netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-9vv2-f3c8-m9x6
GHSA-4jg7-q447-f8gx
GHSA-h92g-3xc3-ww2r
GHSA-j8p7-wwq4-9gm4
This commit is contained in:
advisory-database[bot]
2025-06-07 15:31:37 +00:00
parent 7201be5cd0
commit ee85d98f6a
4 changed files with 157 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/05/GHSA-9vv2-f3c8-m9x6/GHSA-9vv2-f3c8-m9x6.json
+9 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9vv2-f3c8-m9x6",
"modified": "2025-05-13T00:31:10Z",
"modified": "2025-06-07T15:30:18Z",
"published": "2025-05-08T21:32:57Z",
"aliases": [
"CVE-2025-28074"
@@ -26,6 +26,14 @@
{
"type": "WEB",
"url": "https://github.com/phpList/phplist3/blob/main/public_html/lists/lt.php"
},
{
"type": "WEB",
"url": "https://github.com/phpList/phplist3/compare/v3.6.14...v3.6.15"
},
{
"type": "WEB",
"url": "https://www.phplist.org/newslist/phplist-3-6-15-release-notes"
}
],
"database_specific": {
advisories/unreviewed/2025/06/GHSA-4jg7-q447-f8gx/GHSA-4jg7-q447-f8gx.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4jg7-q447-f8gx",
"modified": "2025-06-07T15:30:18Z",
"published": "2025-06-07T15:30:18Z",
"aliases": [
"CVE-2025-5836"
],
"details": "A vulnerability was found in Tenda AC9 15.03.02.13. It has been rated as critical. This issue affects the function formSetIptv of the file /goform/SetIPTVCfg of the component POST Request Handler. The manipulation of the argument list leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5836"
},
{
"type": "WEB",
"url": "https://candle-throne-f75.notion.site/Tenda-AC9-formSetIptv-209df0aa11858061ae2bcbf83918d034"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.311579"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.311579"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.591363"
},
{
"type": "WEB",
"url": "https://www.tenda.com.cn"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-07T14:15:22Z"
}
}
advisories/unreviewed/2025/06/GHSA-h92g-3xc3-ww2r/GHSA-h92g-3xc3-ww2r.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h92g-3xc3-ww2r",
"modified": "2025-06-07T15:30:18Z",
"published": "2025-06-07T15:30:18Z",
"aliases": [
"CVE-2025-49619"
],
"details": "Skyvern through 0.1.85 has a Jinja runtime leak in sdk/workflow/models/block.py.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49619"
},
{
"type": "WEB",
"url": "https://github.com/Skyvern-AI/skyvern/commit/db856cd8433a204c8b45979c70a4da1e119d949d"
}
],
"database_specific": {
"cwe_ids": [
"CWE-1336"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-07T14:15:21Z"
}
}
advisories/unreviewed/2025/06/GHSA-j8p7-wwq4-9gm4/GHSA-j8p7-wwq4-9gm4.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j8p7-wwq4-9gm4",
"modified": "2025-06-07T15:30:18Z",
"published": "2025-06-07T15:30:18Z",
"aliases": [
"CVE-2025-5837"
],
"details": "A vulnerability classified as critical has been found in PHPGurukul Employee Record Management System 1.3. Affected is an unknown function of the file /admin/allemployees.php. The manipulation of the argument delid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5837"
},
{
"type": "WEB",
"url": "https://github.com/f1rstb100d/myCVE/issues/61"
},
{
"type": "WEB",
"url": "https://phpgurukul.com"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.311580"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.311580"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.591364"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-07T14:15:22Z"
}
}