diff --git a/advisories/unreviewed/2022/05/GHSA-2652-63hr-2gvh/GHSA-2652-63hr-2gvh.json b/advisories/unreviewed/2022/05/GHSA-2652-63hr-2gvh/GHSA-2652-63hr-2gvh.json index ee6a755e06b..62188aa37a4 100644 --- a/advisories/unreviewed/2022/05/GHSA-2652-63hr-2gvh/GHSA-2652-63hr-2gvh.json +++ b/advisories/unreviewed/2022/05/GHSA-2652-63hr-2gvh/GHSA-2652-63hr-2gvh.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-2652-63hr-2gvh", - "modified": "2022-05-24T17:26:42Z", + "modified": "2025-03-24T15:30:32Z", "published": "2022-05-24T17:26:42Z", "aliases": [ "CVE-2020-24312" ], "details": "mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file. This results in the ability for unauthenticated users to browse and download any site backups, which sometimes include full database backups, that the plugin has taken.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], "affected": [], "references": [ { @@ -21,7 +26,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-200" + "CWE-200", + "CWE-552" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2022/05/GHSA-hwf5-vp84-w4x7/GHSA-hwf5-vp84-w4x7.json b/advisories/unreviewed/2022/05/GHSA-hwf5-vp84-w4x7/GHSA-hwf5-vp84-w4x7.json index f3583f42b63..64a937449b4 100644 --- a/advisories/unreviewed/2022/05/GHSA-hwf5-vp84-w4x7/GHSA-hwf5-vp84-w4x7.json +++ b/advisories/unreviewed/2022/05/GHSA-hwf5-vp84-w4x7/GHSA-hwf5-vp84-w4x7.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-hwf5-vp84-w4x7", - "modified": "2022-05-24T17:46:32Z", + "modified": "2025-03-24T15:30:32Z", "published": "2022-05-24T17:46:32Z", "aliases": [ "CVE-2021-24177" ], "details": "In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_manager_properties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { diff --git a/advisories/unreviewed/2023/02/GHSA-7hxq-xwr5-7997/GHSA-7hxq-xwr5-7997.json b/advisories/unreviewed/2023/02/GHSA-7hxq-xwr5-7997/GHSA-7hxq-xwr5-7997.json index f248adc1a5c..dbf215b1161 100644 --- a/advisories/unreviewed/2023/02/GHSA-7hxq-xwr5-7997/GHSA-7hxq-xwr5-7997.json +++ b/advisories/unreviewed/2023/02/GHSA-7hxq-xwr5-7997/GHSA-7hxq-xwr5-7997.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-20" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/02/GHSA-4974-qrr5-pm93/GHSA-4974-qrr5-pm93.json b/advisories/unreviewed/2024/02/GHSA-4974-qrr5-pm93/GHSA-4974-qrr5-pm93.json index 99f73a88e53..8b26d43ab7d 100644 --- a/advisories/unreviewed/2024/02/GHSA-4974-qrr5-pm93/GHSA-4974-qrr5-pm93.json +++ b/advisories/unreviewed/2024/02/GHSA-4974-qrr5-pm93/GHSA-4974-qrr5-pm93.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4974-qrr5-pm93", - "modified": "2024-02-13T18:38:22Z", + "modified": "2025-03-24T15:30:32Z", "published": "2024-02-06T00:30:27Z", "aliases": [ "CVE-2024-0761" @@ -19,6 +19,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0761" }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3023403/wp-file-manager/trunk/file_folder_manager.php?old=2984933&old_path=wp-file-manager%2Ftrunk%2Ffile_folder_manager.php" + }, { "type": "WEB", "url": "https://plugins.trac.wordpress.org/changeset/3023403/wp-file-manager/trunk/file_folder_manager.php?old=2984933&old_path=wp-file-manager/trunk/file_folder_manager.php" diff --git a/advisories/unreviewed/2024/03/GHSA-4gqf-hq99-2fwr/GHSA-4gqf-hq99-2fwr.json b/advisories/unreviewed/2024/03/GHSA-4gqf-hq99-2fwr/GHSA-4gqf-hq99-2fwr.json index f3ae6c7af27..731fd413036 100644 --- a/advisories/unreviewed/2024/03/GHSA-4gqf-hq99-2fwr/GHSA-4gqf-hq99-2fwr.json +++ b/advisories/unreviewed/2024/03/GHSA-4gqf-hq99-2fwr/GHSA-4gqf-hq99-2fwr.json @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/03/GHSA-8cv6-h2pr-548g/GHSA-8cv6-h2pr-548g.json b/advisories/unreviewed/2024/03/GHSA-8cv6-h2pr-548g/GHSA-8cv6-h2pr-548g.json index 992de1715c8..051430dedc6 100644 --- a/advisories/unreviewed/2024/03/GHSA-8cv6-h2pr-548g/GHSA-8cv6-h2pr-548g.json +++ b/advisories/unreviewed/2024/03/GHSA-8cv6-h2pr-548g/GHSA-8cv6-h2pr-548g.json @@ -26,7 +26,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-287" + "CWE-287", + "CWE-613" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/03/GHSA-p824-rm68-c4g7/GHSA-p824-rm68-c4g7.json b/advisories/unreviewed/2024/03/GHSA-p824-rm68-c4g7/GHSA-p824-rm68-c4g7.json index d13bb921c70..142b03b5588 100644 --- a/advisories/unreviewed/2024/03/GHSA-p824-rm68-c4g7/GHSA-p824-rm68-c4g7.json +++ b/advisories/unreviewed/2024/03/GHSA-p824-rm68-c4g7/GHSA-p824-rm68-c4g7.json @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/03/GHSA-rmc6-5r9w-qwpm/GHSA-rmc6-5r9w-qwpm.json b/advisories/unreviewed/2024/03/GHSA-rmc6-5r9w-qwpm/GHSA-rmc6-5r9w-qwpm.json index 5da8de61d90..37e64bbd390 100644 --- a/advisories/unreviewed/2024/03/GHSA-rmc6-5r9w-qwpm/GHSA-rmc6-5r9w-qwpm.json +++ b/advisories/unreviewed/2024/03/GHSA-rmc6-5r9w-qwpm/GHSA-rmc6-5r9w-qwpm.json @@ -26,7 +26,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-200" + "CWE-200", + "CWE-312" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/04/GHSA-c8v3-wvcw-2g23/GHSA-c8v3-wvcw-2g23.json b/advisories/unreviewed/2024/04/GHSA-c8v3-wvcw-2g23/GHSA-c8v3-wvcw-2g23.json index eea591ae3ff..4cdc005285c 100644 --- a/advisories/unreviewed/2024/04/GHSA-c8v3-wvcw-2g23/GHSA-c8v3-wvcw-2g23.json +++ b/advisories/unreviewed/2024/04/GHSA-c8v3-wvcw-2g23/GHSA-c8v3-wvcw-2g23.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-c8v3-wvcw-2g23", - "modified": "2024-04-23T12:30:45Z", + "modified": "2025-03-24T15:30:34Z", "published": "2024-04-23T12:30:45Z", "aliases": [ "CVE-2024-3732" @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/04/GHSA-qvj2-mp9w-8qjx/GHSA-qvj2-mp9w-8qjx.json b/advisories/unreviewed/2024/04/GHSA-qvj2-mp9w-8qjx/GHSA-qvj2-mp9w-8qjx.json index 7c7e6cca89a..fb621601e52 100644 --- a/advisories/unreviewed/2024/04/GHSA-qvj2-mp9w-8qjx/GHSA-qvj2-mp9w-8qjx.json +++ b/advisories/unreviewed/2024/04/GHSA-qvj2-mp9w-8qjx/GHSA-qvj2-mp9w-8qjx.json @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/04/GHSA-wcxr-jpx9-m67f/GHSA-wcxr-jpx9-m67f.json b/advisories/unreviewed/2024/04/GHSA-wcxr-jpx9-m67f/GHSA-wcxr-jpx9-m67f.json index 48736085802..cf2604d69f0 100644 --- a/advisories/unreviewed/2024/04/GHSA-wcxr-jpx9-m67f/GHSA-wcxr-jpx9-m67f.json +++ b/advisories/unreviewed/2024/04/GHSA-wcxr-jpx9-m67f/GHSA-wcxr-jpx9-m67f.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-wcxr-jpx9-m67f", - "modified": "2024-04-17T12:32:03Z", + "modified": "2025-03-24T15:30:34Z", "published": "2024-04-17T12:32:03Z", "aliases": [ "CVE-2024-32508" ], - "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deTheme DethemeKit For Elementor allows Stored XSS.This issue affects DethemeKit For Elementor: from n/a through 2.0.2.\n\n", + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deTheme DethemeKit For Elementor allows Stored XSS.This issue affects DethemeKit For Elementor: from n/a through 2.0.2.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/unreviewed/2024/05/GHSA-jwqj-hg2j-7q5j/GHSA-jwqj-hg2j-7q5j.json b/advisories/unreviewed/2024/05/GHSA-jwqj-hg2j-7q5j/GHSA-jwqj-hg2j-7q5j.json index 9abcfe027f2..9e2f403b8f3 100644 --- a/advisories/unreviewed/2024/05/GHSA-jwqj-hg2j-7q5j/GHSA-jwqj-hg2j-7q5j.json +++ b/advisories/unreviewed/2024/05/GHSA-jwqj-hg2j-7q5j/GHSA-jwqj-hg2j-7q5j.json @@ -41,7 +41,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/05/GHSA-wh2p-rhh2-p26w/GHSA-wh2p-rhh2-p26w.json b/advisories/unreviewed/2024/05/GHSA-wh2p-rhh2-p26w/GHSA-wh2p-rhh2-p26w.json index df5419c8c79..15491342c50 100644 --- a/advisories/unreviewed/2024/05/GHSA-wh2p-rhh2-p26w/GHSA-wh2p-rhh2-p26w.json +++ b/advisories/unreviewed/2024/05/GHSA-wh2p-rhh2-p26w/GHSA-wh2p-rhh2-p26w.json @@ -33,7 +33,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/06/GHSA-7m6w-6686-g729/GHSA-7m6w-6686-g729.json b/advisories/unreviewed/2024/06/GHSA-7m6w-6686-g729/GHSA-7m6w-6686-g729.json index c11eb5dea03..99b21a8ac6d 100644 --- a/advisories/unreviewed/2024/06/GHSA-7m6w-6686-g729/GHSA-7m6w-6686-g729.json +++ b/advisories/unreviewed/2024/06/GHSA-7m6w-6686-g729/GHSA-7m6w-6686-g729.json @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/10/GHSA-mwf7-wfvq-vc32/GHSA-mwf7-wfvq-vc32.json b/advisories/unreviewed/2024/10/GHSA-mwf7-wfvq-vc32/GHSA-mwf7-wfvq-vc32.json index 4ba0b156138..df5f9e5c6ff 100644 --- a/advisories/unreviewed/2024/10/GHSA-mwf7-wfvq-vc32/GHSA-mwf7-wfvq-vc32.json +++ b/advisories/unreviewed/2024/10/GHSA-mwf7-wfvq-vc32/GHSA-mwf7-wfvq-vc32.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mwf7-wfvq-vc32", - "modified": "2024-10-16T21:31:08Z", + "modified": "2025-03-24T15:30:35Z", "published": "2024-10-15T21:30:39Z", "aliases": [ "CVE-2024-41311" @@ -34,6 +34,10 @@ { "type": "WEB", "url": "https://gist.github.com/flyyee/79f1b224069842ee320115cafa5c35c0" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00025.html" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/02/GHSA-m4c7-j6q4-hc9j/GHSA-m4c7-j6q4-hc9j.json b/advisories/unreviewed/2025/02/GHSA-m4c7-j6q4-hc9j/GHSA-m4c7-j6q4-hc9j.json index 2202fce423c..35749d24eef 100644 --- a/advisories/unreviewed/2025/02/GHSA-m4c7-j6q4-hc9j/GHSA-m4c7-j6q4-hc9j.json +++ b/advisories/unreviewed/2025/02/GHSA-m4c7-j6q4-hc9j/GHSA-m4c7-j6q4-hc9j.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-m4c7-j6q4-hc9j", - "modified": "2025-02-27T18:31:14Z", + "modified": "2025-03-24T15:30:37Z", "published": "2025-02-27T18:31:14Z", "aliases": [ "CVE-2025-1742" @@ -23,6 +23,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1742" }, + { + "type": "WEB", + "url": "https://github.com/janssensjelle/published-pocs/blob/main/pihomehvac_xss_home.md" + }, { "type": "WEB", "url": "https://vuldb.com/?ctiid.297830" diff --git a/advisories/unreviewed/2025/03/GHSA-24xf-f6x5-p9rf/GHSA-24xf-f6x5-p9rf.json b/advisories/unreviewed/2025/03/GHSA-24xf-f6x5-p9rf/GHSA-24xf-f6x5-p9rf.json new file mode 100644 index 00000000000..42639d70101 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-24xf-f6x5-p9rf/GHSA-24xf-f6x5-p9rf.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-24xf-f6x5-p9rf", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30541" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Info Boxes Shortcode and Widget allows Cross Site Request Forgery. This issue affects Info Boxes Shortcode and Widget: from n/a through 1.15.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30541" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/info-boxes-shortcode-and-widget/vulnerability/wordpress-info-boxes-shortcode-and-widgets-plugin-1-15-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-2582-6w84-87q2/GHSA-2582-6w84-87q2.json b/advisories/unreviewed/2025/03/GHSA-2582-6w84-87q2/GHSA-2582-6w84-87q2.json new file mode 100644 index 00000000000..5a0def6878a --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-2582-6w84-87q2/GHSA-2582-6w84-87q2.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2582-6w84-87q2", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30565" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in karrikas banner-manager allows Stored XSS. This issue affects banner-manager: from n/a through 16.04.19.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30565" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/banner-manager/vulnerability/wordpress-banner-manager-plugin-16-04-19-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-25xq-f8xm-q632/GHSA-25xq-f8xm-q632.json b/advisories/unreviewed/2025/03/GHSA-25xq-f8xm-q632/GHSA-25xq-f8xm-q632.json new file mode 100644 index 00000000000..feb56ab995a --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-25xq-f8xm-q632/GHSA-25xq-f8xm-q632.