CVEs published June 17, 2025
173 CVEs were published on June 17, 2025: 23 critical, 78 high. 1 is now in CISA KEV.
- Published
- 173
- Critical
- 23
- High
- 78
- Medium
- 64
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 68
Most affected products
- Trend Micro Apex Central
- 8
- Trend Micro Endpoint Encryption Policy Server
- 8
- X.Org xwayland · Red Hat Enterprise Linux
- 6
- Trend Micro Apex One
- 4
- Fuji Electric Smart Editor
- 3
- LS Electric GMWin
- 3
- PHPGurukul Hostel Management System
- 3
- Trend Micro Deep Security
- 3
- asvd microlight
- 2
- conda-forge conda-smithy
- 2
Critical 23
- CVE-2025-49825Teleport allows remote authentication bypassgravitational teleport · github.com/gravitational/teleport
- CVE-2025-49217An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exeTrend Micro Endpoint Encryption Policy Server
- CVE-2025-49216An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as Trend Micro Endpoint Encryption Policy Server
- CVE-2025-49213An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exeTrend Micro Endpoint Encryption Policy Server
- CVE-2025-49212An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exeTrend Micro Endpoint Encryption Policy Server
- CVE-2025-49220An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execTrend Micro Apex Central
- CVE-2025-49219An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code exeTrend Micro Apex Central
- CVE-2025-49071WordPress Flozen < 1.5.1 - Arbitrary File Upload VulnerabilityNasaTheme Flozen
- CVE-2025-49452WordPress PostaPanduri plugin <= 2.1.3 - SQL Injection VulnerabilityAdrian Ladó PostaPanduri
- CVE-2025-24773WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin <= 3.2.0 - SQL Injection Vulnerabilitymojoomla WPCRM - CRM for Contact form CF7 & WooCommerce
- CVE-2025-30618WordPress Rapyd Payment Extension for WooCommerce plugin <= 1.2.0 - PHP Object Injection Vulnerabilityyuliaz Rapyd Payment Extension for WooCommerce
- CVE-2025-31919WordPress Spare <= 1.7 - PHP Object Injection Vulnerabilitythemeton Spare
- CVE-2025-32510WordPress Ovatheme Events Manager plugin <= 1.8.4 - Arbitrary File Upload vulnerabilityOvatheme Events Manager
- CVE-2025-39479WordPress Smart Notification Plugin <= 10.3 - SQL Injection vulnerabilitysmartiolabs Smart Notification
- CVE-2025-47452WordPress WP VR plugin <= 8.5.26 - Arbitrary File Upload VulnerabilityRexTheme WP VR
- CVE-2025-47559WordPress MapSVG plugin < 8.7.4 - Arbitrary File Upload vulnerabilityRomanCode MapSVG
- CVE-2025-47573WordPress School Management System Plugin <= 92.0.0 - SQL Injection vulnerabilitymojoomla School Management
- CVE-2025-48274WordPress WP Job Portal plugin <= 2.3.2 - SQL Injection Vulnerabilitywpjobportal WP Job Portal
- CVE-2025-49330WordPress Integration for Contact Form 7 and Zoho CRM, Bigin plugin <= 1.3.0 - PHP Object Injection VulnerabilityCRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin
- CVE-2025-49444WordPress Reformer for Elementor plugin <= 1.0.5 - Arbitrary File Upload Vulnerabilitymerkulove Reformer for Elementor
- CVE-2025-49447WordPress FW Food Menu <= 6.0.0 - Arbitrary File Upload VulnerabilityFastw3b FW Food Menu
- CVE-2025-4404Freeipa: idm: privilege escalation from host to domain admin in freeipafreeipa · Red Hat Enterprise Linux
- CVE-2025-5777NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overreadNetScaler ADC · NetScaler Gateway
High 78
- CVE-2025-49385Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attTrend Micro Internet Security
- CVE-2025-49384Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attTrend Micro Internet Security
