Skip to content

Commit 6fd3f48

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-29wh-g4c8-c35q GHSA-4v76-jcg6-9p6m GHSA-6g4h-3cjf-h9q9 GHSA-7mhf-6fhv-c83c GHSA-ff49-f5c2-ggcq GHSA-jh7j-fmhv-cv25 GHSA-vxpf-6v9m-jq3x GHSA-vxr5-9gfx-r9w6
1 parent a83d4a2 commit 6fd3f48

File tree

8 files changed

+365
-0
lines changed

8 files changed

+365
-0
lines changed

‎advisories/unreviewed/2025/12/GHSA-29wh-g4c8-c35q/GHSA-29wh-g4c8-c35q.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-29wh-g4c8-c35q",
4+
"modified": "2025-12-26T00:30:12Z",
5+
"published": "2025-12-26T00:30:12Z",
6+
"aliases": [
7+
"CVE-2025-15089"
8+
],
9+
"details": "A vulnerability has been found in UTT 进取 512W up to 1.7.7-171114. This affects the function strcpy of the file /goform/APSecurity. The manipulation of the argument wepkey1 leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15089"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/cymiao1978/cve/blob/main/new/14.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/cymiao1978/cve/blob/main/new/14.md#poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.338418"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.338418"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.708348"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-25T23:15:41Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-4v76-jcg6-9p6m/GHSA-4v76-jcg6-9p6m.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4v76-jcg6-9p6m",
4+
"modified": "2025-12-26T00:30:12Z",
5+
"published": "2025-12-26T00:30:12Z",
6+
"aliases": [
7+
"CVE-2025-15090"
8+
],
9+
"details": "A vulnerability was found in UTT 进取 512W up to 1.7.7-171114. This vulnerability affects the function strcpy of the file /goform/formConfigNoticeConfig. The manipulation of the argument timestart results in buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15090"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/cymiao1978/cve/blob/main/new/15.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/cymiao1978/cve/blob/main/new/15.md#poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.338419"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.338419"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.708349"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-25T23:15:41Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-6g4h-3cjf-h9q9/GHSA-6g4h-3cjf-h9q9.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6g4h-3cjf-h9q9",
4+
"modified": "2025-12-26T00:30:12Z",
5+
"published": "2025-12-26T00:30:12Z",
6+
"aliases": [
7+
"CVE-2025-14913"
8+
],
9+
"details": "The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to an incorrect authorization check on the 'media_delete_action' function in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to delete arbitrary attachments.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14913"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.2.6/includes/classes/class-fpsml-ajax.php#L91"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/changeset/3427082/frontend-post-submission-manager-lite"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/19a6b19c-244d-4b30-8db2-b4d06a5f5509?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-862"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-26T00:16:00Z"
43+
}
44+
}

‎advisories/unreviewed/2025/12/GHSA-7mhf-6fhv-c83c/GHSA-7mhf-6fhv-c83c.json‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7mhf-6fhv-c83c",
4+
"modified": "2025-12-26T00:30:12Z",
5+
"published": "2025-12-26T00:30:12Z",
6+
"aliases": [
7+
"CVE-2025-68937"
8+
],
9+
"details": "Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository symlink destinations for template repositories. This is also fixed for 11 LTS in 11.0.7 and later.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68937"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://codeberg.org/forgejo/forgejo/milestone/27340"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://codeberg.org/forgejo/forgejo/milestone/29156"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/11.0.7.md"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/13.0.2.md"
32+
},
33+
{
34+
"type": "WEB",
35+
"url": "https://codeberg.org/forgejo/security-announcements/issues/43"
36+
}
37+
],
38+
"database_specific": {
39+
"cwe_ids": [
40+
"CWE-61"
41+
],
42+
"severity": null,
43+
"github_reviewed": false,
44+
"github_reviewed_at": null,
45+
"nvd_published_at": "2025-12-26T00:16:01Z"
46+
}
47+
}

‎advisories/unreviewed/2025/12/GHSA-ff49-f5c2-ggcq/GHSA-ff49-f5c2-ggcq.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-ff49-f5c2-ggcq",
4+
"modified": "2025-12-26T00:30:12Z",
5+
"published": "2025-12-26T00:30:12Z",
6+
"aliases": [
7+
"CVE-2025-15091"
8+
],
9+
"details": "A vulnerability was determined in UTT 进取 512W up to 1.7.7-171114. This issue affects the function strcpy of the file /goform/formPictureUrl. This manipulation of the argument importpictureurl causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15091"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/cymiao1978/cve/blob/main/new/16.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/cymiao1978/cve/blob/main/new/16.md#poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.338420"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.338420"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.708350"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-26T00:16:00Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-jh7j-fmhv-cv25/GHSA-jh7j-fmhv-cv25.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jh7j-fmhv-cv25",
4+
"modified": "2025-12-26T00:30:12Z",
5+
"published": "2025-12-26T00:30:12Z",
6+
"aliases": [
7+
"CVE-2025-14715"
8+
],
9+
"details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14715"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-12-25T23:15:40Z"
24+
}
25+
}

‎advisories/unreviewed/2025/12/GHSA-vxpf-6v9m-jq3x/GHSA-vxpf-6v9m-jq3x.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vxpf-6v9m-jq3x",
4+
"modified": "2025-12-26T00:30:12Z",
5+
"published": "2025-12-26T00:30:12Z",
6+
"aliases": [
7+
"CVE-2025-15088"
8+
],
9+
"details": "A vulnerability was detected in ketr JEPaaS up to 7.2.8. Affected by this vulnerability is the function postilService.loadPostils of the file /je/postil/postil/loadPostil. Performing manipulation of the argument keyWord results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15088"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/ha1yu-Yiqiyin/warehouse/blob/main/jepaas-v7.2.8-sqlinject1.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/ha1yu-Yiqiyin/warehouse/blob/main/jepaas-v7.2.8-sqlinject1.md#2%E5%A4%8D%E7%8E%B0replicate"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.338416"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.338416"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.708321"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-25T22:15:42Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-vxr5-9gfx-r9w6/GHSA-vxr5-9gfx-r9w6.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vxr5-9gfx-r9w6",
4+
"modified": "2025-12-26T00:30:12Z",
5+
"published": "2025-12-26T00:30:12Z",
6+
"aliases": [
7+
"CVE-2025-14820"
8+
],
9+
"details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14820"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-12-25T23:15:41Z"
24+
}
25+
}

0 commit comments

Comments
 (0)