Metasploit Weekly Wrap-Up 09/19/2025

Consistently Persistent The Metasploit Framework has around 26 different modules which can be used to establish persistence on a target. Persistence modules help operators ensure they can maintain a consistent foothold within an environment once a target has been compromised and are quite helpful...

Multiple Node.js Modules compromised in supply chain attack to steal crypto (08/09/2025)

The remote host has a version of one or more Node.js modules installed known to be compromised in a supply chain attack. The following Node.js modules are known to be affected: 'backslash', 'chalk', 'debug', 'chalk-template', 'supports-hyperlinks', 'has-ansi', 'simple-swizzle', 'color-string',...

CVE-2025-10673

A vulnerability was determined in itsourcecode Student Information Management System 1.0. The impacted element is an unknown function of the file /admin/modules/class/index.php. This manipulation of the argument classId causes sql injection. The attack may be initiated remotely. The exploit has...

CVE-2025-10673 itsourcecode Student Information Management System index.php sql injection

A vulnerability was determined in itsourcecode Student Information Management System 1.0. The impacted element is an unknown function of the file /admin/modules/class/index.php. This manipulation of the argument classId causes sql injection. The attack may be initiated remotely. The exploit has...

[SECURITY] Fedora 42 Update: lemonldap-ng-2.21.3-1.fc42

LemonLdap::NG is a modular Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application. It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection for your web space as...

Itsourcecode Student Information Management System SQL Injection Vulnerability

itsourcecode Student Information Management System is itsourcecode open source student information management system. Itsourcecode Student Information Management System version 1.0 has a SQL injection vulnerability, the vulnerability stems from the wrong operation of the parameter classId in the...

CVE-2025-8999

The Sydney theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'activatemodules' function in all versions up to, and including, 2.56. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate...

SUSE-SU-2025:20750-1 Security update for pam

This update for pam fixes the following issues: - CVE-2024-10041: Fixed hashed password leak bsc1232234...

CVE-2025-8999 Sydney <= 2.56 - Missing Authorization to Authenticated (Subscriber+) Limited Theme Options Update

The Sydney theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'activatemodules' function in all versions up to, and including, 2.56. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate...

CVE-2025-8999 Sydney <= 2.56 - Missing Authorization to Authenticated (Subscriber+) Limited Theme Options Update

The Sydney theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'activatemodules' function in all versions up to, and including, 2.56. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate...

PT-2025-38145

Name of the Vulnerable Software and Affected Versions: Sydney theme for WordPress versions prior to 2.57 Description: The Sydney theme for WordPress is susceptible to unauthorized data modification due to a missing capability check on the activate modules function. This allows authenticated...

Linux-astra-modules Kernel Module DoS

The vulnerability of the initparsecsecid function in the linux-astra-modules kernel module is related to improper memory release after its use. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux kernel-module Heap Buffer Overflow DoS

The vulnerability of the pdpmlcmp function in the Linux-Astra-Modules kernel module is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux-Astra-Modules Module Heap Buffer Overflow DoS

The vulnerability of the pdpmlgetfromuser function in the Linux-astra-modules kernel module is related to improper memory release after its use. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux-astra-modules Kernel Module Heap Buffer Overflow DoS

The vulnerability of the parsec inodepostxattr function in the linux-astra-modules kernel module is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux-Astra-Modules Kernel Module Heap Buffer Overflow DoS

The vulnerability of the pdpmlgetnew function in the Linux-Astra-Modules kernel module is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

linux-astra-modules Kernel Module DoS

The vulnerability of the pdplPut function in the linux-astra-modules kernel module is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux-astra-modules Kernel Buffer Overflow DoS

The vulnerability of the parsec inodegetsecid function in the linux-astra-modules kernel module is related to improper memory release after its use. Exploiting this vulnerability could allow an attacker to cause a service failure...

linux-astra-modules Kernel Module Heap Buffer Overflow DoS

The vulnerability of the pdplgetnewinitmr function in the linux-astra-modules kernel module is related to improper memory release after its use. Exploiting this vulnerability could allow an attacker to cause a service failure...

linux-astra-modules Kernel Module Use-After-Free DoS

The vulnerability of the pcomparemnt function in the Linux-astra-modules kernel module is related to reading data from beyond the allowed buffer size. Exploiting this vulnerability can allow an attacker to access confidential data and also cause service interruptions...