netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2982-34wj-7m53
GHSA-36jv-w59f-85w3
GHSA-3rfj-x9v3-777c
GHSA-5gp3-3rvx-qhx2
GHSA-cc29-mj6j-7rfp
GHSA-f6f3-grvj-5rhr
GHSA-fq8g-w74w-m345
GHSA-jqcw-jj5v-2h9g
GHSA-mgcr-297w-jg79
GHSA-mwp5-6mcm-q9cq
GHSA-qq4f-qwj9-p7pg
GHSA-rfhm-m5c8-xx3j
GHSA-vv97-g4jh-67w7
GHSA-vwgf-9vcj-w93c
GHSA-wfgm-35m4-w39j
This commit is contained in:
advisory-database[bot]
2025-05-01 06:32:01 +00:00
parent 9542b3e350
commit 679078cf2c
15 changed files with 668 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/05/GHSA-2982-34wj-7m53/GHSA-2982-34wj-7m53.json
+48
View File
@@ -0,0 +1,48 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2982-34wj-7m53",
"modified": "2025-05-01T06:30:27Z",
"published": "2025-05-01T06:30:27Z",
"aliases": [
"CVE-2025-2168"
],
"details": "The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1. This is due to missing or incorrect nonce validation on the dismiss() function. This makes it possible for unauthenticated attackers to set arbitrary user meta values to `1` which can be leveraged to lock and administrator out of their site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2168"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/ultimate-store-kit/tags/2.3.6/admin/admin-notice.php#L43"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3255125/ultimate-store-kit/trunk/admin/admin-notice.php"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3283438/ultimate-store-kit/trunk/admin/admin-notice.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a48634d7-30c9-4124-87dd-93a303a969eb?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T04:16:53Z"
}
}
advisories/unreviewed/2025/05/GHSA-36jv-w59f-85w3/GHSA-36jv-w59f-85w3.json
+29
View File
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-36jv-w59f-85w3",
"modified": "2025-05-01T06:30:28Z",
"published": "2025-05-01T06:30:28Z",
"aliases": [
"CVE-2025-3504"
],
"details": "The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3504"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/252484a6-96f0-43f3-a7dc-d20cc89ba119"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T06:15:35Z"
}
}
advisories/unreviewed/2025/05/GHSA-3rfj-x9v3-777c/GHSA-3rfj-x9v3-777c.json
+44
View File
@@ -0,0 +1,44 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3rfj-x9v3-777c",
"modified": "2025-05-01T06:30:26Z",
"published": "2025-05-01T06:30:26Z",
"aliases": [
"CVE-2025-1305"
],
"details": "The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1305"
},
{
"type": "WEB",
"url": "https://themes.trac.wordpress.org/browser/newsblogger/0.2/functions.php#L440"
},
{
"type": "WEB",
"url": "https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=269615%40newsblogger&new=269615%40newsblogger&sfp_email=&sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b2cac27-4a36-490f-b2d8-3c6f32843a38?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T04:16:47Z"
}
}
advisories/unreviewed/2025/05/GHSA-5gp3-3rvx-qhx2/GHSA-5gp3-3rvx-qhx2.json
+29
View File
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5gp3-3rvx-qhx2",
"modified": "2025-05-01T06:30:28Z",
"published": "2025-05-01T06:30:28Z",
"aliases": [
"CVE-2024-13381"
],
"details": "The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13381"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/da099e52-7f7b-4d76-a0bc-a46315510e0a"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T06:15:33Z"
}
}
advisories/unreviewed/2025/05/GHSA-cc29-mj6j-7rfp/GHSA-cc29-mj6j-7rfp.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cc29-mj6j-7rfp",
"modified": "2025-05-01T06:30:26Z",
"published": "2025-05-01T06:30:26Z",
"aliases": [
"CVE-2025-1304"
],
"details": "The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin() function in all versions up to, and including, 0.2.5.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1304"
},
{
"type": "WEB",
"url": "https://themes.trac.wordpress.org/browser/newsblogger/0.2.5.5/functions.php?annotate=blame&rev=269615#file2"
},
{
"type": "WEB",
"url": "https://themes.trac.wordpress.org/browser/newsblogger/0.2/functions.php#L440"
},
{
"type": "WEB",
"url": "https://themes.trac.wordpress.org/browser/newsblogger/0.2/functions.php#L461"
},
{
"type": "WEB",
"url": "https://themes.trac.wordpress.org/browser/newsblogger/0.2/functions.php#L470"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/85cea6b5-d57b-495e-a504-a0c1ba691637?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T04:16:43Z"
}
}
advisories/unreviewed/2025/05/GHSA-f6f3-grvj-5rhr/GHSA-f6f3-grvj-5rhr.json
+29
View File
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f6f3-grvj-5rhr",
"modified": "2025-05-01T06:30:28Z",
"published": "2025-05-01T06:30:28Z",
"aliases": [
"CVE-2025-3502"
],
"details": "The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3502"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/dd436064-e611-4a4b-a873-67ed6029c46f"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T06:15:34Z"
}
}
advisories/unreviewed/2025/05/GHSA-fq8g-w74w-m345/GHSA-fq8g-w74w-m345.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fq8g-w74w-m345",
"modified": "2025-05-01T06:30:27Z",
"published": "2025-05-01T06:30:27Z",
"aliases": [
"CVE-2025-4148"
],
"details": "A vulnerability was found in Netgear EX6200 1.0.3.94 and classified as critical. Affected by this issue is the function sub_503FC. The manipulation of the argument host leads to buffer overflow. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4148"
},
{
"type": "WEB",
"url": "https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_ex6200/Buffer_overflow-sub_503FC-gui_region/README.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.306680"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.306680"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.560802"
},
{
"type": "WEB",
"url": "https://www.netgear.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T04:16:58Z"
}
}
advisories/unreviewed/2025/05/GHSA-jqcw-jj5v-2h9g/GHSA-jqcw-jj5v-2h9g.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jqcw-jj5v-2h9g",
"modified": "2025-05-01T06:30:28Z",
"published": "2025-05-01T06:30:28Z",
"aliases": [
"CVE-2025-4152"
],
