# CVEs published 2025-11-17 122 CVEs were published on November 17, 2025: 5 critical, 38 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2025-13306](https://cve.now/CVE-2025-13306.md): D-Link DWR-M920/DWR-M921/DIR-822K/DIR-825M formDebugDiagnosticRun system command injection (CVSS 5.3, D-Link DWR-M920 · D-Link DWR-M921 +2) - [CVE-2025-13230](https://cve.now/CVE-2025-13230.md): Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome) - [CVE-2025-13229](https://cve.now/CVE-2025-13229.md): Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome) - [CVE-2025-13228](https://cve.now/CVE-2025-13228.md): Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome) - [CVE-2025-13227](https://cve.now/CVE-2025-13227.md): Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome) - [CVE-2025-13226](https://cve.now/CVE-2025-13226.md): Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome) - [CVE-2025-13224](https://cve.now/CVE-2025-13224.md): Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome) - [CVE-2025-13223](https://cve.now/CVE-2025-13223.md): Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, KEV, Google Chrome) - [CVE-2025-13305](https://cve.now/CVE-2025-13305.md): D-Link DWR-M920/DWR-M921/DWR-M960/DIR-822K/DIR-825M formTracerouteDiagnosticRun buffer overflow (CVSS 8.7, D-Link DWR-M920 · D-Link DWR-M921 +3) - [CVE-2025-31649](https://cve.now/CVE-2025-31649.md): Dell ControlVault3 ControlVault WBDI Driver hard-coded password vulnerability (CVSS 8.7, Broadcom BCM5820X · Dell ControlVault3) - [CVE-2025-31361](https://cve.now/CVE-2025-31361.md): Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter privilege escalation vulnerability (CVSS 8.7, Broadcom BCM5820X · Dell ControlVault3) - [CVE-2025-36463](https://cve.now/CVE-2025-36463.md): Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write vulnerability (CVSS 7.3, Broadcom BCM5820X · Dell ControlVault3) - [CVE-2025-36462](https://cve.now/CVE-2025-36462.md): Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write vulnerability (CVSS 7.3, Broadcom BCM5820X · Dell ControlVault3) - [CVE-2025-36461](https://cve.now/CVE-2025-36461.md): Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write vulnerability (CVSS 7.3, Broadcom BCM5820X · Dell ControlVault3) - [CVE-2025-36460](https://cve.now/CVE-2025-36460.md): Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write vulnerability (CVSS 7.3, Broadcom BCM5820X · Dell ControlVault3) - [CVE-2025-32089](https://cve.now/CVE-2025-32089.md): Dell ControlVault3 CvManager\_SBI buffer overflow vulnerability (CVSS 8.8, Broadcom BCM5820X · Dell ControlVault3) - [CVE-2025-13304](https://cve.now/CVE-2025-13304.md): D-Link DWR-M920/DWR-M921/DWR-M960/DWR-M961/DIR-825M formPingDiagnosticRun buffer overflow (CVSS 8.7, D-Link DWR-M920 · D-Link DWR-M921 +3) - [CVE-2025-7711](https://cve.now/CVE-2025-7711.md): Classified Listing – Classified ads & Business Directory Plugin \<= 5.0.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Listing Description (CVSS 5.4, techlabpro1 Classified Listing – AI-Powered Classified ads…) - [CVE-2025-36553](https://cve.now/CVE-2025-36553.md): Dell ControlVault3 CvManager buffer overflow vulnerability (CVSS 8.8, Broadcom BCM5820X · Dell ControlVault3) - [CVE-2025-13303](https://cve.now/CVE-2025-13303.md): code-projects Courier Management System search-edit.php sql injection (CVSS 5.3, code-projects Courier Management System) - [CVE-2025-64766](https://cve.now/CVE-2025-64766.md): NixOS has hardcoded credentials in Onlyoffice module (CVSS 5.3, NixOS