# CVEs published 2025-06-27

223 CVEs were published on June 27, 2025: 22 critical, 90 high. Days are UTC.

- [CVE-2024-36347](https://cve.now/CVE-2024-36347.md): Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malic (CVSS 6.4, AMD EPYC™ 7001 Series · AMD EPYC™ 7002 Series +36)
- [CVE-2025-53098](https://cve.now/CVE-2025-53098.md): Roo Code Vulnerable to Potential Remote Code Execution via Model Context Protocol (CVSS 8.1, RooCodeInc Roo-Code)
- [CVE-2025-53097](https://cve.now/CVE-2025-53097.md): Roo Code extension vulnerable to Potential Information Leakage via JSON Schema (CVSS 5.9, RooCodeInc Roo-Code)
- [CVE-2025-6778](https://cve.now/CVE-2025-6778.md): code-projects Food Distributor Site save\_settings.php cross site scripting (CVSS 4.8, code-projects Food Distributor Site)
- [CVE-2025-6777](https://cve.now/CVE-2025-6777.md): code-projects Food Distributor Site process\_login.php sql injection (CVSS 6.9, code-projects Food Distributor Site)
- [CVE-2025-6776](https://cve.now/CVE-2025-6776.md): xiaoyunjie openvpn-cms-flask File Upload controller.py upload path traversal (CVSS 6.9, xiaoyunjie openvpn-cms-flask)
- [CVE-2025-6775](https://cve.now/CVE-2025-6775.md): xiaoyunjie openvpn-cms-flask User Creation Endpoint openvpn.py create\_user command injection (CVSS 5.3, xiaoyunjie openvpn-cms-flask)
- [CVE-2025-53094](https://cve.now/CVE-2025-53094.md): ESPAsyncWebServer Vulnerable to CRLF Injection in AsyncWebHeader.cpp (CVSS 8.7, ESP32Async ESPAsyncWebServer)
- [CVE-2025-6774](https://cve.now/CVE-2025-6774.md): gooaclok819 sublinkX template.go AddTemp path traversal (CVSS 5.3, gooaclok819 sublinkX)
- [CVE-2025-6773](https://cve.now/CVE-2025-6773.md): HKUDS LightRAG File Upload document\_routes.py upload\_to\_input\_dir path traversal (CVSS 4.8, HKUDS LightRAG · lightrag-hku)
- [CVE-2025-6772](https://cve.now/CVE-2025-6772.md): eosphoros-ai db-gpt import import\_flow path traversal (CVSS 6.9, eosphoros-ai db-gpt)
- [CVE-2025-53093](https://cve.now/CVE-2025-53093.md): TabberNeue vulnerable to Stored XSS through wikitext (CVSS 8.6, StarCitizenTools mediawiki-extensions-TabberNeue · starciti…)
- [CVE-2025-5310](https://cve.now/CVE-2025-5310.md): Dover Fueling Solutions ProGauge MagLink LX Consoles Missing Authentication for Critical Function (CVSS 9.8, Dover Fueling Solutions ProGauge MagLink LX)
- [CVE-2025-6522](https://cve.now/CVE-2025-6522.md): TrendMakers Sight Bulb Pro Command Injection (CVSS 5.4, TrendMakers Sight Bulb Pro Firmware ZJ\_CG32-2201)
- [CVE-2025-6521](https://cve.now/CVE-2025-6521.md): TrendMakers Sight Bulb Pro Use of a Broken or Risky Cryptographic Algorithm (CVSS 7.6, TrendMakers Sight Bulb Pro Firmware ZJ\_CG32-2201)
- [CVE-2025-46708](https://cve.now/CVE-2025-46708.md): GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs (CVSS 4.3, Imagination Technologies Graphics DDK)
- [CVE-2024-12143](https://cve.now/CVE-2024-12143.md): SQLi in Mobilteg Mobile Informatics' Mikro Hand Terminal - MikroDB (CVSS 9.8, Mobilteg Mobile Informatics Mikro Hand Terminal - MikroDB)
- [CVE-2025-46707](https://cve.now/CVE-2025-46707.md): GPU DDK - Guest VM can override its own FW VZ connection state after the FW has close it (CVSS 5.2, Imagination Technologies Graphics DDK)
- [CVE-2024-12150](https://cve.now/CVE-2024-12150.md): SQLi in Eron Software's Wowwo CRM (CVSS 9.8, Eron Software Wowwo CRM)
- [CVE-2024-12364](https://cve.now/CVE-2024-12364.md): SQLi in Mavi Yeşil Software's Guest Tracking Software (CVSS 9.8, Mavi Yeşil Software Guest Tracking Software)
- [CVE-2024-11739](https://cve.now/CVE-2024-11739.md): SQLi in Case Informatics' Case ERP (CVSS 9.8, Case Informatics Case ERP)
- [CVE-2025-53091](https://cve.now/CVE-2025-53091.md): WeGIA has Unauthenticated Time-Based Blind SQL Injection in almox Parameter (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-52553](https://cve.now/CVE-2025-52553.md): authentik has Insufficient Session verification for Remote Access Control endpoint access (CVSS 5.5, goauthentik authentik)
- [CVE-2025-6705](https://cve.now/CVE-2025-6705.md): A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. (CVSS 7.6, Eclipse Foundation Eclipse Open VSX Registry)
- [CVE-2023-38007](https://cve.now/CVE-2023-38007.md): IBM Cloud Pak System HTML injection (CVSS 5.4, IBM Cloud Pak System)
- [CVE-2025-36595](https://cve.now/CVE-2025-36595.md): Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Directives in Statically Saved Code ('Static (CVSS 7.2, Dell Unisphere for PowerMax vApp)
- [CVE-2025-6768](https://cve.now/CVE-2025-6768.md): sfturing hosp\_order HospitalServiceImpl.java findAllHosByCondition sql injection (CVSS 5.3, sfturing hosp\_order)
- [CVE-2025-53339](https://cve.now/CVE-2025-53339.md): WordPress Devnex Addons For Elementor plugin \<= 1.0.9 - Local File Inclusion Vulnerability (CVSS 7.5, Devnex Addons For Elementor)
- [CVE-2025-53338](https://cve.now/CVE-2025-53338.md): WordPress re.place plugin \<= 0.2.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, dor re.place)
