CVEs published in June 2025
3,618 vulnerabilities, 289 critical, 18 exploited.
- tenda fh1201, fh1201 firmware +1 moreTenda FH1201 SafeMacFilter stack-based overflow8.7 High
- hamastar technology wimpHAMASTAR Technology WIMP website co-construction management platform - SQL Injection9.3 Critical
- javahongxi whatsmarsjavahongxi whatsmars InitializrController.java initialize path traversal5.3 Medium
- hansonwang99 spring-boot-in-actionhansonwang99 Spring-Boot-In-Action File Upload ImageUploadService.java watermarkTest path traversal5.3 Medium
- comfyanonymous comfyuicomfyanonymous comfyui utils.py set_attr dynamically-determined object attributes2.3 Low
- wukongopensource wukongcrm, 72crm wukong crm +1 moreWuKongOpenSource WukongCRM AdminRoleController.java cross-site request forgery5.3 Medium
- jflyfox jfinal cmsjflyfox jfinal_cms HOME.java cross-site request forgery5.3 Medium
- wifi-soft unibox controllerWifi-soft UniBox Controller pms_check.php os command injection8.7 High
- wifi-soft unibox controllerWifi-soft UniBox Controller test_accesscodelogin.php os command injection8.7 High
- wifi-soft unibox controllerWifi-soft UniBox Controller logout.php os command injection8.7 High
- letta-ai lettaletta-ai letta interface.py function_message eval injection5.1 Medium
- realguoshuai open-video-cmsrealguoshuai open-video-cms list sql injection5.3 Medium
- szluyu99 gin-vue-blogszluyu99 gin-vue-blog PATCH Request manager.go improper authorization6.9 Medium
- utt 进取 750w, 750w firmware +1 moreUTT 进取 750W API setSysAdm strcpy buffer overflow9.3 Critical
ndpiOSS-FuzzUse-of-uninitialized-value in ndpi_strdupNo score- utt 进取 750w, 750w firmware +1 moreUTT 进取 750W Administrator Password setSysAdm formDefineManagement unverified password change6.9 Medium
- codesiddhant jasmin ransomware, jasmin-ransomware +1 morecodesiddhant Jasmin Ransomware dashboard.php sql injection5.3 Medium
- codesiddhant jasmin ransomware, jasmin-ransomware +1 morecodesiddhant Jasmin Ransomware checklogin.php sql injection6.9 Medium
- qianfox foxcmsqianfox FoxCMS Download.php batchCope sql injection5.3 Medium
- uyanki board-stm32f103rc-berialuYanki board-stm32f103rc-berial heartrate1_hal.c heartrate1_i2c_hal_write stack-based overflow5.1 Medium
- m-files serverPath traversal in M-Files API8.4 High
- arcadia technology, llc crafty controllerImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller7.6 High
- comfyanonymous comfyuicomfyanonymous comfyui Incomplete Fix CVE-2024-10099 image cross site scripting5.3 Medium
- h3c gr-3000axH3C GR-3000AX aspForm UpdateIpv6Params buffer overflow8.7 High
- ping identity pingfederateStored Cross-Site Scripting in Administrative Console Context6.9 Medium
- ping identity pingfederatePossible thread exhaustion from processing http responses in PingFederate Google Adapter6.9 Medium
- h3c gr-5400axH3C GR-5400AX aspForm UpdateIpv6params buffer overflow8.7 High
- ping identity pingfederatePingFederate OAuth Grant attribute duplication may use excessive memory2.1 Low
- astun technology ishare mapsAstun Technology iShare Maps atCheckJS.aspx redirect5.3 Medium
- ibm mq operator, supplied mq advanced container images +1 moreIBM MQ improper certificate validation4.7 Medium
- ibm security verify directoryIBM Security Verify Directory Container command execution7.8 High
xmlsecOSS-FuzzHeap-buffer-overflow in xmlParsePubidLiteralNo score- yith woocommerce wishlist, yithemes yith woocommerce wishlist +1 moreYITH WooCommerce Wishlist <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter6.4 Medium
- metaslider slider, gallery, and carousel by metaslider – image slider, video slider, slider\, gallery\, and carousel +1 moreSlider, Gallery, and Carousel by MetaSlider <= 3.98.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via aria-label Parameter6.4 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking pluginSimply Schedule Appointments <= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes6.4 Medium
- dmitry78 xisearch barXiSearch bar <= 2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- bhittani kk youtube videokk Youtube Video <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- holithemes click to chat – holithemesClick to Chat <= 4.22 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number Parameter6.4 Medium
- josxha restrict file accessRestrict File Access <= 1.1.2 - Authenticated (Subscriber+) Arbitrary File Read6.5 Medium
- netlatch yougler blogger profile pageYougler Blogger Profile Page <= v1.01 - Cross-Site Request Forgery to Settings Update4.3 Medium
- aspengrovestudios ai image lab – free ai image generatorAI Image Lab – Free AI Image Generator <= 1.0.6 - Cross-Site Request Forgery to API Key Update4.3 Medium
- bogdanding zen sticky socialZen Sticky Social <= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- streamweasels kick integrationStreamWeasels Kick Integration <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via status-classic-offline-text Parameter6.4 Medium
- sagesony easy flashcardsEasy Flashcards <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- bzotheme zagg - electronics & accessories woocommerce wordpress themeZagg - Electronics & Accessories WooCommerce WordPress Theme <= 1.4.1 - Unauthenticated Local File Inclusion8.1 High
- No product listedUserPro - Community and User Profile WordPress Plugin <= 5.1.10 - Unauthenticated Arbitrary File Read5.9 Medium
- djerba wp url shortenerWP URL Shortener <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- scada diot scada with mqttDIOT SCADA with MQTT <= 1.0.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wework4web image resizer on the flyImage Resizer On The Fly <= 1.1 - Unauthenticated Arbitrary File Deletion9.1 Critical
- rubengc automatorwp – automator plugin for no-code automations, webhooks & custom integrations in wordpressAutomatorWP <= 5.2.5 - Authenticated (Administrator+) SQL Injection via field_conditions7.2 High
- Show moreLoading…