# CVEs published 2025-06-04

134 CVEs were published on June 4, 2025: 7 critical, 25 high. Days are UTC.

- [CVE-2025-5621](https://cve.now/CVE-2025-5621.md): D-Link DIR-816 qosClassifier os command injection (CVSS 6.9, D-Link DIR-816)
- [CVE-2025-5620](https://cve.now/CVE-2025-5620.md): D-Link DIR-816 setipsec\_config os command injection (CVSS 6.9, D-Link DIR-816)
- [CVE-2025-5619](https://cve.now/CVE-2025-5619.md): Tenda CH22 addUserName formaddUserName stack-based overflow (CVSS 8.7, Tenda CH22)
- [CVE-2025-5618](https://cve.now/CVE-2025-5618.md): PHPGurukul Online Fire Reporting System edit-team.php sql injection (CVSS 5.3, PHPGurukul Online Fire Reporting System)
- [CVE-2025-49007](https://cve.now/CVE-2025-49007.md): ReDoS Vulnerability in Rack::Multipart handle\_mime\_head (CVSS 6.6, rack)
- [CVE-2025-5617](https://cve.now/CVE-2025-5617.md): PHPGurukul Online Fire Reporting System manage-teams.php sql injection (CVSS 5.3, PHPGurukul Online Fire Reporting System)
- [CVE-2025-5616](https://cve.now/CVE-2025-5616.md): PHPGurukul Online Fire Reporting System profile.php sql injection (CVSS 5.3, PHPGurukul Online Fire Reporting System)
- [CVE-2025-5615](https://cve.now/CVE-2025-5615.md): PHPGurukul Online Fire Reporting System details.php sql injection (CVSS 5.3, PHPGurukul Online Fire Reporting System)
- [CVE-2025-5614](https://cve.now/CVE-2025-5614.md): PHPGurukul Online Fire Reporting System search-report-result.php sql injection (CVSS 5.3, PHPGurukul Online Fire Reporting System)
- [CVE-2025-5690](https://cve.now/CVE-2025-5690.md): Cursor allows PostgreSQL Anonymizer masked user to gain unauthorized access to authentic data (CVSS 6.5, DALIBO PostgreSQL Anonymizer)
- [CVE-2025-5613](https://cve.now/CVE-2025-5613.md): PHPGurukul Online Fire Reporting System request-details.php sql injection (CVSS 5.3, PHPGurukul Online Fire Reporting System)
- [CVE-2025-5612](https://cve.now/CVE-2025-5612.md): PHPGurukul Online Fire Reporting System reporting.php sql injection (CVSS 5.3, PHPGurukul Online Fire Reporting System)
- [CVE-2025-5611](https://cve.now/CVE-2025-5611.md): CodeAstro Real Estate Management System submitpropertyupdate.php sql injection (CVSS 5.3, CodeAstro Real Estate Management System)
- [CVE-2025-5610](https://cve.now/CVE-2025-5610.md): CodeAstro Real Estate Management System submitpropertydelete.php sql injection (CVSS 5.3, CodeAstro Real Estate Management System)
- [CVE-2025-48947](https://cve.now/CVE-2025-48947.md): NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies (CVSS 7.7, nextjs-auth0 · @auth0/nextjs-auth0)
- [CVE-2025-46341](https://cve.now/CVE-2025-46341.md): Privilege escalation via SSRF when using HTTP auth (CVSS 7.1, FreshRSS)
- [CVE-2025-46339](https://cve.now/CVE-2025-46339.md): FreshRSS vulnerable to favicon cache poisoning via proxy (CVSS 4.3, FreshRSS)
- [CVE-2025-5609](https://cve.now/CVE-2025-5609.md): Tenda AC18 AdvSetLanip fromadvsetlanip buffer overflow (CVSS 8.7, Tenda AC18)
- [CVE-2025-5608](https://cve.now/CVE-2025-5608.md): Tenda AC18 SetSysAutoRebbotCfg formsetreboottimer buffer overflow (CVSS 8.7, Tenda AC18)
- [CVE-2025-32015](https://cve.now/CVE-2025-32015.md): FreshRSS vulnerable to Cross-site Scripting by embedding \<script\> tag inside \<iframe srcdoc\> (CVSS 6.7, FreshRSS)
- [CVE-2025-31482](https://cve.now/CVE-2025-31482.md): FreshRSS vulnerable to DoS by malicious feed entry loading logout URL (CVSS 4.3, FreshRSS)
- [CVE-2025-31136](https://cve.now/CVE-2025-31136.md): FreshRSS vulnerable to Cross-site Scripting by \<iframe\>'ing a vulnerable same-origin page in a feed entry (CVSS 6.7, FreshRSS)
- [CVE-2025-31134](https://cve.now/CVE-2025-31134.md): FreshRSS vulnerable to directory enumeration via ext.php (CVSS 5.5, FreshRSS)
