# CVEs published 2025-06-29 47 CVEs were published on June 29, 2025: 1 critical, 1 high. Days are UTC. - [CVE-2025-6877](https://cve.now/CVE-2025-6877.md): SourceCodester Best Salon Management System edit-category.php sql injection (CVSS 5.3, SourceCodester Best Salon Management System) - [CVE-2025-6876](https://cve.now/CVE-2025-6876.md): SourceCodester Best Salon Management System add-category.php sql injection (CVSS 5.3, SourceCodester Best Salon Management System) - [CVE-2025-6875](https://cve.now/CVE-2025-6875.md): SourceCodester Best Salon Management System edit-subscription.php sql injection (CVSS 5.3, SourceCodester Best Salon Management System) - [CVE-2025-6874](https://cve.now/CVE-2025-6874.md): SourceCodester Best Salon Management System add\_subscribe.php sql injection (CVSS 5.3, SourceCodester Best Salon Management System) - [CVE-2025-6873](https://cve.now/CVE-2025-6873.md): SourceCodester Simple Company Website Users.php unrestricted upload (CVSS 5.1, SourceCodester Simple Company Website) - [CVE-2025-6872](https://cve.now/CVE-2025-6872.md): SourceCodester Simple Company Website SystemSettings.php unrestricted upload (CVSS 5.1, SourceCodester Simple Company Website) - [CVE-2025-6871](https://cve.now/CVE-2025-6871.md): SourceCodester Simple Company Website Login.php sql injection (CVSS 6.9, SourceCodester Simple Company Website) - [CVE-2025-6870](https://cve.now/CVE-2025-6870.md): SourceCodester Simple Company Website Content.php unrestricted upload (CVSS 5.1, SourceCodester Simple Company Website) - [CVE-2025-6869](https://cve.now/CVE-2025-6869.md): SourceCodester Simple Company Website manage.php sql injection (CVSS 5.1, SourceCodester Simple Company Website) - [CVE-2025-24292](https://cve.now/CVE-2025-24292.md): A misconfigured query in UniFi Network (v9.1.120 and earlier) could allow users to authenticate to Enterprise WiFi or VPN Server (l2tp and O (CVSS 6.8, Ubiquiti UniFi Network Application) - [CVE-2025-24290](https://cve.now/CVE-2025-24290.md): Multiple Authenticated SQL Injection vulnerabilities found in UISP Application (Version 2.4.206 and earlier) could allow a malicious actor w (CVSS 9.9, Ubiquiti UISP Application) - [CVE-2025-24289](https://cve.now/CVE-2025-24289.md): A Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in the UCRM Client Signup Plugin (v1.3.4 and earlier (CVSS 7.5, Ubiquiti UCRM Client Signup Plugin) - [CVE-2025-6868](https://cve.now/CVE-2025-6868.md): SourceCodester Simple Company Website manage.php sql injection (CVSS 5.1, SourceCodester Simple Company Website) - [CVE-2025-6867](https://cve.now/CVE-2025-6867.md): SourceCodester Simple Company Website manage.php sql injection (CVSS 5.1, SourceCodester Simple Company Website) - [CVE-2025-6866](https://cve.now/CVE-2025-6866.md): code-projects Simple Forum forum\_downloadfile.php path traversal (CVSS 5.3, code-projects Simple Forum) - [CVE-2025-6865](https://cve.now/CVE-2025-6865.md): DaiCuo index cross-site request forgery (CVSS 5.3, DaiCuo) - [CVE-2025-6864](https://cve.now/CVE-2025-6864.md): SeaCMS admin\_type.php cross-site request forgery (CVSS 5.3, SeaCMS) - [CVE-2025-6863](https://cve.now/CVE-2025-6863.md): PHPGurukul Local Services Search Engine Management System edit-category-detail.php sql injection (CVSS 6.9, PHPGurukul Local Services Search Engine Management System) - [CVE-2025-6862](https://cve.now/CVE-2025-6862.md): SourceCodester Best Salon Management System edit\_plan.php sql injection (CVSS 5.3, SourceCodester Best Salon Management System) - [CVE-2025-6861](https://cve.now/CVE-2025-6861.md): SourceCodester Best Salon Management System add\_plan.php sql injection (CVSS 5.3, SourceCodester Best Salon Management System) - [CVE-2025-6860](https://cve.now/CVE-2025-6860.md): SourceCodester Best Salon Management System staff\_commision.php sql injection (CVSS 5.3, SourceCodester Best Salon Management System) - [CVE-2025-6859](https://cve.now/CVE-2025-6859.md): SourceCodester Best Salon Management System pro\_sale.php sql injection (CVSS 5.3, SourceCodester Best Salon Management System) - [CVE-2024-24915](https://cve.now/CVE-2024-24915.md): SmartConsole