Skip to content

Commit 5552854

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3jg4-mfj9-3m8j GHSA-786c-jm2j-j6xw GHSA-7mmp-vchm-mm2p GHSA-9cqv-87fq-8fjx GHSA-c5fm-9xmx-m8v3 GHSA-f5hx-m48w-jh25 GHSA-rm9x-gmj8-vfxh
1 parent 1b8b37e commit 5552854

7 files changed

Lines changed: 368 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/02/GHSA-3jg4-mfj9-3m8j/GHSA-3jg4-mfj9-3m8j.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3jg4-mfj9-3m8j",
4+
"modified": "2026-02-22T09:30:26Z",
5+
"published": "2026-02-22T09:30:26Z",
6+
"aliases": [
7+
"CVE-2026-2933"
8+
],
9+
"details": "A weakness has been identified in YiFang CMS up to 2.0.5. This affects the function update of the file app/db/admin/D_adManage.php of the component Extended Management Module. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2933"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/ZZCTD/CVE/issues/4"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.347279"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.347279"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.755295"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-02-22T08:15:56Z"
51+
}
52+
}

‎advisories/unreviewed/2026/02/GHSA-786c-jm2j-j6xw/GHSA-786c-jm2j-j6xw.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-786c-jm2j-j6xw",
4+
"modified": "2026-02-22T09:30:26Z",
5+
"published": "2026-02-22T09:30:26Z",
6+
"aliases": [
7+
"CVE-2026-2934"
8+
],
9+
"details": "A security vulnerability has been detected in YiFang CMS up to 2.0.5. This impacts the function update of the file app/db/admin/D_friendLinkGroup.php of the component Extended Management Module. The manipulation of the argument Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2934"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/ZZCTD/CVE/issues/5"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.347280"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.347280"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.755296"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-02-22T09:16:11Z"
51+
}
52+
}

‎advisories/unreviewed/2026/02/GHSA-7mmp-vchm-mm2p/GHSA-7mmp-vchm-mm2p.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7mmp-vchm-mm2p",
4+
"modified": "2026-02-22T09:30:26Z",
5+
"published": "2026-02-22T09:30:26Z",
6+
"aliases": [
7+
"CVE-2026-2385"
8+
],
9+
"details": "The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.4.7. This is due to the plugin decrypting and trusting attacker-controlled email_data in an unauthenticated AJAX handler without cryptographic authenticity guarantees. This makes it possible for unauthenticated attackers to tamper with form email routing and redirection values to trigger unauthorized email relay and attacker-controlled redirection via the 'email_data' parameter.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2385"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3463156/the-plus-addons-for-elementor-page-builder"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9176535c-8e37-4a18-b458-a71c4a84daa4?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-345"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-02-22T09:16:10Z"
39+
}
40+
}

‎advisories/unreviewed/2026/02/GHSA-9cqv-87fq-8fjx/GHSA-9cqv-87fq-8fjx.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9cqv-87fq-8fjx",
4+
"modified": "2026-02-22T09:30:26Z",
5+
"published": "2026-02-22T09:30:26Z",
6+
"aliases": [
7+
"CVE-2026-2935"
8+
],
9+
"details": "A weakness has been identified in UTT HiPER 810G up to 1.7.7-171114. This issue affects the function strcpy of the file /goform/ConfigExceptMSN. Executing a manipulation of the argument remark can lead to buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2935"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/alc9700jmo/CVE/issues/23"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.347297"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.347297"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.755297"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-119"
46+
],
47+
"severity": "HIGH",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-02-22T09:16:11Z"
51+
}
52+
}

‎advisories/unreviewed/2026/02/GHSA-c5fm-9xmx-m8v3/GHSA-c5fm-9xmx-m8v3.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c5fm-9xmx-m8v3",
4+
"modified": "2026-02-22T09:30:26Z",
5+
"published": "2026-02-22T09:30:26Z",
6+
"aliases": [
7+
"CVE-2026-2930"
8+
],
9+
"details": "A vulnerability was identified in Tenda A18 15.13.07.13. The affected element is the function webCgiGetUploadFile of the file /cgi-bin/UploadCfg of the component Httpd Service. Such manipulation of the argument boundary leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2930"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/master-abc/cve/issues/40"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.347277"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.347277"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.755227"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.tenda.com.cn"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-22T07:16:15Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-f5hx-m48w-jh25/GHSA-f5hx-m48w-jh25.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f5hx-m48w-jh25",
4+
"modified": "2026-02-22T09:30:26Z",
5+
"published": "2026-02-22T09:30:26Z",
6+
"aliases": [
7+
"CVE-2026-2938"
8+
],
9+
"details": "A vulnerability has been found in SourceCodester Student Result Management System 1.0. The affected element is an unknown function of the file /srms/script/admin/core/update_smtp.php. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2938"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Shaon-Xis/SRMS-1.0---Unauthenticated-SMTP-Hijacking-to-Account-Takeover"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.347310"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.347310"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.755345"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-266"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-22T09:16:11Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-rm9x-gmj8-vfxh/GHSA-rm9x-gmj8-vfxh.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rm9x-gmj8-vfxh",
4+
"modified": "2026-02-22T09:30:26Z",
5+
"published": "2026-02-22T09:30:26Z",
6+
"aliases": [
7+
"CVE-2026-2932"
8+
],
9+
"details": "A security flaw has been discovered in YiFang CMS up to 2.0.5. The impacted element is the function update of the file app/db/admin/D_adPosition.php of the component Extended Management Module. Performing a manipulation of the argument name/index results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2932"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/ZZCTD/CVE/issues/2"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/ZZCTD/CVE/issues/3"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.347278"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.347278"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.755281"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.755286"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-79"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-02-22T08:15:55Z"
59+
}
60+
}

0 commit comments

Comments
 (0)