# CVEs published 2025-06-09 180 CVEs were published on June 9, 2025: 24 critical, 93 high. Days are UTC. - [CVE-2025-0036](https://cve.now/CVE-2025-0036.md): In AMD Versal Adaptive SoC devices, the incorrect configuration of the SSS during runtime (post-boot) cryptographic operations could cause d (CVSS 3.2, AMD Versal Adaptive SoC Devices · AMD Versal RF Series +6) - [CVE-2025-0037](https://cve.now/CVE-2025-0037.md): In AMD Versal Adaptive SoC devices, the lack of address validation when executing PLM runtime services through the PLM firmware can allow ac (CVSS 6.6, AMD Platform Loader and Manager) - [CVE-2025-5903](https://cve.now/CVE-2025-5903.md): TOTOLINK T10 POST Request cstecgi.cgi setWiFiAclRules buffer overflow (CVSS 8.7, TOTOLINK T10) - [CVE-2025-5902](https://cve.now/CVE-2025-5902.md): TOTOLINK T10 POST Request cstecgi.cgi setUpgradeFW buffer overflow (CVSS 8.7, TOTOLINK T10) - [CVE-2025-30515](https://cve.now/CVE-2025-30515.md): CyberData 011209 SIP Emergency Intercom Path Traversal (CVSS 9.8, CyberData 011209 SIP Emergency Intercom) - [CVE-2025-5901](https://cve.now/CVE-2025-5901.md): TOTOLINK T10 POST Request cstecgi.cgi UploadCustomModule buffer overflow (CVSS 8.7, TOTOLINK T10) - [CVE-2025-30183](https://cve.now/CVE-2025-30183.md): CyberData 011209 SIP Emergency Intercom Insufficiently Protected Credentials (CVSS 7.5, CyberData 011209 SIP Emergency Intercom) - [CVE-2025-30507](https://cve.now/CVE-2025-30507.md): CyberData 011209 SIP Emergency Intercom SQL Injection (CVSS 5.3, CyberData 011209 SIP Emergency Intercom) - [CVE-2025-26468](https://cve.now/CVE-2025-26468.md): CyberData 011209 SIP Emergency Intercom Missing Authentication for Critical Function (CVSS 7.5, CyberData 011209 SIP Emergency Intercom) - [CVE-2025-30184](https://cve.now/CVE-2025-30184.md): CyberData 011209 SIP Emergency Intercom Authentication Bypass Using an Alternate Path or Channel (CVSS 9.8, CyberData 011209 SIP Emergency Intercom) - [CVE-2025-5900](https://cve.now/CVE-2025-5900.md): Tenda AC9 cross-site request forgery (CVSS 5.3, Tenda AC9) - [CVE-2025-5899](https://cve.now/CVE-2025-5899.md): GNU PSPP pspp-convert.c parse\_variables\_option free of memory not on the heap (CVSS 4.8, GNU PSPP) - [CVE-2025-5898](https://cve.now/CVE-2025-5898.md): GNU PSPP pspp-convert.c parse\_variables\_option out-of-bounds write (CVSS 4.8, GNU PSPP) - [CVE-2025-49140](https://cve.now/CVE-2025-49140.md): Pion Interceptor's improper RTP padding handling allows remote crash for SFU users (DoS) (CVSS 7.5, pion interceptor · github.com/pion/interceptor) - [CVE-2025-49141](https://cve.now/CVE-2025-49141.md): HaxCMS-PHP Command Injection Vulnerability (CVSS 8.6, haxtheweb issues · @haxtheweb/haxcms-nodejs) - [CVE-2025-49139](https://cve.now/CVE-2025-49139.md): @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability (CVSS 5.3, haxtheweb issues · @haxtheweb/haxcms-nodejs) - [CVE-2025-49138](https://cve.now/CVE-2025-49138.md): HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter (CVSS 6.5, haxtheweb issues · elmsln/haxcms) - [CVE-2025-5897](https://cve.now/CVE-2025-5897.md): vuejs vue-cli Markdown Code HtmlPwaPlugin.js HtmlPwaPlugin redos (CVSS 5.3, vuejs vue-cli · @vue/cli-plugin-pwa) - [CVE-2025-49137](https://cve.now/CVE-2025-49137.md): Hax CMS Stored Cross-Site Scripting vulnerability (CVSS 8.5, haxtheweb issues · elmsln/haxcms) - [CVE-2025-5896](https://cve.now/CVE-2025-5896.md): tarojs taro index.js redos (CVSS 5.3, tarojs taro · taro-css-to-react-native) - [CVE-2025-49004](https://cve.now/CVE-2025-49004.md): Hijacking Caido instance during the initial setup via DNS Rebinding to achieve RCE (CVSS 7.5, caido) - [CVE-2025-5895](https://cve.now/CVE-2025-5895.md): Metabase dom.js parseDataUri redos (CVSS 5.3, Metabase) - [CVE-2025-5914](https://cve.now/CVE-2025-5914.md): Libarchive: