# CVEs published 2025-06-05

94 CVEs were published on June 5, 2025: 8 critical, 9 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-5705](https://cve.now/CVE-2025-5705.md): code-projects Real Estate Property Management System Property.php sql injection (CVSS 6.9, code-projects Real Estate Property Management System)
- [CVE-2025-5704](https://cve.now/CVE-2025-5704.md): code-projects Real Estate Property Management System User.php sql injection (CVSS 6.9, code-projects Real Estate Property Management System)
- [CVE-2025-49012](https://cve.now/CVE-2025-49012.md): Himmelblau's Name-Based Group Matching in \`pam\_allow\_groups\` Leads to Potential Security Bypass (CVSS 5.4, himmelblau-idm himmelblau)
- [CVE-2025-5698](https://cve.now/CVE-2025-5698.md): Brilliance Golden Link Secondary System logSelect.htm sql injection (CVSS 5.3, Brilliance Golden Link Secondary System)
- [CVE-2025-5697](https://cve.now/CVE-2025-5697.md): Brilliance Golden Link Secondary System tcCustDeferPosiQuery.htm sql injection (CVSS 5.3, Brilliance Golden Link Secondary System)
- [CVE-2025-5696](https://cve.now/CVE-2025-5696.md): Brilliance Golden Link Secondary System rentChangeCheckInfoPage.htm sql injection (CVSS 5.3, Brilliance Golden Link Secondary System)
- [CVE-2025-5695](https://cve.now/CVE-2025-5695.md): Teledyne FLIR AX8 Backend subscriptions.php subscribe\_to\_alarm command injection (CVSS 5.1, Teledyne FLIR AX8)
- [CVE-2025-47966](https://cve.now/CVE-2025-47966.md): Power Automate Elevation of Privilege Vulnerability (CVSS 9.8, Microsoft Power Automate for Desktop)
- [CVE-2025-48133](https://cve.now/CVE-2025-48133.md): WordPress Uncanny Automator plugin \<= 6.4.0.2 - Broken Access Control Vulnerability (CVSS 6.5, Uncanny Owl Uncanny Automator)
- [CVE-2025-5694](https://cve.now/CVE-2025-5694.md): PHPGurukul Human Metapneumovirus Testing Management System search-report-result.php sql injection (CVSS 5.3, PHPGurukul Human Metapneumovirus Testing Management System)
- [CVE-2025-5693](https://cve.now/CVE-2025-5693.md): PHPGurukul Human Metapneumovirus Testing Management System bwdates-report-result.php sql injection (CVSS 5.3, PHPGurukul Human Metapneumovirus Testing Management System)
- [CVE-2025-5685](https://cve.now/CVE-2025-5685.md): Tenda CH22 Natlimit formNatlimit stack-based overflow (CVSS 8.7, Tenda CH22)
- [CVE-2025-43026](https://cve.now/CVE-2025-43026.md): HP Support Assistant – Potential Escalation of Privilege (CVSS 7.1, HP Support Assistant)
- [CVE-2025-5680](https://cve.now/CVE-2025-5680.md): Shenzhen Dashi Tongzhou Information Technology AgileBPM Groovy Script SysScriptController.java executeScript deserialization (CVSS 5.3, Shenzhen Dashi Tongzhou Information Technology AgileBPM)
- [CVE-2025-5745](https://cve.now/CVE-2025-5745.md): The strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 to (CVSS 5.6, The GNU C Library glibc)
- [CVE-2025-5679](https://cve.now/CVE-2025-5679.md): Shenzhen Dashi Tongzhou Information Technology AgileBPM SysToolsController.java parseStrByFreeMarker deserialization (CVSS 5.3, Shenzhen Dashi Tongzhou Information Technology AgileBPM)
- [CVE-2025-5677](https://cve.now/CVE-2025-5677.md): Campcodes Online Recruitment Management System ajax.php sql injection (CVSS 6.9, Campcodes Online Recruitment Management System)
- [CVE-2025-5676](https://cve.now/CVE-2025-5676.md): Campcodes Online Recruitment Management System ajax.php sql injection (CVSS 6.9, Campcodes Online Recruitment Management System)
- [CVE-2025-5675](https://cve.now/CVE-2025-5675.md): Campcodes Online Teacher Record Management System bwdates-reports-details.php sql injection (CVSS 6.9, Campcodes Online Teacher Record Management System)
- [CVE-2025-5702](https://cve.now/CVE-2025-5702.md): The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to (CVSS 5.6, The GNU C Library glibc)
- [CVE-2025-5674](https://cve.now/CVE-2025-5674.md): code-projects Patient Record Management System urinalysis\_form.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2025-46258](https://cve.now/CVE-2025-46258.md): WordPress Element Pack Pro Plugin \< 8.0.0 - Broken Access Control vulnerability (CVSS 5.4, BdThemes Element Pack Pro)
