# CVEs published 2025-11-23 32 CVEs were published on November 23, 2025: 0 critical, 10 high. Days are UTC. - [CVE-2025-13573](https://cve.now/CVE-2025-13573.md): projectworlds can pass malicious payloads add\_book.php unrestricted upload (CVSS 5.3, projectworlds can pass malicious payloads) - [CVE-2025-13572](https://cve.now/CVE-2025-13572.md): projectworlds Advanced Library Management System delete\_admin.php sql injection (CVSS 6.9, projectworlds Advanced Library Management System) - [CVE-2025-12800](https://cve.now/CVE-2025-12800.md): WP Shortcodes Plugin — Shortcodes Ultimate \<= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery (CVSS 6.4, gn\_themes WP Shortcodes Plugin — Shortcodes Ultimate) - [CVE-2025-13571](https://cve.now/CVE-2025-13571.md): code-projects Simple Food Ordering System listorder.php sql injection (CVSS 5.3, code-projects Simple Food Ordering System) - [CVE-2025-13570](https://cve.now/CVE-2025-13570.md): itsourcecode COVID Tracking System page sql injection (CVSS 5.3, itsourcecode COVID Tracking System) - [CVE-2025-13569](https://cve.now/CVE-2025-13569.md): itsourcecode COVID Tracking System page sql injection (CVSS 5.3, itsourcecode COVID Tracking System) - [CVE-2025-13568](https://cve.now/CVE-2025-13568.md): itsourcecode COVID Tracking System page sql injection (CVSS 5.3, itsourcecode COVID Tracking System) - [CVE-2025-13567](https://cve.now/CVE-2025-13567.md): itsourcecode COVID Tracking System page sql injection (CVSS 5.3, itsourcecode COVID Tracking System) - [CVE-2025-13566](https://cve.now/CVE-2025-13566.md): jarun nnn nnn.c run\_cmd\_as\_plugin double free (CVSS 4.8, jarun nnn) - [CVE-2025-13565](https://cve.now/CVE-2025-13565.md): SourceCodester Inventory Management System resetPassword.php password recovery (CVSS 6.9, SourceCodester Inventory Management System) - [CVE-2025-13564](https://cve.now/CVE-2025-13564.md): SourceCodester Pre-School Management System FilehelperController.php removefile denial of service (CVSS 5.3, SourceCodester Pre-School Management System) - [CVE-2025-13562](https://cve.now/CVE-2025-13562.md): D-Link DIR-852 gena.cgi command injection (CVSS 6.9, D-Link DIR-852) - [CVE-2025-13561](https://cve.now/CVE-2025-13561.md): SourceCodester Company Website CMS index.php sql injection (CVSS 6.9, SourceCodester Company Website CMS) - [CVE-2025-54515](https://cve.now/CVE-2025-54515.md): The Secure Flag passed to Versal™ Adaptive SoC’s Trusted Firmware for Cortex®-A processors (TF-A) for Arm’s Power State Coordination Interfa (CVSS 1.0, AMD Versal™ Adaptive SoC Devices · AMD Versal™ RF Series +6) - [CVE-2025-48507](https://cve.now/CVE-2025-48507.md): The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors acces (CVSS 8.6, AMD Kria™ SOM · AMD Zynq™ UltraScale+™ MPSoCs +1) - [CVE-2025-13560](https://cve.now/CVE-2025-13560.md): SourceCodester Company Website CMS reset-password.php sql injection (CVSS 6.9, SourceCodester Company Website CMS) - [CVE-2025-13557](https://cve.now/CVE-2025-13557.md): Campcodes Online Polling System registeracc.php sql injection (CVSS 6.9, Campcodes Online Polling System) - [CVE-2024-21923](https://cve.now/CVE-2024-21923.md): Incorrect default permissions in AMD StoreMI™ could allow an attacker to achieve privilege escalation potentially resulting in arbitrary cod (CVSS 7.3, AMD StoreMI™) - [CVE-2024-21922](https://cve.now/CVE-2024-21922.md): A DLL hijacking vulnerability in AMD StoreMI™ could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary co (CVSS 7.3, AMD StoreMI™) - [CVE-2025-13556](https://cve.now/CVE-2025-13556.md): Campcodes Online Polling System checklogin.php sql injection (CVSS 6.9, Campcodes Online Polling System) - [CVE-2025-13555](https://cve.now/CVE-2025-13555.md): Campcodes School File Management System Login index.php sql injection (CVSS 6.9, Campcodes School File Management System) - [CVE-2025-13554](https://cve.now/CVE-2025-13554.md): Campcodes Supplier Management System Login index.php sql injection (CVSS 6.9, Campcodes Supplier Management System) - [CVE-2025-13553](https://cve.now/CVE-2025-13553.md): D-Link DWR-M920 formPinManageSetup sub\_41C7FC buffer overflow (CVSS 8.7, D-Link DWR-M920) - [CVE-2025-13552](https://cve.now/CVE-2025-13552.md): D-Link DIR-822K/DWR-M920 formWlEncrypt buffer overflow (CVSS 8.7, D-Link DIR-822K · D-Link DWR-M920) - [CVE-2025-13551](https://cve.now/CVE-2025-13551.md): D-Link DIR-822K/DWR-M920 formWanConfigSetup buffer overflow (CVSS 8.7, D-Link DIR-822K · D-Link DWR-M920) - [CVE-2025-13550](https://cve.now/CVE-2025-13550.md): D-Link DIR-822K/DWR-M920 formVpnConfigSetup buffer overflow (CVSS 8.7, D-Link DIR-822K · D-Link DWR-M920) - [CVE-2025-13549](https://cve.now/CVE-2025-13549.md): D-Link DIR-822K formNtp sub\_455524 buffer overflow (CVSS 8.7, D-Link DIR-822K) - [CVE-2025-13548](https://cve.now/CVE-2025-13548.md): D-Link DIR-822K/DWR-M920 formFirewallAdv buffer overflow (CVSS 8.7, D-Link DIR-822K · D-Link DWR-M920) - [CVE-2025-13547](https://cve.now/CVE-2025-13547.md): D-Link DIR-822K/DWR-M920 formDdns memory corruption (CVSS 8.7, D-Link DIR-822K · D-Link DWR-M920) - [CVE-2025-13546](https://cve.now/CVE-2025-13546.md): ashraf-kabir travel-agency Search results.php sql injection (CVSS 5.3, ashraf-kabir travel-agency) - [CVE-2025-13545](https://cve.now/CVE-2025-13545.md): ashraf-kabir travel-agency index.php sql injection (CVSS 5.1, ashraf-kabir travel-agency) - [CVE-2025-13544](https://cve.now/CVE-2025-13544.md): ashraf-kabir travel-agency customer\_register.php unrestricted upload (CVSS 5.3, ashraf-kabir travel-agency) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-11-23 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.