CVEs published November 17, 2025
122 CVEs were published on November 17, 2025: 5 critical, 38 high. 1 is now in CISA KEV.
- Published
- 122
- Critical
- 5
- High
- 38
- Medium
- 77
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 32
Most affected products
- Broadcom BCM5820X · Dell ControlVault3
- 8
- Google Chrome
- 7
- Campcodes School Fees Payment Management System
- 6
- itsourcecode Web-Based Internet Laboratory Management System
- 5
- Rumpus FTP Server
- 5
- projectworlds Advanced Library Management System
- 4
- Campcodes Supplier Management System
- 3
- Digiwin EasyFlow GP
- 3
- itsourcecode Online Voting System
- 3
- Chunghwa Telecom TenderDocTransfer
- 2
Critical 5
- CVE-2025-9501W3 Total Cache < 2.8.13 - Unauthenticated Command InjectionW3 Total Cache
- CVE-2025-13284ThinPLUS｜ThinPLUS - OS Command InjectionThinPLUS
- CVE-2025-10460Unsanitized parameter input leading to SQL Injection vulnerabilityBEIMS Contractor Web
- CVE-2024-44659PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the email parameter in forgot-password.php.
- CVE-2025-63747QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immediate login via the web
High 38
- CVE-2025-13230Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2025-13229Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2025-13228Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2025-13227Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2025-13226Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2025-13224Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2025-13223Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2025-13305D-Link DWR-M920/DWR-M921/DWR-M960/DIR-822K/DIR-825M formTracerouteDiagnosticRun buffer overflowD-Link DWR-M920 · D-Link DWR-M921 +3
- CVE-2025-31649Dell ControlVault3 ControlVault WBDI Driver hard-coded password vulnerabilityBroadcom BCM5820X · Dell ControlVault3
- CVE-2025-31361Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter privilege escalation vulnerabilityBroadcom BCM5820X · Dell ControlVault3
- CVE-2025-36463Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write vulnerabilityBroadcom BCM5820X · Dell ControlVault3
- CVE-2025-36462Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write vulnerabilityBroadcom BCM5820X · Dell ControlVault3
- CVE-2025-36461Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write vulnerabilityBroadcom BCM5820X · Dell ControlVault3
- CVE-2025-36460Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write vulnerabilityBroadcom BCM5820X · Dell ControlVault3
- CVE-2025-32089Dell ControlVault3 CvManager_SBI buffer overflow vulnerabilityBroadcom BCM5820X · Dell ControlVault3
- CVE-2025-13304D-Link DWR-M920/DWR-M921/DWR-M960/DWR-M961/DIR-825M formPingDiagnosticRun buffer overflowD-Link DWR-M920 · D-Link DWR-M921 +3
- CVE-2025-36553Dell ControlVault3 CvManager buffer overflow vulnerabilityBroadcom BCM5820X · Dell ControlVault3
- CVE-2025-36118IBM Storage Virtualize Information DisclosureIBM Storage Virtualize
- CVE-2025-36357IBM Planning Analytics Local Directory TraversalIBM Planning Analytics Local
- CVE-2025-34323Nagios Log Server < 2026R1.0.1 Local Privilege Escalation via Writable Scripts and Sudo RulesNagios Log Server
- CVE-2025-34322Nagios Log Server < 2026R1.0.1 Authenticated Command Injection via Natural Language QueriesNagios Log Server
- CVE-2025-64756glob CLI: Command injection via -c/--cmd executes matches with shell:trueisaacs node-glob · glob
- CVE-2025-58407GPU DDK - TOCTOU bug affecting psFWMemContext->uiPageCatBaseRegSetImagination Technologies Graphics DDK
- CVE-2025-58410GPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma_buf import PMRImagination Technologies Graphics DDK
- CVE-2025-62519phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionalitythorsten phpMyFAQ · thorsten/phpmyfaq +1
- CVE-2025-13319Authenticated SQL injection in API - Digi On-Prem ManagerNettec AS Digi On-Prem Manager
- CVE-2025-13288Tenda CH22 PPTPUserSetting fromPptpUserSetting buffer overflowTenda CH22
- CVE-2025-4321DoS in RS9116W-WiSeConnect L2CAP protocol due to reception of malformed packetssilabs.com RS9116W
- CVE-2025-40936A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V29.0.258), Simcenter Femap (All versions < V2Siemens PS/IGES Parasolid Translator Component · Siemens… +1
- CVE-2025-11681Denial of Service condition in M-Files ServerM-Files Server
- CVE-2025-13165Digiwin｜EasyFlow GP - Denial of serviceDigiwin EasyFlow GP
- CVE-2025-13283Chunghwa Telecom｜TenderDocTransfer - Arbitrary File Copy and PasteChunghwa Telecom TenderDocTransfer
- CVE-2025-13282Chunghwa Telecom｜TenderDocTransfer - Arbitrary File DeleteChunghwa Telecom TenderDocTransfer
- CVE-2025-13258Tenda AC20 WifiExtraSet buffer overflowTenda AC20
- CVE-2025-63748QaTraq 6.9.2 allows authenticated users to upload arbitrary files via the "Add Attachment" feature in the "Test Script" module.
