Skip to content

Commit e8170b4

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-4jq4-pprp-6g43 GHSA-6hp6-j394-rmqr GHSA-72v6-44v4-h4vc GHSA-88pj-m87f-2hv5 GHSA-9649-47r9-xcxc GHSA-9h3v-9qqv-822m GHSA-f6cr-5vcg-p3cg GHSA-jpjm-2g38-x396 GHSA-p76h-gwg5-j85j GHSA-r3r3-89fv-rw6f GHSA-rw8m-hvvr-gqpp GHSA-wm3j-77wq-prwp GHSA-wpmx-929x-xv8j GHSA-x84j-v2j2-g9v8
1 parent 70d5a34 commit e8170b4

File tree

14 files changed

+592
-0
lines changed

14 files changed

+592
-0
lines changed

‎advisories/unreviewed/2025/12/GHSA-4jq4-pprp-6g43/GHSA-4jq4-pprp-6g43.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4jq4-pprp-6g43",
4+
"modified": "2025-12-15T06:31:15Z",
5+
"published": "2025-12-15T06:31:15Z",
6+
"aliases": [
7+
"CVE-2025-13740"
8+
],
9+
"details": "The Lightweight Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `lightweight-accordion` shortcode in all versions up to, and including, 1.5.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13740"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3413649"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f117f713-e2f1-4803-87f7-14b1576d823b?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-15T04:15:36Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-6hp6-j394-rmqr/GHSA-6hp6-j394-rmqr.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6hp6-j394-rmqr",
4+
"modified": "2025-12-15T06:31:16Z",
5+
"published": "2025-12-15T06:31:16Z",
6+
"aliases": [
7+
"CVE-2025-12684"
8+
],
9+
"details": "The URL Shortify WordPress plugin before 1.11.3 does not sanitize and escape a parameter before outputting it back in the page, leading to a reflected cross site scripting, which could be used against high-privilege users such as admins.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12684"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/8f1e04c6-8781-4366-99d9-9a59102957cf"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-12-15T06:15:42Z"
28+
}
29+
}

‎advisories/unreviewed/2025/12/GHSA-72v6-44v4-h4vc/GHSA-72v6-44v4-h4vc.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-72v6-44v4-h4vc",
4+
"modified": "2025-12-15T06:31:15Z",
5+
"published": "2025-12-15T06:31:15Z",
6+
"aliases": [
7+
"CVE-2025-14704"
8+
],
9+
"details": "A vulnerability was found in Shiguangwu sgwbox N3 2.0.25. The impacted element is an unknown function of the file /eshell of the component API. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14704"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.336421"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.336421"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.706915"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.notion.so/sgwbox-NAS-N3-Directory-Traversal-2be6cf4e528a802a9c0ad6f01b75694e?source=copy_link"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-22"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-15T05:15:43Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-88pj-m87f-2hv5/GHSA-88pj-m87f-2hv5.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-88pj-m87f-2hv5",
4+
"modified": "2025-12-15T06:31:16Z",
5+
"published": "2025-12-15T06:31:16Z",
6+
"aliases": [
7+
"CVE-2025-13355"
8+
],
9+
"details": "The URL Shortify WordPress plugin before 1.11.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13355"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/8581af77-2d72-48e8-9b22-2c36f122473c"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-12-15T06:15:42Z"
28+
}
29+
}

‎advisories/unreviewed/2025/12/GHSA-9649-47r9-xcxc/GHSA-9649-47r9-xcxc.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9649-47r9-xcxc",
4+
"modified": "2025-12-15T06:31:15Z",
5+
"published": "2025-12-15T06:31:15Z",
6+
"aliases": [
7+
"CVE-2025-14702"
8+
],
9+
"details": "A flaw has been found in Smartbit CommV Smartschool App up to 10.4.4. Impacted is an unknown function of the component be.smartschool.mobile.SplashActivity. Executing manipulation can lead to path traversal. The attack requires local access. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14702"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Secsys-FDU/AF_CVEs/issues/4"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.336419"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.336419"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.706220"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-22"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-15T04:15:36Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-9h3v-9qqv-822m/GHSA-9h3v-9qqv-822m.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9h3v-9qqv-822m",
4+
"modified": "2025-12-15T06:31:16Z",
5+
"published": "2025-12-15T06:31:16Z",
6+
"aliases": [
7+
"CVE-2025-14706"
8+
],
9+
"details": "A vulnerability was identified in Shiguangwu sgwbox N3 2.0.25. This impacts an unknown function of the file /usr/sbin/http_eshell_server of the component NETREBOOT Interface. Such manipulation leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14706"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.336423"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.336423"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.706975"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.notion.so/sgwbox-NAS-N3-Command-Injection-2be6cf4e528a807cb619f9d2e1bcda20?source=copy_link"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "HIGH",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-15T06:15:42Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-f6cr-5vcg-p3cg/GHSA-f6cr-5vcg-p3cg.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f6cr-5vcg-p3cg",
4+
"modified": "2025-12-15T06:31:16Z",
5+
"published": "2025-12-15T06:31:16Z",
6+
"aliases": [
7+
"CVE-2025-11363"
8+
],
9+
"details": "The Royal Addons for Elementor WordPress plugin before 1.7.1037 does not have proper authorisation, allowing unauthenticated users to upload media files via the wpr_addons_upload_file action.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11363"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/b2eadb7a-30a4-44c7-a420-849484faccf4"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-12-15T06:15:42Z"
28+
}
29+
}

‎advisories/unreviewed/2025/12/GHSA-jpjm-2g38-x396/GHSA-jpjm-2g38-x396.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jpjm-2g38-x396",
4+
"modified": "2025-12-15T06:31:16Z",
5+
"published": "2025-12-15T06:31:16Z",
6+
"aliases": [
7+
"CVE-2025-14712"
8+
],
9+
"details": "Student Learning Assessment and Support System developed by JHENG GAO has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to view a specific page and obtain test accounts and password.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14712"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.twcert.org.tw/en/cp-139-10571-a0c2a-2.html"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.twcert.org.tw/tw/cp-132-10570-72e31-1.html"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-497"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-15T06:15:43Z"
43+
}
44+
}

‎advisories/unreviewed/2025/12/GHSA-p76h-gwg5-j85j/GHSA-p76h-gwg5-j85j.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p76h-gwg5-j85j",
4+
"modified": "2025-12-15T06:31:16Z",
5+
"published": "2025-12-15T06:31:16Z",
6+
"aliases": [
7+
"CVE-2025-14705"
8+
],
9+
"details": "A vulnerability was determined in Shiguangwu sgwbox N3 2.0.25. This affects an unknown function of the component SHARESERVER Feature. This manipulation of the argument params causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14705"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.336422"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.336422"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.706974"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.notion.so/sgwbox-NAS-N3-Command-Injection-2be6cf4e528a80d69da5d6d17456a183?source=copy_link"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "HIGH",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-15T05:15:51Z"
51+
}
52+
}

0 commit comments

Comments
 (0)