Эксплуатируемые и новые серьёзные CVE: ноябрь 2025 г.

Document Library Lite <= 1.1.6 - Missing Authorization to Sensitive Information Exposure

• Без аутентификации
• Нарушение контроля доступа (IDOR)

barn2media · document library lite1 нояб. 2025 г.

Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Lo

• Без аутентификации
• Нарушение контроля доступа (IDOR)

saadiqbal · post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app1 нояб. 2025 г.

wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection

• SQL-инъекция

tomdever · wpforo forum1 нояб. 2025 г.

Import WP – Export and Import CSV and XML files to WordPress <= 2.14.16 - Authenticated (Admin+) Arbitrary File Read

• Обход пути

jcollings · import wp – export and import csv and xml files to wordpress1 нояб. 2025 г.

A cross-site scripting (XSS) vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted i

• RCE
• XSS

ultimatefosters · ultimatepos3 нояб. 2025 г.

Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

• RCE без входа
• Инъекция команд

react-native-community · react native community cli3 нояб. 2025 г.

Phpgurukul Maid Hiring Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in /maid-hiring.php va the name field.

• Без аутентификации
• XSS

phpgurukul · maid hiring management system3 нояб. 2025 г.

Open Source Social Network (OSSN) 8.6 is vulnerable to Cross Site Scripting (XSS) via the parameter param` at endpoint u/administrator/frien

• XSS

opensource-socialnetwork · open source social network3 нояб. 2025 г.

A logging issue was addressed with improved data redaction.

• Утечка информации

apple · ipados3 нояб. 2025 г.

This issue was addressed with improved entitlements.

• Нарушение контроля доступа (IDOR)

apple · ipados4 нояб. 2025 г.

A buffer overflow was addressed with improved bounds checking.

• Ошибки памяти
• Отказ в обслуживании

apple · xcode4 нояб. 2025 г.

In preloader, there is a possible escalation of privilege due to an insecure default value.

• Обход аутентификации
• Локальное повышение привилегий

linuxfoundation · yocto4 нояб. 2025 г.

An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2

• Без аутентификации
• Ошибки памяти
• Отказ в обслуживании

samsung · exynos 1080 firmware4 нояб. 2025 г.

Xibo CMS: Remote Code Execution through module templates

• RCE

xibosignage · xibo4 нояб. 2025 г.

Redis: Bug in XACKDEL may lead to stack overflow and potential RCE

• RCE

redis · redis4 нояб. 2025 г.

The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined

• RCE без входа

jorenbroekema · javascript expression evaluator5 нояб. 2025 г.

The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s

• Без аутентификации
• SQL-инъекция

stellarwp · the events calendar5 нояб. 2025 г.

AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation

• Без аутентификации
• Утечка информации

tigroumeow · ai engine – the chatbot, ai framework & mcp for wordpress5 нояб. 2025 г.

File Manager for Google Drive – Integrate Google Drive with WordPress <= 1.5.3 - Unauthenticated Sensitive Information Exposure

• Без аутентификации
• Утечка информации

princeahmed · file manager for google drive – integrate google drive5 нояб. 2025 г.

KiotViet Sync <= 1.8.5 - Unauthenticated Arbitrary File Upload

• RCE без входа
• Загрузка файлов

mykiot · kiotviet sync5 нояб. 2025 г.

Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

• Без аутентификации
• Отказ в обслуживании

djangoproject · django5 нояб. 2025 г.

Potential SQL injection via _connector keyword argument in QuerySet and Q objects

• Без аутентификации
• SQL-инъекция

djangoproject · django5 нояб. 2025 г.

OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address.

• RCE без входа
• Инъекция команд

dynatrace · activegate ping extension5 нояб. 2025 г.

ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint.

• Без аутентификации
• Утечка информации

owncloud · guests5 нояб. 2025 г.

XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration

• Без аутентификации
• XXE

wso2 · api control plane5 нояб. 2025 г.

A use-after-free issue was addressed with improved memory management.

