Skip to content

Commit bffd966

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-28vm-3vp8-h5jp GHSA-2w93-qwpp-vgvj GHSA-6qj9-2g9m-29x9 GHSA-jqfc-9q34-prhg GHSA-p3p5-xrmv-4j6x GHSA-xhgv-99mj-8m2x
1 parent 43386f3 commit bffd966

File tree

6 files changed

+240
-0
lines changed

6 files changed

+240
-0
lines changed

‎advisories/unreviewed/2025/11/GHSA-28vm-3vp8-h5jp/GHSA-28vm-3vp8-h5jp.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-28vm-3vp8-h5jp",
4+
"modified": "2025-11-30T03:30:26Z",
5+
"published": "2025-11-30T03:30:26Z",
6+
"aliases": [
7+
"CVE-2025-13615"
8+
],
9+
"details": "The StreamTube Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 4.78. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited if the 'registration password fields' enabled in theme options.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13615"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://themeforest.net/item/streamtube-responsive-video-wordpress-theme/33821786"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b812a0d7-99a1-4f61-b78a-78cea6a2ada1?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-639"
34+
],
35+
"severity": "CRITICAL",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-30T02:15:58Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-2w93-qwpp-vgvj/GHSA-2w93-qwpp-vgvj.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2w93-qwpp-vgvj",
4+
"modified": "2025-11-30T03:30:26Z",
5+
"published": "2025-11-30T03:30:26Z",
6+
"aliases": [
7+
"CVE-2025-66424"
8+
],
9+
"details": "Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66424"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://discuss.tryton.org/t/security-release-for-issue-14366/8953"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://foss.heptapod.net/tryton/tryton/-/issues/14366"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-863"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-30T03:15:48Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-6qj9-2g9m-29x9/GHSA-6qj9-2g9m-29x9.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6qj9-2g9m-29x9",
4+
"modified": "2025-11-30T03:30:26Z",
5+
"published": "2025-11-30T03:30:26Z",
6+
"aliases": [
7+
"CVE-2025-66421"
8+
],
9+
"details": "Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66421"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://discuss.tryton.org/t/security-release-for-issue-14363/8951"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://foss.heptapod.net/tryton/tryton/-/issues/14363"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-30T03:15:47Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-jqfc-9q34-prhg/GHSA-jqfc-9q34-prhg.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jqfc-9q34-prhg",
4+
"modified": "2025-11-30T03:30:26Z",
5+
"published": "2025-11-30T03:30:26Z",
6+
"aliases": [
7+
"CVE-2025-66422"
8+
],
9+
"details": "Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66422"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://discuss.tryton.org/t/security-release-for-issue-14354/8950"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://foss.heptapod.net/tryton/tryton/-/issues/14354"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-402"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-30T03:15:47Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-p3p5-xrmv-4j6x/GHSA-p3p5-xrmv-4j6x.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p3p5-xrmv-4j6x",
4+
"modified": "2025-11-30T03:30:26Z",
5+
"published": "2025-11-30T03:30:26Z",
6+
"aliases": [
7+
"CVE-2025-66423"
8+
],
9+
"details": "Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66423"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://discuss.tryton.org/t/security-release-for-issue-14364/8952"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://foss.heptapod.net/tryton/tryton/-/issues/14364"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-863"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-30T03:15:48Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-xhgv-99mj-8m2x/GHSA-xhgv-99mj-8m2x.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xhgv-99mj-8m2x",
4+
"modified": "2025-11-30T03:30:26Z",
5+
"published": "2025-11-30T03:30:26Z",
6+
"aliases": [
7+
"CVE-2025-66420"
8+
],
9+
"details": "Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66420"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://discuss.tryton.org/t/security-release-for-issue-14290/8895"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://foss.heptapod.net/tryton/tryton/-/issues/14290"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-30T03:15:46Z"
39+
}
40+
}

0 commit comments

Comments
 (0)