Skip to content

Commit b45c372

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-264f-3frq-cpxq GHSA-2x9h-r46q-gf7w GHSA-58qr-v987-vh6w GHSA-6m8q-32w5-c768 GHSA-8hrp-4v5x-m9q3 GHSA-9f9p-gp89-cxxh GHSA-w43v-pfh7-6jqq GHSA-x6h5-48q8-5528
1 parent 2fd8ec6 commit b45c372

8 files changed

Lines changed: 395 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/03/GHSA-264f-3frq-cpxq/GHSA-264f-3frq-cpxq.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-264f-3frq-cpxq",
4+
"modified": "2026-03-26T03:30:28Z",
5+
"published": "2026-03-26T03:30:28Z",
6+
"aliases": [
7+
"CVE-2026-4830"
8+
],
9+
"details": "A vulnerability was identified in kalcaddle kodbox 1.64. This issue affects the function Add of the file app/controller/explorer/userShare.class.php of the component Public Share Handler. Such manipulation leads to unrestricted upload. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4830"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.353127"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.353127"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.775479"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vulnplus-note.wetolink.com/share/7oB22Zhc6u5X"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-284"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-26T01:16:28Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-2x9h-r46q-gf7w/GHSA-2x9h-r46q-gf7w.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2x9h-r46q-gf7w",
4+
"modified": "2026-03-26T03:30:28Z",
5+
"published": "2026-03-26T03:30:28Z",
6+
"aliases": [
7+
"CVE-2026-4836"
8+
],
9+
"details": "A vulnerability was detected in code-projects Accounting System 1.0. The affected element is an unknown function of the file /my_account/delete.php. Performing a manipulation of the argument cos_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4836"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://code-projects.org"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Time-Based%20Blind%20SQL%20Injection%20Accounting%20System%20in%20PHP%20in%20cos_id%20Parameter.md"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.353140"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.353140"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.775867"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-26T03:16:04Z"
55+
}
56+
}

‎advisories/unreviewed/2026/03/GHSA-58qr-v987-vh6w/GHSA-58qr-v987-vh6w.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-58qr-v987-vh6w",
4+
"modified": "2026-03-26T03:30:28Z",
5+
"published": "2026-03-26T03:30:28Z",
6+
"aliases": [
7+
"CVE-2014-125112"
8+
],
9+
"details": "Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution.\n\nPlack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no secret used to sign the cookie.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-125112"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://gist.github.com/miyagawa/2b8764af908a0dacd43d"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.23-TRIAL/changes"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-565"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-03-26T03:16:00Z"
34+
}
35+
}

‎advisories/unreviewed/2026/03/GHSA-6m8q-32w5-c768/GHSA-6m8q-32w5-c768.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6m8q-32w5-c768",
4+
"modified": "2026-03-26T03:30:28Z",
5+
"published": "2026-03-26T03:30:28Z",
6+
"aliases": [
7+
"CVE-2026-4484"
8+
],
9+
"details": "The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. This is due to the plugin allowing a user to update the user role through the 'InstructorsController::prepare_object_for_database' function. This makes it possible for authenticated attackers, with Student-level access and above, to elevate their privileges to that of an administrator.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4484"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.6/includes/RestApi/Controllers/Version1/InstructorsController.php#L305"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/changeset/3490792/learning-management-system/trunk/includes/RestApi/Controllers/Version1/InstructorsController.php"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/265be0af-66a4-4636-ab81-f8e2c5a1282e?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-862"
38+
],
39+
"severity": "CRITICAL",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-03-26T02:16:07Z"
43+
}
44+
}

‎advisories/unreviewed/2026/03/GHSA-8hrp-4v5x-m9q3/GHSA-8hrp-4v5x-m9q3.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8hrp-4v5x-m9q3",
4+
"modified": "2026-03-26T03:30:28Z",
5+
"published": "2026-03-26T03:30:28Z",
6+
"aliases": [
7+
"CVE-2026-4831"
8+
],
9+
"details": "A security flaw has been discovered in kalcaddle kodbox 1.64. Impacted is the function can of the file /workspace/source-code/app/controller/explorer/auth.class.php of the component Password-protected Share Handler. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4831"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.353128"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.353128"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.775502"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vulnplus-note.wetolink.com/share/xdk9igJ3sulk"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-287"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-03-26T02:16:08Z"
51+
}
52+
}

‎advisories/unreviewed/2026/03/GHSA-9f9p-gp89-cxxh/GHSA-9f9p-gp89-cxxh.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9f9p-gp89-cxxh",
4+
"modified": "2026-03-26T03:30:28Z",
5+
"published": "2026-03-26T03:30:28Z",
6+
"aliases": [
7+
"CVE-2026-4833"
8+
],
9+
"details": "A weakness has been identified in Orc discount up to 3.0.1.2. This issue affects the function compile of the file markdown.c of the component Markdown Handler. This manipulation causes uncontrolled recursion. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project maintainer confirms: \"[I]f you feed it an infinitely deep blockquote input it will crash. (...) [T]his is a duplicate of an old bug that I've been working on.\"",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4833"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Orc/discount/issues/305"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/Orc/discount/issues/305#issuecomment-4027546673"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/Orc/discount"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/user-attachments/files/25847391/crash00.md"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?ctiid.353138"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?id.353138"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/?submit.775841"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-404"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": false,
61+
"github_reviewed_at": null,
62+
"nvd_published_at": "2026-03-26T02:16:08Z"
63+
}
64+
}

‎advisories/unreviewed/2026/03/GHSA-w43v-pfh7-6jqq/GHSA-w43v-pfh7-6jqq.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-w43v-pfh7-6jqq",
4+
"modified": "2026-03-26T03:30:28Z",
5+
"published": "2026-03-26T03:30:28Z",
6+
"aliases": [
7+
"CVE-2026-4835"
8+
],
9+
"details": "A security vulnerability has been detected in code-projects Accounting System 1.0. Impacted is an unknown function of the file /my_account/add_costumer.php of the component Web Application Interface. Such manipulation of the argument costumer_name leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4835"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://code-projects.org"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Accounting%20System%20in%20PHP%201.0%20-%20Stored%20Cross-Site%20Scripting%20(XSS)%20in%20costumer_name%20Parameter.md"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.353139"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.353139"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.775859"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-79"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-03-26T03:16:04Z"
55+
}
56+
}

0 commit comments

Comments
 (0)