CVEs published June 4, 2025
134 CVEs were published on June 4, 2025: 7 critical, 25 high.
- Published
- 134
- Critical
- 7
- High
- 25
- Medium
- 100
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 25
Most affected products
- FreeFloat FTP Server
- 10
- Samsung Mobile Devices
- 10
- PHPGurukul Online Fire Reporting System
- 7
- CodeAstro Real Estate Management System
- 6
- FreshRSS
- 6
- PHPGurukul Dairy Farm Shop Management System
- 6
- Cisco Unified Contact Center Express
- 4
- Delta Electronics CNCSoft
- 4
- Tenda AC18
- 4
- Acronis Cyber Protect
- 3
Critical 7
- CVE-2025-5600TOTOLINK EX1200T cstecgi.cgi setLanguageCfg stack-based overflowTOTOLINK EX1200T
- CVE-2025-20286ISE on AWS Static CredentialCisco Identity Services Engine Software
- CVE-2025-5597WF Steuerungstechnik GmbH - airleader MASTER - Authentication BypassWF Steuerungstechnik airleader MASTER
- CVE-2025-5598WF Steuerungstechnik GmbH - airleader MASTER - Path TraversalWF Steuerungstechnik airleader MASTER
- CVE-2024-13967ession-Management FailureABB EIBPORT V3 KNX · ABB EIBPORT V3 KNX GSM
- CVE-2025-4578File Provider <= 1.2.3 - Unauthenticated SQLiFile Provider
- CVE-2025-49223billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to executeNAVER billboard.js · billboard.js
High 25
- CVE-2025-5619Tenda CH22 addUserName formaddUserName stack-based overflowTenda CH22
- CVE-2025-48947NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookiesnextjs-auth0 · @auth0/nextjs-auth0
- CVE-2025-46341Privilege escalation via SSRF when using HTTP authFreshRSS
- CVE-2025-5609Tenda AC18 AdvSetLanip fromadvsetlanip buffer overflowTenda AC18
- CVE-2025-5608Tenda AC18 SetSysAutoRebbotCfg formsetreboottimer buffer overflowTenda AC18
- CVE-2025-22243VMware NSX Manager UI is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper input validation.VMware NSX
- CVE-2025-5607Tenda AC18 setPptpUserList formSetPPTPUserList buffer overflowTenda AC18
- CVE-2025-5688Out of Bounds Write in FreeRTOS-Plus-TCPAmazon FreeRTOS
- CVE-2025-20261Cisco Integrated Management Controller Privilege Escalation VulnerabilityCisco Unified Computing System
- CVE-2025-20163Cisco Nexus Dashboard Fabric Controller SSH Host Key VulnerabilityCisco Data Center Network Manager · Cisco Nexus Dashboard
- CVE-2025-48961Local privilege escalation due to insecure folder permissions.Acronis Cyber Protect
- CVE-2025-1701Local Privilege Escalation in MIM Admin ServiceMIM Software MIM Admin Service
- CVE-2025-30415Denial of service due to improper handling of malformed input.Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect
- CVE-2025-5601Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in WiresharkWireshark Foundation Wireshark
- CVE-2018-25112PHOENIX CONTACT: ILC 1x1 ETH Denial of ServicePHOENIX CONTACT ILC
- CVE-2025-47728File Parsing Memory Corruption in CNCSoft-G2Delta Electronics CNCSoft-G2
- CVE-2025-47727Out-of-bounds Write in CNCSoftDelta Electronics CNCSoft
- CVE-2025-47726Out-of-bounds Write in CNCSoftDelta Electronics CNCSoft
- CVE-2025-47725Out-of-bounds Write in CNCSoftDelta Electronics CNCSoft
- CVE-2025-47724Out-of-bounds Write in CNCSoftDelta Electronics CNCSoft
- CVE-2025-5482Sunshine Photo Cart <= 3.4.11 - Authenticated (Subscriber+) Privilege Escalationsunshinephotocart Sunshine Photo Cart – Client Photo Galler…
- CVE-2025-5572D-Link DCS-932L setSystemEmail stack-based overflowD-Link DCS-932L
- CVE-2024-31127MacOS Zscaler Client Connector Local Privilege EscalationZscaler Client Connector
- CVE-2025-27811A local privilege escalation in the razer_elevation_service.exe in Razer Synapse 4 through 4.0.86.2502180127 allows a local attacker to esca
- CVE-2025-29093File Upload vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Content/Ga
Medium, low and unrated 102
- CVE-2025-5621D-Link DIR-816 qosClassifier os command injectionD-Link DIR-816
- CVE-2025-5620D-Link DIR-816 setipsec_config os command injectionD-Link DIR-816
- CVE-2025-5618PHPGurukul Online Fire Reporting System edit-team.php sql injectionPHPGurukul Online Fire Reporting System
