Skip to content

Commit 8b73367

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-4pxq-x5rp-36j3 GHSA-4wp6-2mc5-g5v5 GHSA-jc2q-683w-4vx8 GHSA-rf9w-8fhj-jfq2 GHSA-x52f-5p58-rc23 GHSA-xj6g-6cpf-m82c
1 parent 688b8a8 commit 8b73367

File tree

6 files changed

+334
-0
lines changed

6 files changed

+334
-0
lines changed

‎advisories/unreviewed/2025/12/GHSA-4pxq-x5rp-36j3/GHSA-4pxq-x5rp-36j3.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4pxq-x5rp-36j3",
4+
"modified": "2025-12-14T09:30:24Z",
5+
"published": "2025-12-14T09:30:24Z",
6+
"aliases": [
7+
"CVE-2025-14652"
8+
],
9+
"details": "A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. This issue affects some unknown processing of the file /admindetail.php?action=edit. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14652"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/moonrains/test/issues/1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.336385"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.336385"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.712648"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-14T09:15:40Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-4wp6-2mc5-g5v5/GHSA-4wp6-2mc5-g5v5.json‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4wp6-2mc5-g5v5",
4+
"modified": "2025-12-14T09:30:24Z",
5+
"published": "2025-12-14T09:30:24Z",
6+
"aliases": [
7+
"CVE-2025-14651"
8+
],
9+
"details": "A vulnerability has been found in MartialBE one-hub up to 0.14.27. This vulnerability affects unknown code of the file docker-compose.yml. The manipulation of the argument SESSION_SECRET leads to use of hard-coded cryptographic key\n . The attack may be initiated remotely. The complexity of an attack is rather high. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. The code maintainer recommends (translated from Chinese): \"The default docker-compose example file is not recommended for production use. If you intend to use it in production, please carefully check and modify every configuration and environment variable yourself!\"",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14651"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/MartialBE/one-hub/issues/872"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/MartialBE/one-hub/issues/872#issuecomment-3616033169"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/MartialBE/one-hub/blob/main/docker-compose.yml#L15C24-L15C38"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?ctiid.336384"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?id.336384"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.710249"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [],
53+
"severity": "MODERATE",
54+
"github_reviewed": false,
55+
"github_reviewed_at": null,
56+
"nvd_published_at": "2025-12-14T09:15:39Z"
57+
}
58+
}

‎advisories/unreviewed/2025/12/GHSA-jc2q-683w-4vx8/GHSA-jc2q-683w-4vx8.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jc2q-683w-4vx8",
4+
"modified": "2025-12-14T09:30:24Z",
5+
"published": "2025-12-14T09:30:24Z",
6+
"aliases": [
7+
"CVE-2025-14650"
8+
],
9+
"details": "A flaw has been found in itsourcecode Online Cake Ordering System 1.0. This affects an unknown part of the file /cakeshop/product.php. Executing manipulation of the argument Product can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14650"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/yihaofuweng/cve/issues/61"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.336383"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.336383"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.710248"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-14T08:15:39Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-rf9w-8fhj-jfq2/GHSA-rf9w-8fhj-jfq2.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rf9w-8fhj-jfq2",
4+
"modified": "2025-12-14T09:30:24Z",
5+
"published": "2025-12-14T09:30:24Z",
6+
"aliases": [
7+
"CVE-2025-14648"
8+
],
9+
"details": "A security vulnerability has been detected in DedeBIZ up to 6.5.9. Affected by this vulnerability is an unknown functionality of the file /src/admin/catalog_add.php. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14648"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/HOrange147/CVE/blob/main/DedeBIZ%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C.pdf"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.336381"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.336381"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.710164"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-14T07:15:39Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-x52f-5p58-rc23/GHSA-x52f-5p58-rc23.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-x52f-5p58-rc23",
4+
"modified": "2025-12-14T09:30:24Z",
5+
"published": "2025-12-14T09:30:24Z",
6+
"aliases": [
7+
"CVE-2025-14649"
8+
],
9+
"details": "A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. Affected by this issue is some unknown functionality of the file /cakeshop/supplier.php. Performing manipulation of the argument supplier results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14649"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/yihaofuweng/cve/issues/60"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.336382"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.336382"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.710247"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-14T08:15:38Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-xj6g-6cpf-m82c/GHSA-xj6g-6cpf-m82c.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xj6g-6cpf-m82c",
4+
"modified": "2025-12-14T09:30:24Z",
5+
"published": "2025-12-14T09:30:24Z",
6+
"aliases": [
7+
"CVE-2025-14647"
8+
],
9+
"details": "A weakness has been identified in code-projects Computer Book Store 1.0. Affected is an unknown function of the file /admin_delete.php. This manipulation of the argument bookisbn causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14647"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/jjjjj-zr/jjjjjzr11/issues/2"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://code-projects.org"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.336380"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.336380"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.709618"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-14T07:15:39Z"
55+
}
56+
}

0 commit comments

Comments
 (0)