# CVEs published 2025-06-24

120 CVEs were published on June 24, 2025: 27 critical, 38 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-6582](https://cve.now/CVE-2025-6582.md): SourceCodester Best Salon Management System edit-customer-detailed.php sql injection (CVSS 5.3, SourceCodester Best Salon Management System)
- [CVE-2025-6581](https://cve.now/CVE-2025-6581.md): SourceCodester Best Salon Management System add-customer.php sql injection (CVSS 5.3, SourceCodester Best Salon Management System)
- [CVE-2025-6580](https://cve.now/CVE-2025-6580.md): SourceCodester Best Salon Management System Login sql injection (CVSS 6.9, SourceCodester Best Salon Management System)
- [CVE-2025-52884](https://cve.now/CVE-2025-52884.md): risc0-ethereum-contracts allows invalid commitment with digest value of zero to be accepted by Steel.validateCommitment (CVSS 1.7, risc0-ethereum · risc0-ethereum-contracts)
- [CVE-2025-52883](https://cve.now/CVE-2025-52883.md): Meshtastic-Android vulnerable to forged DMs with no PKC showing up as encrypted (CVSS 5.3, Meshtastic-Android)
- [CVE-2025-52572](https://cve.now/CVE-2025-52572.md): Hikka vulnerable to RCE through dangling web interface (CVSS 10.0, hikariatama Hikka)
- [CVE-2025-52571](https://cve.now/CVE-2025-52571.md): Hikka vulnerable to RCE through edits in a channel (CVSS 9.7, hikariatama Hikka)
- [CVE-2025-6557](https://cve.now/CVE-2025-6557.md): Insufficient data validation in DevTools in Google Chrome on Windows prior to 138.0.7204.49 allowed a remote attacker who convinced a user t (CVSS 5.4, Google Chrome)
- [CVE-2025-6556](https://cve.now/CVE-2025-6556.md): Insufficient policy enforcement in Loader in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to bypass content security polic (CVSS 5.4, Google Chrome)
- [CVE-2025-6555](https://cve.now/CVE-2025-6555.md): Use after free in Animation in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to potentially exploit heap corruption via a c (CVSS 5.4, Google Chrome)
- [CVE-2025-52882](https://cve.now/CVE-2025-52882.md): Claude Code IDE extensions allow websocket connections from arbitrary origins (CVSS 8.8, anthropics claude-code · @anthropic-ai/claude-code)
- [CVE-2025-6579](https://cve.now/CVE-2025-6579.md): code-projects Car Rental System message\_admin.php sql injection (CVSS 6.9, code-projects Car Rental System)
- [CVE-2025-6578](https://cve.now/CVE-2025-6578.md): code-projects Simple Online Hotel Reservation System delete\_account.php sql injection (CVSS 6.9, code-projects Simple Online Hotel Reservation System)
- [CVE-2025-52880](https://cve.now/CVE-2025-52880.md): Komga Vulnerable to Arbitrary Code Execution via Crafted EPUB File (CVSS 4.2, gotson komga)
- [CVE-2025-52471](https://cve.now/CVE-2025-52471.md): ESP-NOW Integer Underflow Vulnerability Advisory (CVSS 7.2, espressif esp-idf)
- [CVE-2025-52888](https://cve.now/CVE-2025-52888.md): Allure 2's xunit-xml-plugin Vulnerable to Improper XXE Restriction (CVSS 7.5, allure-framework allure2 · io.qameta.allure.plugins:xuni… +2)
- [CVE-2025-49853](https://cve.now/CVE-2025-49853.md): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in ControlID iDSecure On-premises (CVSS 9.3, ControlID iDSecure On-premises)
- [CVE-2025-49852](https://cve.now/CVE-2025-49852.md): Server-Side Request Forgery (SSRF) in ControlID iDSecure On-premises (CVSS 8.7, ControlID iDSecure On-premises)
