# CVEs published 2025-11-27

55 CVEs were published on November 27, 2025: 9 critical, 11 high. Days are UTC.

- [CVE-2025-12421](https://cve.now/CVE-2025-12421.md): Account Takeover via Code Exchange Endpoint (CVSS 9.9, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2025-12559](https://cve.now/CVE-2025-12559.md): Information Disclosure in Common Teams API (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-12419](https://cve.now/CVE-2025-12419.md): Account takeover on OAuth/OpenID-enabled servers (CVSS 9.9, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2025-13758](https://cve.now/CVE-2025-13758.md): Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8. (CVSS 3.5, Devolutions Server)
- [CVE-2025-13757](https://cve.now/CVE-2025-13757.md): SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025. (CVSS 8.8, Devolutions Server)
- [CVE-2025-13765](https://cve.now/CVE-2025-13765.md): Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: be (CVSS 4.3, Devolutions Server)
- [CVE-2025-12140](https://cve.now/CVE-2025-12140.md): RCE in Wirtualna Uczelnia (CVSS 9.3, Simple SA Wirtualna Uczelnia)
- [CVE-2025-13692](https://cve.now/CVE-2025-13692.md): Unlimited Elements For Elementor and Unlimited Elements For Elementor (Premium) \<= 2.0 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload (CVSS 7.2, unitecms Unlimited Elements for Elementor)
- [CVE-2025-8890](https://cve.now/CVE-2025-8890.md): Authenticated RCE in SDMC NE6037 router (CVSS 9.3, SDMC NE6037)
- [CVE-2025-12971](https://cve.now/CVE-2025-12971.md): Folders \<= 3.1.5 - Incorrect Authorization to Authenticated (Contributor+) Folder Content Manipulation (CVSS 4.3, premio Folders – Unlimited Folders to Organize Media Librar…)
- [CVE-2025-54057](https://cve.now/CVE-2025-54057.md): Apache SkyWalking: Stored XSS vulnerability (CVSS 6.1, Apache Software Foundation Apache SkyWalking · org.apache.s…)
- [CVE-2025-59302](https://cve.now/CVE-2025-59302.md): Apache CloudStack: Potential remote code execution on Javascript engine defined rules (CVSS 4.7, Apache Software Foundation Apache CloudStack)
- [CVE-2025-59454](https://cve.now/CVE-2025-59454.md): Apache CloudStack: Lack of user permission validation leading to data leak for few APIs (CVSS 4.3, Apache Software Foundation Apache CloudStack)
- [CVE-2025-13742](https://cve.now/CVE-2025-13742.md): Limited HTML injection in emails (CVSS 2.4, pretix)
- [CVE-2025-10476](https://cve.now/CVE-2025-10476.md): WP Fastest Cache \<= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) DB Cleanup Actions (CVSS 4.3, emrevona WP Fastest Cache – WordPress Cache Plugin)
- [CVE-2025-59890](https://cve.now/CVE-2025-59890.md): Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead int (CVSS 7.3, Eaton Galileo Software)
- [CVE-2025-13381](https://cve.now/CVE-2025-13381.md): AI ChatBot with ChatGPT and Content Generator by AYS \<= 2.7.0 - Missing Authorization to Unauthenticated Media File Uploads (CVSS 5.3, ays-pro AI ChatBot with ChatGPT and Content Generator by AYS)
- [CVE-2025-12584](https://cve.now/CVE-2025-12584.md): Quick View for WooCommerce \<= 2.2.17 - Unauthenticated Private Product Disclosure (CVSS 5.3, shapedplugin Quick View for WooCommerce)
- [CVE-2025-13378](https://cve.now/CVE-2025-13378.md): AI ChatBot with ChatGPT and Content Generator by AYS \<= 2.7.0 - Unauthenticated Server-Side Request Forgery via 'pinecone\_url' Parameter (CVSS 6.5, ays-pro AI ChatBot with ChatGPT and Content Generator by AYS)
- [CVE-2025-59026](https://cve.now/CVE-2025-59026.md): Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. (CVSS 5.4, Open-Xchange OX App Suite)
- [CVE-2025-59025](https://cve.now/CVE-2025-59025.md): Malicious e-mail content can be used to execute script code. (CVSS 6.1, Open-Xchange OX App Suite)
- [CVE-2025-30190](https://cve.now/CVE-2025-30190.md): Malicious content at office documents can be used to inject script code when editing a document. (CVSS 5.4, Open-Xchange OX App Suite)
- [CVE-2025-30186](https://cve.now/CVE-2025-30186.md): Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. (CVSS 5.4, Open-Xchange OX App Suite)
- [CVE-2025-13536](https://cve.now/CVE-2025-13536.md): Blubrry PowerPress \<= 11.15.2 - Authenticated (Contributor+) Arbitrary File Upload via 'powerpress\_edit\_post' (CVSS 8.8, PowerPress Podcasting plugin by Blubrry)
- [CVE-2025-13157](https://cve.now/CVE-2025-13157.md): QODE Wishlist for WooCommerce \<= 1.2.7 - Unauthenticated Insecure Direct Object Reference to Wishlist Update (CVSS 5.3, qodeinteractive QODE Wishlist for WooCommerce)
- [CVE-2025-13441](https://cve.now/CVE-2025-13441.md): Hide Category by User Role for WooCommerce \<= 2.3.1 - Missing Authorization to Unauthenticated Cache Flushing (CVSS 5.3, themesupport Hide Category by User Role for WooCommerce)
