# CVEs published 2025-11-14

101 CVEs were published on November 14, 2025: 7 critical, 28 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-8386](https://cve.now/CVE-2025-8386.md): AVEVA Application Server IDE Basic Cross-site Scripting (CVSS 6.9, AVEVA Application Server)
- [CVE-2025-9317](https://cve.now/CVE-2025-9317.md): AVEVA Edge Use of a Broken or Risky Cryptographic Algorithm (CVSS 8.4, AVEVA Edge)
- [CVE-2025-64309](https://cve.now/CVE-2025-64309.md): Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials (CVSS 7.4, Brightpick AI Brightpick Mission Control / Internal Logic C…)
- [CVE-2025-64308](https://cve.now/CVE-2025-64308.md): Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials (CVSS 6.5, Brightpick AI Brightpick Mission Control / Internal Logic C…)
- [CVE-2025-64307](https://cve.now/CVE-2025-64307.md): Brightpick Mission Control / Internal Logic Control Missing Authentication for Critical Function (CVSS 6.5, Brightpick AI Brightpick Mission Control / Internal Logic C…)
- [CVE-2025-62765](https://cve.now/CVE-2025-62765.md): General Industrial Controls Lynx+ Gateway Cleartext Transmission of Sensitive Information (CVSS 7.5, General Industrial Controls Lynx+ Gateway)
- [CVE-2025-59780](https://cve.now/CVE-2025-59780.md): General Industrial Controls Lynx+ Gateway Missing Authentication for Critical Function (CVSS 7.5, General Industrial Controls Lynx+ Gateway)
- [CVE-2025-58083](https://cve.now/CVE-2025-58083.md): General Industrial Controls Lynx+ Gateway Missing Authentication for Critical Function (CVSS 10.0, General Industrial Controls Lynx+ Gateway)
- [CVE-2025-55034](https://cve.now/CVE-2025-55034.md): General Industrial Controls Lynx+ Gateway Weak Password Requirements (CVSS 8.2, General Industrial Controls Lynx+ Gateway)
- [CVE-2021-4469](https://cve.now/CVE-2021-4469.md): Denver SHO-110 IP Camera Unauthenticated Snapshot Access (CVSS 8.7, Denver SHO-110)
- [CVE-2021-4466](https://cve.now/CVE-2021-4466.md): IPCop \<= 2.1.9 Authenticated RCE (CVSS 8.7, IPCop Project IPCop)
- [CVE-2018-25125](https://cve.now/CVE-2018-25125.md): Netis DL4322D RTK 2.1.1 FTP Service DoS (CVSS 8.7, Netis Systems Co. DL4322D)
- [CVE-2021-4468](https://cve.now/CVE-2021-4468.md): PLANEX CS-QP50F-ING2 Smart Camera Remote Configuration Disclosure (CVSS 8.7, PLANEX COMMUNICATIONS CS-QP50F-ING2)
- [CVE-2021-4467](https://cve.now/CVE-2021-4467.md): Positive Technologies MaxPatrol 8 & XSpider Remote DoS (CVSS 8.7, Positive Technologies MaxPatrol · Positive Technologies XSp…)
- [CVE-2021-4465](https://cve.now/CVE-2021-4465.md): ReQuest Serious Play F3 Media Server \<= 7.0.3 Remote DoS (CVSS 8.7, ReQuest Serious Play Pro · ReQuest Serious Play)
- [CVE-2023-7328](https://cve.now/CVE-2023-7328.md): Screen SFT DAB 600/C \<= 1.9.3 Unauthenticated Information Disclosure (CVSS 6.9, DB Elettronica Telecomunicazioni SpA Screen SFT DAB 600/C)
- [CVE-2021-4470](https://cve.now/CVE-2021-4470.md): TG8 Firewall Unauthenticated RCE via runphpcmd.php (CVSS 9.3, TG8 Firewall)
- [CVE-2021-4471](https://cve.now/CVE-2021-4471.md): TG8 Firewall Unauthenticated User Password Disclosure (CVSS 8.7, TG8 Firewall)
- [CVE-2016-15056](https://cve.now/CVE-2016-15056.md): Ubee EVW3226 Unauthenticated Backup File Disclosure (CVSS 8.7, Ubee Interactive Ubee EVW3226)
- [CVE-2022-4985](https://cve.now/CVE-2022-4985.md): Vodafone H500s WiFi Password Disclosure via activation.json (CVSS 8.7, Vodacom Vodafone H500s)
