# CVEs published 2025-11-13

150 CVEs were published on November 13, 2025: 6 critical, 31 high. Days are UTC.

- [CVE-2025-64530](https://cve.now/CVE-2025-64530.md): @apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields (CVSS 7.5, apollographql federation · @apollo/composition)
- [CVE-2025-13131](https://cve.now/CVE-2025-13131.md): Sonarr Service Sonarr.Console.exe default permission (CVSS 8.5, Sonarr)
- [CVE-2025-13130](https://cve.now/CVE-2025-13130.md): Radarr Service Radarr.Console.exe default permission (CVSS 8.5, Radarr)
- [CVE-2025-36236](https://cve.now/CVE-2025-36236.md): AIX Path Traversal (CVSS 8.2, IBM AIX · IBM VIOS)
- [CVE-2025-36250](https://cve.now/CVE-2025-36250.md): AIX Code Execution (CVSS 10.0, IBM AIX · IBM VIOS)
- [CVE-2025-36096](https://cve.now/CVE-2025-36096.md): AIX Insufficiently Protected Credentials (CVSS 9.0, IBM AIX · IBM VIOS)
- [CVE-2025-36251](https://cve.now/CVE-2025-36251.md): AIX Command Execution (CVSS 9.6, IBM AIX · IBM VIOS)
- [CVE-2025-64754](https://cve.now/CVE-2025-64754.md): Jitsi Meet has DOM Redirect on Microsoft OAuth Flow (CVSS 2.7, jitsi-meet)
- [CVE-2025-64753](https://cve.now/CVE-2025-64753.md): grist-core has insufficient access control in endpoints for comparisons between documents and versions (CVSS 5.3, gristlabs grist-core)
- [CVE-2025-64752](https://cve.now/CVE-2025-64752.md): grist-core has path to server-side requests via websocket (CVSS 6.8, gristlabs grist-core)
- [CVE-2025-64749](https://cve.now/CVE-2025-64749.md): Directus Vulnerable to Information Leakage in Existing Collections (CVSS 4.3, directus · @directus/api)
- [CVE-2025-64748](https://cve.now/CVE-2025-64748.md): Directus's conceal fields are searchable if read permissions enabled (CVSS 6.5, directus · @directus/api)
- [CVE-2025-47913](https://cve.now/CVE-2025-47913.md): Potential denial of service in golang.org/x/crypto/ssh/agent (CVSS 7.5, golang.org/x/crypto/ssh/agent · golang.org/x/crypto)
- [CVE-2025-64747](https://cve.now/CVE-2025-64747.md): Directus Vulnerable to Stored Cross-site Scripting (CVSS 5.5, directus)
- [CVE-2025-64746](https://cve.now/CVE-2025-64746.md): Directus has Improper Permission Handling on Deleted Fields (CVSS 4.6, directus)
- [CVE-2025-64744](https://cve.now/CVE-2025-64744.md): OpenObserve Vulnerable to HTML Injection in Organization Invitation Emails (CVSS 3.5, openobserve)
- [CVE-2025-64745](https://cve.now/CVE-2025-64745.md): Astro development server error page vulnerable to reflected Cross-site Scripting (CVSS 2.7, withastro astro · astro)
- [CVE-2025-4619](https://cve.now/CVE-2025-4619.md): PAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted Packets (CVSS 6.6, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2025-64726](https://cve.now/CVE-2025-64726.md): External Control of System or Configuration Setting and Uncontrolled Search Path Element in sfw (CVSS 7.3, SocketDev firewall-release)
- [CVE-2025-59840](https://cve.now/CVE-2025-59840.md): Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA\_DEBUG global variable (CVSS 8.1, vega · vega-expression +1)
- [CVE-2025-64709](https://cve.now/CVE-2025-64709.md): Typebot May Expose AWS EKS Credentials via Server Side Request Forgery in Webhook Block (CVSS 9.6, baptisteArno typebot.io)
- [CVE-2025-46369](https://cve.now/CVE-2025-46369.md): Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. (CVSS 7.8, Dell Alienware Command Center 6.x)
- [CVE-2025-46370](https://cve.now/CVE-2025-46370.md): Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Process Control vulnerability. (CVSS 3.3, Dell Alienware Command Center 6.x)
- [CVE-2022-4984](https://cve.now/CVE-2022-4984.md): ZenTao Biz \< 6.5, Max \< 3.0, & Open Source Edition 16.5/16.5beta1 SQL Injection via user-login.html (CVSS 8.7, Qingdao Esoft Tianchuang Network Technology Co. ZenTao B… +1)
