opsecsafe — cyber intelligence

2025-08-27

2025-08-27 17:03Z

HIGH

Referral Beware, Your Rewards are Mine (Part 1)

Rhino Security Labs·rhinosecuritylabs.com

Rhino Security Labs published a comprehensive analysis of security vulnerabilities in referral rewards programs across 20+ companies, identifying three common implementation patterns and discovering 25+ vulnerability classes including business logic flaws, race conditions, cookie injection, client-side path traversals, and a novel attack vector called referral hijacking via cookie fixation. The research demonstrates how attackers can steal referral rewards, hijack referral codes, and achieve XSS/CSRF through gadget chaining in client-side code.

SRFApplicationTACTA0001TACTA0006SRFWebTYPResearchTYPTechniqueSTGInitial AccessSTGCred Access

Edit Score

2025-08-26

2025-08-26 14:15Z

CRIT

CVE-2025-55526 — Zie619 N8n_workflow_collection: n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55526

n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function within api_server.py CVSSv3.1 9.1 (CRITICAL) · EPSS 54th percentile

CWECWE 22VNDZie619VNDMainTYPVulnerability

9.1

CVSS v3.1

Edit Score

2025-08-26

2025-08-26 14:15Z

HIGH

CVE-2025-50753 — Mitrastar: GPT-2741GNAC-N2 devices are provided with access through ssh into a restricted default shell.The

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-50753

Mitrastar GPT-2741GNAC-N2 devices are provided with access through ssh into a restricted default shell.The command "deviceinfo show file" is supposed to be used from restricted shell to show files and directories. By providing " /bin/sh" (quotes included) to the argument of this command will drop a root shell. CVSSv3.1 8.4 (HIGH) · EPSS 5th percentile

CWECWE 250VNDMitrastarTYPVulnerability

8.4

CVSS v3.1

Edit Score

2025-08-25

2025-08-25 18:15Z

HIGH

CVE-2025-50383 — Easyappointments Easy\!appointments: alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-50383

alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by parameter. CVSSv3.1 8.1 (HIGH) · EPSS 27th percentile

CWECWE 89VNDEasyappointmentsTYPVulnerability

8.1

CVSS v3.1

Edit Score

2025-08-25

2025-08-25 16:15Z

HIGH

CVE-2025-55409 — Foxcms Foxcms: 1.2.6, there is a Cross Site Scripting vulnerability in /index.php/article.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55409

FoxCMS 1.2.6, there is a Cross Site Scripting vulnerability in /index.php/article. This allows attackers to execute arbitrary code. CVSSv3.1 8.8 (HIGH) · EPSS 38th percentile

CWECWE 79VNDFoxcmsTYPVulnerability

8.8

CVSS v3.1

Edit Score

2025-08-25

2025-08-25 15:15Z

HIGH

CVE-2025-56216 — Phpgurukul Hospital_management_system: Hospital Management System 4.0 is vulnerable to SQL Injection in about-us.php via the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-56216

phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in about-us.php via the pagetitle parameter. CVSSv3.1 8.5 (HIGH)

CWECWE 89VNDPhpgurukulVNDHospitalTYPVulnerability

8.5

CVSS v3.1

Edit Score

2025-08-25

2025-08-25 15:15Z

CRIT

CVE-2025-56214 — Phpgurukul Hospital_management_system: Hospital Management System 4.0 is vulnerable to SQL Injection in index.php via the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-56214

phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in index.php via the username parameter. CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDPhpgurukulVNDHospitalTYPVulnerability

9.8

CVSS v3.1

Edit Score

2025-08-25

2025-08-25 15:15Z

CRIT

CVE-2025-56212 — Phpgurukul Hospital_management_system: Hospital Management System 4.0 is vulnerable to SQL Injection in add-doctor.php via the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-56212

phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in add-doctor.php via the docname parameter. CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDPhpgurukulVNDHospitalTYPVulnerability

9.8

CVSS v3.1

Edit Score

2025-08-23

2025-08-23 14:43Z

LOW

v3.4.10

Nuclei releases·github.com

Nuclei v3.4.10 released with a single bug fix addressing a segmentation fault in template caching logic. This is a maintenance release with no security implications or feature additions.

SRFApplicationVNDProjectdiscoveryTYPTool

Edit Score

2025-08-23

2025-08-23 07:15Z

CRIT

CVE-2025-5821 — Case: The Case Theme User plugin for WordPress is vulnerable to Authentication Bypass in all

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-5821

The Case Theme User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.3. This is due to the plugin not properly logging in a user with the data that was previously verified through the facebook_ajax_login_callback() function. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user CVSSv3.1 9.8 (CRITICAL)

CWECWE 288TYPVulnerability

9.8

CVSS v3.1

Edit Score

2025-08-23

2025-08-23 07:15Z

HIGH

CVE-2025-5060 — Bravis: The Bravis User plugin for WordPress is vulnerable to Authentication Bypass in all versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-5060

