Skip to content

Commit 96f8205

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-22cp-hq23-fv85 GHSA-2jxx-qpjm-mvc4 GHSA-326g-q2jr-r5fm GHSA-5p2h-8jcf-24rf GHSA-5q8c-r7p8-3p9v GHSA-5rfv-6ff9-rm8q GHSA-935j-38v5-5gwh GHSA-9553-998g-436x GHSA-998x-7989-c3gf GHSA-9cqc-hhcp-cf94 GHSA-g3cm-8x52-2j6x GHSA-g8rh-w59p-62h4 GHSA-hg79-vv5q-whmg GHSA-hhgj-xcf6-9r3p GHSA-pgrh-pvp5-q8cj GHSA-q595-fccr-c7x4 GHSA-qffr-32xx-42rc GHSA-rpjf-75px-h9cf GHSA-vf9p-jc95-pqcv GHSA-w337-cfcg-vpqj GHSA-x997-vvm5-qvcr
1 parent 13cb407 commit 96f8205

File tree

21 files changed

+756
-0
lines changed

21 files changed

+756
-0
lines changed

‎advisories/unreviewed/2025/11/GHSA-22cp-hq23-fv85/GHSA-22cp-hq23-fv85.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-22cp-hq23-fv85",
4+
"modified": "2025-11-26T03:30:21Z",
5+
"published": "2025-11-26T03:30:21Z",
6+
"aliases": [
7+
"CVE-2025-66255"
8+
],
9+
"details": "Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Missing signature validation allows uploading malicious firmware packages. \nThe firmware upgrade endpoint in `upgrade_contents.php` accepts arbitrary file uploads without validating file headers, cryptographic signatures, or enforcing .tgz format requirements, allowing malicious firmware injection. This endpoint also subsequently provides ways for arbitrary file uploads and subsequent remote code execution",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66255"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.abdulmhsblog.com/posts/webfmvulns"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-345"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-26T01:16:08Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-2jxx-qpjm-mvc4/GHSA-2jxx-qpjm-mvc4.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2jxx-qpjm-mvc4",
4+
"modified": "2025-11-26T03:30:22Z",
5+
"published": "2025-11-26T03:30:22Z",
6+
"aliases": [
7+
"CVE-2025-66269"
8+
],
9+
"details": "The RupsMon and USBMate services in UPSilon 2000 run with SYSTEM privileges and contain unquoted service paths. This allows a local attacker to perform path interception and escalate privileges if they have write permissions to the directories proceeding that of which the real service executables live in",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66269"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.megatec.com.tw/software-download"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-428"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-26T02:15:50Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-326g-q2jr-r5fm/GHSA-326g-q2jr-r5fm.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-326g-q2jr-r5fm",
4+
"modified": "2025-11-26T03:30:21Z",
5+
"published": "2025-11-26T03:30:21Z",
6+
"aliases": [
7+
"CVE-2025-66260"
8+
],
9+
"details": "PostgreSQL SQL Injection (status_sql.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform SQL injection via sw1 and sw2 parameters in status_sql.php.\nThe `status_sql.php` endpoint constructs SQL UPDATE queries by directly concatenating user-controlled `sw1` and `sw2` parameters without using parameterized queries or `pg_escape_string()`. While PostgreSQL's `pg_exec` limitations prevent stacked queries, attackers can inject subqueries for data exfiltration and leverage verbose error messages for reconnaissance.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66260"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.abdulmhsblog.com/posts/webfmvulns"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-26T01:16:09Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-5p2h-8jcf-24rf/GHSA-5p2h-8jcf-24rf.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5p2h-8jcf-24rf",
4+
"modified": "2025-11-26T03:30:21Z",
5+
"published": "2025-11-26T03:30:21Z",
6+
"aliases": [
7+
"CVE-2025-66258"
8+
],
9+
"details": "Stored Cross-Site Scripting via XML Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Stored XSS via crafted filenames injected into patchlist.xml.\nUser-controlled filenames are directly concatenated into `patchlist.xml` without encoding, allowing injection of malicious JavaScript payloads via crafted filenames (e.g., `<img src=x onerror=alert()>.bin`). The XSS executes when ajax.js processes and renders the XML file.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66258"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.abdulmhsblog.com/posts/webfmvulns"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-26T01:16:09Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-5q8c-r7p8-3p9v/GHSA-5q8c-r7p8-3p9v.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5q8c-r7p8-3p9v",
4+
"modified": "2025-11-26T03:30:22Z",
5+
"published": "2025-11-26T03:30:21Z",
6+
"aliases": [
7+
"CVE-2025-12848"
8+
],
9+
"details": "Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer. An unauthenticated attacker can exploit this vulnerability by uploading a file with a malicious\nfilename containing JavaScript code (e.g., \"<img src=1 onerror=alert(document.domain)>\") to a Webform node with a Multifile field where file type validation is disabled. This allows the execution of arbitrary scripts\nin the context of the victim's browser.\n \nThe issue is present in a third-party library and has been addressed in a patch available at  https://github.com/fyneworks/multifile/pull/44 . Users are advised to apply the provided patch or update to a fixed version of the module.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:U/V:D/RE:L/U:Amber"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12848"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.drupal.org/node/3105204"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-26T02:15:48Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-5rfv-6ff9-rm8q/GHSA-5rfv-6ff9-rm8q.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5rfv-6ff9-rm8q",
