Skip to content

Commit 7ba24dc

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-pffp-qx9q-h7v4 GHSA-4jf5-rmwc-7vww GHSA-6vj3-p34w-xxjp GHSA-8cpr-48rw-5rrc GHSA-8mv8-wmgc-7crw GHSA-8qx7-g43x-4mhm GHSA-98p6-cqhp-8c8x GHSA-chq3-v87j-fwq5 GHSA-fmqj-pm68-cqq4 GHSA-g5p6-3j82-xfm4 GHSA-h78q-4j5r-86xx GHSA-jv72-59wq-8rxm GHSA-qxv4-g9hq-r87f GHSA-v82x-ghcg-c238 GHSA-x2hf-qg23-rjpx GHSA-xq7p-3jhh-cr76
1 parent 8f1dd92 commit 7ba24dc

File tree

16 files changed

+494
-17
lines changed

16 files changed

+494
-17
lines changed

‎advisories/unreviewed/2025/11/GHSA-pffp-qx9q-h7v4/GHSA-pffp-qx9q-h7v4.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-pffp-qx9q-h7v4",
4-
"modified": "2025-11-15T00:30:26Z",
4+
"modified": "2025-12-26T18:30:24Z",
55
"published": "2025-11-15T00:30:26Z",
66
"aliases": [
77
"CVE-2023-7328"
88
],
99
"details": "Screen SFT DAB 600/C firmware versions up to and including 1.9.3 contain an improper access control on the user management API allows unauthenticated requests to retrieve structured user data, including account names and connection metadata such as client IP and timeout values.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/12/GHSA-4jf5-rmwc-7vww/GHSA-4jf5-rmwc-7vww.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4jf5-rmwc-7vww",
4+
"modified": "2025-12-26T18:30:27Z",
5+
"published": "2025-12-26T18:30:26Z",
6+
"aliases": [
7+
"CVE-2025-67013"
8+
],
9+
"details": "The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) protection mechanisms (no tokens, no Origin/Referer validation) on critical configuration endpoints.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67013"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-67013%20_%20ETL%20Systems%20Ltd%20DEXTRA%20Series%20_%20CSRF"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.etlsystems.com"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-352"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-26T16:15:44Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-6vj3-p34w-xxjp/GHSA-6vj3-p34w-xxjp.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6vj3-p34w-xxjp",
4+
"modified": "2025-12-26T18:30:26Z",
5+
"published": "2025-12-26T18:30:26Z",
6+
"aliases": [
7+
"CVE-2025-13158"
8+
],
9+
"details": "Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript object prototypes via malformed data structures, including the “define” property processed by the application, potentially leading to denial of service or unintended behavior in applications relying on the integrity of prototype chains. This affects the preProcess() function in api_group.js, api_param_title.js, api_use.js, and api_permission.js worker modules.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13158"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.sonatype.com/security-advisories/cve-2025-13158"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-1321"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-26T16:15:43Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-8cpr-48rw-5rrc/GHSA-8cpr-48rw-5rrc.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8cpr-48rw-5rrc",
4+
"modified": "2025-12-26T18:30:27Z",
5+
"published": "2025-12-26T18:30:27Z",
6+
"aliases": [
7+
"CVE-2025-66737"
8+
],
9+
"details": "Yealink T21P_E2 Phone 52.84.0.15 is vulnerable to Directory Traversal. A remote normal privileged attacker can read arbitrary files via a crafted request result read function of the diagnostic component.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66737"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://drive.google.com/file/d/1MpxnCL4koKupqWWDmY3ljlybjIPD8ieD/view?usp=sharing"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "http://yealink.com"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-23"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-26T17:15:44Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-8mv8-wmgc-7crw/GHSA-8mv8-wmgc-7crw.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8mv8-wmgc-7crw",
4+
"modified": "2025-12-26T18:30:27Z",
5+
"published": "2025-12-26T18:30:27Z",
6+
"aliases": [
7+
"CVE-2025-67015"
8+
],
9+
"details": "Incorrect access control in Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2.5.1 allows attackers to change the Administrator password and escalate privileges via sending a crafted POST request to /Forms/admin_access_1.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67015"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-67015%20_%20Comtech%20EF%20Data%20CDM-625%20_%20CDM-625A%20Advanced%20_%20Broken%20Access%20Control"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.comtechefdata.com"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-284"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-26T16:15:44Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-8qx7-g43x-4mhm/GHSA-8qx7-g43x-4mhm.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8qx7-g43x-4mhm",
4+
"modified": "2025-12-26T18:30:26Z",
5+
"published": "2025-12-26T18:30:26Z",
6+
"aliases": [
7+
"CVE-2024-29720"
8+
],
9+
"details": "An issue in Terra Informatica Software, Inc Sciter v.4.4.7.0 allows a local attacker to obtain sensitive information via the adopt component of the Sciter video rendering function.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29720"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/sciter-sdk/rust-sciter/issues/143"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-200"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-26T16:15:42Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-98p6-cqhp-8c8x/GHSA-98p6-cqhp-8c8x.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-98p6-cqhp-8c8x",
4+
"modified": "2025-12-26T18:30:27Z",
5+
"published": "2025-12-26T18:30:26Z",
6+
"aliases": [
7+
"CVE-2025-57403"
8+
],
9+
"details": "Cola Dnslog v1.3.2 is vulnerable to Directory Traversal. When a DNS query for a TXT record is processed, the application concatenates the requested URL (or a portion of it) directly with a base path using os.path.join. This bypass allows directory traversal or absolute path injection, leading to the potential exposure of sensitive information.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57403"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/AbelChe/cola_dnslog/issues/29"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gist.github.com/Captaince/99b728c792c72b2666c2400625702df0"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-23"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-26T16:15:43Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-chq3-v87j-fwq5/GHSA-chq3-v87j-fwq5.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-chq3-v87j-fwq5",
4-
"modified": "2025-12-26T15:30:17Z",
4+
"modified": "2025-12-26T18:30:26Z",
55
"published": "2025-12-26T15:30:17Z",
66
"aliases": [
77
"CVE-2025-65885"
88
],
99
"details": "An issue was discovered in the Delight Custom Firmware (CFW) for Nokia Symbian Belle devices on Nokia 808 (Delight v1.8), Nokia N8 (Delight v6.7), Nokia E7 (Delight v1.3), Nokia C7 (Delight v6.7), Nokia 700 (Delight v1.2), Nokia 701 (Delight v1.1), Nokia 603 (Delight v1.0), Nokia 500 (Delight v1.2), Nokia E6 (Delight v1.0), Nokia Oro (Delight v1.0), and Vertu Constellation T (Delight v1.0) allowing local attackers to inject startup scripts via crafted .txt files in the :\\Data directory.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-77"
34+
],
35+
"severity": "MODERATE",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2025-12-26T15:15:47Z"

