Skip to content

Commit 393d231

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2f5g-m75x-xphf GHSA-4vr2-gvv5-x55w GHSA-6h78-g5gr-4mp3 GHSA-74gw-c73g-6fq2 GHSA-7qxc-43wm-v793 GHSA-jvmm-jqv7-98vp GHSA-jwfw-xx6c-8gwv GHSA-pq7v-9vmm-7jw6 GHSA-rm76-fcj7-6cxh GHSA-rv67-6qhq-rp2p GHSA-xw84-4gx9-vm4h
1 parent c720cdc commit 393d231

11 files changed

Lines changed: 464 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/02/GHSA-2f5g-m75x-xphf/GHSA-2f5g-m75x-xphf.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2f5g-m75x-xphf",
4+
"modified": "2026-02-27T12:31:25Z",
5+
"published": "2026-02-27T12:31:25Z",
6+
"aliases": [
7+
"CVE-2026-21660"
8+
],
9+
"details": "Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or system compromise\nThis issue affects Frick Controls Quantum HD version 10.22 and prior.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21660"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-256"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-02-27T10:16:22Z"
39+
}
40+
}

‎advisories/unreviewed/2026/02/GHSA-4vr2-gvv5-x55w/GHSA-4vr2-gvv5-x55w.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4vr2-gvv5-x55w",
4+
"modified": "2026-02-27T12:31:25Z",
5+
"published": "2026-02-27T12:31:25Z",
6+
"aliases": [
7+
"CVE-2024-10938"
8+
],
9+
"details": "The OVRI Payment plugin for WordPress contains malicious .htaccess files in version 1.7.0. The files contain directives to prevent the execution of certain scripts while allowing execution of known malicious PHP files. If moved outside of the plugin's directory, they may interfere with the proper function of a site.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10938"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/moneytigo/tags/1.7.0/.htaccess"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/moneytigo/tags/1.7.0/assets/.htaccess"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b45674c-8446-44eb-a45a-15dab02c89cf?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-506"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-27T10:16:18Z"
43+
}
44+
}

‎advisories/unreviewed/2026/02/GHSA-6h78-g5gr-4mp3/GHSA-6h78-g5gr-4mp3.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6h78-g5gr-4mp3",
4+
"modified": "2026-02-27T12:31:25Z",
5+
"published": "2026-02-27T12:31:25Z",
6+
"aliases": [
7+
"CVE-2025-14142"
8+
],
9+
"details": "The Electric Enquiries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button' parameter of the electric-enquiry shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14142"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/electric-enquiries/tags/1.1/electric-enquiries.php#L76"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/electric-enquiries/trunk/electric-enquiries.php#L76"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f99da73-1db9-43ee-ac74-b772882baf15?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-27T10:16:21Z"
43+
}
44+
}

‎advisories/unreviewed/2026/02/GHSA-74gw-c73g-6fq2/GHSA-74gw-c73g-6fq2.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-74gw-c73g-6fq2",
4+
"modified": "2026-02-27T12:31:25Z",
5+
"published": "2026-02-27T12:31:25Z",
6+
"aliases": [
7+
"CVE-2026-1434"
8+
],
9+
"details": "Omega-PSIR is vulnerable to Reflected XSS via the lang parameter. An attacker can craft a malicious URL that, when opened, causes arbitrary JavaScript to execute in the victim’s browser.\n\nThis issue was fixed in 4.6.7.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1434"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://cert.pl/posts/2026/02/CVE-2026-1434"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.omegapsir.io"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-02-27T11:16:04Z"
39+
}
40+
}

‎advisories/unreviewed/2026/02/GHSA-7qxc-43wm-v793/GHSA-7qxc-43wm-v793.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7qxc-43wm-v793",
4+
"modified": "2026-02-27T12:31:25Z",
5+
"published": "2026-02-27T12:31:25Z",
6+
"aliases": [
7+
"CVE-2026-21659"
8+
],
9+
"details": "Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to\nexecute arbitrary code on the affected device, leading to full system compromise. \nThis issue affects Frick Controls Quantum HD: Frick Controls Quantum HD version 10.22 and prior.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21659"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-23"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-02-27T10:16:22Z"
39+
}
40+
}

‎advisories/unreviewed/2026/02/GHSA-jvmm-jqv7-98vp/GHSA-jvmm-jqv7-98vp.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jvmm-jqv7-98vp",
4+
"modified": "2026-02-27T12:31:25Z",
5+
"published": "2026-02-27T12:31:25Z",
6+
"aliases": [
7+
"CVE-2025-11251"
8+
],
9+
"details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platform allows SQL Injection.This issue affects E-Commerce Platform: through 27022026.\n\nNOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11251"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.usom.gov.tr/bildirim/tr-26-0084"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-02-27T12:16:01Z"
35+
}
36+
}

‎advisories/unreviewed/2026/02/GHSA-jwfw-xx6c-8gwv/GHSA-jwfw-xx6c-8gwv.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jwfw-xx6c-8gwv",
4+
"modified": "2026-02-27T12:31:25Z",
5+
"published": "2026-02-27T12:31:25Z",
6+
"aliases": [
7+
"CVE-2026-24351"
8+
],
9+
"details": "PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24351"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://cert.pl/posts/2026/03/CVE-2026-24350"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://pluxml.org"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-02-27T12:16:03Z"
39+
}
40+
}

‎advisories/unreviewed/2026/02/GHSA-pq7v-9vmm-7jw6/GHSA-pq7v-9vmm-7jw6.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pq7v-9vmm-7jw6",
4+
"modified": "2026-02-27T12:31:25Z",
5+
"published": "2026-02-27T12:31:25Z",
6+
"aliases": [
7+
"CVE-2026-24352"
8+
],
9+
"details": "PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID\nfor a victim and later hijack the authenticated session.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24352"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://cert.pl/posts/2026/03/CVE-2026-24350"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://pluxml.org"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-384"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-02-27T12:16:03Z"
39+
}
40+
}

‎advisories/unreviewed/2026/02/GHSA-rm76-fcj7-6cxh/GHSA-rm76-fcj7-6cxh.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rm76-fcj7-6cxh",
4+
"modified": "2026-02-27T12:31:25Z",
5+
"published": "2026-02-27T12:31:25Z",
6+
"aliases": [
7+
"CVE-2026-1305"
8+
],
9+
"details": "The Japanized for WooCommerce plugin for WordPress is vulnerable to Improper Authentication in versions up to, and including, 2.8.4. This is due to a flawed permission check in the `paidy_webhook_permission_check` function that unconditionally returns `true` when the webhook signature header is omitted. This makes it possible for unauthenticated attackers to bypass payment verification and fraudulently mark orders as \"Processing\" or \"Completed\" without actual payment via a crafted POST request to the Paidy webhook endpoint.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1305"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/tags/2.8.2/includes/gateways/paidy/class-wc-paidy-endpoint.php#L108"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/tags/2.8.2/includes/gateways/paidy/class-wc-paidy-endpoint.php#L63"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/trunk/includes/gateways/paidy/class-wc-paidy-endpoint.php#L108"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/trunk/includes/gateways/paidy/class-wc-paidy-endpoint.php#L63"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://plugins.trac.wordpress.org/changeset/3464868/woocommerce-for-japan/trunk/includes/gateways/paidy/class-wc-paidy-endpoint.php"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8cef4b2b-ae8d-4e18-b763-6960a0b944f7?source=cve"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-287"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-27T10:16:21Z"
55+
}
56+
}

0 commit comments

Comments
 (0)