- [CVE-2025-53336](https://cve.now/CVE-2025-53336.md): WordPress My Resume Builder plugin \<= 1.0.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, abditsori My Resume Builder)
- [CVE-2025-53332](https://cve.now/CVE-2025-53332.md): WordPress Track Everything plugin \<= 2.0.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, ethoseo Track Everything)
- [CVE-2025-53331](https://cve.now/CVE-2025-53331.md): WordPress RSS Digest plugin \<= 1.5 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, samcharrington RSS Digest)
- [CVE-2025-53329](https://cve.now/CVE-2025-53329.md): WordPress Społecznościowa 6 PL 2013 plugin \<= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, szajenw Społecznościowa 6 PL)
- [CVE-2025-53327](https://cve.now/CVE-2025-53327.md): WordPress Aioseo Multibyte Descriptions plugin \<= 0.0.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, rui\_mashita Aioseo Multibyte Descriptions)
- [CVE-2025-53325](https://cve.now/CVE-2025-53325.md): WordPress Beauty Contact Popup Form plugin \<= 6.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Dilip kumar Beauty Contact Popup Form)
- [CVE-2025-53323](https://cve.now/CVE-2025-53323.md): WordPress Pre-Publish Post Checklist plugin \<= 3.1 - Broken Access Control Vulnerability (CVSS 4.3, danbriapps Pre-Publish Post Checklist)
- [CVE-2025-53322](https://cve.now/CVE-2025-53322.md): WordPress Accept Authorize.NET Payments Using Contact Form 7 plugin \<= 2.5 - Sensitive Data Exposure Vulnerability (CVSS 5.3, ZealousWeb Accept Authorize.NET Payments Using Contact Form)
- [CVE-2025-53321](https://cve.now/CVE-2025-53321.md): WordPress Raise The Money plugin \<= 5.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Raise The Money)
- [CVE-2025-53320](https://cve.now/CVE-2025-53320.md): WordPress Free Downloads EDD plugin \<= 1.0.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Wp Enhanced Free Downloads EDD)
- [CVE-2025-53318](https://cve.now/CVE-2025-53318.md): WordPress WP DB Booster plugin \<= 1.0.1 - Broken Access Control Vulnerability (CVSS 5.4, WPManiax WP DB Booster)
- [CVE-2025-53317](https://cve.now/CVE-2025-53317.md): WordPress WPShapere Lite plugin \<= 1.4.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, AcmeeDesign WPShapere - WordPress admin theme)
- [CVE-2025-53315](https://cve.now/CVE-2025-53315.md): WordPress Relocate Upload plugin \<= 0.24.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, alanft Relocate Upload)
- [CVE-2025-53314](https://cve.now/CVE-2025-53314.md): WordPress WP Optimizer plugin \<= 2.5.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 9.6, sh1zen WP Optimizer)
- [CVE-2025-53313](https://cve.now/CVE-2025-53313.md): WordPress Twitch TV Embed Suite plugin \<= 2.1.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, plumwd Twitch TV Embed Suite)
- [CVE-2025-53312](https://cve.now/CVE-2025-53312.md): WordPress OnionBuzz plugin \<= 1.0.7 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Looks Awesome OnionBuzz)
- [CVE-2025-53311](https://cve.now/CVE-2025-53311.md): WordPress Navayan Subscribe plugin \<= 1.13 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Amol Nirmala Waman Navayan Subscribe)
- [CVE-2025-53310](https://cve.now/CVE-2025-53310.md): WordPress HidePost plugin \<= 2.3.8 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Funnnny HidePost)
- [CVE-2025-53309](https://cve.now/CVE-2025-53309.md): WordPress Accept Stripe Payments Using Contact Form 7 plugin \<= 3.0 - Sensitive Data Exposure Vulnerability (CVSS 5.3, ZealousWeb Accept Stripe Payments Using Contact Form)
- [CVE-2025-53308](https://cve.now/CVE-2025-53308.md): WordPress Image Slider With Description plugin \<= 9.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, gopi\_plus Image Slider With Description)
- [CVE-2025-53306](https://cve.now/CVE-2025-53306.md): WordPress WP Forum Server plugin \<= 1.8.2 - SQL Injection Vulnerability (CVSS 7.6, lucidcrew WP Forum Server)
- [CVE-2025-53305](https://cve.now/CVE-2025-53305.md): WordPress WP Forum Server plugin \<= 1.8.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, lucidcrew WP Forum Server)
- [CVE-2025-53304](https://cve.now/CVE-2025-53304.md): WordPress Contact Form – 7 : Hide Success Message plugin \<= 1.1.4 - Broken Access Control Vulnerability (CVSS 5.3, Rohil Contact Form – 7 : Hide Success Message)
- [CVE-2025-53301](https://cve.now/CVE-2025-53301.md): WordPress Theme Junkie Team Content plugin \<= 0.1.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Theme Junkie Team Content)
- [CVE-2025-53300](https://cve.now/CVE-2025-53300.md): WordPress Podcast Feed Player Widget and Shortcode plugin \<= 2.2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, douglaskarr Podcast Feed Player Widget and Shortcode)
- [CVE-2025-53298](https://cve.now/CVE-2025-53298.md): WordPress Plugin Inspector plugin \<= 1.5 - Arbitrary File Download Vulnerability (CVSS 4.9, gioni Plugin Inspector)
