diff --git a/advisories/unreviewed/2025/05/GHSA-5xxh-9www-w7ph/GHSA-5xxh-9www-w7ph.json b/advisories/unreviewed/2025/05/GHSA-5xxh-9www-w7ph/GHSA-5xxh-9www-w7ph.json new file mode 100644 index 00000000000..2bde245e053 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-5xxh-9www-w7ph/GHSA-5xxh-9www-w7ph.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5xxh-9www-w7ph", + "modified": "2025-05-04T09:30:32Z", + "published": "2025-05-04T09:30:32Z", + "aliases": [ + "CVE-2025-4249" + ], + "details": "A vulnerability was found in PHPGurukul e-Diary Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /manage-categories.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4249" + }, + { + "type": "WEB", + "url": "https://github.com/MichaelZhuang521/curly-memory/issues/1" + }, + { + "type": "WEB", + "url": "https://phpgurukul.com" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.307346" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.307346" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.562836" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-04T07:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-v6cp-qj97-x87h/GHSA-v6cp-qj97-x87h.json b/advisories/unreviewed/2025/05/GHSA-v6cp-qj97-x87h/GHSA-v6cp-qj97-x87h.json new file mode 100644 index 00000000000..ade80c83db4 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-v6cp-qj97-x87h/GHSA-v6cp-qj97-x87h.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v6cp-qj97-x87h", + "modified": "2025-05-04T09:30:33Z", + "published": "2025-05-04T09:30:33Z", + "aliases": [ + "CVE-2025-4250" + ], + "details": "A vulnerability was found in code-projects Nero Social Networking Site 1.0. It has been classified as critical. This affects an unknown part of the file /index.php. The manipulation of the argument fname/lname/login/password2/cpassword/address/cnumber/email/gender/propic/month leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4250" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://github.com/zzZxby/Vulnerability-Exploration/blob/main/Nero%20Social%20Networking%20Site/Nero_Social_Networking_Site.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.307347" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.307347" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.562906" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-04T09:17:08Z" + } +} \ No newline at end of file