Skip to content
OpenAdvisories

Archive

6 June 2025

Vulnerabilities first published on this day (UTC), newest first.

← May 2025 2025 / June /6 July 2025 →
  1. 119
  2. 2121
  3. 3116
  4. 4134
  5. 597
  6. 6344
  7. 715
  8. 833
  9. 9181
  10. 10490
  11. 1159
  12. 1280
  13. 1388
  14. 1421
  15. 1515
  16. 1695
  17. 17174
  18. 18414
  19. 1955
  20. 20222
  21. 2157
  22. 2238
  23. 2374
  24. 24120
  25. 25120
  26. 26116
  27. 27225
  28. 2846
  29. 2948
  30. 3089
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Critical —
    GHSA-c42h-56wx-h85q

    laravel-auth0 SDK Deserialization of Untrusted Data vulnerability

    **Overview** The laravel-auth0 SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing …

    auth0/login Packagist
  • Critical 9.8
    CVE-2025-27531

    Apache InLong: An arbitrary file read vulnerability for JDBC

    Deserialization of Untrusted Data vulnerability in Apache InLong.  This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an authenticated attacker to read arbitrary files by double writing the param. Users are recommended to upgra…

    Apache Software Foundation Apache InLong org.apache.inlong:inlong-manager Maven
  • Critical 9.8
    CVE-2025-41646 Public exploit Scanner template EPSS 51%

    RevPi Webstatus application is vulnerable to an authentication bypass

    An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device

    KUNBUS Revolution Pi webstatus
  • Critical 9.8
    CVE-2025-49072

    WordPress Mr. Murphy < 1.2.12.1 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in AncoraThemes Mr. Murphy mr-murphy allows Object Injection.This issue affects Mr. Murphy: from n/a through < 1.2.12.1.

    AncoraThemes Mr. Murphy
  • Critical 9.8
    CVE-2025-49073

    WordPress Sweet Dessert < 1.1.13 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in axiomthemes Sweet Dessert sweet-dessert allows Object Injection.This issue affects Sweet Dessert: from n/a through < 1.1.13.

    axiomthemes Sweet Dessert
  • Critical 9.0
    CVE-2025-47586

    WordPress Motors - Events plugin <= 1.4.7 - Unauthenticated Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors - Events stm-motors-events allows PHP Local File Inclusion.This issue affects Motors - Events: from n/a through <= 1…

    StylemixThemes Motors - Events
  • Critical 9.9
    CVE-2025-48782

    Soar Cloud HRD Human Resource Management System - Unrestricted Upload of File with Dangerous Type

    An unrestricted upload of file with dangerous type vulnerability in the upload file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to execute arbitrary system commands via a malicious file.

    Soar Cloud System HRD Human Resource Management System
  • Critical 9.9
    CVE-2025-48780

    Soar Cloud HRD Human Resource Management System - Deserialization of Untrusted Data

    A deserialization of untrusted data vulnerability in the download file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to execute arbitrary system commands via a crafted serialized object.

    Soar Cloud System HRD Human Resource Management System
  • Critical 9.3
    CVE-2025-5192

    Soar Cloud HRD Human Resource Management System - Missing Authentication for Critical Function

    A missing authentication for critical function vulnerability in the client application of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to bypass authentication and access application functions.

    Soar Cloud System HRD Human Resource Management System
  • Critical 9.8
    CVE-2025-3365

    Relative Path Traversal in OnlineSuite

    A missing protection against path traversal allows to access any file on the server.

    B. Braun Melsungen OnlineSuite
  • Critical 10.0
    CVE-2025-3322

    Improper Neutralization of Special Elements in OnlineSuite

    An improper neutralization of inputs used in expression language allows remote code execution with the highest privileges on the server.

    B. Braun Melsungen OnlineSuite
  • Critical 9.4
    CVE-2025-3321

    Use of Hard-coded Credentials in OnlineSuite

    A predefined administrative account is not documented and cannot be deactivated. This account cannot be misused from the network, only by local users on the server.

    B. Braun Melsungen OnlineSuite
  • Critical 9.8
    CVE-2025-5486

    WP Email Debug 1.0 - 1.1.0 - Missing Authorization to Unauthenticated Privilege Escalation via Password Reset

    The WP Email Debug plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the WPMDBUG_handle_settings() function in versions 1.0 to 1.1.0. This makes it possible for unauthenticated attackers to enable debugging and se…

    dr_scythe WP Email Debug Web / CMS
  • Critical —
    GHSA-98j6-67v3-mw34

    Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability

    **Overview** The Auth0 Symfony SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing …

    auth0/symfony Packagist