.3.0 - Broken Access Control Vulnerability (CVSS 4.3, EdwardBock Cron Logger)
- [CVE-2025-53265](https://cve.now/CVE-2025-53265.md): WordPress Virusdie plugin \<= 1.1.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, Virusdie)
- [CVE-2025-53264](https://cve.now/CVE-2025-53264.md): WordPress ONet Regenerate Thumbnails plugin \<= 1.5 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Konrád Koller ONet Regenerate Thumbnails)
- [CVE-2025-53263](https://cve.now/CVE-2025-53263.md): WordPress Address Autocomplete via Google for Gravity Forms plugin \<= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, PluginsCafe Address Autocomplete via Google for Gravity For…)
- [CVE-2025-53262](https://cve.now/CVE-2025-53262.md): WordPress Writesonic plugin \<= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Writesonic)
- [CVE-2025-53261](https://cve.now/CVE-2025-53261.md): WordPress WP YouTube Live plugin \<= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, macbookandrew WP YouTube Live)
- [CVE-2025-53260](https://cve.now/CVE-2025-53260.md): WordPress File Manager Plugin For Wordpress plugin \<= 7.5 - Arbitrary File Upload Vulnerability (CVSS 9.1, getredhawkstudio File Manager Plugin For Wordpress)
- [CVE-2025-53259](https://cve.now/CVE-2025-53259.md): WordPress Hotel Booking plugin \<= 3.7 - Local File Inclusion Vulnerability (CVSS 7.5, nicdark Hotel Booking)
- [CVE-2025-53258](https://cve.now/CVE-2025-53258.md): WordPress Hover Effects plugin \<= 2.1.2 - SQL Injection Vulnerability (CVSS 7.6, Wow-Company Hover Effects)
- [CVE-2025-53257](https://cve.now/CVE-2025-53257.md): WordPress Gmedia Photo Gallery plugin \<= 1.23.0 - Local File Inclusion Vulnerability (CVSS 7.5, Serhii Pasyuk Gmedia Photo Gallery)
- [CVE-2025-53256](https://cve.now/CVE-2025-53256.md): WordPress YaySMTP plugin \<= 2.6.6 - SQL Injection Vulnerability (CVSS 7.6, YayCommerce YaySMTP)
- [CVE-2025-53255](https://cve.now/CVE-2025-53255.md): WordPress HurryTimer plugin \<= 2.13.1 - Broken Access Control Vulnerability (CVSS 5.3, Nabil Lemsieh HurryTimer)
- [CVE-2025-53254](https://cve.now/CVE-2025-53254.md): WordPress Cyrlitera plugin \<= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Themeisle Cyrlitera)
- [CVE-2025-53253](https://cve.now/CVE-2025-53253.md): WordPress WP Edit plugin \<= 4.0.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Josh WP Edit)
- [CVE-2025-53211](https://cve.now/CVE-2025-53211.md): WordPress Audio Editor & Recorder plugin \<= 2.2.3 - Sensitive Data Exposure Vulnerability (CVSS 5.3, Roland Beaussant Audio Editor & Recorder)
- [CVE-2025-53206](https://cve.now/CVE-2025-53206.md): WordPress HT Mega – Absolute Addons for WPBakery Page Builder plugin \<= 1.0.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, HT Plugins HT Mega – Absolute Addons for WPBakery Page Buil…)
- [CVE-2025-53203](https://cve.now/CVE-2025-53203.md): WordPress WooCommerce PDF Invoice Builder plugin \<= 1.2.148 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, EDGARROJAS WooCommerce PDF Invoice Builder)
- [CVE-2025-53202](https://cve.now/CVE-2025-53202.md): WordPress Responsive Blocks plugin \<= 2.0.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, CyberChimps Responsive Blocks)
- [CVE-2025-53200](https://cve.now/CVE-2025-53200.md): WordPress ChatBot plugin \<= 6.7.3 - Broken Access Control Vulnerability (CVSS 4.3, QuantumCloud ChatBot)
- [CVE-2025-53199](https://cve.now/CVE-2025-53199.md): WordPress HT Slider For Elementor plugin \<= 1.6.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, HT Plugins HT Slider For Elementor)
