# CVEs published 2025-11-19

125 CVEs were published on November 19, 2025: 17 critical, 46 high. Days are UTC.

- [CVE-2025-13423](https://cve.now/CVE-2025-13423.md): Campcodes Retro Basketball Shoes Online Store admin\_product.php unrestricted upload (CVSS 5.1, Campcodes Retro Basketball Shoes Online Store)
- [CVE-2025-13422](https://cve.now/CVE-2025-13422.md): freeprojectscodes Sports Club Management System change\_s\_pwd.php sql injection (CVSS 6.9, freeprojectscodes Sports Club Management System)
- [CVE-2025-13421](https://cve.now/CVE-2025-13421.md): itsourcecode Human Resource Management System NoticeStore.php sql injection (CVSS 6.9, itsourcecode Human Resource Management System)
- [CVE-2025-13420](https://cve.now/CVE-2025-13420.md): itsourcecode Human Resource Management System EventStore.php sql injection (CVSS 6.9, itsourcecode Human Resource Management System)
- [CVE-2025-13415](https://cve.now/CVE-2025-13415.md): icret EasyImages SVG Image upload.php cross site scripting (CVSS 5.1, icret EasyImages)
- [CVE-2025-11001](https://cve.now/CVE-2025-11001.md): 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability (CVSS 7.0, 7-Zip)
- [CVE-2025-11884](https://cve.now/CVE-2025-11884.md): Cross-site Scripting vulnerability discovered in OpenText™ Universal Discovery and CMDB (CVSS 2.3, OpenText™ uCMDB)
- [CVE-2025-13412](https://cve.now/CVE-2025-13412.md): Campcodes Retro Basketball Shoes Online Store admin\_running.php cross site scripting (CVSS 4.8, Campcodes Retro Basketball Shoes Online Store)
- [CVE-2025-13147](https://cve.now/CVE-2025-13147.md): External Service Interaction (DNS) (CVSS 5.3, Progress MOVEit Transfer)
- [CVE-2025-47914](https://cve.now/CVE-2025-47914.md): Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent (CVSS 5.3, golang.org/x/crypto/ssh/agent · golang.org/x/crypto)
- [CVE-2025-58181](https://cve.now/CVE-2025-58181.md): Unbounded memory consumption in golang.org/x/crypto/ssh (CVSS 5.3, golang.org/x/crypto/ssh · golang.org/x/crypto)
- [CVE-2025-13411](https://cve.now/CVE-2025-13411.md): Campcodes Retro Basketball Shoes Online Store admin\_football.php unrestricted upload (CVSS 5.1, Campcodes Retro Basketball Shoes Online Store)
- [CVE-2025-13410](https://cve.now/CVE-2025-13410.md): Campcodes Retro Basketball Shoes Online Store receipt.php sql injection (CVSS 6.9, Campcodes Retro Basketball Shoes Online Store)
- [CVE-2025-36371](https://cve.now/CVE-2025-36371.md): IBM i Information Disclosure (CVSS 6.5, IBM i)
- [CVE-2025-65103](https://cve.now/CVE-2025-65103.md): OpenSTAManager has an authenticated SQL Injection vulnerability in API via 'display' parameter (CVSS 8.8, devcode-it openstamanager · devcode-it/openstamanager)
- [CVE-2025-65094](https://cve.now/CVE-2025-65094.md): WBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation (IDOR) (CVSS 8.7, WBCE\_CMS)
- [CVE-2025-65100](https://cve.now/CVE-2025-65100.md): Security Snapshot May Use Unintended Timestamp When Only ISAR\_APT\_SNAPSHOT\_DATE Is Set (CVSS 6.9, ilbers isar)
- [CVE-2025-64759](https://cve.now/CVE-2025-64759.md): Homarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG Upload (CVSS 8.1, homarr-labs homarr)
- [CVE-2025-13316](https://cve.now/CVE-2025-13316.md): Hard-coded encryption keys in Twonky Server (CVSS 8.2, Lynxtechnology Twonky Server)
