# CVEs published 2025-11-09

7 CVEs were published on November 9, 2025: 0 critical, 0 high. Days are UTC.

- [CVE-2025-12921](https://cve.now/CVE-2025-12921.md): OpenClinica Community Edition CRF Data Import ImportCRFData xml injection (CVSS 5.3, OpenClinica Community Edition)
- [CVE-2025-12920](https://cve.now/CVE-2025-12920.md): qianfox FoxCMS Product.php edit cross site scripting (CVSS 4.8, qianfox FoxCMS)
- [CVE-2025-12919](https://cve.now/CVE-2025-12919.md): EverShop Order Order.resolvers.js resource injection (CVSS 6.3, EverShop · @evershop/evershop)
- [CVE-2025-12918](https://cve.now/CVE-2025-12918.md): yungifez Skuul School Management System View Fee Invoice fee-invoices resource injection (CVSS 2.3, yungifez Skuul School Management System · yungifez/skuul)
- [CVE-2025-12917](https://cve.now/CVE-2025-12917.md): TOZED ZLT T10 Reboot proc\_post denial of service (CVSS 5.3, TOZED ZLT T10)
- [CVE-2025-40109](https://cve.now/CVE-2025-40109.md): crypto: rng - Ensure set\_ent is always present (no CVSS, Linux)
- [CVE-2025-40108](https://cve.now/CVE-2025-40108.md): serial: qcom-geni: Fix blocked task (no CVSS, Linux)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.