CVEs published June 21, 2025
57 CVEs were published on June 21, 2025: 3 critical, 15 high. 1 is now in CISA KEV.
- Published
- 57
- Critical
- 3
- High
- 15
- Medium
- 37
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 15
Most affected products
- PHPGurukul Art Gallery Management System
- 9
- code-projects Simple Online Hotel Reservation System
- 6
- Sony XAV-AX8500
- 6
- dnnsoftware Dnn.Platform · DNN.PLATFORM
- 4
- Yealink RPS
- 4
- Campcodes Online Hospital Management System
- 3
- Campcodes Online Teacher Record Management System
- 2
- IBM InfoSphere Information Server
- 2
- TOTOLINK N300RH
- 2
- TOTOLINK X15
- 2
Critical 3
- CVE-2025-1987Stored XSS in Psono-Client via Malicious Vault Entry URLsPsono-client · Bitdefender SecurePass
- CVE-2025-52556rfc3161-client has insufficient verification for timestamp response signaturestrailofbits rfc3161-client · rfc3161-client
- CVE-2025-6216Allegra calculateTokenExpDate Password Recovery Authentication Bypass VulnerabilityAllegra
High 15
- CVE-2025-3221IBM InfoSphere Information Server denial of serviceIBM InfoSphere Information Server
- CVE-2025-6402TOTOLINK X15 HTTP POST Request formIpv6Setup buffer overflowTOTOLINK X15
- CVE-2025-5034WP File Download < 6.2.6 - Reflected XSSwp-file-download
- CVE-2025-6400TOTOLINK N300RH HTTP POST Message formPortFw buffer overflowTOTOLINK N300RH
- CVE-2025-6399TOTOLINK X15 HTTP POST Request formIPv6Addr buffer overflowTOTOLINK X15
- CVE-2025-52488DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user inputdnnsoftware Dnn.Platform · DNN.PLATFORM
- CVE-2025-52487DNN.PLATFORM possibly allows bypass of IP Filtersdnnsoftware Dnn.Platform · DNN.PLATFORM
- CVE-2025-52557Mail-0 Zero Session Hijacking Via EmailMail-0 Zero
- CVE-2025-6393TOTOLINK A702R/A3002R/A3002RU/EX1200T HTTP POST Request formIPv6Addr buffer overflowTOTOLINK A702R · TOTOLINK A3002R +2
- CVE-2025-5475Sony XAV-AX8500 Bluetooth Packet Handling Integer Overflow Remote Code Execution VulnerabilitySony XAV-AX8500
- CVE-2025-5477Sony XAV-AX8500 Bluetooth L2CAP Protocol Heap-based Buffer Overflow Remote Code Execution VulnerabilitySony XAV-AX8500
- CVE-2025-5478Sony XAV-AX8500 Bluetooth SDP Protocol Integer Overflow Remote Code Execution VulnerabilitySony XAV-AX8500
- CVE-2025-5479Sony XAV-AX8500 Bluetooth AVCTP Protocol Heap-based Buffer Overflow Remote Code Execution VulnerabilitySony XAV-AX8500
- CVE-2025-6218RARLAB WinRAR Directory Traversal Remote Code Execution VulnerabilityRARLAB WinRAR
- CVE-2025-6374D-Link DIR-619L formSetACLFilter stack-based overflowD-Link DIR-619L
Medium, low and unrated 39
- CVE-2025-6447code-projects Simple Online Hotel Reservation System index.php sql injectioncode-projects Simple Online Hotel Reservation System
- CVE-2025-6446code-projects Client Details System index.php sql injectioncode-projects Client Details System
- CVE-2025-6422Campcodes Online Recruitment Management System About Content Page ajax.php unrestricted uploadCampcodes Online Recruitment Management System
- CVE-2025-6421code-projects Simple Online Hotel Reservation System add_account.php sql injectioncode-projects Simple Online Hotel Reservation System
- CVE-2025-6420code-projects Simple Online Hotel Reservation System add_room.php sql injectioncode-projects Simple Online Hotel Reservation System
- CVE-2025-6419code-projects Simple Online Hotel Reservation System edit_room.php sql injectioncode-projects Simple Online Hotel Reservation System
- CVE-2025-6418code-projects Simple Online Hotel Reservation System edit_query_account.php sql injectioncode-projects Simple Online Hotel Reservation System
- CVE-2025-6417PHPGurukul Art Gallery Management System add-artist.php sql injectionPHPGurukul Art Gallery Management System
- CVE-2025-6416PHPGurukul Art Gallery Management System changeimage4.php sql injectionPHPGurukul Art Gallery Management System
