CVEs published June 30, 2025
88 CVEs were published on June 30, 2025: 4 critical, 24 high. 2 are now in CISA KEV.
- Published
- 88
- Critical
- 4
- High
- 24
- Medium
- 56
- Low
- 3
- Unrated
- 1
- Now in CISA KEV
- 2
- Fix available
- 22
Most affected products
- PHPGurukul Student Record System
- 6
- code-projects Car Rental System
- 5
- Daily Expense Manager
- 4
- Linux
- 4
- Samsung Open Source rLottie
- 4
- code-projects Inventory Management System
- 3
- D-Link DI-7300G+
- 3
- frappe
- 3
- SourceCodester Best Salon Management System
- 3
- Akamai CloudTest
- 2
Critical 4
- CVE-2025-38089sunrpc: handle SVC_GARBAGE during svc auth processing as auth errorLinux
- CVE-2025-26074Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes.org.conductoross:conductor-core
- CVE-2025-32463Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the -Sudo project Sudo
- CVE-2025-45931An issue D-Link DIR-816-A2 DIR-816A2_FWv1.10CNB05_R1B011D88210 allows a remote attacker to execute arbitrary code via system() function in t
High 24
- CVE-2025-6554Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML paGoogle Chrome
- CVE-2025-49520Event-driven-ansible: authenticated argument injection in git url in eda project creationRed Hat Ansible Automation Platform 2.5 for RHEL
- CVE-2025-49521Event-driven-ansible: template injection via git branch and refspec in eda projectsRed Hat Ansible Automation Platform 2.5 for RHEL
- CVE-2025-53004Dataease Redshift Data Source JDBC Connection Parameters Bypass Vulnerabilitydataease
- CVE-2025-52995File Browser vulnerable to command execution allowlist bypassfilebrowser · github.com/filebrowser/filebrowser +1
- CVE-2025-36593Dell OpenManage Network Integration, versions prior to 3.8, contains an Authentication Bypass by Capture-replay vulnerability in the RADIUS Dell OpenManage Network Integration
- CVE-2025-52898Frappe account takeover via password reset token leakagefrappe
- CVE-2025-52896Frappe authenticated XSS via data importfrappe
- CVE-2025-52895Frappe possibility of SQL injection due to improper validationsfrappe
- CVE-2025-6916TOTOLINK T6 formLoginAuth.htm Form_Login missing authenticationTOTOLINK T6
- CVE-2024-8419Improper Access Control vulnerability in AC4xxS devicesifm electronic ifm Smart PLC AC402s · ifm electronic ifm… +3
- CVE-2025-53416File Parsing Deserialization of Untrusted Data in DTN SoftDelta Electronics DTN Soft
- CVE-2025-53415File Parsing Deserialization of Untrusted Data in DTM SoftDelta Electronics DTM Soft
- CVE-2025-40732User enumeration vulnerability in Daily Expense ManagerDaily Expense Manager
- CVE-2025-40731SQL injection vulnerability in Daily Expense ManagerDaily Expense Manager
- CVE-2025-38090drivers/rapidio/rio_cm.c: prevent possible heap overwriteLinux
- CVE-2025-38087net/sched: fix use-after-free in taprio_dev_notifierLinux
- CVE-2025-6887Tenda AC5 SetSysTimeCfg stack-based overflowTenda AC5
- CVE-2025-6886Tenda AC5 openSchedWifi stack-based overflowTenda AC5
- CVE-2025-6882D-Link DIR-513 formSetWanPPTP buffer overflowD-Link DIR-513
- CVE-2025-6881D-Link DI-8100 jhttpd pppoe_base.asp buffer overflowD-Link DI-8100
- CVE-2024-53621A buffer overflow in the formSetCfm() function of Tenda AC1206 1200M 11ac US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 allows attackers to cause
- CVE-2025-45143string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.string-math
- CVE-2025-46014Several services in Honor Device Co., Ltd Honor PC Manager v16.0.0.118 was discovered to connect services to the named pipe iMateBookAssista
Medium, low and unrated 60
- CVE-2025-6935Campcodes Sales and Inventory System payment_add.php sql injectionCampcodes Sales and Inventory System
- CVE-2025-6932D-Link DCS-7517 Qlync Password Generation httpd g_F_n_GenPassForQlync hard-coded passwordD-Link DCS-7517
- CVE-2025-6931D-Link DCS-6517/DCS-7517 Root Password Generation httpd generate_pass_from_mac entropyD-Link DCS-6517 · D-Link DCS-7517
- CVE-2025-6930PHPGurukul Zoo Management System manage-foreigners-ticket.php sql injectionPHPGurukul Zoo Management System
- CVE-2025-6929PHPGurukul Zoo Management System view-normal-ticket.php sql injectionPHPGurukul Zoo Management System
- CVE-2025-52997File Browser Insecurely Handles Passwordsfilebrowser · github.com/filebrowser/filebrowser/v2 +1
- CVE-2025-52996File Browser's Password Protection of Links Vulnerable to Bypassfilebrowser · github.com/filebrowser/filebrowser/v2 +1
- CVE-2025-52901File Browser allows sensitive data to be transferred in URLfilebrowser · github.com/filebrowser/filebrowser +1
- CVE-2025-6925Dromara RuoYi-Vue-Plus Mail MailController.java path traversalDromara RuoYi-Vue-Plus
- CVE-2025-6917code-projects Online Hotel Booking registration.php sql injectioncode-projects Online Hotel Booking
- CVE-2025-47871Mattermost Playbooks exposes private channel metadata to unauthorized users via run metadata APIMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-46702Mattermost Playbooks allows privilege escalation through improper access control in playbook run participant managementMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-6915PHPGurukul Student Record System register.php sql injectionPHPGurukul Student Record System
