By publication date

Exploited and new serious CVEs: June 2025

207 records · 18 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 3

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
43Plan	CVE-2025-5301Proof of concept	Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)onlyoffice · docs (documentserver) · CWE-79 Pre-auth XSS	Medium6.1	—	62.3%	Jun 12, 2025
37Monitor	CVE-2025-4278No exploit	Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLabgitlab · gitlab · CWE-80 XSS	High8.7	—	10.8%	Jun 12, 2025
31Monitor	CVE-2025-47959No exploit	Visual Studio Remote Code Execution Vulnerabilitymicrosoft · visual studio 2022 · CWE-77 RCE Command injection	High7.1	—	10.9%	Jun 12, 2025
39Monitor	CVE-2025-5288Proof of concept	REST API \| Custom API Generator For Cross Platform And Import Export In WP 1.0.0 - 2.0.3 - Missing Authorization to Unauthenticated Privilege Escalation via proweboccults · rest api \| custom api generator for cross platform and import export in wp · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Jun 12, 2025
21Monitor	CVE-2025-5815Proof of concept	Traffic Monitor <= 3.2.2 - Missing Authorization to Unauthenticated Settings Updatedmitriamartin · traffic monitor · CWE-862 Pre-auth Broken access control (IDOR)	Medium5.3	—	0.4%	Jun 13, 2025
41Plan	CVE-2025-45985Proof of concept	Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450b-link · bl-wr9000 firmware · CWE-77 pre-auth RCE Command injection	Critical9.8	—	6.8%	Jun 13, 2025
42Plan	CVE-2025-45988No exploit	Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450b-link · bl-wr9000 firmware · CWE-77 pre-auth RCE Command injection	Critical9.8	—	10.8%	Jun 13, 2025
50Plan	CVE-2025-49596Proof of concept	MCP Inspector proxy server lacks authentication between the Inspector client and proxymodelcontextprotocol · inspector · CWE-306 pre-auth RCE Auth bypass	Critical9.4	—	44.4%	Jun 13, 2025
39Monitor	CVE-2025-36041Proof of concept	IBM MQ improper certificate validationibm · mq operator · CWE-295 Pre-auth Weak crypto	Critical9.8	—	0.3%	Jun 15, 2025
37Monitor	CVE-2025-5964Proof of concept	Path traversal in M-Files APIm-files · m-files server · CWE-22 Path traversal	High8.4	—	13.0%	Jun 15, 2025
60This week	CVE-2025-6095Weaponized	codesiddhant Jasmin Ransomware checklogin.php sql injectioncodesiddhant · jasmin-ransomware · CWE-74 Pre-auth SQL injection	Medium5.5	—	2.6%	Jun 15, 2025
33Monitor	CVE-2025-3464Proof of concept	A race condition vulnerability exists in Armoury Crate.asus · armoury crate · CWE-367 Auth bypass Race condition	High8.4	—	0.5%	Jun 16, 2025
40Plan	CVE-2025-48976Proof of concept	Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headersapache · commons fileupload · CWE-770 Pre-auth Denial of service	High7.5	—	32.9%	Jun 16, 2025
39Monitor	CVE-2025-48988Proof of concept	Apache Tomcat: FileUpload large number of parts with headers DoSapache · tomcat · CWE-770 Pre-auth Denial of service	High7.5	—	30.5%	Jun 16, 2025
31Monitor	CVE-2025-49125Proof of concept	Apache Tomcat: Security constraint bypass for pre/post-resourcesapache · tomcat · CWE-288 Pre-auth Auth bypass	High7.5	—	3.4%	Jun 16, 2025
31Monitor	CVE-2025-6087No exploit	SSRF vulnerability in opennextjs-cloudflare via /_next/image endpointcloudflare · create-cloudflare · CWE-918 Pre-auth SSRF	High7.8	—	0.9%	Jun 16, 2025
60This week	CVE-2025-43200Weaponized	This issue was addressed with improved checks.apple · ipados Pre-auth	Medium4.2	KEV	1.1%	Jun 16, 2025
41Plan	CVE-2025-3515Proof of concept	Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checkscodedropz · drag and drop multiple file upload - contact form 7 · CWE-434 pre-auth RCE File upload	Critical9.8	—	6.0%	Jun 17, 2025
30Monitor	CVE-2025-4365No exploit	NetScaler Console and NetScaler SDX (SVM) - Arbitrary file readcitrix · netscaler console · CWE-1284	Medium6.9	—	10.7%	Jun 17, 2025
36Monitor	CVE-2025-5349Proof of concept	NetScaler ADC and NetScaler Gateway - Improper access control on the NetScaler Management Interfacecitrix · netscaler application delivery controller · CWE-1284 Pre-auth	High8.7	—	6.1%	Jun 17, 2025
37Monitor	CVE-2025-4404Proof of concept	Freeipa: idm: privilege escalation from host to domain admin in freeipared hat · red hat enterprise linux 10 · CWE-1220	Critical9.1	—	1.9%	Jun 17, 2025
43Plan	CVE-2025-34508No exploit	ZendTo < 6.15-8 Path Traversalzendto · zendto · CWE-22 Path traversal	Medium5.3	—	73.2%	Jun 17, 2025
40Plan	CVE-2025-49071Proof of concept	WordPress Flozen < 1.5.1 - Arbitrary File Upload Vulnerabilitynasatheme · flozen · CWE-434 Pre-auth File upload	Critical10.0	—	0.5%	Jun 17, 2025
