CVEs published November 8, 2025
39 CVEs were published on November 8, 2025: 0 critical, 12 high.
- Published
- 39
- Critical
- 0
- High
- 12
- Medium
- 27
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- SuiteCRM
- 3
- getwpfunnels WPFunnels – Funnel Builder for WooCommerce wit…
- 2
- open-webui
- 2
- SuiteCRM-Core
- 2
- 70mai X200
- 1
- aaPanel BaoTa
- 1
- academylms Academy LMS Pro
- 1
- alexreservations Alex Reservations: Smart Restaurant Booking
- 1
- Asgaros Forum
- 1
- burhandodhy Smart Auto Upload Images – Import External Imag…
- 1
High 12
- CVE-2025-1291570mai X200 Init Script file inclusion70mai X200
- CVE-2025-12399Alex Reservations: Smart Restaurant Booking <= 2.2.3 - Authenticated (Admin+) Arbitrary File Uploadalexreservations Alex Reservations: Smart Restaurant Booking
- CVE-2025-11967Mail Mint <= 1.18.10 - Authenticated (Admin+) Arbitrary File Uploadgetwpfunnels Mail Mint – Email Marketing, Newsletter, Email…
- CVE-2025-12099Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'kodezen Academy LMS – WordPress LMS Plugin for Complete eLe…
- CVE-2025-9334Better Find and Replace <= 1.7.7 - Authenticated (Subscriber+) Limited Code Injectioncodesolz Better Find and Replace – AI-Powered Suggestions
- CVE-2025-12161Smart Auto Upload Images <= 1.2.0 - Authenticated (Contributor+) Arbitrary File Uploadburhandodhy Smart Auto Upload Images – Import External Imag…
- CVE-2025-11452Asgaros Forum <= 3.1.0 - Unauthenticated SQL InjectionAsgaros Forum
- CVE-2025-64496Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Eventsopen-webui
- CVE-2025-64495Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCEopen-webui
- CVE-2025-64492SuiteCRM is Vulnerable to Authenticated Time Based Blind SQL InjectionSuiteCRM-Core
- CVE-2025-64490SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control BypassSuiteCRM
- CVE-2025-64489SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User BypassSuiteCRM
Medium, low and unrated 27
- CVE-2025-12916Sangfor Operation and Maintenance Security Management System Frontend portal_login command injectionSangfor Operation and Maintenance Security Management System
- CVE-2025-12914aaPanel BaoTa Backend database sql injectionaaPanel BaoTa
- CVE-2025-12913code-projects Responsive Hotel Site roomdel.php sql injectioncode-projects Responsive Hotel Site
- CVE-2025-11448Gallery Plugin for WordPress – Envira Photo Gallery <= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery Conversionsmub Envira Gallery – Image Photo Gallery, Albums, Video Ga…
- CVE-2025-12837aThemes Addons for Elementor <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widgetsmub aThemes Addons for Elementor
- CVE-2025-12643Saphali LiqPay for donate <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeSaphali LiqPay for donate
- CVE-2025-11980Quick Featured Images <= 13.7.3 - Authenticated (Editor+) SQL Injection via delete_orphanedkybernetikservices Quick Featured Images
- CVE-2025-12092CYAN Backup <= 2.5.4 - Authenticated (Admin+) Arbitrary File Deletiongregross CYAN Backup
- CVE-2025-12098Academy LMS Pro <= 3.3.8 - Unauthenticated Sensitive Information Exposure via 'enqueue_social_login_script'academylms Academy LMS Pro
- CVE-2025-12621Flexible Refund and Return Order for WooCommerce <= 1.0.42 - Incorrect Authorization to Authenticated (Contributor+) Refund Status Updatewpdesk Flexible Refund and Return Order for WooCommerce
- CVE-2025-12498EventPrime – Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creationmetagauss EventPrime – Events Calendar, Bookings and Tickets
- CVE-2025-12125HTML Forms <= 1.5.5 - Authenticated (Admin+) Stored Cross-Site Scriptinglinksoftware HTML Forms – Simple WordPress Forms Plugin
- CVE-2025-12112Insert Headers and Footers Code – HT Script <= 1.1.6 - Authenticated (Author+) Stored Cross-Site Scriptinghtplugins Insert Headers and Footers Code – HT Script
- CVE-2025-12000WPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversalgetwpfunnels WPFunnels – Funnel Builder for WooCommerce wit…
- CVE-2025-11748Groups <= 3.7.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Group Joinitthinx Groups
- CVE-2025-12193Mang Board WP <= 2.3.1 - Reflected Cross-Site Scriptingkitae-park Mang Board WP
- CVE-2025-11972Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.0 - Authenticated (Editor+) SQL Injectionstevejburge Tag, Category, and Taxonomy Manager – AI Autota…
- CVE-2025-7663Ovatheme Events Manager <= 1.8.6 - Missing AuthorizationOvatheme Events Manager
- CVE-2025-12353WPFunnels <= 3.6.2 - Unauthorized User Registrationgetwpfunnels WPFunnels – Funnel Builder for WooCommerce wit…
- CVE-2025-12042Course Booking System <= 6.1.5 - Missing Authorization to Unauthenticated Booking Data Exportwerbeagenturcommotion Course Booking System
- CVE-2025-12064WP2Social Auto Publish <= 2.4.7 - Reflected Cross-Site Scripting via PostMessagef1logic WP2Social Auto Publish
- CVE-2025-12177Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Keycodename065 Download Manager
- CVE-2025-12167Contact Form 7 AWeber Extension <= 0.1.42 - Missing Authorization to Authenticated (Subscriber+) Log Resetrnzo Connect Contact Form 7 and AWeber
- CVE-2025-12583Simple Downloads List <= 1.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scriptingneofix Simple Downloads List
- CVE-2025-64494Soft Serve does not sanitize ANSI escape sequences in user inputcharmbracelet soft-serve · github.com/charmbracelet/soft-se…
- CVE-2025-64493SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQLSuiteCRM-Core
- CVE-2025-64491SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login pageSuiteCRM