The Bravis User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.1. This is due to the plugin not properly logging a user in with the data that was previously verified through the facebook_ajax_login_callback(). This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site, and access to the administrative user's email. CVSSv3.1 8.1 (HIGH)

CWECWE 288VNDBravisTYPVulnerability

8.1

CVSS v3.1

Edit Score

2025-08-22

2025-08-22 17:15Z

CRIT

CVE-2025-57105 — Dlink Di-7400g\+_firmware: The DI-7400G+ router has a command injection vulnerability, which allows attackers to execute arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-57105

The DI-7400G+ router has a command injection vulnerability, which allows attackers to execute arbitrary commands on the device. The sub_478D28 function in in mng_platform.asp, and sub_4A12DC function in wayos_ac_server.asp of the jhttpd program, with the parameter ac_mng_srv_host. CVSSv3.1 9.8 (CRITICAL) · EPSS 88th percentile

CWECWE 77VNDDlinkTYPVulnerability

9.8

CVSS v3.1

100

Edit Score

2025-08-22

2025-08-22 16:15Z

CRIT

CVE-2025-38660 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: [ceph] parse_longname(): strrchr() expects

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38660

In the Linux kernel, the following vulnerability has been resolved: [ceph] parse_longname(): strrchr() expects NUL-terminated string ... and parse_longname() is not guaranteed that. That's the reason why it uses kmemdup_nul() to build the argument for kstrtou64(); the problem is, kstrtou64() is not the only thing that need it. Just get a NUL-terminated copy of the entire thing and be done with that... CVSSv3.1 9.8 (CRITICAL) · EPSS 5th percentile

TYPVulnerability

9.8

CVSS v3.1

Edit Score

2025-08-22

2025-08-22 16:15Z

HIGH

CVE-2025-38658 — Linux Linux_kernel: Description of the problem: nvmet_req_init() calls __nvmet_req_complete() internally upon failure, e.g., unsupported opcode, which

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38658

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: Do not complete commands twice if nvmet_req_init() fails Have nvmet_req_init() and req->execute() complete failed commands. Description of the problem: nvmet_req_init() calls __nvmet_req_complete() internally upon failure, e.g., unsupported opcode, which calls the "queue_response" callback, this results in nvmet_pci_epf_queue_response() being called, which will call nvmet_pci_epf_complete_i CVSSv3.1 8.8 (HIGH) · EPSS 4th percentile

CWECWE 908TYPVulnerability

8.8

CVSS v3.1

Edit Score

2025-08-22

2025-08-22 16:15Z

HIGH

CVE-2025-38643 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Add missing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38643

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() Callers of wdev_chandef() must hold the wiphy mutex. But the worker cfg80211_propagate_cac_done_wk() never takes the lock. Which triggers the warning below with the mesh_peer_connected_dfs test from hostapd and not (yet) released mac80211 code changes: WARNING: CPU: 0 PID: 495 at net/wireless/chan.c:1552 wdev_chandef+0x60/0x165 Modules linke CVSSv3.1 8.8 (HIGH) · EPSS 2th percentile

CWECWE 667TYPVulnerability

8.8

CVSS v3.1

Edit Score

2025-08-22

2025-08-22 15:09Z

INFO

v3.4.9

Nuclei releases·github.com

Nuclei v3.4.9 released with a minor bug fix addressing output event handling for skipped hosts. This is a routine maintenance release with no security implications or feature additions.

SRFApplicationVNDProjectdiscoveryTYPTool

Edit Score

2025-08-22

2025-08-22 14:15Z

HIGH

CVE-2024-58239 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: tls: stop recv() if

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-58239

In the Linux kernel, the following vulnerability has been resolved: tls: stop recv() if initial process_rx_list gave us non-DATA If we have a non-DATA record on the rx_list and another record of the same type still on the queue, we will end up merging them: - process_rx_list copies the non-DATA record - we start the loop and process the first available record since it's of the same type - we break out of the loop since the record was not DATA Just check the record ty CVSSv3.1 8.2 (HIGH)

TYPVulnerability

8.2

CVSS v3.1

Edit Score

2025-08-21

2025-08-21 15:15Z

CRIT

CVE-2025-53251 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in An-Themes Pin WP pin-wp allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-53251

Unrestricted Upload of File with Dangerous Type vulnerability in An-Themes Pin WP pin-wp allows Upload a Web Shell to a Web Server.This issue affects Pin WP: from n/a through < 7.2. CVSSv3.1 9.9 (CRITICAL)

CWECWE 434TYPVulnerability

9.9

CVSS v3.1

100

Edit Score

2025-08-21

2025-08-21 14:15Z

HIGH

CVE-2025-55370 — Jishenghua Jsherp: Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55370

Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID data by modifying the ID value. CVSSv3.1 8.8 (HIGH) · EPSS 32th percentile