17Monitor	CVE-2025-49857No exploit	WordPress myCred plugin <= 2.9.4.2 - Broken Access Control Vulnerabilitysaad iqbal · mycred · CWE-862 Broken access control (IDOR)	Medium4.3	—	0.2%	Jun 17, 2025
97Now	CVE-2025-5777Weaponized	NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overreadcitrix · netscaler application delivery controller · CWE-125 Pre-auth Memory safety	Critical9.3	KEV	99.9%	Jun 17, 2025
47Plan	CVE-2025-34509Proof of concept	Sitecore XM and XP Hardcoded Credentialssitecore · experience commerce · CWE-798 Pre-auth Hard-coded credentials	High7.5	—	55.8%	Jun 17, 2025
42Plan	CVE-2025-34510Weaponized	Sitecore XM, XC, and XP Post-Auth RCE via Zip Slipsitecore · experience commerce · CWE-23 RCE Path traversal	High8.8	—	24.2%	Jun 17, 2025
44Plan	CVE-2025-34511Weaponized	Sitecore PowerShell Extension RCE via Unrestricted Uploadsitecore · experience commerce · CWE-434 RCE File upload	High8.8	—	29.8%	Jun 17, 2025
43Plan	CVE-2025-49212No exploit	An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exetrendmicro · trend micro endpoint encryption · CWE-477 pre-auth RCE Deserialization	Critical9.8	—	13.2%	Jun 17, 2025
43Plan	CVE-2025-49213No exploit	An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exetrendmicro · trend micro endpoint encryption · CWE-477 pre-auth RCE Deserialization	Critical9.8	—	13.2%	Jun 17, 2025
41Plan	CVE-2025-49825Proof of concept	Teleport allows remote authentication bypassgravitational · teleport · CWE-863 Pre-auth Auth bypass Broken access control (IDOR)	Critical9.8	—	7.9%	Jun 17, 2025
40Plan	CVE-2025-1562Proof of concept	Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Authorization to Unauthenticated Arbitrafunnelkit · funnelkit automations · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.8	—	3.3%	Jun 18, 2025
28Monitor	CVE-2025-6220Proof of concept	Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'themefic · ultimate addons for contact form 7 · CWE-434 RCE File upload	High7.2	—	1.0%	Jun 18, 2025
39Monitor	CVE-2025-46157Proof of concept	An issue in EfroTech Time Trax v.1.0 allows a remote attacker to execute arbitrary code via the file attachment function in the leave requesefrotech · timetrax · CWE-434 RCE File upload	Critical9.9	—	0.8%	Jun 18, 2025
39Monitor	CVE-2025-20260Proof of concept	ClamAV PDF Scanning Buffer Overflow Vulnerabilityclamav · clamav · CWE-122 pre-auth RCE Memory safety	Critical9.8	—	1.6%	Jun 18, 2025
39Monitor	CVE-2025-26198Proof of concept	CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component.vishalmathur · cloudclassroom-php project · CWE-89 Pre-auth Auth bypass SQL injection	Critical9.8	—	0.6%	Jun 18, 2025
38Monitor	CVE-2025-6191No exploit	Integer overflow in V8 in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially perform out of bounds memory accessgoogle · chrome · CWE-472 Pre-auth	High8.8	—	11.4%	Jun 18, 2025
39Monitor	CVE-2025-26199Proof of concept	CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability.vishalmathur · cloudclassroom-php project · CWE-319 pre-auth RCE Weak crypto	Critical9.8	—	0.5%	Jun 18, 2025
42Plan	CVE-2025-23121No exploit	A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain userveeam · veeam backup \& replication · CWE-94 RCE	High8.8	—	24.2%	Jun 18, 2025
25Monitor	CVE-2025-24286No exploit	A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code.veeam · veeam backup \& replication · CWE-269 RCE	Medium4.9	—	19.0%	Jun 18, 2025
36Monitor	CVE-2025-52467Proof of concept	pgai secrets exfiltration via `pull_request_target`timescale · pgai · CWE-200 pre-auth RCE Info leak	Critical9.1	—	0.4%	Jun 18, 2025
28Monitor	CVE-2025-6019Proof of concept	Libblockdev: lpe from allow_active to root in libblockdev via udisksred hat · red hat enterprise linux 10 · CWE-250 Local privilege escalation	High7.0	—	0.4%	Jun 19, 2025
38Monitor	CVE-2025-52464Proof of concept	Meshtastic Repeated Public and Private Keypairsmeshtastic · meshtastic firmware · CWE-331 Pre-auth	Critical9.5	—	0.5%	Jun 19, 2025
29Monitor	CVE-2025-6384Proof of concept	Improper Control of Dynamically-Managed Code Resources in Crafter Studiocraftercms · craftercms · CWE-913 RCE	High7.3	—	0.9%	Jun 19, 2025
22Monitor	CVE-2025-6264Proof of concept	Velociraptor priviledge escalation via UpdateConfig artifactrapid7 · velociraptor · CWE-276 RCE	Medium5.5	—	1.0%	Jun 19, 2025
11Monitor	CVE-2025-6299No exploit	TOTOLINK N150RT formWSC os command injectiontotolink · n150rt firmware · CWE-77 RCE Command injection	Low2.0	—	11.6%	Jun 19, 2025