nixpkgs) - [CVE-2025-13302](https://cve.now/CVE-2025-13302.md): code-projects Courier Management System add-new-officer.php sql injection (CVSS 5.1, code-projects Courier Management System) - [CVE-2025-13301](https://cve.now/CVE-2025-13301.md): itsourcecode Web-Based Internet Laboratory Management System controller.php sql injection (CVSS 6.9, itsourcecode Web-Based Internet Laboratory Management System) - [CVE-2025-36118](https://cve.now/CVE-2025-36118.md): IBM Storage Virtualize Information Disclosure (CVSS 7.5, IBM Storage Virtualize) - [CVE-2025-13300](https://cve.now/CVE-2025-13300.md): itsourcecode Web-Based Internet Laboratory Management System controller.php sql injection (CVSS 6.9, itsourcecode Web-Based Internet Laboratory Management System) - [CVE-2025-36299](https://cve.now/CVE-2025-36299.md): IBM Planning Analytics Information Disclosure (CVSS 4.3, IBM Planning Analytics Local) - [CVE-2025-36357](https://cve.now/CVE-2025-36357.md): IBM Planning Analytics Local Directory Traversal (CVSS 8.0, IBM Planning Analytics Local) - [CVE-2025-13299](https://cve.now/CVE-2025-13299.md): itsourcecode Web-Based Internet Laboratory Management System controller.php sql injection (CVSS 6.9, itsourcecode Web-Based Internet Laboratory Management System) - [CVE-2025-13298](https://cve.now/CVE-2025-13298.md): itsourcecode Web-Based Internet Laboratory Management System controller.php sql injection (CVSS 6.9, itsourcecode Web-Based Internet Laboratory Management System) - [CVE-2025-13297](https://cve.now/CVE-2025-13297.md): itsourcecode Web-Based Internet Laboratory Management System controller.php sql injection (CVSS 6.9, itsourcecode Web-Based Internet Laboratory Management System) - [CVE-2025-34323](https://cve.now/CVE-2025-34323.md): Nagios Log Server \< 2026R1.0.1 Local Privilege Escalation via Writable Scripts and Sudo Rules (CVSS 8.5, Nagios Log Server) - [CVE-2025-34322](https://cve.now/CVE-2025-34322.md): Nagios Log Server \< 2026R1.0.1 Authenticated Command Injection via Natural Language Queries (CVSS 8.6, Nagios Log Server) - [CVE-2025-55059](https://cve.now/CVE-2025-55059.md): CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (CVSS 4.8, Rumpus FTP Server) - [CVE-2025-55058](https://cve.now/CVE-2025-55058.md): CWE-20 Improper Input Validation (CVSS 4.5, Rumpus FTP Server) - [CVE-2025-55057](https://cve.now/CVE-2025-55057.md): Multiple CWE-352 Cross-Site Request Forgery (CSRF) (CVSS 4.5, Rumpus FTP Server) - [CVE-2025-64756](https://cve.now/CVE-2025-64756.md): glob CLI: Command injection via -c/--cmd executes matches with shell:true (CVSS 7.5, isaacs node-glob · glob) - [CVE-2025-55056](https://cve.now/CVE-2025-55056.md): Multiple CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (CVSS 4.8, Rumpus FTP Server) - [CVE-2025-55055](https://cve.now/CVE-2025-55055.md): CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CVSS 6.8, Rumpus FTP Server) - [CVE-2025-64758](https://cve.now/CVE-2025-64758.md): @dependencytrack/frontend Vulnerable to Persistent Cross-Site-Scripting via Welcome Message (CVSS 4.8, DependencyTrack frontend · @dependencytrack/frontend) - [CVE-2025-64342](https://cve.now/CVE-2025-64342.md): ESF-IDF's ESP32 Bluetooth Controller Has an Invalid Access Address Vulnerability (CVSS 6.9, espressif esp-idf) - [CVE-2025-58407](https://cve.now/CVE-2025-58407.md): GPU DDK - TOCTOU bug affecting psFWMemContext-\>uiPageCatBaseRegSet (CVSS 7.4, Imagination Technologies Graphics DDK) - [CVE-2025-13193](https://cve.now/CVE-2025-13193.md): Libvirt: information disclosure via world-readable