Skip to content

Commit 8d1bc4c

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-9v3x-rmcf-rhp4 GHSA-p8xm-2g2x-wx76 GHSA-r76w-8fvw-mh93 GHSA-wf4q-g5g8-q8w9
1 parent 3078692 commit 8d1bc4c

File tree

4 files changed

+169
-1
lines changed

4 files changed

+169
-1
lines changed

‎advisories/unreviewed/2025/08/GHSA-9v3x-rmcf-rhp4/GHSA-9v3x-rmcf-rhp4.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9v3x-rmcf-rhp4",
4-
"modified": "2025-09-12T15:31:15Z",
4+
"modified": "2025-09-13T15:31:04Z",
55
"published": "2025-08-19T12:31:14Z",
66
"aliases": [
77
"CVE-2025-9135"

‎advisories/unreviewed/2025/09/GHSA-p8xm-2g2x-wx76/GHSA-p8xm-2g2x-wx76.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p8xm-2g2x-wx76",
4+
"modified": "2025-09-13T15:31:04Z",
5+
"published": "2025-09-13T15:31:04Z",
6+
"aliases": [
7+
"CVE-2025-10359"
8+
],
9+
"details": "A vulnerability was detected in Wavlink WL-WN578W2 221110. This impacts the function sub_404DBC of the file /cgi-bin/wireless.cgi. The manipulation of the argument macAddr results in os command injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10359"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/ZZ2266/.github.io/blob/main/WAVLINK/WL-WN578W2/wireless.cgi/add_mac"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/ZZ2266/.github.io/tree/main/WAVLINK/WL-WN578W2/wireless.cgi/add_mac#proof-of-concept-poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.323773"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.323773"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.643444"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-77"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-09-13T13:15:32Z"
55+
}
56+
}

‎advisories/unreviewed/2025/09/GHSA-r76w-8fvw-mh93/GHSA-r76w-8fvw-mh93.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r76w-8fvw-mh93",
4+
"modified": "2025-09-13T15:31:04Z",
5+
"published": "2025-09-13T15:31:04Z",
6+
"aliases": [
7+
"CVE-2025-10366"
8+
],
9+
"details": "A flaw has been found in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected is an unknown function of the file /htdocs/inc.setWlanIpMail.php. This manipulation of the argument Email address causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10366"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/xss1.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/xss1.md#poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.323774"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.323774"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.643517"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-79"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-09-13T14:15:31Z"
55+
}
56+
}

‎advisories/unreviewed/2025/09/GHSA-wf4q-g5g8-q8w9/GHSA-wf4q-g5g8-q8w9.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wf4q-g5g8-q8w9",
4+
"modified": "2025-09-13T15:31:04Z",
5+
"published": "2025-09-13T15:31:04Z",
6+
"aliases": [
7+
"CVE-2025-10367"
8+
],
9+
"details": "A vulnerability has been found in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this vulnerability is an unknown functionality of the file /htdocs/cardEdit.php. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10367"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/xss2.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/xss2.md#poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.323775"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.323775"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.643518"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-79"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-09-13T14:15:32Z"
55+
}
56+
}

0 commit comments

Comments
 (0)