Sec WriteUp ~ CVE Alert

‼️ CVE ALERT ‼️ *************** 🗓Date: Wed, 28 May 2025 20:33:15 +0200 *************** ✏️Title: CVE-2025-48927 | TeleMessage Service up to 2025-05-05 Spring Boot Actuator /heapdump insecure default initialization of resource *************** 📎Link: https://vuldb.com/?id.310461 *************** ⚙️Information: #Vendor: TeleMessage #Product: Service #Risk: problematic #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Wed, 28 May 2025 20:33:48 +0200 *************** ✏️Title: CVE-2025-48747 | Netwrix Directory Manager up to 11.1.25134.03 permission (adv-2025-014) *************** 📎Link: https://vuldb.com/?id.310462 *************** ⚙️Information: #Vendor: Netwrix #Product: Directory Manager #Risk: critical #Local: No #Remote: Partially #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Wed, 28 May 2025 20:34:09 +0200 *************** ✏️Title: CVE-2025-45343 | Tenda W18E 16.01.0.11 Editing /goform/setmodules access control *************** 📎Link: https://vuldb.com/?id.310463 *************** ⚙️Information: #Vendor: Tenda #Product: W18E #Type: Router Operating System #Risk: critical #Local: No #Remote: Partially #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Wed, 28 May 2025 20:34:24 +0200 *************** ✏️Title: CVE-2025-48746 | Netwrix Directory Manager up to 11.1.25134.03 improper authentication (adv-2025-014) *************** 📎Link: https://vuldb.com/?id.310464 *************** ⚙️Information: #Vendor: Netwrix #Product: Directory Manager #Risk: critical #Local: No #Remote: Partially #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Wed, 28 May 2025 20:35:16 +0200 *************** ✏️Title: CVE-2025-48931 | TeleMessage Service up to 2025-05-05 Password weak hash *************** 📎Link: https://vuldb.com/?id.310465 *************** ⚙️Information: #Vendor: TeleMessage #Product: Service #Risk: problematic #Local: Yes #Remote: No #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Wed, 28 May 2025 20:35:30 +0200 *************** ✏️Title: CVE-2025-48749 | Netwrix Directory Manager up to 11.1.25134.03 information disclosure *************** 📎Link: https://vuldb.com/?id.310466 *************** ⚙️Information: #Vendor: Netwrix #Product: Directory Manager #Risk: problematic #Local: No #Remote: Partially #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Wed, 28 May 2025 20:35:48 +0200 *************** ✏️Title: CVE-2024-57336 | M2Soft CROWNIX Report & ERS up to 7.4.3.599/8.0.3.79 access control *************** 📎Link: https://vuldb.com/?id.310467 *************** ⚙️Information: #Vendor: M2Soft #Product: CROWNIX Report & ERS #Type: Reporting Software #Risk: critical #Local: No #Remote: Partially #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Wed, 28 May 2025 20:35:48 +0200 *************** ✏️Title: CVE-2025-1461 | Vuetify 2.x cross site scripting *************** 📎Link: https://vuldb.com/?id.310468 *************** ⚙️Information: #Product: Vuetify #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Wed, 28 May 2025 20:36:10 +0200 *************** ✏️Title: CVE-2025-32803 | ISC Kea up to 2.4.1/2.6.2/2.7.8 Log File default permission *************** 📎Link: https://vuldb.com/?id.310469 *************** ⚙️Information: #Vendor: ISC #Product: Kea #Risk: problematic #Local: Yes #Remote: No #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Wed, 28 May 2025 20:36:23 +0200 *************** ✏️Title: CVE-2025-47748 | Netwrix Directory Manager up to 11.1.25134.03 hard-coded password *************** 📎Link: https://vuldb.com/?id.310470 *************** ⚙️Information: #Vendor: Netwrix #Product: Directory Manager #Risk: problematic #Local: No #Remote: Partially #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Wed, 28 May 2025 20:36:50 +0200 *************** ✏️Title: CVE-2025-31500 | Best Practical Request Tracker up to 5.0.7 Asset Name cross site scripting *************** 📎Link: https://vuldb.com/?id.310471 *************** ⚙️Information: #Vendor: Best Practical #Product: Request Tracker #Type: Ticket Tracking Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Wed, 28 May 2025 20:37:08 +0200 *************** ✏️Title: CVE-2025-31501 | Best Practical Request Tracker up to 5.0.7 RT Permalink cross site scripting *************** 📎Link: https://vuldb.com/?id.310472 *************** ⚙️Information: #Vendor: Best Practical #Product: Request Tracker #Type: Ticket Tracking Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Wed, 28 May 2025 20:37:24 +0200 *************** ✏️Title: CVE-2025-30087 | Best Practical Request Tracker up to 4.4.7/5.0.7 Search URL cross site scripting *************** 📎Link: https://vuldb.com/?id.310473 *************** ⚙️Information: #Vendor: Best Practical #Product: Request Tracker #Type: Ticket Tracking Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Wed, 28 May 2025 20:37:41 +0200 *************** ✏️Title: CVE-2025-3357 | IBM Tivoli Monitoring up to 6.3.0.7 SP15 index improper validation of specified index, position, or offset in input *************** 📎Link: https://vuldb.com/?id.310474 *************** ⚙️Information: #Vendor: IBM #Product: Tivoli Monitoring #Type: Directory Service Software #Risk: very critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Wed, 28 May 2025 20:38:36 +0200 *************** ✏️Title: CVE-2025-48147 | CryptoCloud Plugin up to 2.1.2 on WordPress authorization *************** 📎Link: https://vuldb.com/?id.310475 *************** ⚙️Information: #Product: CryptoCloud Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Wed, 28 May 2025 20:38:37 +0200 *************** ✏️Title: CVE-2025-47585 | Booking and Rental Manager Plugin up to 2.3.8 on WordPress authorization *************** 📎Link: https://vuldb.com/?id.310476 *************** ⚙️Information: #Product: Booking and Rental Manager Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Wed, 28 May 2025 20:38:46 +0200 *************** ✏️Title: CVE-2025-4583 | Smash Balloon Instagram Feed Plugin up to 6.9.0 on WordPress Attribute data-plugin cross site scripting *************** 📎Link: https://vuldb.com/?id.310477 *************** ⚙️Information: #Vendor: Smash Balloon #Product: Instagram Feed Plugin #Type: Social Network Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Wed, 28 May 2025 20:38:57 +0200 *************** ✏️Title: CVE-2025-48139 | StyleAI Plugin up to 1.0.4 on WordPress authorization *************** 📎Link: https://vuldb.com/?id.310478 *************** ⚙️Information: #Product: StyleAI Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Wed, 28 May 2025 18:15:23 +0000 *************** ✏️Title: CVE-2022-32233 - Cisco Internetwork Operating System (IOS) Remote Command Execution *************** 📎Link: https://cvefeed.io/vuln/detail/CVE-2022-32233 *************** ⚙️Tags: #Vulnerability #CVE #Exploit #POC *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Wed, 28 May 2025 18:15:23 +0000 *************** ✏️Title: CVE-2022-33893 - Apache HTTP Server Remote File Inclusion *************** 📎Link: https://cvefeed.io/vuln/detail/CVE-2022-33893 *************** ⚙️Tags: #Vulnerability #CVE #Exploit #POC *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security