Skip to content

Commit cdf72b9

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-qc8j-wvjf-7jfj GHSA-357h-9gq8-42jr GHSA-5fjw-vh88-cccm GHSA-6m34-78r8-ppcg GHSA-fp54-556c-2q63 GHSA-mqq2-8v99-x556 GHSA-q53m-jpj6-g58x GHSA-rpqm-qpjq-22jm
1 parent 0d8034c commit cdf72b9

File tree

8 files changed

+381
-1
lines changed

8 files changed

+381
-1
lines changed

‎advisories/unreviewed/2025/09/GHSA-qc8j-wvjf-7jfj/GHSA-qc8j-wvjf-7jfj.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-qc8j-wvjf-7jfj",
4-
"modified": "2025-11-12T09:30:26Z",
4+
"modified": "2025-11-17T03:30:25Z",
55
"published": "2025-09-23T18:30:24Z",
66
"aliases": [
77
"CVE-2025-9900"
@@ -47,6 +47,10 @@
4747
"type": "WEB",
4848
"url": "https://access.redhat.com/security/cve/CVE-2025-9900"
4949
},
50+
{
51+
"type": "WEB",
52+
"url": "https://access.redhat.com/errata/RHSA-2025:21407"
53+
},
5054
{
5155
"type": "WEB",
5256
"url": "https://access.redhat.com/errata/RHSA-2025:21062"

‎advisories/unreviewed/2025/11/GHSA-357h-9gq8-42jr/GHSA-357h-9gq8-42jr.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-357h-9gq8-42jr",
4+
"modified": "2025-11-17T03:30:25Z",
5+
"published": "2025-11-17T03:30:25Z",
6+
"aliases": [
7+
"CVE-2025-13257"
8+
],
9+
"details": "A security vulnerability has been detected in itsourcecode Inventory Management System 1.0. The affected element is an unknown function of the file /admin/user/index.php?view=edit. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13257"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/iamzzzzz/iam/issues/3"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.332592"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.332592"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.687863"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-17T02:15:42Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-5fjw-vh88-cccm/GHSA-5fjw-vh88-cccm.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5fjw-vh88-cccm",
4+
"modified": "2025-11-17T03:30:25Z",
5+
"published": "2025-11-17T03:30:25Z",
6+
"aliases": [
7+
"CVE-2025-10460"
8+
],
9+
"details": "A SQL Injection vulnerability on an endpoint in BEIMS Contractor Web, a legacy product that is no longer maintained or patched by the vendor, allows an unauthorised user to retrieve sensitive database contents via unsanitized parameter input. This vulnerability occurs due to improper input validation on /BEIMSWeb/contractor.asp endpoint and successful exploitation requires a contractor.asp endpoint open to the internet. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity and potentially the availability of the database. \n\n\n\n\n\nVersion 5.7.139\n\n has been confirmed as vulnerable. Other versions have not been confirmed by the vendor and users should assume that all versions of BEIMS Contractor Web may be impacted until further guidance is provided by the vendor.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10460"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://help.fmiworks.com/knowledge/beims-web"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://help.fmiworks.com/knowledge/contractor-web-operational-requirements"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-20"
34+
],
35+
"severity": "CRITICAL",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-17T03:15:55Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-6m34-78r8-ppcg/GHSA-6m34-78r8-ppcg.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6m34-78r8-ppcg",
4+
"modified": "2025-11-17T03:30:25Z",
5+
"published": "2025-11-17T03:30:24Z",
6+
"aliases": [
7+
"CVE-2025-13254"
8+
],
9+
"details": "A vulnerability was identified in projectworlds Advanced Library Management System 1.0. This vulnerability affects unknown code of the file /add_member.php. Such manipulation of the argument roll_number leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13254"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Wyg2002yx/cve/blob/main/002/report.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.332589"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.332589"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.687854"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-11-17T01:15:44Z"
51+
}
52+
}

‎advisories/unreviewed/2025/11/GHSA-fp54-556c-2q63/GHSA-fp54-556c-2q63.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fp54-556c-2q63",
4+
"modified": "2025-11-17T03:30:26Z",
5+
"published": "2025-11-17T03:30:26Z",
6+
"aliases": [
7+
"CVE-2025-13258"
8+
],
9+
"details": "A vulnerability was detected in Tenda AC20 up to 16.03.08.12. The impacted element is an unknown function of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto results in buffer overflow. The attack can be launched remotely. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13258"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/DavCloudz/cve/blob/main/Tenda/Tengda%20AC20%20Router%20WifiExtraSet%20Buffer%20Overflow%20Vulnerability.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/DavCloudz/cve/blob/main/Tenda/Tengda%20AC20%20Router%20WifiExtraSet%20Buffer%20Overflow%20Vulnerability.md#poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.332593"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.332593"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.688716"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://www.tenda.com.cn"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-119"
54+
],
55+
"severity": "HIGH",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2025-11-17T03:15:55Z"
59+
}
60+
}

‎advisories/unreviewed/2025/11/GHSA-mqq2-8v99-x556/GHSA-mqq2-8v99-x556.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mqq2-8v99-x556",
4+
"modified": "2025-11-17T03:30:25Z",
5+
"published": "2025-11-17T03:30:25Z",
6+
"aliases": [
7+
"CVE-2025-13255"
8+
],
9+
"details": "A security flaw has been discovered in projectworlds Advanced Library Management System 1.0. This issue affects some unknown processing of the file /book_search.php. Performing manipulation of the argument book_pub/book_title results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13255"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Wyg2002yx/cve/blob/main/003/report.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/Wyg2002yx/cve/blob/main/004/report.md"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.332590"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.332590"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.687855"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.687857"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-74"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2025-11-17T01:15:44Z"
59+
}
60+
}

‎advisories/unreviewed/2025/11/GHSA-q53m-jpj6-g58x/GHSA-q53m-jpj6-g58x.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-q53m-jpj6-g58x",
4+
"modified": "2025-11-17T03:30:26Z",
5+
"published": "2025-11-17T03:30:26Z",
6+
"aliases": [
7+
"CVE-2025-13259"
8+
],
9+
"details": "A flaw has been found in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /manufacturer/edit_unit.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13259"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/arpcyber060/CVE/issues/1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.332594"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.332594"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.688780"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.campcodes.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-17T03:15:55Z"
55+
}
56+
}

0 commit comments

Comments
 (0)