Skip to content

Commit 2929119

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-fh73-r4jx-8p6f GHSA-qxq4-hr62-m2rg GHSA-r2c6-8jc8-g32w
1 parent e79c935 commit 2929119

File tree

3 files changed

+156
-0
lines changed

3 files changed

+156
-0
lines changed

‎advisories/unreviewed/2026/02/GHSA-fh73-r4jx-8p6f/GHSA-fh73-r4jx-8p6f.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fh73-r4jx-8p6f",
4+
"modified": "2026-02-02T00:30:23Z",
5+
"published": "2026-02-02T00:30:22Z",
6+
"aliases": [
7+
"CVE-2026-1733"
8+
],
9+
"details": "A vulnerability was identified in Zhong Bang CRMEB up to 5.6.3. This affects the function detail/tidyOrder of the file /api/store_integral/order/detail/:uni. The manipulation of the argument order_id leads to improper authorization. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1733"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/foeCat/CVE/blob/main/CRMEB/integral_order_detail_idor.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/foeCat/CVE/blob/main/CRMEB/integral_order_detail_idor.md#%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.343632"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.343632"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.736558"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-266"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-01T23:15:49Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-qxq4-hr62-m2rg/GHSA-qxq4-hr62-m2rg.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qxq4-hr62-m2rg",
4+
"modified": "2026-02-02T00:30:23Z",
5+
"published": "2026-02-02T00:30:23Z",
6+
"aliases": [
7+
"CVE-2026-1734"
8+
],
9+
"details": "A security flaw has been discovered in Zhong Bang CRMEB up to 5.6.3. This vulnerability affects unknown code of the file crmeb/app/api/controller/v1/CrontabController.php of the component crontab Endpoint. The manipulation results in missing authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1734"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/foeCat/CVE/blob/main/CRMEB/crontab_unauthorized_access.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/foeCat/CVE/blob/main/CRMEB/crontab_unauthorized_access.md#proof-of-concept"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.343633"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.343633"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.736619"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-862"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-02T00:15:52Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-r2c6-8jc8-g32w/GHSA-r2c6-8jc8-g32w.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r2c6-8jc8-g32w",
4+
"modified": "2026-02-02T00:30:23Z",
5+
"published": "2026-02-02T00:30:23Z",
6+
"aliases": [
7+
"CVE-2026-25253"
8+
],
9+
"details": "OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "WEB",
20+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-g8p2-7wf7-98mq"
21+
},
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25253"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://depthfirst.com/post/1-click-rce-to-steal-your-moltbot-data-and-keys"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://openclaw.ai/blog"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-669"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-01T23:15:49Z"
43+
}
44+
}

0 commit comments

Comments
 (0)