# CVEs published 2025-11-25

119 CVEs were published on November 25, 2025: 19 critical, 35 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-65963](https://cve.now/CVE-2025-65963.md): CFiles Unauthorized Folder/ZIP Access in Public Spaces (CVSS 5.4, humhub cfiles)
- [CVE-2025-66019](https://cve.now/CVE-2025-66019.md): pypdf manipulated LZWDecode streams can exhaust RAM (CVSS 6.6, py-pdf pypdf · pypdf)
- [CVE-2025-65957](https://cve.now/CVE-2025-65957.md): Core Bot is Leaking Sensitive Credentials in Logs, Errors, and Messages (CVSS 8.8, Intercore-Productions Core-Bot)
- [CVE-2025-65956](https://cve.now/CVE-2025-65956.md): Formwork CMS Has a Stored Cross-Site Scripting (XSS) Vulnerability in Blog Tags (CVSS 6.5, getformwork formwork · getformwork/formwork)
- [CVE-2025-65953](https://cve.now/CVE-2025-65953.md): NanoMQ UAF of retain message due to invalid MQTTV5 properties (CVSS 6.0, nanomq)
- [CVE-2025-65952](https://cve.now/CVE-2025-65952.md): Console is vulnerable to path traversal regarding custom assets (CVSS 8.7, iiDk-the-actual Console)
- [CVE-2025-13597](https://cve.now/CVE-2025-13597.md): AI Feeds \<= 1.0.11 - Unauthenticated Arbitrary File Upload (CVSS 9.8, soportecibeles AI Feeds)
- [CVE-2025-13595](https://cve.now/CVE-2025-13595.md): CIBELES AI \<= 1.10.8 - Unauthenticated Arbitrary File Upload (CVSS 9.8, soportecibeles CIBELES AI)
- [CVE-2025-65942](https://cve.now/CVE-2025-65942.md): VictoriaMetrics Snappy Decoder DoS Vulnerability is Causing OOM (CVSS 2.7, VictoriaMetrics · github.com/VictoriaMetrics/VictoriaMetrics)
- [CVE-2025-64713](https://cve.now/CVE-2025-64713.md): WebAssembly Micro Runtime frame\_offset\_bottom array bounds overflow in fast Interpreter mode when handling GET\_GLOBAL(I32) followed by if opcode (CVSS 5.1, bytecodealliance wasm-micro-runtime)
- [CVE-2025-64704](https://cve.now/CVE-2025-64704.md): WebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instruction (CVSS 4.7, bytecodealliance wasm-micro-runtime)
- [CVE-2025-21621](https://cve.now/CVE-2025-21621.md): GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format (CVSS 6.1, geoserver · org.geoserver.web:gs-web-app +1)
- [CVE-2025-62703](https://cve.now/CVE-2025-62703.md): Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer (CVSS 8.8, fugue-project fugue · fugue)
- [CVE-2025-58360](https://cve.now/CVE-2025-58360.md): GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature (CVSS 8.2, KEV, geoserver · org.geoserver.web:gs-web-app +1)
- [CVE-2025-66017](https://cve.now/CVE-2025-66017.md): CGGMP21 presignatures can be used in the way that significantly reduces security (CVSS 8.2, LFDT-Lockness cggmp21 · cggmp21 +1)
- [CVE-2025-66016](https://cve.now/CVE-2025-66016.md): CGGMP24 is missing a check in the ZK proof used in CGGMP21 (CVSS 9.3, LFDT-Lockness cggmp21 · cggmp24 +1)
- [CVE-2025-9624](https://cve.now/CVE-2025-9624.md): OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS (CVSS 8.3, OpenSearch · org.opensearch:opensearch-common)
- [CVE-2025-65965](https://cve.now/CVE-2025-65965.md): Grype has a credential disclosure vulnerability in Grype JSON output (CVSS 8.2, anchore grype · github.com/anchore/grype)
- [CVE-2025-12816](https://cve.now/CVE-2025-12816.md): CVE-2025-12816 (CVSS 8.6, Digital Bazaar node-forge · Digital Bazaar forge +1)
- [CVE-2025-65961](https://cve.now/CVE-2025-65961.md): Contao is vulnerable to cross-site scripting in templates (CVSS 3.3, contao · contao/core-bundle)
- [CVE-2025-34350](https://cve.now/CVE-2025-34350.md): UnForm Server \< 10.1.15 Doc Flow Unauthenticated File Read (CVSS 8.7, Synergetic Data Systems UnForm Server)
