Skip to content

Commit 874139e

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2hcm-m8v2-w64r GHSA-84rr-pqmh-qg2q GHSA-hhf5-65hr-xrv8 GHSA-hpp2-r5c8-cwwc GHSA-q23r-q5j4-fj7h GHSA-w7r2-997h-qpf4 GHSA-wg5h-wgv3-pgqh
1 parent d53fef6 commit 874139e

File tree

7 files changed

+408
-0
lines changed

7 files changed

+408
-0
lines changed

‎advisories/unreviewed/2026/03/GHSA-2hcm-m8v2-w64r/GHSA-2hcm-m8v2-w64r.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2hcm-m8v2-w64r",
4+
"modified": "2026-03-08T12:30:26Z",
5+
"published": "2026-03-08T12:30:26Z",
6+
"aliases": [
7+
"CVE-2026-3730"
8+
],
9+
"details": "A security flaw has been discovered in itsourcecode Free Hotel Reservation System 1.0. The affected element is an unknown function of the file /hotel/admin/mod_amenities/index.php?view=edit. Performing a manipulation of the argument amen_id/rmtype_id results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3730"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/anon387tdug/anon387/issues/1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/yihaofuweng/cve/issues/62"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://itsourcecode.com"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?ctiid.349708"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?id.349708"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.767010"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/?submit.767385"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-74"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": false,
61+
"github_reviewed_at": null,
62+
"nvd_published_at": "2026-03-08T11:15:50Z"
63+
}
64+
}

‎advisories/unreviewed/2026/03/GHSA-84rr-pqmh-qg2q/GHSA-84rr-pqmh-qg2q.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-84rr-pqmh-qg2q",
4+
"modified": "2026-03-08T12:30:26Z",
5+
"published": "2026-03-08T12:30:26Z",
6+
"aliases": [
7+
"CVE-2026-3728"
8+
],
9+
"details": "A vulnerability was determined in Tenda F453 1.0.0.3/1.If. This issue affects the function fromSetCfm of the file /goform/setcfm. This manipulation of the argument funcname/funcpara1 causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3728"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Litengzheng/vul_db/blob/main/F453/vul_97/README.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.349706"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.349706"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.766933"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-08T10:15:51Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-hhf5-65hr-xrv8/GHSA-hhf5-65hr-xrv8.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hhf5-65hr-xrv8",
4+
"modified": "2026-03-08T12:30:27Z",
5+
"published": "2026-03-08T12:30:27Z",
6+
"aliases": [
7+
"CVE-2026-3732"
8+
],
9+
"details": "A security vulnerability has been detected in Tenda F453 1.0.0.3. This affects the function strcpy of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3732"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Litengzheng/vul_db/blob/main/F453/vul_99/README.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.349710"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.349710"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.767222"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-08T11:15:50Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-hpp2-r5c8-cwwc/GHSA-hpp2-r5c8-cwwc.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hpp2-r5c8-cwwc",
4+
"modified": "2026-03-08T12:30:27Z",
5+
"published": "2026-03-08T12:30:27Z",
6+
"aliases": [
7+
"CVE-2026-3733"
8+
],
9+
"details": "A vulnerability was detected in xuxueli xxl-job up to 3.3.2. This impacts an unknown function of the file source-code/src/main/java/com/xxl/job/admin/controller/JobInfoController.java. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit is now public and may be used. The project maintainer closed the issue report with the following statement: \"Access token security verification is required.\" (translated from Chinese)",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3733"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/xuxueli/xxl-job/issues/3924"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/xuxueli/xxl-job/issues/3924#issue-3987941359"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/xuxueli/xxl-job"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?ctiid.349711"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?id.349711"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.767226"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-918"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-03-08T11:15:50Z"
59+
}
60+
}

‎advisories/unreviewed/2026/03/GHSA-q23r-q5j4-fj7h/GHSA-q23r-q5j4-fj7h.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-q23r-q5j4-fj7h",
4+
"modified": "2026-03-08T12:30:26Z",
5+
"published": "2026-03-08T12:30:26Z",
6+
"aliases": [
7+
"CVE-2026-3727"
8+
],
9+
"details": "A vulnerability was found in Tenda F453 1.0.0.3. This vulnerability affects the function sub_3C6C0 of the file /goform/QuickIndex. The manipulation of the argument mit_linktype/PPPOEPassword results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3727"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Litengzheng/vul_db/blob/main/F453/vul_96/README.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.349705"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.349705"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.766932"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-08T10:15:50Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-w7r2-997h-qpf4/GHSA-w7r2-997h-qpf4.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-w7r2-997h-qpf4",
4+
"modified": "2026-03-08T12:30:26Z",
5+
"published": "2026-03-08T12:30:26Z",
6+
"aliases": [
7+
"CVE-2026-3729"
8+
],
9+
"details": "A vulnerability was identified in Tenda F453 1.0.0.3/3.As. Impacted is the function fromPptpUserAdd of the file /goform/PPTPDClient. Such manipulation of the argument username/opttype leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3729"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Litengzheng/vul_db/blob/main/F453/vul_98/README.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.349707"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.349707"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.766934"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-08T11:15:49Z"
55+
}
56+
}

0 commit comments

Comments
 (0)