Exploit / PoCcritical
⚡ Weekly Recap: Zero-Day Exploits, Developer Malware, IoT Botnets, and AI
- CVEs
- CVE-2025-29824CVE-2025-2775CVE-2025-2776CVE-2025-2777CVE-2025-2778CVE-2025-32819CVE-2025-32820CVE-2025-32821CVE-2025-20188CVE-2025-27007CVE-2025-24977CVE-2025-4372CVE-2025-25014CVE-2025-4318CVE-2024-56523CVE-2024-56524CVE-2025-27533CVE-2025-26168CVE-2025-26169CVE-2025-23123CVE-2024-8176CVE-2025-47188
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2024-56523+1 related CVE | Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by placing random data in the HTTP request… | 9.1 | <1% | ||
| CVE-2024-8176 | A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents | 7.5 | 1% | ||
| CVE-2025-20188 | Unauthenticated File Upload to Root RCE in Cisco IOS XE WLC (Hard-coded JWT) | 10.0 | 27% | PoC | |
| CVE-2025-23123 | A malicious actor with access to the management network could execute a remote code execution (RCE) by exploiting a heap buffer overflow vulnerability in the… | 10.0 | 1% | ||
| CVE-2025-24977 | OpenCTI: Prior to version 6.4.11 any user with the capability `manage customizations` can execute commands on the underlying… | 9.1 | <1% | ||
| CVE-2025-25014 | Prototype Pollution RCE in Elastic Kibana ML and Reporting Endpoints | 9.8 | 21% | ||
CVE-2025-26169+1 related CVE | IXON VPN Client before 1.4.4 on Windows allows Local Privilege Escalation to SYSTEM because there is code execution from a configuration file that can be… | 8.1 | <1% | ||
| CVE-2025-27007 | Privilege Escalation in Brainstorm Force OttoKit WordPress Plugin (≤ 1.0.82) | 9.8 | 51% | ||
| CVE-2025-27533 | Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ | 6.9 | 9% | ||
CVE-2025-2776+1 related CVE | Unauthenticated XXE in SysAid On-Prem Enables Admin Account Takeover | 9.8 group max | 65% | KEVPoC | KEV |
| CVE-2025-2777 | Unauthenticated XXE in SysAid On-Prem <= 23.3.40 Enables Admin Takeover | 9.8 | 73% | PoC | |
| CVE-2025-2778 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority | — | — | ||
| CVE-2025-29824 | Use-After-Free Privilege Escalation in Microsoft Windows CLFS Driver (Actively Exploited) | 7.8 | 19% | KEVRansomwarePoC ×2 | KEV |
CVE-2025-32819+2 related CVEs | A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete an arbitrary file… | 8.8 group max | 6% | PoC | |
| CVE-2025-4318 | The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation | 9.0 | <1% | ||
| CVE-2025-4372 | Use after free in WebAudio in Google Chrome prior to 136.0.7103.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page | 8.8 | <1% | ||
| CVE-2025-47188 | Unauthenticated Command Injection in Mitel 6800/6900 Series SIP Phones | 6.5 | 50% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 5socks.net | ntled a criminal proxy network, known as anyproxy[.]net and 5socks[.]net, that was powered by thousands of infected Internet of Th |
| domain | anyproxy.net | . authorities dismantled a criminal proxy network, known as anyproxy[.]net and 5socks[.]net, that was powered by thousands of infect |
| domain | ipresale.world | tors to a crypto scam website impersonating Apple's brand ("ipresale[.]world"). "The scam encourages visitors to create an account and |
| domain | megamodelstudio.com | n threat actors have been linked to covert infrastructure ("megamodelstudio[.]com") impersonating a German model agency. The site is design |
From the original article
13 min read at thehackernews.com
Ravie Lakshmanan May 12, 2025 Cybersecurity / Hacking News What do a source code editor, a smart billboard, and a web server have in common? They’ve all become launchpads for attacks—because cybercriminals are rethinking what counts as “infrastructure.”
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.