Skip to content

Commit 2faefd6

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3h7r-f34v-h2h3 GHSA-6w66-j7h2-8jjr GHSA-8jc6-q7jq-r8wg GHSA-m496-m5ff-4j4p GHSA-pj23-86ww-f72p GHSA-q6cr-5pc5-4693 GHSA-v539-hv42-wghc
1 parent b2f5975 commit 2faefd6

7 files changed

Lines changed: 372 additions & 0 deletions

File tree

‎advisories/unreviewed/2025/12/GHSA-3h7r-f34v-h2h3/GHSA-3h7r-f34v-h2h3.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3h7r-f34v-h2h3",
4+
"modified": "2025-12-28T18:30:26Z",
5+
"published": "2025-12-28T18:30:26Z",
6+
"aliases": [
7+
"CVE-2025-15142"
8+
],
9+
"details": "A vulnerability was identified in 9786 phpok3w up to 901d96a06809fb28b17f3a4362c59e70411c933c. Impacted is an unknown function of the file show.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15142"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gitee.com/9786/phpok3w/issues/IDD1IZ"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.338520"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.338520"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.715574"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-28T16:15:50Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-6w66-j7h2-8jjr/GHSA-6w66-j7h2-8jjr.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6w66-j7h2-8jjr",
4+
"modified": "2025-12-28T18:30:26Z",
5+
"published": "2025-12-28T18:30:26Z",
6+
"aliases": [
7+
"CVE-2025-15143"
8+
],
9+
"details": "A security flaw has been discovered in EyouCMS up to 1.7.6. The affected element is an unknown function of the file /application/admin/logic/FilemanagerLogic.php of the component Backend Template Management. The manipulation of the argument content results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15143"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://note-hxlab.wetolink.com/share/XfINjg5i25Ud"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.338521"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.338521"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.716078"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-28T16:15:51Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-8jc6-q7jq-r8wg/GHSA-8jc6-q7jq-r8wg.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8jc6-q7jq-r8wg",
4+
"modified": "2025-12-28T18:30:26Z",
5+
"published": "2025-12-28T18:30:26Z",
6+
"aliases": [
7+
"CVE-2025-15146"
8+
],
9+
"details": "A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. This impacts the function doUserList of the file src/main/java/com/sohu/cache/web/controller/UserManageController.java. Performing manipulation results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15146"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/sohutv/cachecloud/issues/366"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/sohutv/cachecloud/issues/366#issue-3733542570"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.338524"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.338524"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.716302"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-79"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-28T18:15:47Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-m496-m5ff-4j4p/GHSA-m496-m5ff-4j4p.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m496-m5ff-4j4p",
4+
"modified": "2025-12-28T18:30:27Z",
5+
"published": "2025-12-28T18:30:27Z",
6+
"aliases": [
7+
"CVE-2025-15148"
8+
],
9+
"details": "A flaw has been found in CmsEasy up to 7.7.7. Affected is the function savetemp_action in the library /lib/admin/template_admin.php of the component Backend Template Management Page. Executing manipulation of the argument content/tempdata can lead to code injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15148"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://note-hxlab.wetolink.com/share/msJH69Y06ZlS"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.338525"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.338525"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.716303"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-28T18:15:47Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-pj23-86ww-f72p/GHSA-pj23-86ww-f72p.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pj23-86ww-f72p",
4+
"modified": "2025-12-28T18:30:26Z",
5+
"published": "2025-12-28T18:30:26Z",
6+
"aliases": [
7+
"CVE-2025-68973"
8+
],
9+
"details": "In GnuPG through 2.4.8, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68973"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c#L1305-L1306"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://gpg.fail/memcpy"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://news.ycombinator.com/item?id=46403200"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.openwall.com/lists/oss-security/2025/12/28/5"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-675"
46+
],
47+
"severity": "HIGH",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-28T17:16:01Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-q6cr-5pc5-4693/GHSA-q6cr-5pc5-4693.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-q6cr-5pc5-4693",
4+
"modified": "2025-12-28T18:30:26Z",
5+
"published": "2025-12-28T18:30:26Z",
6+
"aliases": [
7+
"CVE-2025-15145"
8+
],
9+
"details": "A security vulnerability has been detected in SohuTV CacheCloud up to 3.2.0. This affects the function doTotalList of the file src/main/java/com/sohu/cache/web/controller/TotalManageController.java. Such manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15145"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/sohutv/cachecloud/issues/365"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/sohutv/cachecloud/issues/365#issue-3733522215"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.338523"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.338523"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.716301"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-79"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-28T17:16:01Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-v539-hv42-wghc/GHSA-v539-hv42-wghc.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v539-hv42-wghc",
4+
"modified": "2025-12-28T18:30:26Z",
5+
"published": "2025-12-28T18:30:26Z",
6+
"aliases": [
7+
"CVE-2025-15144"
8+
],
9+
"details": "A weakness has been identified in dayrui XunRuiCMS up to 4.7.1. The impacted element is the function dr_show_error/dr_exit_msg of the file /dayrui/Fcms/Init.php of the component JSONP Callback Handler. This manipulation of the argument callback causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15144"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://note-hxlab.wetolink.com/share/gbCf35DJ3los"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.338522"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.338522"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.716122"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-28T17:16:00Z"
51+
}
52+
}

0 commit comments

Comments
 (0)