Skip to content

Commit ad64205

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3vw4-6555-wh35 GHSA-5mx6-qhcr-4pqv GHSA-858c-g64p-6mfh GHSA-pr97-qg84-hf52 GHSA-q252-w8cv-75jr GHSA-vfwh-w29h-mwvr
1 parent abf4d54 commit ad64205

File tree

6 files changed

+310
-0
lines changed

6 files changed

+310
-0
lines changed

‎advisories/unreviewed/2025/11/GHSA-3vw4-6555-wh35/GHSA-3vw4-6555-wh35.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3vw4-6555-wh35",
4+
"modified": "2025-11-16T06:31:11Z",
5+
"published": "2025-11-16T06:31:11Z",
6+
"aliases": [
7+
"CVE-2025-13237"
8+
],
9+
"details": "A security flaw has been discovered in itsourcecode Inventory Management System 1.0. Affected is an unknown function of the file /LogSignModal.PHP. The manipulation of the argument U_USERNAME results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be exploited.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13237"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/yihaofuweng/cve/issues/57"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.332563"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.332563"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.686734"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-16T05:16:01Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-5mx6-qhcr-4pqv/GHSA-5mx6-qhcr-4pqv.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5mx6-qhcr-4pqv",
4+
"modified": "2025-11-16T06:31:11Z",
5+
"published": "2025-11-16T06:31:10Z",
6+
"aliases": [
7+
"CVE-2025-12482"
8+
],
9+
"details": "The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to, and including, 1.2.35 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12482"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3390245/ameliabooking/tags/1.2.36/src/Infrastructure/Repository/Booking/Event/EventRepository.php"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cacf2e32-12cf-41a9-a57f-1135c165494c?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-89"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-16T05:15:59Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-858c-g64p-6mfh/GHSA-858c-g64p-6mfh.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-858c-g64p-6mfh",
4+
"modified": "2025-11-16T06:31:11Z",
5+
"published": "2025-11-16T06:31:11Z",
6+
"aliases": [
7+
"CVE-2025-13238"
8+
],
9+
"details": "A weakness has been identified in Bdtask Flight Booking Software 4. Affected by this vulnerability is an unknown functionality of the file /agent/profile/edit of the component Edit Profile Page. This manipulation causes unrestricted upload. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13238"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/4m3rr0r/PoCVulDb/issues/6"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.332564"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.332564"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.686895"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-284"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-11-16T06:15:42Z"
51+
}
52+
}

‎advisories/unreviewed/2025/11/GHSA-pr97-qg84-hf52/GHSA-pr97-qg84-hf52.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pr97-qg84-hf52",
4+
"modified": "2025-11-16T06:31:11Z",
5+
"published": "2025-11-16T06:31:10Z",
6+
"aliases": [
7+
"CVE-2025-13236"
8+
],
9+
"details": "A vulnerability was identified in itsourcecode Inventory Management System 1.0. This impacts an unknown function of the file /admin/products/index.php?view=edit. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13236"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/3169417664/cve/issues/3"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.332562"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.332562"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.686702"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-16T04:15:55Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-q252-w8cv-75jr/GHSA-q252-w8cv-75jr.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-q252-w8cv-75jr",
4+
"modified": "2025-11-16T06:31:11Z",
5+
"published": "2025-11-16T06:31:11Z",
6+
"aliases": [
7+
"CVE-2025-13239"
8+
],
9+
"details": "A security vulnerability has been detected in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution 5. Affected by this issue is some unknown functionality of the file /submit_checkout. Such manipulation of the argument order_total_amount/cart_total_amount leads to enforcement of behavioral workflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13239"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/4m3rr0r/PoCVulDb/issues/7"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.332565"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.332565"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.686896"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [],
45+
"severity": "MODERATE",
46+
"github_reviewed": false,
47+
"github_reviewed_at": null,
48+
"nvd_published_at": "2025-11-16T06:15:43Z"
49+
}
50+
}

‎advisories/unreviewed/2025/11/GHSA-vfwh-w29h-mwvr/GHSA-vfwh-w29h-mwvr.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vfwh-w29h-mwvr",
4+
"modified": "2025-11-16T06:31:10Z",
5+
"published": "2025-11-16T06:31:10Z",
6+
"aliases": [
7+
"CVE-2025-13235"
8+
],
9+
"details": "A vulnerability was determined in itsourcecode Inventory Management System 1.0. This affects an unknown function of the file /admin/login.php. Executing manipulation of the argument user_email can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13235"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/52914/cve/issues/1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.332561"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.332561"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.686701"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-16T04:15:54Z"
55+
}
56+
}

0 commit comments

Comments
 (0)