CVEs published June 25, 2025
120 CVEs were published on June 25, 2025: 8 critical, 44 high. 2 are now in CISA KEV.
- Published
- 120
- Critical
- 8
- High
- 44
- Medium
- 52
- Low
- 16
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 27
Most affected products
- PDF-XChange Editor
- 23
- Autel MaxiCharger AC Wallbox Commercial
- 10
- SourceCodester Best Salon Management System
- 7
- code-projects Inventory Management System
- 4
- D-Link DIR-619L
- 4
- TOTOLINK CA300-PoE
- 4
- Cisco Identity Services Engine Software
- 3
- Microsens NMP Web+
- 3
- Pioneer DMH-WT7600NEX
- 3
- Adobe Commerce · magento/project-community-edition +1
- 2
Critical 8
- CVE-2025-36038IBM WebSphere Application Server code executionIBM WebSphere Application Server
- CVE-2025-49153Path Traversal in MICROSENS NMP Web+Microsens NMP Web+
- CVE-2025-49151Use of Hard-coded, Security-relevant Constants in MICROSENS NMP Web+Microsens NMP Web+
- CVE-2025-20282Cisco ISE API Unauthenticated Remote Code Execution VulnerabilityCisco Identity Services Engine Software
- CVE-2025-20281Cisco ISE API Unauthenticated Remote Code Execution VulnerabilityCisco Identity Services Engine Software
- CVE-2021-4457ZoomSounds < 6.05 - Unauthenticated Arbitrary File UploadZoomSounds
- CVE-2025-6543Memory overflow vulnerability leading to unintended control flow and Denial of ServiceNetScaler ADC · NetScaler Gateway
- CVE-2024-51978Authentication bypass via default password generation affecting multiple models from Brother Industries, Ltd, Toshiba Tec, and Konica Minolta, Inc.Brother Industries DCP-J928N-W/B · Brother Industries… +572
High 44
- CVE-2025-6640PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution VulnerabilityPDF-XChange Editor
- CVE-2025-6642PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityPDF-XChange Editor
- CVE-2025-6644PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution VulnerabilityPDF-XChange Editor
- CVE-2025-6645PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution VulnerabilityPDF-XChange Editor
- CVE-2025-6647PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityPDF-XChange Editor
- CVE-2025-6651PDF-XChange Editor JP2 File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityPDF-XChange Editor
- CVE-2025-6654PDF-XChange Editor PRC File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityPDF-XChange Editor
- CVE-2025-6659PDF-XChange Editor PRC File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityPDF-XChange Editor
- CVE-2025-6660PDF-XChange Editor GIF File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityPDF-XChange Editor
- CVE-2025-6661PDF-XChange Editor App Object Use-After-Free Remote Code Execution VulnerabilityPDF-XChange Editor
- CVE-2025-6443Mikrotik RouterOS VXLAN Source IP Improper Access Control VulnerabilityMikrotik RouterOS
- CVE-2025-6627TOTOLINK A702R HTTP POST Request formIpv6Setup buffer overflowTOTOLINK A702R
- CVE-2025-5825Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution VulnerabilityAutel MaxiCharger AC Wallbox Commercial
- CVE-2025-6678Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure VulnerabilityAutel MaxiCharger AC Wallbox Commercial
- CVE-2025-5830Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution VulnerabilityAutel MaxiCharger AC Wallbox Commercial
- CVE-2025-5827Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution VulnerabilityAutel MaxiCharger AC Wallbox Commercial
- CVE-2025-5822Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation VulnerabilityAutel MaxiCharger AC Wallbox Commercial
- CVE-2025-6445ServiceStack FindType Directory Traversal Remote Code Execution VulnerabilityServiceStack
- CVE-2025-52999jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested dataFasterXML jackson-core · com.fasterxml.jackson.core:jackson…
- CVE-2025-6617D-Link DIR-619L formAdvanceSetup stack-based overflowD-Link DIR-619L
- CVE-2025-52890Incus vulnerable to antispoofing nftables firewall rule bypass on bridge networks with ACLslxc incus · github.com/lxc/incus/v6 +1
- CVE-2025-52483Registrator.jl Vulnerable to Argument Injection and Command InjectionJuliaRegistries Registrator.jl
- CVE-2025-52480Registrator.jl Argument Injection VulnerabilityJuliaRegistries Registrator.jl
- CVE-2025-49152Insufficient Session Expiration in MICROSENS NMP Web+Microsens NMP Web+
- CVE-2025-6616D-Link DIR-619L formSetWAN_Wizard51 stack-based overflowD-Link DIR-619L
- CVE-2025-5015Parsons AccuWeather Widget Cross-site ScriptingParsons Utility Enterprise Data Management · Parsons Aclara…
- CVE-2025-52479HTTP.jl vulnerable to CR/LF Injection in URIsJuliaWeb HTTP.jl
- CVE-2025-6615D-Link DIR-619L formAutoDetecWAN_wizard4 stack-based overflowD-Link DIR-619L
- CVE-2025-6614D-Link DIR-619L formSetWANType_Wizard5 stack-based overflowD-Link DIR-619L
- CVE-2025-48954Discourse vulnerable to XSS via user-provided query parameter in oauth failure flowdiscourse