- [CVE-2025-13315](https://cve.now/CVE-2025-13315.md): Unauthenticated log access in Twonky Server (CVSS 9.3, Lynxtechnology Twonky Server)
- [CVE-2025-65089](https://cve.now/CVE-2025-65089.md): XWiki view file macro: User can view content of office file without view rights on the attachment (CVSS 6.8, xwikisas xwiki-pro-macros · com.xwiki.pro:xwiki-pro-macros-…)
- [CVE-2025-65095](https://cve.now/CVE-2025-65095.md): Lookyloo is vulnerable due to improper user input sanitization (CVSS 9.4, lookyloo)
- [CVE-2025-65099](https://cve.now/CVE-2025-65099.md): Claude Code vulnerable to command execution prior to startup trust dialog (CVSS 7.7, anthropics claude-code · @anthropic-ai/claude-code)
- [CVE-2025-65026](https://cve.now/CVE-2025-65026.md): esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript (CVSS 6.1, esm-dev esm.sh · github.com/esm-dev/esm.sh)
- [CVE-2025-65025](https://cve.now/CVE-2025-65025.md): esm.sh CDN service has arbitrary file write via tarslip (CVSS 8.2, esm-dev esm.sh · github.com/esm-dev/esm.sh)
- [CVE-2025-65034](https://cve.now/CVE-2025-65034.md): Rallly Improper Authorization Allows Reopening of Any Finalized Poll via Public pollId (CVSS 8.1, lukevella rallly)
- [CVE-2025-65033](https://cve.now/CVE-2025-65033.md): Rallly Broken Authorization: Any User Can Pause or Resume Any Poll via Poll ID Manipulation (CVSS 8.1, lukevella rallly)
- [CVE-2025-65032](https://cve.now/CVE-2025-65032.md): Rallly Has an IDOR Vulnerability in Participant Rename Function Allows Unauthorized Modification of Other Users’ Names (CVSS 6.5, lukevella rallly)
- [CVE-2025-65031](https://cve.now/CVE-2025-65031.md): Rallly Improper Authorization in Comment Endpoint Allows User Impersonation (CVSS 6.5, lukevella rallly)
- [CVE-2025-65030](https://cve.now/CVE-2025-65030.md): Rallly Improper Authorization in Comment Deletion Endpoint Allows Unauthorized Comment Removal (CVSS 7.1, lukevella rallly)
- [CVE-2025-65029](https://cve.now/CVE-2025-65029.md): Rallly Has an IDOR Vulnerability in Participant Deletion Endpoint Allows Unauthorized Removal of Poll Participants (CVSS 8.1, lukevella rallly)
- [CVE-2025-65021](https://cve.now/CVE-2025-65021.md): Rallly Has Unauthorized Poll Finalization via Insecure Direct Object Reference (IDOR) (CVSS 9.1, lukevella rallly)
- [CVE-2025-65020](https://cve.now/CVE-2025-65020.md): Rallly Has Unauthorized Poll Duplication via Insecure Direct Object Reference (IDOR) (CVSS 6.5, lukevella rallly)
- [CVE-2025-65028](https://cve.now/CVE-2025-65028.md): Rallly Has an IDOR Vulnerability in Vote Update Endpoint Allows Unauthorized Manipulation of Participant Votes (CVSS 6.5, lukevella rallly)
- [CVE-2025-64708](https://cve.now/CVE-2025-64708.md): authentik invitation expiry is delayed by at least 5 minutes (CVSS 5.8, goauthentik authentik · goauthentik.io)
- [CVE-2025-64521](https://cve.now/CVE-2025-64521.md): authentik deactivated service accounts can authenticate to OAuth (CVSS 4.8, goauthentik authentik · authentik-client +1)
- [CVE-2025-13400](https://cve.now/CVE-2025-13400.md): Tenda CH22 WrlExtraGet formWrlExtraGet buffer overflow (CVSS 8.7, Tenda CH22)
- [CVE-2025-12743](https://cve.now/CVE-2025-12743.md): SQL Injection in Looker Project Generation Endpoint Allows Access to Internal MySQL Database (CVSS 6.0, Google Cloud Looker)