- [CVE-2025-22245](https://cve.now/CVE-2025-22245.md): VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the router port due to improper input validation. (CVSS 5.9, VMware NSX)
- [CVE-2025-22244](https://cve.now/CVE-2025-22244.md): VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation. (CVSS 6.9, VMware NSX)
- [CVE-2025-22243](https://cve.now/CVE-2025-22243.md): VMware NSX Manager UI is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper input validation. (CVSS 7.5, VMware NSX)
- [CVE-2025-48935](https://cve.now/CVE-2025-48935.md): Deno has --allow-read / --allow-write permission bypass in \`node:sqlite\` (CVSS 5.5, denoland deno · deno +1)
- [CVE-2025-5607](https://cve.now/CVE-2025-5607.md): Tenda AC18 setPptpUserList formSetPPTPUserList buffer overflow (CVSS 8.7, Tenda AC18)
- [CVE-2025-48934](https://cve.now/CVE-2025-48934.md): Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables (CVSS 5.5, denoland deno · deno +1)
- [CVE-2025-48888](https://cve.now/CVE-2025-48888.md): Deno run with --allow-read and --deny-read flags results in allowed (CVSS 5.5, denoland deno · deno +1)
- [CVE-2025-5606](https://cve.now/CVE-2025-5606.md): Tenda AC18 SetIPTVCfg formSetIptv command injection (CVSS 5.3, Tenda AC18)
- [CVE-2025-5604](https://cve.now/CVE-2025-5604.md): Campcodes Hospital Management System user-login.php sql injection (CVSS 6.9, Campcodes Hospital Management System)
- [CVE-2025-5603](https://cve.now/CVE-2025-5603.md): Campcodes Hospital Management System registration.php sql injection (CVSS 6.9, Campcodes Hospital Management System)
- [CVE-2025-5602](https://cve.now/CVE-2025-5602.md): Campcodes Hospital Management System registration.php sql injection (CVSS 6.9, Campcodes Hospital Management System)
- [CVE-2025-5600](https://cve.now/CVE-2025-5600.md): TOTOLINK EX1200T cstecgi.cgi setLanguageCfg stack-based overflow (CVSS 9.3, TOTOLINK EX1200T)
- [CVE-2025-5599](https://cve.now/CVE-2025-5599.md): PHPGurukul Student Result Management System editmyexp.php sql injection (CVSS 6.9, PHPGurukul Student Result Management System)
- [CVE-2025-5688](https://cve.now/CVE-2025-5688.md): Out of Bounds Write in FreeRTOS-Plus-TCP (CVSS 7.5, Amazon FreeRTOS)
- [CVE-2025-5596](https://cve.now/CVE-2025-5596.md): FreeFloat FTP Server REGET Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-2336](https://cve.now/CVE-2025-2336.md): AngularJS improper sanitization in SVG '\<image\>' element with 'ngSanitize' (CVSS 4.8, Google AngularJS · angular-sanitize)
- [CVE-2025-5595](https://cve.now/CVE-2025-5595.md): FreeFloat FTP Server PROGRESS Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-20259](https://cve.now/CVE-2025-20259.md): Cisco ThousandEyes Endpoint Agent for Windows Arbitrary File Write Vulnerability (CVSS 5.3, Cisco ThousandEyes Endpoint Agent)
- [CVE-2025-20286](https://cve.now/CVE-2025-20286.md): ISE on AWS Static Credential (CVSS 9.9, Cisco Identity Services Engine Software)
- [CVE-2025-20278](https://cve.now/CVE-2025-20278.md): Cisco Unified Communications Products Command Injection Vulnerability (CVSS 6.0, Cisco Finesse · Cisco SocialMiner +5)
- [CVE-2025-20279](https://cve.now/CVE-2025-20279.md): Cisco Unifed Contact Center Express Stored Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Unified Contact Center Express)
- [CVE-2025-20277](https://cve.now/CVE-2025-20277.md): Cisco Unified Contact Center Express Path Traversal Vulnerability (CVSS 3.4, Cisco Unified Contact Center Express)
- [CVE-2025-20276](https://cve.now/CVE-2025-20276.md): Cisco Unified Contact Center Express Remote Code Execution Vulnerability (CVSS 3.8, Cisco Unified Contact Center Express)
- [CVE-2025-20275](https://cve.now/CVE-2025-20275.md): Cisco Unified Contact Center Express Editor Remote Code Execution Vulnerability (CVSS 5.3, Cisco Unified Contact Center Express)
