diff --git a/advisories/unreviewed/2025/04/GHSA-2jpw-g3p8-3vqg/GHSA-2jpw-g3p8-3vqg.json b/advisories/unreviewed/2025/04/GHSA-2jpw-g3p8-3vqg/GHSA-2jpw-g3p8-3vqg.json new file mode 100644 index 00000000000..1c6e0bff658 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-2jpw-g3p8-3vqg/GHSA-2jpw-g3p8-3vqg.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2jpw-g3p8-3vqg", + "modified": "2025-04-19T21:30:27Z", + "published": "2025-04-19T21:30:27Z", + "aliases": [ + "CVE-2025-3817" + ], + "details": "A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the file /oews/classes/Master.php?f=delete_stock. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3817" + }, + { + "type": "WEB", + "url": "https://github.com/88hsb88/cve/blob/main/sql.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.305723" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.305723" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.555607" + }, + { + "type": "WEB", + "url": "https://www.sourcecodester.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-19T19:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-8j5h-cxpp-7g62/GHSA-8j5h-cxpp-7g62.json b/advisories/unreviewed/2025/04/GHSA-8j5h-cxpp-7g62/GHSA-8j5h-cxpp-7g62.json new file mode 100644 index 00000000000..0a165e68f9f --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-8j5h-cxpp-7g62/GHSA-8j5h-cxpp-7g62.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8j5h-cxpp-7g62", + "modified": "2025-04-19T21:30:28Z", + "published": "2025-04-19T21:30:28Z", + "aliases": [ + "CVE-2022-47112" + ], + "details": "7-Zip through 24.09 does not report an error for certain invalid xz files, involving stream flags and reserved bits.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47112" + }, + { + "type": "WEB", + "url": "https://github.com/boofish/semantic-bugs" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-754" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-19T21:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-8m5h-w7m5-3jm3/GHSA-8m5h-w7m5-3jm3.json b/advisories/unreviewed/2025/04/GHSA-8m5h-w7m5-3jm3/GHSA-8m5h-w7m5-3jm3.json new file mode 100644 index 00000000000..13d1d518249 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-8m5h-w7m5-3jm3/GHSA-8m5h-w7m5-3jm3.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8m5h-w7m5-3jm3", + "modified": "2025-04-19T21:30:27Z", + "published": "2025-04-19T21:30:27Z", + "aliases": [ + "CVE-2025-43917" + ], + "details": "In Pritunl Client before 1.3.4220.57, an administrator with access to /Applications can escalate privileges after uninstalling the product. Specifically, an administrator can insert a new file at the pathname of the removed pritunl-service file. This file then is executed by a LaunchDaemon as root.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43917" + }, + { + "type": "WEB", + "url": "https://forum.pritunl.com/t/pritunl-client-v1-3-4220-57/3183" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-19T19:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-9g47-36rw-gjh2/GHSA-9g47-36rw-gjh2.json b/advisories/unreviewed/2025/04/GHSA-9g47-36rw-gjh2/GHSA-9g47-36rw-gjh2.json new file mode 100644 index 00000000000..1af4c8c9388 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-9g47-36rw-gjh2/GHSA-9g47-36rw-gjh2.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9g47-36rw-gjh2", + "modified": "2025-04-19T21:30:28Z", + "published": "2025-04-19T21:30:27Z", + "aliases": [ + "CVE-2025-3818" + ], + "details": "A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB._process_insert_query of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3818" + }, + { + "type": "WEB", + "url": "https://noppgwz8if.feishu.cn/docx/TxjpddUpTokyBwxibSgcTRr7nUf" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.305724" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.305724" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.555649" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-19T20:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-f2q2-pv27-hgjf/GHSA-f2q2-pv27-hgjf.json b/advisories/unreviewed/2025/04/GHSA-f2q2-pv27-hgjf/GHSA-f2q2-pv27-hgjf.json new file mode 100644 index 00000000000..189b72b526d --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-f2q2-pv27-hgjf/GHSA-f2q2-pv27-hgjf.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f2q2-pv27-hgjf", + "modified": "2025-04-19T21:30:28Z", + "published": "2025-04-19T21:30:27Z", + "aliases": [ + "CVE-2022-47111" + ], + "details": "7-Zip through 24.09 does not report an error for certain invalid xz files, involving block flags and reserved bits.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47111" + }, + { + "type": "WEB", + "url": "https://github.com/boofish/semantic-bugs" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-754" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-19T21:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-f9cw-7mcv-gq63/GHSA-f9cw-7mcv-gq63.json b/advisories/unreviewed/2025/04/GHSA-f9cw-7mcv-gq63/GHSA-f9cw-7mcv-gq63.json new file mode 100644 index 00000000000..4a33b4aac40 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-f9cw-7mcv-gq63/GHSA-f9cw-7mcv-gq63.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f9cw-7mcv-gq63", + "modified": "2025-04-19T21:30:28Z", + "published": "2025-04-19T21:30:28Z", + "aliases": [ + "CVE-2025-3820" + ], + "details": "A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644) and classified as critical. Affected by this issue is the function cgiSysUplinkCheckSet of the file /bin/httpd. The manipulation of the argument hostIp1/hostIp2 leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3820" + }, + { + "type": "WEB", + "url": "https://github.com/02Tn/vul/issues/4" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.305726" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.305726" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.555728" + }, + { + "type": "WEB", + "url": "https://www.tenda.com.cn" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-19T21:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-rgpp-94g2-9xpm/GHSA-rgpp-94g2-9xpm.json b/advisories/unreviewed/2025/04/GHSA-rgpp-94g2-9xpm/GHSA-rgpp-94g2-9xpm.json new file mode 100644 index 00000000000..fb3b1997008 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-rgpp-94g2-9xpm/GHSA-rgpp-94g2-9xpm.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rgpp-94g2-9xpm", + "modified": "2025-04-19T21:30:28Z", + "published": "2025-04-19T21:30:27Z", + "aliases": [ + "CVE-2025-3819" + ], + "details": "A vulnerability has been found in PHPGurukul Men Salon Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/search-appointment.php. The manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3819" + }, + { + "type": "WEB", + "url": "https://github.com/wcndy13/cve/issues/1" + }, + { + "type": "WEB", + "url": "https://phpgurukul.com" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.305725" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.305725" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.555687" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-19T20:15:15Z" + } +} \ No newline at end of file