# CVEs published 2025-06-01

19 CVEs were published on June 1, 2025: 2 critical, 0 high. Days are UTC.

- [CVE-2025-5412](https://cve.now/CVE-2025-5412.md): Mist Community Edition Authentication Endpoint views.py login cross site scripting (CVSS 5.1, Mist Community Edition)
- [CVE-2025-5411](https://cve.now/CVE-2025-5411.md): Mist Community Edition views.py tag\_resources cross site scripting (CVSS 5.1, Mist Community Edition)
- [CVE-2025-5410](https://cve.now/CVE-2025-5410.md): Mist Community Edition middleware.py session\_start\_response cross-site request forgery (CVSS 5.3, Mist Community Edition)
- [CVE-2025-5409](https://cve.now/CVE-2025-5409.md): Mist Community Edition API Token views.py create\_token access control (CVSS 6.9, Mist Community Edition)
- [CVE-2025-5408](https://cve.now/CVE-2025-5408.md): WAVLINK WL-WN576K1 HTTP POST Request login.cgi sys\_login buffer overflow (CVSS 9.3, WAVLINK QUANTUM D2G · WAVLINK QUANTUM D3G +4)
- [CVE-2025-5407](https://cve.now/CVE-2025-5407.md): chaitak-gorai Blogbook register\_script.php cross site scripting (CVSS 4.8, chaitak-gorai Blogbook)
- [CVE-2025-5406](https://cve.now/CVE-2025-5406.md): chaitak-gorai Blogbook posts.php unrestricted upload (CVSS 5.3, chaitak-gorai Blogbook)
- [CVE-2025-5405](https://cve.now/CVE-2025-5405.md): chaitak-gorai Blogbook post.php cross site scripting (CVSS 5.1, chaitak-gorai Blogbook)
- [CVE-2025-5404](https://cve.now/CVE-2025-5404.md): chaitak-gorai Blogbook GET Parameter search.php denial of service (CVSS 5.3, chaitak-gorai Blogbook)
- [CVE-2025-5403](https://cve.now/CVE-2025-5403.md): chaitak-gorai Blogbook GET Parameter view\_all\_posts.php sql injection (CVSS 5.3, chaitak-gorai Blogbook)
- [CVE-2025-5402](https://cve.now/CVE-2025-5402.md): chaitak-gorai Blogbook GET Parameter edit\_post.php sql injection (CVSS 6.9, chaitak-gorai Blogbook)
- [CVE-2025-40908](https://cve.now/CVE-2025-40908.md): YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified (CVSS 9.1, TINITA YAML::LibYAML)
- [CVE-2025-5401](https://cve.now/CVE-2025-5401.md): chaitak-gorai Blogbook GET Parameter post.php sql injection (CVSS 6.9, chaitak-gorai Blogbook)
- [CVE-2025-33005](https://cve.now/CVE-2025-33005.md): IBM Planning Analytics Local session fixation (CVSS 6.3, IBM Planning Analytics Local)
- [CVE-2025-33004](https://cve.now/CVE-2025-33004.md): IBM Planning Analytics Local path traversal (CVSS 6.5, IBM Planning Analytics Local)
- [CVE-2025-2896](https://cve.now/CVE-2025-2896.md): IBM Planning Analytics Local cross-site scripting (CVSS 4.8, IBM Planning Analytics Local)
- [CVE-2025-25044](https://cve.now/CVE-2025-25044.md): IBM Planning Analytics Local cross-site scripting (CVSS 5.4, IBM Planning Analytics Local)
- [CVE-2025-1499](https://cve.now/CVE-2025-1499.md): IBM InfoSphere Information Server information disclosure (CVSS 6.5, IBM InfoSphere Information Server)
- [CVE-2025-5400](https://cve.now/CVE-2025-5400.md): chaitak-gorai Blogbook GET Parameter user.php sql injection (CVSS 6.9, chaitak-gorai Blogbook)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-06-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.