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-25xq-f8xm-q632", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30542" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in wpsolutions SoundCloud Ultimate allows Cross Site Request Forgery. This issue affects SoundCloud Ultimate: from n/a through 1.5.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30542" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/soundcloud-ultimate/vulnerability/wordpress-wp-soundcloud-ultimate-plugin-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-2jv3-8jp8-xgcm/GHSA-2jv3-8jp8-xgcm.json b/advisories/unreviewed/2025/03/GHSA-2jv3-8jp8-xgcm/GHSA-2jv3-8jp8-xgcm.json new file mode 100644 index 00000000000..c8859766cc8 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-2jv3-8jp8-xgcm/GHSA-2jv3-8jp8-xgcm.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2jv3-8jp8-xgcm", + "modified": "2025-03-24T15:30:45Z", + "published": "2025-03-24T15:30:45Z", + "aliases": [ + "CVE-2025-30522" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in Damian Orzol Contact Form 7 Material Design allows Stored XSS. This issue affects Contact Form 7 Material Design: from n/a through 1.0.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30522" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/cf7-material-design/vulnerability/wordpress-contact-form-7-material-design-plugin-1-0-0-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-2v44-wc7v-87rm/GHSA-2v44-wc7v-87rm.json b/advisories/unreviewed/2025/03/GHSA-2v44-wc7v-87rm/GHSA-2v44-wc7v-87rm.json new file mode 100644 index 00000000000..e6533863c7d --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-2v44-wc7v-87rm/GHSA-2v44-wc7v-87rm.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2v44-wc7v-87rm", + "modified": "2025-03-24T15:30:45Z", + "published": "2025-03-24T15:30:45Z", + "aliases": [ + "CVE-2024-8774" + ], + "details": "The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges to a database administrator.\n\nThis issue affect SIMPLE.ERP from 6.20 through 6.30. Only the 6.30 version received a patch 6.30@a03.9, which removed the vulnerability. Versions 6.20 and 6.25 remain unpatched.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8774" + }, + { + "type": "WEB", + "url": "https://cert.pl/en/posts/2025/03/CVE-2024-8773" + }, + { + "type": "WEB", + "url": "https://cert.pl/posts/2025/03/CVE-2024-8773" + }, + { + "type": "WEB", + "url": "https://simple.com.pl/produkty/simple-erp/dla-kogo" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-257" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T13:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-3fr8-v66h-2g57/GHSA-3fr8-v66h-2g57.json b/advisories/unreviewed/2025/03/GHSA-3fr8-v66h-2g57/GHSA-3fr8-v66h-2g57.json index 70eb81f7c08..308495a37dc 100644 --- a/advisories/unreviewed/2025/03/GHSA-3fr8-v66h-2g57/GHSA-3fr8-v66h-2g57.json +++ b/advisories/unreviewed/2025/03/GHSA-3fr8-v66h-2g57/GHSA-3fr8-v66h-2g57.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-3fr8-v66h-2g57", - "modified": "2025-03-19T21:30:52Z", + "modified": "2025-03-24T15:30:39Z", "published": "2025-03-19T21:30:52Z", "aliases": [ "CVE-2024-55009" ], "details": "A reflected cross-site scripting (XSS) vulnerability in AutoBib - Bibliographic collection management system 3.1.140 and earlier allows attackers to execute arbitrary Javascript in the context of a victim's browser via injecting a crafted payload into the WCE=topFrame&WCU= parameter.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -28,8 +33,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-03-19T21:15:37Z" diff --git a/advisories/unreviewed/2025/03/GHSA-3r3f-956m-rpvm/GHSA-3r3f-956m-rpvm.json b/advisories/unreviewed/2025/03/GHSA-3r3f-956m-rpvm/GHSA-3r3f-956m-rpvm.json new file mode 100644 index 00000000000..6f03fa82f07 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-3r3f-956m-rpvm/GHSA-3r3f-956m-rpvm.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3r3f-956m-rpvm", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30586" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in bbodine1 cTabs allows Stored XSS. This issue affects cTabs: from n/a through 1.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30586" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/ctabs/vulnerability/wordpress-ctabs-plugin-1-3-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-3x87-43vv-824j/GHSA-3x87-43vv-824j.json b/advisories/unreviewed/2025/03/GHSA-3x87-43vv-824j/GHSA-3x87-43vv-824j.json new file mode 100644 index 00000000000..233f89701d6 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-3x87-43vv-824j/GHSA-3x87-43vv-824j.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3x87-43vv-824j", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30573" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mrdenny My Default Post Content allows Stored XSS. This issue affects My Default Post Content: from n/a through 0.7.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30573" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/my-default-post-content/vulnerability/wordpress-my-default-post-content-0-7-3-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-422v-qjrr-7jh4/GHSA-422v-qjrr-7jh4.json b/advisories/unreviewed/2025/03/GHSA-422v-qjrr-7jh4/GHSA-422v-qjrr-7jh4.json index afcab3fcb49..815cb1d8185 100644 --- a/advisories/unreviewed/2025/03/GHSA-422v-qjrr-7jh4/GHSA-422v-qjrr-7jh4.json +++ b/advisories/unreviewed/2025/03/GHSA-422v-qjrr-7jh4/GHSA-422v-qjrr-7jh4.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-422v-qjrr-7jh4", - "modified": "2025-03-19T21:30:52Z", + "modified": "2025-03-24T15:30:39Z", "published": "2025-03-19T21:30:52Z", "aliases": [ "CVE-2025-2476" ], "details": "Use after free in Lens in Google Chrome prior to 134.0.6998.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -27,7 +32,7 @@ "cwe_ids": [ "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-03-19T19:15:50Z" diff --git a/advisories/unreviewed/2025/03/GHSA-492h-pgjr-5pj9/GHSA-492h-pgjr-5pj9.json b/advisories/unreviewed/2025/03/GHSA-492h-pgjr-5pj9/GHSA-492h-pgjr-5pj9.json new file mode 100644 index 00000000000..649500d1640 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-492h-pgjr-5pj9/GHSA-492h-pgjr-5pj9.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-492h-pgjr-5pj9", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:48Z", + "aliases": [ + "CVE-2025-30602" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alphasis Related Posts via Categories allows Stored XSS. This issue affects Related Posts via Categories: from n/a through 2.1.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30602" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/related-posts-via-categories/vulnerability/wordpress-related-posts-via-categories-plugin-2-1-2-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-4f5w-5ccj-9j8h/GHSA-4f5w-5ccj-9j8h.json b/advisories/unreviewed/2025/03/GHSA-4f5w-5ccj-9j8h/GHSA-4f5w-5ccj-9j8h.json new file mode 100644 index 00000000000..290ce731f61 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-4f5w-5ccj-9j8h/GHSA-4f5w-5ccj-9j8h.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4f5w-5ccj-9j8h", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30532" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MorganF Weather Layer allows Stored XSS. This issue affects Weather Layer: from n/a through 4.2.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30532" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/weather-layer/vulnerability/wordpress-weather-layer-plugin-4-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-4pmc-79gm-h29v/GHSA-4pmc-79gm-h29v.json b/advisories/unreviewed/2025/03/GHSA-4pmc-79gm-h29v/GHSA-4pmc-79gm-h29v.json new file mode 100644 index 00000000000..140daa58204 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-4pmc-79gm-h29v/GHSA-4pmc-79gm-h29v.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4pmc-79gm-h29v", + "modified": "2025-03-24T15:30:45Z", + "published": "2025-03-24T15:30:45Z", + "aliases": [ + "CVE-2025-30527" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetoolbox My Bootstrap Menu allows Stored XSS. This issue affects My Bootstrap Menu: from n/a through 1.2.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30527" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/my-bootstrap-menu/vulnerability/wordpress-my-bootstrap-menu-plugin-1-2-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-4r9j-v95c-pgxw/GHSA-4r9j-v95c-pgxw.json b/advisories/unreviewed/2025/03/GHSA-4r9j-v95c-pgxw/GHSA-4r9j-v95c-pgxw.json new file mode 100644 index 00000000000..c8d530681dc --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-4r9j-v95c-pgxw/GHSA-4r9j-v95c-pgxw.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4r9j-v95c-pgxw", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30557" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in odihost Easy 301 Redirects allows Cross Site Request Forgery. This issue affects Easy 301 Redirects: from n/a through 1.33.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30557" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/odihost-easy-redirect-301/vulnerability/wordpress-easy-301-redirects-plugin-1-33-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-4rf9-3v3w-xg8c/GHSA-4rf9-3v3w-xg8c.json b/advisories/unreviewed/2025/03/GHSA-4rf9-3v3w-xg8c/GHSA-4rf9-3v3w-xg8c.json new file mode 100644 index 00000000000..49f3a36c08b --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-4rf9-3v3w-xg8c/GHSA-4rf9-3v3w-xg8c.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4rf9-3v3w-xg8c", + "modified": "2025-03-24T15:30:45Z", + "published": "2025-03-24T15:30:45Z", + "aliases": [ + "CVE-2025-30526" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in lucksy Typekit plugin for WordPress allows Cross Site Request Forgery. This issue affects Typekit plugin for WordPress: from n/a through 1.2.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30526" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/typekit/vulnerability/wordpress-typekit-plugin-1-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-4vq9-rwg9-vq6x/GHSA-4vq9-rwg9-vq6x.json b/advisories/unreviewed/2025/03/GHSA-4vq9-rwg9-vq6x/GHSA-4vq9-rwg9-vq6x.json new file mode 100644 index 00000000000..b2e790f2a6b --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-4vq9-rwg9-vq6x/GHSA-4vq9-rwg9-vq6x.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4vq9-rwg9-vq6x", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:48Z", + "aliases": [ + "CVE-2025-30609" + ], + "details": "Insertion of Sensitive Information Into Sent Data vulnerability in AppExperts AppExperts – WordPress to Mobile App – WooCommerce to iOs and Android Apps allows Retrieve Embedded Sensitive Data. This issue affects AppExperts – WordPress to Mobile App – WooCommerce to iOs and Android Apps: from n/a through 1.4.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30609" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/appexperts/vulnerability/wordpress-appexperts-wordpress-to-mobile-app-woocommerce-to-ios-and-android-apps-1-4-3-sensitive-data-exposure-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-201" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-4xr2-72fw-vc5j/GHSA-4xr2-72fw-vc5j.json b/advisories/unreviewed/2025/03/GHSA-4xr2-72fw-vc5j/GHSA-4xr2-72fw-vc5j.json new file mode 100644 index 00000000000..240cd5ccae8 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-4xr2-72fw-vc5j/GHSA-4xr2-72fw-vc5j.