- [CVE-2025-64765](https://cve.now/CVE-2025-64765.md): Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values (CVSS 6.9, withastro astro · astro)
- [CVE-2025-64764](https://cve.now/CVE-2025-64764.md): Astro is vulnerable to Reflected XSS via the server islands feature (CVSS 7.1, withastro astro · astro)
- [CVE-2025-65019](https://cve.now/CVE-2025-65019.md): Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /\_image endpoint (CVSS 5.4, withastro astro · astro)
- [CVE-2025-64757](https://cve.now/CVE-2025-64757.md): Astro Development Server is Vulnerable to Arbitrary Local File Read (CVSS 3.5, withastro astro · astro)
- [CVE-2025-34335](https://cve.now/CVE-2025-34335.md): AudioCodes Fax/IVR Appliance \<= 2.6.23 Authenticated Command Injection via ActivateLicense.php (CVSS 8.7, AudioCodes Limited AudioCodes Fax/IVR Appliance)
- [CVE-2025-34334](https://cve.now/CVE-2025-34334.md): AudioCodes Fax/IVR Appliance \<= 2.6.23 Authenticated Command Injection via TestFax.php & LPE (CVSS 8.7, AudioCodes Limited AudioCodes Fax/IVR Appliance)
- [CVE-2025-34332](https://cve.now/CVE-2025-34332.md): AudioCodes Fax/IVR Appliance \<= 2.6.23 Insecure Service Control Scripts LPE (CVSS 8.5, AudioCodes Limited AudioCodes Fax/IVR Appliance)
- [CVE-2025-34329](https://cve.now/CVE-2025-34329.md): AudioCodes Fax/IVR Appliance \<= 2.6.23 Unauthenticated Backup Upload RCE via ajaxBackupUploadFile.php (CVSS 9.3, AudioCodes Limited AudioCodes Fax/IVR Appliance)
- [CVE-2025-34331](https://cve.now/CVE-2025-34331.md): AudioCodes Fax/IVR Appliance \<= 2.6.23 Unauthenticated File Read via download.php (CVSS 8.7, AudioCodes Limited AudioCodes Fax/IVR Appliance)
- [CVE-2025-34328](https://cve.now/CVE-2025-34328.md): AudioCodes Fax/IVR Appliance \<= 2.6.23 Unauthenticated File Upload RCE via ajaxScript.php (CVSS 9.3, AudioCodes Limited AudioCodes Fax/IVR Appliance)
- [CVE-2025-34330](https://cve.now/CVE-2025-34330.md): AudioCodes Fax/IVR Appliance \<= 2.6.23 Unauthenticated Prompt File Upload via ajaxPromptUploadFile.php (CVSS 6.9, AudioCodes Limited AudioCodes Fax/IVR Appliance)
- [CVE-2025-34333](https://cve.now/CVE-2025-34333.md): AudioCodes Fax/IVR Appliance \<= 2.6.23 World-Writable Webroot LPE (CVSS 8.5, AudioCodes Limited AudioCodes Fax/IVR Appliance)
- [CVE-2025-34336](https://cve.now/CVE-2025-34336.md): eGovFramework \<= 4.3.1 Unauthenticated File Upload via Web Editor Image Upload Endpoints (CVSS 6.9, eGovFramework/egovframe-common-components)
- [CVE-2025-34337](https://cve.now/CVE-2025-34337.md): eGovFramework \<= 4.3.1 Unauthenticated Encryption Oracle via Web Editor Image Upload Endpoints (CVSS 8.7, eGovFramework/egovframe-common-components)
- [CVE-2025-12766](https://cve.now/CVE-2025-12766.md): Insecure Direct Object Reference (IDOR) vulnerability in the Management Console of affected versions of BlackBerry AtHoc. (CVSS 5.0, BlackBerry® AtHoc®)
- [CVE-2025-65022](https://cve.now/CVE-2025-65022.md): i-Educar Authenticated Time-based SQL Injection in \`agenda.php\` (CVSS 7.2, portabilis i-educar)
- [CVE-2025-65023](https://cve.now/CVE-2025-65023.md): i-Educar Authenticated Time-based SQL Injection in \`funcionario\_vinculo\_cad.php\` (CVSS 7.2, portabilis i-educar)
