Skip to content

Commit da775b5

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-295f-pwgh-q72q GHSA-29mq-c452-8pvf GHSA-52mc-8c8q-x9g6 GHSA-7xr6-x66r-h3w5 GHSA-h684-p7cm-3g45 GHSA-j3gv-x7fr-5wqw GHSA-mg82-54x7-675c GHSA-vfpj-4m7v-768q GHSA-xmhv-g25h-6j26
1 parent 5437725 commit da775b5

File tree

9 files changed

+389
-0
lines changed

9 files changed

+389
-0
lines changed

‎advisories/unreviewed/2025/11/GHSA-295f-pwgh-q72q/GHSA-295f-pwgh-q72q.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-295f-pwgh-q72q",
4+
"modified": "2025-11-17T12:30:14Z",
5+
"published": "2025-11-17T12:30:14Z",
6+
"aliases": [
7+
"CVE-2025-40936"
8+
],
9+
"details": "A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V29.0.258). The affected applications contains an out of bounds read vulnerability while parsing specially crafted IGS files. This could allow an attacker to crash the application or execute code in the context of the current process. (ZDI-CAN-26755)",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40936"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://cert-portal.siemens.com/productcert/html/ssa-241605.html"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-125"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-17T12:15:44Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-29mq-c452-8pvf/GHSA-29mq-c452-8pvf.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-29mq-c452-8pvf",
4+
"modified": "2025-11-17T12:30:14Z",
5+
"published": "2025-11-17T12:30:14Z",
6+
"aliases": [
7+
"CVE-2025-11681"
8+
],
9+
"details": "Denial-of-service condition in M-Files Server versions before 25.11.15392.1 allows an authenticated user to cause the MFserver process to crash.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11681"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://product.m-files.com/security-advisories/cve-2025-11681"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-400"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-17T12:15:43Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-52mc-8c8q-x9g6/GHSA-52mc-8c8q-x9g6.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-52mc-8c8q-x9g6",
4+
"modified": "2025-11-17T12:30:14Z",
5+
"published": "2025-11-17T12:30:14Z",
6+
"aliases": [
7+
"CVE-2025-13276"
8+
],
9+
"details": "A vulnerability was detected in g33kyrash Online-Banking-System up to 12dbfa690e5af649fb72d2e5d3674e88d6743455. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument Username results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13276"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Nianalb/Report_Online-Banking-System/blob/main/SQL.docx"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.332611"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.332611"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.690087"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-11-17T11:15:46Z"
51+
}
52+
}

‎advisories/unreviewed/2025/11/GHSA-7xr6-x66r-h3w5/GHSA-7xr6-x66r-h3w5.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7xr6-x66r-h3w5",
4+
"modified": "2025-11-17T12:30:14Z",
5+
"published": "2025-11-17T12:30:14Z",
6+
"aliases": [
7+
"CVE-2025-40834"
8+
],
9+
"details": "A vulnerability has been identified in Mendix RichText (All versions >= V4.0.0 < V4.6.1). Affected widget does not properly neutralize the input. This could allow an attacker to execute cross-site scripting attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40834"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://cert-portal.siemens.com/productcert/html/ssa-190588.html"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-17T12:15:44Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-h684-p7cm-3g45/GHSA-h684-p7cm-3g45.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h684-p7cm-3g45",
4+
"modified": "2025-11-17T12:30:14Z",
5+
"published": "2025-11-17T12:30:14Z",
6+
"aliases": [
7+
"CVE-2025-13275"
8+
],
9+
"details": "A security vulnerability has been detected in Iqbolshoh php-business-website up to 10677743a8dfc281f85291a27cf63a0bce043c24. This affects an unknown part of the file /admin/about.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13275"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/mhszed/Report/blob/main/php-business-website%20upload.docx"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.332610"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.332610"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.690049"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-284"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-11-17T11:15:42Z"
51+
}
52+
}

‎advisories/unreviewed/2025/11/GHSA-j3gv-x7fr-5wqw/GHSA-j3gv-x7fr-5wqw.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
],
2727
"database_specific": {
2828
"cwe_ids": [
29+
"CWE-426",
2930
"CWE-732"
3031
],
3132
"severity": "MODERATE",

‎advisories/unreviewed/2025/11/GHSA-mg82-54x7-675c/GHSA-mg82-54x7-675c.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mg82-54x7-675c",
4+
"modified": "2025-11-17T12:30:14Z",
5+
"published": "2025-11-17T12:30:14Z",
6+
"aliases": [
7+
"CVE-2025-13277"
8+
],
9+
"details": "A flaw has been found in code-projects Nero Social Networking Site 1.0. This issue affects some unknown processing of the file /friendsphoto.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13277"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://code-projects.org"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/daojian1/Nero-Social-Networking-Site-V1.0_004"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.332612"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.332612"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.690140"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-17T12:15:44Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-vfpj-4m7v-768q/GHSA-vfpj-4m7v-768q.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vfpj-4m7v-768q",
4+
"modified": "2025-11-17T12:30:14Z",
5+
"published": "2025-11-17T12:30:14Z",
6+
"aliases": [
7+
"CVE-2025-13274"
8+
],
9+
"details": "A weakness has been identified in Campcodes School Fees Payment Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=delete_fees. Executing manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be exploited.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13274"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/ASantsSec/CVE/issues/21"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.332609"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.332609"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.690886"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.campcodes.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-17T10:15:59Z"
55+
}
56+
}

0 commit comments

Comments
 (0)