Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: November 2025

164 records · 11 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2025-11174
    21Monitor

    Document Library Lite <= 1.1.6 - Missing Authorization to Sensitive Information Exposure

    MediumCVSS 5.3Proof of conceptEPSS 0%

    barn2media · document library liteNov 1, 2025

  • CVE-2025-11833
    57Plan

    Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Lo

    CriticalCVSS 9.8Proof of conceptEPSS 61%

    saadiqbal · post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile appNov 1, 2025

  • CVE-2025-11740
    26Monitor

    wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection

    MediumCVSS 6.5Proof of conceptEPSS 0%

    tomdever · wpforo forumNov 1, 2025

  • CVE-2025-12137
    19Monitor

    Import WP – Export and Import CSV and XML files to WordPress <= 2.14.16 - Authenticated (Admin+) Arbitrary File Read

    MediumCVSS 4.9Proof of conceptEPSS 0%

    jcollings · import wp – export and import csv and xml files to wordpressNov 1, 2025

  • CVE-2025-60503
    34Monitor

    A cross-site scripting (XSS) vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted i

    HighCVSS 8.7Proof of conceptEPSS 0%

    ultimatefosters · ultimateposNov 3, 2025

  • CVE-2025-11953
    97Now

    Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

    CriticalCVSS 9.8KEVWeaponizedEPSS 93%

    react-native-community · react native community cliNov 3, 2025

  • CVE-2025-50363
    21Monitor

    Phpgurukul Maid Hiring Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in /maid-hiring.php va the name field.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    phpgurukul · maid hiring management systemNov 3, 2025

  • CVE-2025-63441
    29Monitor

    Open Source Social Network (OSSN) 8.6 is vulnerable to Cross Site Scripting (XSS) via the parameter param` at endpoint u/administrator/frien

    HighCVSS 7.3Proof of conceptEPSS 0%

    opensource-socialnetwork · open source social networkNov 3, 2025

  • CVE-2025-43426
    22Monitor

    A logging issue was addressed with improved data redaction.

    MediumCVSS 5.5Proof of conceptEPSS 0%

    apple · ipadosNov 3, 2025

  • CVE-2025-43407
    31Monitor

    This issue was addressed with improved entitlements.

    HighCVSS 7.8Proof of conceptEPSS 0%

    apple · ipadosNov 4, 2025

  • CVE-2025-43504
    19Monitor

    A buffer overflow was addressed with improved bounds checking.

    MediumCVSS 4.9Proof of conceptEPSS 0%

    apple · xcodeNov 4, 2025

  • CVE-2025-20730
    26Monitor

    In preloader, there is a possible escalation of privilege due to an insecure default value.

    MediumCVSS 6.7Proof of conceptEPSS 0%

    linuxfoundation · yoctoNov 4, 2025

  • CVE-2024-56426
    30Monitor

    An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2

    HighCVSS 7.5Proof of conceptEPSS 0%

    samsung · exynos 1080 firmwareNov 4, 2025

  • CVE-2025-62507
    32Monitor

    Redis: Bug in XACKDEL may lead to stack overflow and potential RCE

    HighCVSS 7.7Proof of conceptEPSS 6%

    redis · redisNov 4, 2025

  • CVE-2025-62369
    28Monitor

    Xibo CMS: Remote Code Execution through module templates

    HighCVSS 7.2Proof of conceptEPSS 0%

    xibosignage · xiboNov 4, 2025

  • CVE-2025-12735
    40Plan

    The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    jorenbroekema · javascript expression evaluatorNov 5, 2025

  • CVE-2025-12197
    35Monitor

    The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s

    HighCVSS 7.5No exploitEPSS 18%

    stellarwp · the events calendarNov 5, 2025

  • CVE-2025-11749
    61This week

    AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation

    CriticalCVSS 9.8WeaponizedEPSS 74%

    tigroumeow · ai engine – the chatbot, ai framework & mcp for wordpressNov 5, 2025

  • CVE-2025-12139
    31Monitor

    File Manager for Google Drive – Integrate Google Drive with WordPress <= 1.5.3 - Unauthenticated Sensitive Information Exposure