- [CVE-2025-46362](https://cve.now/CVE-2025-46362.md): Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain an Improper Access Control vulnerability. (CVSS 6.6, Dell Alienware Command Center 6.x)
- [CVE-2025-46368](https://cve.now/CVE-2025-46368.md): Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. (CVSS 6.6, Dell Alienware Command Center 6.x)
- [CVE-2025-46367](https://cve.now/CVE-2025-46367.md): Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Detection of Error Condition Without Action vulnerability. (CVSS 7.8, Dell Alienware Command Center)
- [CVE-2025-43515](https://cve.now/CVE-2025-43515.md): The issue was addressed by refusing external connections by default. (CVSS 8.8, Apple Compressor)
- [CVE-2025-13123](https://cve.now/CVE-2025-13123.md): AMTT Hotel Broadband Operation System get\_firstdate.php sql injection (CVSS 5.3, AMTT Hotel Broadband Operation System)
- [CVE-2025-13122](https://cve.now/CVE-2025-13122.md): SourceCodester Patients Waiting Area Queue Management System api\_patient\_checkin.php getPatientAppointment sql injection (CVSS 6.9, SourceCodester Patients Waiting Area Queue Management System)
- [CVE-2025-64706](https://cve.now/CVE-2025-64706.md): Typebot IDOR Vulnerability: Unauthorized API Token Deletion and Exposure (CVSS 5.0, baptisteArno typebot.io)
- [CVE-2025-12785](https://cve.now/CVE-2025-12785.md): Certain HP LaserJet Pro Printers – Potential Information Disclosure (CVSS 6.9, HP Color LaserJet MFP M478-M479 series · HP Color LaserJ… +4)
- [CVE-2025-12784](https://cve.now/CVE-2025-12784.md): Certain HP LaserJet Pro Printers – Potential Information Disclosure (CVSS 6.9, HP Color LaserJet MFP M478-M479 series · HP Color LaserJ… +4)
- [CVE-2025-59480](https://cve.now/CVE-2025-59480.md): Inadequate validation of SSO redirect credentials permits credential theft (CVSS 6.1, Mattermost)
- [CVE-2025-11777](https://cve.now/CVE-2025-11777.md): Cross-team channel membership access (CVSS 3.1, Mattermost · github.com/mattermost/mattermost-server +5)
- [CVE-2025-11538](https://cve.now/CVE-2025-11538.md): Keycloak-server: debug default bind address (CVSS 6.8, keycloak · Red Hat build of Keycloak +1)
- [CVE-2025-13121](https://cve.now/CVE-2025-13121.md): cameasy Liketea API Endpoint StoreController.php list sql injection (CVSS 6.9, cameasy Liketea)
- [CVE-2025-20346](https://cve.now/CVE-2025-20346.md): Cisco Catalyst Center Privilege Escalation Vulnerability (CVSS 4.3, Cisco Digital Network Architecture Center)
- [CVE-2025-20355](https://cve.now/CVE-2025-20355.md): Cisco Catalyst Center Software HTTP Open Redirect Vulnerability (CVSS 4.7, Cisco Digital Network Architecture Center)
- [CVE-2025-20353](https://cve.now/CVE-2025-20353.md): Cisco Catalyst Center Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Digital Network Architecture Center)
- [CVE-2025-20349](https://cve.now/CVE-2025-20349.md): Cisco DNA Center API Command Injection Vulnerability (CVSS 6.3, Cisco Digital Network Architecture Center)
- [CVE-2025-20341](https://cve.now/CVE-2025-20341.md): Cisco Catalyst Center Privilege Escalation Vulnerability (CVSS 8.8, Cisco Digital Network Architecture Center)
- [CVE-2025-64525](https://cve.now/CVE-2025-64525.md): Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass (CVSS 6.5, withastro astro · astro)
- [CVE-2025-64703](https://cve.now/CVE-2025-64703.md): MaxKB has Information Leak in sandbox (CVSS 6.3, 1Panel-dev MaxKB)
- [CVE-2025-64511](https://cve.now/CVE-2025-64511.md): MaxKB has SSRF in sandbox (CVSS 7.4, 1Panel-dev MaxKB)
- [CVE-2025-64718](https://cve.now/CVE-2025-64718.md): js-yaml has prototype pollution in merge (\<\<) (CVSS 5.3, nodeca js-yaml · js-yaml)