- [CVE-2025-13188](https://cve.now/CVE-2025-13188.md): D-Link DIR-816L authentication.cgi authenticationcgi\_main stack-based overflow (CVSS 9.3, D-Link DIR-816L)
- [CVE-2025-13187](https://cve.now/CVE-2025-13187.md): Intelbras ICIP acessodeusuario.xml credentials storage (CVSS 6.9, Intelbras ICIP)
- [CVE-2025-13186](https://cve.now/CVE-2025-13186.md): Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution manage\_customer cross site scripting (CVSS 4.8, Bdtask Isshue Multi Store eCommerce Shopping Cart Solution…)
- [CVE-2025-13185](https://cve.now/CVE-2025-13185.md): Bdtask/CodeCanyon News365 profile unrestricted upload (CVSS 5.1, Bdtask News365 · CodeCanyon News365)
- [CVE-2025-13182](https://cve.now/CVE-2025-13182.md): pojoin h3blog addtitle cross site scripting (CVSS 5.1, pojoin h3blog)
- [CVE-2025-13181](https://cve.now/CVE-2025-13181.md): pojoin h3blog add cross site scripting (CVSS 5.1, pojoin h3blog)
- [CVE-2025-13033](https://cve.now/CVE-2025-13033.md): Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict (CVSS 7.5, nodemailer · Red Hat Ceph Storage +2)
- [CVE-2025-13180](https://cve.now/CVE-2025-13180.md): Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System edit\_profile cross site scripting (CVSS 5.1, Bdtask Wholesale Inventory Control and Inventory Management…)
- [CVE-2025-13179](https://cve.now/CVE-2025-13179.md): Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System cross-site request forgery (CVSS 5.3, Bdtask Wholesale Inventory Control and Inventory Management…)
- [CVE-2025-13178](https://cve.now/CVE-2025-13178.md): Bdtask/CodeCanyon SalesERP User Profile edit\_profile cross site scripting (CVSS 5.1, Bdtask SalesERP · CodeCanyon SalesERP)
- [CVE-2025-13177](https://cve.now/CVE-2025-13177.md): Bdtask/CodeCanyon SalesERP cross-site request forgery (CVSS 5.3, Bdtask SalesERP · CodeCanyon SalesERP)
- [CVE-2025-13174](https://cve.now/CVE-2025-13174.md): rachelos WeRSS we-mp-rss Webhook mps.py do\_job server-side request forgery (CVSS 5.3, rachelos WeRSS we-mp-rss)
- [CVE-2025-13172](https://cve.now/CVE-2025-13172.md): CodeAstro Gym Management System view-member-report.php sql injection (CVSS 5.3, CodeAstro Gym Management System)
- [CVE-2025-4618](https://cve.now/CVE-2025-4618.md): Prisma Browser: Sensitive Information Disclosure Vulnerability in Prisma Browser (CVSS 4.4, Palo Alto Networks Prisma Browser)
- [CVE-2025-4617](https://cve.now/CVE-2025-4617.md): Prisma Browser: Insufficient Policy Enforcement Vulnerability in Prisma Browser (CVSS 1.1, Palo Alto Networks Prisma Browser)
- [CVE-2025-4616](https://cve.now/CVE-2025-4616.md): Prisma Browser: Insufficient Validation of Untrusted Input Vulnerability in Prisma Browser (CVSS 1.1, Palo Alto Networks Prisma Browser)
- [CVE-2025-13171](https://cve.now/CVE-2025-13171.md): ZZCMS wangkan\_list.php sql injection (CVSS 5.3, ZZCMS)
- [CVE-2025-13204](https://cve.now/CVE-2025-13204.md): CVE-2025-13204 (CVSS 9.8, silentmatt expr-eval · expr-eval +1)
- [CVE-2025-13170](https://cve.now/CVE-2025-13170.md): code-projects Simple Online Hotel Reservation System edit\_account.php sql injection (CVSS 6.9, code-projects Simple Online Hotel Reservation System)
- [CVE-2025-8870](https://cve.now/CVE-2025-8870.md): On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device. (CVSS 4.9, Arista Networks EOS)
- [CVE-2025-64446](https://cve.now/CVE-2025-64446.md): A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 (CVSS 9.4, KEV, Fortinet FortiWeb)