- [CVE-2025-49851](https://cve.now/CVE-2025-49851.md): Improper Authentication in ControlID iDSecure On-premises (CVSS 8.7, ControlID iDSecure On-premises)
- [CVE-2025-5087](https://cve.now/CVE-2025-5087.md): Cleartext Transmission of Sensitive Information in Kaleris Navis N4 (CVSS 6.0, Kaleris Navis N4)
- [CVE-2025-2566](https://cve.now/CVE-2025-2566.md): Deserialization of Untrusted Data in Kaleris Navis N4 (CVSS 9.3, Kaleris Navis N4)
- [CVE-2025-49147](https://cve.now/CVE-2025-49147.md): Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements (CVSS 5.3, Umbraco-CMS · Umbraco.Cms)
- [CVE-2025-23260](https://cve.now/CVE-2025-23260.md): NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount at (CVSS 5.0, NVIDIA AIS Operator)
- [CVE-2025-4378](https://cve.now/CVE-2025-4378.md): Hardcoded Credentials in Ataturk University's ATA-AOF Mobile Application (CVSS 10.0, Ataturk University ATA-AOF Mobile Application)
- [CVE-2025-6570](https://cve.now/CVE-2025-6570.md): PHPGurukul Hospital Management System search.php sql injection (CVSS 5.3, PHPGurukul Hospital Management System)
- [CVE-2025-23265](https://cve.now/CVE-2025-23265.md): NVIDIA Megatron-LM for all platforms contains a vulnerability in a python component where an attacker may cause a code injection issue by pr (CVSS 7.8, NVIDIA Megatron LM)
- [CVE-2025-23264](https://cve.now/CVE-2025-23264.md): NVIDIA Megatron-LM for all platforms contains a vulnerability in a python component where an attacker may cause a code injection issue by pr (CVSS 7.8, NVIDIA Megatron LM)
- [CVE-2025-4383](https://cve.now/CVE-2025-4383.md): Authentication Bypass in Art-In Systems' Wi-Fi Cloud Hotspot (CVSS 9.3, Art-in Bilişim Teknolojileri ve Yazılım Hizm. Tic. Ltd. Şti…)
- [CVE-2025-6569](https://cve.now/CVE-2025-6569.md): code-projects School Fees Payment System student.php cross site scripting (CVSS 5.3, code-projects School Fees Payment System)
- [CVE-2025-6568](https://cve.now/CVE-2025-6568.md): TOTOLINK EX1200T HTTP POST Request formIpv6Setup buffer overflow (CVSS 8.7, TOTOLINK EX1200T)
- [CVE-2025-6567](https://cve.now/CVE-2025-6567.md): Campcodes Online Recruitment Management System view\_application.php sql injection (CVSS 6.9, Campcodes Online Recruitment Management System)
- [CVE-2025-36537](https://cve.now/CVE-2025-36537.md): Incorrect Permission Assignment for Critical Resource in TeamViewer Remote Management (CVSS 7.0, TeamViewer Full Client · TeamViewer Host)
- [CVE-2025-5318](https://cve.now/CVE-2025-5318.md): Libssh: out-of-bounds read in sftp\_handle() (CVSS 5.4, libssh · Red Hat Enterprise Linux +3)
- [CVE-2025-6032](https://cve.now/CVE-2025-6032.md): Podman: podman missing tls verification (CVSS 8.3, podman · Red Hat Enterprise Linux +6)
- [CVE-2025-6566](https://cve.now/CVE-2025-6566.md): oatpp Oat++ Deserializer.cpp deserializeArray stack-based overflow (CVSS 6.9, oatpp Oat++)
- [CVE-2025-6565](https://cve.now/CVE-2025-6565.md): Netgear WNCE3001 HTTP POST Request http\_d stack-based overflow (CVSS 8.7, Netgear WNCE3001)