- CVE-2025-49218A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges oTrend Micro Endpoint Encryption Policy Server
- CVE-2025-49215A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges oTrend Micro Endpoint Encryption Policy Server
- CVE-2025-49214An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code exTrend Micro Endpoint Encryption Policy Server
- CVE-2025-41388Fuji Electric Smart Editor Stack-based Buffer OverflowFuji Electric Smart Editor
- CVE-2025-41413Fuji Electric Smart Editor Out-of-bounds WriteFuji Electric Smart Editor
- CVE-2025-32412Fuji Electric Smart Editor Out-of-bounds ReadFuji Electric Smart Editor
- CVE-2025-49211A SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affectedTrend Micro Endpoint Encryption Policy Server
- CVE-2025-30641A link following vulnerability in the anti-malware solution portion of Trend Micro Deep Security 20.0 agents could allow a local attacker toTrend Micro Deep Security
- CVE-2025-30640A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected instTrend Micro Deep Security
- CVE-2025-49847llama.cpp Vulnerable to Buffer Overflow via Malicious GGUF Modelggml-org llama.cpp
- CVE-2025-30680A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipulate certain parameteTrend Micro Apex Central
- CVE-2025-34511Sitecore PowerShell Extension RCE via Unrestricted UploadSitecore Powershell Extension
- CVE-2025-34510Sitecore XM, XC, and XP Post-Auth RCE via Zip SlipSitecore Experience Manager · Sitecore Experience Platfo… +1
- CVE-2025-49157A link following vulnerability in the Trend Micro Apex One Damage Cleanup Engine could allow a local attacker to escalation privileges on afTrend Micro Apex One
- CVE-2025-49156A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalation privileges on affected insTrend Micro Apex One
- CVE-2025-49155An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject maliciouTrend Micro Apex One
- CVE-2025-49154An insecure access control vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security could allow a local attacker tTrend Micro Apex One · Trend Micro Worry-Free Business Secu…
- CVE-2025-49850Out-of-bounds Read in Write in LS Electric GMWin 4LS Electric GMWin
- CVE-2025-49849Out-of-bounds Read in Write in LS Electric GMWin 4LS Electric GMWin
- CVE-2025-49848Out-of-bounds Write in LS Electric GMWin 4LS Electric GMWin
- CVE-2025-34509Sitecore XM and XP Hardcoded CredentialsSitecore Experience Manager · Sitecore Experience Platform
- CVE-2025-47867A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbiTrend Micro Apex Central
- CVE-2025-47865A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote codeTrend Micro Apex Central
- CVE-2025-33122IBM i privilege escalationIBM i
- CVE-2025-48333WordPress eForm - WordPress Form Builder < 4.19.1 - Cross Site Scripting (XSS) VulnerabilityWPQuark eForm - WordPress Form Builder
- CVE-2025-49451WordPress Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery plugin <= 1.0.13 - Directory Traversal Vulnerabilityyannisraft Aeroscroll Gallery – Infinite Scroll Image Galle…
- CVE-2025-49508WordPress CozyStay theme < 1.7.1 - Local File Inclusion vulnerabilityLoftOcean CozyStay
- CVE-2025-24761WordPress DSK theme < 2.4 - Local File Inclusion vulnerabilitysnstheme DSK
- CVE-2025-28972WordPress WP Employee Attendance System plugin <= 3.5 - SQL Injection VulnerabilitySuhas Surse WP Employee Attendance System
- CVE-2025-28991WordPress Evon theme <= 3.4 - Local File Inclusion Vulnerabilitysnstheme Evon
- CVE-2025-29002WordPress Simen theme <= 4.6 - Local File Inclusion Vulnerabilitysnstheme Simen
