Skip to content

Commit 12221e0

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3cvf-5chq-5r99 GHSA-5gw4-7cfm-h82q GHSA-3gxp-j77p-vmqh GHSA-4jj6-9r93-mpjw GHSA-qc32-mjp2-qfv5 GHSA-qcfc-hmrc-59x7 GHSA-r7v3-974m-576m GHSA-v42x-fq35-8393 GHSA-wrg7-gj8f-p6mh GHSA-xp8h-gc5h-wmff GHSA-xvh8-9h96-57r8
1 parent 1e9dd55 commit 12221e0

11 files changed

Lines changed: 296 additions & 4 deletions

File tree

‎advisories/unreviewed/2025/11/GHSA-3cvf-5chq-5r99/GHSA-3cvf-5chq-5r99.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
],
3535
"database_specific": {
3636
"cwe_ids": [
37+
"CWE-639",
3738
"CWE-648"
3839
],
3940
"severity": "MODERATE",

‎advisories/unreviewed/2025/12/GHSA-5gw4-7cfm-h82q/GHSA-5gw4-7cfm-h82q.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5gw4-7cfm-h82q",
4-
"modified": "2025-12-12T15:30:42Z",
4+
"modified": "2026-01-12T15:30:35Z",
55
"published": "2025-12-12T15:30:42Z",
66
"aliases": [
77
"CVE-2025-58770"
88
],
99
"details": "APTIOV contains a vulnerability in BIOS where a user may cause “Improper Handling of Insufficient Permissions or Privileges” by local access. Successful exploitation of this vulnerability can lead to escalation of authorization and potentially impact Integrity and Availability.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/01/GHSA-3gxp-j77p-vmqh/GHSA-3gxp-j77p-vmqh.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3gxp-j77p-vmqh",
4+
"modified": "2026-01-12T15:30:42Z",
5+
"published": "2026-01-12T15:30:42Z",
6+
"aliases": [
7+
"CVE-2025-41003"
8+
],
9+
"details": "Imaster's Patient Record Management System contains a stored Cross-Site Scripting (XSS) vulnerability in the endpoint ‘/projects/hospital/admin/edit_patient.php’. By injecting a malicious script into the ‘firstname’ parameter, the JavaScript code is stored and executed every time a user accesses the patient list, allowing an attacker to execute arbitrary JavaScript in a victim's browser.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41003"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-imaster-products"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-12T14:16:01Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-4jj6-9r93-mpjw/GHSA-4jj6-9r93-mpjw.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4jj6-9r93-mpjw",
4+
"modified": "2026-01-12T15:30:42Z",
5+
"published": "2026-01-12T15:30:42Z",
6+
"aliases": [
7+
"CVE-2025-41006"
8+
],
9+
"details": "Imaster's MEMS Events CRM contains an SQL injection vulnerability in ‘phone’ parameter in ‘/memsdemo/login.php’.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41006"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-imaster-products"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-12T15:16:02Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-qc32-mjp2-qfv5/GHSA-qc32-mjp2-qfv5.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qc32-mjp2-qfv5",
4+
"modified": "2026-01-12T15:30:42Z",
5+
"published": "2026-01-12T15:30:42Z",
6+
"aliases": [
7+
"CVE-2025-41004"
8+
],
9+
"details": "Imaster's Patient Records Management System is vulnerable to SQL Injection in the endpoint ‘/projects/hospital/admin/complaints.php’ through the ‘id’ parameter.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41004"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-imaster-products"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-12T14:16:02Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-qcfc-hmrc-59x7/GHSA-qcfc-hmrc-59x7.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-qcfc-hmrc-59x7",
4-
"modified": "2026-01-11T21:30:19Z",
4+
"modified": "2026-01-12T15:30:41Z",
55
"published": "2026-01-11T15:31:59Z",
66
"aliases": [
77
"CVE-2025-68493"
88
],
99
"details": "Missing XML Validation vulnerability in Apache Struts, Apache Struts.\n\nThis issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.\n\nUsers are recommended to upgrade to version 6.1.1, which fixes the issue.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -27,7 +32,7 @@
2732
"cwe_ids": [
2833
"CWE-112"
2934
],
30-
"severity": null,
35+
"severity": "HIGH",
3136
"github_reviewed": false,
3237
"github_reviewed_at": null,
3338
"nvd_published_at": "2026-01-11T13:15:45Z"

‎advisories/unreviewed/2026/01/GHSA-r7v3-974m-576m/GHSA-r7v3-974m-576m.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r7v3-974m-576m",
4+
"modified": "2026-01-12T15:30:42Z",
5+
"published": "2026-01-12T15:30:42Z",
6+
"aliases": [
7+
"CVE-2025-41078"
8+
],
9+
"details": "Weaknesses in the authorization mechanisms of Viafirma Documents v3.7.129 allow an authenticated user without privileges to list and access other user data, use user creation, modification, and deletion features, and escalate privileges by impersonating other users of the application in the generation and signing of documents.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41078"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-viafirma-products"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-863"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-12T15:16:03Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-v42x-fq35-8393/GHSA-v42x-fq35-8393.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v42x-fq35-8393",
4+
"modified": "2026-01-12T15:30:42Z",
5+
"published": "2026-01-12T15:30:42Z",
6+
"aliases": [
7+
"CVE-2025-65552"
8+
],
9+
"details": "D3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on the 433 MHz sensor communication channel. The system does not implement rolling codes, message authentication, or anti-replay protection, allowing an attacker within RF range to record valid alarm/control frames and replay them to trigger false alarms.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65552"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/EmbdCDACHyd/CVE/tree/main/CVE-2025-65552"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "http://d3d.com"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2026-01-12T15:16:03Z"
32+
}
33+
}

‎advisories/unreviewed/2026/01/GHSA-wrg7-gj8f-p6mh/GHSA-wrg7-gj8f-p6mh.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wrg7-gj8f-p6mh",
4+
"modified": "2026-01-12T15:30:42Z",
5+
"published": "2026-01-12T15:30:42Z",
6+
"aliases": [
7+
"CVE-2025-41005"
8+
],
9+
"details": "Imaster's MEMS Events CRM contains an SQL injection vulnerability in‘keyword’ parameter in ‘/memsdemo/exchange_offers.php’.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41005"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-imaster-products"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-12T15:16:02Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-xp8h-gc5h-wmff/GHSA-xp8h-gc5h-wmff.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xp8h-gc5h-wmff",
4+
"modified": "2026-01-12T15:30:42Z",
5+
"published": "2026-01-12T15:30:42Z",
6+
"aliases": [
7+
"CVE-2025-65553"
8+
],
9+
"details": "D3D Wi-Fi Home Security System ZX-G12 v2.1.17 is susceptible to RF jamming on the 433 MHz alarm sensor channel. An attacker within RF range can transmit continuous interference to block sensor transmissions, resulting in missed alarms and loss of security monitoring. The device lacks jamming detection or mitigations, creating a denial-of-service condition that may lead to undetected intrusions or failure to trigger safety alerts.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65553"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/EmbdCDACHyd/CVE/tree/main/CVE-2025-65553"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "http://d3d.com"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2026-01-12T15:16:03Z"
32+
}
33+
}

0 commit comments

Comments
 (0)