Skip to content

Commit 0e105d7

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-6gh6-m6r8-43wc GHSA-6j66-5hmg-2xj7 GHSA-87hc-gvqr-qvx5 GHSA-8f84-x6pj-qm67 GHSA-c7p2-9p5w-6x7m GHSA-h3wr-fr68-rf69 GHSA-p243-3f4f-v8qm GHSA-qq79-56j7-gmq4 GHSA-rj7j-w6j6-856v GHSA-rrm6-2q2p-cpx5 GHSA-v36w-f92j-7386 GHSA-v8fj-r7vv-gv6q
1 parent bd1e3a7 commit 0e105d7

12 files changed

Lines changed: 648 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/04/GHSA-6gh6-m6r8-43wc/GHSA-6gh6-m6r8-43wc.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6gh6-m6r8-43wc",
4+
"modified": "2026-04-13T03:30:29Z",
5+
"published": "2026-04-13T03:30:29Z",
6+
"aliases": [
7+
"CVE-2026-6142"
8+
],
9+
"details": "A vulnerability was identified in tushar-2223 Hotel Management System up to bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15. Affected by this vulnerability is an unknown functionality of the file /admin/roomdelete.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6142"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/tushar-2223/Hotel-Management-System/issues/15"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://gist.github.com/freeloader9527/a9ab20c922c6aa2b3eabf93e01a40f6b"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/795751"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/357006"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/357006/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-04-13T01:16:36Z"
55+
}
56+
}

‎advisories/unreviewed/2026/04/GHSA-6j66-5hmg-2xj7/GHSA-6j66-5hmg-2xj7.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6j66-5hmg-2xj7",
4+
"modified": "2026-04-13T03:30:30Z",
5+
"published": "2026-04-13T03:30:29Z",
6+
"aliases": [
7+
"CVE-2026-6152"
8+
],
9+
"details": "A vulnerability was determined in code-projects Vehicle Showroom Management System 1.0. This issue affects some unknown processing of the file /util/StaffAddingFunction.php. This manipulation of the argument STAFF_ID causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6152"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/zheng-lv/CVE-/issues/3"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://code-projects.org"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/796312"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/357032"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/357032/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-04-13T03:16:03Z"
55+
}
56+
}

‎advisories/unreviewed/2026/04/GHSA-87hc-gvqr-qvx5/GHSA-87hc-gvqr-qvx5.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-87hc-gvqr-qvx5",
4+
"modified": "2026-04-13T03:30:28Z",
5+
"published": "2026-04-13T03:30:28Z",
6+
"aliases": [
7+
"CVE-2026-6139"
8+
],
9+
"details": "A vulnerability has been found in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function UploadOpenVpnCert of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument FileName leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6139"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_192/README.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/submit/792982"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/357003"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/357003/cti"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.totolink.net"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-77"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-04-13T01:16:35Z"
55+
}
56+
}

‎advisories/unreviewed/2026/04/GHSA-8f84-x6pj-qm67/GHSA-8f84-x6pj-qm67.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8f84-x6pj-qm67",
4+
"modified": "2026-04-13T03:30:30Z",
5+
"published": "2026-04-13T03:30:30Z",
6+
"aliases": [
7+
"CVE-2026-6150"
8+
],
9+
"details": "A vulnerability has been found in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /checkupdatestatus.php. The manipulation of the argument serviceId leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6150"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/zheng-lv/CVE-/issues/1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://code-projects.org"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/796309"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/357030"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/357030/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-79"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-04-13T03:16:02Z"
55+
}
56+
}

‎advisories/unreviewed/2026/04/GHSA-c7p2-9p5w-6x7m/GHSA-c7p2-9p5w-6x7m.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c7p2-9p5w-6x7m",
4+
"modified": "2026-04-13T03:30:29Z",
5+
"published": "2026-04-13T03:30:29Z",
6+
"aliases": [
7+
"CVE-2026-6141"
8+
],
9+
"details": "A vulnerability was determined in danielmiessler Personal_AI_Infrastructure up to 2.3.0. Affected is an unknown function of the file Skills/Parser/Tools/parse_url.ts. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 14322e87e58bf585cf3c7b9295578a6eb7dc4945. It is advisable to implement a patch to correct this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6141"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/danielmiessler/Personal_AI_Infrastructure/pull/659"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/danielmiessler/Personal_AI_Infrastructure/pull/659#issuecomment-3905020094"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/danielmiessler/Personal_AI_Infrastructure/commit/14322e87e58bf585cf3c7b9295578a6eb7dc4945"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/danielmiessler/Personal_AI_Infrastructure"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/submit/793438"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/vuln/357005"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/vuln/357005/cti"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-77"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": false,
61+
"github_reviewed_at": null,
62+
"nvd_published_at": "2026-04-13T01:16:35Z"
63+
}
64+
}

‎advisories/unreviewed/2026/04/GHSA-h3wr-fr68-rf69/GHSA-h3wr-fr68-rf69.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h3wr-fr68-rf69",
4+
"modified": "2026-04-13T03:30:30Z",
5+
"published": "2026-04-13T03:30:29Z",
6+
"aliases": [
7+
"CVE-2026-6151"
8+
],
9+
"details": "A vulnerability was found in code-projects Vehicle Showroom Management System 1.0. This vulnerability affects unknown code of the file /util/PaymentStatusFunction.php. The manipulation of the argument CUSTOMER_ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6151"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/zheng-lv/CVE-/issues/2"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://code-projects.org"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/796311"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/357031"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/357031/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-04-13T03:16:02Z"
55+
}
56+
}

0 commit comments

Comments
 (0)