netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2qvw-44pq-38xj
GHSA-4mpp-jp65-h4rw
GHSA-9fw4-p66g-p3hh
GHSA-m6j5-92q7-225w
GHSA-p345-jmhp-7wg2
GHSA-p5jf-h6mx-5w8x
GHSA-xp8f-rxxq-p5wv
This commit is contained in:
advisory-database[bot]
2025-04-17 06:32:20 +00:00
parent 31ce1df65a
commit 7d305ebd12
7 changed files with 225 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/04/GHSA-2qvw-44pq-38xj/GHSA-2qvw-44pq-38xj.json
+29
View File
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2qvw-44pq-38xj",
"modified": "2025-04-17T06:30:35Z",
"published": "2025-04-17T06:30:35Z",
"aliases": [
"CVE-2025-1525"
],
"details": "The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1525"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/d457733f-72e9-45e2-ac07-4e1b94e46102"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-17T06:15:43Z"
}
}
advisories/unreviewed/2025/04/GHSA-4mpp-jp65-h4rw/GHSA-4mpp-jp65-h4rw.json
+29
View File
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4mpp-jp65-h4rw",
"modified": "2025-04-17T06:30:35Z",
"published": "2025-04-17T06:30:35Z",
"aliases": [
"CVE-2025-1523"
],
"details": "The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1523"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/5a20768f-3128-4b0a-a06b-2247f3e02c99"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-17T06:15:43Z"
}
}
advisories/unreviewed/2025/04/GHSA-9fw4-p66g-p3hh/GHSA-9fw4-p66g-p3hh.json
+29
View File
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9fw4-p66g-p3hh",
"modified": "2025-04-17T06:30:35Z",
"published": "2025-04-17T06:30:35Z",
"aliases": [
"CVE-2025-1524"
],
"details": "The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1524"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/36aed1e4-05cb-42d2-b835-f6336f1a82cd"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-17T06:15:43Z"
}
}
advisories/unreviewed/2025/04/GHSA-m6j5-92q7-225w/GHSA-m6j5-92q7-225w.json
+29
View File
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m6j5-92q7-225w",
"modified": "2025-04-17T06:30:35Z",
"published": "2025-04-17T06:30:35Z",
"aliases": [
"CVE-2024-13925"
],
"details": "The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per request. This can result in rapid consumption of disk space, potentially filling the entire disk.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13925"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/6aebb52f-d74a-4043-86c4-c24579f24ef4"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-17T06:15:43Z"
}
}
advisories/unreviewed/2025/04/GHSA-p345-jmhp-7wg2/GHSA-p345-jmhp-7wg2.json
+29
View File
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p345-jmhp-7wg2",
"modified": "2025-04-17T06:30:35Z",
"published": "2025-04-17T06:30:35Z",
"aliases": [
"CVE-2024-11924"
],
"details": "The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11924"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/70288369-132d-4211-bca0-0411736df747"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-17T06:15:42Z"
}
}
advisories/unreviewed/2025/04/GHSA-p5jf-h6mx-5w8x/GHSA-p5jf-h6mx-5w8x.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p5jf-h6mx-5w8x",
"modified": "2025-04-17T06:30:36Z",
"published": "2025-04-17T06:30:36Z",
"aliases": [
"CVE-2025-3295"
],
"details": "The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the affected site's server which may reveal sensitive information.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3295"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3269832%40wp-editor%2Ftrunk&old=3151053%40wp-editor%2Ftrunk&sfp_email=&sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4618c1f4-c0aa-47f5-8c0b-2cb4a021f2e0?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-17T06:15:44Z"
}
}
advisories/unreviewed/2025/04/GHSA-xp8f-rxxq-p5wv/GHSA-xp8f-rxxq-p5wv.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xp8f-rxxq-p5wv",
"modified": "2025-04-17T06:30:35Z",
"published": "2025-04-17T06:30:35Z",
"aliases": [
"CVE-2025-3294"
],
"details": "The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to overwrite arbitrary files on the affected site's server which may make remote code execution possible assuming the files can be written to by the web server.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3294"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3269832%40wp-editor%2Ftrunk&old=3151053%40wp-editor%2Ftrunk&sfp_email=&sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9298820e-3753-41b3-8ba6-9fb494e215a8?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-17T06:15:43Z"
}
}