- [CVE-2025-13120](https://cve.now/CVE-2025-13120.md): mruby array.c sort\_cmp use after free (CVSS 4.8, mruby)
- [CVE-2025-64717](https://cve.now/CVE-2025-64717.md): ZITADEL vulnerable to Account Takeover with deactivated Instance IdP (CVSS 7.4, zitadel · github.com/zitadel/zitadel)
- [CVE-2025-64714](https://cve.now/CVE-2025-64714.md): PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal (CVSS 5.8, PrivateBin · privatebin/privatebin)
- [CVE-2025-62484](https://cve.now/CVE-2025-62484.md): Zoom Workplace Clients - Inefficient Regular Expression Complexity (CVSS 8.1, Zoom Communications Zoom Workplace)
- [CVE-2025-62483](https://cve.now/CVE-2025-62483.md): Zoom Clients - Improper Removal of Sensitive Information (CVSS 5.3, Zoom Communications Zoom Clients)
- [CVE-2025-13119](https://cve.now/CVE-2025-13119.md): Fabian Ros/SourceCodester Simple E-Banking System cross-site request forgery (CVSS 5.3, Fabian Ros Simple E-Banking System · SourceCodester Simple…)
- [CVE-2025-13118](https://cve.now/CVE-2025-13118.md): macrozheng mall-swarm paySuccess improper authorization (CVSS 5.3, macrozheng mall-swarm)
- [CVE-2025-62482](https://cve.now/CVE-2025-62482.md): Zoom Workplace for Windows - Cross-site Scripting (CVSS 4.3, Zoom Communications Zoom Workplace)
- [CVE-2025-30662](https://cve.now/CVE-2025-30662.md): Zoom Workplace VDI Plugin macOS Universal Installer - Symlink Following (CVSS 6.6, Zoom Communications Zoom Workplace VDI Plugin macOS Univers…)
- [CVE-2025-30669](https://cve.now/CVE-2025-30669.md): Zoom Workplace Clients - Improper Certificate Validation (CVSS 4.8, Zoom Communications Zoom Workplace Clients)
- [CVE-2025-64741](https://cve.now/CVE-2025-64741.md): Zoom Workplace for Android - Improper Authorization Handling (CVSS 8.1, Zoom Communications Zoom Workplace for Android)
- [CVE-2025-64740](https://cve.now/CVE-2025-64740.md): Zoom Workplace VDI Client for Windows - Improper Verification of Cryptographic Signature (CVSS 7.5, Zoom Communications Zoom Workplace VDI Client)
- [CVE-2025-13117](https://cve.now/CVE-2025-13117.md): macrozheng mall-swarm/mall cancelOrder improper authorization (CVSS 5.3, macrozheng mall-swarm · macrozheng mall)
- [CVE-2025-64739](https://cve.now/CVE-2025-64739.md): Zoom Clients - External Control of File Name or Path (CVSS 4.3, Zoom Communications Zoom Clients)
- [CVE-2025-64738](https://cve.now/CVE-2025-64738.md): Zoom Workplace for macOS - External Control of File Name or Path (CVSS 5.0, Zoom Communications Zoom Workplace for macOS)
- [CVE-2025-13116](https://cve.now/CVE-2025-13116.md): macrozheng mall-swarm/mall cancelUserOrder improper authorization (CVSS 5.3, macrozheng mall-swarm · macrozheng mall)
- [CVE-2025-13115](https://cve.now/CVE-2025-13115.md): macrozheng mall-swarm/mall Order Details detail improper authorization (CVSS 5.3, macrozheng mall-swarm · macrozheng mall)
- [CVE-2025-13114](https://cve.now/CVE-2025-13114.md): macrozheng mall-swarm attr updateAttr improper authorization (CVSS 5.3, macrozheng mall-swarm)
- [CVE-2025-41069](https://cve.now/CVE-2025-41069.md): Insecure Direct Object References (IDOR) in DeporSite of T-Innova DeporSite (CVSS 5.3, T-Innova DeporSite DSuite)
- [CVE-2025-12818](https://cve.now/CVE-2025-12818.md): PostgreSQL libpq undersizes allocations, via integer wraparound (CVSS 5.9, PostgreSQL)
- [CVE-2025-12817](https://cve.now/CVE-2025-12817.md): PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege (CVSS 3.1, PostgreSQL)
- [CVE-2025-12765](https://cve.now/CVE-2025-12765.md): pgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass. (CVSS 7.5, pgadmin.org pgAdmin · pgadmin4)
- [CVE-2025-12764](https://cve.now/CVE-2025-12764.md): pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow. (CVSS 7.5, pgadmin.org pgAdmin · pgadmin4)
