Auto-Update: 2025-11-13T15:00:11.548300+00:00

This commit is contained in:
cad-safe-bot committed 2025-11-13 15:03:59 +00:00
1 parent 86c88995fd
commit 8fca574d60
24 files changed
+1509 -576

No files matched your search

+2 -2
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-23454",
"sourceIdentifier": "[email protected]",
"published": "2024-09-25T08:15:04.317",
"lastModified": "2025-09-05T09:15:31.053",
"vulnStatus": "Undergoing Analysis",
"lastModified": "2025-11-13T14:14:48.893",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
+2 -2
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-37005",
"sourceIdentifier": "[email protected]",
"published": "2024-06-25T04:15:15.890",
"lastModified": "2025-08-27T22:15:38.957",
"vulnStatus": "Undergoing Analysis",
"lastModified": "2025-11-13T14:46:31.297",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
+22 -2
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-45965",
"sourceIdentifier": "[email protected]",
"published": "2024-10-02T20:15:11.320",
"lastModified": "2025-08-27T22:15:45.610",
"vulnStatus": "Undergoing Analysis",
"lastModified": "2025-11-13T14:50:19.490",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -36,6 +36,26 @@
},
"exploitabilityScore": 3.1,
"impactScore": 2.7
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7
}
]
},
+2 -2
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-48889",
"sourceIdentifier": "[email protected]",
"published": "2024-12-18T13:15:06.463",
"lastModified": "2025-08-27T22:15:46.057",
"vulnStatus": "Undergoing Analysis",
"lastModified": "2025-11-13T14:56:42.523",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
+2 -2
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-52322",
"sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"published": "2025-04-05T17:15:39.513",
"lastModified": "2025-09-05T14:15:40.603",
"vulnStatus": "Undergoing Analysis",
"lastModified": "2025-11-13T14:34:51.550",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
+2 -2
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-57868",
"sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"published": "2025-04-05T16:15:33.180",
"lastModified": "2025-09-05T14:15:41.480",
"vulnStatus": "Undergoing Analysis",
"lastModified": "2025-11-13T14:38:28.427",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
+2 -2
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-7697",
"sourceIdentifier": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea",
"published": "2024-08-12T13:38:58.913",
"lastModified": "2025-09-05T07:15:33.430",
"vulnStatus": "Undergoing Analysis",
"lastModified": "2025-11-13T13:48:31.560",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -0,0 +1,44 @@
{
"id": "CVE-2025-12762",
"sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"published": "2025-11-13T13:15:44.620",
"lastModified": "2025-11-13T13:15:44.620",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.1,
"impactScore": 5.3
}
]
},
"references": [
{
"url": "https://github.com/pgadmin-org/pgadmin4/issues/9320",
"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"
}
]
}
@@ -0,0 +1,44 @@
{
"id": "CVE-2025-12763",
"sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"published": "2025-11-13T13:15:44.777",
"lastModified": "2025-11-13T13:15:44.777",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 0.9,
"impactScore": 5.9
}
]
},
"references": [
{
"url": "https://github.com/pgadmin-org/pgadmin4/issues/9323",
"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"
}
]
}
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-12764",
"sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"published": "2025-11-13T13:15:44.910",
"lastModified": "2025-11-13T14:15:47.740",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "pgAdmin <= 9.9\u00a0 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-90"
}
]
}
],
"references": [
{
"url": "https://github.com/pgadmin-org/pgadmin4/issues/9325",
"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"
}
]
}
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-12765",
"sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"published": "2025-11-13T13:15:45.037",
"lastModified": "2025-11-13T14:15:47.873",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "pgAdmin <= 9.9\u00a0 is affected by a\u00a0vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-295"
}
]
}
],
"references": [
{
"url": "https://github.com/pgadmin-org/pgadmin4/issues/9324",
"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"
}
]
}
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-12817",
"sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"published": "2025-11-13T13:15:45.167",
"lastModified": "2025-11-13T13:15:45.167",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
"baseScore": 3.1,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.6,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2025-12817/",
"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"
}
]
}
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-12818",
"sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"published": "2025-11-13T13:15:45.313",
"lastModified": "2025-11-13T13:15:45.313",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-190"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2025-12818/",
"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"
}
]
}
+145
View File
@@ -0,0 +1,145 @@
{
"id": "CVE-2025-13114",
"sourceIdentifier": "[email protected]",
"published": "2025-11-13T14:15:48.110",
"lastModified": "2025-11-13T14:15:48.110",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in macrozheng mall-swarm up to 1.0.3. This affects the function updateAttr of the file /cart/update/attr. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"baseScore": 6.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-266"
},
{
"lang": "en",
"value": "CWE-285"
}
