Skip to content

Commit 8f94301

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-38q3-29hj-9w26 GHSA-3w6x-xqhx-2c63 GHSA-5jwq-x5rg-hgv9 GHSA-7wgf-36j2-vf64 GHSA-85v2-6j9h-fhq9 GHSA-8g7h-h6c6-fr83 GHSA-cwgq-hj3j-r5wv GHSA-g5qq-5f56-7h93 GHSA-jjrw-wx9c-5386 GHSA-m5wr-8mwj-cqpw GHSA-pm7c-3cpx-6wx4 GHSA-qfvh-gchw-82wr GHSA-r9x3-jhcx-h8m8 GHSA-r9xx-rmrv-8vpg
1 parent 309f4e1 commit 8f94301

File tree

14 files changed

+178
-11
lines changed

14 files changed

+178
-11
lines changed

‎advisories/unreviewed/2025/12/GHSA-38q3-29hj-9w26/GHSA-38q3-29hj-9w26.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-38q3-29hj-9w26",
4+
"modified": "2025-12-18T03:30:17Z",
5+
"published": "2025-12-18T03:30:17Z",
6+
"aliases": [
7+
"CVE-2025-12885"
8+
],
9+
"details": "The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sanitize_pdf_src function regex bypass in all versions up to, and including, 2.7.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12885"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3406443"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/efbdf0f0-6b38-418c-b3fb-396f89ada34f?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-18T03:15:45Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-3w6x-xqhx-2c63/GHSA-3w6x-xqhx-2c63.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3w6x-xqhx-2c63",
4-
"modified": "2025-12-15T12:30:26Z",
4+
"modified": "2025-12-18T03:30:17Z",
55
"published": "2025-12-15T12:30:26Z",
66
"aliases": [
77
"CVE-2025-11670"

‎advisories/unreviewed/2025/12/GHSA-5jwq-x5rg-hgv9/GHSA-5jwq-x5rg-hgv9.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@
4646
],
4747
"database_specific": {
4848
"cwe_ids": [
49-
"CWE-74"
49+
"CWE-74",
50+
"CWE-89"
5051
],
5152
"severity": "MODERATE",
5253
"github_reviewed": false,

‎advisories/unreviewed/2025/12/GHSA-7wgf-36j2-vf64/GHSA-7wgf-36j2-vf64.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@
4646
],
4747
"database_specific": {
4848
"cwe_ids": [
49-
"CWE-74"
49+
"CWE-74",
50+
"CWE-89"
5051
],
5152
"severity": "MODERATE",
5253
"github_reviewed": false,

‎advisories/unreviewed/2025/12/GHSA-85v2-6j9h-fhq9/GHSA-85v2-6j9h-fhq9.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-295"
30+
],
2931
"severity": "HIGH",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2025/12/GHSA-8g7h-h6c6-fr83/GHSA-8g7h-h6c6-fr83.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@
4646
],
4747
"database_specific": {
4848
"cwe_ids": [
49-
"CWE-74"
49+
"CWE-74",
50+
"CWE-89"
5051
],
5152
"severity": "MODERATE",
5253
"github_reviewed": false,

‎advisories/unreviewed/2025/12/GHSA-cwgq-hj3j-r5wv/GHSA-cwgq-hj3j-r5wv.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@
4646
],
4747
"database_specific": {
4848
"cwe_ids": [
49-
"CWE-74"
49+
"CWE-74",
50+
"CWE-89"
5051
],
5152
"severity": "MODERATE",
5253
"github_reviewed": false,

‎advisories/unreviewed/2025/12/GHSA-g5qq-5f56-7h93/GHSA-g5qq-5f56-7h93.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@
4646
],
4747
"database_specific": {
4848
"cwe_ids": [
49-
"CWE-77"
49+
"CWE-77",
50+
"CWE-78"
5051
],
5152
"severity": "MODERATE",
5253
"github_reviewed": false,

‎advisories/unreviewed/2025/12/GHSA-jjrw-wx9c-5386/GHSA-jjrw-wx9c-5386.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jjrw-wx9c-5386",
4+
"modified": "2025-12-18T03:30:17Z",
5+
"published": "2025-12-18T03:30:17Z",
6+
"aliases": [
7+
"CVE-2025-14841"
8+
],
9+
"details": "A flaw has been found in OFFIS DCMTK up to 3.6.9. The impacted element is the function DcmQueryRetrieveIndexDatabaseHandle::startFindRequest/DcmQueryRetrieveIndexDatabaseHandle::startMoveRequest in the library dcmqrdb/libsrc/dcmqrdbi.cc of the component dcmqrscp. This manipulation causes null pointer dereference. The attack requires local access. Upgrading to version 3.7.0 is sufficient to resolve this issue. Patch name: ffb1a4a37d2c876e3feeb31df4930f2aed7fa030. You should upgrade the affected component.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14841"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/DCMTK/dcmtk/commit/ffb1a4a37d2c876e3feeb31df4930f2aed7fa030"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/DCMTK/dcmtk/releases/tag/DCMTK-3.7.0"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://support.dcmtk.org/redmine/issues/1183"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?ctiid.337004"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?id.337004"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.714605"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/?submit.714634"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-404"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": false,
61+
"github_reviewed_at": null,
62+
"nvd_published_at": "2025-12-18T01:15:51Z"
63+
}
64+
}

‎advisories/unreviewed/2025/12/GHSA-m5wr-8mwj-cqpw/GHSA-m5wr-8mwj-cqpw.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m5wr-8mwj-cqpw",
4+
"modified": "2025-12-18T03:30:17Z",
5+
"published": "2025-12-18T03:30:17Z",
6+
"aliases": [
7+
"CVE-2025-14856"
8+
],
9+
"details": "A security vulnerability has been detected in y_project RuoYi up to 4.8.1. The affected element is an unknown function of the file /monitor/cache/getnames. Such manipulation of the argument fragment leads to code injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14856"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/ltranquility/CVE/issues/26"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.337047"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.337047"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.710152"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-18T02:15:46Z"
51+
}
52+
}

0 commit comments

Comments
 (0)