- CVE-2025-30562WordPress Navigation Tree Elementor plugin <= 1.0.1 - SQL Injection Vulnerabilitywpdistillery Navigation Tree Elementor
- CVE-2025-30988WordPress Elite Video Player plugin <= 10.0.5 - Cross Site Scripting (XSS) Vulnerability_CreativeMedia_ Elite Video Player
- CVE-2025-32549WordPress WPGYM <= 65.0 - Local File Inclusion Vulnerabilitymojoomla WPGYM
- CVE-2025-39486WordPress Rankie plugin < 1.8.2 - SQL Injection vulnerabilityValvePress Rankie
- CVE-2025-39508WordPress Nasa Core Plugin <= 6.4.4 - Cross Site Scripting (XSS) vulnerabilityNasaTheme Nasa Core
- CVE-2025-47572WordPress School Management <= 93.0.0 - Local File Inclusion Vulnerabilitymojoomla School Management
- CVE-2025-48118WordPress Woocommerce Partial Shipment plugin <= 3.2 - SQL Injection VulnerabilityWpExperts Hub Woocommerce Partial Shipment
- CVE-2025-48145WordPress Track, Analyze & Optimize by WP Tao plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityMichal Jaworski Track, Analyze & Optimize by WP Tao
- CVE-2025-49251WordPress Fana theme <= 1.1.28 - Local File Inclusion Vulnerabilitythembay Fana
- CVE-2025-49252WordPress Besa theme <= 2.3.8 - Local File Inclusion Vulnerabilitythembay Besa
- CVE-2025-49253WordPress Lasa theme <= 1.1 - Local File Inclusion Vulnerabilitythembay Lasa
- CVE-2025-49254WordPress Nika theme <= 1.2.8 - Local File Inclusion Vulnerabilitythembay Nika
- CVE-2025-49255WordPress Ruza theme <= 1.0.7 - Local File Inclusion Vulnerabilitythembay Ruza
- CVE-2025-49256WordPress Sapa theme <= 1.1.14 - Local File Inclusion Vulnerabilitythembay Sapa
- CVE-2025-49257WordPress Zota theme <= 1.3.8 - Local File Inclusion Vulnerabilitythembay Zota
- CVE-2025-49258WordPress Maia theme <= 1.1.15 - Local File Inclusion Vulnerabilitythembay Maia
- CVE-2025-49259WordPress Hara theme <= 1.2.10 - Local File Inclusion Vulnerabilitythembay Hara
- CVE-2025-49260WordPress Aora theme <= 1.3.9 - Local File Inclusion Vulnerabilitythembay Aora
- CVE-2025-49261WordPress Diza theme <= 1.3.8 - Local File Inclusion Vulnerabilitythembay Diza
- CVE-2025-49266WordPress Ultimate Reviews plugin <= 3.2.14 - Reflected Cross Site Scripting (XSS) vulnerabilityRustaurius Ultimate Reviews
- CVE-2025-49312WordPress Echo RSS Feed Post Generator Plugin for WordPress plugin <= 5.4.8.1 - Reflected Cross Site Scripting (XSS) vulnerabilityCodeRevolution Echo RSS Feed Post Generator Plugin for Word…
- CVE-2025-49316WordPress WP2LEADS plugin <= 3.5.0 - Reflected Cross Site Scripting (XSS) vulnerabilitySaleswonder Team: Tobias WP2LEADS
- CVE-2025-49331WordPress eCommerce Product Catalog plugin <= 3.4.3 - PHP Object Injection VulnerabilityimpleCode eCommerce Product Catalog
- CVE-2025-49854WordPress Slim SEO plugin <= 4.5.4 - SQL Injection VulnerabilityAnh Tran Slim SEO
- CVE-2025-49879WordPress Litho theme <= 3.0 - Arbitrary File Deletion Vulnerabilitythemezaa Litho
- CVE-2025-49415WordPress FW Gallery plugin <= 8.0.0 - Arbitrary File Deletion VulnerabilityFastw3b FW Gallery
- CVE-2025-49180Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x resize, rotate and reflect (randr) extensionX.Org xwayland · Red Hat Enterprise Linux
- CVE-2025-49179Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x record extensionX.Org xwayland · Red Hat Enterprise Linux
- CVE-2025-49176Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in big requests extensionX.Org xwayland · Red Hat Enterprise Linux
- CVE-2025-0320Citrix Secure Access - Local Privilege escalation allows a low-privileged user to gain SYSTEM privilegesCitrix Secure Access Client for Windows
