CVEs published June 27, 2025
223 CVEs were published on June 27, 2025: 22 critical, 90 high.
- Published
- 223
- Critical
- 22
- High
- 90
- Medium
- 100
- Low
- 11
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 30
Most affected products
- NixOS Nix
- 5
- Flock Safety Gunshot Detection devices
- 4
- Flock Safety License Plate Reader
- 3
- huija bicycleSharingServer
- 3
- sfturing hosp_order
- 3
- code-projects Food Distributor Site
- 2
- Imagination Technologies Graphics DDK
- 2
- lucidcrew WP Forum Server
- 2
- RooCodeInc Roo-Code
- 2
- TB-eye XRN-410SN/TE · TB-eye XRN-810SN/TE +15
- 2
Critical 22
- CVE-2025-5310Dover Fueling Solutions ProGauge MagLink LX Consoles Missing Authentication for Critical FunctionDover Fueling Solutions ProGauge MagLink LX
- CVE-2024-12143SQLi in Mobilteg Mobile Informatics' Mikro Hand Terminal - MikroDBMobilteg Mobile Informatics Mikro Hand Terminal - MikroDB
- CVE-2024-12150SQLi in Eron Software's Wowwo CRMEron Software Wowwo CRM
- CVE-2024-12364SQLi in Mavi Yeşil Software's Guest Tracking SoftwareMavi Yeşil Software Guest Tracking Software
- CVE-2024-11739SQLi in Case Informatics' Case ERPCase Informatics Case ERP
- CVE-2025-53091WeGIA has Unauthenticated Time-Based Blind SQL Injection in almox ParameterLabRedesCefetRJ WeGIA
- CVE-2025-53314WordPress WP Optimizer plugin <= 2.5.0 - Cross Site Request Forgery (CSRF) vulnerabilitysh1zen WP Optimizer
- CVE-2025-53260WordPress File Manager Plugin For Wordpress plugin <= 7.5 - Arbitrary File Upload Vulnerabilitygetredhawkstudio File Manager Plugin For Wordpress
- CVE-2025-28970WordPress WP Optimize By xTraffic plugin <= 5.1.6 - PHP Object Injection Vulnerabilitypep.vn WP Optimize By xTraffic
- CVE-2025-39474WordPress Amely theme <= 3.1.4 - SQL Injection vulnerabilityThemeMove Amely
- CVE-2025-49885WordPress Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin <= 5.0.6 - Arbitrary File Upload VulnerabilityHaruTheme Drag and Drop Multiple File Upload (Pro) - WooCom…
- CVE-2025-52717WordPress LifterLMS plugin <= 8.0.6 - SQL Injection Vulnerabilitychrisbadgett LifterLMS
- CVE-2025-52722WordPress Classiera theme <= 4.0.34 - SQL Injection VulnerabilityJoinWebs Classiera
- CVE-2025-52724WordPress Amwerk theme <= 1.2.0 - PHP Object Injection VulnerabilityBoldThemes Amwerk
- CVE-2025-52725WordPress CouponXxL theme <= 3.0.0 - PHP Object Injection Vulnerabilitypebas CouponXxL
- CVE-2025-52829WordPress DirectIQ Email Marketing plugin <= 2.0 - SQL Injection VulnerabilityDirectIQ Email Marketing
- CVE-2025-52834WordPress Homey theme <= 2.4.7 - SQL Injection vulnerabilityfavethemes Homey
- CVE-2025-23967WordPress GG Bought Together for WooCommerce plugin <= 1.0.2 - SQL Injection Vulnerabilitywpopal GG Bought Together for WooCommerce
- CVE-2025-6763Comet System H3531 Web-based Management setupA.cfg missing authenticationComet System T0510 · Comet System T3510 +8
- CVE-2024-12827DWT - Directory & Listing WordPress Theme <= 3.3.6 - Unauthenticated Arbitrary User Password Resetscriptsbundle DWT - Directory & Listing WordPress Theme
- CVE-2025-6688Simple Payment 1.3.6 - 2.3.8 - Authentication Bypass to Adminidokd Simple Payment
- CVE-2025-52207PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbitrary directory.MikoPBX
High 90
- CVE-2025-53098Roo Code Vulnerable to Potential Remote Code Execution via Model Context ProtocolRooCodeInc Roo-Code
- CVE-2025-53094ESPAsyncWebServer Vulnerable to CRLF Injection in AsyncWebHeader.cppESP32Async ESPAsyncWebServer
- CVE-2025-53093TabberNeue vulnerable to Stored XSS through wikitextStarCitizenTools mediawiki-extensions-TabberNeue · starciti…
- CVE-2025-6521TrendMakers Sight Bulb Pro Use of a Broken or Risky Cryptographic AlgorithmTrendMakers Sight Bulb Pro Firmware ZJ_CG32-2201
