# CVEs published 2025-11-03

60 CVEs were published on November 3, 2025: 8 critical, 15 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-34501](https://cve.now/CVE-2025-34501.md): Shuffle Master Deck Mate 2 Hard-coded Credentials & Exposed Services (CVSS 7.0, Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle M…)
- [CVE-2021-47698](https://cve.now/CVE-2021-47698.md): Nagios XI \< 5.8.7 XSS in Core UI Views URL handling (CVSS 5.1, Nagios XI)
- [CVE-2024-13997](https://cve.now/CVE-2024-13997.md): Nagios XI \< 2024R1.1.3 Privilege Escalation via Migrate Server Feature to Root on Host (CVSS 9.4, Nagios XI)
- [CVE-2024-13998](https://cve.now/CVE-2024-13998.md): Nagios XI \< 2024R1.1.3 API Keys & Hashed Passwords Authenticated Information Disclosure (CVSS 6.0, Nagios XI)
- [CVE-2025-11193](https://cve.now/CVE-2025-11193.md): A potential vulnerability was reported in some Lenovo Tablets that could allow a local authenticated user or application to gain access to s (CVSS 6.8, Lenovo Tab M11 TB330FU TB330XU · Lenovo Tab K11 TB330FU… +16)
- [CVE-2025-36172](https://cve.now/CVE-2025-36172.md): Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for 24.0.0-IF007, 24.0.1-IF005 and 25.0.0-IF002 (CVSS 6.4, IBM Cloud Pak for Business Automation)
- [CVE-2025-12657](https://cve.now/CVE-2025-12657.md): Malformed KMIP response may result in access violation (CVSS 5.9, MongoDB Server)
- [CVE-2025-12531](https://cve.now/CVE-2025-12531.md): IBM InfoSphere Information Server is affected by an XML external entity injection (XXE) vulnerability (CVSS 7.1, IBM InfoSphere Information Server)
- [CVE-2025-12642](https://cve.now/CVE-2025-12642.md): HTTP Header Smuggling via Trailer Merge (CVSS 6.9, lighttpd)
- [CVE-2025-8558](https://cve.now/CVE-2025-8558.md): Insider Threat Management (ITM) Server versions prior to 7.17.2 contain an authentication bypass vulnerability that allows unauthenticated u (CVSS 2.3, Proofpoint Insider Threat Management (ITM) Server)
- [CVE-2025-12463](https://cve.now/CVE-2025-12463.md): Unauthenticated SQL Injection in Guetebruck G-Cam Series Cameras (CVSS 9.8, Guetebruck G-Cam)
- [CVE-2025-10280](https://cve.now/CVE-2025-10280.md): Incorrect Content Type Cross-Site Scripting Vulnerability (CVSS 7.1, SailPoint Technologies IdentityIQ)
- [CVE-2025-11953](https://cve.now/CVE-2025-11953.md): Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests (CVSS 9.8, KEV, @react-native-community/cli-server-api · @react-native-comm…)
- [CVE-2025-36093](https://cve.now/CVE-2025-36093.md): security vulnerabilities are addressed with IBM Business Automation Insights iFixes for October 2025. (CVSS 4.8, IBM Cloud Pak For Business Automation)
- [CVE-2025-36092](https://cve.now/CVE-2025-36092.md): IBM Business Automation Insights improper input validation (CVSS 6.5, IBM Cloud Pak For Business Automation)
- [CVE-2025-36091](https://cve.now/CVE-2025-36091.md): IBM Business Automation Insights unverified ownership (CVSS 4.3, IBM Cloud Pak For Business Automation)
- [CVE-2025-11761](https://cve.now/CVE-2025-11761.md): HP Client Management Script Library – Security Update (CVSS 8.5, HP Client Management Script Library)
- [CVE-2025-8900](https://cve.now/CVE-2025-8900.md): Doccure Core \< 1.5.4 - Unauthenticated Privilege Escalation (CVSS 9.8, dreamstechnologies Doccure Core)