- [CVE-2025-6436](https://cve.now/CVE-2025-6436.md): Memory safety bugs fixed in Firefox 140 and Thunderbird 140 (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-6435](https://cve.now/CVE-2025-6435.md): Save as in Devtools could download files without sanitizing the extension (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-6434](https://cve.now/CVE-2025-6434.md): HTTPS-Only exception screen lacked anti-clickjacking delay (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-6433](https://cve.now/CVE-2025-6433.md): WebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificate (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-6432](https://cve.now/CVE-2025-6432.md): DNS Requests leaked outside of a configured SOCKS proxy (CVSS 8.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-6431](https://cve.now/CVE-2025-6431.md): The prompt in Firefox for Android that asks before opening a link in an external application could be bypassed (CVSS 6.5, Mozilla Firefox)
- [CVE-2025-6428](https://cve.now/CVE-2025-6428.md): Firefox for Android opened URLs specified in a link querystring parameter (CVSS 4.3, Mozilla Firefox)
- [CVE-2025-6427](https://cve.now/CVE-2025-6427.md): connect-src Content Security Policy restriction could be bypassed (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-6430](https://cve.now/CVE-2025-6430.md): Content-Disposition header ignored when a file is included in an embed or object tag (CVSS 6.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-6429](https://cve.now/CVE-2025-6429.md): Incorrect parsing of URLs could have allowed embedding of youtube.com (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-6426](https://cve.now/CVE-2025-6426.md): No warning when opening executable terminal files on macOS (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-6425](https://cve.now/CVE-2025-6425.md): The WebCompat WebExtension shipped with Firefox exposed a persistent UUID (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-6424](https://cve.now/CVE-2025-6424.md): Use-after-free in FontFaceSet (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-39205](https://cve.now/CVE-2025-39205.md): A vulnerability exists in the IEC 61850 in MicroSCADA X SYS600 product. (CVSS 6.5, Hitachi Energy MicroSCADA X SYS600)
- [CVE-2025-39204](https://cve.now/CVE-2025-39204.md): A vulnerability exists in the Web interface of the MicroSCADA X SYS600 product. (CVSS 8.5, Hitachi Energy MicroSCADA X SYS600)
- [CVE-2025-39203](https://cve.now/CVE-2025-39203.md): A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product. (CVSS 6.5, Hitachi Energy MicroSCADA X SYS600)
- [CVE-2025-39202](https://cve.now/CVE-2025-39202.md): A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product. (CVSS 8.3, Hitachi Energy MicroSCADA X SYS600)
- [CVE-2025-39201](https://cve.now/CVE-2025-39201.md): A vulnerability exists in MicroSCADA X SYS600 product. (CVSS 6.1, Hitachi Energy MicroSCADA X SYS600)
- [CVE-2025-2403](https://cve.now/CVE-2025-2403.md): A denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanism exists in Relion 670/650 and S (CVSS 7.5, Hitachi Energy Relion 670/650 and SAM600-IO)
- [CVE-2025-1718](https://cve.now/CVE-2025-1718.md): An authenticated user with file access privilege via FTP access can cause the Relion 670/650 and SAM600-IO series device to reboot due to im (CVSS 6.5, Hitachi Energy Relion 670/650 and SAM600-IO)
- [CVE-2025-6206](https://cve.now/CVE-2025-6206.md): Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit \<= 2.5.0 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 7.5, CodeRevolution Aiomatic - Automatic AI Content Writer & Edi…)
- [CVE-2025-3092](https://cve.now/CVE-2025-3092.md): MB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT24 (CVSS 7.5, Helmholz myREX24 · Helmholz myREX24.virtual +2)
