Skip to content

Commit 29f52ff

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent b1c45d7 commit 29f52ff

File tree

45 files changed

+1575
-26
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+1575
-26
lines changed

‎advisories/github-reviewed/2025/11/GHSA-6pmj-xjxp-p8g9/GHSA-6pmj-xjxp-p8g9.json‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-6pmj-xjxp-p8g9",
4-
"modified": "2025-11-19T14:24:56Z",
4+
"modified": "2025-12-05T18:31:51Z",
55
"published": "2025-11-18T18:48:01Z",
66
"aliases": [
77
"CVE-2025-65093"
@@ -28,11 +28,14 @@
2828
"introduced": "0"
2929
},
3030
{
31-
"last_affected": "25.10.0"
31+
"fixed": "25.11.0"
3232
}
3333
]
3434
}
35-
]
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 25.10.0"
38+
}
3639
}
3740
],
3841
"references": [

‎advisories/unreviewed/2024/01/GHSA-v432-65m6-c4x6/GHSA-v432-65m6-c4x6.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-v432-65m6-c4x6",
4-
"modified": "2024-01-04T15:30:22Z",
4+
"modified": "2025-12-05T18:31:06Z",
55
"published": "2024-01-04T15:30:22Z",
66
"aliases": [
77
"CVE-2023-49666"
88
],
9-
"details": "Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'custmer_details' parameter of the submit_material_list.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n",
9+
"details": "Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'custmer_details' parameter of the submit_material_list.php resource does not validate the characters received and they are sent unfiltered to the database.",
1010
"severity": [
1111
{
1212
"type": "CVSS_V3",

‎advisories/unreviewed/2024/03/GHSA-f357-4jg5-3c72/GHSA-f357-4jg5-3c72.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-f357-4jg5-3c72",
4-
"modified": "2024-03-28T09:31:12Z",
4+
"modified": "2025-12-05T18:31:07Z",
55
"published": "2024-03-28T09:31:12Z",
66
"aliases": [
77
"CVE-2024-25599"
88
],
9-
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Castos Seriously Simple Podcasting allows Reflected XSS.This issue affects Seriously Simple Podcasting: from n/a through 3.0.2.\n\n",
9+
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Castos Seriously Simple Podcasting allows Reflected XSS.This issue affects Seriously Simple Podcasting: from n/a through 3.0.2.",
1010
"severity": [
1111
{
1212
"type": "CVSS_V3",

‎advisories/unreviewed/2025/03/GHSA-8h4g-52x5-5r4v/GHSA-8h4g-52x5-5r4v.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8h4g-52x5-5r4v",
4-
"modified": "2025-03-26T12:30:35Z",
4+
"modified": "2025-12-05T18:31:07Z",
55
"published": "2025-03-26T12:30:35Z",
66
"aliases": [
77
"CVE-2025-1913"
@@ -19,6 +19,10 @@
1919
"type": "ADVISORY",
2020
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1913"
2121
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/S0haib518-KSA/CVE-2025-1913-PoC"
25+
},
2226
{
2327
"type": "WEB",
2428
"url": "https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/trunk/admin/modules/import/classes/class-import-ajax.php"

‎advisories/unreviewed/2025/12/GHSA-2hhf-9f74-3jqg/GHSA-2hhf-9f74-3jqg.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2hhf-9f74-3jqg",
4+
"modified": "2025-12-05T18:31:11Z",
5+
"published": "2025-12-05T18:31:11Z",
6+
"aliases": [
7+
"CVE-2025-64056"
8+
],
9+
"details": "File upload vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store arbitrary files on the filesystem.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64056"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64056.md"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "http://fanvil.com"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2025-12-05T16:15:50Z"
32+
}
33+
}

‎advisories/unreviewed/2025/12/GHSA-399h-rrqc-rpgv/GHSA-399h-rrqc-rpgv.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-399h-rrqc-rpgv",
4-
"modified": "2025-12-02T18:30:30Z",
4+
"modified": "2025-12-05T18:31:07Z",
55
"published": "2025-12-01T18:30:38Z",
66
"aliases": [
77
"CVE-2025-13836"
@@ -27,6 +27,10 @@
2727
"type": "WEB",
2828
"url": "https://github.com/python/cpython/pull/119454"
2929
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15"
33+
},
3034
{
3135
"type": "WEB",
3236
"url": "https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155"

‎advisories/unreviewed/2025/12/GHSA-3ch6-fjmw-mj86/GHSA-3ch6-fjmw-mj86.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3ch6-fjmw-mj86",
4+
"modified": "2025-12-05T18:31:10Z",
5+
"published": "2025-12-05T18:31:10Z",
6+
"aliases": [
7+
"CVE-2025-14089"
8+
],
9+
"details": "A vulnerability was identified in Himool ERP up to 2.2. Affected by this issue is the function update_account of the file /api/admin/update_account/ of the component AdminActionViewSet. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14089"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/caigo8/CVE-md/blob/main/BoxwoodERP/%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.334479"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.334479"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.696049"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-266"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-05T16:15:48Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-3j3g-3pw9-9vcc/GHSA-3j3g-3pw9-9vcc.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3j3g-3pw9-9vcc",
4-
"modified": "2025-12-05T12:30:13Z",
4+
"modified": "2025-12-05T18:31:09Z",
55
"published": "2025-12-05T12:30:13Z",
66
"aliases": [
77
"CVE-2025-66200"
88
],
99
"details": "mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.\n\nThis issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.\n\nUsers are recommended to upgrade to version 2.4.66, which fixes the issue.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-288"
34+
],
35+
"severity": "MODERATE",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2025-12-05T11:15:52Z"

‎advisories/unreviewed/2025/12/GHSA-479c-6w78-7qfg/GHSA-479c-6w78-7qfg.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-479c-6w78-7qfg",
4+
"modified": "2025-12-05T18:31:11Z",
5+
"published": "2025-12-05T18:31:11Z",
6+
"aliases": [
7+
"CVE-2025-65879"
8+
],
9+
"details": "Warehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability. The /goods/deleteGoods endpoint accepts a user-controlled goodsimg parameter, which is directly concatenated with the server's UPLOAD_PATH and passed to File.delete() without validation. A remote authenticated attacker can delete arbitrary files on the server by supplying directory traversal payloads.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65879"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/W000i/vuln/issues/3"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-12-05T17:16:04Z"
28+
}
29+
}

‎advisories/unreviewed/2025/12/GHSA-4m29-g52g-c6qc/GHSA-4m29-g52g-c6qc.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4m29-g52g-c6qc",
4-
"modified": "2025-12-05T15:30:27Z",
4+
"modified": "2025-12-05T18:31:10Z",
55
"published": "2025-12-05T15:30:27Z",
66
"aliases": [
77
"CVE-2025-58098"
88
],
99
"details": "Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd=\"...\" directives.\n\nThis issue affects Apache HTTP Server before 2.4.66.\n\nUsers are recommended to upgrade to version 2.4.66, which fixes the issue.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -27,7 +32,7 @@
2732
"cwe_ids": [
2833
"CWE-201"
2934
],
30-
"severity": null,
35+
"severity": "HIGH",
3136
"github_reviewed": false,
3237
"github_reviewed_at": null,
3338
"nvd_published_at": "2025-12-05T14:15:49Z"

0 commit comments

Comments
 (0)