- [CVE-2025-53296](https://cve.now/CVE-2025-53296.md): WordPress EC Stars Rating plugin \<= 1.0.11 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, ecoal95 EC Stars Rating)
- [CVE-2025-53295](https://cve.now/CVE-2025-53295.md): WordPress iCount Payment Gateway plugin \<= 2.0.7 - Broken Access Control Vulnerability (CVSS 5.3, iCount Payment Gateway)
- [CVE-2025-53294](https://cve.now/CVE-2025-53294.md): WordPress Smart Agenda plugin \<= 4.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Smart Agenda)
- [CVE-2025-53293](https://cve.now/CVE-2025-53293.md): WordPress Dashboard Widget Sidebar plugin \<= 1.2.3 - Broken Access Control Vulnerability (CVSS 4.3, Morten Dalgaard Johansen Dashboard Widget Sidebar)
- [CVE-2025-53292](https://cve.now/CVE-2025-53292.md): WordPress WP DataTable plugin \<= 0.2.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, samsk WP DataTable)
- [CVE-2025-53290](https://cve.now/CVE-2025-53290.md): WordPress WP Visual Sitemap plugin \<= 1.0.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, MS WP Visual Sitemap)
- [CVE-2025-53288](https://cve.now/CVE-2025-53288.md): WordPress PlatiOnline Payments plugin \<= 7.0.0 - Broken Access Control vulnerability (CVSS 4.3, Adrian Ladó PlatiOnline Payments)
- [CVE-2025-53287](https://cve.now/CVE-2025-53287.md): WordPress Quick Favicon plugin \<= 0.22.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Robert Cummings Quick Favicon)
- [CVE-2025-53285](https://cve.now/CVE-2025-53285.md): WordPress Add & Replace Affiliate Links for Amazon plugin \<= 1.0.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, The Website Flip Add & Replace Affiliate Links for Amazon)
- [CVE-2025-53284](https://cve.now/CVE-2025-53284.md): WordPress CMS Blocks plugin \<= 1.1 - Broken Access Control Vulnerability (CVSS 6.5, pankaj.sakaria CMS Blocks)
- [CVE-2025-53282](https://cve.now/CVE-2025-53282.md): WordPress Thumbnail Editor plugin \<= 2.3.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, aviplugins.com Thumbnail Editor)
- [CVE-2025-53281](https://cve.now/CVE-2025-53281.md): WordPress WPB Category Slider for WooCommerce plugin \<= 1.71 - Local File Inclusion Vulnerability (CVSS 7.5, WPBean WPB Category Slider for WooCommerce)
- [CVE-2025-53280](https://cve.now/CVE-2025-53280.md): WordPress Football Pool plugin \<= 2.12.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, AntoineH Football Pool)
- [CVE-2025-53279](https://cve.now/CVE-2025-53279.md): WordPress Popup addon for Ninja Forms plugin \<= 3.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Aman Popup addon for Ninja Forms)
- [CVE-2025-53278](https://cve.now/CVE-2025-53278.md): WordPress WP AdCenter plugin \<= 2.6.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPeka WP AdCenter)
- [CVE-2025-53277](https://cve.now/CVE-2025-53277.md): WordPress IS-theme-companion plugin \<= 1.59 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8, Infigo Software IS-theme-companion)
- [CVE-2025-53276](https://cve.now/CVE-2025-53276.md): WordPress Omnipress plugin \<= 1.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, omnipressteam Omnipress)
- [CVE-2025-53275](https://cve.now/CVE-2025-53275.md): WordPress Leyka plugin \<= 3.32.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, VaultDweller Leyka)
- [CVE-2025-53274](https://cve.now/CVE-2025-53274.md): WordPress WP Permalink Translator plugin \<= 1.7.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Hossin Asaadi WP Permalink Translator)
- [CVE-2025-53273](https://cve.now/CVE-2025-53273.md): WordPress Slickstream plugin \<= 2.0.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Slickstream)
- [CVE-2025-53272](https://cve.now/CVE-2025-53272.md): WordPress Image Cleanup plugin \<= 1.9.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, opicron Image Cleanup)
- [CVE-2025-53271](https://cve.now/CVE-2025-53271.md): WordPress Additional Order Filters for WooCommerce plugin \<= 1.22 - Cross Site Request Forgery (CSRF) to Stored XSS Vulnerability (CVSS 7.1, Anton Bond Additional Order Filters for WooCommerce)
- [CVE-2025-53270](https://cve.now/CVE-2025-53270.md): WordPress CTA plugin \<= 1.7.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Blend Media WordPress CTA)
- [CVE-2025-53269](https://cve.now/CVE-2025-53269.md): WordPress My Wp Brand plugin \<= 1.1.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, imw3 My Wp Brand)
- [CVE-2025-53268](https://cve.now/CVE-2025-53268.md): WordPress Import external attachments plugin \<= 1.5.12 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, ryanpcmcquen Import external attachments)
- [CVE-2025-53267](https://cve.now/CVE-2025-53267.md): WordPress Hide Admin Bar From Front End plugin \<= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Aftab Husain Hide Admin Bar From Front End)
- [CVE-2025-53266](https://cve.now/CVE-2025-53266.md): WordPress Cron Logger plugin \<= 1.3.0 - Broken Access Control Vulnerability (CVSS 4.3, EdwardBock Cron Logger)
- [CVE-2025-53265](https://cve.now/CVE-2025-53265.md): WordPress Virusdie plugin \<= 1.1.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, Virusdie)
