Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2025-04-03 09:34:34 +00:00
parent 6d8dc6369c
commit a29300be2e
28 changed files with 1174 additions and 1 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-jp3v-pxf4-pg97",
-  "modified": "2023-03-03T18:30:26Z",
+  "modified": "2025-04-03T09:32:14Z",
  "published": "2023-02-24T21:30:18Z",
  "aliases": [
    "CVE-2023-1030"
@@ -11,6 +11,10 @@
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  ],
  "affected": [],
@@ -30,6 +34,10 @@
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.221755"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.94112"
    }
  ],
  "database_specific": {
@@ -46,6 +46,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-74",
      "CWE-89"
    ],
    "severity": "MODERATE",
@@ -0,0 +1,41 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2648-xh5w-2w3q",
+  "modified": "2025-04-03T09:32:15Z",
+  "published": "2025-04-03T09:32:15Z",
+  "aliases": [
+    "CVE-2025-22003"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: ucan: fix out of bound read in strscpy() source\n\nCommit 7fdaf8966aae (\"can: ucan: use strscpy() to instead of strncpy()\")\nunintentionally introduced a one byte out of bound read on strscpy()'s\nsource argument (which is kind of ironic knowing that strscpy() is meant\nto be a more secure alternative :)).\n\nLet's consider below buffers:\n\n  dest[len + 1]; /* will be NUL terminated */\n  src[len]; /* may not be NUL terminated */\n\nWhen doing:\n\n  strncpy(dest, src, len);\n  dest[len] = '\\0';\n\nstrncpy() will read up to len bytes from src.\n\nOn the other hand:\n\n  strscpy(dest, src, len + 1);\n\nwill read up to len + 1 bytes from src, that is to say, an out of bound\nread of one byte will occur on src if it is not NUL terminated. Note\nthat the src[len] byte is never copied, but strscpy() still needs to\nread it to check whether a truncation occurred or not.\n\nThis exact pattern happened in ucan.\n\nThe root cause is that the source is not NUL terminated. Instead of\ndoing a copy in a local buffer, directly NUL terminate it as soon as\nusb_control_msg() returns. With this, the local firmware_str[] variable\ncan be removed.\n\nOn top of this do a couple refactors:\n\n  - ucan_ctl_payload->raw is only used for the firmware string, so\n    rename it to ucan_ctl_payload->fw_str and change its type from u8 to\n    char.\n\n  - ucan_device_request_in() is only used to retrieve the firmware\n    string, so rename it to ucan_get_fw_str() and refactor it to make it\n    directly handle all the string termination logic.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22003"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/1d22a122ffb116c3cf78053e812b8b21f8852ee9"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/8cec9e314d3360fc1d8346297c41a6ee45cb45a9"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/a4994161a61bc8fd71d105c579d847cefee99262"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/cc29775a8a72d7f3b56cc026796ad99bd65804a7"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-03T08:15:15Z"
+  }
+}
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-299w-p965-fx3w",
+  "modified": "2025-04-03T09:32:15Z",
+  "published": "2025-04-03T09:32:15Z",
+  "aliases": [
+    "CVE-2025-3148"
+  ],
+  "details": "A vulnerability was found in codeprojects Product Management System 1.0 and classified as problematic. This issue affects some unknown processing of the component Login. The manipulation of the argument Str1 leads to buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3148"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/LxxxtSec/CVE/blob/main/CVE-Product_Management_System.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.303053"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.303053"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.525395"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-119"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-03T07:15:41Z"
+  }
+}
@@ -0,0 +1,41 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2xg8-765h-q668",
+  "modified": "2025-04-03T09:32:15Z",
+  "published": "2025-04-03T09:32:15Z",
+  "aliases": [
+    "CVE-2025-22001"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Fix integer overflow in qaic_validate_req()\n\nThese are u64 variables that come from the user via\nqaic_attach_slice_bo_ioctl().  Use check_add_overflow() to ensure that\nthe math doesn't have an integer wrapping bug.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22001"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/4b2a170c25862ad116bd31be6b9841646b4862e8"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/57fae0c505f49bb1e3d5660cd2cc49697ed85f7c"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/67d15c7aa0864dfd82325c7e7e7d8548b5224c7b"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/b362fc904d264a88b4af20baae9e82491c285e9c"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-03T08:15:15Z"
+  }
+}
@@ -0,0 +1,48 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3rj6-h2wq-9rh8",
+  "modified": "2025-04-03T09:32:14Z",
+  "published": "2025-04-03T09:32:14Z",
+  "aliases": [
+    "CVE-2025-3145"
+  ],
+  "details": "A vulnerability, which was classified as problematic, has been found in MindSpore 2.5.0. Affected by this issue is the function mindspore.numpy.fft.rfft2. The manipulation leads to memory corruption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3145"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gitee.com/mindspore/mindspore/issues/IBVKM8"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.303050"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.303050"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-119"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-03T07:15:41Z"
+  }
+}
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-46xh-4gmj-g35c",
+  "modified": "2025-04-03T09:32:16Z",
+  "published": "2025-04-03T09:32:16Z",
+  "aliases": [
+    "CVE-2025-2874"
+  ],
+  "details": "The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 20240319 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2874"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3263067%40user-submitted-posts&new=3263067%40user-submitted-posts&sfp_email=&sfph_mail="