10Monitor	CVE-2025-6335Proof of concept	DedeCMS Template dedetag.class.php command injectiondedecms · dedecms · CWE-74 RCE Command injection	Low2.0	—	6.5%	Jun 20, 2025
30Monitor	CVE-2025-44203Proof of concept	In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs digitaldruid · hoteldruid · CWE-209 Pre-auth Race condition Info leak	High7.5	—	0.5%	Jun 20, 2025
60This week	CVE-2025-49132Weaponized	Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Executionpterodactyl · panel · CWE-94 pre-auth RCE	Critical10.0	—	54.4%	Jun 20, 2025
43Plan	CVE-2025-5121No exploit	Missing Authorization in GitLabgitlab · gitlab · CWE-862 Broken access control (IDOR)	Critical9.9	—	12.4%	Jun 20, 2025
32Monitor	CVE-2024-4994No exploit	Cross-Site Request Forgery (CSRF) in GitLabgitlab · gitlab · CWE-352 Pre-auth CSRF	High8.1	—	0.3%	Jun 20, 2025
60This week	CVE-2025-25034Weaponized	SugarCRM PHP Deserialization RCEsugarcrm · sugarcrm · CWE-502 pre-auth RCE Deserialization	Critical9.3	—	4.9%	Jun 20, 2025
37Monitor	CVE-2025-25037Proof of concept	Aquatronica Controller System Complete Information Disclosureaquatronica · aquatronica controller system · CWE-200 Pre-auth Auth bypass Info leak	Critical9.3	—	1.5%	Jun 20, 2025
56Plan	CVE-2025-34030Proof of concept	sar2html OS Command Injectionsar2html · sar2html · CWE-78 pre-auth RCE Command injection	Critical10.0	—	54.4%	Jun 20, 2025
34Monitor	CVE-2025-34023Proof of concept	Karel IP Phone IP1211 Path Traversalkarel · karel ip phone ip1211 · CWE-22 Path traversal	High8.5	—	1.5%	Jun 20, 2025
53Plan	CVE-2025-6216Proof of concept	Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerabilityalltena · allegra · CWE-640 Pre-auth Auth bypass	Critical9.8	—	47.7%	Jun 20, 2025
88Now	CVE-2025-6218Weaponized	RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerabilityrarlab · winrar · CWE-22 RCE Path traversal	High7.8	KEV	90.4%	Jun 20, 2025
45Plan	CVE-2025-52488Proof of concept	DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user inputdnnsoftware · dotnetnuke · CWE-200 Pre-auth Info leak	High8.6	—	35.7%	Jun 20, 2025
23Monitor	CVE-2025-6403Proof of concept	code-projects School Fees Payment System student.php sql injectionfabian · school fees payment system · CWE-74 Pre-auth SQL injection	Medium5.5	—	2.0%	Jun 21, 2025
30Monitor	CVE-2025-2172No exploit	Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line uaviatrix · controller · CWE-78 RCE Command injection	Medium6.6	—	12.2%	Jun 23, 2025
60This week	CVE-2025-48700Weaponized	An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1.synacor · zimbra collaboration suite · CWE-79 pre-auth RCE XSS	Medium6.1	KEV	1.7%	Jun 23, 2025
32Monitor	CVE-2025-52876No exploit	In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possiblejetbrains · teamcity · CWE-79 XSS	Medium5.4	—	37.8%	Jun 23, 2025
30Monitor	CVE-2025-52877No exploit	In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possiblejetbrains · teamcity · CWE-79 XSS	Medium4.8	—	36.9%	Jun 23, 2025
29Monitor	CVE-2025-49144Proof of concept	Notepad++ Privilege Escalation in Installer via Uncontrolled Executable Search Pathnotepad-plus-plus · notepad-plus-plus · CWE-272 Local privilege escalation	High7.3	—	0.6%	Jun 23, 2025
46Plan	CVE-2025-2828No exploit	SSRF Vulnerability in RequestsToolkit in langchain-ai/langchainlangchain · langchain · CWE-918 Pre-auth SSRF	Critical10.0	—	21.0%	Jun 23, 2025
35Monitor	CVE-2025-34031Proof of concept	Moodle LMS Jmol Plugin Path Traversalgeoffrowland · jmol · CWE-22 Pre-auth Auth bypass Path traversal	High8.7	—	3.0%	Jun 23, 2025
20Monitor	CVE-2025-34032Proof of concept	Moodle LMS Jmol Plugin Cross-site Scripting (XSS)geoffrowland · jmol · CWE-79 pre-auth RCE XSS	Medium5.1	—	0.7%	Jun 23, 2025
33Monitor	CVE-2025-34033Proof of concept	5VTechnologies Blue Angel Software Suite OS Command Injection5vtechnologies · blue angel software suite · CWE-78 RCE Command injection	High7.7	—	11.2%	Jun 23, 2025
47Plan	CVE-2025-34035Proof of concept	EnGenius EnShare IoT Gigabit Cloud Service Command Injectionengeniustech · esr300 firmware · CWE-78 pre-auth RCE Command injection	Critical10.0	—	22.8%	Jun 23, 2025
49Plan	CVE-2025-34036No exploit	Shenzhen TVT CCTV-DVR Command Injectiontvt · td-2108ts-cl firmware · CWE-78 pre-auth RCE Command injection	Critical10.0	—	30.9%	Jun 23, 2025
68This week	CVE-2025-34037Weaponized	Linksys Routers E/WAG/WAP/WES/WET/WRT-Serieslinksys · e4200 · CWE-78 pre-auth RCE Command injection	Critical10.0	—	92.7%	Jun 23, 2025
