Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2025-03-24 15:32:06 +00:00
parent f1de69a5ff
commit 51e02f3cd7
116 changed files with 3241 additions and 61 deletions
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2652-63hr-2gvh",
-  "modified": "2022-05-24T17:26:42Z",
+  "modified": "2025-03-24T15:30:32Z",
  "published": "2022-05-24T17:26:42Z",
  "aliases": [
    "CVE-2020-24312"
  ],
  "details": "mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file. This results in the ability for unauthenticated users to browse and download any site backups, which sometimes include full database backups, that the plugin has taken.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -21,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-200"
+      "CWE-200",
+      "CWE-552"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-hwf5-vp84-w4x7",
-  "modified": "2022-05-24T17:46:32Z",
+  "modified": "2025-03-24T15:30:32Z",
  "published": "2022-05-24T17:46:32Z",
  "aliases": [
    "CVE-2021-24177"
  ],
  "details": "In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_manager_properties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -25,7 +25,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-20"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-4974-qrr5-pm93",
-  "modified": "2024-02-13T18:38:22Z",
+  "modified": "2025-03-24T15:30:32Z",
  "published": "2024-02-06T00:30:27Z",
  "aliases": [
    "CVE-2024-0761"
@@ -19,6 +19,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0761"
    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset/3023403/wp-file-manager/trunk/file_folder_manager.php?old=2984933&old_path=wp-file-manager%2Ftrunk%2Ffile_folder_manager.php"
+    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3023403/wp-file-manager/trunk/file_folder_manager.php?old=2984933&old_path=wp-file-manager/trunk/file_folder_manager.php"
@@ -29,7 +29,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-79"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -26,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-287"
+      "CWE-287",
+      "CWE-613"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -29,7 +29,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-79"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -26,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-200"
+      "CWE-200",
+      "CWE-312"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-c8v3-wvcw-2g23",
-  "modified": "2024-04-23T12:30:45Z",
+  "modified": "2025-03-24T15:30:34Z",
  "published": "2024-04-23T12:30:45Z",
  "aliases": [
    "CVE-2024-3732"
@@ -29,7 +29,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-79"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -29,7 +29,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-79"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -1,12 +1,12 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-wcxr-jpx9-m67f",
-  "modified": "2024-04-17T12:32:03Z",
+  "modified": "2025-03-24T15:30:34Z",
  "published": "2024-04-17T12:32:03Z",
  "aliases": [
    "CVE-2024-32508"
  ],
-  "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deTheme DethemeKit For Elementor allows Stored XSS.This issue affects DethemeKit For Elementor: from n/a through 2.0.2.\n\n",
+  "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deTheme DethemeKit For Elementor allows Stored XSS.This issue affects DethemeKit For Elementor: from n/a through 2.0.2.",
  "severity": [
    {
      "type": "CVSS_V3",
@@ -41,7 +41,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-79"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -33,7 +33,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-79"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -29,7 +29,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-79"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-mwf7-wfvq-vc32",
-  "modified": "2024-10-16T21:31:08Z",
+  "modified": "2025-03-24T15:30:35Z",
  "published": "2024-10-15T21:30:39Z",
  "aliases": [
    "CVE-2024-41311"
@@ -34,6 +34,10 @@
    {
      "type": "WEB",
      "url": "https://gist.github.com/flyyee/79f1b224069842ee320115cafa5c35c0"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00025.html"
    }
  ],
  "database_specific": {
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-m4c7-j6q4-hc9j",
-  "modified": "2025-02-27T18:31:14Z",
+  "modified": "2025-03-24T15:30:37Z",
  "published": "2025-02-27T18:31:14Z",
  "aliases": [
    "CVE-2025-1742"
@@ -23,6 +23,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1742"
    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/janssensjelle/published-pocs/blob/main/pihomehvac_xss_home.md"
+    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.297830"
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-24xf-f6x5-p9rf",
+  "modified": "2025-03-24T15:30:46Z",
+  "published": "2025-03-24T15:30:46Z",
+  "aliases": [
+    "CVE-2025-30541"
+  ],
+  "details": "Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Info Boxes Shortcode and Widget allows Cross Site Request Forgery. This issue affects Info Boxes Shortcode and Widget: from n/a through 1.15.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30541"
+    },
+    {
+      "type": "WEB",
+      "url": "https://patchstack.com/database/wordpress/plugin/info-boxes-shortcode-and-widget/vulnerability/wordpress-info-boxes-shortcode-and-widgets-plugin-1-15-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-352"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-24T14:15:23Z"
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2582-6w84-87q2",
+  "modified": "2025-03-24T15:30:47Z",
+  "published": "2025-03-24T15:30:47Z",
+  "aliases": [
+    "CVE-2025-30565"
+  ],
+  "details": "Cross-Site Request Forgery (CSRF) vulnerability in karrikas banner-manager allows Stored XSS. This issue affects banner-manager: from n/a through 16.04.19.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30565"
+    },
+    {
+      "type": "WEB",
+      "url": "https://patchstack.com/database/wordpress/plugin/banner-manager/vulnerability/wordpress-banner-manager-plugin-16-04-19-csrf-to-stored-xss-vulnerability?_s_id=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-352"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-24T14:15:28Z"
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-25xq-f8xm-q632",
+  "modified": "2025-03-24T15:30:46Z",
+  "published": "2025-03-24T15:30:46Z",
+  "aliases": [
+    "CVE-2025-30542"
+  ],
+  "details": "Cross-Site Request Forgery (CSRF) vulnerability in wpsolutions SoundCloud Ultimate allows Cross Site Request Forgery. This issue affects SoundCloud Ultimate: from n/a through 1.5.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30542"
+    },
+    {
+      "type": "WEB",
+      "url": "https://patchstack.com/database/wordpress/plugin/soundcloud-ultimate/vulnerability/wordpress-wp-soundcloud-ultimate-plugin-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-352"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-24T14:15:23Z"
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2jv3-8jp8-xgcm",
+  "modified": "2025-03-24T15:30:45Z",
+  "published": "2025-03-24T15:30:45Z",
+  "aliases": [
+    "CVE-2025-30522"
+  ],
+  "details": "Cross-Site Request Forgery (CSRF) vulnerability in Damian Orzol Contact Form 7 Material Design allows Stored XSS. This issue affects Contact Form 7 Material Design: from n/a through 1.0.0.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30522"
+    },
+    {
+      "type": "WEB",
+      "url": "https://patchstack.com/database/wordpress/plugin/cf7-material-design/vulnerability/wordpress-contact-form-7-material-design-plugin-1-0-0-csrf-to-stored-xss-vulnerability?_s_id=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-352"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-24T14:15:20Z"
+  }
+}
--- a/Show More
+++ b/Show More