- [CVE-2025-53197](https://cve.now/CVE-2025-53197.md): WordPress Cookiebot plugin \<= 4.5.8 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Cookiebot)
- [CVE-2025-53193](https://cve.now/CVE-2025-53193.md): WordPress Burst Statistics plugin \<= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Burst Statistics B.V. Burst Statistics)
- [CVE-2025-6767](https://cve.now/CVE-2025-6767.md): sfturing hosp\_order DoctorServiceImpl.java findDoctorByCondition sql injection (CVSS 5.3, sfturing hosp\_order)
- [CVE-2025-53018](https://cve.now/CVE-2025-53018.md): Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs (CVSS 3.0, LycheeOrg Lychee)
- [CVE-2025-6766](https://cve.now/CVE-2025-6766.md): sfturing hosp\_order OfficeServiceImpl.java getOfficeName sql injection (CVSS 5.3, sfturing hosp\_order)
- [CVE-2025-40910](https://cve.now/CVE-2025-40910.md): Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow… (CVSS 6.5, Net-IP-LPM)
- [CVE-2025-6765](https://cve.now/CVE-2025-6765.md): Intelbras InControl HTTP PUT Request operador permission (CVSS 5.3, Intelbras InControl)
- [CVE-2025-24765](https://cve.now/CVE-2025-24765.md): WordPress Image Shadow plugin \<= 1.1.0 - Arbitrary File Deletion Vulnerability (CVSS 7.7, RobMarsh Image Shadow)
- [CVE-2025-24769](https://cve.now/CVE-2025-24769.md): WordPress Zenny theme \<= 1.7.5 - Local File Inclusion Vulnerability (CVSS 8.1, BZOTheme Zenny)
- [CVE-2025-24774](https://cve.now/CVE-2025-24774.md): WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin \<= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce)
- [CVE-2025-25171](https://cve.now/CVE-2025-25171.md): WordPress WP SmartPay plugin \<= 2.7.13 - Account Takeover vulnerability (CVSS 8.8, Convers Lab WP SmartPay)
- [CVE-2025-25173](https://cve.now/CVE-2025-25173.md): WordPress FastBook plugin \<= 1.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, FasterThemes FastBook)
- [CVE-2025-27361](https://cve.now/CVE-2025-27361.md): WordPress Photo Express for Google plugin \<= 0.3.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, thhake Photo Express for Google)
- [CVE-2025-28946](https://cve.now/CVE-2025-28946.md): WordPress PrintXtore theme \< 1.7.8 - Local File Inclusion vulnerability (CVSS 8.1, BZOTheme PrintXtore)
- [CVE-2025-28947](https://cve.now/CVE-2025-28947.md): WordPress MBStore - Digital WooCommerce WordPress Theme \<= 2.3 - Local File Inclusion Vulnerability (CVSS 8.1, snstheme MBStore - Digital WooCommerce WordPress Theme)
- [CVE-2025-28956](https://cve.now/CVE-2025-28956.md): WordPress Backwp plugin \<= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wphobby Backwp)
- [CVE-2025-28960](https://cve.now/CVE-2025-28960.md): WordPress Evangelische Termine plugin \<= 3.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, regibaer Evangelische Termine)
- [CVE-2025-28970](https://cve.now/CVE-2025-28970.md): WordPress WP Optimize By xTraffic plugin \<= 5.1.6 - PHP Object Injection Vulnerability (CVSS 9.8, pep.vn WP Optimize By xTraffic)
- [CVE-2025-28988](https://cve.now/CVE-2025-28988.md): WordPress WP Front User Submit / Front Editor plugin \<= 4.9.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, aharonyan WP Front User Submit / Front Editor)
- [CVE-2025-28990](https://cve.now/CVE-2025-28990.md): WordPress SNS Vicky theme \<= 3.7 - Local File Inclusion Vulnerability (CVSS 8.1, snstheme SNS Vicky)
- [CVE-2025-28993](https://cve.now/CVE-2025-28993.md): WordPress Content No Cache plugin \<= 0.1.4 - Arbitrary Function Call vulnerability (CVSS 8.6, Jose Mortellaro Content No Cache)