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4xr2-72fw-vc5j", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30566" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aryan Themes Clink allows DOM-Based XSS. This issue affects Clink: from n/a through 1.2.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30566" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/clink/vulnerability/wordpress-clink-1-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-56mj-p4v2-2245/GHSA-56mj-p4v2-2245.json b/advisories/unreviewed/2025/03/GHSA-56mj-p4v2-2245/GHSA-56mj-p4v2-2245.json new file mode 100644 index 00000000000..00f3bdb0932 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-56mj-p4v2-2245/GHSA-56mj-p4v2-2245.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-56mj-p4v2-2245", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30571" + ], + "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in STEdb Corp. STEdb Forms allows SQL Injection. This issue affects STEdb Forms: from n/a through 1.0.4.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30571" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/stedb-forms/vulnerability/wordpress-stedb-forms-1-0-4-sql-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-5h9p-4fm4-cr85/GHSA-5h9p-4fm4-cr85.json b/advisories/unreviewed/2025/03/GHSA-5h9p-4fm4-cr85/GHSA-5h9p-4fm4-cr85.json new file mode 100644 index 00000000000..d46b0511ce6 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-5h9p-4fm4-cr85/GHSA-5h9p-4fm4-cr85.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5h9p-4fm4-cr85", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:48Z", + "aliases": [ + "CVE-2025-30605" + ], + "details": "Missing Authorization vulnerability in ldwin79 sourceplay-navermap allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects sourceplay-navermap: from n/a through 0.0.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30605" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/sourceplay-navermap/vulnerability/wordpress-sourceplay-navermap-plugin-0-0-2-broken-access-control-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-5p3r-7jhw-3cm2/GHSA-5p3r-7jhw-3cm2.json b/advisories/unreviewed/2025/03/GHSA-5p3r-7jhw-3cm2/GHSA-5p3r-7jhw-3cm2.json new file mode 100644 index 00000000000..632cec3cd1c --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-5p3r-7jhw-3cm2/GHSA-5p3r-7jhw-3cm2.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5p3r-7jhw-3cm2", + "modified": "2025-03-24T15:30:49Z", + "published": "2025-03-24T15:30:49Z", + "aliases": [ + "CVE-2025-1558" + ], + "details": "Mattermost Mobile Apps versions <=2.25.0 fail to properly validate GIF images prior to rendering which allows a malicious user to cause the Android application to crash via message containing a maliciously crafted GIF.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1558" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1287" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T15:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-5p4x-j869-mmj2/GHSA-5p4x-j869-mmj2.json b/advisories/unreviewed/2025/03/GHSA-5p4x-j869-mmj2/GHSA-5p4x-j869-mmj2.json new file mode 100644 index 00000000000..2431830a268 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-5p4x-j869-mmj2/GHSA-5p4x-j869-mmj2.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5p4x-j869-mmj2", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30549" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in Yummly Yummly Rich Recipes allows Cross Site Request Forgery. This issue affects Yummly Rich Recipes: from n/a through 4.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30549" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/yummly-rich-recipes/vulnerability/wordpress-yummly-rich-recipes-plugin-4-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-68f4-hrcm-jf8f/GHSA-68f4-hrcm-jf8f.json b/advisories/unreviewed/2025/03/GHSA-68f4-hrcm-jf8f/GHSA-68f4-hrcm-jf8f.json new file mode 100644 index 00000000000..993a3654ca2 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-68f4-hrcm-jf8f/GHSA-68f4-hrcm-jf8f.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-68f4-hrcm-jf8f", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30556" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in flyaga Fix Rss Feeds allows Cross Site Request Forgery. This issue affects Fix Rss Feeds: from n/a through 3.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30556" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/fix-rss-feed/vulnerability/wordpress-fix-rss-feeds-plugin-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-69m8-336v-j57w/GHSA-69m8-336v-j57w.json b/advisories/unreviewed/2025/03/GHSA-69m8-336v-j57w/GHSA-69m8-336v-j57w.json new file mode 100644 index 00000000000..6148a560dfb --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-69m8-336v-j57w/GHSA-69m8-336v-j57w.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-69m8-336v-j57w", + "modified": "2025-03-24T15:30:45Z", + "published": "2025-03-24T15:30:45Z", + "aliases": [ + "CVE-2024-8773" + ], + "details": "SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification.\n\nThis issue affect SIMPLE.ERP from 6.20 to 6.30. Only the 6.30 version received a patch 6.30@a03.9, which make it possible for an administrator to enforce encrypted communication. Versions 6.20 and 6.25 remain unpatched.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8773" + }, + { + "type": "WEB", + "url": "https://cert.pl/en/posts/2025/03/CVE-2024-8773" + }, + { + "type": "WEB", + "url": "https://cert.pl/posts/2025/03/CVE-2024-8773" + }, + { + "type": "WEB", + "url": "https://simple.com.pl/produkty/simple-erp/dla-kogo" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-757" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T13:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-6cgp-2pxr-4vm6/GHSA-6cgp-2pxr-4vm6.json b/advisories/unreviewed/2025/03/GHSA-6cgp-2pxr-4vm6/GHSA-6cgp-2pxr-4vm6.json new file mode 100644 index 00000000000..13323db1f82 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-6cgp-2pxr-4vm6/GHSA-6cgp-2pxr-4vm6.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6cgp-2pxr-4vm6", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30592" + ], + "details": "Missing Authorization vulnerability in westerndeal Advanced Dewplayer allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Advanced Dewplayer: from n/a through 1.6.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30592" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/advanced-dewplayer/vulnerability/wordpress-advanced-dewplayer-1-6-broken-access-control-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:31Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-6pfh-7rxm-m3rv/GHSA-6pfh-7rxm-m3rv.json b/advisories/unreviewed/2025/03/GHSA-6pfh-7rxm-m3rv/GHSA-6pfh-7rxm-m3rv.json new file mode 100644 index 00000000000..ff82fc126d8 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-6pfh-7rxm-m3rv/GHSA-6pfh-7rxm-m3rv.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6pfh-7rxm-m3rv", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30568" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in hitoy Super Static Cache allows Cross Site Request Forgery. This issue affects Super Static Cache: from n/a through 3.3.5.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30568" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/super-static-cache/vulnerability/wordpress-super-static-cache-3-3-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-7f25-w27r-9h2w/GHSA-7f25-w27r-9h2w.json b/advisories/unreviewed/2025/03/GHSA-7f25-w27r-9h2w/GHSA-7f25-w27r-9h2w.json new file mode 100644 index 00000000000..4dda249ec63 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-7f25-w27r-9h2w/GHSA-7f25-w27r-9h2w.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7f25-w27r-9h2w", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30560" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in Sana Ullah jQuery Dropdown Menu allows Stored XSS. This issue affects jQuery Dropdown Menu: from n/a through 3.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30560" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/jquery-drop-down-menu-plugin/vulnerability/wordpress-jquery-dropdown-menu-plugin-3-0-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-7f92-xqqr-xjhw/GHSA-7f92-xqqr-xjhw.json b/advisories/unreviewed/2025/03/GHSA-7f92-xqqr-xjhw/GHSA-7f92-xqqr-xjhw.json index bf8e08ff773..853e3c14852 100644 --- a/advisories/unreviewed/2025/03/GHSA-7f92-xqqr-xjhw/GHSA-7f92-xqqr-xjhw.json +++ b/advisories/unreviewed/2025/03/GHSA-7f92-xqqr-xjhw/GHSA-7f92-xqqr-xjhw.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-7f92-xqqr-xjhw", - "modified": "2025-03-20T15:30:35Z", + "modified": "2025-03-24T15:30:39Z", "published": "2025-03-20T15:30:35Z", "aliases": [ "CVE-2025-29101" ], "details": "Tenda AC8V4.0 V16.03.34.06 was discovered to contain a stack overflow via the deviceid parameter in the get_parentControl_list_Info function.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-121" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-03-20T13:15:36Z" diff --git a/advisories/unreviewed/2025/03/GHSA-7qx5-g5pm-mq66/GHSA-7qx5-g5pm-mq66.json b/advisories/unreviewed/2025/03/GHSA-7qx5-g5pm-mq66/GHSA-7qx5-g5pm-mq66.json index 8913f25a650..3422788d903 100644 --- a/advisories/unreviewed/2025/03/GHSA-7qx5-g5pm-mq66/GHSA-7qx5-g5pm-mq66.json +++ b/advisories/unreviewed/2025/03/GHSA-7qx5-g5pm-mq66/GHSA-7qx5-g5pm-mq66.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-119" + "CWE-119", + "CWE-787" ], "severity": "LOW", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/03/GHSA-7xxf-4qg8-75qc/GHSA-7xxf-4qg8-75qc.json b/advisories/unreviewed/2025/03/GHSA-7xxf-4qg8-75qc/GHSA-7xxf-4qg8-75qc.json new file mode 100644 index 00000000000..db4cb058b1c --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-7xxf-4qg8-75qc/GHSA-7xxf-4qg8-75qc.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7xxf-4qg8-75qc", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30577" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in mendibass Browser Address Bar Color allows Stored XSS. This issue affects Browser Address Bar Color: from n/a through 3.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30577" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/browser-address-bar-color/vulnerability/wordpress-browser-address-bar-color-plugin-3-3-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-82p7-v78v-j5h9/GHSA-82p7-v78v-j5h9.json b/advisories/unreviewed/2025/03/GHSA-82p7-v78v-j5h9/GHSA-82p7-v78v-j5h9.json new file mode 100644 index 00000000000..275532e0a34 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-82p7-v78v-j5h9/GHSA-82p7-v78v-j5h9.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-82p7-v78v-j5h9", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:48Z", + "aliases": [ + "CVE-2025-30608" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in Anthony WordPress SQL Backup allows Stored XSS. This issue affects WordPress SQL Backup: from n/a through 3.5.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30608" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wordpress-sql-backup/vulnerability/wordpress-wordpress-sql-backup-3-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-875m-425m-pmch/GHSA-875m-425m-pmch.json b/advisories/unreviewed/2025/03/GHSA-875m-425m-pmch/GHSA-875m-425m-pmch.json new file mode 100644 index 00000000000..54aeac67d0b --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-875m-425m-pmch/GHSA-875m-425m-pmch.