"details": "A vulnerability classified as critical has been found in PHPGurukul Online Birth Certificate System 1.0. Affected is an unknown function of the file /admin/bwdates-reports-details.php. The manipulation of the argument fromdate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4152"
},
{
"type": "WEB",
"url": "https://github.com/faithhard/cve/issues/2"
},
{
"type": "WEB",
"url": "https://phpgurukul.com"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.306684"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.306684"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.560808"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T06:15:35Z"
}
}
advisories/unreviewed/2025/05/GHSA-mgcr-297w-jg79/GHSA-mgcr-297w-jg79.json
+44
View File
@@ -0,0 +1,44 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mgcr-297w-jg79",
"modified": "2025-05-01T06:30:27Z",
"published": "2025-05-01T06:30:27Z",
"aliases": [
"CVE-2025-3952"
],
"details": "The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'pto_remove_logo' function in all versions up to, and including, 5.1.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3952"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/projectopia-core/trunk/includes/functions/admin/admin_functions.php#L838"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3284330"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/de7489e8-fe18-4a80-832c-aa62424c538b?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T05:15:52Z"
}
}
advisories/unreviewed/2025/05/GHSA-mwp5-6mcm-q9cq/GHSA-mwp5-6mcm-q9cq.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mwp5-6mcm-q9cq",
"modified": "2025-05-01T06:30:28Z",
"published": "2025-05-01T06:30:28Z",
"aliases": [
"CVE-2025-4151"
],
"details": "A vulnerability was found in PHPGurukul Curfew e-Pass Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/pass-bwdates-reports-details.php. The manipulation of the argument fromdate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4151"
},
{
"type": "WEB",
"url": "https://github.com/faithhard/cve/issues/1"
},
{
"type": "WEB",
"url": "https://phpgurukul.com"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.306683"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.306683"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.560806"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T06:15:35Z"
}
}
advisories/unreviewed/2025/05/GHSA-qq4f-qwj9-p7pg/GHSA-qq4f-qwj9-p7pg.json
+29
View File
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qq4f-qwj9-p7pg",
"modified": "2025-05-01T06:30:28Z",
"published": "2025-05-01T06:30:28Z",
"aliases": [
"CVE-2025-3503"
],
"details": "The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3503"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/83ddd432-309f-4ff5-974c-fdc9c67d1051"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T06:15:34Z"
}
}
advisories/unreviewed/2025/05/GHSA-rfhm-m5c8-xx3j/GHSA-rfhm-m5c8-xx3j.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rfhm-m5c8-xx3j",
"modified": "2025-05-01T06:30:27Z",
"published": "2025-05-01T06:30:27Z",
"aliases": [
"CVE-2025-4149"
],
"details": "A vulnerability was found in Netgear EX6200 1.0.3.94. It has been classified as critical. This affects the function sub_54014. The manipulation of the argument host leads to buffer overflow. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4149"
},
{
"type": "WEB",
"url": "https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_ex6200/Buffer_overflow-sub_54014-gui_region/README.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.306681"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.306681"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.560803"
},
{
"type": "WEB",
"url": "https://www.netgear.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T04:16:58Z"
}
}
advisories/unreviewed/2025/05/GHSA-vv97-g4jh-67w7/GHSA-vv97-g4jh-67w7.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vv97-g4jh-67w7",
"modified": "2025-05-01T06:30:28Z",
"published": "2025-05-01T06:30:27Z",
"aliases": [
"CVE-2025-4150"
],
"details": "A vulnerability was found in Netgear EX6200 1.0.3.94. It has been declared as critical. This vulnerability affects the function sub_54340. The manipulation of the argument host leads to buffer overflow. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4150"
},
{
"type": "WEB",
"url": "https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_ex6200/Buffer_overflow-sub_54340-gui_region/README.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.306682"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.306682"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.560804"
},
{
"type": "WEB",
"url": "https://www.netgear.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T05:15:52Z"
}
}
advisories/unreviewed/2025/05/GHSA-vwgf-9vcj-w93c/GHSA-vwgf-9vcj-w93c.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vwgf-9vcj-w93c",
"modified": "2025-05-01T06:30:27Z",
"published": "2025-05-01T06:30:27Z",
"aliases": [
"CVE-2024-13845"
],
"details": "The Gravity Forms WebHooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.0 via the 'process_feed' method of the GF_Webhooks class This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13845"
},
{
"type": "WEB",
"url": "https://www.gravityforms.com/blog/brand-new-release-webhooks-add-on-1-7"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9311b20b-daad-408f-a1a0-d1e42573ab97?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T05:15:51Z"
}
}
advisories/unreviewed/2025/05/GHSA-wfgm-35m4-w39j/GHSA-wfgm-35m4-w39j.json
+44
View File
@@ -0,0 +1,44 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wfgm-35m4-w39j",
"modified": "2025-05-01T06:30:27Z",
"published": "2025-05-01T06:30:27Z",
"aliases": [
"CVE-2025-4099"
],
"details": "The List Children plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'list_children' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4099"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/list-children/trunk/list_children.php#L26"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3284430"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/538b4d4b-f8c6-44db-89d2-d345bfbfecb2?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T05:15:52Z"
}
}