# CVEs published 2025-10-19

11 CVEs were published on October 19, 2025: 0 critical, 1 high. Days are UTC.

- [CVE-2025-11947](https://cve.now/CVE-2025-11947.md): bftpd Configuration File options.c expand\_groups heap-based overflow (CVSS 2.0, bftpd)
- [CVE-2025-11946](https://cve.now/CVE-2025-11946.md): LogicalDOC Community Edition Add Contact frontend.jsp cross site scripting (CVSS 5.1, LogicalDOC Community Edition)
- [CVE-2025-11945](https://cve.now/CVE-2025-11945.md): toeverything AFFiNE Avatar Upload Image Endpoint cross site scripting (CVSS 5.1, toeverything AFFiNE)
- [CVE-2025-11944](https://cve.now/CVE-2025-11944.md): givanz Vvveb Raw SQL import.php import sql injection (CVSS 5.1, givanz Vvveb)
- [CVE-2025-11943](https://cve.now/CVE-2025-11943.md): 70mai X200 HTTP Web Server default credentials (CVSS 6.9, 70mai X200)
- [CVE-2025-11942](https://cve.now/CVE-2025-11942.md): 70mai X200 Pairing missing authentication (CVSS 6.9, 70mai X200)
- [CVE-2025-11941](https://cve.now/CVE-2025-11941.md): e107 CMS Avatar image.php path traversal (CVSS 5.3, e107 CMS)
- [CVE-2025-11940](https://cve.now/CVE-2025-11940.md): LibreWolf Installer setup.nsi uncontrolled search path (CVSS 7.3, LibreWolf)
- [CVE-2025-11939](https://cve.now/CVE-2025-11939.md): ChurchCRM Backup Restore RestoreJob.php path traversal (CVSS 5.1, ChurchCRM)
- [CVE-2025-11938](https://cve.now/CVE-2025-11938.md): ChurchCRM setup.php deserialization (CVSS 6.3, ChurchCRM)
- [CVE-2025-62672](https://cve.now/CVE-2025-62672.md): rplay through 3.3.2 allows attackers to cause a denial of service (SIGSEGV and daemon crash) or possibly have unspecified other impact. (CVSS 5.3, boyns rplay)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-10-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.