Sec WriteUp ~ CVE Alert

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 26 May 2025 22:38:51 +0200 *************** ✏️Title: CVE-2025-5232 | PHPGurukul Student Study Center Management System 1.0 /admin/report.php fromdate/todate sql injection *************** 📎Link: https://vuldb.com/?id.310331 *************** ⚙️Information: #Vendor: PHPGurukul #Product: Student Study Center Management System #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 07:39:36 +0200 *************** ✏️Title: CVE-2025-48827 | vBulletin up to 5.7.5/6.0.3 api.php?method=protectedMethod improper protection of alternate path *************** 📎Link: https://vuldb.com/?id.310332 *************** ⚙️Information: #Product: vBulletin #Type: Forum Software #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 07:39:56 +0200 *************** ✏️Title: CVE-2025-48828 | vBulletin 6.0.3 Template improper protection of alternate path *************** 📎Link: https://vuldb.com/?id.310333 *************** ⚙️Information: #Product: vBulletin #Type: Forum Software #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 07:40:56 +0200 *************** ✏️Title: CVE-2025-33079 | IBM Controller/Cognos Controller 11.0.0/11.0.1/11.1.0 credentials storage *************** 📎Link: https://vuldb.com/?id.310334 *************** ⚙️Information: #Vendor: IBM #Product: Controller/Cognos Controller #Type: Business Process Management Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 07:41:15 +0200 *************** ✏️Title: CVE-2025-48054 | radashi up to 12.5.0 set path prototype pollution (GHSA-2xv9-ghh9-xc69) *************** 📎Link: https://vuldb.com/?id.310335 *************** ⚙️Information: #Product: radashi #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 07:43:17 +0200 *************** ✏️Title: CVE-2025-48382 | codelibs fess up to 14.19.1 org.codelibs.fess.helper.SystemHelper createTempFile permission assignment (GHSA-g88v-2j67-9rmx) *************** 📎Link: https://vuldb.com/?id.310336 *************** ⚙️Information: #Vendor: codelibs #Product: fess #Risk: problematic #Local: Yes #Remote: No #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 07:43:29 +0200 *************** ✏️Title: CVE-2025-48742 | SIGB PMB prior 8.0.1.2 Installer missing authentication *************** 📎Link: https://vuldb.com/?id.310337 *************** ⚙️Information: #Vendor: SIGB #Product: PMB #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 07:43:35 +0200 *************** ✏️Title: CVE-2025-48743 | SIGB PMB prior 8.0.1.2 sql injection *************** 📎Link: https://vuldb.com/?id.310338 *************** ⚙️Information: #Vendor: SIGB #Product: PMB #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 07:43:44 +0200 *************** ✏️Title: CVE-2025-48744 | SIGB PMB prior 8.0.1.2 path traversal *************** 📎Link: https://vuldb.com/?id.310339 *************** ⚙️Information: #Vendor: SIGB #Product: PMB #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 07:43:55 +0200 *************** ✏️Title: CVE-2025-26211 | Gibbon up to 28.x cross-site request forgery *************** 📎Link: https://vuldb.com/?id.310340 *************** ⚙️Information: #Product: Gibbon #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 07:45:03 +0200 *************** ✏️Title: CVE-2025-5117 | Property Plugin 1.0.5/1.0.6 on WordPress property_package_user_role authorization *************** 📎Link: https://vuldb.com/?id.310341 *************** ⚙️Information: #Product: Property Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 09:34:24 +0200 *************** ✏️Title: CVE-2024-38866 | Nagvis up to 1.9.46 livestatus delimiters *************** 📎Link: https://vuldb.com/?id.310342 *************** ⚙️Information: #Product: Nagvis #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 09:34:31 +0200 *************** ✏️Title: CVE-2024-47090 | Nagvis up to 1.9.46 cross site scripting *************** 📎Link: https://vuldb.com/?id.310343 *************** ⚙️Information: #Product: Nagvis #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 10:06:37 +0200 *************** ✏️Title: CVE-2025-23393 | SUSE Manager Server Module 4.3 cross site scripting *************** 📎Link: https://vuldb.com/?id.310344 *************** ⚙️Information: #Vendor: SUSE #Product: Manager Server Module #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 10:07:31 +0200 *************** ✏️Title: CVE-2025-2407 | Mobatime AMX MTAPI/AMXGT-100 Web API missing authentication *************** 📎Link: https://vuldb.com/?id.310345 *************** ⚙️Information: #Vendor: Mobatime #Product: AMX MTAPI/AMXGT_100 #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 10:12:13 +0200 *************** ✏️Title: CVE-2025-5244 | GNU Binutils up to 2.44 ld bfd/elflink.c elf_gc_sweep memory corruption (Bug 32858) *************** 📎Link: https://vuldb.com/?id.310346 *************** ⚙️Information: #Vendor: GNU #Product: Binutils #Type: Programming Tool Software #Risk: critical #Local: Yes #Remote: No #Exploit: Yes #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 10:12:17 +0200 *************** ✏️Title: CVE-2025-5245 | GNU Binutils up to 2.44 objdump /binutils/debug.c debug_type_samep memory corruption (Bug 32829) *************** 📎Link: https://vuldb.com/?id.310347 *************** ⚙️Information: #Vendor: GNU #Product: Binutils #Type: Programming Tool Software #Risk: critical #Local: Yes #Remote: No #Exploit: Yes #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 10:13:31 +0200 *************** ✏️Title: CVE-2025-5246 | Campcodes Online Hospital Management System 1.0 query-details.php adminremark sql injection *************** 📎Link: https://vuldb.com/?id.310348 *************** ⚙️Information: #Vendor: Campcodes #Product: Online Hospital Management System #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 10:16:35 +0200 *************** ✏️Title: CVE-2025-5247 | Gowabby HFish 0.1 \view\url.go LoadUrl r improper authentication *************** 📎Link: https://vuldb.com/?id.310349 *************** ⚙️Information: #Vendor: Gowabby #Product: HFish #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 10:18:36 +0200 *************** ✏️Title: CVE-2025-5248 | PHPGurukul Company Visitor Management System 1.0 bwdates-reports-details.php fromdate/todate sql injection *************** 📎Link: https://vuldb.com/?id.310350 *************** ⚙️Information: #Vendor: PHPGurukul #Product: Company Visitor Management System #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security