Skip to content

Commit bb382bb

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent d18b97f commit bb382bb

File tree

40 files changed

+746
-89
lines changed

40 files changed

+746
-89
lines changed

‎advisories/unreviewed/2026/01/GHSA-267g-8279-vj63/GHSA-267g-8279-vj63.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-267g-8279-vj63",
4-
"modified": "2026-01-22T18:30:34Z",
4+
"modified": "2026-01-29T00:31:10Z",
55
"published": "2026-01-22T18:30:34Z",
66
"aliases": [
77
"CVE-2025-67964"
88
],
99
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey Core homey-core allows Reflected XSS.This issue affects Homey Core: from n/a through <= 2.4.3.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-79"
2530
],
26-
"severity": null,
31+
"severity": "HIGH",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-01-22T17:16:05Z"

‎advisories/unreviewed/2026/01/GHSA-26qr-hrpr-gcj8/GHSA-26qr-hrpr-gcj8.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-26qr-hrpr-gcj8",
4+
"modified": "2026-01-29T00:31:11Z",
5+
"published": "2026-01-29T00:31:11Z",
6+
"aliases": [
7+
"CVE-2026-1547"
8+
],
9+
"details": "A vulnerability was detected in Totolink A7000R 4.1cu.4154. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument plugin_name results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1547"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A7000R/01_RCE_setUnloadUserData_RCE.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A7000R/01_RCE_setUnloadUserData_RCE.md#poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.343231"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.343231"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.739713"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://www.totolink.net"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-74"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-01-28T22:15:55Z"
59+
}
60+
}

‎advisories/unreviewed/2026/01/GHSA-2m34-qqp3-pjcj/GHSA-2m34-qqp3-pjcj.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2m34-qqp3-pjcj",
4-
"modified": "2026-01-22T18:30:38Z",
4+
"modified": "2026-01-29T00:31:11Z",
55
"published": "2026-01-22T18:30:38Z",
66
"aliases": [
77
"CVE-2025-69066"
88
],
99
"details": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Indoor Plants indoor-plants allows PHP Local File Inclusion.This issue affects Indoor Plants: from n/a through <= 1.2.7.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-98"
2530
],
26-
"severity": null,
31+
"severity": "HIGH",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-01-22T17:16:20Z"

‎advisories/unreviewed/2026/01/GHSA-32g2-rj6c-338f/GHSA-32g2-rj6c-338f.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-32g2-rj6c-338f",
4-
"modified": "2026-01-22T18:30:38Z",
4+
"modified": "2026-01-29T00:31:11Z",
55
"published": "2026-01-22T18:30:38Z",
66
"aliases": [
77
"CVE-2025-69075"
88
],
99
"details": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Yolox yolox allows PHP Local File Inclusion.This issue affects Yolox: from n/a through <= 1.0.15.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-98"
2530
],
26-
"severity": null,
31+
"severity": "HIGH",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-01-22T17:16:21Z"

‎advisories/unreviewed/2026/01/GHSA-35ff-rw37-67v2/GHSA-35ff-rw37-67v2.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-35ff-rw37-67v2",
4-
"modified": "2026-01-22T18:30:38Z",
4+
"modified": "2026-01-29T00:31:11Z",
55
"published": "2026-01-22T18:30:38Z",
66
"aliases": [
77
"CVE-2025-69102"
88
],
99
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Boopathi Rajan WP Test Email wp-test-email allows Reflected XSS.This issue affects WP Test Email: from n/a through <= 1.1.7.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-79"
2530
],
26-
"severity": null,
31+
"severity": "HIGH",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-01-22T17:16:23Z"

‎advisories/unreviewed/2026/01/GHSA-3788-g3jp-362m/GHSA-3788-g3jp-362m.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3788-g3jp-362m",
4-
"modified": "2026-01-22T18:30:38Z",
4+
"modified": "2026-01-29T00:31:11Z",
55
"published": "2026-01-22T18:30:38Z",
66
"aliases": [
77
"CVE-2025-69072"
88
],
99
"details": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Prider prider allows PHP Local File Inclusion.This issue affects Prider: from n/a through <= 1.1.3.1.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-98"
2530
],
26-
"severity": null,
31+
"severity": "HIGH",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-01-22T17:16:21Z"

‎advisories/unreviewed/2026/01/GHSA-457r-j4jw-r8c4/GHSA-457r-j4jw-r8c4.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-457r-j4jw-r8c4",
4+
"modified": "2026-01-29T00:31:11Z",
5+
"published": "2026-01-29T00:31:11Z",
6+
"aliases": [
7+
"CVE-2026-1550"
8+
],
9+
"details": "A security flaw has been discovered in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /hms/hospital/docappsystem/adminviews.py of the component Admin Dashboard Page. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1550"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/rsecroot/Hospital-Management-System/blob/main/Broken%20Access%20Control.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://phpgurukul.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.343246"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.343246"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.739837"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-266"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-01-28T23:15:51Z"
55+
}
56+
}

‎advisories/unreviewed/2026/01/GHSA-4gx6-36jg-p3wm/GHSA-4gx6-36jg-p3wm.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4gx6-36jg-p3wm",
4+
"modified": "2026-01-29T00:31:11Z",
5+
"published": "2026-01-29T00:31:11Z",
6+
"aliases": [
7+
"CVE-2026-1544"
8+
],
9+
"details": "A security flaw has been discovered in D-Link DIR-823X 250416. Impacted is the function sub_41E2A0 of the file /goform/set_mode. Performing a manipulation of the argument lan_gateway results in os command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1544"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/master-abc/cve/issues/16"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.343228"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.343228"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.739155"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.dlink.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-77"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-01-28T22:15:55Z"
55+
}
56+
}

‎advisories/unreviewed/2026/01/GHSA-4r4r-44h4-6pmr/GHSA-4r4r-44h4-6pmr.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4r4r-44h4-6pmr",
4-
"modified": "2026-01-22T18:30:38Z",
4+
"modified": "2026-01-29T00:31:11Z",
55
"published": "2026-01-22T18:30:38Z",
66
"aliases": [
77
"CVE-2025-69068"
88
],
99
"details": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Muji muji allows PHP Local File Inclusion.This issue affects Muji: from n/a through <= 1.2.0.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-98"
2530
],
26-
"severity": null,
31+
"severity": "HIGH",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-01-22T17:16:20Z"

‎advisories/unreviewed/2026/01/GHSA-57rf-cvcf-cgq7/GHSA-57rf-cvcf-cgq7.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-57rf-cvcf-cgq7",
4-
"modified": "2026-01-22T18:30:34Z",
4+
"modified": "2026-01-29T00:31:10Z",
55
"published": "2026-01-22T18:30:34Z",
66
"aliases": [
77
"CVE-2025-67967"
88
],
99
"details": "Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Directory: from n/a through <= 1.3.3.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-862"
2530
],
26-
"severity": null,
31+
"severity": "HIGH",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2026-01-22T17:16:06Z"

0 commit comments

Comments
 (0)