- [CVE-2025-53264](https://cve.now/CVE-2025-53264.md): WordPress ONet Regenerate Thumbnails plugin \<= 1.5 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Konrád Koller ONet Regenerate Thumbnails)
- [CVE-2025-53263](https://cve.now/CVE-2025-53263.md): WordPress Address Autocomplete via Google for Gravity Forms plugin \<= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, PluginsCafe Address Autocomplete via Google for Gravity For…)
- [CVE-2025-53262](https://cve.now/CVE-2025-53262.md): WordPress Writesonic plugin \<= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Writesonic)
- [CVE-2025-53261](https://cve.now/CVE-2025-53261.md): WordPress WP YouTube Live plugin \<= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, macbookandrew WP YouTube Live)
- [CVE-2025-53260](https://cve.now/CVE-2025-53260.md): WordPress File Manager Plugin For Wordpress plugin \<= 7.5 - Arbitrary File Upload Vulnerability (CVSS 9.1, getredhawkstudio File Manager Plugin For Wordpress)
- [CVE-2025-53259](https://cve.now/CVE-2025-53259.md): WordPress Hotel Booking plugin \<= 3.7 - Local File Inclusion Vulnerability (CVSS 7.5, nicdark Hotel Booking)
- [CVE-2025-53258](https://cve.now/CVE-2025-53258.md): WordPress Hover Effects plugin \<= 2.1.2 - SQL Injection Vulnerability (CVSS 7.6, Wow-Company Hover Effects)
- [CVE-2025-53257](https://cve.now/CVE-2025-53257.md): WordPress Gmedia Photo Gallery plugin \<= 1.23.0 - Local File Inclusion Vulnerability (CVSS 7.5, Serhii Pasyuk Gmedia Photo Gallery)
- [CVE-2025-53256](https://cve.now/CVE-2025-53256.md): WordPress YaySMTP plugin \<= 2.6.6 - SQL Injection Vulnerability (CVSS 7.6, YayCommerce YaySMTP)
- [CVE-2025-53255](https://cve.now/CVE-2025-53255.md): WordPress HurryTimer plugin \<= 2.13.1 - Broken Access Control Vulnerability (CVSS 5.3, Nabil Lemsieh HurryTimer)
- [CVE-2025-53254](https://cve.now/CVE-2025-53254.md): WordPress Cyrlitera plugin \<= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Themeisle Cyrlitera)
- [CVE-2025-53253](https://cve.now/CVE-2025-53253.md): WordPress WP Edit plugin \<= 4.0.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Josh WP Edit)
- [CVE-2025-53211](https://cve.now/CVE-2025-53211.md): WordPress Audio Editor & Recorder plugin \<= 2.2.3 - Sensitive Data Exposure Vulnerability (CVSS 5.3, Roland Beaussant Audio Editor & Recorder)
- [CVE-2025-53206](https://cve.now/CVE-2025-53206.md): WordPress HT Mega – Absolute Addons for WPBakery Page Builder plugin \<= 1.0.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, HT Plugins HT Mega – Absolute Addons for WPBakery Page Buil…)
- [CVE-2025-53203](https://cve.now/CVE-2025-53203.md): WordPress WooCommerce PDF Invoice Builder plugin \<= 1.2.148 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, EDGARROJAS WooCommerce PDF Invoice Builder)
- [CVE-2025-53202](https://cve.now/CVE-2025-53202.md): WordPress Responsive Blocks plugin \<= 2.0.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, CyberChimps Responsive Blocks)
- [CVE-2025-53200](https://cve.now/CVE-2025-53200.md): WordPress ChatBot plugin \<= 6.7.3 - Broken Access Control Vulnerability (CVSS 4.3, QuantumCloud ChatBot)
- [CVE-2025-53199](https://cve.now/CVE-2025-53199.md): WordPress HT Slider For Elementor plugin \<= 1.6.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, HT Plugins HT Slider For Elementor)
- [CVE-2025-53197](https://cve.now/CVE-2025-53197.md): WordPress Cookiebot plugin \<= 4.5.8 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Cookiebot)
- [CVE-2025-53193](https://cve.now/CVE-2025-53193.md): WordPress Burst Statistics plugin \<= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Burst Statistics B.V. Burst Statistics)
- [CVE-2025-6767](https://cve.now/CVE-2025-6767.md): sfturing hosp\_order DoctorServiceImpl.java findDoctorByCondition sql injection (CVSS 5.3, sfturing hosp\_order)
- [CVE-2025-53018](https://cve.now/CVE-2025-53018.md): Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs (CVSS 3.0, LycheeOrg Lychee)
- [CVE-2025-6766](https://cve.now/CVE-2025-6766.md): sfturing hosp\_order OfficeServiceImpl.java getOfficeName sql injection (CVSS 5.3, sfturing hosp\_order)
- [CVE-2025-40910](https://cve.now/CVE-2025-40910.md): Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses (CVSS 6.5, Net-IP-LPM)
- [CVE-2025-6765](https://cve.now/CVE-2025-6765.md): Intelbras InControl HTTP PUT Request operador permission (CVSS 5.3, Intelbras InControl)
- [CVE-2025-24765](https://cve.now/CVE-2025-24765.md): WordPress Image Shadow plugin \<= 1.1.0 - Arbitrary File Deletion Vulnerability (CVSS 7.7, RobMarsh Image Shadow)
- [CVE-2025-24769](https://cve.now/CVE-2025-24769.md): WordPress Zenny theme \<= 1.7.5 - Local File Inclusion Vulnerability (CVSS 8.1, BZOTheme Zenny)
- [CVE-2025-24774](https://cve.now/CVE-2025-24774.md): WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin \<= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce)
