From 478bfb5fed69cb2d037a41693647d31d677fb865 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 30 Jan 2025 12:32:51 +0000
Subject: [PATCH] Publish Advisories

GHSA-rjx7-v6g9-8g3m
GHSA-26wm-7r96-7phx
GHSA-2ch8-gj76-vc82
GHSA-2mqw-xvh5-rv38
GHSA-2p76-x4wh-x3c6
GHSA-3qjq-8563-xqpx
GHSA-3vmp-5673-67p4
GHSA-4jv8-7mvw-g797
GHSA-53gc-fm45-xq5f
GHSA-54x3-pqpj-qp4h
GHSA-82gc-5r4p-79v3
GHSA-9w74-59mf-vjxv
GHSA-ff3c-r3wv-56wm
GHSA-hw45-5mv8-6p87
GHSA-jh7c-9hmh-jxw3
GHSA-jx6c-jcmp-rgvp
GHSA-vf69-hcwp-rxc8
GHSA-vwj2-w4fq-pg78
GHSA-wq6j-h853-fwf7
---
 .../GHSA-rjx7-v6g9-8g3m.json                  |  7 ++-
 .../GHSA-26wm-7r96-7phx.json                  | 36 +++++++++++++++
 .../GHSA-2ch8-gj76-vc82.json                  | 40 +++++++++++++++++
 .../GHSA-2mqw-xvh5-rv38.json                  | 36 +++++++++++++++
 .../GHSA-2p76-x4wh-x3c6.json                  | 36 +++++++++++++++
 .../GHSA-3qjq-8563-xqpx.json                  | 36 +++++++++++++++
 .../GHSA-3vmp-5673-67p4.json                  | 36 +++++++++++++++
 .../GHSA-4jv8-7mvw-g797.json                  | 36 +++++++++++++++
 .../GHSA-53gc-fm45-xq5f.json                  | 40 +++++++++++++++++
 .../GHSA-54x3-pqpj-qp4h.json                  | 36 +++++++++++++++
 .../GHSA-82gc-5r4p-79v3.json                  | 44 +++++++++++++++++++
 .../GHSA-9w74-59mf-vjxv.json                  | 44 +++++++++++++++++++
 .../GHSA-ff3c-r3wv-56wm.json                  | 31 +++++++++++++
 .../GHSA-hw45-5mv8-6p87.json                  | 40 +++++++++++++++++
 .../GHSA-jh7c-9hmh-jxw3.json                  | 44 +++++++++++++++++++
 .../GHSA-jx6c-jcmp-rgvp.json                  | 36 +++++++++++++++
 .../GHSA-vf69-hcwp-rxc8.json                  | 36 +++++++++++++++
 .../GHSA-vwj2-w4fq-pg78.json                  | 36 +++++++++++++++
 .../GHSA-wq6j-h853-fwf7.json                  | 36 +++++++++++++++
 19 files changed, 685 insertions(+), 1 deletion(-)
 create mode 100644 advisories/unreviewed/2025/01/GHSA-26wm-7r96-7phx/GHSA-26wm-7r96-7phx.json
 create mode 100644 advisories/unreviewed/2025/01/GHSA-2ch8-gj76-vc82/GHSA-2ch8-gj76-vc82.json
 create mode 100644 advisories/unreviewed/2025/01/GHSA-2mqw-xvh5-rv38/GHSA-2mqw-xvh5-rv38.json
 create mode 100644 advisories/unreviewed/2025/01/GHSA-2p76-x4wh-x3c6/GHSA-2p76-x4wh-x3c6.json
 create mode 100644 advisories/unreviewed/2025/01/GHSA-3qjq-8563-xqpx/GHSA-3qjq-8563-xqpx.json
 create mode 100644 advisories/unreviewed/2025/01/GHSA-3vmp-5673-67p4/GHSA-3vmp-5673-67p4.json
 create mode 100644 advisories/unreviewed/2025/01/GHSA-4jv8-7mvw-g797/GHSA-4jv8-7mvw-g797.json
 create mode 100644 advisories/unreviewed/2025/01/GHSA-53gc-fm45-xq5f/GHSA-53gc-fm45-xq5f.json
 create mode 100644 advisories/unreviewed/2025/01/GHSA-54x3-pqpj-qp4h/GHSA-54x3-pqpj-qp4h.json
 create mode 100644 advisories/unreviewed/2025/01/GHSA-82gc-5r4p-79v3/GHSA-82gc-5r4p-79v3.json
 create mode 100644 advisories/unreviewed/2025/01/GHSA-9w74-59mf-vjxv/GHSA-9w74-59mf-vjxv.json
 create mode 100644 advisories/unreviewed/2025/01/GHSA-ff3c-r3wv-56wm/GHSA-ff3c-r3wv-56wm.json
 create mode 100644 advisories/unreviewed/2025/01/GHSA-hw45-5mv8-6p87/GHSA-hw45-5mv8-6p87.json
 create mode 100644 advisories/unreviewed/2025/01/GHSA-jh7c-9hmh-jxw3/GHSA-jh7c-9hmh-jxw3.json
 create mode 100644 advisories/unreviewed/2025/01/GHSA-jx6c-jcmp-rgvp/GHSA-jx6c-jcmp-rgvp.json
 create mode 100644 advisories/unreviewed/2025/01/GHSA-vf69-hcwp-rxc8/GHSA-vf69-hcwp-rxc8.json
 create mode 100644 advisories/unreviewed/2025/01/GHSA-vwj2-w4fq-pg78/GHSA-vwj2-w4fq-pg78.json
 create mode 100644 advisories/unreviewed/2025/01/GHSA-wq6j-h853-fwf7/GHSA-wq6j-h853-fwf7.json