35Monitor	CVE-2025-34038Proof of concept	Weaver E-cology SQL Injectionweaver · e-cology · CWE-89 pre-auth RCE SQL injection	High8.7	—	2.1%	Jun 23, 2025
45Plan	CVE-2025-34040Proof of concept	Seeyon Zhiyuan OA System Path Traversal File Uploadseeyon (beijing zhiyuan internet software co., ltd.) · zhiyuan oa web application system · CWE-22 pre-auth RCE Path traversal File upload	Critical10.0	—	15.4%	Jun 23, 2025
20Monitor	CVE-2025-48461Proof of concept	Weak Session Cookie Entropyadvantech · wise-4060lan firmware · CWE-341 Pre-auth	Medium5.0	—	0.4%	Jun 23, 2025
32Monitor	CVE-2025-48466Proof of concept	Modbus Command Injection without Authenticationadvantech · wise-4060lan firmware · CWE-863 pre-auth RCE Auth bypass Broken access control (IDOR) Command injection	High8.1	—	0.5%	Jun 23, 2025
71This week	CVE-2025-32975Weaponized	Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 quest · kace systems management appliance · CWE-287 Pre-auth Auth bypass	Critical10.0	KEV	2.4%	Jun 24, 2025
40Plan	CVE-2021-41691Proof of concept	A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" paraos4ed · opensis · CWE-89 Pre-auth SQL injection	Critical9.8	—	1.9%	Jun 24, 2025
60This week	CVE-2024-51977Weaponized	Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konbrother industries, ltd · hl-l8260cdn · CWE-538 Pre-auth Info leak	Medium5.3	—	46.6%	Jun 25, 2025
60This week	CVE-2024-51978Weaponized	Authentication bypass via default password generation affecting multiple models from Brother Industries, Ltd, Toshiba Tec, and Konica Minolta, Inc.brother industries, ltd · dcp-j928n-w/b · CWE-1391 Pre-auth Auth bypass Hard-coded credentials	Critical9.8	—	15.8%	Jun 25, 2025
33Monitor	CVE-2024-51982No exploit	Unauthenticated Denial of Service (DoS) via malformed PJL request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, and Ricobrother industries, ltd · hl-l8260cdn · CWE-1286 Pre-auth Denial of service	High7.5	—	10.7%	Jun 25, 2025
34Monitor	CVE-2024-51983No exploit	Unauthenticated Denial of Service (DoS) via malformed WS-Scan request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricobrother industries, ltd · hl-l8260cdn · CWE-1286 Pre-auth Denial of service	High7.5	—	11.7%	Jun 25, 2025
69This week	CVE-2025-6543Weaponized	Memory overflow vulnerability leading to unintended control flow and Denial of Servicecitrix · netscaler application delivery controller · CWE-119 Pre-auth Memory safety	Critical9.2	KEV	10.5%	Jun 25, 2025
24Monitor	CVE-2025-48954Proof of concept	Discourse vulnerable to XSS via user-provided query parameter in oauth failure flowdiscourse · discourse · CWE-79 Pre-auth XSS	Medium6.1	—	0.7%	Jun 25, 2025
22Monitor	CVE-2024-57708Proof of concept	An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.CWE-400 Pre-auth Prototype pollution Denial of service	Medium5.7	—	0.9%	Jun 25, 2025
99Now	CVE-2025-20281Weaponized	Cisco ISE API Unauthenticated Remote Code Execution Vulnerabilitycisco · identity services engine · CWE-74 pre-auth RCE	Critical10.0	KEV	97.6%	Jun 25, 2025
52Plan	CVE-2025-20282Proof of concept	Cisco ISE API Unauthenticated Remote Code Execution Vulnerabilitycisco · identity services engine · CWE-269 pre-auth RCE	Critical10.0	—	38.7%	Jun 25, 2025
34Monitor	CVE-2025-52999Proof of concept	jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested datafasterxml · jackson-core · CWE-121 Pre-auth Memory safety	High8.7	—	0.7%	Jun 25, 2025
43Plan	CVE-2025-36038No exploit	IBM WebSphere Application Server code executionibm · websphere application server · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	13.3%	Jun 25, 2025
40Plan	CVE-2025-4334Proof of concept	Simple User Registration <= 6.3 - Unauthenticated Privilege Escalationnajeebmedia · memberhero · CWE-269 Pre-auth	Critical9.8	—	2.5%	Jun 25, 2025
35Monitor	CVE-2025-34045Proof of concept	WeiPHP Path Traversal Arbitrary File Readweiphp · weiphp · CWE-22 Pre-auth Path traversal	High8.7	—	4.1%	Jun 26, 2025
26Monitor	CVE-2025-45737Proof of concept	An issue in NetEase (Hangzhou) Network Co., Ltd NeacSafe64 Driver before v1.0.0.8 allows attackers to escalate privileges via sending craftenetease · neacsafe64 · CWE-269 Pre-auth	Medium6.5	—	0.3%	Jun 27, 2025
40Plan	CVE-2025-5306Weaponized	Command Injection in Netflow pathartica · pandora fms · CWE-77 RCE Command injection	High7.0	—	35.6%	Jun 27, 2025
39Monitor	CVE-2025-52207Proof of concept	PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbitrary directory.miko · mikopbx · CWE-23 Path traversal	Critical9.9	—	1.6%	Jun 27, 2025