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-875m-425m-pmch", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30574" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jenst Mobile Navigation allows Stored XSS. This issue affects Mobile Navigation: from n/a through 1.5.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30574" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/mobile-navigation/vulnerability/wordpress-mobile-navigation-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-87w3-vh62-jpww/GHSA-87w3-vh62-jpww.json b/advisories/unreviewed/2025/03/GHSA-87w3-vh62-jpww/GHSA-87w3-vh62-jpww.json new file mode 100644 index 00000000000..e044d066f14 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-87w3-vh62-jpww/GHSA-87w3-vh62-jpww.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-87w3-vh62-jpww", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30546" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in boroV Cackle allows Cross Site Request Forgery. This issue affects Cackle: from n/a through 4.33.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30546" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/cackle/vulnerability/wordpress-cackle-plugin-4-33-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-8mx5-8v9m-w9m3/GHSA-8mx5-8v9m-w9m3.json b/advisories/unreviewed/2025/03/GHSA-8mx5-8v9m-w9m3/GHSA-8mx5-8v9m-w9m3.json new file mode 100644 index 00000000000..b1e9fc997f4 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-8mx5-8v9m-w9m3/GHSA-8mx5-8v9m-w9m3.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8mx5-8v9m-w9m3", + "modified": "2025-03-24T15:30:45Z", + "published": "2025-03-24T15:30:45Z", + "aliases": [ + "CVE-2025-30528" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in wpshopee Awesome Logos allows SQL Injection. This issue affects Awesome Logos: from n/a through 1.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30528" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/awesome-logos/vulnerability/wordpress-awesome-logos-plugin-1-2-csrf-to-sql-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-8wgh-r989-wp43/GHSA-8wgh-r989-wp43.json b/advisories/unreviewed/2025/03/GHSA-8wgh-r989-wp43/GHSA-8wgh-r989-wp43.json new file mode 100644 index 00000000000..4a20854ba0d --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-8wgh-r989-wp43/GHSA-8wgh-r989-wp43.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8wgh-r989-wp43", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30588" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in ryan_xantoo Map Contact allows Stored XSS. This issue affects Map Contact: from n/a through 3.0.4.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30588" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/map-contact/vulnerability/wordpress-map-contact-plugin-3-0-4-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:31Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-9f25-wfqc-782v/GHSA-9f25-wfqc-782v.json b/advisories/unreviewed/2025/03/GHSA-9f25-wfqc-782v/GHSA-9f25-wfqc-782v.json index e4ae3b49c25..b43f3c1fd6a 100644 --- a/advisories/unreviewed/2025/03/GHSA-9f25-wfqc-782v/GHSA-9f25-wfqc-782v.json +++ b/advisories/unreviewed/2025/03/GHSA-9f25-wfqc-782v/GHSA-9f25-wfqc-782v.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9f25-wfqc-782v", - "modified": "2025-03-10T12:30:55Z", + "modified": "2025-03-24T15:30:38Z", "published": "2025-03-10T12:30:55Z", "aliases": [ "CVE-2025-24387" @@ -26,7 +26,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-1275" + "CWE-1275", + "CWE-352" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/03/GHSA-9m25-fhhg-jhcm/GHSA-9m25-fhhg-jhcm.json b/advisories/unreviewed/2025/03/GHSA-9m25-fhhg-jhcm/GHSA-9m25-fhhg-jhcm.json new file mode 100644 index 00000000000..878c251043f --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-9m25-fhhg-jhcm/GHSA-9m25-fhhg-jhcm.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9m25-fhhg-jhcm", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30537" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristian Sarov Upload Quota per User allows Stored XSS. This issue affects Upload Quota per User: from n/a through 1.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30537" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/upload-quota-per-user/vulnerability/wordpress-upload-quota-per-user-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-9q4x-fr4m-jp86/GHSA-9q4x-fr4m-jp86.json b/advisories/unreviewed/2025/03/GHSA-9q4x-fr4m-jp86/GHSA-9q4x-fr4m-jp86.json index abe784e73c7..6852587c86a 100644 --- a/advisories/unreviewed/2025/03/GHSA-9q4x-fr4m-jp86/GHSA-9q4x-fr4m-jp86.json +++ b/advisories/unreviewed/2025/03/GHSA-9q4x-fr4m-jp86/GHSA-9q4x-fr4m-jp86.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-9q4x-fr4m-jp86", - "modified": "2025-03-23T21:30:33Z", + "modified": "2025-03-24T15:30:44Z", "published": "2025-03-23T15:30:33Z", "aliases": [ "CVE-2025-27553" ], "details": "Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.\n\nThe FileObject API in Commons VFS has a 'resolveFile' method that\ntakes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that \"an exception is thrown if the resolved file is not a descendent of\nthe base file\". However, when the path contains encoded \"..\"\ncharacters (for example, \"%2E%2E/bar.txt\"), it might return file objects that are not\na descendent of the base file, without throwing an exception.\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], "affected": [], "references": [ { @@ -27,7 +32,7 @@ "cwe_ids": [ "CWE-23" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-03-23T15:15:13Z" diff --git a/advisories/unreviewed/2025/03/GHSA-9vqg-fwfq-v3fr/GHSA-9vqg-fwfq-v3fr.json b/advisories/unreviewed/2025/03/GHSA-9vqg-fwfq-v3fr/GHSA-9vqg-fwfq-v3fr.json new file mode 100644 index 00000000000..db2d4a56797 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-9vqg-fwfq-v3fr/GHSA-9vqg-fwfq-v3fr.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9vqg-fwfq-v3fr", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:48Z", + "aliases": [ + "CVE-2025-30604" + ], + "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jiangqie JiangQie Official Website Mini Program allows Blind SQL Injection. This issue affects JiangQie Official Website Mini Program: from n/a through 1.8.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30604" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/jiangqie-official-website-mini-program/vulnerability/wordpress-jiangqie-official-website-mini-program-plugin-1-8-2-sql-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-chcj-cf82-v7fw/GHSA-chcj-cf82-v7fw.json b/advisories/unreviewed/2025/03/GHSA-chcj-cf82-v7fw/GHSA-chcj-cf82-v7fw.json new file mode 100644 index 00000000000..96edaa0f38d --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-chcj-cf82-v7fw/GHSA-chcj-cf82-v7fw.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-chcj-cf82-v7fw", + "modified": "2025-03-24T15:30:45Z", + "published": "2025-03-24T15:30:45Z", + "aliases": [ + "CVE-2025-30523" + ], + "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Marcel-NL Super Simple Subscriptions allows SQL Injection. This issue affects Super Simple Subscriptions: from n/a through 1.1.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30523" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/super-simple-subscriptions/vulnerability/wordpress-super-simple-subscriptions-plugin-1-1-0-sql-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-cqh3-89vx-gpjh/GHSA-cqh3-89vx-gpjh.json b/advisories/unreviewed/2025/03/GHSA-cqh3-89vx-gpjh/GHSA-cqh3-89vx-gpjh.json new file mode 100644 index 00000000000..90c6bc1fdb4 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-cqh3-89vx-gpjh/GHSA-cqh3-89vx-gpjh.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cqh3-89vx-gpjh", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30531" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in GBS Developer WP Ride Booking allows Cross Site Request Forgery. This issue affects WP Ride Booking: from n/a through 2.4.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30531" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-ride-booking/vulnerability/wordpress-wp-ride-booking-plugin-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-cv3w-78q7-pg79/GHSA-cv3w-78q7-pg79.json b/advisories/unreviewed/2025/03/GHSA-cv3w-78q7-pg79/GHSA-cv3w-78q7-pg79.json new file mode 100644 index 00000000000..9cbed83b51f --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-cv3w-78q7-pg79/GHSA-cv3w-78q7-pg79.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cv3w-78q7-pg79", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30578" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in hotvanrod AdSense Privacy Policy allows Stored XSS. This issue affects AdSense Privacy Policy: from n/a through 1.1.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30578" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/adsense-privacy-policy/vulnerability/wordpress-adsense-privacy-policy-plugin-1-1-1-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-cw9m-3974-64p8/GHSA-cw9m-3974-64p8.json b/advisories/unreviewed/2025/03/GHSA-cw9m-3974-64p8/GHSA-cw9m-3974-64p8.json new file mode 100644 index 00000000000..6d5a10346c0 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-cw9m-3974-64p8/GHSA-cw9m-3974-64p8.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cw9m-3974-64p8", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30550" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in WPShop.ru CallPhone'r allows Stored XSS. This issue affects CallPhone'r: from n/a through 1.1.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30550" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/callphoner/vulnerability/wordpress-callphone-r-plugin-1-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-cwvj-wxq8-9qr2/GHSA-cwvj-wxq8-9qr2.json b/advisories/unreviewed/2025/03/GHSA-cwvj-wxq8-9qr2/GHSA-cwvj-wxq8-9qr2.json new file mode 100644 index 00000000000..32c743d3df8 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-cwvj-wxq8-9qr2/GHSA-cwvj-wxq8-9qr2.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cwvj-wxq8-9qr2", + "modified": "2025-03-24T15:30:45Z", + "published": "2025-03-24T15:30:45Z", + "aliases": [ + "CVE-2025-30529" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in Sébastien Dumont Auto Load Next Post allows Cross Site Request Forgery. This issue affects Auto Load Next Post: from n/a through 1.5.14.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30529" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/auto-load-next-post/vulnerability/wordpress-auto-load-next-post-plugin-1-5-14-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-f9mf-wjq9-xxwh/GHSA-f9mf-wjq9-xxwh.json b/advisories/unreviewed/2025/03/GHSA-f9mf-wjq9-xxwh/GHSA-f9mf-wjq9-xxwh.json new file mode 100644 index 00000000000..94e7ef94fdb --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-f9mf-wjq9-xxwh/GHSA-f9mf-wjq9-xxwh.