- [CVE-2025-65960](https://cve.now/CVE-2025-65960.md): Contao is vulnerable to remote code execution in template closures (CVSS 6.6, contao · contao/core-bundle)
- [CVE-2025-33203](https://cve.now/CVE-2025-33203.md): NVIDIA NeMo Agent Toolkit UI for Web contains a vulnerability in the chat API endpoint where an attacker may cause a Server-Side Request For (CVSS 7.6, NVIDIA NeMo Agent ToolKit)
- [CVE-2025-33205](https://cve.now/CVE-2025-33205.md): NVIDIA NeMo framework contains a vulnerability in a predefined variable, where an attacker could cause inclusion of functionality from an un (CVSS 7.3, NVIDIA NeMo Framework)
- [CVE-2025-33204](https://cve.now/CVE-2025-33204.md): NVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP and LLM components, where malicious data created by an attacker (CVSS 7.8, NVIDIA NeMo Framework)
- [CVE-2025-33200](https://cve.now/CVE-2025-33200.md): NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. (CVSS 2.3, NVIDIA DGX Spark)
- [CVE-2025-33199](https://cve.now/CVE-2025-33199.md): NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause incorrect control flow behavior. (CVSS 3.2, NVIDIA DGX Spark)
- [CVE-2025-33198](https://cve.now/CVE-2025-33198.md): NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. (CVSS 3.3, NVIDIA DGX Spark)
- [CVE-2025-33197](https://cve.now/CVE-2025-33197.md): NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a NULL pointer dereference. (CVSS 4.3, NVIDIA DGX Spark)
- [CVE-2025-33196](https://cve.now/CVE-2025-33196.md): NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. (CVSS 4.4, NVIDIA DGX Spark)
- [CVE-2025-33195](https://cve.now/CVE-2025-33195.md): NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause unexpected memory buffer operations. (CVSS 4.4, NVIDIA DGX Spark)
- [CVE-2025-33194](https://cve.now/CVE-2025-33194.md): NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause improper processing of input data. (CVSS 5.7, NVIDIA DGX Spark)
- [CVE-2025-33193](https://cve.now/CVE-2025-33193.md): NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause improper validation of integrity. (CVSS 5.7, NVIDIA DGX Spark)
- [CVE-2025-33192](https://cve.now/CVE-2025-33192.md): NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause an arbitrary memory read. (CVSS 5.7, NVIDIA DGX Spark)
- [CVE-2025-33191](https://cve.now/CVE-2025-33191.md): NVIDIA DGX Spark GB10 contains a vulnerability in OSROOT firmware, where an attacker could cause an invalid memory read. (CVSS 5.7, NVIDIA DGX Spark)
- [CVE-2025-33190](https://cve.now/CVE-2025-33190.md): NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware where an attacker could cause an out-of-bound write. (CVSS 6.7, NVIDIA DGX Spark)
- [CVE-2025-33189](https://cve.now/CVE-2025-33189.md): NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause an out-of-bound write. (CVSS 7.8, NVIDIA DGX Spark)
- [CVE-2025-33188](https://cve.now/CVE-2025-33188.md): NVIDIA DGX Spark GB10 contains a vulnerability in hardware resources where an attacker could tamper with hardware controls. (CVSS 8.0, NVIDIA DGX Spark)
- [CVE-2025-33187](https://cve.now/CVE-2025-33187.md): NVIDIA DGX Spark GB10 contains a vulnerability in SROOT, where an attacker could use privileged access to gain access to SoC protected areas (CVSS 9.3, NVIDIA DGX Spark)
- [CVE-2025-65085](https://cve.now/CVE-2025-65085.md): Heap-based Buffer Overflow in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share (CVSS 8.4, Ashlar-Vellum Cobalt · Ashlar-Vellum Xenon +2)