- [CVE-2025-28998](https://cve.now/CVE-2025-28998.md): WordPress SERPed.net plugin \<= 4.6 - Local File Inclusion Vulnerability (CVSS 8.1, serpednet SERPed.net)
- [CVE-2025-30972](https://cve.now/CVE-2025-30972.md): WordPress Woocommerce Line Notify plugin \<= 1.1.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, iamapinan Woocommerce Line Notify)
- [CVE-2025-30992](https://cve.now/CVE-2025-30992.md): WordPress Puca theme \<= 2.6.33 - Local File Inclusion Vulnerability (CVSS 8.1, thembay Puca)
- [CVE-2025-31067](https://cve.now/CVE-2025-31067.md): WordPress Seven Stars theme \<= 1.4.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, themeton Seven Stars)
- [CVE-2025-31428](https://cve.now/CVE-2025-31428.md): WordPress HYDRO theme \<= 2.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, BuddhaThemes HYDRO)
- [CVE-2025-32281](https://cve.now/CVE-2025-32281.md): WordPress DarkMySite plugin \<= 1.2.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, DarkMySite)
- [CVE-2025-32298](https://cve.now/CVE-2025-32298.md): WordPress CTUsers plugin \<= 1.0.0 - Local File Inclusion Vulnerability (CVSS 7.5, Case-Themes CTUsers)
- [CVE-2025-39474](https://cve.now/CVE-2025-39474.md): WordPress Amely theme \<= 3.1.4 - SQL Injection vulnerability (CVSS 9.3, ThemeMove Amely)
- [CVE-2025-39478](https://cve.now/CVE-2025-39478.md): WordPress Smart Notification Plugin \<= 10.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, smartiolabs Smart Notification)
- [CVE-2025-39488](https://cve.now/CVE-2025-39488.md): WordPress MagOne theme \<= 8.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sneeit MagOne)
- [CVE-2025-47574](https://cve.now/CVE-2025-47574.md): WordPress School Management System Plugin \<= 92.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mojoomla School Management)
- [CVE-2025-47654](https://cve.now/CVE-2025-47654.md): WordPress FormLift for Infusionsoft Web Forms plugin \<= 7.5.20 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Adrian Tobey FormLift for Infusionsoft Web Forms)
- [CVE-2025-49290](https://cve.now/CVE-2025-49290.md): WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin \<= 0.5.8.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jory Hogeveen Off-Canvas Sidebars & Menus)
- [CVE-2025-49321](https://cve.now/CVE-2025-49321.md): WordPress Eventin plugin \<= 4.0.28 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Arraytics Eventin)
- [CVE-2025-49883](https://cve.now/CVE-2025-49883.md): WordPress Greenmart theme \<= 4.2.3 - Local File Inclusion Vulnerability (CVSS 8.1, thembay Greenmart)
- [CVE-2025-49885](https://cve.now/CVE-2025-49885.md): WordPress Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin \<= 5.0.6 - Arbitrary File Upload Vulnerability (CVSS 10.0, HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCom…)
- [CVE-2025-49886](https://cve.now/CVE-2025-49886.md): WordPress Zikzag Core plugin \<= 1.4.5 - Local File Inclusion Vulnerability (CVSS 8.1, WebGeniusLab Zikzag Core)
- [CVE-2025-50052](https://cve.now/CVE-2025-50052.md): WordPress Flexo Counter plugin \<= 1.0001 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, flexostudio Flexo Counter)
- [CVE-2025-52717](https://cve.now/CVE-2025-52717.md): WordPress LifterLMS plugin \<= 8.0.6 - SQL Injection Vulnerability (CVSS 9.3, chrisbadgett LifterLMS)
- [CVE-2025-52722](https://cve.now/CVE-2025-52722.md): WordPress Classiera theme \<= 4.0.34 - SQL Injection Vulnerability (CVSS 9.3, JoinWebs Classiera)
- [CVE-2025-52723](https://cve.now/CVE-2025-52723.md): WordPress Networker theme \<= 1.2.0 - Local File Inclusion Vulnerability (CVSS 8.1, codesupplyco Networker)
