Skip to content

Commit 3c41662

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2jxq-mx43-c7q5 GHSA-3j85-7795-mc66 GHSA-485v-639h-vm9r GHSA-4cf6-r5pq-4jhc GHSA-6q89-p8ww-gjxm GHSA-6w3w-2xr2-g4xf GHSA-f6rc-8xc8-gmfm GHSA-f97p-pxx9-4r46 GHSA-fc9c-m6r5-f592 GHSA-g4mf-96x5-5m2c GHSA-rv6x-ghr7-v4f6
1 parent 155ffe6 commit 3c41662

File tree

11 files changed

+572
-0
lines changed

11 files changed

+572
-0
lines changed

‎advisories/unreviewed/2025/11/GHSA-2jxq-mx43-c7q5/GHSA-2jxq-mx43-c7q5.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2jxq-mx43-c7q5",
4+
"modified": "2025-11-10T06:30:26Z",
5+
"published": "2025-11-10T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-12932"
8+
],
9+
"details": "A vulnerability was determined in SourceCodester Baby Care System 1.0. Affected by this issue is some unknown functionality of the file /admin.php?id=inbox. This manipulation of the argument msgid causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12932"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/puppytgyh/-CVE/issues/7"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.331652"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.331652"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.682272"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-10T05:15:43Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-3j85-7795-mc66/GHSA-3j85-7795-mc66.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3j85-7795-mc66",
4+
"modified": "2025-11-10T06:30:25Z",
5+
"published": "2025-11-10T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-12868"
8+
],
9+
"details": "New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on the website.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12868"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.twcert.org.tw/en/cp-139-10492-84a10-2.html"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.twcert.org.tw/tw/cp-132-10493-bf807-1.html"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-603"
38+
],
39+
"severity": "CRITICAL",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-11-10T04:15:41Z"
43+
}
44+
}

‎advisories/unreviewed/2025/11/GHSA-485v-639h-vm9r/GHSA-485v-639h-vm9r.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-485v-639h-vm9r",
4+
"modified": "2025-11-10T06:30:25Z",
5+
"published": "2025-11-10T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-12928"
8+
],
9+
"details": "A vulnerability was detected in code-projects Online Job Search Engine 1.0. This affects an unknown function of the file /login.php. Performing manipulation of the argument username/phone results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12928"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://code-projects.org"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/lakshayyverma/CVE-Discovery/blob/main/Online%20Job%20Search%20Engine.md"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/lakshayyverma/CVE-Discovery/blob/main/Online%20Job%20Search%20Engine.md#proof-of-concept-poc"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?ctiid.331648"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?id.331648"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.681740"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-74"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2025-11-10T04:15:41Z"
59+
}
60+
}

‎advisories/unreviewed/2025/11/GHSA-4cf6-r5pq-4jhc/GHSA-4cf6-r5pq-4jhc.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4cf6-r5pq-4jhc",
4+
"modified": "2025-11-10T06:30:26Z",
5+
"published": "2025-11-10T06:30:26Z",
6+
"aliases": [
7+
"CVE-2025-12931"
8+
],
9+
"details": "A vulnerability was found in SourceCodester Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /routers/edit-orders.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12931"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/puppytgyh/-CVE/issues/5"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.331651"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.331651"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.682234"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-10T05:15:43Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-6q89-p8ww-gjxm/GHSA-6q89-p8ww-gjxm.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6q89-p8ww-gjxm",
4+
"modified": "2025-11-10T06:30:25Z",
5+
"published": "2025-11-10T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-12929"
8+
],
9+
"details": "A flaw has been found in SourceCodester Survey Application System 1.0. This impacts the function save_user/update_user of the file /LoginRegistration.php. Executing manipulation of the argument fullname can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. Other parameters might be affected as well.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12929"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/lakshayyverma/CVE-Discovery/blob/main/Survey%20Application%20System.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.331649"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.331649"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.681746"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-10T04:15:41Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-6w3w-2xr2-g4xf/GHSA-6w3w-2xr2-g4xf.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6w3w-2xr2-g4xf",
4+
"modified": "2025-11-10T06:30:26Z",
5+
"published": "2025-11-10T06:30:26Z",
6+
"aliases": [
7+
"CVE-2025-12933"
8+
],
9+
"details": "A vulnerability was identified in SourceCodester Baby Care System 1.0. This affects an unknown part of the file /updatewelcome.php?id=siteoptions&action=welcome. Such manipulation of the argument roleid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12933"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/puppytgyh/-CVE/issues/8"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.331653"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.331653"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.682276"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-10T06:15:34Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-f6rc-8xc8-gmfm/GHSA-f6rc-8xc8-gmfm.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f6rc-8xc8-gmfm",
4+
"modified": "2025-11-10T06:30:26Z",
5+
"published": "2025-11-10T06:30:26Z",
6+
"aliases": [
7+
"CVE-2025-59777"
8+
],
9+
"details": "NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59777"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://git.gnunet.org/libmicrohttpd.git/commit/?id=ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://jvn.jp/en/jp/JVN76719218"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.gnu.org/software/libmicrohttpd"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-476"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-11-10T05:15:44Z"
47+
}
48+
}

0 commit comments

Comments
 (0)