Skip to content

Commit 5b5923b

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-23v2-gv35-vww5 GHSA-588w-wrcx-mhcm GHSA-7vx4-j234-7f53 GHSA-c6q3-g8x3-7xgf GHSA-ggm9-w3r3-2c6h GHSA-w22x-mx57-4r69 GHSA-x3c9-p79c-qhqc
1 parent 2483202 commit 5b5923b

File tree

7 files changed

+341
-0
lines changed

7 files changed

+341
-0
lines changed

‎advisories/unreviewed/2025/11/GHSA-23v2-gv35-vww5/GHSA-23v2-gv35-vww5.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-23v2-gv35-vww5",
4+
"modified": "2025-11-24T00:30:17Z",
5+
"published": "2025-11-24T00:30:17Z",
6+
"aliases": [
7+
"CVE-2025-13572"
8+
],
9+
"details": "A vulnerability was identified in projectworlds Advanced Library Management System 1.0. This affects an unknown part of the file /delete_admin.php. The manipulation of the argument admin_id leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13572"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/GYSakura/tmp/blob/main/report.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.333336"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.333336"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.698645"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-11-23T23:15:46Z"
51+
}
52+
}

‎advisories/unreviewed/2025/11/GHSA-588w-wrcx-mhcm/GHSA-588w-wrcx-mhcm.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-588w-wrcx-mhcm",
4+
"modified": "2025-11-24T00:30:17Z",
5+
"published": "2025-11-24T00:30:17Z",
6+
"aliases": [
7+
"CVE-2025-13573"
8+
],
9+
"details": "A security flaw has been discovered in projectworlds can pass malicious payloads up to 1.0. This vulnerability affects unknown code of the file /add_book.php. The manipulation of the argument image results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be exploited.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13573"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/GYSakura/tmp75/blob/main/report.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.333337"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.333337"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.698646"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-284"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-11-24T00:15:46Z"
51+
}
52+
}

‎advisories/unreviewed/2025/11/GHSA-7vx4-j234-7f53/GHSA-7vx4-j234-7f53.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7vx4-j234-7f53",
4+
"modified": "2025-11-24T00:30:17Z",
5+
"published": "2025-11-24T00:30:17Z",
6+
"aliases": [
7+
"CVE-2025-12800"
8+
],
9+
"details": "The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.4.5 via the su_shortcode_csv_table function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. If the 'Unsafe features' option is explicitly enabled by an administrator, this issue becomes exploitable by Contributor+ attackers",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12800"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3397946"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbb7db4-bef7-4799-9b65-ebe77976e21c?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-918"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-23T23:15:45Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-c6q3-g8x3-7xgf/GHSA-c6q3-g8x3-7xgf.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c6q3-g8x3-7xgf",
4+
"modified": "2025-11-24T00:30:17Z",
5+
"published": "2025-11-24T00:30:17Z",
6+
"aliases": [
7+
"CVE-2025-13571"
8+
],
9+
"details": "A vulnerability was determined in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /listorder.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13571"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/jjjjj-zr/jjjjjzr/issues/1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://code-projects.org"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.333335"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.333335"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.698495"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-23T22:16:18Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-ggm9-w3r3-2c6h/GHSA-ggm9-w3r3-2c6h.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-ggm9-w3r3-2c6h",
4+
"modified": "2025-11-24T00:30:17Z",
5+
"published": "2025-11-24T00:30:17Z",
6+
"aliases": [
7+
"CVE-2025-13570"
8+
],
9+
"details": "A vulnerability was found in itsourcecode COVID Tracking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/?page=state. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13570"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/yihaofuweng/cve/issues/59"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.333334"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.333334"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.698656"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-23T22:16:17Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-w22x-mx57-4r69/GHSA-w22x-mx57-4r69.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-w22x-mx57-4r69",
4+
"modified": "2025-11-24T00:30:17Z",
5+
"published": "2025-11-24T00:30:17Z",
6+
"aliases": [
7+
"CVE-2025-12759"
8+
],
9+
"details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12759"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-11-23T23:15:45Z"
24+
}
25+
}

‎advisories/unreviewed/2025/11/GHSA-x3c9-p79c-qhqc/GHSA-x3c9-p79c-qhqc.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-x3c9-p79c-qhqc",
4+
"modified": "2025-11-24T00:30:17Z",
5+
"published": "2025-11-24T00:30:17Z",
6+
"aliases": [
7+
"CVE-2025-13574"
8+
],
9+
"details": "A weakness has been identified in code-projects Online Bidding System 1.0. This issue affects the function categoryadd of the file /administrator/addcategory.php. This manipulation of the argument catimage causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13574"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://code-projects.org"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/Yohane-Mashiro/cve/blob/main/upload%201.md"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.333338"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.333338"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.698717"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.698718"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-284"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2025-11-24T00:15:46Z"
59+
}
60+
}

0 commit comments

Comments
 (0)