Skip to content

Commit b2f5f02

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-9x68-7qq6-v523 GHSA-jx2m-wgq5-5qcj GHSA-fpq4-r87v-g246 GHSA-2q98-7m46-rq23 GHSA-8vh6-v9pf-9wpq GHSA-cc8c-28gj-px38 GHSA-hvcw-x8r7-vqvw GHSA-j2v6-pm7r-ggcf GHSA-mrcm-cqrc-38qw
1 parent d52709b commit b2f5f02

File tree

9 files changed

+232
-4
lines changed

9 files changed

+232
-4
lines changed

‎advisories/unreviewed/2025/01/GHSA-9x68-7qq6-v523/GHSA-9x68-7qq6-v523.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9x68-7qq6-v523",
4-
"modified": "2025-12-15T09:31:28Z",
4+
"modified": "2025-12-16T12:30:27Z",
55
"published": "2025-01-14T18:32:00Z",
66
"aliases": [
77
"CVE-2024-12087"
@@ -27,6 +27,10 @@
2727
"type": "WEB",
2828
"url": "https://access.redhat.com/errata/RHSA-2025:23154"
2929
},
30+
{
31+
"type": "WEB",
32+
"url": "https://access.redhat.com/errata/RHSA-2025:23235"
33+
},
3034
{
3135
"type": "WEB",
3236
"url": "https://access.redhat.com/errata/RHSA-2025:2600"

‎advisories/unreviewed/2025/05/GHSA-jx2m-wgq5-5qcj/GHSA-jx2m-wgq5-5qcj.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-jx2m-wgq5-5qcj",
4-
"modified": "2025-12-16T03:31:16Z",
4+
"modified": "2025-12-16T12:30:27Z",
55
"published": "2025-05-30T15:30:31Z",
66
"aliases": [
77
"CVE-2025-4598"
@@ -27,6 +27,10 @@
2727
"type": "WEB",
2828
"url": "https://access.redhat.com/errata/RHSA-2025:22868"
2929
},
30+
{
31+
"type": "WEB",
32+
"url": "https://access.redhat.com/errata/RHSA-2025:23227"
33+
},
3034
{
3135
"type": "WEB",
3236
"url": "https://access.redhat.com/errata/RHSA-2025:23234"

‎advisories/unreviewed/2025/10/GHSA-fpq4-r87v-g246/GHSA-fpq4-r87v-g246.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-fpq4-r87v-g246",
4-
"modified": "2025-10-24T15:31:23Z",
4+
"modified": "2025-12-16T12:30:27Z",
55
"published": "2025-10-17T21:31:17Z",
66
"aliases": [
77
"CVE-2025-34281"
@@ -27,6 +27,14 @@
2727
"type": "WEB",
2828
"url": "https://github.com/thingsboard/thingsboard/pull/13927"
2929
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/thingsboard/thingsboard/commit/b2ae6f92d12206ea185a2e882945a6b69234bf03"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://advisory.checkmarx.net/advisory/CVE-2025-3261"
37+
},
3038
{
3139
"type": "WEB",
3240
"url": "https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1"

‎advisories/unreviewed/2025/12/GHSA-2q98-7m46-rq23/GHSA-2q98-7m46-rq23.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2q98-7m46-rq23",
4+
"modified": "2025-12-16T12:30:28Z",
5+
"published": "2025-12-16T12:30:28Z",
6+
"aliases": [
7+
"CVE-2025-11220"
8+
],
9+
"details": "The Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Text Path widget in all versions up to, and including, 3.33.3 due to insufficient neutralization of user-supplied input used to build SVG markup inside the widget. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11220"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3414494/elementor"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1a73c078-ce66-4131-8bd7-6fd48fc9fa84?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-16T12:15:45Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-8vh6-v9pf-9wpq/GHSA-8vh6-v9pf-9wpq.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8vh6-v9pf-9wpq",
4+
"modified": "2025-12-16T12:30:28Z",
5+
"published": "2025-12-16T12:30:28Z",
6+
"aliases": [
7+
"CVE-2025-14002"
8+
],
9+
"details": "The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak OTP (One-Time Password) generation using only 6 numeric digits combined with a 10-minute validity window and no rate limiting on verification attempts. This makes it possible for unauthenticated attackers to brute-force the verification code and authenticate as any user, including administrators, if they know the target's phone number, and the target does not notice or ignores the SMS notification with the OTP.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14002"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.16/includes/class-sesstion.php#L29"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.16/includes/member-functions.php#L833"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/changeset/3411048/wpcom-member"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4f02ee56-40bd-4132-92e1-e2897ff2a4c4?source=cve"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-287"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-12-16T10:15:42Z"
47+
}
48+
}

‎advisories/unreviewed/2025/12/GHSA-cc8c-28gj-px38/GHSA-cc8c-28gj-px38.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-cc8c-28gj-px38",
4-
"modified": "2025-12-15T18:30:40Z",
4+
"modified": "2025-12-16T12:30:28Z",
55
"published": "2025-12-15T18:30:40Z",
66
"aliases": [
77
"CVE-2025-11393"
@@ -19,6 +19,10 @@
1919
"type": "ADVISORY",
2020
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11393"
2121
},
22+
{
23+
"type": "WEB",
24+
"url": "https://access.redhat.com/errata/RHSA-2025:23236"
25+
},
2226
{
2327
"type": "WEB",
2428
"url": "https://access.redhat.com/security/cve/CVE-2025-11393"

‎advisories/unreviewed/2025/12/GHSA-hvcw-x8r7-vqvw/GHSA-hvcw-x8r7-vqvw.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hvcw-x8r7-vqvw",
4+
"modified": "2025-12-16T12:30:28Z",
5+
"published": "2025-12-16T12:30:28Z",
6+
"aliases": [
7+
"CVE-2025-13741"
8+
],
9+
"details": "The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getAuthors function in all versions up to, and including, 4.9.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve emails for all users with edit_posts capability.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13741"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/post-expirator/tags/4.9.1/src/Modules/Workflows/Rest/RestApiV1.php#L376"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f67da8c-da60-4c77-a8b8-7dfc027662e9?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-862"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-16T12:15:46Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-j2v6-pm7r-ggcf/GHSA-j2v6-pm7r-ggcf.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j2v6-pm7r-ggcf",
4+
"modified": "2025-12-16T12:30:28Z",
5+
"published": "2025-12-16T12:30:28Z",
6+
"aliases": [
7+
"CVE-2025-13474"
8+
],
9+
"details": "Authorization Bypass Through User-Controlled Key vulnerability in Menulux Software Inc. Mobile App allows Exploitation of Trusted Identifiers.This issue affects Mobile App: before 9.5.8.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13474"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.usom.gov.tr/bildirim/tr-25-0457"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-639"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-16T12:15:46Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-mrcm-cqrc-38qw/GHSA-mrcm-cqrc-38qw.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mrcm-cqrc-38qw",
4+
"modified": "2025-12-16T12:30:28Z",
5+
"published": "2025-12-16T12:30:28Z",
6+
"aliases": [
7+
"CVE-2025-0836"
8+
],
9+
"details": "Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to MIP Webhooks API.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0836"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://doc.milestonesys.com/en-US/bundle/sec1504_latest/page/Milestone_Security_Advisory.html"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://supportcommunity.milestonesys.com/s/article/XProtect-VMS-cumulative-patches-complete-list?language=en_US"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-862"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-16T11:15:43Z"
43+
}
44+
}

0 commit comments

Comments
 (0)