CVEs published June 5, 2025
94 CVEs were published on June 5, 2025: 8 critical, 9 high. 1 is now in CISA KEV.
- Published
- 94
- Critical
- 8
- High
- 9
- Medium
- 69
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 20
Most affected products
- PHPGurukul Complaint Management System
- 9
- Radare2
- 8
- D-Link DIR-816
- 4
- FreeFloat FTP Server
- 4
- PCMan FTP Server
- 4
- Brilliance Golden Link Secondary System
- 3
- Campcodes Online Teacher Record Management System
- 3
- code-projects Content Management System · code-projects… +2
- 3
- Devolutions Server
- 3
- PHPGurukul Medical Card Generation System
- 3
Critical 8
- CVE-2025-47966Power Automate Elevation of Privilege VulnerabilityMicrosoft Power Automate for Desktop
- CVE-2025-4568SQL Injection in 2ClickPortalTrol InterMedia 2ClickPortal
- CVE-2025-1793SQL Injection in run-llama/llama_indexrun-llama/llama_index · llama-index
- CVE-2025-5630D-Link DIR-816 form2lansetup.cgi stack-based overflowD-Link DIR-816
- CVE-2025-5624D-Link DIR-816 QoSPortSetup stack-based overflowD-Link DIR-816
- CVE-2025-49008Atheos Improper Input Validation Vulnerability Enables RCE in Common.phpAtheos
- CVE-2025-5623D-Link DIR-816 qosClassifier stack-based overflowD-Link DIR-816
- CVE-2025-5622D-Link DIR-816 wirelessApcli_5g stack-based overflowD-Link DIR-816
High 9
- CVE-2025-5685Tenda CH22 Natlimit formNatlimit stack-based overflowTenda CH22
- CVE-2025-43026HP Support Assistant – Potential Escalation of PrivilegeHP Support Assistant
- CVE-2025-5672TOTOLINK N302R Plus HTTP POST Request formFilter buffer overflowTOTOLINK N302R Plus
- CVE-2025-5671TOTOLINK N302R Plus HTTP POST Request formPortFw buffer overflowTOTOLINK N302R Plus
- CVE-2011-10007File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when `grep()` encounters a crafted file nameRCLAMP File::Find::Rule
- CVE-2025-5701HyperComments <= 1.2.2 - Unauthenticated (Subscriber+) Arbitrary Options Updatesiteheart HyperComments
- CVE-2025-3055WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Deletionwedevs WP User Frontend Pro
- CVE-2025-3054WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Uploadwedevs WP User Frontend Pro
- CVE-2025-5629Tenda AC10 HTTP SetPptpServerCfg formSetPPTPServer buffer overflowTenda AC10
Medium, low and unrated 77
- CVE-2025-5705code-projects Real Estate Property Management System Property.php sql injectioncode-projects Real Estate Property Management System
- CVE-2025-5704code-projects Real Estate Property Management System User.php sql injectioncode-projects Real Estate Property Management System
- CVE-2025-49012Himmelblau's Name-Based Group Matching in `pam_allow_groups` Leads to Potential Security Bypasshimmelblau-idm himmelblau
- CVE-2025-5698Brilliance Golden Link Secondary System logSelect.htm sql injectionBrilliance Golden Link Secondary System
- CVE-2025-5697Brilliance Golden Link Secondary System tcCustDeferPosiQuery.htm sql injectionBrilliance Golden Link Secondary System
- CVE-2025-5696Brilliance Golden Link Secondary System rentChangeCheckInfoPage.htm sql injectionBrilliance Golden Link Secondary System
- CVE-2025-5695Teledyne FLIR AX8 Backend subscriptions.php subscribe_to_alarm command injectionTeledyne FLIR AX8
- CVE-2025-48133WordPress Uncanny Automator plugin <= 6.4.0.2 - Broken Access Control VulnerabilityUncanny Owl Uncanny Automator
- CVE-2025-5694PHPGurukul Human Metapneumovirus Testing Management System search-report-result.php sql injectionPHPGurukul Human Metapneumovirus Testing Management System
- CVE-2025-5693PHPGurukul Human Metapneumovirus Testing Management System bwdates-report-result.php sql injectionPHPGurukul Human Metapneumovirus Testing Management System
- CVE-2025-5680Shenzhen Dashi Tongzhou Information Technology AgileBPM Groovy Script SysScriptController.java executeScript deserializationShenzhen Dashi Tongzhou Information Technology AgileBPM