- [CVE-2025-52724](https://cve.now/CVE-2025-52724.md): WordPress Amwerk theme \<= 1.2.0 - PHP Object Injection Vulnerability (CVSS 9.8, BoldThemes Amwerk)
- [CVE-2025-52725](https://cve.now/CVE-2025-52725.md): WordPress CouponXxL theme \<= 3.0.0 - PHP Object Injection Vulnerability (CVSS 9.8, pebas CouponXxL)
- [CVE-2025-52726](https://cve.now/CVE-2025-52726.md): WordPress CouponXxL Custom Post Types plugin \<= 3.0 - Privilege Escalation Vulnerability (CVSS 8.6, pebas CouponXxL Custom Post Types)
- [CVE-2025-52727](https://cve.now/CVE-2025-52727.md): WordPress CSS3 Vertical Web Pricing Tables plugin \<= 1.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, QuanticaLabs CSS3 Vertical Web Pricing Tables)
- [CVE-2025-52729](https://cve.now/CVE-2025-52729.md): WordPress Diza theme \<= 1.3.9 - Local File Inclusion Vulnerability (CVSS 8.1, thembay Diza)
- [CVE-2025-52774](https://cve.now/CVE-2025-52774.md): WordPress Infility Global plugin \<= 2.15.06 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Infility Global)
- [CVE-2025-52778](https://cve.now/CVE-2025-52778.md): WordPress xili-dictionary plugin \<= 2.12.5.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Michel - xiligroup dev xili-dictionary)
- [CVE-2025-52799](https://cve.now/CVE-2025-52799.md): WordPress LMS theme \<= 9.2 - Reflected Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, designthemes LMS)
- [CVE-2025-52808](https://cve.now/CVE-2025-52808.md): WordPress RealtyElite theme \<= 1.0.0 - Local File Inclusion Vulnerability (CVSS 8.1, real-web RealtyElite)
- [CVE-2025-52809](https://cve.now/CVE-2025-52809.md): WordPress National Weather Service Alerts plugin \<= 1.3.5 - Local File Inclusion Vulnerability (CVSS 8.1, John Russell National Weather Service Alerts)
- [CVE-2025-52810](https://cve.now/CVE-2025-52810.md): WordPress Katerio - Magazine theme \<= 1.5.1 - Local File Inclusion Vulnerability (CVSS 8.1, TMRW-studio Katerio - Magazine)
- [CVE-2025-52811](https://cve.now/CVE-2025-52811.md): WordPress Davenport - Versatile Blog and Magazine WordPress Theme \<= 1.3 - Local File Inclusion Vulnerability (CVSS 8.1, Creanncy Davenport - Versatile Blog and Magazine WordPress…)
- [CVE-2025-52812](https://cve.now/CVE-2025-52812.md): WordPress Domnoo theme \<= 1.49 - Local File Inclusion Vulnerability (CVSS 8.1, ApusWP Domnoo)
- [CVE-2025-52814](https://cve.now/CVE-2025-52814.md): WordPress BRW plugin \<= 1.8.8 - Local File Inclusion Vulnerability (CVSS 8.1, ovatheme BRW)
- [CVE-2025-52815](https://cve.now/CVE-2025-52815.md): WordPress CityGov theme \<= 1.9 - Local File Inclusion Vulnerability (CVSS 8.1, AncoraThemes CityGov)
- [CVE-2025-52816](https://cve.now/CVE-2025-52816.md): WordPress Zita theme \<= 1.6.5 - Local File Inclusion Vulnerability (CVSS 8.1, themehunk Zita)
- [CVE-2025-52817](https://cve.now/CVE-2025-52817.md): WordPress Abandoned Contact Form 7 plugin \<= 2.2 - Broken Access Control vulnerability (CVSS 8.2, ZealousWeb Abandoned Contact Form)
- [CVE-2025-52818](https://cve.now/CVE-2025-52818.md): WordPress Trusty Whistleblowing plugin \<= 2.0.1 - Broken Access Control vulnerability (CVSS 8.2, Dejan Jasnic Trusty Whistleblowing)
- [CVE-2025-52824](https://cve.now/CVE-2025-52824.md): WordPress Mobile DJ Manager plugin \<= 1.7.8.3 - Privilege Escalation vulnerability (CVSS 8.8, MDJM Mobile DJ Manager)
- [CVE-2025-52826](https://cve.now/CVE-2025-52826.md): WordPress Sala theme \<= 1.1.3 - PHP Object Injection Vulnerability (CVSS 8.8, uxper Sala)
- [CVE-2025-52827](https://cve.now/CVE-2025-52827.md): WordPress Nuss theme \<= 1.3.3 - PHP Object Injection Vulnerability (CVSS 8.8, uxper Nuss)
