Skip to content

Commit 22bc74a

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-26wj-qjvf-gf89 GHSA-2w2q-r6q7-86fg GHSA-2x59-2w3w-3ccw GHSA-5rcg-7jx4-f3xr GHSA-5wvf-mw3c-73fm GHSA-63jh-v6wx-r73j GHSA-7q72-8f9r-v4mw GHSA-9hwh-38g7-jrxm GHSA-c2x5-h372-v5w7 GHSA-fxm8-3753-c2p6 GHSA-h3mf-62g7-rhfj GHSA-hpjm-36pf-pv8v GHSA-jgm2-j5pr-pph9 GHSA-jvgr-7mgj-9rx2 GHSA-jwpw-v44x-63pc GHSA-q57j-wgw3-jw48 GHSA-xxxg-8p58-2qqv
1 parent 423f554 commit 22bc74a

File tree

17 files changed

+846
-1
lines changed

17 files changed

+846
-1
lines changed

‎advisories/unreviewed/2025/10/GHSA-26wj-qjvf-gf89/GHSA-26wj-qjvf-gf89.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-26wj-qjvf-gf89",
4+
"modified": "2025-10-27T06:30:27Z",
5+
"published": "2025-10-27T06:30:27Z",
6+
"aliases": [
7+
"CVE-2025-12212"
8+
],
9+
"details": "A weakness has been identified in Tenda O3 1.0.0.10(2478). This affects the function SetValue/GetValue of the file /goform/setNetworkService. This manipulation of the argument upnpEn causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12212"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/setNetworkService.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.329882"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.329882"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.673267"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-10-27T04:15:50Z"
55+
}
56+
}

‎advisories/unreviewed/2025/10/GHSA-2w2q-r6q7-86fg/GHSA-2w2q-r6q7-86fg.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2w2q-r6q7-86fg",
4+
"modified": "2025-10-27T06:30:28Z",
5+
"published": "2025-10-27T06:30:28Z",
6+
"aliases": [
7+
"CVE-2025-12226"
8+
],
9+
"details": "A vulnerability was found in SourceCodester Best House Rental Management System 1.0. Impacted is the function save_house of the file /admin_class.php. Performing manipulation of the argument house_no results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12226"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/zhang947/vul/blob/main/report.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.329896"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.329896"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.673611"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.674055"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.675883"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://www.sourcecodester.com"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-74"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": false,
61+
"github_reviewed_at": null,
62+
"nvd_published_at": "2025-10-27T05:15:38Z"
63+
}
64+
}

‎advisories/unreviewed/2025/10/GHSA-2x59-2w3w-3ccw/GHSA-2x59-2w3w-3ccw.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2x59-2w3w-3ccw",
4+
"modified": "2025-10-27T06:30:28Z",
5+
"published": "2025-10-27T06:30:28Z",
6+
"aliases": [
7+
"CVE-2025-12229"
8+
],
9+
"details": "A security flaw has been discovered in projectworlds Expense Management System 1.0. This affects an unknown function of the file /public/admin/roles/create of the component Roles Page. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be exploited.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12229"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/QIU-DIE/CVE/issues/10"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.329899"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.329899"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.673706"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-10-27T06:15:38Z"
51+
}
52+
}

‎advisories/unreviewed/2025/10/GHSA-5rcg-7jx4-f3xr/GHSA-5rcg-7jx4-f3xr.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5rcg-7jx4-f3xr",
4+
"modified": "2025-10-27T06:30:26Z",
5+
"published": "2025-10-27T06:30:26Z",
6+
"aliases": [
7+
"CVE-2025-12211"
8+
],
9+
"details": "A security flaw has been discovered in Tenda O3 1.0.0.10(2478). Affected by this issue is the function SetValue/GetValue of the file /goform/setDmzInfo. The manipulation of the argument dmzIP results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12211"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/setDmzInfo.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.329881"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.329881"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.673265"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-10-27T04:15:48Z"
55+
}
56+
}

‎advisories/unreviewed/2025/10/GHSA-5wvf-mw3c-73fm/GHSA-5wvf-mw3c-73fm.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5wvf-mw3c-73fm",
4+
"modified": "2025-10-27T06:30:28Z",
5+
"published": "2025-10-27T06:30:28Z",
6+
"aliases": [
7+
"CVE-2025-12231"
8+
],
9+
"details": "A security vulnerability has been detected in projectworlds Expense Management System 1.0. Affected is an unknown function of the file /public/admin/expense_categories/create of the component Expense Categories Page. Such manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12231"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/QIU-DIE/CVE/issues/12"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.329901"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.329901"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.673708"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-10-27T06:15:39Z"
51+
}
52+
}

‎advisories/unreviewed/2025/10/GHSA-63jh-v6wx-r73j/GHSA-63jh-v6wx-r73j.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-63jh-v6wx-r73j",
4+
"modified": "2025-10-27T06:30:28Z",
5+
"published": "2025-10-27T06:30:28Z",
6+
"aliases": [
7+
"CVE-2025-12230"
8+
],
9+
"details": "A weakness has been identified in projectworlds Expense Management System 1.0. This impacts an unknown function of the file /public/admin/currencies/create of the component Currency Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12230"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/QIU-DIE/CVE/issues/11"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.329900"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.329900"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.673707"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-10-27T06:15:38Z"
51+
}
52+
}

‎advisories/unreviewed/2025/10/GHSA-7q72-8f9r-v4mw/GHSA-7q72-8f9r-v4mw.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7q72-8f9r-v4mw",
4-
"modified": "2025-10-01T21:31:21Z",
4+
"modified": "2025-10-27T06:30:26Z",
55
"published": "2025-10-01T21:31:21Z",
66
"aliases": [
77
"CVE-2025-46205"
@@ -19,6 +19,10 @@
1919
"type": "ADVISORY",
2020
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46205"
2121
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/ShadowByte1/CVE-Reports/issues/1"
25+
},
2226
{
2327
"type": "WEB",
2428
"url": "https://github.com/ShadowByte1/CVE-Reports/blob/main/CVE-2025-46205.md"

0 commit comments

Comments
 (0)