CVE-2025-13184: Undefined Security Weakness

Unauthenticated Telnet enablement via cstecgi.cgi auth bypass leading to unauthenticated root login with a blank password on factory/reset X5000R V9.1.0u.6369B20230113 arbitrary command execution. Earlier versions that share the same implementation, may also be affected...

CVE-2025-66039 FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target us...

@nocobase/devtools (>=1.9.0, <=1.9.22), @nocobase/server (>=1.9.0, <=1.9.22) +1 more potentially affected by CVE-2025-13877 via @nocobase/auth (>=1.9.0, <=1.9.22)

@nocobase/auth NPM version =1.9.0, =1.9.0, =1.9.0, =1.9.0, =1.9.22 Source cves: CVE-2025-13877 Source advisory: OSV:GHSA-MV7P-34FV-4874...

@nocobase/devtools (>=2.0.0-alpha.2, <=2.0.0-alpha.51), @nocobase/server (>=2.0.0-alpha.2, <=2.0.0-alpha.51) +1 more potentially affected by CVE-2025-13877 via @nocobase/auth (>=2.0.0-alpha.2, <=2.0.0-alpha.51)

@nocobase/auth NPM version =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0-alpha.51 Source cves: CVE-2025-13877 Source advisory: SNYK:JS-NOCOBASEAUTH-14287473...

@nocobase/devtools (>=2.0.0-alpha.2, <=2.0.0-alpha.51), @nocobase/server (>=2.0.0-alpha.2, <=2.0.0-alpha.51) +1 more potentially affected by CVE-2025-13877 via @nocobase/auth (>=2.0.0-alpha.2, <=2.0.0-alpha.51)

@nocobase/auth NPM version =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0-alpha.51 Source cves: CVE-2025-13877 Source advisory: GHSA-MV7P-34FV-4874...

@nocobase/devtools (>=2.0.0-alpha.2, <=2.0.0-alpha.51), @nocobase/server (>=2.0.0-alpha.2, <=2.0.0-alpha.51) +1 more potentially affected by CVE-2025-13877 via @nocobase/auth (>=2.0.0-alpha.2, <=2.0.0-alpha.51)

@nocobase/auth NPM version =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0-alpha.51 Source cves: CVE-2025-13877 Source advisory: OSV:GHSA-MV7P-34FV-4874...

@nocobase/app (>=1.0.0-alpha.1, <=1.4.0-alpha.20240914095808), @nocobase/cli (>=1.0.0-alpha.1, <=1.4.0-alpha.20240914095808) +3 more potentially affected by CVE-2025-13877 via @nocobase/auth (>=1.0.0-alpha.1, <=1.9.0-beta.17)

@nocobase/auth NPM version =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.9.0-beta.17 Source cves: CVE-2025-13877 Source advisory: GHSA-MV7P-34FV-4874...

@nocobase/app (>=1.0.0-alpha.1, <=1.4.0-alpha.20240914095808), @nocobase/cli (>=1.0.0-alpha.1, <=1.4.0-alpha.20240914095808) +3 more potentially affected by CVE-2025-13877 via @nocobase/auth (>=1.0.0-alpha.1, <=1.9.0-beta.17)

@nocobase/auth NPM version =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.9.0-beta.17 Source cves: CVE-2025-13877 Source advisory: OSV:GHSA-MV7P-34FV-4874...

@nocobase/devtools (>=1.9.0, <=1.9.21), @nocobase/server (>=1.9.0, <=1.9.21) +1 more potentially affected by CVE-2025-13877 via @nocobase/auth (>=1.9.0, <=1.9.21)

@nocobase/auth NPM version =1.9.0, =1.9.0, =1.9.0, =1.9.0, =1.9.21 Source cves: CVE-2025-13877 Source advisory: GHSA-MV7P-34FV-4874...

@nocobase/devtools (>=1.9.0, <=1.9.21), @nocobase/server (>=1.9.0, <=1.9.21) +1 more potentially affected by CVE-2025-13877 via @nocobase/auth (>=1.9.0, <=1.9.21)

@nocobase/auth NPM version =1.9.0, =1.9.0, =1.9.0, =1.9.0, =1.9.21 Source cves: CVE-2025-13877 Source advisory: SNYK:JS-NOCOBASEAUTH-14287473...

@nocobase/app (>=1.0.0-alpha.1, <=1.4.0-alpha.20240914095808), @nocobase/cli (>=1.0.0-alpha.1, <=1.4.0-alpha.20240914095808) +3 more potentially affected by CVE-2025-13877 via @nocobase/auth (>=1.0.0-alpha.1, <=1.9.0-beta.17)

@nocobase/auth NPM version =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.9.0-beta.17 Source cves: CVE-2025-13877 Source advisory: SNYK:JS-NOCOBASEAUTH-14287473...

CVE-2025-14192

A vulnerability was found in RashminDungrani online-banking up to 2337ad552ea9d385b4e07b90e6f32d011b7c68a2. This affects an unknown part of the file /site/dist/authlogin.php. Performing manipulation of the argument Username results in sql injection. The attack can be initiated remotely. The explo...

EUVD-2023-60068

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: mcq: Fix &hwq-cqlock deadlock issue When ufshcderrhandler is executed, CQ event interrupt can enter waiting for the same lock. This can happen in ufshcdhandlemcqcqevents and also in ufsmtkmcqintr. The following...

📄 Craft CMS 5.0 Logic Flaw

A flaw in the Craft CMS image transform endpoint allows an unauthenticated attacker to trigger backend processing without prior authentication. While the original Metasploit module targeted remote code execution, this proof of concept does not execute code, does not write files, and does not inje...

Linux RPC Kernel Heap Buffer Overflow DoS

The vulnerability of the xdrstreamdecodeopaqueauth function in the net/sunrpc/authgss/svcauthgss.c module of the Linux operating system’s RPC implementation is related to the swapping of pointers. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CVE-2025-14192 RashminDungrani online-banking auth_login.php sql injection

A vulnerability was found in RashminDungrani online-banking up to 2337ad552ea9d385b4e07b90e6f32d011b7c68a2. This affects an unknown part of the file /site/dist/authlogin.php. Performing manipulation of the argument Username results in sql injection. The attack can be initiated remotely. The explo...

Online Banking website vulnerable to PHP SQL injection attacks

Online Banking website using PHP is an online banking website by Rashmin Personal Developer. A SQL injection vulnerability exists in Online Banking website using PHP, which stems from incorrect manipulation of the parameter Username in the file /site/dist/authlogin.php, which can lead to SQL...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 A modified and a...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 - React Server Components RCE Scanner !Severi...

Metasploit Wrap-Up 12/05/2025

Twonky Auth Bypass, RCEs and RISC-V Reverse Shell Payloads This was another fantastic week in terms of PR contribution to the Metasploit Framework. Rapid7’s very own Ryan Emmons recently disclosed CVE-2025-13315 and CVE-2025-13316 which exist in Twonky Server and allow decrypting admin credential...