- CVE-2025-5745The strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 toThe GNU C Library glibc
- CVE-2025-5679Shenzhen Dashi Tongzhou Information Technology AgileBPM SysToolsController.java parseStrByFreeMarker deserializationShenzhen Dashi Tongzhou Information Technology AgileBPM
- CVE-2025-5677Campcodes Online Recruitment Management System ajax.php sql injectionCampcodes Online Recruitment Management System
- CVE-2025-5676Campcodes Online Recruitment Management System ajax.php sql injectionCampcodes Online Recruitment Management System
- CVE-2025-5675Campcodes Online Teacher Record Management System bwdates-reports-details.php sql injectionCampcodes Online Teacher Record Management System
- CVE-2025-5702The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to The GNU C Library glibc
- CVE-2025-5674code-projects Patient Record Management System urinalysis_form.php sql injectioncode-projects Patient Record Management System
- CVE-2025-46258WordPress Element Pack Pro Plugin < 8.0.0 - Broken Access Control vulnerabilityBdThemes Element Pack Pro
- CVE-2025-46257WordPress Element Pack Pro Plugin < 8.0.0 - Cross Site Request Forgery (CSRF) vulnerabilityBdThemes Element Pack Pro
- CVE-2025-5670PHPGurukul Medical Card Generation System manage-card.php sql injectionPHPGurukul Medical Card Generation System
- CVE-2025-49009Para Inserts Sensitive Information into Log File for Facebook authenticationErudika para · com.erudika:para-server
- CVE-2025-48493Yii 2 Redis may expose AUTH paramters in logs in case of connection failureyiisoft yii2-redis · yiisoft/yii2-redis
- CVE-2025-5669PHPGurukul Medical Card Generation System unreadenq.php sql injectionPHPGurukul Medical Card Generation System
- CVE-2025-5668PHPGurukul Medical Card Generation System readenq.php sql injectionPHPGurukul Medical Card Generation System
- CVE-2025-5667FreeFloat FTP Server REIN Command buffer overflowFreeFloat FTP Server
- CVE-2025-5666FreeFloat FTP Server XMKD Command buffer overflowFreeFloat FTP Server
- CVE-2025-5665FreeFloat FTP Server XCWD Command buffer overflowFreeFloat FTP Server
- CVE-2025-5664FreeFloat FTP Server RESTART Command buffer overflowFreeFloat FTP Server
- CVE-2025-5663PHPGurukul Auto Taxi Stand Management System search-autoortaxi.php sql injectionPHPGurukul Auto Taxi Stand Management System
- CVE-2025-0691Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "EDevolutions Server
- CVE-2025-5382Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to rDevolutions Server
- CVE-2025-3768Improper access control in Tor network blocking feature in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypassDevolutions Server
- CVE-2025-5661code-projects Traffic Offense Reporting System Setting save-settings.php cross site scriptingcode-projects Traffic Offense Reporting System
- CVE-2025-27754Extension - rsjoomla.com - A stored XSS vulnerability RSBlog! component 1.11.6 - 1.14.4 for Joomlarsjoomla.com RSBlog component for Joomla
- CVE-2025-27753Extension - rsjoomla.com - A SQLi vulnerability RSMediaGallery component 1.7.4 - 2.1.6 for Joomlarsjoomla.com RSMediaGallery component for Joomla
- CVE-2025-27445Extension - rsjoomla.com - A path traversal vulnerability RSFirewall component 2.9.7 - 3.1.5 for Joomlarsjoomla.com RSFirewall component for Joomla
- CVE-2025-30084Extension - rsjoomla.com - Reflected XSS vulnerability RSMail! component 1.19.20-1.22.26 for Joomlarsjoomla.com RSMail! component for Joomla
- CVE-2025-5660PHPGurukul Complaint Management System register-complaint.php sql injectionPHPGurukul Complaint Management System
- CVE-2025-5659PHPGurukul Complaint Management System profile.php sql injectionPHPGurukul Complaint Management System
- CVE-2025-5658PHPGurukul Complaint Management System updatecomplaint.php sql injectionPHPGurukul Complaint Management System
- CVE-2025-5657PHPGurukul Complaint Management System manage-users.php sql injectionPHPGurukul Complaint Management System
