Skip to content

Commit 29aab74

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 96bb047 commit 29aab74

File tree

34 files changed

+1341
-0
lines changed

34 files changed

+1341
-0
lines changed

‎advisories/unreviewed/2026/03/GHSA-2926-f789-68jv/GHSA-2926-f789-68jv.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2926-f789-68jv",
4+
"modified": "2026-03-24T00:30:24Z",
5+
"published": "2026-03-24T00:30:24Z",
6+
"aliases": [
7+
"CVE-2025-60949"
8+
],
9+
"details": "Census CSWeb 8.0.1 allows \"app/config\" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration files and obtain leaked secrets. Fixed in 8.1.0 alpha.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60949"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/csprousers/csweb/commit/eba0b59a243390a1a4f9524cce6dbc0314bf0d91"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/hx381/cspro-exploits"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-082-01.json"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.cve.org/CVERecord?id=CVE-2025-60949"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-200"
46+
],
47+
"severity": "CRITICAL",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-23T22:16:23Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-2qpc-rpxq-phv6/GHSA-2qpc-rpxq-phv6.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2qpc-rpxq-phv6",
4+
"modified": "2026-03-24T00:30:26Z",
5+
"published": "2026-03-24T00:30:26Z",
6+
"aliases": [
7+
"CVE-2026-4001"
8+
],
9+
"details": "The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.4.1 via the custom pricing formula eval() in the process_custom_formula() function within includes/process/price.php. This is due to insufficient sanitization and validation of user-submitted field values before passing them to PHP's eval() function. The sanitize_values() method strips HTML tags but does not escape single quotes or prevent PHP code injection. This makes it possible for unauthenticated attackers to execute arbitrary code on the server by submitting a crafted value to a WCPA text field configured with custom pricing formula (pricingType: \"custom\" with {this.value}).",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4001"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://acowebs.com/woo-custom-product-addons"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/70a2b6ff-defc-4722-9af9-3cae94e98632?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-95"
34+
],
35+
"severity": "CRITICAL",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-03-24T00:16:31Z"
39+
}
40+
}

‎advisories/unreviewed/2026/03/GHSA-32px-r229-cx92/GHSA-32px-r229-cx92.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-32px-r229-cx92",
4+
"modified": "2026-03-24T00:30:24Z",
5+
"published": "2026-03-24T00:30:24Z",
6+
"aliases": [
7+
"CVE-2025-60948"
8+
],
9+
"details": "Census CSWeb 8.0.1 allows stored cross-site scripting in user supplied fields. A remote, authenticated attacker could store malicious javascript that executes in a victim's browser. Fixed in 8.1.0 alpha.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60948"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/csprousers/csweb/commit/eba0b59a243390a1a4f9524cce6dbc0314bf0d91"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/hx381/cspro-exploits"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-082-01.json"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.cve.org/CVERecord?id=CVE-2025-60948"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-23T22:16:22Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-4x24-3v7p-2g45/GHSA-4x24-3v7p-2g45.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4x24-3v7p-2g45",
4+
"modified": "2026-03-24T00:30:26Z",
5+
"published": "2026-03-24T00:30:26Z",
6+
"aliases": [
7+
"CVE-2026-4614"
8+
],
9+
"details": "A vulnerability was determined in itsourcecode sanitize or validate this input 1.0. This issue affects some unknown processing of the file /admin/subjects.php of the component Parameter Handler. This manipulation of the argument subject_code causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4614"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/ltranquility/submit/issues/2"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.352478"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.352478"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.775723"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-24T00:16:31Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-56rf-g9gc-682p/GHSA-56rf-g9gc-682p.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-56rf-g9gc-682p",
4+
"modified": "2026-03-24T00:30:25Z",
5+
"published": "2026-03-24T00:30:25Z",
6+
"aliases": [
7+
"CVE-2026-4611"
8+
],
9+
"details": "A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue is the function setLanCfg of the file /usr/sbin/shttpd. Executing a manipulation of the argument Hostname can lead to os command injection. The attack may be launched remotely.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4611"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.352475"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.352475"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.775642"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.totolink.net"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-77"
46+
],
47+
"severity": "HIGH",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-23T22:16:31Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-6m84-3f7p-p24x/GHSA-6m84-3f7p-p24x.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6m84-3f7p-p24x",
4+
"modified": "2026-03-24T00:30:25Z",
5+
"published": "2026-03-24T00:30:25Z",
6+
"aliases": [
7+
"CVE-2026-32900"
8+
],
9+
"details": "Rejected reason: This CVE ID has been rejected.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32900"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2026-03-23T22:16:28Z"
24+
}
25+
}

‎advisories/unreviewed/2026/03/GHSA-78v3-9w5r-92fm/GHSA-78v3-9w5r-92fm.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-78v3-9w5r-92fm",
4+
"modified": "2026-03-24T00:30:25Z",
5+
"published": "2026-03-24T00:30:25Z",
6+
"aliases": [
7+
"CVE-2026-32903"
8+
],
9+
"details": "Rejected reason: This CVE ID has been rejected.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32903"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2026-03-23T22:16:28Z"
24+
}
25+
}

‎advisories/unreviewed/2026/03/GHSA-7j7f-88p8-wh55/GHSA-7j7f-88p8-wh55.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7j7f-88p8-wh55",
4+
"modified": "2026-03-24T00:30:25Z",
5+
"published": "2026-03-24T00:30:25Z",
6+
"aliases": [
7+
"CVE-2026-32912"
8+
],
9+
"details": "Rejected reason: This CVE ID has been rejected.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32912"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2026-03-23T22:16:30Z"
24+
}
25+
}

0 commit comments

Comments
 (0)