# CVEs published 2025-06-21

57 CVEs were published on June 21, 2025: 3 critical, 15 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-6447](https://cve.now/CVE-2025-6447.md): code-projects Simple Online Hotel Reservation System index.php sql injection (CVSS 6.9, code-projects Simple Online Hotel Reservation System)
- [CVE-2025-6446](https://cve.now/CVE-2025-6446.md): code-projects Client Details System index.php sql injection (CVSS 6.9, code-projects Client Details System)
- [CVE-2025-6422](https://cve.now/CVE-2025-6422.md): Campcodes Online Recruitment Management System About Content Page ajax.php unrestricted upload (CVSS 5.3, Campcodes Online Recruitment Management System)
- [CVE-2025-6421](https://cve.now/CVE-2025-6421.md): code-projects Simple Online Hotel Reservation System add\_account.php sql injection (CVSS 6.9, code-projects Simple Online Hotel Reservation System)
- [CVE-2025-1987](https://cve.now/CVE-2025-1987.md): Stored XSS in Psono-Client via Malicious Vault Entry URLs (CVSS 9.3, Psono-client · Bitdefender SecurePass)
- [CVE-2025-6420](https://cve.now/CVE-2025-6420.md): code-projects Simple Online Hotel Reservation System add\_room.php sql injection (CVSS 6.9, code-projects Simple Online Hotel Reservation System)
- [CVE-2025-6419](https://cve.now/CVE-2025-6419.md): code-projects Simple Online Hotel Reservation System edit\_room.php sql injection (CVSS 6.9, code-projects Simple Online Hotel Reservation System)
- [CVE-2025-6418](https://cve.now/CVE-2025-6418.md): code-projects Simple Online Hotel Reservation System edit\_query\_account.php sql injection (CVSS 6.9, code-projects Simple Online Hotel Reservation System)
- [CVE-2025-6417](https://cve.now/CVE-2025-6417.md): PHPGurukul Art Gallery Management System add-artist.php sql injection (CVSS 5.3, PHPGurukul Art Gallery Management System)
- [CVE-2025-6416](https://cve.now/CVE-2025-6416.md): PHPGurukul Art Gallery Management System changeimage4.php sql injection (CVSS 5.3, PHPGurukul Art Gallery Management System)
- [CVE-2025-6415](https://cve.now/CVE-2025-6415.md): PHPGurukul Art Gallery Management System changeimage3.php sql injection (CVSS 5.3, PHPGurukul Art Gallery Management System)
- [CVE-2025-6414](https://cve.now/CVE-2025-6414.md): PHPGurukul Art Gallery Management System changeimage2.php sql injection (CVSS 5.3, PHPGurukul Art Gallery Management System)
- [CVE-2025-6413](https://cve.now/CVE-2025-6413.md): PHPGurukul Art Gallery Management System changeimage1.php sql injection (CVSS 5.3, PHPGurukul Art Gallery Management System)
- [CVE-2025-6412](https://cve.now/CVE-2025-6412.md): PHPGurukul Art Gallery Management System changeimage.php sql injection (CVSS 5.3, PHPGurukul Art Gallery Management System)
- [CVE-2025-6411](https://cve.now/CVE-2025-6411.md): PHPGurukul Art Gallery Management System changepropic.php sql injection (CVSS 5.3, PHPGurukul Art Gallery Management System)
- [CVE-2025-6410](https://cve.now/CVE-2025-6410.md): PHPGurukul Art Gallery Management System edit-art-medium-detail.php sql injection (CVSS 5.3, PHPGurukul Art Gallery Management System)
- [CVE-2025-6409](https://cve.now/CVE-2025-6409.md): PHPGurukul Art Gallery Management System forgot-password.php sql injection (CVSS 6.9, PHPGurukul Art Gallery Management System)