- [CVE-2025-65024](https://cve.now/CVE-2025-65024.md): i-Educar Authenticated Time-based SQL Injection in \`agenda\_admin\_cad.php\` (CVSS 7.2, portabilis i-educar)
- [CVE-2025-10703](https://cve.now/CVE-2025-10703.md): Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect (CVSS 8.6, Progress DataDirect Connect for JDBC for Amazon Redshif… +30)
- [CVE-2025-10702](https://cve.now/CVE-2025-10702.md): Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect (CVSS 8.6, Progress DataDirect Connect for JDBC for Amazon Redshif… +30)
- [CVE-2025-13397](https://cve.now/CVE-2025-13397.md): mrubyc alloc.c mrbc\_raw\_realloc null pointer dereference (CVSS 4.8, mrubyc)
- [CVE-2025-13396](https://cve.now/CVE-2025-13396.md): code-projects Courier Management System add-office.php sql injection (CVSS 5.3, code-projects Courier Management System)
- [CVE-2025-11963](https://cve.now/CVE-2025-11963.md): Reflected XSS in Saysis's StarCities (CVSS 5.4, Saysis Computer Systems Trade Ltd. StarCities)
- [CVE-2025-0421](https://cve.now/CVE-2025-0421.md): iFrame Injection in Mikrogrup's Shopside (CVSS 4.7, Shopside Software Technologies Shopside)
- [CVE-2024-8528](https://cve.now/CVE-2024-8528.md): ALC WebCTRL Carrier i-Vu Reflected XSS due to unsanitized parameter (CVSS 5.4, Automated Logic WebCtrl · Carrier i-Vu)
- [CVE-2024-8527](https://cve.now/CVE-2024-8527.md): ALC WebCTRL Carrier i-Vu Open Redirect via URL parameter (CVSS 8.6, Automated Logic WebCtrl · Carrier i-Vu)
- [CVE-2025-12592](https://cve.now/CVE-2025-12592.md): Use of default login credentials in Legacy Vivotek Devices (CVSS 9.3, Vivotek Affected device model numbers are FD7131-VVTK,FD713…)
- [CVE-2025-10437](https://cve.now/CVE-2025-10437.md): SQLi in Exagate's Webpack Management System (CVSS 9.8, Eksagate Electronic Engineering and Computer Industry Trade…)
- [CVE-2025-13395](https://cve.now/CVE-2025-13395.md): codehub666 94list function.php login sql injection (CVSS 6.9, codehub666 94list)
- [CVE-2025-64408](https://cve.now/CVE-2025-64408.md): Apache Causeway: Java deserialization vulnerability to authenticated attackers (CVSS 6.3, Apache Software Foundation Apache Causeway · org.apache.… +3)
- [CVE-2025-12472](https://cve.now/CVE-2025-12472.md): Remote Code Execution in Looker due to Improperly Validated Directory Deletion (CVSS 7.1, Google Cloud Looker)
- [CVE-2025-58412](https://cve.now/CVE-2025-58412.md): A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 thr (CVSS 4.2, Fortinet FortiADC)
- [CVE-2025-11230](https://cve.now/CVE-2025-11230.md): Denial of service vulnerability in HAProxy mjson library (CVSS 7.5, HAProxy Technologies HAProxy Community Edition)
- [CVE-2025-11446](https://cve.now/CVE-2025-11446.md): Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials (CVSS 7.3, upKeeper Solutions upKeeper Manager)
- [CVE-2025-13035](https://cve.now/CVE-2025-13035.md): Code Snippets \<= 3.9.1 - Authenticated (Contributor+) PHP Code Injection via extract() and PHP Filter Chains (CVSS 8.0, codesnippetspro Code Snippets)
- [CVE-2025-13206](https://cve.now/CVE-2025-13206.md): GiveWP - Donation Plugin and Fundraising Platform \<= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name' (CVSS 7.2, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2025-12484](https://cve.now/CVE-2025-12484.md): Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers \<= 1.12.19 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, smub Giveaways and Contests by RafflePress – Get More Websi…)
