# CVEs published 2025-11-10

118 CVEs were published on November 10, 2025: 6 critical, 50 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-11578](https://cve.now/CVE-2025-11578.md): Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation (CVSS 7.5, GitHub Enterprise Server)
- [CVE-2025-11892](https://cve.now/CVE-2025-11892.md): DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggers (CVSS 8.6, GitHub Enterprise Server)
- [CVE-2021-4462](https://cve.now/CVE-2021-4462.md): Employee Records System v1.0 Arbitrary File Upload RCE (CVSS 9.3, Employee Records System)
- [CVE-2018-25124](https://cve.now/CVE-2018-25124.md): PacsOne Server 6.6.2 DICOM Web Viewer Directory Traversal LFI (CVSS 8.7, RainbowFish Software PacsOne Server)
- [CVE-2025-64529](https://cve.now/CVE-2025-64529.md): SpiceDB's WriteRelationships fails silently if payload is too big (CVSS 2.7, authzed spicedb · github.com/authzed/spicedb)
- [CVE-2025-64519](https://cve.now/CVE-2025-64519.md): TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic\_id parameter (CVSS 8.8, torrentpier · torrentpier/torrentpier)
- [CVE-2025-64522](https://cve.now/CVE-2025-64522.md): Soft Serve is vulnerable to SSRF through its Webhooks (CVSS 9.1, charmbracelet soft-serve · github.com/charmbracelet/soft-se…)
- [CVE-2025-64518](https://cve.now/CVE-2025-64518.md): CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection (CVSS 7.5, cyclonedx-core-java · org.cyclonedx:cyclonedx-core-java)
- [CVE-2025-64513](https://cve.now/CVE-2025-64513.md): Milvus Proxy has Critical Authentication Bypass Vulnerability (CVSS 9.3, milvus-io milvus · github.com/milvus-io/milvus)
- [CVE-2025-64512](https://cve.now/CVE-2025-64512.md): pdfminer.six vulnerable to Arbitrary Code Execution via Crafted PDF Input (CVSS 8.6, pdfminer.six · pdfminer-six)
- [CVE-2025-64507](https://cve.now/CVE-2025-64507.md): Incus vulnerable to local privilege escalation through custom storage volumes (CVSS 8.6, lxc incus · github.com/lxc/incus/v6 +1)
- [CVE-2025-64504](https://cve.now/CVE-2025-64504.md): Langfuse vulnerable to cross‑organization enumeration of member & invitation lists via project membership APIs (CVSS 5.0, langfuse)
- [CVE-2025-64509](https://cve.now/CVE-2025-64509.md): Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU) (CVSS 7.5, bugsink)
- [CVE-2025-64508](https://cve.now/CVE-2025-64508.md): Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input (CVSS 7.5, bugsink)
- [CVE-2025-64502](https://cve.now/CVE-2025-64502.md): Parse Server allows public \`explain\` queries which may expose sensitive database performance information and schema details (CVSS 6.9, parse-community parse-server · parse-server)
- [CVE-2025-64501](https://cve.now/CVE-2025-64501.md): ProsemirrorToHtml: Cross-Site Scripting vulnerability through unescaped HTML attribute values (CVSS 7.6, etaminstudio prosemirror\_to\_html · prosemirror\_to\_html)
- [CVE-2025-64484](https://cve.now/CVE-2025-64484.md): OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation (CVSS 8.5, oauth2-proxy · github.com/oauth2-proxy/oauth2-proxy/v7 +1)
- [CVE-2025-64183](https://cve.now/CVE-2025-64183.md): OpenEXR has use after free in PyObject\_StealAttrString (CVSS 5.5, AcademySoftwareFoundation openexr · openexr)
- [CVE-2025-64182](https://cve.now/CVE-2025-64182.md): OpenEXR has buffer overflow in PyOpenEXR\_old's channels() and channel() (CVSS 5.5, AcademySoftwareFoundation openexr · openexr)
- [CVE-2025-64181](https://cve.now/CVE-2025-64181.md): OpenEXR Makes Use of Uninitialized Memory (CVSS 2.0, AcademySoftwareFoundation openexr · openexr)
- [CVE-2025-62780](https://cve.now/CVE-2025-62780.md): changedetection.io vulnerable to stored XSS in Watch update via API (CVSS 3.5, dgtlmoon changedetection.io · changedetection-io)
- [CVE-2025-64167](https://cve.now/CVE-2025-64167.md): Combodo iTop vulnerable to reflected XSS in webservices/export.php (CVSS 7.1, Combodo iTop)