diff --git a/advisories/unreviewed/2024/03/GHSA-rjx7-v6g9-8g3m/GHSA-rjx7-v6g9-8g3m.json b/advisories/unreviewed/2024/03/GHSA-rjx7-v6g9-8g3m/GHSA-rjx7-v6g9-8g3m.json
index a28fb8d9b77..669b1d84c6b 100644
--- a/advisories/unreviewed/2024/03/GHSA-rjx7-v6g9-8g3m/GHSA-rjx7-v6g9-8g3m.json
+++ b/advisories/unreviewed/2024/03/GHSA-rjx7-v6g9-8g3m/GHSA-rjx7-v6g9-8g3m.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-rjx7-v6g9-8g3m",
-  "modified": "2024-03-12T09:30:42Z",
+  "modified": "2025-01-30T12:31:17Z",
   "published": "2024-03-12T09:30:42Z",
   "aliases": [
     "CVE-2024-25995"
@@ -22,10 +22,15 @@
     {
       "type": "WEB",
       "url": "https://cert.vde.com/en/advisories/VDE-2024-011"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-856"
     }
   ],
   "database_specific": {
     "cwe_ids": [
+      "CWE-20",
       "CWE-306"
     ],
     "severity": "CRITICAL",
diff --git a/advisories/unreviewed/2025/01/GHSA-26wm-7r96-7phx/GHSA-26wm-7r96-7phx.json b/advisories/unreviewed/2025/01/GHSA-26wm-7r96-7phx/GHSA-26wm-7r96-7phx.json
new file mode 100644
index 00000000000..80cbc95d422
--- /dev/null
+++ b/advisories/unreviewed/2025/01/GHSA-26wm-7r96-7phx/GHSA-26wm-7r96-7phx.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-26wm-7r96-7phx",
+  "modified": "2025-01-30T12:31:20Z",
+  "published": "2025-01-30T12:31:19Z",
+  "aliases": [
+    "CVE-2025-0744"
+  ],
+  "details": "an Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker change his subscription plan without paying by making a POST request changing the parameters of the \"/demos/embedai/pmt_cash_on_delivery/pay\" endpoint.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0744"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-284"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T12:15:27Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/01/GHSA-2ch8-gj76-vc82/GHSA-2ch8-gj76-vc82.json b/advisories/unreviewed/2025/01/GHSA-2ch8-gj76-vc82/GHSA-2ch8-gj76-vc82.json
new file mode 100644
index 00000000000..f5e0ebc3c05
--- /dev/null
+++ b/advisories/unreviewed/2025/01/GHSA-2ch8-gj76-vc82/GHSA-2ch8-gj76-vc82.json
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2ch8-gj76-vc82",
+  "modified": "2025-01-30T12:31:17Z",
+  "published": "2025-01-30T12:31:17Z",
+  "aliases": [
+    "CVE-2025-0861"
+  ],
+  "details": "The VR-Frases (collect & share quotes) plugin for WordPress is vulnerable to SQL Injection via several parameters in all versions up to, and including, 3.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0861"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.svn.wordpress.org/vr-frases/tags/3.0.1/includes/vr-frases-admin.php"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1d9d5afb-d38d-442c-8511-f1683739a1da?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T10:15:08Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/01/GHSA-2mqw-xvh5-rv38/GHSA-2mqw-xvh5-rv38.json b/advisories/unreviewed/2025/01/GHSA-2mqw-xvh5-rv38/GHSA-2mqw-xvh5-rv38.json
new file mode 100644
index 00000000000..4f3f3805cc5
--- /dev/null
+++ b/advisories/unreviewed/2025/01/GHSA-2mqw-xvh5-rv38/GHSA-2mqw-xvh5-rv38.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2mqw-xvh5-rv38",
+  "modified": "2025-01-30T12:31:19Z",
+  "published": "2025-01-30T12:31:19Z",
+  "aliases": [
+    "CVE-2025-0741"
+  ],
+  "details": "An Improper Access Control vulnerability has been found in EmbedAI\n\n 2.1 and below. This vulnerability allows an authenticated attacker to write messages into other users chat by changing the parameter \"chat_id\" of the POST request \"/embedai/chats/send_message\".",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0741"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-284"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T11:15:11Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/01/GHSA-2p76-x4wh-x3c6/GHSA-2p76-x4wh-x3c6.json b/advisories/unreviewed/2025/01/GHSA-2p76-x4wh-x3c6/GHSA-2p76-x4wh-x3c6.json