vm snapshots (CVSS 5.5, libvirt · Red Hat Enterprise Linux) - [CVE-2025-13291](https://cve.now/CVE-2025-13291.md): Campcodes Supplier Management System confirm\_order.php sql injection (CVSS 6.9, Campcodes Supplier Management System) - [CVE-2025-58410](https://cve.now/CVE-2025-58410.md): GPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma\_buf import PMR (CVSS 7.5, Imagination Technologies Graphics DDK) - [CVE-2025-62519](https://cve.now/CVE-2025-62519.md): phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality (CVSS 7.2, thorsten phpMyFAQ · thorsten/phpmyfaq +1) - [CVE-2025-13319](https://cve.now/CVE-2025-13319.md): Authenticated SQL injection in API - Digi On-Prem Manager (CVSS 8.8, Nettec AS Digi On-Prem Manager) - [CVE-2025-13290](https://cve.now/CVE-2025-13290.md): code-projects Simple Food Ordering System saveorder.php sql injection (CVSS 5.3, code-projects Simple Food Ordering System) - [CVE-2025-13289](https://cve.now/CVE-2025-13289.md): 1000projects Design & Development of Student Database Management System SubjectDetails.php sql injection (CVSS 5.3, 1000projects Design & Development of Student Database Manag…) - [CVE-2025-13288](https://cve.now/CVE-2025-13288.md): Tenda CH22 PPTPUserSetting fromPptpUserSetting buffer overflow (CVSS 8.7, Tenda CH22) - [CVE-2025-4321](https://cve.now/CVE-2025-4321.md): DoS in RS9116W-WiSeConnect L2CAP protocol due to reception of malformed packets (CVSS 7.1, silabs.com RS9116W) - [CVE-2025-13287](https://cve.now/CVE-2025-13287.md): itsourcecode Online Voting System index.php sql injection (CVSS 5.3, itsourcecode Online Voting System) - [CVE-2025-13286](https://cve.now/CVE-2025-13286.md): itsourcecode Online Voting System ajax.php sql injection (CVSS 5.3, itsourcecode Online Voting System) - [CVE-2025-13285](https://cve.now/CVE-2025-13285.md): itsourcecode Online Voting System login.php sql injection (CVSS 6.9, itsourcecode Online Voting System) - [CVE-2025-13280](https://cve.now/CVE-2025-13280.md): CodeAstro Simple Inventory System Login index.php sql injection (CVSS 6.9, CodeAstro Simple Inventory System) - [CVE-2025-13279](https://cve.now/CVE-2025-13279.md): code-projects Nero Social Networking Site profilefriends.php sql injection (CVSS 5.3, code-projects Nero Social Networking Site) - [CVE-2025-13278](https://cve.now/CVE-2025-13278.md): projectworlds Advanced Library Management System borrowed\_book\_search.php sql injection (CVSS 5.3, projectworlds Advanced Library Management System) - [CVE-2025-40936](https://cve.now/CVE-2025-40936.md): A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions \< V29.0.258), Simcenter Femap (All versions \< V2 (CVSS 7.8, Siemens PS/IGES Parasolid Translator Component · Siemens… +1) - [CVE-2025-40834](https://cve.now/CVE-2025-40834.md): A vulnerability has been identified in Mendix RichText (All versions \>= V4.0.0 \< V4.6.1). (CVSS 5.7, Siemens Mendix RichText) - [CVE-2025-13277](https://cve.now/CVE-2025-13277.md): code-projects Nero Social Networking Site friendsphoto.php sql injection (CVSS 6.9, code-projects Nero Social Networking Site) - [CVE-2025-11681](https://cve.now/CVE-2025-11681.md): Denial of Service condition in M-Files Server (CVSS 7.1, M-Files Server) - [CVE-2025-13276](https://cve.now/CVE-2025-13276.md): g33kyrash Online-Banking-System index.php sql injection (CVSS 6.9, g33kyrash Online-Banking-System) - [CVE-2025-13275](https://cve.now/CVE-2025-13275.md): Iqbolshoh php-business-website about.php unrestricted upload (CVSS 5.1, Iqbolshoh