double free at archive\_read\_format\_rar\_seek\_data() in archive\_read\_support\_format\_rar.c (CVSS 7.8, libarchive · Red Hat Enterprise Linux +11) - [CVE-2025-5918](https://cve.now/CVE-2025-5918.md): Libarchive: reading past eof may be triggered for piped file streams (CVSS 3.9, libarchive · Red Hat Enterprise Linux +1) - [CVE-2025-5917](https://cve.now/CVE-2025-5917.md): Libarchive: off by one error in build\_ustar\_entry\_name() at archive\_write\_set\_format\_pax.c (CVSS 2.8, libarchive · Red Hat Enterprise Linux +1) - [CVE-2025-5916](https://cve.now/CVE-2025-5916.md): Libarchive: integer overflow while reading warc files at archive\_read\_support\_format\_warc.c (CVSS 3.9, libarchive · Red Hat Enterprise Linux +1) - [CVE-2025-5915](https://cve.now/CVE-2025-5915.md): Libarchive: heap buffer over read in copy\_from\_lzss\_window() at archive\_read\_support\_format\_rar.c (CVSS 6.6, libarchive · Red Hat Enterprise Linux +1) - [CVE-2025-5892](https://cve.now/CVE-2025-5892.md): RocketChat parseMessage.js parseMessage redos (CVSS 5.3, RocketChat) - [CVE-2025-5891](https://cve.now/CVE-2025-5891.md): Unitech pm2 Config.js redos (CVSS 5.3, Unitech pm2 · pm2) - [CVE-2025-5890](https://cve.now/CVE-2025-5890.md): actions toolkit glob internal-pattern.ts globEscape redos (CVSS 5.3, actions toolkit) - [CVE-2025-5889](https://cve.now/CVE-2025-5889.md): juliangruber brace-expansion index.js expand redos (CVSS 2.3, juliangruber brace-expansion · brace-expansion) - [CVE-2024-47081](https://cve.now/CVE-2024-47081.md): Requests vulnerable to .netrc credentials leak via malicious URLs (CVSS 5.3, psf requests · requests) - [CVE-2025-5888](https://cve.now/CVE-2025-5888.md): jsnjfz WebStack-Guns cross-site request forgery (CVSS 5.3, jsnjfz WebStack-Guns) - [CVE-2025-49653](https://cve.now/CVE-2025-49653.md): Exposure of sensitive Information allows account takeover (CVSS 8.0, Lablup BackendAI · backend-ai) - [CVE-2025-49652](https://cve.now/CVE-2025-49652.md): Improper access control allows arbitrary account creation (CVSS 9.8, Lablup BackendAI · backend-ai) - [CVE-2025-49651](https://cve.now/CVE-2025-49651.md): Missing Authorization for Interactive Sessions (CVSS 8.1, Lablup BackendAI · backend-ai) - [CVE-2025-5887](https://cve.now/CVE-2025-5887.md): jsnjfz WebStack-Guns File Upload UserMgrController.java cross site scripting (CVSS 5.1, jsnjfz WebStack-Guns) - [CVE-2025-49136](https://cve.now/CVE-2025-49136.md): listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user (CVSS 9.1, knadh listmonk · github.com/knadh/listmonk) - [CVE-2025-5886](https://cve.now/CVE-2025-5886.md): Emlog article.php cross site scripting (CVSS 5.1, Emlog) - [CVE-2023-25999](https://cve.now/CVE-2023-25999.md): WordPress BodyCenter - Gym, Fitness WooCommerce WordPress Theme \<= 2.4 - Local File Inclusion Vulnerability (CVSS 8.1, snstheme BodyCenter - Gym, Fitness WooCommerce WordPress Th…) - [CVE-2023-26005](https://cve.now/CVE-2023-26005.md): WordPress Fitrush \<= 1.3.4 - Local File Inclusion Vulnerability (CVSS 8.1, BZOTheme Fitrush) - [CVE-2025-23974](https://cve.now/CVE-2025-23974.md): WordPress One-Login plugin \<= 1.4 - Privilege Escalation Vulnerability (CVSS 8.1, ifkooo One-Login) - [CVE-2025-24767](https://cve.now/CVE-2025-24767.md): WordPress TicketBAI Facturas para WooCommerce plugin \<= 3.19 - SQL Injection Vulnerability (CVSS 9.3, facturaone TicketBAI Facturas para WooCommerce) - [CVE-2025-24768](https://cve.now/CVE-2025-24768.md): WordPress Nitan theme \<= 2.9 - Local File Inclusion Vulnerability (CVSS 8.1, snstheme Nitan) - [CVE-2025-24770](https://cve.now/CVE-2025-24770.md): WordPress CraftXtore theme \<= 1.7 - Local File Inclusion Vulnerability (CVSS 8.1, BZOTheme CraftXtore) - [CVE-2025-26592](https://cve.now/CVE-2025-26592.md): WordPress