new file mode 100644
index 00000000000..f9faa339194
--- /dev/null
+++ b/advisories/unreviewed/2025/01/GHSA-2p76-x4wh-x3c6/GHSA-2p76-x4wh-x3c6.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2p76-x4wh-x3c6",
+  "modified": "2025-01-30T12:31:20Z",
+  "published": "2025-01-30T12:31:20Z",
+  "aliases": [
+    "CVE-2025-0747"
+  ],
+  "details": "A Stored Cross-Site Scripting vulnerability has been found in EmbedAI. This vulnerability allows an authenticated attacker to inject a malicious JavaScript code into a message that will be executed when a user opens the chat.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0747"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T12:15:28Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/01/GHSA-3qjq-8563-xqpx/GHSA-3qjq-8563-xqpx.json b/advisories/unreviewed/2025/01/GHSA-3qjq-8563-xqpx/GHSA-3qjq-8563-xqpx.json
new file mode 100644
index 00000000000..1dbdb7fa234
--- /dev/null
+++ b/advisories/unreviewed/2025/01/GHSA-3qjq-8563-xqpx/GHSA-3qjq-8563-xqpx.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3qjq-8563-xqpx",
+  "modified": "2025-01-30T12:31:17Z",
+  "published": "2025-01-30T12:31:17Z",
+  "aliases": [
+    "CVE-2025-21107"
+  ],
+  "details": "Dell NetWorker, version(s) prior to 19.11.0.3, all versions of 19.10 & prior versions contain(s) an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21107"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.dell.com/support/kbdoc/en-us/000278811/dsa-2025-064-security-update-for-dell-networker-networker-virtual-edition-and-networker-management-console-multiple-component-vulnerabilities"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-428"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T10:15:09Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/01/GHSA-3vmp-5673-67p4/GHSA-3vmp-5673-67p4.json b/advisories/unreviewed/2025/01/GHSA-3vmp-5673-67p4/GHSA-3vmp-5673-67p4.json
new file mode 100644
index 00000000000..e322024d56d
--- /dev/null
+++ b/advisories/unreviewed/2025/01/GHSA-3vmp-5673-67p4/GHSA-3vmp-5673-67p4.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3vmp-5673-67p4",
+  "modified": "2025-01-30T12:31:19Z",
+  "published": "2025-01-30T12:31:19Z",
+  "aliases": [
+    "CVE-2022-43916"
+  ],
+  "details": "IBM App Connect Enterprise Certified Container 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4, 12.5, 12.6, and 12.7 Pods do not restrict network egress for Pods that are used for internal infrastructure.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43916"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.ibm.com/support/pages/node/7181916"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-923"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T12:15:26Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/01/GHSA-4jv8-7mvw-g797/GHSA-4jv8-7mvw-g797.json b/advisories/unreviewed/2025/01/GHSA-4jv8-7mvw-g797/GHSA-4jv8-7mvw-g797.json
new file mode 100644
index 00000000000..60d845b743f
--- /dev/null
+++ b/advisories/unreviewed/2025/01/GHSA-4jv8-7mvw-g797/GHSA-4jv8-7mvw-g797.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4jv8-7mvw-g797",
+  "modified": "2025-01-30T12:31:20Z",
+  "published": "2025-01-30T12:31:20Z",
+  "aliases": [
+    "CVE-2025-0746"
+  ],