- [CVE-2025-3091](https://cve.now/CVE-2025-3091.md): MB connect line: Authorization bypass in mbCONNECT24/mymbCONNECT24 (CVSS 7.5, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2025-3090](https://cve.now/CVE-2025-3090.md): MB connect line: Missing Authentication in mbCONNECT24/mymbCONNECT24 (CVSS 8.2, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2025-5258](https://cve.now/CVE-2025-5258.md): Conference Scheduler \<= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter (CVSS 6.4, swift Conference Scheduler)
- [CVE-2025-50213](https://cve.now/CVE-2025-50213.md): Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator (CVSS 9.8, Apache Software Foundation Apache Airflow Providers Snowfla…)
- [CVE-2025-2962](https://cve.now/CVE-2025-2962.md): Infinite loop in dns\_copy\_qname (CVSS 8.2, zephyrproject-rtos Zephyr)
- [CVE-2025-48890](https://cve.now/CVE-2025-48890.md): WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilit (CVSS 9.8, ELECOM CO. WRH-733GBK · ELECOM CO. WRH-733GWH)
- [CVE-2025-43879](https://cve.now/CVE-2025-43879.md): WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilit (CVSS 9.8, ELECOM CO. WRH-733GBK · ELECOM CO. WRH-733GWH)
- [CVE-2025-43877](https://cve.now/CVE-2025-43877.md): WRC-1167GHBK2-S contains a stored cross-site scripting vulnerability in WebGUI. (CVSS 5.4, ELECOM CO. WRC-1167GHBK2-S)
- [CVE-2025-41427](https://cve.now/CVE-2025-41427.md): WRC-X3000GS, WRC-X3000GSA, and WRC-X3000GSN contain an improper neutralization of special elements used in an OS command ('OS Command Inject (CVSS 8.8, ELECOM CO. WRC-X3000GS · ELECOM CO. WRC-X3000GSA +1)
- [CVE-2025-36519](https://cve.now/CVE-2025-36519.md): Unrestricted upload of file with dangerous type issue exists in WRC-2533GST2, WRC-1167GST2, WRC-2533GST2, WRC-2533GS2V-B,WRC-2533GS2-B v1.69 (CVSS 4.3, ELECOM CO. WRC-2533GST2 · ELECOM CO. WRC-1167GST2 +5)
- [CVE-2025-47943](https://cve.now/CVE-2025-47943.md): Gogs stored XSS in PDF renderer (CVSS 6.3, gogs · gogs.io/gogs +1)
- [CVE-2024-56731](https://cve.now/CVE-2024-56731.md): Gogs deletion of internal files allows remote command execution (CVSS 10.0, gogs · gogs.io/gogs)
- [CVE-2025-52566](https://cve.now/CVE-2025-52566.md): llama.cpp tokenizer signed vs. unsigned heap overflow (CVSS 8.6, ggml-org llama.cpp)
- [CVE-2025-52570](https://cve.now/CVE-2025-52570.md): Letmein connection limiter allows an arbitrary amount of simultaneous connections (CVSS 1.7, mbuesch letmein · letmeind +1)
- [CVE-2025-52568](https://cve.now/CVE-2025-52568.md): NeKernal Multiple Memory Corruption Vulnerabilities in mkfs.hefs (CVSS 8.8, nekernel-org nekernel)
- [CVE-2025-52560](https://cve.now/CVE-2025-52560.md): Kanboard Password Reset Poisoning via Host Header Injection (CVSS 8.1, kanboard)
- [CVE-2025-52574](https://cve.now/CVE-2025-52574.md): SysmonElixir path traversal in /read endpoint allows arbitrary file read (CVSS 7.5, bocaletto-luca elixir-system-monitor)
- [CVE-2025-48470](https://cve.now/CVE-2025-48470.md): Stored Cross site Scripting (XSS) (CVSS 4.1, Advantech Wireless Sensing and Equipment)
- [CVE-2025-48469](https://cve.now/CVE-2025-48469.md): Unauthenticated Firmware Upload (CVSS 9.6, Advantech Wireless Sensing and Equipment)
- [CVE-2025-48468](https://cve.now/CVE-2025-48468.md): Open JTAG Debug Port (CVSS 6.4, Advantech Wireless Sensing and Equipment)
