Skip to content

Commit c6ca45b

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3f8c-8h8v-p54h GHSA-52cp-m58w-wp9x GHSA-56fg-4g9q-9hgx GHSA-77vm-wwqh-qv39 GHSA-pw2x-h8g7-9fgp GHSA-rw74-fqrf-pr2q
1 parent a2e15e5 commit c6ca45b

File tree

6 files changed

+324
-0
lines changed

6 files changed

+324
-0
lines changed

‎advisories/unreviewed/2025/12/GHSA-3f8c-8h8v-p54h/GHSA-3f8c-8h8v-p54h.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3f8c-8h8v-p54h",
4+
"modified": "2025-12-14T18:31:30Z",
5+
"published": "2025-12-14T18:31:30Z",
6+
"aliases": [
7+
"CVE-2025-14674"
8+
],
9+
"details": "A vulnerability was found in aizuda snail-job up to 1.6.0. Affected by this vulnerability is the function QLExpressEngine.doEval of the file snail-job-common/snail-job-common-core/src/main/java/com/aizuda/snailjob/common/core/expression/strategy/QLExpressEngine.java. The manipulation results in injection. The attack can be launched remotely. Upgrading to version 1.7.0-beta1 addresses this issue. The patch is identified as 978f316c38b3d68bb74d2489b5e5f721f6675e86. The affected component should be upgraded.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14674"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gitee.com/aizuda/snail-job/commit/978f316c38b3d68bb74d2489b5e5f721f6675e86"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://gitee.com/aizuda/snail-job/issues/ICNUG0"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://gitee.com/aizuda/snail-job/issues/ICNUG0#note_44321424_link"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://gitee.com/aizuda/snail-job/releases/tag/vsj1.7.0-beta1"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?ctiid.336403"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?id.336403"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-74"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2025-12-14T18:15:43Z"
59+
}
60+
}

‎advisories/unreviewed/2025/12/GHSA-52cp-m58w-wp9x/GHSA-52cp-m58w-wp9x.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-52cp-m58w-wp9x",
4+
"modified": "2025-12-14T18:31:30Z",
5+
"published": "2025-12-14T18:31:30Z",
6+
"aliases": [
7+
"CVE-2025-14672"
8+
],
9+
"details": "A flaw has been found in gmg137 snap7-rs up to 1.142.1. This impacts the function TSnap7MicroClient::opWriteArea of the file s7_micro_client.cpp. Executing manipulation can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14672"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gitee.com/gmg137/snap7-rs/issues/ID2H8E"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.336401"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.336401"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-119"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-12-14T17:15:39Z"
47+
}
48+
}

‎advisories/unreviewed/2025/12/GHSA-56fg-4g9q-9hgx/GHSA-56fg-4g9q-9hgx.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-56fg-4g9q-9hgx",
4+
"modified": "2025-12-14T18:31:30Z",
5+
"published": "2025-12-14T18:31:30Z",
6+
"aliases": [
7+
"CVE-2025-14667"
8+
],
9+
"details": "A security vulnerability has been detected in itsourcecode COVID Tracking System 1.0. The impacted element is an unknown function of the file /admin/?page=system_info. Such manipulation of the argument meta_value leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14667"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/bardminx/Lonlydance/issues/3"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.336399"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.336399"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.714805"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-14T16:15:37Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-77vm-wwqh-qv39/GHSA-77vm-wwqh-qv39.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-77vm-wwqh-qv39",
4+
"modified": "2025-12-14T18:31:30Z",
5+
"published": "2025-12-14T18:31:29Z",
6+
"aliases": [
7+
"CVE-2025-14666"
8+
],
9+
"details": "A weakness has been identified in itsourcecode COVID Tracking System 1.0. The affected element is an unknown function of the file /admin/?page=user. This manipulation of the argument Username causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14666"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/bardminx/Lonlydance/issues/2"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.336398"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.336398"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.714786"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-14T16:15:37Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-pw2x-h8g7-9fgp/GHSA-pw2x-h8g7-9fgp.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pw2x-h8g7-9fgp",
4+
"modified": "2025-12-14T18:31:30Z",
5+
"published": "2025-12-14T18:31:30Z",
6+
"aliases": [
7+
"CVE-2025-14668"
8+
],
9+
"details": "A vulnerability was detected in campcodes Advanced Online Examination System 1.0. This affects an unknown function of the file /query/loginExe.php. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14668"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/gravity123123/CVE/issues/1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.336400"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.336400"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.714806"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.campcodes.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-14T17:15:39Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-rw74-fqrf-pr2q/GHSA-rw74-fqrf-pr2q.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rw74-fqrf-pr2q",
4+
"modified": "2025-12-14T18:31:30Z",
5+
"published": "2025-12-14T18:31:30Z",
6+
"aliases": [
7+
"CVE-2025-14673"
8+
],
9+
"details": "A vulnerability has been found in gmg137 snap7-rs up to 1.142.1. Affected is the function snap7_rs::client::S7Client::as_ct_write of the file /tests/snap7-rs/src/client.rs. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14673"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gitee.com/gmg137/snap7-rs/issues/ID2H74"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.336402"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.336402"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-119"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-12-14T18:15:43Z"
47+
}
48+
}

0 commit comments

Comments
 (0)