- [CVE-2025-46257](https://cve.now/CVE-2025-46257.md): WordPress Element Pack Pro Plugin \< 8.0.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, BdThemes Element Pack Pro)
- [CVE-2025-5672](https://cve.now/CVE-2025-5672.md): TOTOLINK N302R Plus HTTP POST Request formFilter buffer overflow (CVSS 8.7, TOTOLINK N302R Plus)
- [CVE-2025-5671](https://cve.now/CVE-2025-5671.md): TOTOLINK N302R Plus HTTP POST Request formPortFw buffer overflow (CVSS 8.7, TOTOLINK N302R Plus)
- [CVE-2025-5670](https://cve.now/CVE-2025-5670.md): PHPGurukul Medical Card Generation System manage-card.php sql injection (CVSS 5.3, PHPGurukul Medical Card Generation System)
- [CVE-2025-49009](https://cve.now/CVE-2025-49009.md): Para Inserts Sensitive Information into Log File for Facebook authentication (CVSS 6.2, Erudika para · com.erudika:para-server)
- [CVE-2025-48493](https://cve.now/CVE-2025-48493.md): Yii 2 Redis may expose AUTH paramters in logs in case of connection failure (CVSS 5.1, yiisoft yii2-redis · yiisoft/yii2-redis)
- [CVE-2025-5669](https://cve.now/CVE-2025-5669.md): PHPGurukul Medical Card Generation System unreadenq.php sql injection (CVSS 5.3, PHPGurukul Medical Card Generation System)
- [CVE-2025-5668](https://cve.now/CVE-2025-5668.md): PHPGurukul Medical Card Generation System readenq.php sql injection (CVSS 5.3, PHPGurukul Medical Card Generation System)
- [CVE-2025-5667](https://cve.now/CVE-2025-5667.md): FreeFloat FTP Server REIN Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-5666](https://cve.now/CVE-2025-5666.md): FreeFloat FTP Server XMKD Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-5665](https://cve.now/CVE-2025-5665.md): FreeFloat FTP Server XCWD Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-5664](https://cve.now/CVE-2025-5664.md): FreeFloat FTP Server RESTART Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-5663](https://cve.now/CVE-2025-5663.md): PHPGurukul Auto Taxi Stand Management System search-autoortaxi.php sql injection (CVSS 6.9, PHPGurukul Auto Taxi Stand Management System)
- [CVE-2025-0691](https://cve.now/CVE-2025-0691.md): Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "E (CVSS 5.0, Devolutions Server)
- [CVE-2025-5382](https://cve.now/CVE-2025-5382.md): Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to r (CVSS 6.8, Devolutions Server)
- [CVE-2025-3768](https://cve.now/CVE-2025-3768.md): Improper access control in Tor network blocking feature in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass (CVSS 5.0, Devolutions Server)
- [CVE-2025-5661](https://cve.now/CVE-2025-5661.md): code-projects Traffic Offense Reporting System Setting save-settings.php cross site scripting (CVSS 4.8, code-projects Traffic Offense Reporting System)
- [CVE-2025-27754](https://cve.now/CVE-2025-27754.md): Extension - rsjoomla.com - A stored XSS vulnerability RSBlog! component 1.11.6 - 1.14.4 for Joomla (CVSS 6.5, rsjoomla.com RSBlog component for Joomla)
- [CVE-2025-27753](https://cve.now/CVE-2025-27753.md): Extension - rsjoomla.com - A SQLi vulnerability RSMediaGallery component 1.7.4 - 2.1.6 for Joomla (CVSS 6.5, rsjoomla.com RSMediaGallery component for Joomla)
- [CVE-2025-27445](https://cve.now/CVE-2025-27445.md): Extension - rsjoomla.com - A path traversal vulnerability RSFirewall component 2.9.7 - 3.1.5 for Joomla (CVSS 5.4, rsjoomla.com RSFirewall component for Joomla)
- [CVE-2025-30084](https://cve.now/CVE-2025-30084.md): Extension - rsjoomla.com - Reflected XSS vulnerability RSMail! component 1.19.20-1.22.26 for Joomla (CVSS 6.1, rsjoomla.com RSMail! component for Joomla)
- [CVE-2025-5660](https://cve.now/CVE-2025-5660.md): PHPGurukul Complaint Management System register-complaint.php sql injection (CVSS 5.3, PHPGurukul Complaint Management System)