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8b212a1a-0e2b-4327-93b5-398bd7a36b5c?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-03T08:15:16Z"
+  }
+}
@@ -0,0 +1,45 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-58q5-9x94-w4fc",
+  "modified": "2025-04-03T09:32:16Z",
+  "published": "2025-04-03T09:32:16Z",
+  "aliases": [
+    "CVE-2025-22007"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix error code in chan_alloc_skb_cb()\n\nThe chan_alloc_skb_cb() function is supposed to return error pointers on\nerror.  Returning NULL will lead to a NULL dereference.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22007"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/72d061ee630d0dbb45c2920d8d19b3861c413e54"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/761b7c36addd22c7e6ceb05caaadc3b062d99faa"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/788ae2ae4cf484e248b5bc29211c7ac6510e3e92"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/a78692ec0d1e17a96b09f2349a028878f5b305e4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/ecd06ad0823a90b4420c377ef8917e44e23ee841"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-03T08:15:16Z"
+  }
+}
@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5qmw-w9cg-68jh",
+  "modified": "2025-04-03T09:32:15Z",
+  "published": "2025-04-03T09:32:14Z",
+  "aliases": [
+    "CVE-2025-3147"
+  ],
+  "details": "A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /add-subadmin.php. The manipulation of the argument sadminusername leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3147"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/nabiland/cve/issues/2"
+    },
+    {
+      "type": "WEB",
+      "url": "https://phpgurukul.com"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.303052"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.303052"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.525388"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-74"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-03T07:15:41Z"
+  }
+}
@@ -0,0 +1,37 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6hcp-x8fr-rwcv",
+  "modified": "2025-04-03T09:32:15Z",
+  "published": "2025-04-03T09:32:15Z",
+  "aliases": [
+    "CVE-2025-21998"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: qcom: uefisecapp: fix efivars registration race\n\nSince the conversion to using the TZ allocator, the efivars service is\nregistered before the memory pool has been allocated, something which\ncan lead to a NULL-pointer dereference in case of a racing EFI variable\naccess.\n\nMake sure that all resources have been set up before registering the\nefivars.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21998"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/c4e37b381a7a243c298a4858fc0a5a74e737c79a"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/da8d493a80993972c427002684d0742560f3be4a"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/f15a2b96a0e41c426c63a932d0e63cde7b9784aa"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-03T08:15:15Z"
+  }
+}
@@ -0,0 +1,45 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7j34-4m8p-353w",
+  "modified": "2025-04-03T09:32:15Z",
+  "published": "2025-04-03T09:32:15Z",
+  "aliases": [
+    "CVE-2025-22005"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().\n\nfib_check_nh_v6_gw() expects that fib6_nh_init() cleans up everything\nwhen it fails.\n\nCommit 7dd73168e273 (\"ipv6: Always allocate pcpu memory in a fib6_nh\")\nmoved fib_nh_common_init() before alloc_percpu_gfp() within fib6_nh_init()\nbut forgot to add cleanup for fib6_nh->nh_common.nhc_pcpu_rth_output in\ncase it fails to allocate fib6_nh->rt6i_pcpu, resulting in memleak.\n\nLet's call fib_nh_common_release() and clear nhc_pcpu_rth_output in the\nerror path.\n\nNote that we can remove the fib6_nh_release() call in nh_create_ipv6()\nlater in net-next.git.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22005"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/119dcafe36795a15ae53351cbbd6177aaf94ffef"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/29d91820184d5cbc70f3246d4911d96eaeb930d6"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/77c41cdbe6bce476e08d3251c0d501feaf10a9f3"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/9740890ee20e01f99ff1dde84c63dcf089fabb98"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/d3d5b4b5ae263c3225db363ba08b937e2e2b0380"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-03T08:15:16Z"
+  }
+}
@@ -0,0 +1,37 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-84gc-cf68-frm5",
+  "modified": "2025-04-03T09:32:15Z",
+  "published": "2025-04-03T09:32:15Z",
+  "aliases": [
+    "CVE-2025-22000"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: drop beyond-EOF folios with the right number of refs\n\nWhen an after-split folio is large and needs to be dropped due to EOF,\nfolio_put_refs(folio, folio_nr_pages(folio)) should be used to drop all\npage cache refs.  Otherwise, the folio will not be freed, causing memory\nleak.\n\nThis leak would happen on a filesystem with blocksize > page_size and a\ntruncate is performed, where the blocksize makes folios split to >0 order\nones, causing truncated folios not being freed.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22000"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/14efb4793519d73fb2902bb0ece319b886e4b4b9"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/86368616a9ce51f6b41efa251b6e066893851d67"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/92ad820a1f2d95d5a8d6c2bd3f391bbb068a5f9e"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-03T08:15:15Z"
+  }
+}
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8gw7-rgf3-h6qx",
+  "modified": "2025-04-03T09:32:16Z",
+  "published": "2025-04-03T09:32:16Z",
+  "aliases": [
+    "CVE-2025-3152"
+  ],
