netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-c22c-jjc2-m9m6
GHSA-3gx7-hcg4-pm64
GHSA-5gpp-h74r-6jj3
GHSA-5mw2-w8pc-m6p6
GHSA-84fw-m7gm-r6gw
GHSA-8wj2-5w43-v8hg
GHSA-f9cw-8g68-pfqj
GHSA-fg4p-ghcp-f5rx
GHSA-jm27-r34j-pr59
GHSA-qh53-m7cx-vgcp
GHSA-rggh-j84q-m7ww
GHSA-v3c8-3pr6-gr7p
GHSA-w2vj-j5c3-9qmp
GHSA-x94v-5rvp-vf9c
This commit is contained in:
advisory-database[bot]
2025-06-05 06:32:06 +00:00
parent 16d6ca3e03
commit 9f9d993470
14 changed files with 651 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/05/GHSA-c22c-jjc2-m9m6/GHSA-c22c-jjc2-m9m6.json
+13 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c22c-jjc2-m9m6",
"modified": "2025-05-06T15:31:08Z",
"modified": "2025-06-05T06:30:26Z",
"published": "2025-05-06T09:31:32Z",
"aliases": [
"CVE-2025-4332"
@@ -46,6 +46,18 @@
{
"type": "WEB",
"url": "https://vuldb.com/?submit.564339"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.564729"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.568338"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.590559"
}
],
"database_specific": {
advisories/unreviewed/2025/06/GHSA-3gx7-hcg4-pm64/GHSA-3gx7-hcg4-pm64.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3gx7-hcg4-pm64",
"modified": "2025-06-05T06:30:26Z",
"published": "2025-06-05T06:30:26Z",
"aliases": [
"CVE-2025-5633"
],
"details": "A vulnerability was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/users.php. The manipulation of the argument delete leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5633"
},
{
"type": "WEB",
"url": "https://github.com/YZS17/CVE/blob/main/NEWS-BUZZ/sqli_users.php_delete.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.311120"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.311120"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.589783"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-05T04:15:53Z"
}
}
advisories/unreviewed/2025/06/GHSA-5gpp-h74r-6jj3/GHSA-5gpp-h74r-6jj3.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5gpp-h74r-6jj3",
"modified": "2025-06-05T06:30:26Z",
"published": "2025-06-05T06:30:26Z",
"aliases": [
"CVE-2025-5632"
],
"details": "A vulnerability was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/users.php. The manipulation of the argument change_to_admin leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5632"
},
{
"type": "WEB",
"url": "https://github.com/YZS17/CVE/blob/main/NEWS-BUZZ/sqli_users.php_change_to_admin.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.311119"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.311119"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.589781"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-05T04:15:40Z"
}
}
advisories/unreviewed/2025/06/GHSA-5mw2-w8pc-m6p6/GHSA-5mw2-w8pc-m6p6.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5mw2-w8pc-m6p6",
"modified": "2025-06-05T06:30:27Z",
"published": "2025-06-05T06:30:27Z",
"aliases": [
"CVE-2025-5683"
],
"details": "When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash. This issue affects Qt from versions 6.3.0 through 6.5.9, from 6.6.0 through 6.8.4, 6.9.0. This is fixed in 6.5.10, 6.8.5 and 6.9.1.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5683"
},
{
"type": "WEB",
"url": "https://codereview.qt-project.org/c/qt/qtimageformats/+/644548"
},
{
"type": "WEB",
"url": "https://issues.oss-fuzz.com/issues/415350704"
}
],
"database_specific": {
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-05T06:15:27Z"
}
}
advisories/unreviewed/2025/06/GHSA-84fw-m7gm-r6gw/GHSA-84fw-m7gm-r6gw.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-84fw-m7gm-r6gw",
"modified": "2025-06-05T06:30:27Z",
"published": "2025-06-05T06:30:27Z",
"aliases": [
"CVE-2025-3055"
],
"details": "The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_avatar_ajax() function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3055"
},
{
"type": "WEB",
"url": "https://headwayapp.co/wp-user-frontend-changelog"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eeb71c31-9e56-4b58-9cfc-a97f6892cc2b?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-05T06:15:26Z"
}
}
advisories/unreviewed/2025/06/GHSA-8wj2-5w43-v8hg/GHSA-8wj2-5w43-v8hg.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8wj2-5w43-v8hg",
"modified": "2025-06-05T06:30:26Z",
"published": "2025-06-05T06:30:26Z",
"aliases": [
"CVE-2025-5634"
],
"details": "A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component NOOP Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5634"
},
{
"type": "WEB",
"url": "https://fitoxs.com/exploit/exploit-c5e11f95f8d134e3c6b23c3b1b7ce5e79274ab0719f798f1bb509474b33b1c0e1.txt"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.311121"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.311121"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.587048"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-05T04:15:54Z"
}
}
advisories/unreviewed/2025/06/GHSA-f9cw-8g68-pfqj/GHSA-f9cw-8g68-pfqj.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f9cw-8g68-pfqj",
"modified": "2025-06-05T06:30:26Z",
"published": "2025-06-05T06:30:26Z",
"aliases": [
"CVE-2025-5637"
],
"details": "A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component SYSTEM Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5637"
},
{
"type": "WEB",
"url": "https://fitoxs.com/exploit/exploit-af5b0137a4b3e132a79a087dbb97a8854fc4db337aad9a85fae3c7e748da3ad595.txt"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.311124"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.311124"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.587064"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-05T05:15:24Z"
}
}
