CVEs published June 3, 2025
116 CVEs were published on June 3, 2025: 9 critical, 40 high. 3 are now in CISA KEV.
- Published
- 116
- Critical
- 9
- High
- 40
- Medium
- 66
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 3
- Fix available
- 35
Most affected products
- Qualcomm Snapdragon
- 18
- IBM QRadar Suite Software · IBM Cloud Pak for Security
- 5
- Python Software Foundation CPython
- 5
- quequnlong shiyi-blog
- 5
- TOTOLINK X2000R
- 5
- dataease
- 4
- Parallels Desktop for Mac
- 4
- TOTOLINK A3002RU
- 4
- slackero phpwcms
- 3
- aaluoxiang oa_system
- 2
Critical 9
- CVE-2025-48951Auth0-PHP SDK Deserialization of Untrusted Data vulnerabilityauth0-PHP · auth0/auth0-php
- CVE-2025-25022IBM QRadar Suite Software and IBM Cloud Pak for Security information disclosureIBM QRadar Suite Software · IBM Cloud Pak for Security
- CVE-2025-4517Arbitrary writes via tarfile realpath overflowPython Software Foundation CPython
- CVE-2025-4797Golo <= 1.7.0 - Authentication Bypass to Account Takeoveruxper Golo - City Travel Guide WordPress Theme
- CVE-2025-23097An issue was discovered in Samsung Mobile Processor Exynos 1380.
- CVE-2025-32105A buffer overflow in the the Sangoma IMG2020 HTTP server through 2.3.9.6 allows an unauthenticated user to achieve remote code execution.
- CVE-2025-32106In Audiocodes Mediapack MP-11x through 6.60A.369.002, a crafted POST request request may result in an unauthenticated remote user's ability
- CVE-2025-44148Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx co
- CVE-2025-45854/server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams.JEHC-BPM
High 40
- CVE-2025-24015Deno's AES GCM authentication tags are not verifieddenoland deno · deno +1
- CVE-2025-49002Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerabilitydataease
- CVE-2025-49001Dataease Authentication Bypass Vulnerabilitydataease
- CVE-2025-5527Tenda RX3 SetStaticRouteCfg save_staticroute_data stack-based overflowTenda RX3
- CVE-2025-35036hibernate-validator insecure default Expression Language interpolationHibernate Validator · org.hibernate.validator:hibernate-… +1
- CVE-2025-48998Dataease MYSQL JDBC File Reading Vulnerabilitydataease
- CVE-2025-48997Multer vulnerable to Denial of Service via unhandled exceptionexpressjs multer · multer
- CVE-2025-30167Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerabilityjupyter_core · jupyter-core
- CVE-2025-25021IBM QRadar Suite Software and IBM Cloud Pak for Security code injectionIBM QRadar Suite Software · IBM Cloud Pak for Security
- CVE-2025-36564Dell Encryption Admin Utilities versions prior to 11.10.2 contain an Improper Link Resolution vulnerability.Dell Encryption Admin Utilities
- CVE-2025-5503TOTOLINK X15 formMapReboot stack-based overflowTOTOLINK X15
- CVE-2025-4435Tarfile extracts filtered members when errorlevel=0Python Software Foundation CPython
- CVE-2025-4138Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directoryPython Software Foundation CPython
- CVE-2025-4330Extraction filter bypass for linking outside extraction directoryPython Software Foundation CPython
- CVE-2024-52561A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740).Parallels Desktop for Mac
- CVE-2024-54189A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740).Parallels Desktop for Mac
- CVE-2024-36486A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20Parallels Desktop for Mac
- CVE-2025-31359A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879).Parallels Desktop for Mac
- CVE-2025-4392Shared Files <= 1.7.48 - Unauthenticated Stored Cross-Site Scripting via sanitize_file Functionanssilaitila Shared Files – Frontend File Upload Form & Sec…
- CVE-2025-46355Incorrect default permissions issue in PC Time Tracer prior to 5.2.Keiyo System Co. PC Time Tracer
- CVE-2025-21479Incorrect Authorization in GraphicsQualcomm Snapdragon
- CVE-2025-27038Use After Free in GraphicsQualcomm Snapdragon
- CVE-2025-27031Use After Free in Bluetooth HOSTQualcomm Snapdragon
- CVE-2025-27029Buffer Over-read in WLAN HALQualcomm Snapdragon
- CVE-2025-21486Untrusted Pointer Dereference in DSP ServiceQualcomm Snapdragon
- CVE-2025-21485Time-of-check Time-of-use (TOCTOU) Race Condition in DSP ServiceQualcomm Snapdragon
- CVE-2025-21480Incorrect Authorization in Graphics WindowsQualcomm Snapdragon
- CVE-2025-21463Buffer Over-read in WLAN Host CommunicationQualcomm Snapdragon
- CVE-2024-53026Buffer Over-read in Data Network Stack & ConnectivityQualcomm Snapdragon
- CVE-2024-53021Buffer Over-read in Data Network Stack & ConnectivityQualcomm Snapdragon
- CVE-2024-53020Buffer Over-read in Data Network Stack & ConnectivityQualcomm Snapdragon
- CVE-2024-53019Buffer Over-read in Data Network Stack & ConnectivityQualcomm Snapdragon
- CVE-2024-53010Improper Access Control in CoreQualcomm Snapdragon
- CVE-2025-4224wpForo + wpForo Advanced Attachments <= 3.1.3 - Unauthenticated Stored Cross-Site ScriptinggVectors wpForo + wpForo Advanced Attachments
- CVE-2025-23098An issue was discovered in Samsung Mobile Processor Exynos 980, 990, 1080, 2100, 1280, 2200, 1380.
