Skip to content

Commit af2b059

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2h27-2gxp-mwg2 GHSA-37cp-xxfx-m7pj GHSA-r7cm-3qjx-j8fh GHSA-r9h9-fgfp-v4m4 GHSA-wvj6-8496-wm9r
1 parent ba30c36 commit af2b059

5 files changed

Lines changed: 264 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/03/GHSA-2h27-2gxp-mwg2/GHSA-2h27-2gxp-mwg2.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2h27-2gxp-mwg2",
4+
"modified": "2026-03-09T03:30:20Z",
5+
"published": "2026-03-09T03:30:20Z",
6+
"aliases": [
7+
"CVE-2026-3793"
8+
],
9+
"details": "A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file sales_invoice1.php of the component GET Parameter Handler. This manipulation of the argument sellid causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3793"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/SQLi-SalesInvoice1-sellid.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.349760"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.349760"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.768048"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-09T03:15:49Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-37cp-xxfx-m7pj/GHSA-37cp-xxfx-m7pj.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-37cp-xxfx-m7pj",
4+
"modified": "2026-03-09T03:30:20Z",
5+
"published": "2026-03-09T03:30:20Z",
6+
"aliases": [
7+
"CVE-2026-3791"
8+
],
9+
"details": "A vulnerability has been found in SourceCodester Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file dashboard.php of the component Search. The manipulation of the argument searchtxt leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3791"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/SQLi-Dashboard-searchtxt.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.349758"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.349758"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.768046"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-09T01:15:47Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-r7cm-3qjx-j8fh/GHSA-r7cm-3qjx-j8fh.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r7cm-3qjx-j8fh",
4+
"modified": "2026-03-09T03:30:20Z",
5+
"published": "2026-03-09T03:30:20Z",
6+
"aliases": [
7+
"CVE-2026-3792"
8+
],
9+
"details": "A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown part of the file purchase_invoice.php of the component GET Parameter Handler. The manipulation of the argument purchaseid results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3792"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/SQLi-PurchaseInvoice-purchaseid.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.349759"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.349759"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.768047"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-09T02:15:47Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-r9h9-fgfp-v4m4/GHSA-r9h9-fgfp-v4m4.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r9h9-fgfp-v4m4",
4+
"modified": "2026-03-09T03:30:20Z",
5+
"published": "2026-03-09T03:30:20Z",
6+
"aliases": [
7+
"CVE-2026-3795"
8+
],
9+
"details": "A security flaw has been discovered in doramart DoraCMS 3.0.x. Impacted is the function createFileBypath of the file /DoraCMS/server/app/router/api/v1.js. Performing a manipulation results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3795"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.349762"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.349762"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.768241"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-22"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-03-09T03:15:49Z"
47+
}
48+
}

‎advisories/unreviewed/2026/03/GHSA-wvj6-8496-wm9r/GHSA-wvj6-8496-wm9r.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wvj6-8496-wm9r",
4+
"modified": "2026-03-09T03:30:20Z",
5+
"published": "2026-03-09T03:30:20Z",
6+
"aliases": [
7+
"CVE-2026-3794"
8+
],
9+
"details": "A vulnerability was identified in doramart DoraCMS 3.0.x. This issue affects some unknown processing of the file /api/v1/mail/send of the component Email API. Such manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3794"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.349761"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.349761"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.768239"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-287"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-03-09T03:15:49Z"
47+
}
48+
}

0 commit comments

Comments
 (0)