+  "details": "A Reflected Cross-Site Scripting vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to craft a malicious URL leveraging the\"/embedai/users/show/<SCRIPT>\" endpoint to inject the malicious JavaScript code. This JavaScript code will be executed when a user opens the malicious URL.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0746"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T12:15:28Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/01/GHSA-53gc-fm45-xq5f/GHSA-53gc-fm45-xq5f.json b/advisories/unreviewed/2025/01/GHSA-53gc-fm45-xq5f/GHSA-53gc-fm45-xq5f.json
new file mode 100644
index 00000000000..64f7c3ffecb
--- /dev/null
+++ b/advisories/unreviewed/2025/01/GHSA-53gc-fm45-xq5f/GHSA-53gc-fm45-xq5f.json
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-53gc-fm45-xq5f",
+  "modified": "2025-01-30T12:31:19Z",
+  "published": "2025-01-30T12:31:18Z",
+  "aliases": [
+    "CVE-2024-13706"
+  ],
+  "details": "The WP Image Uploader plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'file' parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13706"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/wp-image-uploader/trunk/index.php#L85"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fea1546c-1d8f-4478-81b7-20a9096e0217?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T11:15:11Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/01/GHSA-54x3-pqpj-qp4h/GHSA-54x3-pqpj-qp4h.json b/advisories/unreviewed/2025/01/GHSA-54x3-pqpj-qp4h/GHSA-54x3-pqpj-qp4h.json
new file mode 100644
index 00000000000..ea862e162c6
--- /dev/null
+++ b/advisories/unreviewed/2025/01/GHSA-54x3-pqpj-qp4h/GHSA-54x3-pqpj-qp4h.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-54x3-pqpj-qp4h",
+  "modified": "2025-01-30T12:31:19Z",
+  "published": "2025-01-30T12:31:19Z",
+  "aliases": [
+    "CVE-2025-0742"
+  ],
+  "details": "An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain files stored by others users by changing the \"FILE_ID\" of the endpoint \"/embedai/files/show/<FILE_ID>\".",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0742"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-284"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T12:15:27Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/01/GHSA-82gc-5r4p-79v3/GHSA-82gc-5r4p-79v3.json b/advisories/unreviewed/2025/01/GHSA-82gc-5r4p-79v3/GHSA-82gc-5r4p-79v3.json
new file mode 100644
index 00000000000..e99b4f260e4
--- /dev/null
+++ b/advisories/unreviewed/2025/01/GHSA-82gc-5r4p-79v3/GHSA-82gc-5r4p-79v3.json
@@ -0,0 +1,44 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-82gc-5r4p-79v3",
+  "modified": "2025-01-30T12:31:18Z",
+  "published": "2025-01-30T12:31:18Z",
+  "aliases": [
+    "CVE-2024-12524"
+  ],
+  "details": "The Clinked Client Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'clinked-login-button' shortcode in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12524"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/clinked-client-portal/trunk/clinked-wordpress-plugin.php#L87"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3229331%40clinked-client-portal&new=3229331%40clinked-client-portal&sfp_email=&sfph_mail="
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/417b9dfe-2571-4816-af55-c7cb7dfa62c6?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T11:15:10Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/01/GHSA-9w74-59mf-vjxv/GHSA-9w74-59mf-vjxv.json b/advisories/unreviewed/2025/01/GHSA-9w74-59mf-vjxv/GHSA-9w74-59mf-vjxv.json
new file mode 100644
index 00000000000..4c7cb685213
--- /dev/null
+++ b/advisories/unreviewed/2025/01/GHSA-9w74-59mf-vjxv/GHSA-9w74-59mf-vjxv.json
@@ -0,0 +1,44 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9w74-59mf-vjxv",
+  "modified": "2025-01-30T12:31:18Z",
+  "published": "2025-01-30T12:31:18Z",
+  "aliases": [
+    "CVE-2024-13453"
+  ],
