From 5f9f5a8555e877e7b95127dff92beed886c4bfde Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 5 Jun 2025 03:32:13 +0000
Subject: [PATCH] Publish Advisories

GHSA-jx2m-wgq5-5qcj
GHSA-2f2j-p95m-cpgc
GHSA-446v-89xj-w74v
GHSA-5wcp-7q3x-hqr4
GHSA-7rw4-hfv5-c2v2
GHSA-7xr5-9hcq-chf9
GHSA-c75r-6jvf-vrx7
GHSA-fq7j-84fx-gr99
GHSA-g433-v23v-rq82
GHSA-pxpm-gqm6-6pwh
GHSA-q54j-vxv9-x54v
---
 .../GHSA-jx2m-wgq5-5qcj.json                  |  6 +-
 .../GHSA-2f2j-p95m-cpgc.json                  | 40 +++++++++++++
 .../GHSA-446v-89xj-w74v.json                  | 56 +++++++++++++++++++
 .../GHSA-5wcp-7q3x-hqr4.json                  | 56 +++++++++++++++++++
 .../GHSA-7rw4-hfv5-c2v2.json                  | 56 +++++++++++++++++++
 .../GHSA-7xr5-9hcq-chf9.json                  | 48 ++++++++++++++++
 .../GHSA-c75r-6jvf-vrx7.json                  | 56 +++++++++++++++++++
 .../GHSA-fq7j-84fx-gr99.json                  | 52 +++++++++++++++++
 .../GHSA-g433-v23v-rq82.json                  | 56 +++++++++++++++++++
 .../GHSA-pxpm-gqm6-6pwh.json                  | 56 +++++++++++++++++++
 .../GHSA-q54j-vxv9-x54v.json                  | 56 +++++++++++++++++++
 11 files changed, 537 insertions(+), 1 deletion(-)
 create mode 100644 advisories/unreviewed/2025/06/GHSA-2f2j-p95m-cpgc/GHSA-2f2j-p95m-cpgc.json
 create mode 100644 advisories/unreviewed/2025/06/GHSA-446v-89xj-w74v/GHSA-446v-89xj-w74v.json
 create mode 100644 advisories/unreviewed/2025/06/GHSA-5wcp-7q3x-hqr4/GHSA-5wcp-7q3x-hqr4.json
 create mode 100644 advisories/unreviewed/2025/06/GHSA-7rw4-hfv5-c2v2/GHSA-7rw4-hfv5-c2v2.json
 create mode 100644 advisories/unreviewed/2025/06/GHSA-7xr5-9hcq-chf9/GHSA-7xr5-9hcq-chf9.json
 create mode 100644 advisories/unreviewed/2025/06/GHSA-c75r-6jvf-vrx7/GHSA-c75r-6jvf-vrx7.json
 create mode 100644 advisories/unreviewed/2025/06/GHSA-fq7j-84fx-gr99/GHSA-fq7j-84fx-gr99.json
 create mode 100644 advisories/unreviewed/2025/06/GHSA-g433-v23v-rq82/GHSA-g433-v23v-rq82.json
 create mode 100644 advisories/unreviewed/2025/06/GHSA-pxpm-gqm6-6pwh/GHSA-pxpm-gqm6-6pwh.json
 create mode 100644 advisories/unreviewed/2025/06/GHSA-q54j-vxv9-x54v/GHSA-q54j-vxv9-x54v.json

diff --git a/advisories/unreviewed/2025/05/GHSA-jx2m-wgq5-5qcj/GHSA-jx2m-wgq5-5qcj.json b/advisories/unreviewed/2025/05/GHSA-jx2m-wgq5-5qcj/GHSA-jx2m-wgq5-5qcj.json
index 63162e6faf6..5bd6ec9cdf7 100644
--- a/advisories/unreviewed/2025/05/GHSA-jx2m-wgq5-5qcj/GHSA-jx2m-wgq5-5qcj.json
+++ b/advisories/unreviewed/2025/05/GHSA-jx2m-wgq5-5qcj/GHSA-jx2m-wgq5-5qcj.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-jx2m-wgq5-5qcj",
-  "modified": "2025-05-30T15:30:31Z",
+  "modified": "2025-06-05T03:30:58Z",
   "published": "2025-05-30T15:30:31Z",
   "aliases": [
     "CVE-2025-4598"
@@ -30,6 +30,10 @@
     {
       "type": "WEB",
       "url": "https://www.openwall.com/lists/oss-security/2025/05/29/3"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2025/06/05/1"
     }
   ],
   "database_specific": {
diff --git a/advisories/unreviewed/2025/06/GHSA-2f2j-p95m-cpgc/GHSA-2f2j-p95m-cpgc.json b/advisories/unreviewed/2025/06/GHSA-2f2j-p95m-cpgc/GHSA-2f2j-p95m-cpgc.json
new file mode 100644
index 00000000000..8ea49a15bc9
--- /dev/null
+++ b/advisories/unreviewed/2025/06/GHSA-2f2j-p95m-cpgc/GHSA-2f2j-p95m-cpgc.json
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2f2j-p95m-cpgc",
+  "modified": "2025-06-05T03:30:59Z",
+  "published": "2025-06-05T03:30:59Z",
+  "aliases": [
+    "CVE-2025-49466"
+  ],
