Sec WriteUp ~ CVE Alert

📌#WriteUp Community *************** 🗓Date: Fri, 06 Jun 2025 21:13:54 GMT *************** ✏️Title: ADCS Attack Series: Abusing ESC9 for Privilege Escalation via Weak Certificate Mapping *************** 📎Link: https://medium.com/p/d625aceb5942 *************** ⚙️Tags: #red_team #infosec #pentesting #security #hacking *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

📌#WriteUp Community *************** 🗓Date: Fri, 06 Jun 2025 21:17:20 GMT *************** ✏️Title: TryHackMe: Daily Bugle Walkthrough *************** 📎Link: https://medium.com/p/075d478e597a *************** ⚙️Tags: #hackthebox #ejpt #walkthrough #oscp_preparation #tryhackme *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 06 Jun 2025 15:45:37 +0200 *************** ✏️Title: CVE-2025-28954 | wphobby Backwp Plugin up to 2.0.2 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.311526 *************** ⚙️Information: #Vendor: wphobby #Product: Backwp Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 06 Jun 2025 15:45:40 +0200 *************** ✏️Title: CVE-2025-29005 | weblizar HR Management Lite Plugin up to 3.3 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.311527 *************** ⚙️Information: #Vendor: weblizar #Product: HR Management Lite Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 06 Jun 2025 15:45:43 +0200 *************** ✏️Title: CVE-2025-30629 | Codehaveli Bitly URL Shortener Plugin up to 1.3.3 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.311528 *************** ⚙️Information: #Vendor: Codehaveli #Product: Bitly URL Shortener Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 06 Jun 2025 15:45:46 +0200 *************** ✏️Title: CVE-2025-30632 | pozzad Global Translator Plugin up to 2.0.2 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.311529 *************** ⚙️Information: #Vendor: pozzad #Product: Global Translator Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 06 Jun 2025 15:45:49 +0200 *************** ✏️Title: CVE-2025-30968 | jokerbr313 Advanced Post List Plugin up to 0.5.6.2 on WordPress cross-site request forgery (EUVD-2025-17224) *************** 📎Link: https://vuldb.com/?id.311530 *************** ⚙️Information: #Vendor: jokerbr313 #Product: Advanced Post List Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 06 Jun 2025 15:48:02 +0200 *************** ✏️Title: CVE-2025-30981 | tggfref WP-Recall Plugin up to 16.26.14 on WordPress cross-site request forgery (EUVD-2025-17230) *************** 📎Link: https://vuldb.com/?id.311531 *************** ⚙️Information: #Vendor: tggfref #Product: WP_Recall Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 06 Jun 2025 15:48:16 +0200 *************** ✏️Title: CVE-2025-49440 | Vuong Nguyen WP Security Master Plugin up to 1.0.2 on WordPress cross-site request forgery (EUVD-2025-17146) *************** 📎Link: https://vuldb.com/?id.311532 *************** ⚙️Information: #Vendor: Vuong Nguyen #Product: WP Security Master Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 06 Jun 2025 15:48:17 +0200 *************** ✏️Title: CVE-2025-28950 | David Shabtai Post Author Plugin up to 1.1.1 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.311533 *************** ⚙️Information: #Vendor: David Shabtai #Product: Post Author Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 06 Jun 2025 15:48:18 +0200 *************** ✏️Title: CVE-2025-49446 | minhlaobao Admin Notes Plugin up to 1.1 on WordPress cross-site request forgery (EUVD-2025-17150) *************** 📎Link: https://vuldb.com/?id.311534 *************** ⚙️Information: #Vendor: minhlaobao #Product: Admin Notes Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 06 Jun 2025 15:48:18 +0200 *************** ✏️Title: CVE-2025-28986 | Webaholicson Epicwin Plugin up to 1.5 on WordPress cross-site request forgery (EUVD-2025-17177) *************** 📎Link: https://vuldb.com/?id.311535 *************** ⚙️Information: #Vendor: Webaholicson #Product: Epicwin Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 06 Jun 2025 15:48:19 +0200 *************** ✏️Title: CVE-2025-28974 | mail250 Free WP Mail SMTP Plugin up to 1.0 on WordPress cross-site request forgery (EUVD-2025-17173) *************** 📎Link: https://vuldb.com/?id.311536 *************** ⚙️Information: #Vendor: mail250 #Product: Free WP Mail SMTP Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 06 Jun 2025 15:48:20 +0200 *************** ✏️Title: CVE-2025-28958 | Vadim Bogaiskov Bg Orthodox Calendar Plugin up to 0.13.10 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.311537 *************** ⚙️Information: #Vendor: Vadim Bogaiskov #Product: Bg Orthodox Calendar Plugin #Type: Calendar Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 06 Jun 2025 15:48:21 +0200 *************** ✏️Title: CVE-2025-49425 | Adrian Hanft Konami Easter Egg Plugin up to 0.4 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.311538 *************** ⚙️Information: #Vendor: Adrian Hanft #Product: Konami Easter Egg Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 06 Jun 2025 15:48:22 +0200 *************** ✏️Title: CVE-2025-30995 | OTWthemes Widgetize Pages Light Plugin up to 3.0 on WordPress OTWthemes Widgetize Page cross-site request forgery (EUVD-2025-17236) *************** 📎Link: https://vuldb.com/?id.311539 *************** ⚙️Information: #Vendor: OTWthemes #Product: Widgetize Pages Light Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 06 Jun 2025 15:48:22 +0200 *************** ✏️Title: CVE-2025-28981 | Soli WP Mail Options Plugin up to 0.2.3 on WordPress cross-site request forgery (EUVD-2025-17174) *************** 📎Link: https://vuldb.com/?id.311540 *************** ⚙️Information: #Vendor: Soli #Product: WP Mail Options Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 06 Jun 2025 15:48:23 +0200 *************** ✏️Title: CVE-2025-30986 | CreativeMedia Elite Video Player Plugin up to 10.0.5 on WordPress cross-site request forgery (EUVD-2025-17231) *************** 📎Link: https://vuldb.com/?id.311541 *************** ⚙️Information: #Vendor: CreativeMedia #Product: Elite Video Player Plugin #Type: Multimedia Player Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 06 Jun 2025 15:48:24 +0200 *************** ✏️Title: CVE-2025-49453 | Jatinder Pal Singh BP Profile as Homepage Plugin up to 1.1 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.311542 *************** ⚙️Information: #Vendor: Jatinder Pal Singh #Product: BP Profile as Homepage Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 06 Jun 2025 15:48:36 +0200 *************** ✏️Title: CVE-2025-28964 | mangup Personal Favicon Plugin up to 2.0 on WordPress cross-site request forgery *************** 📎Link: https://vuldb.com/?id.311543 *************** ⚙️Information: #Vendor: mangup #Product: Personal Favicon Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security