Publish Advisories

GHSA-f4w4-7455-jm45 GHSA-p3g3-qcxj-gm4g
2026-05-22 18:04:22 -07:00 · 2025-02-03 03:32:00 +00:00
parent 735d2d8106
commit c92baaebe7
2 changed files with 104 additions and 0 deletions
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-f4w4-7455-jm45",
+  "modified": "2025-02-03T03:30:53Z",
+  "published": "2025-02-03T03:30:53Z",
+  "aliases": [
+    "CVE-2025-0973"
+  ],
+  "details": "A vulnerability classified as critical was found in CmsEasy 7.7.7.9. This vulnerability affects the function backAll_action in the library lib/admin/database_admin.php of the file /index.php?case=database&act=backAll&admin_dir=admin&site=default. The manipulation of the argument select[] leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0973"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Sinon2003/cve/blob/main/CmsEasy/CmsEasy-V7.7.7.9%2020240105-Directory%20Traversal.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.294364"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.294364"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.487649"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-03T01:15:07Z"
+  }
+}
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-p3g3-qcxj-gm4g",
+  "modified": "2025-02-03T03:30:53Z",
+  "published": "2025-02-03T03:30:53Z",
+  "aliases": [
+    "CVE-2025-0974"
+  ],
+  "details": "A vulnerability, which was classified as critical, has been found in MaxD Lightning Module 4.43 on OpenCart. This issue affects some unknown processing. The manipulation of the argument li_op/md leads to deserialization. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0974"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gist.github.com/mcdruid/f8153d7d535c0fcba920e83a64953d4e"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.294365"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.294365"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.489672"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20"
+    ],
+    "severity": "LOW",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-03T02:15:26Z"
+  }
+}