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f9mf-wjq9-xxwh", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30595" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tstafford include-file allows Stored XSS. This issue affects include-file: from n/a through 1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30595" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/include-file/vulnerability/wordpress-include-file-1-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:31Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-fc88-2f3c-x76v/GHSA-fc88-2f3c-x76v.json b/advisories/unreviewed/2025/03/GHSA-fc88-2f3c-x76v/GHSA-fc88-2f3c-x76v.json new file mode 100644 index 00000000000..afe8247d3dc --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-fc88-2f3c-x76v/GHSA-fc88-2f3c-x76v.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fc88-2f3c-x76v", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30584" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in alphaomegaplugins AlphaOmega Captcha & Anti-Spam Filter allows Stored XSS. This issue affects AlphaOmega Captcha & Anti-Spam Filter: from n/a through 3.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30584" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/alphaomega-captcha-anti-spam/vulnerability/wordpress-alphaomega-captcha-anti-spam-filter-plugin-3-3-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-fm48-cc9j-347r/GHSA-fm48-cc9j-347r.json b/advisories/unreviewed/2025/03/GHSA-fm48-cc9j-347r/GHSA-fm48-cc9j-347r.json new file mode 100644 index 00000000000..f7d691df65c --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-fm48-cc9j-347r/GHSA-fm48-cc9j-347r.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fm48-cc9j-347r", + "modified": "2025-03-24T15:30:45Z", + "published": "2025-03-24T15:30:45Z", + "aliases": [ + "CVE-2025-30525" + ], + "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ProfitShare.ro WP Profitshare allows SQL Injection. This issue affects WP Profitshare: from n/a through 1.4.9.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30525" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-profitshare/vulnerability/wordpress-wp-profitshare-plugin-1-4-9-sql-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-fmxw-76xq-cmqq/GHSA-fmxw-76xq-cmqq.json b/advisories/unreviewed/2025/03/GHSA-fmxw-76xq-cmqq/GHSA-fmxw-76xq-cmqq.json index 5b28a2c0e40..ca6a068d0b2 100644 --- a/advisories/unreviewed/2025/03/GHSA-fmxw-76xq-cmqq/GHSA-fmxw-76xq-cmqq.json +++ b/advisories/unreviewed/2025/03/GHSA-fmxw-76xq-cmqq/GHSA-fmxw-76xq-cmqq.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-fmxw-76xq-cmqq", - "modified": "2025-03-22T15:30:36Z", + "modified": "2025-03-24T15:30:39Z", "published": "2025-03-22T15:30:36Z", "aliases": [ "CVE-2025-26796" ], "details": "** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Oozie.\n\nThis issue affects Apache Oozie: all versions.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -27,7 +32,7 @@ "cwe_ids": [ "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-03-22T13:15:35Z" diff --git a/advisories/unreviewed/2025/03/GHSA-g3cr-3jfg-p9mh/GHSA-g3cr-3jfg-p9mh.json b/advisories/unreviewed/2025/03/GHSA-g3cr-3jfg-p9mh/GHSA-g3cr-3jfg-p9mh.json new file mode 100644 index 00000000000..09aa99c23d9 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-g3cr-3jfg-p9mh/GHSA-g3cr-3jfg-p9mh.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g3cr-3jfg-p9mh", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:48Z", + "aliases": [ + "CVE-2025-30610" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget allows Stored XSS. This issue affects WP Social Widget: from n/a through 2.2.6.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30610" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-social-widget/vulnerability/wordpress-wp-social-widget-2-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-g73g-f4c3-v6x8/GHSA-g73g-f4c3-v6x8.json b/advisories/unreviewed/2025/03/GHSA-g73g-f4c3-v6x8/GHSA-g73g-f4c3-v6x8.json new file mode 100644 index 00000000000..becc8167b11 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-g73g-f4c3-v6x8/GHSA-g73g-f4c3-v6x8.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g73g-f4c3-v6x8", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:48Z", + "aliases": [ + "CVE-2025-30599" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp-maverick WP Parallax Content Slider allows Stored XSS. This issue affects WP Parallax Content Slider: from n/a through 0.9.8.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30599" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-parallax-content-slider/vulnerability/wordpress-wp-parallax-content-slider-plugin-0-9-8-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-ggw8-5cc8-v5cp/GHSA-ggw8-5cc8-v5cp.json b/advisories/unreviewed/2025/03/GHSA-ggw8-5cc8-v5cp/GHSA-ggw8-5cc8-v5cp.json new file mode 100644 index 00000000000..64124407035 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-ggw8-5cc8-v5cp/GHSA-ggw8-5cc8-v5cp.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ggw8-5cc8-v5cp", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30552" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in Donald Gilbert WordPress Admin Bar Improved allows Stored XSS. This issue affects WordPress Admin Bar Improved: from n/a through 3.3.5.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30552" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wordpress-admin-bar-improved/vulnerability/wordpress-wordpress-admin-bar-improved-plugin-3-3-5-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-gxw8-5rc5-g4xq/GHSA-gxw8-5rc5-g4xq.json b/advisories/unreviewed/2025/03/GHSA-gxw8-5rc5-g4xq/GHSA-gxw8-5rc5-g4xq.json new file mode 100644 index 00000000000..edbaef9cdb5 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-gxw8-5rc5-g4xq/GHSA-gxw8-5rc5-g4xq.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gxw8-5rc5-g4xq", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30539" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benedikt Mo BMo Expo allows Stored XSS. This issue affects BMo Expo: from n/a through 1.0.15.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30539" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/bmo-expo/vulnerability/wordpress-bmo-expo-plugin-1-0-15-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-h7cj-m9v9-3624/GHSA-h7cj-m9v9-3624.json b/advisories/unreviewed/2025/03/GHSA-h7cj-m9v9-3624/GHSA-h7cj-m9v9-3624.json new file mode 100644 index 00000000000..3c388eb1b63 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-h7cj-m9v9-3624/GHSA-h7cj-m9v9-3624.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h7cj-m9v9-3624", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30569" + ], + "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jahertor WP Featured Entries allows SQL Injection. This issue affects WP Featured Entries: from n/a through 1.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30569" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-featured-entries/vulnerability/wordpress-wp-featured-entries-1-0-sql-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-h85v-v7m6-x35c/GHSA-h85v-v7m6-x35c.json b/advisories/unreviewed/2025/03/GHSA-h85v-v7m6-x35c/GHSA-h85v-v7m6-x35c.json new file mode 100644 index 00000000000..8a54181ddd2 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-h85v-v7m6-x35c/GHSA-h85v-v7m6-x35c.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h85v-v7m6-x35c", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30585" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in marynixie Generate Post Thumbnails allows Cross Site Request Forgery. This issue affects Generate Post Thumbnails: from n/a through 0.8.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30585" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/generate-post-thumbnails/vulnerability/wordpress-generate-post-thumbnails-0-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-hjq4-ccf7-g9v3/GHSA-hjq4-ccf7-g9v3.json b/advisories/unreviewed/2025/03/GHSA-hjq4-ccf7-g9v3/GHSA-hjq4-ccf7-g9v3.json new file mode 100644 index 00000000000..70e9944b7e0 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-hjq4-ccf7-g9v3/GHSA-hjq4-ccf7-g9v3.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hjq4-ccf7-g9v3", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30555" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in iiiryan WordPres 同步微博 allows Stored XSS. This issue affects WordPres 同步微博: from n/a through 1.1.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30555" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp2wb/vulnerability/wordpress-wordpres-plugin-1-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-hpf8-j2rr-mhxw/GHSA-hpf8-j2rr-mhxw.json b/advisories/unreviewed/2025/03/GHSA-hpf8-j2rr-mhxw/GHSA-hpf8-j2rr-mhxw.json new file mode 100644 index 00000000000..94588d3dcb0 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-hpf8-j2rr-mhxw/GHSA-hpf8-j2rr-mhxw.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hpf8-j2rr-mhxw", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30597" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iografica IG Shortcodes allows DOM-Based XSS. This issue affects IG Shortcodes: from n/a through 3.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30597" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/ig-shortcodes/vulnerability/wordpress-ig-shortcodes-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:31Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-j54v-6438-jp89/GHSA-j54v-6438-jp89.json b/advisories/unreviewed/2025/03/GHSA-j54v-6438-jp89/GHSA-j54v-6438-jp89.json new file mode 100644 index 00000000000..e867f662f22 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-j54v-6438-jp89/GHSA-j54v-6438-jp89.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j54v-6438-jp89", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:48Z", + "aliases": [ + "CVE-2025-30600" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thiagogsrwp WP Hotjar allows Stored XSS. This issue affects WP Hotjar: from n/a through 0.0.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30600" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-hotjar/vulnerability/wordpress-wp-hotjar-plugin-0-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-j6qw-mm8g-6fjw/GHSA-j6qw-mm8g-6fjw.json b/advisories/unreviewed/2025/03/GHSA-j6qw-mm8g-6fjw/GHSA-j6qw-mm8g-6fjw.json index 2d5c2091428..bfe117a1360 100644 --- a/advisories/unreviewed/2025/03/GHSA-j6qw-mm8g-6fjw/GHSA-j6qw-mm8g-6fjw.json +++ b/advisories/unreviewed/2025/03/GHSA-j6qw-mm8g-6fjw/GHSA-j6qw-mm8g-6fjw.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-j6qw-mm8g-6fjw", - "modified": "2025-03-19T21:30:53Z", + "modified": "2025-03-24T15:30:39Z", "published": "2025-03-19T21:30:53Z", "aliases": [ "CVE-2025-30092" ], "details": "Intrexx Portal Server 12.x <= 12.0.2 and 11.x <= 11.9.2 allows XSS in multiple Velocity scripts.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-03-19T21:15:41Z" diff --git a/advisories/unreviewed/2025/03/GHSA-j7rr-hp2m-2rw4/GHSA-j7rr-hp2m-2rw4.json b/advisories/unreviewed/2025/03/GHSA-j7rr-hp2m-2rw4/GHSA-j7rr-hp2m-2rw4.json new file mode 100644 index 00000000000..9dfebfd5fac --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-j7rr-hp2m-2rw4/GHSA-j7rr-hp2m-2rw4.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j7rr-hp2m-2rw4", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30583" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in ProRankTracker Pro Rank Tracker allows Stored XSS. This issue affects Pro Rank Tracker: from n/a through 1.0.