• Без аутентификации
• Ошибки памяти

apple · safari5 нояб. 2025 г.

OSSN (Open Source Social Network) 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter.

• Без аутентификации
• SQL-инъекция

opensource-socialnetwork · open source social network5 нояб. 2025 г.

Cisco Identity Services Engine Radius Suppression Denial of Service Vulnerability

• Без аутентификации
• Отказ в обслуживании

cisco · identity services engine5 нояб. 2025 г.

Dell Command Monitor (DCM), versions prior to 10.12.3.28, contains an Execution with Unnecessary Privileges vulnerability.

• Локальное повышение привилегий

dell · command monitor5 нояб. 2025 г.

alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS).

• XSS

alexusmai · laravel file manager6 нояб. 2025 г.

An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and ex

• RCE без входа
• XSS

cmsimple-xh · cmsimple xh6 нояб. 2025 г.

A reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or encod

• Без аутентификации
• XSS

cmsimple-xh · cmsimple xh6 нояб. 2025 г.

An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS

• Без аутентификации
• Ошибки памяти

anydesk · anydesk6 нояб. 2025 г.

WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerability

• Без аутентификации

vito peleg · atarim6 нояб. 2025 г.

WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.6.6 - Sensitive Data Exposure vulnerability

• Без аутентификации

ays pro · ai chatbot with chatgpt and content generator by ays6 нояб. 2025 г.

WordPress Contest Gallery plugin <= 28.0.0 - Cross Site Request Forgery (CSRF) vulnerability

• Без аутентификации
• CSRF

wasiliy strecker / contestgallery developer · contest gallery6 нояб. 2025 г.

WordPress King Addons for Elementor plugin <= 51.1.36 - Privilege Escalation vulnerability

• Без аутентификации

kingaddons.com · king addons for elementor6 нояб. 2025 г.

runc container escape via "masked path" abuse due to mount race conditions

• Состояние гонки

linuxfoundation · runc6 нояб. 2025 г.

Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability

• RCE
• Обход пути

netgate · pfsense6 нояб. 2025 г.

runc: LSM labels can be bypassed with malicious config using dummy procfs files

linuxfoundation · runc6 нояб. 2025 г.

FreePBX Administration GUI is Vulnerable to Authenticated Command Injection

• RCE
• Инъекция команд

sangoma · filestore7 нояб. 2025 г.

Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload

• RCE без входа
• Загрузка файлов

monstaftp · monsta ftp7 нояб. 2025 г.

A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117.

• Без аутентификации
• Обход пути

webair · tquadra cms7 нояб. 2025 г.

CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling pe

• XSS

crushftp · crushftp7 нояб. 2025 г.

Bluetooth: peripheral: Invalid handling of malformed connection request

• Без аутентификации
• Отказ в обслуживании

zephyrproject-rtos · zephyr7 нояб. 2025 г.

Samba: command injection in wins server hook script

• RCE без входа
• Инъекция команд

red hat · red hat enterprise linux 107 нояб. 2025 г.

Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

• RCE
• XSS

openwebui · open webui7 нояб. 2025 г.

Asgaros Forum <= 3.1.0 - Unauthenticated SQL Injection

• Без аутентификации
• SQL-инъекция

asgaros · asgaros forum8 нояб. 2025 г.

Alex Reservations: Smart Restaurant Booking <= 2.2.3 - Authenticated (Admin+) Arbitrary File Upload

• RCE
• Загрузка файлов

alexreservations · alex reservations: smart restaurant booking8 нояб. 2025 г.

Sangfor Operation and Maintenance Security Management System Frontend portal_login command injection

• RCE
• Инъекция команд

sangfor · operation and maintenance security management system9 нояб. 2025 г.

Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even

• Без аутентификации
• Нарушение контроля доступа (IDOR)

gladinet · triofox10 нояб. 2025 г.

