Skip to content

Commit 2483202

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-235q-qgg3-c2xw GHSA-7xmv-xm4j-88mj GHSA-fcmx-4fpp-mg5q GHSA-gcfw-6v54-vq4f GHSA-mggq-rppf-vgmq GHSA-xjx2-5qhc-hpw9
1 parent 0f6bb1d commit 2483202

File tree

6 files changed

+340
-0
lines changed

6 files changed

+340
-0
lines changed

‎advisories/unreviewed/2025/11/GHSA-235q-qgg3-c2xw/GHSA-235q-qgg3-c2xw.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-235q-qgg3-c2xw",
4+
"modified": "2025-11-23T21:30:32Z",
5+
"published": "2025-11-23T21:30:32Z",
6+
"aliases": [
7+
"CVE-2025-13567"
8+
],
9+
"details": "A vulnerability was detected in itsourcecode COVID Tracking System 1.0. This affects an unknown function of the file /admin/?page=establishment. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13567"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Abxery/cveee/issues/9"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.333331"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.333331"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.698116"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-23T20:15:40Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-7xmv-xm4j-88mj/GHSA-7xmv-xm4j-88mj.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7xmv-xm4j-88mj",
4+
"modified": "2025-11-23T21:30:33Z",
5+
"published": "2025-11-23T21:30:33Z",
6+
"aliases": [
7+
"CVE-2025-13569"
8+
],
9+
"details": "A vulnerability has been found in itsourcecode COVID Tracking System 1.0. Affected is an unknown function of the file /admin/?page=city. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13569"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/yihaofuweng/cve/issues/58"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.333333"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.333333"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.698655"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-23T21:15:58Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-fcmx-4fpp-mg5q/GHSA-fcmx-4fpp-mg5q.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fcmx-4fpp-mg5q",
4+
"modified": "2025-11-23T21:30:32Z",
5+
"published": "2025-11-23T21:30:32Z",
6+
"aliases": [
7+
"CVE-2025-13565"
8+
],
9+
"details": "A weakness has been identified in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the file /model/user/resetPassword.php. Executing manipulation can lead to weak password recovery. The attack may be performed from remote. The exploit has been made available to the public and could be exploited.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13565"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.333329"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.333329"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.697984"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.notion.so/Unauthenticated-Password-Reset-Vulnerability-in-SourceCodester-Inventory-Management-System-2b023917db8c8001b5ecf4c50a54dfbd?source=copy_link"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-640"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-23T19:15:46Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-gcfw-6v54-vq4f/GHSA-gcfw-6v54-vq4f.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gcfw-6v54-vq4f",
4+
"modified": "2025-11-23T21:30:32Z",
5+
"published": "2025-11-23T21:30:32Z",
6+
"aliases": [
7+
"CVE-2025-13568"
8+
],
9+
"details": "A flaw has been found in itsourcecode COVID Tracking System 1.0. This impacts an unknown function of the file /admin/?page=people. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13568"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Abxery/cveee/issues/10"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.333332"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.333332"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.698117"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-23T21:15:58Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-mggq-rppf-vgmq/GHSA-mggq-rppf-vgmq.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mggq-rppf-vgmq",
4+
"modified": "2025-11-23T21:30:32Z",
5+
"published": "2025-11-23T21:30:32Z",
6+
"aliases": [
7+
"CVE-2025-13566"
8+
],
9+
"details": "A security vulnerability has been detected in jarun nnn up to 5.1. The impacted element is the function show_content_in_floating_window/run_cmd_as_plugin of the file nnn/src/nnn.c. The manipulation leads to double free. An attack has to be approached locally. The identifier of the patch is 2f07ccdf21e705377862e5f9dfa31e1694979ac7. It is suggested to install a patch to address this issue.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13566"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/jarun/nnn/issues/2091#issue-3635886658"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/jarun/nnn/issues/2091#issuecomment-3547591759"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/jarun/nnn/commit/2f07ccdf21e705377862e5f9dfa31e1694979ac7"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?ctiid.333330"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?id.333330"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.698113"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-119"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2025-11-23T20:15:39Z"
59+
}
60+
}

‎advisories/unreviewed/2025/11/GHSA-xjx2-5qhc-hpw9/GHSA-xjx2-5qhc-hpw9.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xjx2-5qhc-hpw9",
4+
"modified": "2025-11-23T21:30:32Z",
5+
"published": "2025-11-23T21:30:32Z",
6+
"aliases": [
7+
"CVE-2025-13564"
8+
],
9+
"details": "A security flaw has been discovered in SourceCodester Pre-School Management System 1.0. Impacted is the function removefile of the file app/controllers/FilehelperController.php. Performing manipulation of the argument filepath results in denial of service. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13564"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/0xffaaa/cve/blob/main/Pre_School_Management_System_Arbitrary_File_Deletion_Vulnerabilit.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.333328"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.333328"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.697083"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-404"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-23T19:15:46Z"
55+
}
56+
}

0 commit comments

Comments
 (0)