Lab Theme \<= 1.0.0 - Local File Inclusion Vulnerability (CVSS 8.1, axiomthemes Lab) - [CVE-2025-27362](https://cve.now/CVE-2025-27362.md): WordPress Petito theme \< 1.6.6 - Local File Inclusion vulnerability (CVSS 8.1, BZOTheme Petito) - [CVE-2025-28888](https://cve.now/CVE-2025-28888.md): WordPress GiftXtore theme \< 1.7.7 - Local File Inclusion vulnerability (CVSS 8.1, BZOTheme GiftXtore) - [CVE-2025-28944](https://cve.now/CVE-2025-28944.md): WordPress Avaz theme \<= 2.8 - Local File Inclusion Vulnerability (CVSS 8.1, snstheme Avaz) - [CVE-2025-28945](https://cve.now/CVE-2025-28945.md): WordPress Valen - Sport, Fashion WooCommerce WordPress Theme \<= 2.4 - Local File Inclusion Vulnerability (CVSS 8.1, snstheme Valen - Sport, Fashion WooCommerce WordPress Theme) - [CVE-2025-28992](https://cve.now/CVE-2025-28992.md): WordPress SNS Anton theme \<= 4.1 - Local File Inclusion Vulnerability (CVSS 8.1, snstheme SNS Anton) - [CVE-2025-31019](https://cve.now/CVE-2025-31019.md): WordPress Password Policy Manager plugin \<= 2.0.4 - Account Takeover vulnerability (CVSS 8.8, miniOrange Password Policy Manager) - [CVE-2025-31022](https://cve.now/CVE-2025-31022.md): WordPress PayU India plugin \< 3.8.8 - Account Takeover vulnerability (CVSS 9.8, PayU India) - [CVE-2025-31039](https://cve.now/CVE-2025-31039.md): WordPress Category Icon plugin \<= 1.0.3 - XML External Entity (XXE) vulnerability (CVSS 9.1, pixelgrade Category Icon) - [CVE-2025-31045](https://cve.now/CVE-2025-31045.md): WordPress elfsight Contact Form widget plugin \<= 2.3.1 - Sensitive Data Exposure Vulnerability (CVSS 7.5, elfsight Contact Form widget) - [CVE-2025-31050](https://cve.now/CVE-2025-31050.md): WordPress Apptha Slider Gallery plugin \<= 2.5 - Arbitrary File Read vulnerability (CVSS 7.5, appthaplugins Apptha Slider Gallery) - [CVE-2025-31052](https://cve.now/CVE-2025-31052.md): WordPress The Fashion - Model Agency One Page Beauty Theme plugin \<= 1.4.4 - Deserialization of untrusted data Vulnerability (CVSS 9.8, themeton The Fashion - Model Agency One Page Beauty Theme) - [CVE-2025-31057](https://cve.now/CVE-2025-31057.md): WordPress Universal Video Player plugin \<= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LambertGroup Universal Video Player) - [CVE-2025-31058](https://cve.now/CVE-2025-31058.md): WordPress Revolution Video Player plugin \<= 2.9.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LambertGroup Revolution Video Player) - [CVE-2025-31059](https://cve.now/CVE-2025-31059.md): WordPress WBW Product Table PRO plugin \<= 2.2.6 - SQL Injection vulnerability (CVSS 9.3, woobewoo WBW Product Table PRO) - [CVE-2025-31061](https://cve.now/CVE-2025-31061.md): WordPress Wishlist plugin \<= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, redqteam Wishlist) - [CVE-2025-31396](https://cve.now/CVE-2025-31396.md): WordPress FLAP - Business WordPress Theme \<= 1.5 - PHP Object Injection Vulnerability (CVSS 9.8, themeton FLAP - Business WordPress Theme) - [CVE-2025-31398](https://cve.now/CVE-2025-31398.md): WordPress PIMP - Creative MultiPurpose \<= 1.7 - Deserialization of untrusted data Vulnerability (CVSS 9.8, themeton PIMP - Creative MultiPurpose) - [CVE-2025-31424](https://cve.now/CVE-2025-31424.md): WordPress WP Lead Capturing Pages plugin \< 2.6 - SQL Injection vulnerability (CVSS 9.3, kamleshyadav WP Lead Capturing Pages) - [CVE-2025-31426](https://cve.now/CVE-2025-31426.md): WordPress Sticky Radio Player plugin \<= 3.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LambertGroup Sticky Radio Player) - [CVE-2025-31429](https://cve.now/CVE-2025-31429.md): WordPress PressGrid - Frontend Publish Reaction & Multimedia Theme \<= 1.3.1 - Deserialization of untrusted data Vulnerability (CVSS 9.8, themeton PressGrid - Frontend Publish Reaction & Multimedia…) - [CVE-2025-31635](https://cve.now/CVE-2025-31635.md): WordPress CLEVER plugin \<= 2.6 - Arbitrary File Download Vulnerability (CVSS 7.5, LambertGroup CLEVER) - [CVE-2025-31638](https://cve.now/CVE-2025-31638.md): WordPress Spare \<= 1.