Skip to content

Commit a83d4a2

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3jrf-74h9-v6jf GHSA-g7fx-r7wp-m8cx GHSA-gjff-p6ff-7g4f GHSA-v55r-6gfm-698m GHSA-w9p6-fhvw-j42q GHSA-wxxw-j7jh-6gvh
1 parent 1f01360 commit a83d4a2

File tree

6 files changed

+280
-0
lines changed

6 files changed

+280
-0
lines changed

‎advisories/unreviewed/2025/12/GHSA-3jrf-74h9-v6jf/GHSA-3jrf-74h9-v6jf.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3jrf-74h9-v6jf",
4+
"modified": "2025-12-25T21:30:11Z",
5+
"published": "2025-12-25T21:30:11Z",
6+
"aliases": [
7+
"CVE-2025-15086"
8+
],
9+
"details": "A weakness has been identified in youlaitech youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile of the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java. This manipulation causes improper access controls. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15086"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Hwwg/cve/issues/27"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.338414"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.338414"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.708176"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-266"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-25T21:15:40Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-g7fx-r7wp-m8cx/GHSA-g7fx-r7wp-m8cx.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g7fx-r7wp-m8cx",
4+
"modified": "2025-12-25T21:30:11Z",
5+
"published": "2025-12-25T21:30:11Z",
6+
"aliases": [
7+
"CVE-2025-15085"
8+
],
9+
"details": "A security flaw has been discovered in youlaitech youlai-mall 1.0.0/2.0.0. This affects the function deductBalance of the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java of the component Balance Handler. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15085"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Hwwg/cve/issues/26"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.338413"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.338413"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.708175"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-266"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-25T20:15:41Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-gjff-p6ff-7g4f/GHSA-gjff-p6ff-7g4f.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gjff-p6ff-7g4f",
4+
"modified": "2025-12-25T21:30:11Z",
5+
"published": "2025-12-25T21:30:11Z",
6+
"aliases": [
7+
"CVE-2025-15084"
8+
],
9+
"details": "A vulnerability was identified in youlaitech youlai-mall 1.0.0/2.0.0. The impacted element is the function orderService.payOrder of the file mall-oms/oms-boot/src/main/java/com/youlai/mall/oms/controller/app/OrderController.java of the component Order Payment Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15084"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Hwwg/cve/issues/24"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.338412"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.338412"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.708174"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-266"
46+
],
47+
"severity": "LOW",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-25T19:15:39Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-v55r-6gfm-698m/GHSA-v55r-6gfm-698m.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v55r-6gfm-698m",
4+
"modified": "2025-12-25T21:30:11Z",
5+
"published": "2025-12-25T21:30:11Z",
6+
"aliases": [
7+
"CVE-2025-68936"
8+
],
9+
"details": "ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68936"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#921"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-25T20:15:42Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-w9p6-fhvw-j42q/GHSA-w9p6-fhvw-j42q.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-w9p6-fhvw-j42q",
4+
"modified": "2025-12-25T21:30:12Z",
5+
"published": "2025-12-25T21:30:11Z",
6+
"aliases": [
7+
"CVE-2025-15087"
8+
],
9+
"details": "A security vulnerability has been detected in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function submitOrderPayment of the file mall-oms/oms-boot/src/main/java/com/youlai/mall/oms/controller/app/OrderController.java. Such manipulation of the argument orderSn leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15087"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Hwwg/cve/issues/30"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.338415"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.338415"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.708180"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-266"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-25T21:15:41Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-wxxw-j7jh-6gvh/GHSA-wxxw-j7jh-6gvh.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wxxw-j7jh-6gvh",
4+
"modified": "2025-12-25T21:30:11Z",
5+
"published": "2025-12-25T21:30:11Z",
6+
"aliases": [
7+
"CVE-2025-68935"
8+
],
9+
"details": "ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68935"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#921"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-25T20:15:42Z"
35+
}
36+
}

0 commit comments

Comments
 (0)