CVEs published November 30, 2025
23 CVEs were published on November 30, 2025: 2 critical, 1 high.
- Published
- 23
- Critical
- 2
- High
- 1
- Medium
- 20
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- taosir WTCMS
- 3
- trytond
- 3
- Scada-LTS
- 2
- Tryton sao · tryton-sao
- 2
- yungifez Skuul School Management System · yungifez/skuul
- 2
- ZenTao
- 2
- 0x4m4 HexStrike AI
- 1
- Chanjet CRM
- 1
- codingWithElias School Management System
- 1
- deco-cx apps
- 1
Critical 2
High 1
Medium, low and unrated 20
- CVE-2025-13796deco-cx apps Parameter analyticsScript.ts AnalyticsScript server-side request forgerydeco-cx apps
- CVE-2025-13795codingWithElias School Management System Edit Student Info student-view.php cross site scriptingcodingWithElias School Management System
- CVE-2025-13793winston-dsouza Ecommerce-Website GET Parameter header_menu.php cross site scriptingwinston-dsouza Ecommerce-Website
- CVE-2025-13792Qualitor getResumo.php eval code injectionQualitor
- CVE-2025-13791Scada-LTS Project Import ZIPProjectManager.java Common.getHomeDir path traversalScada-LTS
- CVE-2025-13790Scada-LTS cross-site request forgeryScada-LTS
- CVE-2025-13789ZenTao model.php makeRequest server-side request forgeryZenTao
- CVE-2025-13788Chanjet CRM upgradeattribute.php sql injectionChanjet CRM
- CVE-2025-13787ZenTao File control.php delete privileges managementZenTao
- CVE-2025-13786taosir WTCMS index.php fetch code injectiontaosir WTCMS
- CVE-2025-13785yungifez Skuul School Management System Image profile information disclosureyungifez Skuul School Management System · yungifez/skuul
- CVE-2025-13784yungifez Skuul School Management System SVG File edit cross site scriptingyungifez Skuul School Management System · yungifez/skuul
- CVE-2025-13783taosir WTCMS CommentadminController CommentadminController.class.php delete sql injectiontaosir WTCMS
- CVE-2025-13782taosir WTCMS SlideController SlideController.class.php delete sql injectiontaosir WTCMS
- CVE-2025-66420Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment.Tryton sao · tryton-sao
- CVE-2025-66421Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values.Tryton sao · tryton-sao
- CVE-2025-66422Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information.trytond
- CVE-2025-66424Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export.trytond
- CVE-2025-66432In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date.Oxide Omicron
- CVE-2025-66433HTCondor Access Point before 25.3.1 allows an authenticated user to impersonate other users on the local machine by submitting a batch job.wisc HTCondor