From 0406a7cd17c6ad3bf2a8d170c86332de7644a323 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 3 Apr 2025 12:32:19 +0000
Subject: [PATCH] Publish Advisories

GHSA-ph76-mqg3-44g8
GHSA-q3rr-g46f-jgqr
GHSA-mchq-vv84-m9gr
GHSA-w67q-cmfr-rmhr
---
 .../GHSA-ph76-mqg3-44g8.json                  |  1 +
 .../GHSA-q3rr-g46f-jgqr.json                  |  6 ++-
 .../GHSA-mchq-vv84-m9gr.json                  |  6 ++-
 .../GHSA-w67q-cmfr-rmhr.json                  | 48 +++++++++++++++++++
 4 files changed, 59 insertions(+), 2 deletions(-)
 create mode 100644 advisories/unreviewed/2025/04/GHSA-w67q-cmfr-rmhr/GHSA-w67q-cmfr-rmhr.json

diff --git a/advisories/unreviewed/2024/10/GHSA-ph76-mqg3-44g8/GHSA-ph76-mqg3-44g8.json b/advisories/unreviewed/2024/10/GHSA-ph76-mqg3-44g8/GHSA-ph76-mqg3-44g8.json
index 86deb869b71..5e84ad95a0b 100644
--- a/advisories/unreviewed/2024/10/GHSA-ph76-mqg3-44g8/GHSA-ph76-mqg3-44g8.json
+++ b/advisories/unreviewed/2024/10/GHSA-ph76-mqg3-44g8/GHSA-ph76-mqg3-44g8.json
@@ -46,6 +46,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
+      "CWE-119",
       "CWE-120"
     ],
     "severity": "MODERATE",
diff --git a/advisories/unreviewed/2025/02/GHSA-q3rr-g46f-jgqr/GHSA-q3rr-g46f-jgqr.json b/advisories/unreviewed/2025/02/GHSA-q3rr-g46f-jgqr/GHSA-q3rr-g46f-jgqr.json
index 4029b32e3e6..91e589503df 100644
--- a/advisories/unreviewed/2025/02/GHSA-q3rr-g46f-jgqr/GHSA-q3rr-g46f-jgqr.json
+++ b/advisories/unreviewed/2025/02/GHSA-q3rr-g46f-jgqr/GHSA-q3rr-g46f-jgqr.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-q3rr-g46f-jgqr",
-  "modified": "2025-04-03T04:41:18Z",
+  "modified": "2025-04-03T12:30:24Z",
   "published": "2025-02-19T21:31:38Z",
   "aliases": [
     "CVE-2025-0624"
@@ -51,6 +51,10 @@
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2025:2869"
     },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2025:3297"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2025:3301"
diff --git a/advisories/unreviewed/2025/03/GHSA-mchq-vv84-m9gr/GHSA-mchq-vv84-m9gr.json b/advisories/unreviewed/2025/03/GHSA-mchq-vv84-m9gr/GHSA-mchq-vv84-m9gr.json
index 37b7a381546..2d5f60c4fe9 100644
--- a/advisories/unreviewed/2025/03/GHSA-mchq-vv84-m9gr/GHSA-mchq-vv84-m9gr.json
+++ b/advisories/unreviewed/2025/03/GHSA-mchq-vv84-m9gr/GHSA-mchq-vv84-m9gr.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-mchq-vv84-m9gr",
-  "modified": "2025-03-28T03:30:24Z",
+  "modified": "2025-04-03T12:30:24Z",
   "published": "2025-03-21T18:31:35Z",
   "aliases": [
     "CVE-2025-30349"
@@ -43,6 +43,10 @@
       "type": "WEB",
       "url": "https://github.com/natasaka/CVE-2025-30349"
     },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00008.html"
+    },
     {
       "type": "WEB",
       "url": "https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html"
diff --git a/advisories/unreviewed/2025/04/GHSA-w67q-cmfr-rmhr/GHSA-w67q-cmfr-rmhr.json b/advisories/unreviewed/2025/04/GHSA-w67q-cmfr-rmhr/GHSA-w67q-cmfr-rmhr.json
new file mode 100644
index 00000000000..3165e97469f
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-w67q-cmfr-rmhr/GHSA-w67q-cmfr-rmhr.json
@@ -0,0 +1,48 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-w67q-cmfr-rmhr",
+  "modified": "2025-04-03T12:30:24Z",
+  "published": "2025-04-03T12:30:24Z",
+  "aliases": [
+    "CVE-2025-2299"
+  ],
+  "details": "The LuckyWP Table of Contents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.10. This is due to missing or incorrect nonce validation on the 'ajaxEdit' function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2299"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/luckywp-table-of-contents/trunk/admin/controllers/EditorBlockController.php#L30"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/luckywp-table-of-contents/trunk/admin/widgets/customizeSuccess/views/widget.php#L12"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset/3265169"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/82df5b2e-4c4a-402f-99c9-694fa710009b?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-03T12:15:14Z"
+  }
+}
\ No newline at end of file