+  "details": "aerc before 93bec0d allows directory traversal in commands/msgview/open.go because of direct path concatenation of the name of an attachment part,",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49466"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.sr.ht/~rjarry/aerc/commit/2bbe75fe0bc87ab4c1e16c5a18c6200224391629"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.sr.ht/~rjarry/aerc/commit/93bec0de8ed5ab3d6b1f01026fe2ef20fa154329"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-23"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-06-05T03:15:26Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/06/GHSA-446v-89xj-w74v/GHSA-446v-89xj-w74v.json b/advisories/unreviewed/2025/06/GHSA-446v-89xj-w74v/GHSA-446v-89xj-w74v.json
new file mode 100644
index 00000000000..fb118e1f8d6
--- /dev/null
+++ b/advisories/unreviewed/2025/06/GHSA-446v-89xj-w74v/GHSA-446v-89xj-w74v.json
@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-446v-89xj-w74v",
+  "modified": "2025-06-05T03:30:58Z",
+  "published": "2025-06-05T03:30:58Z",
+  "aliases": [
+    "CVE-2025-5625"
+  ],
+  "details": "A vulnerability was found in Campcodes Online Teacher Record Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /search-teacher.php. The manipulation of the argument searchteacher leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5625"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/nikeWRL/CVE-/issues/1"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.311111"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.311111"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.589279"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.campcodes.com"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-74"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-06-05T01:15:21Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/06/GHSA-5wcp-7q3x-hqr4/GHSA-5wcp-7q3x-hqr4.json b/advisories/unreviewed/2025/06/GHSA-5wcp-7q3x-hqr4/GHSA-5wcp-7q3x-hqr4.json
new file mode 100644
index 00000000000..b053e0f1186
--- /dev/null
+++ b/advisories/unreviewed/2025/06/GHSA-5wcp-7q3x-hqr4/GHSA-5wcp-7q3x-hqr4.json
@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5wcp-7q3x-hqr4",
+  "modified": "2025-06-05T03:30:58Z",
+  "published": "2025-06-05T03:30:58Z",
+  "aliases": [
+    "CVE-2025-5627"
+  ],
+  "details": "A vulnerability classified as critical was found in code-projects Patient Record Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /sputum_form.php. The manipulation of the argument itr_no leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5627"
+    },
+    {
+      "type": "WEB",
+      "url": "https://code-projects.org"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/bazhahei123/CVE/blob/main/sql_cve_6_3.pdf"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.311113"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.311113"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.589364"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-74"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-06-05T01:15:21Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/06/GHSA-7rw4-hfv5-c2v2/GHSA-7rw4-hfv5-c2v2.json b/advisories/unreviewed/2025/06/GHSA-7rw4-hfv5-c2v2/GHSA-7rw4-hfv5-c2v2.json
new file mode 100644
index 00000000000..c82656e1b97
--- /dev/null
+++ b/advisories/unreviewed/2025/06/GHSA-7rw4-hfv5-c2v2/GHSA-7rw4-hfv5-c2v2.json
@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7rw4-hfv5-c2v2",
+  "modified": "2025-06-05T03:30:58Z",
+  "published": "2025-06-05T03:30:58Z",
+  "aliases": [
+    "CVE-2025-5626"
+  ],
+  "details": "A vulnerability classified as critical has been found in Campcodes Online Teacher Record Management System 1.0. Affected is an unknown function of the file /admin/edit-subjects-detail.php. The manipulation of the argument editid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5626"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/nikeWRL/CVE-/issues/2"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.311112"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.311112"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.589309"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.campcodes.com"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-74"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-06-05T01:15:21Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/06/GHSA-7xr5-9hcq-chf9/GHSA-7xr5-9hcq-chf9.json b/advisories/unreviewed/2025/06/GHSA-7xr5-9hcq-chf9/GHSA-7xr5-9hcq-chf9.json
