# CVEs published 2025-11-08

39 CVEs were published on November 8, 2025: 0 critical, 12 high. Days are UTC.

- [CVE-2025-12916](https://cve.now/CVE-2025-12916.md): Sangfor Operation and Maintenance Security Management System Frontend portal\_login command injection (CVSS 5.3, Sangfor Operation and Maintenance Security Management System)
- [CVE-2025-12915](https://cve.now/CVE-2025-12915.md): 70mai X200 Init Script file inclusion (CVSS 7.1, 70mai X200)
- [CVE-2025-12914](https://cve.now/CVE-2025-12914.md): aaPanel BaoTa Backend database sql injection (CVSS 5.1, aaPanel BaoTa)
- [CVE-2025-12913](https://cve.now/CVE-2025-12913.md): code-projects Responsive Hotel Site roomdel.php sql injection (CVSS 5.1, code-projects Responsive Hotel Site)
- [CVE-2025-12399](https://cve.now/CVE-2025-12399.md): Alex Reservations: Smart Restaurant Booking \<= 2.2.3 - Authenticated (Admin+) Arbitrary File Upload (CVSS 7.2, alexreservations Alex Reservations: Smart Restaurant Booking)
- [CVE-2025-11967](https://cve.now/CVE-2025-11967.md): Mail Mint \<= 1.18.10 - Authenticated (Admin+) Arbitrary File Upload (CVSS 7.2, getwpfunnels Mail Mint – Email Marketing, Newsletter, Email…)
- [CVE-2025-11448](https://cve.now/CVE-2025-11448.md): Gallery Plugin for WordPress – Envira Photo Gallery \<= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery Conversion (CVSS 4.3, smub Envira Gallery – Image Photo Gallery, Albums, Video Ga…)
- [CVE-2025-12837](https://cve.now/CVE-2025-12837.md): aThemes Addons for Elementor \<= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widget (CVSS 6.4, smub aThemes Addons for Elementor)
- [CVE-2025-12643](https://cve.now/CVE-2025-12643.md): Saphali LiqPay for donate \<= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Saphali LiqPay for donate)
- [CVE-2025-11980](https://cve.now/CVE-2025-11980.md): Quick Featured Images \<= 13.7.3 - Authenticated (Editor+) SQL Injection via delete\_orphaned (CVSS 4.9, kybernetikservices Quick Featured Images)
- [CVE-2025-12092](https://cve.now/CVE-2025-12092.md): CYAN Backup \<= 2.5.4 - Authenticated (Admin+) Arbitrary File Deletion (CVSS 6.5, gregross CYAN Backup)
- [CVE-2025-12098](https://cve.now/CVE-2025-12098.md): Academy LMS Pro \<= 3.3.8 - Unauthenticated Sensitive Information Exposure via 'enqueue\_social\_login\_script' (CVSS 5.3, academylms Academy LMS Pro)
- [CVE-2025-12099](https://cve.now/CVE-2025-12099.md): Academy LMS – WordPress LMS Plugin for Complete eLearning Solution \<= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import\_all\_courses' (CVSS 7.2, kodezen Academy LMS – WordPress LMS Plugin for Complete eLe…)
- [CVE-2025-12621](https://cve.now/CVE-2025-12621.md): Flexible Refund and Return Order for WooCommerce \<= 1.0.42 - Incorrect Authorization to Authenticated (Contributor+) Refund Status Update (CVSS 5.3, wpdesk Flexible Refund and Return Order for WooCommerce)
- [CVE-2025-12498](https://cve.now/CVE-2025-12498.md): EventPrime – Events Calendar, Bookings and Tickets \<= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation (CVSS 4.3, metagauss EventPrime – Events Calendar, Bookings and Tickets)
- [CVE-2025-9334](https://cve.now/CVE-2025-9334.md): Better Find and Replace \<= 1.7.7 - Authenticated (Subscriber+) Limited Code Injection (CVSS 8.8, codesolz Better Find and Replace – AI-Powered Suggestions)
- [CVE-2025-12125](https://cve.now/CVE-2025-12125.md): HTML Forms \<= 1.5.5 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, linksoftware HTML Forms – Simple WordPress Forms Plugin)
- [CVE-2025-12112](https://cve.now/CVE-2025-12112.md): Insert Headers and Footers Code – HT Script \<= 1.1.6 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, htplugins Insert Headers and Footers Code – HT Script)
