Skip to content

Commit 155ffe6

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-856v-8qm2-9wjv GHSA-qc8j-wvjf-7jfj GHSA-3wqv-qpc6-2469 GHSA-8849-h57v-c6xm GHSA-8fjh-p7j5-79fg GHSA-c9jg-5vh8-ff2v GHSA-cfjq-p9cp-c745 GHSA-hm5m-9phw-v9hq GHSA-jh7m-5fwg-gpmf GHSA-mfg3-2r9j-5hv9 GHSA-qf35-h73j-5vfh
1 parent 5b02600 commit 155ffe6

File tree

11 files changed

+466
-2
lines changed

11 files changed

+466
-2
lines changed

‎advisories/github-reviewed/2025/08/GHSA-856v-8qm2-9wjv/GHSA-856v-8qm2-9wjv.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-856v-8qm2-9wjv",
4-
"modified": "2025-11-07T00:30:27Z",
4+
"modified": "2025-11-10T03:30:15Z",
55
"published": "2025-08-07T21:31:08Z",
66
"aliases": [
77
"CVE-2025-7195"
@@ -48,6 +48,14 @@
4848
"type": "WEB",
4949
"url": "https://access.redhat.com/errata/RHSA-2025:19335"
5050
},
51+
{
52+
"type": "WEB",
53+
"url": "https://access.redhat.com/errata/RHSA-2025:19958"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://access.redhat.com/errata/RHSA-2025:19961"
58+
},
5159
{
5260
"type": "WEB",
5361
"url": "https://access.redhat.com/security/cve/CVE-2025-7195"

‎advisories/unreviewed/2025/09/GHSA-qc8j-wvjf-7jfj/GHSA-qc8j-wvjf-7jfj.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-qc8j-wvjf-7jfj",
4-
"modified": "2025-11-08T00:31:00Z",
4+
"modified": "2025-11-10T03:30:15Z",
55
"published": "2025-09-23T18:30:24Z",
66
"aliases": [
77
"CVE-2025-9900"
@@ -47,6 +47,10 @@
4747
"type": "WEB",
4848
"url": "https://access.redhat.com/security/cve/CVE-2025-9900"
4949
},
50+
{
51+
"type": "WEB",
52+
"url": "https://access.redhat.com/errata/RHSA-2025:19947"
53+
},
5054
{
5155
"type": "WEB",
5256
"url": "https://access.redhat.com/errata/RHSA-2025:19906"

‎advisories/unreviewed/2025/11/GHSA-3wqv-qpc6-2469/GHSA-3wqv-qpc6-2469.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3wqv-qpc6-2469",
4+
"modified": "2025-11-10T03:30:15Z",
5+
"published": "2025-11-10T03:30:15Z",
6+
"aliases": [
7+
"CVE-2025-12922"
8+
],
9+
"details": "A vulnerability was found in OpenClinica Community Edition up to 3.12.2/3.13. This affects an unknown part of the file /ImportCRFData?action=confirm of the component CRF Data Import. Performing manipulation of the argument xml_file results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12922"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-rce.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-rce.md#raw-requests-abridged"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.331642"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.331642"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.680873"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-22"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-10T01:15:36Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-8849-h57v-c6xm/GHSA-8849-h57v-c6xm.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8849-h57v-c6xm",
4+
"modified": "2025-11-10T03:30:16Z",
5+
"published": "2025-11-10T03:30:16Z",
6+
"aliases": [
7+
"CVE-2025-12865"
8+
],
9+
"details": "U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, modify, and delete database contents.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12865"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.twcert.org.tw/en/cp-139-10489-a5a6d-2.html"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.twcert.org.tw/tw/cp-132-10488-2df22-1.html"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-89"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-11-10T03:15:42Z"
43+
}
44+
}

‎advisories/unreviewed/2025/11/GHSA-8fjh-p7j5-79fg/GHSA-8fjh-p7j5-79fg.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8fjh-p7j5-79fg",
4+
"modified": "2025-11-10T03:30:15Z",
5+
"published": "2025-11-10T03:30:15Z",
6+
"aliases": [
7+
"CVE-2025-12923"
8+
],
9+
"details": "A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file /dev-api/common/download. Executing manipulation of the argument path can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12923"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Huu1j/CVE/blob/main/chestnutcms%20Arbitrary%20File%20Read.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.331643"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.331643"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.681032"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-22"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-11-10T01:15:37Z"
51+
}
52+
}

‎advisories/unreviewed/2025/11/GHSA-c9jg-5vh8-ff2v/GHSA-c9jg-5vh8-ff2v.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c9jg-5vh8-ff2v",
4+
"modified": "2025-11-10T03:30:16Z",
5+
"published": "2025-11-10T03:30:15Z",
6+
"aliases": [
7+
"CVE-2025-12925"
8+
],
9+
"details": "A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. Impacted is the function getAll/addDic/getAllDic/deleteDic of the file src/main/java/com/rymcu/forest/lucene/api/UserDicController.java. The manipulation results in missing authorization. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12925"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/rymcu/forest/issues/199"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.331645"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.331645"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.681080"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-862"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-11-10T02:15:34Z"
51+
}
52+
}

‎advisories/unreviewed/2025/11/GHSA-cfjq-p9cp-c745/GHSA-cfjq-p9cp-c745.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cfjq-p9cp-c745",
4+
"modified": "2025-11-10T03:30:16Z",
5+
"published": "2025-11-10T03:30:16Z",
6+
"aliases": [
7+
"CVE-2025-12926"
8+
],
9+
"details": "A weakness has been identified in SourceCodester Farm Management System 1.0. The affected element is an unknown function of the file /review.php. This manipulation of the argument pid causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12926"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/R178/cve/issues/1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.331646"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.331646"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.681506"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-10T03:15:42Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-hm5m-9phw-v9hq/GHSA-hm5m-9phw-v9hq.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hm5m-9phw-v9hq",
4+
"modified": "2025-11-10T03:30:16Z",
5+
"published": "2025-11-10T03:30:16Z",
6+
"aliases": [
7+
"CVE-2025-12866"
8+
],
9+
"details": "EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the 'forgot password' link, thereby successfully resetting any user's password.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12866"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.twcert.org.tw/en/cp-139-10491-004b0-2.html"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.twcert.org.tw/tw/cp-132-10490-2534b-1.html"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-640"
38+
],
39+
"severity": "CRITICAL",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-11-10T03:15:42Z"
43+
}
44+
}

0 commit comments

Comments
 (0)