new file mode 100644
index 00000000000..8d89ce6d7e6
--- /dev/null
+++ b/advisories/unreviewed/2025/06/GHSA-7xr5-9hcq-chf9/GHSA-7xr5-9hcq-chf9.json
@@ -0,0 +1,48 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7xr5-9hcq-chf9",
+  "modified": "2025-06-05T03:30:59Z",
+  "published": "2025-06-05T03:30:58Z",
+  "aliases": [
+    "CVE-2025-48432"
+  ],
+  "details": "An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48432"
+    },
+    {
+      "type": "WEB",
+      "url": "https://docs.djangoproject.com/en/dev/releases/security"
+    },
+    {
+      "type": "WEB",
+      "url": "https://groups.google.com/g/django-announce"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.djangoproject.com/weblog/2025/jun/04/security-releases"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2025/06/04/5"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-117"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-06-05T03:15:25Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/06/GHSA-c75r-6jvf-vrx7/GHSA-c75r-6jvf-vrx7.json b/advisories/unreviewed/2025/06/GHSA-c75r-6jvf-vrx7/GHSA-c75r-6jvf-vrx7.json
new file mode 100644
index 00000000000..7b538e4b68f
--- /dev/null
+++ b/advisories/unreviewed/2025/06/GHSA-c75r-6jvf-vrx7/GHSA-c75r-6jvf-vrx7.json
@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-c75r-6jvf-vrx7",
+  "modified": "2025-06-05T03:30:59Z",
+  "published": "2025-06-05T03:30:59Z",
+  "aliases": [
+    "CVE-2025-5630"
+  ],
+  "details": "A vulnerability has been found in D-Link DIR-816 1.10CNB05 and classified as critical. This vulnerability affects unknown code of the file /goform/form2lansetup.cgi. The manipulation of the argument ip leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5630"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/wudipjq/my_vuln/blob/main/D-Link5/vuln_54/54.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.311116"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.311116"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.589779"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.dlink.com"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-119"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-06-05T03:15:27Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/06/GHSA-fq7j-84fx-gr99/GHSA-fq7j-84fx-gr99.json b/advisories/unreviewed/2025/06/GHSA-fq7j-84fx-gr99/GHSA-fq7j-84fx-gr99.json
new file mode 100644
index 00000000000..4b284851590
--- /dev/null
+++ b/advisories/unreviewed/2025/06/GHSA-fq7j-84fx-gr99/GHSA-fq7j-84fx-gr99.json
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-fq7j-84fx-gr99",
+  "modified": "2025-06-05T03:30:59Z",
+  "published": "2025-06-05T03:30:59Z",
+  "aliases": [
+    "CVE-2025-5631"
+  ],
+  "details": "A vulnerability was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. It has been classified as critical. Affected is an unknown function of the file /publicposts.php. The manipulation of the argument post leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5631"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/YZS17/CVE/blob/main/NEWS-BUZZ/sqli_publicposts.php_post.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.311118"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.311118"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.589780"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-74"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-06-05T03:15:27Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/06/GHSA-g433-v23v-rq82/GHSA-g433-v23v-rq82.json b/advisories/unreviewed/2025/06/GHSA-g433-v23v-rq82/GHSA-g433-v23v-rq82.json