]
}
],
"references": [
{
"url": "https://github.com/Hwwg/cve/issues/5",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/?ctiid.332319",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/?id.332319",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/?submit.683221",
"source": "[email protected]"
},
{
"url": "https://github.com/Hwwg/cve/issues/5",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
+145
View File
@@ -0,0 +1,145 @@
{
"id": "CVE-2025-13115",
"sourceIdentifier": "[email protected]",
"published": "2025-11-13T14:15:48.330",
"lastModified": "2025-11-13T14:15:48.330",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in macrozheng mall-swarm up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results in improper authorization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"baseScore": 4.0,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-266"
},
{
"lang": "en",
"value": "CWE-285"
}
]
}
],
"references": [
{
"url": "https://github.com/Hwwg/cve/issues/6",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/?ctiid.332320",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/?id.332320",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/?submit.683222",
"source": "[email protected]"
},
{
"url": "https://github.com/Hwwg/cve/issues/6",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
+141
View File
@@ -0,0 +1,141 @@
{
"id": "CVE-2025-13116",
"sourceIdentifier": "[email protected]",
"published": "2025-11-13T14:15:48.550",
"lastModified": "2025-11-13T14:15:48.550",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in macrozheng mall-swarm up to 1.0.3. Affected is the function cancelUserOrder of the file /order/cancelUserOrder. Executing manipulation of the argument orderId can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P",
"baseScore": 5.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 8.0,
"impactScore": 4.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-266"
},
{
"lang": "en",
"value": "CWE-285"
}
]
}
],
"references": [
{
"url": "https://github.com/Hwwg/cve/issues/8",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/?ctiid.332321",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/?id.332321",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/?submit.683339",
"source": "[email protected]"
}
]
}
+2 -2
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-2190",
"sourceIdentifier": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea",
"published": "2025-03-11T07:15:37.950",
"lastModified": "2025-09-05T07:15:33.907",
"vulnStatus": "Undergoing Analysis",
"lastModified": "2025-11-13T13:58:31.430",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
+2 -2
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-3698",
"sourceIdentifier": "907edf6c-bf03-423e-ab1a-8da27e1aa1ea",
"published": "2025-04-16T03:15:18.223",
"lastModified": "2025-09-05T07:15:34.127",
"vulnStatus": "Undergoing Analysis",
"lastModified": "2025-11-13T14:00:00.200",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -0,0 +1,78 @@
{
"id": "CVE-2025-40681",
"sourceIdentifier": "[email protected]",
"published": "2025-11-13T13:15:45.537",
"lastModified": "2025-11-13T13:15:45.537",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) vulnerability reflected in xCally's Omnichannel v3.30.1. This vulnerability allowsan attacker to executed JavaScript code in the victim's browser by sending them a malicious URL using the 'failureMessage' parameter in '/login'. This vulnerability can be exploited to steal sentitive user data, such as session cookies , or to perform actions on behalf of the user."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-xcally-omnichannel",
"source": "[email protected]"
}
]
}
@@ -0,0 +1,78 @@
{
"id": "CVE-2025-41069",
"sourceIdentifier": "[email protected]",
"published": "2025-11-13T14:15:48.747",
"lastModified": "2025-11-13T14:15:48.747",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Insecure Direct Object Reference (IDOR) vulnerability in DeporSite of T-INNOVA. This vulnerability allows an attacker to access or modify unauthorized resources by manipulating requests using the 'idUsuario' parameter in \u2018/ajax/TInnova_v2/Formulario_Consentimiento/llamadaAjax/obtenerDatosConsentimientos\u2019, which could lead to the exposure or alteration os confidential data."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-639"
}
]
}
],
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-references-idor-deporsite-t-innova-deporsite",
"source": "[email protected]"
}
]
}
+4 -4
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-48982",
"sourceIdentifier": "[email protected]",
"published": "2025-10-31T00:15:36.437",
"lastModified": "2025-11-11T02:05:04.267",
"vulnStatus": "Undergoing Analysis",
"lastModified": "2025-11-13T14:47:08.707",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -80,8 +80,8 @@
"vulnerable": true,
"criteria": "cpe:2.3:a:veeam:veeam_agent_for_windows:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.0.959",
"versionEndExcluding": "6.3.2.1205",
"matchCriteriaId": "6E54CE61-A5A7-4F8D-B368-C2ACB862DF0C"
"versionEndExcluding": "6.3.2.1302",
"matchCriteriaId": "7B6D796B-E61F-4CC6-8469-4E95F7F0D8F4"
}
]
}
+10 -3
View File
@@ -2,13 +2,20 @@
"id": "CVE-2025-61084",
"sourceIdentifier": "[email protected]",
"published": "2025-11-05T15:15:39.997",
"lastModified": "2025-11-06T19:45:30.990",
"lastModified": "2025-11-13T14:15:49.040",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"cveTags": [
{
"sourceIdentifier": "[email protected]",
"tags": [
"disputed"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets (<>) in the From: header of SMTP DATA. An attacker can craft a From: header with multiple invisible Unicode thin spaces to display a spoofed sender while passing validation, allowing email spoofing even when anti-spoofing protections are in place."
