Skip to content

Commit 0d10035

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent ef0209a commit 0d10035

File tree

25 files changed

+800
-0
lines changed

25 files changed

+800
-0
lines changed

‎advisories/unreviewed/2025/11/GHSA-4245-33hh-r4j6/GHSA-4245-33hh-r4j6.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4245-33hh-r4j6",
4+
"modified": "2025-11-05T06:30:25Z",
5+
"published": "2025-11-05T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-64453"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64453"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-11-05T04:15:33Z"
24+
}
25+
}

‎advisories/unreviewed/2025/11/GHSA-49q4-53vc-m8p9/GHSA-49q4-53vc-m8p9.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-49q4-53vc-m8p9",
4+
"modified": "2025-11-05T06:30:25Z",
5+
"published": "2025-11-05T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-11072"
8+
],
9+
"details": "The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11072"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/538117c5-b04c-45fc-a953-6f619fdf7eaf"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-11-05T06:15:32Z"
28+
}
29+
}

‎advisories/unreviewed/2025/11/GHSA-57cg-g95j-25q3/GHSA-57cg-g95j-25q3.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-57cg-g95j-25q3",
4+
"modified": "2025-11-05T06:30:25Z",
5+
"published": "2025-11-05T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-21074"
8+
],
9+
"details": "Out-of-bounds read in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21074"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=11"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "MODERATE",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2025-11-05T06:15:33Z"
33+
}
34+
}

‎advisories/unreviewed/2025/11/GHSA-6p65-2966-2gj7/GHSA-6p65-2966-2gj7.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6p65-2966-2gj7",
4+
"modified": "2025-11-05T06:30:25Z",
5+
"published": "2025-11-05T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-64451"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64451"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-11-05T04:15:33Z"
24+
}
25+
}

‎advisories/unreviewed/2025/11/GHSA-8652-4qrv-r8hp/GHSA-8652-4qrv-r8hp.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8652-4qrv-r8hp",
4+
"modified": "2025-11-05T06:30:25Z",
5+
"published": "2025-11-05T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-64450"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64450"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-11-05T04:15:33Z"
24+
}
25+
}

‎advisories/unreviewed/2025/11/GHSA-8jg3-f28x-33h3/GHSA-8jg3-f28x-33h3.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8jg3-f28x-33h3",
4+
"modified": "2025-11-05T06:30:25Z",
5+
"published": "2025-11-05T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-10567"
8+
],
9+
"details": "The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing attackers to conduct reflected XSS attacks against logged-in users.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10567"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/c7536b0c-3bce-449d-937e-b0195990110a"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-11-05T06:15:32Z"
28+
}
29+
}

‎advisories/unreviewed/2025/11/GHSA-93gj-8p48-h7f8/GHSA-93gj-8p48-h7f8.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-93gj-8p48-h7f8",
4+
"modified": "2025-11-05T06:30:25Z",
5+
"published": "2025-11-05T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-11835"
8+
],
9+
"details": "The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability and validation check on the PMS_AJAX_Checkout_Handler::process_payment() function in all versions up to, and including, 2.16.4. This makes it possible for unauthenticated attackers to trigger stored auto-renew charges for arbitrary members.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11835"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3383182/paid-member-subscriptions"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eb1948bd-c5b4-4fbe-9aa6-19f24325e6bb?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-862"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-05T04:15:32Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-9r3j-gc74-fvx7/GHSA-9r3j-gc74-fvx7.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9r3j-gc74-fvx7",
4+
"modified": "2025-11-05T06:30:25Z",
5+
"published": "2025-11-05T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-21073"
8+
],
9+
"details": "Insecure default configuration in USB connection mode prior to SMR Nov-2025 Release 1 allows privileged physical attackers to access user data. User interaction is required for triggering this vulnerability.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21073"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=11"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "MODERATE",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2025-11-05T06:15:33Z"
33+
}
34+
}

‎advisories/unreviewed/2025/11/GHSA-c798-f247-mv6f/GHSA-c798-f247-mv6f.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c798-f247-mv6f",
4+
"modified": "2025-11-05T06:30:25Z",
5+
"published": "2025-11-05T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-21075"
8+
],
9+
"details": "Out-of-bounds write in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21075"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=11"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "MODERATE",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2025-11-05T06:15:33Z"
33+
}
34+
}

‎advisories/unreviewed/2025/11/GHSA-ch23-x532-vgwg/GHSA-ch23-x532-vgwg.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-ch23-x532-vgwg",
4+
"modified": "2025-11-05T06:30:25Z",
5+
"published": "2025-11-05T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-10873"
8+
],
9+
"details": "The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form action.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10873"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/2eb133db-e1c5-409e-94f8-b71edca5db16"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-11-05T06:15:32Z"
28+
}
29+
}

0 commit comments

Comments
 (0)