Skip to content

Commit a76874f

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent bd6ae6c commit a76874f

File tree

40 files changed

+1468
-4
lines changed

40 files changed

+1468
-4
lines changed

‎advisories/github-reviewed/2025/09/GHSA-wp3j-xq48-xpjw/GHSA-wp3j-xq48-xpjw.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-wp3j-xq48-xpjw",
4-
"modified": "2025-10-22T06:31:11Z",
4+
"modified": "2025-10-22T09:30:18Z",
55
"published": "2025-09-04T20:01:54Z",
66
"aliases": [
77
"CVE-2025-9566"
@@ -102,6 +102,10 @@
102102
"type": "WEB",
103103
"url": "https://access.redhat.com/errata/RHSA-2025:16515"
104104
},
105+
{
106+
"type": "WEB",
107+
"url": "https://access.redhat.com/errata/RHSA-2025:18217"
108+
},
105109
{
106110
"type": "WEB",
107111
"url": "https://access.redhat.com/errata/RHSA-2025:18218"

‎advisories/unreviewed/2025/06/GHSA-7376-x4rm-3v8x/GHSA-7376-x4rm-3v8x.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7376-x4rm-3v8x",
4-
"modified": "2025-10-22T06:31:11Z",
4+
"modified": "2025-10-22T09:30:18Z",
55
"published": "2025-06-09T21:30:52Z",
66
"aliases": [
77
"CVE-2025-5914"
@@ -43,6 +43,10 @@
4343
"type": "WEB",
4444
"url": "https://access.redhat.com/errata/RHSA-2025:18218"
4545
},
46+
{
47+
"type": "WEB",
48+
"url": "https://access.redhat.com/errata/RHSA-2025:18217"
49+
},
4650
{
4751
"type": "WEB",
4852
"url": "https://access.redhat.com/errata/RHSA-2025:16524"

‎advisories/unreviewed/2025/06/GHSA-83xx-9f6p-vwfj/GHSA-83xx-9f6p-vwfj.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-83xx-9f6p-vwfj",
4-
"modified": "2025-10-22T06:31:11Z",
4+
"modified": "2025-10-22T09:30:18Z",
55
"published": "2025-06-16T18:32:19Z",
66
"aliases": [
77
"CVE-2025-49796"
@@ -35,6 +35,10 @@
3535
"type": "WEB",
3636
"url": "https://access.redhat.com/errata/RHSA-2025:18218"
3737
},
38+
{
39+
"type": "WEB",
40+
"url": "https://access.redhat.com/errata/RHSA-2025:18217"
41+
},
3842
{
3943
"type": "WEB",
4044
"url": "https://access.redhat.com/errata/RHSA-2025:15828"

‎advisories/unreviewed/2025/06/GHSA-qg4c-8pj4-qgw2/GHSA-qg4c-8pj4-qgw2.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-qg4c-8pj4-qgw2",
4-
"modified": "2025-10-22T06:31:11Z",
4+
"modified": "2025-10-22T09:30:18Z",
55
"published": "2025-06-16T18:32:19Z",
66
"aliases": [
77
"CVE-2025-49794"
@@ -35,6 +35,10 @@
3535
"type": "WEB",
3636
"url": "https://access.redhat.com/errata/RHSA-2025:18218"
3737
},
38+
{
39+
"type": "WEB",
40+
"url": "https://access.redhat.com/errata/RHSA-2025:18217"
41+
},
3842
{
3943
"type": "WEB",
4044
"url": "https://access.redhat.com/errata/RHSA-2025:15828"

‎advisories/unreviewed/2025/10/GHSA-3ff6-64wh-g4r9/GHSA-3ff6-64wh-g4r9.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3ff6-64wh-g4r9",
4+
"modified": "2025-10-22T09:30:19Z",
5+
"published": "2025-10-22T09:30:19Z",
6+
"aliases": [
7+
"CVE-2025-11818"
8+
],
9+
"details": "The WP Responsive Meet The Team plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wprm_team' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11818"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/wp-responsive-meet-the-team/tags/1.0.1/admin/layouts.php#L64"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://wordpress.org/plugins/wp-responsive-meet-the-team"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/30d79f14-b70c-403b-9e55-66e40b18aca7?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-10-22T09:15:33Z"
43+
}
44+
}