"value": "MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets (<>) in the From: header of SMTP DATA. An attacker can craft a From: header with multiple invisible Unicode thin spaces to display a spoofed sender while passing validation, allowing email spoofing even when anti-spoofing protections are in place. NOTE: this is disputed by the Supplier because UI spoofing occurs in a client, not in a server such as MDaemon's product or any other server implementation. Also, if a client without its own spoofing protection must be used, the Header Screening feature in MDaemon's product can be employed to mitigate the client-side vulnerability."
}
],
"metrics": {
+27 -31
View File
@@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2025-11-13T13:00:12.185993+00:00
2025-11-13T15:00:11.548300+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2025-11-13T12:15:48.903000+00:00
2025-11-13T14:56:42.523000+00:00
```
### Last Data Feed Release
@@ -33,45 +33,41 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
318122
318133
```
### CVEs added in the last Commit
Recently added CVEs: `1`
Recently added CVEs: `11`
- [CVE-2025-12377](CVE-2025/CVE-2025-123xx/CVE-2025-12377.json) (`2025-11-13T12:15:48.903`)
- [CVE-2025-12762](CVE-2025/CVE-2025-127xx/CVE-2025-12762.json) (`2025-11-13T13:15:44.620`)
- [CVE-2025-12763](CVE-2025/CVE-2025-127xx/CVE-2025-12763.json) (`2025-11-13T13:15:44.777`)
- [CVE-2025-12764](CVE-2025/CVE-2025-127xx/CVE-2025-12764.json) (`2025-11-13T13:15:44.910`)
- [CVE-2025-12765](CVE-2025/CVE-2025-127xx/CVE-2025-12765.json) (`2025-11-13T13:15:45.037`)
- [CVE-2025-12817](CVE-2025/CVE-2025-128xx/CVE-2025-12817.json) (`2025-11-13T13:15:45.167`)
- [CVE-2025-12818](CVE-2025/CVE-2025-128xx/CVE-2025-12818.json) (`2025-11-13T13:15:45.313`)
- [CVE-2025-13114](CVE-2025/CVE-2025-131xx/CVE-2025-13114.json) (`2025-11-13T14:15:48.110`)
- [CVE-2025-13115](CVE-2025/CVE-2025-131xx/CVE-2025-13115.json) (`2025-11-13T14:15:48.330`)
- [CVE-2025-13116](CVE-2025/CVE-2025-131xx/CVE-2025-13116.json) (`2025-11-13T14:15:48.550`)
- [CVE-2025-40681](CVE-2025/CVE-2025-406xx/CVE-2025-40681.json) (`2025-11-13T13:15:45.537`)
- [CVE-2025-41069](CVE-2025/CVE-2025-410xx/CVE-2025-41069.json) (`2025-11-13T14:15:48.747`)
### CVEs modified in the last Commit
Recently modified CVEs: `508`
Recently modified CVEs: `11`
- [CVE-2025-64286](CVE-2025/CVE-2025-642xx/CVE-2025-64286.json) (`2025-11-13T11:17:35.760`)
- [CVE-2025-64287](CVE-2025/CVE-2025-642xx/CVE-2025-64287.json) (`2025-11-13T11:17:35.963`)
- [CVE-2025-64288](CVE-2025/CVE-2025-642xx/CVE-2025-64288.json) (`2025-11-13T11:17:36.160`)
- [CVE-2025-64289](CVE-2025/CVE-2025-642xx/CVE-2025-64289.json) (`2025-11-13T11:17:36.323`)
- [CVE-2025-64290](CVE-2025/CVE-2025-642xx/CVE-2025-64290.json) (`2025-11-13T11:17:36.510`)
- [CVE-2025-64291](CVE-2025/CVE-2025-642xx/CVE-2025-64291.json) (`2025-11-13T11:17:36.700`)
