CVEs published June 12, 2025
80 CVEs were published on June 12, 2025: 4 critical, 26 high.
- Published
- 80
- Critical
- 4
- High
- 26
- Medium
- 46
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 40
Most affected products
- GitLab
- 9
- SICK AG SICK Field Analytics
- 8
- SICK AG SICK Media Server
- 8
- kiCode111 like-girl
- 5
- StarCitizenTools mediawiki-skins-Citizen · starcitizentools…
- 5
- Absolute Security Secure Access
- 2
- AmentoTech Workreap
- 2
- AVEVA PI Connector for CygNet
- 2
- AVEVA PI Data Archive · AVEVA PI Server
- 2
- Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- 2
Critical 4
- CVE-2025-49467Joomla Extension - jevents.net - SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomlajevents.net / GWE Systems JEvents component for Joomla
- CVE-2024-56158XWiki allows SQL injection in query endpoint of REST API with Oraclexwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2025-4973Workreap <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account'AmentoTech Workreap
- CVE-2022-4976Archive::Unzip::Burst from 0.01 through 0.09 for Perl contains a bundled InfoZip library that is affected by several vulnerabilitiesETJ Archive::Unzip::Burst
High 26
- CVE-2025-4230PAN-OS: Authenticated Admin Command Injection Vulnerability Through CLIPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2025-4231PAN-OS: Authenticated Admin Command Injection Vulnerability in the Management Web InterfacePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2025-4232GlobalProtect: Authenticated Code Injection Through Wildcard on macOSPalo Alto Networks GlobalProtect App
- CVE-2025-27689Dell iDRAC Tools, version(s) prior to 11.3.0.0, contain(s) an Improper Access Control vulnerability.Dell iDRAC Tools
- CVE-2025-5485SinoTrack GPS Receiver Weak AuthenticationSinoTrack IOT PC Platform
- CVE-2025-5484SinoTrack GPS Receiver Weak AuthenticationSinoTrack IOT PC Platform
- CVE-2025-44019AVEVA PI Data Archive Uncaught ExceptionAVEVA PI Data Archive · AVEVA PI Server
- CVE-2025-6031Insecure device pairing in end of life Amazon Cloud CamAmazon Cloud Cam
- CVE-2025-49080Memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54Absolute Security Secure Access
- CVE-2024-7562A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom aRevenera InstallShield
- CVE-2025-36573Dell Smart Dock Firmware, versions prior to 01.00.08.01, contain an Insertion of Sensitive Information into Log File vulnerability.Dell Smart Dock
- CVE-2025-49199Backup files can be modified and uploadedSICK AG SICK Field Analytics
- CVE-2025-49194Unencrypted communicationSICK AG SICK Media Server
- CVE-2025-49184Information disclosure to unauthorized userSICK AG Field Analytics · SICK AG Baggage Analytics +4
- CVE-2025-49183Unencrypted communication (HTTP)SICK AG SICK Media Server
- CVE-2025-49182Credential disclosureSICK AG SICK Media Server
- CVE-2025-49181Configurations endpoint does not require authorizationSICK AG SICK Media Server
- CVE-2025-6021Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2libxml2 · Red Hat Enterprise Linux +8
- CVE-2025-0673Loop with Unreachable Exit Condition ('Infinite Loop') in GitLabGitLab
- CVE-2025-2254Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-4278Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLabGitLab
- CVE-2025-4613Client side RCE in Google Web Designer AppGoogle Web Designer App
- CVE-2025-35978Improper restriction of communication channel to intended endpoints issue exists in UpdateNavi V1.4 L10 to L33 and UpdateNaviInstallService Fujitsu Client Computing Limited UpdateNavi · Fujitsu Clien…
- CVE-2025-5012Workreap <= 3.3.2 - Authenticated (Subscriber+) Arbitrary File Upload via 'workreap_temp_upload_to_media'AmentoTech Workreap
- CVE-2024-55567Improper input validation was discovered in UsbCoreDxe in Insyde InsydeH2O kernel 5.4 before 05.47.01, 5.5 before 05.55.01, 5.6 before 05.62
- CVE-2025-46035Buffer Overflow vulnerability in Tenda AC6 v.15.03.05.16 allows a remote attacker to cause a denial of service via the oversized schedStartT
Medium, low and unrated 50
- CVE-2025-4228Cortex XDR Broker VM: Privilege Escalation (PE) VulnerabilityPalo Alto Networks Cortex XDR Broker VM
- CVE-2025-4233Prisma Access Browser: Inappropriate implementation in CachePalo Alto Networks Prisma Access Browser
- CVE-2025-41233Description: VMware AVI Load Balancer contains an authenticated blind SQL Injection vulnerability.VMware Avi Load Balancer
