Skip to content

Commit 6443a70

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-h63q-2463-x5hq GHSA-hh36-fjhw-7fj3 GHSA-3fh9-jhg5-xch9 GHSA-5jj4-7gh8-3j9x GHSA-7vh4-842v-rgxg GHSA-7vhr-jxp7-33h3 GHSA-8267-hc98-7hgr GHSA-cg85-crjc-jm7h GHSA-hp6r-r9vc-q8wx GHSA-m765-p4wm-gj85 GHSA-mvgw-frm8-7wwj GHSA-qf8c-9wm3-3mmr GHSA-w9g8-pq43-7qm5 GHSA-x46c-mj5p-7mww GHSA-x55m-xqmm-wff4
1 parent 6936f91 commit 6443a70

File tree

15 files changed

+421
-2
lines changed

15 files changed

+421
-2
lines changed

‎advisories/unreviewed/2022/05/GHSA-h63q-2463-x5hq/GHSA-h63q-2463-x5hq.json‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-h63q-2463-x5hq",
4-
"modified": "2022-05-14T01:02:41Z",
4+
"modified": "2025-12-19T06:30:27Z",
55
"published": "2022-05-14T01:02:41Z",
66
"aliases": [
77
"CVE-2019-3863"
@@ -51,6 +51,10 @@
5151
"type": "WEB",
5252
"url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html"
5353
},
54+
{
55+
"type": "WEB",
56+
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O"
57+
},
5458
{
5559
"type": "WEB",
5660
"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O"
@@ -86,6 +90,7 @@
8690
],
8791
"database_specific": {
8892
"cwe_ids": [
93+
"CWE-190",
8994
"CWE-787"
9095
],
9196
"severity": "HIGH",

‎advisories/unreviewed/2025/11/GHSA-hh36-fjhw-7fj3/GHSA-hh36-fjhw-7fj3.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-hh36-fjhw-7fj3",
4-
"modified": "2025-11-23T18:30:27Z",
4+
"modified": "2025-12-19T06:30:27Z",
55
"published": "2025-11-23T18:30:27Z",
66
"aliases": [
77
"CVE-2025-54515"

‎advisories/unreviewed/2025/12/GHSA-3fh9-jhg5-xch9/GHSA-3fh9-jhg5-xch9.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3fh9-jhg5-xch9",
4+
"modified": "2025-12-19T06:30:27Z",
5+
"published": "2025-12-19T06:30:27Z",
6+
"aliases": [
7+
"CVE-2025-68485"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68485"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-12-19T04:16:01Z"
24+
}
25+
}

‎advisories/unreviewed/2025/12/GHSA-5jj4-7gh8-3j9x/GHSA-5jj4-7gh8-3j9x.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5jj4-7gh8-3j9x",
4+
"modified": "2025-12-19T06:30:27Z",
5+
"published": "2025-12-19T06:30:27Z",
6+
"aliases": [
7+
"CVE-2025-68483"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68483"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-12-19T04:16:01Z"
24+
}
25+
}

‎advisories/unreviewed/2025/12/GHSA-7vh4-842v-rgxg/GHSA-7vh4-842v-rgxg.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7vh4-842v-rgxg",
4+
"modified": "2025-12-19T06:30:27Z",
5+
"published": "2025-12-19T06:30:27Z",
6+
"aliases": [
7+
"CVE-2025-14939"
8+
],
9+
"details": "A vulnerability was found in code-projects Online Appointment Booking System 1.0. Impacted is an unknown function of the file /admin/deletemanager.php. The manipulation of the argument managername results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14939"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/wegitlab/cve/issues/1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://code-projects.org"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.337519"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.337519"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.715796"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-19T04:16:00Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-7vhr-jxp7-33h3/GHSA-7vhr-jxp7-33h3.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7vhr-jxp7-33h3",
4+
"modified": "2025-12-19T06:30:27Z",
5+
"published": "2025-12-19T06:30:27Z",
6+
"aliases": [
7+
"CVE-2025-13307"
8+
],
9+
"details": "The Ocean Modal Window WordPress plugin before 2.3.3 is vulnerable to Remote Code Execution via the modal display logic. These modals can be displayed under user-controlled conditions that Editors and Administrators can set (edit_pages capability). The conditions are then executed as part of an eval statement executed on every site page. This leads to remote code execution.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13307"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/710de342-6fb9-47bd-a40b-7b74fc3c181b"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-12-19T06:15:50Z"
28+
}
29+
}

‎advisories/unreviewed/2025/12/GHSA-8267-hc98-7hgr/GHSA-8267-hc98-7hgr.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8267-hc98-7hgr",
4+
"modified": "2025-12-19T06:30:27Z",
5+
"published": "2025-12-19T06:30:27Z",
6+
"aliases": [
7+
"CVE-2025-68491"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68491"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-12-19T04:16:02Z"
24+
}
25+
}

‎advisories/unreviewed/2025/12/GHSA-cg85-crjc-jm7h/GHSA-cg85-crjc-jm7h.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cg85-crjc-jm7h",
4+
"modified": "2025-12-19T06:30:27Z",
5+
"published": "2025-12-19T06:30:27Z",
6+
"aliases": [
7+
"CVE-2025-68489"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68489"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-12-19T04:16:02Z"
24+
}
25+
}

‎advisories/unreviewed/2025/12/GHSA-hp6r-r9vc-q8wx/GHSA-hp6r-r9vc-q8wx.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hp6r-r9vc-q8wx",
4+
"modified": "2025-12-19T06:30:27Z",
5+
"published": "2025-12-19T06:30:27Z",
6+
"aliases": [
7+
"CVE-2025-14546"
8+
],
9+
"details": "Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the OAuth state parameter during the authentication callback. While the get_login_url method allows for state generation, it does not persist the state or bind it to the user's session. Consequently, the verify_and_process method accepts the state received in the query parameters without verifying it against a trusted local value. This allows a remote attacker to trick a victim into visiting a malicious callback URL, which can result in the attacker's account being linked to the victim's internal account.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14546"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/tomasvotava/fastapi-sso/issues/266"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/tomasvotava/fastapi-sso/commit/6117d1a5ad498ba57d671e8a059ebe20db5abe02"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://security.snyk.io/vuln/SNYK-PYTHON-FASTAPISSO-14386403"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-285"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-12-19T05:16:09Z"
47+
}
48+
}

‎advisories/unreviewed/2025/12/GHSA-m765-p4wm-gj85/GHSA-m765-p4wm-gj85.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m765-p4wm-gj85",
4+
"modified": "2025-12-19T06:30:27Z",
5+
"published": "2025-12-19T06:30:27Z",
6+
"aliases": [
7+
"CVE-2025-68488"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68488"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-12-19T04:16:01Z"
24+
}
25+
}

0 commit comments

Comments
 (0)