- [CVE-2025-12000](https://cve.now/CVE-2025-12000.md): WPFunnels \<= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal (CVSS 6.5, getwpfunnels WPFunnels – Funnel Builder for WooCommerce wit…)
- [CVE-2025-11748](https://cve.now/CVE-2025-11748.md): Groups \<= 3.7.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Group Join (CVSS 4.3, itthinx Groups)
- [CVE-2025-12161](https://cve.now/CVE-2025-12161.md): Smart Auto Upload Images \<= 1.2.0 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8, burhandodhy Smart Auto Upload Images – Import External Imag…)
- [CVE-2025-12193](https://cve.now/CVE-2025-12193.md): Mang Board WP \<= 2.3.1 - Reflected Cross-Site Scripting (CVSS 6.1, kitae-park Mang Board WP)
- [CVE-2025-11972](https://cve.now/CVE-2025-11972.md): Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI \<= 3.40.0 - Authenticated (Editor+) SQL Injection (CVSS 4.9, stevejburge Tag, Category, and Taxonomy Manager – AI Autota…)
- [CVE-2025-7663](https://cve.now/CVE-2025-7663.md): Ovatheme Events Manager \<= 1.8.6 - Missing Authorization (CVSS 6.5, Ovatheme Events Manager)
- [CVE-2025-12353](https://cve.now/CVE-2025-12353.md): WPFunnels \<= 3.6.2 - Unauthorized User Registration (CVSS 5.3, getwpfunnels WPFunnels – Funnel Builder for WooCommerce wit…)
- [CVE-2025-12042](https://cve.now/CVE-2025-12042.md): Course Booking System \<= 6.1.5 - Missing Authorization to Unauthenticated Booking Data Export (CVSS 5.3, werbeagenturcommotion Course Booking System)
- [CVE-2025-12064](https://cve.now/CVE-2025-12064.md): WP2Social Auto Publish \<= 2.4.7 - Reflected Cross-Site Scripting via PostMessage (CVSS 6.1, f1logic WP2Social Auto Publish)
- [CVE-2025-12177](https://cve.now/CVE-2025-12177.md): Download Manager \<= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key (CVSS 5.3, codename065 Download Manager)
- [CVE-2025-12167](https://cve.now/CVE-2025-12167.md): Contact Form 7 AWeber Extension \<= 0.1.42 - Missing Authorization to Authenticated (Subscriber+) Log Reset (CVSS 4.3, rnzo Connect Contact Form 7 and AWeber)
- [CVE-2025-12583](https://cve.now/CVE-2025-12583.md): Simple Downloads List \<= 1.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, neofix Simple Downloads List)
- [CVE-2025-11452](https://cve.now/CVE-2025-11452.md): Asgaros Forum \<= 3.1.0 - Unauthenticated SQL Injection (CVSS 7.5, Asgaros Forum)
- [CVE-2025-64496](https://cve.now/CVE-2025-64496.md): Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events (CVSS 7.3, open-webui)
- [CVE-2025-64495](https://cve.now/CVE-2025-64495.md): Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE (CVSS 8.7, open-webui)
- [CVE-2025-64494](https://cve.now/CVE-2025-64494.md): Soft Serve does not sanitize ANSI escape sequences in user input (CVSS 4.6, charmbracelet soft-serve · github.com/charmbracelet/soft-se…)
- [CVE-2025-64493](https://cve.now/CVE-2025-64493.md): SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL (CVSS 6.5, SuiteCRM-Core)
- [CVE-2025-64492](https://cve.now/CVE-2025-64492.md): SuiteCRM is Vulnerable to Authenticated Time Based Blind SQL Injection (CVSS 8.8, SuiteCRM-Core)
- [CVE-2025-64491](https://cve.now/CVE-2025-64491.md): SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page (CVSS 6.1, SuiteCRM)
- [CVE-2025-64490](https://cve.now/CVE-2025-64490.md): SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass (CVSS 8.3, SuiteCRM)
- [CVE-2025-64489](https://cve.now/CVE-2025-64489.md): SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass (CVSS 8.3, SuiteCRM)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.