Sec WriteUp ~ CVE Alert

‼️ CVE ALERT ‼️ *************** 🗓Date: Thu, 29 May 2025 21:11:22 +0200 *************** ✏️Title: CVE-2025-48474 | freescout up to 1.8.179 authorization (GHSA-9wc4-vchw-mr3m) *************** 📎Link: https://vuldb.com/?id.310553 *************** ⚙️Information: #Product: freescout #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Thu, 29 May 2025 21:11:50 +0200 *************** ✏️Title: CVE-2025-46722 | vLLM up to 0.8.x hasher.py MultiModalHasher improper validation of consistency within input (GHSA-c65p-x677-fgj6) *************** 📎Link: https://vuldb.com/?id.310554 *************** ⚙️Information: #Product: vLLM #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Thu, 29 May 2025 21:12:13 +0200 *************** ✏️Title: CVE-2023-41591 | Open Network Foundation ONOS 2.7.0 channel accessible *************** 📎Link: https://vuldb.com/?id.310555 *************** ⚙️Information: #Vendor: Open Network Foundation #Product: ONOS #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Thu, 29 May 2025 21:12:40 +0200 *************** ✏️Title: CVE-2025-46823 | openmrs-module-fhir2 up to 2.4.x on OpenMRS FHIR REST API authorization (GHSA-g5vq-w8v2-4x9j) *************** 📎Link: https://vuldb.com/?id.310556 *************** ⚙️Information: #Product: openmrs_module_fhir2 #Type: Health Information Software #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Thu, 29 May 2025 21:12:55 +0200 *************** ✏️Title: CVE-2024-53423 | Open Network Foundation ONOS 2.7.0 Packet denial of service *************** 📎Link: https://vuldb.com/?id.310557 *************** ⚙️Information: #Vendor: Open Network Foundation #Product: ONOS #Risk: problematic #Local: No #Remote: Partially #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Thu, 29 May 2025 21:14:04 +0200 *************** ✏️Title: CVE-2025-32752 | Dell ThinOS up to 2502 cleartext storage (dsa-2025-225) *************** 📎Link: https://vuldb.com/?id.310558 *************** ⚙️Information: #Vendor: Dell #Product: ThinOS #Risk: problematic #Local: Partially #Remote: No #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Thu, 29 May 2025 21:14:21 +0200 *************** ✏️Title: CVE-2025-39484 | Entrada Plugin up to 5.7.7 on WordPress sql injection *************** 📎Link: https://vuldb.com/?id.310559 *************** ⚙️Information: #Product: Entrada Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Thu, 29 May 2025 21:14:32 +0200 *************** ✏️Title: CVE-2025-48140 | MetalpriceAPI Plugin up to 1.1.4 on WordPress privilege escalation *************** 📎Link: https://vuldb.com/?id.310560 *************** ⚙️Information: #Product: MetalpriceAPI Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Thu, 29 May 2025 21:14:33 +0200 *************** ✏️Title: CVE-2025-48123 | Spreadsheet Price Changer for WooCommerce and WP E-commerce Plugin Remote Code Execution *************** 📎Link: https://vuldb.com/?id.310561 *************** ⚙️Information: #Product: Spreadsheet Price Changer for WooCommerce and WP E_commerce Plugin #Type: E_Commerce Management Software #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Thu, 29 May 2025 21:14:33 +0200 *************** ✏️Title: CVE-2025-31634 | Insurance Plugin up to 3.5 on WordPress deserialization *************** 📎Link: https://vuldb.com/?id.310562 *************** ⚙️Information: #Product: Insurance Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Thu, 29 May 2025 21:14:44 +0200 *************** ✏️Title: CVE-2025-48336 | ThimPress Course Builder Plugin up to 3.6.5 on WordPress deserialization *************** 📎Link: https://vuldb.com/?id.310563 *************** ⚙️Information: #Vendor: ThimPress #Product: Course Builder Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Thu, 29 May 2025 21:15:00 +0200 *************** ✏️Title: CVE-2025-4659 | Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms Plugin information disclosure *************** 📎Link: https://vuldb.com/?id.310564 *************** ⚙️Information: #Product: Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Thu, 29 May 2025 21:15:12 +0200 *************** ✏️Title: CVE-2025-46256 | Advanced Database Cleaner Pro Plugin up to 3.2.10 on WordPress path traversal *************** 📎Link: https://vuldb.com/?id.310565 *************** ⚙️Information: #Product: Advanced Database Cleaner Pro Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Thu, 29 May 2025 21:15:22 +0200 *************** ✏️Title: CVE-2025-48129 | Spreadsheet Price Changer for WooCommerce and WP E-commerce Plugin Remote Code Execution *************** 📎Link: https://vuldb.com/?id.310566 *************** ⚙️Information: #Product: Spreadsheet Price Changer for WooCommerce and WP E_commerce Plugin #Type: E_Commerce Management Software #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Thu, 29 May 2025 21:15:27 +0200 *************** ✏️Title: CVE-2025-5259 | Minimal Share Buttons Plugin up to 1.7.3 on WordPress align cross site scripting *************** 📎Link: https://vuldb.com/?id.310567 *************** ⚙️Information: #Product: Minimal Share Buttons Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Thu, 29 May 2025 21:15:39 +0200 *************** ✏️Title: CVE-2025-4943 | LA-Studio Element Kit for Elementor Plugin up to 1.5.2 on WordPress data-lakit-element-link cross site scripting *************** 📎Link: https://vuldb.com/?id.310568 *************** ⚙️Information: #Vendor: LA_Studio #Product: Element Kit for Elementor Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Thu, 29 May 2025 21:16:23 +0200 *************** ✏️Title: CVE-2025-48865 | Fabio up to 1.6.5 Header data authenticity *************** 📎Link: https://vuldb.com/?id.310569 *************** ⚙️Information: #Product: Fabio #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Thu, 29 May 2025 21:17:10 +0200 *************** ✏️Title: CVE-2025-1907 | Instantel Micromate 3.1/9.8 missing authentication (icsa-25-148-04) *************** 📎Link: https://vuldb.com/?id.310570 *************** ⚙️Information: #Vendor: Instantel #Product: Micromate #Risk: very critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Thu, 29 May 2025 21:18:41 +0200 *************** ✏️Title: CVE-2025-41438 | Consilium Safety CS5000 Fire Panel insecure default initialization of resource (icsa-25-148-03) *************** 📎Link: https://vuldb.com/?id.310571 *************** ⚙️Information: #Vendor: Consilium Safety #Product: CS5000 Fire Panel #Risk: very critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Thu, 29 May 2025 21:19:01 +0200 *************** ✏️Title: CVE-2025-46352 | Consilium Safety CS5000 Fire Panel VNC Server hard-coded credentials (icsa-25-148-03) *************** 📎Link: https://vuldb.com/?id.310572 *************** ⚙️Information: #Vendor: Consilium Safety #Product: CS5000 Fire Panel #Risk: very critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security