Skip to content
OpenAdvisories

Archive

3 November 2025

Vulnerabilities first published on this day (UTC), newest first.

← October 2025 2025 / November /3 December 2025 →
  1. 133
  2. 29
  3. 361
  4. 4260
  5. 5102
  6. 6244
  7. 7119
  8. 839
  9. 97
  10. 10122
  11. 11323
  12. 12212
  13. 13154
  14. 14112
  15. 1526
  16. 1623
  17. 17128
  18. 18182
  19. 19125
  20. 2099
  21. 21163
  22. 228
  23. 2332
  24. 24104
  25. 25120
  26. 26101
  27. 2755
  28. 2843
  29. 2927
  30. 3023
All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

  • High 7.0
    CVE-2025-34501

    Shuffle Master Deck Mate 2 Hard-coded Credentials & Exposed Services

    Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet, SMB, X11) are enabled by default. If an attacker can reach these interfaces - most often through l…

    Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master Deck Mate 2
  • High 7.1
    CVE-2025-12531

    IBM InfoSphere Information Server is affected by an XML external entity injection (XXE) vulnerability

    IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

    IBM InfoSphere Information Server
  • High 7.1
    CVE-2025-10280

    Incorrect Content Type Cross-Site Scripting Vulnerability

    IdentityIQ 8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and all 8.3 patch levels including 8.3p5, and all prior versions allows some IdentityIQ web services that provide non-HTML content to be accessed via a URL path that will s…

    SailPoint IdentityIQ
  • High 8.5
    CVE-2025-11761

    HP Client Management Script Library – Security Update

    A potential security vulnerability has been identified in the HP Client Management Script Library software, which might allow escalation of privilege during the installation process. HP is releasing software updates to mitigate the potential vulnerability.

    HP HP Client Management Script Library
  • High 7.1
    CVE-2025-48397

    The privileged user could log in without sufficient credentials after enabling an application protocol. This security i…

    Eaton Eaton Brightlayer Software Suite (BLSS)
  • High 8.3
    CVE-2025-48396

    Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This se…

    Eaton Eaton Brightlayer Software Suite (BLSS)
  • High 8.8
    CVE-2025-12622

    Tenda AC10 SysRunCmd formSysRunCmd buffer overflow

    A vulnerability was determined in Tenda AC10 16.03.10.13. Affected by this vulnerability is the function formSysRunCmd of the file /goform/SysRunCmd. This manipulation of the argument getui causes buffer overflow. The attack may be initiated remotely. The exp…

    Tenda AC10
  • High 8.8
    CVE-2025-12619

    Tenda A15 openNetworkGateway fromSetWirelessRepeat buffer overflow

    A vulnerability was found in Tenda A15 15.13.07.13. Affected is the function fromSetWirelessRepeat of the file /goform/openNetworkGateway. The manipulation of the argument wpapsk_crypto2_4g results in buffer overflow. The attack can be launched remotely. The …

    Tenda A15
  • High 8.8
    CVE-2025-12618

    Tenda AC8 DatabaseIniSet buffer overflow

    A vulnerability has been found in Tenda AC8 16.03.34.06. This impacts an unknown function of the file /goform/DatabaseIniSet. The manipulation of the argument Time leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed …

    Tenda AC8
  • High 7.3
    CVE-2025-12617

    itsourcecode Billing System login_crud.php sql injection

    A flaw has been found in itsourcecode Billing System 1.0. This affects an unknown function of the file /admin/app/login_crud.php. Executing a manipulation of the argument Password can lead to sql injection. It is possible to launch the attack remotely. The ex…

    itsourcecode Billing System
  • High 8.8
    CVE-2025-12611

    Tenda AC21 SetPptpServerCfg formSetPPTPServer buffer overflow

    A vulnerability was identified in Tenda AC21 16.03.08.16. This vulnerability affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg. The manipulation of the argument startIp leads to buffer overflow. Remote exploitation of the attack is p…

    Tenda AC21
  • High 7.3
    CVE-2025-12608

    itsourcecode Online Loan Management System manage_user.php sql injection

    A security flaw has been discovered in itsourcecode Online Loan Management System 1.0. The affected element is an unknown function of the file /manage_user.php. Performing manipulation of the argument ID results in sql injection. The attack is possible to be …

    itsourcecode Online Loan Management System
  • High 7.3
    CVE-2025-12607

    itsourcecode Online Loan Management System manage_payment.php sql injection

    A vulnerability was identified in itsourcecode Online Loan Management System 1.0. Impacted is an unknown function of the file /manage_payment.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is…

    itsourcecode Online Loan Management System
  • High 7.5
    CVE-2025-50735

    Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot…

  • High 7.3
    CVE-2025-63441 Public exploit

    Open Source Social Network (OSSN) 8.6 is vulnerable to Cross Site Scripting (XSS) via the parameter param` at endpoint …

  • High 8.7
    CVE-2025-60503 Public exploit

    A cross-site scripting (XSS) vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 wh…

  • High 8.8
    CVE-2025-60785

    A remote code execution (RCE) vulnerability in the Postgres Drivers component of iceScrum v7.54 Pro On-prem allows atta…