Skip to content

Commit ed16481

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2g8j-hf3c-6cc2 GHSA-42v3-8vjx-xjp9 GHSA-55fx-hxx2-342g GHSA-6jvr-846q-v6m3 GHSA-6p5q-jjvw-vg9p GHSA-6rfh-4m76-4764 GHSA-ccfc-w7hx-qcqw GHSA-gmhr-3cxv-5pw9 GHSA-gr63-2w3v-w2gp GHSA-j34r-x4fp-8j3c GHSA-p6qv-grc7-2v6h GHSA-pf42-2vwp-g7x9 GHSA-w77x-v6v5-9x28 GHSA-xhhj-c5c5-55qx GHSA-xj4j-qqwc-95gc
1 parent 8e99717 commit ed16481

File tree

15 files changed

+743
-1
lines changed

15 files changed

+743
-1
lines changed

‎advisories/unreviewed/2026/03/GHSA-2g8j-hf3c-6cc2/GHSA-2g8j-hf3c-6cc2.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2g8j-hf3c-6cc2",
4+
"modified": "2026-03-12T06:31:37Z",
5+
"published": "2026-03-12T06:31:37Z",
6+
"aliases": [
7+
"CVE-2026-3982"
8+
],
9+
"details": "A vulnerability was determined in itsourcecode University Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_result.php. Executing a manipulation of the argument vr can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3982"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/PIPIzzz1/aaa/issues/1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.350417"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.350417"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.769668"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-79"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-12T05:16:14Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-42v3-8vjx-xjp9/GHSA-42v3-8vjx-xjp9.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-42v3-8vjx-xjp9",
4+
"modified": "2026-03-12T06:31:37Z",
5+
"published": "2026-03-12T06:31:37Z",
6+
"aliases": [
7+
"CVE-2026-3993"
8+
],
9+
"details": "A security vulnerability has been detected in itsourcecode Payroll Management System 1.0. This vulnerability affects unknown code of the file /manage_employee_deductions.php. Such manipulation of the argument ID leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3993"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/ltranquility/cve_submit/issues/11"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.350475"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.350475"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.769749"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-79"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-12T06:16:31Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-55fx-hxx2-342g/GHSA-55fx-hxx2-342g.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-55fx-hxx2-342g",
4+
"modified": "2026-03-12T06:31:37Z",
5+
"published": "2026-03-12T06:31:37Z",
6+
"aliases": [
7+
"CVE-2025-15473"
8+
],
9+
"details": "The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated users to arbitrarily change a booking's payment status and post status for the \"timetics-booking\" custom post type.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15473"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/f355e4ac-7aa6-4c5b-b1e5-b37937156583"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2026-03-12T06:16:30Z"
28+
}
29+
}

‎advisories/unreviewed/2026/03/GHSA-6jvr-846q-v6m3/GHSA-6jvr-846q-v6m3.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6jvr-846q-v6m3",
4+
"modified": "2026-03-12T06:31:37Z",
5+
"published": "2026-03-12T06:31:37Z",
6+
"aliases": [
7+
"CVE-2026-2687"
8+
],
9+
"details": "The Reading progressbar WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2687"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/af2e1249-2b69-47b6-85aa-9a6b30c51936"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2026-03-12T06:16:30Z"
28+
}
29+
}

‎advisories/unreviewed/2026/03/GHSA-6p5q-jjvw-vg9p/GHSA-6p5q-jjvw-vg9p.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6p5q-jjvw-vg9p",
4+
"modified": "2026-03-12T06:31:36Z",
5+
"published": "2026-03-12T06:31:36Z",
6+
"aliases": [
7+
"CVE-2026-3977"
8+
],
9+
"details": "A security vulnerability has been detected in projectsend up to r1945. The affected element is an unknown function of the component AJAX Endpoints. The manipulation leads to missing authorization. The attack can be initiated remotely. The identifier of the patch is 35dfd6f08f7d517709c77ee73e57367141107e6b. To fix this issue, it is recommended to deploy a patch.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3977"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/projectsend/projectsend/issues/1525"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/projectsend/projectsend/issues/1525#issuecomment-3957109914"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/projectsend/projectsend/commit/35dfd6f08f7d517709c77ee73e57367141107e6b"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/projectsend/projectsend"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?ctiid.350412"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?id.350412"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-862"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-03-12T04:16:39Z"
59+
}
60+
}

‎advisories/unreviewed/2026/03/GHSA-6rfh-4m76-4764/GHSA-6rfh-4m76-4764.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-6rfh-4m76-4764",
4-
"modified": "2026-03-12T03:31:06Z",
4+
"modified": "2026-03-12T06:31:36Z",
55
"published": "2026-03-12T03:31:06Z",
66
"aliases": [
77
"CVE-2025-15038"

‎advisories/unreviewed/2026/03/GHSA-ccfc-w7hx-qcqw/GHSA-ccfc-w7hx-qcqw.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-ccfc-w7hx-qcqw",
4+
"modified": "2026-03-12T06:31:36Z",
5+
"published": "2026-03-12T06:31:36Z",
6+
"aliases": [
7+
"CVE-2026-3978"
8+
],
9+
"details": "A vulnerability was detected in D-Link DIR-513 1.10. The impacted element is an unknown function of the file /goform/formEasySetupWizard3. The manipulation of the argument wan_connected results in stack-based buffer overflow. The attack can be launched remotely. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3978"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Litengzheng/vul_db/blob/main/Dir513/vul_21/README.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.350413"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.350413"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.769586"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.dlink.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-12T04:16:40Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-gmhr-3cxv-5pw9/GHSA-gmhr-3cxv-5pw9.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gmhr-3cxv-5pw9",
4+
"modified": "2026-03-12T06:31:37Z",
5+
"published": "2026-03-12T06:31:37Z",
6+
"aliases": [
7+
"CVE-2026-3983"
8+
],
9+
"details": "A security flaw has been discovered in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1. This affects an unknown part of the file save-games.php. The manipulation of the argument game_name results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3983"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/LaneyYu/cve/issues/10"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.350419"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.350419"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.769720"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.campcodes.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-79"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-12T06:16:30Z"
55+
}
56+
}

0 commit comments

Comments
 (0)