- [CVE-2025-52829](https://cve.now/CVE-2025-52829.md): WordPress DirectIQ Email Marketing plugin \<= 2.0 - SQL Injection Vulnerability (CVSS 9.3, DirectIQ Email Marketing)
- [CVE-2025-52834](https://cve.now/CVE-2025-52834.md): WordPress Homey theme \<= 2.4.7 - SQL Injection vulnerability (CVSS 9.3, favethemes Homey)
- [CVE-2023-25998](https://cve.now/CVE-2023-25998.md): WordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme \<= 2.6 - Local File Inclusion Vulnerability (CVSS 8.1, snstheme Samex - Clean, Minimal Shop WooCommerce WordPress…)
- [CVE-2025-23967](https://cve.now/CVE-2025-23967.md): WordPress GG Bought Together for WooCommerce plugin \<= 1.0.2 - SQL Injection Vulnerability (CVSS 9.3, wpopal GG Bought Together for WooCommerce)
- [CVE-2025-23973](https://cve.now/CVE-2025-23973.md): WordPress SpecFit-Virtual Try On Woocommerce plugin \<= 8.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, dugudlabs SpecFit-Virtual Try On Woocommerce)
- [CVE-2025-24760](https://cve.now/CVE-2025-24760.md): WordPress Sofass theme \<= 1.3.4 - Local File Inclusion Vulnerability (CVSS 8.1, goalthemes Sofass)
- [CVE-2025-49416](https://cve.now/CVE-2025-49416.md): WordPress FW Gallery plugin \<= 8.0.0 - Local File Inclusion Vulnerability (CVSS 8.1, Fastw3b FW Gallery)
- [CVE-2025-49423](https://cve.now/CVE-2025-49423.md): WordPress Bulk YouTube Post Creator plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Syed Tahir Ali Jan Bulk YouTube Post Creator)
- [CVE-2025-49448](https://cve.now/CVE-2025-49448.md): WordPress FW Food Menu plugin \<= 6.0.0 - Arbitrary File Deletion Vulnerability (CVSS 8.6, Fastw3b FW Food Menu)
- [CVE-2025-6763](https://cve.now/CVE-2025-6763.md): Comet System H3531 Web-based Management setupA.cfg missing authentication (CVSS 9.2, Comet System T0510 · Comet System T3510 +8)
- [CVE-2025-6762](https://cve.now/CVE-2025-6762.md): diyhi bbs HTTP Header login getUrl server-side request forgery (CVSS 5.3, diyhi bbs)
- [CVE-2025-6761](https://cve.now/CVE-2025-6761.md): Kingdee Cloud-Starry-Sky Enterprise Edition Freemarker Engine DynamicForm 4 Action.class plugin.buildMobilePopHtml special elements used… (CVSS 6.9, Kingdee Cloud-Starry-Sky Enterprise Edition)
- [CVE-2025-5398](https://cve.now/CVE-2025-5398.md): Ninja Forms \<= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI (CVSS 6.4, kstover Ninja Forms – The Contact Form Builder That Grows W…)
- [CVE-2024-12827](https://cve.now/CVE-2024-12827.md): DWT - Directory & Listing WordPress Theme \<= 3.3.6 - Unauthenticated Arbitrary User Password Reset (CVSS 9.8, scriptsbundle DWT - Directory & Listing WordPress Theme)
- [CVE-2025-2940](https://cve.now/CVE-2025-2940.md): Ninja Tables – Easy Data Table Builder \<= 5.0.18 - Unauthenticated Server-Side Request Forgery (CVSS 7.2, techjewel Ninja Tables – Easy Data Table Builder)
- [CVE-2025-5306](https://cve.now/CVE-2025-5306.md): Command Injection in Netflow path (CVSS 7.0, Pandora FMS)
- [CVE-2025-6688](https://cve.now/CVE-2025-6688.md): Simple Payment 1.3.6 - 2.3.8 - Authentication Bypass to Admin (CVSS 9.8, idokd Simple Payment)
- [CVE-2025-5936](https://cve.now/CVE-2025-5936.md): VR Calendar \<= 2.4.7 - Cross-Site Request Forgery to Calendar Sync (CVSS 4.3, innate-images-llc VR Calendar)
- [CVE-2025-5940](https://cve.now/CVE-2025-5940.md): Osom Blocks \<= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via class\_name Parameter (CVSS 6.4, osompress Osom Blocks)
- [CVE-2025-6550](https://cve.now/CVE-2025-6550.md): The Pack Elementor addon \<= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, webangon The Pack Elementor addon)