- [CVE-2025-12763](https://cve.now/CVE-2025-12763.md): Command injection vulnerability allowing arbitrary command execution on Windows (CVSS 6.8, pgadmin.org pgAdmin · pgadmin4)
- [CVE-2025-12762](https://cve.now/CVE-2025-12762.md): Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4) (CVSS 9.1, pgadmin.org pgAdmin · pgadmin4)
- [CVE-2025-40681](https://cve.now/CVE-2025-40681.md): Cross-Site Scripting (XSS) in xCally Omnichannel (CVSS 5.1, xCally Omnichannel)
- [CVE-2025-12377](https://cve.now/CVE-2025-12377.md): Gallery Plugin for WordPress – Envira Photo Gallery \<= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actions (CVSS 4.3, smub Envira Gallery – Image Photo Gallery, Albums, Video Ga…)
- [CVE-2025-64384](https://cve.now/CVE-2025-64384.md): WordPress JetFormBuilder plugin \<= 3.5.3 - Broken Access Control vulnerability (CVSS 5.3, jetmonsters JetFormBuilder)
- [CVE-2025-64383](https://cve.now/CVE-2025-64383.md): WordPress Qi Blocks plugin \<= 1.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Qode Qi Blocks)
- [CVE-2025-64382](https://cve.now/CVE-2025-64382.md): WordPress Order Export & Order Import for WooCommerce plugin \<= 2.6.7 - Broken Access Control vulnerability (CVSS 4.3, WebToffee Order Export & Order Import for WooCommerce)
- [CVE-2025-64381](https://cve.now/CVE-2025-64381.md): WordPress Booking Calendar plugin \<= 10.14.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpdevelop Booking Calendar)
- [CVE-2025-64380](https://cve.now/CVE-2025-64380.md): WordPress Booster for WooCommerce plugin \<= 7.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Pluggabl Booster for WooCommerce)
- [CVE-2025-64379](https://cve.now/CVE-2025-64379.md): WordPress Booster for WooCommerce plugin \<= 7.4.0 - Broken Access Control vulnerability (CVSS 4.3, Pluggabl Booster for WooCommerce)
- [CVE-2025-64370](https://cve.now/CVE-2025-64370.md): WordPress YOP Poll plugin \<= 6.5.38 - Broken Access Control vulnerability (CVSS 5.3, YOP Poll)
- [CVE-2025-64369](https://cve.now/CVE-2025-64369.md): WordPress Contact Form Email plugin \<= 1.3.58 - Broken Access Control vulnerability (CVSS 6.5, codepeople Contact Form Email)
- [CVE-2025-64292](https://cve.now/CVE-2025-64292.md): WordPress Analytics Germanized for Google Analytics plugin \<= 1.6.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PascalBajorat Analytics Germanized for Google Analytics)
- [CVE-2025-64277](https://cve.now/CVE-2025-64277.md): WordPress ChatBot plugin \<= 7.3.9 - Broken Access Control vulnerability (CVSS 5.3, QuantumCloud ChatBot)
- [CVE-2025-64276](https://cve.now/CVE-2025-64276.md): WordPress Survey Maker plugin \<= 5.1.9.4 - Broken Access Control vulnerability (CVSS 6.5, Ays Pro Survey Maker)
- [CVE-2025-64275](https://cve.now/CVE-2025-64275.md): WordPress Booking Manager plugin \<= 2.1.17 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpdevelop Booking Manager)
- [CVE-2025-64274](https://cve.now/CVE-2025-64274.md): WordPress WPKoi Templates for Elementor plugin \<= 3.4.4 - Broken Access Control vulnerability (CVSS 4.3, wpkoithemes WPKoi Templates for Elementor)
- [CVE-2025-64271](https://cve.now/CVE-2025-64271.md): WordPress WP Plugin Manager plugin \<= 1.4.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, HasThemes WP Plugin Manager)
- [CVE-2025-64269](https://cve.now/CVE-2025-64269.md): WordPress WooCommerce PDF Invoice Builder plugin \<= 1.2.150 - Broken Access Control vulnerability (CVSS 4.3, EDGARROJAS WooCommerce PDF Invoice Builder)
- [CVE-2025-64267](https://cve.now/CVE-2025-64267.md): WordPress WooCommerce Ultimate Points And Rewards plugin \<= 2.10.2 - Sensitive Data Exposure vulnerability (CVSS 4.3, WPSwings WooCommerce Ultimate Points And Rewards)
