netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3cm8-c447-7fw4
GHSA-3r92-3wmq-rmm2
GHSA-9wv3-p38x-5wqv
GHSA-fr45-gqpr-4fc9
GHSA-p2v5-rvqj-c2xc
This commit is contained in:
advisory-database[bot]
2025-03-09 06:33:10 +00:00
parent b526221d9c
commit ed89cb22c4
5 changed files with 191 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/03/GHSA-3cm8-c447-7fw4/GHSA-3cm8-c447-7fw4.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3cm8-c447-7fw4",
"modified": "2025-03-09T06:31:42Z",
"published": "2025-03-09T06:31:42Z",
"aliases": [
"CVE-2025-2115"
],
"details": "A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 3.1. Affected is the function ProcessRequest of the file /AcceptZip.ashx. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2115"
},
{
"type": "WEB",
"url": "https://github.com/heiheixz/report/blob/main/sk_1.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.299010"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.299010"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.506655"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-09T06:15:11Z"
}
}
advisories/unreviewed/2025/03/GHSA-3r92-3wmq-rmm2/GHSA-3r92-3wmq-rmm2.json
+29
View File
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3r92-3wmq-rmm2",
"modified": "2025-03-09T06:31:42Z",
"published": "2025-03-09T06:31:42Z",
"aliases": [
"CVE-2025-1382"
],
"details": "The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1382"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/a3002265-ac83-4c00-8afb-cbfbb4afc1e9"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-09T06:15:11Z"
}
}
advisories/unreviewed/2025/03/GHSA-9wv3-p38x-5wqv/GHSA-9wv3-p38x-5wqv.json
+29
View File
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9wv3-p38x-5wqv",
"modified": "2025-03-09T06:31:42Z",
"published": "2025-03-09T06:31:42Z",
"aliases": [
"CVE-2025-1362"
],
"details": "The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1362"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/035cc502-a514-440f-8808-5655c8c915e2"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-09T06:15:10Z"
}
}
advisories/unreviewed/2025/03/GHSA-fr45-gqpr-4fc9/GHSA-fr45-gqpr-4fc9.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fr45-gqpr-4fc9",
"modified": "2025-03-09T06:31:42Z",
"published": "2025-03-09T06:31:42Z",
"aliases": [
"CVE-2025-2114"
],
"details": "A vulnerability, which was classified as problematic, has been found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This issue affects some unknown processing of the file /WebPages/Adm/OperatorStop.asp of the component Reset Password Interface. The manipulation of the argument OperId leads to improper authorization. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2114"
},
{
"type": "WEB",
"url": "https://github.com/zhangbuneng/an-arbitrary-user-password-reset-vulnerability-in-the-Sixun-Shanghui-7-Group/issues/1#issue-2877317082"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.299009"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.299009"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.506591"
}
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-09T05:15:30Z"
}
}
advisories/unreviewed/2025/03/GHSA-p2v5-rvqj-c2xc/GHSA-p2v5-rvqj-c2xc.json
+29
View File
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p2v5-rvqj-c2xc",
"modified": "2025-03-09T06:31:42Z",
"published": "2025-03-09T06:31:42Z",
"aliases": [
"CVE-2025-1363"
],
"details": "The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1363"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/16b08e77-3562-4506-9b28-abd1b1128b0a"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-09T06:15:11Z"
}
}