An issue in Sublime HQ Pty Ltd Sublime Text 4 4200 allows authenticated attackers with low-level privileges to escalate privileges to Admini

10 нояб. 2025 г.

BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the re

• Без аутентификации
• Нарушение контроля доступа (IDOR)

busybox · busybox10 нояб. 2025 г.

KERUI K259 5MP Wi-Fi / Tuya Smart Security Camera firmware v33.53.87 contains a code execution vulnerability in its boot/update logic: durin

• RCE без входа
• Инъекция команд

keruistore · kerui k259 firmware10 нояб. 2025 г.

changedetection.io vulnerable to stored XSS in Watch update via API

• XSS

changedetection · changedetection10 нояб. 2025 г.

pdfminer.six vulnerable to Arbitrary Code Execution via Crafted PDF Input

• RCE
• Десериализация

pdfminer · pdfminer.six10 нояб. 2025 г.

Milvus Proxy has Critical Authentication Bypass Vulnerability

• Без аутентификации
• Обход аутентификации

milvus-io · milvus10 нояб. 2025 г.

Employee Records System v1.0 Arbitrary File Upload RCE

• RCE без входа
• Загрузка файлов

skittles · employee records system10 нояб. 2025 г.

Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform out of bounds memory access

• Без аутентификации

google · chrome10 нояб. 2025 г.

WP移行専用プラグイン for CPI <= 1.0.2 - Unauthenticated Arbitrary File Upload

• RCE без входа
• Загрузка файлов

kddiwebcommunications · wp移行専用プラグイン for cpi11 нояб. 2025 г.

Crypto Tool <= 2.22 - Unauthenticated Information Exposure via Global Authentication State

• Без аутентификации
• Обход аутентификации

odude · crypto tool11 нояб. 2025 г.

Crypto Tool <= 2.22 - Missing Authentication to Unauthenticated Limited File Deletion

• Без аутентификации
• Обход аутентификации
• Нарушение контроля доступа (IDOR)

odude · crypto tool11 нояб. 2025 г.

WP Google Maps < 9.0.48 - Unauthenticated Stored XSS

• Без аутентификации
• XSS

unknown · wp go maps (formerly wp google maps)11 нояб. 2025 г.

Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to

• RCE
• Инъекция команд

zohocorp · manageengine applications manager11 нояб. 2025 г.

TNC Toolbox: Web Performance <= 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover

• RCE без входа
• Загрузка файлов

leopardhost · tnc toolbox: web performance11 нояб. 2025 г.

Cross-Site Scripting (XSS)

• Без аутентификации
• XSS

netscaler · adc11 нояб. 2025 г.

Windows Common Log File System Driver Elevation of Privilege Vulnerability

• Локальное повышение привилегий
• Ошибки памяти

microsoft · windows 10 160711 нояб. 2025 г.

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

• Локальное повышение привилегий

microsoft · windows 10 160711 нояб. 2025 г.

GDI+ Remote Code Execution Vulnerability

• RCE без входа
• Ошибки памяти

microsoft · 365 copilot11 нояб. 2025 г.

Windows Kernel Elevation of Privilege Vulnerability

• Локальное повышение привилегий
• Состояние гонки

microsoft · windows 10 180911 нояб. 2025 г.

Uncontrolled search path for the Instrumentation and Tracing Technology API (ITT API) software before version 3.25.4 within Ring 3: User App

• Локальное повышение привилегий

11 нояб. 2025 г.

Host Process for Windows Tasks Elevation of Privilege Vulnerability

• Локальное повышение привилегий

microsoft · windows 11 24h211 нояб. 2025 г.

Agentic AI and Visual Studio Code Remote Code Execution Vulnerability

• RCE без входа
• Инъекция команд

microsoft · github copilot chat11 нояб. 2025 г.

Libvirt: denial of service in xml parsing

• Отказ в обслуживании

red hat · red hat enterprise linux 1011 нояб. 2025 г.

Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-en

• Без аутентификации
• Нарушение контроля доступа (IDOR)

tenda · ac15 firmware12 нояб. 2025 г.

