CVEs published November 19, 2025
125 CVEs were published on November 19, 2025: 17 critical, 46 high.
- Published
- 125
- Critical
- 17
- High
- 46
- Medium
- 60
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 45
Most affected products
- lukevella rallly
- 9
- AudioCodes Limited AudioCodes Fax/IVR Appliance
- 8
- Campcodes Retro Basketball Shoes Online Store
- 4
- withastro astro · astro
- 4
- portabilis i-educar
- 3
- Automated Logic WebCtrl · Carrier i-Vu
- 2
- eGovFramework/egovframe-common-components
- 2
- esm-dev esm.sh · github.com/esm-dev/esm.sh
- 2
- Google Cloud Looker
- 2
- itsourcecode Human Resource Management System
- 2
Critical 17
- CVE-2025-13315Unauthenticated log access in Twonky ServerLynxtechnology Twonky Server
- CVE-2025-65095Lookyloo is vulnerable due to improper user input sanitizationlookyloo
- CVE-2025-65021Rallly Has Unauthorized Poll Finalization via Insecure Direct Object Reference (IDOR)lukevella rallly
- CVE-2025-34329AudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated Backup Upload RCE via ajaxBackupUploadFile.phpAudioCodes Limited AudioCodes Fax/IVR Appliance
- CVE-2025-34328AudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated File Upload RCE via ajaxScript.phpAudioCodes Limited AudioCodes Fax/IVR Appliance
- CVE-2025-12592Use of default login credentials in Legacy Vivotek DevicesVivotek Affected device model numbers are FD7131-VVTK,FD713…
- CVE-2025-10437SQLi in Exagate's Webpack Management SystemEksagate Electronic Engineering and Computer Industry Trade…
- CVE-2025-12057WavePlayer < 3.8.0 - Unauthenticated Arbitrary File UploadWavePlayer
- CVE-2025-13051Windows service used an uncontrolled search path element will cause unauthorized code execution with localsystem privilegesASUSTOR ABP and AES
- CVE-2025-63206An authentication bypass issue was discovered in Dasan Switch DS2924 web based interface, firmware versions 1.01.18 and 1.02.00, allowing at
- CVE-2025-63207The R.V.R Elettronica TEX product (firmware TEXL-000400, Web GUI TLAN-000400) is vulnerable to broken access control due to improper authent
- CVE-2025-63210The Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is vulnerable to an authentication bypass.
- CVE-2025-63213The QVidium Opera11 device (firmware version 2.9.0-Ax4x-opera11) is vulnerable to Remote Code Execution (RCE) due to improper input validati
- CVE-2025-63218The Axel Technology WOLF1MS and WOLF2MS devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing au
- CVE-2025-63221The Axel Technology puma devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on
- CVE-2025-63223The Axel Technology StreamerMAX MK II devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing auth
- CVE-2025-63224The Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JWT validation across devices.
High 46
- CVE-2025-110017-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability7-Zip
- CVE-2025-65103OpenSTAManager has an authenticated SQL Injection vulnerability in API via 'display' parameterdevcode-it openstamanager · devcode-it/openstamanager
- CVE-2025-65094WBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation (IDOR)WBCE_CMS
- CVE-2025-64759Homarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG Uploadhomarr-labs homarr
- CVE-2025-13316Hard-coded encryption keys in Twonky ServerLynxtechnology Twonky Server
- CVE-2025-65099Claude Code vulnerable to command execution prior to startup trust dialoganthropics claude-code · @anthropic-ai/claude-code
- CVE-2025-65025esm.sh CDN service has arbitrary file write via tarslipesm-dev esm.sh · github.com/esm-dev/esm.sh
- CVE-2025-65034Rallly Improper Authorization Allows Reopening of Any Finalized Poll via Public pollIdlukevella rallly
- CVE-2025-65033Rallly Broken Authorization: Any User Can Pause or Resume Any Poll via Poll ID Manipulationlukevella rallly
- CVE-2025-65030Rallly Improper Authorization in Comment Deletion Endpoint Allows Unauthorized Comment Removallukevella rallly
- CVE-2025-65029Rallly Has an IDOR Vulnerability in Participant Deletion Endpoint Allows Unauthorized Removal of Poll Participantslukevella rallly
- CVE-2025-13400Tenda CH22 WrlExtraGet formWrlExtraGet buffer overflowTenda CH22
