Publish Advisories

GHSA-6jx6-mrpj-vr27 GHSA-f54f-hr32-586f GHSA-hgm9-29r5-x94q GHSA-mr9x-8334-2fgf GHSA-w4rj-x734-wm94
2026-05-22 18:04:22 -07:00 · 2025-05-03 21:31:58 +00:00
parent 80c8d52170
commit c1a1373c89
5 changed files with 248 additions and 0 deletions
@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6jx6-mrpj-vr27",
+  "modified": "2025-05-03T21:30:23Z",
+  "published": "2025-05-03T21:30:23Z",
+  "aliases": [
+    "CVE-2025-4244"
+  ],
+  "details": "A vulnerability, which was classified as critical, was found in code-projects Online Bus Reservation System 1.0. This affects an unknown part of the file /seatlocation.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4244"
+    },
+    {
+      "type": "WEB",
+      "url": "https://code-projects.org"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/zzZxby/Vulnerability-Exploration/blob/main/Online%20Bus%20Reservation%20System/Online%20Bus%20Reservation%20System2.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.307335"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.307335"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.562691"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-74"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-03T20:15:16Z"
+  }
+}
@@ -0,0 +1,44 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-f54f-hr32-586f",
+  "modified": "2025-05-03T21:30:23Z",
+  "published": "2025-05-03T21:30:23Z",
+  "aliases": [
+    "CVE-2025-47241"
+  ],
+  "details": "In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/browser-use/browser-use/security/advisories/GHSA-x39x-9qw5-ghrf"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47241"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/browser-use/browser-use/pull/1561"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/browser-use/browser-use/releases/tag/0.1.45"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-647"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-03T21:15:48Z"
+  }
+}
@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-hgm9-29r5-x94q",
+  "modified": "2025-05-03T21:30:23Z",
+  "published": "2025-05-03T21:30:23Z",
+  "aliases": [
+    "CVE-2025-4242"
+  ],
+  "details": "A vulnerability classified as critical was found in PHPGurukul Online Birth Certificate System 2.0. Affected by this vulnerability is an unknown functionality of the file /admin/between-dates-report.php. The manipulation of the argument fromdate leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4242"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/bluechips-zhao/myCVE/issues/8"
+    },
+    {
+      "type": "WEB",
+      "url": "https://phpgurukul.com"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.307333"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.307333"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.562624"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-74"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-03T19:15:48Z"
+  }
+}
@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-mr9x-8334-2fgf",
+  "modified": "2025-05-03T21:30:23Z",
+  "published": "2025-05-03T21:30:23Z",
+  "aliases": [
+    "CVE-2025-4243"
+  ],
+  "details": "A vulnerability, which was classified as critical, has been found in code-projects Online Bus Reservation System 1.0. Affected by this issue is some unknown functionality of the file /print.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4243"
+    },
+    {
+      "type": "WEB",
+      "url": "https://code-projects.org"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/zzZxby/Vulnerability-Exploration/blob/main/Online%20Bus%20Reservation%20System/Online%20Bus%20Reservation%20System1.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.307334"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.307334"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.562690"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-74"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-03T19:15:49Z"
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-w4rj-x734-wm94",
+  "modified": "2025-05-03T21:30:23Z",
+  "published": "2025-05-03T21:30:23Z",
+  "aliases": [
+    "CVE-2025-1838"
+  ],
+  "details": "IBM Cloud Pak for Business Automation\n\n 24.0.0 and 24.0.1 through 24.0.1 IF001 \n\nAuthoring allows an authenticated user to bypass client-side data validation in an authoring user interface which could cause a denial of service.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1838"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.ibm.com/support/pages/node/7232429"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-602"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-03T19:15:48Z"
+  }
+}