Skip to content

Commit 5ba5652

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-347j-pfc2-rvr3 GHSA-9qmm-fmp8-wcfp GHSA-9xgc-j99m-jvr5 GHSA-jp5v-2v6v-3w4h GHSA-phqp-j38f-cm7h GHSA-qg34-2w8p-vh8q
1 parent 4d50562 commit 5ba5652

6 files changed

Lines changed: 332 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/02/GHSA-347j-pfc2-rvr3/GHSA-347j-pfc2-rvr3.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-347j-pfc2-rvr3",
4+
"modified": "2026-02-08T12:30:26Z",
5+
"published": "2026-02-08T12:30:26Z",
6+
"aliases": [
7+
"CVE-2026-2150"
8+
],
9+
"details": "A flaw has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this issue is some unknown functionality of the file /checkin.php. This manipulation of the argument patient_id causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2150"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Patients-Waiting-Area-Queue-Management-System-checkin-php-XSS.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.344852"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.344852"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.747921"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-02-08T12:15:51Z"
51+
}
52+
}

‎advisories/unreviewed/2026/02/GHSA-9qmm-fmp8-wcfp/GHSA-9qmm-fmp8-wcfp.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9qmm-fmp8-wcfp",
4+
"modified": "2026-02-08T12:30:26Z",
5+
"published": "2026-02-08T12:30:26Z",
6+
"aliases": [
7+
"CVE-2026-2151"
8+
],
9+
"details": "A vulnerability has been found in D-Link DIR-615 4.10. This affects an unknown part of the file adv_firewall.php of the component DMZ Host Feature. Such manipulation of the argument dmz_ipaddr  leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2151"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://pentagonal-time-3a7.notion.site/DIR-615-OS-Command-Injection-2f6e5dd4c5a58053b2b4f166c2a503ba"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.344853"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.344853"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.748031"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.dlink.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-77"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-08T12:15:52Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-9xgc-j99m-jvr5/GHSA-9xgc-j99m-jvr5.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9xgc-j99m-jvr5",
4+
"modified": "2026-02-08T12:30:26Z",
5+
"published": "2026-02-08T12:30:26Z",
6+
"aliases": [
7+
"CVE-2026-2146"
8+
],
9+
"details": "A security flaw has been discovered in guchengwuyue yshopmall up to 1.9.1. This affects the function updateAvatar of the file /api/users/updateAvatar of the component co.yixiang.utils.FileUtil. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2146"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/guchengwuyue/yshopmall/issues/40"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/guchengwuyue/yshopmall/issues/40#issue-3860542812"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/guchengwuyue/yshopmall"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?ctiid.344848"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?id.344848"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.747409"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-284"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-02-08T10:15:49Z"
59+
}
60+
}

‎advisories/unreviewed/2026/02/GHSA-jp5v-2v6v-3w4h/GHSA-jp5v-2v6v-3w4h.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jp5v-2v6v-3w4h",
4+
"modified": "2026-02-08T12:30:26Z",
5+
"published": "2026-02-08T12:30:26Z",
6+
"aliases": [
7+
"CVE-2026-2148"
8+
],
9+
"details": "A security vulnerability has been detected in Tenda AC21 16.03.08.16. Affected is an unknown function of the file /cgi-bin/DownloadFlash of the component Web Management Interface. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2148"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/master-abc/cve/issues/27"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.344850"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.344850"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.747557"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-200"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-08T11:15:51Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-phqp-j38f-cm7h/GHSA-phqp-j38f-cm7h.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-phqp-j38f-cm7h",
4+
"modified": "2026-02-08T12:30:26Z",
5+
"published": "2026-02-08T12:30:26Z",
6+
"aliases": [
7+
"CVE-2026-2149"
8+
],
9+
"details": "A vulnerability was detected in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /appointments.php. The manipulation of the argument patient_id results in cross site scripting. It is possible to launch the attack remotely. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2149"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Patients-Waiting-Area-Queue-Management-System-appointments-XSS.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.344851"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.344851"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.747920"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-02-08T11:15:53Z"
51+
}
52+
}

‎advisories/unreviewed/2026/02/GHSA-qg34-2w8p-vh8q/GHSA-qg34-2w8p-vh8q.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qg34-2w8p-vh8q",
4+
"modified": "2026-02-08T12:30:26Z",
5+
"published": "2026-02-08T12:30:26Z",
6+
"aliases": [
7+
"CVE-2026-2147"
8+
],
9+
"details": "A weakness has been identified in Tenda AC21 16.03.08.16. This impacts an unknown function of the file /cgi-bin/DownloadLog of the component Web Management Interface. Executing a manipulation can lead to information disclosure. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2147"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/master-abc/cve/issues/30"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.344849"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.344849"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.747429"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-200"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-08T10:15:50Z"
55+
}
56+
}

0 commit comments

Comments
 (0)