Skip to content

Commit cbf932e

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-29mw-f55p-xcww GHSA-48xv-9m5x-256f GHSA-52m5-qhx2-x9w6 GHSA-58j3-q2f3-hh75 GHSA-8p82-2232-cwqg GHSA-8vm6-8f9c-2ffc GHSA-fj6q-c6x7-q7w3 GHSA-g3xg-63p8-r3r3 GHSA-j5f2-3cr2-pf2v GHSA-mg4w-ccc5-hpc5 GHSA-p2cr-7737-pf4v
1 parent 8ec11bd commit cbf932e

File tree

11 files changed

+422
-0
lines changed

11 files changed

+422
-0
lines changed

‎advisories/unreviewed/2025/09/GHSA-29mw-f55p-xcww/GHSA-29mw-f55p-xcww.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-29mw-f55p-xcww",
4+
"modified": "2025-09-11T12:31:24Z",
5+
"published": "2025-09-11T12:31:24Z",
6+
"aliases": [
7+
"CVE-2025-40693"
8+
],
9+
"details": "Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a reflected and stored authenticated XSS due to the lack of propper validation of user inputs 'tname' parameter via GET and, 'teamleadname', 'teammember' and 'teamname'\n\n parameters via POST at the endpoint '/ofrs/admin/edit-team.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40693"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-09-11T12:15:35Z"
35+
}
36+
}

‎advisories/unreviewed/2025/09/GHSA-48xv-9m5x-256f/GHSA-48xv-9m5x-256f.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-48xv-9m5x-256f",
4+
"modified": "2025-09-11T12:31:24Z",
5+
"published": "2025-09-11T12:31:24Z",
6+
"aliases": [
7+
"CVE-2025-40695"
8+
],
9+
"details": "Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'remark', 'status' and 'takeaction' parameters via POST at the endpoint '/ofrs/admin/request-details.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40695"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-09-11T12:15:36Z"
35+
}
36+
}

‎advisories/unreviewed/2025/09/GHSA-52m5-qhx2-x9w6/GHSA-52m5-qhx2-x9w6.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-52m5-qhx2-x9w6",
4+
"modified": "2025-09-11T12:31:24Z",
5+
"published": "2025-09-11T12:31:24Z",
6+
"aliases": [
7+
"CVE-2025-40691"
8+
],
9+
"details": "SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via \n\n'todate' parameter in the endpoint '/ofrs/admin/bwdates-report-result.php'.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40691"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-09-11T12:15:35Z"
35+
}
36+
}

‎advisories/unreviewed/2025/09/GHSA-58j3-q2f3-hh75/GHSA-58j3-q2f3-hh75.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-58j3-q2f3-hh75",
4+
"modified": "2025-09-11T12:31:24Z",
5+
"published": "2025-09-11T12:31:24Z",
6+
"aliases": [
7+
"CVE-2025-10250"
8+
],
9+
"details": "A weakness has been identified in DJI Mavic Spark, Mavic Air and Mavic Mini 01.00.0500. Affected is an unknown function of the component Telemetry Channel. Executing manipulation can lead to use of hard-coded cryptographic key\n . The attacker needs to be present on the local network. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10250"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/ByteMe1001/DJI-Enhanced-WiFi-Weak-Cryptography"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.323609"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.323609"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.639757"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [],
45+
"severity": "LOW",
46+
"github_reviewed": false,
47+
"github_reviewed_at": null,
48+
"nvd_published_at": "2025-09-11T12:15:33Z"
49+
}
50+
}

‎advisories/unreviewed/2025/09/GHSA-8p82-2232-cwqg/GHSA-8p82-2232-cwqg.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8p82-2232-cwqg",
4+
"modified": "2025-09-11T12:31:24Z",
5+
"published": "2025-09-11T12:31:24Z",
6+
"aliases": [
7+
"CVE-2025-40692"
8+
],
9+
"details": "SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via \n\n'requestid' parameter in the endpoint '/ofrs/details.php'.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40692"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-09-11T12:15:35Z"
35+
}
36+
}

‎advisories/unreviewed/2025/09/GHSA-8vm6-8f9c-2ffc/GHSA-8vm6-8f9c-2ffc.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8vm6-8f9c-2ffc",
4+
"modified": "2025-09-11T12:31:24Z",
5+
"published": "2025-09-11T12:31:24Z",
6+
"aliases": [
7+
"CVE-2025-40689"
8+
],
9+
"details": "SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via \n\n'remark', 'status' and 'requestid' parameters in the endpoint '/ofrs/admin/request-details.php'.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40689"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-09-11T12:15:34Z"
35+
}
36+
}

‎advisories/unreviewed/2025/09/GHSA-fj6q-c6x7-q7w3/GHSA-fj6q-c6x7-q7w3.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fj6q-c6x7-q7w3",
4+
"modified": "2025-09-11T12:31:24Z",
5+
"published": "2025-09-11T12:31:24Z",
6+
"aliases": [
7+
"CVE-2025-40690"
8+
],
9+
"details": "SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'teamid' parameter in the endpoint '/ofrs/admin/edit-team.php'.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40690"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-09-11T12:15:35Z"
35+
}
36+
}

‎advisories/unreviewed/2025/09/GHSA-g3xg-63p8-r3r3/GHSA-g3xg-63p8-r3r3.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g3xg-63p8-r3r3",
4+
"modified": "2025-09-11T12:31:24Z",
5+
"published": "2025-09-11T12:31:24Z",
6+
"aliases": [
7+
"CVE-2025-40687"
8+
],
9+
"details": "SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via \n\n'mobilenumber', 'teamleadname' and 'teammember' parameters in the endpoint '/ofrs/admin/add-team.php'.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40687"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-09-11T12:15:34Z"
35+
}
36+
}

‎advisories/unreviewed/2025/09/GHSA-j5f2-3cr2-pf2v/GHSA-j5f2-3cr2-pf2v.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j5f2-3cr2-pf2v",
4+
"modified": "2025-09-11T12:31:25Z",
5+
"published": "2025-09-11T12:31:25Z",
6+
"aliases": [
7+
"CVE-2025-9018"
8+
],
9+
"details": "The Time Tracker plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'tt_update_table_function' and 'tt_delete_record_function' functions in all versions up to, and including, 3.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update options such as user registration and default role, allowing anyone to register as an Administrator, and to delete limited data from the database.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9018"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/time-tracker/trunk/inc/function-tt-delete-record.php#L22"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/time-tracker/trunk/inc/function-tt-update-table.php#L25"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/changeset/3359157"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2e840f76-1b46-452e-bd63-507cbab779b9?source=cve"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-862"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-09-11T12:15:36Z"
47+
}
48+
}

0 commit comments

Comments
 (0)