new file mode 100644
index 00000000000..d48e4b3edaa
--- /dev/null
+++ b/advisories/unreviewed/2025/06/GHSA-g433-v23v-rq82/GHSA-g433-v23v-rq82.json
@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-g433-v23v-rq82",
+  "modified": "2025-06-05T03:30:58Z",
+  "published": "2025-06-05T03:30:58Z",
+  "aliases": [
+    "CVE-2025-5628"
+  ],
+  "details": "A vulnerability, which was classified as problematic, has been found in SourceCodester Food Menu Manager 1.0. Affected by this issue is some unknown functionality of the file /index.php of the component Add Menu Handler. The manipulation of the argument name/description leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5628"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mysq13/CVE/issues/1"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.311114"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.311114"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.589365"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.sourcecodester.com"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-06-05T02:15:24Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/06/GHSA-pxpm-gqm6-6pwh/GHSA-pxpm-gqm6-6pwh.json b/advisories/unreviewed/2025/06/GHSA-pxpm-gqm6-6pwh/GHSA-pxpm-gqm6-6pwh.json
new file mode 100644
index 00000000000..39086b0a97d
--- /dev/null
+++ b/advisories/unreviewed/2025/06/GHSA-pxpm-gqm6-6pwh/GHSA-pxpm-gqm6-6pwh.json
@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-pxpm-gqm6-6pwh",
+  "modified": "2025-06-05T03:30:59Z",
+  "published": "2025-06-05T03:30:59Z",
+  "aliases": [
+    "CVE-2025-5629"
+  ],
+  "details": "A vulnerability, which was classified as critical, was found in Tenda AC10 up to 15.03.06.47. This affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg of the component HTTP Handler. The manipulation of the argument startIp/endIp leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5629"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pfwqdxwdd/cve/blob/main/4.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.311115"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.311115"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.589424"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.tenda.com.cn"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-119"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-06-05T03:15:26Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/06/GHSA-q54j-vxv9-x54v/GHSA-q54j-vxv9-x54v.json b/advisories/unreviewed/2025/06/GHSA-q54j-vxv9-x54v/GHSA-q54j-vxv9-x54v.json
new file mode 100644
index 00000000000..535d2c1d995
--- /dev/null
+++ b/advisories/unreviewed/2025/06/GHSA-q54j-vxv9-x54v/GHSA-q54j-vxv9-x54v.json
@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-q54j-vxv9-x54v",
+  "modified": "2025-06-05T03:30:58Z",
+  "published": "2025-06-05T03:30:58Z",
+  "aliases": [
+    "CVE-2025-5624"
+  ],
+  "details": "A vulnerability was found in D-Link DIR-816 1.10CNB05. It has been declared as critical. This vulnerability affects the function QoSPortSetup of the file /goform/QoSPortSetup. The manipulation of the argument port0_group/port0_remarker/ssid0_group/ssid0_remarker leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5624"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/wudipjq/my_vuln/blob/main/D-Link5/vuln_53/53.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.311110"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.311110"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.589226"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.dlink.com"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-119"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-06-05T01:15:21Z"
+  }
+}
\ No newline at end of file