- [CVE-2025-11243](https://cve.now/CVE-2025-11243.md): Allocation of Resources Without Limits or Throttling in Shelly Pro 4PM (CVSS 8.3, Shelly Pro 4PM)
- [CVE-2025-12056](https://cve.now/CVE-2025-12056.md): Out-of-bounds Read in Shelly Pro 3EM (CVSS 8.3, Shelly Pro 3EM)
- [CVE-2025-12535](https://cve.now/CVE-2025-12535.md): SureForms \<= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution (CVSS 5.3, brainstormforce SureForms – Contact Form, Payment Form & Ot…)
- [CVE-2025-13085](https://cve.now/CVE-2025-13085.md): SiteSEO – SEO Simplified \<= 1.3.2 - Insecure Direct Object Reference to Sensitive Post Meta Disclosure (CVSS 4.3, softaculous SiteSEO – SEO Simplified)
- [CVE-2025-12057](https://cve.now/CVE-2025-12057.md): WavePlayer \< 3.8.0 - Unauthenticated Arbitrary File Upload (CVSS 9.8, WavePlayer)
- [CVE-2025-12814](https://cve.now/CVE-2025-12814.md): SiteSEO – SEO Simplified \<= 1.3.2 - Improper Authorization to Authenticated Settings Reset (CVSS 5.3, softaculous SiteSEO – SEO Simplified)
- [CVE-2025-12822](https://cve.now/CVE-2025-12822.md): WP Login and Register using JWT \<= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) API Key Exposure (CVSS 4.3, cyberlord92 WP Login and Register using JWT)
- [CVE-2025-12359](https://cve.now/CVE-2025-12359.md): Responsive Lightbox & Gallery \<= 2.5.3 - Authenticated (Author+) Server-Side Request Forgery (CVSS 5.4, dfactory Responsive Lightbox & Gallery)
- [CVE-2025-12174](https://cve.now/CVE-2025-12174.md): Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings \<= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug Update (CVSS 6.5, wpwax Directorist: AI-Powered Business Directory, Listings…)
- [CVE-2025-12878](https://cve.now/CVE-2025-12878.md): FunnelKit – Funnel Builder for WooCommerce Checkout \<= 3.13.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wfop\_phone Shortcode (CVSS 6.4, amans2k FunnelKit – Funnel Builder for WooCommerce Checkout)
- [CVE-2025-13145](https://cve.now/CVE-2025-13145.md): WP Import – Ultimate CSV XML Importer for WordPress \<= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import (CVSS 7.2, smackcoders WP Ultimate CSV Importer – Import CSV, XML & Ex…)
- [CVE-2025-12646](https://cve.now/CVE-2025-12646.md): Community Events \<= 1.5.4 - Unauthenticated SQL Injection (CVSS 7.5, jackdewey Community Events)
- [CVE-2025-13054](https://cve.now/CVE-2025-13054.md): User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor \<= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, cozmoslabs User Profile Builder – Beautiful User Registrati…)
- [CVE-2025-12710](https://cve.now/CVE-2025-12710.md): Pet-Manager – Petfinder \<= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via kwm-petfinder Shortcode (CVSS 6.4, kwmanagement Pet-Manager – Petfinder)
- [CVE-2025-12751](https://cve.now/CVE-2025-12751.md): WSChat – WordPress Live Chat \<= 3.1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset (CVSS 4.3, elextensions WSChat – WordPress Live Chat)
- [CVE-2025-12842](https://cve.now/CVE-2025-12842.md): Booking Plugin for WordPress Appointments – Time Slot \<= 1.4.7 - Unauthenticated Arbitrary Email Sending (CVSS 5.3, timeslotplugins Time Slot – Booking and Appointment System)
