Skip to content

Commit ceffb48

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3645-f6qv-w99w GHSA-8jwj-hrwc-5589 GHSA-96mr-jqwr-4jfr GHSA-g73r-575p-rqj2 GHSA-h439-96gf-q82r GHSA-h7gc-pxgj-65p6 GHSA-hvww-m87w-qfpc GHSA-j2ch-mw2x-9r92 GHSA-mcx7-55c8-m5jv GHSA-r5xm-3frq-2xcm GHSA-w22j-qgr5-cw5m GHSA-ww6p-m485-xmcc
1 parent 9eb944b commit ceffb48

File tree

12 files changed

+568
-0
lines changed

12 files changed

+568
-0
lines changed

‎advisories/unreviewed/2025/12/GHSA-3645-f6qv-w99w/GHSA-3645-f6qv-w99w.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3645-f6qv-w99w",
4+
"modified": "2025-12-08T12:30:25Z",
5+
"published": "2025-12-08T12:30:25Z",
6+
"aliases": [
7+
"CVE-2025-27020"
8+
],
9+
"details": "Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data on file system\n\n.\n\n\nThis issue affects MTC-9: from R22.1.1.0275 before R23.0.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27020"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27020"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-306"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-08T10:16:01Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-8jwj-hrwc-5589/GHSA-8jwj-hrwc-5589.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8jwj-hrwc-5589",
4+
"modified": "2025-12-08T12:30:26Z",
5+
"published": "2025-12-08T12:30:26Z",
6+
"aliases": [
7+
"CVE-2025-66461"
8+
],
9+
"details": "FULLBACK Manager Pro provided by GS Yuasa International Ltd. registers two Windows services with unquoted file paths. A user may execute arbitrary code with SYSTEM privilege if he/she has the write permission on the path to the directory where the affected product is installed.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66461"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://jvn.jp/en/jp/JVN59242986"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://ps.gs-yuasa.com/technicalinfo/pdf/failure/FMP_info20251201_TEX48214-993.pdf"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-428"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-08T10:16:01Z"
43+
}
44+
}

‎advisories/unreviewed/2025/12/GHSA-96mr-jqwr-4jfr/GHSA-96mr-jqwr-4jfr.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-96mr-jqwr-4jfr",
4+
"modified": "2025-12-08T12:30:25Z",
5+
"published": "2025-12-08T12:30:25Z",
6+
"aliases": [
7+
"CVE-2025-14227"
8+
],
9+
"details": "A security flaw has been discovered in Philipinho Simple-PHP-Blog up to 94b5d3e57308bce5dfbc44c3edafa9811893d958. This issue affects some unknown processing of the file /edit.php. The manipulation results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be exploited. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14227"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/woshinenbaba/CVE-/issues/1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.334669"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.334669"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.701826"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-08T10:16:00Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-g73r-575p-rqj2/GHSA-g73r-575p-rqj2.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g73r-575p-rqj2",
4+
"modified": "2025-12-08T12:30:25Z",
5+
"published": "2025-12-08T12:30:25Z",
6+
"aliases": [
7+
"CVE-2025-27019"
8+
],
9+
"details": "Remote shell service (RSH) in Infinera MTC-9 version R22.1.1.0275 allows\n an attacker to utilize password-less user accounts and obtain \nsystem access by activating a reverse shell.This issue affects MTC-9: from R22.1.1.0275 before R23.0.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27019"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27019"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-306"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-08T10:16:01Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-h439-96gf-q82r/GHSA-h439-96gf-q82r.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h439-96gf-q82r",
4+
"modified": "2025-12-08T12:30:26Z",
5+
"published": "2025-12-08T12:30:26Z",
6+
"aliases": [
7+
"CVE-2025-14230"
8+
],
9+
"details": "A vulnerability was detected in code-projects Daily Time Recording System 4.5.0. The impacted element is an unknown function of the file /admin/add_payroll.php. Performing manipulation of the argument detail_Id results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14230"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/woshilaiyi/cve/issues/6"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://code-projects.org"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.334672"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.334672"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.702426"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-08T12:16:02Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-h7gc-pxgj-65p6/GHSA-h7gc-pxgj-65p6.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h7gc-pxgj-65p6",
4+
"modified": "2025-12-08T12:30:26Z",
5+
"published": "2025-12-08T12:30:26Z",
6+
"aliases": [
7+
"CVE-2025-14228"
8+
],
9+
"details": "A weakness has been identified in Yealink SIP-T21P E2 52.84.0.15. Impacted is an unknown function of the component Local Directory Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14228"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://drive.google.com/file/d/1vptRtEeoS1AZgnqow1yPrsgsBkw4jXc2/view?usp=sharing"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.334670"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.334670"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.701949"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-08T11:15:47Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-hvww-m87w-qfpc/GHSA-hvww-m87w-qfpc.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hvww-m87w-qfpc",
4+
"modified": "2025-12-08T12:30:26Z",
5+
"published": "2025-12-08T12:30:26Z",
6+
"aliases": [
7+
"CVE-2025-14229"
8+
],
9+
"details": "A security vulnerability has been detected in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the component SVC Report Export. Such manipulation leads to csv injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14229"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.334671"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.334671"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.702119"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.notion.so/Spreadsheet-Formula-Injection-Leading-to-Remote-Code-Execution-in-SourceCodester-Inventory-Managemen-2b723917db8c80dfaaabe2b74d6f283d?source=copy_link"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-08T11:15:48Z"
55+
}
56+
}

0 commit comments

Comments
 (0)