Skip to content

Commit 36c2eec

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2xr7-8qgr-hch2 GHSA-3cxw-q7h6-95gj GHSA-4q8q-3r7h-5j3f GHSA-53hw-7r73-89x3 GHSA-5mp6-372v-5m92 GHSA-5w85-6378-9j4v GHSA-7h47-c92x-cf8w GHSA-829c-jpvx-vfrv GHSA-8h8x-gmrp-h6m6 GHSA-8v4q-mf53-phfq GHSA-8wr8-qf33-p6vc GHSA-f5xc-6j3j-hf4h GHSA-fggr-pw4j-mqwr GHSA-q4g4-9h3h-h3p3 GHSA-vf25-p22q-rg8q GHSA-w247-2vxj-mgr3 GHSA-w4jg-8w9c-f6rv GHSA-wjpm-rxpc-g4gj GHSA-wjwr-77x9-rqfh GHSA-wwrp-v67c-phr5 GHSA-xcmx-jj38-v524 GHSA-xp9w-j3h7-4wxv GHSA-xr34-pc3c-449f
1 parent 6443a70 commit 36c2eec

File tree

23 files changed

+856
-0
lines changed

23 files changed

+856
-0
lines changed

‎advisories/unreviewed/2025/12/GHSA-2xr7-8qgr-hch2/GHSA-2xr7-8qgr-hch2.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2xr7-8qgr-hch2",
4+
"modified": "2025-12-19T09:30:28Z",
5+
"published": "2025-12-19T09:30:28Z",
6+
"aliases": [
7+
"CVE-2025-66493"
8+
],
9+
"details": "A use-after-free vulnerability exists in the AcroForm handling of Foxit PDF Reader and Foxit PDF Editor before 2025.2.1,14.0.1 and 13.2.1 \n\non Windows\n\n. When opening a PDF containing specially crafted JavaScript, a pointer to memory that has already been freed may be accessed or dereferenced, potentially allowing a remote attacker to execute arbitrary code.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66493"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.foxit.com/support/security-bulletins.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-416"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-19T07:16:01Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-3cxw-q7h6-95gj/GHSA-3cxw-q7h6-95gj.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3cxw-q7h6-95gj",
4+
"modified": "2025-12-19T09:30:27Z",
5+
"published": "2025-12-19T09:30:27Z",
6+
"aliases": [
7+
"CVE-2025-66173"
8+
],
9+
"details": "There is a privilege escalation vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an attacker with physical access could exploit this vulnerability by connecting to the affected products and gaining access to an unrestricted shell environment.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66173"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/serial-port-privilege-escalation-vulnerabilities-in-some-hikvision-nvr-devices"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "MODERATE",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2025-12-19T07:16:01Z"
33+
}
34+
}

