Skip to content

Commit 5b87d8c

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 8c74a09 commit 5b87d8c

File tree

26 files changed

+1033
-1
lines changed

26 files changed

+1033
-1
lines changed

‎advisories/unreviewed/2025/10/GHSA-9w5h-px4f-8h8m/GHSA-9w5h-px4f-8h8m.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9w5h-px4f-8h8m",
4-
"modified": "2025-10-22T18:30:33Z",
4+
"modified": "2026-04-01T03:31:40Z",
55
"published": "2025-10-09T21:31:11Z",
66
"aliases": [
77
"CVE-2025-4615"

‎advisories/unreviewed/2026/04/GHSA-2ch2-j7qp-pqm3/GHSA-2ch2-j7qp-pqm3.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2ch2-j7qp-pqm3",
4+
"modified": "2026-04-01T03:31:40Z",
5+
"published": "2026-04-01T03:31:40Z",
6+
"aliases": [
7+
"CVE-2026-35054"
8+
],
9+
"details": "XenForo before 2.3.9 is vulnerable to stored cross-site scripting (XSS) related to BB code rendering. An attacker can inject malicious scripts through BB code that are stored and executed when other users view the content.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35054"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.vulncheck.com/advisories/xenforo-stored-cross-site-scripting-via-bb-code-rendering"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://xenforo.com/community/threads/xenforo-2-3-9-inc-xfmg-2-2-18-released-security-fix.235659"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-04-01T01:16:41Z"
43+
}
44+
}

‎advisories/unreviewed/2026/04/GHSA-499p-g3jm-62mp/GHSA-499p-g3jm-62mp.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-499p-g3jm-62mp",
4+
"modified": "2026-04-01T03:31:40Z",
5+
"published": "2026-04-01T03:31:40Z",
6+
"aliases": [
7+
"CVE-2025-71278"
8+
],
9+
"details": "XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo 2.3 prior to 2.3.5, potentially allowing client applications to gain access beyond their intended authorization level.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71278"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.vulncheck.com/advisories/xenforo-oauth2-unauthorized-scope-request"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://xenforo.com/community/threads/xenforo-2-3-5-includes-security-fix-add-ons-released.228812"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-863"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-04-01T01:16:40Z"
43+
}
44+
}

‎advisories/unreviewed/2026/04/GHSA-4q9h-crq4-9xjq/GHSA-4q9h-crq4-9xjq.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4q9h-crq4-9xjq",
4+
"modified": "2026-04-01T03:31:40Z",
5+
"published": "2026-04-01T03:31:40Z",
6+
"aliases": [
7+
"CVE-2026-5248"
8+
],
9+
"details": "A vulnerability has been found in gougucms 4.08.18. This affects the function reg_submit of the file gougucms-master\\app\\home\\controller\\Login.php of the component User Registration Handler. Such manipulation of the argument level leads to dynamically-determined object attributes. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5248"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://thinhneee.github.io/posts/gougu-mass-assign"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/submit/780589"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/354429"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/354429/cti"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-913"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-04-01T01:16:41Z"
51+
}
52+
}

‎advisories/unreviewed/2026/04/GHSA-56gw-v5vp-rmjp/GHSA-56gw-v5vp-rmjp.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-56gw-v5vp-rmjp",
4+
"modified": "2026-04-01T03:31:40Z",
5+
"published": "2026-04-01T03:31:40Z",
6+
"aliases": [
7+
"CVE-2026-5249"
8+
],
9+
"details": "A vulnerability was found in gougucms 4.08.18. This impacts an unknown function of the file \\gougucms-master\\app\\admin\\view\\user\\record.html of the component Record Endpoint. Performing a manipulation of the argument value.content results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5249"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://thinhneee.github.io/posts/gougu-blind-xss"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/submit/780716"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/vuln/354430"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/354430/cti"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-04-01T02:16:03Z"
51+
}
52+
}

‎advisories/unreviewed/2026/04/GHSA-6xgc-8m9r-qvgm/GHSA-6xgc-8m9r-qvgm.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6xgc-8m9r-qvgm",
4+
"modified": "2026-04-01T03:31:40Z",
5+
"published": "2026-04-01T03:31:40Z",
6+
"aliases": [
7+
"CVE-2026-3777"
8+
],
9+
"details": "The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state. When a script modifies the zoom property and then triggers a page change, the original view object may be destroyed while stale pointers are still kept and later dereferenced, which under crafted JavaScript and document structures can lead to a use-after-free condition and potentially allow arbitrary code execution.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3777"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.foxit.com/support/security-bulletins.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-416"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-01T02:16:02Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-7285-3w46-g6m6/GHSA-7285-3w46-g6m6.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7285-3w46-g6m6",
4+
"modified": "2026-04-01T03:31:40Z",
5+
"published": "2026-04-01T03:31:40Z",
6+
"aliases": [
7+
"CVE-2026-35055"
8+
],
9+
"details": "XenForo before 2.3.9 and before 2.2.18 is vulnerable to cross-site scripting (XSS) related to lightbox usage in posts. An attacker can inject malicious scripts that execute when users interact with post content displayed in the lightbox.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35055"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.vulncheck.com/advisories/xenforo-cross-site-scripting-via-lightbox-in-posts"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://xenforo.com/community/threads/xenforo-2-3-9-inc-xfmg-2-2-18-released-security-fix.235659"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-04-01T01:16:41Z"
43+
}
44+
}

‎advisories/unreviewed/2026/04/GHSA-8fvj-rw6m-xrph/GHSA-8fvj-rw6m-xrph.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8fvj-rw6m-xrph",
4+
"modified": "2026-04-01T03:31:40Z",
5+
"published": "2026-04-01T03:31:40Z",
6+
"aliases": [
7+
"CVE-2025-71282"
8+
],
9+
"details": "XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker to obtain information about the server's directory structure.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71282"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.vulncheck.com/advisories/xenforo-path-disclosure-via-open-basedir-exceptions"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://xenforo.com/community/threads/xenforo-2-3-7-released-includes-security-fixes.232121"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-209"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-04-01T01:16:40Z"
43+
}
44+
}

‎advisories/unreviewed/2026/04/GHSA-f5w8-q66w-xp9m/GHSA-f5w8-q66w-xp9m.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f5w8-q66w-xp9m",
4+
"modified": "2026-04-01T03:31:40Z",
5+
"published": "2026-04-01T03:31:40Z",
6+
"aliases": [
7+
"CVE-2026-4374"
8+
],
9+
"details": "Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Routing Service,Observability Collector,Recording Service,Queueing Service,Cloud Discovery Service) allows Serialized Data External Linking, Data Serializat...",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4374"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.rti.com/vulnerabilities/#cve-2026-4374"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-611"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-01T02:16:03Z"
35+
}
36+
}

0 commit comments

Comments
 (0)