+  "details": "The The Contact Form & SMTP Plugin for WordPress by PirateForms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13453"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/pirate-forms/tags/2.6.0/gutenberg/class-pirateforms-gutenberg.php#L145"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3225666%40pirate-forms&old=3219203%40pirate-forms&sfp_email=&sfph_mail=#file163"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/98859214-7acf-4d40-9291-b5669b9614b7?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-94"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T11:15:10Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/01/GHSA-ff3c-r3wv-56wm/GHSA-ff3c-r3wv-56wm.json b/advisories/unreviewed/2025/01/GHSA-ff3c-r3wv-56wm/GHSA-ff3c-r3wv-56wm.json
new file mode 100644
index 00000000000..af02dffacb0
--- /dev/null
+++ b/advisories/unreviewed/2025/01/GHSA-ff3c-r3wv-56wm/GHSA-ff3c-r3wv-56wm.json
@@ -0,0 +1,31 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-ff3c-r3wv-56wm",
+  "modified": "2025-01-30T12:31:18Z",
+  "published": "2025-01-30T12:31:18Z",
+  "aliases": [
+    "CVE-2025-23007"
+  ],
+  "details": "A vulnerability in the NetExtender Windows client log export function allows unauthorized access to sensitive Windows system files, potentially leading to privilege escalation.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23007"
+    },
+    {
+      "type": "WEB",
+      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0005"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-269"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T10:15:09Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/01/GHSA-hw45-5mv8-6p87/GHSA-hw45-5mv8-6p87.json b/advisories/unreviewed/2025/01/GHSA-hw45-5mv8-6p87/GHSA-hw45-5mv8-6p87.json
new file mode 100644
index 00000000000..3780341324e
--- /dev/null
+++ b/advisories/unreviewed/2025/01/GHSA-hw45-5mv8-6p87/GHSA-hw45-5mv8-6p87.json
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-hw45-5mv8-6p87",
+  "modified": "2025-01-30T12:31:17Z",
+  "published": "2025-01-30T12:31:17Z",
+  "aliases": [
+    "CVE-2025-0860"
+  ],
+  "details": "The VR-Frases (collect & share quotes) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0860"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.svn.wordpress.org/vr-frases/tags/3.0.1/includes/vr-frases-admin.php"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f5ea3e03-fafa-431e-b1fe-a527f491da79?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T10:15:08Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/01/GHSA-jh7c-9hmh-jxw3/GHSA-jh7c-9hmh-jxw3.json b/advisories/unreviewed/2025/01/GHSA-jh7c-9hmh-jxw3/GHSA-jh7c-9hmh-jxw3.json
new file mode 100644
index 00000000000..339fa8dcf93
--- /dev/null
+++ b/advisories/unreviewed/2025/01/GHSA-jh7c-9hmh-jxw3/GHSA-jh7c-9hmh-jxw3.json
@@ -0,0 +1,44 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-jh7c-9hmh-jxw3",
+  "modified": "2025-01-30T12:31:18Z",
+  "published": "2025-01-30T12:31:18Z",
+  "aliases": [
+    "CVE-2024-12409"
+  ],
+  "details": "The Simple:Press Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 6.10.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12409"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/simplepress/trunk/admin/panel-plugins/forms/spa-plugins-list-form.php"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3230289%40simplepress&new=3230289%40simplepress&sfp_email=&sfph_mail="
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b9ebeb96-2f39-488e-aef6-d5af0a37c24a?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T11:15:09Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/01/GHSA-jx6c-jcmp-rgvp/GHSA-jx6c-jcmp-rgvp.json b/advisories/unreviewed/2025/01/GHSA-jx6c-jcmp-rgvp/GHSA-jx6c-jcmp-rgvp.json
