Skip to content

Commit cc51cc7

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-39hf-cw8g-g4qj GHSA-58w6-w55x-6wq8 GHSA-697w-w949-fhm4 GHSA-8hh6-8639-p8vq GHSA-96fr-rv8q-2885 GHSA-qx6m-hh7f-72hf GHSA-v2x4-9r4m-m784 GHSA-wm7v-q4q9-gqfh GHSA-wr88-5946-rq47
1 parent 1808960 commit cc51cc7

File tree

9 files changed

+297
-1
lines changed

9 files changed

+297
-1
lines changed

‎advisories/unreviewed/2025/12/GHSA-39hf-cw8g-g4qj/GHSA-39hf-cw8g-g4qj.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-39hf-cw8g-g4qj",
4+
"modified": "2025-12-02T12:30:28Z",
5+
"published": "2025-12-02T12:30:28Z",
6+
"aliases": [
7+
"CVE-2025-13090"
8+
],
9+
"details": "The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13090"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3396348%40wpdirectorykit&new=3396348%40wpdirectorykit&sfp_email=&sfph_mail="
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3405484%40wpdirectorykit&new=3405484%40wpdirectorykit&sfp_email=&sfph_mail="
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d0fbf502-2dfb-49e5-94a6-1525aabc08c1?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-89"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-02T12:16:18Z"
43+
}
44+
}

‎advisories/unreviewed/2025/12/GHSA-58w6-w55x-6wq8/GHSA-58w6-w55x-6wq8.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-58w6-w55x-6wq8",
4+
"modified": "2025-12-02T12:30:28Z",
5+
"published": "2025-12-02T12:30:28Z",
6+
"aliases": [
7+
"CVE-2025-13870"
8+
],
9+
"details": "Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards, which allows an authenticated user to access other board files and was able to subscribe to the block from other boards that the user does not have access to",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13870"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://mattermost.com/security-updates"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-306"
30+
],
31+
"severity": "LOW",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-02T10:16:01Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-697w-w949-fhm4/GHSA-697w-w949-fhm4.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-697w-w949-fhm4",
4+
"modified": "2025-12-02T12:30:28Z",
5+
"published": "2025-12-02T12:30:28Z",
6+
"aliases": [
7+
"CVE-2025-41744"
8+
],
9+
"details": "Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted communications, thereby compromising confidentiality and integrity.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41744"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511043_de.pdf"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-1394"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-02T11:15:51Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-8hh6-8639-p8vq/GHSA-8hh6-8639-p8vq.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8hh6-8639-p8vq",
4+
"modified": "2025-12-02T12:30:28Z",
5+
"published": "2025-12-02T12:30:28Z",
6+
"aliases": [
7+
"CVE-2025-13872"
8+
],
9+
"details": "Blind Server-Side Request Forgery (SSRF) in the survey-import feature of \n\n ObjectPlanet Opinio 7.26 rev12562 on \n\nWeb-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests \n\n to an arbitrary destination.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13872"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.objectplanet.com/opinio/changelog.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-918"
30+
],
31+
"severity": "LOW",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-02T10:16:01Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-96fr-rv8q-2885/GHSA-96fr-rv8q-2885.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-96fr-rv8q-2885",
4-
"modified": "2025-12-01T15:30:18Z",
4+
"modified": "2025-12-02T12:30:27Z",
55
"published": "2025-12-01T15:30:18Z",
66
"aliases": [
77
"CVE-2025-13129"

‎advisories/unreviewed/2025/12/GHSA-qx6m-hh7f-72hf/GHSA-qx6m-hh7f-72hf.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qx6m-hh7f-72hf",
4+
"modified": "2025-12-02T12:30:28Z",
5+
"published": "2025-12-02T12:30:28Z",
6+
"aliases": [
7+
"CVE-2025-41742"
8+
],
9+
"details": "Sprecher Automations SPRECON-E-C,  SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use of these keys allows the attacker to read, modify, and write projects and data, or to access any device via remote maintenance.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41742"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511042_de.pdf"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-1394"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-02T11:15:51Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-v2x4-9r4m-m784/GHSA-v2x4-9r4m-m784.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v2x4-9r4m-m784",
4+
"modified": "2025-12-02T12:30:28Z",
5+
"published": "2025-12-02T12:30:28Z",
6+
"aliases": [
7+
"CVE-2025-41743"
8+
],
9+
"details": "Insufficient encryption strength in Sprecher Automation SPRECON-E-C, SPRECON-E-P, and SPRECON-E-T3 allows a local unprivileged attacker to extract data from update images and thus obtain limited information about the architecture and internal processes.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41743"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511043_de.pdf"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-326"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-02T11:15:51Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-wm7v-q4q9-gqfh/GHSA-wm7v-q4q9-gqfh.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wm7v-q4q9-gqfh",
4+
"modified": "2025-12-02T12:30:28Z",
5+
"published": "2025-12-02T12:30:28Z",
6+
"aliases": [
7+
"CVE-2025-13871"
8+
],
9+
"details": "Cross-Site Request Forgery (CSRF) in the resource-management feature of \n\nObjectPlanet Opinio 7.26 rev12562\n\n allows to upload \nfiles on behalf of the connected users and then access such files without authentication.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13871"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.objectplanet.com/opinio/changelog.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-352"
30+
],
31+
"severity": "LOW",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-02T10:16:01Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-wr88-5946-rq47/GHSA-wr88-5946-rq47.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wr88-5946-rq47",
4+
"modified": "2025-12-02T12:30:28Z",
5+
"published": "2025-12-02T12:30:28Z",
6+
"aliases": [
7+
"CVE-2025-13873"
8+
],
9+
"details": "Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web application allows an attacker to inject arbitrary JavaScript code, which executes in the browsing context of any visitor accessing the compromised survey.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13873"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.objectplanet.com/opinio/changelog.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-02T10:16:02Z"
35+
}
36+
}

0 commit comments

Comments
 (0)