Skip to content

Commit 71ff960

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5523-p533-prfw GHSA-259w-3jff-442h GHSA-4wp5-pw3x-6v2m GHSA-c6g6-rgwx-76pj GHSA-j5c3-85x7-rxv3 GHSA-qcxg-jm6f-8cv8 GHSA-rjwc-px3p-9mv8
1 parent 1c5df8e commit 71ff960

File tree

7 files changed

+220
-1
lines changed

7 files changed

+220
-1
lines changed

‎advisories/unreviewed/2025/09/GHSA-5523-p533-prfw/GHSA-5523-p533-prfw.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5523-p533-prfw",
4-
"modified": "2025-09-22T21:30:23Z",
4+
"modified": "2025-10-24T06:31:21Z",
55
"published": "2025-09-22T21:30:23Z",
66
"aliases": [
77
"CVE-2025-57923"
@@ -22,6 +22,10 @@
2222
{
2323
"type": "WEB",
2424
"url": "https://patchstack.com/database/wordpress/plugin/uk-address-postcode-validation/vulnerability/wordpress-uk-address-postcode-validation-plugin-3-9-2-sensitive-data-exposure-vulnerability?_s_id=cve"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://web.archive.org/web/20250807222539/https://docs.ideal-postcodes.co.uk/docs/guides/api-key-secure"
2529
}
2630
],
2731
"database_specific": {

‎advisories/unreviewed/2025/10/GHSA-259w-3jff-442h/GHSA-259w-3jff-442h.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-259w-3jff-442h",
4+
"modified": "2025-10-24T06:31:21Z",
5+
"published": "2025-10-24T06:31:21Z",
6+
"aliases": [
7+
"CVE-2025-10723"
8+
],
9+
"details": "The PixelYourSite WordPress plugin before 11.1.2 does not validate some URL parameters before using them to generate paths passed to function/s, allowing any admins to perform LFI attacks",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10723"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/88a99f9d-dc7f-4c04-8734-77295c8656bf"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-10-24T06:15:34Z"
28+
}
29+
}

‎advisories/unreviewed/2025/10/GHSA-4wp5-pw3x-6v2m/GHSA-4wp5-pw3x-6v2m.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4wp5-pw3x-6v2m",
4+
"modified": "2025-10-24T06:31:21Z",
5+
"published": "2025-10-24T06:31:21Z",
6+
"aliases": [
7+
"CVE-2025-9158"
8+
],
9+
"details": "The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data without HTML sanitization. XSS vulnerability allows an attacker to send a specifically crafted e-mail enabling JavaScript code execution by displaying the ticket in the context of the logged-in user. \n\nThis vulnerability affects versions from 5.0.4 through 5.0.8 and from 6.0.0 through 6.0.1.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9158"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://cert.pl/en/posts/2025/10/CVE-2025-9158"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://requesttracker.com/request-tracker"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-10-24T06:15:35Z"
39+
}
40+
}

‎advisories/unreviewed/2025/10/GHSA-c6g6-rgwx-76pj/GHSA-c6g6-rgwx-76pj.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c6g6-rgwx-76pj",
4+
"modified": "2025-10-24T06:31:21Z",
5+
"published": "2025-10-24T06:31:21Z",
6+
"aliases": [
7+
"CVE-2025-61931"
8+
],
9+
"details": "Pleasanter contains a stored cross-site scripting vulnerability in Body, Description and Comments, which allows an attacker to execute an arbitrary script in a logged-in user's web browser.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61931"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://jvn.jp/en/jp/JVN20611740"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://pleasanter.org/archives/vulnerability-update-20251024"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-10-24T06:15:35Z"
43+
}
44+
}

‎advisories/unreviewed/2025/10/GHSA-j5c3-85x7-rxv3/GHSA-j5c3-85x7-rxv3.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j5c3-85x7-rxv3",
4+
"modified": "2025-10-24T06:31:21Z",
5+
"published": "2025-10-24T06:31:21Z",
6+
"aliases": [
7+
"CVE-2025-9978"
8+
],
9+
"details": "The Jeg Kit for Elementor WordPress plugin before 2.7.0 does not sanitize SVG file contents when uploaded via xmlrpc.php, leading to a cross site scripting vulnerability.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9978"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/cef78a77-c66d-4d62-8d49-140ca2d04d5b"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-10-24T06:15:36Z"
28+
}
29+
}

‎advisories/unreviewed/2025/10/GHSA-qcxg-jm6f-8cv8/GHSA-qcxg-jm6f-8cv8.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qcxg-jm6f-8cv8",
4+
"modified": "2025-10-24T06:31:21Z",
5+
"published": "2025-10-24T06:31:21Z",
6+
"aliases": [
7+
"CVE-2025-58070"
8+
],
9+
"details": "Pleasanter contains a stored cross-site scripting vulnerability in Preview for Attachments, which allows an attacker to execute an arbitrary script in a logged-in user's web browser.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58070"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://jvn.jp/en/jp/JVN20611740"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://pleasanter.org/archives/vulnerability-update-20251024"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-10-24T06:15:35Z"
43+
}
44+
}

‎advisories/unreviewed/2025/10/GHSA-rjwc-px3p-9mv8/GHSA-rjwc-px3p-9mv8.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rjwc-px3p-9mv8",
4+
"modified": "2025-10-24T06:31:21Z",
5+
"published": "2025-10-24T06:31:21Z",
6+
"aliases": [
7+
"CVE-2025-10874"
8+
],
9+
"details": "The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.2 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10874"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/171ba43f-55b6-471d-af0a-be553baf639a"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-10-24T06:15:35Z"
28+
}
29+
}

0 commit comments

Comments
 (0)