- [CVE-2025-20273](https://cve.now/CVE-2025-20273.md): Cisco Unified Intelligent Contact Management Enterprise Cross-Site Scripting vulnerability (CVSS 6.1, Cisco Unified Intelligent Contact Management Enterprise)
- [CVE-2025-20261](https://cve.now/CVE-2025-20261.md): Cisco Integrated Management Controller Privilege Escalation Vulnerability (CVSS 8.8, Cisco Unified Computing System)
- [CVE-2025-20163](https://cve.now/CVE-2025-20163.md): Cisco Nexus Dashboard Fabric Controller SSH Host Key Vulnerability (CVSS 8.7, Cisco Data Center Network Manager · Cisco Nexus Dashboard)
- [CVE-2025-20129](https://cve.now/CVE-2025-20129.md): Cisco Customer Collaboration Platform Information Disclosure Vulnerability (CVSS 4.3, Cisco SocialMiner · Cisco Unified Contact Center Express)
- [CVE-2025-20130](https://cve.now/CVE-2025-20130.md): Cisco Identity Services Engine Access Control Bypass Vulnerability (CVSS 4.9, Cisco Identity Services Engine Software)
- [CVE-2025-5594](https://cve.now/CVE-2025-5594.md): FreeFloat FTP Server SET Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-5593](https://cve.now/CVE-2025-5593.md): FreeFloat FTP Server HOST Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-5592](https://cve.now/CVE-2025-5592.md): FreeFloat FTP Server PASSIVE Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-48962](https://cve.now/CVE-2025-48962.md): Sensitive information disclosure due to SSRF. (CVSS 4.3, Acronis Cyber Protect)
- [CVE-2025-48961](https://cve.now/CVE-2025-48961.md): Local privilege escalation due to insecure folder permissions. (CVSS 7.3, Acronis Cyber Protect)
- [CVE-2025-48960](https://cve.now/CVE-2025-48960.md): Weak server key used for TLS encryption. (CVSS 5.9, Acronis Cyber Protect)
- [CVE-2025-1701](https://cve.now/CVE-2025-1701.md): Local Privilege Escalation in MIM Admin Service (CVSS 8.9, MIM Software MIM Admin Service)
- [CVE-2025-48959](https://cve.now/CVE-2025-48959.md): Local privilege escalation due to insecure file permissions. (CVSS 6.7, Acronis Cyber Protect Cloud Agent)
- [CVE-2025-30415](https://cve.now/CVE-2025-30415.md): Denial of service due to improper handling of malformed input. (CVSS 7.5, Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect)
- [CVE-2025-5597](https://cve.now/CVE-2025-5597.md): WF Steuerungstechnik GmbH - airleader MASTER - Authentication Bypass (CVSS 10.0, WF Steuerungstechnik airleader MASTER)
- [CVE-2025-5598](https://cve.now/CVE-2025-5598.md): WF Steuerungstechnik GmbH - airleader MASTER - Path Traversal (CVSS 9.2, WF Steuerungstechnik airleader MASTER)
- [CVE-2025-5601](https://cve.now/CVE-2025-5601.md): Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2025-5584](https://cve.now/CVE-2025-5584.md): PHPGurukul Hospital Management System POST Parameter edit-patient.php cross site scripting (CVSS 4.8, PHPGurukul Hospital Management System)
- [CVE-2018-25112](https://cve.now/CVE-2018-25112.md): PHOENIX CONTACT: ILC 1x1 ETH Denial of Service (CVSS 7.5, PHOENIX CONTACT ILC)
- [CVE-2025-5583](https://cve.now/CVE-2025-5583.md): CodeAstro Real Estate Management System register.php sql injection (CVSS 6.9, CodeAstro Real Estate Management System)
- [CVE-2025-5582](https://cve.now/CVE-2025-5582.md): CodeAstro Real Estate Management System profile.php sql injection (CVSS 5.3, CodeAstro Real Estate Management System)
- [CVE-2025-5581](https://cve.now/CVE-2025-5581.md): CodeAstro Real Estate Management System index.php sql injection (CVSS 6.9, CodeAstro Real Estate Management System)
- [CVE-2025-5580](https://cve.now/CVE-2025-5580.md): CodeAstro Real Estate Management System login.php sql injection (CVSS 6.9, CodeAstro Real Estate Management System)