- CVE-2025-64764Astro is vulnerable to Reflected XSS via the server islands featurewithastro astro · astro
- CVE-2025-34335AudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via ActivateLicense.phpAudioCodes Limited AudioCodes Fax/IVR Appliance
- CVE-2025-34334AudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via TestFax.php & LPEAudioCodes Limited AudioCodes Fax/IVR Appliance
- CVE-2025-34332AudioCodes Fax/IVR Appliance <= 2.6.23 Insecure Service Control Scripts LPEAudioCodes Limited AudioCodes Fax/IVR Appliance
- CVE-2025-34331AudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated File Read via download.phpAudioCodes Limited AudioCodes Fax/IVR Appliance
- CVE-2025-34333AudioCodes Fax/IVR Appliance <= 2.6.23 World-Writable Webroot LPEAudioCodes Limited AudioCodes Fax/IVR Appliance
- CVE-2025-34337eGovFramework <= 4.3.1 Unauthenticated Encryption Oracle via Web Editor Image Upload EndpointseGovFramework/egovframe-common-components
- CVE-2025-65022i-Educar Authenticated Time-based SQL Injection in `agenda.php`portabilis i-educar
- CVE-2025-65023i-Educar Authenticated Time-based SQL Injection in `funcionario_vinculo_cad.php`portabilis i-educar
- CVE-2025-65024i-Educar Authenticated Time-based SQL Injection in `agenda_admin_cad.php`portabilis i-educar
- CVE-2025-10703Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirectProgress DataDirect Connect for JDBC for Amazon Redshif… +30
- CVE-2025-10702Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirectProgress DataDirect Connect for JDBC for Amazon Redshif… +30
- CVE-2024-8527ALC WebCTRL Carrier i-Vu Open Redirect via URL parameterAutomated Logic WebCtrl · Carrier i-Vu
- CVE-2025-12472Remote Code Execution in Looker due to Improperly Validated Directory DeletionGoogle Cloud Looker
- CVE-2025-11230Denial of service vulnerability in HAProxy mjson libraryHAProxy Technologies HAProxy Community Edition
- CVE-2025-11446Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain CredentialsupKeeper Solutions upKeeper Manager
- CVE-2025-13035Code Snippets <= 3.9.1 - Authenticated (Contributor+) PHP Code Injection via extract() and PHP Filter Chainscodesnippetspro Code Snippets
- CVE-2025-13206GiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name'stellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2025-12484Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers <= 1.12.19 - Unauthenticated Stored Cross-Site Scriptingsmub Giveaways and Contests by RafflePress – Get More Websi…
- CVE-2025-11243Allocation of Resources Without Limits or Throttling in Shelly Pro 4PMShelly Pro 4PM
- CVE-2025-12056Out-of-bounds Read in Shelly Pro 3EMShelly Pro 3EM
- CVE-2025-13145WP Import – Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Importsmackcoders WP Ultimate CSV Importer – Import CSV, XML & Ex…
- CVE-2025-12646Community Events <= 1.5.4 - Unauthenticated SQL Injectionjackdewey Community Events
- CVE-2025-12852DLL Loading vulnerability in NEC Corporation RakurakuMusen Start EX All Verisons allows a attacker to manipulate the PC environment to causeNEC RakurakuMusen Start EX
- CVE-2025-51661A path Traversal vulnerability found in FileCodeBox v2.2 and earlier allows arbitrary file writes when application is configured to use loca
- CVE-2025-51663A vulnerability found in IPRateLimit implementation of FileCodeBox up to 2.2 allows remote attackers to bypass ip-based rate limit protectio
- CVE-2025-63205An issue was discovered in bridgetech probes VB220 IP Network Probe,VB120 Embedded IP + RF Probe, VB330 High-Capacity Probe, VB440 ST 2110 P
- CVE-2025-63208An issue was discovered in bridgetech VB288 Objective QoE Content Extractor, firmware version 5.6.0-8, allowing attackers to gain sensitive
- CVE-2025-63209The ELCA Star Transmitter Remote Control firmware 1.25 for STAR150, BP1000, STAR300, STAR2000, STAR1000, STAR500, and possibly other models,
- CVE-2025-63219The ITEL ISO FM SFN Adapter (firmware ISO2 2.0.0.0, WebServer 2.0) is vulnerable to session hijacking due to improper session management on
- CVE-2025-63220The Sound4 FIRST web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package.
- CVE-2025-63371Milos Paripovic OneCommander 3.102.0.0 is vulnerable to Directory Traversal.