- [CVE-2025-12426](https://cve.now/CVE-2025-12426.md): Quiz Maker \<= 6.7.0.80 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, ays-pro Quiz Maker)
- [CVE-2025-12349](https://cve.now/CVE-2025-12349.md): Email Subscribers & Newsletters \<= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger (CVSS 5.3, icegram Email Subscribers & Newsletters – Email Marketing,…)
- [CVE-2025-12427](https://cve.now/CVE-2025-12427.md): YITH WooCommerce Wishlist \<= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Rename (CVSS 5.3, yithemes YITH WooCommerce Wishlist)
- [CVE-2025-6251](https://cve.now/CVE-2025-6251.md): Royal Elementor Addons and Templates \<= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2025-12770](https://cve.now/CVE-2025-12770.md): New User Approve \<= 3.0.9 - Unauthenticated Sensitive Information Disclosure via Type Juggling (CVSS 5.3, saadiqbal New User Approve)
- [CVE-2025-12777](https://cve.now/CVE-2025-12777.md): YITH WooCommerce Wishlist \<= 4.10.0 - Unauthenticated Wishlist Token Disclosure to Wishlist Item Deletion (CVSS 5.3, yithemes YITH WooCommerce Wishlist)
- [CVE-2025-13051](https://cve.now/CVE-2025-13051.md): Windows service used an uncontrolled search path element will cause unauthorized code execution with localsystem privileges (CVSS 9.3, ASUSTOR ABP and AES)
- [CVE-2025-13225](https://cve.now/CVE-2025-13225.md): Tanium addressed an arbitrary file deletion vulnerability in TanOS. (CVSS 5.6, Tanium TanOS)
- [CVE-2025-12852](https://cve.now/CVE-2025-12852.md): DLL Loading vulnerability in NEC Corporation RakurakuMusen Start EX All Verisons allows a attacker to manipulate the PC environment to cause (CVSS 8.4, NEC RakurakuMusen Start EX)
- [CVE-2025-51661](https://cve.now/CVE-2025-51661.md): A path Traversal vulnerability found in FileCodeBox v2.2 and earlier allows arbitrary file writes when application is configured to use loca (CVSS 7.5)
- [CVE-2025-51662](https://cve.now/CVE-2025-51662.md): A stored cross-site scripting (XSS) vulnerability is found in the text sharing feature of FileCodeBox version 2.2 and earlier. (CVSS 5.4)
- [CVE-2025-51663](https://cve.now/CVE-2025-51663.md): A vulnerability found in IPRateLimit implementation of FileCodeBox up to 2.2 allows remote attackers to bypass ip-based rate limit protectio (CVSS 7.5)
- [CVE-2025-63205](https://cve.now/CVE-2025-63205.md): An issue was discovered in bridgetech probes VB220 IP Network Probe,VB120 Embedded IP + RF Probe, VB330 High-Capacity Probe, VB440 ST 2110 P (CVSS 7.5)
- [CVE-2025-63206](https://cve.now/CVE-2025-63206.md): An authentication bypass issue was discovered in Dasan Switch DS2924 web based interface, firmware versions 1.01.18 and 1.02.00, allowing at (CVSS 9.8)
- [CVE-2025-63207](https://cve.now/CVE-2025-63207.md): The R.V.R Elettronica TEX product (firmware TEXL-000400, Web GUI TLAN-000400) is vulnerable to broken access control due to improper authent (CVSS 9.8)
- [CVE-2025-63208](https://cve.now/CVE-2025-63208.md): An issue was discovered in bridgetech VB288 Objective QoE Content Extractor, firmware version 5.6.0-8, allowing attackers to gain sensitive (CVSS 7.5)