- CVE-2025-49797Multiple Brother driver installers for Windows contain a privilege escalation vulnerability.BROTHER INDUSTRIES Multiple driver installers for Window… +1
- CVE-2025-5927Everest Forms (Pro) <= 1.9.4 - Unauthenticated Path Traversal to Arbitrary File DeletionWPEverest Everest Forms Pro
- CVE-2025-41255Cyberduck and Mountain Duck - Improper Certificate Store Handlingiterate Cyberduck · iterate Mountain Duck
- CVE-2025-41256Cyberduck and Mountain Duck - Weak Hash Algorithm for Certificate Fingerprintiterate Cyberduck · iterate Mountain Duck
- CVE-2024-51983Unauthenticated Denial of Service (DoS) via malformed WS-Scan request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.Brother Industries HL-L8260CDN · Brother Industries HL… +673
- CVE-2024-51982Unauthenticated Denial of Service (DoS) via malformed PJL request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, and Ricoh.Brother Industries HL-L8260CDN · Brother Industries HL… +205
- CVE-2024-51979Authenticated stack based buffer overflow affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, and Konica Minolta, Inc.Brother Industries HL-L8260CDN · Brother Industries HL… +602
- CVE-2025-0966IBM InfoSphere Information Server SQL injectionIBM InfoSphere Information Server
- CVE-2025-36004IBM i privilege escalationIBM i
- CVE-2023-44915A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scrip
- CVE-2024-27685SQL Injection vulnerability in Student Record system Using PHP and MySQL v.3.20 allows a remote attacker to obtain sensitive information via
- CVE-2025-25905Cross-Site Scripting (XSS) vulnerability in CADClick v1.13.0 and before allows remote attackers to inject arbitrary web script or HTML via t
- CVE-2025-45332vkoskiv c-ray 1.1 contains a Null Pointer Dereference (NPD) vulnerability in the parse_mtllib function of its data processing module, leadin
- CVE-2025-45333berkeley-abc abc 1.1 contains a Null Pointer Dereference (NPD) vulnerability in the Abc_NtkCecFraigPart function of its data processing modu
Medium, low and unrated 68
- CVE-2025-6669gooaclok819 sublinkX jwt.go hard-coded keygooaclok819 sublinkX
- CVE-2025-6668code-projects Inventory Management System fetchSelectedBrand.php sql injectioncode-projects Inventory Management System
- CVE-2025-6667code-projects Car Rental System add_cars.php unrestricted uploadcode-projects Car Rental System
- CVE-2025-6641PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2025-6643PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2025-6646PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2025-6648PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2025-6649PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2025-6650PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2025-6652PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2025-6653PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2025-6655PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2025-6656PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2025-6657PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2025-6658PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2025-6662PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2025-6665code-projects Inventory Management System editBrand.php sql injectioncode-projects Inventory Management System
- CVE-2025-6664CodeAstro Patient Record Management System cross-site request forgeryCodeAstro Patient Record Management System
- CVE-2025-5829Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution VulnerabilityAutel MaxiCharger AC Wallbox Commercial
- CVE-2025-5823Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure VulnerabilityAutel MaxiCharger AC Wallbox Commercial
- CVE-2025-5828Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution VulnerabilityAutel MaxiCharger AC Wallbox Commercial
- CVE-2025-5826Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input VulnerabilityAutel MaxiCharger AC Wallbox Commercial
- CVE-2025-6621TOTOLINK CA300-PoE ap.so QuickSetting os command injectionTOTOLINK CA300-PoE
- CVE-2025-6620TOTOLINK CA300-PoE upgrade.so setUpgradeUboot os command injectionTOTOLINK CA300-PoE
- CVE-2025-5824Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass VulnerabilityAutel MaxiCharger AC Wallbox Commercial
- CVE-2025-5833Pioneer DMH-WT7600NEX Root Filesystem Insufficient Verification of Data Authenticity VulnerabilityPioneer DMH-WT7600NEX
- CVE-2025-5834Pioneer DMH-WT7600NEX Missing Immutable Root of Trust in Hardware Local Privilege Escalation VulnerabilityPioneer DMH-WT7600NEX
- CVE-2025-5832Pioneer DMH-WT7600NEX Software Update Signing Insufficient Verification of Data Authenticity VulnerabilityPioneer DMH-WT7600NEX
- CVE-2025-49550Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · magento/project-community-edition +1
