Skip to content

Commit dd92ebb

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent a34bb83 commit dd92ebb

File tree

33 files changed

+681
-20
lines changed

33 files changed

+681
-20
lines changed

‎advisories/unreviewed/2025/12/GHSA-2733-h98q-64p4/GHSA-2733-h98q-64p4.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2733-h98q-64p4",
4+
"modified": "2025-12-30T21:30:33Z",
5+
"published": "2025-12-30T21:30:32Z",
6+
"aliases": [
7+
"CVE-2025-15354"
8+
],
9+
"details": "A flaw has been found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/add_admin.php. Executing manipulation of the argument Username can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15354"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/BUPT2025201/CVE/issues/2"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.338741"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.338741"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.726282"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-30T20:16:00Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-35f9-r8q8-pqf5/GHSA-35f9-r8q8-pqf5.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@
4242
],
4343
"database_specific": {
4444
"cwe_ids": [
45-
"CWE-266"
45+
"CWE-266",
46+
"CWE-863"
4647
],
4748
"severity": "LOW",
4849
"github_reviewed": false,

‎advisories/unreviewed/2025/12/GHSA-36pw-gpfg-hfxr/GHSA-36pw-gpfg-hfxr.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-36pw-gpfg-hfxr",
4-
"modified": "2025-12-12T00:30:21Z",
4+
"modified": "2025-12-30T21:30:25Z",
55
"published": "2025-12-12T00:30:21Z",
66
"aliases": [
77
"CVE-2024-58309"
88
],
99
"details": "xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL code through the msgid parameter. Attackers can send crafted requests to /shoutedit.php with EXTRACTVALUE functions to extract database names, user credentials, and password hashes from the underlying database.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/12/GHSA-36vw-m4cf-f8jm/GHSA-36vw-m4cf-f8jm.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-36vw-m4cf-f8jm",
4-
"modified": "2025-12-10T21:31:37Z",
4+
"modified": "2025-12-30T21:30:25Z",
55
"published": "2025-12-10T21:31:37Z",
66
"aliases": [
77
"CVE-2020-36901"
88
],
99
"details": "UBICOD Medivision Digital Signage 1.5.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without proper request validation. Attackers can craft a malicious web page that submits a form to the /query/user/itSet endpoint to add a new admin user with elevated privileges.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/12/GHSA-3h23-rfwm-gcx3/GHSA-3h23-rfwm-gcx3.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,8 @@
5858
],
5959
"database_specific": {
6060
"cwe_ids": [
61-
"CWE-404"
61+
"CWE-404",
62+
"CWE-476"
6263
],
6364
"severity": "MODERATE",
6465
"github_reviewed": false,

‎advisories/unreviewed/2025/12/GHSA-44xp-hxfq-7fh9/GHSA-44xp-hxfq-7fh9.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,8 @@
5454
],
5555
"database_specific": {
5656
"cwe_ids": [
57-
"CWE-119"
57+
"CWE-119",
58+
"CWE-787"
5859
],
5960
"severity": "MODERATE",
6061
"github_reviewed": false,

‎advisories/unreviewed/2025/12/GHSA-4g6x-74c2-rfr9/GHSA-4g6x-74c2-rfr9.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4g6x-74c2-rfr9",
4+
"modified": "2025-12-30T21:30:32Z",
5+
"published": "2025-12-30T21:30:32Z",
6+
"aliases": [
7+
"CVE-2025-15264"
8+
],
9+
"details": "A vulnerability was determined in FeehiCMS up to 2.1.1. Impacted is an unknown function of the file frontend/web/timthumb.php of the component TimThumb. Executing manipulation of the argument src can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15264"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.338663"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.338663"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.718278"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-918"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-12-30T19:15:44Z"
47+
}
48+
}

‎advisories/unreviewed/2025/12/GHSA-54r5-8767-w6vq/GHSA-54r5-8767-w6vq.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-54r5-8767-w6vq",
4+
"modified": "2025-12-30T21:30:32Z",
5+
"published": "2025-12-30T21:30:32Z",
6+
"aliases": [
7+
"CVE-2025-50343"
8+
],
9+
"details": "An issue was discovered in matio 1.5.28. A heap-based memory corruption can occur in Mat_VarCreateStruct() when the nfields value does not match the actual number of strings in the fields array. This leads to out-of-bounds reads and invalid memory frees during cleanup, potentially causing a segmentation fault or heap corruption.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50343"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/tbeu/matio/issues/275"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://github.com/zakkanijia/POC/blob/main/matio/CVE-2025-50343/matio.md"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2025-12-30T20:16:00Z"
32+
}
33+
}

‎advisories/unreviewed/2025/12/GHSA-5rqh-29cg-rcqm/GHSA-5rqh-29cg-rcqm.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5rqh-29cg-rcqm",
4+
"modified": "2025-12-30T21:30:33Z",
5+
"published": "2025-12-30T21:30:33Z",
6+
"aliases": [
7+
"CVE-2025-66723"
8+
],
9+
"details": "inMusic Brands Engine DJ 4.3.0 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all files and network paths.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66723"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/audiopump/cve-2025-66723"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "http://inmusic.com"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2025-12-30T21:15:44Z"
32+
}
33+
}

‎advisories/unreviewed/2025/12/GHSA-5vw2-j3g7-v489/GHSA-5vw2-j3g7-v489.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5vw2-j3g7-v489",
4+
"modified": "2025-12-30T21:30:32Z",
5+
"published": "2025-12-30T21:30:32Z",
6+
"aliases": [
7+
"CVE-2025-66834"
8+
],
9+
"details": "A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exported chat logs via crafted Display Name.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66834"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/x00nullbit/CVE-References/blob/main/CVE-2025-66834/README.md"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://trueconf.com"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2025-12-30T19:15:44Z"
32+
}
33+
}

0 commit comments

Comments
 (0)