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30583" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/proranktracker/vulnerability/wordpress-pro-rank-tracker-plugin-1-0-0-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-jmqg-7x7f-3xhr/GHSA-jmqg-7x7f-3xhr.json b/advisories/unreviewed/2025/03/GHSA-jmqg-7x7f-3xhr/GHSA-jmqg-7x7f-3xhr.json index f7b9eac8a76..a0959ab6fa3 100644 --- a/advisories/unreviewed/2025/03/GHSA-jmqg-7x7f-3xhr/GHSA-jmqg-7x7f-3xhr.json +++ b/advisories/unreviewed/2025/03/GHSA-jmqg-7x7f-3xhr/GHSA-jmqg-7x7f-3xhr.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-jmqg-7x7f-3xhr", - "modified": "2025-03-24T12:30:29Z", + "modified": "2025-03-24T15:30:45Z", "published": "2025-03-24T12:30:29Z", "aliases": [ "CVE-2025-0835" ], "details": "Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -23,7 +28,7 @@ "cwe_ids": [ "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-03-24T12:15:13Z" diff --git a/advisories/unreviewed/2025/03/GHSA-jrwx-pqpc-96qx/GHSA-jrwx-pqpc-96qx.json b/advisories/unreviewed/2025/03/GHSA-jrwx-pqpc-96qx/GHSA-jrwx-pqpc-96qx.json new file mode 100644 index 00000000000..86704c44e3d --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-jrwx-pqpc-96qx/GHSA-jrwx-pqpc-96qx.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jrwx-pqpc-96qx", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:45Z", + "aliases": [ + "CVE-2025-30534" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in captcha.soft Image Captcha allows Cross Site Request Forgery. This issue affects Image Captcha: from n/a through 1.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30534" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/image-captcha/vulnerability/wordpress-image-captcha-plugin-1-2-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-m39g-fjx5-4827/GHSA-m39g-fjx5-4827.json b/advisories/unreviewed/2025/03/GHSA-m39g-fjx5-4827/GHSA-m39g-fjx5-4827.json new file mode 100644 index 00000000000..9e7e2029116 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-m39g-fjx5-4827/GHSA-m39g-fjx5-4827.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m39g-fjx5-4827", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30581" + ], + "details": "Missing Authorization vulnerability in PluginOps Top Bar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Top Bar: from n/a through 3.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30581" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/ultimate-bar/vulnerability/wordpress-top-bar-3-3-broken-access-control-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-m5f9-gqx8-j5gj/GHSA-m5f9-gqx8-j5gj.json b/advisories/unreviewed/2025/03/GHSA-m5f9-gqx8-j5gj/GHSA-m5f9-gqx8-j5gj.json new file mode 100644 index 00000000000..9cc3eb250de --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-m5f9-gqx8-j5gj/GHSA-m5f9-gqx8-j5gj.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m5f9-gqx8-j5gj", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:48Z", + "aliases": [ + "CVE-2025-30619" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in SpeakPipe SpeakPipe allows Cross Site Request Forgery. This issue affects SpeakPipe: from n/a through 0.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30619" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/speakpipe-voicemail-for-websites/vulnerability/wordpress-speakpipe-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:34Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-m97q-2pg2-grg9/GHSA-m97q-2pg2-grg9.json b/advisories/unreviewed/2025/03/GHSA-m97q-2pg2-grg9/GHSA-m97q-2pg2-grg9.json new file mode 100644 index 00000000000..e344327eb81 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-m97q-2pg2-grg9/GHSA-m97q-2pg2-grg9.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m97q-2pg2-grg9", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30540" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in avaibook AvaiBook allows Stored XSS. This issue affects AvaiBook: from n/a through 1.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30540" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/avaibook/vulnerability/wordpress-avaibook-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-m9gr-jfh8-79x2/GHSA-m9gr-jfh8-79x2.json b/advisories/unreviewed/2025/03/GHSA-m9gr-jfh8-79x2/GHSA-m9gr-jfh8-79x2.json new file mode 100644 index 00000000000..579e868dc4e --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-m9gr-jfh8-79x2/GHSA-m9gr-jfh8-79x2.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m9gr-jfh8-79x2", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30551" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smartredfox Pretty file links allows Stored XSS. This issue affects Pretty file links: from n/a through 0.9.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30551" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/pretty-file-links/vulnerability/wordpress-pretty-file-links-plugin-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-mj3m-mh6j-wfrh/GHSA-mj3m-mh6j-wfrh.json b/advisories/unreviewed/2025/03/GHSA-mj3m-mh6j-wfrh/GHSA-mj3m-mh6j-wfrh.json new file mode 100644 index 00000000000..20c49a7197b --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-mj3m-mh6j-wfrh/GHSA-mj3m-mh6j-wfrh.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mj3m-mh6j-wfrh", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:48Z", + "aliases": [ + "CVE-2025-30620" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in coderscom WP Odoo Form Integrator allows Stored XSS. This issue affects WP Odoo Form Integrator: from n/a through 1.1.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30620" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-odoo-form-integrator/vulnerability/wordpress-wp-odoo-form-integrator-plugin-1-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:34Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-mvhf-cmhg-7m43/GHSA-mvhf-cmhg-7m43.json b/advisories/unreviewed/2025/03/GHSA-mvhf-cmhg-7m43/GHSA-mvhf-cmhg-7m43.json new file mode 100644 index 00000000000..aef61af2efc --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-mvhf-cmhg-7m43/GHSA-mvhf-cmhg-7m43.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mvhf-cmhg-7m43", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30576" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog Remote Image Autosave allows Cross Site Request Forgery. This issue affects Hacklog Remote Image Autosave: from n/a through 2.1.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30576" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/hacklog-remote-image-autosave/vulnerability/wordpress-hacklog-remote-image-autosave-2-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-p3rh-58j4-qhhq/GHSA-p3rh-58j4-qhhq.json b/advisories/unreviewed/2025/03/GHSA-p3rh-58j4-qhhq/GHSA-p3rh-58j4-qhhq.json index 56ef799a659..49042c96c61 100644 --- a/advisories/unreviewed/2025/03/GHSA-p3rh-58j4-qhhq/GHSA-p3rh-58j4-qhhq.json +++ b/advisories/unreviewed/2025/03/GHSA-p3rh-58j4-qhhq/GHSA-p3rh-58j4-qhhq.json @@ -42,6 +42,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-639", "CWE-99" ], "severity": "MODERATE", diff --git a/advisories/unreviewed/2025/03/GHSA-p455-3f4r-4vgc/GHSA-p455-3f4r-4vgc.json b/advisories/unreviewed/2025/03/GHSA-p455-3f4r-4vgc/GHSA-p455-3f4r-4vgc.json new file mode 100644 index 00000000000..59d22441366 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-p455-3f4r-4vgc/GHSA-p455-3f4r-4vgc.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p455-3f4r-4vgc", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30572" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in Igor Yavych Simple Rating allows Stored XSS. This issue affects Simple Rating: from n/a through 1.4.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30572" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/simple-rating/vulnerability/wordpress-simple-rating-plugin-1-4-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-p753-73v7-m85r/GHSA-p753-73v7-m85r.json b/advisories/unreviewed/2025/03/GHSA-p753-73v7-m85r/GHSA-p753-73v7-m85r.json new file mode 100644 index 00000000000..f9f5bf3f041 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-p753-73v7-m85r/GHSA-p753-73v7-m85r.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p753-73v7-m85r", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30587" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in shawfactor LH OGP Meta allows Stored XSS. This issue affects LH OGP Meta: from n/a through 1.73.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30587" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/lh-ogp-meta-tags/vulnerability/wordpress-lh-ogp-meta-plugin-1-73-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-pff8-m8jx-77fj/GHSA-pff8-m8jx-77fj.json b/advisories/unreviewed/2025/03/GHSA-pff8-m8jx-77fj/GHSA-pff8-m8jx-77fj.json index 59f77451c23..204fb89be00 100644 --- a/advisories/unreviewed/2025/03/GHSA-pff8-m8jx-77fj/GHSA-pff8-m8jx-77fj.json +++ b/advisories/unreviewed/2025/03/GHSA-pff8-m8jx-77fj/GHSA-pff8-m8jx-77fj.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-pff8-m8jx-77fj", - "modified": "2025-03-24T12:30:29Z", + "modified": "2025-03-24T15:30:45Z", "published": "2025-03-24T12:30:29Z", "aliases": [ "CVE-2025-0478" ], "details": "Software installed and run as a non-privileged user may conduct improper GPU system calls to issue reads and writes to arbitrary physical memory pages.\n\nUnder certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform, altering their behaviour.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -23,7 +28,7 @@ "cwe_ids": [ "CWE-280" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-03-24T12:15:13Z" diff --git a/advisories/unreviewed/2025/03/GHSA-pfhc-9683-m6r9/GHSA-pfhc-9683-m6r9.json b/advisories/unreviewed/2025/03/GHSA-pfhc-9683-m6r9/GHSA-pfhc-9683-m6r9.json new file mode 100644 index 00000000000..3e6fd636466 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-pfhc-9683-m6r9/GHSA-pfhc-9683-m6r9.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pfhc-9683-m6r9", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30533" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Message ticker allows Stored XSS. This issue affects Message ticker: from n/a through 9.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30533" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/message-ticker/vulnerability/wordpress-message-ticker-plugin-9-3-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-pfv3-rmq3-8hrq/GHSA-pfv3-rmq3-8hrq.json b/advisories/unreviewed/2025/03/GHSA-pfv3-rmq3-8hrq/GHSA-pfv3-rmq3-8hrq.json index 7c6a2f250e2..dbfe7b61bf1 100644 --- a/advisories/unreviewed/2025/03/GHSA-pfv3-rmq3-8hrq/GHSA-pfv3-rmq3-8hrq.json +++ b/advisories/unreviewed/2025/03/GHSA-pfv3-rmq3-8hrq/GHSA-pfv3-rmq3-8hrq.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-94" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2025/03/GHSA-ph4h-xjvh-82m8/GHSA-ph4h-xjvh-82m8.json b/advisories/unreviewed/2025/03/GHSA-ph4h-xjvh-82m8/GHSA-ph4h-xjvh-82m8.json new file mode 100644 index 00000000000..38bed344abb --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-ph4h-xjvh-82m8/GHSA-ph4h-xjvh-82m8.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ph4h-xjvh-82m8", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30538" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in ChrisHurst Simple Optimizer allows Cross Site Request Forgery. This issue affects Simple Optimizer: from n/a through 1.2.7.