# CVEs published 2025-06-26

116 CVEs were published on June 26, 2025: 16 critical, 29 high. Days are UTC.

- [CVE-2025-6736](https://cve.now/CVE-2025-6736.md): juzaweb CMS Add New Themes Page install improper authorization (CVSS 5.3, juzaweb CMS · juzaweb/cms)
- [CVE-2025-6735](https://cve.now/CVE-2025-6735.md): juzaweb CMS Import Page imports improper authorization (CVSS 5.3, juzaweb CMS · juzaweb/cms)
- [CVE-2025-6734](https://cve.now/CVE-2025-6734.md): UTT HiPER 840G API formP2PLimitConfig sub\_484E40 buffer overflow (CVSS 8.7, UTT HiPER)
- [CVE-2025-3699](https://cve.now/CVE-2025-3699.md): Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation G-50 all versions, G-50-W all versions, G-50A (CVSS 9.8, Mitsubishi Electric G-50 · Mitsubishi Electric G-50-W +25)
- [CVE-2025-6733](https://cve.now/CVE-2025-6733.md): UTT HiPER 840G API formConfigDnsFilterGlobal sub\_416928 buffer overflow (CVSS 8.7, UTT HiPER)
- [CVE-2025-6732](https://cve.now/CVE-2025-6732.md): UTT HiPER 840G API setSysAdm strcpy buffer overflow (CVSS 8.7, UTT HiPER)
- [CVE-2025-6731](https://cve.now/CVE-2025-6731.md): yzcheng90 X-SpringBoot APK File apk uploadApk path traversal (CVSS 5.3, yzcheng90 X-SpringBoot)
- [CVE-2025-5731](https://cve.now/CVE-2025-5731.md): Infinispan: credential leakage in infinispan cli (CVSS 5.5, Red Hat infinispan · Red Hat Data Grid +2)
- [CVE-2015-0849](https://cve.now/CVE-2015-0849.md): pycode-browser before version 1.0 is prone to a predictable temporary file vulnerability. (CVSS 3.9, pycode-browser)
- [CVE-2015-0843](https://cve.now/CVE-2015-0843.md): yubiserver before 0.6 is prone to buffer overflows due to misuse of sprintf. (CVSS 9.8, yubiserver)
- [CVE-2015-0842](https://cve.now/CVE-2015-0842.md): yubiserver before 0.6 is prone to SQL injection issues, potentially leading to an authentication bypass. (CVSS 9.8, yubiserver)
- [CVE-2014-6274](https://cve.now/CVE-2014-6274.md): S3 and Glacier remotes creds embedded in the git repo were not encrypted (CVSS 7.5, git-annex)
- [CVE-2014-7210](https://cve.now/CVE-2014-7210.md): pdns specific as packaged in Debian in version before 3.3.1-1 creates a too privileged MySQL user. (CVSS 9.8, Debian pdns)
- [CVE-2014-0468](https://cve.now/CVE-2014-0468.md): Vulnerability in fusionforge in the shipped Apache configuration, where the web server may execute scripts that the users would have upload (CVSS 9.8, fusionforge)
- [CVE-2025-52555](https://cve.now/CVE-2025-52555.md): CephFS Permission Escalation Vulnerability in Ceph Fuse mounted FS (CVSS 6.5, ceph)
- [CVE-2013-1424](https://cve.now/CVE-2013-1424.md): Buffer overflow vulnerability in matplotlib.This issue affects matplotlib: before upstream commit ba4016014cb4fb4927e36ce8ea429fed47dcb787. (CVSS 5.6, matplotlib)
- [CVE-2025-53122](https://cve.now/CVE-2025-53122.md): SQLi in OpenNMS Horizon and Meridian (CVSS 6.9, The OpenNMS Group Horizon · The OpenNMS Group Meridian)
- [CVE-2025-49592](https://cve.now/CVE-2025-49592.md): n8n Login Flow has Open Redirect Vulnerability (CVSS 4.6, n8n-io n8n · n8n)
- [CVE-2025-5995](https://cve.now/CVE-2025-5995.md): Canon EOS Webcam Utility Pro for MAC OS contains an insecure permission issue potentially leading to code execution and privilege escalation (CVSS 4.6, Canon USA Canon EOS Webcam Utility Pro)
