Skip to content

Commit 3a4f105

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-423v-7q98-2mj3 GHSA-23pm-7qvj-mjmc GHSA-fp2q-4h72-pcjp GHSA-g3h4-h85m-jqvx GHSA-rmhj-6jmw-2pxq GHSA-wghp-x8f8-p2w5 GHSA-x8w5-83w4-56jr
1 parent 9197997 commit 3a4f105

File tree

7 files changed

+333
-1
lines changed

7 files changed

+333
-1
lines changed

‎advisories/unreviewed/2025/11/GHSA-423v-7q98-2mj3/GHSA-423v-7q98-2mj3.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-423v-7q98-2mj3",
4-
"modified": "2025-11-24T06:31:25Z",
4+
"modified": "2025-12-07T18:31:16Z",
55
"published": "2025-11-24T06:31:25Z",
66
"aliases": [
77
"CVE-2025-13585"
@@ -31,6 +31,10 @@
3131
"type": "WEB",
3232
"url": "https://code-projects.org"
3333
},
34+
{
35+
"type": "WEB",
36+
"url": "https://itsourcecode.com"
37+
},
3438
{
3539
"type": "WEB",
3640
"url": "https://vuldb.com/?ctiid.333349"
@@ -42,6 +46,10 @@
4246
{
4347
"type": "WEB",
4448
"url": "https://vuldb.com/?submit.699840"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/?submit.701229"
4553
}
4654
],
4755
"database_specific": {

‎advisories/unreviewed/2025/12/GHSA-23pm-7qvj-mjmc/GHSA-23pm-7qvj-mjmc.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-23pm-7qvj-mjmc",
4+
"modified": "2025-12-07T18:31:16Z",
5+
"published": "2025-12-07T18:31:16Z",
6+
"aliases": [
7+
"CVE-2025-14198"
8+
],
9+
"details": "A vulnerability was detected in Verysync 微力同步 2.21.3. This affects an unknown function of the file /safebrowsing/clientreport/download?key=dummytoken of the component Web Administration Module. Performing manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14198"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/jjjjj-zr/jjjjjzr/issues/7"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.334618"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.334618"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.699533"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-200"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-07T17:15:47Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-fp2q-4h72-pcjp/GHSA-fp2q-4h72-pcjp.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fp2q-4h72-pcjp",
4+
"modified": "2025-12-07T18:31:16Z",
5+
"published": "2025-12-07T18:31:16Z",
6+
"aliases": [
7+
"CVE-2025-14197"
8+
],
9+
"details": "A security vulnerability has been detected in Verysync 微力同步 up to 2.21.3. The impacted element is an unknown function of the file /rest/f/api/resources/f96956469e7be39d of the component Web Administration Module. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14197"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/jjjjj-zr/jjjjjzr/issues/6"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/jjjjj-zr/jjjjjzr/issues/8"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.334617"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.334617"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.699498"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.699537"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-200"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2025-12-07T16:15:47Z"
59+
}
60+
}

‎advisories/unreviewed/2025/12/GHSA-g3h4-h85m-jqvx/GHSA-g3h4-h85m-jqvx.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g3h4-h85m-jqvx",
4+
"modified": "2025-12-07T18:31:17Z",
5+
"published": "2025-12-07T18:31:17Z",
6+
"aliases": [
7+
"CVE-2025-14201"
8+
],
9+
"details": "A vulnerability was found in alokjaiswal Hotel-Management-services-using-MYSQL-and-php up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f. Affected by this vulnerability is an unknown functionality of the file /dishsub.php. The manipulation of the argument item.name results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14201"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Yh276/h0202/blob/main/Hotel-Management-services-using-MYSQL-and-php%20web%201%20xxs.docx"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.334621"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.334621"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.699994"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-07T18:16:02Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-rmhj-6jmw-2pxq/GHSA-rmhj-6jmw-2pxq.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rmhj-6jmw-2pxq",
4+
"modified": "2025-12-07T18:31:16Z",
5+
"published": "2025-12-07T18:31:16Z",
6+
"aliases": [
7+
"CVE-2025-14200"
8+
],
9+
"details": "A vulnerability has been found in alokjaiswal Hotel-Management-services-using-MYSQL-and-php up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f. Affected is an unknown function of the file /usersub.php of the component Request Pending Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14200"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Yh276/h0202/blob/main/Hotel-Management-services-using-MYSQL-and-php%20web%202xxs.docx"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.334620"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.334620"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.699993"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-07T18:16:01Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-wghp-x8f8-p2w5/GHSA-wghp-x8f8-p2w5.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wghp-x8f8-p2w5",
4+
"modified": "2025-12-07T18:31:16Z",
5+
"published": "2025-12-07T18:31:16Z",
6+
"aliases": [
7+
"CVE-2025-14199"
8+
],
9+
"details": "A flaw has been found in Verysync 微力同步 up to 2.21.3. This impacts an unknown function of the file /rest/f/api/resources/f96956469e7be39d/tmp/text.txt?override=false of the component Web Administration Module. Executing manipulation can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14199"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/jjjjj-zr/jjjjjzr/issues/10"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.334619"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.334619"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.699539"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-284"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-07T17:15:47Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-x8w5-83w4-56jr/GHSA-x8w5-83w4-56jr.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-x8w5-83w4-56jr",
4+
"modified": "2025-12-07T18:31:16Z",
5+
"published": "2025-12-07T18:31:16Z",
6+
"aliases": [
7+
"CVE-2025-14196"
8+
],
9+
"details": "A weakness has been identified in H3C Magic B1 up to 100R004. The affected element is the function sub_44de0 of the file /goform/aspForm. This manipulation of the argument param causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14196"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/lin-3-start/lin-cve/blob/main/H3C%20Magic%20B1/H3C%20Magic%20B1.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/lin-3-start/lin-cve/blob/main/H3C%20Magic%20B1/H3C%20Magic%20B1.md#poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.334616"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.334616"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.699387"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-07T16:15:47Z"
55+
}
56+
}

0 commit comments

Comments
 (0)