CVE-2025-11700

HighCVSS 7.5/10Last modified Oct 23, 2026

Description

N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

VendorProductVersions
N-ableN-central< 2025.4

References

Timeline

Published
Nov 12, 2025
Last modified
Oct 23, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-117015.3The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing pCVE-2025-117028.8GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could hCVE-2025-117035.3The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 9.0.48.CVE-2025-117047.5The Elegance Menu plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the 'elegance-menCVE-2025-117056.5The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and inclCVE-2025-117066.1The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the dbstatus parameter in all versions up tCVE-2025-117075.3The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all versions up to, and including, 2.14. This is duCVE-2025-117089.8Use-after-free in MediaTrackGraphImpl::GetInstance(). This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and TCVE-2025-117099.8A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. CVE-2025-11716.1A vulnerability classified as problematic was found in code-projects Real Estate Property Management System 1.0. Affected by this vulnerabilCVE-2025-117109.8A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to thCVE-2025-117116.5There was a way to change the value of JavaScript Object properties that were supposed to be non-writeable. This vulnerability was fixed in
CVE-2025-11700: High severity, CVSS 7.5 | Vulnix