Sec WriteUp ~ CVE Alert

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 02 Jun 2025 19:15:26 +0000 *************** ✏️Title: CVE-2025-23099 - Samsung Exynos OOB Write Vulnerability *************** 📎Link: https://cvefeed.io/vuln/detail/CVE-2025-23099 *************** ⚙️Tags: #Vulnerability #CVE #Exploit #POC *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 02 Jun 2025 19:15:26 +0000 *************** ✏️Title: CVE-2025-23105 - Samsung Mobile Processor Exynos Use-After-Free Privilege Escalation Vulnerability *************** 📎Link: https://cvefeed.io/vuln/detail/CVE-2025-23105 *************** ⚙️Tags: #Vulnerability #CVE #Exploit #POC *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 02 Jun 2025 19:15:28 +0000 *************** ✏️Title: CVE-2025-49069 - Cimatti Consulting Contact Forms CSRF *************** 📎Link: https://cvefeed.io/vuln/detail/CVE-2025-49069 *************** ⚙️Tags: #Vulnerability #CVE #Exploit #POC *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 02 Jun 2025 21:54:47 +0200 *************** ✏️Title: CVE-2025-48996 | haxtheweb haxPsuUsage.js up to 10.0.2 API Endpoint HAXPsuUsage insertion of sensitive information into sent data *************** 📎Link: https://vuldb.com/?id.310870 *************** ⚙️Information: #Vendor: haxtheweb #Product: haxPsuUsage.js #Type: JavaScript Library #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 02 Jun 2025 21:59:25 +0200 *************** ✏️Title: CVE-2025-48387 | mafintosh tar-fs up to 1.16.4/2.1.2/3.0.8 path traversal *************** 📎Link: https://vuldb.com/?id.310871 *************** ⚙️Information: #Vendor: mafintosh #Product: tar_fs #Risk: critical #Local: No #Remote: Partially #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 02 Jun 2025 21:59:37 +0200 *************** ✏️Title: CVE-2025-49069 | Cimatti Consulting Contact Forms Plugin up to 1.9.8 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.310872 *************** ⚙️Information: #Vendor: Cimatti Consulting #Product: Contact Forms Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 02 Jun 2025 21:59:48 +0200 *************** ✏️Title: CVE-2025-48267 | WP Pipes Plugin up to 1.4.2 on WordPress wp-config.php delete_template denial of service *************** 📎Link: https://vuldb.com/?id.310873 *************** ⚙️Information: #Product: WP Pipes Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 02 Jun 2025 22:00:00 +0200 *************** ✏️Title: CVE-2025-32283 | Solar Energy Theme up to 3.5 on WordPress deserialization *************** 📎Link: https://vuldb.com/?id.310874 *************** ⚙️Information: #Product: Solar Energy Theme #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 02 Jun 2025 22:00:08 +0200 *************** ✏️Title: CVE-2025-39358 | WP Posts Carousel Plugin up to 1.3.12 on WordPress deserialization *************** 📎Link: https://vuldb.com/?id.310875 *************** ⚙️Information: #Product: WP Posts Carousel Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 02 Jun 2025 22:00:26 +0200 *************** ✏️Title: CVE-2025-31052 | Fashion Theme up to 1.4.4 on WordPress deserialization *************** 📎Link: https://vuldb.com/?id.310876 *************** ⚙️Information: #Product: Fashion Theme #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 02 Jun 2025 22:00:30 +0200 *************** ✏️Title: CVE-2025-32291 | SUMO Affiliates Pro Plugin up to 10.7.0 on WordPress unrestricted upload *************** 📎Link: https://vuldb.com/?id.310877 *************** ⚙️Information: #Product: SUMO Affiliates Pro Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 02 Jun 2025 22:00:41 +0200 *************** ✏️Title: CVE-2025-5103 | Ultimate Gift Cards for WooCommerce Plugin up to 3.1.4 on WordPress wps_wgm_save_post default_price/product_id sql injection *************** 📎Link: https://vuldb.com/?id.310878 *************** ⚙️Information: #Product: Ultimate Gift Cards for WooCommerce Plugin #Type: E_Commerce Management Software #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 02 Jun 2025 22:00:55 +0200 *************** ✏️Title: CVE-2025-48124 | Spreadsheet Price Changer for WooCommerce and WP E-commerce Plugin path traversal *************** 📎Link: https://vuldb.com/?id.310879 *************** ⚙️Information: #Product: Spreadsheet Price Changer for WooCommerce and WP E_commerce Plugin #Type: E_Commerce Management Software #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 02 Jun 2025 22:01:08 +0200 *************** ✏️Title: CVE-2025-4797 | Golo Theme up to 1.7.0 on WordPress Setting improper authentication *************** 📎Link: https://vuldb.com/?id.310880 *************** ⚙️Information: #Product: Golo Theme #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 02 Jun 2025 22:01:18 +0200 *************** ✏️Title: CVE-2025-48337 | QuickCab Plugin up to 1.3.3 on WordPress authorization *************** 📎Link: https://vuldb.com/?id.310881 *************** ⚙️Information: #Product: QuickCab Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 02 Jun 2025 22:01:29 +0200 *************** ✏️Title: CVE-2025-31050 | Apptha Slider Gallery Plugin up to 2.5 on WordPress path traversal *************** 📎Link: https://vuldb.com/?id.310882 *************** ⚙️Information: #Vendor: Apptha #Product: Slider Gallery Plugin #Type: Photo Gallery Software #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 02 Jun 2025 22:01:38 +0200 *************** ✏️Title: CVE-2025-31643 | WPCHURCH Plugin up to 2.7.0 on WordPress privilege escalation *************** 📎Link: https://vuldb.com/?id.310883 *************** ⚙️Information: #Product: WPCHURCH Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 02 Jun 2025 22:01:54 +0200 *************** ✏️Title: CVE-2025-48335 | Responsive Plus Theme up to 3.2.0 on WordPress import_sites authorization *************** 📎Link: https://vuldb.com/?id.310884 *************** ⚙️Information: #Product: Responsive Plus Theme #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 02 Jun 2025 22:01:58 +0200 *************** ✏️Title: CVE-2025-47651 | Infility Global Plugin up to 2.12.2 on WordPress sql injection *************** 📎Link: https://vuldb.com/?id.310885 *************** ⚙️Information: #Product: Infility Global Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

📌#WriteUp Community *************** 🗓Date: Mon, 02 Jun 2025 19:33:34 GMT *************** ✏️Title: Cracking JWTs: A Bug Bounty Hunting Guide [Part 3] *************** 📎Link: https://medium.com/p/4cee87018c39 *************** ⚙️Tags: #jwt_authentication #jwt_exploitation #jwt #bug_bounty #burpsuite *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security