# CVEs published 2025-06-30

88 CVEs were published on June 30, 2025: 4 critical, 24 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2025-6935](https://cve.now/CVE-2025-6935.md): Campcodes Sales and Inventory System payment\_add.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-6932](https://cve.now/CVE-2025-6932.md): D-Link DCS-7517 Qlync Password Generation httpd g\_F\_n\_GenPassForQlync hard-coded password (CVSS 6.3, D-Link DCS-7517)
- [CVE-2025-6931](https://cve.now/CVE-2025-6931.md): D-Link DCS-6517/DCS-7517 Root Password Generation httpd generate\_pass\_from\_mac entropy (CVSS 6.3, D-Link DCS-6517 · D-Link DCS-7517)
- [CVE-2025-6930](https://cve.now/CVE-2025-6930.md): PHPGurukul Zoo Management System manage-foreigners-ticket.php sql injection (CVSS 5.3, PHPGurukul Zoo Management System)
- [CVE-2025-6554](https://cve.now/CVE-2025-6554.md): Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML pa (CVSS 8.1, KEV, Google Chrome)
- [CVE-2025-6929](https://cve.now/CVE-2025-6929.md): PHPGurukul Zoo Management System view-normal-ticket.php sql injection (CVSS 5.3, PHPGurukul Zoo Management System)
- [CVE-2025-49520](https://cve.now/CVE-2025-49520.md): Event-driven-ansible: authenticated argument injection in git url in eda project creation (CVSS 8.8, Red Hat Ansible Automation Platform 2.5 for RHEL)
- [CVE-2025-49521](https://cve.now/CVE-2025-49521.md): Event-driven-ansible: template injection via git branch and refspec in eda projects (CVSS 8.8, Red Hat Ansible Automation Platform 2.5 for RHEL)
- [CVE-2025-53004](https://cve.now/CVE-2025-53004.md): Dataease Redshift Data Source JDBC Connection Parameters Bypass Vulnerability (CVSS 8.9, dataease)
- [CVE-2025-52997](https://cve.now/CVE-2025-52997.md): File Browser Insecurely Handles Passwords (CVSS 5.9, filebrowser · github.com/filebrowser/filebrowser/v2 +1)
- [CVE-2025-52996](https://cve.now/CVE-2025-52996.md): File Browser's Password Protection of Links Vulnerable to Bypass (CVSS 3.1, filebrowser · github.com/filebrowser/filebrowser/v2 +1)
- [CVE-2025-52995](https://cve.now/CVE-2025-52995.md): File Browser vulnerable to command execution allowlist bypass (CVSS 8.1, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2025-52901](https://cve.now/CVE-2025-52901.md): File Browser allows sensitive data to be transferred in URL (CVSS 4.5, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2025-36593](https://cve.now/CVE-2025-36593.md): Dell OpenManage Network Integration, versions prior to 3.8, contains an Authentication Bypass by Capture-replay vulnerability in the RADIUS (CVSS 8.8, Dell OpenManage Network Integration)
- [CVE-2025-6925](https://cve.now/CVE-2025-6925.md): Dromara RuoYi-Vue-Plus Mail MailController.java path traversal (CVSS 6.9, Dromara RuoYi-Vue-Plus)
- [CVE-2025-6917](https://cve.now/CVE-2025-6917.md): code-projects Online Hotel Booking registration.php sql injection (CVSS 6.9, code-projects Online Hotel Booking)
- [CVE-2025-52898](https://cve.now/CVE-2025-52898.md): Frappe account takeover via password reset token leakage (CVSS 8.7, frappe)
- [CVE-2025-52896](https://cve.now/CVE-2025-52896.md): Frappe authenticated XSS via data import (CVSS 8.6, frappe)
- [CVE-2025-52895](https://cve.now/CVE-2025-52895.md): Frappe possibility of SQL injection due to improper validations (CVSS 8.7, frappe)
- [CVE-2025-6916](https://cve.now/CVE-2025-6916.md): TOTOLINK T6 formLoginAuth.htm Form\_Login missing authentication (CVSS 8.7, TOTOLINK T6)
