Skip to content

Commit 73adc91

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-gwm8-8jq9-c7h5 GHSA-p6xj-m4mp-fwqx GHSA-rr7h-2vmq-r7qh GHSA-x4w4-c97j-2px5
1 parent 229452f commit 73adc91

File tree

4 files changed

+208
-0
lines changed

4 files changed

+208
-0
lines changed

‎advisories/unreviewed/2026/01/GHSA-gwm8-8jq9-c7h5/GHSA-gwm8-8jq9-c7h5.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gwm8-8jq9-c7h5",
4+
"modified": "2026-01-18T15:30:25Z",
5+
"published": "2026-01-18T15:30:25Z",
6+
"aliases": [
7+
"CVE-2026-1123"
8+
],
9+
"details": "A vulnerability was identified in Yonyou KSOA 9.0. Affected is an unknown function of the file /worksheet/work_mod.jsp of the component HTTP GET Parameter Handler. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1123"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/LX-66-LX/cve/issues/9"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.341715"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.341715"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.734550"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-18T15:15:51Z"
51+
}
52+
}

‎advisories/unreviewed/2026/01/GHSA-p6xj-m4mp-fwqx/GHSA-p6xj-m4mp-fwqx.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p6xj-m4mp-fwqx",
4+
"modified": "2026-01-18T15:30:25Z",
5+
"published": "2026-01-18T15:30:25Z",
6+
"aliases": [
7+
"CVE-2026-1122"
8+
],
9+
"details": "A vulnerability was determined in Yonyou KSOA 9.0. This impacts an unknown function of the file /worksheet/work_info.jsp of the component HTTP GET Parameter Handler. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1122"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/LX-66-LX/cve/issues/8"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.341714"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.341714"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.734549"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-18T14:16:16Z"
51+
}
52+
}

‎advisories/unreviewed/2026/01/GHSA-rr7h-2vmq-r7qh/GHSA-rr7h-2vmq-r7qh.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rr7h-2vmq-r7qh",
4+
"modified": "2026-01-18T15:30:25Z",
5+
"published": "2026-01-18T15:30:25Z",
6+
"aliases": [
7+
"CVE-2026-1120"
8+
],
9+
"details": "A vulnerability has been found in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_work.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1120"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/LX-66-LX/cve/issues/6"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.341712"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.341712"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.734535"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-18T14:16:16Z"
51+
}
52+
}

‎advisories/unreviewed/2026/01/GHSA-x4w4-c97j-2px5/GHSA-x4w4-c97j-2px5.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-x4w4-c97j-2px5",
4+
"modified": "2026-01-18T15:30:25Z",
5+
"published": "2026-01-18T15:30:25Z",
6+
"aliases": [
7+
"CVE-2026-1121"
8+
],
9+
"details": "A vulnerability was found in Yonyou KSOA 9.0. This affects an unknown function of the file /worksheet/del_workplan.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1121"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/LX-66-LX/cve/issues/7"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.341713"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.341713"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.734548"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-01-18T14:16:16Z"
51+
}
52+
}

0 commit comments

Comments
 (0)