    HighCVSS 7.5Proof of conceptEPSS 2%

    princeahmed · file manager for google drive – integrate google driveNov 5, 2025

  • CVE-2025-12674
    39Monitor

    KiotViet Sync <= 1.8.5 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    mykiot · kiotviet syncNov 5, 2025

  • CVE-2025-64458
    31Monitor

    Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

    HighCVSS 7.5Proof of conceptEPSS 1%

    djangoproject · djangoNov 5, 2025

  • CVE-2025-64459
    42Plan

    Potential SQL injection via _connector keyword argument in QuerySet and Q objects

    CriticalCVSS 9.1Proof of conceptEPSS 19%

    djangoproject · djangoNov 5, 2025

  • CVE-2025-61304
    40Plan

    OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    dynatrace · activegate ping extensionNov 5, 2025

  • CVE-2025-59716
    21Monitor

    ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint.

    MediumCVSS 5.3Proof of conceptEPSS 0%

    owncloud · guestsNov 5, 2025

  • CVE-2025-10713
    36Monitor

    XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration

    CriticalCVSS 9.1No exploitEPSS 0%

    wso2 · api control planeNov 5, 2025

  • CVE-2023-43000
    66This week

    A use-after-free issue was addressed with improved memory management.

    HighCVSS 8.8KEVWeaponizedEPSS 4%

    apple · safariNov 5, 2025

  • CVE-2025-63585
    26Monitor

    OSSN (Open Source Social Network) 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter.

    MediumCVSS 6.5Proof of conceptEPSS 0%

    opensource-socialnetwork · open source social networkNov 5, 2025

  • CVE-2025-20343
    30Monitor

    Cisco Identity Services Engine Radius Suppression Denial of Service Vulnerability

    HighCVSS 7.5Proof of conceptEPSS 0%

    cisco · identity services engineNov 5, 2025

  • CVE-2025-43990
    31Monitor

    Dell Command Monitor (DCM), versions prior to 10.12.3.28, contains an Execution with Unnecessary Privileges vulnerability.

    HighCVSS 7.8Proof of conceptEPSS 0%

    dell · command monitorNov 5, 2025

  • CVE-2025-62039
    30Monitor

    WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.6.6 - Sensitive Data Exposure vulnerability

    HighCVSS 7.5Proof of conceptEPSS 1%

    ays pro · ai chatbot with chatgpt and content generator by aysNov 6, 2025

  • CVE-2025-63307
    32Monitor

    alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS).

    HighCVSS 8.1Proof of conceptEPSS 0%

    alexusmai · laravel file managerNov 6, 2025

  • CVE-2025-63588
    28Monitor

    An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and ex

    HighCVSS 7.1Proof of conceptEPSS 0%

    cmsimple-xh · cmsimple xhNov 6, 2025

  • CVE-2025-63589
    28Monitor

    A reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or encod

    HighCVSS 7.1Proof of conceptEPSS 0%

    cmsimple-xh · cmsimple xhNov 6, 2025

  • CVE-2025-27918
    39Monitor

    An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS

    CriticalCVSS 9.8No exploitEPSS 0%

    anydesk · anydeskNov 6, 2025

  • CVE-2025-60188
    31Monitor

    WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerability

    HighCVSS 7.5Proof of conceptEPSS 3%

    vito peleg · atarimNov 6, 2025

  • CVE-2025-62950
    17Monitor

    WordPress Contest Gallery plugin <= 28.0.0 - Cross Site Request Forgery (CSRF) vulnerability

    MediumCVSS 4.3Proof of conceptEPSS 0%

    wasiliy strecker / contestgallery developer · contest galleryNov 6, 2025

  • CVE-2025-6325
    39Monitor

    WordPress King Addons for Elementor plugin <= 51.1.36 - Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    kingaddons.com · king addons for elementorNov 6, 2025

  • CVE-2025-31133
    29Monitor

    runc container escape via "masked path" abuse due to mount race conditions

    HighCVSS 7.3Proof of conceptEPSS 0%

    linuxfoundation · runcNov 6, 2025

  • CVE-2025-12490
    40Plan

    Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 16%

    netgate · pfsenseNov 6, 2025

  • CVE-2025-52881
    29Monitor

    runc: LSM labels can be bypassed with malicious config using dummy procfs files

    HighCVSS 7.3Proof of conceptEPSS 0%

    linuxfoundation · runcNov 6, 2025

  • CVE-2025-64328
    89Now

    FreePBX Administration GUI is Vulnerable to Authenticated Command Injection

    HighCVSS 8.6KEVWeaponizedEPSS 84%

    sangoma · filestoreNov 7, 2025

  • CVE-2025-34299
    60This week

    Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.3WeaponizedEPSS 72%

    monstaftp · monsta ftpNov 7, 2025

  • CVE-2025-60574
    30Monitor

    A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117.