- [CVE-2025-65084](https://cve.now/CVE-2025-65084.md): Out-of-bounds Write in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share (CVSS 8.4, Ashlar-Vellum Cobalt · Ashlar-Vellum Xenon +2)
- [CVE-2025-13483](https://cve.now/CVE-2025-13483.md): Missing Authentication for Critical Function in SiRcom SMART Alert (SiSA) (CVSS 8.8, SiRcom SMART Alert (SiSA)
- [CVE-2025-13467](https://cve.now/CVE-2025-13467.md): Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation (CVSS 5.5, Keycloak · Red Hat build of Keycloak +1)
- [CVE-2025-40890](https://cve.now/CVE-2025-40890.md): Stored Cross-Site Scripting (XSS) in Dashboards in Guardian/CMC before 25.4.0 (CVSS 5.8, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-0248](https://cve.now/CVE-2025-0248.md): HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability, (CVSS 8.1, HCL Software iNotes)
- [CVE-2025-36134](https://cve.now/CVE-2025-36134.md): IBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosure (CVSS 3.7, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2025-13502](https://cve.now/CVE-2025-13502.md): Webkit: webkitgtk / wpe webkit: out-of-bounds read and integer underflow vulnerability leading to dos (CVSS 7.5, The WebKitGTK Team webkitgtk · Red Hat Enterprise Linux… +1)
- [CVE-2025-59372](https://cve.now/CVE-2025-59372.md): A path traversal vulnerability has been identified in certain router models. (CVSS 6.9, ASUS Router)
- [CVE-2025-59371](https://cve.now/CVE-2025-59371.md): An authentication bypass vulnerability has been identified in the IFTTT integration feature. (CVSS 7.5, ASUS Router)
- [CVE-2025-59370](https://cve.now/CVE-2025-59370.md): A command injection vulnerability has been identified in bwdpi. (CVSS 7.5, ASUS Router)
- [CVE-2025-59369](https://cve.now/CVE-2025-59369.md): A SQL injection vulnerability has been identified in bwdpi. (CVSS 5.9, ASUS Router)
- [CVE-2025-59368](https://cve.now/CVE-2025-59368.md): An integer underflow vulnerability has been identified in Aicloud. (CVSS 6.0, ASUS Router)
- [CVE-2025-12003](https://cve.now/CVE-2025-12003.md): A path traversal vulnerability has been identified in WebDAV, which may allow unauthenticated remote attackers to impact the integrity of th (CVSS 8.2, ASUS Router)
- [CVE-2025-12587](https://cve.now/CVE-2025-12587.md): Peer Publish \<= 1.0 - Cross-Site Request Forgery (CVSS 4.3, webgarh Peer Publish)
- [CVE-2025-13385](https://cve.now/CVE-2025-13385.md): Bookme \<= 4.2 - Authenticated (Admin+) SQL Injection via 'filter\[status\]' Parameter (CVSS 4.9, bylancer Bookme – Free Online Appointment Booking and Sched…)
- [CVE-2025-12634](https://cve.now/CVE-2025-12634.md): Refund Request for WooCommerce \<= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Update (CVSS 4.3, sunarc Refund Request for WooCommerce)
- [CVE-2025-13370](https://cve.now/CVE-2025-13370.md): ProjectList \<= 0.3.0 - Authenticated (Editor+) SQL Injection via 'id' Parameter (CVSS 4.9, ov3rkll ProjectList)
- [CVE-2025-13311](https://cve.now/CVE-2025-13311.md): Just Highlight \<= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Highlight Color' Setting (CVSS 4.4, sigalitam Just Highlight)
- [CVE-2025-12645](https://cve.now/CVE-2025-12645.md): Inline frame – Iframe \<= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, karthiksg Inline frame – Iframe)
- [CVE-2025-13405](https://cve.now/CVE-2025-13405.md): Ace Post Type Builder \<= 1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Custom Taxonomy Deletion via 'taxonomy' Parameter (CVSS 5.3, buywptemplates Ace Post Type Builder)
- [CVE-2025-13380](https://cve.now/CVE-2025-13380.md): AI Engine for WordPress: ChatGPT, GPT Content Generator \<= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read (CVSS 6.5, liquidthemes AI Engine for WordPress: ChatGPT, GPT Content…)