+  "details": "A vulnerability classified as problematic has been found in caipeichao ThinkOX 1.0. This affects an unknown part of the file /ThinkOX-master/index.php?s=/Weibo/Index/search.html of the component Search. The manipulation of the argument keywords leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3152"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/dtwin88/cve-md/blob/main/ThinkOX1.0/ThinkOX1.0.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.303057"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.303057"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.525767"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-03T08:15:17Z"
+  }
+}
@@ -0,0 +1,37 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-c5f2-596r-9c4q",
+  "modified": "2025-04-03T09:32:15Z",
+  "published": "2025-04-03T09:32:15Z",
+  "aliases": [
+    "CVE-2025-22006"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: ti: am65-cpsw: Fix NAPI registration sequence\n\nRegistering the interrupts for TX or RX DMA Channels prior to registering\ntheir respective NAPI callbacks can result in a NULL pointer dereference.\nThis is seen in practice as a random occurrence since it depends on the\nrandomness associated with the generation of traffic by Linux and the\nreception of traffic from the wire.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22006"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/5f079290e5913a0060e059500b7d440990ac1066"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/942557abed7f38b77a47d77b92d448802eefe185"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/d4bf956547c38c04fad8d72a961ac4dc00bad000"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-03T08:15:16Z"
+  }
+}
@@ -0,0 +1,45 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-fmvx-5hvp-q7fh",
+  "modified": "2025-04-03T09:32:15Z",
+  "published": "2025-04-03T09:32:15Z",
+  "aliases": [
+    "CVE-2025-22004"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atm: fix use after free in lec_send()\n\nThe ->send() operation frees skb so save the length before calling\n->send() to avoid a use after free.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22004"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/326223182e4703cde99fdbd36d07d0b3de9980fb"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/51e8be9578a2e74f9983d8fd8de8cafed191f30c"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/9566f6ee13b17a15d0a47667ad1b1893c539f730"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/f3009d0d6ab78053117f8857b921a8237f4d17b3"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/f3271f7548385e0096739965961c7cbf7e6b4762"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-03T08:15:15Z"
+  }
+}
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-g6qj-9f49-6c8c",
+  "modified": "2025-04-03T09:32:14Z",
+  "published": "2025-04-03T09:32:14Z",
+  "aliases": [
+    "CVE-2025-30485"
+  ],
+  "details": "UNIX symbolic link (Symlink) following issue exists in FutureNet NXR series, VXR series and WXR series routers. Attaching to the affected product an external storage containing malicious symbolic link files, a logged-in administrative user may obtain and/or destroy internal files.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30485"
+    },
+    {
+      "type": "WEB",
+      "url": "https://jvn.jp/en/vu/JVNVU92821536"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.centurysys.co.jp/backnumber/common/jvnvu92821536.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-61"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-03T07:15:41Z"
+  }
+}
@@ -0,0 +1,44 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-h9fg-vwh2-w3rr",
+  "modified": "2025-04-03T09:32:15Z",
+  "published": "2025-04-03T09:32:15Z",
+  "aliases": [
+    "CVE-2024-13673"
+  ],
+  "details": "The Big Boom Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bbd-search' shortcode in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13673"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3258281%40big-boom-directory&new=3258281%40big-boom-directory&sfp_email=&sfph_mail="
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3262078%40big-boom-directory&new=3262078%40big-boom-directory&sfp_email=&sfph_mail="
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5284cbe4-1550-4f3c-be54-e2de8a089512?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-03T08:15:13Z"
+  }
+}
@@ -0,0 +1,41 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-jwm2-2q27-v4vh",
+  "modified": "2025-04-03T09:32:14Z",
+  "published": "2025-04-03T09:32:14Z",
+  "aliases": [
+    "CVE-2025-21995"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Fix fence reference count leak\n\nThe last_scheduled fence leaks when an entity is being killed and adding\nthe cleanup callback fails.\n\nDecrement the reference count of prev when dma_fence_add_callback()\nfails, ensuring proper balance.\n\n[phasta: add git tag info for stable kernel]",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21995"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/1135a9431160575466ea9ac37ebd756ecbe35fff"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/35399c84dcedd6d31448fb9e1336ef52673f2882"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/a952f1ab696873be124e31ce5ef964d36bce817f"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/c76bd3c99293834de7d1dca5de536616d5655e38"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-03T08:15:14Z"
+  }
+}
@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-m29v-f5j8-8qc4",
+  "modified": "2025-04-03T09:32:14Z",
+  "published": "2025-04-03T09:32:14Z",
+  "aliases": [
+    "CVE-2025-3146"
+  ],
+  "details": "A vulnerability, which was classified as critical, was found in PHPGurukul Bus Pass Management System 1.0. This affects an unknown part of the file /view-pass-detail.php. The manipulation of the argument viewid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3146"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/nabiland/cve/issues/1"
+    },
+    {
+      "type": "WEB",
+      "url": "https://phpgurukul.com"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.303051"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.303051"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.525340"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-74"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-03T07:15:41Z"
+  }
+}
--- a/Show More
+++ b/Show More