Skip to content

Commit 493d991

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5m2g-4cf6-c3rg GHSA-8hhx-xq9j-xwfj GHSA-fmr2-m7gc-577w GHSA-pc25-pwr8-gpp2
1 parent 6fbb688 commit 493d991

File tree

4 files changed

+240
-0
lines changed

4 files changed

+240
-0
lines changed

‎advisories/unreviewed/2026/02/GHSA-5m2g-4cf6-c3rg/GHSA-5m2g-4cf6-c3rg.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5m2g-4cf6-c3rg",
4+
"modified": "2026-02-22T00:31:01Z",
5+
"published": "2026-02-22T00:31:01Z",
6+
"aliases": [
7+
"CVE-2026-2896"
8+
],
9+
"details": "A weakness has been identified in funadmin up to 7.1.0-rc4. This affects the function setConfig of the file app/backend/controller/Ajax.php of the component Configuration Handler. Executing a manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2896"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/I4m6da/CVE/issues/3"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/I4m6da/CVE/issues/3#issue-3884949083"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.347207"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.347207"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.753972"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-266"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-22T00:15:59Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-8hhx-xq9j-xwfj/GHSA-8hhx-xq9j-xwfj.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8hhx-xq9j-xwfj",
4+
"modified": "2026-02-22T00:31:01Z",
5+
"published": "2026-02-22T00:31:01Z",
6+
"aliases": [
7+
"CVE-2026-2894"
8+
],
9+
"details": "A vulnerability was identified in funadmin up to 7.1.0-rc4. Affected by this vulnerability is the function getMember of the file app/frontend/view/login/forget.html. Such manipulation leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2894"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/I4m6da/CVE/issues/1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/I4m6da/CVE/issues/1#issue-3884896592"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.347205"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.347205"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.753969"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-200"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-21T23:15:59Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-fmr2-m7gc-577w/GHSA-fmr2-m7gc-577w.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fmr2-m7gc-577w",
4+
"modified": "2026-02-22T00:31:01Z",
5+
"published": "2026-02-22T00:31:01Z",
6+
"aliases": [
7+
"CVE-2026-2895"
8+
],
9+
"details": "A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2895"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/I4m6da/CVE/issues/2"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/I4m6da/CVE/issues/2#issue-3884919985"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.347206"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.347206"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.753971"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-640"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-21T23:15:59Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-pc25-pwr8-gpp2/GHSA-pc25-pwr8-gpp2.json‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pc25-pwr8-gpp2",
4+
"modified": "2026-02-22T00:31:01Z",
5+
"published": "2026-02-22T00:31:01Z",
6+
"aliases": [
7+
"CVE-2026-2889"
8+
],
9+
"details": "A vulnerability was detected in CCExtractor up to 0.96.5. Affected is the function processmp4 in the library src/lib_ccx/mp4.c. Performing a manipulation results in use after free. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 0.96.6 is able to address this issue. The patch is named fd7271bae238ccb3ae8a71304ea64f0886324925. You should upgrade the affected component.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2889"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/CCExtractor/ccextractor/issues/2055"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/CCExtractor/ccextractor/pull/2057"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/CCExtractor/ccextractor/commit/fd7271bae238ccb3ae8a71304ea64f0886324925"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/CCExtractor/ccextractor"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/CCExtractor/ccextractor/releases/tag/v0.96.6"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://github.com/oneafter/0123/blob/main/cc3/repro"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/?ctiid.347182"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://vuldb.com/?id.347182"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://vuldb.com/?submit.755029"
61+
}
62+
],
63+
"database_specific": {
64+
"cwe_ids": [
65+
"CWE-119"
66+
],
67+
"severity": "MODERATE",
68+
"github_reviewed": false,
69+
"github_reviewed_at": null,
70+
"nvd_published_at": "2026-02-21T22:15:59Z"
71+
}
72+
}

0 commit comments

Comments
 (0)