CVEs published June 24, 2025
120 CVEs were published on June 24, 2025: 27 critical, 38 high. 1 is now in CISA KEV.
- Published
- 120
- Critical
- 27
- High
- 38
- Medium
- 51
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 33
Most affected products
- Mozilla Firefox · Mozilla Thunderbird
- 11
- Advantech Wireless Sensing and Equipment
- 8
- Hitachi Energy MicroSCADA X SYS600
- 5
- ControlID iDSecure On-premises
- 3
- Google Chrome
- 3
- SourceCodester Best Salon Management System
- 3
- xxyopen novel-plus · 201206030 novel-plus
- 3
- 5VTechnologies Blue Angel Software Suite
- 2
- ELECOM CO. WRH-733GBK · ELECOM CO. WRH-733GWH
- 2
- hikariatama Hikka
- 2
Critical 27
- CVE-2025-52572Hikka vulnerable to RCE through dangling web interfacehikariatama Hikka
- CVE-2025-52571Hikka vulnerable to RCE through edits in a channelhikariatama Hikka
- CVE-2025-49853Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in ControlID iDSecure On-premisesControlID iDSecure On-premises
- CVE-2025-2566Deserialization of Untrusted Data in Kaleris Navis N4Kaleris Navis N4
- CVE-2025-4378Hardcoded Credentials in Ataturk University's ATA-AOF Mobile ApplicationAtaturk University ATA-AOF Mobile Application
- CVE-2025-4383Authentication Bypass in Art-In Systems' Wi-Fi Cloud HotspotArt-in Bilişim Teknolojileri ve Yazılım Hizm. Tic. Ltd. Şti…
- CVE-2025-6433WebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificateMozilla Firefox · Mozilla Thunderbird
- CVE-2025-6427connect-src Content Security Policy restriction could be bypassedMozilla Firefox · Mozilla Thunderbird
- CVE-2025-6424Use-after-free in FontFaceSetMozilla Firefox · Mozilla Thunderbird
- CVE-2025-50213Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperatorApache Software Foundation Apache Airflow Providers Snowfla…
- CVE-2025-48890WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilitELECOM CO. WRH-733GBK · ELECOM CO. WRH-733GWH
- CVE-2025-43879WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilitELECOM CO. WRH-733GBK · ELECOM CO. WRH-733GWH
- CVE-2024-56731Gogs deletion of internal files allows remote command executiongogs · gogs.io/gogs
- CVE-2025-48469Unauthenticated Firmware UploadAdvantech Wireless Sensing and Equipment
- CVE-2025-6560Sapido Wireless Router - Exposure of Sensitive InformationSapido BR071n · Sapido BR261c +10
- CVE-2025-6559Sapido Wireless Router - OS Command InjectionSapido BR071n · Sapido BR261c +10
- CVE-2025-34041Sangfor Endpoint Detection and Response OS Command InjectionSangfor Technologies Co. Endpoint Detection and Response Pl…
- CVE-2025-34040Seeyon Zhiyuan OA System Path Traversal File UploadSeeyon (Beijing Zhiyuan Internet Software Co., Ltd.) Zhiyua…
- CVE-2025-34039Yonyou NC BeanShell Command InjectionYonyou Co. UFIDA NC
- CVE-2025-34037Linksys Routers E/WAG/WAP/WES/WET/WRT-SeriesLinksys E4200 · Linksys E3200 +9
- CVE-2025-34036Shenzhen TVT CCTV-DVR Command InjectionShenzhen TVT CCTV-DVR
- CVE-2025-34035EnGenius EnShare IoT Gigabit Cloud Service Command InjectionEnGenius EnShare IoT Gigabit Cloud Service
- CVE-2025-340345VTechnologies Blue Angel Software Suite Hardcoded Credentials5VTechnologies Blue Angel Software Suite
- CVE-2021-41691A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" para
- CVE-2024-37743An issue in mmzdev KnowledgeGPT V.0.0.5 allows a remote attacker to execute arbitrary code via the Document Display Component.
