Skip to content

Commit 4a9f1a6

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-263q-5cv3-xq9g GHSA-4vwr-f92g-29m6 GHSA-5qwr-m3vg-gj86 GHSA-6m8p-6c5x-r759 GHSA-7mhf-6fhv-c83c GHSA-898p-hh3p-hf9r GHSA-9492-pwhm-prgg GHSA-cm54-pfmc-xrwx GHSA-hg49-2rqm-p9hf GHSA-q45h-4pv4-p744 GHSA-rrcw-5rjv-vj26 GHSA-xfq3-qj7j-4565
1 parent 6fd3f48 commit 4a9f1a6

File tree

12 files changed

+560
-3
lines changed

12 files changed

+560
-3
lines changed

‎advisories/unreviewed/2025/12/GHSA-263q-5cv3-xq9g/GHSA-263q-5cv3-xq9g.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-263q-5cv3-xq9g",
4+
"modified": "2025-12-26T03:30:15Z",
5+
"published": "2025-12-26T03:30:15Z",
6+
"aliases": [
7+
"CVE-2025-68939"
8+
],
9+
"details": "Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68939"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/go-gitea/gitea/pull/32151"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://blog.gitea.com/release-of-1.23.0"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.23.0"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-424"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-26T03:15:50Z"
43+
}
44+
}

‎advisories/unreviewed/2025/12/GHSA-4vwr-f92g-29m6/GHSA-4vwr-f92g-29m6.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4vwr-f92g-29m6",
4+
"modified": "2025-12-26T03:30:15Z",
5+
"published": "2025-12-26T03:30:15Z",
6+
"aliases": [
7+
"CVE-2025-15097"
8+
],
9+
"details": "A vulnerability was found in Alteryx Server. Affected by this issue is some unknown functionality of the file /gallery/api/status/. Performing manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 2023.1.1.13.486, 2023.2.1.10.293, 2024.1.1.9.236, 2024.2.1.6.125 and 2025.1.1.1.31 can resolve this issue. Upgrading the affected component is recommended.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15097"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gist.github.com/apostolovd/f84631eed2f0c0e83e2e174b1480f08c"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://help.alteryx.com/release-notes/en/release-notes/server-release-notes/server-2025-1-release-notes.html"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://ict-strypes.eu/wp-content/uploads/2025/12/Alteryx-Second-Research.pdf"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?ctiid.338428"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?id.338428"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.710169"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-287"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2025-12-26T03:15:50Z"
59+
}
60+
}

‎advisories/unreviewed/2025/12/GHSA-5qwr-m3vg-gj86/GHSA-5qwr-m3vg-gj86.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5qwr-m3vg-gj86",
4+
"modified": "2025-12-26T03:30:16Z",
5+
"published": "2025-12-26T03:30:15Z",
6+
"aliases": [
7+
"CVE-2025-15098"
8+
],
9+
"details": "A vulnerability was determined in YunaiV yudao-cloud up to 2025.11. This affects the function BpmHttpCallbackTrigger/BpmSyncHttpRequestTrigger of the component Business Process Management. Executing manipulation of the argument url/header/body can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15098"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/AnalogyC0de/public_exp/blob/main/archives/yudao-cloud-bpm_SSRF/report.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/AnalogyC0de/public_exp/blob/main/archives/yudao-cloud-bpm_SSRF/report.md#proof-of-concept"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.338429"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.338429"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.710170"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-918"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-26T03:15:50Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-6m8p-6c5x-r759/GHSA-6m8p-6c5x-r759.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6m8p-6c5x-r759",
4+
"modified": "2025-12-26T03:30:15Z",
5+
"published": "2025-12-26T03:30:15Z",
6+
"aliases": [
7+
"CVE-2025-15095"
8+
],
9+
"details": "A security vulnerability has been detected in postmanlabs httpbin up to 0.6.1. This affects an unknown function of the file httpbin-master/httpbin/core.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15095"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/postmanlabs/httpbin/issues/735"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.338424"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.338424"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.709002"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-26T03:15:50Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-7mhf-6fhv-c83c/GHSA-7mhf-6fhv-c83c.json‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,28 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7mhf-6fhv-c83c",
4-
"modified": "2025-12-26T00:30:12Z",
4+
"modified": "2025-12-26T03:30:14Z",
55
"published": "2025-12-26T00:30:12Z",
66
"aliases": [
77
"CVE-2025-68937"
88
],
99
"details": "Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository symlink destinations for template repositories. This is also fixed for 11 LTS in 11.0.7 and later.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
1419
"type": "ADVISORY",
1520
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68937"
1621
},
22+
{
23+
"type": "WEB",
24+
"url": "https://blog.gitea.com/release-of-1.24.7"
25+
},
1726
{
1827
"type": "WEB",
1928
"url": "https://codeberg.org/forgejo/forgejo/milestone/27340"
@@ -39,7 +48,7 @@
3948
"cwe_ids": [
4049
"CWE-61"
4150
],
42-
"severity": null,
51+
"severity": "CRITICAL",
4352
"github_reviewed": false,
4453
"github_reviewed_at": null,
4554
"nvd_published_at": "2025-12-26T00:16:01Z"

‎advisories/unreviewed/2025/12/GHSA-898p-hh3p-hf9r/GHSA-898p-hh3p-hf9r.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-898p-hh3p-hf9r",
4+
"modified": "2025-12-26T03:30:17Z",
5+
"published": "2025-12-26T03:30:17Z",
6+
"aliases": [
7+
"CVE-2025-68942"
8+
],
9+
"details": "Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68942"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/go-gitea/gitea/pull/31966"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://blog.gitea.com/release-of-1.22.2"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.22.2"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-26T03:15:51Z"
43+
}
44+
}

‎advisories/unreviewed/2025/12/GHSA-9492-pwhm-prgg/GHSA-9492-pwhm-prgg.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9492-pwhm-prgg",
4+
"modified": "2025-12-26T03:30:14Z",
5+
"published": "2025-12-26T03:30:14Z",
6+
"aliases": [
7+
"CVE-2025-15093"
8+
],
9+
"details": "A security flaw has been discovered in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The affected element is an unknown function of the file src/main/java/com/flycms/web/system/IndexAdminController.java of the component Admin Login. Performing manipulation of the argument redirectUrl results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15093"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/sunkaifei/FlyCms/issues/15"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.338422"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.338422"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.708996"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-26T01:15:58Z"
51+
}
52+
}

0 commit comments

Comments
 (0)