php-business-website) - [CVE-2025-13274](https://cve.now/CVE-2025-13274.md): Campcodes School Fees Payment Management System ajax.php sql injection (CVSS 5.3, Campcodes School Fees Payment Management System) - [CVE-2025-13273](https://cve.now/CVE-2025-13273.md): Campcodes School Fees Payment Management System ajax.php sql injection (CVSS 5.3, Campcodes School Fees Payment Management System) - [CVE-2025-13272](https://cve.now/CVE-2025-13272.md): Campcodes School Fees Payment Management System manage\_course.php sql injection (CVSS 6.9, Campcodes School Fees Payment Management System) - [CVE-2025-13271](https://cve.now/CVE-2025-13271.md): Campcodes School Fees Payment Management System ajax.php sql injection (CVSS 6.9, Campcodes School Fees Payment Management System) - [CVE-2025-13270](https://cve.now/CVE-2025-13270.md): Campcodes School Fees Payment Management System ajax.php sql injection (CVSS 5.3, Campcodes School Fees Payment Management System) - [CVE-2025-13269](https://cve.now/CVE-2025-13269.md): Campcodes School Fees Payment Management System ajax.php sql injection (CVSS 5.3, Campcodes School Fees Payment Management System) - [CVE-2025-13268](https://cve.now/CVE-2025-13268.md): Dromara dataCompare JDBC URL DbconfigServiceImpl.java DbConfig injection (CVSS 5.3, Dromara dataCompare) - [CVE-2025-13165](https://cve.now/CVE-2025-13165.md): Digiwin｜EasyFlow GP - Denial of service (CVSS 8.7, Digiwin EasyFlow GP) - [CVE-2025-13267](https://cve.now/CVE-2025-13267.md): SourceCodester Dental Clinic Appointment Reservation System success.php sql injection (CVSS 5.3, SourceCodester Dental Clinic Appointment Reservation System) - [CVE-2025-13164](https://cve.now/CVE-2025-13164.md): Digiwin｜EasyFlow GP - Insufficiently Protected Credentials (CVSS 6.9, Digiwin EasyFlow GP) - [CVE-2025-13163](https://cve.now/CVE-2025-13163.md): Digiwin｜EasyFlow GP - Insufficiently Protected Credentials (CVSS 6.9, Digiwin EasyFlow GP) - [CVE-2025-13266](https://cve.now/CVE-2025-13266.md): wwwlike vlife VLifeApi SysFileApi.java create path traversal (CVSS 6.9, wwwlike vlife · io.github.wwwlike:vlife-base) - [CVE-2025-9501](https://cve.now/CVE-2025-9501.md): W3 Total Cache \< 2.8.13 - Unauthenticated Command Injection (CVSS 9.0, W3 Total Cache) - [CVE-2025-60022](https://cve.now/CVE-2025-60022.md): Improper certificate validation vulnerability exists in 'デジラアプリ' App for iOS prior to ver.80.10.00. (CVSS 4.8, KDDI 'デジラアプリ' App for iOS) - [CVE-2025-13265](https://cve.now/CVE-2025-13265.md): lsfusion platform ZipUtils.java unpackFile path traversal (CVSS 5.3, lsfusion platform · lsfusion.platform:server) - [CVE-2025-13264](https://cve.now/CVE-2025-13264.md): SourceCodester Online Magazine Management System view\_magazine.php sql injection (CVSS 5.3, SourceCodester Online Magazine Management System) - [CVE-2025-13263](https://cve.now/CVE-2025-13263.md): SourceCodester Online Magazine Management System categories.php sql injection (CVSS 5.3, SourceCodester Online Magazine Management System) - [CVE-2025-13262](https://cve.now/CVE-2025-13262.md): lsfusion platform UploadFileRequestHandler.java UploadFileRequestHandler path traversal (CVSS 6.9, lsfusion platform · lsfusion.platform:web-client) - [CVE-2025-13284](https://cve.now/CVE-2025-13284.md): ThinPLUS｜ThinPLUS - OS Command Injection (CVSS 9.3, ThinPLUS) - [CVE-2025-13261](https://cve.now/CVE-2025-13261.md): lsfusion platform DownloadFileRequestHandler.java DownloadFileRequestHandler path traversal (CVSS 6.9, lsfusion platform · lsfusion.platform:web-client) - [CVE-2025-13283](https://cve.now/CVE-2025-13283.md): Chunghwa