Skip to content

Commit ef4ae7d

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-57pm-w85h-x97q GHSA-88jg-87gj-m92c GHSA-8fgh-55xj-7pjm GHSA-f739-9xv4-c36c GHSA-vr29-pvvw-gw33
1 parent c8cb570 commit ef4ae7d

5 files changed

Lines changed: 276 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/03/GHSA-57pm-w85h-x97q/GHSA-57pm-w85h-x97q.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-57pm-w85h-x97q",
4+
"modified": "2026-03-29T06:31:20Z",
5+
"published": "2026-03-29T06:31:20Z",
6+
"aliases": [
7+
"CVE-2026-5033"
8+
],
9+
"details": "A vulnerability was detected in code-projects Accounting System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_costumer.php of the component Parameter Handler. The manipulation of the argument cos_id results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5033"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Xu-Zhihan/CVE/issues/6"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://code-projects.org"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/778589"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/353959"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/353959/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-29T06:16:11Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-88jg-87gj-m92c/GHSA-88jg-87gj-m92c.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-88jg-87gj-m92c",
4+
"modified": "2026-03-29T06:31:20Z",
5+
"published": "2026-03-29T06:31:20Z",
6+
"aliases": [
7+
"CVE-2026-5031"
8+
],
9+
"details": "A vulnerability was found in BichitroGan ISP Billing Software 2025.3.20. Impacted is an unknown function of the file /?_route=settings/users-view/ of the component Endpoint. The manipulation of the argument ID results in improper control of resource identifiers. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5031"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/4m3rr0r/PoCVulDb/issues/15"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/submit/778530"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/353953"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/353953/cti"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-99"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-29T05:15:55Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-8fgh-55xj-7pjm/GHSA-8fgh-55xj-7pjm.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8fgh-55xj-7pjm",
4+
"modified": "2026-03-29T06:31:20Z",
5+
"published": "2026-03-29T06:31:20Z",
6+
"aliases": [
7+
"CVE-2026-5030"
8+
],
9+
"details": "A vulnerability has been found in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi of the component Telnet Service. The manipulation of the argument host_time leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5030"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://lavender-bicycle-a5a.notion.site/TOTOLINK-NR1800X-NTPSyncWithHost-32153a41781f8032afebc0802b704e9c?source=copy_link"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/submit/778529"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/353952"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/353952/cti"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.totolink.net"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-29T05:15:55Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-f739-9xv4-c36c/GHSA-f739-9xv4-c36c.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f739-9xv4-c36c",
4+
"modified": "2026-03-29T06:31:20Z",
5+
"published": "2026-03-29T06:31:20Z",
6+
"aliases": [
7+
"CVE-2026-5024"
8+
],
9+
"details": "A vulnerability was found in D-Link DIR-513 1.10. This issue affects the function formSetEmail of the file /goform/formSetEmail. Performing a manipulation of the argument curTime results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5024"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Litengzheng/vul_db/blob/main/Dir513/vul_30/README.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/submit/778414"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/353908"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/353908/cti"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.dlink.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-29T04:16:00Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-vr29-pvvw-gw33/GHSA-vr29-pvvw-gw33.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vr29-pvvw-gw33",
4+
"modified": "2026-03-29T06:31:20Z",
5+
"published": "2026-03-29T06:31:20Z",
6+
"aliases": [
7+
"CVE-2026-5034"
8+
],
9+
"details": "A flaw has been found in code-projects Accounting System 1.0. Affected by this issue is some unknown functionality of the file /edit_costumer.php of the component Parameter Handler. This manipulation of the argument cos_id causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5034"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Xu-Zhihan/CVE/issues/7"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://code-projects.org"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/778594"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/353960"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/353960/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-29T06:16:12Z"
55+
}
56+
}

0 commit comments

Comments
 (0)