netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-pg65-86gh-q227
GHSA-qqm5-4wx3-f56x
GHSA-c2rf-m726-rrr8
GHSA-cfqc-4q39-jp6f
GHSA-fgvj-q3hx-cpwr
GHSA-m9p6-4vvj-3w8m
GHSA-mxvp-mc7m-q699
This commit is contained in:
advisory-database[bot]
2025-04-18 03:32:39 +00:00
parent 6439f39496
commit fb9ace148f
7 changed files with 229 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/02/GHSA-pg65-86gh-q227/GHSA-pg65-86gh-q227.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pg65-86gh-q227",
"modified": "2025-04-18T03:31:21Z",
"published": "2025-02-04T15:31:38Z",
"aliases": [
"CVE-2025-22664"
],
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Survey Maker team Survey Maker allows Stored XSS. This issue affects Survey Maker: from n/a through 5.1.3.5.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22664"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/survey-maker/vulnerability/wordpress-survey-maker-plugin-5-1-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-04T15:15:21Z"
}
}
advisories/unreviewed/2025/02/GHSA-qqm5-4wx3-f56x/GHSA-qqm5-4wx3-f56x.json
+2 -1
View File
@@ -42,7 +42,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-74"
"CWE-74",
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2025/04/GHSA-c2rf-m726-rrr8/GHSA-c2rf-m726-rrr8.json
+31
View File
@@ -0,0 +1,31 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c2rf-m726-rrr8",
"modified": "2025-04-18T03:31:22Z",
"published": "2025-04-18T03:31:22Z",
"aliases": [
"CVE-2025-0467"
],
"details": "Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0467"
},
{
"type": "WEB",
"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities"
}
],
"database_specific": {
"cwe_ids": [
"CWE-823"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-18T01:15:32Z"
}
}
advisories/unreviewed/2025/04/GHSA-cfqc-4q39-jp6f/GHSA-cfqc-4q39-jp6f.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cfqc-4q39-jp6f",
"modified": "2025-04-18T03:31:22Z",
"published": "2025-04-18T03:31:22Z",
"aliases": [
"CVE-2025-2613"
],
"details": "The Login Manager – Design Login Page, View Login Activity, Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom logo and background URLs in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2613"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/customized-login/trunk/customized-login.php#L199"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d2ea5e34-9303-43c8-8579-80ef02e1d9c4?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-18T02:15:14Z"
}
}
advisories/unreviewed/2025/04/GHSA-fgvj-q3hx-cpwr/GHSA-fgvj-q3hx-cpwr.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fgvj-q3hx-cpwr",
"modified": "2025-04-18T03:31:22Z",
"published": "2025-04-18T03:31:22Z",
"aliases": [
"CVE-2025-25427"
],
"details": "A Stored cross-site scripting (XSS)\nvulnerability in upnp page of the web Interface in TP-Link WR841N <=4.19\nallows remote attackers to inject arbitrary JavaScript code via the port\nmapping description. This leads to \n\nan execution of the JavaScript payload when the upnp page is loaded.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25427"
},
{
"type": "WEB",
"url": "https://github.com/slin99/2025-25427"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-18T01:15:32Z"
}
}
advisories/unreviewed/2025/04/GHSA-m9p6-4vvj-3w8m/GHSA-m9p6-4vvj-3w8m.json
+44
View File
@@ -0,0 +1,44 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m9p6-4vvj-3w8m",
"modified": "2025-04-18T03:31:22Z",
"published": "2025-04-18T03:31:22Z",
"aliases": [
"CVE-2025-3520"
],
"details": "The Avatar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 0.1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3520"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/avatar/trunk/avatar.php#L417"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/avatar"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/01769760-5bfe-4352-bc5b-141f078c0b6d?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-18T02:15:14Z"
}
}
advisories/unreviewed/2025/04/GHSA-mxvp-mc7m-q699/GHSA-mxvp-mc7m-q699.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mxvp-mc7m-q699",
"modified": "2025-04-18T03:31:22Z",
"published": "2025-04-18T03:31:22Z",
"aliases": [
"CVE-2024-13650"
],
"details": "The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'PAFE Before After Image Comparison Slider' widget in all versions up to, and including, 2.4.34 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13650"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/piotnet-addons-for-elementor"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4e3d0ffd-209b-4e29-bc1d-91f2498b4632?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-18T02:15:14Z"
}
}