- CVE-2025-6415PHPGurukul Art Gallery Management System changeimage3.php sql injectionPHPGurukul Art Gallery Management System
- CVE-2025-6414PHPGurukul Art Gallery Management System changeimage2.php sql injectionPHPGurukul Art Gallery Management System
- CVE-2025-6413PHPGurukul Art Gallery Management System changeimage1.php sql injectionPHPGurukul Art Gallery Management System
- CVE-2025-6412PHPGurukul Art Gallery Management System changeimage.php sql injectionPHPGurukul Art Gallery Management System
- CVE-2025-6411PHPGurukul Art Gallery Management System changepropic.php sql injectionPHPGurukul Art Gallery Management System
- CVE-2025-6410PHPGurukul Art Gallery Management System edit-art-medium-detail.php sql injectionPHPGurukul Art Gallery Management System
- CVE-2025-6409PHPGurukul Art Gallery Management System forgot-password.php sql injectionPHPGurukul Art Gallery Management System
- CVE-2025-6408Campcodes Online Hospital Management System search.php sql injectionCampcodes Online Hospital Management System
- CVE-2025-6407Campcodes Online Hospital Management System user-login.php sql injectionCampcodes Online Hospital Management System
- CVE-2025-6406Campcodes Online Hospital Management System forgot-password.php sql injectionCampcodes Online Hospital Management System
- CVE-2025-6405Campcodes Online Teacher Record Management System edit-teacher-detail.php sql injectionCampcodes Online Teacher Record Management System
- CVE-2025-3629IBM InfoSphere Information Server file manipulationIBM InfoSphere Information Server
- CVE-2025-36016IBM Process Mining HTTP open redirectIBM Process Mining
- CVE-2025-6404Campcodes Online Teacher Record Management System search.php sql injectionCampcodes Online Teacher Record Management System
- CVE-2025-52893D FlipBook - Lite Edition <= 1.16.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via style and mode Parametersiberezansky 3D FlipBook – PDF Embedder, PDF Flipbook Viewer…
- CVE-2025-6403code-projects School Fees Payment System student.php sql injectioncode-projects School Fees Payment System
- CVE-2025-5143TableOn – WordPress Posts Table Filterable <= 1.0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via tableon_popup_iframe_button Shortcoderealmag777 TableOn – WordPress Posts Table Filterable
- CVE-2025-6401TOTOLINK N300RH HTTP POST Message formFilter denial of serviceTOTOLINK N300RH
- CVE-2025-52486DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjectsdnnsoftware Dnn.Platform · DNN.PLATFORM
- CVE-2025-52485DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feeddnnsoftware Dnn.Platform · DNN.PLATFORM
- CVE-2025-52552FastGPT LastRoute Parameter on Login Page Vulnerable to Open Redirect and DOM-based XSSlabring FastGPT
- CVE-2025-6394code-projects Simple Online Hotel Reservation System add_reserve.php sql injectioncode-projects Simple Online Hotel Reservation System
- CVE-2025-6375poco MultipartReader.cpp MultipartInputStream null pointer dereferencepoco
- CVE-2025-5476Sony XAV-AX8500 Bluetooth Improper Isolation Authentication Bypass VulnerabilitySony XAV-AX8500
- CVE-2025-5820Sony XAV-AX8500 Bluetooth ERTM Channel Authentication Bypass VulnerabilitySony XAV-AX8500
- CVE-2025-6217PEAK-System Driver PCANFD_ADD_FILTERS Time-Of-Check Time-Of-Use Information Disclosure VulnerabilityPEAK-System Driver
- CVE-2025-52916Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration (last five digits).Yealink RPS
- CVE-2025-52917The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests.Yealink RPS
- CVE-2025-52918Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated intYealink RPS
- CVE-2025-52919In Yealink RPS before 2025-05-26, the certificate upload function does not properly validate certificate content, potentially allowing invalYealink RPS