Skip to content

Commit 10ddced

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-grxq-cfv6-jw9w GHSA-p9mf-x9hh-r538 GHSA-gc2x-hm2m-2mfm GHSA-gpr9-62pw-pr5w GHSA-vx23-6x2j-vfq4 GHSA-xg52-rc56-qm35
1 parent 9f672c5 commit 10ddced

6 files changed

Lines changed: 148 additions & 4 deletions

File tree

‎advisories/unreviewed/2023/10/GHSA-grxq-cfv6-jw9w/GHSA-grxq-cfv6-jw9w.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-grxq-cfv6-jw9w",
4-
"modified": "2024-03-08T18:30:27Z",
4+
"modified": "2026-01-12T12:30:27Z",
55
"published": "2023-10-13T21:30:21Z",
66
"aliases": [
77
"CVE-2023-34975"
88
],
9-
"details": "A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.\n\nWe have already fixed the vulnerability in the following version:\nVideo Station 5.7.0 ( 2023/07/27 ) and later\n",
9+
"details": "A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.\n\nWe have already fixed the vulnerability in the following version:\nVideo Station 5.7.0 ( 2023/07/27 ) and later",
1010
"severity": [
1111
{
1212
"type": "CVSS_V3",

‎advisories/unreviewed/2023/10/GHSA-p9mf-x9hh-r538/GHSA-p9mf-x9hh-r538.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-p9mf-x9hh-r538",
4-
"modified": "2024-04-04T08:38:25Z",
4+
"modified": "2026-01-12T12:30:27Z",
55
"published": "2023-10-13T21:30:21Z",
66
"aliases": [
77
"CVE-2023-34976"
88
],
9-
"details": "A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.\n\nWe have already fixed the vulnerability in the following version:\nVideo Station 5.7.0 ( 2023/07/27 ) and later\n",
9+
"details": "A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.\n\nWe have already fixed the vulnerability in the following version:\nVideo Station 5.7.0 ( 2023/07/27 ) and later",
1010
"severity": [
1111
{
1212
"type": "CVSS_V3",

‎advisories/unreviewed/2026/01/GHSA-gc2x-hm2m-2mfm/GHSA-gc2x-hm2m-2mfm.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gc2x-hm2m-2mfm",
4+
"modified": "2026-01-12T12:30:28Z",
5+
"published": "2026-01-12T12:30:28Z",
6+
"aliases": [
7+
"CVE-2025-40977"
8+
],
9+
"details": "Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's eCommerceGo SaaS, consisting of a lack of proper validation of user input by sending a POST request to ‘/store-ticket’, using the ‘subject’ and ‘description’ parameters.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40977"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-workdo-products"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-12T12:16:06Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-gpr9-62pw-pr5w/GHSA-gpr9-62pw-pr5w.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gpr9-62pw-pr5w",
4+
"modified": "2026-01-12T12:30:28Z",
5+
"published": "2026-01-12T12:30:28Z",
6+
"aliases": [
7+
"CVE-2025-40978"
8+
],
9+
"details": "Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's eCommerceGo SaaS, consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request to ‘/ticket/x/conversion’, using the ‘reply_description’ parameter.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40978"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-workdo-products"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-12T12:16:07Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-vx23-6x2j-vfq4/GHSA-vx23-6x2j-vfq4.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vx23-6x2j-vfq4",
4+
"modified": "2026-01-12T12:30:27Z",
5+
"published": "2026-01-12T12:30:27Z",
6+
"aliases": [
7+
"CVE-2025-40976"
8+
],
9+
"details": "Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's TicketGo, consisting of a lack of proper validation of user input by sending a POST request to ‘/ticketgo-saas/home’, using the ‘description’ parameter.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40976"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-workdo-products"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-12T12:16:06Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-xg52-rc56-qm35/GHSA-xg52-rc56-qm35.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xg52-rc56-qm35",
4+
"modified": "2026-01-12T12:30:27Z",
5+
"published": "2026-01-12T12:30:27Z",
6+
"aliases": [
7+
"CVE-2025-40975"
8+
],
9+
"details": "Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's HRMGo, consisting of a lack of proper validation of user input by sending a POST request to ‘/hrmgo/ticket/changereply’, using the ‘description’ parameter.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40975"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-workdo-products"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-12T12:16:05Z"
35+
}
36+
}

0 commit comments

Comments
 (0)