Skip to content

Commit 7016f16

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-cmfh-mpmf-fmq4 GHSA-hxqw-6qv7-cqfv
1 parent 406cf37 commit 7016f16

2 files changed

Lines changed: 176 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-cmfh-mpmf-fmq4/GHSA-cmfh-mpmf-fmq4.json‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cmfh-mpmf-fmq4",
4+
"modified": "2026-03-23T20:35:48Z",
5+
"published": "2026-03-23T20:35:48Z",
6+
"aliases": [
7+
"CVE-2026-32277"
8+
],
9+
"summary": "Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View",
10+
"details": "# Security Advisory — Cabinet Plugin (DOM-based XSS)\n\n## Summary\n\nA DOM-based Cross-Site Scripting (XSS) issue exists in the Cabinet Plugin list view.\n\n## Affected Versions\n\n- 1.x series: >= 1.35.0, <= 1.41.0\n- 2.x series: >= 2.35.0, <= 2.41.0\n\n## Patched Versions\n\n- 1.41.1\n- 2.41.1\n\n## Description\n\nIn the Cabinet Plugin list view, DOM-based Cross-Site Scripting (XSS) could occur due to how saved names were rendered.\nIf exploited, arbitrary script could run in the victim's browser, which may lead to unauthorized actions or information theft.\nExploitation requires that the attacker be able to reach the affected functionality as an authenticated user.\nUsers affected by this vulnerability should update to a fixed version.\n\n## Solution\n\nUpdate to the fixed version.\nFor the 1.x series, update to 1.41.1 or later.\nFor the 2.x series, update to 2.41.1 or later.\n\n## Credits\n\nOpenSource WorkShop thanks **Sho Odagiri** (小田切 祥) of **GMO Cybersecurity by Ierae, Inc.** for reporting this vulnerability.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "opensource-workshop/connect-cms"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "1.35.0"
29+
},
30+
{
31+
"fixed": "1.41.1"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Packagist",
40+
"name": "opensource-workshop/connect-cms"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "2.35.0"
48+
},
49+
{
50+
"fixed": "2.41.1"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/opensource-workshop/connect-cms/security/advisories/GHSA-cmfh-mpmf-fmq4"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/opensource-workshop/connect-cms/commit/c04dc40f814eff891915752ef1ec00ba6612441c"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/opensource-workshop/connect-cms"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://github.com/opensource-workshop/connect-cms/releases/tag/v1.41.1"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://github.com/opensource-workshop/connect-cms/releases/tag/v2.41.1"
77+
}
78+
],
79+
"database_specific": {
80+
"cwe_ids": [
81+
"CWE-79"
82+
],
83+
"severity": "HIGH",
84+
"github_reviewed": true,
85+
"github_reviewed_at": "2026-03-23T20:35:48Z",
86+
"nvd_published_at": null
87+
}
88+
}

‎advisories/github-reviewed/2026/03/GHSA-hxqw-6qv7-cqfv/GHSA-hxqw-6qv7-cqfv.json‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hxqw-6qv7-cqfv",
4+
"modified": "2026-03-23T20:33:34Z",
5+
"published": "2026-03-23T20:33:34Z",
6+
"aliases": [
7+
"CVE-2026-32276"
8+
],
9+
"summary": "Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin",
10+
"details": "# Security Advisory — Code Study Plugin\n\n## Summary\n\nAn authenticated user may be able to execute arbitrary code in the Code Study Plugin.\n\n## Affected Versions\n\n- 1.x series: <= 1.41.0\n- 2.x series: <= 2.41.0\n\n## Patched Versions\n\n- 1.41.1\n- 2.41.1\n\n## Description\n\nIn the Code Study Plugin, an authenticated user could trigger unintended code execution. If exploited, it may lead to code execution on the server or information disclosure. Users affected by this vulnerability should update to a fixed version.\n\n## Solution\n\nUpdate to the fixed version.\nFor the 1.x series, update to 1.41.1 or later.\nFor the 2.x series, update to 2.41.1 or later.\n\n## Credits\n\nOpenSource WorkShop thanks **Sho Odagiri** (小田切 祥) of **GMO Cybersecurity by Ierae, Inc.** for reporting this vulnerability.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "opensource-workshop/connect-cms"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.41.1"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Packagist",
40+
"name": "opensource-workshop/connect-cms"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "2.0.0"
48+
},
49+
{
50+
"fixed": "2.41.1"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/opensource-workshop/connect-cms/security/advisories/GHSA-hxqw-6qv7-cqfv"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/opensource-workshop/connect-cms/commit/c0bcd07fc1e9375941aa1295d044328ecd44ed85"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/opensource-workshop/connect-cms"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://github.com/opensource-workshop/connect-cms/releases/tag/v1.41.1"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://github.com/opensource-workshop/connect-cms/releases/tag/v2.41.1"
77+
}
78+
],
79+
"database_specific": {
80+
"cwe_ids": [
81+
"CWE-94"
82+
],
83+
"severity": "HIGH",
84+
"github_reviewed": true,
85+
"github_reviewed_at": "2026-03-23T20:33:34Z",
86+
"nvd_published_at": null
87+
}
88+
}

0 commit comments

Comments
 (0)