# CVEs published 2025-06-12

80 CVEs were published on June 12, 2025: 4 critical, 26 high. Days are UTC.

- [CVE-2025-4228](https://cve.now/CVE-2025-4228.md): Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability (CVSS 4.6, Palo Alto Networks Cortex XDR Broker VM)
- [CVE-2025-4230](https://cve.now/CVE-2025-4230.md): PAN-OS: Authenticated Admin Command Injection Vulnerability Through CLI (CVSS 8.4, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2025-4231](https://cve.now/CVE-2025-4231.md): PAN-OS: Authenticated Admin Command Injection Vulnerability in the Management Web Interface (CVSS 8.6, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2025-4232](https://cve.now/CVE-2025-4232.md): GlobalProtect: Authenticated Code Injection Through Wildcard on macOS (CVSS 8.5, Palo Alto Networks GlobalProtect App)
- [CVE-2025-4233](https://cve.now/CVE-2025-4233.md): Prisma Access Browser: Inappropriate implementation in Cache (CVSS 5.1, Palo Alto Networks Prisma Access Browser)
- [CVE-2025-41233](https://cve.now/CVE-2025-41233.md): Description: VMware AVI Load Balancer contains an authenticated blind SQL Injection vulnerability. (CVSS 6.8, VMware Avi Load Balancer)
- [CVE-2025-41234](https://cve.now/CVE-2025-41234.md): RFD Attack via “Content-Disposition” Header Sourced from Request (CVSS 6.5, VMware Spring Framework · org.springframework:spring-web)
- [CVE-2025-49589](https://cve.now/CVE-2025-49589.md): PCSX2 Contains a Stack-based Buffer Overflow in IOP Console Logging (CVSS 6.1, pcsx2)
- [CVE-2025-27689](https://cve.now/CVE-2025-27689.md): Dell iDRAC Tools, version(s) prior to 11.3.0.0, contain(s) an Improper Access Control vulnerability. (CVSS 7.8, Dell iDRAC Tools)
- [CVE-2025-5485](https://cve.now/CVE-2025-5485.md): SinoTrack GPS Receiver Weak Authentication (CVSS 8.6, SinoTrack IOT PC Platform)
- [CVE-2025-5484](https://cve.now/CVE-2025-5484.md): SinoTrack GPS Receiver Weak Authentication (CVSS 8.3, SinoTrack IOT PC Platform)
- [CVE-2025-36539](https://cve.now/CVE-2025-36539.md): AVEVA PI Data Archive Uncaught Exception (CVSS 6.5, AVEVA PI Data Archive · AVEVA PI Server)
- [CVE-2025-44019](https://cve.now/CVE-2025-44019.md): AVEVA PI Data Archive Uncaught Exception (CVSS 7.1, AVEVA PI Data Archive · AVEVA PI Server)
- [CVE-2025-2745](https://cve.now/CVE-2025-2745.md): AVEVA PI Web API Cross-site Scripting (CVSS 6.5, AVEVA PI Web API)
- [CVE-2025-4418](https://cve.now/CVE-2025-4418.md): AVEVA PI Connector for CygNet Improper Validation of Integrity Check Value (CVSS 4.4, AVEVA PI Connector for CygNet)
- [CVE-2025-4417](https://cve.now/CVE-2025-4417.md): AVEVA PI Connector for CygNet Cross-site Scripting (CVSS 5.5, AVEVA PI Connector for CygNet)
- [CVE-2025-6031](https://cve.now/CVE-2025-6031.md): Insecure device pairing in end of life Amazon Cloud Cam (CVSS 7.7, Amazon Cloud Cam)
- [CVE-2025-49576](https://cve.now/CVE-2025-49576.md): Citizen allows stored XSS in search no result messages (CVSS 6.5, StarCitizenTools mediawiki-skins-Citizen · starcitizentools…)
- [CVE-2025-49578](https://cve.now/CVE-2025-49578.md): Citizen allows stored XSS in user registration date message (CVSS 6.5, StarCitizenTools mediawiki-skins-Citizen · starcitizentools…)
- [CVE-2025-49579](https://cve.now/CVE-2025-49579.md): Citizen allows stored XSS in menu heading message (CVSS 6.5, StarCitizenTools mediawiki-skins-Citizen · starcitizentools…)
- [CVE-2025-49575](https://cve.now/CVE-2025-49575.md): Citizen allows stored XSS in Command Palette tip messages (CVSS 6.5, StarCitizenTools mediawiki-skins-Citizen · starcitizentools…)
- [CVE-2025-49577](https://cve.now/CVE-2025-49577.md): Citizen allows stored XSS in preference menu headings (CVSS 6.5, StarCitizenTools mediawiki-skins-Citizen · starcitizentools…)
- [CVE-2025-43866](https://cve.now/CVE-2025-43866.md): Vantage6 Server JWT secret not cryptographically secure (CVSS 1.7, vantage6 · vantage6-server)
- [CVE-2025-43863](https://cve.now/CVE-2025-43863.md): vantage6 lacks brute-force protection on change password functionality (CVSS 1.7, vantage6)
- [CVE-2025-49081](https://cve.now/CVE-2025-49081.md): Input validation vulnerability in the Secure Access prior to version 13.55 (CVSS 6.9, Absolute Security Secure Access)
