admin/nvd-json-data-feeds
1
0
Fork 0
mirror of https://github.com/fkie-cad/nvd-json-data-feeds.git synced 2025-07-09 16:05:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auto-Update: 2025-03-22T07:00:20.050144+00:00

Browse Source
This commit is contained in:
cad-safe-bot 2025-03-22 07:03:50 +00:00
parent 6abcf00708
commit 459053dff9
6 changed files with 261 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
CVE-2024/CVE-2024-137xx/CVE-2024-13739.json Normal file
View File

@ -0,0 +1,60 @@
{
"id": "CVE-2024-13739",
"sourceIdentifier": "security@wordfence.com",
"published": "2025-03-22T05:15:36.887",
"lastModified": "2025-03-22T05:15:36.887",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Newsletters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \"to\" parameter in all versions up to, and including, 4.9.9.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an admin user into performing an action such as clicking on a link."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7
}
]
},
"weaknesses": [
{
"source": "security@wordfence.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.9.9.7/views/admin/history/view.php#L48",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2578a863-4129-4f56-8b18-65b2d2b972e3?source=cve",
"source": "security@wordfence.com"
}
]
}

64
CVE-2025/CVE-2025-07xx/CVE-2025-0723.json Normal file
View File

@ -0,0 +1,64 @@
{
"id": "CVE-2025-0723",
"sourceIdentifier": "security@wordfence.com",
"published": "2025-03-22T05:15:38.053",
"lastModified": "2025-03-22T05:15:38.053",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The ProfileGrid \u2013 User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind and time-based SQL Injections via the rid and search parameters in all versions up to, and including, 5.9.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "security@wordfence.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"references": [
{
"url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.4.2/includes/class-profile-magic-chat-system.php#L39",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.4.2/includes/class-profile-magic-request.php#L2379",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/140fa6e8-4381-4df2-af62-44d40b116daf?source=cve",
"source": "security@wordfence.com"
}
]
}

60
CVE-2025/CVE-2025-07xx/CVE-2025-0724.json Normal file
View File

@ -0,0 +1,60 @@
{
"id": "CVE-2025-0724",
"sourceIdentifier": "security@wordfence.com",
"published": "2025-03-22T05:15:38.200",
"lastModified": "2025-03-22T05:15:38.200",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The ProfileGrid \u2013 User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.4.5 via deserialization of untrusted input in the get_user_meta_fields_html function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "security@wordfence.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-502"
}
]
}
],
"references": [
{
"url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.4.2/includes/class-profile-magic-html-generator.php#L259",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6bb1de69-7bc2-4785-9789-0a2d1cf35b9b?source=cve",
"source": "security@wordfence.com"
}
]
}

64
CVE-2025/CVE-2025-14xx/CVE-2025-1408.json Normal file
View File

@ -0,0 +1,64 @@
{
"id": "CVE-2025-1408",
"sourceIdentifier": "security@wordfence.com",
"published": "2025-03-22T05:15:38.353",
"lastModified": "2025-03-22T05:15:38.353",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The ProfileGrid \u2013 User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_decline_join_group_request and pm_approve_join_group_request functions in all versions up to, and including, 5.9.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to approve or decline join group requests which is normally should be available to administrators only."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "security@wordfence.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"references": [
{
"url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.4.3/public/class-profile-magic-public.php#L3262",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.4.3/public/class-profile-magic-public.php#L3306",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/641f7727-83ba-45c2-b3e1-1ce19f86eac7?source=cve",
"source": "security@wordfence.com"
}
]
}

13
README.md
View File

@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2025-03-22T05:00:15.916440+00:00
2025-03-22T07:00:20.050144+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2025-03-22T03:15:11.817000+00:00
2025-03-22T05:15:38.353000+00:00
```
### Last Data Feed Release
@ -33,14 +33,17 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
286191
286195
```
### CVEs added in the last Commit
Recently added CVEs: `1`
Recently added CVEs: `4`
- [CVE-2024-13737](CVE-2024/CVE-2024-137xx/CVE-2024-13737.json) (`2025-03-22T03:15:11.817`)
- [CVE-2024-13739](CVE-2024/CVE-2024-137xx/CVE-2024-13739.json) (`2025-03-22T05:15:36.887`)
- [CVE-2025-0723](CVE-2025/CVE-2025-07xx/CVE-2025-0723.json) (`2025-03-22T05:15:38.053`)
- [CVE-2025-0724](CVE-2025/CVE-2025-07xx/CVE-2025-0724.json) (`2025-03-22T05:15:38.200`)
- [CVE-2025-1408](CVE-2025/CVE-2025-14xx/CVE-2025-1408.json) (`2025-03-22T05:15:38.353`)
### CVEs modified in the last Commit

