Skip to content

Commit 14b7227

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 2dc51f5 commit 14b7227

File tree

89 files changed

+2390
-128
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

89 files changed

+2390
-128
lines changed

‎advisories/unreviewed/2025/06/GHSA-8x66-x5gf-2pc8/GHSA-8x66-x5gf-2pc8.json‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8x66-x5gf-2pc8",
4-
"modified": "2025-06-23T21:31:49Z",
4+
"modified": "2025-12-09T21:31:29Z",
55
"published": "2025-06-23T21:31:49Z",
66
"aliases": [
77
"CVE-2025-6218"
@@ -19,6 +19,18 @@
1919
"type": "ADVISORY",
2020
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6218"
2121
},
22+
{
23+
"type": "WEB",
24+
"url": "https://foresiet.com/blog/apt-c-08-winrar-directory-traversal-exploit"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6218"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.secpod.com/blog/archive-terror-dissecting-the-winrar-cve-2025-6218-exploit-apt-c-08s-stealth-move"
33+
},
2234
{
2335
"type": "WEB",
2436
"url": "https://www.win-rar.com/singlenewsview.html?&tx_ttnews%5Btt_news%5D=276&cHash=388885bd3908a40726f535c026f94eb6"

‎advisories/unreviewed/2025/12/GHSA-2w86-r6rm-76wr/GHSA-2w86-r6rm-76wr.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2w86-r6rm-76wr",
4-
"modified": "2025-12-09T18:30:43Z",
4+
"modified": "2025-12-09T21:31:42Z",
55
"published": "2025-12-09T18:30:43Z",
66
"aliases": [
77
"CVE-2025-67567"
88
],
99
"details": "Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in uixthemes Sober sober allows Retrieve Embedded Sensitive Data.This issue affects Sober: from n/a through <= 3.5.11.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-497"
2530
],
26-
"severity": null,
31+
"severity": "MODERATE",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2025-12-09T16:18:33Z"

‎advisories/unreviewed/2025/12/GHSA-2wqc-47g4-pm22/GHSA-2wqc-47g4-pm22.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2wqc-47g4-pm22",
4-
"modified": "2025-12-09T18:30:42Z",
4+
"modified": "2025-12-09T21:31:41Z",
55
"published": "2025-12-09T18:30:42Z",
66
"aliases": [
77
"CVE-2025-67543"
88
],
99
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Catch Themes Essential Widgets essential-widgets allows Stored XSS.This issue affects Essential Widgets: from n/a through <= 2.2.2.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-79"
2530
],
26-
"severity": null,
31+
"severity": "MODERATE",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2025-12-09T16:18:29Z"

‎advisories/unreviewed/2025/12/GHSA-34w2-vr99-v872/GHSA-34w2-vr99-v872.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-34w2-vr99-v872",
4-
"modified": "2025-12-09T18:30:45Z",
4+
"modified": "2025-12-09T21:31:43Z",
55
"published": "2025-12-09T18:30:45Z",
66
"aliases": [
77
"CVE-2025-34409"
88
],
99
"details": "MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the Failed parameter of /Mondo/lang/sys/Forms/MAI/AddRecipientsResult.aspx. The Failed value is not properly sanitized when processed via a GET request and is reflected in the response, allowing an attacker to break out of existing markup and inject arbitrary script. A remote attacker can supply a crafted payload that closes an existing HTML list element, inserts attacker-controlled JavaScript, and comments out remaining code, leading to script execution in a victim’s browser when the victim visits a malicious link. Successful exploitation can redirect victims to malicious sites, steal non-HttpOnly cookies, inject arbitrary HTML or CSS, and perform actions as the authenticated user.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/12/GHSA-3jvf-36wg-6h35/GHSA-3jvf-36wg-6h35.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3jvf-36wg-6h35",
4-
"modified": "2025-12-09T18:30:45Z",
4+
"modified": "2025-12-09T21:31:43Z",
55
"published": "2025-12-09T18:30:45Z",
66
"aliases": [
77
"CVE-2025-34408"
88
],
99
"details": "MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the Added parameter of /Mondo/lang/sys/Forms/MAI/AddRecipientsResult.aspx. The Added value is not properly sanitized when processed via a GET request and is reflected in the response, allowing an attacker to break out of existing markup and inject arbitrary script. A remote attacker can supply a crafted payload that closes an existing HTML list element, inserts attacker-controlled JavaScript, and comments out remaining code, leading to script execution in a victim’s browser when the victim visits a malicious link. Successful exploitation can redirect victims to malicious sites, steal non-HttpOnly cookies, inject arbitrary HTML or CSS, and perform actions as the authenticated user.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/12/GHSA-3rfh-phff-7g8v/GHSA-3rfh-phff-7g8v.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3rfh-phff-7g8v",
4+
"modified": "2025-12-09T21:31:48Z",
5+
"published": "2025-12-09T21:31:48Z",
6+
"aliases": [
7+
"CVE-2021-47701"
8+
],
9+
"details": "OpenBMCS 2.4 allows an attacker to escalate privileges from a read user to an admin user by manipulating permissions and exploiting a vulnerability in the update_user_permissions.php script. Attackers can submit a malicious HTTP POST request to PHP scripts in '/plugins/useradmin/' directory.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47701"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.exploit-db.com/exploits/50669"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.vulncheck.com/advisories/openbmcs-user-management-privilege-escalation"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5693.php"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-862"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-09T21:15:47Z"
43+
}
44+
}

