diff --git a/advisories/unreviewed/2025/05/GHSA-c22c-jjc2-m9m6/GHSA-c22c-jjc2-m9m6.json b/advisories/unreviewed/2025/05/GHSA-c22c-jjc2-m9m6/GHSA-c22c-jjc2-m9m6.json index 80b89db0845..3d47f0a0284 100644 --- a/advisories/unreviewed/2025/05/GHSA-c22c-jjc2-m9m6/GHSA-c22c-jjc2-m9m6.json +++ b/advisories/unreviewed/2025/05/GHSA-c22c-jjc2-m9m6/GHSA-c22c-jjc2-m9m6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-c22c-jjc2-m9m6", - "modified": "2025-05-06T15:31:08Z", + "modified": "2025-06-05T06:30:26Z", "published": "2025-05-06T09:31:32Z", "aliases": [ "CVE-2025-4332" @@ -46,6 +46,18 @@ { "type": "WEB", "url": "https://vuldb.com/?submit.564339" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.564729" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.568338" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.590559" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/06/GHSA-3gx7-hcg4-pm64/GHSA-3gx7-hcg4-pm64.json b/advisories/unreviewed/2025/06/GHSA-3gx7-hcg4-pm64/GHSA-3gx7-hcg4-pm64.json new file mode 100644 index 00000000000..787d28772a7 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-3gx7-hcg4-pm64/GHSA-3gx7-hcg4-pm64.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3gx7-hcg4-pm64", + "modified": "2025-06-05T06:30:26Z", + "published": "2025-06-05T06:30:26Z", + "aliases": [ + "CVE-2025-5633" + ], + "details": "A vulnerability was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/users.php. The manipulation of the argument delete leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5633" + }, + { + "type": "WEB", + "url": "https://github.com/YZS17/CVE/blob/main/NEWS-BUZZ/sqli_users.php_delete.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311120" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311120" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.589783" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-05T04:15:53Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-5gpp-h74r-6jj3/GHSA-5gpp-h74r-6jj3.json b/advisories/unreviewed/2025/06/GHSA-5gpp-h74r-6jj3/GHSA-5gpp-h74r-6jj3.json new file mode 100644 index 00000000000..a9a364a38f0 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-5gpp-h74r-6jj3/GHSA-5gpp-h74r-6jj3.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5gpp-h74r-6jj3", + "modified": "2025-06-05T06:30:26Z", + "published": "2025-06-05T06:30:26Z", + "aliases": [ + "CVE-2025-5632" + ], + "details": "A vulnerability was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/users.php. The manipulation of the argument change_to_admin leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5632" + }, + { + "type": "WEB", + "url": "https://github.com/YZS17/CVE/blob/main/NEWS-BUZZ/sqli_users.php_change_to_admin.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311119" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311119" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.589781" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-05T04:15:40Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-5mw2-w8pc-m6p6/GHSA-5mw2-w8pc-m6p6.json b/advisories/unreviewed/2025/06/GHSA-5mw2-w8pc-m6p6/GHSA-5mw2-w8pc-m6p6.json new file mode 100644 index 00000000000..48312d0c6d0 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-5mw2-w8pc-m6p6/GHSA-5mw2-w8pc-m6p6.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5mw2-w8pc-m6p6", + "modified": "2025-06-05T06:30:27Z", + "published": "2025-06-05T06:30:27Z", + "aliases": [ + "CVE-2025-5683" + ], + "details": "When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash. This issue affects Qt from versions 6.3.0 through 6.5.9, from 6.6.0 through 6.8.4, 6.9.0. This is fixed in 6.5.10, 6.8.5 and 6.9.1.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5683" + }, + { + "type": "WEB", + "url": "https://codereview.qt-project.org/c/qt/qtimageformats/+/644548" + }, + { + "type": "WEB", + "url": "https://issues.oss-fuzz.com/issues/415350704" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-05T06:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-84fw-m7gm-r6gw/GHSA-84fw-m7gm-r6gw.json b/advisories/unreviewed/2025/06/GHSA-84fw-m7gm-r6gw/GHSA-84fw-m7gm-r6gw.json new file mode 100644 index 00000000000..f86623ae6fc --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-84fw-m7gm-r6gw/GHSA-84fw-m7gm-r6gw.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-84fw-m7gm-r6gw", + "modified": "2025-06-05T06:30:27Z", + "published": "2025-06-05T06:30:27Z", + "aliases": [ + "CVE-2025-3055" + ], + "details": "The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_avatar_ajax() function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3055" + }, + { + "type": "WEB", + "url": "https://headwayapp.co/wp-user-frontend-changelog" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eeb71c31-9e56-4b58-9cfc-a97f6892cc2b?