- CVE-2025-23100An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400.
- CVE-2025-23102An issue was discovered in Samsung Mobile Processor Exynos 980, 990, 1080, 2100, 1280, 2200, 1380, 1480 and 2400.
- CVE-2025-23103An issue was discovered in Samsung Mobile Processor Exynos 1480 and 2400.
- CVE-2025-23107An issue was discovered in Samsung Mobile Processor Exynos 1480 and 2400.
- CVE-2025-46154Foxcms v1.25 has a SQL time injection in the $_POST['dbname'] parameter of installdb.php.
Medium, low and unrated 67
- CVE-2025-5546PHPGurukul Daily Expense Tracker System expense-reports-detailed.php sql injectionPHPGurukul Daily Expense Tracker System
- CVE-2025-5545aaluoxiang oa_system ProcedureController.java image path traversalaaluoxiang oa_system
- CVE-2025-5544aaluoxiang oa_system UserpanelController.java image path traversalaaluoxiang oa_system
- CVE-2025-5543TOTOLINK X2000R Parent Controls Page cross site scriptingTOTOLINK X2000R
- CVE-2025-5542TOTOLINK X2000R Virtual Server Page formPortFw cross site scriptingTOTOLINK X2000R
- CVE-2025-49000InvenTree has uncontrolled memory allocation via built-in label-sheet pluginInvenTree
- CVE-2025-48999Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerabilitydataease
- CVE-2025-5525Jrohy trojan linux.go LogChan os command injectionJrohy trojan
- CVE-2025-5523enilu web-flash File Upload upload fileService.upload cross site scriptingenilu web-flash
- CVE-2025-5522jack0240 魏 bskms 蓝天幼儿园管理系统 User Creation addUser improper authorizationjack0240 魏 bskms 蓝天幼儿园管理系统
- CVE-2025-5521WuKongOpenSource WukongCRM updataPassword cross-site request forgeryWuKongOpenSource WukongCRM
- CVE-2025-48953Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File UploadsUmbraco-CMS · Umbraco.Cms
- CVE-2025-48950MaxKB Python Sandbox Bypass in Function Library1Panel-dev MaxKB
- CVE-2025-5520Open5GS AMF/MME emm_state_authentication assertionOpen5GS
- CVE-2025-5516TOTOLINK X2000R URL Filtering Page formFilter cross site scriptingTOTOLINK X2000R
- CVE-2025-30360webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browserwebpack-dev-server
- CVE-2025-30359webpack-dev-server users' source code may be stolen when they access a malicious web sitewebpack-dev-server
- CVE-2025-5515TOTOLINK X2000R formMapDel command injectionTOTOLINK X2000R
- CVE-2025-5513quequnlong shiyi-blog add cross site scriptingquequnlong shiyi-blog
- CVE-2025-5512quequnlong shiyi-blog Administrator Backend verifyPassword improper authenticationquequnlong shiyi-blog
- CVE-2025-5511quequnlong shiyi-blog photos improper authorizationquequnlong shiyi-blog
- CVE-2025-5510quequnlong shiyi-blog optimize server-side request forgeryquequnlong shiyi-blog
- CVE-2025-5509quequnlong shiyi-blog upload path traversalquequnlong shiyi-blog
- CVE-2025-5508TOTOLINK A3002RU IP Port Filtering Page cross site scriptingTOTOLINK A3002RU
- CVE-2025-5507TOTOLINK A3002RU MAC Filtering Page cross site scriptingTOTOLINK A3002RU
- CVE-2025-25020IBM QRadar Suite Software and IBM Cloud Pak for Security improper input validationIBM QRadar Suite Software · IBM Cloud Pak for Security
- CVE-2025-1334IBM QRadar Suite Software and IBM Cloud Pak for Security information disclosureIBM QRadar Suite Software · IBM Cloud Pak for Security
- CVE-2025-25019IBM QRadar Suite Software and IBM Cloud Pak for Security session fixationIBM QRadar Suite Software · IBM Cloud Pak for Security
- CVE-2025-5506TOTOLINK A3002RU NAT Mapping Page cross site scriptingTOTOLINK A3002RU
- CVE-2025-5505TOTOLINK A3002RU Virtual Server Page formPortFw cross site scriptingTOTOLINK A3002RU
- CVE-2024-45655IBM Application Gateway incorrect permission assignmentIBM Application Gateway
- CVE-2025-46548Apache Pekko Management, Apache Pekko Management, Apache Pekko Management, Akka Management, Akka Management, Akka Management: management API basic authentication is not effectiveApache Software Foundation Apache Pekko Management · Lig… +6
- CVE-2025-5504TOTOLINK X2000R formWsc command injectionTOTOLINK X2000R