Telecom｜TenderDocTransfer - Arbitrary File Copy and Paste (CVSS 7.0, Chunghwa Telecom TenderDocTransfer) - [CVE-2025-13282](https://cve.now/CVE-2025-13282.md): Chunghwa Telecom｜TenderDocTransfer - Arbitrary File Delete (CVSS 7.0, Chunghwa Telecom TenderDocTransfer) - [CVE-2025-13260](https://cve.now/CVE-2025-13260.md): Campcodes Supplier Management System edit\_product.php sql injection (CVSS 5.3, Campcodes Supplier Management System) - [CVE-2025-10460](https://cve.now/CVE-2025-10460.md): Unsanitized parameter input leading to SQL Injection vulnerability (CVSS 9.4, BEIMS Contractor Web) - [CVE-2025-13259](https://cve.now/CVE-2025-13259.md): Campcodes Supplier Management System edit\_unit.php sql injection (CVSS 5.3, Campcodes Supplier Management System) - [CVE-2025-13258](https://cve.now/CVE-2025-13258.md): Tenda AC20 WifiExtraSet buffer overflow (CVSS 8.7, Tenda AC20) - [CVE-2025-13257](https://cve.now/CVE-2025-13257.md): itsourcecode Inventory Management System index.php sql injection (CVSS 6.9, itsourcecode Inventory Management System) - [CVE-2025-13256](https://cve.now/CVE-2025-13256.md): projectworlds Advanced Library Management System borrow.php sql injection (CVSS 5.3, projectworlds Advanced Library Management System) - [CVE-2025-13255](https://cve.now/CVE-2025-13255.md): projectworlds Advanced Library Management System book\_search.php sql injection (CVSS 5.3, projectworlds Advanced Library Management System) - [CVE-2025-13254](https://cve.now/CVE-2025-13254.md): projectworlds Advanced Library Management System add\_member.php sql injection (CVSS 5.3, projectworlds Advanced Library Management System) - [CVE-2024-44641](https://cve.now/CVE-2024-44641.md): PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the oldpass parameter in change-password.php. (CVSS 6.5) - [CVE-2024-44644](https://cve.now/CVE-2024-44644.md): PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the frm\_id and aremark parameters in manage-tickets.php. (CVSS 6.5) - [CVE-2024-44647](https://cve.now/CVE-2024-44647.md): PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via the aremark parameter in manage-tickets.php. (CVSS 6.1) - [CVE-2024-44648](https://cve.now/CVE-2024-44648.md): PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via id and adminremark parameters in quote-details.php. (CVSS 6.5) - [CVE-2024-44651](https://cve.now/CVE-2024-44651.md): Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the recover\_email parameter in user\_password\_recover.php. (CVSS 6.5) - [CVE-2024-44652](https://cve.now/CVE-2024-44652.md): Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the user\_email, username, user\_firstname, user\_lastname, and user\_address (CVSS 6.5) - [CVE-2024-44653](https://cve.now/CVE-2024-44653.md): Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the user\_email parameter in user\_login.php. (CVSS 6.5) - [CVE-2024-44654](https://cve.now/CVE-2024-44654.md): PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the email and mobileno parameters in reset-password.php. (CVSS 6.5) - [CVE-2024-44655](https://cve.now/CVE-2024-44655.md): PHPGurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) via the search parameter in user-search.php. (CVSS 6.1) - [CVE-2024-44657](https://cve.now/CVE-2024-44657.md): PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the fromdate and todate parameters in between-date-userreport. (CVSS 6.5) - [CVE-2024-44658](https://cve.now/CVE-2024-44658.md): PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the