netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2025-05-17 06:31:32 +00:00
parent 02c36b6f1b
commit bee0ee604f
46 changed files with 728 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/04/GHSA-wq26-hpcc-wh38/GHSA-wq26-hpcc-wh38.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wq26-hpcc-wh38",
"modified": "2025-04-08T15:31:06Z",
"modified": "2025-05-17T06:30:24Z",
"published": "2025-04-08T15:31:06Z",
"aliases": [
"CVE-2025-22458"
@@ -22,6 +22,10 @@
{
"type": "WEB",
"url": "https://forums.ivanti.com/s/article/Security-Advisory-EPM-April-2025-for-EPM-2024-and-EPM-2022-SU6"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/May/17"
}
],
"database_specific": {
advisories/unreviewed/2025/05/GHSA-2cp7-pmqc-mq6m/GHSA-2cp7-pmqc-mq6m.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2cp7-pmqc-mq6m",
"modified": "2025-05-17T06:30:28Z",
"published": "2025-05-17T06:30:28Z",
"aliases": [
"CVE-2025-4817"
],
"details": "A vulnerability was found in Sourcecodester Doctor's Appointment System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/delete-appointment.php of the component GET Parameter Handler. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4817"
},
{
"type": "WEB",
"url": "https://github.com/Xiaoyi-ing/CVE/issues/9"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.309274"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.309274"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.574178"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-17T04:16:20Z"
}
}
advisories/unreviewed/2025/05/GHSA-2gpg-rr9p-jqp9/GHSA-2gpg-rr9p-jqp9.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2gpg-rr9p-jqp9",
"modified": "2025-05-15T21:31:32Z",
"modified": "2025-05-17T06:30:26Z",
"published": "2025-05-15T21:31:32Z",
"aliases": [
"CVE-2024-8426"
],
"details": "The Page Builder: Pagelayer WordPress plugin before 1.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-15T20:15:58Z"
advisories/unreviewed/2025/05/GHSA-33f2-v5w3-mmvw/GHSA-33f2-v5w3-mmvw.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-33f2-v5w3-mmvw",
"modified": "2025-05-15T21:31:31Z",
"modified": "2025-05-17T06:30:24Z",
"published": "2025-05-15T21:31:31Z",
"aliases": [
"CVE-2024-6665"
],
"details": "The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-15T20:15:55Z"
advisories/unreviewed/2025/05/GHSA-37c5-cj42-grq7/GHSA-37c5-cj42-grq7.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-37c5-cj42-grq7",
"modified": "2025-05-15T21:31:32Z",
"modified": "2025-05-17T06:30:24Z",
"published": "2025-05-15T21:31:32Z",
"aliases": [
"CVE-2024-7758"
],
"details": "The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege users of contributor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-15T20:15:56Z"
advisories/unreviewed/2025/05/GHSA-3m52-6qc2-vwqh/GHSA-3m52-6qc2-vwqh.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3m52-6qc2-vwqh",
"modified": "2025-05-15T21:31:33Z",
"modified": "2025-05-17T06:30:26Z",
"published": "2025-05-15T21:31:33Z",
"aliases": [
"CVE-2024-8702"
],
"details": "The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-15T20:15:59Z"
advisories/unreviewed/2025/05/GHSA-3q32-7qwj-m73v/GHSA-3q32-7qwj-m73v.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3q32-7qwj-m73v",
"modified": "2025-05-15T21:31:31Z",
"modified": "2025-05-17T06:30:24Z",
"published": "2025-05-15T21:31:31Z",
"aliases": [
"CVE-2024-6667"
],
"details": "The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-15T20:15:55Z"
advisories/unreviewed/2025/05/GHSA-4jg8-qc3w-j5hx/GHSA-4jg8-qc3w-j5hx.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4jg8-qc3w-j5hx",
"modified": "2025-05-15T21:31:32Z",
"modified": "2025-05-17T06:30:24Z",
"published": "2025-05-15T21:31:32Z",
"aliases": [
"CVE-2024-7556"
],
"details": "The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-15T20:15:56Z"
advisories/unreviewed/2025/05/GHSA-4p7f-6rw5-m5v7/GHSA-4p7f-6rw5-m5v7.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4p7f-6rw5-m5v7",
"modified": "2025-05-02T15:31:48Z",
"modified": "2025-05-17T06:30:24Z",
"published": "2025-05-02T15:31:47Z",
"aliases": [
"CVE-2025-2605"
@@ -22,6 +22,10 @@
{
"type": "WEB",
"url": "https://www.honeywell.com/us/en/product-security#security-notices"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/May/19"
}
],
"database_specific": {
advisories/unreviewed/2025/05/GHSA-5c34-m5vc-78j5/GHSA-5c34-m5vc-78j5.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5c34-m5vc-78j5",
"modified": "2025-05-15T21:31:32Z",
"modified": "2025-05-17T06:30:25Z",
"published": "2025-05-15T21:31:32Z",
"aliases": [
"CVE-2024-8284"
],