- [CVE-2025-49145](https://cve.now/CVE-2025-49145.md): iTop admin can drop iTop database using webhooks (CVSS 8.7, Combodo iTop)
- [CVE-2025-48878](https://cve.now/CVE-2025-48878.md): Combodo iTop vulnerable to IDOR with ModuleInstallation object (CVSS 4.3, Combodo iTop)
- [CVE-2025-48065](https://cve.now/CVE-2025-48065.md): Combodo iTop vulnerable to reflected XSS via objection edition form error (CVSS 8.8, Combodo iTop)
- [CVE-2025-48055](https://cve.now/CVE-2025-48055.md): Combodo iTop has stored XSS in user portal's browse brick (CVSS 8.5, Combodo iTop)
- [CVE-2025-12729](https://cve.now/CVE-2025-12729.md): Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user t (CVSS 4.2, Google Chrome)
- [CVE-2025-12728](https://cve.now/CVE-2025-12728.md): Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user t (CVSS 4.2, Google Chrome)
- [CVE-2025-12727](https://cve.now/CVE-2025-12727.md): Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.137 allowed a remote attacker to potentially exploit heap corruption (CVSS 8.8, Google Chrome)
- [CVE-2025-12726](https://cve.now/CVE-2025-12726.md): Inappropriate implementation in Views in Google Chrome on Windows prior to 142.0.7444.137 allowed a remote attacker who had compromised the (CVSS 7.5, Google Chrome)
- [CVE-2025-12725](https://cve.now/CVE-2025-12725.md): Out of bounds read in WebGPU in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker to perform an out of bounds memor (CVSS 8.8, Google Chrome)
- [CVE-2025-12447](https://cve.now/CVE-2025-12447.md): Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage (CVSS 4.2, Google Chrome)
- [CVE-2025-12446](https://cve.now/CVE-2025-12446.md): Incorrect security UI in SplitView in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in speci (CVSS 4.2, Google Chrome)
- [CVE-2025-12445](https://cve.now/CVE-2025-12445.md): Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extensio (CVSS 6.5, Google Chrome)
- [CVE-2025-12444](https://cve.now/CVE-2025-12444.md): Incorrect security UI in Fullscreen UI in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in s (CVSS 4.2, Google Chrome)
- [CVE-2025-12443](https://cve.now/CVE-2025-12443.md): Out of bounds read in WebXR in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform an out of bounds memory read via a (CVSS 4.3, Google Chrome)
- [CVE-2025-12441](https://cve.now/CVE-2025-12441.md): Out of bounds read in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform an out of bounds memory read via a cra (CVSS 4.3, Google Chrome)
- [CVE-2025-12440](https://cve.now/CVE-2025-12440.md): Inappropriate implementation in Autofill in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in (CVSS 5.3, Google Chrome)
- [CVE-2025-12439](https://cve.now/CVE-2025-12439.md): Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142.0.7444.59 allowed a local attacker to obtain p (CVSS 5.5, Google Chrome)
- [CVE-2025-12438](https://cve.now/CVE-2025-12438.md): Use after free in Ozone in Google Chrome on Linux and ChromeOS prior to 142.0.7444.59 allowed a remote attacker to potentially exploit objec (CVSS 8.8, Google Chrome)
- [CVE-2025-12437](https://cve.now/CVE-2025-12437.md): Use after free in PageInfo in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI g (CVSS 7.5, Google Chrome)
- [CVE-2025-12436](https://cve.now/CVE-2025-12436.md): Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extensio (CVSS 5.9, Google Chrome)
- [CVE-2025-12435](https://cve.now/CVE-2025-12435.md): Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a c (CVSS 5.4, Google Chrome)
- [CVE-2025-12434](https://cve.now/CVE-2025-12434.md): Race in Storage in Google Chrome on Windows prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI g (CVSS 4.2, Google Chrome)
- [CVE-2025-12433](https://cve.now/CVE-2025-12433.md): Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform out of bounds memory access (CVSS 4.3, Google Chrome)
- [CVE-2025-12432](https://cve.now/CVE-2025-12432.md): Race in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (CVSS 8.8, Google Chrome)