- CVE-2025-6705A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions.Eclipse Foundation Eclipse Open VSX Registry
- CVE-2025-36595Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Directives in Statically Saved Code ('Static Dell Unisphere for PowerMax vApp
- CVE-2025-53339WordPress Devnex Addons For Elementor plugin <= 1.0.9 - Local File Inclusion VulnerabilityDevnex Addons For Elementor
- CVE-2025-53338WordPress re.place plugin <= 0.2.1 - Cross Site Request Forgery (CSRF) Vulnerabilitydor re.place
- CVE-2025-53332WordPress Track Everything plugin <= 2.0.1 - Cross Site Request Forgery (CSRF) Vulnerabilityethoseo Track Everything
- CVE-2025-53331WordPress RSS Digest plugin <= 1.5 - Cross Site Request Forgery (CSRF) Vulnerabilitysamcharrington RSS Digest
- CVE-2025-53329WordPress Społecznościowa 6 PL 2013 plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerabilityszajenw Społecznościowa 6 PL
- CVE-2025-53317WordPress WPShapere Lite plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) VulnerabilityAcmeeDesign WPShapere - WordPress admin theme
- CVE-2025-53315WordPress Relocate Upload plugin <= 0.24.1 - Cross Site Request Forgery (CSRF) Vulnerabilityalanft Relocate Upload
- CVE-2025-53313WordPress Twitch TV Embed Suite plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) Vulnerabilityplumwd Twitch TV Embed Suite
- CVE-2025-53312WordPress OnionBuzz plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) VulnerabilityLooks Awesome OnionBuzz
- CVE-2025-53311WordPress Navayan Subscribe plugin <= 1.13 - Cross Site Request Forgery (CSRF) VulnerabilityAmol Nirmala Waman Navayan Subscribe
- CVE-2025-53310WordPress HidePost plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) VulnerabilityFunnnny HidePost
- CVE-2025-53308WordPress Image Slider With Description plugin <= 9.2 - Cross Site Request Forgery (CSRF) Vulnerabilitygopi_plus Image Slider With Description
- CVE-2025-53306WordPress WP Forum Server plugin <= 1.8.2 - SQL Injection Vulnerabilitylucidcrew WP Forum Server
- CVE-2025-53305WordPress WP Forum Server plugin <= 1.8.2 - Cross Site Request Forgery (CSRF) Vulnerabilitylucidcrew WP Forum Server
- CVE-2025-53281WordPress WPB Category Slider for WooCommerce plugin <= 1.71 - Local File Inclusion VulnerabilityWPBean WPB Category Slider for WooCommerce
- CVE-2025-53277WordPress IS-theme-companion plugin <= 1.59 - Cross Site Request Forgery (CSRF) vulnerabilityInfigo Software IS-theme-companion
- CVE-2025-53274WordPress WP Permalink Translator plugin <= 1.7.6 - Cross Site Request Forgery (CSRF) VulnerabilityHossin Asaadi WP Permalink Translator
- CVE-2025-53271WordPress Additional Order Filters for WooCommerce plugin <= 1.22 - Cross Site Request Forgery (CSRF) to Stored XSS VulnerabilityAnton Bond Additional Order Filters for WooCommerce
- CVE-2025-53259WordPress Hotel Booking plugin <= 3.7 - Local File Inclusion Vulnerabilitynicdark Hotel Booking
- CVE-2025-53258WordPress Hover Effects plugin <= 2.1.2 - SQL Injection VulnerabilityWow-Company Hover Effects
- CVE-2025-53257WordPress Gmedia Photo Gallery plugin <= 1.23.0 - Local File Inclusion VulnerabilitySerhii Pasyuk Gmedia Photo Gallery
- CVE-2025-53256WordPress YaySMTP plugin <= 2.6.6 - SQL Injection VulnerabilityYayCommerce YaySMTP
- CVE-2025-24765WordPress Image Shadow plugin <= 1.1.0 - Arbitrary File Deletion VulnerabilityRobMarsh Image Shadow
- CVE-2025-24769WordPress Zenny theme <= 1.7.5 - Local File Inclusion VulnerabilityBZOTheme Zenny
- CVE-2025-24774WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilitymojoomla WPCRM - CRM for Contact form CF7 & WooCommerce
- CVE-2025-25171WordPress WP SmartPay plugin <= 2.7.13 - Account Takeover vulnerabilityConvers Lab WP SmartPay