39Monitor	CVE-2025-5304Proof of concept	PT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via wpnb_pto_new_users_add Functionptoffice · pt project notebooks · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Jun 28, 2025
27Monitor	CVE-2025-53392Proof of concept	In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directpfsense · pfsense · CWE-36 Path traversal	Medium6.5	—	1.8%	Jun 28, 2025
22Monitor	CVE-2025-5878Proof of concept	ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special elementesapi · esapi-java-legacy · CWE-20 Pre-auth SQL injection	Medium5.5	—	0.4%	Jun 29, 2025
8Monitor	CVE-2025-6860Proof of concept	SourceCodester Best Salon Management System staff_commision.php sql injectionmayurik · best salon management system · CWE-74 SQL injection	Low2.1	—	0.4%	Jun 29, 2025
8Monitor	CVE-2025-6867Proof of concept	SourceCodester Simple Company Website manage.php sql injectionoretnom23 · simple company website · CWE-74 SQL injection	Low2.0	—	0.4%	Jun 29, 2025
13Monitor	CVE-2025-6898No exploit	D-Link DI-7300G+ in proxy_client.asp os command injectiondlink · di-7300g\+ firmware · CWE-77 RCE Command injection	Low2.1	—	16.5%	Jun 30, 2025
22Monitor	CVE-2025-38089Proof of concept	sunrpc: handle SVC_GARBAGE during svc auth processing as auth errorlinux · linux kernel · CWE-476 Memory safety Denial of service	Medium5.5	—	0.5%	Jun 30, 2025

CVE-2025-5301
43Plan
Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)
MediumCVSS 6.1Proof of conceptEPSS 62%
- Pre-auth
- XSS
onlyoffice · docs (documentserver)Jun 12, 2025
CVE-2025-4278
37Monitor
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab
HighCVSS 8.7No exploitEPSS 10%
- XSS
gitlab · gitlabJun 12, 2025
CVE-2025-47959
31Monitor
Visual Studio Remote Code Execution Vulnerability
HighCVSS 7.1No exploitEPSS 10%
- RCE
- Command injection
microsoft · visual studio 2022Jun 12, 2025
CVE-2025-5288
39Monitor
REST API | Custom API Generator For Cross Platform And Import Export In WP 1.0.0 - 2.0.3 - Missing Authorization to Unauthenticated Privilege Escalation via pro
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
weboccults · rest api | custom api generator for cross platform and import export in wpJun 12, 2025
CVE-2025-5815
21Monitor
Traffic Monitor <= 3.2.2 - Missing Authorization to Unauthenticated Settings Update
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
dmitriamartin · traffic monitorJun 13, 2025
CVE-2025-45985
41Plan
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450
CriticalCVSS 9.8Proof of conceptEPSS 6%
- pre-auth RCE
- Command injection
b-link · bl-wr9000 firmwareJun 13, 2025
CVE-2025-45988
42Plan
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450
CriticalCVSS 9.8No exploitEPSS 10%
- pre-auth RCE
- Command injection
b-link · bl-wr9000 firmwareJun 13, 2025
CVE-2025-49596
50Plan
MCP Inspector proxy server lacks authentication between the Inspector client and proxy
CriticalCVSS 9.4Proof of conceptEPSS 44%
- pre-auth RCE
- Auth bypass
modelcontextprotocol · inspectorJun 13, 2025
CVE-2025-36041
39Monitor
IBM MQ improper certificate validation
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
ibm · mq operatorJun 15, 2025
CVE-2025-5964
37Monitor
Path traversal in M-Files API
HighCVSS 8.4Proof of conceptEPSS 13%
- Path traversal
m-files · m-files serverJun 15, 2025
CVE-2025-6095
60This week
codesiddhant Jasmin Ransomware checklogin.php sql injection
MediumCVSS 5.5WeaponizedEPSS 2%
- Pre-auth
- SQL injection
codesiddhant · jasmin-ransomwareJun 15, 2025
CVE-2025-3464
33Monitor
A race condition vulnerability exists in Armoury Crate.
HighCVSS 8.4Proof of conceptEPSS 0%
- Auth bypass
- Race condition
asus · armoury crateJun 16, 2025
CVE-2025-48976
40Plan
Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers
HighCVSS 7.5Proof of conceptEPSS 32%
- Pre-auth
- Denial of service
apache · commons fileuploadJun 16, 2025
CVE-2025-48988
39Monitor
Apache Tomcat: FileUpload large number of parts with headers DoS
HighCVSS 7.5Proof of conceptEPSS 30%
- Pre-auth
- Denial of service
apache · tomcatJun 16, 2025
CVE-2025-49125
31Monitor
Apache Tomcat: Security constraint bypass for pre/post-resources
HighCVSS 7.5Proof of conceptEPSS 3%
- Pre-auth
- Auth bypass
apache · tomcatJun 16, 2025
CVE-2025-6087
31Monitor
SSRF vulnerability in opennextjs-cloudflare via /_next/image endpoint
HighCVSS 7.8No exploitEPSS 0%
- Pre-auth
- SSRF
cloudflare · create-cloudflareJun 16, 2025
CVE-2025-43200
60This week
This issue was addressed with improved checks.