- [CVE-2025-4587](https://cve.now/CVE-2025-4587.md): A/B Testing for WordPress \<= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, johnjamesjacoby A/B Testing for WordPress)
- [CVE-2025-6689](https://cve.now/CVE-2025-6689.md): FL3R Accessibility Suite \<= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via fl3raccessibilitysuite Shortcode (CVSS 6.4, armandofiore FL3R Accessibility Suite)
- [CVE-2025-5526](https://cve.now/CVE-2025-5526.md): BuddyPress Docs \< 2.2.5 - Subscriber+ Arbitrary Document Read/Update (CVSS 4.3, BuddyPress Docs)
- [CVE-2025-5194](https://cve.now/CVE-2025-5194.md): WP Map Block by aBlocks \< 2.0.3 - Contributor+ Stored XSS via Marker (CVSS 4.8, WP Map Block)
- [CVE-2025-5093](https://cve.now/CVE-2025-5093.md): Responsive Lightbox & Gallery \< 2.5.2 - Contributor+ Stored XSS (CVSS 5.4, Responsive Lightbox & Gallery)
- [CVE-2025-5035](https://cve.now/CVE-2025-5035.md): Firelight Lightbox \< 2.3.16 - Contributor+ Stored XSS (CVSS 5.4, Firelight Lightbox)
- [CVE-2025-41418](https://cve.now/CVE-2025-41418.md): Buffer Overflow vulnerability exists in multiple versions of TB-eye network recorders and AHD recorders. (CVSS 5.3, TB-eye XRN-410SN/TE · TB-eye XRN-810SN/TE +15)
- [CVE-2025-36529](https://cve.now/CVE-2025-36529.md): An OS command injection issue exists in multiple versions of TB-eye network recorders and AHD recorders. (CVSS 7.2, TB-eye XRN-410SN/TE · TB-eye XRN-810SN/TE +15)
- [CVE-2025-6488](https://cve.now/CVE-2025-6488.md): isMobile \<= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via device Parameter (CVSS 6.4, jairoochoa isMobile() Shortcode for WordPress)
- [CVE-2025-6753](https://cve.now/CVE-2025-6753.md): huija bicycleSharingServer AdminController.java selectAdminByNameLike sql injection (CVSS 5.3, huija bicycleSharingServer)
- [CVE-2025-6752](https://cve.now/CVE-2025-6752.md): Linksys WRT1900ACS/EA7200/EA7450/EA7500 IGD Layer3Forwarding SetDefaultConnectionService stack-based overflow (CVSS 8.7, Linksys WRT1900ACS · Linksys EA7200 +2)
- [CVE-2025-6751](https://cve.now/CVE-2025-6751.md): Linksys E8450 HTTP POST Request portal.cgi set\_device\_language buffer overflow (CVSS 8.7, Linksys E8450)
- [CVE-2025-6750](https://cve.now/CVE-2025-6750.md): HDF5 H5Omtime.c H5O\_\_mtime\_new\_encode heap-based overflow (CVSS 4.8, HDF5)
- [CVE-2025-6749](https://cve.now/CVE-2025-6749.md): huija bicycleSharingServer AdminController.java searchAdminMessageShow sql injection (CVSS 5.3, huija bicycleSharingServer)
- [CVE-2025-6748](https://cve.now/CVE-2025-6748.md): Bharti Airtel Thanks App files cleartext storage in a file or on disk (CVSS 2.4, Bharti Airtel Thanks App)
- [CVE-2025-6738](https://cve.now/CVE-2025-6738.md): huija bicycleSharingServer UserServiceImpl.java userDao.selectUserByUserNameLike sql injection (CVSS 5.3, huija bicycleSharingServer)
- [CVE-2025-44163](https://cve.now/CVE-2025-44163.md): RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get\_wgkey.php. (CVSS 6.3, billz/raspap-webgui)
- [CVE-2025-44557](https://cve.now/CVE-2025-44557.md): A state machine transition flaw in the Bluetooth Low Energy (BLE) stack of Cypress PSoC4 v3.66 allows attackers to bypass the pairing… (CVSS 8.1)
- [CVE-2025-44559](https://cve.now/CVE-2025-44559.md): An issue in the Bluetooth Low Energy (BLE) stack of Realtek RTL8762E BLE SDK v1.4.0 allows attackers within Bluetooth range to cause a… (CVSS 6.5)
- [CVE-2025-45729](https://cve.now/CVE-2025-45729.md): D-Link DIR-823-Pro 1.02 has improper permission control, allowing unauthorized users to turn on and access Telnet services. (CVSS 6.3)