- CVE-2025-25173WordPress FastBook plugin <= 1.1 - Cross Site Scripting (XSS) VulnerabilityFasterThemes FastBook
- CVE-2025-27361WordPress Photo Express for Google plugin <= 0.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilitythhake Photo Express for Google
- CVE-2025-28946WordPress PrintXtore theme < 1.7.8 - Local File Inclusion vulnerabilityBZOTheme PrintXtore
- CVE-2025-28947WordPress MBStore - Digital WooCommerce WordPress Theme <= 2.3 - Local File Inclusion Vulnerabilitysnstheme MBStore - Digital WooCommerce WordPress Theme
- CVE-2025-28956WordPress Backwp plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilitywphobby Backwp
- CVE-2025-28960WordPress Evangelische Termine plugin <= 3.3 - Cross Site Scripting (XSS) Vulnerabilityregibaer Evangelische Termine
- CVE-2025-28988WordPress WP Front User Submit / Front Editor plugin <= 4.9.3 - Reflected Cross Site Scripting (XSS) vulnerabilityaharonyan WP Front User Submit / Front Editor
- CVE-2025-28990WordPress SNS Vicky theme <= 3.7 - Local File Inclusion Vulnerabilitysnstheme SNS Vicky
- CVE-2025-28993WordPress Content No Cache plugin <= 0.1.4 - Arbitrary Function Call vulnerabilityJose Mortellaro Content No Cache
- CVE-2025-28998WordPress SERPed.net plugin <= 4.6 - Local File Inclusion Vulnerabilityserpednet SERPed.net
- CVE-2025-30972WordPress Woocommerce Line Notify plugin <= 1.1.7 - Cross Site Scripting (XSS) Vulnerabilityiamapinan Woocommerce Line Notify
- CVE-2025-30992WordPress Puca theme <= 2.6.33 - Local File Inclusion Vulnerabilitythembay Puca
- CVE-2025-31067WordPress Seven Stars theme <= 1.4.4 - Cross Site Scripting (XSS) Vulnerabilitythemeton Seven Stars
- CVE-2025-31428WordPress HYDRO theme <= 2.8 - Reflected Cross Site Scripting (XSS) vulnerabilityBuddhaThemes HYDRO
- CVE-2025-32298WordPress CTUsers plugin <= 1.0.0 - Local File Inclusion VulnerabilityCase-Themes CTUsers
- CVE-2025-39478WordPress Smart Notification Plugin <= 10.3 - Reflected Cross Site Scripting (XSS) vulnerabilitysmartiolabs Smart Notification
- CVE-2025-39488WordPress MagOne theme <= 8.8 - Reflected Cross Site Scripting (XSS) vulnerabilitySneeit MagOne
- CVE-2025-47574WordPress School Management System Plugin <= 92.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilitymojoomla School Management
- CVE-2025-47654WordPress FormLift for Infusionsoft Web Forms plugin <= 7.5.20 - Reflected Cross Site Scripting (XSS) vulnerabilityAdrian Tobey FormLift for Infusionsoft Web Forms
- CVE-2025-49290WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.8.4 - Reflected Cross Site Scripting (XSS) vulnerabilityJory Hogeveen Off-Canvas Sidebars & Menus
- CVE-2025-49321WordPress Eventin plugin <= 4.0.28 - Cross Site Scripting (XSS) VulnerabilityArraytics Eventin
- CVE-2025-49883WordPress Greenmart theme <= 4.2.3 - Local File Inclusion Vulnerabilitythembay Greenmart
- CVE-2025-49886WordPress Zikzag Core plugin <= 1.4.5 - Local File Inclusion VulnerabilityWebGeniusLab Zikzag Core
- CVE-2025-50052WordPress Flexo Counter plugin <= 1.0001 - Cross Site Scripting (XSS) Vulnerabilityflexostudio Flexo Counter
- CVE-2025-52723WordPress Networker theme <= 1.2.0 - Local File Inclusion Vulnerabilitycodesupplyco Networker
- CVE-2025-52726WordPress CouponXxL Custom Post Types plugin <= 3.0 - Privilege Escalation Vulnerabilitypebas CouponXxL Custom Post Types
- CVE-2025-52727WordPress CSS3 Vertical Web Pricing Tables plugin <= 1.9 - Cross Site Scripting (XSS) VulnerabilityQuanticaLabs CSS3 Vertical Web Pricing Tables
- CVE-2025-52729WordPress Diza theme <= 1.3.9 - Local File Inclusion Vulnerabilitythembay Diza
- CVE-2025-52774WordPress Infility Global plugin <= 2.15.06 - Cross Site Scripting (XSS) vulnerabilityInfility Global