- [CVE-2025-53121](https://cve.now/CVE-2025-53121.md): Stored XSS in multiple 33.0.8files in opennms/opennms (CVSS 6.9, The OpenNMS Group Horizon · The OpenNMS Group Meridian)
- [CVE-2025-52904](https://cve.now/CVE-2025-52904.md): File Browser: Command Execution not Limited to Scope (CVSS 8.0, filebrowser · github.com/filebrowser/filebrowser/v2 +1)
- [CVE-2025-52903](https://cve.now/CVE-2025-52903.md): File Browser Allows Execution of Shell Commands That Can Spawn Other Commands (CVSS 8.0, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2025-53013](https://cve.now/CVE-2025-53013.md): Himmelblau offline auth permits authentication with invalid Hello PIN (CVSS 5.2, himmelblau-idm himmelblau)
- [CVE-2025-52477](https://cve.now/CVE-2025-52477.md): Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow (CVSS 8.6, octo-sts app · github.com/octo-sts/app)
- [CVE-2025-34047](https://cve.now/CVE-2025-34047.md): Leadsec VPN Path Traversal Arbitrary File Read (CVSS 8.7, Beijing NetGuard Nebula Information Technology Co. Leadsec…)
- [CVE-2025-6702](https://cve.now/CVE-2025-6702.md): linlinjava litemall post improper authorization (CVSS 5.3, linlinjava litemall)
- [CVE-2025-6701](https://cve.now/CVE-2025-6701.md): Xuxueli xxl-sso doLogin redirect (CVSS 5.1, Xuxueli xxl-sso · com.xuxueli:xxl-sso)
- [CVE-2025-34049](https://cve.now/CVE-2025-34049.md): OptiLink ONT1GEW GPON Remote Code Execution (CVSS 9.4, OptiLink ONT1GEW GPON)
- [CVE-2025-34048](https://cve.now/CVE-2025-34048.md): D-Link DSL-2730U/2750U/2750E Path Traversal Arbitrary File Read (CVSS 8.7, D-Link DSL-2730U · D-Link DSL-2750U +1)
- [CVE-2025-34046](https://cve.now/CVE-2025-34046.md): Fanwei E-Office Unauthenticated File Upload (CVSS 10.0, Shanghai Fanwei Network Technology E-Office)
- [CVE-2025-34045](https://cve.now/CVE-2025-34045.md): WeiPHP Path Traversal Arbitrary File Read (CVSS 8.7, Shenzhen Yuanmengyun Technology Co. WeiPHP)
- [CVE-2025-34044](https://cve.now/CVE-2025-34044.md): WIFISKY 7-Layer Flow Control Router Remote Command Execution (CVSS 9.4, Shenzhen Lingkong Technology WIFISKY 7-layer flow control r…)
- [CVE-2025-34043](https://cve.now/CVE-2025-34043.md): Vacron NVR Remote Command Execution (CVSS 10.0, Vacron Network Video Recorder)
- [CVE-2025-34042](https://cve.now/CVE-2025-34042.md): Beward N100 IP Camera Remote Command Execution (CVSS 9.4, Beward N100 IP Camera)
- [CVE-2025-6700](https://cve.now/CVE-2025-6700.md): Xuxueli xxl-sso login cross site scripting (CVSS 5.3, Xuxueli xxl-sso · com.xuxueli:xxl-sso)
- [CVE-2025-6699](https://cve.now/CVE-2025-6699.md): LabRedesCefetRJ WeGIA Cadastro de Funcionário cadastro\_funcionario.php cross site scripting (CVSS 5.1, LabRedesCefetRJ WeGIA)
- [CVE-2025-36034](https://cve.now/CVE-2025-36034.md): IBM InfoSphere DataStage Flow Designer information disclosure (CVSS 5.3, IBM InfoSphere Information Server)
- [CVE-2025-6698](https://cve.now/CVE-2025-6698.md): LabRedesCefetRJ WeGIA Adicionar tipo adicionar\_tipoSaida.php cross site scripting (CVSS 5.1, LabRedesCefetRJ WeGIA)
- [CVE-2025-6697](https://cve.now/CVE-2025-6697.md): LabRedesCefetRJ WeGIA Adicionar tipo adicionar\_tipoEntrada.php cross site scripting (CVSS 5.1, LabRedesCefetRJ WeGIA)
