Skip to content

Commit dd60c67

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-27q7-wp8x-jjqq GHSA-2v5q-fm75-vvjv GHSA-c42p-mjmp-r2p3 GHSA-cw84-p4q3-v7wm GHSA-fhvp-377r-h69j GHSA-fw9r-r3mq-2mc5 GHSA-g496-f5j2-wg37 GHSA-g57h-5w9h-27v7 GHSA-hhj5-vff4-phcr GHSA-jc6x-m3w9-p954 GHSA-p99v-hv4j-4qrr GHSA-rqvv-2vf7-q48w GHSA-vvcw-w9h4-xjfh GHSA-w6hx-92x2-67r3
1 parent c363ba8 commit dd60c67

14 files changed

Lines changed: 485 additions & 0 deletions

File tree

‎advisories/unreviewed/2025/11/GHSA-27q7-wp8x-jjqq/GHSA-27q7-wp8x-jjqq.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-27q7-wp8x-jjqq",
4+
"modified": "2025-11-15T06:30:15Z",
5+
"published": "2025-11-15T06:30:15Z",
6+
"aliases": [
7+
"CVE-2025-13189"
8+
],
9+
"details": "A vulnerability has been found in D-Link DIR-816L 2_06_b09_beta. This affects the function genacgi_main of the file gena.cgi. The manipulation of the argument SERVER_ID/HTTP_SID leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13189"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/scanleale/IOT_sec/blob/main/DIR-816L%20stack%20overflow(gena.cgi).pdf"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.332478"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.332478"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.685540"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.dlink.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-15T06:15:43Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-2v5q-fm75-vvjv/GHSA-2v5q-fm75-vvjv.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2v5q-fm75-vvjv",
4+
"modified": "2025-11-15T06:30:14Z",
5+
"published": "2025-11-15T06:30:14Z",
6+
"aliases": [
7+
"CVE-2025-65065"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65065"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-11-15T04:15:57Z"
24+
}
25+
}

‎advisories/unreviewed/2025/11/GHSA-c42p-mjmp-r2p3/GHSA-c42p-mjmp-r2p3.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c42p-mjmp-r2p3",
4+
"modified": "2025-11-15T06:30:15Z",
5+
"published": "2025-11-15T06:30:15Z",
6+
"aliases": [
7+
"CVE-2025-12494"
8+
],
9+
"details": "The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajax_import_file function in all versions up to, and including, 2.12.28. This makes it possible for authenticated attackers, with author-level access and above, to move arbitrary image files on the server.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12494"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.12.26/includes/admin/class-modula-gallery-upload.php#L554"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.12.26/includes/admin/class-modula-gallery-upload.php#L567"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.12.26/includes/admin/class-modula-gallery-upload.php#L589"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.12.26/includes/admin/class-modula-gallery-upload.php#L597"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://plugins.trac.wordpress.org/changeset/3391790/modula-best-grid-gallery/trunk?contextall=1&old=3390878&old_path=%2Fmodula-best-grid-gallery%2Ftrunk"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://research.cleantalk.org/cve-2025-12494"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca423309-d8bd-46a4-9e88-9534d9c60b4a?source=cve"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-285"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2025-11-15T06:15:42Z"
59+
}
60+
}

‎advisories/unreviewed/2025/11/GHSA-cw84-p4q3-v7wm/GHSA-cw84-p4q3-v7wm.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cw84-p4q3-v7wm",
4+
"modified": "2025-11-15T06:30:14Z",
5+
"published": "2025-11-15T06:30:14Z",
6+
"aliases": [
7+
"CVE-2025-65068"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65068"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-11-15T04:15:57Z"
24+
}
25+
}

‎advisories/unreviewed/2025/11/GHSA-fhvp-377r-h69j/GHSA-fhvp-377r-h69j.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fhvp-377r-h69j",
4+
"modified": "2025-11-15T06:30:14Z",
5+
"published": "2025-11-15T06:30:14Z",
6+
"aliases": [
7+
"CVE-2025-65064"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65064"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-11-15T04:15:56Z"
24+
}
25+
}

‎advisories/unreviewed/2025/11/GHSA-fw9r-r3mq-2mc5/GHSA-fw9r-r3mq-2mc5.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fw9r-r3mq-2mc5",
4+
"modified": "2025-11-15T06:30:15Z",
5+
"published": "2025-11-15T06:30:15Z",
6+
"aliases": [
7+
"CVE-2025-8994"
8+
],
9+
"details": "The Project Management, Team Collaboration, Kanban Board, Gantt Charts, Task Manager and More – WP Project Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘completed_at_operator’ parameter in all versions up to, and including, 2.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8994"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/2.6.24/src/Task/Helper/Task.php#L1484"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/changeset/3386164"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/74984cc6-06b1-4c3a-a3e6-9e104c71e9c5?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-89"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-11-15T06:15:43Z"
43+
}
44+
}

‎advisories/unreviewed/2025/11/GHSA-g496-f5j2-wg37/GHSA-g496-f5j2-wg37.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g496-f5j2-wg37",
4+
"modified": "2025-11-15T06:30:15Z",
5+
"published": "2025-11-15T06:30:15Z",
6+
"aliases": [
7+
"CVE-2025-65069"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65069"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-11-15T04:15:57Z"
24+
}
25+
}

‎advisories/unreviewed/2025/11/GHSA-g57h-5w9h-27v7/GHSA-g57h-5w9h-27v7.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g57h-5w9h-27v7",
4+
"modified": "2025-11-15T06:30:15Z",
5+
"published": "2025-11-15T06:30:15Z",
6+
"aliases": [
7+
"CVE-2025-65072"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65072"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-11-15T04:15:57Z"
24+
}
25+
}

‎advisories/unreviewed/2025/11/GHSA-hhj5-vff4-phcr/GHSA-hhj5-vff4-phcr.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hhj5-vff4-phcr",
4+
"modified": "2025-11-15T06:30:14Z",
5+
"published": "2025-11-15T06:30:14Z",
6+
"aliases": [
7+
"CVE-2025-12182"
8+
],
9+
"details": "The Qi Blocks plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the `resize_image_callback()` function in all versions up to, and including, 1.4.3. This is due to the plugin not properly verifying that a user has permission to resize a specific attachment. This makes it possible for authenticated attackers, with Contributor-level access and above, to resize arbitrary media library images belonging to other users, which can result in unintended file writes, disk consumption, and server resource abuse through processing of large images.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12182"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/qi-blocks/tags/1.4.3/inc/media/class-qi-blocks-media.php#L138"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/changeset/3387712/qi-blocks/trunk/inc/media/class-qi-blocks-media.php"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/41b0b12f-ff52-4913-aa54-3fbaf0839959?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-284"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-11-15T04:15:55Z"
43+
}
44+
}

‎advisories/unreviewed/2025/11/GHSA-jc6x-m3w9-p954/GHSA-jc6x-m3w9-p954.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jc6x-m3w9-p954",
4+
"modified": "2025-11-15T06:30:14Z",
5+
"published": "2025-11-15T06:30:14Z",
6+
"aliases": [
7+
"CVE-2025-65066"
8+
],
9+
"details": "Rejected reason: Not used",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65066"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-11-15T04:15:57Z"
24+
}
25+
}

0 commit comments

Comments
 (0)