CVEs published November 23, 2025
32 CVEs were published on November 23, 2025: 0 critical, 10 high.
- Published
- 32
- Critical
- 0
- High
- 10
- Medium
- 21
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- D-Link DIR-822K · D-Link DWR-M920
- 5
- itsourcecode COVID Tracking System
- 4
- ashraf-kabir travel-agency
- 3
- AMD StoreMI™
- 2
- Campcodes Online Polling System
- 2
- SourceCodester Company Website CMS
- 2
- AMD Kria™ SOM · AMD Zynq™ UltraScale+™ MPSoCs +1
- 1
- AMD Versal™ Adaptive SoC Devices · AMD Versal™ RF Series +6
- 1
- Campcodes School File Management System
- 1
- Campcodes Supplier Management System
- 1
High 10
- CVE-2025-48507The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors accesAMD Kria™ SOM · AMD Zynq™ UltraScale+™ MPSoCs +1
- CVE-2024-21923Incorrect default permissions in AMD StoreMI™ could allow an attacker to achieve privilege escalation potentially resulting in arbitrary codAMD StoreMI™
- CVE-2024-21922A DLL hijacking vulnerability in AMD StoreMI™ could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary coAMD StoreMI™
- CVE-2025-13553D-Link DWR-M920 formPinManageSetup sub_41C7FC buffer overflowD-Link DWR-M920
- CVE-2025-13552D-Link DIR-822K/DWR-M920 formWlEncrypt buffer overflowD-Link DIR-822K · D-Link DWR-M920
- CVE-2025-13551D-Link DIR-822K/DWR-M920 formWanConfigSetup buffer overflowD-Link DIR-822K · D-Link DWR-M920
- CVE-2025-13550D-Link DIR-822K/DWR-M920 formVpnConfigSetup buffer overflowD-Link DIR-822K · D-Link DWR-M920
- CVE-2025-13549D-Link DIR-822K formNtp sub_455524 buffer overflowD-Link DIR-822K
- CVE-2025-13548D-Link DIR-822K/DWR-M920 formFirewallAdv buffer overflowD-Link DIR-822K · D-Link DWR-M920
- CVE-2025-13547D-Link DIR-822K/DWR-M920 formDdns memory corruptionD-Link DIR-822K · D-Link DWR-M920
Medium, low and unrated 22
- CVE-2025-13573projectworlds can pass malicious payloads add_book.php unrestricted uploadprojectworlds can pass malicious payloads
- CVE-2025-13572projectworlds Advanced Library Management System delete_admin.php sql injectionprojectworlds Advanced Library Management System
- CVE-2025-12800WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgerygn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- CVE-2025-13571code-projects Simple Food Ordering System listorder.php sql injectioncode-projects Simple Food Ordering System
- CVE-2025-13570itsourcecode COVID Tracking System page sql injectionitsourcecode COVID Tracking System
- CVE-2025-13569itsourcecode COVID Tracking System page sql injectionitsourcecode COVID Tracking System
- CVE-2025-13568itsourcecode COVID Tracking System page sql injectionitsourcecode COVID Tracking System
- CVE-2025-13567itsourcecode COVID Tracking System page sql injectionitsourcecode COVID Tracking System
- CVE-2025-13566jarun nnn nnn.c run_cmd_as_plugin double freejarun nnn
- CVE-2025-13565SourceCodester Inventory Management System resetPassword.php password recoverySourceCodester Inventory Management System
- CVE-2025-13564SourceCodester Pre-School Management System FilehelperController.php removefile denial of serviceSourceCodester Pre-School Management System
- CVE-2025-13562D-Link DIR-852 gena.cgi command injectionD-Link DIR-852
- CVE-2025-13561SourceCodester Company Website CMS index.php sql injectionSourceCodester Company Website CMS
- CVE-2025-54515The Secure Flag passed to Versal™ Adaptive SoC’s Trusted Firmware for Cortex®-A processors (TF-A) for Arm’s Power State Coordination InterfaAMD Versal™ Adaptive SoC Devices · AMD Versal™ RF Series +6
- CVE-2025-13560SourceCodester Company Website CMS reset-password.php sql injectionSourceCodester Company Website CMS
- CVE-2025-13557Campcodes Online Polling System registeracc.php sql injectionCampcodes Online Polling System
- CVE-2025-13556Campcodes Online Polling System checklogin.php sql injectionCampcodes Online Polling System
- CVE-2025-13555Campcodes School File Management System Login index.php sql injectionCampcodes School File Management System
- CVE-2025-13554Campcodes Supplier Management System Login index.php sql injectionCampcodes Supplier Management System
- CVE-2025-13546ashraf-kabir travel-agency Search results.php sql injectionashraf-kabir travel-agency
- CVE-2025-13545ashraf-kabir travel-agency index.php sql injectionashraf-kabir travel-agency
- CVE-2025-13544ashraf-kabir travel-agency customer_register.php unrestricted uploadashraf-kabir travel-agency