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, themeton Spare) - [CVE-2025-31917](https://cve.now/CVE-2025-31917.md): WordPress Universal Video Player plugin \<= 3.8.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LambertGroup Universal Video Player) - [CVE-2025-31920](https://cve.now/CVE-2025-31920.md): WordPress WP Guppy plugin \<= 4.3.3 - SQL Injection Vulnerability (CVSS 8.5, AmentoTech WP Guppy) - [CVE-2025-31925](https://cve.now/CVE-2025-31925.md): WordPress SHOUT plugin \<= 3.5.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LambertGroup SHOUT) - [CVE-2025-32291](https://cve.now/CVE-2025-32291.md): WordPress SUMO Affiliates Pro plugin \< 11.1.0 - Arbitrary File Upload vulnerability (CVSS 10.0, FantasticPlugins SUMO Affiliates Pro) - [CVE-2025-32305](https://cve.now/CVE-2025-32305.md): WordPress FlatNews theme \<= 5.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sneeit WordPress FlatNews Theme) - [CVE-2025-32308](https://cve.now/CVE-2025-32308.md): WordPress Team Builder plugin \<= 1.5.7 - Broken Access Control Vulnerability (CVSS 7.6, looks\_awesome Team Builder) - [CVE-2025-32595](https://cve.now/CVE-2025-32595.md): WordPress Krowd theme \< 1.5.0 - Local File Inclusion vulnerability (CVSS 8.1, gavias Krowd) - [CVE-2025-39473](https://cve.now/CVE-2025-39473.md): WordPress Seofy Core plugin \<= 1.6.8 - Local File Inclusion Vulnerability (CVSS 8.1, WebGeniusLab Seofy Core) - [CVE-2025-39475](https://cve.now/CVE-2025-39475.md): WordPress Arlo theme \<= 6.0.3 - Local File Inclusion Vulnerability (CVSS 8.1, Frenify Arlo) - [CVE-2025-39476](https://cve.now/CVE-2025-39476.md): WordPress Revo theme \<= 4.0.26 - Local File Inclusion Vulnerability (CVSS 7.5, magentech Revo) - [CVE-2025-39539](https://cve.now/CVE-2025-39539.md): WordPress WP Email Delivery plugin \<= 1.20.11.23 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, brewlabs WP Email Delivery) - [CVE-2025-47463](https://cve.now/CVE-2025-47463.md): WordPress Stock Locations for WooCommerce plugin \<= 2.8.6 - Broken Access Control Vulnerability (CVSS 7.1, Fahad Mahmood Stock Locations for WooCommerce) - [CVE-2025-47477](https://cve.now/CVE-2025-47477.md): WordPress Backup and Staging by WP Time Capsule plugin \<= 1.22.23 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, revmakx Backup and Staging by WP Time Capsule) - [CVE-2025-47487](https://cve.now/CVE-2025-47487.md): WordPress MC Woocommerce Wishlist plugin \<= 1.9.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Moreconvert Team MC Woocommerce Wishlist) - [CVE-2025-47511](https://cve.now/CVE-2025-47511.md): WordPress Welcart e-Commerce plugin \<= 2.11.13 - Arbitrary File Deletion Vulnerability (CVSS 6.8, info@welcart Welcart e-Commerce) - [CVE-2025-47527](https://cve.now/CVE-2025-47527.md): WordPress Icegram Collect – Easy Form, Lead Collection and Subscription plugin \<= 1.3.18 - Broken Access Control Vulnerability (CVSS 7.1, Icegram Collect) - [CVE-2025-47561](https://cve.now/CVE-2025-47561.md): WordPress MapSVG plugin \< 8.6.13 - Privilege Escalation Vulnerability (CVSS 8.8, RomanCode MapSVG) - [CVE-2025-47598](https://cve.now/CVE-2025-47598.md): WordPress History Log by click5 plugin \<= 1.0.13 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, History Log by click5) - [CVE-2025-47608](https://cve.now/CVE-2025-47608.md): WordPress Recover abandoned cart for WooCommerce plugin \<= 2.5 - SQL Injection Vulnerability (CVSS 9.3, sonalsinha21 Recover abandoned cart for WooCommerce) - [CVE-2025-47651](https://cve.now/CVE-2025-47651.md): WordPress