- [CVE-2025-45737](https://cve.now/CVE-2025-45737.md): An issue in NetEase (Hangzhou) Network Co., Ltd NeacSafe64 Driver before v1.0.0.8 allows attackers to escalate privileges via sending… (CVSS 6.5)
- [CVE-2025-45851](https://cve.now/CVE-2025-45851.md): An issue in Hikvision DS-2CD1321-I V5.7.21 build 230819 allows attackers to cause a Denial of Service (DoS) via sending a crafted POST… (CVSS 7.5)
- [CVE-2025-46415](https://cve.now/CVE-2025-46415.md): A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. (CVSS 3.2, NixOS Nix)
- [CVE-2025-46416](https://cve.now/CVE-2025-46416.md): The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user… (CVSS 2.9, NixOS Nix)
- [CVE-2025-47818](https://cve.now/CVE-2025-47818.md): Flock Safety Gunshot Detection devices before 1.3 have a hard-coded password for a connection. (CVSS 2.2, Flock Safety Gunshot Detection devices)
- [CVE-2025-47819](https://cve.now/CVE-2025-47819.md): Flock Safety Gunshot Detection devices before 1.3 have an on-chip debug interface with improper access control. (CVSS 6.4, Flock Safety Gunshot Detection devices)
- [CVE-2025-47820](https://cve.now/CVE-2025-47820.md): Flock Safety Gunshot Detection devices before 1.3 have cleartext storage of code. (CVSS 2.0, Flock Safety Gunshot Detection devices)
- [CVE-2025-47821](https://cve.now/CVE-2025-47821.md): Flock Safety Gunshot Detection devices before 1.3 have a hardcoded password for a system. (CVSS 2.2, Flock Safety Gunshot Detection devices)
- [CVE-2025-47822](https://cve.now/CVE-2025-47822.md): Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have an on-chip debug interface with improper access control. (CVSS 6.4, Flock Safety License Plate Reader)
- [CVE-2025-47823](https://cve.now/CVE-2025-47823.md): Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system. (CVSS 2.2, Flock Safety License Plate Reader)
- [CVE-2025-47824](https://cve.now/CVE-2025-47824.md): Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have cleartext storage of code. (CVSS 2.0, Flock Safety License Plate Reader)
- [CVE-2025-50367](https://cve.now/CVE-2025-50367.md): A stored blind XSS vulnerability exists in the Contact Page of the Phpgurukul Medical Card Generation System 1.0 mcgs/contact.php. (CVSS 6.1)
- [CVE-2025-50369](https://cve.now/CVE-2025-50369.md): A Cross-Site Request Forgery (CSRF) vulnerability exists in the Manage Card functionality (/mcgs/admin/manage-card.php) of PHPGurukul… (CVSS 6.5)
- [CVE-2025-50370](https://cve.now/CVE-2025-50370.md): A Cross-Site Request Forgery (CSRF) vulnerability exists in the Inquiry Management functionality /mcgs/admin/readenq.php of the Phpgurukul… (CVSS 6.5)
- [CVE-2025-50528](https://cve.now/CVE-2025-50528.md): A buffer overflow vulnerability exists in the fromNatStaticSetting function of Tenda AC6 \<=V15.03.05.19 via the page parameter. (CVSS 7.3)
- [CVE-2025-52207](https://cve.now/CVE-2025-52207.md): PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbitrary directory. (CVSS 9.9, MikoPBX)
- [CVE-2025-52991](https://cve.now/CVE-2025-52991.md): The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. (CVSS 3.2, NixOS Nix)
- [CVE-2025-52992](https://cve.now/CVE-2025-52992.md): The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. (CVSS 3.2, NixOS Nix)
- [CVE-2025-52993](https://cve.now/CVE-2025-52993.md): A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the… (CVSS 5.6, NixOS Nix)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2025-06-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.