- [CVE-2025-5659](https://cve.now/CVE-2025-5659.md): PHPGurukul Complaint Management System profile.php sql injection (CVSS 5.3, PHPGurukul Complaint Management System)
- [CVE-2025-5658](https://cve.now/CVE-2025-5658.md): PHPGurukul Complaint Management System updatecomplaint.php sql injection (CVSS 5.3, PHPGurukul Complaint Management System)
- [CVE-2025-5657](https://cve.now/CVE-2025-5657.md): PHPGurukul Complaint Management System manage-users.php sql injection (CVSS 5.3, PHPGurukul Complaint Management System)
- [CVE-2011-10007](https://cve.now/CVE-2011-10007.md): File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when \`grep()\` encounters a crafted file name (CVSS 8.8, RCLAMP File::Find::Rule)
- [CVE-2025-5656](https://cve.now/CVE-2025-5656.md): PHPGurukul Complaint Management System edit-category.php sql injection (CVSS 5.3, PHPGurukul Complaint Management System)
- [CVE-2025-5341](https://cve.now/CVE-2025-5341.md): Forminator \<= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters (CVSS 6.4, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2025-5701](https://cve.now/CVE-2025-5701.md): HyperComments \<= 1.2.2 - Unauthenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, siteheart HyperComments)
- [CVE-2025-5655](https://cve.now/CVE-2025-5655.md): PHPGurukul Complaint Management System edit-subcategory.php sql injection (CVSS 5.3, PHPGurukul Complaint Management System)
- [CVE-2025-5654](https://cve.now/CVE-2025-5654.md): PHPGurukul Complaint Management System edit-state.php sql injection (CVSS 5.3, PHPGurukul Complaint Management System)
- [CVE-2025-5653](https://cve.now/CVE-2025-5653.md): PHPGurukul Complaint Management System between-date-userreport.php sql injection (CVSS 5.3, PHPGurukul Complaint Management System)
- [CVE-2025-4568](https://cve.now/CVE-2025-4568.md): SQL Injection in 2ClickPortal (CVSS 9.3, Trol InterMedia 2ClickPortal)
- [CVE-2025-5652](https://cve.now/CVE-2025-5652.md): PHPGurukul Complaint Management System between-date-complaintreport.php sql injection (CVSS 5.3, PHPGurukul Complaint Management System)
- [CVE-2025-5651](https://cve.now/CVE-2025-5651.md): code-projects Traffic Offense Reporting System saveuser.php cross site scripting (CVSS 5.1, code-projects Traffic Offense Reporting System)
- [CVE-2025-5650](https://cve.now/CVE-2025-5650.md): 1000projects Online Notice Board register.php sql injection (CVSS 6.9, 1000projects Online Notice Board)
- [CVE-2025-5649](https://cve.now/CVE-2025-5649.md): SourceCodester Student Result Management System Register Interface new\_user access control (CVSS 6.9, SourceCodester Student Result Management System)
- [CVE-2025-5648](https://cve.now/CVE-2025-5648.md): Radare2 radiff2 pal.c r\_cons\_pal\_init memory corruption (CVSS 2.0, Radare2)
- [CVE-2025-5647](https://cve.now/CVE-2025-5647.md): Radare2 radiff2 cons.c r\_cons\_context\_break\_pop memory corruption (CVSS 2.0, Radare2)
- [CVE-2025-5646](https://cve.now/CVE-2025-5646.md): Radare2 radiff2 pal.c r\_cons\_rainbow\_free memory corruption (CVSS 2.0, Radare2)
- [CVE-2025-5645](https://cve.now/CVE-2025-5645.md): Radare2 radiff2 pal.c r\_cons\_pal\_init memory corruption (CVSS 2.0, Radare2)
- [CVE-2025-5644](https://cve.now/CVE-2025-5644.md): Radare2 radiff2 cons.c r\_cons\_flush use after free (CVSS 2.0, Radare2)
- [CVE-2025-5643](https://cve.now/CVE-2025-5643.md): Radare2 radiff2 cons.c cons\_stack\_load memory corruption (CVSS 2.0, Radare2)
- [CVE-2025-5642](https://cve.now/CVE-2025-5642.md): Radare2 radiff2 pal.c r\_cons\_pal\_init memory corruption (CVSS 2.0, Radare2)
- [CVE-2025-5641](https://cve.now/CVE-2025-5641.md): Radare2 radiff2 cons.c r\_cons\_is\_breaked memory corruption (CVSS 2.0, Radare2)
- [CVE-2025-5640](https://cve.now/CVE-2025-5640.md): PX4-Autopilot TRAJECTORY\_REPRESENTATION\_WAYPOINTS Message mavlink\_receiver.cpp stack-based overflow (CVSS 4.8, PX4-Autopilot)
- [CVE-2025-5683](https://cve.now/CVE-2025-5683.md): When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash. (CVSS 5.1, Qt)