Infility Global plugin \<= 2.15.06 - SQL Injection vulnerability (CVSS 8.5, Infility Global) - [CVE-2025-48122](https://cve.now/CVE-2025-48122.md): WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin \<= 2.4.37 - SQL Injection Vulnerability (CVSS 9.3, Holest Engineering Spreadsheet Price Changer for WooCommerc…) - [CVE-2025-48123](https://cve.now/CVE-2025-48123.md): WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin \<= 2.4.37 - Remote Code Execution (RCE) Vulnerability (CVSS 10.0, Holest Engineering Spreadsheet Price Changer for WooCommerc…) - [CVE-2025-48124](https://cve.now/CVE-2025-48124.md): WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin \<= 2.4.37 - Arbitrary File Download Vulnerability (CVSS 7.5, Holest Engineering Spreadsheet Price Changer for WooCommerc…) - [CVE-2025-48125](https://cve.now/CVE-2025-48125.md): WordPress WP Event Manager plugin \<= 3.1.51 - Local File Inclusion Vulnerability (CVSS 8.1, WP Event Manager) - [CVE-2025-48126](https://cve.now/CVE-2025-48126.md): WordPress Essential Real Estate plugin \<= 5.2.9 - Local File Inclusion vulnerability (CVSS 8.1, g5theme Essential Real Estate) - [CVE-2025-48129](https://cve.now/CVE-2025-48129.md): WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin \<= 2.4.37 - Privilege Escalation Vulnerability (CVSS 9.8, Holest Engineering Spreadsheet Price Changer for WooCommerc…) - [CVE-2025-48130](https://cve.now/CVE-2025-48130.md): WordPress Spice Blocks plugin \<= 2.0.7.4 - Arbitrary File Download vulnerability (CVSS 7.5, spicethemes Spice Blocks) - [CVE-2025-48139](https://cve.now/CVE-2025-48139.md): WordPress StyleAI plugin \<= 1.0.4 - Broken Access Control Vulnerability (CVSS 6.5, relentlo StyleAI) - [CVE-2025-48140](https://cve.now/CVE-2025-48140.md): WordPress MetalpriceAPI plugin \<= 1.1.4 - Remote Code Execution (RCE) Vulnerability (CVSS 9.9, MetalpriceAPI) - [CVE-2025-48141](https://cve.now/CVE-2025-48141.md): WordPress Multi CryptoCurrency Payments plugin \<= 2.0.7 - SQL Injection Vulnerability (CVSS 9.3, Alex Zaytseff Multi CryptoCurrency Payments) - [CVE-2025-48143](https://cve.now/CVE-2025-48143.md): WordPress Formulario de contacto SalesUp! plugin \<= 1.0.14 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, salesup2019 Formulario de contacto SalesUp!) - [CVE-2025-48147](https://cve.now/CVE-2025-48147.md): WordPress CryptoCloud - Crypto Payment Gateway plugin \<= 2.1.2 - Broken Access Control vulnerability (CVSS 6.5, Crypto Cloud CryptoCloud - Crypto Payment Gateway) - [CVE-2025-48261](https://cve.now/CVE-2025-48261.md): WordPress MultiVendorX plugin \<= 4.2.22 - Sensitive Data Exposure Vulnerability (CVSS 7.5, MultiVendorX) - [CVE-2025-48267](https://cve.now/CVE-2025-48267.md): WordPress WP Pipes plugin \<= 1.4.2 - Arbitrary File Deletion Vulnerability (CVSS 8.6, ThimPress WP Pipes) - [CVE-2025-48279](https://cve.now/CVE-2025-48279.md): WordPress WC MyParcel Belgium plugin \<= 4.5.5-beta - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Richard Perdaan WC MyParcel Belgium) - [CVE-2025-48281](https://cve.now/CVE-2025-48281.md): WordPress MyStyle Custom Product Designer plugin \<= 3.21.1 - SQL Injection Vulnerability (CVSS 9.3, mystyleplatform MyStyle Custom Product Designer) - [CVE-2025-49265](https://cve.now/CVE-2025-49265.md): WordPress Membership For WooCommerce plugin \<= 2.8.1 - Broken Access Control Vulnerability (CVSS 7.5, WP Swings Membership For WooCommerce) - [CVE-2025-49275](https://cve.now/CVE-2025-49275.md): WordPress Blogbyte theme \<= 1.1.1 - Local File Inclusion Vulnerability (CVSS 8.1, unfoldwp Blogbyte) - [CVE-2025-49276](https://cve.now/CVE-2025-49276.md): WordPress Blogmine theme \<= 1.1.7 - Local File Inclusion Vulnerability (CVSS 8.1, unfoldwp