Skip to content

Commit 3413223

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2rmp-qgp4-wg66 GHSA-f46x-7cm8-vxx8 GHSA-f985-hh3h-wcqc
1 parent beb02d9 commit 3413223

File tree

3 files changed

+158
-0
lines changed

3 files changed

+158
-0
lines changed

‎advisories/unreviewed/2025/11/GHSA-2rmp-qgp4-wg66/GHSA-2rmp-qgp4-wg66.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2rmp-qgp4-wg66",
4+
"modified": "2025-11-15T21:30:12Z",
5+
"published": "2025-11-15T21:30:12Z",
6+
"aliases": [
7+
"CVE-2025-13209"
8+
],
9+
"details": "A weakness has been identified in bestfeng oa_git_free up to 9.5. This affects the function updateWriteBack of the file yimioa-oa9.5\\server\\c-flow\\src\\main\\java\\com\\cloudweb\\oa\\controller\\WorkflowPredefineController.java. This manipulation of the argument writeProp causes xml external entity reference. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13209"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/bkglfpp/CVE-md/blob/main/%E4%BA%91%E7%BD%91%E5%8D%8F%E5%90%8C%E5%8A%9E%E5%85%AC%E7%B3%BB%E7%BB%9F/XXE.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.332528"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.332528"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.685626"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-610"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-11-15T19:15:43Z"
51+
}
52+
}

‎advisories/unreviewed/2025/11/GHSA-f46x-7cm8-vxx8/GHSA-f46x-7cm8-vxx8.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f46x-7cm8-vxx8",
4+
"modified": "2025-11-15T21:30:12Z",
5+
"published": "2025-11-15T21:30:12Z",
6+
"aliases": [
7+
"CVE-2025-13210"
8+
],
9+
"details": "A security vulnerability has been detected in itsourcecode Inventory Management System 1.0. This impacts an unknown function of the file /admin/products/index.php?view=add. Such manipulation of the argument PROMODEL leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13210"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/yihaofuweng/cve/issues/56"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.332529"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.332529"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.685702"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-15T19:15:43Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-f985-hh3h-wcqc/GHSA-f985-hh3h-wcqc.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f985-hh3h-wcqc",
4+
"modified": "2025-11-15T21:30:12Z",
5+
"published": "2025-11-15T21:30:12Z",
6+
"aliases": [
7+
"CVE-2025-13221"
8+
],
9+
"details": "A weakness has been identified in Intelbras UnniTI 24.07.11. The affected element is an unknown function of the file /xml/sistema/usuarios.xml. Executing manipulation of the argument Usuario/Senha can lead to unprotected storage of credentials. The attack can be executed remotely. The exploit has been made available to the public and could be exploited.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13221"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.332537"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.332537"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.685825"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.notion.so/eldruin/Intelbras-UnniTI-Plaintext-Admin-Credentials-Disclosure-29c27474cccb8008b2d7ea60affdf86e?source=copy_link"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [],
45+
"severity": "MODERATE",
46+
"github_reviewed": false,
47+
"github_reviewed_at": null,
48+
"nvd_published_at": "2025-11-15T20:15:42Z"
49+
}
50+
}

0 commit comments

Comments
 (0)