Skip to content
OpenAdvisories

Archive

20 June 2025

Vulnerabilities first published on this day (UTC), newest first.

← May 2025 2025 / June /20 July 2025 →
  1. 119
  2. 2121
  3. 3116
  4. 4134
  5. 597
  6. 6344
  7. 715
  8. 833
  9. 9181
  10. 10490
  11. 1159
  12. 1280
  13. 1388
  14. 1421
  15. 1515
  16. 1695
  17. 17174
  18. 18414
  19. 1955
  20. 20222
  21. 2157
  22. 2238
  23. 2374
  24. 24120
  25. 25120
  26. 26116
  27. 27225
  28. 2846
  29. 2948
  30. 3089
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 10.0
    CVE-2025-34030 Public exploit Scanner template EPSS 52%

    sar2html OS Command Injection

    An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php. The application fails to sanitize user-supplied input before using it in a system-level context. Remote, unauthenticated attackers can inject…

    sar2html sar2html
  • Critical 9.3
    CVE-2025-25034 Public exploit Scanner template

    SugarCRM PHP Deserialization RCE

    A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_dat…

    SugarCRM SugarCRM
  • Critical 10.0
    CVE-2025-49132 Public exploit Scanner template EPSS 54%

    Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

    Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the…

    pterodactyl panel pterodactyl/panel Packagist
  • Medium 4.7
    CVE-2025-6335 Public exploit

    DedeCMS Template dedetag.class.php command injection

    A vulnerability was found in DedeCMS up to 5.7.2 and classified as critical. This issue affects some unknown processing of the file /include/dedetag.class.php of the component Template Handler. The manipulation of the argument notes leads to command injection…

  • Medium 5.5
    CVE-2025-6264 Public exploit

    Velociraptor priviledge escalation via UpdateConfig artifact

    Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions.  To limit access to some dangerous artifact, Velociraptor allows for those to require h…

    Rapid7 Velociraptor www.velocidex.com/golang/velociraptor Go
  • High 7.5
    CVE-2025-44203 Public exploit

    In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is co…

    hoteldruid hoteldruid Debian Ubuntu