Skip to content

Commit 04193b8

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-49pm-cgmh-hw25 GHSA-892r-x96w-jh76 GHSA-gj84-8vfx-q3vm GHSA-h4r4-6hvf-34r8 GHSA-32wm-p53q-684m GHSA-rgx4-r686-q8hp GHSA-w48v-8pqw-vj5q
1 parent 77673b1 commit 04193b8

File tree

7 files changed

+164
-4
lines changed

7 files changed

+164
-4
lines changed

‎advisories/unreviewed/2025/10/GHSA-49pm-cgmh-hw25/GHSA-49pm-cgmh-hw25.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-49pm-cgmh-hw25",
4-
"modified": "2025-11-03T18:31:51Z",
4+
"modified": "2025-11-04T12:30:18Z",
55
"published": "2025-10-30T06:30:53Z",
66
"aliases": [
77
"CVE-2025-62229"
@@ -39,6 +39,10 @@
3939
"type": "WEB",
4040
"url": "https://access.redhat.com/errata/RHSA-2025:19489"
4141
},
42+
{
43+
"type": "WEB",
44+
"url": "https://access.redhat.com/errata/RHSA-2025:19623"
45+
},
4246
{
4347
"type": "WEB",
4448
"url": "https://access.redhat.com/security/cve/CVE-2025-62229"

‎advisories/unreviewed/2025/10/GHSA-892r-x96w-jh76/GHSA-892r-x96w-jh76.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-892r-x96w-jh76",
4-
"modified": "2025-11-03T18:31:51Z",
4+
"modified": "2025-11-04T12:30:19Z",
55
"published": "2025-10-30T06:30:54Z",
66
"aliases": [
77
"CVE-2025-62230"
@@ -39,6 +39,10 @@
3939
"type": "WEB",
4040
"url": "https://access.redhat.com/errata/RHSA-2025:19489"
4141
},
42+
{
43+
"type": "WEB",
44+
"url": "https://access.redhat.com/errata/RHSA-2025:19623"
45+
},
4246
{
4347
"type": "WEB",
4448
"url": "https://access.redhat.com/security/cve/CVE-2025-62230"

‎advisories/unreviewed/2025/10/GHSA-gj84-8vfx-q3vm/GHSA-gj84-8vfx-q3vm.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-gj84-8vfx-q3vm",
4-
"modified": "2025-10-09T15:31:03Z",
4+
"modified": "2025-11-04T12:30:18Z",
55
"published": "2025-10-09T15:31:03Z",
66
"aliases": [
77
"CVE-2025-11561"
@@ -19,6 +19,10 @@
1919
"type": "ADVISORY",
2020
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11561"
2121
},
22+
{
23+
"type": "WEB",
24+
"url": "https://access.redhat.com/errata/RHSA-2025:19610"
25+
},
2226
{
2327
"type": "WEB",
2428
"url": "https://access.redhat.com/security/cve/CVE-2025-11561"

‎advisories/unreviewed/2025/10/GHSA-h4r4-6hvf-34r8/GHSA-h4r4-6hvf-34r8.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-h4r4-6hvf-34r8",
4-
"modified": "2025-11-03T18:31:51Z",
4+
"modified": "2025-11-04T12:30:18Z",
55
"published": "2025-10-30T06:30:53Z",
66
"aliases": [
77
"CVE-2025-62231"
@@ -39,6 +39,10 @@
3939
"type": "WEB",
4040
"url": "https://access.redhat.com/errata/RHSA-2025:19489"
4141
},
42+
{
43+
"type": "WEB",
44+
"url": "https://access.redhat.com/errata/RHSA-2025:19623"
45+
},
4246
{
4347
"type": "WEB",
4448
"url": "https://access.redhat.com/security/cve/CVE-2025-62231"

‎advisories/unreviewed/2025/11/GHSA-32wm-p53q-684m/GHSA-32wm-p53q-684m.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-32wm-p53q-684m",
4+
"modified": "2025-11-04T12:30:19Z",
5+
"published": "2025-11-04T12:30:19Z",
6+
"aliases": [
7+
"CVE-2025-11690"
8+
],
9+
"details": "An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other users’ vehicles. Exploiting this issue enables an attacker to retrieve data such as GPS coordinates, encryption keys, initialization vectors, model numbers, and fuel statistics belonging to other users, instead of being limited to their own vehicle data. This is a server-side authorization fix.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11690"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://advisories.ncsc.nl/2025/ncsc-2025-0350.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-639"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-04T11:15:37Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-rgx4-r686-q8hp/GHSA-rgx4-r686-q8hp.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rgx4-r686-q8hp",
4+
"modified": "2025-11-04T12:30:19Z",
5+
"published": "2025-11-04T12:30:19Z",
6+
"aliases": [
7+
"CVE-2025-12493"
8+
],
9+
"details": "The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the 'load_template' function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12493"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L213"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L241"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L42"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/includes/addons/product-grid/base/class.product-grid-base.php#L378"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://plugins.trac.wordpress.org/changeset/3388234"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/12bb4bb9-e908-43ad-8fb1-59418580f5e1?source=cve"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-22"
50+
],
51+
"severity": "CRITICAL",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-04T12:15:36Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-w48v-8pqw-vj5q/GHSA-w48v-8pqw-vj5q.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-w48v-8pqw-vj5q",
4+
"modified": "2025-11-04T12:30:19Z",
5+
"published": "2025-11-04T12:30:19Z",
6+
"aliases": [
7+
"CVE-2025-12045"
8+
],
9+
"details": "The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the category and tag 'name' parameters in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12045"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/themeisle-companion/trunk/obfx_modules/elementor-extra-widgets/widgets/elementor/posts-grid.php#L1878"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/themeisle-companion/trunk/obfx_modules/elementor-extra-widgets/widgets/elementor/posts-grid.php#L1912"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/changeset/3388856"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://research.cleantalk.org/cve-2025-12045"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/139a264b-082b-45db-ac9e-4974bf86c56f?source=cve"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-11-04T12:15:35Z"
51+
}
52+
}

0 commit comments

Comments
 (0)