- CVE-2025-6914PHPGurukul Student Record System edit-student.php sql injectionPHPGurukul Student Record System
- CVE-2024-12915Reflected XSS in Devinim Software's Modified Koha Library SoftwareDevinim Software Library Software
- CVE-2025-6913PHPGurukul Student Record System admin-profile.php sql injectionPHPGurukul Student Record System
- CVE-2025-6912PHPGurukul Student Record System manage-students.php sql injectionPHPGurukul Student Record System
- CVE-2025-2895IBM Cloud Pak System HTML injectionIBM Cloud Pak System
- CVE-2025-6911PHPGurukul Student Record System manage-subjects.php sql injectionPHPGurukul Student Record System
- CVE-2025-6910PHPGurukul Student Record System session.php sql injectionPHPGurukul Student Record System
- CVE-2025-6909PHPGurukul Old Age Home Management System add-scdetails.php sql injectionPHPGurukul Old Age Home Management System
- CVE-2025-6908PHPGurukul Old Age Home Management System edit-services.php sql injectionPHPGurukul Old Age Home Management System
- CVE-2025-6907code-projects Car Rental System book_car.php sql injectioncode-projects Car Rental System
- CVE-2025-6906code-projects Car Rental System login.php sql injectioncode-projects Car Rental System
- CVE-2025-6905code-projects Car Rental System signup.php sql injectioncode-projects Car Rental System
- CVE-2025-4407Application does not invalidate session after password resetABB Lite Panel Pro
- CVE-2025-6904code-projects Car Rental System add_cars.php sql injectioncode-projects Car Rental System
- CVE-2025-40710Host Header Injection (HHI) in the Hotspot Shield VPN clientHotspot Shield VPN client
- CVE-2025-6903code-projects Car Rental System approve.php sql injectioncode-projects Car Rental System
- CVE-2025-6902code-projects Inventory Management System editUser.php sql injectioncode-projects Inventory Management System
- CVE-2025-6901code-projects Inventory Management System removeUser.php sql injectioncode-projects Inventory Management System
- CVE-2025-41439A reflected cross-site scripting vulnerability via a specific parameter exists in SLNX Help Documentation of RICOH Streamline NX.Ricoh Company RICOH Streamline NX
- CVE-2025-6900code-projects Library System add-book.php unrestricted uploadcode-projects Library System
- CVE-2025-6899D-Link DI-7300G+/DI-8200G msp_info.htm os command injectionD-Link DI-7300G+ · D-Link DI-8200G
- CVE-2025-40734Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense ManagerDaily Expense Manager
- CVE-2025-40733Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense ManagerDaily Expense Manager
- CVE-2025-6898D-Link DI-7300G+ in proxy_client.asp os command injectionD-Link DI-7300G+
- CVE-2025-6897D-Link DI-7300G+ httpd_debug.asp os command injectionD-Link DI-7300G+
- CVE-2025-38088powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmapLinux
- CVE-2025-6896D-Link DI-7300G+ wget_test.asp os command injectionD-Link DI-7300G+
- CVE-2025-6891code-projects Inventory Management System createUser.php sql injectioncode-projects Inventory Management System
- CVE-2025-6890code-projects Movie Ticketing System ticketConfirmation.php sql injectioncode-projects Movie Ticketing System
- CVE-2025-5730Easy Contact Form Lite < 1.1.29 - Contributor+ Stored XSSContact Form Plugin
- CVE-2025-3745WP Lightbox 2 < 3.0.6.8 - Unauthenticated Stored XSSWP Lightbox
- CVE-2025-6889code-projects Movie Ticketing System logIn.php sql injectioncode-projects Movie Ticketing System
- CVE-2025-6888PHPGurukul Teachers Record Management System changeimage.php sql injectionPHPGurukul Teachers Record Management System
- CVE-2025-6885PHPGurukul Teachers Record Management System edit-teacher-detail.php sql injectionPHPGurukul Teachers Record Management System
- CVE-2025-6884code-projects Staff Audit System search_index.php sql injectioncode-projects Staff Audit System
- CVE-2025-6883code-projects Staff Audit System update_index.php sql injectioncode-projects Staff Audit System
- CVE-2025-53074Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.2.Samsung Open Source rLottie
- CVE-2025-53076Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLottie: V0.2.Samsung Open Source rLottie
- CVE-2025-53075Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie: V0.2.Samsung Open Source rLottie
- CVE-2025-0634Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.2.Samsung Open Source rLottie
- CVE-2025-6880SourceCodester Best Salon Management System edit-tax.php sql injectionSourceCodester Best Salon Management System
- CVE-2025-6879SourceCodester Best Salon Management System add-tax.php sql injectionSourceCodester Best Salon Management System
- CVE-2025-6878SourceCodester Best Salon Management System search-appointment.php sql injectionSourceCodester Best Salon Management System
- CVE-2023-47310A misconfiguration in the default settings of MikroTik RouterOS 7 and fixed in v7.14 allows incoming IPv6 UDP traceroute packets.
- CVE-2025-32462Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to eSudo project Sudo
- CVE-2025-49493Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.Akamai CloudTest
- CVE-2025-52491Akamai CloudTest before 60 2025.06.09 (12989) allows SSRF.Akamai CloudTest