- [CVE-2025-53007](https://cve.now/CVE-2025-53007.md): arduino-esp32 vulnerable to CRLF injection in WebServer.cpp (CVSS 8.9, espressif arduino-esp32)
- [CVE-2025-53002](https://cve.now/CVE-2025-53002.md): LLaMA-Factory Remote Code Execution (RCE) Vulnerability (CVSS 8.3, hiyouga LLaMA-Factory · llamafactory)
- [CVE-2025-52902](https://cve.now/CVE-2025-52902.md): File Browser has Stored Cross-Site Scripting vulnerability (CVSS 7.6, filebrowser · github.com/filebrowser/filebrowser/v2 +1)
- [CVE-2025-52900](https://cve.now/CVE-2025-52900.md): File Browser has Insecure File Permissions (CVSS 5.5, filebrowser · github.com/filebrowser/filebrowser/v2 +1)
- [CVE-2025-52887](https://cve.now/CVE-2025-52887.md): cpp-httplib has unlimited number of http header fields, which causes memory leak (CVSS 7.5, yhirose cpp-httplib)
- [CVE-2025-6696](https://cve.now/CVE-2025-6696.md): LabRedesCefetRJ WeGIA Cadastro de Atendio Cadastro\_Atendido.php cross site scripting (CVSS 5.1, LabRedesCefetRJ WeGIA)
- [CVE-2025-6710](https://cve.now/CVE-2025-6710.md): Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDB (CVSS 7.5, MongoDB Server)
- [CVE-2025-52573](https://cve.now/CVE-2025-52573.md): Command Injection in MCP Server ios-simulator-mcp (CVSS 6.0, joshuayoes ios-simulator-mcp · ios-simulator-mcp)
- [CVE-2025-6709](https://cve.now/CVE-2025-6709.md): Pre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC Authentication (CVSS 7.5, MongoDB Server)
- [CVE-2025-6707](https://cve.now/CVE-2025-6707.md): Race condition in privilege cache invalidation cycle (CVSS 4.2, MongoDB Server)
- [CVE-2025-6706](https://cve.now/CVE-2025-6706.md): Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server (CVSS 5.0, MongoDB Server)
- [CVE-2025-49003](https://cve.now/CVE-2025-49003.md): Dataease H2 JDBC Connection Remote Code Execution (CVSS 8.9, dataease)
- [CVE-2025-6677](https://cve.now/CVE-2025-6677.md): Paragraphs table - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-084 (CVSS 5.4, Drupal Paragraphs table · drupal/paragraphs\_table)
- [CVE-2025-6676](https://cve.now/CVE-2025-6676.md): Simple XML sitemap - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-083 (CVSS 5.4, Drupal Simple XML sitemap · drupal/simple\_sitemap)
- [CVE-2025-6675](https://cve.now/CVE-2025-6675.md): Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-082 (CVSS 4.8, Enterprise MFA - TFA for Drupal · drupal/miniorange\_2fa)
- [CVE-2025-6674](https://cve.now/CVE-2025-6674.md): CKEditor5 Youtube - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-081 (CVSS 6.1, Drupal CKEditor5 Youtube · drupal/ckeditor5\_youtube)
- [CVE-2025-5682](https://cve.now/CVE-2025-5682.md): Klaro Cookie & Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-080 (CVSS 4.3, Drupal Klaro Cookie & Consent Management · drupal/klaro)
- [CVE-2025-48921](https://cve.now/CVE-2025-48921.md): Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079 (CVSS 8.8, Drupal Open Social)
- [CVE-2025-48922](https://cve.now/CVE-2025-48922.md): GLightbox - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-078 (CVSS 6.1, Drupal GLightbox · drupal/glightbox)
- [CVE-2025-48923](https://cve.now/CVE-2025-48923.md): Toc.js - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-077 (CVSS 6.1, Drupal Toc.js · drupal/toc\_js)
