Skip to content

Commit 01843fc

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 30c1963 commit 01843fc

32 files changed

Lines changed: 1572 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/02/GHSA-34qg-fch7-c5r6/GHSA-34qg-fch7-c5r6.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-34qg-fch7-c5r6",
4+
"modified": "2026-02-01T15:32:31Z",
5+
"published": "2026-02-01T15:32:30Z",
6+
"aliases": [
7+
"CVE-2021-47914"
8+
],
9+
"details": "PHP Melody version 3.0 contains a persistent cross-site scripting vulnerability in the edit-video.php submitted parameter that allows remote attackers to inject malicious script code. Attackers can exploit this vulnerability to execute arbitrary JavaScript, potentially leading to session hijacking, persistent phishing, and manipulation of application modules.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47914"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.phpsugar.com/phpmelody.html"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/php-melody-persistent-xss-vulnerability-via-edit-video-parameter"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.vulnerability-lab.com/get_content.php?id=2292"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-02-01T13:15:55Z"
51+
}
52+
}

‎advisories/unreviewed/2026/02/GHSA-4c7c-97vp-w235/GHSA-4c7c-97vp-w235.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4c7c-97vp-w235",
4+
"modified": "2026-02-01T15:32:31Z",
5+
"published": "2026-02-01T15:32:31Z",
6+
"aliases": [
7+
"CVE-2023-54343"
8+
],
9+
"details": "QWE DL 2.0.1 mobile web application contains a persistent input validation vulnerability allowing remote attackers to inject malicious script code through path parameter manipulation. Attackers can exploit the vulnerability to execute persistent cross-site scripting attacks, potentially leading to session hijacking and application module manipulation.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-54343"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://apps.apple.com/us/app/qwe/id935520103"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/qwe-dl-persistent-xss-vulnerability-via-path-parameter"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulnerability-lab.com/get_content.php?id=2326"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-79"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-02-01T13:15:58Z"
47+
}
48+
}

‎advisories/unreviewed/2026/02/GHSA-5m25-34q2-5599/GHSA-5m25-34q2-5599.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5m25-34q2-5599",
4+
"modified": "2026-02-01T15:32:30Z",
5+
"published": "2026-02-01T15:32:30Z",
6+
"aliases": [
7+
"CVE-2021-47911"
8+
],
9+
"details": "Affiliate Pro 1.7 contains multiple reflected cross-site scripting vulnerabilities in the index module's input fields. Attackers can inject malicious scripts through fullname, username, and email parameters to execute client-side attacks and manipulate browser requests.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47911"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://codecanyon.net/item/affiliate-pro-affiliate-management-system/12908496"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://jdwebdesigner.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/affiliate-pro-reflected-cross-site-scripting-via-index-module"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.vulnerability-lab.com/get_content.php?id=2281"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-02-01T13:15:55Z"
51+
}
52+
}

‎advisories/unreviewed/2026/02/GHSA-5p8g-6vrq-jcmp/GHSA-5p8g-6vrq-jcmp.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5p8g-6vrq-jcmp",
4+
"modified": "2026-02-01T15:32:31Z",
5+
"published": "2026-02-01T15:32:31Z",
6+
"aliases": [
7+
"CVE-2022-50950"
8+
],
9+
"details": "Webile 1.0.1 contains a directory traversal vulnerability that allows remote attackers to manipulate file system paths without authentication. Attackers can exploit path manipulation to access sensitive system directories and potentially compromise the mobile device's local file system.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50950"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://play.google.com/store/apps/details?id=com.techprd.filetransfer&hl=en_US"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/webile-directory-traversal-vulnerability-via-web-application"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulnerability-lab.com/get_content.php?id=2320"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-22"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-02-01T13:15:57Z"
47+
}
48+
}

‎advisories/unreviewed/2026/02/GHSA-5w42-2fm6-qvmc/GHSA-5w42-2fm6-qvmc.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5w42-2fm6-qvmc",
4+
"modified": "2026-02-01T15:32:30Z",
5+
"published": "2026-02-01T15:32:30Z",
6+
"aliases": [
7+
"CVE-2021-47916"
8+
],
9+
"details": "Simple CMS 2.1 contains a remote SQL injection vulnerability that allows privileged attackers to inject unfiltered SQL commands in the users module. Attackers can exploit unvalidated input parameters in the admin.php file to compromise the database management system and web application.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47916"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://simplephpscripts.com/simple-cms-php"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/simple-cms-sql-injection-vulnerability-via-users-module"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulnerability-lab.com/get_content.php?id=2303"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-89"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-02-01T13:15:55Z"
47+
}
48+
}

‎advisories/unreviewed/2026/02/GHSA-6hrv-vgx8-q9xm/GHSA-6hrv-vgx8-q9xm.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6hrv-vgx8-q9xm",
4+
"modified": "2026-02-01T15:32:31Z",
5+
"published": "2026-02-01T15:32:31Z",
6+
"aliases": [
7+
"CVE-2020-37063"
8+
],
9+
"details": "TFTP Turbo 4.6.1273 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that will be launched with LocalSystem permissions.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37063"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.exploit-db.com/exploits/48085"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/tftp-turbo-tftp-turbo-unquoted-service-path"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.weird-solutions.com"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-428"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-02-01T15:16:04Z"
47+
}
48+
}

‎advisories/unreviewed/2026/02/GHSA-6q9f-h462-2vqv/GHSA-6q9f-h462-2vqv.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6q9f-h462-2vqv",
4+
"modified": "2026-02-01T15:32:31Z",
5+
"published": "2026-02-01T15:32:31Z",
6+
"aliases": [
7+
"CVE-2020-37048"
8+
],
9+
"details": "Iskysoft Application Framework Service 2.4.3.241 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that would be run with the service's high-level system permissions.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37048"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.exploit-db.com/exploits/48171"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.iskysoft.us"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/iskysoft-application-framework-service-isappservice-unquoted-service-path"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-428"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-02-01T15:16:03Z"
47+
}
48+
}

0 commit comments

Comments
 (0)