Sec WriteUp ~ CVE Alert

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 15:00:23 +0200 *************** ✏️Title: CVE-2025-4053 | Be-Tech Mifare Classic Card cleartext storage *************** 📎Link: https://vuldb.com/?id.310286 *************** ⚙️Information: #Vendor: Be_Tech #Product: Mifare Classic Card #Risk: problematic #Local: Partially #Remote: No #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 15:00:37 +0200 *************** ✏️Title: CVE-2025-4683 | MStore API Plugin up to 4.17.5 on WordPress create_blog authorization *************** 📎Link: https://vuldb.com/?id.310287 *************** ⚙️Information: #Product: MStore API Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 15:00:47 +0200 *************** ✏️Title: CVE-2025-4783 | timstrifler Exclusive Addons for Elementor Plugin 2.7.9.1 on WordPress Countdown Timer Widget cross site scripting *************** 📎Link: https://vuldb.com/?id.310288 *************** ⚙️Information: #Vendor: timstrifler #Product: Exclusive Addons for Elementor Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 15:08:45 +0200 *************** ✏️Title: CVE-2025-5200 | Open Asset Import Library Assimp 5.4.3 MDLLoader.cpp InternReadFile_Quake1 out-of-bounds (Issue 6172) *************** 📎Link: https://vuldb.com/?id.310289 *************** ⚙️Information: #Vendor: Open Asset Import Library #Product: Assimp #Type: Software Library #Risk: problematic #Local: Yes #Remote: No #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 15:08:47 +0200 *************** ✏️Title: CVE-2025-5201 | Open Asset Import Library Assimp 5.4.3 LWOLoader.cpp CountVertsAndFacesLWO2 out-of-bounds (Issue 6173) *************** 📎Link: https://vuldb.com/?id.310290 *************** ⚙️Information: #Vendor: Open Asset Import Library #Product: Assimp #Type: Software Library #Risk: problematic #Local: Yes #Remote: No #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 15:08:48 +0200 *************** ✏️Title: CVE-2025-5202 | Open Asset Import Library Assimp 5.4.3 HL1MDLLoader.cpp validate_header out-of-bounds (Issue 6174) *************** 📎Link: https://vuldb.com/?id.310291 *************** ⚙️Information: #Vendor: Open Asset Import Library #Product: Assimp #Type: Software Library #Risk: problematic #Local: Yes #Remote: No #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 15:08:50 +0200 *************** ✏️Title: CVE-2025-5203 | Open Asset Import Library Assimp 5.4.3 ParsingUtils.h SkipSpaces out-of-bounds (Issue 6175) *************** 📎Link: https://vuldb.com/?id.310292 *************** ⚙️Information: #Vendor: Open Asset Import Library #Product: Assimp #Type: Software Library #Risk: problematic #Local: Yes #Remote: No #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 15:08:51 +0200 *************** ✏️Title: CVE-2025-5204 | Open Asset Import Library Assimp 5.4.3 MDLMaterialLoader.cpp ParseSkinLump_3DGS_MDL7 out-of-bounds (Issue 6176) *************** 📎Link: https://vuldb.com/?id.310293 *************** ⚙️Information: #Vendor: Open Asset Import Library #Product: Assimp #Type: Software Library #Risk: problematic #Local: Yes #Remote: No #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 15:09:52 +0200 *************** ✏️Title: CVE-2025-40653 | M3M Printer Server Web Authentication information exposure *************** 📎Link: https://vuldb.com/?id.310294 *************** ⚙️Information: #Vendor: M3M #Product: Printer Server Web #Type: Printing Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 15:10:04 +0200 *************** ✏️Title: CVE-2025-40664 | TCMAN GIM 11 GetData missing authentication *************** 📎Link: https://vuldb.com/?id.310295 *************** ⚙️Information: #Vendor: TCMAN #Product: GIM #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 15:10:16 +0200 *************** ✏️Title: CVE-2025-40666 | TCMAN GIM 11 frmPreventivosList.aspx ArbolID sql injection *************** 📎Link: https://vuldb.com/?id.310296 *************** ⚙️Information: #Vendor: TCMAN #Product: GIM #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 15:10:16 +0200 *************** ✏️Title: CVE-2025-40665 | TCMAN GIM 11 frmCorrectivosList.aspx ArbolID sql injection *************** 📎Link: https://vuldb.com/?id.310297 *************** ⚙️Information: #Vendor: TCMAN #Product: GIM #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 15:10:31 +0200 *************** ✏️Title: CVE-2025-40667 | TCMAN GIM 11 hdnReadOnly/hdnUserLogin authorization *************** 📎Link: https://vuldb.com/?id.310298 *************** ⚙️Information: #Vendor: TCMAN #Product: GIM #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 15:10:52 +0200 *************** ✏️Title: CVE-2025-40650 | Clickedu Student Report Card authorization *************** 📎Link: https://vuldb.com/?id.310299 *************** ⚙️Information: #Product: Clickedu #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 15:11:13 +0200 *************** ✏️Title: CVE-2025-40652 | CoverManager cross site scripting *************** 📎Link: https://vuldb.com/?id.310300 *************** ⚙️Information: #Product: CoverManager #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 15:11:39 +0200 *************** ✏️Title: CVE-2025-40663 | i2A Cronos 23.02.01.17 SVG Image Parser PersonalDocuments cross site scripting *************** 📎Link: https://vuldb.com/?id.310301 *************** ⚙️Information: #Vendor: i2A #Product: Cronos #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 15:14:10 +0200 *************** ✏️Title: CVE-2025-5205 | 1000 Projects Daily College Class Work Report Book 1.0 /dcwr_entry.php Date sql injection *************** 📎Link: https://vuldb.com/?id.310302 *************** ⚙️Information: #Vendor: 1000 Projects #Product: Daily College Class Work Report Book #Type: Reporting Software #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 15:17:30 +0200 *************** ✏️Title: CVE-2025-5206 | Pixelimity 1.0 Installation /install/index.php site_description sql injection *************** 📎Link: https://vuldb.com/?id.310303 *************** ⚙️Information: #Product: Pixelimity #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 15:20:50 +0200 *************** ✏️Title: CVE-2025-5207 | SourceCodester Client Database Management System 1.0 superadmin_update_profile.php nickname sql injection *************** 📎Link: https://vuldb.com/?id.310304 *************** ⚙️Information: #Vendor: SourceCodester #Product: Client Database Management System #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 15:23:47 +0200 *************** ✏️Title: CVE-2025-5208 | SourceCodester Online Hospital Management System 1.0 check_availability.php emailid sql injection *************** 📎Link: https://vuldb.com/?id.310305 *************** ⚙️Information: #Vendor: SourceCodester #Product: Online Hospital Management System #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security