Skip to content

Commit ea85793

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-88w2-6722-q9jg GHSA-hfpp-2q66-88fj GHSA-j2f8-96fc-682m
1 parent ad067c6 commit ea85793

File tree

3 files changed

+156
-0
lines changed

3 files changed

+156
-0
lines changed

‎advisories/unreviewed/2025/11/GHSA-88w2-6722-q9jg/GHSA-88w2-6722-q9jg.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-88w2-6722-q9jg",
4+
"modified": "2025-11-09T00:30:26Z",
5+
"published": "2025-11-09T00:30:26Z",
6+
"aliases": [
7+
"CVE-2025-12914"
8+
],
9+
"details": "A vulnerability has been found in aaPanel BaoTa up to 11.1.0. This vulnerability affects unknown code of the file /database?action=GetDatabaseAccess of the component Backend. The manipulation of the argument Name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12914"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/coolcj-stack/BaoTa-Panel-Backstage-SQL-injection-vulnerability/blob/main/README.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.331632"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.331632"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.678237"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-11-08T22:15:41Z"
51+
}
52+
}

‎advisories/unreviewed/2025/11/GHSA-hfpp-2q66-88fj/GHSA-hfpp-2q66-88fj.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hfpp-2q66-88fj",
4+
"modified": "2025-11-09T00:30:26Z",
5+
"published": "2025-11-09T00:30:26Z",
6+
"aliases": [
7+
"CVE-2025-12915"
8+
],
9+
"details": "A vulnerability was found in 70mai X200 up to 20251019. This issue affects some unknown processing of the component Init Script Handler. The manipulation results in file inclusion. The attack requires a local approach. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12915"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/geo-chen/70mai/blob/main/README.md#finding-11-init-script-binary-hijack-persistence-vulnerability-in-70mai-x200-omni-dashcam"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.331633"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.331633"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.678285"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-73"
46+
],
47+
"severity": "HIGH",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-11-08T23:15:48Z"
51+
}
52+
}

‎advisories/unreviewed/2025/11/GHSA-j2f8-96fc-682m/GHSA-j2f8-96fc-682m.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j2f8-96fc-682m",
4+
"modified": "2025-11-09T00:30:26Z",
5+
"published": "2025-11-09T00:30:26Z",
6+
"aliases": [
7+
"CVE-2025-12916"
8+
],
9+
"details": "A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portal_login of the component Frontend. This manipulation of the argument loginUrl causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.0.11 and 3.0.12 is recommended to address this issue. It is advisable to upgrade the affected component.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12916"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://h4cker.zip/post/fe0ada"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.331634"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.331634"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.678377"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-11-09T00:15:40Z"
51+
}
52+
}

0 commit comments

Comments
 (0)