- [CVE-2025-64265](https://cve.now/CVE-2025-64265.md): WordPress Frontend File Manager plugin \<= 23.2 - Broken Access Control vulnerability (CVSS 4.3, N-Media Frontend File Manager)
- [CVE-2025-64264](https://cve.now/CVE-2025-64264.md): WordPress Popup addon for Ninja Forms plugin \<= 3.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Aman Popup addon for Ninja Forms)
- [CVE-2025-64263](https://cve.now/CVE-2025-64263.md): WordPress WP Content Pilot plugin \<= 2.1.7 - Broken Access Control vulnerability (CVSS 5.4, PluginEver WP Content Pilot)
- [CVE-2025-64262](https://cve.now/CVE-2025-64262.md): WordPress Auto Prune Posts plugin \<= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5, ramon fincken Auto Prune Posts)
- [CVE-2025-64261](https://cve.now/CVE-2025-64261.md): WordPress Appointment Booking Calendar plugin \<= 1.3.95 - Broken Access Control vulnerability (CVSS 5.4, codepeople Appointment Booking Calendar)
- [CVE-2025-64259](https://cve.now/CVE-2025-64259.md): WordPress Theater for WordPress plugin \<= 0.18.8 - Broken Access Control vulnerability (CVSS 5.3, Jeroen Schmit Theater for WordPress)
- [CVE-2025-7704](https://cve.now/CVE-2025-7704.md): Supermicro BMC SMASH services has a Stack-based buffer overflow vulnerability (CVSS 5.4, SMCI SYS-111C-NR)
- [CVE-2025-11769](https://cve.now/CVE-2025-11769.md): WordPress Content Flipper \<= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, aumsrini WordPress Content Flipper)
- [CVE-2025-11260](https://cve.now/CVE-2025-11260.md): WP Headless CMS Framework \<= 1.15 - Unauthenticated Protection Mechanism Bypass (CVSS 5.3, benmoody WP Headless CMS Framework)
- [CVE-2025-10295](https://cve.now/CVE-2025-10295.md): Angel – Fashion Model Agency WordPress CMS Theme \<= 3.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, kayapati Angel – Fashion Model Agency WordPress CMS Theme)
- [CVE-2025-8397](https://cve.now/CVE-2025-8397.md): Save as PDF Button \<= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via restpackpdfbutton Shortcode (CVSS 6.4, restpack Save as PDF Button)
- [CVE-2025-12015](https://cve.now/CVE-2025-12015.md): Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed \<= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Afosto Disconnect (CVSS 4.3, sanderkah Convert WebP & AVIF | Quicq | Best image optimize…)
- [CVE-2025-12844](https://cve.now/CVE-2025-12844.md): AI Engine \<= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization (CVSS 7.1, tigroumeow AI Engine – The Chatbot, AI Framework & MCP for…)
- [CVE-2025-12681](https://cve.now/CVE-2025-12681.md): Comment Edit Core – Simple Comment Editing \<= 3.1.0 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, ronalfy Comment Edit Core – Simple Comment Editing)
- [CVE-2025-12620](https://cve.now/CVE-2025-12620.md): Poll Maker – Versus Polls, Anonymous Polls, Image Polls \<= 6.0.7 - Authenticated (Administrator+) SQL Injection via \`filterbyauthor\` Parameter (CVSS 4.9, ays-pro Poll Maker – Versus Polls, Anonymous Polls, Image P…)
- [CVE-2025-12891](https://cve.now/CVE-2025-12891.md): Survey Maker \<= 5.1.9.4 - Missing Authorization to Unauthenticated Information Exposure (CVSS 5.3, ays-pro Survey Maker)
- [CVE-2025-11923](https://cve.now/CVE-2025-11923.md): LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes - Various Versions - Authenticated (Student+) Privilege Escalation (CVSS 8.8, chrisbadgett LifterLMS – WP LMS for eLearning, Online Cours…)
- [CVE-2025-12536](https://cve.now/CVE-2025-12536.md): SureForms \<= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure (CVSS 5.3, brainstormforce SureForms – Contact Form, Payment Form & Ot…)
- [CVE-2025-12733](https://cve.now/CVE-2025-12733.md): Import any XML, CSV or Excel File to WordPress (WP All Import) \<= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic (CVSS 8.8, wpallimport WP All Import – Drag & Drop Import for CSV, XML…)
