Skip to content

Commit 6936f91

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-4w56-v3gv-mf6c GHSA-5mfv-8xjm-pmmh GHSA-6p6p-x42g-j3hv GHSA-767x-95qw-8v6j GHSA-g5pm-7qx6-f2hg GHSA-hv82-jj64-jf47 GHSA-m2jw-wc29-6qmv GHSA-p5pj-p5gv-2r5w GHSA-q9f7-mpvw-2h86 GHSA-rgwf-hw46-5w7j GHSA-rhhc-xvm8-7w83 GHSA-rx26-cqvh-gprg GHSA-x3hm-53cx-8hp8 GHSA-xqhc-c94v-wffx
1 parent cecb097 commit 6936f91

File tree

14 files changed

+668
-0
lines changed

14 files changed

+668
-0
lines changed

‎advisories/unreviewed/2025/12/GHSA-4w56-v3gv-mf6c/GHSA-4w56-v3gv-mf6c.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4w56-v3gv-mf6c",
4+
"modified": "2025-12-19T03:31:18Z",
5+
"published": "2025-12-19T03:31:18Z",
6+
"aliases": [
7+
"CVE-2025-52692"
8+
],
9+
"details": "Successful exploitation of the vulnerability could allow an attacker with local network access to send a specially crafted URL to access certain administration functions without login credentials.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52692"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-118"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "HIGH",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2025-12-19T02:16:05Z"
33+
}
34+
}

‎advisories/unreviewed/2025/12/GHSA-5mfv-8xjm-pmmh/GHSA-5mfv-8xjm-pmmh.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5mfv-8xjm-pmmh",
4+
"modified": "2025-12-19T03:31:17Z",
5+
"published": "2025-12-19T03:31:17Z",
6+
"aliases": [
7+
"CVE-2025-14899"
8+
],
9+
"details": "A weakness has been identified in CodeAstro Real Estate Management System 1.0. This impacts an unknown function of the file /admin/stateadd.php of the component Administrator Endpoint. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14899"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://codeastro.com"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/YZS17/CVE/blob/main/CodeAstro_Real_Estate_Management_System/stateadd.php-sqli.md"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.337424"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.337424"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.715671"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-19T01:16:05Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-6p6p-x42g-j3hv/GHSA-6p6p-x42g-j3hv.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6p6p-x42g-j3hv",
4+
"modified": "2025-12-19T03:31:18Z",
5+
"published": "2025-12-19T03:31:18Z",
6+
"aliases": [
7+
"CVE-2025-67843"
8+
],
9+
"details": "A Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attackers to execute arbitrary code via inline JSX expressions in an MDX file.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67843"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://kibty.town/blog/mintlify"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://news.ycombinator.com/item?id=46317098"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.mintlify.com/blog/working-with-security-researchers-november-2025"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.mintlify.com/docs/changelog"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-1336"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-12-19T02:16:08Z"
47+
}
48+
}

‎advisories/unreviewed/2025/12/GHSA-767x-95qw-8v6j/GHSA-767x-95qw-8v6j.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-767x-95qw-8v6j",
4+
"modified": "2025-12-19T03:31:18Z",
5+
"published": "2025-12-19T03:31:18Z",
6+
"aliases": [
7+
"CVE-2025-67846"
8+
],
9+
"details": "The Deployment Infrastructure in Mintlify Platform before 2025-11-15 allows remote attackers to bypass security patches and execute downgrade attacks via predictable deployment identifiers on the Vercel preview domain. An attacker can identify the URL structure of a previous deployment that contains unpatched vulnerabilities. By browsing directly to the specific git-ref or deployment-id subdomain, the attacker can force the application to load the vulnerable version.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67846"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://kibty.town/blog/mintlify"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://news.ycombinator.com/item?id=46317098"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.mintlify.com/blog/working-with-security-researchers-november-2025"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.mintlify.com/docs/changelog"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-472"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-12-19T02:16:09Z"
47+
}
48+
}

‎advisories/unreviewed/2025/12/GHSA-g5pm-7qx6-f2hg/GHSA-g5pm-7qx6-f2hg.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g5pm-7qx6-f2hg",
4+
"modified": "2025-12-19T03:31:18Z",
5+
"published": "2025-12-19T03:31:18Z",
6+
"aliases": [
7+
"CVE-2025-67845"
8+
],
9+
"details": "A Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing path traversal sequences.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67845"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://kibty.town/blog/mintlify"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://news.ycombinator.com/item?id=46317098"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.mintlify.com/blog/working-with-security-researchers-november-2025"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.mintlify.com/docs/changelog"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-24"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-12-19T02:16:09Z"
47+
}
48+
}

‎advisories/unreviewed/2025/12/GHSA-hv82-jj64-jf47/GHSA-hv82-jj64-jf47.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hv82-jj64-jf47",
4+
"modified": "2025-12-19T03:31:17Z",
5+
"published": "2025-12-19T03:31:17Z",
6+
"aliases": [
7+
"CVE-2025-14733"
8+
],
9+
"details": "An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.5 and 2025.1 up to and including 2025.1.3.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14733"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-787"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-19T01:16:05Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-m2jw-wc29-6qmv/GHSA-m2jw-wc29-6qmv.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m2jw-wc29-6qmv",
4+
"modified": "2025-12-19T03:31:18Z",
5+
"published": "2025-12-19T03:31:18Z",
6+
"aliases": [
7+
"CVE-2025-67844"
8+
],
9+
"details": "The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository metadata via the repository owner and name fields. It fails to validate that the repository owner and name fields provided during configuration belong to the specific GitHub App Installation ID associated with the user's organization.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67844"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://kibty.town/blog/mintlify"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://news.ycombinator.com/item?id=46317098"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.mintlify.com/blog/working-with-security-researchers-november-2025"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.mintlify.com/docs/changelog"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-425"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-12-19T02:16:09Z"
47+
}
48+
}

‎advisories/unreviewed/2025/12/GHSA-p5pj-p5gv-2r5w/GHSA-p5pj-p5gv-2r5w.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p5pj-p5gv-2r5w",
4+
"modified": "2025-12-19T03:31:17Z",
5+
"published": "2025-12-19T03:31:17Z",
6+
"aliases": [
7+
"CVE-2025-14900"
8+
],
9+
"details": "A security vulnerability has been detected in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /admin/userdelete.php of the component Administrator Endpoint. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14900"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://codeastro.com"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/YZS17/CVE/blob/main/CodeAstro_Real_Estate_Management_System/userdelete-sqli.md"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.337425"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.337425"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.715672"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-19T01:16:05Z"
55+
}
56+
}

0 commit comments

Comments
 (0)