- [CVE-2025-49080](https://cve.now/CVE-2025-49080.md): Memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54 (CVSS 8.7, Absolute Security Secure Access)
- [CVE-2025-5982](https://cve.now/CVE-2025-5982.md): Insufficient Granularity of Access Control in GitLab (CVSS 3.7, GitLab)
- [CVE-2024-7562](https://cve.now/CVE-2024-7562.md): A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom a (CVSS 7.3, Revenera InstallShield)
- [CVE-2025-49467](https://cve.now/CVE-2025-49467.md): Joomla Extension - jevents.net - SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla (CVSS 9.3, jevents.net / GWE Systems JEvents component for Joomla)
- [CVE-2025-36573](https://cve.now/CVE-2025-36573.md): Dell Smart Dock Firmware, versions prior to 01.00.08.01, contain an Insertion of Sensitive Information into Log File vulnerability. (CVSS 7.1, Dell Smart Dock)
- [CVE-2024-56158](https://cve.now/CVE-2024-56158.md): XWiki allows SQL injection in query endpoint of REST API with Oracle (CVSS 9.3, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2025-49200](https://cve.now/CVE-2025-49200.md): Unencrypted backup contains sensitive information (CVSS 6.5, SICK AG SICK Field Analytics)
- [CVE-2025-49199](https://cve.now/CVE-2025-49199.md): Backup files can be modified and uploaded (CVSS 8.8, SICK AG SICK Field Analytics)
- [CVE-2025-49198](https://cve.now/CVE-2025-49198.md): Poor quality of randomness in authorization tokens (CVSS 3.1, SICK AG SICK Media Server)
- [CVE-2025-49197](https://cve.now/CVE-2025-49197.md): Deprecated TLS version supported (CVSS 6.5, SICK AG SICK Media Server)
- [CVE-2025-49196](https://cve.now/CVE-2025-49196.md): Deprecated TLS version supported (CVSS 6.5, SICK AG SICK Field Analytics)
- [CVE-2025-49195](https://cve.now/CVE-2025-49195.md): No protection against brute-force attacks (CVSS 5.3, SICK AG SICK Media Server)
- [CVE-2025-49194](https://cve.now/CVE-2025-49194.md): Unencrypted communication (CVSS 7.5, SICK AG SICK Media Server)
- [CVE-2025-49193](https://cve.now/CVE-2025-49193.md): Missing HTTP Security Headers (CVSS 4.2, SICK AG Field Analytics · SICK AG Media Server +4)
- [CVE-2025-49192](https://cve.now/CVE-2025-49192.md): Clickjacking (CVSS 4.3, SICK AG SICK Field Analytics · SICK AG SICK Media Server)
- [CVE-2025-49191](https://cve.now/CVE-2025-49191.md): Dashboards and iFrames can link malicious web content (CVSS 4.8, SICK AG SICK Field Analytics)
- [CVE-2025-49190](https://cve.now/CVE-2025-49190.md): Server-Side Request Forgery (CVSS 4.3, SICK AG SICK Field Analytics)
- [CVE-2025-49189](https://cve.now/CVE-2025-49189.md): Cookie missing HttpOnly flag (CVSS 5.3, SICK AG SICK Media Server)
- [CVE-2024-9512](https://cve.now/CVE-2024-9512.md): Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab (CVSS 5.3, GitLab)
- [CVE-2025-49188](https://cve.now/CVE-2025-49188.md): Sensitive Data in URL (CVSS 5.3, SICK AG SICK Field Analytics)
- [CVE-2025-49187](https://cve.now/CVE-2025-49187.md): User enumeration (CVSS 5.3, SICK AG SICK Field Analytics)
- [CVE-2025-49186](https://cve.now/CVE-2025-49186.md): No brute-force protection (CVSS 5.3, SICK AG Field Analytics · SICK AG Baggage Analytics +3)
- [CVE-2025-49185](https://cve.now/CVE-2025-49185.md): Stored Cross-Site-Script (CVSS 5.5, SICK AG SICK Field Analytics)
- [CVE-2025-49184](https://cve.now/CVE-2025-49184.md): Information disclosure to unauthorized user (CVSS 7.5, SICK AG Field Analytics · SICK AG Baggage Analytics +4)
- [CVE-2025-49183](https://cve.now/CVE-2025-49183.md): Unencrypted communication (HTTP) (CVSS 7.5, SICK AG SICK Media Server)
- [CVE-2025-49182](https://cve.now/CVE-2025-49182.md): Credential disclosure (CVSS 7.5, SICK AG SICK Media Server)
- [CVE-2025-49181](https://cve.now/CVE-2025-49181.md): Configurations endpoint does not require authorization (CVSS 8.6, SICK AG SICK Media Server)
- [CVE-2025-6021](https://cve.now/CVE-2025-6021.md): Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2 (CVSS 7.5, libxml2 · Red Hat Enterprise Linux +8)
- [CVE-2025-0673](https://cve.now/CVE-2025-0673.md): Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab (CVSS 7.5, GitLab)