- [CVE-2025-12431](https://cve.now/CVE-2025-12431.md): Inappropriate implementation in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a mal (CVSS 6.5, Google Chrome)
- [CVE-2025-12430](https://cve.now/CVE-2025-12430.md): Object lifecycle issue in Media in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML (CVSS 7.5, Google Chrome)
- [CVE-2025-12429](https://cve.now/CVE-2025-12429.md): Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a c (CVSS 8.8, Google Chrome)
- [CVE-2025-12428](https://cve.now/CVE-2025-12428.md): Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML pa (CVSS 8.8, Google Chrome)
- [CVE-2025-33150](https://cve.now/CVE-2025-33150.md): IBM Cognos Analytics Certified Containers information disclosure (CVSS 5.3, IBM Cognos Analytics Certified Containers)
- [CVE-2025-47932](https://cve.now/CVE-2025-47932.md): Combodo iTop vulnerable to reflected XSS in ajax.render.php render\_dashboard (CVSS 8.8, Combodo iTop)
- [CVE-2025-47773](https://cve.now/CVE-2025-47773.md): Combodo iTop has XSS vulnerability in /pages/ajax.render.php (CVSS 8.8, Combodo iTop)
- [CVE-2025-43723](https://cve.now/CVE-2025-43723.md): Dell PowerScale OneFS, versions prior to 9.10.1.3 and versions 9.11.0.0 through 9.12.0.0, contains a use of a broken or risky cryptographic (CVSS 5.9, Dell PowerScale OneFS)
- [CVE-2025-47286](https://cve.now/CVE-2025-47286.md): Combodo iTop vulnerable to Remote Code Execution in the backup creation functionality (CVSS 8.6, Combodo iTop)
- [CVE-2025-12967](https://cve.now/CVE-2025-12967.md): An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds\_superuser role. (CVSS 8.6, AWS JDBC Wrapper · AWS Go Wrapper +4)
- [CVE-2025-43079](https://cve.now/CVE-2025-43079.md): Local Privilege Escalation via qagent\_uninstall.sh Qualys Cloud Agents (CVSS 6.3, Qualys Agent)
- [CVE-2025-46430](https://cve.now/CVE-2025-46430.md): Dell Display and Peripheral Manager, versions prior to 2.1.2.12, contains an Execution with Unnecessary Privileges vulnerability in the Inst (CVSS 7.3, Dell Display and Peripheral Manager)
- [CVE-2025-12480](https://cve.now/CVE-2025-12480.md): Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even (CVSS 9.1, KEV, TrioFox)
- [CVE-2025-64457](https://cve.now/CVE-2025-64457.md): In JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race condition (CVSS 4.2, JetBrains ReSharper, Rider and dotTrace)
- [CVE-2025-64456](https://cve.now/CVE-2025-64456.md): In JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows local privilege escalation (CVSS 8.4, JetBrains ReSharper)
- [CVE-2025-64685](https://cve.now/CVE-2025-64685.md): In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure (CVSS 8.1, JetBrains YouTrack)
- [CVE-2025-64684](https://cve.now/CVE-2025-64684.md): In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form (CVSS 4.5, JetBrains YouTrack)
- [CVE-2025-64683](https://cve.now/CVE-2025-64683.md): In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API (CVSS 5.3, JetBrains Hub)
- [CVE-2025-64682](https://cve.now/CVE-2025-64682.md): In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit (CVSS 2.7, JetBrains Hub)
- [CVE-2025-64681](https://cve.now/CVE-2025-64681.md): In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations (CVSS 2.7, JetBrains Hub)
- [CVE-2025-12939](https://cve.now/CVE-2025-12939.md): SourceCodester Interview Management System addCandidate.php sql injection (CVSS 5.3, SourceCodester Interview Management System)
- [CVE-2025-12938](https://cve.now/CVE-2025-12938.md): projectworlds Online Admission System process\_login.php sql injection (CVSS 6.9, projectworlds Online Admission System)
- [CVE-2025-41001](https://cve.now/CVE-2025-41001.md): Cross-Site Scripting (XSS) in SOPlanning (CVSS 5.1, SOPlanning)
- [CVE-2025-12405](https://cve.now/CVE-2025-12405.md): Unauthorized access through stored credentials in Looker Studio (CVSS 7.7, Google Cloud Looker Studio)