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-05T06:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-8wj2-5w43-v8hg/GHSA-8wj2-5w43-v8hg.json b/advisories/unreviewed/2025/06/GHSA-8wj2-5w43-v8hg/GHSA-8wj2-5w43-v8hg.json new file mode 100644 index 00000000000..9fadc43e661 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-8wj2-5w43-v8hg/GHSA-8wj2-5w43-v8hg.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8wj2-5w43-v8hg", + "modified": "2025-06-05T06:30:26Z", + "published": "2025-06-05T06:30:26Z", + "aliases": [ + "CVE-2025-5634" + ], + "details": "A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component NOOP Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5634" + }, + { + "type": "WEB", + "url": "https://fitoxs.com/exploit/exploit-c5e11f95f8d134e3c6b23c3b1b7ce5e79274ab0719f798f1bb509474b33b1c0e1.txt" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311121" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311121" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.587048" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-05T04:15:54Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-f9cw-8g68-pfqj/GHSA-f9cw-8g68-pfqj.json b/advisories/unreviewed/2025/06/GHSA-f9cw-8g68-pfqj/GHSA-f9cw-8g68-pfqj.json new file mode 100644 index 00000000000..0cda00771cd --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-f9cw-8g68-pfqj/GHSA-f9cw-8g68-pfqj.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f9cw-8g68-pfqj", + "modified": "2025-06-05T06:30:26Z", + "published": "2025-06-05T06:30:26Z", + "aliases": [ + "CVE-2025-5637" + ], + "details": "A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component SYSTEM Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5637" + }, + { + "type": "WEB", + "url": "https://fitoxs.com/exploit/exploit-af5b0137a4b3e132a79a087dbb97a8854fc4db337aad9a85fae3c7e748da3ad595.txt" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311124" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311124" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.587064" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-05T05:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-fg4p-ghcp-f5rx/GHSA-fg4p-ghcp-f5rx.json b/advisories/unreviewed/2025/06/GHSA-fg4p-ghcp-f5rx/GHSA-fg4p-ghcp-f5rx.json new file mode 100644 index 00000000000..d309406ad61 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-fg4p-ghcp-f5rx/GHSA-fg4p-ghcp-f5rx.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fg4p-ghcp-f5rx", + "modified": "2025-06-05T06:30:26Z", + "published": "2025-06-05T06:30:26Z", + "aliases": [ + "CVE-2025-5636" + ], + "details": "A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component SET Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5636" + }, + { + "type": "WEB", + "url": "https://fitoxs.com/exploit/exploit-76d51400a1f23f1d67c2eb8f6793d6b8109cf44230294b16380f676b7bcad8c695.txt" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311123" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311123" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.587059" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-05T05:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-jm27-r34j-pr59/GHSA-jm27-r34j-pr59.json b/advisories/unreviewed/2025/06/GHSA-jm27-r34j-pr59/GHSA-jm27-r34j-pr59.json new file mode 100644 index 00000000000..694b988c150 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-jm27-r34j-pr59/GHSA-jm27-r34j-pr59.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jm27-r34j-pr59", + "modified": "2025-06-05T06:30:26Z", + "published": "2025-06-05T06:30:26Z", + "aliases": [ + "CVE-2025-5638" + ], + "details": "A vulnerability has been found in PHPGurukul Notice Board System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin-profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5638" + }, + { + "type": "WEB", + "url": "https://github.com/f1rstb100d/myCVE/issues/39" + }, + { + "type": "WEB", + "url": "https://phpgurukul.com" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311125" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311125" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.589811" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-05T05:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-qh53-m7cx-vgcp/GHSA-qh53-m7cx-vgcp.json b/advisories/unreviewed/2025/06/GHSA-qh53-m7cx-vgcp/GHSA-qh53-m7cx-vgcp.json new file mode 100644 index 00000000000..fdd38e5e4de --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-qh53-m7cx-vgcp/GHSA-qh53-m7cx-vgcp.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qh53-m7cx-vgcp", + "modified": "2025-06-05T06:30:27Z", + "published": "2025-06-05T06:30:27Z", + "aliases": [ + "CVE-2025-3054" + ], + "details": "The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that this requires the 'Private Message' module to be enabled and the Business version of the PRO software to be in use.