Skip to content

Commit de0920f

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 329fe19 commit de0920f

File tree

48 files changed

+1510
-44
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+1510
-44
lines changed

‎advisories/unreviewed/2025/10/GHSA-gppq-jw9r-4v4j/GHSA-gppq-jw9r-4v4j.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-gppq-jw9r-4v4j",
4-
"modified": "2025-10-23T12:31:16Z",
4+
"modified": "2025-12-12T00:30:19Z",
55
"published": "2025-10-23T12:31:16Z",
66
"aliases": [
77
"CVE-2025-12105"
@@ -19,6 +19,10 @@
1919
"type": "ADVISORY",
2020
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12105"
2121
},
22+
{
23+
"type": "WEB",
24+
"url": "https://access.redhat.com/errata/RHSA-2025:23139"
25+
},
2226
{
2327
"type": "WEB",
2428
"url": "https://access.redhat.com/security/cve/CVE-2025-12105"

‎advisories/unreviewed/2025/11/GHSA-fqq7-h225-8w6h/GHSA-fqq7-h225-8w6h.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@
4646
],
4747
"database_specific": {
4848
"cwe_ids": [
49+
"CWE-639",
4950
"CWE-99"
5051
],
5152
"severity": "LOW",

‎advisories/unreviewed/2025/11/GHSA-jpj2-v98q-h9vj/GHSA-jpj2-v98q-h9vj.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@
4646
],
4747
"database_specific": {
4848
"cwe_ids": [
49-
"CWE-74"
49+
"CWE-74",
50+
"CWE-89"
5051
],
5152
"severity": "MODERATE",
5253
"github_reviewed": false,

‎advisories/unreviewed/2025/11/GHSA-jwf9-8pmx-vhcx/GHSA-jwf9-8pmx-vhcx.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,8 @@
5050
],
5151
"database_specific": {
5252
"cwe_ids": [
53-
"CWE-74"
53+
"CWE-74",
54+
"CWE-89"
5455
],
5556
"severity": "MODERATE",
5657
"github_reviewed": false,

‎advisories/unreviewed/2025/11/GHSA-pvg7-jq3v-hmq6/GHSA-pvg7-jq3v-hmq6.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@
4646
],
4747
"database_specific": {
4848
"cwe_ids": [
49-
"CWE-74"
49+
"CWE-74",
50+
"CWE-94"
5051
],
5152
"severity": "MODERATE",
5253
"github_reviewed": false,

‎advisories/unreviewed/2025/12/GHSA-2g4c-4qm2-q7cv/GHSA-2g4c-4qm2-q7cv.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2g4c-4qm2-q7cv",
4+
"modified": "2025-12-12T00:30:21Z",
5+
"published": "2025-12-12T00:30:20Z",
6+
"aliases": [
7+
"CVE-2024-58301"
8+
],
9+
"details": "Purei CMS 1.0 contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queries through unfiltered user input parameters. Attackers can exploit vulnerable endpoints like getAllParks.php and events-ajax.php by injecting crafted SQL payloads to potentially extract or modify database information.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58301"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://purei.com"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.exploit-db.com/exploits/51929"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/purei-cms-sql-injection-via-multiple-vulnerable-endpoints"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-89"
38+
],
39+
"severity": "CRITICAL",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-11T22:15:51Z"
43+
}
44+
}

‎advisories/unreviewed/2025/12/GHSA-2h7r-4859-wjp6/GHSA-2h7r-4859-wjp6.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2h7r-4859-wjp6",
4-
"modified": "2025-12-11T21:31:33Z",
4+
"modified": "2025-12-12T00:30:20Z",
55
"published": "2025-12-11T21:31:33Z",
66
"aliases": [
77
"CVE-2025-36929"
88
],
99
"details": "In AreFencesRegistered of gxp_fence_manager.cc, there is a possible information leak due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -20,8 +25,10 @@
2025
}
2126
],
2227
"database_specific": {
23-
"cwe_ids": [],
24-
"severity": null,
28+
"cwe_ids": [
29+
"CWE-20"
30+
],
31+
"severity": "MODERATE",
2532
"github_reviewed": false,
2633
"github_reviewed_at": null,
2734
"nvd_published_at": "2025-12-11T20:15:57Z"

‎advisories/unreviewed/2025/12/GHSA-36pw-gpfg-hfxr/GHSA-36pw-gpfg-hfxr.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-36pw-gpfg-hfxr",
4+
"modified": "2025-12-12T00:30:21Z",
5+
"published": "2025-12-12T00:30:21Z",
6+
"aliases": [
7+
"CVE-2024-58309"
8+
],
9+
"details": "xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL code through the msgid parameter. Attackers can send crafted requests to /shoutedit.php with EXTRACTVALUE functions to extract database names, user credentials, and password hashes from the underlying database.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58309"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.exploit-db.com/exploits/51909"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.vulncheck.com/advisories/xbtitfm-unauthenticated-sql-injection-in-shouteditphp"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://xbtitfm.eu"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-89"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-11T22:15:52Z"
43+
}
44+
}

‎advisories/unreviewed/2025/12/GHSA-3f55-6gfh-8xfx/GHSA-3f55-6gfh-8xfx.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3f55-6gfh-8xfx",
4+
"modified": "2025-12-12T00:30:20Z",
5+
"published": "2025-12-12T00:30:20Z",
6+
"aliases": [
7+
"CVE-2024-58294"
8+
],
9+
"details": "FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbitrary commands. Attackers can exploit the 'generatedocs' endpoint by crafting malicious POST requests with bash command injection to establish remote shell access.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58294"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.exploit-db.com/exploits/52031"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.freepbx.org"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/freepbx-authenticated-remote-code-execution-via-api-module"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.youtube.com/watch?v=rqFJ0BxwlLI"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-78"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-12-11T22:15:50Z"
47+
}
48+
}

‎advisories/unreviewed/2025/12/GHSA-3m3j-jxfh-jw6m/GHSA-3m3j-jxfh-jw6m.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3m3j-jxfh-jw6m",
4+
"modified": "2025-12-12T00:30:20Z",
5+
"published": "2025-12-12T00:30:20Z",
6+
"aliases": [
7+
"CVE-2024-58286"
8+
],
9+
"details": "dizqueTV 1.5.3 contains a remote code execution vulnerability that allows attackers to inject arbitrary commands through the FFMPEG Executable Path settings. Attackers can modify the executable path with shell commands to read system files like /etc/passwd by exploiting improper input validation.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58286"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/vexorian/dizquetv"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.exploit-db.com/exploits/52079"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/dizquetv-remote-code-execution-via-ffmpeg-executable-path"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-78"
38+
],
39+
"severity": "CRITICAL",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-11T22:15:48Z"
43+
}
44+
}

0 commit comments

Comments
 (0)