CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- car-booking-system-php project car-booking-system-phpCar-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/sign-in.php.9.8 Critical
- car-booking-system-php project car-booking-system-phpCar-Booking-System-PHP v.1.0 is vulnerable to Cross Site Scripting (XSS) in /carlux/booking.php.5.4 Medium
- water management system project management systemWater Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /orders.php.5.4 Medium
- water management system project management systemWater Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit_product.php?id=1.6.1 Medium
- water management system project management systemWater Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_customer.php.6.1 Medium
- water management system project management systemWater Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_vendor.php.6.1 Medium
- school management system php project management system phpSchool Management System PHP v1.0 is vulnerable to Cross Site Scripting (XSS) in /login.php via...5.4 Medium
- nababur simple-user-management-systemSimple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting (XSS) via...4.6 Medium
- opensource-socialnetwork open source social networkOpen Source Social Network (OSSN) 8.6 is vulnerable to Cross Site Scripting (XSS) via the...7.3 High
- fairsketch rise ultimate project managerFairSketch Rise Ultimate Project Manager & CRM 3.9.4 is vulnerable to Insecure Permissions. A...6.5 Medium
- No product listedAn issue in Raspberry Pi Imager version 1.9.6 for Windows, affecting its OS customization feature...6.8 Medium
- kagilum icescrumA remote code execution (RCE) vulnerability in the Postgres Drivers component of iceScrum v7.54...8.8 High
- ultimatefosters ultimateposA cross-site scripting (XSS) vulnerability exists in the administrative interface of...8.7 High
- nextchatDirectory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to...7.5 High
- phpgurukul maid hiring management systemPhpgurukul Maid Hiring Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in /maid...5.4 Medium
- netsurf-browser netsurfAn issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating...6.5 Medium
- netsurf-browser netsurfNetSurf 3.11 is vulnerable to Use After Free in dom_node_set_text_content function.6.5 Medium
- netsurf-browser netsurfAn issue in NetSurf v.3.11 allows a remote attacker to execute arbitrary code via the...6.5 Medium
- angeljudesuarez online loan management systemitsourcecode Online Loan Management System manage_borrower.php sql injection6.9 Medium
- angeljudesuarez online loan management systemitsourcecode Online Loan Management System manage_loan.php sql injection6.9 Medium
- angeljudesuarez online loan management systemitsourcecode Online Loan Management System load_fields.php sql injection6.9 Medium
- mayurik best house rental management systemSourceCodester Best House Rental Management System admin_class.php save_tenant sql injection5.1 Medium
- mayurik best house rental management systemSourceCodester Best House Rental Management System admin_class.php save_category sql injection5.1 Medium
- tenda ac23, ac23 firmware +1 moreTenda AC23 saveParentControlInfo buffer overflow8.7 High
- tenda ac23, ac23 firmware +1 moreTenda AC23 SetVirtualServerCfg formSetVirtualSer buffer overflow8.7 High
- code-projects simple online hotel reservation systemcode-projects Simple Online Hotel Reservation System add_account.php sql injection5.1 Medium
- code-projects simple online hotel reservation systemcode-projects Simple Online Hotel Reservation System Photo edit_room.php unrestricted upload5.1 Medium
- redisRedis: Bug in XACKDEL may lead to stack overflow and potential RCE7.7 High
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 more/etc/timezone can be Arbitrarily Written2.3 Low
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 more/etc/avahi/services/z9.service can be Arbitrarily Written2.3 Low
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreDenial of Service Due to SlowLoris10.0 Critical
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreWeb UI Malfunction10.0 Critical
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreMultiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000)10.0 Critical
- ibm iIBM i is affected by a privilege escalation in IBM i SQL services8.8 High
- hogash kallyas - creative ecommerce multi-purpose wordpress themeKallyas <= 4.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- hogash kallyas - creative ecommerce multi-purpose wordpress themeKallyas <= 4.24.0 - Authenticated (Contributor+) Remote Code Execution8.8 High
- jcollings import wp – export and import csv and xml files to wordpressImport WP – Export and Import CSV and XML files to WordPress <= 2.14.16 - Authenticated (Admin+) Arbitrary File Read4.9 Medium
- anthonyeden restful content syndicationRESTful Content Syndication 1.1.0 - 1.5.0 - Authenticated (Contributor+) Arbitrary File Upload8.8 High
- wpdelicious wp delicious – recipe plugin for food bloggers (formerly delicious recipes)Delicious Recipes <= 1.9.0 - Authenticated (Contributor+) Arbitrary File Upload8.8 High
- essekia tablesome table – contact form db – wpforms, cf7, gravity, forminator, fluentTablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.1.32 - Unauthenticated Arbitrary File Upload9.8 Critical
- monetizemore advanced ads – ad manager & adsenseAdvanced Ads <= 2.0.12 - Unauthenticated Limited Code Execution7.3 High
- aonetheme service finder bookingsService Finder Bookings < 6.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover8.8 High
- tomdever wpforo forumwpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection6.5 Medium
- magazine3 schema & structured data for wp & ampSchema & Structured Data for WP & AMP <= 1.51 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wpfolderly folderlyFolderly <= 0.3 - Incorrect Authorization to Authenticated (Author+) Term Deletion4.3 Medium
- scossar wp discourseWP Discourse <= 2.5.9 - Authenticated (Author+) Information Exposure4.3 Medium
- emarket-design employee spotlight – team member showcase & meet the team pluginEmployee Spotlight – Team Member Showcase & Meet the Team Plugin <= 5.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- qode qi blocksQi Blocks <= 1.4.3 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update4.3 Medium
- aonetheme service finder bookingsService Finder Bookings <= 6.0 - Authenticated (Subscriber+) Privilege Escalation via change_candidate_password8.8 High
- gijo flying images: optimize and lazy load images for faster page speedFlying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.14 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- Show moreLoading…