‎advisories/unreviewed/2025/12/GHSA-4q8q-3r7h-5j3f/GHSA-4q8q-3r7h-5j3f.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4q8q-3r7h-5j3f",
4+
"modified": "2025-12-19T09:30:28Z",
5+
"published": "2025-12-19T09:30:28Z",
6+
"aliases": [
7+
"CVE-2025-66494"
8+
],
9+
"details": "A use-after-free vulnerability exists in the PDF file parsing of Foxit PDF Reader before 2025.2.1, 14.0.1, and 13.2.1 on Windows. A PDF object managed by multiple parent objects could be freed while still being referenced, potentially allowing a remote attacker to execute arbitrary code.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66494"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.foxit.com/support/security-bulletins.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-416"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-19T07:16:02Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-53hw-7r73-89x3/GHSA-53hw-7r73-89x3.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-53hw-7r73-89x3",
4+
"modified": "2025-12-19T09:30:28Z",
5+
"published": "2025-12-19T09:30:28Z",
6+
"aliases": [
7+
"CVE-2025-66497"
8+
],
9+
"details": "A memory corruption vulnerability exists in the 3D annotation handling of Foxit PDF Reader due to insufficient bounds checking when parsing PRC data. When opening a PDF file containing malformed or specially crafted PRC content, out-of-bounds memory access may occur, resulting in memory corruption.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66497"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.foxit.com/support/security-bulletins.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-125"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-19T07:16:02Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-5mp6-372v-5m92/GHSA-5mp6-372v-5m92.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5mp6-372v-5m92",
4+
"modified": "2025-12-19T09:30:29Z",
5+
"published": "2025-12-19T09:30:29Z",
6+
"aliases": [
7+
"CVE-2025-66522"
8+
],
9+
"details": "A stored cross-site scripting (XSS) vulnerability exists in the Digital IDs functionality of the Foxit PDF Editor Cloud (pdfonline.foxit.com). The application does not properly sanitize or encode the Common Name field of Digital IDs before inserting user-supplied content into the DOM. As a result, embedded HTML or JavaScript may execute whenever the Digital IDs dialog is accessed or when the affected PDF is loaded.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66522"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.foxit.com/support/security-bulletins.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-19T08:15:54Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-5w85-6378-9j4v/GHSA-5w85-6378-9j4v.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5w85-6378-9j4v",
4+
"modified": "2025-12-19T09:30:28Z",
5+
"published": "2025-12-19T09:30:28Z",
6+
"aliases": [
7+
"CVE-2025-66499"
8+
],
9+
"details": "A heap-based buffer overflow vulnerability exists in the PDF parsing of Foxit PDF Reader when processing specially crafted JBIG2 data. An integer overflow in the calculation of the image buffer size may occur, potentially allowing a remote attacker to execute arbitrary code.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66499"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.foxit.com/support/security-bulletins.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-190"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-19T07:16:03Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-7h47-c92x-cf8w/GHSA-7h47-c92x-cf8w.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7h47-c92x-cf8w",
4+
"modified": "2025-12-19T09:30:28Z",
5+
"published": "2025-12-19T09:30:28Z",
6+
"aliases": [
7+
"CVE-2025-66174"
8+
],
9+
"details": "There is an improper authentication vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an attacker with physical access could exploit this vulnerability by connecting to the affected products and run a series of commands.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66174"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/serial-port-privilege-escalation-vulnerabilities-in-some-hikvision-nvr-devices"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "MODERATE",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2025-12-19T07:16:01Z"
33+
}
34+
}

‎advisories/unreviewed/2025/12/GHSA-829c-jpvx-vfrv/GHSA-829c-jpvx-vfrv.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-829c-jpvx-vfrv",
4+
"modified": "2025-12-19T09:30:27Z",
5+
"published": "2025-12-19T09:30:27Z",
6+
"aliases": [
7+
"CVE-2025-13008"
8+
],
9+
"details": "An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13008"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://product.m-files.com/security-advisories/cve-2025-13008"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-359"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-19T07:15:58Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-8h8x-gmrp-h6m6/GHSA-8h8x-gmrp-h6m6.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8h8x-gmrp-h6m6",
4+
"modified": "2025-12-19T09:30:29Z",
5+
"published": "2025-12-19T09:30:29Z",
6+
"aliases": [
7+
"CVE-2025-11747"
8+
],
9+
"details": "The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the colibri_blog_posts shortcode in all versions up to, and including, 1.0.345 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11747"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/shortcodes/blog-posts.php#L251"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/changeset/3421590/colibri-page-builder/trunk/extend-builder/shortcodes/blog-posts.php"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e3305b39-5f7b-493b-80b5-cb925c2710c1?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-19T09:15:45Z"
43+
}
44+
}

‎advisories/unreviewed/2025/12/GHSA-8v4q-mf53-phfq/GHSA-8v4q-mf53-phfq.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8v4q-mf53-phfq",
4+
"modified": "2025-12-19T09:30:28Z",
5+
"published": "2025-12-19T09:30:28Z",
6+
"aliases": [
7+
"CVE-2025-66519"
8+
],
9+
"details": "A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Layer Import functionality. A crafted payload can be injected into the “Create new Layer” field during layer import and is later rendered into the DOM without proper sanitization. As a result, the injected script executes when the Layers panel is accessed.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66519"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.foxit.com/support/security-bulletins.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-19T08:15:53Z"
35+
}
36+
}

0 commit comments

Comments
 (0)