MediumCVSS 4.2KEVWeaponizedEPSS 1%
- Pre-auth
apple · ipadosJun 16, 2025
CVE-2025-3515
41Plan
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks
CriticalCVSS 9.8Proof of conceptEPSS 6%
- pre-auth RCE
- File upload
codedropz · drag and drop multiple file upload - contact form 7Jun 17, 2025
CVE-2025-4365
30Monitor
NetScaler Console and NetScaler SDX (SVM) - Arbitrary file read
MediumCVSS 6.9No exploitEPSS 10%
citrix · netscaler consoleJun 17, 2025
CVE-2025-5349
36Monitor
NetScaler ADC and NetScaler Gateway - Improper access control on the NetScaler Management Interface
HighCVSS 8.7Proof of conceptEPSS 6%
- Pre-auth
citrix · netscaler application delivery controllerJun 17, 2025
CVE-2025-4404
37Monitor
Freeipa: idm: privilege escalation from host to domain admin in freeipa
CriticalCVSS 9.1Proof of conceptEPSS 1%
red hat · red hat enterprise linux 10Jun 17, 2025
CVE-2025-34508
43Plan
ZendTo < 6.15-8 Path Traversal
MediumCVSS 5.3No exploitEPSS 73%
- Path traversal
zendto · zendtoJun 17, 2025
CVE-2025-49071
40Plan
WordPress Flozen < 1.5.1 - Arbitrary File Upload Vulnerability
CriticalCVSS 10.0Proof of conceptEPSS 0%
- Pre-auth
- File upload
nasatheme · flozenJun 17, 2025
CVE-2025-49857
17Monitor
WordPress myCred plugin <= 2.9.4.2 - Broken Access Control Vulnerability
MediumCVSS 4.3No exploitEPSS 0%
- Broken access control (IDOR)
saad iqbal · mycredJun 17, 2025
CVE-2025-5777
97Now
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
CriticalCVSS 9.3KEVWeaponizedEPSS 99%
- Pre-auth
- Memory safety
citrix · netscaler application delivery controllerJun 17, 2025
CVE-2025-34509
47Plan
Sitecore XM and XP Hardcoded Credentials
HighCVSS 7.5Proof of conceptEPSS 55%
- Pre-auth
- Hard-coded credentials
sitecore · experience commerceJun 17, 2025
CVE-2025-34510
42Plan
Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip
HighCVSS 8.8WeaponizedEPSS 24%
- RCE
- Path traversal
sitecore · experience commerceJun 17, 2025
CVE-2025-34511
44Plan
Sitecore PowerShell Extension RCE via Unrestricted Upload
HighCVSS 8.8WeaponizedEPSS 29%
- RCE
- File upload
sitecore · experience commerceJun 17, 2025
CVE-2025-49212
43Plan
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exe
CriticalCVSS 9.8No exploitEPSS 13%
- pre-auth RCE
- Deserialization
trendmicro · trend micro endpoint encryptionJun 17, 2025
CVE-2025-49213
43Plan
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exe
CriticalCVSS 9.8No exploitEPSS 13%
- pre-auth RCE
- Deserialization
trendmicro · trend micro endpoint encryptionJun 17, 2025
CVE-2025-49825
41Plan
Teleport allows remote authentication bypass
CriticalCVSS 9.8Proof of conceptEPSS 7%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
gravitational · teleportJun 17, 2025
CVE-2025-1562
40Plan
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Authorization to Unauthenticated Arbitra
CriticalCVSS 9.8Proof of conceptEPSS 3%
- Pre-auth
- Broken access control (IDOR)
funnelkit · funnelkit automationsJun 18, 2025
CVE-2025-6220
28Monitor
Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'
HighCVSS 7.2Proof of conceptEPSS 1%
- RCE
- File upload
themefic · ultimate addons for contact form 7Jun 18, 2025
CVE-2025-46157
39Monitor
An issue in EfroTech Time Trax v.1.0 allows a remote attacker to execute arbitrary code via the file attachment function in the leave reques
CriticalCVSS 9.9Proof of conceptEPSS 0%
- RCE
- File upload
efrotech · timetraxJun 18, 2025
CVE-2025-20260
39Monitor
ClamAV PDF Scanning Buffer Overflow Vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
- Memory safety
clamav · clamavJun 18, 2025
CVE-2025-26198
39Monitor
CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component.
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
- SQL injection
vishalmathur · cloudclassroom-php projectJun 18, 2025
CVE-2025-6191
38Monitor
Integer overflow in V8 in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially perform out of bounds memory access
HighCVSS 8.8No exploitEPSS 11%
- Pre-auth
google · chromeJun 18, 2025
CVE-2025-26199
39Monitor
CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability.
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
- Weak crypto
vishalmathur · cloudclassroom-php projectJun 18, 2025
CVE-2025-23121
42Plan
A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user
HighCVSS 8.8No exploitEPSS 24%
- RCE
veeam · veeam backup \& replicationJun 18, 2025
CVE-2025-24286
25Monitor
A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code.
MediumCVSS 4.9No exploitEPSS 19%
- RCE
veeam · veeam backup \& replicationJun 18, 2025
CVE-2025-52467
36Monitor
pgai secrets exfiltration via `pull_request_target`
CriticalCVSS 9.1Proof of conceptEPSS 0%
- pre-auth RCE
- Info leak
timescale · pgaiJun 18, 2025
CVE-2025-6019
28Monitor
Libblockdev: lpe from allow_active to root in libblockdev via udisks
HighCVSS 7.0Proof of conceptEPSS 0%
- Local privilege escalation
red hat · red hat enterprise linux 10Jun 19, 2025
CVE-2025-52464
38Monitor
Meshtastic Repeated Public and Private Keypairs
CriticalCVSS 9.5Proof of conceptEPSS 0%
- Pre-auth
meshtastic · meshtastic firmwareJun 19, 2025
CVE-2025-6384
29Monitor
Improper Control of Dynamically-Managed Code Resources in Crafter Studio
HighCVSS 7.3Proof of conceptEPSS 0%
- RCE
craftercms · craftercmsJun 19, 2025
CVE-2025-6264
22Monitor
Velociraptor priviledge escalation via UpdateConfig artifact
MediumCVSS 5.5Proof of conceptEPSS 1%
- RCE
rapid7 · velociraptorJun 19, 2025
CVE-2025-6299
11Monitor
TOTOLINK N150RT formWSC os command injection
LowCVSS 2.0No exploitEPSS 11%
- RCE
- Command injection
totolink · n150rt firmwareJun 19, 2025
CVE-2025-6335
10Monitor
DedeCMS Template dedetag.class.php command injection
LowCVSS 2.0Proof of conceptEPSS 6%
- RCE
- Command injection