- CVE-2025-52778WordPress xili-dictionary plugin <= 2.12.5.2 - Cross Site Scripting (XSS) VulnerabilityMichel - xiligroup dev xili-dictionary
- CVE-2025-52799WordPress LMS theme <= 9.2 - Reflected Cross Site Scripting (XSS) Vulnerabilitydesignthemes LMS
- CVE-2025-52808WordPress RealtyElite theme <= 1.0.0 - Local File Inclusion Vulnerabilityreal-web RealtyElite
- CVE-2025-52809WordPress National Weather Service Alerts plugin <= 1.3.5 - Local File Inclusion VulnerabilityJohn Russell National Weather Service Alerts
- CVE-2025-52810WordPress Katerio - Magazine theme <= 1.5.1 - Local File Inclusion VulnerabilityTMRW-studio Katerio - Magazine
- CVE-2025-52811WordPress Davenport - Versatile Blog and Magazine WordPress Theme <= 1.3 - Local File Inclusion VulnerabilityCreanncy Davenport - Versatile Blog and Magazine WordPress…
- CVE-2025-52812WordPress Domnoo theme <= 1.49 - Local File Inclusion VulnerabilityApusWP Domnoo
- CVE-2025-52814WordPress BRW plugin <= 1.8.8 - Local File Inclusion Vulnerabilityovatheme BRW
- CVE-2025-52815WordPress CityGov theme <= 1.9 - Local File Inclusion VulnerabilityAncoraThemes CityGov
- CVE-2025-52816WordPress Zita theme <= 1.6.5 - Local File Inclusion Vulnerabilitythemehunk Zita
- CVE-2025-52817WordPress Abandoned Contact Form 7 plugin <= 2.2 - Broken Access Control vulnerabilityZealousWeb Abandoned Contact Form
- CVE-2025-52818WordPress Trusty Whistleblowing plugin <= 2.0.1 - Broken Access Control vulnerabilityDejan Jasnic Trusty Whistleblowing
- CVE-2025-52824WordPress Mobile DJ Manager plugin <= 1.7.8.3 - Privilege Escalation vulnerabilityMDJM Mobile DJ Manager
- CVE-2025-52826WordPress Sala theme <= 1.1.3 - PHP Object Injection Vulnerabilityuxper Sala
- CVE-2025-52827WordPress Nuss theme <= 1.3.3 - PHP Object Injection Vulnerabilityuxper Nuss
- CVE-2023-25998WordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme <= 2.6 - Local File Inclusion Vulnerabilitysnstheme Samex - Clean, Minimal Shop WooCommerce WordPress…
- CVE-2025-23973WordPress SpecFit-Virtual Try On Woocommerce plugin <= 8.0.3 - Cross Site Scripting (XSS) vulnerabilitydugudlabs SpecFit-Virtual Try On Woocommerce
- CVE-2025-24760WordPress Sofass theme <= 1.3.4 - Local File Inclusion Vulnerabilitygoalthemes Sofass
- CVE-2025-49416WordPress FW Gallery plugin <= 8.0.0 - Local File Inclusion VulnerabilityFastw3b FW Gallery
- CVE-2025-49423WordPress Bulk YouTube Post Creator plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitySyed Tahir Ali Jan Bulk YouTube Post Creator
- CVE-2025-49448WordPress FW Food Menu plugin <= 6.0.0 - Arbitrary File Deletion VulnerabilityFastw3b FW Food Menu
- CVE-2025-2940Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated Server-Side Request Forgerytechjewel Ninja Tables – Easy Data Table Builder
- CVE-2025-5306Command Injection in Netflow pathPandora FMS
- CVE-2025-36529An OS command injection issue exists in multiple versions of TB-eye network recorders and AHD recorders.TB-eye XRN-410SN/TE · TB-eye XRN-810SN/TE +15
- CVE-2025-6752Linksys WRT1900ACS/EA7200/EA7450/EA7500 IGD Layer3Forwarding SetDefaultConnectionService stack-based overflowLinksys WRT1900ACS · Linksys EA7200 +2
- CVE-2025-6751Linksys E8450 HTTP POST Request portal.cgi set_device_language buffer overflowLinksys E8450
- CVE-2025-44557A state machine transition flaw in the Bluetooth Low Energy (BLE) stack of Cypress PSoC4 v3.66 allows attackers to bypass the pairing proces
- CVE-2025-45851An issue in Hikvision DS-2CD1321-I V5.7.21 build 230819 allows attackers to cause a Denial of Service (DoS) via sending a crafted POST reque
- CVE-2025-50528A buffer overflow vulnerability exists in the fromNatStaticSetting function of Tenda AC6 <=V15.03.05.19 via the page parameter.
