Skip to content

Commit 1d45369

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-47hm-hwg5-7m57 GHSA-986g-8crq-6x83 GHSA-wmcg-whfp-429v
1 parent 668fd99 commit 1d45369

File tree

3 files changed

+164
-0
lines changed

3 files changed

+164
-0
lines changed

‎advisories/unreviewed/2025/10/GHSA-47hm-hwg5-7m57/GHSA-47hm-hwg5-7m57.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-47hm-hwg5-7m57",
4+
"modified": "2025-10-19T21:30:24Z",
5+
"published": "2025-10-19T21:30:24Z",
6+
"aliases": [
7+
"CVE-2025-11943"
8+
],
9+
"details": "A vulnerability has been found in 70mai X200 up to 20251010. Affected by this vulnerability is an unknown functionality of the component HTTP Web Server. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11943"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/geo-chen/70mai/blob/main/README.md#finding-10-exposed-root-password-via-unauthenticated-http-server"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.329022"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.329022"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.672521"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-1392"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-10-19T20:15:36Z"
51+
}
52+
}

‎advisories/unreviewed/2025/10/GHSA-986g-8crq-6x83/GHSA-986g-8crq-6x83.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-986g-8crq-6x83",
4+
"modified": "2025-10-19T21:30:24Z",
5+
"published": "2025-10-19T21:30:24Z",
6+
"aliases": [
7+
"CVE-2025-11945"
8+
],
9+
"details": "A vulnerability was identified in toeverything AFFiNE up to 0.24.1. This vulnerability affects unknown code of the component Avatar Upload Image Endpoint. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11945"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://drive.google.com/file/d/1L6gX0GY8cE9rS6o50oJzuMRPVMerFQNS"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.329025"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.329025"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.670888"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-10-19T21:15:36Z"
51+
}
52+
}

‎advisories/unreviewed/2025/10/GHSA-wmcg-whfp-429v/GHSA-wmcg-whfp-429v.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wmcg-whfp-429v",
4+
"modified": "2025-10-19T21:30:24Z",
5+
"published": "2025-10-19T21:30:24Z",
6+
"aliases": [
7+
"CVE-2025-11944"
8+
],
9+
"details": "A vulnerability was determined in givanz Vvveb up to 1.0.7.3. This affects the function Import of the file admin/controller/tools/import.php of the component Raw SQL Handler. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 52204b4a106b2fb02d16eee06a88a1f2697f9b35. It is recommended to apply a patch to fix this issue.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11944"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/givanz/Vvveb/issues/332"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/givanz/Vvveb/issues/332#issue-3505043543"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/givanz/Vvveb/commit/52204b4a106b2fb02d16eee06a88a1f2697f9b35"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?ctiid.329024"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?id.329024"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.673129"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-74"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2025-10-19T20:15:36Z"
59+
}
60+
}

0 commit comments

Comments
 (0)