CVEs published November 3, 2025
60 CVEs were published on November 3, 2025: 8 critical, 15 high. 1 is now in CISA KEV.
- Published
- 60
- Critical
- 8
- High
- 15
- Medium
- 33
- Low
- 3
- Unrated
- 1
- Now in CISA KEV
- 1
- Fix available
- 17
Most affected products
- IBM Cloud Pak For Business Automation
- 3
- Nagios XI
- 3
- CodeAstro Gym Management System
- 2
- Eaton Brightlayer Software Suite
- 2
- itsourcecode Online Loan Management System
- 2
- PHPGurukul News Portal
- 2
- @react-native-community/cli-server-api · @react-native-comm…
- 1
- Campcodes School Fees Payment Management System
- 1
- CB Project Ltd. CVLand
- 1
- d3wp WP Snow Effect
- 1
Critical 8
- CVE-2024-13997Nagios XI < 2024R1.1.3 Privilege Escalation via Migrate Server Feature to Root on HostNagios XI
- CVE-2025-12463Unauthenticated SQL Injection in Guetebruck G-Cam Series CamerasGuetebruck G-Cam
- CVE-2025-11953Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests@react-native-community/cli-server-api · @react-native-comm…
- CVE-2025-8900Doccure Core < 1.5.4 - Unauthenticated Privilege Escalationdreamstechnologies Doccure Core
- CVE-2025-0987IDOR in CB Project's CVLandCB Project Ltd. CVLand
- CVE-2025-63451Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/sign-in.php.
- CVE-2025-63452Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/forgot-pass.php.
- CVE-2025-63453Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/contact.php.
High 15
- CVE-2025-34501Shuffle Master Deck Mate 2 Hard-coded Credentials & Exposed ServicesLight & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle M…
- CVE-2025-12531IBM InfoSphere Information Server is affected by an XML external entity injection (XXE) vulnerabilityIBM InfoSphere Information Server
- CVE-2025-10280Incorrect Content Type Cross-Site Scripting VulnerabilitySailPoint Technologies IdentityIQ
- CVE-2025-11761HP Client Management Script Library – Security UpdateHP Client Management Script Library
- CVE-2025-48397The privileged user could log in without sufficient credentials after enabling an application protocol.Eaton Brightlayer Software Suite
- CVE-2025-48396Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS.Eaton Brightlayer Software Suite
- CVE-2025-12622Tenda AC10 SysRunCmd formSysRunCmd buffer overflowTenda AC10
- CVE-2025-12619Tenda A15 openNetworkGateway fromSetWirelessRepeat buffer overflowTenda A15
- CVE-2025-12503Digiwin｜EasyFlow .NET and EasyFlow AiNetDigiwin EasyFlow .NET · Digiwin EasyFlow AiNet
- CVE-2025-12618Tenda AC8 DatabaseIniSet buffer overflowTenda AC8
- CVE-2025-12611Tenda AC21 SetPptpServerCfg formSetPPTPServer buffer overflowTenda AC21
- CVE-2025-50735Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot path segments in its
- CVE-2025-60503A cross-site scripting (XSS) vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted i
- CVE-2025-60785A remote code execution (RCE) vulnerability in the Postgres Drivers component of iceScrum v7.54 Pro On-prem allows attackers to execute arbi
- CVE-2025-63441Open Source Social Network (OSSN) 8.6 is vulnerable to Cross Site Scripting (XSS) via the parameter param` at endpoint u/administrator/frien
Medium, low and unrated 37
- CVE-2021-47698Nagios XI < 5.8.7 XSS in Core UI Views URL handlingNagios XI
- CVE-2024-13998Nagios XI < 2024R1.1.3 API Keys & Hashed Passwords Authenticated Information DisclosureNagios XI
- CVE-2025-11193A potential vulnerability was reported in some Lenovo Tablets that could allow a local authenticated user or application to gain access to sLenovo Tab M11 TB330FU TB330XU · Lenovo Tab K11 TB330FU… +16
- CVE-2025-36172Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for 24.0.0-IF007, 24.0.1-IF005 and 25.0.0-IF002IBM Cloud Pak for Business Automation
