# CVEs published 2025-06-22 38 CVEs were published on June 22, 2025: 0 critical, 2 high. Days are UTC. - [CVE-2025-6494](https://cve.now/CVE-2025-6494.md): sparklemotion nokogiri hashmap.c hashmap\_get\_with\_hash heap-based overflow (CVSS 4.8, sparklemotion nokogiri) - [CVE-2025-6493](https://cve.now/CVE-2025-6493.md): CodeMirror Markdown Mode markdown.js redos (CVSS 6.9, CodeMirror) - [CVE-2025-6492](https://cve.now/CVE-2025-6492.md): MarkText index.js getRecommendTitleFromMarkdownString redos (CVSS 6.9, MarkText) - [CVE-2025-6490](https://cve.now/CVE-2025-6490.md): sparklemotion nokogiri hashmap.c hashmap\_set\_with\_hash heap-based overflow (CVSS 4.8, sparklemotion nokogiri) - [CVE-2025-6489](https://cve.now/CVE-2025-6489.md): itsourcecode Agri-Trading Online Shopping System transactionsave.php sql injection (CVSS 6.9, itsourcecode Agri-Trading Online Shopping System) - [CVE-2025-6487](https://cve.now/CVE-2025-6487.md): TOTOLINK A3002R formRoute stack-based overflow (CVSS 8.7, TOTOLINK A3002R) - [CVE-2025-6486](https://cve.now/CVE-2025-6486.md): TOTOLINK A3002R formWlanMultipleAP stack-based overflow (CVSS 8.7, TOTOLINK A3002R) - [CVE-2025-6485](https://cve.now/CVE-2025-6485.md): TOTOLINK A3002R formWlSiteSurvey os command injection (CVSS 5.3, TOTOLINK A3002R) - [CVE-2025-6484](https://cve.now/CVE-2025-6484.md): code-projects Online Shopping Store action.php sql injection (CVSS 5.1, code-projects Online Shopping Store) - [CVE-2025-6483](https://cve.now/CVE-2025-6483.md): code-projects Simple Pizza Ordering System edituser.php sql injection (CVSS 6.9, code-projects Simple Pizza Ordering System) - [CVE-2025-6482](https://cve.now/CVE-2025-6482.md): code-projects Simple Pizza Ordering System edituser-exec.php sql injection (CVSS 6.9, code-projects Simple Pizza Ordering System) - [CVE-2025-6481](https://cve.now/CVE-2025-6481.md): code-projects Simple Pizza Ordering System update.php sql injection (CVSS 6.9, code-projects Simple Pizza Ordering System) - [CVE-2025-6480](https://cve.now/CVE-2025-6480.md): code-projects Simple Pizza Ordering System addcatexec.php sql injection (CVSS 6.9, code-projects Simple Pizza Ordering System) - [CVE-2025-6479](https://cve.now/CVE-2025-6479.md): code-projects Simple Pizza Ordering System salesreport.php sql injection (CVSS 6.9, code-projects Simple Pizza Ordering System) - [CVE-2025-6478](https://cve.now/CVE-2025-6478.md): CodeAstro Expense Management System cross-site request forgery (CVSS 5.3, CodeAstro Expense Management System) - [CVE-2025-6477](https://cve.now/CVE-2025-6477.md): SourceCodester Student Result Management System System Settings Page system cross site scripting (CVSS 4.8, SourceCodester Student Result Management System) - [CVE-2025-6476](https://cve.now/CVE-2025-6476.md): SourceCodester Gym Management System cross-site request forgery (CVSS 5.3, SourceCodester Gym Management System) - [CVE-2025-6475](https://cve.now/CVE-2025-6475.md): SourceCodester Student Result Management System Manage Students Module manage\_students cross site scripting (CVSS 4.8, SourceCodester Student Result Management System) - [CVE-2025-6474](https://cve.now/CVE-2025-6474.md): code-projects Inventory Management System changeUsername.php sql injection (CVSS 6.9, code-projects Inventory Management System) - [CVE-2025-6473](https://cve.now/CVE-2025-6473.md): code-projects School Fees Payment