# CVEs published 2025-06-28

46 CVEs were published on June 28, 2025: 3 critical, 12 high. Days are UTC.

- [CVE-2025-6834](https://cve.now/CVE-2025-6834.md): code-projects Inventory Management System editPayment.php sql injection (CVSS 6.9, code-projects Inventory Management System)
- [CVE-2025-6829](https://cve.now/CVE-2025-6829.md): aaluoxiang oa\_system External Address Book outAddress sql injection (CVSS 5.3, aaluoxiang oa\_system)
- [CVE-2025-6828](https://cve.now/CVE-2025-6828.md): code-projects Inventory Management System orders.php sql injection (CVSS 6.9, code-projects Inventory Management System)
- [CVE-2025-6827](https://cve.now/CVE-2025-6827.md): code-projects Inventory Management System editOrder.php sql injection (CVSS 6.9, code-projects Inventory Management System)
- [CVE-2025-6826](https://cve.now/CVE-2025-6826.md): code-projects Payroll Management System ajax.php sql injection (CVSS 6.9, code-projects Payroll Management System)
- [CVE-2025-6825](https://cve.now/CVE-2025-6825.md): TOTOLINK A702R HTTP POST Request formWlSiteSurvey buffer overflow (CVSS 8.7, TOTOLINK A702R)
- [CVE-2025-6824](https://cve.now/CVE-2025-6824.md): TOTOLINK X15 HTTP POST Request formParentControl buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-6823](https://cve.now/CVE-2025-6823.md): code-projects Inventory Management System editProduct.php sql injection (CVSS 6.9, code-projects Inventory Management System)
- [CVE-2025-6822](https://cve.now/CVE-2025-6822.md): code-projects Inventory Management System removeProduct.php sql injection (CVSS 6.9, code-projects Inventory Management System)
- [CVE-2025-32897](https://cve.now/CVE-2025-32897.md): Apache Seata (incubating): Deserialization of untrusted Data in Apache Seata Server (CVSS 9.8, Apache Software Foundation Apache Seata · org.apache.seata:…)
- [CVE-2025-6821](https://cve.now/CVE-2025-6821.md): code-projects Inventory Management System createOrder.php sql injection (CVSS 6.9, code-projects Inventory Management System)
- [CVE-2025-6820](https://cve.now/CVE-2025-6820.md): code-projects Inventory Management System createProduct.php sql injection (CVSS 6.9, code-projects Inventory Management System)
- [CVE-2025-6819](https://cve.now/CVE-2025-6819.md): code-projects Inventory Management System removeBrand.php sql injection (CVSS 6.9, code-projects Inventory Management System)
- [CVE-2023-28902](https://cve.now/CVE-2023-28902.md): Denial of Service via integer underflow in picserver (CVSS 3.3, Preh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…)
- [CVE-2023-28903](https://cve.now/CVE-2023-28903.md): An integer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to caus (CVSS 3.3, Preh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…)
- [CVE-2023-28904](https://cve.now/CVE-2023-28904.md): Bypass of secure boot process (CVSS 5.2, Preh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…)
- [CVE-2023-28905](https://cve.now/CVE-2023-28905.md): Heap buffer overflow in picserver (CVSS 8.0, Preh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…)
- [CVE-2023-28906](https://cve.now/CVE-2023-28906.md): Command injection in networking service (CVSS 7.8, Preh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…)
- [CVE-2023-28907](https://cve.now/CVE-2023-28907.md): A lack of access restrictions on internal memory regions (CVSS 6.7, Preh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…)
- [CVE-2023-28908](https://cve.now/CVE-2023-28908.md): Integer Overflow in Non-Fragmented Data Reception (CVSS 5.4, Preh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…)
- [CVE-2023-28909](https://cve.now/CVE-2023-28909.md): Integer Overflow Leading to MTU Bypass (CVSS 8.0, Preh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…)
- [CVE-2023-28910](https://cve.now/CVE-2023-28910.md): Disabled Abortion Flag (CVSS 8.0, Preh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…)