- CVE-2025-49007ReDoS Vulnerability in Rack::Multipart handle_mime_headrack
- CVE-2025-5617PHPGurukul Online Fire Reporting System manage-teams.php sql injectionPHPGurukul Online Fire Reporting System
- CVE-2025-5616PHPGurukul Online Fire Reporting System profile.php sql injectionPHPGurukul Online Fire Reporting System
- CVE-2025-5615PHPGurukul Online Fire Reporting System details.php sql injectionPHPGurukul Online Fire Reporting System
- CVE-2025-5614PHPGurukul Online Fire Reporting System search-report-result.php sql injectionPHPGurukul Online Fire Reporting System
- CVE-2025-5690Cursor allows PostgreSQL Anonymizer masked user to gain unauthorized access to authentic dataDALIBO PostgreSQL Anonymizer
- CVE-2025-5613PHPGurukul Online Fire Reporting System request-details.php sql injectionPHPGurukul Online Fire Reporting System
- CVE-2025-5612PHPGurukul Online Fire Reporting System reporting.php sql injectionPHPGurukul Online Fire Reporting System
- CVE-2025-5611CodeAstro Real Estate Management System submitpropertyupdate.php sql injectionCodeAstro Real Estate Management System
- CVE-2025-5610CodeAstro Real Estate Management System submitpropertydelete.php sql injectionCodeAstro Real Estate Management System
- CVE-2025-46339FreshRSS vulnerable to favicon cache poisoning via proxyFreshRSS
- CVE-2025-32015FreshRSS vulnerable to Cross-site Scripting by embedding <script> tag inside <iframe srcdoc>FreshRSS
- CVE-2025-31482FreshRSS vulnerable to DoS by malicious feed entry loading logout URLFreshRSS
- CVE-2025-31136FreshRSS vulnerable to Cross-site Scripting by <iframe>'ing a vulnerable same-origin page in a feed entryFreshRSS
- CVE-2025-31134FreshRSS vulnerable to directory enumeration via ext.phpFreshRSS
- CVE-2025-22245VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the router port due to improper input validation.VMware NSX
- CVE-2025-22244VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation.VMware NSX
- CVE-2025-48935Deno has --allow-read / --allow-write permission bypass in `node:sqlite`denoland deno · deno +1
- CVE-2025-48934Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variablesdenoland deno · deno +1
- CVE-2025-48888Deno run with --allow-read and --deny-read flags results in alloweddenoland deno · deno +1
- CVE-2025-5606Tenda AC18 SetIPTVCfg formSetIptv command injectionTenda AC18
- CVE-2025-5604Campcodes Hospital Management System user-login.php sql injectionCampcodes Hospital Management System
- CVE-2025-5603Campcodes Hospital Management System registration.php sql injectionCampcodes Hospital Management System
- CVE-2025-5602Campcodes Hospital Management System registration.php sql injectionCampcodes Hospital Management System
- CVE-2025-5599PHPGurukul Student Result Management System editmyexp.php sql injectionPHPGurukul Student Result Management System
- CVE-2025-5596FreeFloat FTP Server REGET Command buffer overflowFreeFloat FTP Server
- CVE-2025-2336AngularJS improper sanitization in SVG '<image>' element with 'ngSanitize'Google AngularJS · angular-sanitize
- CVE-2025-5595FreeFloat FTP Server PROGRESS Command buffer overflowFreeFloat FTP Server
- CVE-2025-20259Cisco ThousandEyes Endpoint Agent for Windows Arbitrary File Write VulnerabilityCisco ThousandEyes Endpoint Agent
- CVE-2025-20278Cisco Unified Communications Products Command Injection VulnerabilityCisco Finesse · Cisco SocialMiner +5
- CVE-2025-20279Cisco Unifed Contact Center Express Stored Cross-Site Scripting VulnerabilityCisco Unified Contact Center Express
- CVE-2025-20277Cisco Unified Contact Center Express Path Traversal VulnerabilityCisco Unified Contact Center Express
- CVE-2025-20276Cisco Unified Contact Center Express Remote Code Execution VulnerabilityCisco Unified Contact Center Express
- CVE-2025-20275Cisco Unified Contact Center Express Editor Remote Code Execution VulnerabilityCisco Unified Contact Center Express
- CVE-2025-20273Cisco Unified Intelligent Contact Management Enterprise Cross-Site Scripting vulnerabilityCisco Unified Intelligent Contact Management Enterprise