- [CVE-2025-12892](https://cve.now/CVE-2025-12892.md): Survey Maker \<= 5.1.9.4 - Missing Authorization to Unauthenticated Limited Option Update (CVSS 5.3, ays-pro Survey Maker)
- [CVE-2025-12979](https://cve.now/CVE-2025-12979.md): Welcart e-Commerce \<= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure (CVSS 5.3, uscnanbu Welcart e-Commerce)
- [CVE-2025-12366](https://cve.now/CVE-2025-12366.md): Page Builder: Pagelayer – Drag and Drop website builder \<= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference (CVSS 4.3, softaculous Page Builder: Pagelayer – Drag and Drop website…)
- [CVE-2025-12089](https://cve.now/CVE-2025-12089.md): Data Tables Generator by Supsystic \<= 1.10.45 - Authenticated (Admin+) Arbitrary File Deletion (CVSS 6.5, supsysticcom Data Tables Generator by Supsystic)
- [CVE-2025-59367](https://cve.now/CVE-2025-59367.md): An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized ac (CVSS 9.3, ASUS DSL-AC51 · ASUS DSL-N16 +1)
- [CVE-2025-64711](https://cve.now/CVE-2025-64711.md): PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users (CVSS 3.9, PrivateBin · privatebin/privatebin)
- [CVE-2025-64716](https://cve.now/CVE-2025-64716.md): Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode (CVSS 5.1, TecharoHQ anubis · github.com/TecharoHQ/anubis)
- [CVE-2025-64710](https://cve.now/CVE-2025-64710.md): Bitplatform Boilerplate has cross-site scripting vulnerability (CVSS 5.3, bitfoundation bitplatform)
- [CVE-2025-47220](https://cve.now/CVE-2025-47220.md): A local file enumeration was found in Keyfactor SignServer versions prior to 7.3.2 .The property VISIBLE\_SIGNATURE\_CUSTOM\_IMAGE\_PATH, which (CVSS 5.3)
- [CVE-2025-47221](https://cve.now/CVE-2025-47221.md): An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2. (CVSS 5.3)
- [CVE-2025-47222](https://cve.now/CVE-2025-47222.md): A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2. (CVSS 6.5)
- [CVE-2025-52186](https://cve.now/CVE-2025-52186.md): Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c (2025-06-02) contains a Server-Side Request Forgery (SSRF) vulnerability (CVSS 6.5)
- [CVE-2025-55810](https://cve.now/CVE-2025-55810.md): A vulnerability was found in Alaga Home Security WiFi Camera 3K (model S-CW2503C-H) with hardware version V03 and firmware version 1.4.2, wh (CVSS 6.8)
- [CVE-2025-60671](https://cve.now/CVE-2025-60671.md): A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G\_V1.0.2B05\_20181207.bin in the timelycheck and syscon (CVSS 5.4)
- [CVE-2025-60672](https://cve.now/CVE-2025-60672.md): An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. (CVSS 6.5)
- [CVE-2025-60673](https://cve.now/CVE-2025-60673.md): An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. (CVSS 6.5)
- [CVE-2025-60674](https://cve.now/CVE-2025-60674.md): A stack buffer overflow vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin in the rc binary's USB storage handling mo (CVSS 6.8)
- [CVE-2025-60675](https://cve.now/CVE-2025-60675.md): A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G\_V1.0.2B05\_20181207.bin in the timelycheck and syscon (CVSS 5.4)
- [CVE-2025-60676](https://cve.now/CVE-2025-60676.md): An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. (CVSS 6.5)
- [CVE-2025-60679](https://cve.now/CVE-2025-60679.md): A stack buffer overflow vulnerability exists in the D-Link DIR-816A2 router firmware DIR-816A2\_FWv1.10CNB05\_R1B011D88210.img in the upload.c (CVSS 8.8)
- [CVE-2025-60682](https://cve.now/CVE-2025-60682.md): A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614\_B20230630 within the cloudupdate\_check binary, s (CVSS 6.5)
- [CVE-2025-60683](https://cve.now/CVE-2025-60683.md): A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614\_B20230630 within the sysconf binary, specificall (CVSS 6.5)