6
_state.csv
View File

@ -248007,7 +248007,8 @@ CVE-2024-13733,0,0,4ca526af1929c133c0fe46b638ac9c59d6820bc471060a7321cdbca576df0
CVE-2024-13734,0,0,fb13d30c5d3b7eac80b2a64e86d45d007134e68bd4fdca6d18f22cd1479a839b,2025-03-11T15:55:48.603000
CVE-2024-13735,0,0,3547c31c6d72f19019bc47ce66440b94aad2dbe68a07077b91d9f59acae687cd,2025-02-25T03:45:15.060000
CVE-2024-13736,0,0,3362a69c50f09f93ac1b8892771db3d9d5410b27ce15edc8013225c7425828fe,2025-03-06T15:08:38
CVE-2024-13737,1,1,91ea646ae02a7e4936ac7cfebde601dcc3026e4694e4b1129db4d267dc39e06b,2025-03-22T03:15:11.817000
CVE-2024-13737,0,0,91ea646ae02a7e4936ac7cfebde601dcc3026e4694e4b1129db4d267dc39e06b,2025-03-22T03:15:11.817000
CVE-2024-13739,1,1,76ff1f3e1c0e52d39fa29b75715451459384d326f7e683281cdf410703834c75,2025-03-22T05:15:36.887000
CVE-2024-1374,0,0,8b967aad89e76e7b7285732fb028781ee942f5f6a3c1468dd34bb1833f269dd3,2024-11-21T08:50:26.443000
CVE-2024-13740,0,0,7ff99f97d425424bdc9a3d1a435df988f74877e53c6e3d16169a71dec8c37f3b,2025-02-24T12:41:27.353000
CVE-2024-13741,0,0,78f05de9655a03d53c2e8400793bb4a26c0069c47279ba1e219e404df9296757,2025-02-24T12:40:05.483000
@ -281251,6 +281252,8 @@ CVE-2025-0719,0,0,44927ec8b6afaf34270843fd13dbd3ba0f3f99ce1ef23ab7a0954a7b4854cf
CVE-2025-0720,0,0,bf163c74b4e9e0ae1d92684788b595f2199f607068d51d6135d379966c283462,2025-01-26T23:15:21.547000
CVE-2025-0721,0,0,a17c1b763dfbd45aa4203f0e8b4c3b1bd0f0a61d080bea2c50ad8ff161e60eaa,2025-02-25T20:28:55.787000
CVE-2025-0722,0,0,c9c24be950ff93b5151cdab68af4eb0f25cca0b4d685aeadd762fbc951dbdf6d,2025-02-25T20:12:27.810000
CVE-2025-0723,1,1,9d3b8e55e6fd2299554e6b6f08258bdfcf6dc4a86ebf2d9bc78102c83c836007,2025-03-22T05:15:38.053000
CVE-2025-0724,1,1,f7c9b7519f945c1b287a0f6dc110cbed9800ccfad8c0eced192d7eceb99b15d5,2025-03-22T05:15:38.200000
CVE-2025-0725,0,0,ef1920cda444939d67fecb4a1c9b571c4d38e3bc4bcb5bd151f156910c1fc4af,2025-03-07T01:15:12.403000
CVE-2025-0726,0,0,739ea1d1541d6b26153a964e4e4136a3057eaa8274a2f66ba7a27171ffa2b087,2025-02-21T08:15:28.417000
CVE-2025-0727,0,0,89665f1801b7a5f4bd56958ba24239f6773c6fef24507ea8f637acdf839ad9ca,2025-02-21T09:15:09.010000
@ -281702,6 +281705,7 @@ CVE-2025-1404,0,0,f39be30144b0a5fe80b4b94433169bbe79b568debe0e45a11fa0a8302ed0e6
CVE-2025-1405,0,0,ca338b60d57145f57b8776eb235933a7d68d0a6a1ad4c6b54938a69de448f221,2025-03-06T17:57:54.597000
CVE-2025-1406,0,0,6fbc92715581c083383884df65716e311e7920e9986e87816bf21c4af15408ec,2025-02-25T03:38:24.303000
CVE-2025-1407,0,0,81ebc501504f4e0e97111e960151a7a649f1ecbd9d904ea14ecfe9745b475037,2025-02-25T03:37:32.347000
CVE-2025-1408,1,1,0a01b5e9486d3003cf6a37adb1cb318494940890109f9521eca9987d98d841a3,2025-03-22T05:15:38.353000
CVE-2025-1410,0,0,1acd34ee1bf4de50c7bb7990bb2833820ce8a935ac6fe3383da13c0fe4fe3da0,2025-02-25T03:35:42.633000
CVE-2025-1412,0,0,15006068dde5667dc534d1c6a1b910fc18a441695fc7fe8438811af885c4587d,2025-02-24T08:15:09.890000
CVE-2025-1413,0,0,66d6334b5b3ce2a5ffd2689297e5c1bb234e6299d8a70ce39e1288c295632ed0,2025-02-28T09:15:11.850000

Can't render this file because it is too large.