- CVE-2025-63916MyScreenTools v2.2.1.0 contains a critical OS command injection vulnerability in the GIF compression tool.
- CVE-2025-63917PDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entity (XXE) references.
- CVE-2025-65073OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide KeOpenStack Keystone · keystone
Medium, low and unrated 79
- CVE-2025-13306D-Link DWR-M920/DWR-M921/DIR-822K/DIR-825M formDebugDiagnosticRun system command injectionD-Link DWR-M920 · D-Link DWR-M921 +2
- CVE-2025-7711Classified Listing – Classified ads & Business Directory Plugin <= 5.0.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Listing Descriptiontechlabpro1 Classified Listing – AI-Powered Classified ads…
- CVE-2025-13303code-projects Courier Management System search-edit.php sql injectioncode-projects Courier Management System
- CVE-2025-64766NixOS has hardcoded credentials in Onlyoffice moduleNixOS nixpkgs
- CVE-2025-13302code-projects Courier Management System add-new-officer.php sql injectioncode-projects Courier Management System
- CVE-2025-13301itsourcecode Web-Based Internet Laboratory Management System controller.php sql injectionitsourcecode Web-Based Internet Laboratory Management System
- CVE-2025-13300itsourcecode Web-Based Internet Laboratory Management System controller.php sql injectionitsourcecode Web-Based Internet Laboratory Management System
- CVE-2025-36299IBM Planning Analytics Information DisclosureIBM Planning Analytics Local
- CVE-2025-13299itsourcecode Web-Based Internet Laboratory Management System controller.php sql injectionitsourcecode Web-Based Internet Laboratory Management System
- CVE-2025-13298itsourcecode Web-Based Internet Laboratory Management System controller.php sql injectionitsourcecode Web-Based Internet Laboratory Management System
- CVE-2025-13297itsourcecode Web-Based Internet Laboratory Management System controller.php sql injectionitsourcecode Web-Based Internet Laboratory Management System
- CVE-2025-55059CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')Rumpus FTP Server
- CVE-2025-55058CWE-20 Improper Input ValidationRumpus FTP Server
- CVE-2025-55057Multiple CWE-352 Cross-Site Request Forgery (CSRF)Rumpus FTP Server
- CVE-2025-55056Multiple CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')Rumpus FTP Server
- CVE-2025-55055CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Rumpus FTP Server
- CVE-2025-64758@dependencytrack/frontend Vulnerable to Persistent Cross-Site-Scripting via Welcome MessageDependencyTrack frontend · @dependencytrack/frontend
- CVE-2025-64342ESF-IDF's ESP32 Bluetooth Controller Has an Invalid Access Address Vulnerabilityespressif esp-idf
- CVE-2025-13193Libvirt: information disclosure via world-readable vm snapshotslibvirt · Red Hat Enterprise Linux
- CVE-2025-13291Campcodes Supplier Management System confirm_order.php sql injectionCampcodes Supplier Management System
- CVE-2025-13290code-projects Simple Food Ordering System saveorder.php sql injectioncode-projects Simple Food Ordering System
- CVE-2025-132891000projects Design & Development of Student Database Management System SubjectDetails.php sql injection1000projects Design & Development of Student Database Manag…
- CVE-2025-13287itsourcecode Online Voting System index.php sql injectionitsourcecode Online Voting System
- CVE-2025-13286itsourcecode Online Voting System ajax.php sql injectionitsourcecode Online Voting System
- CVE-2025-13285itsourcecode Online Voting System login.php sql injectionitsourcecode Online Voting System
- CVE-2025-13280CodeAstro Simple Inventory System Login index.php sql injectionCodeAstro Simple Inventory System
- CVE-2025-13279code-projects Nero Social Networking Site profilefriends.php sql injectioncode-projects Nero Social Networking Site
- CVE-2025-13278projectworlds Advanced Library Management System borrowed_book_search.php sql injectionprojectworlds Advanced Library Management System
- CVE-2025-40834A vulnerability has been identified in Mendix RichText (All versions >= V4.0.0 < V4.6.1).Siemens Mendix RichText
- CVE-2025-13277code-projects Nero Social Networking Site friendsphoto.php sql injectioncode-projects Nero Social Networking Site
- CVE-2025-13276g33kyrash Online-Banking-System index.php sql injectiong33kyrash Online-Banking-System
- CVE-2025-13275Iqbolshoh php-business-website about.php unrestricted uploadIqbolshoh php-business-website
- CVE-2025-13274Campcodes School Fees Payment Management System ajax.php sql injectionCampcodes School Fees Payment Management System
- CVE-2025-13273Campcodes School Fees Payment Management System ajax.php sql injectionCampcodes School Fees Payment Management System
- CVE-2025-13272Campcodes School Fees Payment Management System manage_course.php sql injectionCampcodes School Fees Payment Management System
- CVE-2025-13271Campcodes School Fees Payment Management System ajax.php sql injectionCampcodes School Fees Payment Management System
- CVE-2025-13270Campcodes School Fees Payment Management System ajax.php sql injectionCampcodes School Fees Payment Management System
- CVE-2025-13269Campcodes School Fees Payment Management System ajax.php sql injectionCampcodes School Fees Payment Management System
- CVE-2025-13268Dromara dataCompare JDBC URL DbconfigServiceImpl.java DbConfig injectionDromara dataCompare