    HighCVSS 7.5Proof of conceptEPSS 0%

    webair · tquadra cmsNov 7, 2025

  • CVE-2025-63420
    16Monitor

    CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling pe

    MediumCVSS 4.1Proof of conceptEPSS 0%

    crushftp · crushftpNov 7, 2025

  • CVE-2025-12890
    26Monitor

    Bluetooth: peripheral: Invalid handling of malformed connection request

    MediumCVSS 6.5Proof of conceptEPSS 0%

    zephyrproject-rtos · zephyrNov 7, 2025

  • CVE-2025-10230
    52Plan

    Samba: command injection in wins server hook script

    CriticalCVSS 10.0Proof of conceptEPSS 39%

    red hat · red hat enterprise linux 10Nov 7, 2025

  • CVE-2025-64495
    21Monitor

    Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

    MediumCVSS 5.4Proof of conceptEPSS 0%

    openwebui · open webuiNov 7, 2025

  • CVE-2025-11452
    30Monitor

    Asgaros Forum <= 3.1.0 - Unauthenticated SQL Injection

    HighCVSS 7.5Proof of conceptEPSS 1%

    asgaros · asgaros forumNov 8, 2025

  • CVE-2025-12399
    28Monitor

    Alex Reservations: Smart Restaurant Booking <= 2.2.3 - Authenticated (Admin+) Arbitrary File Upload

    HighCVSS 7.2Proof of conceptEPSS 0%

    alexreservations · alex reservations: smart restaurant bookingNov 8, 2025

  • CVE-2025-12916
    10Monitor

    Sangfor Operation and Maintenance Security Management System Frontend portal_login command injection

    LowCVSS 2.1Proof of conceptEPSS 5%

    sangfor · operation and maintenance security management systemNov 9, 2025

  • CVE-2025-12480
    95Now

    Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even

    CriticalCVSS 9.1KEVWeaponizedEPSS 95%

    gladinet · triofoxNov 10, 2025

  • CVE-2025-56503
    26Monitor

    An issue in Sublime HQ Pty Ltd Sublime Text 4 4200 allows authenticated attackers with low-level privileges to escalate privileges to Admini

    MediumCVSS 6.5Proof of conceptEPSS 0%

    Nov 10, 2025

  • CVE-2025-60876
    26Monitor

    BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the re

    MediumCVSS 6.5Proof of conceptEPSS 0%

    busybox · busyboxNov 10, 2025

  • CVE-2025-63296
    26Monitor

    KERUI K259 5MP Wi-Fi / Tuya Smart Security Camera firmware v33.53.87 contains a code execution vulnerability in its boot/update logic: durin

    MediumCVSS 6.5Proof of conceptEPSS 0%

    keruistore · kerui k259 firmwareNov 10, 2025

  • CVE-2025-62780
    21Monitor

    changedetection.io vulnerable to stored XSS in Watch update via API

    MediumCVSS 5.4Proof of conceptEPSS 0%

    changedetection · changedetectionNov 10, 2025

  • CVE-2025-64512
    31Monitor

    pdfminer.six vulnerable to Arbitrary Code Execution via Crafted PDF Input

    HighCVSS 7.8Proof of conceptEPSS 0%

    pdfminer · pdfminer.sixNov 10, 2025

  • CVE-2025-64513
    37Monitor

    Milvus Proxy has Critical Authentication Bypass Vulnerability

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    milvus-io · milvusNov 10, 2025

  • CVE-2021-4462
    38Monitor

    Employee Records System v1.0 Arbitrary File Upload RCE

    CriticalCVSS 9.3Proof of conceptEPSS 3%

    skittles · employee records systemNov 10, 2025

  • CVE-2025-12433
    17Monitor

    Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform out of bounds memory access