- [CVE-2025-25171](https://cve.now/CVE-2025-25171.md): WordPress WP SmartPay plugin \<= 2.7.13 - Account Takeover vulnerability (CVSS 8.8, Convers Lab WP SmartPay)
- [CVE-2025-25173](https://cve.now/CVE-2025-25173.md): WordPress FastBook plugin \<= 1.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, FasterThemes FastBook)
- [CVE-2025-27361](https://cve.now/CVE-2025-27361.md): WordPress Photo Express for Google plugin \<= 0.3.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, thhake Photo Express for Google)
- [CVE-2025-28946](https://cve.now/CVE-2025-28946.md): WordPress PrintXtore theme \< 1.7.8 - Local File Inclusion vulnerability (CVSS 8.1, BZOTheme PrintXtore)
- [CVE-2025-28947](https://cve.now/CVE-2025-28947.md): WordPress MBStore - Digital WooCommerce WordPress Theme \<= 2.3 - Local File Inclusion Vulnerability (CVSS 8.1, snstheme MBStore - Digital WooCommerce WordPress Theme)
- [CVE-2025-28956](https://cve.now/CVE-2025-28956.md): WordPress Backwp plugin \<= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wphobby Backwp)
- [CVE-2025-28960](https://cve.now/CVE-2025-28960.md): WordPress Evangelische Termine plugin \<= 3.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, regibaer Evangelische Termine)
- [CVE-2025-28970](https://cve.now/CVE-2025-28970.md): WordPress WP Optimize By xTraffic plugin \<= 5.1.6 - PHP Object Injection Vulnerability (CVSS 9.8, pep.vn WP Optimize By xTraffic)
- [CVE-2025-28988](https://cve.now/CVE-2025-28988.md): WordPress WP Front User Submit / Front Editor plugin \<= 4.9.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, aharonyan WP Front User Submit / Front Editor)
- [CVE-2025-28990](https://cve.now/CVE-2025-28990.md): WordPress SNS Vicky theme \<= 3.7 - Local File Inclusion Vulnerability (CVSS 8.1, snstheme SNS Vicky)
- [CVE-2025-28993](https://cve.now/CVE-2025-28993.md): WordPress Content No Cache plugin \<= 0.1.4 - Arbitrary Function Call vulnerability (CVSS 8.6, Jose Mortellaro Content No Cache)
- [CVE-2025-28998](https://cve.now/CVE-2025-28998.md): WordPress SERPed.net plugin \<= 4.6 - Local File Inclusion Vulnerability (CVSS 8.1, serpednet SERPed.net)
- [CVE-2025-30972](https://cve.now/CVE-2025-30972.md): WordPress Woocommerce Line Notify plugin \<= 1.1.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, iamapinan Woocommerce Line Notify)
- [CVE-2025-30992](https://cve.now/CVE-2025-30992.md): WordPress Puca theme \<= 2.6.33 - Local File Inclusion Vulnerability (CVSS 8.1, thembay Puca)
- [CVE-2025-31067](https://cve.now/CVE-2025-31067.md): WordPress Seven Stars theme \<= 1.4.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, themeton Seven Stars)
- [CVE-2025-31428](https://cve.now/CVE-2025-31428.md): WordPress HYDRO theme \<= 2.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, BuddhaThemes HYDRO)
- [CVE-2025-32281](https://cve.now/CVE-2025-32281.md): WordPress DarkMySite plugin \<= 1.2.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, DarkMySite)
- [CVE-2025-32298](https://cve.now/CVE-2025-32298.md): WordPress CTUsers plugin \<= 1.0.0 - Local File Inclusion Vulnerability (CVSS 7.5, Case-Themes CTUsers)
- [CVE-2025-39474](https://cve.now/CVE-2025-39474.md): WordPress Amely theme \<= 3.1.4 - SQL Injection vulnerability (CVSS 9.3, ThemeMove Amely)
- [CVE-2025-39478](https://cve.now/CVE-2025-39478.md): WordPress Smart Notification Plugin \<= 10.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, smartiolabs Smart Notification)
- [CVE-2025-39488](https://cve.now/CVE-2025-39488.md): WordPress MagOne theme \<= 8.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sneeit MagOne)
- [CVE-2025-47574](https://cve.now/CVE-2025-47574.md): WordPress School Management System Plugin \<= 92.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mojoomla School Management)
- [CVE-2025-47654](https://cve.now/CVE-2025-47654.md): WordPress FormLift for Infusionsoft Web Forms plugin \<= 7.5.20 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Adrian Tobey FormLift for Infusionsoft Web Forms)
- [CVE-2025-49290](https://cve.now/CVE-2025-49290.md): WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin \<= 0.5.8.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jory Hogeveen Off-Canvas Sidebars & Menus)
- [CVE-2025-49321](https://cve.now/CVE-2025-49321.md): WordPress Eventin plugin \<= 4.0.28 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Arraytics Eventin)
- [CVE-2025-49883](https://cve.now/CVE-2025-49883.md): WordPress Greenmart theme \<= 4.2.3 - Local File Inclusion Vulnerability (CVSS 8.1, thembay Greenmart)
- [CVE-2025-49885](https://cve.now/CVE-2025-49885.md): WordPress Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin \<= 5.0.6 - Arbitrary File Upload Vulnerability (CVSS 10.0, HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCom…)
- [CVE-2025-49886](https://cve.now/CVE-2025-49886.md): WordPress Zikzag Core plugin \<= 1.4.5 - Local File Inclusion Vulnerability (CVSS 8.1, WebGeniusLab Zikzag Core)