‎advisories/unreviewed/2025/10/GHSA-4354-j643-p6c7/GHSA-4354-j643-p6c7.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4354-j643-p6c7",
4+
"modified": "2025-10-22T09:30:19Z",
5+
"published": "2025-10-22T09:30:19Z",
6+
"aliases": [
7+
"CVE-2025-10138"
8+
],
9+
"details": "The This-or-That plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'thisorthat' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10138"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/this-or-that/trunk/this-or-that.php#L232"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/22f291eb-d1f8-40d6-b020-f6364164dc40?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-10-22T09:15:31Z"
39+
}
40+
}

‎advisories/unreviewed/2025/10/GHSA-45h2-9ghc-w5ff/GHSA-45h2-9ghc-w5ff.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-45h2-9ghc-w5ff",
4+
"modified": "2025-10-22T09:30:20Z",
5+
"published": "2025-10-22T09:30:19Z",
6+
"aliases": [
7+
"CVE-2025-41109"
8+
],
9+
"details": "Ghost Robotics Vision 60 v0.27.2 includes, among its physical interfaces, three RJ45 connectors and a USB Type-C port. The vulnerability is due to the lack of authentication mechanisms when establishing connections through these ports. Specifically, with regard to network connectivity, the robot's internal router automatically assigns IP addresses to any device physically connected to it. An attacker could connect a WiFi access point under their control to gain access to the robot's network without needing the credentials for the deployed network. Once inside, the attacker can monitor all its data, as the robot runs on ROS 2 without authentication by default.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41109"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ghost-robotics-vision-60"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-798"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-22T09:15:36Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-4cc8-p6r8-frcc/GHSA-4cc8-p6r8-frcc.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4cc8-p6r8-frcc",
4+
"modified": "2025-10-22T09:30:19Z",
5+
"published": "2025-10-22T09:30:19Z",
6+
"aliases": [
7+
"CVE-2025-11824"
8+
],
9+
"details": "The Cinza Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cgrid_skin_content' post meta field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11824"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/cinza-grid/tags/1.2.1/includes/backend-cpts.php#L733"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/cinza-grid/tags/1.2.1/includes/backend-shortcodes.php#L511"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9acec3df-84d6-4cea-8756-64fbb468e5e0?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-10-22T09:15:33Z"
43+
}
44+
}

‎advisories/unreviewed/2025/10/GHSA-5835-f92c-7g99/GHSA-5835-f92c-7g99.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5835-f92c-7g99",
4+
"modified": "2025-10-22T09:30:19Z",
5+
"published": "2025-10-22T09:30:19Z",
6+
"aliases": [
7+
"CVE-2025-11809"
8+
],
9+
"details": "The WP-Force Images Download plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpfid' shortcode in all versions up to, and including, 1.8. This is due to insufficient input sanitization and output escaping on the 'class' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11809"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/wp-force-images-download/tags/1.8/wp_fid.php#L155"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/07775638-270b-4424-8e2a-3ead1d752c88?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-10-22T09:15:32Z"
39+
}
40+
}

‎advisories/unreviewed/2025/10/GHSA-5j2q-wj9v-2vp4/GHSA-5j2q-wj9v-2vp4.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5j2q-wj9v-2vp4",
4+
"modified": "2025-10-22T09:30:19Z",
5+
"published": "2025-10-22T09:30:19Z",
6+
"aliases": [
7+
"CVE-2025-11807"
8+
],
9+
"details": "The Mixlr Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mixlr' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on the 'url' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11807"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/mixlr-shortcode/tags/1.0.1/mixlr-shortcode.php#L30"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://wordpress.org/plugins/mixlr-shortcode"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2771f9d4-429f-4691-a65c-073c3a3778fb?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-10-22T09:15:32Z"
43+
}
44+
}

0 commit comments

Comments
 (0)