Skip to content

Commit 0199bb2

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 304ec10 commit 0199bb2

39 files changed

Lines changed: 1229 additions & 17 deletions

File tree

‎advisories/unreviewed/2021/11/GHSA-cqc3-xrjw-8pwv/GHSA-cqc3-xrjw-8pwv.json‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-cqc3-xrjw-8pwv",
4-
"modified": "2021-11-30T00:00:51Z",
4+
"modified": "2026-01-30T18:31:10Z",
55
"published": "2021-11-30T00:00:51Z",
66
"aliases": [
77
"CVE-2021-24749"
88
],
99
"details": "The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow attackers to make a logged in admin delete arbitrary link and group via a CSRF attack.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{

‎advisories/unreviewed/2026/01/GHSA-286p-xvv8-3qx5/GHSA-286p-xvv8-3qx5.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-286p-xvv8-3qx5",
4+
"modified": "2026-01-30T18:31:15Z",
5+
"published": "2026-01-30T18:31:15Z",
6+
"aliases": [
7+
"CVE-2020-37003"
8+
],
9+
"details": "Sellacious eCommerce 4.6 contains a persistent cross-site scripting vulnerability in the Manage Your Addresses module that allows attackers to inject malicious scripts. Attackers can exploit multiple address input fields like full name, company, and address to execute persistent script code that can hijack user sessions and manipulate application modules.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37003"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.exploit-db.com/exploits/48467"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.sellacious.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.sellacious.com/free-open-source-ecommerce-software"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.vulncheck.com/advisories/sellacious-ecommerce-persistent-cross-site-scripting"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.vulnerability-lab.com/get_content.php?id=2226"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-79"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-01-30T17:16:10Z"
55+
}
56+
}

‎advisories/unreviewed/2026/01/GHSA-2xxq-pq3h-297f/GHSA-2xxq-pq3h-297f.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2xxq-pq3h-297f",
4+
"modified": "2026-01-30T18:31:15Z",
5+
"published": "2026-01-30T18:31:15Z",
6+
"aliases": [
7+
"CVE-2026-1686"
8+
],
9+
"details": "A security flaw has been discovered in Totolink A3600R 5.9c.4959. This issue affects the function setAppEasyWizardConfig in the library /lib/cste_modules/app.so. Performing a manipulation of the argument apcliSsid results in buffer overflow. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1686"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3600R/4959-apcliSsid-setAppEasyWizardConfig.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3600R/4959-apcliSsid-setAppEasyWizardConfig.md#poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.343480"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.343480"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.740888"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://www.totolink.net"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-119"
54+
],
55+
"severity": "HIGH",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-01-30T16:16:12Z"
59+
}
60+
}

‎advisories/unreviewed/2026/01/GHSA-38mq-gg8g-j53r/GHSA-38mq-gg8g-j53r.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@
4242
],
4343
"database_specific": {
4444
"cwe_ids": [
45-
"CWE-74"
45+
"CWE-74",
46+
"CWE-77"
4647
],
4748
"severity": "MODERATE",
4849
"github_reviewed": false,

‎advisories/unreviewed/2026/01/GHSA-39cv-xcc4-9q3h/GHSA-39cv-xcc4-9q3h.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@
4242
],
4343
"database_specific": {
4444
"cwe_ids": [
45-
"CWE-77"
45+
"CWE-77",
46+
"CWE-78"
4647
],
4748
"severity": "HIGH",
4849
"github_reviewed": false,

‎advisories/unreviewed/2026/01/GHSA-3vjv-ww5h-3x77/GHSA-3vjv-ww5h-3x77.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3vjv-ww5h-3x77",
4+
"modified": "2026-01-30T18:31:15Z",
5+
"published": "2026-01-30T18:31:15Z",
6+
"aliases": [
7+
"CVE-2020-37014"
8+
],
9+
"details": "Tryton 5.4 contains a persistent cross-site scripting vulnerability in the user profile name input that allows remote attackers to inject malicious scripts. Attackers can exploit the vulnerability by inserting script payloads in the name field, which execute in the frontend and backend user interfaces.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37014"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.exploit-db.com/exploits/48466"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.tryton.org"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.tryton.org/download"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.vulncheck.com/advisories/tryton-persistent-cross-site-scripting"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.vulnerability-lab.com/get_content.php?id=2233"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-79"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-01-30T17:16:11Z"
55+
}
56+
}

‎advisories/unreviewed/2026/01/GHSA-4rcj-vhqg-6g52/GHSA-4rcj-vhqg-6g52.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4rcj-vhqg-6g52",
4-
"modified": "2026-01-22T18:30:39Z",
4+
"modified": "2026-01-30T18:31:14Z",
55
"published": "2026-01-22T18:30:39Z",
66
"aliases": [
77
"CVE-2026-0534"

‎advisories/unreviewed/2026/01/GHSA-4vwr-5vph-4mjg/GHSA-4vwr-5vph-4mjg.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4vwr-5vph-4mjg",
4+
"modified": "2026-01-30T18:31:16Z",
5+
"published": "2026-01-30T18:31:16Z",
6+
"aliases": [
7+
"CVE-2025-15497"
8+
],
9+
"details": "Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resulting in a denial of service",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15497"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://community.openvpn.net/Security%20Announcements/CVE-2025-15497"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-617"
30+
],
31+
"severity": "LOW",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-30T18:15:55Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-5hpc-pqrr-8j6m/GHSA-5hpc-pqrr-8j6m.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,9 @@
2929
}
3030
],
3131
"database_specific": {
32-
"cwe_ids": [],
32+
"cwe_ids": [
33+
"CWE-416"
34+
],
3335
"severity": "HIGH",
3436
"github_reviewed": false,
3537
"github_reviewed_at": null,

‎advisories/unreviewed/2026/01/GHSA-5vqf-8g9x-xgcv/GHSA-5vqf-8g9x-xgcv.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5vqf-8g9x-xgcv",
4+
"modified": "2026-01-30T18:31:16Z",
5+
"published": "2026-01-30T18:31:16Z",
6+
"aliases": [
7+
"CVE-2026-1700"
8+
],
9+
"details": "A weakness has been identified in projectworlds House Rental and Property Listing 1.0. This vulnerability affects unknown code of the file /app/sms.php. This manipulation of the argument Message causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1700"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/jiahao412/CVE/issues/3"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.343490"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.343490"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.741977"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-30T17:16:14Z"
51+
}
52+
}

0 commit comments

Comments
 (0)