‎advisories/unreviewed/2025/12/GHSA-fmqj-pm68-cqq4/GHSA-fmqj-pm68-cqq4.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-fmqj-pm68-cqq4",
4-
"modified": "2025-12-26T15:30:17Z",
4+
"modified": "2025-12-26T18:30:26Z",
55
"published": "2025-12-26T15:30:17Z",
66
"aliases": [
77
"CVE-2025-66947"
88
],
99
"details": "SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. An attacker can trigger controlled delays using SQL SLEEP() to infer database contents. Successful exploitation may lead to full database compromise, especially within an administrative module.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -20,8 +25,10 @@
2025
}
2126
],
2227
"database_specific": {
23-
"cwe_ids": [],
24-
"severity": null,
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "MODERATE",
2532
"github_reviewed": false,
2633
"github_reviewed_at": null,
2734
"nvd_published_at": "2025-12-26T15:15:47Z"

‎advisories/unreviewed/2025/12/GHSA-g5p6-3j82-xfm4/GHSA-g5p6-3j82-xfm4.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g5p6-3j82-xfm4",
4+
"modified": "2025-12-26T18:30:27Z",
5+
"published": "2025-12-26T18:30:27Z",
6+
"aliases": [
7+
"CVE-2024-42718"
8+
],
9+
"details": "A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42718"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/croogo/croogo"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/jacopo1223/jacopo.github/tree/main/CVE-2024-42718"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-22"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-26T17:15:42Z"
39+
}
40+
}

0 commit comments

Comments
 (0)