Publish Advisories

GHSA-h66j-xm43-47pp
GHSA-hm9j-cgmm-2w36

Author: advisory-database[bot]

…-h66j-xm43-47pp/GHSA-h66j-xm43-47pp.json …-h66j-xm43-47pp/GHSA-h66j-xm43-47pp.jsonadvisories/unreviewed/2026/01/GHSA-h66j-xm43-47pp/GHSA-h66j-xm43-47pp.json renamed to advisories/github-reviewed/2026/01/GHSA-h66j-xm43-47pp/GHSA-h66j-xm43-47pp.json advisories/unreviewed/2026/01/GHSA-h66j-xm43-47pp/GHSA-h66j-xm43-47pp.json renamed to advisories/github-reviewed/2026/01/GHSA-h66j-xm43-47pp/GHSA-h66j-xm43-47pp.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-h66j-xm43-47pp",
-  "modified": "2026-01-15T18:31:32Z",
+  "modified": "2026-01-15T22:39:22Z",
   "published": "2026-01-15T18:31:32Z",
   "aliases": [
     "CVE-2021-47776"
   ],
+  "summary": "Umbraco CMS contains a server-side request forgery vulnerability",
   "details": "Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHelpForPage, GetRemoteDashboardContent, and GetRemoteDashboardCss endpoints to trigger unauthorized server-side requests to external hosts.",
   "severity": [
     {
@@ -14,15 +15,29 @@
     },
     {
       "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "NuGet",
+        "name": "UmbracoCms"
+      },
+      "versions": [
+        "8.14.1"
+      ]
     }
   ],
-  "affected": [],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47776"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/umbraco/Umbraco-CMS"
+    },
     {
       "type": "WEB",
       "url": "https://our.umbraco.com"
@@ -41,8 +56,8 @@
       "CWE-918"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-01-15T22:39:22Z",
     "nvd_published_at": "2026-01-15T16:16:09Z"
   }
 }

…-hm9j-cgmm-2w36/GHSA-hm9j-cgmm-2w36.json …-hm9j-cgmm-2w36/GHSA-hm9j-cgmm-2w36.jsonadvisories/unreviewed/2026/01/GHSA-hm9j-cgmm-2w36/GHSA-hm9j-cgmm-2w36.json renamed to advisories/github-reviewed/2026/01/GHSA-hm9j-cgmm-2w36/GHSA-hm9j-cgmm-2w36.json advisories/unreviewed/2026/01/GHSA-hm9j-cgmm-2w36/GHSA-hm9j-cgmm-2w36.json renamed to advisories/github-reviewed/2026/01/GHSA-hm9j-cgmm-2w36/GHSA-hm9j-cgmm-2w36.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-hm9j-cgmm-2w36",
-  "modified": "2026-01-15T18:31:30Z",
+  "modified": "2026-01-15T22:38:52Z",
   "published": "2026-01-15T18:31:30Z",
   "aliases": [
     "CVE-2021-47763"
   ],
+  "summary": "Aimeos contains a SQL injection vulnerability in the json api 'sort' parameter",
   "details": "Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint.",
   "severity": [
     {
@@ -14,10 +15,20 @@
     },
     {
       "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "aimeos/aimeos-laravel"
+      },
+      "versions": [
+        "2021.10"
+      ]
     }
   ],
-  "affected": [],
   "references": [
     {
       "type": "ADVISORY",
@@ -31,6 +42,10 @@
       "type": "WEB",
       "url": "https://aimeos.org/laravel-ecommerce-package"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/aimeos/aimeos-laravel"
+    },
     {
       "type": "WEB",
       "url": "https://www.exploit-db.com/exploits/50538"
@@ -41,8 +56,8 @@
       "CWE-89"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-01-15T22:38:52Z",
     "nvd_published_at": "2026-01-15T16:16:07Z"
   }
 }