Skip to content

Commit 397baa5

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-397f-58rh-886v GHSA-5xwg-ff7c-5w3f GHSA-73j7-p7fw-fvw8 GHSA-m892-c9fc-5798
1 parent 22add53 commit 397baa5

4 files changed

Lines changed: 208 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/01/GHSA-397f-58rh-886v/GHSA-397f-58rh-886v.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-397f-58rh-886v",
4+
"modified": "2026-01-11T09:30:24Z",
5+
"published": "2026-01-11T09:30:24Z",
6+
"aliases": [
7+
"CVE-2026-0840"
8+
],
9+
"details": "A security vulnerability has been detected in UTT 进取 520W 1.7.7-180627. Affected by this vulnerability is the function strcpy of the file /goform/formConfigNoticeConfig. The manipulation of the argument timestart leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0840"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/GUOTINGTING2297/cve/blob/main/1234/30.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.340440"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.340440"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.729029"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-119"
46+
],
47+
"severity": "HIGH",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-11T07:15:49Z"
51+
}
52+
}

‎advisories/unreviewed/2026/01/GHSA-5xwg-ff7c-5w3f/GHSA-5xwg-ff7c-5w3f.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5xwg-ff7c-5w3f",
4+
"modified": "2026-01-11T09:30:24Z",
5+
"published": "2026-01-11T09:30:24Z",
6+
"aliases": [
7+
"CVE-2026-0843"
8+
],
9+
"details": "A vulnerability has been found in jiujiujia/victor123/wxw850227 jjjfood and jjjshop_food up to 20260103. This vulnerability affects unknown code of the file /index.php/api/product.category/index. Such manipulation of the argument latitude leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product is distributed under multiple different names. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0843"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.340443"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.340443"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.731001"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "http://101.200.76.102:38765/qwertyuiop/qwsdfvbnm/1/vuldb/JJJshop/EnglishVers%E4%B8%89%E5%8B%BE%E7%82%B9%E9%A4%90%E7%B3%BB%E7%BB%9FPHP%E7%89%88%E5%AD%98%E5%9C%A8product.category.indexSQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.pdf"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-11T09:15:50Z"
51+
}
52+
}

‎advisories/unreviewed/2026/01/GHSA-73j7-p7fw-fvw8/GHSA-73j7-p7fw-fvw8.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-73j7-p7fw-fvw8",
4+
"modified": "2026-01-11T09:30:24Z",
5+
"published": "2026-01-11T09:30:24Z",
6+
"aliases": [
7+
"CVE-2026-0841"
8+
],
9+
"details": "A vulnerability was detected in UTT 进取 520W 1.7.7-180627. Affected by this issue is the function strcpy of the file /goform/formPictureUrl. The manipulation of the argument importpictureurl results in buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0841"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/GUOTINGTING2297/cve/blob/main/1234/31.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.340441"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.340441"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.729030"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-119"
46+
],
47+
"severity": "HIGH",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-11T08:15:59Z"
51+
}
52+
}

‎advisories/unreviewed/2026/01/GHSA-m892-c9fc-5798/GHSA-m892-c9fc-5798.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m892-c9fc-5798",
4+
"modified": "2026-01-11T09:30:24Z",
5+
"published": "2026-01-11T09:30:24Z",
6+
"aliases": [
7+
"CVE-2026-0842"
8+
],
9+
"details": "A flaw has been found in Flycatcher Toys smART Sketcher up to 2.0. This affects an unknown part of the component Bluetooth Low Energy Interface. This manipulation causes missing authentication. The attack can only be done within the local network. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0842"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/davidrxchester/smart-sketcher-upload/blob/main/smartsketch-upload.py"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.340442"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.340442"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.729134"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-287"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-11T08:16:00Z"
51+
}
52+
}

0 commit comments

Comments
 (0)