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3054" + }, + { + "type": "WEB", + "url": "https://headwayapp.co/wp-user-frontend-changelog" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/989f0e0b-8a57-4435-95b0-21fec215112d?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-434" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-05T06:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-rggh-j84q-m7ww/GHSA-rggh-j84q-m7ww.json b/advisories/unreviewed/2025/06/GHSA-rggh-j84q-m7ww/GHSA-rggh-j84q-m7ww.json new file mode 100644 index 00000000000..a8b949c7318 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-rggh-j84q-m7ww/GHSA-rggh-j84q-m7ww.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rggh-j84q-m7ww", + "modified": "2025-06-05T06:30:27Z", + "published": "2025-06-05T06:30:27Z", + "aliases": [ + "CVE-2025-5640" + ], + "details": "A vulnerability was found in PX4-Autopilot 1.12.3. It has been classified as problematic. This affects the function MavlinkReceiver::handle_message_trajectory_representation_waypoints of the file mavlink_receiver.cpp of the component TRAJECTORY_REPRESENTATION_WAYPOINTS Message Handler. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5640" + }, + { + "type": "WEB", + "url": "https://github.com/PX4/PX4-Autopilot/issues/24915" + }, + { + "type": "WEB", + "url": "https://github.com/PX4/PX4-Autopilot/issues/24915#issue-3091040552" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311127" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311127" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.584889" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-05T06:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-v3c8-3pr6-gr7p/GHSA-v3c8-3pr6-gr7p.json b/advisories/unreviewed/2025/06/GHSA-v3c8-3pr6-gr7p/GHSA-v3c8-3pr6-gr7p.json new file mode 100644 index 00000000000..95089a44d20 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-v3c8-3pr6-gr7p/GHSA-v3c8-3pr6-gr7p.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v3c8-3pr6-gr7p", + "modified": "2025-06-05T06:30:26Z", + "published": "2025-06-05T06:30:26Z", + "aliases": [ + "CVE-2025-1793" + ], + "details": "Multiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to read and write data using SQL, potentially leading to unauthorized access to data of other users depending on the usage of the llama-index library in a web application.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1793" + }, + { + "type": "WEB", + "url": "https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e" + }, + { + "type": "WEB", + "url": "https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183c" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-05T05:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-w2vj-j5c3-9qmp/GHSA-w2vj-j5c3-9qmp.json b/advisories/unreviewed/2025/06/GHSA-w2vj-j5c3-9qmp/GHSA-w2vj-j5c3-9qmp.json new file mode 100644 index 00000000000..5d0b081273f --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-w2vj-j5c3-9qmp/GHSA-w2vj-j5c3-9qmp.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w2vj-j5c3-9qmp", + "modified": "2025-06-05T06:30:26Z", + "published": "2025-06-05T06:30:26Z", + "aliases": [ + "CVE-2025-5635" + ], + "details": "A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component PLS Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5635" + }, + { + "type": "WEB", + "url": "https://fitoxs.com/exploit/exploit-67a2e172844905e3e09735d62ac7a925e8492f78c789c2995a1f2474c539ed8f95.txt" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311122" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311122" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.587057" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-05T04:15:55Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-x94v-5rvp-vf9c/GHSA-x94v-5rvp-vf9c.json b/advisories/unreviewed/2025/06/GHSA-x94v-5rvp-vf9c/GHSA-x94v-5rvp-vf9c.json new file mode 100644 index 00000000000..ce8c0a95794 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-x94v-5rvp-vf9c/GHSA-x94v-5rvp-vf9c.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x94v-5rvp-vf9c", + "modified": "2025-06-05T06:30:27Z", + "published": "2025-06-05T06:30:27Z", + "aliases": [ + "CVE-2025-5639" + ], + "details": "A vulnerability was found in PHPGurukul Notice Board System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /forgot-password.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5639" + }, + { + "type": "WEB", + "url": "https://github.com/f1rstb100d/myCVE/issues/40" + }, + { + "type": "WEB", + "url": "https://phpgurukul.com" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311126" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311126" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.589812" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-05T06:15:27Z" + } +} \ No newline at end of file