# CVEs published 2025-06-11

57 CVEs were published on June 11, 2025: 9 critical, 23 high. Days are UTC.

- [CVE-2025-30085](https://cve.now/CVE-2025-30085.md): Extension - rsjoomla.com - Remote code execution vulnerability in RSForm!pro component 3.0.0 - 3.3.14 for Joomla (CVSS 9.2, rsjoomla.com RSform!Pro component for Joomla)
- [CVE-2025-32466](https://cve.now/CVE-2025-32466.md): Extension - rsjoomla.com - SQL injection vulnerability in RSMediaGallery! component 1.7.4 - 2.1.7 for Joomla (CVSS 6.7, rsjoomla.com RSMediaGallery component for Joomla)
- [CVE-2025-32465](https://cve.now/CVE-2025-32465.md): Extension - rsjoomla.com - Stored XSS vulnerability in RSTickets! component 1.9.12 - 3.3.0 for Joomla (CVSS 8.5, rsjoomla.com RSTickets! component for Joomla)
- [CVE-2025-49150](https://cve.now/CVE-2025-49150.md): Cursor Agent Potentially Leaks Information using JSON schema (CVSS 5.9, getcursor cursor)
- [CVE-2025-40912](https://cve.now/CVE-2025-40912.md): CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode (CVSS 9.8, MIK CryptX)
- [CVE-2025-0923](https://cve.now/CVE-2025-0923.md): IBM Cognos Analytics information disclosure (CVSS 5.3, IBM Cognos Analytics)
- [CVE-2025-0917](https://cve.now/CVE-2025-0917.md): IBM Cognos Analytics cross-site scripting (CVSS 5.5, IBM Cognos Analytics)
- [CVE-2025-25032](https://cve.now/CVE-2025-25032.md): IBM Cognos Analytics denial of service (CVSS 7.5, IBM Cognos Analytics)
- [CVE-2025-0913](https://cve.now/CVE-2025-0913.md): Inconsistent handling of O\_CREATE|O\_EXCL on Unix and Windows in os in syscall (CVSS 5.5, Go standard library syscall · Go standard library os +1)
- [CVE-2025-40915](https://cve.now/CVE-2025-40915.md): Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens (CVSS 7.0, GRYPHON Mojolicious::Plugin::CSRF)
- [CVE-2025-4673](https://cve.now/CVE-2025-4673.md): Sensitive headers not cleared on cross-origin redirect in net/http (CVSS 6.8, Go standard library net/http · stdlib)
- [CVE-2025-22874](https://cve.now/CVE-2025-22874.md): Usage of ExtKeyUsageAny disables policy validation in crypto/x509 (CVSS 7.5, Go standard library crypto/x509 · stdlib)
- [CVE-2025-6002](https://cve.now/CVE-2025-6002.md): VirtueMart - Unrestricted File Upload (CVSS 7.2, VirtueMart)
- [CVE-2025-6001](https://cve.now/CVE-2025-6001.md): VirtueMart - Cross Site Request Forgery (CSRF) (CVSS 8.3, VirtueMart)
- [CVE-2025-1699](https://cve.now/CVE-2025-1699.md): An incorrect default permissions vulnerability was reported in the MotoSignature application that could result in unauthorized access. (CVSS 2.4, Motorola g34 · Motorola g34t +1)
- [CVE-2025-1698](https://cve.now/CVE-2025-1698.md): Null pointer exception vulnerabilities were reported in the fingerprint sensor service that could allow a local attacker to cause a denial o (CVSS 2.4, Motorola Razr 40 Ultra · Motorola Razr +2)
- [CVE-2025-26383](https://cve.now/CVE-2025-26383.md): The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the Windows (CVSS 6.3, Johnson Controls iSTAR Configuration Utility)
- [CVE-2025-49148](https://cve.now/CVE-2025-49148.md): ClipShare Server Allows Local Privilege Escalation via DLL Hijacking (CVSS 7.3, thevindu-w clip\_share\_server)