- CVE-2025-32975Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341
- CVE-2025-32977Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341
High 38
- CVE-2025-52882Claude Code IDE extensions allow websocket connections from arbitrary originsanthropics claude-code · @anthropic-ai/claude-code
- CVE-2025-52471ESP-NOW Integer Underflow Vulnerability Advisoryespressif esp-idf
- CVE-2025-52888Allure 2's xunit-xml-plugin Vulnerable to Improper XXE Restrictionallure-framework allure2 · io.qameta.allure.plugins:xuni… +2
- CVE-2025-49852Server-Side Request Forgery (SSRF) in ControlID iDSecure On-premisesControlID iDSecure On-premises
- CVE-2025-49851Improper Authentication in ControlID iDSecure On-premisesControlID iDSecure On-premises
- CVE-2025-23265NVIDIA Megatron-LM for all platforms contains a vulnerability in a python component where an attacker may cause a code injection issue by prNVIDIA Megatron LM
- CVE-2025-23264NVIDIA Megatron-LM for all platforms contains a vulnerability in a python component where an attacker may cause a code injection issue by prNVIDIA Megatron LM
- CVE-2025-6568TOTOLINK EX1200T HTTP POST Request formIpv6Setup buffer overflowTOTOLINK EX1200T
- CVE-2025-36537Incorrect Permission Assignment for Critical Resource in TeamViewer Remote ManagementTeamViewer Full Client · TeamViewer Host
- CVE-2025-6032Podman: podman missing tls verificationpodman · Red Hat Enterprise Linux +6
- CVE-2025-6565Netgear WNCE3001 HTTP POST Request http_d stack-based overflowNetgear WNCE3001
- CVE-2025-6436Memory safety bugs fixed in Firefox 140 and Thunderbird 140Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-6435Save as in Devtools could download files without sanitizing the extensionMozilla Firefox · Mozilla Thunderbird
- CVE-2025-6432DNS Requests leaked outside of a configured SOCKS proxyMozilla Firefox · Mozilla Thunderbird
- CVE-2025-6426No warning when opening executable terminal files on macOSMozilla Firefox · Mozilla Thunderbird
- CVE-2025-39204A vulnerability exists in the Web interface of the MicroSCADA X SYS600 product.Hitachi Energy MicroSCADA X SYS600
- CVE-2025-39202A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product.Hitachi Energy MicroSCADA X SYS600
- CVE-2025-2403A denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanism exists in Relion 670/650 and SHitachi Energy Relion 670/650 and SAM600-IO
- CVE-2025-6206Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.5.0 - Authenticated (Subscriber+) Arbitrary File UploadCodeRevolution Aiomatic - Automatic AI Content Writer & Edi…
- CVE-2025-3092MB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT24Helmholz myREX24 · Helmholz myREX24.virtual +2
- CVE-2025-3091MB connect line: Authorization bypass in mbCONNECT24/mymbCONNECT24MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2025-3090MB connect line: Missing Authentication in mbCONNECT24/mymbCONNECT24MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2025-2962Infinite loop in dns_copy_qnamezephyrproject-rtos Zephyr
- CVE-2025-41427WRC-X3000GS, WRC-X3000GSA, and WRC-X3000GSN contain an improper neutralization of special elements used in an OS command ('OS Command InjectELECOM CO. WRC-X3000GS · ELECOM CO. WRC-X3000GSA +1
- CVE-2025-52566llama.cpp tokenizer signed vs. unsigned heap overflowggml-org llama.cpp
- CVE-2025-52568NeKernal Multiple Memory Corruption Vulnerabilities in mkfs.hefsnekernel-org nekernel
- CVE-2025-52560Kanboard Password Reset Poisoning via Host Header Injectionkanboard
- CVE-2025-52574SysmonElixir path traversal in /read endpoint allows arbitrary file readbocaletto-luca elixir-system-monitor
- CVE-2025-48466Modbus Command Injection without AuthenticationAdvantech Wireless Sensing and Equipment
- CVE-2025-34038Weaver E-cology SQL InjectionWeaver E-cology
- CVE-2025-340335VTechnologies Blue Angel Software Suite OS Command Injection5VTechnologies Blue Angel Software Suite
- CVE-2025-34031Moodle LMS Jmol Plugin Path TraversalMoodle Jmol Plugin
- CVE-2024-56917Netbox Community 4.1.7 is vulnerable to Cross Site Scripting (XSS) via the maintenance banner` in maintenance mode.
