1623 matches found
CVE-2025-11071 SeaCMS Cron Task Management admin_cron.php sql injection
A security vulnerability has been detected in SeaCMS 13.3.20250820. Impacted is an unknown function of the file /admincron.php of the component Cron Task Management Module. The manipulation of the argument resourcefrom/collectID leads to sql injection. The attack can be initiated remotely. The...
CVE-2025-9894
CVE-2025-9894 affects the Sync Feedly WordPress plugin (versions
CVE-2025-9894 Sync Feedly <= 1.0.1 - Cross-Site Request Forgery to Sync Trigger
The Sync Feedly plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the crsfcronjobfunc function. This makes it possible for unauthenticated attackers to trigger content synchronizati...
PT-2025-39736
Name of the Vulnerable Software and Affected Versions SeaCMS version 13.3.20250820 Description A security issue exists in SeaCMS 13.3.20250820 related to the Cron Task Management Module. The issue involves SQL injection triggered by manipulating the collectID argument within the /admin cron.php...
SeaCMS SQL注入漏洞
SeaCMS is a free, open source web content management system written in PHP by SeaCMS, Inc. The system is primarily designed to manage video-on-demand resources. A SQL injection vulnerability exists in SeaCMS version 13.3.20250820, which stems from incorrect manipulation of the parameter...
PT-2025-39714
Name of the Vulnerable Software and Affected Versions Sync Feedly plugin for WordPress versions prior to 1.0.2 Description The software is susceptible to a Cross-Site Request Forgery issue. This is due to a lack of proper nonce validation within the crsf cron job func function. An unauthenticated...
Metasploit Wrap-Up 09/26/2025
New module content 2 Cron Persistence Author: h00die [email protected] Type: Exploit Pull request: 20508 contributed by h00die Path: multi/persistence/cron Description: Update cron persistence to use the new mixin. FreePBX ajax.php authenticated SQLi to RCE Authors: EchoSlow, Piotr...
FreePBX ajax.php unauthenticated SQLi to RCE
This module exploits an unauthenticated SQL injection flaw in FreePBX prior to versions 15.0.66, 16.0.89, and 17.0.3. The vulnerability lies in the /admin/ajax.php endpoint, which is accessible without authentication. Additionally, the database user created by FreePBX can schedule cronjobs,...
📄 aaPanel 7.x.x Remote Command Execution
aaPanel version 7.x.x suffers from an authenticated remote command execution vulnerability. This was discovered prior and noted in CVE-2020-14421 where it states that it affects versions 6.6.6 and below. The developers claim it is patched but it still affects the 7.x.x version. This is...
Cron Persistence
This module will create a cron or crontab entry to execute a payload. The module includes the ability to automatically clean up those entries to prevent multiple executions. syslog will get a copy of the cron entry. Verified on Ubuntu 22.04.1, MacOS 13.7.4 Module Options msf use...
Linux Distros Unpatched Vulnerability : CVE-2023-22622
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes...
Linux Distros Unpatched Vulnerability : CVE-2020-5202
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - apt-cacher-ng through 3.3 allows local users to obtain sensitive information by hijacking the hardcoded TCP port. The /usr/lib/apt-cacher-ng/acngtool program...
Linux Distros Unpatched Vulnerability : CVE-2019-9706
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service use- after-free and daemon crash because of a forcerescanuser...
CVE-2025-33120
IBM QRadar SIEM 7.5 through 7.5.0 UP13 could allow an authenticated user to escalate their privileges via a misconfigured cronjob due to execution with unnecessary privileges...
PT-2025-34370 · Ibm · Qradar Siem
Name of the Vulnerable Software and Affected Versions: IBM QRadar SIEM versions 7.5 through 7.5.0 UP13 Description: IBM QRadar SIEM versions 7.5 through 7.5.0 UP13 may allow an authenticated user to escalate their privileges. This is due to a misconfigured cronjob that executes with unnecessary...
Malicious code in eta-xml-wind-parse-cron (npm)
The package eta-xml-wind-parse-cron was found to contain malicious code...
Malicious code in air-cron-moon-compress-hash (npm)
The package air-cron-moon-compress-hash was found to contain malicious code...
Malicious code in promise-cron-key-sudo-analyze (npm)
The package promise-cron-key-sudo-analyze was found to contain malicious code...