# CVEs published 2025-11-15

26 CVEs were published on November 15, 2025: 0 critical, 3 high. Days are UTC.

- [CVE-2025-13221](https://cve.now/CVE-2025-13221.md): Intelbras UnniTI usuarios.xml credentials storage (CVSS 6.9, Intelbras UnniTI)
- [CVE-2025-13210](https://cve.now/CVE-2025-13210.md): itsourcecode Inventory Management System index.php sql injection (CVSS 5.1, itsourcecode Inventory Management System)
- [CVE-2025-13209](https://cve.now/CVE-2025-13209.md): bestfeng oa\_git\_free WorkflowPredefineController.java updateWriteBack xml external entity reference (CVSS 5.3, bestfeng oa\_git\_free)
- [CVE-2025-13208](https://cve.now/CVE-2025-13208.md): FantasticLBP Hotels Server hotelList.php sql injection (CVSS 5.3, FantasticLBP Hotels Server)
- [CVE-2025-13203](https://cve.now/CVE-2025-13203.md): code-projects Simple Cafe Ordering System addmem.php sql injection (CVSS 6.9, code-projects Simple Cafe Ordering System)
- [CVE-2025-13202](https://cve.now/CVE-2025-13202.md): code-projects Simple Cafe Ordering System add\_to\_cart cross site scripting (CVSS 5.1, code-projects Simple Cafe Ordering System)
- [CVE-2025-13201](https://cve.now/CVE-2025-13201.md): code-projects Simple Cafe Ordering System login.php sql injection (CVSS 6.9, code-projects Simple Cafe Ordering System)
- [CVE-2025-13200](https://cve.now/CVE-2025-13200.md): SourceCodester Farm Management System exposure of information through directory listing (CVSS 6.9, SourceCodester Farm Management System)
- [CVE-2025-13199](https://cve.now/CVE-2025-13199.md): code-projects Email Logging Interface signup.cpp path traversal (CVSS 4.8, code-projects Email Logging Interface)
- [CVE-2025-13198](https://cve.now/CVE-2025-13198.md): DouPHP file.class.php unrestricted upload (CVSS 5.1, DouPHP)
- [CVE-2025-12983](https://cve.now/CVE-2025-12983.md): Memory Allocation with Excessive Size Value in GitLab (CVSS 3.5, GitLab)
- [CVE-2025-2615](https://cve.now/CVE-2025-2615.md): Insertion of Sensitive Information Into Sent Data in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-6945](https://cve.now/CVE-2025-6945.md): Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab (CVSS 3.5, GitLab)
- [CVE-2025-6171](https://cve.now/CVE-2025-6171.md): Missing Authorization in GitLab (CVSS 5.3, GitLab)
- [CVE-2025-7000](https://cve.now/CVE-2025-7000.md): Insertion of Sensitive Information Into Sent Data in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-7736](https://cve.now/CVE-2025-7736.md): Incorrect Authorization in GitLab (CVSS 3.1, GitLab)
- [CVE-2025-11865](https://cve.now/CVE-2025-11865.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-11990](https://cve.now/CVE-2025-11990.md): Improper Handling of URL Encoding (Hex Encoding) in GitLab (CVSS 3.1, GitLab)
- [CVE-2025-13191](https://cve.now/CVE-2025-13191.md): D-Link DIR-816L soap.cgi soapcgi\_main stack-based overflow (CVSS 8.7, D-Link DIR-816L)
- [CVE-2025-12849](https://cve.now/CVE-2025-12849.md): Contest Gallery \<= 28.0.2 - Missing Authorization (CVSS 5.3, contest-gallery Contest Gallery – Upload & Vote Photos, Med…)
- [CVE-2025-13190](https://cve.now/CVE-2025-13190.md): D-Link DIR-816L \_\_ajax\_exporer.sgi scandir\_main stack-based overflow (CVSS 8.7, D-Link DIR-816L)
- [CVE-2025-13189](https://cve.now/CVE-2025-13189.md): D-Link DIR-816L gena.cgi genacgi\_main stack-based overflow (CVSS 8.7, D-Link DIR-816L)
- [CVE-2025-12494](https://cve.now/CVE-2025-12494.md): Image Gallery – Photo Grid & Video Gallery \<= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File Move (CVSS 4.3, wpchill Modula Image Gallery – Photo Grid & Video Gallery)
- [CVE-2025-8994](https://cve.now/CVE-2025-8994.md): WP Project Manager \<= 2.6.26 - Authenticated (Subscriber+) SQL Injection via 'completed\_at\_operator' (CVSS 6.5, wedevs Project Manager – AI Powered Project Management, Tas…)
- [CVE-2025-12847](https://cve.now/CVE-2025-12847.md): All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic \<= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion (CVSS 4.3, smub All in One SEO – Powerful SEO Plugin to Boost SEO Rank…)
- [CVE-2025-12182](https://cve.now/CVE-2025-12182.md): Qi Blocks \<= 1.4.3 - Missing Authorization to Arbitrary Attachment Resize (CVSS 4.3, qodeinteractive Qi Blocks)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.