Skip to content

Commit 5437725

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3523-rrw3-92r9 GHSA-5v2j-3mvc-9cmv GHSA-637m-5wp2-vxwg GHSA-9f7j-37pf-4xpm GHSA-9pc2-rxg9-xh9f GHSA-crfg-8xhr-7q4w GHSA-h92m-6623-764w GHSA-hcqg-5g63-7j9h GHSA-hxcg-77v3-qx52 GHSA-r388-5h2x-p38f GHSA-v5pw-jhcf-j7hw GHSA-wcvc-6v9v-c6g7
1 parent ee666dd commit 5437725

File tree

12 files changed

+510
-2
lines changed

12 files changed

+510
-2
lines changed

‎advisories/unreviewed/2025/11/GHSA-3523-rrw3-92r9/GHSA-3523-rrw3-92r9.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3523-rrw3-92r9",
4+
"modified": "2025-11-17T09:30:27Z",
5+
"published": "2025-11-17T09:30:26Z",
6+
"aliases": [
7+
"CVE-2025-13270"
8+
],
9+
"details": "A vulnerability was found in Campcodes School Fees Payment Management System 1.0. This affects an unknown function of the file /ajax.php?action=save_course. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13270"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/ASantsSec/CVE/issues/16"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.332605"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.332605"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.690039"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.campcodes.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-17T08:16:24Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-5v2j-3mvc-9cmv/GHSA-5v2j-3mvc-9cmv.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5v2j-3mvc-9cmv",
4+
"modified": "2025-11-17T09:30:26Z",
5+
"published": "2025-11-17T09:30:26Z",
6+
"aliases": [
7+
"CVE-2025-13267"
8+
],
9+
"details": "A vulnerability was detected in SourceCodester Dental Clinic Appointment Reservation System 1.0. Impacted is an unknown function of the file /success.php. Performing manipulation of the argument username/password results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13267"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/0xffaaa/cve/blob/main/Dental_Clinic_Appointment_Reservation_System_Time-Based_SQL_Injection2.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.332602"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.332602"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.689450"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-17T08:16:23Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-637m-5wp2-vxwg/GHSA-637m-5wp2-vxwg.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-637m-5wp2-vxwg",
4+
"modified": "2025-11-17T09:30:26Z",
5+
"published": "2025-11-17T09:30:26Z",
6+
"aliases": [
7+
"CVE-2025-13163"
8+
],
9+
"details": "EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext database account credentials from the system frontend.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13163"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.twcert.org.tw/en/cp-139-10504-23f4c-2.html"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.twcert.org.tw/tw/cp-132-10503-a66fe-1.html"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-522"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-11-17T08:16:22Z"
43+
}
44+
}

‎advisories/unreviewed/2025/11/GHSA-9f7j-37pf-4xpm/GHSA-9f7j-37pf-4xpm.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9f7j-37pf-4xpm",
4+
"modified": "2025-11-17T09:30:26Z",
5+
"published": "2025-11-17T09:30:26Z",
6+
"aliases": [
7+
"CVE-2025-13269"
8+
],
9+
"details": "A vulnerability has been found in Campcodes School Fees Payment Management System 1.0. The impacted element is an unknown function of the file /ajax.php?action=save_payment. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13269"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/ASantsSec/CVE/issues/17"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.332604"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.332604"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.690034"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.campcodes.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-17T08:16:24Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-9pc2-rxg9-xh9f/GHSA-9pc2-rxg9-xh9f.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9pc2-rxg9-xh9f",
4+
"modified": "2025-11-17T09:30:26Z",
5+
"published": "2025-11-17T09:30:26Z",
6+
"aliases": [
7+
"CVE-2025-13272"
8+
],
9+
"details": "A vulnerability was identified in Campcodes School Fees Payment Management System 1.0. Affected is an unknown function of the file /manage_course.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13272"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/ASantsSec/CVE/issues/19"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.332607"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.332607"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.690046"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.campcodes.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-17T09:15:44Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-crfg-8xhr-7q4w/GHSA-crfg-8xhr-7q4w.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-crfg-8xhr-7q4w",
4-
"modified": "2025-11-13T00:30:16Z",
4+
"modified": "2025-11-17T09:30:26Z",
55
"published": "2025-11-12T18:31:25Z",
66
"aliases": [
77
"CVE-2025-59088"
@@ -43,6 +43,10 @@
4343
"type": "WEB",
4444
"url": "https://access.redhat.com/errata/RHSA-2025:21142"
4545
},
46+
{
47+
"type": "WEB",
48+
"url": "https://access.redhat.com/errata/RHSA-2025:21448"
49+
},
4650
{
4751
"type": "WEB",
4852
"url": "https://access.redhat.com/security/cve/CVE-2025-59088"

‎advisories/unreviewed/2025/11/GHSA-h92m-6623-764w/GHSA-h92m-6623-764w.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h92m-6623-764w",
4+
"modified": "2025-11-17T09:30:26Z",
5+
"published": "2025-11-17T09:30:26Z",
6+
"aliases": [
7+
"CVE-2025-13268"
8+
],
9+
"details": "A flaw has been found in Dromara dataCompare up to 1.0.1. The affected element is the function DbConfig of the file src/main/java/com/vince/xq/project/system/dbconfig/service/DbconfigServiceImpl.java of the component JDBC URL Handler. Executing manipulation can lead to injection. The attack can be launched remotely. The exploit has been published and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13268"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/dromara/dataCompare/issues/13"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.332603"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.332603"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.689460"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-11-17T08:16:24Z"
51+
}
52+
}

‎advisories/unreviewed/2025/11/GHSA-hcqg-5g63-7j9h/GHSA-hcqg-5g63-7j9h.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hcqg-5g63-7j9h",
4+
"modified": "2025-11-17T09:30:26Z",
5+
"published": "2025-11-17T09:30:26Z",
6+
"aliases": [
7+
"CVE-2025-65073"
8+
],
9+
"details": "OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65073"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.openwall.com/lists/oss-security/2025/11/04/2"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-863"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-17T08:16:25Z"
35+
}
36+
}

0 commit comments

Comments
 (0)