# CVEs published 2025-11-16

23 CVEs were published on November 16, 2025: 0 critical, 1 high. Days are UTC.

- [CVE-2025-13253](https://cve.now/CVE-2025-13253.md): projectworlds Advanced Library Management System add\_librarian.php sql injection (CVSS 5.3, projectworlds Advanced Library Management System)
- [CVE-2025-13252](https://cve.now/CVE-2025-13252.md): shsuishang ShopSuite ModulithShop RSA/OAuth2/Database hard-coded credentials (CVSS 6.9, shsuishang ShopSuite ModulithShop)
- [CVE-2025-13251](https://cve.now/CVE-2025-13251.md): WeiYe-Jing datax-web sql injection (CVSS 5.3, WeiYe-Jing datax-web)
- [CVE-2025-13250](https://cve.now/CVE-2025-13250.md): WeiYe-Jing datax-web Job triggerJob access control (CVSS 5.3, WeiYe-Jing datax-web)
- [CVE-2025-13249](https://cve.now/CVE-2025-13249.md): Jiusi OA OfficeServer unrestricted upload (CVSS 5.3, Jiusi OA)
- [CVE-2025-13248](https://cve.now/CVE-2025-13248.md): SourceCodester Patients Waiting Area Queue Management System api\_patient\_schedule.php sql injection (CVSS 6.9, SourceCodester Patients Waiting Area Queue Management System)
- [CVE-2025-13247](https://cve.now/CVE-2025-13247.md): PHPGurukul Tourism Management System user-bookings.php sql injection (CVSS 6.9, PHPGurukul Tourism Management System)
- [CVE-2025-13246](https://cve.now/CVE-2025-13246.md): shsuishang ShopSuite ModulithShop JwtAuthenticationFilter.java JwtAuthenticationFilter path traversal (CVSS 5.3, shsuishang ShopSuite ModulithShop)
- [CVE-2025-13245](https://cve.now/CVE-2025-13245.md): code-projects Student Information System editprofile.php cross site scripting (CVSS 5.1, code-projects Student Information System)
- [CVE-2025-13244](https://cve.now/CVE-2025-13244.md): code-projects Student Information System register.php cross site scripting (CVSS 5.3, code-projects Student Information System)
- [CVE-2025-13243](https://cve.now/CVE-2025-13243.md): code-projects Student Information System editprofile.php sql injection (CVSS 5.3, code-projects Student Information System)
- [CVE-2025-13242](https://cve.now/CVE-2025-13242.md): code-projects Student Information System register.php sql injection (CVSS 6.9, code-projects Student Information System)
- [CVE-2025-13241](https://cve.now/CVE-2025-13241.md): code-projects Student Information System index.php sql injection (CVSS 6.9, code-projects Student Information System)
- [CVE-2025-13240](https://cve.now/CVE-2025-13240.md): code-projects Student Information System searchquery.php sql injection (CVSS 6.9, code-projects Student Information System)
- [CVE-2025-13239](https://cve.now/CVE-2025-13239.md): Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution submit\_checkout behavioral workflow (CVSS 5.3, Bdtask Isshue Multi Store eCommerce Shopping Cart Solution…)
- [CVE-2025-13238](https://cve.now/CVE-2025-13238.md): Bdtask Flight Booking Software Edit Profile edit unrestricted upload (CVSS 5.3, Bdtask Flight Booking Software)
- [CVE-2025-13237](https://cve.now/CVE-2025-13237.md): itsourcecode Inventory Management System LogSignModal.PHP sql injection (CVSS 6.9, itsourcecode Inventory Management System)
- [CVE-2025-12482](https://cve.now/CVE-2025-12482.md): Booking for Appointments and Events Calendar – Amelia \<= 1.2.35 - Unauthenticated SQL Injection via search (CVSS 7.5, ameliabooking Booking for Appointments and Events Calendar…)
- [CVE-2025-13236](https://cve.now/CVE-2025-13236.md): itsourcecode Inventory Management System index.php sql injection (CVSS 5.3, itsourcecode Inventory Management System)
- [CVE-2025-13235](https://cve.now/CVE-2025-13235.md): itsourcecode Inventory Management System login.php sql injection (CVSS 6.9, itsourcecode Inventory Management System)
- [CVE-2025-13234](https://cve.now/CVE-2025-13234.md): itsourcecode Inventory Management System index.php sql injection (CVSS 5.3, itsourcecode Inventory Management System)
- [CVE-2025-13233](https://cve.now/CVE-2025-13233.md): itsourcecode Inventory Management System index.php sql injection (CVSS 6.9, itsourcecode Inventory Management System)
- [CVE-2025-13232](https://cve.now/CVE-2025-13232.md): projectsend File Editor/Custom Download Aliases cross site scripting (CVSS 5.1, projectsend)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.