# CVEs published 2025-06-19

54 CVEs were published on June 19, 2025: 5 critical, 8 high. Days are UTC.

- [CVE-2025-47771](https://cve.now/CVE-2025-47771.md): PowSyBl Core allows deserialization of untrusted SparseMatrix data (CVSS 8.1, powsybl-core · com.powsybl:powsybl-math)
- [CVE-2025-6287](https://cve.now/CVE-2025-6287.md): PHPGurukul COVID19 Testing Management System Take Action test-details.php cross site scripting (CVSS 5.1, PHPGurukul COVID19 Testing Management System)
- [CVE-2025-6286](https://cve.now/CVE-2025-6286.md): PHPGurukul COVID19 Testing Management System search-report-result.php redirect (CVSS 5.1, PHPGurukul COVID19 Testing Management System)
- [CVE-2025-6285](https://cve.now/CVE-2025-6285.md): PHPGurukul COVID19 Testing Management System search-report-result.php cross site scripting (CVSS 5.3, PHPGurukul COVID19 Testing Management System)
- [CVE-2025-6284](https://cve.now/CVE-2025-6284.md): PHPGurukul Car Rental Portal cross-site request forgery (CVSS 5.3, PHPGurukul Car Rental Portal)
- [CVE-2025-6283](https://cve.now/CVE-2025-6283.md): xataio Xata Agent route.ts GET path traversal (CVSS 5.1, xataio Xata Agent)
- [CVE-2025-6282](https://cve.now/CVE-2025-6282.md): xlang-ai OpenAgents file.py create\_upload\_file path traversal (CVSS 5.1, xlang-ai OpenAgents)
- [CVE-2025-47293](https://cve.now/CVE-2025-47293.md): PowSyBl Core XML Reader allows XXE and SSRF (CVSS 2.7, powsybl-core · com.powsybl:powsybl-commons)
- [CVE-2025-6281](https://cve.now/CVE-2025-6281.md): OpenBMB XAgent community path traversal (CVSS 5.1, OpenBMB XAgent)
- [CVE-2025-6280](https://cve.now/CVE-2025-6280.md): TransformerOptimus SuperAGI EmailToolKit read\_email.py download\_attachment path traversal (CVSS 5.1, TransformerOptimus SuperAGI)
- [CVE-2025-6279](https://cve.now/CVE-2025-6279.md): Upsonic Pickle add\_tool cloudpickle.loads deserialization (CVSS 5.1, Upsonic)
- [CVE-2025-6384](https://cve.now/CVE-2025-6384.md): Improper Control of Dynamically-Managed Code Resources in Crafter Studio (CVSS 7.3, CrafterCMS · org.craftercms:crafter-studio)
- [CVE-2025-6278](https://cve.now/CVE-2025-6278.md): Upsonic server.py os.path.join path traversal (CVSS 5.1, Upsonic)
- [CVE-2025-6277](https://cve.now/CVE-2025-6277.md): Brilliance Golden Link Secondary System custTakeInfoPage.htm sql injection (CVSS 5.3, Brilliance Golden Link Secondary System)
- [CVE-2025-6276](https://cve.now/CVE-2025-6276.md): Brilliance Golden Link Secondary System rentTakeInfoPage.htm sql injection (CVSS 5.3, Brilliance Golden Link Secondary System)
- [CVE-2025-6275](https://cve.now/CVE-2025-6275.md): WebAssembly wabt binary-reader-interp.cc GetFuncOffset use after free (CVSS 4.8, WebAssembly wabt)
- [CVE-2025-6274](https://cve.now/CVE-2025-6274.md): WebAssembly wabt binary-reader-interp.cc OnDataCount resource consumption (CVSS 4.8, WebAssembly wabt)
- [CVE-2025-6273](https://cve.now/CVE-2025-6273.md): WebAssembly wabt binary-reader-objdump.cc LogOpcode assertion (CVSS 4.8, WebAssembly wabt)
- [CVE-2025-6272](https://cve.now/CVE-2025-6272.md): wasm3 m3\_compile.c MarkSlotAllocated out-of-bounds write (CVSS 4.8, wasm3 · pywasm3)
- [CVE-2025-6271](https://cve.now/CVE-2025-6271.md): swftools wav2swf wav.c wav\_convert2mono out-of-bounds (CVSS 4.8, swftools)
- [CVE-2025-33117](https://cve.now/CVE-2025-33117.md): IBM QRadar SIEM command execution (CVSS 9.1, IBM QRadar SIEM)
- [CVE-2025-33121](https://cve.now/CVE-2025-33121.md): IBM QRadar SIEM XML external entity injection (CVSS 7.1, IBM QRadar SIEM)
- [CVE-2025-36050](https://cve.now/CVE-2025-36050.md): IBM QRadar SIEM information disclosure (CVSS 6.2, IBM QRadar SIEM)
- [CVE-2025-6270](https://cve.now/CVE-2025-6270.md): HDF5 H5FSsection.c H5FS\_\_sect\_find\_node heap-based overflow (CVSS 4.8, HDF5)
- [CVE-2025-50200](https://cve.now/CVE-2025-50200.md): RabbitMQ Node can log Basic Auth header from an HTTP request (CVSS 6.7, rabbitmq-server)
- [CVE-2025-6269](https://cve.now/CVE-2025-6269.md): HDF5 H5Cimage.c H5C\_\_reconstruct\_cache\_entry heap-based overflow (CVSS 4.8, HDF5)
- [CVE-2025-52464](https://cve.now/CVE-2025-52464.md): Meshtastic Repeated Public and Private Keypairs (CVSS 9.5, meshtastic firmware)
- [CVE-2025-49014](https://cve.now/CVE-2025-49014.md): jq heap use after free vulnerability in f\_strflocaltime (CVSS 5.5, jqlang jq)
- [CVE-2025-6268](https://cve.now/CVE-2025-6268.md): Luna Imaging search cross site scripting (CVSS 5.3, Luna Imaging)