Medium, low and unrated 111
- CVE-2024-36347Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicAMD EPYC™ 7001 Series · AMD EPYC™ 7002 Series +36
- CVE-2025-53097Roo Code extension vulnerable to Potential Information Leakage via JSON SchemaRooCodeInc Roo-Code
- CVE-2025-6778code-projects Food Distributor Site save_settings.php cross site scriptingcode-projects Food Distributor Site
- CVE-2025-6777code-projects Food Distributor Site process_login.php sql injectioncode-projects Food Distributor Site
- CVE-2025-6776xiaoyunjie openvpn-cms-flask File Upload controller.py upload path traversalxiaoyunjie openvpn-cms-flask
- CVE-2025-6775xiaoyunjie openvpn-cms-flask User Creation Endpoint openvpn.py create_user command injectionxiaoyunjie openvpn-cms-flask
- CVE-2025-6774gooaclok819 sublinkX template.go AddTemp path traversalgooaclok819 sublinkX
- CVE-2025-6773HKUDS LightRAG File Upload document_routes.py upload_to_input_dir path traversalHKUDS LightRAG · lightrag-hku
- CVE-2025-6772eosphoros-ai db-gpt import import_flow path traversaleosphoros-ai db-gpt
- CVE-2025-6522TrendMakers Sight Bulb Pro Command InjectionTrendMakers Sight Bulb Pro Firmware ZJ_CG32-2201
- CVE-2025-46708GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMsImagination Technologies Graphics DDK
- CVE-2025-46707GPU DDK - Guest VM can override its own FW VZ connection state after the FW has close itImagination Technologies Graphics DDK
- CVE-2025-52553authentik has Insufficient Session verification for Remote Access Control endpoint accessgoauthentik authentik
- CVE-2023-38007IBM Cloud Pak System HTML injectionIBM Cloud Pak System
- CVE-2025-6768sfturing hosp_order HospitalServiceImpl.java findAllHosByCondition sql injectionsfturing hosp_order
- CVE-2025-53336WordPress My Resume Builder plugin <= 1.0.3 - Cross Site Scripting (XSS) Vulnerabilityabditsori My Resume Builder
- CVE-2025-53327WordPress Aioseo Multibyte Descriptions plugin <= 0.0.6 - Cross Site Request Forgery (CSRF) Vulnerabilityrui_mashita Aioseo Multibyte Descriptions
- CVE-2025-53325WordPress Beauty Contact Popup Form plugin <= 6.0 - Cross Site Scripting (XSS) VulnerabilityDilip kumar Beauty Contact Popup Form
- CVE-2025-53323WordPress Pre-Publish Post Checklist plugin <= 3.1 - Broken Access Control Vulnerabilitydanbriapps Pre-Publish Post Checklist
- CVE-2025-53322WordPress Accept Authorize.NET Payments Using Contact Form 7 plugin <= 2.5 - Sensitive Data Exposure VulnerabilityZealousWeb Accept Authorize.NET Payments Using Contact Form
- CVE-2025-53321WordPress Raise The Money plugin <= 5.2 - Cross Site Scripting (XSS) VulnerabilityRaise The Money
- CVE-2025-53320WordPress Free Downloads EDD plugin <= 1.0.4 - Cross Site Scripting (XSS) VulnerabilityWp Enhanced Free Downloads EDD
- CVE-2025-53318WordPress WP DB Booster plugin <= 1.0.1 - Broken Access Control VulnerabilityWPManiax WP DB Booster
- CVE-2025-53309WordPress Accept Stripe Payments Using Contact Form 7 plugin <= 3.0 - Sensitive Data Exposure VulnerabilityZealousWeb Accept Stripe Payments Using Contact Form
- CVE-2025-53304WordPress Contact Form – 7 : Hide Success Message plugin <= 1.1.4 - Broken Access Control VulnerabilityRohil Contact Form – 7 : Hide Success Message
- CVE-2025-53301WordPress Theme Junkie Team Content plugin <= 0.1.1 - Cross Site Scripting (XSS) VulnerabilityTheme Junkie Team Content
- CVE-2025-53300WordPress Podcast Feed Player Widget and Shortcode plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerabilitydouglaskarr Podcast Feed Player Widget and Shortcode