- [CVE-2025-64294](https://cve.now/CVE-2025-64294.md): WordPress WP Snow Effect plugin \<= 1.1.19 - Broken Access Control vulnerability (CVSS 5.3, d3wp WP Snow Effect)
- [CVE-2025-12626](https://cve.now/CVE-2025-12626.md): jeecgboot jeewx-boot WxActGoldeneggsPrizesController.java getImgUrl path traversal (CVSS 5.3, jeecgboot jeewx-boot)
- [CVE-2025-40107](https://cve.now/CVE-2025-40107.md): can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (no CVSS, Linux)
- [CVE-2025-0987](https://cve.now/CVE-2025-0987.md): IDOR in CB Project's CVLand (CVSS 9.9, CB Project Ltd. CVLand)
- [CVE-2025-48397](https://cve.now/CVE-2025-48397.md): The privileged user could log in without sufficient credentials after enabling an application protocol. (CVSS 7.1, Eaton Brightlayer Software Suite)
- [CVE-2025-12623](https://cve.now/CVE-2025-12623.md): fushengqian fuint Authentication Token ClientSignController.java authorization (CVSS 2.3, fushengqian fuint)
- [CVE-2025-48396](https://cve.now/CVE-2025-48396.md): Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. (CVSS 8.3, Eaton Brightlayer Software Suite)
- [CVE-2025-12622](https://cve.now/CVE-2025-12622.md): Tenda AC10 SysRunCmd formSysRunCmd buffer overflow (CVSS 8.7, Tenda AC10)
- [CVE-2025-12619](https://cve.now/CVE-2025-12619.md): Tenda A15 openNetworkGateway fromSetWirelessRepeat buffer overflow (CVSS 8.7, Tenda A15)
- [CVE-2025-12503](https://cve.now/CVE-2025-12503.md): Digiwin｜EasyFlow .NET and EasyFlow AiNet (CVSS 7.1, Digiwin EasyFlow .NET · Digiwin EasyFlow AiNet)
- [CVE-2025-12618](https://cve.now/CVE-2025-12618.md): Tenda AC8 DatabaseIniSet buffer overflow (CVSS 8.7, Tenda AC8)
- [CVE-2025-12617](https://cve.now/CVE-2025-12617.md): itsourcecode Billing System login\_crud.php sql injection (CVSS 6.9, itsourcecode Billing System)
- [CVE-2025-12616](https://cve.now/CVE-2025-12616.md): PHPGurukul News Portal settings.py insertion of sensitive information into debugging code (CVSS 6.3, PHPGurukul News Portal)
- [CVE-2025-12615](https://cve.now/CVE-2025-12615.md): PHPGurukul News Portal settings.py hard-coded key (CVSS 2.3, PHPGurukul News Portal)
- [CVE-2025-12614](https://cve.now/CVE-2025-12614.md): SourceCodester Best House Rental Management System admin\_class.php delete\_payment sql injection (CVSS 5.1, SourceCodester Best House Rental Management System)
- [CVE-2025-12612](https://cve.now/CVE-2025-12612.md): Campcodes School Fees Payment Management System ajax.php sql injection (CVSS 5.3, Campcodes School Fees Payment Management System)
- [CVE-2025-12611](https://cve.now/CVE-2025-12611.md): Tenda AC21 SetPptpServerCfg formSetPPTPServer buffer overflow (CVSS 8.7, Tenda AC21)
- [CVE-2025-12610](https://cve.now/CVE-2025-12610.md): CodeAstro Gym Management System view-progress-report.php sql injection (CVSS 5.1, CodeAstro Gym Management System)
- [CVE-2025-12609](https://cve.now/CVE-2025-12609.md): CodeAstro Gym Management System update-progress.php sql injection (CVSS 5.1, CodeAstro Gym Management System)
- [CVE-2025-12608](https://cve.now/CVE-2025-12608.md): itsourcecode Online Loan Management System manage\_user.php sql injection (CVSS 6.9, itsourcecode Online Loan Management System)
- [CVE-2025-12607](https://cve.now/CVE-2025-12607.md): itsourcecode Online Loan Management System manage\_payment.php sql injection (CVSS 6.9, itsourcecode Online Loan Management System)
