Skip to content

Commit 7b3accb

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-6rh5-xgvr-7x95 GHSA-95w7-mm38-c8mc GHSA-crmf-3vf5-7m36 GHSA-cwrr-22vg-2h79 GHSA-f6mm-28jx-rrww GHSA-fxrj-3fj6-972h GHSA-h9fv-xmvq-pgf6 GHSA-hrf6-48c7-hhqf GHSA-pw2w-qh66-g5qq GHSA-r62f-cx5r-q9jm GHSA-rrvr-f37x-r3f9
1 parent cc931a1 commit 7b3accb

File tree

11 files changed

+346
-0
lines changed

11 files changed

+346
-0
lines changed

‎advisories/unreviewed/2025/10/GHSA-6rh5-xgvr-7x95/GHSA-6rh5-xgvr-7x95.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6rh5-xgvr-7x95",
4+
"modified": "2025-10-29T06:31:13Z",
5+
"published": "2025-10-29T06:31:13Z",
6+
"aliases": [
7+
"CVE-2025-64162"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64162"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-10-29T04:16:05Z"
24+
}
25+
}

‎advisories/unreviewed/2025/10/GHSA-95w7-mm38-c8mc/GHSA-95w7-mm38-c8mc.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-95w7-mm38-c8mc",
4+
"modified": "2025-10-29T06:31:12Z",
5+
"published": "2025-10-29T06:31:12Z",
6+
"aliases": [
7+
"CVE-2025-64159"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64159"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-10-29T04:16:04Z"
24+
}
25+
}

‎advisories/unreviewed/2025/10/GHSA-crmf-3vf5-7m36/GHSA-crmf-3vf5-7m36.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-crmf-3vf5-7m36",
4+
"modified": "2025-10-29T06:31:14Z",
5+
"published": "2025-10-29T06:31:14Z",
6+
"aliases": [
7+
"CVE-2025-62776"
8+
],
9+
"details": "The installer of WTW EAGLE (for Windows) 3.0.8.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privileges of the running application.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62776"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://jvn.jp/en/jp/JVN23394606"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://wtw.support/wtw/eagle-app-cms-win"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-427"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-10-29T05:15:37Z"
43+
}
44+
}

‎advisories/unreviewed/2025/10/GHSA-cwrr-22vg-2h79/GHSA-cwrr-22vg-2h79.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cwrr-22vg-2h79",
4+
"modified": "2025-10-29T06:31:12Z",
5+
"published": "2025-10-29T06:31:12Z",
6+
"aliases": [
7+
"CVE-2025-64158"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64158"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-10-29T04:16:03Z"
24+
}
25+
}

‎advisories/unreviewed/2025/10/GHSA-f6mm-28jx-rrww/GHSA-f6mm-28jx-rrww.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f6mm-28jx-rrww",
4+
"modified": "2025-10-29T06:31:14Z",
5+
"published": "2025-10-29T06:31:14Z",
6+
"aliases": [
7+
"CVE-2025-9544"
8+
],
9+
"details": "The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a nonce. As a result, any authenticated user — including those with the Subscriber role — can install and activate additional Doppler Forms WordPress plugin through 2.5.1 (limited to those whitelisted by the main Doppler Forms WordPress plugin through 2.5.1).",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9544"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/06312fba-dfc5-47af-afe3-b01d8941acbf"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-10-29T06:15:33Z"
28+
}
29+
}

‎advisories/unreviewed/2025/10/GHSA-fxrj-3fj6-972h/GHSA-fxrj-3fj6-972h.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fxrj-3fj6-972h",
4+
"modified": "2025-10-29T06:31:13Z",
5+
"published": "2025-10-29T06:31:13Z",
6+
"aliases": [
7+
"CVE-2025-64161"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64161"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-10-29T04:16:05Z"
24+
}
25+
}

‎advisories/unreviewed/2025/10/GHSA-h9fv-xmvq-pgf6/GHSA-h9fv-xmvq-pgf6.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h9fv-xmvq-pgf6",
4+
"modified": "2025-10-29T06:31:13Z",
5+
"published": "2025-10-29T06:31:13Z",
6+
"aliases": [
7+
"CVE-2025-64296"
8+
],
9+
"details": "Missing Authorization vulnerability in Facebook Facebook for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Facebook for WooCommerce: from n/a through 3.5.7.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64296"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://vdp.patchstack.com/database/wordpress/plugin/facebook-for-woocommerce/security-policy/vdp/vulnerability/wordpress-facebook-for-woocommerce-plugin-3-5-7-broken-access-control-to-notice-dismissal-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-862"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-29T04:16:05Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-hrf6-48c7-hhqf/GHSA-hrf6-48c7-hhqf.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hrf6-48c7-hhqf",
4+
"modified": "2025-10-29T06:31:12Z",
5+
"published": "2025-10-29T06:31:12Z",
6+
"aliases": [
7+
"CVE-2025-57931"
8+
],
9+
"details": "Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through 5.5.4.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57931"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://vdp.patchstack.com/database/wordpress/plugin/ays-popup-box/security-policy/vdp/vulnerability/wordpress-popup-box-plugin-5-5-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-352"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-29T04:15:52Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-pw2w-qh66-g5qq/GHSA-pw2w-qh66-g5qq.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pw2w-qh66-g5qq",
4+
"modified": "2025-10-29T06:31:13Z",
5+
"published": "2025-10-29T06:31:13Z",
6+
"aliases": [
7+
"CVE-2025-64160"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64160"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-10-29T04:16:05Z"
24+
}
25+
}

‎advisories/unreviewed/2025/10/GHSA-r62f-cx5r-q9jm/GHSA-r62f-cx5r-q9jm.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r62f-cx5r-q9jm",
4+
"modified": "2025-10-29T06:31:13Z",
5+
"published": "2025-10-29T06:31:13Z",
6+
"aliases": [
7+
"CVE-2025-11705"
8+
],
9+
"details": "The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.23.81 due to a missing capability check combined with an information exposure in several GOTMLS_* AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3379118/gotmls"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e2c8838c-d29a-4df8-85b3-6e440ba7f962?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-862"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-10-29T05:15:36Z"
39+
}
40+
}

0 commit comments

Comments
 (0)