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30538" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/simple-optimizer/vulnerability/wordpress-simple-optimizer-plugin-1-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-phgv-62jq-9jj7/GHSA-phgv-62jq-9jj7.json b/advisories/unreviewed/2025/03/GHSA-phgv-62jq-9jj7/GHSA-phgv-62jq-9jj7.json index b1f8d58d705..4a412178b04 100644 --- a/advisories/unreviewed/2025/03/GHSA-phgv-62jq-9jj7/GHSA-phgv-62jq-9jj7.json +++ b/advisories/unreviewed/2025/03/GHSA-phgv-62jq-9jj7/GHSA-phgv-62jq-9jj7.json @@ -50,7 +50,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-119" + "CWE-119", + "CWE-787" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/03/GHSA-pq47-r743-hrh5/GHSA-pq47-r743-hrh5.json b/advisories/unreviewed/2025/03/GHSA-pq47-r743-hrh5/GHSA-pq47-r743-hrh5.json new file mode 100644 index 00000000000..ebdd7821889 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-pq47-r743-hrh5/GHSA-pq47-r743-hrh5.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pq47-r743-hrh5", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:48Z", + "aliases": [ + "CVE-2024-55279" + ], + "details": "Uguu through 1.8.9 allows Cross Site Scripting (XSS) via JavaScript in XML files.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55279" + }, + { + "type": "WEB", + "url": "https://codeberg.org/zypressen/CVE-2024-55279" + }, + { + "type": "WEB", + "url": "https://github.com/nokonoko/Uguu" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T15:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-pq5f-gqjh-4crr/GHSA-pq5f-gqjh-4crr.json b/advisories/unreviewed/2025/03/GHSA-pq5f-gqjh-4crr/GHSA-pq5f-gqjh-4crr.json new file mode 100644 index 00000000000..2719e6d0154 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-pq5f-gqjh-4crr/GHSA-pq5f-gqjh-4crr.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pq5f-gqjh-4crr", + "modified": "2025-03-24T15:30:45Z", + "published": "2025-03-24T15:30:45Z", + "aliases": [ + "CVE-2025-30521" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in giangmd93 GP Back To Top allows Cross Site Request Forgery. This issue affects GP Back To Top: from n/a through 3.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30521" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/gp-back-to-top/vulnerability/wordpress-gp-back-to-top-plugin-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-pv39-24mp-673c/GHSA-pv39-24mp-673c.json b/advisories/unreviewed/2025/03/GHSA-pv39-24mp-673c/GHSA-pv39-24mp-673c.json new file mode 100644 index 00000000000..e462e26c4cb --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-pv39-24mp-673c/GHSA-pv39-24mp-673c.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pv39-24mp-673c", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30558" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in EnzoCostantini55 ANAC XML Render allows Stored XSS. This issue affects ANAC XML Render: from n/a through 1.5.7.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30558" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/anac-xml-render/vulnerability/wordpress-anac-xml-render-plugin-1-5-7-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-pvpj-pcvm-5frr/GHSA-pvpj-pcvm-5frr.json b/advisories/unreviewed/2025/03/GHSA-pvpj-pcvm-5frr/GHSA-pvpj-pcvm-5frr.json new file mode 100644 index 00000000000..6a7e83469d9 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-pvpj-pcvm-5frr/GHSA-pvpj-pcvm-5frr.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pvpj-pcvm-5frr", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30591" + ], + "details": "Missing Authorization vulnerability in tuyennv Music Press Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Music Press Pro: from n/a through 1.4.6.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30591" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/music-press-pro/vulnerability/wordpress-music-press-pro-1-4-6-broken-access-control-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:31Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-pvrp-6fjq-x9rj/GHSA-pvrp-6fjq-x9rj.json b/advisories/unreviewed/2025/03/GHSA-pvrp-6fjq-x9rj/GHSA-pvrp-6fjq-x9rj.json index 73d28bfaa56..3d33a39589e 100644 --- a/advisories/unreviewed/2025/03/GHSA-pvrp-6fjq-x9rj/GHSA-pvrp-6fjq-x9rj.json +++ b/advisories/unreviewed/2025/03/GHSA-pvrp-6fjq-x9rj/GHSA-pvrp-6fjq-x9rj.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-pvrp-6fjq-x9rj", - "modified": "2025-03-20T15:30:35Z", + "modified": "2025-03-24T15:30:39Z", "published": "2025-03-20T15:30:35Z", "aliases": [ "CVE-2024-48590" ], "details": "Inflectra SpiraTeam 7.2.00 is vulnerable to Server-Side Request Forgery (SSRF) via the NewsReaderService. This allows an attacker to escalate privileges and obtain sensitive information.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-918" + ], + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-03-20T14:15:20Z" diff --git a/advisories/unreviewed/2025/03/GHSA-q7g9-5h8f-gjrc/GHSA-q7g9-5h8f-gjrc.json b/advisories/unreviewed/2025/03/GHSA-q7g9-5h8f-gjrc/GHSA-q7g9-5h8f-gjrc.json index e2bd5710ae1..9304b68420a 100644 --- a/advisories/unreviewed/2025/03/GHSA-q7g9-5h8f-gjrc/GHSA-q7g9-5h8f-gjrc.json +++ b/advisories/unreviewed/2025/03/GHSA-q7g9-5h8f-gjrc/GHSA-q7g9-5h8f-gjrc.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-q7g9-5h8f-gjrc", - "modified": "2025-03-20T15:30:36Z", + "modified": "2025-03-24T15:30:39Z", "published": "2025-03-20T15:30:36Z", "aliases": [ "CVE-2025-29411" ], "details": "An arbitrary file upload vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-434" + ], + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-03-20T15:15:46Z" diff --git a/advisories/unreviewed/2025/03/GHSA-qgg8-h57v-vvhp/GHSA-qgg8-h57v-vvhp.json b/advisories/unreviewed/2025/03/GHSA-qgg8-h57v-vvhp/GHSA-qgg8-h57v-vvhp.json new file mode 100644 index 00000000000..3e599a26bf4 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-qgg8-h57v-vvhp/GHSA-qgg8-h57v-vvhp.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qgg8-h57v-vvhp", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:48Z", + "aliases": [ + "CVE-2025-30621" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in kornelly Translator allows Stored XSS. This issue affects Translator: from n/a through 0.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30621" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/translator/vulnerability/wordpress-translator-plugin-0-3-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:34Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-qjmf-hmm9-j3gg/GHSA-qjmf-hmm9-j3gg.json b/advisories/unreviewed/2025/03/GHSA-qjmf-hmm9-j3gg/GHSA-qjmf-hmm9-j3gg.json new file mode 100644 index 00000000000..bfed1719d51 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-qjmf-hmm9-j3gg/GHSA-qjmf-hmm9-j3gg.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qjmf-hmm9-j3gg", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30536" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zeitwesentech Beautiful Link Preview allows Stored XSS. This issue affects Beautiful Link Preview: from n/a through 1.5.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30536" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/beautiful-link-preview/vulnerability/wordpress-beautiful-link-preview-plugin-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-r5wg-rqqj-f266/GHSA-r5wg-rqqj-f266.json b/advisories/unreviewed/2025/03/GHSA-r5wg-rqqj-f266/GHSA-r5wg-rqqj-f266.json new file mode 100644 index 00000000000..3eaea60957c --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-r5wg-rqqj-f266/GHSA-r5wg-rqqj-f266.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r5wg-rqqj-f266", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:48Z", + "aliases": [ + "CVE-2025-30615" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in Jacob Schwartz WP e-Commerce Style Email allows Code Injection. This issue affects WP e-Commerce Style Email: from n/a through 0.6.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30615" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-e-commerce-style-email/vulnerability/wordpress-wp-e-commerce-style-email-plugin-0-6-2-csrf-to-remote-code-execution-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:34Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-r6cg-833c-677g/GHSA-r6cg-833c-677g.json b/advisories/unreviewed/2025/03/GHSA-r6cg-833c-677g/GHSA-r6cg-833c-677g.json new file mode 100644 index 00000000000..605ca3c5e15 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-r6cg-833c-677g/GHSA-r6cg-833c-677g.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r6cg-833c-677g", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30553" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Z.com byGMO GMO Font Agent allows Stored XSS. This issue affects GMO Font Agent: from n/a through 1.6.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30553" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/gmo-font-agent/vulnerability/wordpress-gmo-font-agent-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-rwvr-p4jr-43jx/GHSA-rwvr-p4jr-43jx.json b/advisories/unreviewed/2025/03/GHSA-rwvr-p4jr-43jx/GHSA-rwvr-p4jr-43jx.json new file mode 100644 index 00000000000..e465b8246ef --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-rwvr-p4jr-43jx/GHSA-rwvr-p4jr-43jx.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rwvr-p4jr-43jx", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:48Z", + "aliases": [ + "CVE-2025-30603" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in DEJAN CopyLink allows Stored XSS. This issue affects CopyLink: from n/a through 1.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30603" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/copy-link/vulnerability/wordpress-copylink-plugin-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-rx39-xq6v-h94h/GHSA-rx39-xq6v-h94h.json b/advisories/unreviewed/2025/03/GHSA-rx39-xq6v-h94h/GHSA-rx39-xq6v-h94h.json new file mode 100644 index 00000000000..a0bc0cf8a84 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-rx39-xq6v-h94h/GHSA-rx39-xq6v-h94h.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rx39-xq6v-h94h", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30545" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixeline issuuPress allows Stored XSS. This issue affects issuuPress: from n/a through 1.3.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30545" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/issuupress/vulnerability/wordpress-issuupress-plugin-1-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-v8w8-p4p3-g24w/GHSA-v8w8-p4p3-g24w.json b/advisories/unreviewed/2025/03/GHSA-v8w8-p4p3-g24w/GHSA-v8w8-p4p3-g24w.json new file mode 100644 index 00000000000..95db00f9134 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-v8w8-p4p3-g24w/GHSA-v8w8-p4p3-g24w.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v8w8-p4p3-g24w", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30564" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in wpwox Custom Script Integration allows Stored XSS. This issue affects Custom Script Integration: from n/a through 2.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30564" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/custom-script-integration/vulnerability/wordpress-custom-script-integration-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-v9hm-53m4-vfq7/GHSA-v9hm-53m4-vfq7.json b/advisories/unreviewed/2025/03/GHSA-v9hm-53m4-vfq7/GHSA-v9hm-53m4-vfq7.json new file mode 100644 index 00000000000..de4013b4622 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-v9hm-53m4-vfq7/GHSA-v9hm-53m4-vfq7.