- [CVE-2025-48467](https://cve.now/CVE-2025-48467.md): Denial of Service via Malformed Modbus Packets (CVSS 6.5, Advantech Wireless Sensing and Equipment)
- [CVE-2025-48466](https://cve.now/CVE-2025-48466.md): Modbus Command Injection without Authentication (CVSS 8.1, Advantech Wireless Sensing and Equipment)
- [CVE-2025-48463](https://cve.now/CVE-2025-48463.md): Unencrypted HTTP Communication (CVSS 3.1, Advantech Wireless Sensing and Equipment)
- [CVE-2025-48462](https://cve.now/CVE-2025-48462.md): Login Session Exhaustion (CVSS 4.2, Advantech Wireless Sensing and Equipment)
- [CVE-2025-48461](https://cve.now/CVE-2025-48461.md): Weak Session Cookie Entropy (CVSS 5.0, Advantech Wireless Sensing and Equipment)
- [CVE-2025-6560](https://cve.now/CVE-2025-6560.md): Sapido Wireless Router - Exposure of Sensitive Information (CVSS 9.3, Sapido BR071n · Sapido BR261c +10)
- [CVE-2025-6552](https://cve.now/CVE-2025-6552.md): java-aodeng Hope-Boot Login WebController.java doLogin redirect (CVSS 5.3, java-aodeng Hope-Boot)
- [CVE-2025-6559](https://cve.now/CVE-2025-6559.md): Sapido Wireless Router - OS Command Injection (CVSS 9.3, Sapido BR071n · Sapido BR261c +10)
- [CVE-2025-34041](https://cve.now/CVE-2025-34041.md): Sangfor Endpoint Detection and Response OS Command Injection (CVSS 10.0, Sangfor Technologies Co. Endpoint Detection and Response Pl…)
- [CVE-2025-6551](https://cve.now/CVE-2025-6551.md): java-aodeng Hope-Boot WebController.java login cross site scripting (CVSS 5.1, java-aodeng Hope-Boot)
- [CVE-2025-6536](https://cve.now/CVE-2025-6536.md): Tarantool datetime.c tm\_to\_datetime assertion (CVSS 4.8, Tarantool)
- [CVE-2025-34040](https://cve.now/CVE-2025-34040.md): Seeyon Zhiyuan OA System Path Traversal File Upload (CVSS 10.0, Seeyon (Beijing Zhiyuan Internet Software Co., Ltd.) Zhiyua…)
- [CVE-2025-34039](https://cve.now/CVE-2025-34039.md): Yonyou NC BeanShell Command Injection (CVSS 10.0, Yonyou Co. UFIDA NC)
- [CVE-2025-34038](https://cve.now/CVE-2025-34038.md): Weaver E-cology SQL Injection (CVSS 8.7, Weaver E-cology)
- [CVE-2025-34037](https://cve.now/CVE-2025-34037.md): Linksys Routers E/WAG/WAP/WES/WET/WRT-Series (CVSS 10.0, Linksys E4200 · Linksys E3200 +9)
- [CVE-2025-34036](https://cve.now/CVE-2025-34036.md): Shenzhen TVT CCTV-DVR Command Injection (CVSS 10.0, Shenzhen TVT CCTV-DVR)
- [CVE-2025-34035](https://cve.now/CVE-2025-34035.md): EnGenius EnShare IoT Gigabit Cloud Service Command Injection (CVSS 10.0, EnGenius EnShare IoT Gigabit Cloud Service)
- [CVE-2025-6535](https://cve.now/CVE-2025-6535.md): xxyopen/201206030 novel-plus User Management Module UserMapper.xml list sql injection (CVSS 5.3, xxyopen novel-plus · 201206030 novel-plus)
- [CVE-2025-34034](https://cve.now/CVE-2025-34034.md): 5VTechnologies Blue Angel Software Suite Hardcoded Credentials (CVSS 9.3, 5VTechnologies Blue Angel Software Suite)
- [CVE-2025-34033](https://cve.now/CVE-2025-34033.md): 5VTechnologies Blue Angel Software Suite OS Command Injection (CVSS 7.7, 5VTechnologies Blue Angel Software Suite)
- [CVE-2025-34032](https://cve.now/CVE-2025-34032.md): Moodle LMS Jmol Plugin Cross-site Scripting (XSS) (CVSS 5.1, Moodle Jmol Plugin)
- [CVE-2025-34031](https://cve.now/CVE-2025-34031.md): Moodle LMS Jmol Plugin Path Traversal (CVSS 8.7, Moodle Jmol Plugin)
