Skip to content

Commit f16f96d

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-vvf4-c8p4-89v5 GHSA-26xf-664m-jmwq GHSA-45f2-8284-5w23 GHSA-886p-82g3-p77g GHSA-f832-268f-jpxx
1 parent 292303a commit f16f96d

File tree

5 files changed

+172
-2
lines changed

5 files changed

+172
-2
lines changed

‎advisories/unreviewed/2022/05/GHSA-vvf4-c8p4-89v5/GHSA-vvf4-c8p4-89v5.json‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-vvf4-c8p4-89v5",
4-
"modified": "2022-10-27T19:00:40Z",
4+
"modified": "2025-12-03T03:31:20Z",
55
"published": "2022-05-24T17:47:02Z",
66
"aliases": [
77
"CVE-2021-3448"
@@ -23,6 +23,18 @@
2323
"type": "WEB",
2424
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939368"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVTJUOFFFHINLKWAOC2ZSC5MOPD4SJ24"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHG7GWSQWKF7JXIMLOGJBKZWBB4VIAJ7"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GHURNEHHUBSW45KMIZ4FNBCSUPWPGV5V"
37+
},
2638
{
2739
"type": "WEB",
2840
"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/CVTJUOFFFHINLKWAOC2ZSC5MOPD4SJ24"

‎advisories/unreviewed/2025/12/GHSA-26xf-664m-jmwq/GHSA-26xf-664m-jmwq.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-26xf-664m-jmwq",
4+
"modified": "2025-12-03T03:31:20Z",
5+
"published": "2025-12-03T03:31:20Z",
6+
"aliases": [
7+
"CVE-2025-13448"
8+
],
9+
"details": "The CSSIgniter Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'element' shortcode attribute in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13448"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/cssigniter-shortcodes/tags/2.4.1/ci-shortcodes.php#L117"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/cssigniter-shortcodes/trunk/ci-shortcodes.php#L117"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3408092%40cssigniter-shortcodes&new=3408092%40cssigniter-shortcodes&sfp_email=&sfph_mail="
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/288419ad-fbb2-4a4a-8a40-89ae024e068d?source=cve"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-79"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-12-03T03:15:58Z"
47+
}
48+
}

‎advisories/unreviewed/2025/12/GHSA-45f2-8284-5w23/GHSA-45f2-8284-5w23.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-45f2-8284-5w23",
4+
"modified": "2025-12-03T03:31:20Z",
5+
"published": "2025-12-03T03:31:20Z",
6+
"aliases": [
7+
"CVE-2025-13646"
8+
],
9+
"details": "The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files with race condition on the affected site's server which may make remote code execution possible.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13646"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/WPChill/modula-lite/commit/90c8eb982f71b31584d9be9359e3b594e03927d7"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/WPChill/modula-lite/blob/master/includes/admin/class-modula-gallery-upload.php#L1103"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/changeset/3395701/modula-best-grid-gallery#file5"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/changeset/3407949/modula-best-grid-gallery"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/59ee0ca2-846d-4ae8-ad19-7c3826861aeb?source=cve"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-434"
46+
],
47+
"severity": "HIGH",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-03T03:16:00Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-886p-82g3-p77g/GHSA-886p-82g3-p77g.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,9 @@
2929
}
3030
],
3131
"database_specific": {
32-
"cwe_ids": [],
32+
"cwe_ids": [
33+
"CWE-834"
34+
],
3335
"severity": "MODERATE",
3436
"github_reviewed": false,
3537
"github_reviewed_at": null,

‎advisories/unreviewed/2025/12/GHSA-f832-268f-jpxx/GHSA-f832-268f-jpxx.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f832-268f-jpxx",
4+
"modified": "2025-12-03T03:31:20Z",
5+
"published": "2025-12-03T03:31:20Z",
6+
"aliases": [
7+
"CVE-2025-13645"
8+
],
9+
"details": "The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13645"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/WPChill/modula-lite/commit/90c8eb982f71b31584d9be9359e3b594e03927d7"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.13.2/includes/admin/class-modula-gallery-upload.php#L1025"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.13.2/includes/admin/class-modula-gallery-upload.php#L1119"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/changeset/3395701/modula-best-grid-gallery#file5"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://plugins.trac.wordpress.org/changeset/3407949/modula-best-grid-gallery"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/080683bb-713f-4aa8-b635-90c96f358bec?source=cve"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-22"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-03T03:15:59Z"
55+
}
56+
}

0 commit comments

Comments
 (0)