Blogmine) - [CVE-2025-49277](https://cve.now/CVE-2025-49277.md): WordPress Blogprise theme \<= 1.0.9 - Local File Inclusion Vulnerability (CVSS 8.1, unfoldwp Blogprise) - [CVE-2025-49278](https://cve.now/CVE-2025-49278.md): WordPress Blogty theme \<= 1.0.11 - Local File Inclusion Vulnerability (CVSS 8.1, unfoldwp Blogty) - [CVE-2025-49279](https://cve.now/CVE-2025-49279.md): WordPress Blogvy theme \<= 1.0.7 - Local File Inclusion Vulnerability (CVSS 8.1, unfoldwp Blogvy) - [CVE-2025-49280](https://cve.now/CVE-2025-49280.md): WordPress Magty theme \<= 1.0.6 - Local File Inclusion Vulnerability (CVSS 8.1, unfoldwp Magty) - [CVE-2025-49281](https://cve.now/CVE-2025-49281.md): WordPress Magways theme \<= 1.2.1 - Local File Inclusion Vulnerability (CVSS 8.1, unfoldwp Magways) - [CVE-2025-49282](https://cve.now/CVE-2025-49282.md): WordPress Magze theme \<= 1.0.9 - Local File Inclusion Vulnerability (CVSS 8.1, unfoldwp Magze) - [CVE-2025-49295](https://cve.now/CVE-2025-49295.md): WordPress MediClinic theme \<= 2.1 - Local File Inclusion Vulnerability (CVSS 8.1, Mikado-Themes MediClinic) - [CVE-2025-49296](https://cve.now/CVE-2025-49296.md): WordPress GrandPrix theme \<= 1.6 - Local File Inclusion Vulnerability (CVSS 8.1, Mikado-Themes GrandPrix) - [CVE-2025-49297](https://cve.now/CVE-2025-49297.md): WordPress Grill and Chow theme \<= 1.6 - Local File Inclusion Vulnerability (CVSS 8.1, Mikado-Themes Grill and Chow) - [CVE-2025-5885](https://cve.now/CVE-2025-5885.md): Konica Minolta bizhub cross-site request forgery (CVSS 5.3, Konica Minolta bizhub) - [CVE-2025-5884](https://cve.now/CVE-2025-5884.md): Konica Minolta bizhub Display MFP Information List cross site scripting (CVSS 5.1, Konica Minolta bizhub) - [CVE-2025-5881](https://cve.now/CVE-2025-5881.md): code-projects Chat System confirm\_password.php sql injection (CVSS 5.3, code-projects Chat System) - [CVE-2025-5880](https://cve.now/CVE-2025-5880.md): Whistle get-temp-file path traversal (CVSS 5.3, Whistle) - [CVE-2025-5879](https://cve.now/CVE-2025-5879.md): WuKongOpenSource WukongCRM File Upload AdminSysConfigController.java cross site scripting (CVSS 5.1, WuKongOpenSource WukongCRM) - [CVE-2025-49130](https://cve.now/CVE-2025-49130.md): Laravel Translation Manager Vulnerable to Stored Cross-site Scripting (CVSS 6.0, barryvdh laravel-translation-manager · barryvdh/laravel-tra…) - [CVE-2025-49013](https://cve.now/CVE-2025-49013.md): WilderForge vulnerable to code Injection via GitHub Actions Workflows (CVSS 10.0, WilderForge) - [CVE-2025-49131](https://cve.now/CVE-2025-49131.md): FastGPT Sandbox Vulnerable to Sandbox Bypass (CVSS 6.3, labring FastGPT) - [CVE-2025-49006](https://cve.now/CVE-2025-49006.md): Wasp has case insensitive OAuth ID vulnerability (CVSS 8.2, wasp-lang wasp) - [CVE-2025-48877](https://cve.now/CVE-2025-48877.md): Discourse vulnerable to auto-executing of third-party code in embedded CodePen iframe (CVSS 8.1, discourse) - [CVE-2025-48062](https://cve.now/CVE-2025-48062.md): Discourse vulnerable to HTML injection when inviting to topic via email (CVSS 7.1, discourse) - [CVE-2025-5877](https://cve.now/CVE-2025-5877.md): Fengoffice Feng Office Document Upload ApplicationDataObject.class.php xml external entity reference (CVSS 5.3, Fengoffice Feng Office) - [CVE-2025-48053](https://cve.now/CVE-2025-48053.md): Discourse vulnerable to DoS via large URL payload in PM to a bot (CVSS 8.7, discourse) - [CVE-2025-40670](https://cve.now/CVE-2025-40670.md): Incorrect Authorization vulnerability in TCMAN GIM (CVSS 7.1, TCMAN GIM) - [CVE-2025-40669](https://cve.now/CVE-2025-40669.md): Incorrect Authorization vulnerability in TCMAN GIM (CVSS 7.1, TCMAN GIM) - [CVE-2025-40668](https://cve.now/CVE-2025-40668.md): Incorrect Authorization vulnerability in TCMAN GIM (CVSS 7.1, TCMAN GIM) - [CVE-2025-5876](https://cve.now/CVE-2025-5876.md): Lucky LM-520-SC/LM-520-FSC/LM-520-FSC-SAM missing authentication (CVSS 6.9, Lucky LM-520-SC · Lucky LM-520-FSC +1) - [CVE-2025-5875](https://cve.now/CVE-2025-5875.md): TP-LINK Technologies TL-IPC544EP-W4 main sub\_69064 buffer overflow (CVSS 8.7, TP-LINK Technologies TL-IPC544EP-W4) - [CVE-2025-41444](https://cve.now/CVE-2025-41444.