Sensitive Credential Exposure via Memory Dump (CVSS 6.1, checkpoint Check Point SmartConsole) - [CVE-2025-5878](https://cve.now/CVE-2025-5878.md): ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special element (CVSS 6.9, esapi-java-legacy) - [CVE-2025-6858](https://cve.now/CVE-2025-6858.md): HDF5 H5Centry.c H5C\_\_flush\_single\_entry null pointer dereference (CVSS 4.8, HDF5) - [CVE-2025-6857](https://cve.now/CVE-2025-6857.md): HDF5 H5Gnode.c H5G\_\_node\_cmp3 stack-based overflow (CVSS 4.8, HDF5) - [CVE-2025-6856](https://cve.now/CVE-2025-6856.md): HDF5 H5FL.c H5FL\_\_reg\_gc\_list use after free (CVSS 4.8, HDF5) - [CVE-2025-6855](https://cve.now/CVE-2025-6855.md): chatchat-space Langchain-Chatchat file path traversal (CVSS 5.1, chatchat-space Langchain-Chatchat · langchain-chatchat) - [CVE-2025-6854](https://cve.now/CVE-2025-6854.md): chatchat-space Langchain-Chatchat files path traversal (CVSS 5.3, chatchat-space Langchain-Chatchat · langchain-chatchat) - [CVE-2025-6853](https://cve.now/CVE-2025-6853.md): chatchat-space Langchain-Chatchat Backend upload\_temp\_docs path traversal (CVSS 5.3, chatchat-space Langchain-Chatchat · langchain-chatchat) - [CVE-2025-6850](https://cve.now/CVE-2025-6850.md): code-projects Simple Forum forum1.php sql injection (CVSS 5.3, code-projects Simple Forum) - [CVE-2025-6849](https://cve.now/CVE-2025-6849.md): code-projects Simple Forum forum\_edit1.php cross site scripting (CVSS 5.1, code-projects Simple Forum) - [CVE-2025-6848](https://cve.now/CVE-2025-6848.md): code-projects Simple Forum forum1.php unrestricted upload (CVSS 5.3, code-projects Simple Forum) - [CVE-2025-6847](https://cve.now/CVE-2025-6847.md): code-projects Simple Forum forum\_edit.php sql injection (CVSS 5.3, code-projects Simple Forum) - [CVE-2025-6846](https://cve.now/CVE-2025-6846.md): code-projects Simple Forum forum\_viewfile.php sql injection (CVSS 6.9, code-projects Simple Forum) - [CVE-2025-6845](https://cve.now/CVE-2025-6845.md): code-projects Simple Forum register1.php sql injection (CVSS 6.9, code-projects Simple Forum) - [CVE-2025-6462](https://cve.now/CVE-2025-6462.md): EZ SQL Reports Shortcode Widget and DB Backup \<= 5.25.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via SQLREPORT Shortcode (CVSS 6.4, scheeeli EZ SQL Reports Shortcode Widget and DB Backup) - [CVE-2025-6844](https://cve.now/CVE-2025-6844.md): code-projects Simple Forum signin.php sql injection (CVSS 6.9, code-projects Simple Forum) - [CVE-2025-6843](https://cve.now/CVE-2025-6843.md): code-projects Simple Photo Gallery upload-photo.php unrestricted upload (CVSS 6.9, code-projects Simple Photo Gallery) - [CVE-2025-6842](https://cve.now/CVE-2025-6842.md): code-projects Product Inventory System edit\_user.php sql injection (CVSS 5.1, code-projects Product Inventory System) - [CVE-2025-6841](https://cve.now/CVE-2025-6841.md): code-projects Product Inventory System edit\_product.php sql injection (CVSS 5.1, code-projects Product Inventory System) - [CVE-2025-6840](https://cve.now/CVE-2025-6840.md): code-projects Product Inventory System Login index.php sql injection (CVSS 6.9, code-projects Product Inventory System) - [CVE-2025-6839](https://cve.now/CVE-2025-6839.md): Conjure Position Department Service Quality Evaluation System head.php eval backdoor (CVSS 5.3, Conjure Position Department Service Quality Evaluation Syst…) - [CVE-2025-6837](https://cve.now/CVE-2025-6837.md): code-projects Library System profile.php unrestricted upload (CVSS 5.3, code-projects Library System) - [CVE-2025-6836](https://cve.now/CVE-2025-6836.md): code-projects Library System profile.php sql injection (CVSS 6.9, code-projects Library System) - [CVE-2025-6835](https://cve.now/CVE-2025-6835.md): code-projects Library System student-issue-book.php sql injection (CVSS 6.9, code-projects Library System) - [CVE-2015-20112](https://cve.now/CVE-2015-20112.md): RLPx 5 has two CTR streams based on the same key, IV, and nonce. (CVSS 3.4, Ethereum RLPx) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-06-29 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.