- [CVE-2025-6534](https://cve.now/CVE-2025-6534.md): xxyopen/201206030 novel-plus File FileController.java remove resource injection (CVSS 2.3, xxyopen novel-plus · 201206030 novel-plus)
- [CVE-2025-6533](https://cve.now/CVE-2025-6533.md): xxyopen/201206030 novel-plus CATCHA LoginController.java ajaxLogin authentication replay (CVSS 6.3, xxyopen novel-plus · 201206030 novel-plus)
- [CVE-2025-6532](https://cve.now/CVE-2025-6532.md): NOYAFA/Xiami LF9 Pro RTSP Live Video Stream Endpoint access control (CVSS 5.3, NOYAFA LF9 Pro · Xiami LF9 Pro)
- [CVE-2021-41691](https://cve.now/CVE-2021-41691.md): A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student\_id" and "TRANSFER{SCHOOL\]" para (CVSS 9.8)
- [CVE-2024-37743](https://cve.now/CVE-2024-37743.md): An issue in mmzdev KnowledgeGPT V.0.0.5 allows a remote attacker to execute arbitrary code via the Document Display Component. (CVSS 9.8)
- [CVE-2024-56916](https://cve.now/CVE-2024-56916.md): In Netbox Community 4.1.7, once authenticated, Configuration History \> Add\`is vulnerable to cross-site scripting (XSS) due to the \`current v (CVSS 6.1)
- [CVE-2024-56917](https://cve.now/CVE-2024-56917.md): Netbox Community 4.1.7 is vulnerable to Cross Site Scripting (XSS) via the maintenance banner\` in maintenance mode. (CVSS 7.1)
- [CVE-2024-56918](https://cve.now/CVE-2024-56918.md): In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileged, authenticated attacker to (CVSS 6.1)
- [CVE-2025-27827](https://cve.now/CVE-2025-27827.md): A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.2.0.3 could allow an unauthenticated attacker to (CVSS 7.1)
- [CVE-2025-27828](https://cve.now/CVE-2025-27828.md): A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4, 10.1.0.0 through 10.1.0.5, and 10.2.0.0 th (CVSS 7.1)
- [CVE-2025-32975](https://cve.now/CVE-2025-32975.md): Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (CVSS 10.0, KEV)
- [CVE-2025-32976](https://cve.now/CVE-2025-32976.md): Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (CVSS 8.8)
- [CVE-2025-32977](https://cve.now/CVE-2025-32977.md): Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (CVSS 9.6)
- [CVE-2025-32978](https://cve.now/CVE-2025-32978.md): Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (CVSS 7.5)
- [CVE-2025-44531](https://cve.now/CVE-2025-44531.md): An issue in Realtek RTL8762EKF-EVB RTL8762E SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted before a pa (CVSS 7.5)
- [CVE-2025-50693](https://cve.now/CVE-2025-50693.md): PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Insecure Direct Object Reference (IDOR) in odms/request-details.php. (CVSS 6.5)
- [CVE-2025-50695](https://cve.now/CVE-2025-50695.md): PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in /admin/view-booking-detail.php and /admin/ (CVSS 6.1)
- [CVE-2025-50699](https://cve.now/CVE-2025-50699.md): PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in odms/admin/view-user-queries.php. (CVSS 6.1)
- [CVE-2025-53021](https://cve.now/CVE-2025-53021.md): A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey para (CVSS 4.2, Moodle · moodle/moodle)
- [CVE-2025-53073](https://cve.now/CVE-2025-53073.md): In Sentry 25.1.0 through 25.5.1, an authenticated attacker can access a project's issue endpoint and perform unauthorized actions (such as a (CVSS 4.2, Sentry)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-06-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.