- CVE-2025-4879Citrix Workspace App for Windows - Local Privilege escalation allows a low-privileged user to gain SYSTEM privilegesCitrix Workspace App for Windows
- CVE-2025-6020Linux-pam: linux-pam directory traversallinux-pam · Red Hat Enterprise Linux +10
- CVE-2025-5349NetScaler ADC and NetScaler Gateway - Improper access control on the NetScaler Management InterfaceNetScaler ADC
- CVE-2025-3515Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checksglenwpcoder Drag and Drop Multiple File Upload for Contact…
- CVE-2025-6165TOTOLINK X15 HTTP POST Request formTmultiAP buffer overflowTOTOLINK X15
- CVE-2025-6164TOTOLINK A3002R HTTP POST Request formMultiAP buffer overflowTOTOLINK A3002R
- CVE-2025-6163TOTOLINK A3002RU HTTP POST Request formMultiAP buffer overflowTOTOLINK A3002RU
- CVE-2025-6162TOTOLINK EX1200T HTTP POST Request formMultiAP buffer overflowTOTOLINK EX1200T
- CVE-2025-6158D-Link DIR-665 HTTP POST Request sub_AC78 stack-based overflowD-Link DIR-665
- CVE-2025-3774Wise Chat <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Headermarcinlawrowski Wise Chat
- CVE-2025-6151TP-Link TL-WR940N, TL-WR841N WanSlaacCfgRpm.htm buffer overflowTP-Link Systems TL-WR940N · TP-Link Systems TL-WR841N
- CVE-2025-6150TOTOLINK X15 HTTP POST Request formMultiAP buffer overflowTOTOLINK X15
- CVE-2025-6149TOTOLINK A3002R HTTP POST Request formSysLog buffer overflowTOTOLINK A3002R
- CVE-2025-6148TOTOLINK A3002RU HTTP POST Request formSysLog buffer overflowTOTOLINK A3002RU
- CVE-2025-6147TOTOLINK A702R HTTP POST Request formSysLog buffer overflowTOTOLINK A702R
Medium, low and unrated 72
- CVE-2025-49149Dify has XSS vulnerabilitylanggenius dify
- CVE-2025-49593Portainer HTTP Headers May Leak to Malicious Container Registriesportainer
- CVE-2025-49824conda-smithy Insecure Encryption Vulnerable to Oracle Padding Attackconda-forge conda-smithy
- CVE-2025-49843conda-smithy Has Incorrect Default File Permissionsconda-forge conda-smithy
- CVE-2025-48443Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Local Privilege Escalation VulnerabilTrend Micro Password Manager
- CVE-2025-30642A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to create a denial of service (DoS) sitTrend Micro Deep Security
- CVE-2025-30679A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modOSCE component could allow an attacker to manTrend Micro Apex Central
- CVE-2025-30678A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could allow an attacker to manTrend Micro Apex Central
- CVE-2025-5141Core Privileged Access Manager (BoKS) Leakage of Sensitive Data via the CacheFortra Core Privileged Access Manager
- CVE-2025-49487An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an attacTrend Micro Worry-Free Business Security Services
- CVE-2025-49158An uncontrolled search path vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalation privileges oTrend Micro Apex One
- CVE-2025-47866An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbiTrend Micro Apex Central
- CVE-2025-48111WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.49.0 - Cross Site Request Forgery (CSRF) vulnerabilityYITHEMES YITH PayPal Express Checkout for WooCommerce
- CVE-2025-49234WordPress WP Dummy Content Generator plugin <= 3.4.6 - Arbitrary User Deletion vulnerabilityDeepak anand WP Dummy Content Generator
- CVE-2025-49855WordPress Meks Flexible Shortcodes plugin <= 1.3.7 - Cross Site Scripting (XSS) VulnerabilityMeks Flexible Shortcodes
- CVE-2025-49856WordPress Responsive Plus plugin <= 3.2.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityCyberChimps Responsive Plus