- CVE-2025-53298WordPress Plugin Inspector plugin <= 1.5 - Arbitrary File Download Vulnerabilitygioni Plugin Inspector
- CVE-2025-53296WordPress EC Stars Rating plugin <= 1.0.11 - Cross Site Scripting (XSS) Vulnerabilityecoal95 EC Stars Rating
- CVE-2025-53295WordPress iCount Payment Gateway plugin <= 2.0.7 - Broken Access Control VulnerabilityiCount Payment Gateway
- CVE-2025-53294WordPress Smart Agenda plugin <= 4.9 - Cross Site Scripting (XSS) VulnerabilitySmart Agenda
- CVE-2025-53293WordPress Dashboard Widget Sidebar plugin <= 1.2.3 - Broken Access Control VulnerabilityMorten Dalgaard Johansen Dashboard Widget Sidebar
- CVE-2025-53292WordPress WP DataTable plugin <= 0.2.7 - Cross Site Scripting (XSS) Vulnerabilitysamsk WP DataTable
- CVE-2025-53290WordPress WP Visual Sitemap plugin <= 1.0.2 - Cross Site Scripting (XSS) VulnerabilityMS WP Visual Sitemap
- CVE-2025-53288WordPress PlatiOnline Payments plugin <= 7.0.0 - Broken Access Control vulnerabilityAdrian Ladó PlatiOnline Payments
- CVE-2025-53287WordPress Quick Favicon plugin <= 0.22.8 - Cross Site Scripting (XSS) VulnerabilityRobert Cummings Quick Favicon
- CVE-2025-53285WordPress Add & Replace Affiliate Links for Amazon plugin <= 1.0.6 - Cross Site Scripting (XSS) VulnerabilityThe Website Flip Add & Replace Affiliate Links for Amazon
- CVE-2025-53284WordPress CMS Blocks plugin <= 1.1 - Broken Access Control Vulnerabilitypankaj.sakaria CMS Blocks
- CVE-2025-53282WordPress Thumbnail Editor plugin <= 2.3.3 - Cross Site Scripting (XSS) Vulnerabilityaviplugins.com Thumbnail Editor
- CVE-2025-53280WordPress Football Pool plugin <= 2.12.5 - Cross Site Scripting (XSS) VulnerabilityAntoineH Football Pool
- CVE-2025-53279WordPress Popup addon for Ninja Forms plugin <= 3.4 - Cross Site Scripting (XSS) VulnerabilityAman Popup addon for Ninja Forms
- CVE-2025-53278WordPress WP AdCenter plugin <= 2.6.0 - Cross Site Scripting (XSS) VulnerabilityWPeka WP AdCenter
- CVE-2025-53276WordPress Omnipress plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerabilityomnipressteam Omnipress
- CVE-2025-53275WordPress Leyka plugin <= 3.32.1 - Cross Site Scripting (XSS) vulnerabilityVaultDweller Leyka
- CVE-2025-53273WordPress Slickstream plugin <= 2.0.3 - Cross Site Request Forgery (CSRF) VulnerabilitySlickstream
- CVE-2025-53272WordPress Image Cleanup plugin <= 1.9.2 - Cross Site Request Forgery (CSRF) Vulnerabilityopicron Image Cleanup
- CVE-2025-53270WordPress CTA plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) VulnerabilityBlend Media WordPress CTA
- CVE-2025-53269WordPress My Wp Brand plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) Vulnerabilityimw3 My Wp Brand
- CVE-2025-53268WordPress Import external attachments plugin <= 1.5.12 - Cross Site Request Forgery (CSRF) Vulnerabilityryanpcmcquen Import external attachments
- CVE-2025-53267WordPress Hide Admin Bar From Front End plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) VulnerabilityAftab Husain Hide Admin Bar From Front End
- CVE-2025-53266WordPress Cron Logger plugin <= 1.3.0 - Broken Access Control VulnerabilityEdwardBock Cron Logger
- CVE-2025-53265WordPress Virusdie plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) VulnerabilityVirusdie
- CVE-2025-53264WordPress ONet Regenerate Thumbnails plugin <= 1.5 - Cross Site Request Forgery (CSRF) VulnerabilityKonrád Koller ONet Regenerate Thumbnails
- CVE-2025-53263WordPress Address Autocomplete via Google for Gravity Forms plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) VulnerabilityPluginsCafe Address Autocomplete via Google for Gravity For…