- CVE-2025-12657Malformed KMIP response may result in access violationMongoDB Server
- CVE-2025-12642HTTP Header Smuggling via Trailer Mergelighttpd
- CVE-2025-8558Insider Threat Management (ITM) Server versions prior to 7.17.2 contain an authentication bypass vulnerability that allows unauthenticated uProofpoint Insider Threat Management (ITM) Server
- CVE-2025-36093security vulnerabilities are addressed with IBM Business Automation Insights iFixes for October 2025.IBM Cloud Pak For Business Automation
- CVE-2025-36092IBM Business Automation Insights improper input validationIBM Cloud Pak For Business Automation
- CVE-2025-36091IBM Business Automation Insights unverified ownershipIBM Cloud Pak For Business Automation
- CVE-2025-64294WordPress WP Snow Effect plugin <= 1.1.19 - Broken Access Control vulnerabilityd3wp WP Snow Effect
- CVE-2025-12626jeecgboot jeewx-boot WxActGoldeneggsPrizesController.java getImgUrl path traversaljeecgboot jeewx-boot
- CVE-2025-40107can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabledLinux
- CVE-2025-12623fushengqian fuint Authentication Token ClientSignController.java authorizationfushengqian fuint
- CVE-2025-12617itsourcecode Billing System login_crud.php sql injectionitsourcecode Billing System
- CVE-2025-12616PHPGurukul News Portal settings.py insertion of sensitive information into debugging codePHPGurukul News Portal
- CVE-2025-12615PHPGurukul News Portal settings.py hard-coded keyPHPGurukul News Portal
- CVE-2025-12614SourceCodester Best House Rental Management System admin_class.php delete_payment sql injectionSourceCodester Best House Rental Management System
- CVE-2025-12612Campcodes School Fees Payment Management System ajax.php sql injectionCampcodes School Fees Payment Management System
- CVE-2025-12610CodeAstro Gym Management System view-progress-report.php sql injectionCodeAstro Gym Management System
- CVE-2025-12609CodeAstro Gym Management System update-progress.php sql injectionCodeAstro Gym Management System
- CVE-2025-12608itsourcecode Online Loan Management System manage_user.php sql injectionitsourcecode Online Loan Management System
- CVE-2025-12607itsourcecode Online Loan Management System manage_payment.php sql injectionitsourcecode Online Loan Management System
- CVE-2024-51317An issue in NetSurf v.3.11 allows a remote attacker to execute arbitrary code via the dom_node_normalize function
- CVE-2025-29699NetSurf 3.11 is vulnerable to Use After Free in dom_node_set_text_content function.
- CVE-2025-45663An issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating a dom_event structure.
- CVE-2025-50363Phpgurukul Maid Hiring Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in /maid-hiring.php va the name field.
- CVE-2025-60892An issue in Raspberry Pi Imager version 1.9.6 for Windows, affecting its OS customization feature.
- CVE-2025-63293FairSketch Rise Ultimate Project Manager & CRM 3.9.4 is vulnerable to Insecure Permissions.
- CVE-2025-63442Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting (XSS) via the Profile Section.
- CVE-2025-63443School Management System PHP v1.0 is vulnerable to Cross Site Scripting (XSS) in /login.php via the password parameter.
- CVE-2025-63446Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_vendor.php.
- CVE-2025-63447Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_customer.php.
- CVE-2025-63448Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit_product.php?id=1.
- CVE-2025-63449Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /orders.php.
- CVE-2025-63450Car-Booking-System-PHP v.1.0 is vulnerable to Cross Site Scripting (XSS) in /carlux/booking.php.
- CVE-2025-63593Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting (XSS).