- CVE-2025-49857WordPress myCred plugin <= 2.9.4.2 - Broken Access Control VulnerabilitySaad Iqbal myCred
- CVE-2025-49858WordPress Arconix Shortcodes plugin <= 2.1.17 - Cross Site Scripting (XSS) Vulnerabilitytychesoftwares Arconix Shortcodes
- CVE-2025-49859WordPress WP Views Counter plugin <= 2.0.3 - Cross Site Scripting (XSS) Vulnerabilityetruel WP Views Counter
- CVE-2025-49861WordPress Kama Click Counter plugin <= 4.0.3 - Cross Site Scripting (XSS) vulnerabilityTimur Kamaev Kama Click Counter
- CVE-2025-49862WordPress Ebook Store plugin <= 5.8008 - Cross Site Scripting (XSS) Vulnerabilitymotov.net Ebook Store
- CVE-2025-49863WordPress Advanced Sermons plugin <= 3.6 - Cross Site Scripting (XSS) VulnerabilityWP CodeUs Advanced Sermons
- CVE-2025-49864WordPress AFS Analytics plugin <= 4.21 - Broken Access Control VulnerabilityAFS Analytics
- CVE-2025-49865WordPress Advanced Settings plugin <= 3.0.1 - Cross Site Request Forgery (CSRF) VulnerabilityHelmut Wandl Advanced Settings
- CVE-2025-49868WordPress Automation By Autonami plugin <= 3.6.0 - Open Redirection VulnerabilityAman FunnelKit Automations
- CVE-2025-49871WordPress Noptin plugin <= 3.8.7 - Cross Site Scripting (XSS) VulnerabilityNoptin Newsletter Team Noptin
- CVE-2025-49872WordPress myCred plugin <= 2.9.4.2 - Broken Access Control VulnerabilitySaad Iqbal myCred
- CVE-2025-49874WordPress Arconix FAQ plugin <= 1.9.6 - Broken Access Control Vulnerabilitytychesoftwares Arconix FAQ
- CVE-2025-49875WordPress If-So Dynamic Content Personalization plugin <= 1.9.3.1 - Cross Site Scripting (XSS) VulnerabilityIf-So Dynamic Content Personalization
- CVE-2025-49877WordPress ProfileGrid plugin <= 5.9.5.2 - Server Side Request Forgery (SSRF) VulnerabilityMetagauss ProfileGrid
- CVE-2025-49878WordPress WPAdverts plugin <= 2.2.4 - Cross Site Scripting (XSS) VulnerabilityGreg Winiarski WPAdverts
- CVE-2025-49880WordPress CubeWP Forms plugin <= 1.1.5 - Broken Access Control VulnerabilityImran Tauqeer CubeWP Forms
- CVE-2025-49881WordPress Responsive Blocks plugin <= 2.0.5 - Cross Site Scripting (XSS) VulnerabilityCyberChimps Responsive Blocks
- CVE-2025-49882WordPress CubeWP Framework plugin <= 1.1.23 - Cross Site Scripting (XSS) VulnerabilityImran Tauqeer CubeWP
- CVE-2025-49178Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignoreX.Org xwayland · Red Hat Enterprise Linux
- CVE-2025-49177Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmodeX.Org xwayland · Red Hat Enterprise Linux
- CVE-2025-49175Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: out-of-bounds read in x rendering extension animated cursorsX.Org xwayland · Red Hat Enterprise Linux
- CVE-2025-4754Missing Session Revocation on Logout in ash_authentication_phoenixteam-alembic ash_authentication_phoenix
- CVE-2025-6199Gdk-pixbuf: uninitialized memory disclosure in gdkpixbuf gif lzw decodergdk-pixbuf · Red Hat Enterprise Linux
- CVE-2025-6196Libgepub: integer overflow in libgepub's epub archive handlinglibgepub · Red Hat Enterprise Linux
- CVE-2025-34508ZendTo < 6.15-8 Path TraversalZendTo
- CVE-2025-49842conda-forge-webservices Privilege Escalation Risk via Default Docker Root Userconda-forge-webservices
- CVE-2025-6069HTMLParser quadratic complexity when processing malformed inputsPython Software Foundation CPython
- CVE-2025-4365NetScaler Console and NetScaler SDX (SVM) - Arbitrary file readNetScaler Console · NetScaler SDX
- CVE-2025-5291Master Slider <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via masterslider_pb and ms_slide Shortcodesaverta Master Slider – Responsive Touch Slider