- [CVE-2025-47728](https://cve.now/CVE-2025-47728.md): File Parsing Memory Corruption in CNCSoft-G2 (CVSS 7.3, Delta Electronics CNCSoft-G2)
- [CVE-2024-13967](https://cve.now/CVE-2024-13967.md): ession-Management Failure (CVSS 9.4, ABB EIBPORT V3 KNX · ABB EIBPORT V3 KNX GSM)
- [CVE-2025-5579](https://cve.now/CVE-2025-5579.md): PHPGurukul Dairy Farm Shop Management System search-product.php sql injection (CVSS 6.9, PHPGurukul Dairy Farm Shop Management System)
- [CVE-2025-5578](https://cve.now/CVE-2025-5578.md): PHPGurukul Dairy Farm Shop Management System sales-report-details.php sql injection (CVSS 6.9, PHPGurukul Dairy Farm Shop Management System)
- [CVE-2025-5577](https://cve.now/CVE-2025-5577.md): PHPGurukul Dairy Farm Shop Management System profile.php sql injection (CVSS 6.9, PHPGurukul Dairy Farm Shop Management System)
- [CVE-2025-5576](https://cve.now/CVE-2025-5576.md): PHPGurukul Dairy Farm Shop Management System bwdate-report-details.php sql injection (CVSS 6.9, PHPGurukul Dairy Farm Shop Management System)
- [CVE-2025-47727](https://cve.now/CVE-2025-47727.md): Out-of-bounds Write in CNCSoft (CVSS 7.3, Delta Electronics CNCSoft)
- [CVE-2025-27444](https://cve.now/CVE-2025-27444.md): Extension - rsjoomla.com - A reflected XSS vulnerability RSform!Pro component 3.0.0 - 3.3.13 for Joomla (CVSS 4.8, rsjoomla.com RSform!Pro component for Joomla)
- [CVE-2025-47726](https://cve.now/CVE-2025-47726.md): Out-of-bounds Write in CNCSoft (CVSS 7.3, Delta Electronics CNCSoft)
- [CVE-2025-47725](https://cve.now/CVE-2025-47725.md): Out-of-bounds Write in CNCSoft (CVSS 7.3, Delta Electronics CNCSoft)
- [CVE-2025-47724](https://cve.now/CVE-2025-47724.md): Out-of-bounds Write in CNCSoft (CVSS 7.3, Delta Electronics CNCSoft)
- [CVE-2025-5482](https://cve.now/CVE-2025-5482.md): Sunshine Photo Cart \<= 3.4.11 - Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, sunshinephotocart Sunshine Photo Cart – Client Photo Galler…)
- [CVE-2025-5575](https://cve.now/CVE-2025-5575.md): PHPGurukul Dairy Farm Shop Management System add-product.php sql injection (CVSS 6.9, PHPGurukul Dairy Farm Shop Management System)
- [CVE-2025-5574](https://cve.now/CVE-2025-5574.md): PHPGurukul Dairy Farm Shop Management System add-company.php sql injection (CVSS 6.9, PHPGurukul Dairy Farm Shop Management System)
- [CVE-2025-5573](https://cve.now/CVE-2025-5573.md): D-Link DCS-932L setSystemWizard setSystemControl os command injection (CVSS 5.3, D-Link DCS-932L)
- [CVE-2025-5572](https://cve.now/CVE-2025-5572.md): D-Link DCS-932L setSystemEmail stack-based overflow (CVSS 8.7, D-Link DCS-932L)
- [CVE-2025-4580](https://cve.now/CVE-2025-4580.md): File Provider \<= 1.2.3 - Item Deletion via CSRF (CVSS 4.3, File Provider)
- [CVE-2025-4578](https://cve.now/CVE-2025-4578.md): File Provider \<= 1.2.3 - Unauthenticated SQLi (CVSS 9.8, File Provider)
- [CVE-2025-48710](https://cve.now/CVE-2025-48710.md): kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to (CVSS 4.1, kro.run kro · github.com/kro-run/kro)
- [CVE-2025-5571](https://cve.now/CVE-2025-5571.md): D-Link DCS-932L setSystemAdmin os command injection (CVSS 5.3, D-Link DCS-932L)
- [CVE-2025-5569](https://cve.now/CVE-2025-5569.md): IdeaCMS getList.html Goods sql injection (CVSS 5.3, IdeaCMS)
- [CVE-2025-5566](https://cve.now/CVE-2025-5566.md): PHPGurukul Notice Board System search-notice.php sql injection (CVSS 5.3, PHPGurukul Notice Board System)
- [CVE-2025-5562](https://cve.now/CVE-2025-5562.md): PHPGurukul Curfew e-Pass Management System edit-category-detail.php sql injection (CVSS 6.9, PHPGurukul Curfew e-Pass Management System)
- [CVE-2025-20996](https://cve.now/CVE-2025-20996.md): Improper authorization in Smart Switch installed on non-Samsung Device prior to version 3.7.64.10 allows local attackers to read data with t (CVSS 5.0, Samsung Mobile Smart Switch)
