Sec WriteUp ~ CVE Alert

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 09 Jun 2025 08:15:25 +0200 *************** ✏️Title: CVE-2025-5887 | jsnjfz WebStack-Guns 1.0 File Upload UserMgrController.java cross site scripting *************** 📎Link: https://vuldb.com/?id.311658 *************** ⚙️Information: #Vendor: jsnjfz #Product: WebStack_Guns #Risk: problematic #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 09 Jun 2025 08:15:27 +0200 *************** ✏️Title: CVE-2025-5888 | jsnjfz WebStack-Guns 1.0 cross-site request forgery *************** 📎Link: https://vuldb.com/?id.311659 *************** ⚙️Information: #Vendor: jsnjfz #Product: WebStack_Guns #Risk: problematic #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 09 Jun 2025 08:24:28 +0200 *************** ✏️Title: CVE-2025-5889 | juliangruber brace-expansion up to 1.1.11 index.js expand redos *************** 📎Link: https://vuldb.com/?id.311660 *************** ⚙️Information: #Vendor: juliangruber #Product: brace_expansion #Risk: problematic #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 09 Jun 2025 08:31:07 +0200 *************** ✏️Title: CVE-2025-5890 | actions toolkit 0.5.0 glob internal-pattern.ts globEscape redos (ID 2057) *************** 📎Link: https://vuldb.com/?id.311661 *************** ⚙️Information: #Vendor: actions #Product: toolkit #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 09 Jun 2025 08:33:37 +0200 *************** ✏️Title: CVE-2025-5891 | Unitech pm2 up to 6.0.6 /lib/tools/Config.js redos (ID 5971) *************** 📎Link: https://vuldb.com/?id.311662 *************** ⚙️Information: #Vendor: Unitech #Product: pm2 #Risk: problematic #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 09 Jun 2025 08:39:38 +0200 *************** ✏️Title: CVE-2025-5892 | RocketChat up to 7.6.1 parseMessage.js parseMessage line redos (ID 35711) *************** 📎Link: https://vuldb.com/?id.311663 *************** ⚙️Information: #Product: RocketChat #Type: Chat Software #Risk: problematic #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 09 Jun 2025 08:44:13 +0200 *************** ✏️Title: CVE-2025-3581 | Newsletter Plugin up to 8.8.4 on WordPress Widget Option cross site scripting *************** 📎Link: https://vuldb.com/?id.311664 *************** ⚙️Information: #Product: Newsletter Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 09 Jun 2025 08:44:14 +0200 *************** ✏️Title: CVE-2025-3582 | Newsletter Plugin up to 8.84 on WordPress Form Setting cross site scripting *************** 📎Link: https://vuldb.com/?id.311665 *************** ⚙️Information: #Product: Newsletter Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 09 Jun 2025 08:44:19 +0200 *************** ✏️Title: CVE-2025-4652 | Broadstreet Plugin up to 1.51.7 on WordPress cross site scripting *************** 📎Link: https://vuldb.com/?id.311666 *************** ⚙️Information: #Product: Broadstreet Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 09 Jun 2025 08:52:20 +0200 *************** ✏️Title: CVE-2025-5895 | Metabase 54.10 dom.js parseDataUri redos (ID 57011) *************** 📎Link: https://vuldb.com/?id.311667 *************** ⚙️Information: #Product: Metabase #Risk: problematic #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 09 Jun 2025 08:58:45 +0200 *************** ✏️Title: CVE-2025-5896 | tarojs taro up to 4.1.1 index.js redos (ID 17619) *************** 📎Link: https://vuldb.com/?id.311668 *************** ⚙️Information: #Vendor: tarojs #Product: taro #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 09 Jun 2025 09:07:21 +0200 *************** ✏️Title: CVE-2025-5897 | vuejs vue-cli up to 5.0.8 Markdown Code HtmlPwaPlugin.js HtmlPwaPlugin redos (ID 7478) *************** 📎Link: https://vuldb.com/?id.311669 *************** ⚙️Information: #Vendor: vuejs #Product: vue_cli #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

📌#WriteUp Community *************** 🗓Date: Mon, 09 Jun 2025 05:04:02 GMT *************** ✏️Title: How I bypassed the same open redirect endpoint not once, not twice… but FOUR times *************** 📎Link: https://medium.com/p/1299a56c75f4 *************** ⚙️Tags: #open_redirect #hacking #bug_bounty_writeup #bug_bounty *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

📌#WriteUp Community *************** 🗓Date: Mon, 09 Jun 2025 05:41:52 GMT *************** ✏️Title: Global Cybersecurity Threat Landscape — April 2025 *************** 📎Link: https://medium.com/p/fa9b6bb1e103 *************** ⚙️Tags: #cyber_threat #hacker #cybersecurity #cyberattack #hacking *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

📌#WriteUp Community *************** 🗓Date: Mon, 09 Jun 2025 05:42:09 GMT *************** ✏️Title: Fortinet Strengthens SASE Portfolio with Strategic Acquisition of Israeli SaaS Security Pioneer… *************** 📎Link: https://medium.com/p/df4e2563277b *************** ⚙️Tags: #cyberattack #hacker #cybersecurity #hacking #cybercrime *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

📌#WriteUp Community *************** 🗓Date: Mon, 09 Jun 2025 05:43:14 GMT *************** ✏️Title: Why In-House Isn’t Always the Best Strategy in Cybersecurity *************** 📎Link: https://medium.com/p/26ce93cab5b8 *************** ⚙️Tags: #hacking #hacker #cybersecurity #nationalism #cyberattack *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

📌#WriteUp Community *************** 🗓Date: Mon, 09 Jun 2025 05:21:45 GMT *************** ✏️Title: How a Simple Git Leak Led to AWS Keys & Database Credentials *************** 📎Link: https://medium.com/p/1f24ed5bd665 *************** ⚙️Tags: #bug_bounty #cybersecurity #pentesting *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

📌#WriteUp Community *************** 🗓Date: Mon, 09 Jun 2025 05:36:45 GMT *************** ✏️Title: Everything You Need to Know About XSS — with AI Prompts *************** 📎Link: https://medium.com/p/438a76ed695f *************** ⚙️Tags: #bug_bounty #infosec #ai #xss_attack #cybersecurity *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

📌#WriteUp Community *************** 🗓Date: Mon, 09 Jun 2025 05:34:23 GMT *************** ✏️Title: Bypassing Rewrite Rules in Web Servers + WAF Bypass for bug Bounties *************** 📎Link: https://medium.com/p/ec885c1b2630 *************** ⚙️Tags: #bug_bounty_tips #bug_bounty #waf_bypass #penetration_testing *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

📌#WriteUp Community *************** 🗓Date: Mon, 09 Jun 2025 04:47:43 GMT *************** ✏️Title: PicoCTF writeup — Java code analysis!?! *************** 📎Link: https://medium.com/p/2eead1ac07a7 *************** ⚙️Tags: #picoctf #ctf #jwt #ethical_hacking #cybersecurity *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security