CVEs published in June 2025
3,618 vulnerabilities, 289 critical, 18 exploited.
- emraan cheema cubewp formsWordPress CubeWP Forms plugin <= 1.1.5 - Broken Access Control Vulnerability4.3 Medium
- themezaa lithoWordPress Litho theme <= 3.0 - Arbitrary File Deletion Vulnerability8.6 High
- emraan cheema cubewpWordPress CubeWP Framework plugin <= 1.1.23 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- cyberchimps responsive blocksWordPress Responsive Blocks plugin <= 2.0.5 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- merkulove reformer for elementorWordPress Reformer for Elementor plugin <= 1.0.5 - Arbitrary File Upload Vulnerability10.0 Critical
- fastw3b llc fw galleryWordPress FW Gallery plugin <= 8.0.0 - Arbitrary File Deletion Vulnerability8.6 High
- fastw3b llc fw food menuWordPress FW Food Menu <= 6.0.0 - Arbitrary File Upload Vulnerability10.0 Critical
- gnome gdkpixbuf, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreGdk-pixbuf: uninitialized memory disclosure in gdkpixbuf gif lzw decoder3.3 Low
- gnome libgepub, red hat enterprise linux 7 +1 moreLibgepub: integer overflow in libgepub's epub archive handling5.5 Medium
- ash-project ash authentication phoenixMissing Session Revocation on Logout in ash_authentication_phoenix2.3 Low
- zendtoZendTo < 6.15-8 Path Traversal5.3 Medium
- conda-forge conda-forge-webservicesconda-forge-webservices Privilege Escalation Risk via Default Docker Root User1.0 Low
- python software foundation cpythonHTMLParser quadratic complexity when processing malformed inputs4.3 Medium
- citrix secure access client for windows, secure access client +1 moreCitrix Secure Access - Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges8.6 High
- citrix workspace, workspace app for windows +1 moreCitrix Workspace App for Windows - Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges7.3 High
- citrix netscaler console, netscaler sdx, iidk-the-actual console +1 more +3 moreNetScaler Console and NetScaler SDX (SVM) - Arbitrary file read6.9 Medium
- citrix netscaler gateway, netscaler adc, citrix netscaler application delivery controller +2 moreNetScaler ADC and NetScaler Gateway - Improper access control on the NetScaler Management Interface8.7 High
- citrix netscaler gateway, netscaler adc, gateway +2 more +4 moreNetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread9.3 Critical
- averta master slider – responsive touch slider, master slider +1 moreMaster Slider <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via masterslider_pb and ms_slide Shortcodes6.4 Medium
- assafp quiz, poll & survey maker by opinion stage, opinionstage poll\, survey \& quiz maker +1 morePoll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.9.0 - Incorrect Authorization to Authenticated (Contributor+) Plugin Settings Update4.3 Medium
- tvledesign simple logo carouselSimple Logo Carousel <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter6.4 Medium
- jupo mezzanineStored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface4.8 Medium
- red hat cert-manager operator for red hat openshift 1.16, openshift compliance operator 1, discovery 2 +33 more +35 moreLinux-pam: linux-pam directory traversal7.8 High
- glenwpcoder drag and drop multiple file upload for contact form 7, codedropz drag and drop multiple file upload - contact form 7 +1 moreDrag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks8.1 High
- oscommerceReflected Cross-Site Scripting (XSS) in osCommerce5.1 Medium
python-djangoUbuntupython-django vulnerabilityNo score- webkul qloappsWebkul QloApps ajax_products_list.php sql injection5.1 Medium
- themanojdesai python-a2a, python a2a +1 morethemanojdesai python-a2a api.py create_workflow path traversal5.1 Medium
- agent-zerofrdel Agent-Zero image_get.py image_get path traversal5.1 Medium
- totolink x15, x15 firmware +1 moreTOTOLINK X15 HTTP POST Request formTmultiAP buffer overflow8.7 High
- ivorysearch ivory searchIvory Search < 5.5.10 - Admin+ Stored XSS4.8 Medium
- totolink a3002r, a3002r firmware +1 moreTOTOLINK A3002R HTTP POST Request formMultiAP buffer overflow8.7 High
- totolink a3002ru, a3002ru firmware +1 moreTOTOLINK A3002RU HTTP POST Request formMultiAP buffer overflow8.7 High
- totolink ex1200t, ex1200t firmware +1 moreTOTOLINK EX1200T HTTP POST Request formMultiAP buffer overflow8.7 High
- code-projects simple food ordering systemSourceCodester Simple Food Ordering System editproduct.php unrestricted upload6.9 Medium
- sourcecodester client database management system, downloading client database management system +1 moreSourceCodester Client Database Management System user_customer_create_order.php sql injection6.9 Medium
- code-projects hostel management systemcode-projects Hostel Management System allocate_room.php sql injection6.9 Medium
- d-link dir-665, dlink dir-655 firmware +1 moreD-Link DIR-665 HTTP POST Request sub_AC78 stack-based overflow8.7 High
- phpgurukul nipah virus testing management systemPHPGurukul Nipah Virus Testing Management System registered-user-testing.php sql injection6.9 Medium
- phpgurukul nipah virus testing management systemPHPGurukul Nipah Virus Testing Management System bwdates-report-ds.php sql injection5.3 Medium
- phpgurukul hostel management systemPHPGurukul Hostel Management System login-hm.inc.php sql injection6.9 Medium
- phpgurukul hostel management systemPHPGurukul Hostel Management System login.inc.php sql injection6.9 Medium
- conda constructorConda Constructor Command Injection via Unsanitized User Input (Low)0.0 None
- phpgurukul hostel management systemPHPGurukul Hostel Management System students.php sql injection6.9 Medium
- pr-gateway blog2social: social media auto post & schedulerBlog2Social <= 8.4.4 - Authenticated (Subscriber+) SQL Injection via `prgSortPostType` Parameter6.5 Medium
- dcooney ajax load more – infinite scroll, load more, & lazy loadWordPress Infinite Scroll – Ajax Load More <= 7.4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting6.4 Medium
- marcinlawrowski wise chatWise Chat <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header7.2 High
- lenovo browserSteel Browser files.routes.ts handleFileUpload path traversal5.3 Medium
- tp-link tl-wr940n, tp-link systems inc. tl-wr841n v11, tl-wr940n v4 +1 more +3 moreTP-Link TL-WR940N, TL-WR841N WanSlaacCfgRpm.htm buffer overflow8.2 High
- intermesh group-office, groupoffice +1 moreGroup-Office vulnerable to reflected XSS via Look and Feel Formatting input5.3 Medium
- Show moreLoading…