- CVE-2025-20129Cisco Customer Collaboration Platform Information Disclosure VulnerabilityCisco SocialMiner · Cisco Unified Contact Center Express
- CVE-2025-20130Cisco Identity Services Engine Access Control Bypass VulnerabilityCisco Identity Services Engine Software
- CVE-2025-5594FreeFloat FTP Server SET Command buffer overflowFreeFloat FTP Server
- CVE-2025-5593FreeFloat FTP Server HOST Command buffer overflowFreeFloat FTP Server
- CVE-2025-5592FreeFloat FTP Server PASSIVE Command buffer overflowFreeFloat FTP Server
- CVE-2025-48962Sensitive information disclosure due to SSRF.Acronis Cyber Protect
- CVE-2025-48960Weak server key used for TLS encryption.Acronis Cyber Protect
- CVE-2025-48959Local privilege escalation due to insecure file permissions.Acronis Cyber Protect Cloud Agent
- CVE-2025-5584PHPGurukul Hospital Management System POST Parameter edit-patient.php cross site scriptingPHPGurukul Hospital Management System
- CVE-2025-5583CodeAstro Real Estate Management System register.php sql injectionCodeAstro Real Estate Management System
- CVE-2025-5582CodeAstro Real Estate Management System profile.php sql injectionCodeAstro Real Estate Management System
- CVE-2025-5581CodeAstro Real Estate Management System index.php sql injectionCodeAstro Real Estate Management System
- CVE-2025-5580CodeAstro Real Estate Management System login.php sql injectionCodeAstro Real Estate Management System
- CVE-2025-5579PHPGurukul Dairy Farm Shop Management System search-product.php sql injectionPHPGurukul Dairy Farm Shop Management System
- CVE-2025-5578PHPGurukul Dairy Farm Shop Management System sales-report-details.php sql injectionPHPGurukul Dairy Farm Shop Management System
- CVE-2025-5577PHPGurukul Dairy Farm Shop Management System profile.php sql injectionPHPGurukul Dairy Farm Shop Management System
- CVE-2025-5576PHPGurukul Dairy Farm Shop Management System bwdate-report-details.php sql injectionPHPGurukul Dairy Farm Shop Management System
- CVE-2025-27444Extension - rsjoomla.com - A reflected XSS vulnerability RSform!Pro component 3.0.0 - 3.3.13 for Joomlarsjoomla.com RSform!Pro component for Joomla
- CVE-2025-5575PHPGurukul Dairy Farm Shop Management System add-product.php sql injectionPHPGurukul Dairy Farm Shop Management System
- CVE-2025-5574PHPGurukul Dairy Farm Shop Management System add-company.php sql injectionPHPGurukul Dairy Farm Shop Management System
- CVE-2025-5573D-Link DCS-932L setSystemWizard setSystemControl os command injectionD-Link DCS-932L
- CVE-2025-4580File Provider <= 1.2.3 - Item Deletion via CSRFFile Provider
- CVE-2025-48710kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to kro.run kro · github.com/kro-run/kro
- CVE-2025-5571D-Link DCS-932L setSystemAdmin os command injectionD-Link DCS-932L
- CVE-2025-5569IdeaCMS getList.html Goods sql injectionIdeaCMS
- CVE-2025-5566PHPGurukul Notice Board System search-notice.php sql injectionPHPGurukul Notice Board System
- CVE-2025-5562PHPGurukul Curfew e-Pass Management System edit-category-detail.php sql injectionPHPGurukul Curfew e-Pass Management System
- CVE-2025-20996Improper authorization in Smart Switch installed on non-Samsung Device prior to version 3.7.64.10 allows local attackers to read data with tSamsung Mobile Smart Switch
- CVE-2025-20995Improper handling of insufficient permission in ClientProvider in Samsung Internet installed on non-Samsung Device prior to version 28.0.0.5Samsung Mobile Samsung Internet
- CVE-2025-20994Improper handling of insufficient permission in SyncClientProvider in Samsung Internet installed on non-Samsung Device prior to version 28.0Samsung Mobile Samsung Internet
- CVE-2025-20993Out-of-bounds write in libsecimaging.camera.samsung.so prior to SMR Jun-2025 Release 1 allows local attackers to write out-of-bounds memory.Samsung Mobile Devices
- CVE-2025-20992Out-of-bound read in libsecimaging.camera.samsung.so prior to SMR Feb-2025 Release 1 allows local attackers to read out-of-bounds memory.Samsung Mobile Devices