- [CVE-2025-13169](https://cve.now/CVE-2025-13169.md): code-projects Simple Online Hotel Reservation System add\_query\_reserve.php sql injection (CVSS 6.9, code-projects Simple Online Hotel Reservation System)
- [CVE-2025-13168](https://cve.now/CVE-2025-13168.md): ury-erp ury pos\_extend.py overrided\_past\_order\_list sql injection (CVSS 5.3, ury-erp ury)
- [CVE-2024-21635](https://cve.now/CVE-2024-21635.md): Memos Access Tokens Stay Valid after User Password Change (CVSS 7.1, usememos memos · github.com/usememos/memos)
- [CVE-2025-12149](https://cve.now/CVE-2025-12149.md): Unauthorized access to documents protected by Document-Level Security (DLS), when Signals watches include a search query involving protected documents (CVSS 6.0, floragunn Search Guard FLX)
- [CVE-2025-11918](https://cve.now/CVE-2025-11918.md): Rockwell Automation Arena® Simulation Stack-Based Buffer Overflow Vulnerability (CVSS 7.1, Rockwell Automation Arena® Simulation)
- [CVE-2025-10018](https://cve.now/CVE-2025-10018.md): Multiple Stored XSS in QuickCMS (CVSS 4.8, OpenSolution QuickCMS)
- [CVE-2025-9982](https://cve.now/CVE-2025-9982.md): Hard-coded admin credentials in Quick.CMS (CVSS 6.9, OpenSolution QuickCMS)
- [CVE-2025-8855](https://cve.now/CVE-2025-8855.md): 2FA Expiry Bypass in Optimus Software's Brokerage Automation (CVSS 8.1, Optimus Software Brokerage Automation)
- [CVE-2025-11981](https://cve.now/CVE-2025-11981.md): School Management System – WPSchoolPress \<= 2.2.23 - Authenticated (Administrator+) SQL Injection (CVSS 4.9, jdsofttech School Management System – WPSchoolPress)
- [CVE-2025-11794](https://cve.now/CVE-2025-11794.md): Password hash and MFA secret returned in user email verification endpoint (CVSS 4.9, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-55073](https://cve.now/CVE-2025-55073.md): MS Teams plugin OAuth allows editing arbitrary posts (CVSS 5.4, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-55070](https://cve.now/CVE-2025-55070.md): Lack of MFA enforcement in WebSocket connections (CVSS 6.5, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-41436](https://cve.now/CVE-2025-41436.md): Unauthorized access to archived channel content via threads interface (CVSS 3.1, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-11776](https://cve.now/CVE-2025-11776.md): Guest user can discover archived public channels (CVSS 4.3, Mattermost · github.com/mattermost/mattermost/server/v8 +5)
- [CVE-2025-10686](https://cve.now/CVE-2025-10686.md): Creta Testimonial Showcase \< 1.2.4 - Editor+ Local File Inclusion (CVSS 7.2, Creta Testimonial Showcase)
- [CVE-2025-64444](https://cve.now/CVE-2025-64444.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in NCP-HG100 1.4.48.16 and earlier. (CVSS 7.2, Sony Network Communications NCP-HG100/Cellular model · Sony…)
- [CVE-2025-13161](https://cve.now/CVE-2025-13161.md): IQ Service International｜IQ-Support - Arbitrary File Read (CVSS 8.7, IQ Service International IQ-Support)
- [CVE-2025-13160](https://cve.now/CVE-2025-13160.md): IQ Service International｜IQ-Support - Exposure of Sensitive Information (CVSS 6.9, IQ Service International IQ-Support)
- [CVE-2025-13107](https://cve.now/CVE-2025-13107.md): Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a c (CVSS 4.3, Google Chrome)