- [CVE-2023-28911](https://cve.now/CVE-2023-28911.md): Arbitrary Channel Disconnection Resulting in Denial of Service (CVSS 6.5, Preh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…)
- [CVE-2023-28912](https://cve.now/CVE-2023-28912.md): Cleartext Phonebook Information (CVSS 5.7, Preh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…)
- [CVE-2023-29113](https://cve.now/CVE-2023-29113.md): A lack of access control in custom IPC mechanism (CVSS 6.3, Preh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…)
- [CVE-2025-6818](https://cve.now/CVE-2025-6818.md): HDF5 H5Ochunk.c H5O\_\_chunk\_protect heap-based overflow (CVSS 4.8, HDF5)
- [CVE-2025-1991](https://cve.now/CVE-2025-1991.md): IBM Informix Dynamic Server denial of service (CVSS 7.5, IBM Informix Dynamic Server)
- [CVE-2025-6817](https://cve.now/CVE-2025-6817.md): HDF5 H5Centry.c H5C\_\_load\_entry resource consumption (CVSS 4.8, HDF5)
- [CVE-2025-6816](https://cve.now/CVE-2025-6816.md): HDF5 H5Ofsinfo.c H5O\_\_fsinfo\_encode heap-based overflow (CVSS 4.8, HDF5)
- [CVE-2025-38086](https://cve.now/CVE-2025-38086.md): net: ch9200: fix uninitialised access during mii\_nway\_restart (no CVSS, Linux)
- [CVE-2025-38085](https://cve.now/CVE-2025-38085.md): mm/hugetlb: fix huge\_pmd\_unshare() vs GUP-fast race (CVSS 7.8, Linux)
- [CVE-2025-38084](https://cve.now/CVE-2025-38084.md): mm/hugetlb: unshare page tables during VMA split, not before (CVSS 7.8, Linux)
- [CVE-2025-5937](https://cve.now/CVE-2025-5937.md): MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet \<= 3.2.0 - Cross-Site Request Forgery to Settings Reset (CVSS 4.3, videowhisper MicroPayments – Fans Paysite: Paid Creator Sub…)
- [CVE-2025-6755](https://cve.now/CVE-2025-6755.md): Game Users Share Buttons \<= 1.3.0 - Authenticated (Subscriber+) Arbitrary File Deletion via themeNameId Parameter (CVSS 8.8, gameusers Game Users Share Buttons)
- [CVE-2025-5304](https://cve.now/CVE-2025-5304.md): PT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via wpnb\_pto\_new\_users\_add Function (CVSS 9.8, blafoley PT Project Notebooks – Take Meeting minutes, creat…)
- [CVE-2025-6252](https://cve.now/CVE-2025-6252.md): Qi Addons For Elementor \<= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, qodeinteractive Qi Addons For Elementor)
- [CVE-2025-6350](https://cve.now/CVE-2025-6350.md): WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress \<= 8.5.32 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, rextheme WP VR – 360 Panorama and Free Virtual Tour Builder…)
- [CVE-2025-6381](https://cve.now/CVE-2025-6381.md): BeeTeam368 Extensions \<= 2.3.4 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Deletion (CVSS 8.8, BeeTeam368 Extensions)
- [CVE-2025-6379](https://cve.now/CVE-2025-6379.md): BeeTeam368 Extensions Pro \<= 2.3.4 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Deletion (CVSS 8.8, BeeTeam368 Extensions Pro)
- [CVE-2024-52900](https://cve.now/CVE-2024-52900.md): IBM Cognos Analytics cross-site scripting (CVSS 6.4, IBM Cognos Analytics)
- [CVE-2025-36027](https://cve.now/CVE-2025-36027.md): IBM Datacap clickjacking (CVSS 5.4, IBM Datacap)
- [CVE-2025-36026](https://cve.now/CVE-2025-36026.md): IBM Datacap information disclosure (CVSS 4.3, IBM Datacap)
- [CVE-2024-39730](https://cve.now/CVE-2024-39730.md): IBM Datacap clickjacking (CVSS 5.4, IBM Datacap)
- [CVE-2025-53391](https://cve.now/CVE-2025-53391.md): The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt\_6.2.0-1 package has insecure PolicyKit allow\_any/allow\_inactiv (CVSS 9.3, Debian zulucrypt)
- [CVE-2025-53392](https://cve.now/CVE-2025-53392.md): In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag\_command.php dlPath direct (CVSS 5.0, Netgate pfSense)
- [CVE-2025-53393](https://cve.now/CVE-2025-53393.md): In Akka through 2.10.6, akka-cluster-metrics uses Java serialization for cluster metrics. (CVSS 6.0, Akka · com.typesafe.akka:akka-cluster-metrics\_3 +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-06-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.