Skip to content

Commit 0c185ac

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3386-f7wg-696x GHSA-8w5q-7h44-9vh9 GHSA-9vm5-3w25-78p5 GHSA-fvmg-22f6-q6vj GHSA-gqxj-68c6-vgjx GHSA-m3r7-hp4v-q24g GHSA-qp98-37p8-mxj7 GHSA-vch3-8jh3-g32c GHSA-xrw3-prcw-c39g
1 parent be174c5 commit 0c185ac

File tree

9 files changed

+256
-2
lines changed

9 files changed

+256
-2
lines changed

‎advisories/unreviewed/2025/10/GHSA-3386-f7wg-696x/GHSA-3386-f7wg-696x.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3386-f7wg-696x",
4+
"modified": "2025-10-29T12:30:25Z",
5+
"published": "2025-10-29T12:30:25Z",
6+
"aliases": [
7+
"CVE-2015-10146"
8+
],
9+
"details": "The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-10146"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://wordpress.org/plugins/wp-responsive-slider-with-lightbox"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/70f04f90-a0b7-46d1-85da-e898a6981fa2?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-89"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-10-29T10:15:35Z"
39+
}
40+
}

‎advisories/unreviewed/2025/10/GHSA-8w5q-7h44-9vh9/GHSA-8w5q-7h44-9vh9.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8w5q-7h44-9vh9",
4-
"modified": "2025-10-28T15:30:42Z",
4+
"modified": "2025-10-29T12:30:25Z",
55
"published": "2025-10-27T15:30:42Z",
66
"aliases": [
77
"CVE-2025-41068"
@@ -27,6 +27,10 @@
2727
"type": "WEB",
2828
"url": "https://open5gs.org/open5gs/release/2025/03/30/release-v2.7.5.html"
2929
},
30+
{
31+
"type": "WEB",
32+
"url": "https://open5gs.org/open5gs/release/2025/07/19/release-v2.7.6.html"
33+
},
3034
{
3135
"type": "WEB",
3236
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-newplanes-open5gs"

‎advisories/unreviewed/2025/10/GHSA-9vm5-3w25-78p5/GHSA-9vm5-3w25-78p5.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9vm5-3w25-78p5",
4+
"modified": "2025-10-29T12:30:25Z",
5+
"published": "2025-10-29T12:30:25Z",
6+
"aliases": [
7+
"CVE-2015-10147"
8+
],
9+
"details": "The Easy Testimonial Slider and Form plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-10147"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://wordpress.org/plugins/easy-testimonial-rotator"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f44483df-e50d-4dcf-8a6f-499e2bd05b89?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-89"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-10-29T10:15:36Z"
39+
}
40+
}

‎advisories/unreviewed/2025/10/GHSA-fvmg-22f6-q6vj/GHSA-fvmg-22f6-q6vj.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fvmg-22f6-q6vj",
4+
"modified": "2025-10-29T12:30:25Z",
5+
"published": "2025-10-29T12:30:25Z",
6+
"aliases": [
7+
"CVE-2025-12450"
8+
],
9+
"details": "The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 7.5.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12450"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/litespeedtech/lscache_wp/commit/3d473f44d37ec2a834162ff1d86c017e9ae67db3"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/98f71c32-9453-4598-acb5-242818508c74?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-10-29T10:15:36Z"
39+
}
40+
}

‎advisories/unreviewed/2025/10/GHSA-gqxj-68c6-vgjx/GHSA-gqxj-68c6-vgjx.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gqxj-68c6-vgjx",
4+
"modified": "2025-10-29T12:30:25Z",
5+
"published": "2025-10-29T12:30:25Z",
6+
"aliases": [
7+
"CVE-2025-12142"
8+
],
9+
"details": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:D/RE:L/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12142"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A8107&LanguageCode=en&DocumentPartId=&Action=Launch"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-120"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-10-29T12:15:35Z"
39+
}
40+
}

‎advisories/unreviewed/2025/10/GHSA-m3r7-hp4v-q24g/GHSA-m3r7-hp4v-q24g.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-m3r7-hp4v-q24g",
4-
"modified": "2025-10-28T15:30:42Z",
4+
"modified": "2025-10-29T12:30:25Z",
55
"published": "2025-10-27T15:30:42Z",
66
"aliases": [
77
"CVE-2025-41067"
@@ -27,6 +27,10 @@
2727
"type": "WEB",
2828
"url": "https://open5gs.org/open5gs/release/2025/03/30/release-v2.7.5.html"
2929
},
30+
{
31+
"type": "WEB",
32+
"url": "https://open5gs.org/open5gs/release/2025/07/19/release-v2.7.6.html"
33+
},
3034
{
3135
"type": "WEB",
3236
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-newplanes-open5gs"

‎advisories/unreviewed/2025/10/GHSA-qp98-37p8-mxj7/GHSA-qp98-37p8-mxj7.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qp98-37p8-mxj7",
4+
"modified": "2025-10-29T12:30:25Z",
5+
"published": "2025-10-29T12:30:25Z",
6+
"aliases": [
7+
"CVE-2023-39177"
8+
],
9+
"details": "Rejected reason: Duplicate of CVE-2023-52442.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39177"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-10-29T12:15:32Z"
24+
}
25+
}

‎advisories/unreviewed/2025/10/GHSA-vch3-8jh3-g32c/GHSA-vch3-8jh3-g32c.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vch3-8jh3-g32c",
4+
"modified": "2025-10-29T12:30:25Z",
5+
"published": "2025-10-29T12:30:25Z",
6+
"aliases": [
7+
"CVE-2025-12461"
8+
],
9+
"details": "This vulnerability allows an attacker to access parts of the application that are not protected by any type of access control. The attacker could access this path ‘…/epsilonnet/License/About.aspx’ and obtain information on both the licence and the configuration of the product by knowing which modules are installed.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12461"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/unprotected-access-parts-application-epsilon-rh-grupo-castilla"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-522"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-29T11:15:43Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-xrw3-prcw-c39g/GHSA-xrw3-prcw-c39g.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xrw3-prcw-c39g",
4+
"modified": "2025-10-29T12:30:25Z",
5+
"published": "2025-10-29T12:30:25Z",
6+
"aliases": [
7+
"CVE-2023-39178"
8+
],
9+
"details": "Rejected reason: Duplicate of CVE-2023-52441.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39178"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-10-29T12:15:32Z"
24+
}
25+
}

0 commit comments

Comments
 (0)