- CVE-2025-13267SourceCodester Dental Clinic Appointment Reservation System success.php sql injectionSourceCodester Dental Clinic Appointment Reservation System
- CVE-2025-13164Digiwin｜EasyFlow GP - Insufficiently Protected CredentialsDigiwin EasyFlow GP
- CVE-2025-13163Digiwin｜EasyFlow GP - Insufficiently Protected CredentialsDigiwin EasyFlow GP
- CVE-2025-13266wwwlike vlife VLifeApi SysFileApi.java create path traversalwwwlike vlife · io.github.wwwlike:vlife-base
- CVE-2025-60022Improper certificate validation vulnerability exists in 'デジラアプリ' App for iOS prior to ver.80.10.00.KDDI 'デジラアプリ' App for iOS
- CVE-2025-13265lsfusion platform ZipUtils.java unpackFile path traversallsfusion platform · lsfusion.platform:server
- CVE-2025-13264SourceCodester Online Magazine Management System view_magazine.php sql injectionSourceCodester Online Magazine Management System
- CVE-2025-13263SourceCodester Online Magazine Management System categories.php sql injectionSourceCodester Online Magazine Management System
- CVE-2025-13262lsfusion platform UploadFileRequestHandler.java UploadFileRequestHandler path traversallsfusion platform · lsfusion.platform:web-client
- CVE-2025-13261lsfusion platform DownloadFileRequestHandler.java DownloadFileRequestHandler path traversallsfusion platform · lsfusion.platform:web-client
- CVE-2025-13260Campcodes Supplier Management System edit_product.php sql injectionCampcodes Supplier Management System
- CVE-2025-13259Campcodes Supplier Management System edit_unit.php sql injectionCampcodes Supplier Management System
- CVE-2025-13257itsourcecode Inventory Management System index.php sql injectionitsourcecode Inventory Management System
- CVE-2025-13256projectworlds Advanced Library Management System borrow.php sql injectionprojectworlds Advanced Library Management System
- CVE-2025-13255projectworlds Advanced Library Management System book_search.php sql injectionprojectworlds Advanced Library Management System
- CVE-2025-13254projectworlds Advanced Library Management System add_member.php sql injectionprojectworlds Advanced Library Management System
- CVE-2024-44641PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the oldpass parameter in change-password.php.
- CVE-2024-44644PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the frm_id and aremark parameters in manage-tickets.php.
- CVE-2024-44647PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via the aremark parameter in manage-tickets.php.
- CVE-2024-44648PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via id and adminremark parameters in quote-details.php.
- CVE-2024-44651Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the recover_email parameter in user_password_recover.php.
- CVE-2024-44652Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the user_email, username, user_firstname, user_lastname, and user_address
- CVE-2024-44653Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the user_email parameter in user_login.php.
- CVE-2024-44654PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the email and mobileno parameters in reset-password.php.
- CVE-2024-44655PHPGurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) via the search parameter in user-search.php.
- CVE-2024-44657PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the fromdate and todate parameters in between-date-userreport.
- CVE-2024-44658PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the subcategory and category parameters in subcategory.php.
- CVE-2024-44660PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the fullname, emailid, and contactno parameters in login.php.
- CVE-2024-44661PHPGurukul Online Shopping Portal 2.0 is vulnerable to Cross Site Scripting (XSS) via the quantity parameter in my-cart.php.
- CVE-2024-44662PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the username parameter in the admin page.
- CVE-2024-44663PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the product parameter in search-result.php.
- CVE-2024-44664PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the name, summary, review, quality, price, and value parameters in
- CVE-2024-46334kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the formuser and formpassword parameters in /adminLog
- CVE-2024-46335PHPGurukul Complaint Management System 2.0 is vulnerble to Cross Site Scripting (XSS) via the fromdate and todate parameters in between-date
- CVE-2024-46336kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via /client_user/feedback.php.
- CVE-2025-63292Freebox v5 HD (firmware = 1.7.20), Freebox v5 Crystal (firmware = 1.7.20), Freebox v6 Révolution r1–r3 (firmware = 4.7.x), Freebox Mini 4K (
- CVE-2025-63708Cross-Site Scripting (XSS) vulnerability exists in SourceCodester AI Font Matcher (nid=18425, 2025-10-10) that allows remote attackers to ex
- CVE-2025-63918PDFPatcher executable does not validate user-supplied file paths, allowing directory traversal attacks allowing attackers to upload arbitrar
- CVE-2025-64046OpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /system/update-run.php.
- CVE-2025-65083GoSign Desktop through 2.4.1 disables TLS certificate validation when configured to use a proxy server.Tinexta Infocert GoSign Desktop