new file mode 100644
index 00000000000..ce1f100b9a8
--- /dev/null
+++ b/advisories/unreviewed/2025/01/GHSA-jx6c-jcmp-rgvp/GHSA-jx6c-jcmp-rgvp.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-jx6c-jcmp-rgvp",
+  "modified": "2025-01-30T12:31:19Z",
+  "published": "2025-01-30T12:31:19Z",
+  "aliases": [
+    "CVE-2025-0740"
+  ],
+  "details": "An Improper Access Control vulnerability has been found in EmbedAI\n\n 2.1 and below. This vulnerability allows an authenticated attacker to obtain chat messages belonging to other users by changing the “CHAT_ID” of the endpoint \"/embedai/chats/load_messages?chat_id=<CHAT_ID>\".",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0740"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-284"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T11:15:11Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/01/GHSA-vf69-hcwp-rxc8/GHSA-vf69-hcwp-rxc8.json b/advisories/unreviewed/2025/01/GHSA-vf69-hcwp-rxc8/GHSA-vf69-hcwp-rxc8.json
new file mode 100644
index 00000000000..238cc7b967a
--- /dev/null
+++ b/advisories/unreviewed/2025/01/GHSA-vf69-hcwp-rxc8/GHSA-vf69-hcwp-rxc8.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vf69-hcwp-rxc8",
+  "modified": "2025-01-30T12:31:20Z",
+  "published": "2025-01-30T12:31:20Z",
+  "aliases": [
+    "CVE-2025-0745"
+  ],
+  "details": "An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain the backups of the database by requesting the \"/embedai/app/uploads/database/<SQL_FILE>\" endpoint.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0745"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-284"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T12:15:27Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/01/GHSA-vwj2-w4fq-pg78/GHSA-vwj2-w4fq-pg78.json b/advisories/unreviewed/2025/01/GHSA-vwj2-w4fq-pg78/GHSA-vwj2-w4fq-pg78.json
new file mode 100644
index 00000000000..95d64484168
--- /dev/null
+++ b/advisories/unreviewed/2025/01/GHSA-vwj2-w4fq-pg78/GHSA-vwj2-w4fq-pg78.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vwj2-w4fq-pg78",
+  "modified": "2025-01-30T12:31:19Z",
+  "published": "2025-01-30T12:31:18Z",
+  "aliases": [
+    "CVE-2025-0739"
+  ],
+  "details": "An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to show subscription's information of others users by changing the \"SUSCBRIPTION_ID\" param of the endpoint \"/demos/embedai/subscriptions/show/<SUSCBRIPTION_ID>\".",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0739"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-284"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T11:15:11Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/01/GHSA-wq6j-h853-fwf7/GHSA-wq6j-h853-fwf7.json b/advisories/unreviewed/2025/01/GHSA-wq6j-h853-fwf7/GHSA-wq6j-h853-fwf7.json
new file mode 100644
index 00000000000..f364ae48a37
--- /dev/null
+++ b/advisories/unreviewed/2025/01/GHSA-wq6j-h853-fwf7/GHSA-wq6j-h853-fwf7.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wq6j-h853-fwf7",
+  "modified": "2025-01-30T12:31:19Z",
+  "published": "2025-01-30T12:31:19Z",
+  "aliases": [
+    "CVE-2025-0743"
+  ],
+  "details": "An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to leverage the endpoint \"/embedai/visits/show/<VISIT_ID>\" to obtain information about the visits made by other users. The information provided by this endpoint includes IP address, userAgent and location of the user that visited the web page.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0743"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-284"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T12:15:27Z"
+  }
+}
\ No newline at end of file