- CVE-2025-5502TOTOLINK X15 formMapReboot command injectionTOTOLINK X15
- CVE-2025-5501Open5GS NGAP PathSwitchRequest Message ngap-handler.c ngap_handle_path_switch_request_transfer assertionOpen5GS
- CVE-2025-5499slackero phpwcms image_resized.php getimagesize deserializationslackero phpwcms
- CVE-2025-5498slackero phpwcms Custom Source Tab cnt21.readform.inc.php is_file deserializationslackero phpwcms
- CVE-2025-5497slackero phpwcms Feedimport processing.inc.php deserializationslackero phpwcms
- CVE-2024-12718Bypass extraction filter to modify file metadata outside extraction directoryPython Software Foundation CPython
- CVE-2025-5495Netgear WNR614 URL improper authenticationNetgear WNR614
- CVE-2025-4205Popup Maker <= 1.20.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via popupID Parameterdanieliser Popup Maker – Boost Sales, Conversions, Optins,…
- CVE-2025-4671Profile Builder <= 3.13.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodescozmoslabs User Profile Builder – Beautiful User Registrati…
- CVE-2025-5340Music Player for Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via album_buy_url Parametersmartwpress Music Player for Elementor – Audio Player & Pod…
- CVE-2025-5493Baison Channel Middleware Product ToJsonByControlName sql injectionBaison Channel Middleware Product
- CVE-2025-5492D-Link DI-500WF-WT /usr/sbin/jhttpd msp_info.htm sub_456DE8 command injectionD-Link DI-500WF-WT
- CVE-2025-5103Ultimate Gift Cards for WooCommerce <= 3.1.4 - Authenticated (Administrator+) SQL Injection via wps_wgm_save_post Functionwpswings Ultimate Gift Cards for WooCommerce
- CVE-2025-5116WP Plugin Info Card <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via containerid Parameterbrikou WP Plugin Info Card
- CVE-2025-4420Vayu Blocks <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via containerWidth Parameterthemehunk Vayu Blocks – Website Builder for the Block Editor
- CVE-2025-1725Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Uploadsbitpressadmin File Manager
- CVE-2025-41428Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in TimeWorks 10.0 to 10.3.Keiyo System Co. TimeWorks
- CVE-2025-4567Post Slider and Carousel with Widget < 3.2.10 - Admin+ Stored XSSPost Slider and Post Carousel with Post Vertical Scrolling…
- CVE-2025-3662FancyBox for WordPress < 3.3.6 - Unauthenticated Stored XSSFancyBox for WordPress
- CVE-2025-3584Newsletter < 8.8.2 - Admin+ Stored XSS via SubscriptionNewsletter
- CVE-2024-53018Time-of-check Time-of-use (TOCTOU) Race Condition in Camera DriverQualcomm Snapdragon
- CVE-2024-53017Use of Out-of-range Pointer Offset in Camera DriverQualcomm Snapdragon
- CVE-2024-53016Time-of-check Time-of-use (TOCTOU) Race Condition in Camera DriverQualcomm Snapdragon
- CVE-2024-53015Use After Free in Computer VisionQualcomm Snapdragon
- CVE-2024-53013Buffer Copy Without Checking Size of Input in AudioQualcomm Snapdragon
- CVE-2025-31712In cplog service, there is a possible out of bounds write due to a missing bounds check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2025-31711In cplog service, there is a possible system crash due to null pointer dereference.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2025-31710In engineermode service, there is a possible command injection due to improper input validation.Unisoc (Shanghai) Technologies Co. SC9863A/T606/T612/T616/T…
- CVE-2025-2939Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated PHP Object Injection to Limited Remote Code Executiontechjewel Ninja Tables – Easy Data Table Builder
- CVE-2025-4047Broken Link Checker <= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard Viewwpmudev Broken Link Checker
- CVE-2025-43923An issue was discovered in ReportController in Unicom Focal Point 7.6.1.
- CVE-2025-43924Cross Site Scripting vulnerability was discovered in Unicom Focal Point 7.6.1.
- CVE-2025-43925An issue was discovered in Unicom Focal Point 7.6.1.
- CVE-2025-45855An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary xyz.erupt:erupt