- CVE-2025-3880Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.9.0 - Incorrect Authorization to Authenticated (Contributor+) Plugin Settings Updateassafp Quiz, Poll & Survey Maker by Opinion Stage
- CVE-2025-5700Simple Logo Carousel <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parametertvledesign Simple Logo Carousel
- CVE-2025-6050Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interfacejupo mezzanine · mezzanine
- CVE-2025-40674Reflected Cross-Site Scripting (XSS) in osCommerceosCommerce
- CVE-2025-6173Webkul QloApps ajax_products_list.php sql injectionWebkul QloApps
- CVE-2025-6167themanojdesai python-a2a api.py create_workflow path traversalthemanojdesai python-a2a · python-a2a
- CVE-2025-6166frdel Agent-Zero image_get.py image_get path traversalfrdel Agent-Zero
- CVE-2025-5209Ivory Search < 5.5.10 - Admin+ Stored XSSIvory Search
- CVE-2025-6161SourceCodester Simple Food Ordering System editproduct.php unrestricted uploadSourceCodester Simple Food Ordering System
- CVE-2025-6160SourceCodester Client Database Management System user_customer_create_order.php sql injectionSourceCodester Client Database Management System
- CVE-2025-6159code-projects Hostel Management System allocate_room.php sql injectioncode-projects Hostel Management System
- CVE-2025-6157PHPGurukul Nipah Virus Testing Management System registered-user-testing.php sql injectionPHPGurukul Nipah Virus Testing Management System
- CVE-2025-6156PHPGurukul Nipah Virus Testing Management System bwdates-report-ds.php sql injectionPHPGurukul Nipah Virus Testing Management System
- CVE-2025-6155PHPGurukul Hostel Management System login-hm.inc.php sql injectionPHPGurukul Hostel Management System
- CVE-2025-6154PHPGurukul Hostel Management System login.inc.php sql injectionPHPGurukul Hostel Management System
- CVE-2025-49823Conda Constructor Command Injection via Unsanitized User Input (Low)conda constructor
- CVE-2025-6153PHPGurukul Hostel Management System students.php sql injectionPHPGurukul Hostel Management System
- CVE-2025-5673Blog2Social <= 8.4.4 - Authenticated (Subscriber+) SQL Injection via `prgSortPostType` Parameterpr-gateway Blog2Social: Social Media Auto Post & Scheduler
- CVE-2025-4775WordPress Infinite Scroll – Ajax Load More <= 7.4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scriptingdcooney Ajax Load More – Infinite Scroll, Load More, & Lazy…
- CVE-2025-6152Steel Browser files.routes.ts handleFileUpload path traversalSteel Browser
- CVE-2025-48993Group-Office vulnerable to reflected XSS via Look and Feel Formatting inputIntermesh groupoffice
- CVE-2024-40570SQL Injection vulnerability in SeaCMS v.12.9 allows a remote attacker to obtain sensitive information via the admin_datarelate.php component
- CVE-2025-45525A NULL pointer dereference vulnerability has been identified in the JavaScript library microlight version 0.0.7, a lightweight syntax highliasvd microlight
- CVE-2025-45526A denial of service (DoS) vulnerability has been identified in the JavaScript library microlight version 0.0.7.asvd microlight
- CVE-2025-45878A cross-site scripting (XSS) vulnerability in the report manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary
- CVE-2025-45879A cross-site scripting (XSS) vulnerability in the e-mail manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary
- CVE-2025-45880A cross-site scripting (XSS) vulnerability in the data resource management function of Miliaris Amigdala v2.2.6 allows attackers to execute