- [CVE-2025-5195](https://cve.now/CVE-2025-5195.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-1478](https://cve.now/CVE-2025-1478.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-1516](https://cve.now/CVE-2025-1516.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-2254](https://cve.now/CVE-2025-2254.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2025-4278](https://cve.now/CVE-2025-4278.md): Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab (CVSS 8.7, GitLab)
- [CVE-2025-5996](https://cve.now/CVE-2025-5996.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-4613](https://cve.now/CVE-2025-4613.md): Client side RCE in Google Web Designer App (CVSS 7.1, Google Web Designer App)
- [CVE-2025-6003](https://cve.now/CVE-2025-6003.md): WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposure (CVSS 5.3, cyberlord92 WordPress Single Sign-On (SSO) - Single Site… +5)
- [CVE-2025-40592](https://cve.now/CVE-2025-40592.md): A vulnerability has been identified in Mendix Studio Pro 10 (All versions \< V10.24.24 for Windows), Mendix Studio Pro 10 (All versions \< V10 (CVSS 6.1, Siemens Mendix Studio Pro)
- [CVE-2025-5301](https://cve.now/CVE-2025-5301.md): Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer) (CVSS 6.1, OnlyOffice Docs)
- [CVE-2025-35978](https://cve.now/CVE-2025-35978.md): Improper restriction of communication channel to intended endpoints issue exists in UpdateNavi V1.4 L10 to L33 and UpdateNaviInstallService (CVSS 7.1, Fujitsu Client Computing Limited UpdateNavi · Fujitsu Clien…)
- [CVE-2025-4973](https://cve.now/CVE-2025-4973.md): Workreap \<= 3.3.1 - Authentication Bypass via 'workreap\_verify\_user\_account' (CVSS 9.8, AmentoTech Workreap)
- [CVE-2025-5012](https://cve.now/CVE-2025-5012.md): Workreap \<= 3.3.2 - Authenticated (Subscriber+) Arbitrary File Upload via 'workreap\_temp\_upload\_to\_media' (CVSS 8.8, AmentoTech Workreap)
- [CVE-2025-6009](https://cve.now/CVE-2025-6009.md): kiCode111 like-girl ipAddPost.php sql injection (CVSS 5.1, kiCode111 like-girl)
- [CVE-2025-6008](https://cve.now/CVE-2025-6008.md): kiCode111 like-girl ImgAddPost.php sql injection (CVSS 5.1, kiCode111 like-girl)
- [CVE-2025-6007](https://cve.now/CVE-2025-6007.md): kiCode111 like-girl CopyadminPost.php sql injection (CVSS 5.1, kiCode111 like-girl)
- [CVE-2025-6006](https://cve.now/CVE-2025-6006.md): kiCode111 like-girl ImgUpdaPost.php sql injection (CVSS 5.1, kiCode111 like-girl)
- [CVE-2025-6005](https://cve.now/CVE-2025-6005.md): kiCode111 like-girl aboutPost.php sql injection (CVSS 5.1, kiCode111 like-girl)
- [CVE-2022-4976](https://cve.now/CVE-2022-4976.md): Archive::Unzip::Burst from 0.01 through 0.09 for Perl contains a bundled InfoZip library that is affected by several vulnerabilities (CVSS 9.8, ETJ Archive::Unzip::Burst)
- [CVE-2023-45256](https://cve.now/CVE-2023-45256.md): Multiple SQL injection vulnerabilities in the EuroInformation MoneticoPaiement module before 1.1.1 for PrestaShop allow remote attackers to (CVSS 5.4)
- [CVE-2024-44905](https://cve.now/CVE-2024-44905.md): go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append\_value.go. (CVSS 6.5, github.com/go-pg/pg · github.com/go-pg/pg/v9 +1)
- [CVE-2024-44906](https://cve.now/CVE-2024-44906.md): uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go. (CVSS 6.5, github.com/uptrace/bun/driver/pgdriver)
- [CVE-2024-55567](https://cve.now/CVE-2024-55567.md): Improper input validation was discovered in UsbCoreDxe in Insyde InsydeH2O kernel 5.4 before 05.47.01, 5.5 before 05.55.01, 5.6 before 05.62 (CVSS 7.5)
- [CVE-2025-29744](https://cve.now/CVE-2025-29744.md): pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers. (CVSS 5.4, pg-promise)
- [CVE-2025-44091](https://cve.now/CVE-2025-44091.md): yangyouwang crud v1.0.0 is vulnerable to Cross Site Scripting (XSS) via the role management function. (CVSS 5.4)
- [CVE-2025-46035](https://cve.now/CVE-2025-46035.md): Buffer Overflow vulnerability in Tenda AC6 v.15.03.05.16 allows a remote attacker to cause a denial of service via the oversized schedStartT (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-06-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.