Sec WriteUp ~ CVE Alert

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 22:41:28 +0200 *************** ✏️Title: CVE-2025-48942 | vLLM up to 0.8.x /v1/completions uncaught exception (ID 17248) *************** 📎Link: https://vuldb.com/?id.310717 *************** ⚙️Information: #Product: vLLM #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 22:41:46 +0200 *************** ✏️Title: CVE-2025-48943 | vLLM up to 0.8.x uncaught exception (ID 17313) *************** 📎Link: https://vuldb.com/?id.310718 *************** ⚙️Information: #Product: vLLM #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 22:42:14 +0200 *************** ✏️Title: CVE-2025-48944 | vLLM up to 0.8.x /v1/chat/completions pattern/type denial of service (GHSA-vrq3-r879-7m65) *************** 📎Link: https://vuldb.com/?id.310719 *************** ⚙️Information: #Product: vLLM #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 22:42:26 +0200 *************** ✏️Title: CVE-2025-48946 | open-quantum-safe liboqs up to 0.12.x rejection risky encryption (GHSA-3rxw-4v8q-9gq5) *************** 📎Link: https://vuldb.com/?id.310720 *************** ⚙️Information: #Vendor: open_quantum_safe #Product: liboqs #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 22:43:10 +0200 *************** ✏️Title: CVE-2025-48938 | cli go-gh up to 2.12.0 Browse.Browse trust boundary violation (GHSA-g9f5-x53j-h563) *************** 📎Link: https://vuldb.com/?id.310721 *************** ⚙️Information: #Vendor: cli #Product: go_gh #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 22:43:35 +0200 *************** ✏️Title: CVE-2023-26226 | Yandex Browser for Desktop prior 24.4.0.682 use after free *************** 📎Link: https://vuldb.com/?id.310722 *************** ⚙️Information: #Vendor: Yandex #Product: Browser for Desktop #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 22:43:46 +0200 *************** ✏️Title: CVE-2025-1479 | Lenovo Legion Space for Legion Go prior 1.2.3.8 Open Debug Interface debug code *************** 📎Link: https://vuldb.com/?id.310723 *************** ⚙️Information: #Vendor: Lenovo #Product: Legion Space for Legion Go/Legion Space for Legion PC #Risk: problematic #Local: Yes #Remote: No #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 22:43:54 +0200 *************** ✏️Title: CVE-2025-2501 | Lenovo PC Manager 2.6.40.3154/2.8.90.11211/5.1.80.9023 untrusted search path *************** 📎Link: https://vuldb.com/?id.310724 *************** ⚙️Information: #Vendor: Lenovo #Product: PC Manager #Risk: critical #Local: Yes #Remote: No #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 22:44:05 +0200 *************** ✏️Title: CVE-2025-2502 | Lenovo PC Manager 2.6.40.3154/2.8.90.11211/5.1.80.9023 default permission *************** 📎Link: https://vuldb.com/?id.310725 *************** ⚙️Information: #Vendor: Lenovo #Product: PC Manager #Risk: critical #Local: Yes #Remote: No #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 22:44:19 +0200 *************** ✏️Title: CVE-2025-2503 | Lenovo PC Manager 2.6.40.3154/2.8.90.11211/5.1.80.9023 insufficient permissions or privileges *************** 📎Link: https://vuldb.com/?id.310726 *************** ⚙️Information: #Vendor: Lenovo #Product: PC Manager #Risk: problematic #Local: Yes #Remote: No #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 22:45:34 +0200 *************** ✏️Title: CVE-2025-4672 | Offsprout Page Builder Plugin up to 2.15.2 on WordPress permission_callback privilege escalation *************** 📎Link: https://vuldb.com/?id.310727 *************** ⚙️Information: #Product: Offsprout Page Builder Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 22:45:55 +0200 *************** ✏️Title: CVE-2025-4631 | Profitori Plugin up to 2.0.6.0/2.1.1.3 on WordPress save_object_as_user meta authorization *************** 📎Link: https://vuldb.com/?id.310728 *************** ⚙️Information: #Product: Profitori Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 22:46:00 +0200 *************** ✏️Title: CVE-2025-4607 | PSW Front-end Login & Registration Plugin up to 1.12 on WordPress customer_registration password recovery *************** 📎Link: https://vuldb.com/?id.310729 *************** ⚙️Information: #Product: PSW Front_end Login & Registration Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 22:46:01 +0200 *************** ✏️Title: CVE-2025-4103 | WP-GeoMeta Plugin 0.3.4/0.3.5 on WordPress wp_ajax_wpgm_start_geojson_import authorization *************** 📎Link: https://vuldb.com/?id.310730 *************** ⚙️Information: #Product: WP_GeoMeta Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 22:46:02 +0200 *************** ✏️Title: CVE-2025-5292 | Element Pack Addons for Elementor Plugin up to 5.11.2 on WordPress marker_content cross site scripting *************** 📎Link: https://vuldb.com/?id.310731 *************** ⚙️Information: #Product: Element Pack Addons for Elementor Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 22:46:08 +0200 *************** ✏️Title: CVE-2025-5285 | Product Subtitle for WooCommerce Plugin up to 1.3.9 on WordPress htmlTag cross site scripting *************** 📎Link: https://vuldb.com/?id.310732 *************** ⚙️Information: #Product: Product Subtitle for WooCommerce Plugin #Type: E_Commerce Management Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 22:46:20 +0200 *************** ✏️Title: CVE-2025-4590 | Daisycon Prijsvergelijkers Plugin up to 4.8.4 on WordPress Shortcode daisycon_uitvaart cross site scripting *************** 📎Link: https://vuldb.com/?id.310733 *************** ⚙️Information: #Product: Daisycon Prijsvergelijkers Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 22:46:29 +0200 *************** ✏️Title: CVE-2025-4595 | FastSpring Plugin up to 3.0.1 on WordPress cross site scripting *************** 📎Link: https://vuldb.com/?id.310734 *************** ⚙️Information: #Product: FastSpring Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 22:46:44 +0200 *************** ✏️Title: CVE-2025-3813 | Royal Elementor Addons and Templates Plugin up to 1.7.1020 on WordPress _elementor_data cross site scripting *************** 📎Link: https://vuldb.com/?id.310735 *************** ⚙️Information: #Product: Royal Elementor Addons and Templates Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

📌#WriteUp Community *************** 🗓Date: Fri, 30 May 2025 18:56:03 GMT *************** ✏️Title: Central 196 *************** 📎Link: https://medium.com/p/658ad39f46e5 *************** ⚙️Tags: #hacker #cyber *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security