- [CVE-2024-7021](https://cve.now/CVE-2024-7021.md): Inappropriate implementation in Autofill in Google Chrome on Windows prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing (CVSS 4.3, Google Chrome)
- [CVE-2024-13178](https://cve.now/CVE-2024-13178.md): Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a cr (CVSS 4.3, Google Chrome)
- [CVE-2024-7017](https://cve.now/CVE-2024-7017.md): Inappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox (CVSS 7.5, Google Chrome)
- [CVE-2024-9126](https://cve.now/CVE-2024-9126.md): Use after free in Internals in Google Chrome on iOS prior to 127.0.6533.88 allowed a remote attacker who convinced a user to engage in speci (CVSS 7.5, Google Chrome)
- [CVE-2025-13102](https://cve.now/CVE-2025-13102.md): Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI s (CVSS 4.3, Google Chrome)
- [CVE-2024-11919](https://cve.now/CVE-2024-11919.md): Inappropriate implementation in Intents in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing (CVSS 4.3, Google Chrome)
- [CVE-2024-11920](https://cve.now/CVE-2024-11920.md): Inappropriate implementation in Dawn in Google Chrome on Mac prior to 130.0.6723.92 allowed a remote attacker to perform out of bounds memor (CVSS 4.3, Google Chrome)
- [CVE-2024-13983](https://cve.now/CVE-2024-13983.md): Inappropriate implementation in Lens in Google Chrome on iOS prior to 136.0.7103.59 allowed a remote attacker to perform UI spoofing via a c (CVSS 6.3, Google Chrome)
- [CVE-2025-9479](https://cve.now/CVE-2025-9479.md): Out of bounds read in V8 in Google Chrome prior to 133.0.6943.141 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 4.3, Google Chrome)
- [CVE-2025-13097](https://cve.now/CVE-2025-13097.md): Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially perform a sandbox (CVSS 5.4, Google Chrome)
- [CVE-2025-12904](https://cve.now/CVE-2025-12904.md): SNORDIAN's H5PxAPIkatchu \<= 0.4.17 - Unauthenticated Stored Cross-Site Scripting via insert\_data (CVSS 7.2, otacke SNORDIAN's H5PxAPIkatchu)
- [CVE-2024-42749](https://cve.now/CVE-2024-42749.md): Cross Site Scripting vulnerability in Alto CMS v.1.1.13 allows a local attacker to execute arbitrary code via a crafted script. (CVSS 6.1)
- [CVE-2024-44630](https://cve.now/CVE-2024-44630.md): Multiple parameters in register.php in PHPGurukul Student Record System 3.20 are vulnerable to SQL injection. (CVSS 6.5)
- [CVE-2024-44632](https://cve.now/CVE-2024-44632.md): PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the id and emailid parameters in password-recovery.php. (CVSS 6.5)
- [CVE-2024-44633](https://cve.now/CVE-2024-44633.md): PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the currentpassword parameter in change-password.php. (CVSS 6.5)
- [CVE-2024-44635](https://cve.now/CVE-2024-44635.md): PHPGurukul Student Record System 3.20 is vulnerable to Cross Site Scripting (XSS) via adminname and aemailid parameters in /admin-profile.ph (CVSS 6.1)
- [CVE-2024-44636](https://cve.now/CVE-2024-44636.md): PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the adminname and aemailid parameters in /admin-profile.php. (CVSS 6.5)
- [CVE-2024-44639](https://cve.now/CVE-2024-44639.md): PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the sub1, sub2, sub3, sub4, and course-short parameters in add-subj (CVSS 6.5)
- [CVE-2024-44640](https://cve.now/CVE-2024-44640.md): PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the course-short, course-full, and cdate parameters in add-course.p (CVSS 6.5)