- CVE-2025-53262WordPress Writesonic plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerabilityWritesonic
- CVE-2025-53261WordPress WP YouTube Live plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerabilitymacbookandrew WP YouTube Live
- CVE-2025-53255WordPress HurryTimer plugin <= 2.13.1 - Broken Access Control VulnerabilityNabil Lemsieh HurryTimer
- CVE-2025-53254WordPress Cyrlitera plugin <= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerabilityThemeisle Cyrlitera
- CVE-2025-53253WordPress WP Edit plugin <= 4.0.4 - Cross Site Scripting (XSS) VulnerabilityJosh WP Edit
- CVE-2025-53211WordPress Audio Editor & Recorder plugin <= 2.2.3 - Sensitive Data Exposure VulnerabilityRoland Beaussant Audio Editor & Recorder
- CVE-2025-53206WordPress HT Mega – Absolute Addons for WPBakery Page Builder plugin <= 1.0.8 - Cross Site Scripting (XSS) VulnerabilityHT Plugins HT Mega – Absolute Addons for WPBakery Page Buil…
- CVE-2025-53203WordPress WooCommerce PDF Invoice Builder plugin <= 1.2.148 - Cross Site Request Forgery (CSRF) VulnerabilityEDGARROJAS WooCommerce PDF Invoice Builder
- CVE-2025-53202WordPress Responsive Blocks plugin <= 2.0.6 - Cross Site Scripting (XSS) VulnerabilityCyberChimps Responsive Blocks
- CVE-2025-53200WordPress ChatBot plugin <= 6.7.3 - Broken Access Control VulnerabilityQuantumCloud ChatBot
- CVE-2025-53199WordPress HT Slider For Elementor plugin <= 1.6.5 - Cross Site Scripting (XSS) VulnerabilityHT Plugins HT Slider For Elementor
- CVE-2025-53197WordPress Cookiebot plugin <= 4.5.8 - Cross Site Request Forgery (CSRF) VulnerabilityCookiebot
- CVE-2025-53193WordPress Burst Statistics plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) VulnerabilityBurst Statistics B.V. Burst Statistics
- CVE-2025-6767sfturing hosp_order DoctorServiceImpl.java findDoctorByCondition sql injectionsfturing hosp_order
- CVE-2025-53018Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLsLycheeOrg Lychee
- CVE-2025-6766sfturing hosp_order OfficeServiceImpl.java getOfficeName sql injectionsfturing hosp_order
- CVE-2025-40910Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addressesNet-IP-LPM
- CVE-2025-6765Intelbras InControl HTTP PUT Request operador permissionIntelbras InControl
- CVE-2025-32281WordPress DarkMySite plugin <= 1.2.8 - Cross Site Request Forgery (CSRF) vulnerabilityDarkMySite
- CVE-2025-6762diyhi bbs HTTP Header login getUrl server-side request forgerydiyhi bbs
- CVE-2025-6761Kingdee Cloud-Starry-Sky Enterprise Edition Freemarker Engine DynamicForm 4 Action.class plugin.buildMobilePopHtml special elements used in a template engineKingdee Cloud-Starry-Sky Enterprise Edition
- CVE-2025-5398Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTIkstover Ninja Forms – The Contact Form Builder That Grows W…
- CVE-2025-5936VR Calendar <= 2.4.7 - Cross-Site Request Forgery to Calendar Syncinnate-images-llc VR Calendar
- CVE-2025-5940Osom Blocks <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via class_name Parameterosompress Osom Blocks
- CVE-2025-6550The Pack Elementor addon <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingwebangon The Pack Elementor addon
- CVE-2025-4587A/B Testing for WordPress <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingjohnjamesjacoby A/B Testing for WordPress
- CVE-2025-6689FL3R Accessibility Suite <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via fl3raccessibilitysuite Shortcodearmandofiore FL3R Accessibility Suite
- CVE-2025-5526BuddyPress Docs < 2.2.5 - Subscriber+ Arbitrary Document Read/UpdateBuddyPress Docs