- [CVE-2025-50052](https://cve.now/CVE-2025-50052.md): WordPress Flexo Counter plugin \<= 1.0001 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, flexostudio Flexo Counter)
- [CVE-2025-52717](https://cve.now/CVE-2025-52717.md): WordPress LifterLMS plugin \<= 8.0.6 - SQL Injection Vulnerability (CVSS 9.3, chrisbadgett LifterLMS)
- [CVE-2025-52722](https://cve.now/CVE-2025-52722.md): WordPress Classiera theme \<= 4.0.34 - SQL Injection Vulnerability (CVSS 9.3, JoinWebs Classiera)
- [CVE-2025-52723](https://cve.now/CVE-2025-52723.md): WordPress Networker theme \<= 1.2.0 - Local File Inclusion Vulnerability (CVSS 8.1, codesupplyco Networker)
- [CVE-2025-52724](https://cve.now/CVE-2025-52724.md): WordPress Amwerk theme \<= 1.2.0 - PHP Object Injection Vulnerability (CVSS 9.8, BoldThemes Amwerk)
- [CVE-2025-52725](https://cve.now/CVE-2025-52725.md): WordPress CouponXxL theme \<= 3.0.0 - PHP Object Injection Vulnerability (CVSS 9.8, pebas CouponXxL)
- [CVE-2025-52726](https://cve.now/CVE-2025-52726.md): WordPress CouponXxL Custom Post Types plugin \<= 3.0 - Privilege Escalation Vulnerability (CVSS 8.6, pebas CouponXxL Custom Post Types)
- [CVE-2025-52727](https://cve.now/CVE-2025-52727.md): WordPress CSS3 Vertical Web Pricing Tables plugin \<= 1.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, QuanticaLabs CSS3 Vertical Web Pricing Tables)
- [CVE-2025-52729](https://cve.now/CVE-2025-52729.md): WordPress Diza theme \<= 1.3.9 - Local File Inclusion Vulnerability (CVSS 8.1, thembay Diza)
- [CVE-2025-52774](https://cve.now/CVE-2025-52774.md): WordPress Infility Global plugin \<= 2.15.06 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Infility Global)
- [CVE-2025-52778](https://cve.now/CVE-2025-52778.md): WordPress xili-dictionary plugin \<= 2.12.5.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Michel - xiligroup dev xili-dictionary)
- [CVE-2025-52799](https://cve.now/CVE-2025-52799.md): WordPress LMS theme \<= 9.2 - Reflected Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, designthemes LMS)
- [CVE-2025-52808](https://cve.now/CVE-2025-52808.md): WordPress RealtyElite theme \<= 1.0.0 - Local File Inclusion Vulnerability (CVSS 8.1, real-web RealtyElite)
- [CVE-2025-52809](https://cve.now/CVE-2025-52809.md): WordPress National Weather Service Alerts plugin \<= 1.3.5 - Local File Inclusion Vulnerability (CVSS 8.1, John Russell National Weather Service Alerts)
- [CVE-2025-52810](https://cve.now/CVE-2025-52810.md): WordPress Katerio - Magazine theme \<= 1.5.1 - Local File Inclusion Vulnerability (CVSS 8.1, TMRW-studio Katerio - Magazine)
- [CVE-2025-52811](https://cve.now/CVE-2025-52811.md): WordPress Davenport - Versatile Blog and Magazine WordPress Theme \<= 1.3 - Local File Inclusion Vulnerability (CVSS 8.1, Creanncy Davenport - Versatile Blog and Magazine WordPress…)
- [CVE-2025-52812](https://cve.now/CVE-2025-52812.md): WordPress Domnoo theme \<= 1.49 - Local File Inclusion Vulnerability (CVSS 8.1, ApusWP Domnoo)
- [CVE-2025-52814](https://cve.now/CVE-2025-52814.md): WordPress BRW plugin \<= 1.8.8 - Local File Inclusion Vulnerability (CVSS 8.1, ovatheme BRW)
- [CVE-2025-52815](https://cve.now/CVE-2025-52815.md): WordPress CityGov theme \<= 1.9 - Local File Inclusion Vulnerability (CVSS 8.1, AncoraThemes CityGov)
- [CVE-2025-52816](https://cve.now/CVE-2025-52816.md): WordPress Zita theme \<= 1.6.5 - Local File Inclusion Vulnerability (CVSS 8.1, themehunk Zita)
- [CVE-2025-52817](https://cve.now/CVE-2025-52817.md): WordPress Abandoned Contact Form 7 plugin \<= 2.2 - Broken Access Control vulnerability (CVSS 8.2, ZealousWeb Abandoned Contact Form)
- [CVE-2025-52818](https://cve.now/CVE-2025-52818.md): WordPress Trusty Whistleblowing plugin \<= 2.0.1 - Broken Access Control vulnerability (CVSS 8.2, Dejan Jasnic Trusty Whistleblowing)
- [CVE-2025-52824](https://cve.now/CVE-2025-52824.md): WordPress Mobile DJ Manager plugin \<= 1.7.8.3 - Privilege Escalation vulnerability (CVSS 8.8, MDJM Mobile DJ Manager)
- [CVE-2025-52826](https://cve.now/CVE-2025-52826.md): WordPress Sala theme \<= 1.1.3 - PHP Object Injection Vulnerability (CVSS 8.8, uxper Sala)
- [CVE-2025-52827](https://cve.now/CVE-2025-52827.md): WordPress Nuss theme \<= 1.3.3 - PHP Object Injection Vulnerability (CVSS 8.8, uxper Nuss)
- [CVE-2025-52829](https://cve.now/CVE-2025-52829.md): WordPress DirectIQ Email Marketing plugin \<= 2.0 - SQL Injection Vulnerability (CVSS 9.3, DirectIQ Email Marketing)
- [CVE-2025-52834](https://cve.now/CVE-2025-52834.md): WordPress Homey theme \<= 2.4.7 - SQL Injection vulnerability (CVSS 9.3, favethemes Homey)
- [CVE-2023-25998](https://cve.now/CVE-2023-25998.md): WordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme \<= 2.6 - Local File Inclusion Vulnerability (CVSS 8.1, snstheme Samex - Clean, Minimal Shop WooCommerce WordPress…)
- [CVE-2025-23967](https://cve.now/CVE-2025-23967.md): WordPress GG Bought Together for WooCommerce plugin \<= 1.0.2 - SQL Injection Vulnerability (CVSS 9.3, wpopal GG Bought Together for WooCommerce)