- CVE-2025-20991Improper export of Android application components in Bluetooth prior to SMR Jun-2025 Release 1 allows local attackers to make devices discovSamsung Mobile Devices
- CVE-2025-20989Improper logging in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to get a hmac_key.Samsung Mobile Devices
- CVE-2025-20988Out-of-bounds read in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to read out-of-bounds memory.Samsung Mobile Devices
- CVE-2025-20987Improper access control in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to get a auth_token.Samsung Mobile Devices
- CVE-2025-20986Improper access control in ScreenCapture for Galaxy Watch prior to SMR Jun-2025 Release 1 allows local attackers to take screenshots.Samsung Mobile Devices
- CVE-2025-20985Improper privilege management in ThemeManager prior to SMR Jun-2025 Release 1 allows local privileged attackers to reuse trial items.Samsung Mobile Devices
- CVE-2025-20984Incorrect default permission in Samsung Cloud for Galaxy Watch prior to SMR Jun-2025 Release 1 allows local attackers to access data in SamsSamsung Mobile Devices
- CVE-2025-20981Improper access control in AudioService prior to SMR Jun-2025 Release 1 allows local attackers to access sensitive information.Samsung Mobile Devices
- CVE-2025-5561PHPGurukul Curfew e-Pass Management System view-pass-detail.php sql injectionPHPGurukul Curfew e-Pass Management System
- CVE-2025-5539Simplify Contact Management: WP Easy Contact <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingemarket-design Simple Contact Form Plugin for WordPress – W…
- CVE-2025-5560PHPGurukul Curfew e-Pass Management System index.php sql injectionPHPGurukul Curfew e-Pass Management System
- CVE-2025-5558PHPGurukul Teacher Subject Allocation Management System changeimage.php sql injectionPHPGurukul Teacher Subject Allocation Management System
- CVE-2025-5532Faculty Staff and Student Directory Plugin – Campus Directory <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingemarket-design Campus Directory – Faculty, Staff & Student…
- CVE-2025-5531Staff Directory – Employee Directory for WordPress <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingemarket-design Employee Directory – Staff & Team Directory
- CVE-2025-5557PHPGurukul Teacher Subject Allocation Management System edit-course.php sql injectionPHPGurukul Teacher Subject Allocation Management System
- CVE-2025-5556PHPGurukul Teacher Subject Allocation Management System edit-teacher-info.php sql injectionPHPGurukul Teacher Subject Allocation Management System
- CVE-2025-5554PHPGurukul Rail Pass Management System pass-bwdates-reports-details.php sql injectionPHPGurukul Rail Pass Management System
- CVE-2025-5553PHPGurukul Rail Pass Management System download-pass.php sql injectionPHPGurukul Rail Pass Management System
- CVE-2025-5552ChestnutCMS API Endpoint exec deserializationChestnutCMS
- CVE-2025-5551FreeFloat FTP Server SYSTEM Command buffer overflowFreeFloat FTP Server
- CVE-2025-5550FreeFloat FTP Server PBSZ Command buffer overflowFreeFloat FTP Server
- CVE-2025-5549FreeFloat FTP Server PASV Command buffer overflowFreeFloat FTP Server
- CVE-2025-5548FreeFloat FTP Server NOOP Command buffer overflowFreeFloat FTP Server
- CVE-2025-5547FreeFloat FTP Server CDUP Command buffer overflowFreeFloat FTP Server
- CVE-2025-23095An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400.
- CVE-2025-23096An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400.
- CVE-2025-23101An issue was discovered in Samsung Mobile Processor Exynos 1380.
- CVE-2025-23106An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400.
- CVE-2025-29094Cross Site Scripting vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the M
- CVE-2025-46011Listmonk v4.1.0 (fixed in v5.0.0) is vulnerable to SQL Injection in the QuerySubscribers function which allows attackers to escalate privile
- CVE-2025-46203An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /students/edit/{id} endpoint.
- CVE-2025-46204An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /course/edit/{id} endpoint.