From ed89cb22c499eda73c02f84b689eb82f57829360 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Sun, 9 Mar 2025 06:33:10 +0000
Subject: [PATCH] Publish Advisories

GHSA-3cm8-c447-7fw4
GHSA-3r92-3wmq-rmm2
GHSA-9wv3-p38x-5wqv
GHSA-fr45-gqpr-4fc9
GHSA-p2v5-rvqj-c2xc
---
 .../GHSA-3cm8-c447-7fw4.json                  | 52 +++++++++++++++++++
 .../GHSA-3r92-3wmq-rmm2.json                  | 29 +++++++++++
 .../GHSA-9wv3-p38x-5wqv.json                  | 29 +++++++++++
 .../GHSA-fr45-gqpr-4fc9.json                  | 52 +++++++++++++++++++
 .../GHSA-p2v5-rvqj-c2xc.json                  | 29 +++++++++++
 5 files changed, 191 insertions(+)
 create mode 100644 advisories/unreviewed/2025/03/GHSA-3cm8-c447-7fw4/GHSA-3cm8-c447-7fw4.json
 create mode 100644 advisories/unreviewed/2025/03/GHSA-3r92-3wmq-rmm2/GHSA-3r92-3wmq-rmm2.json
 create mode 100644 advisories/unreviewed/2025/03/GHSA-9wv3-p38x-5wqv/GHSA-9wv3-p38x-5wqv.json
 create mode 100644 advisories/unreviewed/2025/03/GHSA-fr45-gqpr-4fc9/GHSA-fr45-gqpr-4fc9.json
 create mode 100644 advisories/unreviewed/2025/03/GHSA-p2v5-rvqj-c2xc/GHSA-p2v5-rvqj-c2xc.json

diff --git a/advisories/unreviewed/2025/03/GHSA-3cm8-c447-7fw4/GHSA-3cm8-c447-7fw4.json b/advisories/unreviewed/2025/03/GHSA-3cm8-c447-7fw4/GHSA-3cm8-c447-7fw4.json
new file mode 100644
index 00000000000..9603674d577
--- /dev/null
+++ b/advisories/unreviewed/2025/03/GHSA-3cm8-c447-7fw4/GHSA-3cm8-c447-7fw4.json
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3cm8-c447-7fw4",
+  "modified": "2025-03-09T06:31:42Z",
+  "published": "2025-03-09T06:31:42Z",
+  "aliases": [
+    "CVE-2025-2115"
+  ],
+  "details": "A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 3.1. Affected is the function ProcessRequest of the file /AcceptZip.ashx. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2115"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/heiheixz/report/blob/main/sk_1.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.299010"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.299010"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.506655"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-284"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-09T06:15:11Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/03/GHSA-3r92-3wmq-rmm2/GHSA-3r92-3wmq-rmm2.json b/advisories/unreviewed/2025/03/GHSA-3r92-3wmq-rmm2/GHSA-3r92-3wmq-rmm2.json
new file mode 100644
index 00000000000..32744d33a45
--- /dev/null
+++ b/advisories/unreviewed/2025/03/GHSA-3r92-3wmq-rmm2/GHSA-3r92-3wmq-rmm2.json
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3r92-3wmq-rmm2",
+  "modified": "2025-03-09T06:31:42Z",
+  "published": "2025-03-09T06:31:42Z",
+  "aliases": [
+    "CVE-2025-1382"
+  ],
+  "details": "The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1382"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/a3002265-ac83-4c00-8afb-cbfbb4afc1e9"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-09T06:15:11Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/03/GHSA-9wv3-p38x-5wqv/GHSA-9wv3-p38x-5wqv.json b/advisories/unreviewed/2025/03/GHSA-9wv3-p38x-5wqv/GHSA-9wv3-p38x-5wqv.json
new file mode 100644
index 00000000000..31d46759fbd
--- /dev/null
+++ b/advisories/unreviewed/2025/03/GHSA-9wv3-p38x-5wqv/GHSA-9wv3-p38x-5wqv.json
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9wv3-p38x-5wqv",
+  "modified": "2025-03-09T06:31:42Z",
+  "published": "2025-03-09T06:31:42Z",
+  "aliases": [
+    "CVE-2025-1362"
+  ],
+  "details": "The URL Shortener | Conversion Tracking  | AB Testing  | WooCommerce WordPress plugin through 9.0.2 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1362"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/035cc502-a514-440f-8808-5655c8c915e2"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-09T06:15:10Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/03/GHSA-fr45-gqpr-4fc9/GHSA-fr45-gqpr-4fc9.json b/advisories/unreviewed/2025/03/GHSA-fr45-gqpr-4fc9/GHSA-fr45-gqpr-4fc9.json
new file mode 100644
index 00000000000..58032205d0d
--- /dev/null
+++ b/advisories/unreviewed/2025/03/GHSA-fr45-gqpr-4fc9/GHSA-fr45-gqpr-4fc9.json
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-fr45-gqpr-4fc9",
+  "modified": "2025-03-09T06:31:42Z",
+  "published": "2025-03-09T06:31:42Z",
+  "aliases": [
+    "CVE-2025-2114"
+  ],
+  "details": "A vulnerability, which was classified as problematic, has been found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This issue affects some unknown processing of the file /WebPages/Adm/OperatorStop.asp of the component Reset Password Interface. The manipulation of the argument OperId leads to improper authorization. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2114"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/zhangbuneng/an-arbitrary-user-password-reset-vulnerability-in-the-Sixun-Shanghui-7-Group/issues/1#issue-2877317082"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.299009"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.299009"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.506591"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-266"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-09T05:15:30Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/03/GHSA-p2v5-rvqj-c2xc/GHSA-p2v5-rvqj-c2xc.json b/advisories/unreviewed/2025/03/GHSA-p2v5-rvqj-c2xc/GHSA-p2v5-rvqj-c2xc.json
new file mode 100644
index 00000000000..b25f1c1f7ae
--- /dev/null
+++ b/advisories/unreviewed/2025/03/GHSA-p2v5-rvqj-c2xc/GHSA-p2v5-rvqj-c2xc.json
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-p2v5-rvqj-c2xc",
+  "modified": "2025-03-09T06:31:42Z",
+  "published": "2025-03-09T06:31:42Z",
+  "aliases": [
+    "CVE-2025-1363"
+  ],
+  "details": "The URL Shortener | Conversion Tracking  | AB Testing  | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1363"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/16b08e77-3562-4506-9b28-abd1b1128b0a"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-09T06:15:11Z"
+  }
+}
\ No newline at end of file