- [CVE-2025-23973](https://cve.now/CVE-2025-23973.md): WordPress SpecFit-Virtual Try On Woocommerce plugin \<= 8.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, dugudlabs SpecFit-Virtual Try On Woocommerce)
- [CVE-2025-24760](https://cve.now/CVE-2025-24760.md): WordPress Sofass theme \<= 1.3.4 - Local File Inclusion Vulnerability (CVSS 8.1, goalthemes Sofass)
- [CVE-2025-49416](https://cve.now/CVE-2025-49416.md): WordPress FW Gallery plugin \<= 8.0.0 - Local File Inclusion Vulnerability (CVSS 8.1, Fastw3b FW Gallery)
- [CVE-2025-49423](https://cve.now/CVE-2025-49423.md): WordPress Bulk YouTube Post Creator plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Syed Tahir Ali Jan Bulk YouTube Post Creator)
- [CVE-2025-49448](https://cve.now/CVE-2025-49448.md): WordPress FW Food Menu plugin \<= 6.0.0 - Arbitrary File Deletion Vulnerability (CVSS 8.6, Fastw3b FW Food Menu)
- [CVE-2025-6763](https://cve.now/CVE-2025-6763.md): Comet System H3531 Web-based Management setupA.cfg missing authentication (CVSS 9.2, Comet System T0510 · Comet System T3510 +8)
- [CVE-2025-6762](https://cve.now/CVE-2025-6762.md): diyhi bbs HTTP Header login getUrl server-side request forgery (CVSS 5.3, diyhi bbs)
- [CVE-2025-6761](https://cve.now/CVE-2025-6761.md): Kingdee Cloud-Starry-Sky Enterprise Edition Freemarker Engine DynamicForm 4 Action.class plugin.buildMobilePopHtml special elements used in a template engine (CVSS 6.9, Kingdee Cloud-Starry-Sky Enterprise Edition)
- [CVE-2025-5398](https://cve.now/CVE-2025-5398.md): Ninja Forms \<= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI (CVSS 6.4, kstover Ninja Forms – The Contact Form Builder That Grows W…)
- [CVE-2024-12827](https://cve.now/CVE-2024-12827.md): DWT - Directory & Listing WordPress Theme \<= 3.3.6 - Unauthenticated Arbitrary User Password Reset (CVSS 9.8, scriptsbundle DWT - Directory & Listing WordPress Theme)
- [CVE-2025-2940](https://cve.now/CVE-2025-2940.md): Ninja Tables – Easy Data Table Builder \<= 5.0.18 - Unauthenticated Server-Side Request Forgery (CVSS 7.2, techjewel Ninja Tables – Easy Data Table Builder)
- [CVE-2025-5306](https://cve.now/CVE-2025-5306.md): Command Injection in Netflow path (CVSS 7.0, Pandora FMS)
- [CVE-2025-6688](https://cve.now/CVE-2025-6688.md): Simple Payment 1.3.6 - 2.3.8 - Authentication Bypass to Admin (CVSS 9.8, idokd Simple Payment)
- [CVE-2025-5936](https://cve.now/CVE-2025-5936.md): VR Calendar \<= 2.4.7 - Cross-Site Request Forgery to Calendar Sync (CVSS 4.3, innate-images-llc VR Calendar)
- [CVE-2025-5940](https://cve.now/CVE-2025-5940.md): Osom Blocks \<= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via class\_name Parameter (CVSS 6.4, osompress Osom Blocks)
- [CVE-2025-6550](https://cve.now/CVE-2025-6550.md): The Pack Elementor addon \<= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, webangon The Pack Elementor addon)
- [CVE-2025-4587](https://cve.now/CVE-2025-4587.md): A/B Testing for WordPress \<= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, johnjamesjacoby A/B Testing for WordPress)
- [CVE-2025-6689](https://cve.now/CVE-2025-6689.md): FL3R Accessibility Suite \<= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via fl3raccessibilitysuite Shortcode (CVSS 6.4, armandofiore FL3R Accessibility Suite)
- [CVE-2025-5526](https://cve.now/CVE-2025-5526.md): BuddyPress Docs \< 2.2.5 - Subscriber+ Arbitrary Document Read/Update (CVSS 4.3, BuddyPress Docs)
- [CVE-2025-5194](https://cve.now/CVE-2025-5194.md): WP Map Block by aBlocks \< 2.0.3 - Contributor+ Stored XSS via Marker (CVSS 4.8, WP Map Block)
- [CVE-2025-5093](https://cve.now/CVE-2025-5093.md): Responsive Lightbox & Gallery \< 2.5.2 - Contributor+ Stored XSS (CVSS 5.4, Responsive Lightbox & Gallery)
- [CVE-2025-5035](https://cve.now/CVE-2025-5035.md): Firelight Lightbox \< 2.3.16 - Contributor+ Stored XSS (CVSS 5.4, Firelight Lightbox)
- [CVE-2025-41418](https://cve.now/CVE-2025-41418.md): Buffer Overflow vulnerability exists in multiple versions of TB-eye network recorders and AHD recorders. (CVSS 5.3, TB-eye XRN-410SN/TE · TB-eye XRN-810SN/TE +15)
- [CVE-2025-36529](https://cve.now/CVE-2025-36529.md): An OS command injection issue exists in multiple versions of TB-eye network recorders and AHD recorders. (CVSS 7.2, TB-eye XRN-410SN/TE · TB-eye XRN-810SN/TE +15)
- [CVE-2025-6488](https://cve.now/CVE-2025-6488.md): isMobile \<= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via device Parameter (CVSS 6.4, jairoochoa isMobile() Shortcode for WordPress)
- [CVE-2025-6753](https://cve.now/CVE-2025-6753.md): huija bicycleSharingServer AdminController.java selectAdminByNameLike sql injection (CVSS 5.3, huija bicycleSharingServer)
- [CVE-2025-6752](https://cve.now/CVE-2025-6752.md): Linksys WRT1900ACS/EA7200/EA7450/EA7500 IGD Layer3Forwarding SetDefaultConnectionService stack-based overflow (CVSS 8.7, Linksys WRT1900ACS · Linksys EA7200 +2)
- [CVE-2025-6751](https://cve.now/CVE-2025-6751.md): Linksys E8450 HTTP POST Request portal.cgi set\_device\_language buffer overflow (CVSS 8.7, Linksys E8450)