- [CVE-2025-13143](https://cve.now/CVE-2025-13143.md): Poll, Survey & Quiz Maker Plugin by Opinion Stage \<= 19.12.0 - Cross-Site Request Forgery to Account Disconnection (CVSS 4.3, assafp Quiz, Poll & Survey Maker by Opinion Stage)
- [CVE-2025-13525](https://cve.now/CVE-2025-13525.md): WP Directory Kit \<= 1.4.5 - Reflected Cross-Site Scripting via 'order\_by' Parameter (CVSS 6.1, wpdirectorykit WP Directory Kit)
- [CVE-2025-12123](https://cve.now/CVE-2025-12123.md): Customer Reviews Collector for WooCommerce \<= 4.6.1 - Reflected Cross-Site Scripting (CVSS 6.1, trustindex Customer Reviews Collector for WooCommerce)
- [CVE-2025-12185](https://cve.now/CVE-2025-12185.md): StaffList \<= 3.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, era404 StaffList)
- [CVE-2025-12758](https://cve.now/CVE-2025-12758.md): Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the (CVSS 8.7, validator · org.webjars.npm:validator)
- [CVE-2025-13539](https://cve.now/CVE-2025-13539.md): FindAll Membership \<= 1.0.4 - Authentication Bypass via Social Login (CVSS 9.8, Elated Themes FindAll Membership)
- [CVE-2025-13540](https://cve.now/CVE-2025-13540.md): Tiare Membership \<= 1.2 - Unauthenticated Privilege Escalation (CVSS 9.8, Qode Interactive Tiare Membership)
- [CVE-2025-13680](https://cve.now/CVE-2025-13680.md): Tiger \<= 101.2.1 - Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, DirectoryThemes Tiger)
- [CVE-2025-12151](https://cve.now/CVE-2025-12151.md): Simple Folio \<= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, presstigers Simple Folio)
- [CVE-2025-13675](https://cve.now/CVE-2025-13675.md): Tiger \<= 101.2.1 - Unauthenticated Privilege Escalation (CVSS 9.8, DirectoryThemes Tiger)
- [CVE-2025-7820](https://cve.now/CVE-2025-7820.md): SKT PayPal for WooCommerce \<= 1.4 - Unauthenticated Payment Bypass (CVSS 7.5, sonalsinha21 SKT PayPal for WooCommerce)
- [CVE-2025-13538](https://cve.now/CVE-2025-13538.md): FindAll Listing \<= 1.0.5 - Unauthenticated Privilege Escalation (CVSS 9.8, Elated Themes FindAll Listing)
- [CVE-2025-3784](https://cve.now/CVE-2025-3784.md): Information Disclosure Vulnerability in GX Works2 (CVSS 5.5, Mitsubishi Electric GX Works2)
- [CVE-2025-13762](https://cve.now/CVE-2025-13762.md): Client-Side Denial of Service Condition in SWS Extension prior to version 2.2.30305 (CVSS 4.8, CyberArk Secure Web Sessions Extension)
- [CVE-2025-12713](https://cve.now/CVE-2025-12713.md): Soundslides \<= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via soundslides Shortcode (CVSS 6.4, wpoets Soundslides)
- [CVE-2025-12670](https://cve.now/CVE-2025-12670.md): wp-twitpic \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, realin wp-twitpic)
- [CVE-2025-12649](https://cve.now/CVE-2025-12649.md): SortTable Post \<= 4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, sscovil SortTable Post)
- [CVE-2025-12579](https://cve.now/CVE-2025-12579.md): Reuters Direct \<= 3.0.0 - Missing Authorization to Unauthenticated Settings Reset (CVSS 5.3, rnags Reuters Direct)
- [CVE-2025-12712](https://cve.now/CVE-2025-12712.md): Shouty \<= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shouty Shortcode Attributes (CVSS 6.4, gungorbudak Shouty)
- [CVE-2025-12666](https://cve.now/CVE-2025-12666.md): Google Drive upload and download link \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, oscaruh Google Drive upload and download link)
- [CVE-2025-12578](https://cve.now/CVE-2025-12578.md): Reuters Direct \<= 3.0.0 - Cross-Site Request Forgery to Settings Reset (CVSS 4.3, rnags Reuters Direct)
- [CVE-2025-66314](https://cve.now/CVE-2025-66314.md): Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Properly Constrained by AC (CVSS 7.5, ZTE ElasticNet UME R32)
- [CVE-2024-5540](https://cve.now/CVE-2024-5540.md): ALC WebCTRL Carrier i-Vu Reflected Cross-Site Scripting (CVSS 6.9, Automated Logic WebCTRL · Carrier i-Vu)
- [CVE-2024-5539](https://cve.now/CVE-2024-5539.md): ALC WebCTRL Carrier i-Vu Access Control Bypass (CVSS 9.2, Automated Logic WebCTRL · Carrier i-Vu)
- [CVE-2025-0657](https://cve.now/CVE-2025-0657.md): ALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-range (CVSS 8.8, Automated Logic WebCtrl · Automated Logic Gen5 Controlle… +1)
- [CVE-2025-0658](https://cve.now/CVE-2025-0658.md): Automated Logic and Carrier Zone Controllers malformed packets denial of service (CVSS 8.7, Automated Logic Zone Controllers · Carrier Zone Controllers)
- [CVE-2025-66359](https://cve.now/CVE-2025-66359.md): An issue was discovered in Logpoint before 7.7.0. (CVSS 8.5, Logpoint SIEM)
- [CVE-2025-66360](https://cve.now/CVE-2025-66360.md): An issue was discovered in Logpoint before 7.7.0. (CVSS 6.9, Logpoint SIEM)
- [CVE-2025-66361](https://cve.now/CVE-2025-66361.md): An issue was discovered in Logpoint before 7.7.0. (CVSS 6.9, Logpoint SIEM)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.