- [CVE-2025-20995](https://cve.now/CVE-2025-20995.md): Improper handling of insufficient permission in ClientProvider in Samsung Internet installed on non-Samsung Device prior to version 28.0.0.5 (CVSS 4.9, Samsung Mobile Samsung Internet)
- [CVE-2025-20994](https://cve.now/CVE-2025-20994.md): Improper handling of insufficient permission in SyncClientProvider in Samsung Internet installed on non-Samsung Device prior to version 28.0 (CVSS 4.5, Samsung Mobile Samsung Internet)
- [CVE-2025-20993](https://cve.now/CVE-2025-20993.md): Out-of-bounds write in libsecimaging.camera.samsung.so prior to SMR Jun-2025 Release 1 allows local attackers to write out-of-bounds memory. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-20992](https://cve.now/CVE-2025-20992.md): Out-of-bound read in libsecimaging.camera.samsung.so prior to SMR Feb-2025 Release 1 allows local attackers to read out-of-bounds memory. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-20991](https://cve.now/CVE-2025-20991.md): Improper export of Android application components in Bluetooth prior to SMR Jun-2025 Release 1 allows local attackers to make devices discov (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-20989](https://cve.now/CVE-2025-20989.md): Improper logging in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to get a hmac\_key. (CVSS 5.2, Samsung Mobile Devices)
- [CVE-2025-20988](https://cve.now/CVE-2025-20988.md): Out-of-bounds read in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to read out-of-bounds memory. (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2025-20987](https://cve.now/CVE-2025-20987.md): Improper access control in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to get a auth\_token. (CVSS 5.2, Samsung Mobile Devices)
- [CVE-2025-20986](https://cve.now/CVE-2025-20986.md): Improper access control in ScreenCapture for Galaxy Watch prior to SMR Jun-2025 Release 1 allows local attackers to take screenshots. (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2025-20985](https://cve.now/CVE-2025-20985.md): Improper privilege management in ThemeManager prior to SMR Jun-2025 Release 1 allows local privileged attackers to reuse trial items. (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2025-20984](https://cve.now/CVE-2025-20984.md): Incorrect default permission in Samsung Cloud for Galaxy Watch prior to SMR Jun-2025 Release 1 allows local attackers to access data in Sams (CVSS 6.8, Samsung Mobile Devices)
- [CVE-2025-20981](https://cve.now/CVE-2025-20981.md): Improper access control in AudioService prior to SMR Jun-2025 Release 1 allows local attackers to access sensitive information. (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2024-31127](https://cve.now/CVE-2024-31127.md): MacOS Zscaler Client Connector Local Privilege Escalation (CVSS 7.3, Zscaler Client Connector)
- [CVE-2025-5561](https://cve.now/CVE-2025-5561.md): PHPGurukul Curfew e-Pass Management System view-pass-detail.php sql injection (CVSS 6.9, PHPGurukul Curfew e-Pass Management System)
- [CVE-2025-5539](https://cve.now/CVE-2025-5539.md): Simplify Contact Management: WP Easy Contact \<= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, emarket-design Simple Contact Form Plugin for WordPress – W…)
- [CVE-2025-5560](https://cve.now/CVE-2025-5560.md): PHPGurukul Curfew e-Pass Management System index.php sql injection (CVSS 6.9, PHPGurukul Curfew e-Pass Management System)
- [CVE-2025-5558](https://cve.now/CVE-2025-5558.md): PHPGurukul Teacher Subject Allocation Management System changeimage.php sql injection (CVSS 5.3, PHPGurukul Teacher Subject Allocation Management System)
