Skip to content

Commit c0da40a

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 7b171aa commit c0da40a

File tree

36 files changed

+1552
-0
lines changed

36 files changed

+1552
-0
lines changed

‎advisories/unreviewed/2026/02/GHSA-2h8m-3jwj-j68m/GHSA-2h8m-3jwj-j68m.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2h8m-3jwj-j68m",
4+
"modified": "2026-02-21T00:31:43Z",
5+
"published": "2026-02-21T00:31:43Z",
6+
"aliases": [
7+
"CVE-2019-25454"
8+
],
9+
"details": "phpMoAdmin 1.1.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the collection parameter. Attackers can send GET requests to moadmin.php with script payloads in the collection parameter during collection creation to execute arbitrary JavaScript in users' browsers.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25454"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.exploit-db.com/exploits/46082"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/phpmoadmin-stored-cross-site-scripting-via-collection-parameter"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "http://www.phpmoadmin.com"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-79"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-02-20T23:16:02Z"
47+
}
48+
}

‎advisories/unreviewed/2026/02/GHSA-2wwg-wcjv-q464/GHSA-2wwg-wcjv-q464.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2wwg-wcjv-q464",
4+
"modified": "2026-02-21T00:31:42Z",
5+
"published": "2026-02-21T00:31:42Z",
6+
"aliases": [
7+
"CVE-2019-25432"
8+
],
9+
"details": "Part-DB 0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to login by injecting SQL syntax into authentication parameters. Attackers can submit a single quote followed by 'or' in the login form to bypass credential validation and gain unauthorized access to the application.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25432"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Part-DB/Part-DB"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.exploit-db.com/exploits/47547"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/part-db-authentication-bypass-via-loginphp"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-89"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-02-20T23:15:59Z"
47+
}
48+
}

‎advisories/unreviewed/2026/02/GHSA-4cqv-6xj6-7w79/GHSA-4cqv-6xj6-7w79.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4cqv-6xj6-7w79",
4+
"modified": "2026-02-21T00:31:43Z",
5+
"published": "2026-02-21T00:31:43Z",
6+
"aliases": [
7+
"CVE-2026-2034"
8+
],
9+
"details": "Sante DICOM Viewer Pro DCM File Parsing Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28129.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2034"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-104"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-120"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-02-20T23:16:03Z"
35+
}
36+
}

‎advisories/unreviewed/2026/02/GHSA-4jqp-h8f8-5fh9/GHSA-4jqp-h8f8-5fh9.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4jqp-h8f8-5fh9",
4+
"modified": "2026-02-21T00:31:43Z",
5+
"published": "2026-02-21T00:31:43Z",
6+
"aliases": [
7+
"CVE-2026-2490"
8+
],
9+
"details": "RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of RustDesk Client for Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the Transfer File feature. By uploading a symbolic link, an attacker can abuse the service to read arbitrary files. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-27909.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2490"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/rustdesk/rustdesk/pull/13736"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-117"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-59"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-02-20T23:16:05Z"
39+
}
40+
}

‎advisories/unreviewed/2026/02/GHSA-59vc-4mm8-j289/GHSA-59vc-4mm8-j289.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-59vc-4mm8-j289",
4+
"modified": "2026-02-21T00:31:42Z",
5+
"published": "2026-02-21T00:31:42Z",
6+
"aliases": [
7+
"CVE-2018-25158"
8+
],
9+
"details": "Chamilo LMS 1.11.8 contains an arbitrary file upload vulnerability that allows authenticated users to upload and execute PHP files through the elfinder filemanager module. Attackers can upload files with image headers in the social myfiles section, rename them to PHP extensions, and execute arbitrary code by accessing the uploaded files.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25158"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/chamilo/chamilo-lms"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.exploit-db.com/exploits/47423"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/chamilo-lms-arbitrary-file-upload-via-elfinder"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-434"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-02-20T23:15:59Z"
47+
}
48+
}

‎advisories/unreviewed/2026/02/GHSA-65c4-vf29-7265/GHSA-65c4-vf29-7265.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-65c4-vf29-7265",
4+
"modified": "2026-02-21T00:31:43Z",
5+
"published": "2026-02-21T00:31:42Z",
6+
"aliases": [
7+
"CVE-2019-25447"
8+
],
9+
"details": "OrientDB 3.0.17 GA Community Edition contains cross-site request forgery vulnerabilities that allow attackers to perform unauthorized actions by crafting malicious requests to endpoints like /database/, /command/, and /document/. Attackers can create or delete databases, modify schema classes, manage users, and create functions by sending authenticated requests without token validation, combined with reflected and stored cross-site scripting vulnerabilities in the web interface.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25447"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://orientdb.dev"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.exploit-db.com/exploits/46517"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/orientdb-cross-site-request-forgery"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-352"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-02-20T23:16:01Z"
47+
}
48+
}

‎advisories/unreviewed/2026/02/GHSA-6q4c-4x29-76qv/GHSA-6q4c-4x29-76qv.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6q4c-4x29-76qv",
4+
"modified": "2026-02-21T00:31:43Z",
5+
"published": "2026-02-21T00:31:43Z",
6+
"aliases": [
7+
"CVE-2026-2035"
8+
],
9+
"details": "Deciso OPNsense diag_backup.php filename Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Deciso OPNsense. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of backup configuration files. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28131.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2035"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/opnsense/core/commit/cb15c935137d05c86a1e6cf12af877e9c32a23af"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-078"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-78"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-02-20T23:16:03Z"
39+
}
40+
}

‎advisories/unreviewed/2026/02/GHSA-7c63-32m9-7mfg/GHSA-7c63-32m9-7mfg.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7c63-32m9-7mfg",
4+
"modified": "2026-02-21T00:31:42Z",
5+
"published": "2026-02-21T00:31:42Z",
6+
"aliases": [
7+
"CVE-2026-0797"
8+
],
9+
"details": "GIMP ICO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of ICO files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28599.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0797"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://gitlab.gnome.org/GNOME/gimp/-/commit/69cc6b1a6645dc9c4d7b484483dbe6a84b922b9c"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-050"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-122"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-02-20T22:16:19Z"
39+
}
40+
}

0 commit comments

Comments
 (0)