- [CVE-2025-63209](https://cve.now/CVE-2025-63209.md): The ELCA Star Transmitter Remote Control firmware 1.25 for STAR150, BP1000, STAR300, STAR2000, STAR1000, STAR500, and possibly other models, (CVSS 7.5)
- [CVE-2025-63210](https://cve.now/CVE-2025-63210.md): The Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is vulnerable to an authentication bypass. (CVSS 9.8)
- [CVE-2025-63211](https://cve.now/CVE-2025-63211.md): Stored cross-site scripting vulnerability in bridgetech VBC Server & Element Manager, firmware versions 6.5.0-9 thru 6.5.0-10, allows attack (CVSS 6.1)
- [CVE-2025-63212](https://cve.now/CVE-2025-63212.md): GatesAir Flexiva-LX devices on firmware 1.0.13 and 2.0, including models LX100, LX300, LX600, and LX1000, expose sensitive session identifie (CVSS 6.5)
- [CVE-2025-63213](https://cve.now/CVE-2025-63213.md): The QVidium Opera11 device (firmware version 2.9.0-Ax4x-opera11) is vulnerable to Remote Code Execution (RCE) due to improper input validati (CVSS 9.8)
- [CVE-2025-63214](https://cve.now/CVE-2025-63214.md): An issue was discovered in bridgetech VBC Server & Element Manager, firmware version 6.5.0-10 , 6.5.0-9, allowing unauthorized attackers to (CVSS 6.5)
- [CVE-2025-63218](https://cve.now/CVE-2025-63218.md): The Axel Technology WOLF1MS and WOLF2MS devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing au (CVSS 9.8)
- [CVE-2025-63219](https://cve.now/CVE-2025-63219.md): The ITEL ISO FM SFN Adapter (firmware ISO2 2.0.0.0, WebServer 2.0) is vulnerable to session hijacking due to improper session management on (CVSS 7.5)
- [CVE-2025-63220](https://cve.now/CVE-2025-63220.md): The Sound4 FIRST web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package. (CVSS 7.2)
- [CVE-2025-63221](https://cve.now/CVE-2025-63221.md): The Axel Technology puma devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on (CVSS 9.1)
- [CVE-2025-63223](https://cve.now/CVE-2025-63223.md): The Axel Technology StreamerMAX MK II devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing auth (CVSS 9.8)
- [CVE-2025-63224](https://cve.now/CVE-2025-63224.md): The Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JWT validation across devices. (CVSS 10.0)
- [CVE-2025-63243](https://cve.now/CVE-2025-63243.md): A reflected cross-site scripting (XSS) vulnerability exists in the password change functionality of Pixeon WebLaudos 25.1 (01). (CVSS 4.6)
- [CVE-2025-63371](https://cve.now/CVE-2025-63371.md): Milos Paripovic OneCommander 3.102.0.0 is vulnerable to Directory Traversal. (CVSS 7.5)
- [CVE-2025-63719](https://cve.now/CVE-2025-63719.md): Campcodes Online Hospital Management System 1.0 is vulnerable to SQL Injection in /admin/index.php via the parameter username. (CVSS 7.3)
- [CVE-2025-63878](https://cve.now/CVE-2025-63878.md): Github Restaurant Website Restoran v1.0 was discovered to contain a SQL injection vulnerability via the Contact Form page. (CVSS 6.5)
- [CVE-2025-63879](https://cve.now/CVE-2025-63879.md): A reflected cross-site scripted (XSS) vulnerability in the /ecommerce/products.php component of E-commerce Project v1.0 and earlier allows a (CVSS 6.1)
- [CVE-2025-63932](https://cve.now/CVE-2025-63932.md): D-Link Router DIR-868L A1 FW106KRb01.bin has an unauthenticated remote code execution vulnerability in the cgibin binary. (CVSS 7.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.