- CVE-2025-27827A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.2.0.3 could allow an unauthenticated attacker to
- CVE-2025-27828A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4, 10.1.0.0 through 10.1.0.5, and 10.2.0.0 th
- CVE-2025-32976Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341
- CVE-2025-32978Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341
- CVE-2025-44531An issue in Realtek RTL8762EKF-EVB RTL8762E SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted before a pa
Medium, low and unrated 55
- CVE-2025-6582SourceCodester Best Salon Management System edit-customer-detailed.php sql injectionSourceCodester Best Salon Management System
- CVE-2025-6581SourceCodester Best Salon Management System add-customer.php sql injectionSourceCodester Best Salon Management System
- CVE-2025-6580SourceCodester Best Salon Management System Login sql injectionSourceCodester Best Salon Management System
- CVE-2025-52884risc0-ethereum-contracts allows invalid commitment with digest value of zero to be accepted by Steel.validateCommitmentrisc0-ethereum · risc0-ethereum-contracts
- CVE-2025-52883Meshtastic-Android vulnerable to forged DMs with no PKC showing up as encryptedMeshtastic-Android
- CVE-2025-6557Insufficient data validation in DevTools in Google Chrome on Windows prior to 138.0.7204.49 allowed a remote attacker who convinced a user tGoogle Chrome
- CVE-2025-6556Insufficient policy enforcement in Loader in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to bypass content security policGoogle Chrome
- CVE-2025-6555Use after free in Animation in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2025-6579code-projects Car Rental System message_admin.php sql injectioncode-projects Car Rental System
- CVE-2025-6578code-projects Simple Online Hotel Reservation System delete_account.php sql injectioncode-projects Simple Online Hotel Reservation System
- CVE-2025-52880Komga Vulnerable to Arbitrary Code Execution via Crafted EPUB Filegotson komga
- CVE-2025-5087Cleartext Transmission of Sensitive Information in Kaleris Navis N4Kaleris Navis N4
- CVE-2025-49147Umbraco.Cms Vulnerable to Disclosure of Configured Password RequirementsUmbraco-CMS · Umbraco.Cms
- CVE-2025-23260NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount atNVIDIA AIS Operator
- CVE-2025-6570PHPGurukul Hospital Management System search.php sql injectionPHPGurukul Hospital Management System
- CVE-2025-6569code-projects School Fees Payment System student.php cross site scriptingcode-projects School Fees Payment System
- CVE-2025-6567Campcodes Online Recruitment Management System view_application.php sql injectionCampcodes Online Recruitment Management System
- CVE-2025-5318Libssh: out-of-bounds read in sftp_handle()libssh · Red Hat Enterprise Linux +3
- CVE-2025-6566oatpp Oat++ Deserializer.cpp deserializeArray stack-based overflowoatpp Oat++
- CVE-2025-6434HTTPS-Only exception screen lacked anti-clickjacking delayMozilla Firefox · Mozilla Thunderbird
- CVE-2025-6431The prompt in Firefox for Android that asks before opening a link in an external application could be bypassedMozilla Firefox
- CVE-2025-6428Firefox for Android opened URLs specified in a link querystring parameterMozilla Firefox
- CVE-2025-6430Content-Disposition header ignored when a file is included in an embed or object tagMozilla Firefox · Mozilla Thunderbird
- CVE-2025-6429Incorrect parsing of URLs could have allowed embedding of youtube.comMozilla Firefox · Mozilla Thunderbird