- CVE-2025-63719Campcodes Online Hospital Management System 1.0 is vulnerable to SQL Injection in /admin/index.php via the parameter username.
- CVE-2025-63932D-Link Router DIR-868L A1 FW106KRb01.bin has an unauthenticated remote code execution vulnerability in the cgibin binary.
Medium, low and unrated 62
- CVE-2025-13423Campcodes Retro Basketball Shoes Online Store admin_product.php unrestricted uploadCampcodes Retro Basketball Shoes Online Store
- CVE-2025-13422freeprojectscodes Sports Club Management System change_s_pwd.php sql injectionfreeprojectscodes Sports Club Management System
- CVE-2025-13421itsourcecode Human Resource Management System NoticeStore.php sql injectionitsourcecode Human Resource Management System
- CVE-2025-13420itsourcecode Human Resource Management System EventStore.php sql injectionitsourcecode Human Resource Management System
- CVE-2025-13415icret EasyImages SVG Image upload.php cross site scriptingicret EasyImages
- CVE-2025-11884Cross-site Scripting vulnerability discovered in OpenText™ Universal Discovery and CMDBOpenText™ uCMDB
- CVE-2025-13412Campcodes Retro Basketball Shoes Online Store admin_running.php cross site scriptingCampcodes Retro Basketball Shoes Online Store
- CVE-2025-13147External Service Interaction (DNS)Progress MOVEit Transfer
- CVE-2025-47914Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agentgolang.org/x/crypto/ssh/agent · golang.org/x/crypto
- CVE-2025-58181Unbounded memory consumption in golang.org/x/crypto/sshgolang.org/x/crypto/ssh · golang.org/x/crypto
- CVE-2025-13411Campcodes Retro Basketball Shoes Online Store admin_football.php unrestricted uploadCampcodes Retro Basketball Shoes Online Store
- CVE-2025-13410Campcodes Retro Basketball Shoes Online Store receipt.php sql injectionCampcodes Retro Basketball Shoes Online Store
- CVE-2025-36371IBM i Information DisclosureIBM i
- CVE-2025-65100Security Snapshot May Use Unintended Timestamp When Only ISAR_APT_SNAPSHOT_DATE Is Setilbers isar
- CVE-2025-65089XWiki view file macro: User can view content of office file without view rights on the attachmentxwikisas xwiki-pro-macros · com.xwiki.pro:xwiki-pro-macros-…
- CVE-2025-65026esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScriptesm-dev esm.sh · github.com/esm-dev/esm.sh
- CVE-2025-65032Rallly Has an IDOR Vulnerability in Participant Rename Function Allows Unauthorized Modification of Other Users’ Nameslukevella rallly
- CVE-2025-65031Rallly Improper Authorization in Comment Endpoint Allows User Impersonationlukevella rallly
- CVE-2025-65020Rallly Has Unauthorized Poll Duplication via Insecure Direct Object Reference (IDOR)lukevella rallly
- CVE-2025-65028Rallly Has an IDOR Vulnerability in Vote Update Endpoint Allows Unauthorized Manipulation of Participant Voteslukevella rallly
- CVE-2025-64708authentik invitation expiry is delayed by at least 5 minutesgoauthentik authentik · goauthentik.io
- CVE-2025-64521authentik deactivated service accounts can authenticate to OAuthgoauthentik authentik · authentik-client +1
- CVE-2025-12743SQL Injection in Looker Project Generation Endpoint Allows Access to Internal MySQL DatabaseGoogle Cloud Looker
- CVE-2025-64765Astro middleware authentication checks based on url.pathname can be bypassed via url encoded valueswithastro astro · astro
- CVE-2025-65019Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpointwithastro astro · astro
- CVE-2025-64757Astro Development Server is Vulnerable to Arbitrary Local File Readwithastro astro · astro
- CVE-2025-34330AudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated Prompt File Upload via ajaxPromptUploadFile.phpAudioCodes Limited AudioCodes Fax/IVR Appliance
- CVE-2025-34336eGovFramework <= 4.3.1 Unauthenticated File Upload via Web Editor Image Upload EndpointseGovFramework/egovframe-common-components
- CVE-2025-12766Insecure Direct Object Reference (IDOR) vulnerability in the Management Console of affected versions of BlackBerry AtHoc.BlackBerry® AtHoc®
- CVE-2025-13397mrubyc alloc.c mrbc_raw_realloc null pointer dereferencemrubyc
- CVE-2025-13396code-projects Courier Management System add-office.php sql injectioncode-projects Courier Management System