    MediumCVSS 4.3Proof of conceptEPSS 0%

    google · chromeNov 10, 2025

  • CVE-2025-11307
    36Monitor

    WP Google Maps < 9.0.48 - Unauthenticated Stored XSS

    HighCVSS 8.8Proof of conceptEPSS 1%

    unknown · wp go maps (formerly wp google maps)Nov 11, 2025

  • CVE-2025-11170
    39Monitor

    WP移行専用プラグイン for CPI <= 1.0.2 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    kddiwebcommunications · wp移行専用プラグイン for cpiNov 11, 2025

  • CVE-2025-11986
    21Monitor

    Crypto Tool <= 2.22 - Unauthenticated Information Exposure via Global Authentication State

    MediumCVSS 5.3Proof of conceptEPSS 0%

    odude · crypto toolNov 11, 2025

  • CVE-2025-11988
    21Monitor

    Crypto Tool <= 2.22 - Missing Authentication to Unauthenticated Limited File Deletion

    MediumCVSS 5.3Proof of conceptEPSS 0%

    odude · crypto toolNov 11, 2025

  • CVE-2025-9223
    36Monitor

    Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to

    HighCVSS 8.8Proof of conceptEPSS 4%

    zohocorp · manageengine applications managerNov 11, 2025

  • CVE-2025-12539
    40Plan

    TNC Toolbox: Web Performance <= 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    leopardhost · tnc toolbox: web performanceNov 11, 2025

  • CVE-2025-31931
    21Monitor

    Uncontrolled search path for the Instrumentation and Tracing Technology API (ITT API) software before version 3.25.4 within Ring 3: User App

    MediumCVSS 5.4Proof of conceptEPSS 0%

    Nov 11, 2025

  • CVE-2025-12101
    31Monitor

    Cross-Site Scripting (XSS)

    MediumCVSS 5.9Proof of conceptEPSS 26%

    netscaler · adcNov 11, 2025

  • CVE-2025-60709
    31Monitor

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 0%

    microsoft · windows 10 1607Nov 11, 2025

  • CVE-2025-60719
    29Monitor

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    HighCVSS 7.0Proof of conceptEPSS 1%

    microsoft · windows 10 1607Nov 11, 2025

  • CVE-2025-60724
    41Plan

    GDI+ Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 6%

    microsoft · 365 copilotNov 11, 2025

  • CVE-2025-62215
    59Plan

    Windows Kernel Elevation of Privilege Vulnerability

    HighCVSS 7.0KEVWeaponizedEPSS 4%

    microsoft · windows 10 1809Nov 11, 2025

  • CVE-2025-60710
    62This week

    Host Process for Windows Tasks Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 4%

    microsoft · windows 11 24h2Nov 11, 2025

  • CVE-2025-62222
    35Monitor

    Agentic AI and Visual Studio Code Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 0%

    microsoft · github copilot chatNov 11, 2025

  • CVE-2025-12748
    22Monitor

    Libvirt: denial of service in xml parsing

    MediumCVSS 5.5Proof of conceptEPSS 0%

    red hat · red hat enterprise linux 10Nov 11, 2025

  • CVE-2025-63666
    39Monitor

    Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-en

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    tenda · ac15 firmwareNov 12, 2025

  • CVE-2025-63667
    30Monitor

    Incorrect access control in SIMICAM v1.16.41-20250725, KEVIEW v1.14.92-20241120, ASECAM v1.14.10-20240725 allows attackers to access sensiti

    HighCVSS 7.5Proof of conceptEPSS 0%

    simicam · ip camera firmwareNov 12, 2025

  • CVE-2025-40123
    31Monitor

    bpf: Enforce expected_attach_type for tailcall compatibility

    HighCVSS 7.8Proof of conceptEPSS 0%

    linux · linuxNov 12, 2025

  • CVE-2025-63353
    39Monitor

    A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be pre

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    fiberhome · hg6145f1 firmwareNov 12, 2025

  • CVE-2025-63419
    24Monitor

    Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    crushftp · crushftpNov 12, 2025

  • CVE-2025-57310
    35Monitor

    A Cross-Site Request Forgery (CSRF) vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allo