CWECWE 639VNDJishenghuaTYPVulnerability

8.8

CVSS v3.1

Edit Score

2025-08-21

2025-08-21 14:15Z

HIGH

CVE-2025-55368 — Jishenghua Jsherp: Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55368

Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account. CVSSv3.1 8.8 (HIGH) · EPSS 32th percentile

CWECWE 284VNDJishenghuaTYPVulnerability

8.8

CVSS v3.1

Edit Score

2025-08-20

2025-08-20 16:15Z

CRIT

CVE-2010-20103 — Proftpd Proftpd: This allows remote, unauthenticated attackers to run any OS command on the FTP server

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2010-20103

A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host. CVSSv3.1 9.8 (CRITICAL) · EPSS 91th percentile

CWECWE 912VNDProftpdTYPVulnerability

9.8

CVSS v3.1

100

Edit Score

2025-08-20

2025-08-20 09:15Z

HIGH

CVE-2025-5260 — Server: Server-Side Request Forgery (SSRF) vulnerability in Pik Online Yazılım Çözümleri A.Ş.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-5260

Server-Side Request Forgery (SSRF) vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Server Side Request Forgery. This issue affects Pik Online: before 3.1.5. CVSSv3.1 8.6 (HIGH) · EPSS 25th percentile

CWECWE 918TYPVulnerability

8.6

CVSS v3.1

Edit Score

2025-08-20

2025-08-20 08:15Z

HIGH

CVE-2025-54735 — Incorrect: Privilege Assignment vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Privilege Escalation.This issue affects

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-54735

Incorrect Privilege Assignment vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Privilege Escalation.This issue affects CubeWP: from n/a through <= 1.1.24. CVSSv3.1 8.8 (HIGH)

CWECWE 266TYPVulnerability

8.8

CVSS v3.1

Edit Score

2025-08-20

2025-08-20 08:15Z

CRIT

CVE-2025-54726 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-54726

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows SQL Injection.This issue affects JS Archive List: from n/a through < 6.1.6. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability

9.3

CVSS v3.1

Edit Score

2025-08-20

2025-08-20 08:15Z

CRIT

CVE-2025-54713 — Authentication: Bypass Using an Alternate Path or Channel vulnerability in magepeopleteam Taxi Booking Manager

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-54713

Authentication Bypass Using an Alternate Path or Channel vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Authentication Abuse.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.3.0. CVSSv3.1 9.8 (CRITICAL)

CWECWE 288TYPVulnerability

9.8

CVSS v3.1

Edit Score

Latest intel// live feed

Referral Beware, Your Rewards are Mine (Part 1)

CVE-2025-55526 — Zie619 N8n_workflow_collection: n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow

CVE-2025-50753 — Mitrastar: GPT-2741GNAC-N2 devices are provided with access through ssh into a restricted default shell.The

CVE-2025-50383 — Easyappointments Easy\!appointments: alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by

CVE-2025-55409 — Foxcms Foxcms: 1.2.6, there is a Cross Site Scripting vulnerability in /index.php/article.

CVE-2025-56216 — Phpgurukul Hospital_management_system: Hospital Management System 4.0 is vulnerable to SQL Injection in about-us.php via the

CVE-2025-56214 — Phpgurukul Hospital_management_system: Hospital Management System 4.0 is vulnerable to SQL Injection in index.php via the

CVE-2025-56212 — Phpgurukul Hospital_management_system: Hospital Management System 4.0 is vulnerable to SQL Injection in add-doctor.php via the

v3.4.10

CVE-2025-5821 — Case: The Case Theme User plugin for WordPress is vulnerable to Authentication Bypass in all

CVE-2025-5060 — Bravis: The Bravis User plugin for WordPress is vulnerable to Authentication Bypass in all versions

CVE-2025-57105 — Dlink Di-7400g\+_firmware: The DI-7400G+ router has a command injection vulnerability, which allows attackers to execute arbitrary

CVE-2025-38660 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: [ceph] parse_longname(): strrchr() expects

CVE-2025-38658 — Linux Linux_kernel: Description of the problem: nvmet_req_init() calls __nvmet_req_complete() internally upon failure, e.g., unsupported opcode, which

CVE-2025-38643 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Add missing

v3.4.9

CVE-2024-58239 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: tls: stop recv() if

CVE-2025-53251 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in An-Themes Pin WP pin-wp allows

CVE-2025-55370 — Jishenghua Jsherp: Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to

CVE-2025-55368 — Jishenghua Jsherp: Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to

CVE-2010-20103 — Proftpd Proftpd: This allows remote, unauthenticated attackers to run any OS command on the FTP server

CVE-2025-5260 — Server: Server-Side Request Forgery (SSRF) vulnerability in Pik Online Yazılım Çözümleri A.Ş.

CVE-2025-54735 — Incorrect: Privilege Assignment vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Privilege Escalation.This issue affects

CVE-2025-54726 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

CVE-2025-54713 — Authentication: Bypass Using an Alternate Path or Channel vulnerability in magepeopleteam Taxi Booking Manager