Skip to content

Commit 726c387

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2vp3-crwq-3fg5 GHSA-369j-mq74-56g3 GHSA-7pr6-hx5j-fw8h GHSA-f8pm-w4xh-wj52 GHSA-fxwj-494p-xmc7 GHSA-j8wf-mcp8-694g GHSA-m9jj-v5hf-f99h GHSA-mg9f-f46c-6cm7 GHSA-qwwf-j766-5g2p GHSA-r3pp-h225-m34v GHSA-vv27-hw9x-f765 GHSA-xrgh-5p34-46f6
1 parent 8be921b commit 726c387

File tree

12 files changed

+488
-0
lines changed

12 files changed

+488
-0
lines changed

‎advisories/unreviewed/2025/07/GHSA-2vp3-crwq-3fg5/GHSA-2vp3-crwq-3fg5.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2vp3-crwq-3fg5",
4+
"modified": "2025-07-16T09:31:05Z",
5+
"published": "2025-07-16T09:31:05Z",
6+
"aliases": [
7+
"CVE-2025-27465"
8+
],
9+
"details": "Certain instructions need intercepting and emulating by Xen. In some\ncases Xen emulates the instruction by replaying it, using an executable\nstub. Some instructions may raise an exception, which is supposed to be\nhandled gracefully. Certain replayed instructions have additional logic\nto set up and recover the changes to the arithmetic flags.\n\nFor replayed instructions where the flags recovery logic is used, the\nmetadata for exception handling was incorrect, preventing Xen from\nhandling the the exception gracefully, treating it as fatal instead.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27465"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://xenbits.xenproject.org/xsa/advisory-470.html"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-07-16T09:15:23Z"
28+
}
29+
}

‎advisories/unreviewed/2025/07/GHSA-369j-mq74-56g3/GHSA-369j-mq74-56g3.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-369j-mq74-56g3",
4+
"modified": "2025-07-16T09:31:03Z",
5+
"published": "2025-07-16T09:31:03Z",
6+
"aliases": [
7+
"CVE-2025-52688"
8+
],
9+
"details": "Successful exploitation of the vulnerability could allow an attacker to inject commands with root privileges on the access point, potentially leading to the loss of confidentiality, integrity, availability, and full control of the access point.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52688"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://jro.sg/CVEs/CVE-2025-52688"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.al-enterprise.com/-/media/assets/internet/documents/sa-n0150-omniaccess-stellar-multiple-vulnerabilities.pdf"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-072"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-77"
38+
],
39+
"severity": "CRITICAL",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-07-16T07:15:23Z"
43+
}
44+
}

‎advisories/unreviewed/2025/07/GHSA-7pr6-hx5j-fw8h/GHSA-7pr6-hx5j-fw8h.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7pr6-hx5j-fw8h",
4+
"modified": "2025-07-16T09:31:04Z",
5+
"published": "2025-07-16T09:31:04Z",
6+
"aliases": [
7+
"CVE-2025-7359"
8+
],
9+
"details": "The Counter live visitors for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wcvisitor_get_block function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server. NOTE: This particular vulnerability deletes all the files in a targeted arbitrary directory rather than a specified arbitrary file, which can lead to loss of data or a denial of service condition.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7359"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/counter-visitor-for-woocommerce/tags/1.3.6/woo-counter-visitor.php#L378"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ae13dc61-c4bf-4b17-8055-98c80a853a2a?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-22"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-07-16T07:15:24Z"
39+
}
40+
}

‎advisories/unreviewed/2025/07/GHSA-f8pm-w4xh-wj52/GHSA-f8pm-w4xh-wj52.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f8pm-w4xh-wj52",
4+
"modified": "2025-07-16T09:31:05Z",
5+
"published": "2025-07-16T09:31:05Z",
6+
"aliases": [
7+
"CVE-2025-7703"
8+
],
9+
"details": "Authentication vulnerability in the mobile application（tech.palm.id）may lead to the risk of information leakage.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7703"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://security.tecno.com/SRC/blogdetail/428?lang=en_US"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://security.tecno.com/SRC/securityUpdates"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-287"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2025-07-16T09:15:24Z"
34+
}
35+
}