- [CVE-2025-6695](https://cve.now/CVE-2025-6695.md): LabRedesCefetRJ WeGIA Additional Categoria adicionar\_categoria.php cross site scripting (CVSS 5.1, LabRedesCefetRJ WeGIA)
- [CVE-2025-6694](https://cve.now/CVE-2025-6694.md): LabRedesCefetRJ WeGIA Adicionar Unidade adicionar\_unidade.php cross site scripting (CVSS 5.1, LabRedesCefetRJ WeGIA)
- [CVE-2025-6693](https://cve.now/CVE-2025-6693.md): RT-Thread device.c sys\_device\_write memory corruption (CVSS 8.5, RT-Thread)
- [CVE-2025-5966](https://cve.now/CVE-2025-5966.md): Stored XSS (CVSS 8.1, ManageEngine Exchange Reporter Plus)
- [CVE-2025-5366](https://cve.now/CVE-2025-5366.md): Stored XSS (CVSS 8.1, ManageEngine Exchange Reporter Plus)
- [CVE-2025-6562](https://cve.now/CVE-2025-6562.md): Hunt Electronic Hybrid DVR - OS Command Injection (CVSS 8.7, Hunt Electronic Hybrid DVR)
- [CVE-2025-6561](https://cve.now/CVE-2025-6561.md): Hunt Electronic Hybrid DVR - Exposure of Sensitive System Information (CVSS 9.8, Hunt Electronic HBF-09KD · Hunt Electronic HBF-16NK)
- [CVE-2025-3773](https://cve.now/CVE-2025-3773.md): A sensitive information exposure vulnerability in System Information Reporter (SIR) 1.0.3 and prior allows an authenticated non-admin local (CVSS 0.0, Trellix System Information Reporter)
- [CVE-2025-3722](https://cve.now/CVE-2025-3722.md): A path traversal vulnerability in System Information Reporter (SIR) 1.0.3 and prior allowed an authenticated high privileged user to issue (CVSS 0.0, Trellix System Information Reporter)
- [CVE-2025-3771](https://cve.now/CVE-2025-3771.md): A path or symbolic link manipulation vulnerability in SIR 1.0.3 and prior versions allows an authenticated non-admin local user to overwrite (CVSS 7.2, Trellix System Information Reporter)
- [CVE-2025-6703](https://cve.now/CVE-2025-6703.md): transport/fc.rs: panic attempting to send MAX\_DATA with value larger max varint (CVSS 2.3, Mozilla neqo)
- [CVE-2024-11584](https://cve.now/CVE-2024-11584.md): cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, (CVSS 5.9, Canonical cloud-init)
- [CVE-2025-6212](https://cve.now/CVE-2025-6212.md): Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module (CVSS 7.2, themefic Ultra Addons for Contact Form)
- [CVE-2025-5338](https://cve.now/CVE-2025-5338.md): Royal Elementor Addons \<= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets (CVSS 6.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2025-5842](https://cve.now/CVE-2025-5842.md): Modern Design Library \<= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter (CVSS 6.4, butterflymedia Modern Design Library)
- [CVE-2024-6174](https://cve.now/CVE-2024-6174.md): When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. (CVSS 8.8, Canonical cloud-init)
- [CVE-2025-5459](https://cve.now/CVE-2025-5459.md): OS Command Injection (CVSS 8.6, Perforce Puppet Enterprise)
- [CVE-2025-48497](https://cve.now/CVE-2025-48497.md): Cross-site request forgery vulnerability exists in iroha Board versions v0.10.12 and earlier. (CVSS 4.3, iroha Soft Co. iroha Board)
- [CVE-2025-41404](https://cve.now/CVE-2025-41404.md): Direct request ('Forced Browsing') issue exists in iroha Board versions v0.10.12 and earlier. (CVSS 4.3, iroha Soft Co. iroha Board)
- [CVE-2025-1754](https://cve.now/CVE-2025-1754.md): Missing Authentication for Critical Function in GitLab (CVSS 5.3, GitLab)