- [CVE-2025-13382](https://cve.now/CVE-2025-13382.md): Frontend File Manager Plugin \<= 23.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary File Renaming (CVSS 4.3, nmedia Frontend File Manager Plugin)
- [CVE-2025-13404](https://cve.now/CVE-2025-13404.md): atec Duplicate Page & Post \<= 1.2.20 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication and Data Exposure (CVSS 5.3, docjojo atec Duplicate Page & Post)
- [CVE-2025-12025](https://cve.now/CVE-2025-12025.md): YouTube Subscribe \<= 3.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Title and Channel ID (CVSS 4.4, mahabubs YouTube Subscribe)
- [CVE-2025-13386](https://cve.now/CVE-2025-13386.md): Social Images Widget \<= 2.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion (CVSS 5.3, lyrathemes Social Images Widget)
- [CVE-2025-12525](https://cve.now/CVE-2025-12525.md): Locker Content \<= 1.0.0 - Unauthenticated Information Exposure (CVSS 5.3, appglut Locker Content)
- [CVE-2025-13389](https://cve.now/CVE-2025-13389.md): Admin and Customer Messages After Order for WooCommerce: OrderConvo \<= 14 - Missing Authorization to Unauthenticated Information Disclosure (CVSS 5.3, nmedia Admin and Customer Messages After Order for WooComme…)
- [CVE-2025-13376](https://cve.now/CVE-2025-13376.md): ProjectList \<= 0.3.0 - Authenticated (Editor+) Arbitrary File Upload (CVSS 7.2, ov3rkll ProjectList)
- [CVE-2025-12040](https://cve.now/CVE-2025-12040.md): Wishlist for WooCommerce \<= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation (CVSS 6.5, themehunk Wishlist for WooCommerce)
- [CVE-2025-12586](https://cve.now/CVE-2025-12586.md): Conditional Maintenance Mode for WordPress \<= 1.0.0 - Cross-Site Request Forgery (CVSS 4.3, evolurise Conditionnal Maintenance Mode for WordPress)
- [CVE-2025-13452](https://cve.now/CVE-2025-13452.md): Admin and Customer Messages After Order for WooCommerce: OrderConvo \<= 14 - Missing Authorization to Unauthenticated User Impersonation in Order Messages (CVSS 4.3, nmedia Admin and Customer Messages After Order for WooComme…)
- [CVE-2025-12032](https://cve.now/CVE-2025-12032.md): ZWeb - Social Mobile \<= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, vithanhlam Zweb Social Mobile – Ứng Dụng Nút Gọi Mobile)
- [CVE-2025-13383](https://cve.now/CVE-2025-13383.md): Job Board by BestWebSoft \<= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via $\_GET Array Storage (CVSS 6.1, bestweblayout Job Board by BestWebSoft)
- [CVE-2025-13414](https://cve.now/CVE-2025-13414.md): Chamber Dashboard Business Directory \<= 3.3.11 - Missing Authorization to Unauthenticated Business Information Export (CVSS 5.3, gwendydd Chamber Dashboard Business Directory)
- [CVE-2025-12043](https://cve.now/CVE-2025-12043.md): Autochat Automatic Conversation \<= 1.1.9 - Missing Authorization to Unauthenticated Settings Update (CVSS 5.3, Autochat Automatic Conversation)
- [CVE-2025-59365](https://cve.now/CVE-2025-59365.md): A stack buffer overflow vulnerability has been identified in certain router models. (CVSS 6.9, ASUS Router)
- [CVE-2025-59366](https://cve.now/CVE-2025-59366.md): An authentication-bypass vulnerability exists in AiCloud. (CVSS 9.2, ASUS Router)
- [CVE-2025-64693](https://cve.now/CVE-2025-64693.md): Security Point (Windows) of MaLion and MaLionCloud contains a heap-based buffer overflow vulnerability in processing Content-Length. (CVSS 9.8, Intercom Security Point (Windows) of MaLion · Intercom Secu…)
