From 8f5b83786457380248bde781a98715fb6411c965 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 9 Apr 2025 06:32:16 +0000 Subject: [PATCH] Publish Advisories GHSA-4fc7-954j-99v4 GHSA-9cjm-fv5h-54p6 GHSA-c846-2c33-mpmm GHSA-qgc3-2f6v-85jf --- .../GHSA-4fc7-954j-99v4.json | 44 +++++++++++++++++++ .../GHSA-9cjm-fv5h-54p6.json | 29 ++++++++++++ .../GHSA-c846-2c33-mpmm.json | 29 ++++++++++++ .../GHSA-qgc3-2f6v-85jf.json | 29 ++++++++++++ 4 files changed, 131 insertions(+) create mode 100644 advisories/unreviewed/2025/04/GHSA-4fc7-954j-99v4/GHSA-4fc7-954j-99v4.json create mode 100644 advisories/unreviewed/2025/04/GHSA-9cjm-fv5h-54p6/GHSA-9cjm-fv5h-54p6.json create mode 100644 advisories/unreviewed/2025/04/GHSA-c846-2c33-mpmm/GHSA-c846-2c33-mpmm.json create mode 100644 advisories/unreviewed/2025/04/GHSA-qgc3-2f6v-85jf/GHSA-qgc3-2f6v-85jf.json diff --git a/advisories/unreviewed/2025/04/GHSA-4fc7-954j-99v4/GHSA-4fc7-954j-99v4.json b/advisories/unreviewed/2025/04/GHSA-4fc7-954j-99v4/GHSA-4fc7-954j-99v4.json new file mode 100644 index 00000000000..72f03de1eb6 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-4fc7-954j-99v4/GHSA-4fc7-954j-99v4.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4fc7-954j-99v4", + "modified": "2025-04-09T06:30:25Z", + "published": "2025-04-09T06:30:25Z", + "aliases": [ + "CVE-2025-3100" + ], + "details": "The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping in tasks discussion. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3100" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wedevs-project-manager/trunk/src/File/Helper/File.php#L56" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3268509/wedevs-project-manager/trunk/bootstrap/loaders.php" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4d62b087-b0ca-4fa8-921b-5eeb3fa76596?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-09T05:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-9cjm-fv5h-54p6/GHSA-9cjm-fv5h-54p6.json b/advisories/unreviewed/2025/04/GHSA-9cjm-fv5h-54p6/GHSA-9cjm-fv5h-54p6.json new file mode 100644 index 00000000000..2dc1b113129 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-9cjm-fv5h-54p6/GHSA-9cjm-fv5h-54p6.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9cjm-fv5h-54p6", + "modified": "2025-04-09T06:30:25Z", + "published": "2025-04-09T06:30:25Z", + "aliases": [ + "CVE-2024-6857" + ], + "details": "The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6857" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/97636602-2dd0-465b-b6dc-acb42147edb3" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-09T06:15:39Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-c846-2c33-mpmm/GHSA-c846-2c33-mpmm.json b/advisories/unreviewed/2025/04/GHSA-c846-2c33-mpmm/GHSA-c846-2c33-mpmm.json new file mode 100644 index 00000000000..000c711c25e --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-c846-2c33-mpmm/GHSA-c846-2c33-mpmm.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c846-2c33-mpmm", + "modified": "2025-04-09T06:30:25Z", + "published": "2025-04-09T06:30:25Z", + "aliases": [ + "CVE-2024-8243" + ], + "details": "The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8243" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/8e1e2d8d-41aa-49bc-95d5-dae75be788d5" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-09T06:15:41Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-qgc3-2f6v-85jf/GHSA-qgc3-2f6v-85jf.json b/advisories/unreviewed/2025/04/GHSA-qgc3-2f6v-85jf/GHSA-qgc3-2f6v-85jf.json new file mode 100644 index 00000000000..13bf4cfb2bc --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-qgc3-2f6v-85jf/GHSA-qgc3-2f6v-85jf.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qgc3-2f6v-85jf", + "modified": "2025-04-09T06:30:25Z", + "published": "2025-04-09T06:30:25Z", + "aliases": [ + "CVE-2024-6860" + ], + "details": "The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its permalink suffix settings, which could allow attackers to make logged admins perform such action via a CSRF attack", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6860" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/1d09d3dd-aa49-4ff1-80e7-6d176e378916" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-09T06:15:41Z" + } +} \ No newline at end of file