advisories/unreviewed/2025/06/GHSA-fg4p-ghcp-f5rx/GHSA-fg4p-ghcp-f5rx.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fg4p-ghcp-f5rx",
"modified": "2025-06-05T06:30:26Z",
"published": "2025-06-05T06:30:26Z",
"aliases": [
"CVE-2025-5636"
],
"details": "A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component SET Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5636"
},
{
"type": "WEB",
"url": "https://fitoxs.com/exploit/exploit-76d51400a1f23f1d67c2eb8f6793d6b8109cf44230294b16380f676b7bcad8c695.txt"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.311123"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.311123"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.587059"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-05T05:15:24Z"
}
}
advisories/unreviewed/2025/06/GHSA-jm27-r34j-pr59/GHSA-jm27-r34j-pr59.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jm27-r34j-pr59",
"modified": "2025-06-05T06:30:26Z",
"published": "2025-06-05T06:30:26Z",
"aliases": [
"CVE-2025-5638"
],
"details": "A vulnerability has been found in PHPGurukul Notice Board System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin-profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5638"
},
{
"type": "WEB",
"url": "https://github.com/f1rstb100d/myCVE/issues/39"
},
{
"type": "WEB",
"url": "https://phpgurukul.com"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.311125"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.311125"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.589811"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-05T05:15:24Z"
}
}
advisories/unreviewed/2025/06/GHSA-qh53-m7cx-vgcp/GHSA-qh53-m7cx-vgcp.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qh53-m7cx-vgcp",
"modified": "2025-06-05T06:30:27Z",
"published": "2025-06-05T06:30:27Z",
"aliases": [
"CVE-2025-3054"
],
"details": "The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that this requires the 'Private Message' module to be enabled and the Business version of the PRO software to be in use.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3054"
},
{
"type": "WEB",
"url": "https://headwayapp.co/wp-user-frontend-changelog"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/989f0e0b-8a57-4435-95b0-21fec215112d?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-05T06:15:25Z"
}
}
advisories/unreviewed/2025/06/GHSA-rggh-j84q-m7ww/GHSA-rggh-j84q-m7ww.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rggh-j84q-m7ww",
"modified": "2025-06-05T06:30:27Z",
"published": "2025-06-05T06:30:27Z",
"aliases": [
"CVE-2025-5640"
],
"details": "A vulnerability was found in PX4-Autopilot 1.12.3. It has been classified as problematic. This affects the function MavlinkReceiver::handle_message_trajectory_representation_waypoints of the file mavlink_receiver.cpp of the component TRAJECTORY_REPRESENTATION_WAYPOINTS Message Handler. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5640"
},
{
"type": "WEB",
"url": "https://github.com/PX4/PX4-Autopilot/issues/24915"
},
{
"type": "WEB",
"url": "https://github.com/PX4/PX4-Autopilot/issues/24915#issue-3091040552"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.311127"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.311127"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.584889"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-05T06:15:27Z"
}
}
advisories/unreviewed/2025/06/GHSA-v3c8-3pr6-gr7p/GHSA-v3c8-3pr6-gr7p.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v3c8-3pr6-gr7p",
"modified": "2025-06-05T06:30:26Z",
"published": "2025-06-05T06:30:26Z",
"aliases": [
"CVE-2025-1793"
],
"details": "Multiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to read and write data using SQL, potentially leading to unauthorized access to data of other users depending on the usage of the llama-index library in a web application.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1793"
},
{
"type": "WEB",
"url": "https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183c"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-05T05:15:23Z"
}
}
advisories/unreviewed/2025/06/GHSA-w2vj-j5c3-9qmp/GHSA-w2vj-j5c3-9qmp.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w2vj-j5c3-9qmp",
"modified": "2025-06-05T06:30:26Z",
"published": "2025-06-05T06:30:26Z",
"aliases": [
"CVE-2025-5635"
],
"details": "A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component PLS Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5635"
},
{
"type": "WEB",
"url": "https://fitoxs.com/exploit/exploit-67a2e172844905e3e09735d62ac7a925e8492f78c789c2995a1f2474c539ed8f95.txt"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.311122"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.311122"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.587057"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-05T04:15:55Z"
}
}
advisories/unreviewed/2025/06/GHSA-x94v-5rvp-vf9c/GHSA-x94v-5rvp-vf9c.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x94v-5rvp-vf9c",
"modified": "2025-06-05T06:30:27Z",
"published": "2025-06-05T06:30:27Z",
"aliases": [
"CVE-2025-5639"
],
"details": "A vulnerability was found in PHPGurukul Notice Board System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /forgot-password.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5639"
},
{
"type": "WEB",
"url": "https://github.com/f1rstb100d/myCVE/issues/40"
},
{
"type": "WEB",
"url": "https://phpgurukul.com"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.311126"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.311126"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.589812"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-05T06:15:27Z"
}
}