- CVE-2025-6444ServiceStack GetErrorResponse Improper Input Validation NTLM Relay VulnerabilityServiceStack
- CVE-2025-49549Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · magento/project-community-edition +1
- CVE-2025-6619TOTOLINK CA300-PoE upgrade.so setUpgradeFW os command injectionTOTOLINK CA300-PoE
- CVE-2025-6618TOTOLINK CA300-PoE wps.so SetWLanApcliSettings os command injectionTOTOLINK CA300-PoE
- CVE-2025-52894OpenBao Vulnerable to Unauthenticated Rekey Operation Cancellationopenbao · github.com/openbao/openbao
- CVE-2025-52893OpenBao May Leak Sensitive Information in Logs When Processing Malformed Dataopenbao · github.com/openbao/openbao/sdk +1
- CVE-2025-6442Ruby WEBrick read_header HTTP Request Smuggling VulnerabilityRuby WEBrick · webrick
- CVE-2025-52889Incus vulnerable to DoS through antispoofing nftables firewall rule bypass on bridge networks with ACLslxc incus · github.com/lxc/incus/v6 +1
- CVE-2025-52576Kanboard vulnerable to Username Enumeration via Login Behavior and Bruteforce Protection Bypasskanboard
- CVE-2025-52569GitHub.jl lacks validation for user-provided fieldsJuliaWeb GitHub.jl
- CVE-2025-4656Vault Vulnerable to Recovery Key Cancellation Denial of ServiceHashiCorp Vault · github.com/hashicorp/vault
- CVE-2025-20264Cisco Identity Services Engine Authorization Bypass VulnerabilityCisco Identity Services Engine Software
- CVE-2025-50179Tuleap missing CSRF protection on tracker reports manipulationEnalean tuleap
- CVE-2025-49845Discourse users are able to see their own whispers even after being removed from a group that has been configured to see whispersdiscourse
- CVE-2025-6612code-projects Inventory Management System removeCategories.php sql injectioncode-projects Inventory Management System
- CVE-2025-6611code-projects Inventory Management System createBrand.php sql injectioncode-projects Inventory Management System
- CVE-2025-50178GitForge.jl lacks validation for user provided fieldsJuliaWeb GitForge.jl
- CVE-2025-49135CVAT missing validation for in-progress backup upload namescvat-ai cvat
- CVE-2025-6610itsourcecode Employee Management System editempprofile.php sql injectionitsourcecode Employee Management System
- CVE-2025-6609SourceCodester Best Salon Management System bwdates-reports-details.php sql injectionSourceCodester Best Salon Management System
- CVE-2025-6608SourceCodester Best Salon Management System edit-services.php sql injectionSourceCodester Best Salon Management System
- CVE-2025-48991Tuleap missing CSRF protection on tracker canned responses administrationEnalean tuleap
- CVE-2025-6607SourceCodester Best Salon Management System stock.php sql injectionSourceCodester Best Salon Management System
- CVE-2025-6606SourceCodester Best Salon Management System add-services.php sql injectionSourceCodester Best Salon Management System
- CVE-2025-6605SourceCodester Best Salon Management System edit-staff.php sql injectionSourceCodester Best Salon Management System
- CVE-2025-6604SourceCodester Best Salon Management System add-staff.php sql injectionSourceCodester Best Salon Management System
- CVE-2025-25012Kibana Open RedirectElastic Kibana
- CVE-2025-6603coldfunction qCUDA qcow.c qcow_make_empty integer overflowcoldfunction qCUDA
- CVE-2025-41647Lenze: Plaintext Password Disclosure in PLC Designer V4 InterfaceLenze PLC Designer
- CVE-2025-6613PHPGurukul Hospital Management System manage-patient.php cross site scriptingPHPGurukul Hospital Management System
- CVE-2024-51984Authenticated disclosure of external service passwords via pass-back attack affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.Brother Industries HL-L8260CDN · Brother Industries HL… +704
- CVE-2024-51981Unauthenticated Server Side Request Forgery (SSRF) via WS-Eventing affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, and Toshiba Tec, and Konica Minolta, Inc.Brother Industries HL-L8260CDN · Brother Industries HL… +662
- CVE-2024-51980Unauthenticated Server Side Request Forgery (SSRF) via WS-Addressing affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.Brother Industries HL-L8260CDN · Brother Industries HL… +667
- CVE-2024-51977Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.Brother Industries HL-L8260CDN · Brother Industries DC… +422
- CVE-2025-43880Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6.GROWI
- CVE-2025-5585SiteOrigin Widgets Bundle <= 1.68.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-url` DOM Element Attributegpriday SiteOrigin Widgets Bundle
- CVE-2025-6583SourceCodester Best Salon Management System view-appointment.php sql injectionSourceCodester Best Salon Management System
- CVE-2024-57708An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.
- CVE-2025-44206Hexagon HxGN OnCall Dispatch Advantage (Web) v10.2309.03.00264 and Hexagon HxGN OnCall Dispatch Advantage (Mobile) v10.2402 are vulnerable t