Sec WriteUp ~ CVE Alert

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 11 Feb 2025 07:32:28 +0100 *************** ✏️Title: CVE-2024-12599 | devitemsllc HT Mega Plugin up to 2.8.1 on WordPress cross site scripting *************** 📎Link: https://vuldb.com/?id.295177 *************** ⚙️Information: #Vendor: devitemsllc #Product: HT Mega Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 11 Feb 2025 07:32:29 +0100 *************** ✏️Title: CVE-2024-13570 | Stray Random Quotes Plugin up to 1.9.9 on WordPress cross site scripting *************** 📎Link: https://vuldb.com/?id.295178 *************** ⚙️Information: #Vendor: Stray #Product: Random Quotes Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 11 Feb 2025 07:32:30 +0100 *************** ✏️Title: CVE-2024-13544 | Zarinpal Paid Download Plugin up to 2.3 on WordPress unrestricted upload *************** 📎Link: https://vuldb.com/?id.295179 *************** ⚙️Information: #Vendor: Zarinpal #Product: Paid Download Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 11 Feb 2025 07:32:45 +0100 *************** ✏️Title: CVE-2025-1211 | hackney 0.0.0 server-side request forgery (SNYK-HEX-HACKNEY-6516131) *************** 📎Link: https://vuldb.com/?id.295180 *************** ⚙️Information: #Product: hackney #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 11 Feb 2025 07:33:03 +0100 *************** ✏️Title: CVE-2025-1144 | Quanxun School Affairs System exposure of sensitive system information to an unauthorized control sphere *************** 📎Link: https://vuldb.com/?id.295181 *************** ⚙️Information: #Vendor: Quanxun #Product: School Affairs System #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 11 Feb 2025 07:33:12 +0100 *************** ✏️Title: CVE-2024-13543 | Zarinpal Paid Download Plugin up to 2.3 on WordPress cross site scripting *************** 📎Link: https://vuldb.com/?id.295182 *************** ⚙️Information: #Vendor: Zarinpal #Product: Paid Download Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 11 Feb 2025 07:33:34 +0100 *************** ✏️Title: CVE-2025-1143 | Billion Electric M100/M150/M120N/M500 prior 1.04.1.592.10/1.04.1.613.14/1.04.1.676 SSH Service hard-coded credentials *************** 📎Link: https://vuldb.com/?id.295183 *************** ⚙️Information: #Vendor: Billion Electric #Product: M100/M150/M120N/M500 #Risk: critical #Local: Yes #Remote: No #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 11 Feb 2025 07:36:03 +0100 *************** ✏️Title: CVE-2025-24869 | SAP NetWeaver Application Server Java WD-RUNTIME 7.50 authorization *************** 📎Link: https://vuldb.com/?id.295184 *************** ⚙️Information: #Vendor: SAP #Product: NetWeaver Application Server Java #Type: Application Server Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 11 Feb 2025 07:36:04 +0100 *************** ✏️Title: CVE-2025-23193 | SAP NetWeaver Server ABAP up to 758 observable response discrepancy *************** 📎Link: https://vuldb.com/?id.295185 *************** ⚙️Information: #Vendor: SAP #Product: NetWeaver Server ABAP #Type: Solution Stack Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 11 Feb 2025 07:36:17 +0100 *************** ✏️Title: CVE-2025-24874 | SAP Commerce Backoffice COM_CLOUD 2211/HY_COM 2205 Header X-Frame-Options ui layer *************** 📎Link: https://vuldb.com/?id.295186 *************** ⚙️Information: #Vendor: SAP #Product: Commerce Backoffice #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 11 Feb 2025 07:36:18 +0100 *************** ✏️Title: CVE-2025-0054 | SAP NetWeaver Application Server Java 7.50 cross site scripting *************** 📎Link: https://vuldb.com/?id.295187 *************** ⚙️Information: #Vendor: SAP #Product: NetWeaver Application Server Java #Type: Application Server Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 11 Feb 2025 07:37:00 +0100 *************** ✏️Title: CVE-2025-24868 | SAP HANA SAP_EXTENDED_APP_SERVICES 1 Extended Application Services/Advanced Model redirect *************** 📎Link: https://vuldb.com/?id.295188 *************** ⚙️Information: #Vendor: SAP #Product: HANA #Type: Database Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 11 Feb 2025 07:37:16 +0100 *************** ✏️Title: CVE-2025-24870 | SAP GUI 8.00 on Windows RFC Service missing access control *************** 📎Link: https://vuldb.com/?id.295189 *************** ⚙️Information: #Vendor: SAP #Product: GUI #Risk: problematic #Local: Yes #Remote: No #Exploit: No #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 11 Feb 2025 07:37:39 +0100 *************** ✏️Title: CVE-2025-24872 | SAP ABAP Platform up to 758 Build Framework authorization *************** 📎Link: https://vuldb.com/?id.295190 *************** ⚙️Information: #Vendor: SAP #Product: ABAP Platform #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 11 Feb 2025 07:37:56 +0100 *************** ✏️Title: CVE-2025-0064 | SAP BusinessObjects Business Intelligence platform Central Management Console permission assignment *************** 📎Link: https://vuldb.com/?id.295191 *************** ⚙️Information: #Vendor: SAP #Product: BusinessObjects Business Intelligence platform #Type: Business Process Management Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 11 Feb 2025 07:38:31 +0100 *************** ✏️Title: CVE-2025-23190 | SAP NetWeaver and ABAP Platform 740/2008_1_700/2008_1_710 ST-PI authorization *************** 📎Link: https://vuldb.com/?id.295192 *************** ⚙️Information: #Vendor: SAP #Product: NetWeaver and ABAP Platform #Type: Solution Stack Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 11 Feb 2025 07:39:16 +0100 *************** ✏️Title: CVE-2025-23191 | SAP Fiori for ERP up to 758 SAP OData Endpoint http headers for scripting syntax *************** 📎Link: https://vuldb.com/?id.295193 *************** ⚙️Information: #Vendor: SAP #Product: Fiori for ERP #Type: Enterprise Resource Planning Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 11 Feb 2025 07:40:31 +0100 *************** ✏️Title: CVE-2025-24876 | SAP Approuter Node.js Package up to 16.7.1 redirect *************** 📎Link: https://vuldb.com/?id.295194 *************** ⚙️Information: #Vendor: SAP #Product: Approuter Node.js Package #Type: JavaScript Library #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 11 Feb 2025 07:41:43 +0100 *************** ✏️Title: CVE-2025-25243 | SAP Supplier Relationship Management 7.52 Master Data Management Catalog path traversal *************** 📎Link: https://vuldb.com/?id.295195 *************** ⚙️Information: #Vendor: SAP #Product: Supplier Relationship Management #Type: Supplier Relationship Management Software #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 11 Feb 2025 07:42:17 +0100 *************** ✏️Title: CVE-2025-23187 | SAP NetWeaver and ABAP Platform 740/2008_1_700/2008_1_710 SDCCN authorization *************** 📎Link: https://vuldb.com/?id.295196 *************** ⚙️Information: #Vendor: SAP #Product: NetWeaver and ABAP Platform #Type: Solution Stack Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security