- [CVE-2025-47871](https://cve.now/CVE-2025-47871.md): Mattermost Playbooks exposes private channel metadata to unauthorized users via run metadata API (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-46702](https://cve.now/CVE-2025-46702.md): Mattermost Playbooks allows privilege escalation through improper access control in playbook run participant management (CVSS 5.4, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-6915](https://cve.now/CVE-2025-6915.md): PHPGurukul Student Record System register.php sql injection (CVSS 5.3, PHPGurukul Student Record System)
- [CVE-2025-6914](https://cve.now/CVE-2025-6914.md): PHPGurukul Student Record System edit-student.php sql injection (CVSS 5.3, PHPGurukul Student Record System)
- [CVE-2024-12915](https://cve.now/CVE-2024-12915.md): Reflected XSS in Devinim Software's Modified Koha Library Software (CVSS 4.6, Devinim Software Library Software)
- [CVE-2025-6913](https://cve.now/CVE-2025-6913.md): PHPGurukul Student Record System admin-profile.php sql injection (CVSS 5.3, PHPGurukul Student Record System)
- [CVE-2025-6912](https://cve.now/CVE-2025-6912.md): PHPGurukul Student Record System manage-students.php sql injection (CVSS 5.3, PHPGurukul Student Record System)
- [CVE-2025-2895](https://cve.now/CVE-2025-2895.md): IBM Cloud Pak System HTML injection (CVSS 5.4, IBM Cloud Pak System)
- [CVE-2025-6911](https://cve.now/CVE-2025-6911.md): PHPGurukul Student Record System manage-subjects.php sql injection (CVSS 5.3, PHPGurukul Student Record System)
- [CVE-2025-6910](https://cve.now/CVE-2025-6910.md): PHPGurukul Student Record System session.php sql injection (CVSS 5.3, PHPGurukul Student Record System)
- [CVE-2025-6909](https://cve.now/CVE-2025-6909.md): PHPGurukul Old Age Home Management System add-scdetails.php sql injection (CVSS 5.3, PHPGurukul Old Age Home Management System)
- [CVE-2025-6908](https://cve.now/CVE-2025-6908.md): PHPGurukul Old Age Home Management System edit-services.php sql injection (CVSS 5.3, PHPGurukul Old Age Home Management System)
- [CVE-2025-6907](https://cve.now/CVE-2025-6907.md): code-projects Car Rental System book\_car.php sql injection (CVSS 6.9, code-projects Car Rental System)
- [CVE-2025-6906](https://cve.now/CVE-2025-6906.md): code-projects Car Rental System login.php sql injection (CVSS 6.9, code-projects Car Rental System)
- [CVE-2025-6905](https://cve.now/CVE-2025-6905.md): code-projects Car Rental System signup.php sql injection (CVSS 6.9, code-projects Car Rental System)
- [CVE-2025-4407](https://cve.now/CVE-2025-4407.md): Application does not invalidate session after password reset (CVSS 6.8, ABB Lite Panel Pro)
- [CVE-2025-6904](https://cve.now/CVE-2025-6904.md): code-projects Car Rental System add\_cars.php sql injection (CVSS 6.9, code-projects Car Rental System)
- [CVE-2025-40710](https://cve.now/CVE-2025-40710.md): Host Header Injection (HHI) in the Hotspot Shield VPN client (CVSS 2.3, Hotspot Shield VPN client)
- [CVE-2025-6903](https://cve.now/CVE-2025-6903.md): code-projects Car Rental System approve.php sql injection (CVSS 6.9, code-projects Car Rental System)
- [CVE-2025-6902](https://cve.now/CVE-2025-6902.md): code-projects Inventory Management System editUser.php sql injection (CVSS 6.9, code-projects Inventory Management System)
- [CVE-2024-8419](https://cve.now/CVE-2024-8419.md): Improper Access Control vulnerability in AC4xxS devices (CVSS 7.5, ifm electronic ifm Smart PLC AC402s · ifm electronic ifm… +3)
- [CVE-2025-6901](https://cve.now/CVE-2025-6901.md): code-projects Inventory Management System removeUser.php sql injection (CVSS 6.9, code-projects Inventory Management System)