- [CVE-2025-2938](https://cve.now/CVE-2025-2938.md): Business Logic Errors in GitLab (CVSS 3.1, GitLab)
- [CVE-2025-3279](https://cve.now/CVE-2025-3279.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-5315](https://cve.now/CVE-2025-5315.md): Missing Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-5846](https://cve.now/CVE-2025-5846.md): Missing Authorization in GitLab (CVSS 2.7, GitLab)
- [CVE-2025-37101](https://cve.now/CVE-2025-37101.md): HPE OneView for VMware vCenter (OV4VC), Local Elevation of Privilege (CVSS 8.7, Hewlett Packard Enterprise HPE OneView for VMware vCenter)
- [CVE-2025-6624](https://cve.now/CVE-2025-6624.md): Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug (CVSS 2.4, snyk · github.com/snyk/go-application-framework)
- [CVE-2025-6540](https://cve.now/CVE-2025-6540.md): web-cam \<= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug Parameter (CVSS 6.4, murtuzamakda52 web-cam)
- [CVE-2025-5813](https://cve.now/CVE-2025-5813.md): Amazon Products to WooCommerce \<= 1.2.7 - Missing Authorization to Unauthenticated Arbitrary Product Creation (CVSS 5.3, suhailahmad64 Amazon Products to WooCommerce)
- [CVE-2025-6546](https://cve.now/CVE-2025-6546.md): Drive Folder Embedder \<= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via tablecssclass Parameter (CVSS 6.4, azumbro Drive Folder Embedder)
- [CVE-2025-5275](https://cve.now/CVE-2025-5275.md): Charitable \<= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings (CVSS 4.4, smub Charitable – Donation Plugin for WordPress – Fundraisi…)
- [CVE-2025-6537](https://cve.now/CVE-2025-6537.md): Namasha By Mdesign \<= 1.2.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via playicon\_title Parameter (CVSS 6.4, mdesignfa Namasha By Mdesign)
- [CVE-2025-5932](https://cve.now/CVE-2025-5932.md): Homerunner \<= 1.0.30 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, coolrunner Homerunner)
- [CVE-2025-5929](https://cve.now/CVE-2025-5929.md): The Countdown \<= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via clientId Parameter (CVSS 6.4, zourbuth The Countdown – Block Countdown Timer)
- [CVE-2025-5559](https://cve.now/CVE-2025-5559.md): TimeZoneCalculator \<= 3.37 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, neoxx TimeZoneCalculator)
- [CVE-2025-5540](https://cve.now/CVE-2025-5540.md): Event RSVP and Simple Event Management Plugin \<= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, emarket-design Event RSVP and Simple Event Management Plugin)
- [CVE-2025-6258](https://cve.now/CVE-2025-6258.md): WP SoundSystem \<= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsstm-track Shortcode (CVSS 6.4, grosbouff WP SoundSystem)
- [CVE-2025-5564](https://cve.now/CVE-2025-5564.md): GC Social wall \<= 1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, gurievcreative GC Social Wall)
- [CVE-2025-4334](https://cve.now/CVE-2025-4334.md): Simple User Registration \<= 6.3 - Unauthenticated Privilege Escalation (CVSS 9.8, nmedia Simple User Registration)
- [CVE-2025-6383](https://cve.now/CVE-2025-6383.md): WP-PhotoNav \<= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photonav Shortcode (CVSS 6.4, fmos WP-PhotoNav)