‎advisories/unreviewed/2025/12/GHSA-49v5-397q-f66m/GHSA-49v5-397q-f66m.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-49v5-397q-f66m",
4+
"modified": "2025-12-09T21:31:46Z",
5+
"published": "2025-12-09T21:31:46Z",
6+
"aliases": [
7+
"CVE-2025-14335"
8+
],
9+
"details": "A vulnerability has been found in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /new_school_year.php. The manipulation of the argument sy leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14335"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/ltranquility/CVE/issues/20"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.335160"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.335160"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.702743"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-09T19:15:48Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-4mpp-3xgq-2qwv/GHSA-4mpp-3xgq-2qwv.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4mpp-3xgq-2qwv",
4-
"modified": "2025-12-09T18:30:44Z",
4+
"modified": "2025-12-09T21:31:43Z",
55
"published": "2025-12-09T18:30:44Z",
66
"aliases": [
77
"CVE-2025-12945"
@@ -19,6 +19,10 @@
1919
"type": "ADVISORY",
2020
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12945"
2121
},
22+
{
23+
"type": "WEB",
24+
"url": "https://kb.netgear.com/000070416/December-2025-NETGEAR-Security-Advisory"
25+
},
2226
{
2327
"type": "WEB",
2428
"url": "https://www.netgear.com/support/product/r7000p"

‎advisories/unreviewed/2025/12/GHSA-4p2g-f3r4-m384/GHSA-4p2g-f3r4-m384.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4p2g-f3r4-m384",
4-
"modified": "2025-12-09T18:30:39Z",
4+
"modified": "2025-12-09T21:31:38Z",
55
"published": "2025-12-09T18:30:39Z",
66
"aliases": [
77
"CVE-2025-63048"
88
],
99
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro Lead Form listingpro-lead-form allows DOM-Based XSS.This issue affects ListingPro Lead Form: from n/a through <= 1.0.2.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-79"
2530
],
26-
"severity": null,
31+
"severity": "MODERATE",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2025-12-09T16:18:10Z"

‎advisories/unreviewed/2025/12/GHSA-4w7v-fjhh-9j2h/GHSA-4w7v-fjhh-9j2h.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4w7v-fjhh-9j2h",
4-
"modified": "2025-12-09T18:30:39Z",
4+
"modified": "2025-12-09T21:31:38Z",
55
"published": "2025-12-09T18:30:39Z",
66
"aliases": [
77
"CVE-2025-63044"
88
],
99
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows DOM-Based XSS.This issue affects Xpro Elementor Addons: from n/a through <= 1.4.19.1.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-79"
2530
],
26-
"severity": null,
31+
"severity": "MODERATE",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2025-12-09T16:18:09Z"

0 commit comments

Comments
 (0)