- [CVE-2025-41439](https://cve.now/CVE-2025-41439.md): A reflected cross-site scripting vulnerability via a specific parameter exists in SLNX Help Documentation of RICOH Streamline NX. (CVSS 6.1, Ricoh Company RICOH Streamline NX)
- [CVE-2025-53416](https://cve.now/CVE-2025-53416.md): File Parsing Deserialization of Untrusted Data in DTN Soft (CVSS 7.8, Delta Electronics DTN Soft)
- [CVE-2025-53415](https://cve.now/CVE-2025-53415.md): File Parsing Deserialization of Untrusted Data in DTM Soft (CVSS 7.8, Delta Electronics DTM Soft)
- [CVE-2025-6900](https://cve.now/CVE-2025-6900.md): code-projects Library System add-book.php unrestricted upload (CVSS 5.3, code-projects Library System)
- [CVE-2025-6899](https://cve.now/CVE-2025-6899.md): D-Link DI-7300G+/DI-8200G msp\_info.htm os command injection (CVSS 5.3, D-Link DI-7300G+ · D-Link DI-8200G)
- [CVE-2025-40734](https://cve.now/CVE-2025-40734.md): Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager (CVSS 5.1, Daily Expense Manager)
- [CVE-2025-40733](https://cve.now/CVE-2025-40733.md): Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager (CVSS 5.1, Daily Expense Manager)
- [CVE-2025-40732](https://cve.now/CVE-2025-40732.md): User enumeration vulnerability in Daily Expense Manager (CVSS 8.7, Daily Expense Manager)
- [CVE-2025-40731](https://cve.now/CVE-2025-40731.md): SQL injection vulnerability in Daily Expense Manager (CVSS 8.7, Daily Expense Manager)
- [CVE-2025-6898](https://cve.now/CVE-2025-6898.md): D-Link DI-7300G+ in proxy\_client.asp os command injection (CVSS 5.3, D-Link DI-7300G+)
- [CVE-2025-6897](https://cve.now/CVE-2025-6897.md): D-Link DI-7300G+ httpd\_debug.asp os command injection (CVSS 5.1, D-Link DI-7300G+)
- [CVE-2025-38090](https://cve.now/CVE-2025-38090.md): drivers/rapidio/rio\_cm.c: prevent possible heap overwrite (CVSS 7.8, Linux)
- [CVE-2025-38089](https://cve.now/CVE-2025-38089.md): sunrpc: handle SVC\_GARBAGE during svc auth processing as auth error (CVSS 9.8, Linux)
- [CVE-2025-38088](https://cve.now/CVE-2025-38088.md): powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (no CVSS, Linux)
- [CVE-2025-38087](https://cve.now/CVE-2025-38087.md): net/sched: fix use-after-free in taprio\_dev\_notifier (CVSS 7.8, Linux)
- [CVE-2025-6896](https://cve.now/CVE-2025-6896.md): D-Link DI-7300G+ wget\_test.asp os command injection (CVSS 5.3, D-Link DI-7300G+)
- [CVE-2025-6891](https://cve.now/CVE-2025-6891.md): code-projects Inventory Management System createUser.php sql injection (CVSS 6.9, code-projects Inventory Management System)
- [CVE-2025-6890](https://cve.now/CVE-2025-6890.md): code-projects Movie Ticketing System ticketConfirmation.php sql injection (CVSS 5.3, code-projects Movie Ticketing System)
- [CVE-2025-5730](https://cve.now/CVE-2025-5730.md): Easy Contact Form Lite \< 1.1.29 - Contributor+ Stored XSS (CVSS 4.3, Contact Form Plugin)
- [CVE-2025-3745](https://cve.now/CVE-2025-3745.md): WP Lightbox 2 \< 3.0.6.8 - Unauthenticated Stored XSS (CVSS 6.3, WP Lightbox)
- [CVE-2025-6889](https://cve.now/CVE-2025-6889.md): code-projects Movie Ticketing System logIn.php sql injection (CVSS 6.9, code-projects Movie Ticketing System)
- [CVE-2025-6888](https://cve.now/CVE-2025-6888.md): PHPGurukul Teachers Record Management System changeimage.php sql injection (CVSS 6.9, PHPGurukul Teachers Record Management System)
- [CVE-2025-6887](https://cve.now/CVE-2025-6887.md): Tenda AC5 SetSysTimeCfg stack-based overflow (CVSS 8.7, Tenda AC5)
- [CVE-2025-6886](https://cve.now/CVE-2025-6886.md): Tenda AC5 openSchedWifi stack-based overflow (CVSS 8.7, Tenda AC5)
- [CVE-2025-6885](https://cve.now/CVE-2025-6885.md): PHPGurukul Teachers Record Management System edit-teacher-detail.php sql injection (CVSS 6.9, PHPGurukul Teachers Record Management System)