dedecms · dedecmsJun 20, 2025
CVE-2025-44203
30Monitor
In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Race condition
- Info leak
digitaldruid · hoteldruidJun 20, 2025
CVE-2025-49132
60This week
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
CriticalCVSS 10.0WeaponizedEPSS 54%
- pre-auth RCE
pterodactyl · panelJun 20, 2025
CVE-2025-5121
43Plan
Missing Authorization in GitLab
CriticalCVSS 9.9No exploitEPSS 12%
- Broken access control (IDOR)
gitlab · gitlabJun 20, 2025
CVE-2024-4994
32Monitor
Cross-Site Request Forgery (CSRF) in GitLab
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- CSRF
gitlab · gitlabJun 20, 2025
CVE-2025-25034
60This week
SugarCRM PHP Deserialization RCE
CriticalCVSS 9.3WeaponizedEPSS 4%
- pre-auth RCE
- Deserialization
sugarcrm · sugarcrmJun 20, 2025
CVE-2025-25037
37Monitor
Aquatronica Controller System Complete Information Disclosure
CriticalCVSS 9.3Proof of conceptEPSS 1%
- Pre-auth
- Auth bypass
- Info leak
aquatronica · aquatronica controller systemJun 20, 2025
CVE-2025-34030
56Plan
sar2html OS Command Injection
CriticalCVSS 10.0Proof of conceptEPSS 54%
- pre-auth RCE
- Command injection
sar2html · sar2htmlJun 20, 2025
CVE-2025-34023
34Monitor
Karel IP Phone IP1211 Path Traversal
HighCVSS 8.5Proof of conceptEPSS 1%
- Path traversal
karel · karel ip phone ip1211Jun 20, 2025
CVE-2025-6216
53Plan
Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 47%
- Pre-auth
- Auth bypass
alltena · allegraJun 20, 2025
CVE-2025-6218
88Now
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability
HighCVSS 7.8KEVWeaponizedEPSS 90%
- RCE
- Path traversal
rarlab · winrarJun 20, 2025
CVE-2025-52488
45Plan
DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input
HighCVSS 8.6Proof of conceptEPSS 35%
- Pre-auth
- Info leak
dnnsoftware · dotnetnukeJun 20, 2025
CVE-2025-6403
23Monitor
code-projects School Fees Payment System student.php sql injection
MediumCVSS 5.5Proof of conceptEPSS 2%
- Pre-auth
- SQL injection
fabian · school fees payment systemJun 21, 2025
CVE-2025-2172
30Monitor
Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line u
MediumCVSS 6.6No exploitEPSS 12%
- RCE
- Command injection
aviatrix · controllerJun 23, 2025
CVE-2025-48700
60This week
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1.
MediumCVSS 6.1KEVWeaponizedEPSS 1%
- pre-auth RCE
- XSS
synacor · zimbra collaboration suiteJun 23, 2025
CVE-2025-52876
32Monitor
In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible
MediumCVSS 5.4No exploitEPSS 37%
- XSS
jetbrains · teamcityJun 23, 2025
CVE-2025-52877
30Monitor
In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible
MediumCVSS 4.8No exploitEPSS 36%
- XSS
jetbrains · teamcityJun 23, 2025
CVE-2025-49144
29Monitor
Notepad++ Privilege Escalation in Installer via Uncontrolled Executable Search Path
HighCVSS 7.3Proof of conceptEPSS 0%
- Local privilege escalation
notepad-plus-plus · notepad-plus-plusJun 23, 2025
CVE-2025-2828
46Plan
SSRF Vulnerability in RequestsToolkit in langchain-ai/langchain
CriticalCVSS 10.0No exploitEPSS 21%
- Pre-auth
- SSRF
langchain · langchainJun 23, 2025
CVE-2025-34031
35Monitor
Moodle LMS Jmol Plugin Path Traversal
HighCVSS 8.7Proof of conceptEPSS 3%
- Pre-auth
- Auth bypass
- Path traversal
geoffrowland · jmolJun 23, 2025
CVE-2025-34032
20Monitor
Moodle LMS Jmol Plugin Cross-site Scripting (XSS)
MediumCVSS 5.1Proof of conceptEPSS 0%
- pre-auth RCE
- XSS
geoffrowland · jmolJun 23, 2025
CVE-2025-34033
33Monitor
5VTechnologies Blue Angel Software Suite OS Command Injection
HighCVSS 7.7Proof of conceptEPSS 11%
- RCE
- Command injection
5vtechnologies · blue angel software suiteJun 23, 2025
CVE-2025-34035
47Plan
EnGenius EnShare IoT Gigabit Cloud Service Command Injection
CriticalCVSS 10.0Proof of conceptEPSS 22%
- pre-auth RCE
- Command injection
engeniustech · esr300 firmwareJun 23, 2025
CVE-2025-34036
49Plan
Shenzhen TVT CCTV-DVR Command Injection
CriticalCVSS 10.0No exploitEPSS 30%
- pre-auth RCE
- Command injection
tvt · td-2108ts-cl firmwareJun 23, 2025
CVE-2025-34037
68This week
Linksys Routers E/WAG/WAP/WES/WET/WRT-Series
CriticalCVSS 10.0WeaponizedEPSS 92%
- pre-auth RCE
- Command injection
linksys · e4200Jun 23, 2025
CVE-2025-34038
35Monitor
Weaver E-cology SQL Injection
HighCVSS 8.7Proof of conceptEPSS 2%
- pre-auth RCE
- SQL injection
weaver · e-cologyJun 23, 2025
CVE-2025-34040
45Plan
Seeyon Zhiyuan OA System Path Traversal File Upload
CriticalCVSS 10.0Proof of conceptEPSS 15%
- pre-auth RCE
- Path traversal
- File upload
seeyon (beijing zhiyuan internet software co., ltd.) · zhiyuan oa web application systemJun 23, 2025
CVE-2025-48461
20Monitor
Weak Session Cookie Entropy
MediumCVSS 5.0Proof of conceptEPSS 0%
- Pre-auth
advantech · wise-4060lan firmwareJun 23, 2025
CVE-2025-48466
32Monitor
Modbus Command Injection without Authentication
HighCVSS 8.1Proof of conceptEPSS 0%
- pre-auth RCE
- Auth bypass
- Broken access control (IDOR)
- Command injection
advantech · wise-4060lan firmwareJun 23, 2025
CVE-2025-32975
71This week
Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341
CriticalCVSS 10.0KEVWeaponizedEPSS 2%
- Pre-auth
- Auth bypass
quest · kace systems management applianceJun 24, 2025
CVE-2021-41691
40Plan
A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" para
CriticalCVSS 9.8Proof of conceptEPSS 1%
- Pre-auth
- SQL injection
os4ed · opensisJun 24, 2025
CVE-2024-51977
60This week
Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Kon
MediumCVSS 5.3WeaponizedEPSS 46%
- Pre-auth
- Info leak
brother industries, ltd · hl-l8260cdnJun 25, 2025
CVE-2024-51978
60This week
Authentication bypass via default password generation affecting multiple models from Brother Industries, Ltd, Toshiba Tec, and Konica Minolta, Inc.
