Skip to content

Commit 0e63915

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-9vmc-526p-2842 GHSA-f94g-c4x5-h33w GHSA-mrm5-v7mh-6mmq GHSA-px7q-3g2x-xf8v
1 parent 99a62c0 commit 0e63915

File tree

4 files changed

+204
-0
lines changed

4 files changed

+204
-0
lines changed

‎advisories/unreviewed/2025/09/GHSA-9vmc-526p-2842/GHSA-9vmc-526p-2842.json

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9vmc-526p-2842",
4+
"modified": "2025-09-06T09:30:25Z",
5+
"published": "2025-09-06T09:30:25Z",
6+
"aliases": [
7+
"CVE-2025-10029"
8+
],
9+
"details": "A security flaw has been discovered in itsourcecode POS Point of Sale System 1.0. This vulnerability affects unknown code of the file /inventory/main/vendors/datatables/unit_testing/templates/complex_header_2.php. Performing manipulation of the argument scripts results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10029"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/AlphabugX/CVE-Report/blob/main/CVE-006.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.322744"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.322744"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.643944"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-79"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-09-06T09:15:36Z"
55+
}
56+
}

‎advisories/unreviewed/2025/09/GHSA-f94g-c4x5-h33w/GHSA-f94g-c4x5-h33w.json

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f94g-c4x5-h33w",
4+
"modified": "2025-09-06T09:30:25Z",
5+
"published": "2025-09-06T09:30:25Z",
6+
"aliases": [
7+
"CVE-2025-10046"
8+
],
9+
"details": "The ELEX WooCommerce Google Shopping (Google Product Feed) plugin for WordPress is vulnerable to SQL Injection via the 'file_to_delete' parameter in all versions up to, and including, 1.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10046"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.svn.wordpress.org/elex-woocommerce-google-product-feed-plugin-basic/tags/1.4.3/includes/elex-manage-feed-ajax.php#29"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/changeset/3342699/elex-woocommerce-google-product-feed-plugin-basic/tags/1.4.4/includes/elex-manage-feed-ajax.php"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0afe37bb-fa8a-4e7b-93c6-c44b3fbeb904?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-89"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-09-06T07:15:33Z"
43+
}
44+
}

‎advisories/unreviewed/2025/09/GHSA-mrm5-v7mh-6mmq/GHSA-mrm5-v7mh-6mmq.json

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mrm5-v7mh-6mmq",
4+
"modified": "2025-09-06T09:30:25Z",
5+
"published": "2025-09-06T09:30:25Z",
6+
"aliases": [
7+
"CVE-2025-9961"
8+
],
9+
"details": "An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500. \n\nThe exploit can only be conducted via a Man-In-The-Middle (MITM) attack. \n\nThis issue affects AX10 V1/V1.2/V2/V2.6/V3/V3.6: before 1.2.1; AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.6: before 1.3.11.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9961"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://blog.byteray.co.uk/zero-day-alert-automated-discovery-of-critical-cwmp-stack-overflow-in-tp-link-routers-0bc495a08679"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.tp-link.com/us/support/download/archer-ax10"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.tp-link.com/us/support/download/archer-ax1500"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.tp-link.com/us/support/faq/4647"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-120"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-09-06T07:15:33Z"
47+
}
48+
}

‎advisories/unreviewed/2025/09/GHSA-px7q-3g2x-xf8v/GHSA-px7q-3g2x-xf8v.json

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-px7q-3g2x-xf8v",
4+
"modified": "2025-09-06T09:30:25Z",
5+
"published": "2025-09-06T09:30:25Z",
6+
"aliases": [
7+
"CVE-2025-10028"
8+
],
9+
"details": "A vulnerability was identified in itsourcecode POS Point of Sale System 1.0. This affects an unknown part of the file /inventory/main/vendors/datatables/unit_testing/templates/6776.php. Such manipulation of the argument scripts leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10028"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/AlphabugX/CVE-Report/blob/main/CVE-005.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.322743"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.322743"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.643943"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-79"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-09-06T07:15:31Z"
55+
}
56+
}

0 commit comments

Comments
 (0)