- [CVE-2025-41107](https://cve.now/CVE-2025-41107.md): Stored XSS in Smart School (CVSS 5.1, QDOCS Smart Schoo)
- [CVE-2025-12409](https://cve.now/CVE-2025-12409.md): SQL Injection in Looker Studio (CVSS 7.3, Google Cloud Looker Studio)
- [CVE-2025-12397](https://cve.now/CVE-2025-12397.md): SQL Injection in Looker Studio (CVSS 7.6, Google Cloud Looker Studio)
- [CVE-2025-12155](https://cve.now/CVE-2025-12155.md): Command Injection in Looker (CVSS 7.1, Google Cloud Looker)
- [CVE-2025-41731](https://cve.now/CVE-2025-41731.md): Jumo: Insufficient entropy in PRNG may lead to root access (CVSS 7.4, Jumo variTRON300 · Jumo variTRON500)
- [CVE-2025-12933](https://cve.now/CVE-2025-12933.md): SourceCodester Baby Care System updatewelcome.php sql injection (CVSS 5.3, SourceCodester Baby Care System)
- [CVE-2025-12932](https://cve.now/CVE-2025-12932.md): SourceCodester Baby Care System admin.php sql injection (CVSS 5.1, SourceCodester Baby Care System)
- [CVE-2025-12613](https://cve.now/CVE-2025-12613.md): Versions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values c (CVSS 8.8, cloudinary)
- [CVE-2025-12931](https://cve.now/CVE-2025-12931.md): SourceCodester Food Ordering System edit-orders.php sql injection (CVSS 5.3, SourceCodester Food Ordering System)
- [CVE-2025-62689](https://cve.now/CVE-2025-62689.md): NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. (CVSS 7.5, GNU Project GNU libbmicrohttpd)
- [CVE-2025-59777](https://cve.now/CVE-2025-59777.md): NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. (CVSS 7.5, GNU Project GNU libbmicrohttpd)
- [CVE-2025-12930](https://cve.now/CVE-2025-12930.md): SourceCodester Food Ordering System view-ticket.php sql injection (CVSS 5.3, SourceCodester Food Ordering System)
- [CVE-2025-12929](https://cve.now/CVE-2025-12929.md): SourceCodester Survey Application System LoginRegistration.php update\_user sql injection (CVSS 6.9, SourceCodester Survey Application System)
- [CVE-2025-12868](https://cve.now/CVE-2025-12868.md): CyberTutor｜New Site Server - Use of Client-Side Authentication (CVSS 9.3, CyberTutor New Site Server)
- [CVE-2025-12867](https://cve.now/CVE-2025-12867.md): Hundred Plus｜EIP Plus - Arbitrary File Uplaod (CVSS 8.6, Hundred Plus EIP Plus)
- [CVE-2025-12928](https://cve.now/CVE-2025-12928.md): code-projects Online Job Search Engine login.php sql injection (CVSS 6.9, code-projects Online Job Search Engine)
- [CVE-2025-12866](https://cve.now/CVE-2025-12866.md): Hundred Plus｜EIP Plus - Weak Password Recovery Mechanism (CVSS 9.3, Hundred Plus EIP Plus)
- [CVE-2025-12927](https://cve.now/CVE-2025-12927.md): DedeBIZ archives\_add.php sql injection (CVSS 5.1, DedeBIZ)
- [CVE-2025-12865](https://cve.now/CVE-2025-12865.md): e-Excellence｜U-Office Force - SQL Injection (CVSS 8.7, e-Excellence U-Office Force)
- [CVE-2025-12864](https://cve.now/CVE-2025-12864.md): e-Excellence｜U-Office Force - SQL Injection (CVSS 8.7, e-Excellence U-Office Force)
- [CVE-2025-12926](https://cve.now/CVE-2025-12926.md): SourceCodester Farm Management System review.php sql injection (CVSS 5.3, SourceCodester Farm Management System)
- [CVE-2025-12925](https://cve.now/CVE-2025-12925.md): rymcu forest UserDicController.java deleteDic authorization (CVSS 6.9, rymcu forest)
- [CVE-2025-12924](https://cve.now/CVE-2025-12924.md): rymcu forest BankController.java GlobalResult authorization (CVSS 5.3, rymcu forest)
- [CVE-2025-12923](https://cve.now/CVE-2025-12923.md): liweiyi ChestnutCMS download resourceDownload path traversal (CVSS 5.1, liweiyi ChestnutCMS)
- [CVE-2025-12922](https://cve.now/CVE-2025-12922.md): OpenClinica Community Edition CRF Data Import ImportCRFData path traversal (CVSS 5.3, OpenClinica Community Edition)
- [CVE-2025-56503](https://cve.now/CVE-2025-56503.md): An issue in Sublime HQ Pty Ltd Sublime Text 4 4200 allows authenticated attackers with low-level privileges to escalate privileges to Admini (CVSS 6.5)
