Skip to content

Commit 639f0f1

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-34xc-8mm8-rq79 GHSA-4p8f-q5hf-m6pr GHSA-4ph3-v6j7-j4pw GHSA-5xr7-9jmx-g4x4 GHSA-7v8w-cr25-ggqq GHSA-h4xv-q4qh-g7q3 GHSA-hmqj-h9pm-wq53 GHSA-mf8f-5hfr-3cfm
1 parent 8dc3f16 commit 639f0f1

File tree

8 files changed

+446
-0
lines changed

8 files changed

+446
-0
lines changed

‎advisories/unreviewed/2026/04/GHSA-34xc-8mm8-rq79/GHSA-34xc-8mm8-rq79.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-34xc-8mm8-rq79",
4+
"modified": "2026-04-05T09:30:22Z",
5+
"published": "2026-04-05T09:30:22Z",
6+
"aliases": [
7+
"CVE-2026-5551"
8+
],
9+
"details": "A security flaw has been discovered in itsourcecode Free Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /hotel/admin/login.php of the component Parameter Handler. The manipulation of the argument email results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5551"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/jasonwong666/cve/issues/1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/782845"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/355315"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/355315/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-04-05T09:16:17Z"
55+
}
56+
}

‎advisories/unreviewed/2026/04/GHSA-4p8f-q5hf-m6pr/GHSA-4p8f-q5hf-m6pr.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4p8f-q5hf-m6pr",
4+
"modified": "2026-04-05T09:30:22Z",
5+
"published": "2026-04-05T09:30:22Z",
6+
"aliases": [
7+
"CVE-2026-5550"
8+
],
9+
"details": "A vulnerability was identified in Tenda AC10 16.03.10.10_multi_TDE01. This affects the function fromSysToolChangePwd of the file /bin/httpd. The manipulation leads to stack-based buffer overflow. The attack may be initiated remotely. Multiple endpoints might be affected.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5550"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/somanyerrors/tenda-ac10v4-vulnerabilities/blob/main/findings/HIGH-01-getvalue-229-callers.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/submit/782299"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/355314"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/355314/cti"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-04-05T08:16:25Z"
55+
}
56+
}

‎advisories/unreviewed/2026/04/GHSA-4ph3-v6j7-j4pw/GHSA-4ph3-v6j7-j4pw.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4ph3-v6j7-j4pw",
4+
"modified": "2026-04-05T09:30:22Z",
5+
"published": "2026-04-05T09:30:22Z",
6+
"aliases": [
7+
"CVE-2026-5552"
8+
],
9+
"details": "A weakness has been identified in PHPGurukul Online Shopping Portal Project 2.1. This issue affects some unknown processing of the file /sub-category.php of the component Parameter Handler. This manipulation of the argument pid causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5552"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/f1rstb100d/CVE/issues/10"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://phpgurukul.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/782864"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/355316"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/355316/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-04-05T09:16:18Z"
55+
}
56+
}

‎advisories/unreviewed/2026/04/GHSA-5xr7-9jmx-g4x4/GHSA-5xr7-9jmx-g4x4.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5xr7-9jmx-g4x4",
4+
"modified": "2026-04-05T09:30:22Z",
5+
"published": "2026-04-05T09:30:21Z",
6+
"aliases": [
7+
"CVE-2026-5547"
8+
],
9+
"details": "A vulnerability has been found in Tenda AC10 16.03.10.10_multi_TDE01. Affected is the function formAddMacfilterRule of the file /bin/httpd. Such manipulation leads to os command injection. It is possible to launch the attack remotely. Multiple endpoints might be affected.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5547"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/somanyerrors/tenda-ac10v4-vulnerabilities/blob/main/findings/CRITICAL-03-command-injection-formaddmacfilterrule.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/submit/782296"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/355311"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/355311/cti"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-77"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-04-05T08:16:23Z"
55+
}
56+
}

‎advisories/unreviewed/2026/04/GHSA-7v8w-cr25-ggqq/GHSA-7v8w-cr25-ggqq.json‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7v8w-cr25-ggqq",
4+
"modified": "2026-04-05T09:30:22Z",
5+
"published": "2026-04-05T09:30:22Z",
6+
"aliases": [
7+
"CVE-2026-5549"
8+
],
9+
"details": "A vulnerability was determined in Tenda AC10 16.03.10.10_multi_TDE01. Affected by this issue is some unknown functionality of the file /webroot_ro/pem/privkeySrv.pem of the component RSA 2048-bit Private Key Handler. Executing a manipulation can lead to use of hard-coded cryptographic key\n . The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5549"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/somanyerrors/tenda-ac10v4-vulnerabilities/blob/main/findings/CRITICAL-05-exposed-rsa-private-key.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/submit/782298"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/355313"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/355313/cti"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [],
49+
"severity": "MODERATE",
50+
"github_reviewed": false,
51+
"github_reviewed_at": null,
52+
"nvd_published_at": "2026-04-05T08:16:24Z"
53+
}
54+
}

‎advisories/unreviewed/2026/04/GHSA-h4xv-q4qh-g7q3/GHSA-h4xv-q4qh-g7q3.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h4xv-q4qh-g7q3",
4+
"modified": "2026-04-05T09:30:22Z",
5+
"published": "2026-04-05T09:30:22Z",
6+
"aliases": [
7+
"CVE-2026-5553"
8+
],
9+
"details": "A vulnerability was identified in itsourcecode Online Cellphone System 1.0. Affected by this vulnerability is an unknown functionality of the file /cp/available.php of the component Parameter Handler. Such manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5553"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Wzl731/test/issues/3"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/782873"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/355323"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/355323/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-04-05T09:16:19Z"
55+
}
56+
}

0 commit comments

Comments
 (0)