- [CVE-2025-48886](https://cve.now/CVE-2025-48886.md): hydra-node dangerously assumes L1 event finality and does not consider failed transactions (CVSS 4.8, cardano-scaling hydra)
- [CVE-2025-6267](https://cve.now/CVE-2025-6267.md): zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 barcodeDetail sql injection (CVSS 5.3, zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用…)
- [CVE-2024-24916](https://cve.now/CVE-2024-24916.md): DLL-HiJacking (CVSS 6.5, checkpoint Check Point SmartConsole)
- [CVE-2025-4738](https://cve.now/CVE-2025-4738.md): Authenticated SQLi in Yirmibes Software's MY ERP (CVSS 9.8, Yirmibes Software MY ERP)
- [CVE-2025-6266](https://cve.now/CVE-2025-6266.md): Teledyne FLIR AX8 upload.php unrestricted upload (CVSS 5.3, Teledyne FLIR AX8)
- [CVE-2025-6019](https://cve.now/CVE-2025-6019.md): Libblockdev: lpe from allow\_active to root in libblockdev via udisks (CVSS 7.0, libblockdev · Red Hat Enterprise Linux)
- [CVE-2025-32896](https://cve.now/CVE-2025-32896.md): Apache SeaTunnel: Unauthenticated insecure access (CVSS 6.5, Apache Software Foundation Apache SeaTunnel · org.apache… +1)
- [CVE-2025-31698](https://cve.now/CVE-2025-31698.md): Apache Traffic Server: Client IP address from PROXY protocol is not used for ACL (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2025-49763](https://cve.now/CVE-2025-49763.md): Apache Traffic Server: Remote DoS via memory exhaustion in ESI Plugin (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2025-5234](https://cve.now/CVE-2025-5234.md): Gutenverse News \<= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via elementId Parameter (CVSS 6.4, jegstudio Gutenverse News – Advanced News Magazine Blog Gu…)
- [CVE-2025-5071](https://cve.now/CVE-2025-5071.md): AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP (CVSS 8.8, tigroumeow AI Engine)
- [CVE-2025-4965](https://cve.now/CVE-2025-4965.md): WPBakery Page Builder \<= 8.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder (CVSS 6.4, WPBakery Page Builder)
- [CVE-2025-4571](https://cve.now/CVE-2025-4571.md): GiveWP – Donation Plugin and Fundraising Platform \<= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification (CVSS 5.4, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2025-5490](https://cve.now/CVE-2025-5490.md): Football Pool \<= 2.12.4 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, antoineh Football Pool)
- [CVE-2025-5524](https://cve.now/CVE-2025-5524.md): OceanWP \<= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Select HTML Tag (CVSS 4.9, OceanWP)
- [CVE-2025-52474](https://cve.now/CVE-2025-52474.md): WeGIA SQL Injection Vulnerability in id Parameter on control.php Endpoint (CVSS 8.3, LabRedesCefetRJ WeGIA)
- [CVE-2025-4479](https://cve.now/CVE-2025-4479.md): ElementsKit Lite \<= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget (CVSS 6.4, roxnor ElementsKit Elementor Addons – Advanced Widgets & Te…)
- [CVE-2025-4367](https://cve.now/CVE-2025-4367.md): Download Manager \<= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm\_user\_dashboard Shortcode (CVSS 6.4, codename065 Download Manager)
- [CVE-2025-50201](https://cve.now/CVE-2025-50201.md): WeGIA OS Command Injection in debug\_info.php parameter 'branch' (CVSS 9.8, LabRedesCefetRJ WeGIA)
- [CVE-2025-52467](https://cve.now/CVE-2025-52467.md): pgai secrets exfiltration via \`pull\_request\_target\` (CVSS 9.1, timescale pgai)
- [CVE-2025-4661](https://cve.now/CVE-2025-4661.md): Path transversal vulnerability potentially leading to sensitive information disclosure (CVSS 4.8, Brocade Fabric OS)
- [CVE-2025-50183](https://cve.now/CVE-2025-50183.md): OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer (CVSS 6.5, OpenListTeam OpenList · @openlist-frontend/openlist-frontend)
- [CVE-2025-6201](https://cve.now/CVE-2025-6201.md): Pixel Manager for WooCommerce (PRO) \<= 1.49.0 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode (CVSS 6.4, alekv Pixel Manager for WooCommerce – Conversion Tracking,…)
- [CVE-2025-50182](https://cve.now/CVE-2025-50182.md): urllib3 does not control redirects in browsers and Node.js (CVSS 5.3, urllib3)
- [CVE-2025-50181](https://cve.now/CVE-2025-50181.md): urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation (CVSS 5.3, urllib3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-06-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.