Metasploit Wrap-Up 11/07/2025

New module content 3 Centreon authenticated command injection leading to RCE via broker engine "reload" parameter Author: h00die-gr3y [email protected] Type: Exploit Pull request: 20672 contributed by h00die-gr3y Path: linux/http/centreonauthrcecve20255946 AttackerKB reference: CVE-2025-5946...

From Log4j to IIS, China's Hackers Turn Legacy Bugs into Global Espionage Tools

A China-linked threat actor has been attributed to a cyber attack targeting an U.S. non-profit organization with an aim to establish long-term persistence, as part of broader activity aimed at U.S. entities that are linked to or involved in policy issues. The organization, according to a report...

PT-2025-45495

Name of the Vulnerable Software and Affected Versions Sourcecodester AI-Powered To-Do List App version 1.0 Description The application is susceptible to Cross-Site Scripting XSS attacks. Specifically, the "Task Title" and "Description Optional" fields are vulnerable when creating a new task. An...

CVE-2025-63638

The Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. Specifically, the "Task Title" and "Description (Optional)" fields do not adequately validate input when creating a new task. An attack...

CVE-2025-63638: Improper Neutralization of Input During Web Page Generation

Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting XSS in the "Task Title" and "Description Optional" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicki...

CVE-2025-63638

Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting XSS in the "Task Title" and "Description Optional" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicki...

CVE-2025-63638

Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting XSS in the "Task Title" and "Description Optional" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicki...

PT-2025-52907

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A race condition exists in the SmartPQI SCSI driver within the Linux kernel during device removal. Specifically, a scheduled work item to reset a LUN could execute after the device was...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990392)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990392 advisory. In the Linux kernel, the following vulnerability has been resolved: w1: fix WARNING after calling w1process I got the following WARNING message while removing...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990620)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990620 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix hungtask for PADATARESET We found a hungtask bug in testaeadveccfg as...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990578)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990578 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix abort all task initialization In pm80xxsendabortall, the nelem field of the ccb...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989843)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989843 advisory. In the Linux kernel, the following vulnerability has been resolved: m68k: Fix spinlock race in kernel thread creation Context switching does take care to retain the...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989735)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989735 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix abort all task initialization In pm80xxsendabortall, the nelem field of the ccb...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989183)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989183 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Guard against accessing NULL ptregs in bpfgettaskstack taskptregs can return NULL on powerpc...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990055)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990055 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free for aborted SSP/STP sastask Currently a use-after-free may occur...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989415)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989415 advisory. In the Linux kernel, the following vulnerability has been resolved: sched/scs: Reset task stack state in bringupcpu To hot unplug a CPU, the idle task on that CPU...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989638)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989638 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix tag leaks on error In pm8001chipsetdevstatereq, pm8001chipfwflashupdatereq,...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989928)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989928 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix abort all task initialization In pm80xxsendabortall, the nelem field of the ccb...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989182)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989182 advisory. In the Linux kernel, the following vulnerability has been resolved: fs/proc: taskmmu.c: don't read mapcount for migration entry The syzbot reported the below BUG:...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989636)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989636 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Fix refcount issue when LOGO is received during TMF Hung task call trace was seen...