CriticalCVSS 9.8WeaponizedEPSS 15%
- Pre-auth
- Auth bypass
- Hard-coded credentials
brother industries, ltd · dcp-j928n-w/bJun 25, 2025
CVE-2024-51982
33Monitor
Unauthenticated Denial of Service (DoS) via malformed PJL request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, and Rico
HighCVSS 7.5No exploitEPSS 10%
- Pre-auth
- Denial of service
brother industries, ltd · hl-l8260cdnJun 25, 2025
CVE-2024-51983
34Monitor
Unauthenticated Denial of Service (DoS) via malformed WS-Scan request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Rico
HighCVSS 7.5No exploitEPSS 11%
- Pre-auth
- Denial of service
brother industries, ltd · hl-l8260cdnJun 25, 2025
CVE-2025-6543
69This week
Memory overflow vulnerability leading to unintended control flow and Denial of Service
CriticalCVSS 9.2KEVWeaponizedEPSS 10%
- Pre-auth
- Memory safety
citrix · netscaler application delivery controllerJun 25, 2025
CVE-2025-48954
24Monitor
Discourse vulnerable to XSS via user-provided query parameter in oauth failure flow
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
discourse · discourseJun 25, 2025
CVE-2024-57708
22Monitor
An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.
MediumCVSS 5.7Proof of conceptEPSS 0%
- Pre-auth
- Prototype pollution
- Denial of service
Jun 25, 2025
CVE-2025-20281
99Now
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
CriticalCVSS 10.0KEVWeaponizedEPSS 97%
- pre-auth RCE
cisco · identity services engineJun 25, 2025
CVE-2025-20282
52Plan
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
CriticalCVSS 10.0Proof of conceptEPSS 38%
- pre-auth RCE
cisco · identity services engineJun 25, 2025
CVE-2025-52999
34Monitor
jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
fasterxml · jackson-coreJun 25, 2025
CVE-2025-36038
43Plan
IBM WebSphere Application Server code execution
CriticalCVSS 9.8No exploitEPSS 13%
- pre-auth RCE
- Deserialization
ibm · websphere application serverJun 25, 2025
CVE-2025-4334
40Plan
Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation
CriticalCVSS 9.8Proof of conceptEPSS 2%
- Pre-auth
najeebmedia · memberheroJun 25, 2025
CVE-2025-34045
35Monitor
WeiPHP Path Traversal Arbitrary File Read
HighCVSS 8.7Proof of conceptEPSS 4%
- Pre-auth
- Path traversal
weiphp · weiphpJun 26, 2025
CVE-2025-45737
26Monitor
An issue in NetEase (Hangzhou) Network Co., Ltd NeacSafe64 Driver before v1.0.0.8 allows attackers to escalate privileges via sending crafte
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
netease · neacsafe64Jun 27, 2025
CVE-2025-5306
40Plan
Command Injection in Netflow path
HighCVSS 7.0WeaponizedEPSS 35%
- RCE
- Command injection
artica · pandora fmsJun 27, 2025
CVE-2025-52207
39Monitor
PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbitrary directory.
CriticalCVSS 9.9Proof of conceptEPSS 1%
- Path traversal
miko · mikopbxJun 27, 2025
CVE-2025-5304
39Monitor
PT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via wpnb_pto_new_users_add Function
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
ptoffice · pt project notebooksJun 28, 2025
CVE-2025-53392
27Monitor
In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath direct
MediumCVSS 6.5Proof of conceptEPSS 1%
- Path traversal
pfsense · pfsenseJun 28, 2025
CVE-2025-5878
22Monitor
ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special element
MediumCVSS 5.5Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
esapi · esapi-java-legacyJun 29, 2025
CVE-2025-6860
8Monitor
SourceCodester Best Salon Management System staff_commision.php sql injection
LowCVSS 2.1Proof of conceptEPSS 0%
- SQL injection
mayurik · best salon management systemJun 29, 2025
CVE-2025-6867
8Monitor
SourceCodester Simple Company Website manage.php sql injection
LowCVSS 2.0Proof of conceptEPSS 0%
- SQL injection
oretnom23 · simple company websiteJun 29, 2025
CVE-2025-6898
13Monitor
D-Link DI-7300G+ in proxy_client.asp os command injection
LowCVSS 2.1No exploitEPSS 16%
- RCE
- Command injection
dlink · di-7300g\+ firmwareJun 30, 2025
CVE-2025-38089
22Monitor
sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
MediumCVSS 5.5Proof of conceptEPSS 0%
- Memory safety
- Denial of service
linux · linux kernelJun 30, 2025