- [CVE-2025-64294](CVE-2025/CVE-2025-642xx/CVE-2025-64294.json) (`2025-11-13T11:17:36.890`)
- [CVE-2025-64350](CVE-2025/CVE-2025-643xx/CVE-2025-64350.json) (`2025-11-13T11:17:37.020`)
- [CVE-2025-64351](CVE-2025/CVE-2025-643xx/CVE-2025-64351.json) (`2025-11-13T11:17:37.253`)
- [CVE-2025-64352](CVE-2025/CVE-2025-643xx/CVE-2025-64352.json) (`2025-11-13T11:17:37.430`)
- [CVE-2025-64353](CVE-2025/CVE-2025-643xx/CVE-2025-64353.json) (`2025-11-13T11:17:37.620`)
- [CVE-2025-64354](CVE-2025/CVE-2025-643xx/CVE-2025-64354.json) (`2025-11-13T11:17:37.870`)
- [CVE-2025-64356](CVE-2025/CVE-2025-643xx/CVE-2025-64356.json) (`2025-11-13T11:17:38.070`)
- [CVE-2025-64357](CVE-2025/CVE-2025-643xx/CVE-2025-64357.json) (`2025-11-13T11:17:38.247`)
- [CVE-2025-64358](CVE-2025/CVE-2025-643xx/CVE-2025-64358.json) (`2025-11-13T11:17:38.490`)
- [CVE-2025-64359](CVE-2025/CVE-2025-643xx/CVE-2025-64359.json) (`2025-11-13T11:17:38.690`)
- [CVE-2025-64360](CVE-2025/CVE-2025-643xx/CVE-2025-64360.json) (`2025-11-13T11:17:38.857`)
- [CVE-2025-64361](CVE-2025/CVE-2025-643xx/CVE-2025-64361.json) (`2025-11-13T11:17:39.097`)
- [CVE-2025-64362](CVE-2025/CVE-2025-643xx/CVE-2025-64362.json) (`2025-11-13T11:17:39.277`)
- [CVE-2025-64363](CVE-2025/CVE-2025-643xx/CVE-2025-64363.json) (`2025-11-13T11:17:39.463`)
- [CVE-2025-64364](CVE-2025/CVE-2025-643xx/CVE-2025-64364.json) (`2025-11-13T11:17:39.657`)
- [CVE-2025-64365](CVE-2025/CVE-2025-643xx/CVE-2025-64365.json) (`2025-11-13T11:17:39.873`)
- [CVE-2025-64366](CVE-2025/CVE-2025-643xx/CVE-2025-64366.json) (`2025-11-13T11:17:40.053`)
- [CVE-2025-64367](CVE-2025/CVE-2025-643xx/CVE-2025-64367.json) (`2025-11-13T11:17:40.240`)
- [CVE-2025-64368](CVE-2025/CVE-2025-643xx/CVE-2025-64368.json) (`2025-11-13T11:17:40.457`)
- [CVE-2024-23454](CVE-2024/CVE-2024-234xx/CVE-2024-23454.json) (`2025-11-13T14:14:48.893`)
- [CVE-2024-37005](CVE-2024/CVE-2024-370xx/CVE-2024-37005.json) (`2025-11-13T14:46:31.297`)
- [CVE-2024-45965](CVE-2024/CVE-2024-459xx/CVE-2024-45965.json) (`2025-11-13T14:50:19.490`)
- [CVE-2024-48889](CVE-2024/CVE-2024-488xx/CVE-2024-48889.json) (`2025-11-13T14:56:42.523`)
- [CVE-2024-52322](CVE-2024/CVE-2024-523xx/CVE-2024-52322.json) (`2025-11-13T14:34:51.550`)
- [CVE-2024-57868](CVE-2024/CVE-2024-578xx/CVE-2024-57868.json) (`2025-11-13T14:38:28.427`)
- [CVE-2024-7697](CVE-2024/CVE-2024-76xx/CVE-2024-7697.json) (`2025-11-13T13:48:31.560`)
- [CVE-2025-2190](CVE-2025/CVE-2025-21xx/CVE-2025-2190.json) (`2025-11-13T13:58:31.430`)
- [CVE-2025-3698](CVE-2025/CVE-2025-36xx/CVE-2025-3698.json) (`2025-11-13T14:00:00.200`)
- [CVE-2025-48982](CVE-2025/CVE-2025-489xx/CVE-2025-48982.json) (`2025-11-13T14:47:08.707`)
- [CVE-2025-61084](CVE-2025/CVE-2025-610xx/CVE-2025-61084.json) (`2025-11-13T14:15:49.040`)
## Download and Usage
+531 -520
View File
File diff suppressed because it is too large. Load diff