- [CVE-2025-62691](https://cve.now/CVE-2025-62691.md): Security Point (Windows) of MaLion and MaLionCloud contains a stack-based buffer overflow vulnerability in processing HTTP headers. (CVSS 9.8, Intercom Security Point (Windows) of MaLion · Intercom Secu…)
- [CVE-2025-59485](https://cve.now/CVE-2025-59485.md): Incorrect default permissions issue exists in Security Point (Windows) of MaLion prior to Ver.5.3.4. (CVSS 3.3, Intercom Security Point (Windows) of MaLion)
- [CVE-2025-12742](https://cve.now/CVE-2025-12742.md): Remote Code Execution in Looker via Teradata JDBC Driver (CVSS 7.5, Google Cloud Looker)
- [CVE-2025-13644](https://cve.now/CVE-2025-13644.md): MongoDB may be susceptible to Invariant Failure due to batched delete (CVSS 6.5, MongoDB Server)
- [CVE-2025-13643](https://cve.now/CVE-2025-13643.md): MongoDB Server may allow queries to be terminated by unauthorized users (CVSS 3.1, MongoDB Server)
- [CVE-2025-12893](https://cve.now/CVE-2025-12893.md): Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server (CVSS 4.2, MongoDB Server)
- [CVE-2025-13507](https://cve.now/CVE-2025-13507.md): Time-series operations may cause internal BSON size limit to be exceed (CVSS 7.1, MongoDB Server)
- [CVE-2025-13068](https://cve.now/CVE-2025-13068.md): Telegram Bot & Channel \<= 4.1 - Unauthenticated Stored Cross-Site Scripting via Telegram Username (CVSS 7.2, milmor Telegram Bot & Channel)
- [CVE-2025-13559](https://cve.now/CVE-2025-13559.md): EduKart Pro \<= 1.0.3 - Unauthenticated Privilege Escalation (CVSS 9.8, venusweb EduKart Pro)
- [CVE-2025-13558](https://cve.now/CVE-2025-13558.md): Blog2Social \<= 8.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Trashing (CVSS 5.4, pr-gateway Blog2Social: Social Media Auto Post & Scheduler)
- [CVE-2025-64730](https://cve.now/CVE-2025-64730.md): Cross-site scripting vulnerability exists in SNC-CX600W all versions. (CVSS 5.2, Sony SNC-CX600W)
- [CVE-2025-62497](https://cve.now/CVE-2025-62497.md): Cross-site request forgery vulnerability exists in SNC-CX600W versions prior to Ver.2.8.0. (CVSS 3.1, Sony SNC-CX600W)
- [CVE-2025-64304](https://cve.now/CVE-2025-64304.md): "FOD" App uses hard-coded cryptographic keys, which may allow a local unauthenticated attacker to retrieve the cryptographic keys. (CVSS 4.0, Fuji Television Network "FOD" App for Android · Fuji Televi…)
- [CVE-2025-10646](https://cve.now/CVE-2025-10646.md): Search Exclude \<= 2.5.7 – Missing Authorization to Authenticated (Contributor+) Search Settings Modification via REST API (CVSS 4.3, quadlayers Search Exclude)
- [CVE-2025-6389](https://cve.now/CVE-2025-6389.md): Sneeit Framework \<= 8.3 - Unauthenticated Remote Code Execution in sneeit\_articles\_pagination\_callback (CVSS 9.8, Sneeit Framework)
- [CVE-2025-59373](https://cve.now/CVE-2025-59373.md): A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. (CVSS 8.5, MyASUS)
- [CVE-2025-65951](https://cve.now/CVE-2025-65951.md): Inside Track / Entropy Derby Timelock Encryption Bypassed via Pre-Computed VDF Output Leakage (CVSS 8.7, mescuwa entropy-derby)
- [CVE-2025-65944](https://cve.now/CVE-2025-65944.md): Sentry-Javascript deals with leaked sensitive headers when \`sendDefaultPii\` is set to \`true\` (CVSS 5.1, getsentry sentry-javascript · @sentry/node +11)
- [CVE-2025-64761](https://cve.now/CVE-2025-64761.md): OpenBao Privileged Operator Identity Group Root Escalation (CVSS 7.5, openbao · github.com/openbao/openbao)
- [CVE-2025-9803](https://cve.now/CVE-2025-9803.md): Improper Authentication in lunary-ai/lunary (CVSS 9.3, lunary-ai/lunary)