- [CVE-2025-5532](https://cve.now/CVE-2025-5532.md): Faculty Staff and Student Directory Plugin – Campus Directory \<= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, emarket-design Campus Directory – Faculty, Staff & Student…)
- [CVE-2025-5531](https://cve.now/CVE-2025-5531.md): Staff Directory – Employee Directory for WordPress \<= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, emarket-design Employee Directory – Staff & Team Directory)
- [CVE-2025-5557](https://cve.now/CVE-2025-5557.md): PHPGurukul Teacher Subject Allocation Management System edit-course.php sql injection (CVSS 5.3, PHPGurukul Teacher Subject Allocation Management System)
- [CVE-2025-5556](https://cve.now/CVE-2025-5556.md): PHPGurukul Teacher Subject Allocation Management System edit-teacher-info.php sql injection (CVSS 5.3, PHPGurukul Teacher Subject Allocation Management System)
- [CVE-2025-5554](https://cve.now/CVE-2025-5554.md): PHPGurukul Rail Pass Management System pass-bwdates-reports-details.php sql injection (CVSS 5.3, PHPGurukul Rail Pass Management System)
- [CVE-2025-5553](https://cve.now/CVE-2025-5553.md): PHPGurukul Rail Pass Management System download-pass.php sql injection (CVSS 6.9, PHPGurukul Rail Pass Management System)
- [CVE-2025-5552](https://cve.now/CVE-2025-5552.md): ChestnutCMS API Endpoint exec deserialization (CVSS 5.3, ChestnutCMS)
- [CVE-2025-49223](https://cve.now/CVE-2025-49223.md): billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute (CVSS 9.8, NAVER billboard.js · billboard.js)
- [CVE-2025-5551](https://cve.now/CVE-2025-5551.md): FreeFloat FTP Server SYSTEM Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-5550](https://cve.now/CVE-2025-5550.md): FreeFloat FTP Server PBSZ Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-5549](https://cve.now/CVE-2025-5549.md): FreeFloat FTP Server PASV Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-5548](https://cve.now/CVE-2025-5548.md): FreeFloat FTP Server NOOP Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-5547](https://cve.now/CVE-2025-5547.md): FreeFloat FTP Server CDUP Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-23095](https://cve.now/CVE-2025-23095.md): An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400. (CVSS 6.5)
- [CVE-2025-23096](https://cve.now/CVE-2025-23096.md): An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400. (CVSS 6.5)
- [CVE-2025-23101](https://cve.now/CVE-2025-23101.md): An issue was discovered in Samsung Mobile Processor Exynos 1380. (CVSS 6.5)
- [CVE-2025-23106](https://cve.now/CVE-2025-23106.md): An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. (CVSS 6.5)
- [CVE-2025-27811](https://cve.now/CVE-2025-27811.md): A local privilege escalation in the razer\_elevation\_service.exe in Razer Synapse 4 through 4.0.86.2502180127 allows a local attacker to esca (CVSS 7.8)
- [CVE-2025-29093](https://cve.now/CVE-2025-29093.md): File Upload vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Content/Ga (CVSS 8.2)
- [CVE-2025-29094](https://cve.now/CVE-2025-29094.md): Cross Site Scripting vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the M (CVSS 6.1)
- [CVE-2025-46011](https://cve.now/CVE-2025-46011.md): Listmonk v4.1.0 (fixed in v5.0.0) is vulnerable to SQL Injection in the QuerySubscribers function which allows attackers to escalate privile (CVSS 6.5)
- [CVE-2025-46203](https://cve.now/CVE-2025-46203.md): An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /students/edit/{id} endpoint. (CVSS 6.5)
- [CVE-2025-46204](https://cve.now/CVE-2025-46204.md): An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /course/edit/{id} endpoint. (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-06-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.