Sec WriteUp ~ CVE Alert

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 03 Jun 2025 18:32:04 +0200 *************** ✏️Title: CVE-2025-5542 | TOTOLINK X2000R 1.0.0-B20230726.1108 Virtual Server Page /boafrm/formPortFw service_type cross site scripting *************** 📎Link: https://vuldb.com/?id.310992 *************** ⚙️Information: #Vendor: TOTOLINK #Product: X2000R #Risk: problematic #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 03 Jun 2025 18:33:46 +0200 *************** ✏️Title: CVE-2025-5543 | TOTOLINK X2000R 1.0.0-B20230726.1108 Parent Controls Page Device Name cross site scripting *************** 📎Link: https://vuldb.com/?id.310993 *************** ⚙️Information: #Vendor: TOTOLINK #Product: X2000R #Risk: problematic #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 03 Jun 2025 18:37:25 +0200 *************** ✏️Title: CVE-2025-5544 | aaluoxiang oa_system up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5 UserpanelController.java image path traversal *************** 📎Link: https://vuldb.com/?id.310994 *************** ⚙️Information: #Vendor: aaluoxiang #Product: oa_system #Risk: problematic #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 03 Jun 2025 18:38:58 +0200 *************** ✏️Title: CVE-2025-5545 | aaluoxiang oa_system up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5 ProcedureController.java image path traversal *************** 📎Link: https://vuldb.com/?id.310995 *************** ⚙️Information: #Vendor: aaluoxiang #Product: oa_system #Risk: problematic #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 03 Jun 2025 18:41:17 +0200 *************** ✏️Title: CVE-2025-5546 | PHPGurukul Daily Expense Tracker System 1.1 expense-reports-detailed.php fromdate/todate sql injection *************** 📎Link: https://vuldb.com/?id.310996 *************** ⚙️Information: #Vendor: PHPGurukul #Product: Daily Expense Tracker System #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 03 Jun 2025 18:45:30 +0200 *************** ✏️Title: CVE-2025-5547 | FreeFloat FTP Server 1.0 CDUP Command buffer overflow *************** 📎Link: https://vuldb.com/?id.310997 *************** ⚙️Information: #Vendor: FreeFloat #Product: FTP Server #Type: File Transfer Software #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 03 Jun 2025 18:45:31 +0200 *************** ✏️Title: CVE-2025-5548 | FreeFloat FTP Server 1.0 NOOP Command buffer overflow *************** 📎Link: https://vuldb.com/?id.310998 *************** ⚙️Information: #Vendor: FreeFloat #Product: FTP Server #Type: File Transfer Software #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 03 Jun 2025 18:45:33 +0200 *************** ✏️Title: CVE-2025-5549 | FreeFloat FTP Server 1.0 PASV Command buffer overflow *************** 📎Link: https://vuldb.com/?id.310999 *************** ⚙️Information: #Vendor: FreeFloat #Product: FTP Server #Type: File Transfer Software #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 03 Jun 2025 18:45:34 +0200 *************** ✏️Title: CVE-2025-5550 | FreeFloat FTP Server 1.0 PBSZ Command buffer overflow *************** 📎Link: https://vuldb.com/?id.311000 *************** ⚙️Information: #Vendor: FreeFloat #Product: FTP Server #Type: File Transfer Software #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 03 Jun 2025 18:45:36 +0200 *************** ✏️Title: CVE-2025-5551 | FreeFloat FTP Server 1.0 SYSTEM Command buffer overflow *************** 📎Link: https://vuldb.com/?id.311001 *************** ⚙️Information: #Vendor: FreeFloat #Product: FTP Server #Type: File Transfer Software #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 03 Jun 2025 18:49:14 +0200 *************** ✏️Title: CVE-2025-5552 | ChestnutCMS up to 15.1 API Endpoint /dev-api/groovy/exec deserialization *************** 📎Link: https://vuldb.com/?id.311002 *************** ⚙️Information: #Product: ChestnutCMS #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 03 Jun 2025 18:50:05 +0200 *************** ✏️Title: CVE-2025-32105 | Sangoma IMG2020 HTTP server up to 2.3.9.6 buffer overflow *************** 📎Link: https://vuldb.com/?id.311003 *************** ⚙️Information: #Vendor: Sangoma #Product: IMG2020 HTTP server #Type: Web Server #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 03 Jun 2025 18:50:26 +0200 *************** ✏️Title: CVE-2025-32106 | Audiocodes Mediapack MP-11x up to 6.60A.369.002 HTTP POST Request improper authentication *************** 📎Link: https://vuldb.com/?id.311004 *************** ⚙️Information: #Vendor: Audiocodes #Product: Mediapack MP_11x #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 03 Jun 2025 18:53:17 +0200 *************** ✏️Title: CVE-2025-5553 | PHPGurukul Rail Pass Management System 1.0 /download-pass.php searchdata sql injection *************** 📎Link: https://vuldb.com/?id.311005 *************** ⚙️Information: #Vendor: PHPGurukul #Product: Rail Pass Management System #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 03 Jun 2025 18:53:20 +0200 *************** ✏️Title: CVE-2025-5554 | PHPGurukul Rail Pass Management System 1.0 pass-bwdates-reports-details.php fromdate/todate sql injection *************** 📎Link: https://vuldb.com/?id.311006 *************** ⚙️Information: #Vendor: PHPGurukul #Product: Rail Pass Management System #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 03 Jun 2025 18:59:34 +0200 *************** ✏️Title: CVE-2025-5556 | PHPGurukul Teacher Subject Allocation Management System 1.0 edit-teacher-info.php editid sql injection *************** 📎Link: https://vuldb.com/?id.311007 *************** ⚙️Information: #Vendor: PHPGurukul #Product: Teacher Subject Allocation Management System #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 03 Jun 2025 18:59:35 +0200 *************** ✏️Title: CVE-2025-5557 | PHPGurukul Teacher Subject Allocation Management System 1.0 /admin/edit-course.php editid sql injection *************** 📎Link: https://vuldb.com/?id.311008 *************** ⚙️Information: #Vendor: PHPGurukul #Product: Teacher Subject Allocation Management System #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 03 Jun 2025 18:59:37 +0200 *************** ✏️Title: CVE-2025-5558 | PHPGurukul Teacher Subject Allocation Management System 1.0 /admin/changeimage.php editid sql injection *************** 📎Link: https://vuldb.com/?id.311009 *************** ⚙️Information: #Vendor: PHPGurukul #Product: Teacher Subject Allocation Management System #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 03 Jun 2025 19:03:05 +0200 *************** ✏️Title: CVE-2025-5560 | PHPGurukul Curfew e-Pass Management System 1.0 /index.php searchdata sql injection *************** 📎Link: https://vuldb.com/?id.311010 *************** ⚙️Information: #Vendor: PHPGurukul #Product: Curfew e_Pass Management System #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 03 Jun 2025 19:03:07 +0200 *************** ✏️Title: CVE-2025-5561 | PHPGurukul Curfew e-Pass Management System 1.0 view-pass-detail.php viewid sql injection *************** 📎Link: https://vuldb.com/?id.311011 *************** ⚙️Information: #Vendor: PHPGurukul #Product: Curfew e_Pass Management System #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security