- [CVE-2025-60876](https://cve.now/CVE-2025-60876.md): BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the re (CVSS 6.5)
- [CVE-2025-63147](https://cve.now/CVE-2025-63147.md): Tenda AX3 V16.03.12.10\_CN was discovered to contain a stack overflow in the deviceId parameter of the saveParentControlInfo function. (CVSS 6.5)
- [CVE-2025-63149](https://cve.now/CVE-2025-63149.md): Tenda AX3 V16.03.12.10\_CN was discovered to contain a stack overflow in the urls parameter of the get\_parentControl\_list\_Info function. (CVSS 7.5)
- [CVE-2025-63152](https://cve.now/CVE-2025-63152.md): Tenda AX3 V16.03.12.10\_CN was discovered to contain a stack overflow in the wpapsk\_crypto parameter of the wlSetExternParameter function. (CVSS 7.5)
- [CVE-2025-63153](https://cve.now/CVE-2025-63153.md): TOTOLink A7000R V9.1.0u.6115\_B20201022 was discovered to contain a stack overflow in the ssid parameter of the urldecode function. (CVSS 7.5)
- [CVE-2025-63154](https://cve.now/CVE-2025-63154.md): TOTOLink A7000R V9.1.0u.6115\_B20201022 was discovered to contain a stack overflow in the addEffect parameter of the urldecode function. (CVSS 7.5)
- [CVE-2025-63288](https://cve.now/CVE-2025-63288.md): In Open5GS 2.7.6, AMF crashes when receiving an abnormal NGSetupRequest message, resulting in denial of service. (CVSS 7.5)
- [CVE-2025-63296](https://cve.now/CVE-2025-63296.md): KERUI K259 5MP Wi-Fi / Tuya Smart Security Camera firmware v33.53.87 contains a code execution vulnerability in its boot/update logic: durin (CVSS 6.5)
- [CVE-2025-63384](https://cve.now/CVE-2025-63384.md): A vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the SRET (Supervisor-mode Exception Return) instru (CVSS 6.5)
- [CVE-2025-63397](https://cve.now/CVE-2025-63397.md): Improper input validation in OneFlow v0.9.0 allows attackers to cause a segmentation fault via adding a Python sequence to the native code d (CVSS 6.5)
- [CVE-2025-63455](https://cve.now/CVE-2025-63455.md): Tenda AX-3 v16.03.12.10\_CN was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function. (CVSS 7.5)
- [CVE-2025-63456](https://cve.now/CVE-2025-63456.md): Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the time parameter in the SetSysTimeCfg function. (CVSS 6.5)
- [CVE-2025-63457](https://cve.now/CVE-2025-63457.md): Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the wanMTU parameter in the sub\_4F55C function. (CVSS 6.5)
- [CVE-2025-63497](https://cve.now/CVE-2025-63497.md): The patient prescription viewing functionality in his\_doc\_view\_single\_patient.php of rickxy Hospital Management System version 1.0 contains (CVSS 7.1)
- [CVE-2025-63617](https://cve.now/CVE-2025-63617.md): ktg-mes before commit a484f96 (2025-07-03) has a fastjson deserialization vulnerability. (CVSS 6.5)
- [CVE-2025-63678](https://cve.now/CVE-2025-63678.md): An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows att (CVSS 3.8)
- [CVE-2025-63709](https://cve.now/CVE-2025-63709.md): A Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Simple To-Do List System 1.0 in the "Add Tasks" text input. (CVSS 5.4)
- [CVE-2025-63710](https://cve.now/CVE-2025-63710.md): The send\_message.php endpoint in SourceCodester Simple Public Chat Room 1.0 is vulnerable to Cross-Site Request Forgery (CSRF). (CVSS 6.5)
- [CVE-2025-63711](https://cve.now/CVE-2025-63711.md): A Cross-Site Request Forgery (CSRF) vulnerability in the SourceCodester Client Database Management System 1.0 allows an attacker to cause an (CVSS 7.1)
- [CVE-2025-63712](https://cve.now/CVE-2025-63712.md): Cross-Site Request Forgery (CSRF) in SourceCodester Product Expiry Management System. (CVSS 4.5)
- [CVE-2025-63834](https://cve.now/CVE-2025-63834.md): A stored cross-site scripting (XSS) vulnerability was discovered in Tenda AC18 v15.03.05.05\_multi. (CVSS 5.4)
- [CVE-2025-63835](https://cve.now/CVE-2025-63835.md): A stack-based buffer overflow vulnerability was discovered in Tenda AC18 v15.03.05.05\_multi. (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.