CVEs published in June 2025
3,618 vulnerabilities, 289 critical, 18 exploited.
- daman jeet real time validation for gravity formsWordPress Real Time Validation for Gravity Forms plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability4.3 Medium
- posimyth the plus addons for elementor page builder liteWordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.2.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pickplugins wishlistWordPress Wishlist plugin <= 1.0.43 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- abu huraira bin aman widgetkitWordPress WidgetKit plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- oceanwp ocean extraWordPress Ocean Extra plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- nasatheme nasa coreWordPress Nasa Core plugin < 6.4.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- phpgurukul bp monitoring management systemPHPGurukul BP Monitoring Management System edit-family-member.php sql injection5.3 Medium
- themehigh dynamic pricing and discount rulesWordPress Dynamic Pricing and Discount Rules plugin <= 2.2.9 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- quickcabwp quickcabWordPress QuickCab plugin <= 1.3.3 - Broken Access Control vulnerability5.3 Medium
- eskapism simple history – track, log, and audit wordpress changesSimple History <= 5.8.1 - Authenticated (Administrator+) Sensitive Information Exposure via Detective Mode4.9 Medium
- themeatelier domain for sale – sell domains with landing pages, offers & inquiriesDomain For Sale <= 3.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via class_name Parameter6.4 Medium
- phpgurukul local services search engine management systemPHPGurukul Local Services Search Engine Management System edit-person-detail.php sql injection6.9 Medium
- nikhil-bhalerao open source clinic management systemSourceCodester Open Source Clinic Management System doctor.php sql injection6.9 Medium
- carmelo traffic offense reporting systemcode-projects Traffic Offense Reporting System save-reported.php cross site scripting5.1 Medium
- code-projects real estate property management systemcode-projects Real Estate Property Management System EditCity.php sql injection6.9 Medium
- nikhil-bhalerao open source clinic management systemSourceCodester Open Source Clinic Management System email_config.php sql injection6.9 Medium
- soar cloud system co., ltd. hrd human resource management system, scshr hr portal +1 moreSoar Cloud HRD Human Resource Management System - Missing Authorization8.8 High
- soar cloud system co., ltd. hrd human resource management system, scshr hr portal +1 moreSoar Cloud HRD Human Resource Management System - External Control of File Name or Path8.8 High
- soar cloud system co., ltd. hrd human resource management system, scshr hr portal +1 moreSoar Cloud HRD Human Resource Management System - Unrestricted Upload of File with Dangerous Type9.9 Critical
- soar cloud system co., ltd. hrd human resource management system, scshr hr portal +1 moreSoar Cloud HRD Human Resource Management System - External Control of File Name or Path8.7 High
- soar cloud system co., ltd. hrd human resource management system, scshr hr portal +1 moreSoar Cloud HRD Human Resource Management System - Deserialization of Untrusted Data9.9 Critical
- soar cloud system co., ltd. hrd human resource management system, scshr hr portal +1 moreSoar Cloud HRD Human Resource Management System - Missing Authentication for Critical Function9.3 Critical
- totolink x15, x15 firmware +1 moreTOTOLINK X15 HTTP POST Request formSaveConfig buffer overflow8.7 High
- totolink x15, x15 firmware +1 moreTOTOLINK X15 HTTP POST Request formStats buffer overflow8.7 High
- totolink x15, x15 firmware +1 moreTOTOLINK X15 HTTP POST Request formDosCfg buffer overflow8.7 High
- b. braun melsungen ag onlinesuiteRelative Path Traversal in OnlineSuite9.8 Critical
- b. braun melsungen ag onlinesuiteImproper Neutralization of Special Elements in OnlineSuite10.0 Critical
- b. braun melsungen ag onlinesuiteUse of Hard-coded Credentials in OnlineSuite9.4 Critical
- totolink x15, x15 firmware +1 moreTOTOLINK X15 HTTP POST Request formNtp buffer overflow8.7 High
- totolink x15, x15 firmware +1 moreTOTOLINK X15 HTTP POST Request formSetLg buffer overflow8.7 High
- totolink x15, x15 firmware +1 moreTOTOLINK X15 HTTP POST Request formWlanRedirect buffer overflow8.7 High
- carmelo traffic offense reporting systemcode-projects Traffic Offense Reporting System cross-site request forgery5.3 Medium
- code-projects health center patient record management system, fabianros patient record management system +1 morecode-projects Health Center Patient Record Management System birthing_record.php sql injection5.3 Medium
- nikhil-bhalerao open source clinic management systemSourceCodester Open Source Clinic Management System manage_website.php unrestricted upload5.3 Medium
- huawei harmonyosAbility Auto Startup service vulnerability in the foundation process Impact: Successful...6.7 Medium
- huawei harmonyosVulnerability of improper permission assignment in the note sharing module Impact: Successful...8.2 High
- huawei harmonyosBuffer overflow vulnerability in the DFile module Impact: Successful exploitation of this...5.5 Medium
- huawei harmonyosBypass vulnerability in the device management channel Impact: Successful exploitation of this...7.1 High
- andreyk paged galleryPaged Gallery <= 0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- cyberscorp wp-addpubWP-Addpub <= 1.2.8 - Authenticated (Contributor+) SQL Injection6.5 Medium
- dr scythe wp email debugWP Email Debug 1.0 - 1.1.0 - Missing Authorization to Unauthenticated Privilege Escalation via Password Reset9.8 Critical
- jason-lau hide itHide It <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- frold runners logRunners Log <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- webguyio stop spammers classicAnti-Spam: Spam Protection | Block Spam Users, Comments, Forms <= 2024.7 - Cross-Site Request Forgery to Multiple Administrative Actions5.4 Medium
- cais bns featured categoryBNS Featured Category <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- hk1993 wp online users statsWP Online Users Stats <= 1.0.0 - Authenticated (Editor+) SQL Injection via table_name Parameter4.9 Medium
- rsemeteys freemind viewerFreemind Viewer <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- hivesupport hive support | ai-powered help desk, live chat and chatbotHive Support <= 1.2.5 - Authenticated (Subscriber+) Missing Authorization via hs_update_ai_chat_settings and hive_lite_support_get_all_binbox7.1 High
- hk1993 wp online users statsWP Online Users Stats <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via hk_dataset_results Function6.1 Medium
- malcolm-oph stageshowStageShow <= 10.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor Parameter6.4 Medium
- Show moreLoading…