- [CVE-2025-48447](https://cve.now/CVE-2025-48447.md): Lightgallery - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-069 (CVSS 7.1, Drupal Lightgallery · drupal/lightgallery)
- [CVE-2025-48448](https://cve.now/CVE-2025-48448.md): Admin Audit Trail - Less critical - Denial of Service - SA-CONTRIB-2025-068 (CVSS 6.5, Drupal Admin Audit Trail · drupal/admin\_audit\_trail)
- [CVE-2025-48446](https://cve.now/CVE-2025-48446.md): Commerce Alphabank Redirect - Moderately critical - Access bypass - SA-CONTRIB-2025-067 (CVSS 8.8, Drupal Commerce Alphabank Redirect · drupal/commerce\_alphab…)
- [CVE-2025-49146](https://cve.now/CVE-2025-49146.md): pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration (CVSS 8.2, pgjdbc · org.postgresql:postgresql)
- [CVE-2025-48445](https://cve.now/CVE-2025-48445.md): Commerce Eurobank (Redirect) - Moderately critical - Access bypass - SA-CONTRIB-2025-066 (CVSS 8.8, Drupal Commerce Eurobank · drupal/commerce\_eurobank\_redirect)
- [CVE-2025-3473](https://cve.now/CVE-2025-3473.md): IBM Security Guardium privilege escalation (CVSS 6.7, IBM Security Guardium)
- [CVE-2025-0163](https://cve.now/CVE-2025-0163.md): IBM Security Verify Access information disclosure (CVSS 5.3, IBM Security Verify Access)
- [CVE-2025-48013](https://cve.now/CVE-2025-48013.md): Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-065 (CVSS 5.3, Drupal Quick Node Block · drupal/quick\_node\_block)
- [CVE-2025-48444](https://cve.now/CVE-2025-48444.md): Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-064 (CVSS 5.3, Drupal Quick Node Block · drupal/quick\_node\_block)
- [CVE-2025-40914](https://cve.now/CVE-2025-40914.md): Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow (CVSS 9.8, MIK CryptX)
- [CVE-2025-4605](https://cve.now/CVE-2025-4605.md): USD File Parsing Memory Allocation Vulnerability (CVSS 6.6, Autodesk USD for Maya · Autodesk USD for 3ds Max +1)
- [CVE-2025-4922](https://cve.now/CVE-2025-4922.md): Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To A Job (CVSS 8.1, HashiCorp Nomad · github.com/hashicorp/nomad)
- [CVE-2025-32711](https://cve.now/CVE-2025-32711.md): M365 Copilot Information Disclosure Vulnerability (CVSS 9.3, Microsoft 365 Copilot)
- [CVE-2025-35941](https://cve.now/CVE-2025-35941.md): mySCADA PRO Manager Password Disclosure (CVSS 5.5, mySCADA myPRO)
- [CVE-2025-5144](https://cve.now/CVE-2025-5144.md): The Events Calendar \<= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4, stellarwp The Events Calendar)
- [CVE-2025-5986](https://cve.now/CVE-2025-5986.md): Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVSS 6.5, Mozilla Thunderbird)
- [CVE-2025-49710](https://cve.now/CVE-2025-49710.md): Integer overflow in OrderedHashTable (CVSS 9.8, Mozilla Firefox)
- [CVE-2025-49709](https://cve.now/CVE-2025-49709.md): Memory corruption in canvas surfaces (CVSS 9.8, Mozilla Firefox)
- [CVE-2025-5687](https://cve.now/CVE-2025-5687.md): Local privilege escalation vulnerability in Mozilla VPN clients for macOS v2.27.0 and below. (CVSS 7.8, Mozilla VPN)
- [CVE-2025-3302](https://cve.now/CVE-2025-3302.md): Xagio SEO \<= 7.1.0.16 - Unauthenticated Stored Cross-Site Scripting via 'HTTP\_REFERER' (CVSS 7.2, Xagio SEO – AI Powered SEO)
