# CVEs published 2025-06-07

15 CVEs were published on June 7, 2025: 1 critical, 5 high. Days are UTC.

- [CVE-2025-5840](https://cve.now/CVE-2025-5840.md): SourceCodester Client Database Management System user\_update\_customer\_order.php unrestricted upload (CVSS 6.9, SourceCodester Client Database Management System)
- [CVE-2025-5839](https://cve.now/CVE-2025-5839.md): Tenda AC9 POST Request AdvSetLanip fromadvsetlanip buffer overflow (CVSS 8.7, Tenda AC9)
- [CVE-2025-5838](https://cve.now/CVE-2025-5838.md): PHPGurukul Employee Record Management System adminprofile.php sql injection (CVSS 5.3, PHPGurukul Employee Record Management System)
- [CVE-2025-5837](https://cve.now/CVE-2025-5837.md): PHPGurukul Employee Record Management System allemployees.php sql injection (CVSS 5.3, PHPGurukul Employee Record Management System)
- [CVE-2025-5836](https://cve.now/CVE-2025-5836.md): Tenda AC9 POST Request SetIPTVCfg formSetIptv command injection (CVSS 5.3, Tenda AC9)
- [CVE-2024-9993](https://cve.now/CVE-2024-9993.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Event Calendar Widget (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2025-5568](https://cve.now/CVE-2025-5568.md): WpEvently \<= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, magepeopleteam Event Booking Manager for WooCommerce)
- [CVE-2025-5528](https://cve.now/CVE-2025-5528.md): Social Sharing Plugin – Sassy Social Share \<= 3.3.75 - Reflected Cross-Site Scripting via 'heateor\_mastodon\_share' Parameter (CVSS 6.1, heateor Social Sharing Plugin – Sassy Social Share)
- [CVE-2024-9994](https://cve.now/CVE-2024-9994.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Pricing Table Widget (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2025-5303](https://cve.now/CVE-2025-5303.md): LTL Freight Quotes – Freightview Edition \<= 1.0.11, LTL Freight Quotes – Daylight Edition \<=2.2.6 and LTL Freight Quotes – Day & Ross Edition \<= 2.1.10 - Unauthenticated Stored Cross-Site Scripting via \`expiry\_date\` Parameter (CVSS 7.2, enituretechnology LTL Freight Quotes – Freightview Editi… +1)
- [CVE-2025-5399](https://cve.now/CVE-2025-5399.md): WebSocket endless loop (CVSS 7.5, curl)
- [CVE-2025-47601](https://cve.now/CVE-2025-47601.md): WordPress MaxiBlocks plugin \<= 2.1.0 - Arbitrary Option Update to Privilege Escalation vulnerability (CVSS 8.8, Christiaan Pieterse MaxiBlocks)
- [CVE-2025-5814](https://cve.now/CVE-2025-5814.md): Profiler – What Slowing Down Your WP \<= 1.0.0 - Missing Authentication to Unauthenticated Arbitrary Plugin Reactivation via State Restoration (CVSS 5.3, switcorp Profiler – What Slowing Down Your WP)
- [CVE-2024-55585](https://cve.now/CVE-2024-55585.md): In the moPS App through 1.8.618, all users can access administrative API endpoints without additional authentication, resulting in unrestric (CVSS 9.0, moPS)
- [CVE-2025-49619](https://cve.now/CVE-2025-49619.md): Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation (CVSS 8.5, Skyvern)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-06-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.