Skip to content

Commit 2fd8ec6

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-88cv-g9gq-h6pq GHSA-4f54-m9cc-h3ch GHSA-764c-2rh3-p2wj GHSA-8cv4-qwjg-mxw5 GHSA-9gr5-mvp6-h2hx GHSA-c39m-mx52-7rcr GHSA-f93m-5ch9-5cqf GHSA-phg7-w8vm-9cqf GHSA-qj4q-79hc-9854 GHSA-qq7p-wh5q-7f3r GHSA-qwvc-m955-qj8v GHSA-r7j5-cv7f-qr4c GHSA-x4r3-2p23-jwm4
1 parent 6c426a9 commit 2fd8ec6

13 files changed

Lines changed: 389 additions & 8 deletions

File tree

‎advisories/unreviewed/2025/12/GHSA-88cv-g9gq-h6pq/GHSA-88cv-g9gq-h6pq.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,8 @@
3434
],
3535
"database_specific": {
3636
"cwe_ids": [
37-
"CWE-749"
37+
"CWE-749",
38+
"CWE-79"
3839
],
3940
"severity": "MODERATE",
4041
"github_reviewed": false,

‎advisories/unreviewed/2026/03/GHSA-4f54-m9cc-h3ch/GHSA-4f54-m9cc-h3ch.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
],
4343
"database_specific": {
4444
"cwe_ids": [
45+
"CWE-434",
4546
"CWE-79"
4647
],
4748
"severity": "HIGH",

‎advisories/unreviewed/2026/03/GHSA-764c-2rh3-p2wj/GHSA-764c-2rh3-p2wj.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-764c-2rh3-p2wj",
4-
"modified": "2026-03-25T03:31:31Z",
4+
"modified": "2026-03-26T00:30:55Z",
55
"published": "2026-03-25T03:31:31Z",
66
"aliases": [
77
"CVE-2026-28820"
88
],
99
"details": "This issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -21,7 +26,7 @@
2126
],
2227
"database_specific": {
2328
"cwe_ids": [],
24-
"severity": null,
29+
"severity": "MODERATE",
2530
"github_reviewed": false,
2631
"github_reviewed_at": null,
2732
"nvd_published_at": "2026-03-25T01:17:07Z"

‎advisories/unreviewed/2026/03/GHSA-8cv4-qwjg-mxw5/GHSA-8cv4-qwjg-mxw5.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8cv4-qwjg-mxw5",
4-
"modified": "2026-03-25T03:31:28Z",
4+
"modified": "2026-03-26T00:30:54Z",
55
"published": "2026-03-25T03:31:28Z",
66
"aliases": [
77
"CVE-2026-20631"
88
],
99
"details": "A logic issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.4. A user may be able to elevate privileges.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -21,7 +26,7 @@
2126
],
2227
"database_specific": {
2328
"cwe_ids": [],
24-
"severity": null,
29+
"severity": "HIGH",
2530
"github_reviewed": false,
2631
"github_reviewed_at": null,
2732
"nvd_published_at": "2026-03-25T01:17:04Z"

‎advisories/unreviewed/2026/03/GHSA-9gr5-mvp6-h2hx/GHSA-9gr5-mvp6-h2hx.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9gr5-mvp6-h2hx",
4+
"modified": "2026-03-26T00:30:57Z",
5+
"published": "2026-03-26T00:30:57Z",
6+
"aliases": [
7+
"CVE-2026-4826"
8+
],
9+
"details": "A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /update_stock.php of the component HTTP GET Parameter Handler. This manipulation of the argument sid causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. If you want to get best quality of vulnerability data, you may have to visit VulDB.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4826"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/SQLi-UpdateStock-sid.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.353126"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.353126"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.775177"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-26T00:16:41Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-c39m-mx52-7rcr/GHSA-c39m-mx52-7rcr.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c39m-mx52-7rcr",
4+
"modified": "2026-03-26T00:30:55Z",
5+
"published": "2026-03-26T00:30:55Z",
6+
"aliases": [
7+
"CVE-2025-2535"
8+
],
9+
"details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2535"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2026-03-25T23:17:07Z"
24+
}
25+
}

‎advisories/unreviewed/2026/03/GHSA-f93m-5ch9-5cqf/GHSA-f93m-5ch9-5cqf.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-f93m-5ch9-5cqf",
4-
"modified": "2026-03-23T15:30:33Z",
4+
"modified": "2026-03-26T00:30:54Z",
55
"published": "2026-03-20T21:31:28Z",
66
"aliases": [
77
"CVE-2025-63261"
@@ -23,6 +23,10 @@
2323
"type": "WEB",
2424
"url": "https://github.com/eldy/AWStats/blob/develop/wwwroot/cgi-bin/awstats.pl"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://lists.debian.org/debian-lts-announce/2026/03/msg00013.html"
29+
},
2630
{
2731
"type": "WEB",
2832
"url": "https://pentest-tools.com/PTT-2025-021-Code-Execution-in-AWStats.pdf"

‎advisories/unreviewed/2026/03/GHSA-phg7-w8vm-9cqf/GHSA-phg7-w8vm-9cqf.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-phg7-w8vm-9cqf",
4+
"modified": "2026-03-26T00:30:56Z",
5+
"published": "2026-03-26T00:30:56Z",
6+
"aliases": [
7+
"CVE-2026-4825"
8+
],
9+
"details": "A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown part of the file /update_sales.php of the component HTTP GET Parameter Handler. The manipulation of the argument sid results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4825"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/SQLi-UpdateSales-sid.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.353125"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.353125"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.775175"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-25T23:17:10Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-qj4q-79hc-9854/GHSA-qj4q-79hc-9854.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qj4q-79hc-9854",
4+
"modified": "2026-03-26T00:30:55Z",
5+
"published": "2026-03-26T00:30:55Z",
6+
"aliases": [
7+
"CVE-2026-4823"
8+
],
9+
"details": "A flaw has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this vulnerability is an unknown functionality of the component NTLM2 Handler. Executing a manipulation can lead to information disclosure. The attack is restricted to local execution. Attacks of this nature are highly complex. The exploitation appears to be difficult. The exploit has been published and may be used. Upgrading to version 8.7.4 addresses this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4823"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/0truust/iperius-backup-security-advisories/blob/main/advisories/ntlm-relay-credential-exposure.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.353123"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.353123"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.774218"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.iperiusbackup.com/download-software-backup.aspx"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-200"
50+
],
51+
"severity": "LOW",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-25T22:16:19Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-qq7p-wh5q-7f3r/GHSA-qq7p-wh5q-7f3r.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qq7p-wh5q-7f3r",
4+
"modified": "2026-03-26T00:30:57Z",
5+
"published": "2026-03-26T00:30:57Z",
6+
"aliases": [
7+
"CVE-2026-4758"
8+
],
9+
"details": "The WP Job Portal plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'WPJOBPORTALcustomfields::removeFileCustom' function in all versions up to, and including, 2.4.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4758"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.4.9/includes/classes/customfields.php#L1558"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.5.0/includes/classes/customfields.php?rev=3490490#L1558"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e96f31e0-4b2e-4ea1-a3e5-fd7452a2fea9?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-22"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-03-26T00:16:41Z"
43+
}
44+
}

0 commit comments

Comments
 (0)