"details": "The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-15T20:15:58Z"
advisories/unreviewed/2025/05/GHSA-6925-xwwp-qwh5/GHSA-6925-xwwp-qwh5.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6925-xwwp-qwh5",
"modified": "2025-05-15T21:31:32Z",
"modified": "2025-05-17T06:30:25Z",
"published": "2025-05-15T21:31:32Z",
"aliases": [
"CVE-2024-8286"
],
"details": "The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs via CSRF attacks",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-15T20:15:58Z"
advisories/unreviewed/2025/05/GHSA-6c4h-4fjm-m75j/GHSA-6c4h-4fjm-m75j.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6c4h-4fjm-m75j",
"modified": "2025-05-15T21:31:33Z",
"modified": "2025-05-17T06:30:26Z",
"published": "2025-05-15T21:31:33Z",
"aliases": [
"CVE-2024-8542"
],
"details": "The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-15T20:15:58Z"
advisories/unreviewed/2025/05/GHSA-7pq2-p2r6-3h8r/GHSA-7pq2-p2r6-3h8r.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7pq2-p2r6-3h8r",
"modified": "2025-05-15T21:31:33Z",
"modified": "2025-05-17T06:30:27Z",
"published": "2025-05-15T21:31:33Z",
"aliases": [
"CVE-2024-9238"
],
"details": "The AVIF Uploader WordPress plugin before 1.1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-15T20:16:00Z"
advisories/unreviewed/2025/05/GHSA-7rm6-cjw9-cf8v/GHSA-7rm6-cjw9-cf8v.json
+29
View File
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7rm6-cjw9-cf8v",
"modified": "2025-05-17T06:30:28Z",
"published": "2025-05-17T06:30:28Z",
"aliases": [
"CVE-2025-4190"
],
"details": "The CSV Mass Importer WordPress plugin through 1.2 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4190"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/e525ece5-6e03-4aee-bf5b-6ae0b961f027"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-17T06:15:18Z"
}
}
advisories/unreviewed/2025/05/GHSA-7vrj-wjmg-rqm2/GHSA-7vrj-wjmg-rqm2.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7vrj-wjmg-rqm2",
"modified": "2025-05-15T21:31:32Z",
"modified": "2025-05-17T06:30:25Z",
"published": "2025-05-15T21:31:32Z",
"aliases": [
"CVE-2024-7761"
],
"details": "In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-15T20:15:56Z"
advisories/unreviewed/2025/05/GHSA-8hqp-jvp3-493j/GHSA-8hqp-jvp3-493j.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8hqp-jvp3-493j",
"modified": "2025-05-17T06:30:28Z",
"published": "2025-05-17T06:30:28Z",
"aliases": [
"CVE-2025-4391"
],
"details": "The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the echo_generate_featured_image() function in all versions up to, and including, 5.4.8.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4391"
},
{
"type": "WEB",
"url": "https://codecanyon.net/item/echo-rss-feed-post-generator-plugin-for-wordpress/19486974"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/72de9f64-f3e0-4705-adc1-6c22076b382f?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-17T06:15:19Z"
}
}
advisories/unreviewed/2025/05/GHSA-8xqm-w2cq-fmc6/GHSA-8xqm-w2cq-fmc6.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8xqm-w2cq-fmc6",
"modified": "2025-05-15T21:31:33Z",
"modified": "2025-05-17T06:30:27Z",
"published": "2025-05-15T21:31:33Z",
"aliases": [
"CVE-2024-9233"
],
"details": "The Logo Slider WordPress plugin before 3.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-15T20:16:00Z"
advisories/unreviewed/2025/05/GHSA-93mr-fwrq-w2xg/GHSA-93mr-fwrq-w2xg.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-93mr-fwrq-w2xg",
"modified": "2025-05-15T21:31:32Z",
"modified": "2025-05-17T06:30:24Z",
"published": "2025-05-15T21:31:32Z",
"aliases": [
"CVE-2024-6809"
],
"details": "The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-15T20:15:56Z"
advisories/unreviewed/2025/05/GHSA-96q3-fjrx-h9hh/GHSA-96q3-fjrx-h9hh.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-96q3-fjrx-h9hh",
"modified": "2025-05-16T18:31:06Z",
"modified": "2025-05-17T06:30:27Z",
"published": "2025-05-16T18:31:06Z",
"aliases": [
"CVE-2025-47916"
@@ -26,6 +26,10 @@
{
"type": "WEB",
"url": "https://karmainsecurity.com/KIS-2025-02"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/May/4"
}
],
"database_specific": {
advisories/unreviewed/2025/05/GHSA-9m4x-m322-8xcp/GHSA-9m4x-m322-8xcp.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9m4x-m322-8xcp",
"modified": "2025-05-15T21:31:32Z",
"modified": "2025-05-17T06:30:25Z",
"published": "2025-05-15T21:31:32Z",
"aliases": [
"CVE-2024-7759"
],
"details": "The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-15T20:15:56Z"

Some files were not shown because too many files have changed in this diff Show More