- [CVE-2025-5639](https://cve.now/CVE-2025-5639.md): PHPGurukul Notice Board System forgot-password.php sql injection (CVSS 6.9, PHPGurukul Notice Board System)
- [CVE-2025-3055](https://cve.now/CVE-2025-3055.md): WP User Frontend Pro \<= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.1, wedevs WP User Frontend Pro)
- [CVE-2025-3054](https://cve.now/CVE-2025-3054.md): WP User Frontend Pro \<= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, wedevs WP User Frontend Pro)
- [CVE-2025-5638](https://cve.now/CVE-2025-5638.md): PHPGurukul Notice Board System admin-profile.php sql injection (CVSS 5.3, PHPGurukul Notice Board System)
- [CVE-2025-1793](https://cve.now/CVE-2025-1793.md): SQL Injection in run-llama/llama\_index (CVSS 9.8, run-llama/llama\_index · llama-index)
- [CVE-2025-5637](https://cve.now/CVE-2025-5637.md): PCMan FTP Server SYSTEM Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-5636](https://cve.now/CVE-2025-5636.md): PCMan FTP Server SET Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-5635](https://cve.now/CVE-2025-5635.md): PCMan FTP Server PLS Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-5634](https://cve.now/CVE-2025-5634.md): PCMan FTP Server NOOP Command buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2025-5633](https://cve.now/CVE-2025-5633.md): code-projects/anirbandutta9 Content Management System/News-Buzz users.php sql injection (CVSS 5.3, code-projects Content Management System · code-projects… +2)
- [CVE-2025-5632](https://cve.now/CVE-2025-5632.md): code-projects/anirbandutta9 Content Management System/News-Buzz users.php sql injection (CVSS 5.3, code-projects Content Management System · code-projects… +2)
- [CVE-2025-5631](https://cve.now/CVE-2025-5631.md): code-projects/anirbandutta9 Content Management System/News-Buzz publicposts.php sql injection (CVSS 6.9, code-projects Content Management System · code-projects… +2)
- [CVE-2025-5630](https://cve.now/CVE-2025-5630.md): D-Link DIR-816 form2lansetup.cgi stack-based overflow (CVSS 9.3, D-Link DIR-816)
- [CVE-2025-5629](https://cve.now/CVE-2025-5629.md): Tenda AC10 HTTP SetPptpServerCfg formSetPPTPServer buffer overflow (CVSS 8.7, Tenda AC10)
- [CVE-2025-5628](https://cve.now/CVE-2025-5628.md): SourceCodester Food Menu Manager Add Menu index.php cross site scripting (CVSS 5.1, SourceCodester Food Menu Manager)
- [CVE-2025-5627](https://cve.now/CVE-2025-5627.md): code-projects Patient Record Management System sputum\_form.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2025-5626](https://cve.now/CVE-2025-5626.md): Campcodes Online Teacher Record Management System edit-subjects-detail.php sql injection (CVSS 6.9, Campcodes Online Teacher Record Management System)
- [CVE-2025-5625](https://cve.now/CVE-2025-5625.md): Campcodes Online Teacher Record Management System search-teacher.php sql injection (CVSS 6.9, Campcodes Online Teacher Record Management System)
- [CVE-2025-5624](https://cve.now/CVE-2025-5624.md): D-Link DIR-816 QoSPortSetup stack-based overflow (CVSS 9.3, D-Link DIR-816)
- [CVE-2025-49008](https://cve.now/CVE-2025-49008.md): Atheos Improper Input Validation Vulnerability Enables RCE in Common.php (CVSS 9.4, Atheos)
- [CVE-2025-5623](https://cve.now/CVE-2025-5623.md): D-Link DIR-816 qosClassifier stack-based overflow (CVSS 9.3, D-Link DIR-816)
- [CVE-2025-5622](https://cve.now/CVE-2025-5622.md): D-Link DIR-816 wirelessApcli\_5g stack-based overflow (CVSS 9.3, D-Link DIR-816)
- [CVE-2025-47827](https://cve.now/CVE-2025-47827.md): In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. (CVSS 4.6, KEV)
- [CVE-2025-48432](https://cve.now/CVE-2025-48432.md): An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. (CVSS 4.0, djangoproject Django · django)
- [CVE-2025-49466](https://cve.now/CVE-2025-49466.md): aerc before 93bec0d allows directory traversal in commands/msgview/open.go because of direct path concatenation of the name of an attachment (CVSS 5.8, rjarry aerc)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-06-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.