- CVE-2025-5194WP Map Block by aBlocks < 2.0.3 - Contributor+ Stored XSS via MarkerWP Map Block
- CVE-2025-5093Responsive Lightbox & Gallery < 2.5.2 - Contributor+ Stored XSSResponsive Lightbox & Gallery
- CVE-2025-5035Firelight Lightbox < 2.3.16 - Contributor+ Stored XSSFirelight Lightbox
- CVE-2025-41418Buffer Overflow vulnerability exists in multiple versions of TB-eye network recorders and AHD recorders.TB-eye XRN-410SN/TE · TB-eye XRN-810SN/TE +15
- CVE-2025-6488isMobile <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via device Parameterjairoochoa isMobile() Shortcode for WordPress
- CVE-2025-6753huija bicycleSharingServer AdminController.java selectAdminByNameLike sql injectionhuija bicycleSharingServer
- CVE-2025-6750HDF5 H5Omtime.c H5O__mtime_new_encode heap-based overflowHDF5
- CVE-2025-6749huija bicycleSharingServer AdminController.java searchAdminMessageShow sql injectionhuija bicycleSharingServer
- CVE-2025-6748Bharti Airtel Thanks App files cleartext storage in a file or on diskBharti Airtel Thanks App
- CVE-2025-6738huija bicycleSharingServer UserServiceImpl.java userDao.selectUserByUserNameLike sql injectionhuija bicycleSharingServer
- CVE-2025-44163RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php.billz/raspap-webgui
- CVE-2025-44559An issue in the Bluetooth Low Energy (BLE) stack of Realtek RTL8762E BLE SDK v1.4.0 allows attackers within Bluetooth range to cause a Denia
- CVE-2025-45729D-Link DIR-823-Pro 1.02 has improper permission control, allowing unauthorized users to turn on and access Telnet services.
- CVE-2025-45737An issue in NetEase (Hangzhou) Network Co., Ltd NeacSafe64 Driver before v1.0.0.8 allows attackers to escalate privileges via sending crafte
- CVE-2025-46415A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders.NixOS Nix
- CVE-2025-46416The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user accNixOS Nix
- CVE-2025-47818Flock Safety Gunshot Detection devices before 1.3 have a hard-coded password for a connection.Flock Safety Gunshot Detection devices
- CVE-2025-47819Flock Safety Gunshot Detection devices before 1.3 have an on-chip debug interface with improper access control.Flock Safety Gunshot Detection devices
- CVE-2025-47820Flock Safety Gunshot Detection devices before 1.3 have cleartext storage of code.Flock Safety Gunshot Detection devices
- CVE-2025-47821Flock Safety Gunshot Detection devices before 1.3 have a hardcoded password for a system.Flock Safety Gunshot Detection devices
- CVE-2025-47822Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have an on-chip debug interface with improper access control.Flock Safety License Plate Reader
- CVE-2025-47823Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system.Flock Safety License Plate Reader
- CVE-2025-47824Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have cleartext storage of code.Flock Safety License Plate Reader
- CVE-2025-50367A stored blind XSS vulnerability exists in the Contact Page of the Phpgurukul Medical Card Generation System 1.0 mcgs/contact.php.
- CVE-2025-50369A Cross-Site Request Forgery (CSRF) vulnerability exists in the Manage Card functionality (/mcgs/admin/manage-card.php) of PHPGurukul Medica
- CVE-2025-50370A Cross-Site Request Forgery (CSRF) vulnerability exists in the Inquiry Management functionality /mcgs/admin/readenq.php of the Phpgurukul M
- CVE-2025-52991The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location.NixOS Nix
- CVE-2025-52992The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails.NixOS Nix
- CVE-2025-52993A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the builNixOS Nix