# CVEs published 2025-11-30

23 CVEs were published on November 30, 2025: 2 critical, 1 high. Days are UTC.

- [CVE-2025-13796](https://cve.now/CVE-2025-13796.md): deco-cx apps Parameter analyticsScript.ts AnalyticsScript server-side request forgery (CVSS 5.3, deco-cx apps)
- [CVE-2025-13795](https://cve.now/CVE-2025-13795.md): codingWithElias School Management System Edit Student Info student-view.php cross site scripting (CVSS 4.8, codingWithElias School Management System)
- [CVE-2025-35028](https://cve.now/CVE-2025-35028.md): HexStrike AI MCP Server Command Injection (CVSS 9.1, 0x4m4 HexStrike AI)
- [CVE-2025-13793](https://cve.now/CVE-2025-13793.md): winston-dsouza Ecommerce-Website GET Parameter header\_menu.php cross site scripting (CVSS 5.3, winston-dsouza Ecommerce-Website)
- [CVE-2025-13792](https://cve.now/CVE-2025-13792.md): Qualitor getResumo.php eval code injection (CVSS 6.9, Qualitor)
- [CVE-2025-13791](https://cve.now/CVE-2025-13791.md): Scada-LTS Project Import ZIPProjectManager.java Common.getHomeDir path traversal (CVSS 5.3, Scada-LTS)
- [CVE-2025-13790](https://cve.now/CVE-2025-13790.md): Scada-LTS cross-site request forgery (CVSS 5.3, Scada-LTS)
- [CVE-2025-13789](https://cve.now/CVE-2025-13789.md): ZenTao model.php makeRequest server-side request forgery (CVSS 5.3, ZenTao)
- [CVE-2025-13788](https://cve.now/CVE-2025-13788.md): Chanjet CRM upgradeattribute.php sql injection (CVSS 6.9, Chanjet CRM)
- [CVE-2025-13787](https://cve.now/CVE-2025-13787.md): ZenTao File control.php delete privileges management (CVSS 5.3, ZenTao)
- [CVE-2025-13786](https://cve.now/CVE-2025-13786.md): taosir WTCMS index.php fetch code injection (CVSS 6.9, taosir WTCMS)
- [CVE-2025-13785](https://cve.now/CVE-2025-13785.md): yungifez Skuul School Management System Image profile information disclosure (CVSS 5.3, yungifez Skuul School Management System · yungifez/skuul)
- [CVE-2025-13784](https://cve.now/CVE-2025-13784.md): yungifez Skuul School Management System SVG File edit cross site scripting (CVSS 4.8, yungifez Skuul School Management System · yungifez/skuul)
- [CVE-2025-13783](https://cve.now/CVE-2025-13783.md): taosir WTCMS CommentadminController CommentadminController.class.php delete sql injection (CVSS 5.3, taosir WTCMS)
- [CVE-2025-13782](https://cve.now/CVE-2025-13782.md): taosir WTCMS SlideController SlideController.class.php delete sql injection (CVSS 6.9, taosir WTCMS)
- [CVE-2025-13615](https://cve.now/CVE-2025-13615.md): StreamTube Core \<= 4.78 - Unauthenticated Arbitrary User Password Change (CVSS 9.8, phpface StreamTube Core)
- [CVE-2025-66420](https://cve.now/CVE-2025-66420.md): Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. (CVSS 5.4, Tryton sao · tryton-sao)
- [CVE-2025-66421](https://cve.now/CVE-2025-66421.md): Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. (CVSS 5.4, Tryton sao · tryton-sao)
- [CVE-2025-66422](https://cve.now/CVE-2025-66422.md): Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. (CVSS 4.3, trytond)
- [CVE-2025-66423](https://cve.now/CVE-2025-66423.md): Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. (CVSS 7.1, trytond)
- [CVE-2025-66424](https://cve.now/CVE-2025-66424.md): Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. (CVSS 6.5, trytond)
- [CVE-2025-66432](https://cve.now/CVE-2025-66432.md): In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date. (CVSS 5.0, Oxide Omicron)
- [CVE-2025-66433](https://cve.now/CVE-2025-66433.md): HTCondor Access Point before 25.3.1 allows an authenticated user to impersonate other users on the local machine by submitting a batch job. (CVSS 4.2, wisc HTCondor)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-11-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.