Red-Team

CVE-2025-0628 – BerriAI Litellm Privilege Escalation Vulnerability

Exploitation

CVE-2025-0628 – BerriAI Litellm Privilege Escalation Vulnerability

A critical privilege escalation vulnerability, CVE-2025-0628, has been identified in the BerriAI/litellm application. This flaw allows users...

CVE-2024-9701 – Kedro ShelveStore Remote Code Execution Vulnerability

Exploitation

CVE-2024-9701 – Kedro ShelveStore Remote Code Execution Vulnerability

A critical vulnerability, CVE-2024-9701, has been identified in the Kedro ShelveStore class (version 0.19.8), a component of...

CVE-2024-9919 – Parisneo Lollms Webui Missing Authentication Check Directory Traversal Vulnerability

Exploitation

CVE-2024-9919 – Parisneo Lollms Webui Missing Authentication Check Directory Traversal Vulnerability

A high-severity vulnerability, CVE-2024-9919, has been identified in the parisneo/lollms-webui software, specifically in version V13. This vulnerability...

CVE-2025-2303 – Block Logic – WordPress Full Gutenberg Block Display Control Remote Code Execution

Exploitation

CVE-2025-2303 – Block Logic – WordPress Full Gutenberg Block Display Control Remote Code Execution

TL;DR CVE-2025-2303: A critical vulnerability in the Block Logic WordPress plugin allows authenticated attackers with Contributor-level access...

CVE-2024-9880 – Apache Pandas Command Injection Vulnerability

Exploitation

CVE-2024-9880 – Apache Pandas Command Injection Vulnerability

TL;DR CVE-2024-9880: A high-severity command injection vulnerability in Apache Pandas’ DataFrame.query function. Affected Versions: All versions up...

CVE-2025-0452 – Eosphoros-ai DB-GPT Windows File Deletion Vulnerability

Exploitation

CVE-2025-0452 – Eosphoros-ai DB-GPT Windows File Deletion Vulnerability

A newly disclosed vulnerability, CVE-2025-0452, has been identified in the latest version of eosphoros-ai/DB-GPT, a popular database...

CVE-2025-23120 – Veeam Backup & Replication RCE Vulnerability

Exploitation

CVE-2025-23120 – Veeam Backup & Replication RCE Vulnerability

TL;DR CVE-2025-23120: A critical remote code execution (RCE) vulnerability in Veeam Backup & Replication. Severity: 9.9 (CRITICAL)...

Exploiting CVE-2025-29927: A Red-Teamer’s Guide to Next.js Middleware Bypass

Exploitation

Exploiting CVE-2025-29927: A Red-Teamer’s Guide to Next.js Middleware Bypass

Next.js middleware, a cornerstone of modern web applications, faces a critical security threat. CVE-2025-29927 exposes a severe...

CVE-2024-9847 – FlatPress CMS CSRF Attack

Exploitation

CVE-2024-9847 – FlatPress CMS CSRF Attack

A critical vulnerability, CVE-2024-9847, has been identified in FlatPress CMS, a lightweight blogging platform. The flaw, classified...

CVE-2025-1040: AutoGPT Vulnerability Exposes Systems to Remote Code Execution via SSTI

Exploitation

CVE-2025-1040: AutoGPT Vulnerability Exposes Systems to Remote Code Execution via SSTI

TL;DR CVE ID: CVE-2025-1040 Severity: High (CVSS 8.8) Affected Versions: AutoGPT 0.3.4 and earlier Vulnerability Type: Server-Side...

Cobalt Strike 4.11: Shhhhhh, Beacon is Sleeping….

Fig. 1 – A screenshot showing the results of Get-InjectedThreadEx scanning a process into which a 4.11 Beacon has just been injected.

C2-Updates

Cobalt Strike 4.11: Shhhhhh, Beacon is Sleeping….

DNS Over HTTPS Beacon The new DoH implementation blends DNS C2 with legitimate web traffic: Default configuration...

CVE-2025-29927 – Next.js Authorization Bypass in Middleware

Exploitation

CVE-2025-29927 – Next.js Authorization Bypass in Middleware

Vulnerability: A critical authorization bypass flaw (CVE-2025-29927) has been identified in Next.js, a popular React framework. Severity:...

Posts pagination

Previous 1 … 3 4 5 6

Red-Team

CVE-2025-0628 – BerriAI Litellm Privilege Escalation Vulnerability

CVE-2024-9701 – Kedro ShelveStore Remote Code Execution Vulnerability

CVE-2024-9919 – Parisneo Lollms Webui Missing Authentication Check Directory Traversal Vulnerability

CVE-2025-2303 – Block Logic – WordPress Full Gutenberg Block Display Control Remote Code Execution

CVE-2024-9880 – Apache Pandas Command Injection Vulnerability

CVE-2025-0452 – Eosphoros-ai DB-GPT Windows File Deletion Vulnerability

CVE-2025-23120 – Veeam Backup & Replication RCE Vulnerability

Exploiting CVE-2025-29927: A Red-Teamer’s Guide to Next.js Middleware Bypass

CVE-2024-9847 – FlatPress CMS CSRF Attack

CVE-2025-1040: AutoGPT Vulnerability Exposes Systems to Remote Code Execution via SSTI

Cobalt Strike 4.11: Shhhhhh, Beacon is Sleeping….

CVE-2025-29927 – Next.js Authorization Bypass in Middleware

You may have missed

YesWiki Path Traversal Vulnerability (CVE-2025-31131): Technical Analysis and Mitigation

Critical SQL Injection Vulnerability in Next-Cart Store to WooCommerce Migration Plugin (CVE-2025-30807)

WpTravelly Plugin Vulnerability Exposes WordPress Sites to Object Injection Attacks

Critical SQL Injection Vulnerability in WooCommerce Order Splitter Plugin (CVE-2025-31089)