4+
"modified": "2025-11-26T03:30:21Z",
5+
"published": "2025-11-26T03:30:21Z",
6+
"aliases": [
7+
"CVE-2025-66252"
8+
],
9+
"details": "Infinite Loop Denial of Service via Failed File Deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Infinite loop when unlink() fails in status_contents.php causing DoS. Due to the fact that the unlink operation is done in a while loop; if an immutable file is specified or otherwise a file in which the process has no permissions to delete; it would repeatedly attempt to do in a loop.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66252"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.abdulmhsblog.com/posts/webfmvulns"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-835"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-26T01:16:08Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-935j-38v5-5gwh/GHSA-935j-38v5-5gwh.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-935j-38v5-5gwh",
4+
"modified": "2025-11-26T03:30:21Z",
5+
"published": "2025-11-26T03:30:21Z",
6+
"aliases": [
7+
"CVE-2025-66263"
8+
],
9+
"details": "Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Null byte injection in download_setting.php allows reading arbitrary files.\nThe `/var/tdf/download_setting.php` endpoint constructs file paths by concatenating user-controlled `$_GET['filename']` with a forced `.tgz` extension. Running on PHP 5.3.2 (pre-5.3.4), the application is vulnerable to null byte injection (%00), allowing attackers to bypass the extension restriction and traverse paths. By requesting `filename=../../../../etc/passwd%00`, the underlying C functions treat the null byte as a string terminator, ignoring the appended `.tgz` and enabling unauthenticated arbitrary file disclosure of any file readable by the web server user.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66263"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.abdulmhsblog.com/posts/webfmvulns"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-158"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-26T01:16:09Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-9553-998g-436x/GHSA-9553-998g-436x.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9553-998g-436x",
4+
"modified": "2025-11-26T03:30:22Z",
5+
"published": "2025-11-26T03:30:22Z",
6+
"aliases": [
7+
"CVE-2025-66266"
8+
],
9+
"details": "The RupsMon.exe service executable in UPSilon 2000 has insecure permissions, allowing the 'Everyone' group Full Control. A local attacker can replace the executable with a malicious binary to execute code with SYSTEM privileges or simply change the config path of the service to a command; starting and stopping the service to immediately achieve code execution and privilege escalation",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66266"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.megatec.com.tw/software-download"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-269"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-26T02:15:49Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-998x-7989-c3gf/GHSA-998x-7989-c3gf.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-998x-7989-c3gf",
4+
"modified": "2025-11-26T03:30:21Z",
5+
"published": "2025-11-26T03:30:21Z",
6+
"aliases": [
7+
"CVE-2025-66253"
8+
],
9+
"details": "Unauthenticated OS Command Injection (start_upgrade.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform User input passed directly to exec() allows remote code execution via start_upgrade.php. The `/var/tdf/start_upgrade.php` endpoint passes user-controlled `$_GET[\"filename\"]` directly into `exec()` without sanitization or shell escaping. Attackers can inject arbitrary shell commands using metacharacters (`;`, `|`, etc.) to achieve remote code execution as the web server user (likely root).",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66253"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.abdulmhsblog.com/posts/webfmvulns"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-78"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-26T01:16:08Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-9cqc-hhcp-cf94/GHSA-9cqc-hhcp-cf94.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9cqc-hhcp-cf94",
4+
"modified": "2025-11-26T03:30:22Z",
5+
"published": "2025-11-26T03:30:22Z",
6+
"aliases": [
7+
"CVE-2025-66265"
8+
],
9+
"details": "CMService.exe creates the C:\\\\usr directory and subdirectories with insecure permissions, granting write access to all authenticated users. This allows attackers to replace configuration files (such as snmp.conf) or hijack DLLs to escalate privileges.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66265"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.megatec.com.tw/software-download"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-269"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-26T01:16:10Z"
35+
}
36+
}

0 commit comments

Comments
 (0)