1 changes (1 new | 0 updated):

- 1 new CVEs: CVE-2025-0804 - 0 updated CVEs:
CVEProject · Jan 29, 2025 · fade2a4 · fade2a4
1 parent a69cc47
commit fade2a4
Show file tree

Hide file tree

Showing 3 changed files with 107 additions and 19 deletions.
diff --git a/cves/2025/0xxx/CVE-2025-0804.json b/cves/2025/0xxx/CVE-2025-0804.json
@@ -0,0 +1,88 @@
+{
+    "dataType": "CVE_RECORD",
+    "dataVersion": "5.1",
+    "cveMetadata": {
+        "cveId": "CVE-2025-0804",
+        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+        "state": "PUBLISHED",
+        "assignerShortName": "Wordfence",
+        "dateReserved": "2025-01-28T14:53:15.819Z",
+        "datePublished": "2025-01-29T03:21:23.753Z",
+        "dateUpdated": "2025-01-29T03:21:23.753Z"
+    },
+    "containers": {
+        "cna": {
+            "providerMetadata": {
+                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
+                "shortName": "Wordfence",
+                "dateUpdated": "2025-01-29T03:21:23.753Z"
+            },
+            "affected": [
+                {
+                    "vendor": "flowdee",
+                    "product": "ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages",
+                    "versions": [
+                        {
+                            "version": "*",
+                            "status": "affected",
+                            "lessThanOrEqual": "2.4.1",
+                            "versionType": "semver"
+                        }
+                    ],
+                    "defaultStatus": "unaffected"
+                }
+            ],
+            "descriptions": [
+                {
+                    "lang": "en",
+                    "value": "The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via link titles in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+                }
+            ],
+            "title": "ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
+            "references": [
+                {
+                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bf41b5e1-610e-4159-9325-f7a694380050?source=cve"
+                },
+                {
+                    "url": "https://plugins.trac.wordpress.org/changeset/3219341/clickwhale/tags/2.4.2/includes/admin/links/Clickwhale_Links_List_Table.php"
+                }
+            ],
+            "problemTypes": [
+                {
+                    "descriptions": [
+                        {
+                            "lang": "en",
+                            "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                            "cweId": "CWE-79",
+                            "type": "CWE"
+                        }
+                    ]
+                }
+            ],
+            "metrics": [
+                {
+                    "cvssV3_1": {
+                        "version": "3.1",
+                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+                        "baseScore": 6.4,
+                        "baseSeverity": "MEDIUM"
+                    }
+                }
+            ],
+            "credits": [
+                {
+                    "lang": "en",
+                    "type": "finder",
+                    "value": "SOPROBRO"
+                }
+            ],
+            "timeline": [
+                {
+                    "time": "2025-01-28T00:00:00.000+00:00",
+                    "lang": "en",
+                    "value": "Disclosed"
+                }
+            ]
+        }
+    }
+}
diff --git a/cves/delta.json b/cves/delta.json
@@ -1,12 +1,12 @@
 {
-  "fetchTime": "2025-01-29T02:46:51.637Z",
+  "fetchTime": "2025-01-29T03:28:37.195Z",
   "numberOfChanges": 1,
   "new": [
     {
-      "cveId": "CVE-2025-0806",
-      "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-0806",
-      "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/0xxx/CVE-2025-0806.json",
-      "dateUpdated": "2025-01-29T02:31:04.245Z"
+      "cveId": "CVE-2025-0804",
+      "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-0804",
+      "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/0xxx/CVE-2025-0804.json",
+      "dateUpdated": "2025-01-29T03:21:23.753Z"
     }
   ],
   "updated": [],

diff --git a/cves/deltaLog.json b/cves/deltaLog.json
@@ -1,4 +1,18 @@
 [
+  {
+    "fetchTime": "2025-01-29T03:28:37.195Z",
+    "numberOfChanges": 1,
+    "new": [
+      {
+        "cveId": "CVE-2025-0804",
+        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-0804",
+        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/0xxx/CVE-2025-0804.json",
+        "dateUpdated": "2025-01-29T03:21:23.753Z"
+      }
+    ],
+    "updated": [],
+    "error": []
+  },
   {
     "fetchTime": "2025-01-29T02:46:51.637Z",
     "numberOfChanges": 1,
@@ -127756,19 +127770,5 @@
     ],
     "updated": [],
     "error": []
-  },
-  {
-    "fetchTime": "2024-12-30T03:06:24.092Z",
-    "numberOfChanges": 1,
-    "new": [
-      {
-        "cveId": "CVE-2024-13036",
-        "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-13036",
-        "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/13xxx/CVE-2024-13036.json",
-        "dateUpdated": "2024-12-30T03:00:14.514Z"
-      }
-    ],
-    "updated": [],
-    "error": []
   }
 ]