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v9hm-53m4-vfq7", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30535" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in muro External image replace allows Cross Site Request Forgery. This issue affects External image replace: from n/a through 1.0.8.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30535" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/external-image-replace/vulnerability/wordpress-external-image-replace-plugin-1-0-8-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-vmm2-mj96-p4p6/GHSA-vmm2-mj96-p4p6.json b/advisories/unreviewed/2025/03/GHSA-vmm2-mj96-p4p6/GHSA-vmm2-mj96-p4p6.json new file mode 100644 index 00000000000..044730f1f0d --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-vmm2-mj96-p4p6/GHSA-vmm2-mj96-p4p6.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vmm2-mj96-p4p6", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30575" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly Login Redirect allows Stored XSS. This issue affects Login Redirect: from n/a through 1.0.5.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30575" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/login-redirect/vulnerability/wordpress-login-redirect-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-vqv7-fc6q-fqfm/GHSA-vqv7-fc6q-fqfm.json b/advisories/unreviewed/2025/03/GHSA-vqv7-fc6q-fqfm/GHSA-vqv7-fc6q-fqfm.json new file mode 100644 index 00000000000..ff4f616f0b5 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-vqv7-fc6q-fqfm/GHSA-vqv7-fc6q-fqfm.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vqv7-fc6q-fqfm", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30598" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in Link OSS Upload allows Cross Site Request Forgery. This issue affects OSS Upload: from n/a through 4.8.9.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30598" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/oss-upload/vulnerability/wordpress-oss-upload-4-8-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-vr2p-p9qw-gwg7/GHSA-vr2p-p9qw-gwg7.json b/advisories/unreviewed/2025/03/GHSA-vr2p-p9qw-gwg7/GHSA-vr2p-p9qw-gwg7.json new file mode 100644 index 00000000000..1b24b8f46ea --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-vr2p-p9qw-gwg7/GHSA-vr2p-p9qw-gwg7.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vr2p-p9qw-gwg7", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:48Z", + "aliases": [ + "CVE-2025-30601" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in flipdish Flipdish Ordering System allows Cross Site Request Forgery. This issue affects Flipdish Ordering System: from n/a through 1.4.16.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30601" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/flipdish-ordering-system/vulnerability/wordpress-flipdish-ordering-system-plugin-1-4-16-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-vr3r-vj49-p3w8/GHSA-vr3r-vj49-p3w8.json b/advisories/unreviewed/2025/03/GHSA-vr3r-vj49-p3w8/GHSA-vr3r-vj49-p3w8.json new file mode 100644 index 00000000000..6a80792aa15 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-vr3r-vj49-p3w8/GHSA-vr3r-vj49-p3w8.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vr3r-vj49-p3w8", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30590" + ], + "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dourou Flickr set slideshows allows SQL Injection. This issue affects Flickr set slideshows: from n/a through 0.9.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30590" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/flickr-set-slideshows/vulnerability/wordpress-flickr-set-slideshows-0-9-sql-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:31Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-vr3x-j2hv-29ph/GHSA-vr3x-j2hv-29ph.json b/advisories/unreviewed/2025/03/GHSA-vr3x-j2hv-29ph/GHSA-vr3x-j2hv-29ph.json new file mode 100644 index 00000000000..3347f186f07 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-vr3x-j2hv-29ph/GHSA-vr3x-j2hv-29ph.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vr3x-j2hv-29ph", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30570" + ], + "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AliRezaMohammadi دکمه، شبکه اجتماعی خرید allows SQL Injection. This issue affects دکمه، شبکه اجتماعی خرید: from n/a through 2.0.6.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30570" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/dokme/vulnerability/wordpress-d-mh-shb-h-gtm-aa-khr-d-2-0-6-sql-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-w2q8-9gm9-xjhh/GHSA-w2q8-9gm9-xjhh.json b/advisories/unreviewed/2025/03/GHSA-w2q8-9gm9-xjhh/GHSA-w2q8-9gm9-xjhh.json new file mode 100644 index 00000000000..cfdd0b239e5 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-w2q8-9gm9-xjhh/GHSA-w2q8-9gm9-xjhh.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w2q8-9gm9-xjhh", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:48Z", + "aliases": [ + "CVE-2025-30612" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in mandegarweb Replace Default Words allows Stored XSS. This issue affects Replace Default Words: from n/a through 1.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30612" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/replace-default-words/vulnerability/wordpress-replace-default-words-plugin-1-3-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-w7jh-4v5p-jpjq/GHSA-w7jh-4v5p-jpjq.json b/advisories/unreviewed/2025/03/GHSA-w7jh-4v5p-jpjq/GHSA-w7jh-4v5p-jpjq.json new file mode 100644 index 00000000000..3afcd88f368 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-w7jh-4v5p-jpjq/GHSA-w7jh-4v5p-jpjq.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w7jh-4v5p-jpjq", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:48Z", + "aliases": [ + "CVE-2025-30623" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry wA11y – The Web Accessibility Toolbox allows Stored XSS. This issue affects wA11y – The Web Accessibility Toolbox: from n/a through 1.0.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30623" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wa11y/vulnerability/wordpress-wa11y-the-web-accessibility-toolbox-plugin-1-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:34Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-w9p6-9rjq-4546/GHSA-w9p6-9rjq-4546.json b/advisories/unreviewed/2025/03/GHSA-w9p6-9rjq-4546/GHSA-w9p6-9rjq-4546.json new file mode 100644 index 00000000000..8d95971aa69 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-w9p6-9rjq-4546/GHSA-w9p6-9rjq-4546.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w9p6-9rjq-4546", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30530" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atikul AI Preloader allows Stored XSS. This issue affects AI Preloader: from n/a through 1.0.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30530" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/ai-preloader/vulnerability/wordpress-ai-preloader-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-wpr8-w3v4-h4fx/GHSA-wpr8-w3v4-h4fx.json b/advisories/unreviewed/2025/03/GHSA-wpr8-w3v4-h4fx/GHSA-wpr8-w3v4-h4fx.json new file mode 100644 index 00000000000..d1faa5237ec --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-wpr8-w3v4-h4fx/GHSA-wpr8-w3v4-h4fx.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wpr8-w3v4-h4fx", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30561" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in Henrique Mouta CAS Maestro allows Stored XSS. This issue affects CAS Maestro: from n/a through 1.1.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30561" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/cas-maestro/vulnerability/wordpress-cas-maestro-plugin-1-1-3-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-wxqj-6r84-fw8r/GHSA-wxqj-6r84-fw8r.json b/advisories/unreviewed/2025/03/GHSA-wxqj-6r84-fw8r/GHSA-wxqj-6r84-fw8r.json new file mode 100644 index 00000000000..9c2c0e389e9 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-wxqj-6r84-fw8r/GHSA-wxqj-6r84-fw8r.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wxqj-6r84-fw8r", + "modified": "2025-03-24T15:30:47Z", + "published": "2025-03-24T15:30:47Z", + "aliases": [ + "CVE-2025-30593" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in samsk Include URL allows Stored XSS. This issue affects Include URL: from n/a through 0.3.5.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30593" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/include-url/vulnerability/wordpress-include-url-0-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:31Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-x8qg-fw97-xr4x/GHSA-x8qg-fw97-xr4x.json b/advisories/unreviewed/2025/03/GHSA-x8qg-fw97-xr4x/GHSA-x8qg-fw97-xr4x.json new file mode 100644 index 00000000000..c36aa125ec4 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-x8qg-fw97-xr4x/GHSA-x8qg-fw97-xr4x.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x8qg-fw97-xr4x", + "modified": "2025-03-24T15:30:46Z", + "published": "2025-03-24T15:30:46Z", + "aliases": [ + "CVE-2025-30543" + ], + "details": "Missing Authorization vulnerability in swayam.tejwani Menu Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Menu Duplicator: from n/a through 1.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30543" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/copy-menu/vulnerability/wordpress-menu-duplicator-plugin-1-0-broken-access-control-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-xg53-rgc9-jmqc/GHSA-xg53-rgc9-jmqc.json b/advisories/unreviewed/2025/03/GHSA-xg53-rgc9-jmqc/GHSA-xg53-rgc9-jmqc.json new file mode 100644 index 00000000000..a2df0f1174f --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-xg53-rgc9-jmqc/GHSA-xg53-rgc9-jmqc.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xg53-rgc9-jmqc", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:48Z", + "aliases": [ + "CVE-2025-30617" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in takien Rewrite allows Cross Site Request Forgery. This issue affects Rewrite: from n/a through 0.2.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30617" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/rewrite/vulnerability/wordpress-rewrite-0-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:34Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-xpp2-c63f-x3v5/GHSA-xpp2-c63f-x3v5.json b/advisories/unreviewed/2025/03/GHSA-xpp2-c63f-x3v5/GHSA-xpp2-c63f-x3v5.json new file mode 100644 index 00000000000..40e8609256c --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-xpp2-c63f-x3v5/GHSA-xpp2-c63f-x3v5.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xpp2-c63f-x3v5", + "modified": "2025-03-24T15:30:48Z", + "published": "2025-03-24T15:30:48Z", + "aliases": [ + "CVE-2025-30606" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Logan Carlile Easy Page Transition allows Stored XSS. This issue affects Easy Page Transition: from n/a through 1.0.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30606" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/easy-page-transition/vulnerability/wordpress-easy-page-transition-plugin-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-24T14:15:33Z" + } +} \ No newline at end of file