- CVE-2025-11963Reflected XSS in Saysis's StarCitiesSaysis Computer Systems Trade Ltd. StarCities
- CVE-2025-0421iFrame Injection in Mikrogrup's ShopsideShopside Software Technologies Shopside
- CVE-2024-8528ALC WebCTRL Carrier i-Vu Reflected XSS due to unsanitized parameterAutomated Logic WebCtrl · Carrier i-Vu
- CVE-2025-13395codehub666 94list function.php login sql injectioncodehub666 94list
- CVE-2025-64408Apache Causeway: Java deserialization vulnerability to authenticated attackersApache Software Foundation Apache Causeway · org.apache.… +3
- CVE-2025-58412A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 thrFortinet FortiADC
- CVE-2025-12535SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distributionbrainstormforce SureForms – Contact Form, Payment Form & Ot…
- CVE-2025-13085SiteSEO – SEO Simplified <= 1.3.2 - Insecure Direct Object Reference to Sensitive Post Meta Disclosuresoftaculous SiteSEO – SEO Simplified
- CVE-2025-12814SiteSEO – SEO Simplified <= 1.3.2 - Improper Authorization to Authenticated Settings Resetsoftaculous SiteSEO – SEO Simplified
- CVE-2025-12822WP Login and Register using JWT <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) API Key Exposurecyberlord92 WP Login and Register using JWT
- CVE-2025-12359Responsive Lightbox & Gallery <= 2.5.3 - Authenticated (Author+) Server-Side Request Forgerydfactory Responsive Lightbox & Gallery
- CVE-2025-12174Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug Updatewpwax Directorist: AI-Powered Business Directory, Listings…
- CVE-2025-12878FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wfop_phone Shortcodeamans2k FunnelKit – Funnel Builder for WooCommerce Checkout
- CVE-2025-13054User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodecozmoslabs User Profile Builder – Beautiful User Registrati…
- CVE-2025-12710Pet-Manager – Petfinder <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via kwm-petfinder Shortcodekwmanagement Pet-Manager – Petfinder
- CVE-2025-12751WSChat – WordPress Live Chat <= 3.1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Resetelextensions WSChat – WordPress Live Chat
- CVE-2025-12842Booking Plugin for WordPress Appointments – Time Slot <= 1.4.7 - Unauthenticated Arbitrary Email Sendingtimeslotplugins Time Slot – Booking and Appointment System
- CVE-2025-12426Quiz Maker <= 6.7.0.80 - Unauthenticated Sensitive Information Exposureays-pro Quiz Maker
- CVE-2025-12349Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Triggericegram Email Subscribers & Newsletters – Email Marketing,…
- CVE-2025-12427YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Renameyithemes YITH WooCommerce Wishlist
- CVE-2025-6251Royal Elementor Addons and Templates <= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site Scriptingwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2025-12770New User Approve <= 3.0.9 - Unauthenticated Sensitive Information Disclosure via Type Jugglingsaadiqbal New User Approve
- CVE-2025-12777YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Wishlist Token Disclosure to Wishlist Item Deletionyithemes YITH WooCommerce Wishlist
- CVE-2025-13225Tanium addressed an arbitrary file deletion vulnerability in TanOS.Tanium TanOS
- CVE-2025-51662A stored cross-site scripting (XSS) vulnerability is found in the text sharing feature of FileCodeBox version 2.2 and earlier.
- CVE-2025-63211Stored cross-site scripting vulnerability in bridgetech VBC Server & Element Manager, firmware versions 6.5.0-9 thru 6.5.0-10, allows attack
- CVE-2025-63212GatesAir Flexiva-LX devices on firmware 1.0.13 and 2.0, including models LX100, LX300, LX600, and LX1000, expose sensitive session identifie
- CVE-2025-63214An issue was discovered in bridgetech VBC Server & Element Manager, firmware version 6.5.0-10 , 6.5.0-9, allowing unauthorized attackers to
- CVE-2025-63243A reflected cross-site scripting (XSS) vulnerability exists in the password change functionality of Pixeon WebLaudos 25.1 (01).
- CVE-2025-63878Github Restaurant Website Restoran v1.0 was discovered to contain a SQL injection vulnerability via the Contact Form page.
- CVE-2025-63879A reflected cross-site scripted (XSS) vulnerability in the /ecommerce/products.php component of E-commerce Project v1.0 and earlier allows a