- [CVE-2024-55016](https://cve.now/CVE-2024-55016.md): PHPGurukul Student Record Management System 3.20 is vulnerable to SQL Injection via the id and password parameters in login.php. (CVSS 6.5)
- [CVE-2025-54339](https://cve.now/CVE-2025-54339.md): An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 exploit (CVSS 10.0)
- [CVE-2025-54340](https://cve.now/CVE-2025-54340.md): A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. (CVSS 4.1)
- [CVE-2025-54342](https://cve.now/CVE-2025-54342.md): A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. (CVSS 3.3)
- [CVE-2025-54343](https://cve.now/CVE-2025-54343.md): An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 exploit (CVSS 9.6)
- [CVE-2025-54345](https://cve.now/CVE-2025-54345.md): An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. (CVSS 7.5)
- [CVE-2025-54346](https://cve.now/CVE-2025-54346.md): A Reflected Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1. (CVSS 7.6)
- [CVE-2025-54348](https://cve.now/CVE-2025-54348.md): A Stored Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 (CVSS 6.5)
- [CVE-2025-54559](https://cve.now/CVE-2025-54559.md): An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote Path Traversal for l (CVSS 3.7)
- [CVE-2025-54560](https://cve.now/CVE-2025-54560.md): A Server-side Request Forgery vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which (CVSS 3.8)
- [CVE-2025-54561](https://cve.now/CVE-2025-54561.md): An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which a (CVSS 4.3)
- [CVE-2025-54562](https://cve.now/CVE-2025-54562.md): A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Technical Informatio (CVSS 4.3)
- [CVE-2025-63291](https://cve.now/CVE-2025-63291.md): When processing API requests, the Alteryx server 2022.1.1.42654 and 2024.1 used MongoDB object IDs to uniquely identify the data being reque (CVSS 5.4)
- [CVE-2025-63680](https://cve.now/CVE-2025-63680.md): Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw (CWE-22) that, in combination with Windows ShellExec (CVSS 8.6)
- [CVE-2025-63701](https://cve.now/CVE-2025-63701.md): A heap corruption vulnerability exists in the Advantech TP-3250 printer driver's DrvUI\_x64\_ADVANTECH.dll (v0.3.9200.20789) when DocumentProp (CVSS 6.8)
- [CVE-2025-63724](https://cve.now/CVE-2025-63724.md): SQL injection (SQL-i) vulnerability in SVX Portal 2.7A via crafted POST request to admin/update\_setings.php. (CVSS 6.0)
- [CVE-2025-63725](https://cve.now/CVE-2025-63725.md): Reflected Cross-Site Scripting (XSS) vulnerability in SVX Portal 2.7A via the id parameter to Recivers.php. (CVSS 6.1)
- [CVE-2025-63744](https://cve.now/CVE-2025-63744.md): A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the load() function of bin\_dyldcache.c. (CVSS 4.3)
- [CVE-2025-63745](https://cve.now/CVE-2025-63745.md): A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the info() function of bin\_ne.c. (CVSS 5.5)
- [CVE-2025-63830](https://cve.now/CVE-2025-63830.md): CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function. (CVSS 6.1)
- [CVE-2025-63891](https://cve.now/CVE-2025-63891.md): Information Disclosure in web-accessible backup file in SourceCodester Simple Online Book Store System allows a remote unauthenticated attac (CVSS 7.5)
- [CVE-2025-64084](https://cve.now/CVE-2025-64084.md): An authenticated SQL injection vulnerability exists in Cloudlog 2.7.5 and earlier. (CVSS 5.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.