- [CVE-2025-4128](https://cve.now/CVE-2025-4128.md): Mattermost Guest User Information Disclosure Vulnerability (CVSS 3.1, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-4573](https://cve.now/CVE-2025-4573.md): LDAP Injection in Mattermost Enterprise Edition When Using Active Directory (CVSS 4.1, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-4315](https://cve.now/CVE-2025-4315.md): CubeWP – All-in-One Dynamic Content Framework \<= 1.1.23 - Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, cubewp1211 CubeWP Framework)
- [CVE-2025-26412](https://cve.now/CVE-2025-26412.md): Undocumented Root Shell Access in SIMCom SIM7600G Modem (CVSS 6.8, SIMCom SIM7600G Modem)
- [CVE-2025-41663](https://cve.now/CVE-2025-41663.md): Weidmueller: Security routers IE-SR-2TX are affected by Command Injection (CVSS 9.8, Weidmueller IE-SR-2TX-WL · Weidmueller IE-SR-2TX-WL-4G-EU +1)
- [CVE-2025-41661](https://cve.now/CVE-2025-41661.md): Weidmueller: Security routers IE-SR-2TX are affected by CSRF (CVSS 8.8, Weidmueller IE-SR-2TX-WL · Weidmueller IE-SR-2TX-WL-4G-EU +1)
- [CVE-2025-29756](https://cve.now/CVE-2025-29756.md): MQTT implementation in Sungrow iSolarCloud allowed users to subscribe to all data of all connected inverters (CVSS 8.3, SunGrow iSolarCloud)
- [CVE-2025-5991](https://cve.now/CVE-2025-5991.md): Use after free in QHttp2ProtocolHandler (CVSS 2.1, Qt)
- [CVE-2024-35295](https://cve.now/CVE-2024-35295.md): A vulnerability has been identified in Perfect Harmony GH180 (All versions \>= V8.0 \< V8.3.3 with NXGPro+ controller manufactured between Apr (CVSS 6.1, Innomotics Perfect Harmony GH180)
- [CVE-2025-5395](https://cve.now/CVE-2025-5395.md): WordPress Automatic Plugin - AI content generator and auto poster plugin \<= 3.115.0 - Authenticated (Author+) Arbitrary File Upload (CVSS 8.8, ValvePress WordPress Automatic Plugin)
- [CVE-2025-4799](https://cve.now/CVE-2025-4799.md): WP-DownloadManager \<= 1.68.10 - Authenticated (Administrator+) Arbitrary File Deletion (CVSS 7.2, gamerz WP-DownloadManager)
- [CVE-2025-4798](https://cve.now/CVE-2025-4798.md): WP-DownloadManager \<= 1.68.10 - Authenticated (Administrator+) Arbitrary File Read (CVSS 4.9, gamerz WP-DownloadManager)
- [CVE-2025-4666](https://cve.now/CVE-2025-4666.md): ZotPress \<= 7.3.15 - Authenticated (Author+) Stored Cross-Site Scripting via 'nickname' (CVSS 6.4, kseaborn Zotpress)
- [CVE-2024-1244](https://cve.now/CVE-2024-1244.md): Remote code execution and local privilege escalation due to UNC access and NetNTLMv2 hash theft (CVSS 9.5, OSSEC-HIDS Agent)
- [CVE-2024-1243](https://cve.now/CVE-2024-1243.md): Remote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theft (CVSS 9.5, Wazuh Agent)
- [CVE-2025-5959](https://cve.now/CVE-2025-5959.md): Type Confusion in V8 in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra (CVSS 8.8, Google Chrome)
- [CVE-2025-5958](https://cve.now/CVE-2025-5958.md): Use after free in Media in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2025-4275](https://cve.now/CVE-2025-4275.md): SecureFlashDxe: Incorrect UEFI variable attributes check allows usage of invalid certificate (CVSS 7.8, Insyde Software InsydeH2O)
- [CVE-2025-49091](https://cve.now/CVE-2025-49091.md): KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. (CVSS 8.2, KDE Konsole)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-06-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.