Skip to content

Commit 11a156a

Browse files
author
cvelistV5 Github Action
committed
2 changes (1 new | 1 updated):
 - 1 new CVEs: CVE-2026-6574 - 1 updated CVEs: CVE-2025-0974
1 parent 5f978e4 commit 11a156a

4 files changed

Lines changed: 232 additions & 56 deletions

File tree

‎cves/2025/0xxx/CVE-2025-0974.json‎

Lines changed: 26 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,21 @@
11
{
22
"dataType": "CVE_RECORD",
3-
"dataVersion": "5.1",
3+
"dataVersion": "5.2",
44
"cveMetadata": {
55
"cveId": "CVE-2025-0974",
66
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
77
"state": "PUBLISHED",
88
"assignerShortName": "VulDB",
99
"dateReserved": "2025-02-02T09:03:03.907Z",
1010
"datePublished": "2025-02-03T01:00:13.487Z",
11-
"dateUpdated": "2025-02-12T20:41:37.430Z"
11+
"dateUpdated": "2026-04-19T13:24:22.430Z"
1212
},
1313
"containers": {
1414
"cna": {
1515
"providerMetadata": {
1616
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
1717
"shortName": "VulDB",
18-
"dateUpdated": "2025-02-03T01:00:13.487Z"
18+
"dateUpdated": "2026-04-19T13:24:22.430Z"
1919
},
2020
"title": "MaxD Lightning Module deserialization",
2121
"problemTypes": [
@@ -48,50 +48,54 @@
4848
{
4949
"version": "4.43",
5050
"status": "affected"
51+
},
52+
{
53+
"version": "4.44",
54+
"status": "affected"
55+
},
56+
{
57+
"version": "4.45",
58+
"status": "unaffected"
5159
}
5260
]
5361
}
5462
],
5563
"descriptions": [
5664
{
5765
"lang": "en",
58-
"value": "A vulnerability, which was classified as critical, has been found in MaxD Lightning Module 4.43 on OpenCart. This issue affects some unknown processing. The manipulation of the argument li_op/md leads to deserialization. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used."
59-
},
60-
{
61-
"lang": "de",
62-
"value": "Eine Schwachstelle wurde in MaxD Lightning Module 4.43 für OpenCart entdeckt. Sie wurde als kritisch eingestuft. Davon betroffen ist unbekannter Code. Mittels dem Manipulieren des Arguments li_op/md mit unbekannten Daten kann eine deserialization-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Die Komplexität eines Angriffs ist eher hoch. Die Ausnutzbarkeit gilt als schwierig. Der Exploit steht zur öffentlichen Verfügung."
66+
"value": "A vulnerability was determined in MaxD Lightning Module 4.43/4.44 on OpenCart. This issue affects some unknown processing. Executing a manipulation of the argument li_op/md can lead to deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is assessed as difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 4.45 is capable of addressing this issue. Upgrading the affected component is advised."
6367
}
6468
],
6569
"metrics": [
6670
{
6771
"cvssV4_0": {
6872
"version": "4.0",
6973
"baseScore": 2.3,
70-
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
74+
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
7175
"baseSeverity": "LOW"
7276
}
7377
},
7478
{
7579
"cvssV3_1": {
7680
"version": "3.1",
7781
"baseScore": 5,
78-
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
82+
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
7983
"baseSeverity": "MEDIUM"
8084
}
8185
},
8286
{
8387
"cvssV3_0": {
8488
"version": "3.0",
8589
"baseScore": 5,
86-
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
90+
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
8791
"baseSeverity": "MEDIUM"
8892
}
8993
},
9094
{
9195
"cvssV2_0": {
9296
"version": "2.0",
9397
"baseScore": 4.6,
94-
"vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P"
98+
"vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"
9599
}
96100
}
97101
],
@@ -107,7 +111,7 @@
107111
"value": "VulDB entry created"
108112
},
109113
{
110-
"time": "2025-02-02T10:09:12.000Z",
114+
"time": "2026-04-19T15:28:28.000Z",
111115
"lang": "en",
112116
"value": "VulDB entry last update"
113117
}
@@ -121,23 +125,23 @@
121125
],
122126
"references": [
123127
{
124-
"url": "https://vuldb.com/?id.294365",
128+
"url": "https://vuldb.com/vuln/294365",
125129
"name": "VDB-294365 | MaxD Lightning Module deserialization",
126130
"tags": [
127131
"vdb-entry",
128132
"technical-description"
129133
]
130134
},
131135
{
132-
"url": "https://vuldb.com/?ctiid.294365",
136+
"url": "https://vuldb.com/vuln/294365/cti",
133137
"name": "VDB-294365 | CTI Indicators (IOB, IOC, IOA)",
134138
"tags": [
135139
"signature",
136140
"permissions-required"
137141
]
138142
},
139143
{
140-
"url": "https://vuldb.com/?submit.489672",
144+
"url": "https://vuldb.com/submit/489672",
141145
"name": "Submit #489672 | devs.mx OpenCart Lightning 4.43 Deserialization of Untrusted Data",
142146
"tags": [
143147
"third-party-advisory"
@@ -148,6 +152,12 @@
148152
"tags": [
149153
"exploit"
150154
]
155+
},
156+
{
157+
"url": "https://lightning.devs.mx/download",
158+
"tags": [
159+
"patch"
160+
]
151161
}
152162
]
153163
},