- CVE-2025-6425The WebCompat WebExtension shipped with Firefox exposed a persistent UUIDMozilla Firefox · Mozilla Thunderbird
- CVE-2025-39205A vulnerability exists in the IEC 61850 in MicroSCADA X SYS600 product.Hitachi Energy MicroSCADA X SYS600
- CVE-2025-39203A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product.Hitachi Energy MicroSCADA X SYS600
- CVE-2025-39201A vulnerability exists in MicroSCADA X SYS600 product.Hitachi Energy MicroSCADA X SYS600
- CVE-2025-1718An authenticated user with file access privilege via FTP access can cause the Relion 670/650 and SAM600-IO series device to reboot due to imHitachi Energy Relion 670/650 and SAM600-IO
- CVE-2025-5258Conference Scheduler <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameterswift Conference Scheduler
- CVE-2025-43877WRC-1167GHBK2-S contains a stored cross-site scripting vulnerability in WebGUI.ELECOM CO. WRC-1167GHBK2-S
- CVE-2025-36519Unrestricted upload of file with dangerous type issue exists in WRC-2533GST2, WRC-1167GST2, WRC-2533GST2, WRC-2533GS2V-B,WRC-2533GS2-B v1.69ELECOM CO. WRC-2533GST2 · ELECOM CO. WRC-1167GST2 +5
- CVE-2025-47943Gogs stored XSS in PDF renderergogs · gogs.io/gogs +1
- CVE-2025-52570Letmein connection limiter allows an arbitrary amount of simultaneous connectionsmbuesch letmein · letmeind +1
- CVE-2025-48470Stored Cross site Scripting (XSS)Advantech Wireless Sensing and Equipment
- CVE-2025-48468Open JTAG Debug PortAdvantech Wireless Sensing and Equipment
- CVE-2025-48467Denial of Service via Malformed Modbus PacketsAdvantech Wireless Sensing and Equipment
- CVE-2025-48463Unencrypted HTTP CommunicationAdvantech Wireless Sensing and Equipment
- CVE-2025-48462Login Session ExhaustionAdvantech Wireless Sensing and Equipment
- CVE-2025-48461Weak Session Cookie EntropyAdvantech Wireless Sensing and Equipment
- CVE-2025-6552java-aodeng Hope-Boot Login WebController.java doLogin redirectjava-aodeng Hope-Boot
- CVE-2025-6551java-aodeng Hope-Boot WebController.java login cross site scriptingjava-aodeng Hope-Boot
- CVE-2025-6536Tarantool datetime.c tm_to_datetime assertionTarantool
- CVE-2025-6535xxyopen/201206030 novel-plus User Management Module UserMapper.xml list sql injectionxxyopen novel-plus · 201206030 novel-plus
- CVE-2025-34032Moodle LMS Jmol Plugin Cross-site Scripting (XSS)Moodle Jmol Plugin
- CVE-2025-6534xxyopen/201206030 novel-plus File FileController.java remove resource injectionxxyopen novel-plus · 201206030 novel-plus
- CVE-2025-6533xxyopen/201206030 novel-plus CATCHA LoginController.java ajaxLogin authentication replayxxyopen novel-plus · 201206030 novel-plus
- CVE-2025-6532NOYAFA/Xiami LF9 Pro RTSP Live Video Stream Endpoint access controlNOYAFA LF9 Pro · Xiami LF9 Pro
- CVE-2024-56916In Netbox Community 4.1.7, once authenticated, Configuration History > Add`is vulnerable to cross-site scripting (XSS) due to the `current v
- CVE-2024-56918In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileged, authenticated attacker to
- CVE-2025-50693PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Insecure Direct Object Reference (IDOR) in odms/request-details.php.
- CVE-2025-50695PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in /admin/view-booking-detail.php and /admin/
- CVE-2025-50699PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in odms/admin/view-user-queries.php.
- CVE-2025-53021A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey paraMoodle · moodle/moodle
- CVE-2025-53073In Sentry 25.1.0 through 25.5.1, an authenticated attacker can access a project's issue endpoint and perform unauthorized actions (such as aSentry