subcategory and category parameters in subcategory.php. (CVSS 6.5) - [CVE-2024-44659](https://cve.now/CVE-2024-44659.md): PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the email parameter in forgot-password.php. (CVSS 9.8) - [CVE-2024-44660](https://cve.now/CVE-2024-44660.md): PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the fullname, emailid, and contactno parameters in login.php. (CVSS 6.5) - [CVE-2024-44661](https://cve.now/CVE-2024-44661.md): PHPGurukul Online Shopping Portal 2.0 is vulnerable to Cross Site Scripting (XSS) via the quantity parameter in my-cart.php. (CVSS 5.4) - [CVE-2024-44662](https://cve.now/CVE-2024-44662.md): PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the username parameter in the admin page. (CVSS 6.5) - [CVE-2024-44663](https://cve.now/CVE-2024-44663.md): PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the product parameter in search-result.php. (CVSS 6.5) - [CVE-2024-44664](https://cve.now/CVE-2024-44664.md): PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the name, summary, review, quality, price, and value parameters in (CVSS 6.5) - [CVE-2024-46334](https://cve.now/CVE-2024-46334.md): kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the formuser and formpassword parameters in /adminLog (CVSS 6.1) - [CVE-2024-46335](https://cve.now/CVE-2024-46335.md): PHPGurukul Complaint Management System 2.0 is vulnerble to Cross Site Scripting (XSS) via the fromdate and todate parameters in between-date (CVSS 4.6) - [CVE-2024-46336](https://cve.now/CVE-2024-46336.md): kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via /client\_user/feedback.php. (CVSS 6.1) - [CVE-2025-63292](https://cve.now/CVE-2025-63292.md): Freebox v5 HD (firmware = 1.7.20), Freebox v5 Crystal (firmware = 1.7.20), Freebox v6 Révolution r1–r3 (firmware = 4.7.x), Freebox Mini 4K ( (CVSS 3.5) - [CVE-2025-63708](https://cve.now/CVE-2025-63708.md): Cross-Site Scripting (XSS) vulnerability exists in SourceCodester AI Font Matcher (nid=18425, 2025-10-10) that allows remote attackers to ex (CVSS 6.1) - [CVE-2025-63747](https://cve.now/CVE-2025-63747.md): QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immediate login via the web (CVSS 9.8) - [CVE-2025-63748](https://cve.now/CVE-2025-63748.md): QaTraq 6.9.2 allows authenticated users to upload arbitrary files via the "Add Attachment" feature in the "Test Script" module. (CVSS 8.8) - [CVE-2025-63916](https://cve.now/CVE-2025-63916.md): MyScreenTools v2.2.1.0 contains a critical OS command injection vulnerability in the GIF compression tool. (CVSS 8.1) - [CVE-2025-63917](https://cve.now/CVE-2025-63917.md): PDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entity (XXE) references. (CVSS 7.1) - [CVE-2025-63918](https://cve.now/CVE-2025-63918.md): PDFPatcher executable does not validate user-supplied file paths, allowing directory traversal attacks allowing attackers to upload arbitrar (CVSS 6.2) - [CVE-2025-64046](https://cve.now/CVE-2025-64046.md): OpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /system/update-run.php. (CVSS 6.1) - [CVE-2025-65073](https://cve.now/CVE-2025-65073.md): OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Ke (CVSS 7.5, OpenStack Keystone · keystone) - [CVE-2025-65083](https://cve.now/CVE-2025-65083.md): GoSign Desktop through 2.4.1 disables TLS certificate validation when configured to use a proxy server. (CVSS 3.2, Tinexta Infocert GoSign Desktop) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-11-17 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.