- [CVE-2025-51741](https://cve.now/CVE-2025-51741.md): An issue was discovered in Veal98 Echo Open-Source Community System 2.2 thru 2.3 allowing an unauthenticated attacker to cause the server to (CVSS 7.5)
- [CVE-2025-51742](https://cve.now/CVE-2025-51742.md): An issue was discovered in jishenghua JSH\_ERP 2.3.1. (CVSS 9.8)
- [CVE-2025-51743](https://cve.now/CVE-2025-51743.md): An issue was discovered in jishenghua JSH\_ERP 2.3.1. (CVSS 9.8)
- [CVE-2025-51744](https://cve.now/CVE-2025-51744.md): An issue was discovered in jishenghua JSH\_ERP 2.3.1. (CVSS 9.8)
- [CVE-2025-51745](https://cve.now/CVE-2025-51745.md): An issue was discovered in jishenghua JSH\_ERP 2.3.1. (CVSS 9.8)
- [CVE-2025-51746](https://cve.now/CVE-2025-51746.md): An issue was discovered in jishenghua JSH\_ERP 2.3.1. (CVSS 9.8)
- [CVE-2025-60739](https://cve.now/CVE-2025-60739.md): Cross Site Request Forgery (CSRF) vulnerability in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before, Logic Version v6.00 - 20 (CVSS 9.6)
- [CVE-2025-61167](https://cve.now/CVE-2025-61167.md): SIGB PMB v8.0.1.14 was discovered to contain multiple SQL injection vulnerabilities in the /opac\_css/ajax\_selector.php component via the id (CVSS 6.5)
- [CVE-2025-61168](https://cve.now/CVE-2025-61168.md): An issue in the cms\_rest.php component of SIGB PMB v8.0.1.14 allows attackers to execute arbitrary code via unserializing an arbitrary file. (CVSS 9.8)
- [CVE-2025-63729](https://cve.now/CVE-2025-63729.md): An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO\_3.7L\_3.1.02-240517 allowing attackers to exctract the SSL Private Key, CA Certif (CVSS 9.0)
- [CVE-2025-63735](https://cve.now/CVE-2025-63735.md): A reflected Cross site scripting (XSS) vulnerability in Ruckus Unleashed 200.13.6.1.319 via the name parameter to the the captive-portal end (CVSS 6.1)
- [CVE-2025-64049](https://cve.now/CVE-2025-64049.md): A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbi (CVSS 4.8, redaxo/source)
- [CVE-2025-64050](https://cve.now/CVE-2025-64050.md): A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administra (CVSS 7.2, redaxo/source)
- [CVE-2025-64061](https://cve.now/CVE-2025-64061.md): Primakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerable to unauthorized data exposure due to deficient access control mechanisms. (CVSS 4.3)
- [CVE-2025-64062](https://cve.now/CVE-2025-64062.md): The Primakon Pi Portal 1.0.18 /api/V2/pp\_users?email endpoint is used for user data filtering but lacks proper server-side validation agains (CVSS 8.8)
- [CVE-2025-64063](https://cve.now/CVE-2025-64063.md): Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests. (CVSS 9.8)
- [CVE-2025-64064](https://cve.now/CVE-2025-64064.md): Primakon Pi Portal 1.0.18 /api/v2/pp\_users endpoint fails to adequately check user permissions before processing a PATCH request to modify t (CVSS 8.8)
- [CVE-2025-64065](https://cve.now/CVE-2025-64065.md): The Primakon Pi Portal 1.0.18 API /api/V2/pp\_udfv\_admin endpoint, fails to perform necessary server-side validation. (CVSS 8.8)
- [CVE-2025-64066](https://cve.now/CVE-2025-64066.md): Primakon Pi Portal 1.0.18 REST /api/v2/user/register endpoint suffers from a Broken Access Control vulnerability. (CVSS 8.6)
- [CVE-2025-64067](https://cve.now/CVE-2025-64067.md): Primakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered data (e.g., user profiles, project records) f (CVSS 5.3)
- [CVE-2025-65647](https://cve.now/CVE-2025-65647.md): Insecure Direct Object Reference (IDOR) in the Track order function in PHPGURUKUL Online Shopping Portal 2.1 allows information disclosure v (CVSS 4.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.