- [CVE-2024-51317](https://cve.now/CVE-2024-51317.md): An issue in NetSurf v.3.11 allows a remote attacker to execute arbitrary code via the dom\_node\_normalize function (CVSS 6.5)
- [CVE-2025-29699](https://cve.now/CVE-2025-29699.md): NetSurf 3.11 is vulnerable to Use After Free in dom\_node\_set\_text\_content function. (CVSS 6.5)
- [CVE-2025-45663](https://cve.now/CVE-2025-45663.md): An issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating a dom\_event structure. (CVSS 6.5)
- [CVE-2025-50363](https://cve.now/CVE-2025-50363.md): Phpgurukul Maid Hiring Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in /maid-hiring.php va the name field. (CVSS 5.4)
- [CVE-2025-50735](https://cve.now/CVE-2025-50735.md): Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot path segments in its (CVSS 7.5)
- [CVE-2025-60503](https://cve.now/CVE-2025-60503.md): A cross-site scripting (XSS) vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted i (CVSS 8.7)
- [CVE-2025-60785](https://cve.now/CVE-2025-60785.md): A remote code execution (RCE) vulnerability in the Postgres Drivers component of iceScrum v7.54 Pro On-prem allows attackers to execute arbi (CVSS 8.8)
- [CVE-2025-60892](https://cve.now/CVE-2025-60892.md): An issue in Raspberry Pi Imager version 1.9.6 for Windows, affecting its OS customization feature. (CVSS 6.8)
- [CVE-2025-63293](https://cve.now/CVE-2025-63293.md): FairSketch Rise Ultimate Project Manager & CRM 3.9.4 is vulnerable to Insecure Permissions. (CVSS 6.5)
- [CVE-2025-63441](https://cve.now/CVE-2025-63441.md): Open Source Social Network (OSSN) 8.6 is vulnerable to Cross Site Scripting (XSS) via the parameter param\` at endpoint u/administrator/frien (CVSS 7.3)
- [CVE-2025-63442](https://cve.now/CVE-2025-63442.md): Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting (XSS) via the Profile Section. (CVSS 4.6)
- [CVE-2025-63443](https://cve.now/CVE-2025-63443.md): School Management System PHP v1.0 is vulnerable to Cross Site Scripting (XSS) in /login.php via the password parameter. (CVSS 5.4)
- [CVE-2025-63446](https://cve.now/CVE-2025-63446.md): Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add\_vendor.php. (CVSS 6.1)
- [CVE-2025-63447](https://cve.now/CVE-2025-63447.md): Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add\_customer.php. (CVSS 6.1)
- [CVE-2025-63448](https://cve.now/CVE-2025-63448.md): Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit\_product.php?id=1. (CVSS 6.1)
- [CVE-2025-63449](https://cve.now/CVE-2025-63449.md): Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /orders.php. (CVSS 5.4)
- [CVE-2025-63450](https://cve.now/CVE-2025-63450.md): Car-Booking-System-PHP v.1.0 is vulnerable to Cross Site Scripting (XSS) in /carlux/booking.php. (CVSS 5.4)
- [CVE-2025-63451](https://cve.now/CVE-2025-63451.md): Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/sign-in.php. (CVSS 9.8)
- [CVE-2025-63452](https://cve.now/CVE-2025-63452.md): Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/forgot-pass.php. (CVSS 9.4)
- [CVE-2025-63453](https://cve.now/CVE-2025-63453.md): Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/contact.php. (CVSS 9.8)
- [CVE-2025-63593](https://cve.now/CVE-2025-63593.md): Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.