Skip to content

Commit 5e1db7e

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent aea7e1f commit 5e1db7e

File tree

29 files changed

+1072
-0
lines changed

29 files changed

+1072
-0
lines changed

‎advisories/unreviewed/2025/12/GHSA-29wq-mjx6-hr78/GHSA-29wq-mjx6-hr78.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-29wq-mjx6-hr78",
4+
"modified": "2025-12-31T09:30:19Z",
5+
"published": "2025-12-31T09:30:19Z",
6+
"aliases": [
7+
"CVE-2025-62137"
8+
],
9+
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shuttlethemes Shuttle allows Stored XSS.This issue affects Shuttle: from n/a through 1.5.0.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62137"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://vdp.patchstack.com/database/wordpress/theme/shuttle/vulnerability/wordpress-shuttle-theme-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-31T09:15:51Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-364x-6pf8-6vwj/GHSA-364x-6pf8-6vwj.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-364x-6pf8-6vwj",
4+
"modified": "2025-12-31T09:30:19Z",
5+
"published": "2025-12-31T09:30:18Z",
6+
"aliases": [
7+
"CVE-2025-15277"
8+
],
9+
"details": "FontForge GUtils SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of scanlines within SGI files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27920.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15277"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1186"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-122"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-31T07:15:52Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-3gwg-rh47-h7p4/GHSA-3gwg-rh47-h7p4.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3gwg-rh47-h7p4",
4+
"modified": "2025-12-31T09:30:19Z",
5+
"published": "2025-12-31T09:30:19Z",
6+
"aliases": [
7+
"CVE-2025-62760"
8+
],
9+
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev BuddyPress Activity Shortcode allows Stored XSS.This issue affects BuddyPress Activity Shortcode: from n/a through 1.1.8.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62760"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://vdp.patchstack.com/database/wordpress/plugin/bp-activity-shortcode/vulnerability/wordpress-buddypress-activity-shortcode-plugin-1-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-31T09:15:51Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-45h8-36p7-c6vp/GHSA-45h8-36p7-c6vp.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-45h8-36p7-c6vp",
4+
"modified": "2025-12-31T09:30:19Z",
5+
"published": "2025-12-31T09:30:19Z",
6+
"aliases": [
7+
"CVE-2025-63000"
8+
],
9+
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP for church Sermon Manager allows Stored XSS.This issue affects Sermon Manager: from n/a through 2.30.0.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63000"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://vdp.patchstack.com/database/wordpress/plugin/sermon-manager-for-wordpress/vulnerability/wordpress-sermon-manager-plugin-2-30-0-cross-site-scripting-xss-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-31T09:15:52Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-4v43-6wgv-wq2j/GHSA-4v43-6wgv-wq2j.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4v43-6wgv-wq2j",
4+
"modified": "2025-12-31T09:30:19Z",
5+
"published": "2025-12-31T09:30:19Z",
6+
"aliases": [
7+
"CVE-2025-62146"
8+
],
9+
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maksym Marko MX Time Zone Clocks allows Stored XSS.This issue affects MX Time Zone Clocks: from n/a through 5.1.1.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62146"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://vdp.patchstack.com/database/wordpress/plugin/mx-time-zone-clocks/vulnerability/wordpress-mx-time-zone-clocks-plugin-5-1-1-cross-site-scripting-xss-vulnerability-2?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-31T09:15:51Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-5vwc-hh96-8x8g/GHSA-5vwc-hh96-8x8g.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5vwc-hh96-8x8g",
4+
"modified": "2025-12-31T09:30:19Z",
5+
"published": "2025-12-31T09:30:19Z",
6+
"aliases": [
7+
"CVE-2025-2026"
8+
],
9+
"details": "The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a null byte injection through the device’s web API. This may lead to an unexpected device reboot and result in a denial-of-service (DoS) condition.\n\nAn authenticated remote attacker with web read-only privileges can exploit the vulnerable API to inject malicious input. Successful exploitation may cause the device to reboot, disrupting normal operations and causing a temporary denial of service.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2026"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-251731-cve-2025-1977-cve-2025-2026-multiple-vulnerabilities-in-nport-6100-g2-6200-g2-series"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-170"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-31T08:15:45Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-6465-93fg-6pfr/GHSA-6465-93fg-6pfr.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6465-93fg-6pfr",
4+
"modified": "2025-12-31T09:30:18Z",
5+
"published": "2025-12-31T09:30:18Z",
6+
"aliases": [
7+
"CVE-2025-15275"
8+
],
9+
"details": "FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28543.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15275"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1189"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-122"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-31T07:15:51Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-66x8-mhf9-h5jc/GHSA-66x8-mhf9-h5jc.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-66x8-mhf9-h5jc",
4+
"modified": "2025-12-31T09:30:19Z",
5+
"published": "2025-12-31T09:30:19Z",
6+
"aliases": [
7+
"CVE-2025-49028"
8+
],
9+
"details": "Cross-Site Request Forgery (CSRF) vulnerability in Zoho Mail Zoho ZeptoMail allows Stored XSS.This issue affects Zoho ZeptoMail: from n/a through 3.3.1.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49028"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://vdp.patchstack.com/database/wordpress/plugin/transmail/vulnerability/wordpress-zoho-zeptomail-plugin-3-3-1-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-352"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-31T09:15:50Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-6m4m-8948-4883/GHSA-6m4m-8948-4883.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6m4m-8948-4883",
4+
"modified": "2025-12-31T09:30:18Z",
5+
"published": "2025-12-31T09:30:18Z",
6+
"aliases": [
7+
"CVE-2025-15274"
8+
],
9+
"details": "FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of SFD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28544.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15274"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1190"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-122"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-31T07:15:51Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-7f2c-fvqj-vm63/GHSA-7f2c-fvqj-vm63.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7f2c-fvqj-vm63",
4+
"modified": "2025-12-31T09:30:19Z",
5+
"published": "2025-12-31T09:30:19Z",
6+
"aliases": [
7+
"CVE-2025-62992"
8+
],
9+
"details": "Cross-Site Request Forgery (CSRF) vulnerability in Everest themes Everest Backup allows Path Traversal.This issue affects Everest Backup: from n/a through 2.3.9.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62992"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://vdp.patchstack.com/database/wordpress/plugin/everest-backup/vulnerability/wordpress-everest-backup-plugin-2-3-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-352"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-31T09:15:52Z"
35+
}
36+
}

0 commit comments

Comments
 (0)