- CVE-2025-5656PHPGurukul Complaint Management System edit-category.php sql injectionPHPGurukul Complaint Management System
- CVE-2025-5341Forminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameterswpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2025-5655PHPGurukul Complaint Management System edit-subcategory.php sql injectionPHPGurukul Complaint Management System
- CVE-2025-5654PHPGurukul Complaint Management System edit-state.php sql injectionPHPGurukul Complaint Management System
- CVE-2025-5653PHPGurukul Complaint Management System between-date-userreport.php sql injectionPHPGurukul Complaint Management System
- CVE-2025-5652PHPGurukul Complaint Management System between-date-complaintreport.php sql injectionPHPGurukul Complaint Management System
- CVE-2025-5651code-projects Traffic Offense Reporting System saveuser.php cross site scriptingcode-projects Traffic Offense Reporting System
- CVE-2025-56501000projects Online Notice Board register.php sql injection1000projects Online Notice Board
- CVE-2025-5649SourceCodester Student Result Management System Register Interface new_user access controlSourceCodester Student Result Management System
- CVE-2025-5648Radare2 radiff2 pal.c r_cons_pal_init memory corruptionRadare2
- CVE-2025-5647Radare2 radiff2 cons.c r_cons_context_break_pop memory corruptionRadare2
- CVE-2025-5646Radare2 radiff2 pal.c r_cons_rainbow_free memory corruptionRadare2
- CVE-2025-5645Radare2 radiff2 pal.c r_cons_pal_init memory corruptionRadare2
- CVE-2025-5644Radare2 radiff2 cons.c r_cons_flush use after freeRadare2
- CVE-2025-5643Radare2 radiff2 cons.c cons_stack_load memory corruptionRadare2
- CVE-2025-5642Radare2 radiff2 pal.c r_cons_pal_init memory corruptionRadare2
- CVE-2025-5641Radare2 radiff2 cons.c r_cons_is_breaked memory corruptionRadare2
- CVE-2025-5640PX4-Autopilot TRAJECTORY_REPRESENTATION_WAYPOINTS Message mavlink_receiver.cpp stack-based overflowPX4-Autopilot
- CVE-2025-5683When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash.Qt
- CVE-2025-5639PHPGurukul Notice Board System forgot-password.php sql injectionPHPGurukul Notice Board System
- CVE-2025-5638PHPGurukul Notice Board System admin-profile.php sql injectionPHPGurukul Notice Board System
- CVE-2025-5637PCMan FTP Server SYSTEM Command buffer overflowPCMan FTP Server
- CVE-2025-5636PCMan FTP Server SET Command buffer overflowPCMan FTP Server
- CVE-2025-5635PCMan FTP Server PLS Command buffer overflowPCMan FTP Server
- CVE-2025-5634PCMan FTP Server NOOP Command buffer overflowPCMan FTP Server
- CVE-2025-5633code-projects/anirbandutta9 Content Management System/News-Buzz users.php sql injectioncode-projects Content Management System · code-projects… +2
- CVE-2025-5632code-projects/anirbandutta9 Content Management System/News-Buzz users.php sql injectioncode-projects Content Management System · code-projects… +2
- CVE-2025-5631code-projects/anirbandutta9 Content Management System/News-Buzz publicposts.php sql injectioncode-projects Content Management System · code-projects… +2
- CVE-2025-5628SourceCodester Food Menu Manager Add Menu index.php cross site scriptingSourceCodester Food Menu Manager
- CVE-2025-5627code-projects Patient Record Management System sputum_form.php sql injectioncode-projects Patient Record Management System
- CVE-2025-5626Campcodes Online Teacher Record Management System edit-subjects-detail.php sql injectionCampcodes Online Teacher Record Management System
- CVE-2025-5625Campcodes Online Teacher Record Management System search-teacher.php sql injectionCampcodes Online Teacher Record Management System
- CVE-2025-47827In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature.
- CVE-2025-48432An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23.djangoproject Django · django
- CVE-2025-49466aerc before 93bec0d allows directory traversal in commands/msgview/open.go because of direct path concatenation of the name of an attachmentrjarry aerc