- [CVE-2025-6750](https://cve.now/CVE-2025-6750.md): HDF5 H5Omtime.c H5O\_\_mtime\_new\_encode heap-based overflow (CVSS 4.8, HDF5)
- [CVE-2025-6749](https://cve.now/CVE-2025-6749.md): huija bicycleSharingServer AdminController.java searchAdminMessageShow sql injection (CVSS 5.3, huija bicycleSharingServer)
- [CVE-2025-6748](https://cve.now/CVE-2025-6748.md): Bharti Airtel Thanks App files cleartext storage in a file or on disk (CVSS 2.4, Bharti Airtel Thanks App)
- [CVE-2025-6738](https://cve.now/CVE-2025-6738.md): huija bicycleSharingServer UserServiceImpl.java userDao.selectUserByUserNameLike sql injection (CVSS 5.3, huija bicycleSharingServer)
- [CVE-2025-44163](https://cve.now/CVE-2025-44163.md): RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get\_wgkey.php. (CVSS 6.3, billz/raspap-webgui)
- [CVE-2025-44557](https://cve.now/CVE-2025-44557.md): A state machine transition flaw in the Bluetooth Low Energy (BLE) stack of Cypress PSoC4 v3.66 allows attackers to bypass the pairing proces (CVSS 8.1)
- [CVE-2025-44559](https://cve.now/CVE-2025-44559.md): An issue in the Bluetooth Low Energy (BLE) stack of Realtek RTL8762E BLE SDK v1.4.0 allows attackers within Bluetooth range to cause a Denia (CVSS 6.5)
- [CVE-2025-45729](https://cve.now/CVE-2025-45729.md): D-Link DIR-823-Pro 1.02 has improper permission control, allowing unauthorized users to turn on and access Telnet services. (CVSS 6.3)
- [CVE-2025-45737](https://cve.now/CVE-2025-45737.md): An issue in NetEase (Hangzhou) Network Co., Ltd NeacSafe64 Driver before v1.0.0.8 allows attackers to escalate privileges via sending crafte (CVSS 6.5)
- [CVE-2025-45851](https://cve.now/CVE-2025-45851.md): An issue in Hikvision DS-2CD1321-I V5.7.21 build 230819 allows attackers to cause a Denial of Service (DoS) via sending a crafted POST reque (CVSS 7.5)
- [CVE-2025-46415](https://cve.now/CVE-2025-46415.md): A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. (CVSS 3.2, NixOS Nix)
- [CVE-2025-46416](https://cve.now/CVE-2025-46416.md): The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user acc (CVSS 2.9, NixOS Nix)
- [CVE-2025-47818](https://cve.now/CVE-2025-47818.md): Flock Safety Gunshot Detection devices before 1.3 have a hard-coded password for a connection. (CVSS 2.2, Flock Safety Gunshot Detection devices)
- [CVE-2025-47819](https://cve.now/CVE-2025-47819.md): Flock Safety Gunshot Detection devices before 1.3 have an on-chip debug interface with improper access control. (CVSS 6.4, Flock Safety Gunshot Detection devices)
- [CVE-2025-47820](https://cve.now/CVE-2025-47820.md): Flock Safety Gunshot Detection devices before 1.3 have cleartext storage of code. (CVSS 2.0, Flock Safety Gunshot Detection devices)
- [CVE-2025-47821](https://cve.now/CVE-2025-47821.md): Flock Safety Gunshot Detection devices before 1.3 have a hardcoded password for a system. (CVSS 2.2, Flock Safety Gunshot Detection devices)
- [CVE-2025-47822](https://cve.now/CVE-2025-47822.md): Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have an on-chip debug interface with improper access control. (CVSS 6.4, Flock Safety License Plate Reader)
- [CVE-2025-47823](https://cve.now/CVE-2025-47823.md): Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system. (CVSS 2.2, Flock Safety License Plate Reader)
- [CVE-2025-47824](https://cve.now/CVE-2025-47824.md): Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have cleartext storage of code. (CVSS 2.0, Flock Safety License Plate Reader)
- [CVE-2025-50367](https://cve.now/CVE-2025-50367.md): A stored blind XSS vulnerability exists in the Contact Page of the Phpgurukul Medical Card Generation System 1.0 mcgs/contact.php. (CVSS 6.1)
- [CVE-2025-50369](https://cve.now/CVE-2025-50369.md): A Cross-Site Request Forgery (CSRF) vulnerability exists in the Manage Card functionality (/mcgs/admin/manage-card.php) of PHPGurukul Medica (CVSS 6.5)
- [CVE-2025-50370](https://cve.now/CVE-2025-50370.md): A Cross-Site Request Forgery (CSRF) vulnerability exists in the Inquiry Management functionality /mcgs/admin/readenq.php of the Phpgurukul M (CVSS 6.5)
- [CVE-2025-50528](https://cve.now/CVE-2025-50528.md): A buffer overflow vulnerability exists in the fromNatStaticSetting function of Tenda AC6 \<=V15.03.05.19 via the page parameter. (CVSS 7.3)
- [CVE-2025-52207](https://cve.now/CVE-2025-52207.md): PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbitrary directory. (CVSS 9.9, MikoPBX)
- [CVE-2025-52991](https://cve.now/CVE-2025-52991.md): The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. (CVSS 3.2, NixOS Nix)
- [CVE-2025-52992](https://cve.now/CVE-2025-52992.md): The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. (CVSS 3.2, NixOS Nix)
- [CVE-2025-52993](https://cve.now/CVE-2025-52993.md): A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the buil (CVSS 5.6, NixOS Nix)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-06-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.