- CVE-2025-41234RFD Attack via “Content-Disposition” Header Sourced from RequestVMware Spring Framework · org.springframework:spring-web
- CVE-2025-49589PCSX2 Contains a Stack-based Buffer Overflow in IOP Console Loggingpcsx2
- CVE-2025-36539AVEVA PI Data Archive Uncaught ExceptionAVEVA PI Data Archive · AVEVA PI Server
- CVE-2025-2745AVEVA PI Web API Cross-site ScriptingAVEVA PI Web API
- CVE-2025-4418AVEVA PI Connector for CygNet Improper Validation of Integrity Check ValueAVEVA PI Connector for CygNet
- CVE-2025-4417AVEVA PI Connector for CygNet Cross-site ScriptingAVEVA PI Connector for CygNet
- CVE-2025-49576Citizen allows stored XSS in search no result messagesStarCitizenTools mediawiki-skins-Citizen · starcitizentools…
- CVE-2025-49578Citizen allows stored XSS in user registration date messageStarCitizenTools mediawiki-skins-Citizen · starcitizentools…
- CVE-2025-49579Citizen allows stored XSS in menu heading messageStarCitizenTools mediawiki-skins-Citizen · starcitizentools…
- CVE-2025-49575Citizen allows stored XSS in Command Palette tip messagesStarCitizenTools mediawiki-skins-Citizen · starcitizentools…
- CVE-2025-49577Citizen allows stored XSS in preference menu headingsStarCitizenTools mediawiki-skins-Citizen · starcitizentools…
- CVE-2025-43866Vantage6 Server JWT secret not cryptographically securevantage6 · vantage6-server
- CVE-2025-43863vantage6 lacks brute-force protection on change password functionalityvantage6
- CVE-2025-49081Input validation vulnerability in the Secure Access prior to version 13.55Absolute Security Secure Access
- CVE-2025-5982Insufficient Granularity of Access Control in GitLabGitLab
- CVE-2025-49200Unencrypted backup contains sensitive informationSICK AG SICK Field Analytics
- CVE-2025-49198Poor quality of randomness in authorization tokensSICK AG SICK Media Server
- CVE-2025-49197Deprecated TLS version supportedSICK AG SICK Media Server
- CVE-2025-49196Deprecated TLS version supportedSICK AG SICK Field Analytics
- CVE-2025-49195No protection against brute-force attacksSICK AG SICK Media Server
- CVE-2025-49193Missing HTTP Security HeadersSICK AG Field Analytics · SICK AG Media Server +4
- CVE-2025-49192ClickjackingSICK AG SICK Field Analytics · SICK AG SICK Media Server
- CVE-2025-49191Dashboards and iFrames can link malicious web contentSICK AG SICK Field Analytics
- CVE-2025-49190Server-Side Request ForgerySICK AG SICK Field Analytics
- CVE-2025-49189Cookie missing HttpOnly flagSICK AG SICK Media Server
- CVE-2024-9512Time-of-check Time-of-use (TOCTOU) Race Condition in GitLabGitLab
- CVE-2025-49188Sensitive Data in URLSICK AG SICK Field Analytics
- CVE-2025-49187User enumerationSICK AG SICK Field Analytics
- CVE-2025-49186No brute-force protectionSICK AG Field Analytics · SICK AG Baggage Analytics +3
- CVE-2025-49185Stored Cross-Site-ScriptSICK AG SICK Field Analytics
- CVE-2025-5195Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2025-1478Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-1516Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-5996Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-6003WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposurecyberlord92 WordPress Single Sign-On (SSO) - Single Site… +5
- CVE-2025-40592A vulnerability has been identified in Mendix Studio Pro 10 (All versions < V10.24.24 for Windows), Mendix Studio Pro 10 (All versions < V10Siemens Mendix Studio Pro
- CVE-2025-5301Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)OnlyOffice Docs
- CVE-2025-6009kiCode111 like-girl ipAddPost.php sql injectionkiCode111 like-girl
- CVE-2025-6008kiCode111 like-girl ImgAddPost.php sql injectionkiCode111 like-girl
- CVE-2025-6007kiCode111 like-girl CopyadminPost.php sql injectionkiCode111 like-girl
- CVE-2025-6006kiCode111 like-girl ImgUpdaPost.php sql injectionkiCode111 like-girl
- CVE-2025-6005kiCode111 like-girl aboutPost.php sql injectionkiCode111 like-girl
- CVE-2023-45256Multiple SQL injection vulnerabilities in the EuroInformation MoneticoPaiement module before 1.1.1 for PrestaShop allow remote attackers to
- CVE-2024-44905go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append_value.go.github.com/go-pg/pg · github.com/go-pg/pg/v9 +1
- CVE-2024-44906uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go.github.com/uptrace/bun/driver/pgdriver
- CVE-2025-29744pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers.pg-promise
- CVE-2025-44091yangyouwang crud v1.0.0 is vulnerable to Cross Site Scripting (XSS) via the role management function.