‎cves/2026/6xxx/CVE-2026-6574.json‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
{
2+
"dataType": "CVE_RECORD",
3+
"dataVersion": "5.2",
4+
"cveMetadata": {
5+
"cveId": "CVE-2026-6574",
6+
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
7+
"state": "PUBLISHED",
8+
"assignerShortName": "VulDB",
9+
"dateReserved": "2026-04-18T20:01:42.583Z",
10+
"datePublished": "2026-04-19T13:30:17.265Z",
11+
"dateUpdated": "2026-04-19T13:30:17.265Z"
12+
},
13+
"containers": {
14+
"cna": {
15+
"providerMetadata": {
16+
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
17+
"shortName": "VulDB",
18+
"dateUpdated": "2026-04-19T13:30:17.265Z"
19+
},
20+
"title": "osuuu LightPicture API Upload Endpoint lp.sql hard-coded credentials",
21+
"problemTypes": [
22+
{
23+
"descriptions": [
24+
{
25+
"type": "CWE",
26+
"cweId": "CWE-798",
27+
"lang": "en",
28+
"description": "Hard-coded Credentials"
29+
}
30+
]
31+
},
32+
{
33+
"descriptions": [
34+
{
35+
"type": "CWE",
36+
"cweId": "CWE-259",
37+
"lang": "en",
38+
"description": "Use of Hard-coded Password"
39+
}
40+
]
41+
}
42+
],
43+
"affected": [
44+
{
45+
"vendor": "osuuu",
46+
"product": "LightPicture",
47+
"versions": [
48+
{
49+
"version": "1.2.0",
50+
"status": "affected"
51+
},
52+
{
53+
"version": "1.2.1",
54+
"status": "affected"
55+
},
56+
{
57+
"version": "1.2.2",
58+
"status": "affected"
59+
}
60+
],
61+
"cpes": [
62+
"cpe:2.3:a:osuuu:lightpicture:*:*:*:*:*:*:*:*"
63+
],
64+
"modules": [
65+
"API Upload Endpoint"
66+
]
67+
}
68+
],
69+
"descriptions": [
70+
{
71+
"lang": "en",
72+
"value": "A vulnerability has been found in osuuu LightPicture up to 1.2.2. This issue affects some unknown processing of the file /public/install/lp.sql of the component API Upload Endpoint. Such manipulation of the argument key leads to hard-coded credentials. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
73+
}
74+
],
75+
"metrics": [
76+
{
77+
"cvssV4_0": {
78+
"version": "4.0",
79+
"baseScore": 6.9,
80+
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
81+
"baseSeverity": "MEDIUM"
82+
}
83+
},
84+
{
85+
"cvssV3_1": {
86+
"version": "3.1",
87+
"baseScore": 7.3,
88+
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
89+
"baseSeverity": "HIGH"
90+
}
91+
},
92+
{
93+
"cvssV3_0": {
94+
"version": "3.0",
95+
"baseScore": 7.3,
96+
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
97+
"baseSeverity": "HIGH"
98+
}
99+
},
100+
{
101+
"cvssV2_0": {
102+
"version": "2.0",
103+
"baseScore": 7.5,
104+
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"
105+
}
106+
}
107+
],
108+
"timeline": [
109+
{
110+
"time": "2026-04-18T00:00:00.000Z",
111+
"lang": "en",
112+
"value": "Advisory disclosed"
113+
},
114+
{
115+
"time": "2026-04-18T02:00:00.000Z",
116+
"lang": "en",
117+
"value": "VulDB entry created"
118+
},
119+
{
120+
"time": "2026-04-18T22:06:53.000Z",
121+
"lang": "en",
122+
"value": "VulDB entry last update"
123+
}
124+
],
125+
"credits": [
126+
{
127+
"lang": "en",
128+
"value": "vulnplusbot (VulDB User)",
129+
"type": "reporter"
130+
},
131+
{
132+
"lang": "en",
133+
"value": "VulDB CNA Team",
134+
"type": "coordinator"
135+
}
136+
],
137+
"references": [
138+
{
139+
"url": "https://vuldb.com/vuln/358209",
140+
"name": "VDB-358209 | osuuu LightPicture API Upload Endpoint lp.sql hard-coded credentials",
141+
"tags": [
142+
"vdb-entry",
143+
"technical-description"
144+
]
145+
},
146+
{
147+
"url": "https://vuldb.com/vuln/358209/cti",
148+
"name": "VDB-358209 | CTI Indicators (IOB, IOC, TTP, IOA)",
149+
"tags": [
150+
"signature",
151+
"permissions-required"
152+
]
153+
},
154+
{
155+
"url": "https://vuldb.com/submit/790000",
156+
"name": "Submit #790000 | LightPicture v1.2.2 Hardcoded Secret",
157+
"tags": [
158+
"third-party-advisory"
159+
]
160+
},
161+
{
162+
"url": "https://vulnplus-note.wetolink.com/share/VhoNkMja5u7A",
163+
"tags": [
164+
"broken-link",
165+
"exploit"
166+
]
167+
}
168+
]
169+
}
170+
}
171+
}

‎cves/delta.json‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,21 @@
11
{
2-
"fetchTime": "2026-04-19T13:12:18.173Z",
3-
"numberOfChanges": 1,
2+
"fetchTime": "2026-04-19T13:39:36.120Z",
3+
"numberOfChanges": 2,
44
"new": [
55
{
6-
"cveId": "CVE-2026-6573",
7-
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-6573",
8-
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6573.json",
9-
"dateUpdated": "2026-04-19T12:45:14.558Z"
6+
"cveId": "CVE-2026-6574",
7+
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-6574",
8+
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6574.json",
9+
"dateUpdated": "2026-04-19T13:30:17.265Z"
10+
}
11+
],
12+
"updated": [
13+
{
14+
"cveId": "CVE-2025-0974",
15+
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-0974",
16+
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/0xxx/CVE-2025-0974.json",
17+
"dateUpdated": "2026-04-19T13:24:22.430Z"
1018
}
1119
],
12-
"updated": [],
1320
"error": []
1421
}

0 commit comments

Comments
 (0)