Skip to content
OpenAdvisories

Archive

8 November 2025

Vulnerabilities first published on this day (UTC), newest first.

← October 2025 2025 / November /8 December 2025 →
  1. 133
  2. 29
  3. 361
  4. 4260
  5. 5102
  6. 6244
  7. 7119
  8. 839
  9. 97
  10. 10122
  11. 11323
  12. 12212
  13. 13154
  14. 14112
  15. 1526
  16. 1623
  17. 17128
  18. 18182
  19. 19125
  20. 2099
  21. 21163
  22. 228
  23. 2332
  24. 24104
  25. 25120
  26. 26101
  27. 2755
  28. 2843
  29. 2927
  30. 3023
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • High 7.2
    CVE-2025-11967

    Mail Mint <= 1.18.10 - Authenticated (Admin+) Arbitrary File Upload

    The Mail Mint plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_contact_attribute_import function in all versions up to, and including, 1.18.10. This makes it possible for authenticated attackers, …

    getwpfunnels Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails Web / CMS
  • High 7.2
    CVE-2025-12399 Public exploit

    Alex Reservations: Smart Restaurant Booking <= 2.2.3 - Authenticated (Admin+) Arbitrary File Upload

    The Alex Reservations: Smart Restaurant Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-json/srr/v1/app/upload/file REST endpoint in all versions up to, and including, 2.2.3. This makes it po…

    alexreservations Alex Reservations: Smart Restaurant Booking Web / CMS
  • High 7.2
    CVE-2025-12099

    Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'

    The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.8 via deserialization of untrusted input in the 'import_all_courses' function. This mak…

    kodezen Academy LMS – WordPress LMS Plugin for Complete eLearning Solution Web / CMS
  • High 8.8
    CVE-2025-9334

    Better Find and Replace <= 1.7.7 - Authenticated (Subscriber+) Limited Code Injection

    The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 1.7.7. This is due to insufficient input validation and restriction on the 'rtafar_ajax' function. This mak…

    codesolz Better Find and Replace – AI-Powered Suggestions Web / CMS
  • High 8.8
    CVE-2025-12161

    Smart Auto Upload Images <= 1.2.0 - Authenticated (Contributor+) Arbitrary File Upload

    The Smart Auto Upload Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the auto-image creation functionality in all versions up to, and including, 1.2.0. This makes it possible for authenticated attack…

    burhandodhy Smart Auto Upload Images – Import External Images Web / CMS
  • High 7.5
    CVE-2025-11452 Scanner template

    Asgaros Forum <= 3.1.0 - Unauthenticated SQL Injection

    The Asgaros Forum plugin for WordPress is vulnerable to SQL Injection via the '$_COOKIE['asgarosforum_unread_exclude']' cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient prepa…

    Asgaros Asgaros Forum Web / CMS
  • High 7.3
    CVE-2025-64496

    Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

    Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbi…

    open-webui open-webui open-webui open-webui npm PyPI
  • High 8.7
    CVE-2025-64495 Public exploit

    Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

    Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. In versions 0.6.34 and below, the functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is e…

    open-webui open-webui open-webui open-webui npm PyPI
  • High 8.8
    CVE-2025-64492

    SuiteCRM is Vulnerable to Authenticated Time Based Blind SQL Injection

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 8.9.0 and below contain a time-based blind SQL Injection vulnerability. This vulnerability allows an authenticated attacker to infer data from t…

    Suite CRM SuiteCRM-Core
  • High 8.3
    CVE-2025-64490

    SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 allow a low-privileged user with a restrictive role to view and create work items through the Resou…

    Suite CRM SuiteCRM
  • High 8.3
    CVE-2025-64489

    SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 contain a privilege escalation vulnerability where user sessions are not invalidated upon account d…

    Suite CRM SuiteCRM