- [CVE-2025-6408](https://cve.now/CVE-2025-6408.md): Campcodes Online Hospital Management System search.php sql injection (CVSS 6.9, Campcodes Online Hospital Management System)
- [CVE-2025-6407](https://cve.now/CVE-2025-6407.md): Campcodes Online Hospital Management System user-login.php sql injection (CVSS 6.9, Campcodes Online Hospital Management System)
- [CVE-2025-6406](https://cve.now/CVE-2025-6406.md): Campcodes Online Hospital Management System forgot-password.php sql injection (CVSS 6.9, Campcodes Online Hospital Management System)
- [CVE-2025-6405](https://cve.now/CVE-2025-6405.md): Campcodes Online Teacher Record Management System edit-teacher-detail.php sql injection (CVSS 6.9, Campcodes Online Teacher Record Management System)
- [CVE-2025-3629](https://cve.now/CVE-2025-3629.md): IBM InfoSphere Information Server file manipulation (CVSS 4.3, IBM InfoSphere Information Server)
- [CVE-2025-3221](https://cve.now/CVE-2025-3221.md): IBM InfoSphere Information Server denial of service (CVSS 7.5, IBM InfoSphere Information Server)
- [CVE-2025-36016](https://cve.now/CVE-2025-36016.md): IBM Process Mining HTTP open redirect (CVSS 6.8, IBM Process Mining)
- [CVE-2025-6404](https://cve.now/CVE-2025-6404.md): Campcodes Online Teacher Record Management System search.php sql injection (CVSS 6.9, Campcodes Online Teacher Record Management System)
- [CVE-2025-5289](https://cve.now/CVE-2025-5289.md): 3D FlipBook - Lite Edition \<= 1.16.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via style and mode Parameters (CVSS 6.4, iberezansky 3D FlipBook – PDF Embedder, PDF Flipbook Viewer…)
- [CVE-2025-6403](https://cve.now/CVE-2025-6403.md): code-projects School Fees Payment System student.php sql injection (CVSS 6.9, code-projects School Fees Payment System)
- [CVE-2025-6402](https://cve.now/CVE-2025-6402.md): TOTOLINK X15 HTTP POST Request formIpv6Setup buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-5143](https://cve.now/CVE-2025-5143.md): TableOn – WordPress Posts Table Filterable \<= 1.0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via tableon\_popup\_iframe\_button Shortcode (CVSS 6.4, realmag777 TableOn – WordPress Posts Table Filterable)
- [CVE-2025-6401](https://cve.now/CVE-2025-6401.md): TOTOLINK N300RH HTTP POST Message formFilter denial of service (CVSS 5.1, TOTOLINK N300RH)
- [CVE-2025-5034](https://cve.now/CVE-2025-5034.md): WP File Download \< 6.2.6 - Reflected XSS (CVSS 7.1, wp-file-download)
- [CVE-2025-6400](https://cve.now/CVE-2025-6400.md): TOTOLINK N300RH HTTP POST Message formPortFw buffer overflow (CVSS 8.7, TOTOLINK N300RH)
- [CVE-2025-6399](https://cve.now/CVE-2025-6399.md): TOTOLINK X15 HTTP POST Request formIPv6Addr buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-52488](https://cve.now/CVE-2025-52488.md): DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input (CVSS 8.6, dnnsoftware Dnn.Platform · DNN.PLATFORM)
- [CVE-2025-52487](https://cve.now/CVE-2025-52487.md): DNN.PLATFORM possibly allows bypass of IP Filters (CVSS 8.8, dnnsoftware Dnn.Platform · DNN.PLATFORM)
- [CVE-2025-52486](https://cve.now/CVE-2025-52486.md): DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects (CVSS 6.1, dnnsoftware Dnn.Platform · DNN.PLATFORM)
- [CVE-2025-52485](https://cve.now/CVE-2025-52485.md): DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed (CVSS 5.1, dnnsoftware Dnn.Platform · DNN.PLATFORM)