Incorrect access control in SIMICAM v1.16.41-20250725, KEVIEW v1.14.92-20241120, ASECAM v1.14.10-20240725 allows attackers to access sensiti

• Без аутентификации
• Обход аутентификации
• Нарушение контроля доступа (IDOR)

simicam · ip camera firmware12 нояб. 2025 г.

bpf: Enforce expected_attach_type for tailcall compatibility

linux · linux12 нояб. 2025 г.

A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be pre

• Без аутентификации
• Обход аутентификации
• Зашитые учётные данные

fiberhome · hg6145f1 firmware12 нояб. 2025 г.

Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48.

• Без аутентификации
• XSS

crushftp · crushftp12 нояб. 2025 г.

A Cross-Site Request Forgery (CSRF) vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allo

• RCE без входа
• CSRF

salmen · simple faucet script12 нояб. 2025 г.

N-central Multiple XXE Injection Vulnerabilities

• XXE

n-able · n-central12 нояб. 2025 г.

N-central unauthenticated sessionID generation

• Без аутентификации

n-able · n-central12 нояб. 2025 г.

Longjing Technology BEMS API <= 1.21 Remote Arbitrary File Download

• Без аутентификации
• Обход пути

shenzhen longjing technology co. ltd. · bems api12 нояб. 2025 г.

Ozeki SMS Gateway <= 10.3.208 Unauthenticated Arbitrary File Read

• Без аутентификации
• Обход пути

ozeki ltd. · ozeki sms gateway12 нояб. 2025 г.

Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

• Без аутентификации

sensiolabs · httpfoundation12 нояб. 2025 г.

SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure

• Без аутентификации
• Обход аутентификации
• Утечка информации

brainstormforce · sureforms – contact form, payment form & other custom form builder13 нояб. 2025 г.

Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic

• RCE

wpallimport · wp all import – drag & drop import for csv, xml, excel & google sheets13 нояб. 2025 г.

An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200 v2 routers (Firmwar

• RCE без входа
• Обход аутентификации
• Инъекция команд

linksys · e1200 firmware13 нояб. 2025 г.

Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

• RCE без входа

pgadmin · pgadmin 413 нояб. 2025 г.

A stack-based buffer overflow exists in the get_merge_ipaddr function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.1

• RCE без входа
• Обход аутентификации
• Ошибки памяти

linksys · e1200 firmware13 нояб. 2025 г.

An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbTo

• RCE
• Инъекция команд

group-office · group office13 нояб. 2025 г.

Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass

• Без аутентификации
• SSRF

astro · astro13 нояб. 2025 г.

PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal

• RCE без входа
• Обход пути

privatebin · privatebin13 нояб. 2025 г.

SNORDIAN's H5PxAPIkatchu <= 0.4.17 - Unauthenticated Stored Cross-Site Scripting via insert_data

• Без аутентификации
• XSS

otacke · snordian's h5pxapikatchu14 нояб. 2025 г.

CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function.

• Без аутентификации
• XSS

cksource · ckfinder14 нояб. 2025 г.

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9

• Без аутентификации
• Обход пути

fortinet · fortiweb14 нояб. 2025 г.

All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media D

• Нарушение контроля доступа (IDOR)

smub · all in one seo – powerful seo plugin to boost seo rankings & increase traffic15 нояб. 2025 г.

W3 Total Cache < 2.8.13 - Unauthenticated Command Injection

• RCE без входа
• Инъекция команд

unknown · w3 total cache17 нояб. 2025 г.

Cross-Site Scripting (XSS) vulnerability exists in SourceCodester AI Font Matcher (nid=18425, 2025-10-10) that allows remote attackers to ex

• RCE без входа
• XSS

remyandrade · ai font matcher17 нояб. 2025 г.

DoS in RS9116W-WiSeConnect L2CAP protocol due to reception of malformed packets

• Без аутентификации

silabs.com · rs9116w17 нояб. 2025 г.