System fees.php cross site scripting (CVSS 5.3, code-projects School Fees Payment System) - [CVE-2025-6472](https://cve.now/CVE-2025-6472.md): code-projects Online Bidding System showprod.php sql injection (CVSS 6.9, code-projects Online Bidding System) - [CVE-2025-6471](https://cve.now/CVE-2025-6471.md): code-projects Online Bidding System administrator sql injection (CVSS 6.9, code-projects Online Bidding System) - [CVE-2025-6470](https://cve.now/CVE-2025-6470.md): code-projects Online Bidding System bidlog.php sql injection (CVSS 6.9, code-projects Online Bidding System) - [CVE-2025-6469](https://cve.now/CVE-2025-6469.md): code-projects Online Bidding System details.php sql injection (CVSS 6.9, code-projects Online Bidding System) - [CVE-2025-6468](https://cve.now/CVE-2025-6468.md): code-projects Online Bidding System bidnow.php sql injection (CVSS 6.9, code-projects Online Bidding System) - [CVE-2025-6467](https://cve.now/CVE-2025-6467.md): code-projects Online Bidding System login.php sql injection (CVSS 6.9, code-projects Online Bidding System) - [CVE-2025-6466](https://cve.now/CVE-2025-6466.md): ageerle ruoyi-ai SseServiceImpl.java upload unrestricted upload (CVSS 5.3, ageerle ruoyi-ai) - [CVE-2025-6458](https://cve.now/CVE-2025-6458.md): code-projects Online Hotel Reservation System execedituser.php sql injection (CVSS 6.9, code-projects Online Hotel Reservation System) - [CVE-2025-6457](https://cve.now/CVE-2025-6457.md): code-projects Online Hotel Reservation System demo.php sql injection (CVSS 6.9, code-projects Online Hotel Reservation System) - [CVE-2025-6456](https://cve.now/CVE-2025-6456.md): code-projects Online Hotel Reservation System order.php sql injection (CVSS 6.9, code-projects Online Hotel Reservation System) - [CVE-2025-6455](https://cve.now/CVE-2025-6455.md): code-projects Online Hotel Reservation System messageexec.php sql injection (CVSS 6.9, code-projects Online Hotel Reservation System) - [CVE-2025-6453](https://cve.now/CVE-2025-6453.md): diyhi bbs API ForumManageAction.java add path traversal (CVSS 5.3, diyhi bbs) - [CVE-2025-6452](https://cve.now/CVE-2025-6452.md): CodeAstro Patient Record Management System Generate New Report Page cross site scripting (CVSS 4.8, CodeAstro Patient Record Management System) - [CVE-2025-6451](https://cve.now/CVE-2025-6451.md): code-projects Simple Online Hotel Reservation System delete\_pending.php sql injection (CVSS 6.9, code-projects Simple Online Hotel Reservation System) - [CVE-2025-6450](https://cve.now/CVE-2025-6450.md): code-projects Simple Online Hotel Reservation System confirm\_reserve.php sql injection (CVSS 6.9, code-projects Simple Online Hotel Reservation System) - [CVE-2025-6449](https://cve.now/CVE-2025-6449.md): code-projects Simple Online Hotel Reservation System checkout\_query.php sql injection (CVSS 6.9, code-projects Simple Online Hotel Reservation System) - [CVE-2025-6448](https://cve.now/CVE-2025-6448.md): code-projects Simple Online Hotel Reservation System delete\_room.php sql injection (CVSS 6.9, code-projects Simple Online Hotel Reservation System) - [CVE-2025-52923](https://cve.now/CVE-2025-52923.md): Sangfor aTrust through 2.4.10 allows users to modify the ExecStartPre command. (CVSS 4.3, Sangfor aTrust) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-06-22 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.