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus) - [CVE-2025-36528](https://cve.now/CVE-2025-36528.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus) - [CVE-2025-27709](https://cve.now/CVE-2025-27709.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus) - [CVE-2025-5874](https://cve.now/CVE-2025-5874.md): Redash getattr python.py run\_query sandbox (CVSS 2.1, Redash) - [CVE-2025-41437](https://cve.now/CVE-2025-41437.md): Reflected XSS (CVSS 4.3, ManageEngine OpManager) - [CVE-2025-5873](https://cve.now/CVE-2025-5873.md): eCharge Hardy Barth Salia PLCC Web UI firmware.php unrestricted upload (CVSS 5.3, eCharge Hardy Barth Salia PLCC) - [CVE-2025-3835](https://cve.now/CVE-2025-3835.md): Remote Code Execution (CVSS 9.6, ManageEngine Exchange Reporter Plus) - [CVE-2025-5872](https://cve.now/CVE-2025-5872.md): eGauge EG3000 Energy Monitor Setting missing authentication (CVSS 6.9, eGauge EG3000 Energy Monitor) - [CVE-2025-40675](https://cve.now/CVE-2025-40675.md): Reflected Cross-Site Scripting (XSS) in Bagisto (CVSS 5.1, Bagisto) - [CVE-2025-5871](https://cve.now/CVE-2025-5871.md): Papendorf SOL Connect Center Web Interface missing authentication (CVSS 6.9, Papendorf SOL Connect Center) - [CVE-2025-5870](https://cve.now/CVE-2025-5870.md): TRENDnet TV-IP121W Web Interface setup.cgi improper authentication (CVSS 6.9, TRENDnet TV-IP121W) - [CVE-2025-5869](https://cve.now/CVE-2025-5869.md): RT-Thread lwp\_syscall.c sys\_recvfrom memory corruption (CVSS 8.6, RT-Thread) - [CVE-2025-5868](https://cve.now/CVE-2025-5868.md): RT-Thread lwp\_syscall.c sys\_thread\_sigprocmask array index (CVSS 8.6, RT-Thread) - [CVE-2025-5894](https://cve.now/CVE-2025-5894.md): Honding Technology Smart Parking Management System - Missing Authorization (CVSS 8.8, Honding Technology Smart Parking Management System) - [CVE-2025-5867](https://cve.now/CVE-2025-5867.md): RT-Thread lwp\_syscall.c csys\_sendto null pointer dereference (CVSS 8.6, RT-Thread) - [CVE-2025-5866](https://cve.now/CVE-2025-5866.md): RT-Thread lwp\_syscall.c sys\_sigprocmask array index (CVSS 8.6, RT-Thread) - [CVE-2025-5893](https://cve.now/CVE-2025-5893.md): Honding Technology Smart Parking Management System - Exposure of Sensitive Information (CVSS 9.8, Honding Technology Smart Parking Management System) - [CVE-2025-5865](https://cve.now/CVE-2025-5865.md): RT-Thread Parameter lwp\_syscall.c sys\_select memory corruption (CVSS 8.6, RT-Thread) - [CVE-2025-25209](https://cve.now/CVE-2025-25209.md): Rhcl: sharedsecretref can be used to leak secrets severity (CVSS 5.7, rhcl-operator-container · Red Hat Connectivity Link) - [CVE-2025-25208](https://cve.now/CVE-2025-25208.md): Rhcl: authorino denial of service through authpolicy with sharedsecretref severity (CVSS 5.7, rhcl-operator-container · Red Hat Connectivity Link +1) - [CVE-2025-25207](https://cve.now/CVE-2025-25207.md): Rhcl: authpolicy callbacks result in denial of service in authorino severity (CVSS 5.7, rhcl-operator-container · Red Hat Connectivity Link +1) - [CVE-2025-47711](https://cve.now/CVE-2025-47711.md): Nbdkit: nbdkit-server: off-by-one error when processing block status may lead to a denial of service (CVSS 6.5, nbdkit · Red Hat Enterprise Linux) - [CVE-2025-5864](https://cve.now/CVE-2025-5864.md): Tenda TDSEE App Password Reset Confirmation Code ConfirmSmsCode excessive authentication (CVSS 6.3, Tenda TDSEE App) - [CVE-2025-4652](https://cve.now/CVE-2025-4652.md): Broadstreet \< 1.51.8 - Reflected XSS (CVSS 6.1, Broadstreet) - [CVE-2025-3582](https://cve.now/CVE-2025-3582.md): Newsletter \< 8.8.5 - Admin+ Stored XSS via Form (CVSS 4.8, Newsletter) - [CVE-2025-3581](https://cve.now/CVE-2025-3581.md): Newsletter \< 8.8.5 - Admin+ Stored XSS via Widget (CVSS 4.8, Newsletter) - [CVE-2025-47712](https://cve.now/CVE-2025-47712.md): Nbd: nbdkit: integer overflow triggers an assertion resulting in denial of service (CVSS 6.5, nbdkit · Red Hat Enterprise Linux) - [CVE-2025-5863](https://cve.now/CVE-2025-5863.md): Tenda AC5 SetRebootTimer formSetRebootTimer stack-based overflow (CVSS 8.7, Tenda AC5) - [CVE-2025-5862](https://cve.now/CVE-2025-5862.md): Tenda AC7 setPptpUserList formSetPPTPUserList buffer overflow (CVSS 8.7, Tenda AC7) - [CVE-2025-5861](https://cve.now/CVE-2025-5861.md): Tenda AC7 AdvSetLanip fromadvsetlanip buffer overflow (CVSS 8.7, Tenda AC7) - [CVE-2025-5860](https://cve.now/CVE-2025-5860.md): PHPGurukul Maid Hiring Management System search-booking-request.php sql injection (CVSS 6.9, PHPGurukul Maid Hiring Management System) - [CVE-2025-5859](https://cve.now/CVE-2025-5859.md): PHPGurukul Nipah Virus Testing Management System test-details.php sql injection (CVSS 5.3, PHPGurukul Nipah Virus Testing Management System) - [CVE-2025-5858](https://cve.now/CVE-2025-5858.md): PHPGurukul Nipah Virus Testing Management System patient-report.php sql injection (CVSS 5.3, PHPGurukul Nipah Virus Testing Management System) - [CVE-2025-5857](https://cve.now/CVE-2025-5857.md): code-projects Patient Record Management System urinalysis\_record.php sql injection (CVSS 5.3, code-projects Patient Record Management System) - [CVE-2025-5856](https://cve.now/CVE-2025-5856.md): PHPGurukul BP Monitoring Management System registration.php sql injection (CVSS 6.9, PHPGurukul BP Monitoring Management System) - [CVE-2025-5855](https://cve.now/CVE-2025-5855.md): Tenda AC6 SetRebootTimer formSetRebootTimer stack-based overflow (CVSS 8.7, Tenda AC6) - [CVE-2025-5854](https://cve.now/CVE-2025-5854.md): Tenda AC6 AdvSetLanip fromadvsetlanip buffer overflow (CVSS 8.7, Tenda AC6) - [CVE-2025-5853](https://cve.now/CVE-2025-5853.md): Tenda AC6 SetRemoteWebCfg formSetSafeWanWebMan stack-based overflow (CVSS 8.7, Tenda AC6) - [CVE-2025-5852](https://cve.now/CVE-2025-5852.md): Tenda AC6 setPptpUserList formSetPPTPUserList buffer overflow (CVSS 8.7, Tenda AC6) - [CVE-2024-46452](https://cve.now/CVE-2024-46452.md): A Host Header injection vulnerability in the password reset function of VigyBag Open Source Online Shop commit 3f0e21b allows attackers to r (CVSS 6.1) - [CVE-2025-29627](https://cve.now/CVE-2025-29627.md): An issue in KeeperChat IOS Application v.5.8.8 allows a physically proximate attacker to escalate privileges via the Biometric Authenticatio (CVSS 6.8) - [CVE-2025-45001](https://cve.now/CVE-2025-45001.md): react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as pla (CVSS 7.5, react-native-keys) - [CVE-2025-45002](https://cve.now/CVE-2025-45002.md): Vigybag v1.0 and before is vulnerable to Cross Site Scripting (XSS) via the upload profile picture function under my profile. (CVSS 5.4) - [CVE-2025-45055](https://cve.now/CVE-2025-45055.md): Silverpeas 6.4.2 contains a stored cross-site scripting (XSS) vulnerability in the event management module. (CVSS 5.4) - [CVE-2025-46041](https://cve.now/CVE-2025-46041.md): A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript via the page descrip (CVSS 5.4) - [CVE-2025-46178](https://cve.now/CVE-2025-46178.md): Cross-Site Scripting (XSS) vulnerability exists in askquery.php via the eid parameter in the CloudClassroom PHP Project. (CVSS 6.1) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-06-09 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.