- [CVE-2025-6884](https://cve.now/CVE-2025-6884.md): code-projects Staff Audit System search\_index.php sql injection (CVSS 5.3, code-projects Staff Audit System)
- [CVE-2025-6883](https://cve.now/CVE-2025-6883.md): code-projects Staff Audit System update\_index.php sql injection (CVSS 5.3, code-projects Staff Audit System)
- [CVE-2025-6882](https://cve.now/CVE-2025-6882.md): D-Link DIR-513 formSetWanPPTP buffer overflow (CVSS 8.7, D-Link DIR-513)
- [CVE-2025-53074](https://cve.now/CVE-2025-53074.md): Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.2. (CVSS 5.1, Samsung Open Source rLottie)
- [CVE-2025-53076](https://cve.now/CVE-2025-53076.md): Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLottie: V0.2. (CVSS 5.1, Samsung Open Source rLottie)
- [CVE-2025-53075](https://cve.now/CVE-2025-53075.md): Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie: V0.2. (CVSS 4.6, Samsung Open Source rLottie)
- [CVE-2025-0634](https://cve.now/CVE-2025-0634.md): Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.2. (CVSS 5.1, Samsung Open Source rLottie)
- [CVE-2025-6881](https://cve.now/CVE-2025-6881.md): D-Link DI-8100 jhttpd pppoe\_base.asp buffer overflow (CVSS 8.7, D-Link DI-8100)
- [CVE-2025-6880](https://cve.now/CVE-2025-6880.md): SourceCodester Best Salon Management System edit-tax.php sql injection (CVSS 5.3, SourceCodester Best Salon Management System)
- [CVE-2025-6879](https://cve.now/CVE-2025-6879.md): SourceCodester Best Salon Management System add-tax.php sql injection (CVSS 5.3, SourceCodester Best Salon Management System)
- [CVE-2025-6878](https://cve.now/CVE-2025-6878.md): SourceCodester Best Salon Management System search-appointment.php sql injection (CVSS 5.3, SourceCodester Best Salon Management System)
- [CVE-2023-47310](https://cve.now/CVE-2023-47310.md): A misconfiguration in the default settings of MikroTik RouterOS 7 and fixed in v7.14 allows incoming IPv6 UDP traceroute packets. (CVSS 6.5)
- [CVE-2024-53621](https://cve.now/CVE-2024-53621.md): A buffer overflow in the formSetCfm() function of Tenda AC1206 1200M 11ac US\_AC1206V1.0RTL\_V15.03.06.23\_multi\_TD01 allows attackers to cause (CVSS 7.5)
- [CVE-2025-26074](https://cve.now/CVE-2025-26074.md): Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes. (CVSS 9.8, org.conductoross:conductor-core)
- [CVE-2025-32462](https://cve.now/CVE-2025-32462.md): Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to e (CVSS 2.8, Sudo project Sudo)
- [CVE-2025-32463](https://cve.now/CVE-2025-32463.md): Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the - (CVSS 9.3, KEV, Sudo project Sudo)
- [CVE-2025-45143](https://cve.now/CVE-2025-45143.md): string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input. (CVSS 7.0, string-math)
- [CVE-2025-45931](https://cve.now/CVE-2025-45931.md): An issue D-Link DIR-816-A2 DIR-816A2\_FWv1.10CNB05\_R1B011D88210 allows a remote attacker to execute arbitrary code via system() function in t (CVSS 9.8)
- [CVE-2025-46014](https://cve.now/CVE-2025-46014.md): Several services in Honor Device Co., Ltd Honor PC Manager v16.0.0.118 was discovered to connect services to the named pipe iMateBookAssista (CVSS 8.8)
- [CVE-2025-49493](https://cve.now/CVE-2025-49493.md): Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection. (CVSS 5.8, Akamai CloudTest)
- [CVE-2025-52491](https://cve.now/CVE-2025-52491.md): Akamai CloudTest before 60 2025.06.09 (12989) allows SSRF. (CVSS 5.8, Akamai CloudTest)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-06-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.