- [CVE-2025-52552](https://cve.now/CVE-2025-52552.md): FastGPT LastRoute Parameter on Login Page Vulnerable to Open Redirect and DOM-based XSS (CVSS 5.5, labring FastGPT)
- [CVE-2025-52557](https://cve.now/CVE-2025-52557.md): Mail-0 Zero Session Hijacking Via Email (CVSS 8.6, Mail-0 Zero)
- [CVE-2025-52556](https://cve.now/CVE-2025-52556.md): rfc3161-client has insufficient verification for timestamp response signatures (CVSS 9.3, trailofbits rfc3161-client · rfc3161-client)
- [CVE-2025-6394](https://cve.now/CVE-2025-6394.md): code-projects Simple Online Hotel Reservation System add\_reserve.php sql injection (CVSS 6.9, code-projects Simple Online Hotel Reservation System)
- [CVE-2025-6393](https://cve.now/CVE-2025-6393.md): TOTOLINK A702R/A3002R/A3002RU/EX1200T HTTP POST Request formIPv6Addr buffer overflow (CVSS 8.7, TOTOLINK A702R · TOTOLINK A3002R +2)
- [CVE-2025-6375](https://cve.now/CVE-2025-6375.md): poco MultipartReader.cpp MultipartInputStream null pointer dereference (CVSS 4.8, poco)
- [CVE-2025-5475](https://cve.now/CVE-2025-5475.md): Sony XAV-AX8500 Bluetooth Packet Handling Integer Overflow Remote Code Execution Vulnerability (CVSS 7.5, Sony XAV-AX8500)
- [CVE-2025-5477](https://cve.now/CVE-2025-5477.md): Sony XAV-AX8500 Bluetooth L2CAP Protocol Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.5, Sony XAV-AX8500)
- [CVE-2025-5478](https://cve.now/CVE-2025-5478.md): Sony XAV-AX8500 Bluetooth SDP Protocol Integer Overflow Remote Code Execution Vulnerability (CVSS 8.8, Sony XAV-AX8500)
- [CVE-2025-5479](https://cve.now/CVE-2025-5479.md): Sony XAV-AX8500 Bluetooth AVCTP Protocol Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.5, Sony XAV-AX8500)
- [CVE-2025-5476](https://cve.now/CVE-2025-5476.md): Sony XAV-AX8500 Bluetooth Improper Isolation Authentication Bypass Vulnerability (CVSS 6.3, Sony XAV-AX8500)
- [CVE-2025-5820](https://cve.now/CVE-2025-5820.md): Sony XAV-AX8500 Bluetooth ERTM Channel Authentication Bypass Vulnerability (CVSS 6.3, Sony XAV-AX8500)
- [CVE-2025-6218](https://cve.now/CVE-2025-6218.md): RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability (CVSS 7.8, KEV, RARLAB WinRAR)
- [CVE-2025-6217](https://cve.now/CVE-2025-6217.md): PEAK-System Driver PCANFD\_ADD\_FILTERS Time-Of-Check Time-Of-Use Information Disclosure Vulnerability (CVSS 3.8, PEAK-System Driver)
- [CVE-2025-6216](https://cve.now/CVE-2025-6216.md): Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability (CVSS 9.8, Allegra)
- [CVE-2025-6374](https://cve.now/CVE-2025-6374.md): D-Link DIR-619L formSetACLFilter stack-based overflow (CVSS 8.7, D-Link DIR-619L)
- [CVE-2025-52916](https://cve.now/CVE-2025-52916.md): Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration (last five digits). (CVSS 2.2, Yealink RPS)
- [CVE-2025-52917](https://cve.now/CVE-2025-52917.md): The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests. (CVSS 4.3, Yealink RPS)
- [CVE-2025-52918](https://cve.now/CVE-2025-52918.md): Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated int (CVSS 5.0, Yealink RPS)
- [CVE-2025-52919](https://cve.now/CVE-2025-52919.md): In Yealink RPS before 2025-05-26, the certificate upload function does not properly validate certificate content, potentially allowing inval (CVSS 4.3, Yealink RPS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-06-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.