- [CVE-2025-6290](https://cve.now/CVE-2025-6290.md): Tournament Bracket Generator \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via bracket Shortcode (CVSS 6.4, blakelong Tournament Bracket Generator)
- [CVE-2025-5812](https://cve.now/CVE-2025-5812.md): VG WORT METIS \<= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update (CVSS 4.3, vgwort VG WORT METIS)
- [CVE-2025-6378](https://cve.now/CVE-2025-6378.md): Responsive Food and Drink Menu \<= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via display\_pdf\_menus Shortcode (CVSS 6.4, corporatezen222 Responsive Food and Drink Menu)
- [CVE-2025-6538](https://cve.now/CVE-2025-6538.md): Post Rating and Review \<= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter (CVSS 6.4, bourgesloic Post Rating and Review)
- [CVE-2025-3863](https://cve.now/CVE-2025-3863.md): Post Carousel Slider for Elementor \<= 1.6.0 - Authenticated (Subscriber+) Missing Authorization via process\_wbelps\_promo\_form Function (CVSS 4.3, plugindevs Post Carousel Slider for Elementor)
- [CVE-2025-5590](https://cve.now/CVE-2025-5590.md): Owl carousel responsive \<= 1.9 - Authenticated (Contributor+) SQL Injection via id Parameter (CVSS 8.8, gopiplus Owl carousel responsive)
- [CVE-2025-5488](https://cve.now/CVE-2025-5488.md): WP Masonry & Infinite Scroll \<= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, kaushik07 WP Masonry & Infinite Scroll)
- [CVE-2025-5535](https://cve.now/CVE-2025-5535.md): e.nigma buttons \<= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, chemiker e.nigma buttons)
- [CVE-2025-5588](https://cve.now/CVE-2025-5588.md): Image Editor by Pixo \<= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via download Parameter (CVSS 6.4, ickata Image Editor by Pixo)
- [CVE-2024-52928](https://cve.now/CVE-2024-52928.md): Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites (with previously granted permissions) to add new p (CVSS 9.6)
- [CVE-2024-56915](https://cve.now/CVE-2024-56915.md): Netbox Community v4.1.7 and fixed in v.4.2.2 is vulnerable to Cross Site Scripting (XSS) via the RSS feed widget. (CVSS 6.5)
- [CVE-2025-29331](https://cve.now/CVE-2025-29331.md): An issue in MHSanaei 3x-ui before v.2.5.3 and before allows a remote attacker to execute arbitrary code via the management script x-ui passe (CVSS 9.8)
- [CVE-2025-30131](https://cve.now/CVE-2025-30131.md): An issue was discovered on IROAD Dashcam FX2 devices. (CVSS 9.8)
- [CVE-2025-44141](https://cve.now/CVE-2025-44141.md): A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30. (CVSS 6.1)
- [CVE-2025-49603](https://cve.now/CVE-2025-49603.md): Northern.tech Mender Server before 3.7.11 and 4.x before 4.0.1 has Incorrect Access Control. (CVSS 9.1)
- [CVE-2025-50350](https://cve.now/CVE-2025-50350.md): PHPGurukul Pre-School Enrollment System Project v1.0 is vulnerable to Directory Traversal in manage-classes.php. (CVSS 5.4)
- [CVE-2025-51671](https://cve.now/CVE-2025-51671.md): A SQL injection vulnerability was discovered in the PHPGurukul Dairy Farm Shop Management System 1.3. (CVSS 5.4)
- [CVE-2025-51672](https://cve.now/CVE-2025-51672.md): A time-based blind SQL injection vulnerability was identified in the PHPGurukul Dairy Farm Shop Management System 1.3. (CVSS 8.0)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-06-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.