diff --git a/advisories/unreviewed/2025/03/GHSA-23g7-m523-p43j/GHSA-23g7-m523-p43j.json b/advisories/unreviewed/2025/03/GHSA-23g7-m523-p43j/GHSA-23g7-m523-p43j.json new file mode 100644 index 00000000000..8771564ea2c --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-23g7-m523-p43j/GHSA-23g7-m523-p43j.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-23g7-m523-p43j", + "modified": "2025-03-16T06:30:24Z", + "published": "2025-03-16T06:30:23Z", + "aliases": [ + "CVE-2025-1619" + ], + "details": "The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1619" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/ae9bc19d-1634-4501-a258-8c56b2afee88" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-16T06:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-3ph6-cjjg-96q6/GHSA-3ph6-cjjg-96q6.json b/advisories/unreviewed/2025/03/GHSA-3ph6-cjjg-96q6/GHSA-3ph6-cjjg-96q6.json new file mode 100644 index 00000000000..c4c796b0990 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-3ph6-cjjg-96q6/GHSA-3ph6-cjjg-96q6.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3ph6-cjjg-96q6", + "modified": "2025-03-16T06:30:24Z", + "published": "2025-03-16T06:30:24Z", + "aliases": [ + "CVE-2025-1620" + ], + "details": "The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1620" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/923db805-92e7-4489-8e57-374a19f817d7" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-16T06:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-5g2r-4fp2-x498/GHSA-5g2r-4fp2-x498.json b/advisories/unreviewed/2025/03/GHSA-5g2r-4fp2-x498/GHSA-5g2r-4fp2-x498.json new file mode 100644 index 00000000000..60304bfd39f --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-5g2r-4fp2-x498/GHSA-5g2r-4fp2-x498.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5g2r-4fp2-x498", + "modified": "2025-03-16T06:30:24Z", + "published": "2025-03-16T06:30:24Z", + "aliases": [ + "CVE-2025-1622" + ], + "details": "The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1622" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/7a903d61-2792-4fe0-a26b-f400f4a3124b" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-16T06:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-jh5p-2xj5-gpc8/GHSA-jh5p-2xj5-gpc8.json b/advisories/unreviewed/2025/03/GHSA-jh5p-2xj5-gpc8/GHSA-jh5p-2xj5-gpc8.json new file mode 100644 index 00000000000..529a452ecdb --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-jh5p-2xj5-gpc8/GHSA-jh5p-2xj5-gpc8.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jh5p-2xj5-gpc8", + "modified": "2025-03-16T06:30:24Z", + "published": "2025-03-16T06:30:24Z", + "aliases": [ + "CVE-2025-1624" + ], + "details": "The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1624" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/2f4a402a-97f6-4638-9ce0-456ccd5606e9" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-16T06:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-mmcw-cwf5-8442/GHSA-mmcw-cwf5-8442.json b/advisories/unreviewed/2025/03/GHSA-mmcw-cwf5-8442/GHSA-mmcw-cwf5-8442.json new file mode 100644 index 00000000000..057b3fd53e8 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-mmcw-cwf5-8442/GHSA-mmcw-cwf5-8442.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mmcw-cwf5-8442", + "modified": "2025-03-16T06:30:24Z", + "published": "2025-03-16T06:30:24Z", + "aliases": [ + "CVE-2025-1623" + ], + "details": "The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1623" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/40288fa0-50c6-4e13-9b92-968b060d3bf5" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-16T06:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-pwf9-q62p-v7wc/GHSA-pwf9-q62p-v7wc.json b/advisories/unreviewed/2025/03/GHSA-pwf9-q62p-v7wc/GHSA-pwf9-q62p-v7wc.json new file mode 100644 index 00000000000..43295c82a9c --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-pwf9-q62p-v7wc/GHSA-pwf9-q62p-v7wc.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pwf9-q62p-v7wc", + "modified": "2025-03-16T06:30:23Z", + "published": "2025-03-16T06:30:23Z", + "aliases": [ + "CVE-2024-58103" + ], + "details": "Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58103" + }, + { + "type": "WEB", + "url": "https://github.com/square/wire/commit/b90e60c09befaff836a2fc2ee4d678451b2ec75d" + }, + { + "type": "WEB", + "url": "https://github.com/square/wire/compare/5.1.0...5.2.0" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-674" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-16T04:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-qjx4-5xpx-3mfc/GHSA-qjx4-5xpx-3mfc.json b/advisories/unreviewed/2025/03/GHSA-qjx4-5xpx-3mfc/GHSA-qjx4-5xpx-3mfc.json new file mode 100644 index 00000000000..cd5ecb10285 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-qjx4-5xpx-3mfc/GHSA-qjx4-5xpx-3mfc.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qjx4-5xpx-3mfc", + "modified": "2025-03-16T06:30:23Z", + "published": "2025-03-16T06:30:23Z", + "aliases": [ + "CVE-2024-13602" + ], + "details": "The Poll Maker WordPress plugin before 5.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13602" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/05d5010b-94eb-4fd3-b962-e2a16c032b71" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-16T06:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-wmq7-vc7f-g5r2/GHSA-wmq7-vc7f-g5r2.json b/advisories/unreviewed/2025/03/GHSA-wmq7-vc7f-g5r2/GHSA-wmq7-vc7f-g5r2.json new file mode 100644 index 00000000000..75505cdbeeb --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-wmq7-vc7f-g5r2/GHSA-wmq7-vc7f-g5r2.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wmq7-vc7f-g5r2", + "modified": "2025-03-16T06:30:24Z", + "published": "2025-03-16T06:30:24Z", + "aliases": [ + "CVE-2025-1621" + ], + "details": "The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1621" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/c30b9631-2024-4081-9cc5-8294a77c5ebb" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-16T06:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-xcfp-c436-mm2r/GHSA-xcfp-c436-mm2r.json b/advisories/unreviewed/2025/03/GHSA-xcfp-c436-mm2r/GHSA-xcfp-c436-mm2r.json new file mode 100644 index 00000000000..788eb18e95e --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-xcfp-c436-mm2r/GHSA-xcfp-c436-mm2r.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xcfp-c436-mm2r", + "modified": "2025-03-16T06:30:23Z", + "published": "2025-03-16T06:30:23Z", + "aliases": [ + "CVE-2024-13126" + ], + "details": "The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13126" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/c2c69a44-4ecc-41d1-a10c-cfe9c875b803" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-16T06:15:11Z" + } +} \ No newline at end of file