Skip to content

Commit 7bf051d

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-v6c5-9mp4-mwq4 GHSA-6g5v-xg2c-jwmq GHSA-jchx-26cr-w8w2 GHSA-jxp4-5wxx-jhhf GHSA-mj3m-r2gc-xrxc GHSA-qqpg-mvqg-649v GHSA-r8f4-mx7h-29jp GHSA-rwrf-5qh9-q8j8 GHSA-x95g-m33x-ggjj
1 parent 6d0eb1e commit 7bf051d

9 files changed

Lines changed: 317 additions & 1 deletion

File tree

‎advisories/unreviewed/2025/11/GHSA-v6c5-9mp4-mwq4/GHSA-v6c5-9mp4-mwq4.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-v6c5-9mp4-mwq4",
4-
"modified": "2026-01-22T00:31:30Z",
4+
"modified": "2026-01-22T12:31:21Z",
55
"published": "2025-11-26T15:34:12Z",
66
"aliases": [
77
"CVE-2025-13601"
@@ -23,6 +23,10 @@
2323
"type": "WEB",
2424
"url": "https://access.redhat.com/errata/RHSA-2026:0936"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://access.redhat.com/errata/RHSA-2026:0975"
29+
},
2630
{
2731
"type": "WEB",
2832
"url": "https://access.redhat.com/security/cve/CVE-2025-13601"

‎advisories/unreviewed/2026/01/GHSA-6g5v-xg2c-jwmq/GHSA-6g5v-xg2c-jwmq.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6g5v-xg2c-jwmq",
4+
"modified": "2026-01-22T12:31:22Z",
5+
"published": "2026-01-22T12:31:22Z",
6+
"aliases": [
7+
"CVE-2025-10024"
8+
],
9+
"details": "Authorization Bypass Through User-Controlled Key vulnerability in EXERT Computer Technologies Software Ltd. Co. Education Management System allows Parameter Injection.This issue affects Education Management System: through 23.09.2025.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10024"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.usom.gov.tr/bildirim/tr-26-0002"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-639"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-22T12:15:53Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-jchx-26cr-w8w2/GHSA-jchx-26cr-w8w2.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jchx-26cr-w8w2",
4+
"modified": "2026-01-22T12:31:22Z",
5+
"published": "2026-01-22T12:31:22Z",
6+
"aliases": [
7+
"CVE-2025-67684"
8+
],
9+
"details": "Quick.Cart is vulnerable to Local File Inclusion and Path Traversal issues in the theme selection mechanism. Quick.Cart allows a privileged user to upload arbitrary file contents while only validating the filename extension. This allows an attacker to include and execute uploaded PHP code, resulting in Remote Code Execution on the server.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.7 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67684"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://cert.pl/posts/2026/01/CVE-2025-67683"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://opensolution.org/sklep-internetowy-quick-cart.html"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-22"
34+
],
35+
"severity": "CRITICAL",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-22T12:15:55Z"
39+
}
40+
}

‎advisories/unreviewed/2026/01/GHSA-jxp4-5wxx-jhhf/GHSA-jxp4-5wxx-jhhf.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jxp4-5wxx-jhhf",
4+
"modified": "2026-01-22T12:31:22Z",
5+
"published": "2026-01-22T12:31:22Z",
6+
"aliases": [
7+
"CVE-2026-1332"
8+
],
9+
"details": "MeetingHub developed by HAMASTAR Technology has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access specific API functions and obtain meeting-related information.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1332"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.twcert.org.tw/en/cp-139-10651-ff09c-2.html"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.twcert.org.tw/tw/cp-132-10650-a5ee9-1.html"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-306"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-01-22T10:16:07Z"
43+
}
44+
}

‎advisories/unreviewed/2026/01/GHSA-mj3m-r2gc-xrxc/GHSA-mj3m-r2gc-xrxc.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mj3m-r2gc-xrxc",
4+
"modified": "2026-01-22T12:31:22Z",
5+
"published": "2026-01-22T12:31:22Z",
6+
"aliases": [
7+
"CVE-2025-4763"
8+
],
9+
"details": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aida Computer Information Technology Inc. Hotel Guest Hotspot allows Reflected XSS.This issue affects Hotel Guest Hotspot: through 22012026. \n\nNOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4763"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.usom.gov.tr/bildirim/tr-26-0001"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-22T10:16:07Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-qqpg-mvqg-649v/GHSA-qqpg-mvqg-649v.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qqpg-mvqg-649v",
4+
"modified": "2026-01-22T12:31:22Z",
5+
"published": "2026-01-22T12:31:22Z",
6+
"aliases": [
7+
"CVE-2026-1225"
8+
],
9+
"details": "ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file.\n\n\n\n\nThe instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a \nconfiguration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:X/RE:M/U:Green"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1225"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://logback.qos.ch/news.html#1.5.25"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-20"
30+
],
31+
"severity": "LOW",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-22T10:16:07Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-r8f4-mx7h-29jp/GHSA-r8f4-mx7h-29jp.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r8f4-mx7h-29jp",
4+
"modified": "2026-01-22T12:31:22Z",
5+
"published": "2026-01-22T12:31:21Z",
6+
"aliases": [
7+
"CVE-2025-13335"
8+
],
9+
"details": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that under certain circumstances could have allowed an authenticated user to create a denial of service condition by configuring malformed Wiki documents that bypass cycle detection.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13335"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://hackerone.com/reports/3418023"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://about.gitlab.com/releases/2026/01/21/patch-release-gitlab-18-8-2-released"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/581060"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-835"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-01-22T10:16:06Z"
43+
}
44+
}

‎advisories/unreviewed/2026/01/GHSA-rwrf-5qh9-q8j8/GHSA-rwrf-5qh9-q8j8.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rwrf-5qh9-q8j8",
4+
"modified": "2026-01-22T12:31:22Z",
5+
"published": "2026-01-22T12:31:22Z",
6+
"aliases": [
7+
"CVE-2025-4764"
8+
],
9+
"details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aida Computer Information Technology Inc. Hotel Guest Hotspot allows SQL Injection.This issue affects Hotel Guest Hotspot: through 22012026. \n\nNOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4764"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.usom.gov.tr/bildirim/tr-26-0001"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-22T10:16:07Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-x95g-m33x-ggjj/GHSA-x95g-m33x-ggjj.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-x95g-m33x-ggjj",
4+
"modified": "2026-01-22T12:31:22Z",
5+
"published": "2026-01-22T12:31:22Z",
6+
"aliases": [
7+
"CVE-2025-67683"
8+
],
9+
"details": "Quick.Cart is vulnerable to reflected XSS via the sSort parameter. An attacker can craft a malicious URL which, when opened, results in arbitrary JavaScript execution in the victim’s browser.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.7 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67683"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://cert.pl/posts/2026/01/CVE-2025-67683"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://opensolution.org/sklep-internetowy-quick-cart.html"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-22T12:15:55Z"
39+
}
40+
}

0 commit comments

Comments
 (0)