Skip to content

Commit 331cd25

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2wh9-wm58-w79r GHSA-43rr-x62x-q96w GHSA-57xj-86j2-jqm5 GHSA-mcww-77h6-2wxm GHSA-rj2q-p862-w9r3 GHSA-wq8p-q8cq-94w5 GHSA-x64m-wg95-494x
1 parent abb1169 commit 331cd25

7 files changed

Lines changed: 340 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/01/GHSA-2wh9-wm58-w79r/GHSA-2wh9-wm58-w79r.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2wh9-wm58-w79r",
4+
"modified": "2026-01-20T03:30:28Z",
5+
"published": "2026-01-20T03:30:28Z",
6+
"aliases": [
7+
"CVE-2026-1051"
8+
],
9+
"details": "The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.1.0. This is due to missing or incorrect nonce validation on the hook_newsletter_action() function. This makes it possible for unauthenticated attackers to unsubscribe newsletter subscribers via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1051"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/newsletter/tags/9.1.0/unsubscription/unsubscription.php#L141"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8de2156f-5087-4c16-8e5d-93b5c72ec536?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-352"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-20T02:15:46Z"
39+
}
40+
}

‎advisories/unreviewed/2026/01/GHSA-43rr-x62x-q96w/GHSA-43rr-x62x-q96w.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-43rr-x62x-q96w",
4+
"modified": "2026-01-20T03:30:28Z",
5+
"published": "2026-01-20T03:30:28Z",
6+
"aliases": [
7+
"CVE-2026-1195"
8+
],
9+
"details": "A weakness has been identified in MineAdmin 1.x/2.x. This impacts the function refresh of the file /system/refresh of the component JWT Token Handler. This manipulation causes insufficient verification of data authenticity. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1195"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/SourByte05/MineAdmin-Vulnerability/issues/4"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.341780"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.341780"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.734272"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-345"
46+
],
47+
"severity": "LOW",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-20T01:15:56Z"
51+
}
52+
}

‎advisories/unreviewed/2026/01/GHSA-57xj-86j2-jqm5/GHSA-57xj-86j2-jqm5.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-57xj-86j2-jqm5",
4+
"modified": "2026-01-20T03:30:28Z",
5+
"published": "2026-01-20T03:30:28Z",
6+
"aliases": [
7+
"CVE-2026-1197"
8+
],
9+
"details": "A vulnerability was detected in MineAdmin 1.x/2.x. Affected by this vulnerability is an unknown functionality of the file /system/downloadById. Performing a manipulation of the argument ID results in information disclosure. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1197"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/SourByte05/MineAdmin-Vulnerability/issues/2"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.341782"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.341782"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.734274"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-200"
46+
],
47+
"severity": "LOW",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-20T01:15:56Z"
51+
}
52+
}

‎advisories/unreviewed/2026/01/GHSA-mcww-77h6-2wxm/GHSA-mcww-77h6-2wxm.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mcww-77h6-2wxm",
4+
"modified": "2026-01-20T03:30:28Z",
5+
"published": "2026-01-20T03:30:28Z",
6+
"aliases": [
7+
"CVE-2025-14978"
8+
],
9+
"details": "The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on the ConvesioPay webhook REST endpoint in all versions up to, and including, 1.119.8. This makes it possible for unauthenticated attackers to modify the status of arbitrary WooCommerce orders.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14978"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/peachpay-for-woocommerce/tags/1.119.5/core/payments/convesiopay/routes/class-peachpay-convesiopay-webhook.php#L33"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5480a151-3e3a-46ba-9712-6c61fba06812?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-862"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-20T02:15:45Z"
39+
}
40+
}

‎advisories/unreviewed/2026/01/GHSA-rj2q-p862-w9r3/GHSA-rj2q-p862-w9r3.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rj2q-p862-w9r3",
4+
"modified": "2026-01-20T03:30:28Z",
5+
"published": "2026-01-20T03:30:28Z",
6+
"aliases": [
7+
"CVE-2026-1203"
8+
],
9+
"details": "A weakness has been identified in CRMEB up to 5.6.3. The impacted element is the function remoteRegister of the file crmeb/app/services/user/LoginServices.php of the component JSON Token Handler. Executing a manipulation of the argument uid can lead to improper authentication. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1203"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/foeCat/CVE/blob/main/CRMEB/jwt_auth_bypass/remote_register_jwt_bypass.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.341789"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.341789"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.735349"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-287"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-20T01:15:56Z"
51+
}
52+
}

‎advisories/unreviewed/2026/01/GHSA-wq8p-q8cq-94w5/GHSA-wq8p-q8cq-94w5.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wq8p-q8cq-94w5",
4+
"modified": "2026-01-20T03:30:28Z",
5+
"published": "2026-01-20T03:30:28Z",
6+
"aliases": [
7+
"CVE-2026-1196"
8+
],
9+
"details": "A security vulnerability has been detected in MineAdmin 1.x/2.x. Affected is an unknown function of the file /system/getFileInfoById. Such manipulation of the argument ID leads to information disclosure. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1196"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/SourByte05/MineAdmin-Vulnerability/issues/3"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.341781"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.341781"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.734273"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-200"
46+
],
47+
"severity": "LOW",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-20T01:15:56Z"
51+
}
52+
}

‎advisories/unreviewed/2026/01/GHSA-x64m-wg95-494x/GHSA-x64m-wg95-494x.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-x64m-wg95-494x",
4+
"modified": "2026-01-20T03:30:28Z",
5+
"published": "2026-01-20T03:30:28Z",
6+
"aliases": [
7+
"CVE-2026-1202"
8+
],
9+
"details": "A security flaw has been discovered in CRMEB up to 5.6.3. The affected element is the function appleLogin of the file crmeb/app/api/controller/v1/LoginController.php. Performing a manipulation of the argument openId results in improper authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1202"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/foeCat/CVE/blob/main/CRMEB/apple_login_auth_bypass.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.341788"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.341788"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.734711"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-287"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-20T01:15:56Z"
51+
}
52+
}

0 commit comments

Comments
 (0)