    HighCVSS 8.8Proof of conceptEPSS 0%

    salmen · simple faucet scriptNov 12, 2025

  • CVE-2025-11700
    43Plan

    N-central Multiple XXE Injection Vulnerabilities

    HighCVSS 8.4WeaponizedEPSS 31%

    n-able · n-centralNov 12, 2025

  • CVE-2025-9316
    60This week

    N-central unauthenticated sessionID generation

    MediumCVSS 6.9WeaponizedEPSS 37%

    n-able · n-centralNov 12, 2025

  • CVE-2021-4463
    34Monitor

    Longjing Technology BEMS API <= 1.21 Remote Arbitrary File Download

    HighCVSS 8.7Proof of conceptEPSS 1%

    shenzhen longjing technology co. ltd. · bems apiNov 12, 2025

  • CVE-2023-7327
    35Monitor

    Ozeki SMS Gateway <= 10.3.208 Unauthenticated Arbitrary File Read

    HighCVSS 8.7Proof of conceptEPSS 2%

    ozeki ltd. · ozeki sms gatewayNov 12, 2025

  • CVE-2025-64500
    29Monitor

    Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

    HighCVSS 7.3Proof of conceptEPSS 1%

    sensiolabs · httpfoundationNov 12, 2025

  • CVE-2025-12536
    21Monitor

    SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure

    MediumCVSS 5.3Proof of conceptEPSS 0%

    brainstormforce · sureforms – contact form, payment form & other custom form builderNov 13, 2025

  • CVE-2025-12733
    35Monitor

    Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic

    HighCVSS 8.8No exploitEPSS 0%

    wpallimport · wp all import – drag & drop import for csv, xml, excel & google sheetsNov 13, 2025

  • CVE-2025-60689
    26Monitor

    An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200 v2 routers (Firmwar

    MediumCVSS 5.4Proof of conceptEPSS 18%

    linksys · e1200 firmwareNov 13, 2025

  • CVE-2025-64714
    23Monitor

    PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal

    MediumCVSS 5.8Proof of conceptEPSS 0%

    privatebin · privatebinNov 13, 2025

  • CVE-2025-12762
    43Plan

    Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    pgadmin · pgadmin 4Nov 13, 2025

  • CVE-2025-60690
    36Monitor

    A stack-based buffer overflow exists in the get_merge_ipaddr function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.1

    HighCVSS 8.8Proof of conceptEPSS 4%

    linksys · e1200 firmwareNov 13, 2025

  • CVE-2025-63406
    35Monitor

    An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbTo

    HighCVSS 8.8Proof of conceptEPSS 0%

    group-office · group officeNov 13, 2025

  • CVE-2025-64525
    26Monitor

    Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass

    MediumCVSS 6.5Proof of conceptEPSS 1%

    astro · astroNov 13, 2025

  • CVE-2025-12904
    28Monitor

    SNORDIAN's H5PxAPIkatchu <= 0.4.17 - Unauthenticated Stored Cross-Site Scripting via insert_data

    HighCVSS 7.2Proof of conceptEPSS 0%

    otacke · snordian's h5pxapikatchuNov 14, 2025

  • CVE-2025-63830
    24Monitor

    CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    cksource · ckfinderNov 14, 2025

  • CVE-2025-64446
    97Now

    A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9

    CriticalCVSS 9.8KEVWeaponizedEPSS 91%

    fortinet · fortiwebNov 14, 2025

  • CVE-2025-12847
    17Monitor

    All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media D

    MediumCVSS 4.3No exploitEPSS 0%

    smub · all in one seo – powerful seo plugin to boost seo rankings & increase trafficNov 15, 2025

  • CVE-2025-9501
    43Plan

    W3 Total Cache < 2.8.13 - Unauthenticated Command Injection

    CriticalCVSS 9.0Proof of conceptEPSS 22%

    unknown · w3 total cacheNov 17, 2025

  • CVE-2025-63708
    24Monitor

    Cross-Site Scripting (XSS) vulnerability exists in SourceCodester AI Font Matcher (nid=18425, 2025-10-10) that allows remote attackers to ex

    MediumCVSS 6.1Proof of conceptEPSS 0%

    remyandrade · ai font matcherNov 17, 2025

  • CVE-2025-4321
    28Monitor

    DoS in RS9116W-WiSeConnect L2CAP protocol due to reception of malformed packets

    HighCVSS 7.1Proof of conceptEPSS 0%

    silabs.com · rs9116wNov 17, 2025