- [CVE-2025-60684](https://cve.now/CVE-2025-60684.md): A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619\_B20230130) and NR1800X (V9.1.0u.6681\_B20230703) Router f (CVSS 6.5)
- [CVE-2025-60685](https://cve.now/CVE-2025-60685.md): A stack buffer overflow exists in the ToToLink A720R Router firmware V4.1.5cu.614\_B20230630 within the sysconf binary (sub\_401EE0 function). (CVSS 5.1)
- [CVE-2025-60686](https://cve.now/CVE-2025-60686.md): A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers (A720R V4.1.5cu.61 (CVSS 5.1)
- [CVE-2025-60687](https://cve.now/CVE-2025-60687.md): An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619\_B20230130 within the cstecgi (CVSS 6.5)
- [CVE-2025-60688](https://cve.now/CVE-2025-60688.md): A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619\_B20230130) and NR1800X (V9.1.0u.6681\_B20230703) Router f (CVSS 6.5)
- [CVE-2025-60689](https://cve.now/CVE-2025-60689.md): An unauthenticated command injection vulnerability exists in the Start\_EPI function of the httpd binary on Linksys E1200 v2 routers (Firmwar (CVSS 5.4)
- [CVE-2025-60690](https://cve.now/CVE-2025-60690.md): A stack-based buffer overflow exists in the get\_merge\_ipaddr function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200\_v2.0.1 (CVSS 8.8)
- [CVE-2025-60691](https://cve.now/CVE-2025-60691.md): A stack-based buffer overflow exists in the httpd binary of Linksys E1200 v2 routers (Firmware E1200\_v2.0.11.001\_us.tar.gz). (CVSS 8.8)
- [CVE-2025-60692](https://cve.now/CVE-2025-60692.md): A stack-based buffer overflow vulnerability exists in the libshared.so library of Cisco Linksys E1200 v2 routers (Firmware E1200\_v2.0.11.001 (CVSS 8.4)
- [CVE-2025-60693](https://cve.now/CVE-2025-60693.md): A stack-based buffer overflow exists in the get\_merge\_mac function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200\_v2.0.11.0 (CVSS 6.5)
- [CVE-2025-60694](https://cve.now/CVE-2025-60694.md): A stack-based buffer overflow exists in the validate\_static\_route function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200\_v (CVSS 7.5)
- [CVE-2025-60695](https://cve.now/CVE-2025-60695.md): A stack-based buffer overflow vulnerability exists in the mtk\_dut binary of Linksys E7350 routers (Firmware 1.1.00.032). (CVSS 5.9)
- [CVE-2025-60696](https://cve.now/CVE-2025-60696.md): A stack-based buffer overflow vulnerability exists in the makeRequest.cgi binary of Linksys RE7000 routers (Firmware FW\_v2.0.15\_211230\_1012) (CVSS 8.4)
- [CVE-2025-60697](https://cve.now/CVE-2025-60697.md): A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1\_FW102B02 within the \`prog.cgi\` and \`rc\` binaries. (CVSS 7.3)
- [CVE-2025-60698](https://cve.now/CVE-2025-60698.md): A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1\_FW102B02 within the \`prog.cgi\` and \`rc\` binaries. (CVSS 7.3)
- [CVE-2025-60699](https://cve.now/CVE-2025-60699.md): A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592\_B20191022\_ALL within the \`global.so\` binary. (CVSS 6.5)
- [CVE-2025-60700](https://cve.now/CVE-2025-60700.md): A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1\_FW102B02 within the \`prog.cgi\` and \`librcm.so\` binar (CVSS 6.5)
- [CVE-2025-60701](https://cve.now/CVE-2025-60701.md): A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1\_FW102B02 within the \`prog.cgi\` and \`rc\` binaries. (CVSS 6.5)
- [CVE-2025-60702](https://cve.now/CVE-2025-60702.md): A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592\_B20191022\_ALL within the \`system.so\` binary. (CVSS 6.5)
- [CVE-2025-63406](https://cve.now/CVE-2025-63406.md): An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbTo (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.