Published: 2025-12-03 Overview This blog post details a critical security vulnerability, identified as CVE-2025-57198, affecting AVTECH SECURITY Corporation DGM1104 devices (specifically FullImg-1015-1004-1006-1003). This vulnerability is a command injection flaw found in the Machine.cgi endpoint. Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary commands on the affected device. Technical Details The command injection vulnerability exists in the Machine.cgi endpoint of the AVTECH DGM1104. An attacker can leverage this flaw by crafting a malicious input that injects shell commands into the system’s execution process. Since authentication is required, an attacker must first gain valid credentials to exploit this…

Overview A critical pre-authentication remote code execution (RCE) vulnerability, identified as CVE-2025-55182, has been discovered in React Server Components (RSC). This vulnerability affects versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, specifically within the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages. Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the server without authentication. Given the ease of exploitation and potential impact, immediate action is required to mitigate this risk. Technical Details The vulnerability stems from the unsafe deserialization of payloads received from HTTP requests directed to Server Function endpoints. The affected versions of React Server Components inadequately sanitize or…

Overview CVE-2025-65267 details a stored Cross-Site Scripting (XSS) vulnerability affecting ERPNext v15.83.2 and Frappe Framework v15.86.0. This vulnerability stems from the improper validation of uploaded SVG avatar images. An attacker can embed malicious JavaScript within an SVG file, which then executes when an administrator views the avatar image. This could lead to severe consequences, including account takeover, privilege escalation, and complete compromise of the ERPNext instance. Technical Details The vulnerability lies in the insufficient sanitization of SVG avatar images uploaded by users. The affected software fails to adequately strip potentially harmful JavaScript code embedded within the SVG markup. Specifically, when…

Overview CVE-2025-57200 details a critical command injection vulnerability found in AVTECH SECURITY Corporation’s DGM1104 series. Specifically, the vulnerability resides within the test_mail function. An attacker with valid authentication credentials can exploit this flaw to execute arbitrary commands on the underlying system. This vulnerability poses a significant risk to the confidentiality, integrity, and availability of the device and potentially the network it resides on. Technical Details The vulnerability stems from improper input sanitization within the test_mail function. By crafting a malicious input, an authenticated user can inject operating system commands into the function’s parameters. The DGM1104 device, failing to adequately validate…

Overview A high-severity privilege escalation vulnerability, identified as CVE-2025-53841, has been discovered in the Akamai Guardicore Platform Agent. This vulnerability allows an unprivileged user to elevate their privileges to SYSTEM, potentially leading to complete system compromise. This affects versions before 50.15.0, 51.12.0, and 52.1.1. It is crucial to update your Guardicore agents immediately to mitigate this risk. Technical Details CVE-2025-53841 stems from an unspecified flaw within the Akamai Guardicore Platform Agent’s handling of user privileges. The vulnerability allows a local, unprivileged user to execute arbitrary code with SYSTEM-level permissions. While the specific exploitation method isn’t publicly detailed (likely to prevent…

Overview CVE-2025-13949 describes an unrestricted file upload vulnerability identified in ProudMuBai GoFilm versions 1.0.0 and 1.0.1. This vulnerability resides within the SingleUpload function of the /server/controller/FileController.go file. Successful exploitation allows remote attackers to upload arbitrary files to the server, potentially leading to code execution, data exfiltration, or denial-of-service attacks. The vulnerability is considered MEDIUM severity and has a CVSS score of 6.3. Unfortunately, the vendor was contacted regarding this issue but has not provided any response. Technical Details The vulnerability stems from insufficient validation of the File argument passed to the SingleUpload function. Specifically, the application fails to adequately check…

Overview CVE-2025-13948 identifies a medium severity vulnerability within the opsre go-ldap-admin project, specifically affecting versions up to 20251011. The issue stems from the potential use of a hardcoded cryptographic key related to JWT handling. An attacker could potentially exploit this by manipulating the ‘secret key’ argument, leading to unauthorized access or data manipulation. The vulnerability is remotely exploitable but considered difficult to exploit. Technical Details The vulnerability resides within the JWT Handler component of go-ldap-admin. The specific area of concern is the docs/docker-compose/docker-compose.yaml file. By manipulating the secret key argument used during JWT creation, an attacker can potentially force the…

Overview A stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2025-13401, has been discovered in the Autoptimize plugin for WordPress. This vulnerability affects all versions up to and including 3.1.13. It allows authenticated attackers with Contributor-level access or higher to inject malicious JavaScript code into website pages. When a user visits a page containing the injected script, the script will execute, potentially leading to account compromise, data theft, or other malicious actions. Technical Details The vulnerability resides within the create_img_preload_tag function related to the LCP (Largest Contentful Paint) Image preloading metabox. Insufficient input sanitization and output escaping of user-supplied image attributes…

Overview A critical security vulnerability, identified as CVE-2025-13390, has been discovered in the WP Directory Kit plugin for WordPress. This vulnerability affects all versions up to and including 1.4.4. Due to a flaw in the authentication algorithm, unauthenticated attackers can bypass authentication, gain administrative access, and potentially achieve complete site takeover. This is a high-severity issue that requires immediate attention. Technical Details The vulnerability lies within the wdk_generate_auto_login_link function of the WP Directory Kit plugin. This function is responsible for generating auto-login links, allowing users to access the site without manually entering their credentials. However, the implementation uses a cryptographically…

Overview CVE-2025-13359 identifies a significant security vulnerability affecting the “Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI” (TaxoPress) plugin for WordPress. This flaw allows authenticated attackers with Contributor-level access or higher to perform time-based SQL Injection attacks. This vulnerability exists in versions up to and including 3.40.1. Technical Details The vulnerability resides within the getTermsForAjax function. Insufficient input validation and escaping of user-supplied parameters, combined with a lack of adequate preparation in the existing SQL query, enable attackers to inject malicious SQL code. Specifically, an attacker can manipulate parameters passed to this function to inject arbitrary SQL queries.…