‎advisories/unreviewed/2025/07/GHSA-fxwj-494p-xmc7/GHSA-fxwj-494p-xmc7.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fxwj-494p-xmc7",
4+
"modified": "2025-07-16T09:31:04Z",
5+
"published": "2025-07-16T09:31:04Z",
6+
"aliases": [
7+
"CVE-2025-5843"
8+
],
9+
"details": "The Brandfolder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 5.0.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5843"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/brandfolder/tags/5.0.19/brandfolder-integration.php#L138"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://wordpress.org/plugins/brandfolder/#developers"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bedbe508-e879-4989-89a6-db909ecd35a8?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-07-16T07:15:23Z"
43+
}
44+
}

‎advisories/unreviewed/2025/07/GHSA-j8wf-mcp8-694g/GHSA-j8wf-mcp8-694g.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j8wf-mcp8-694g",
4+
"modified": "2025-07-16T09:31:04Z",
5+
"published": "2025-07-16T09:31:04Z",
6+
"aliases": [
7+
"CVE-2025-6747"
8+
],
9+
"details": "The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fusion_map' shortcode in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6747"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://avada.com/documentation/avada-changelog"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f0a21eaa-4e2a-4d07-8635-f0a8a5db660f?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-07-16T07:15:24Z"
39+
}
40+
}

‎advisories/unreviewed/2025/07/GHSA-m9jj-v5hf-f99h/GHSA-m9jj-v5hf-f99h.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m9jj-v5hf-f99h",
4+
"modified": "2025-07-16T09:31:04Z",
5+
"published": "2025-07-16T09:31:04Z",
6+
"aliases": [
7+
"CVE-2025-52690"
8+
],
9+
"details": "Successful exploitation of the vulnerability could allow an attacker to execute arbitrary commands as root, potentially leading to the loss of confidentiality, integrity, availability, and full control of the access point.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52690"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://jro.sg/CVEs/CVE-2025-52690"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.al-enterprise.com/-/media/assets/internet/documents/sa-n0150-omniaccess-stellar-multiple-vulnerabilities.pdf"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-072"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-77"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-07-16T07:15:23Z"
43+
}
44+
}

‎advisories/unreviewed/2025/07/GHSA-mg9f-f46c-6cm7/GHSA-mg9f-f46c-6cm7.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mg9f-f46c-6cm7",
4+
"modified": "2025-07-16T09:31:04Z",
5+
"published": "2025-07-16T09:31:04Z",
6+
"aliases": [
7+
"CVE-2025-6043"
8+
],
9+
"details": "The Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Deletion due to a missing capability check on the wpmr_delete_file() function in all versions up to, and including, 16.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files making remote code execution possible. This is only exploitable when advanced mode is enabled on the site.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6043"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/wp-malware-removal/tags/16.8/wpmr.php#L4570"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/wp-malware-removal/tags/16.8/wpmr.php#L6304"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/wp-malware-removal/tags/16.8/wpmr.php#L6401"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d44fe4d7-1af5-4e26-a33c-43a9cce4174c?source=cve"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-862"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-07-16T07:15:23Z"
47+
}
48+
}

‎advisories/unreviewed/2025/07/GHSA-qwwf-j766-5g2p/GHSA-qwwf-j766-5g2p.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qwwf-j766-5g2p",
4+
"modified": "2025-07-16T09:31:03Z",
5+
"published": "2025-07-16T09:31:03Z",
6+
"aliases": [
7+
"CVE-2025-52687"
8+
],
9+
"details": "Successful exploitation of the vulnerability could allow an attacker with administrator credentials for the access point to inject malicious JavaScript into the payload of web traffics, potentially leading to session hijacking and denial-of-service (DoS).",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52687"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.al-enterprise.com/-/media/assets/internet/documents/sa-n0150-omniaccess-stellar-multiple-vulnerabilities.pdf"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-072"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-77"
34+
],
35+
"severity": "LOW",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-07-16T07:15:21Z"
39+
}
40+
}

0 commit comments

Comments
 (0)