The Consensus Security Vulnerability Alert

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html

Exploit Against FreePBX (CVE-2025-57819) with code execution.

Published: 2025-10-07

Last Updated: 2025-10-07 16:23:36 UTC

by Johannes Ullrich (Version: 1)

FreePBX is a popular PBX system built around the open source VoIP system Asterisk. To manage Asterisk more easily, it provides a capable web-based admin interface. Sadly, like so many web applications, it has had its share of vulnerabilities in the past. Most recently, a SQL injection vulnerability was found that allows attackers to modify the database.

For a PBX, there are a number of obvious attacks. For example, they are often abused for free phone calls, to impersonate the companies running the PBX, or to hide the true origin of phone calls. Manipulating the FreePBX database would certainly facilitate these types of attacks. However, I noticed some slightly more interesting attacks recently attempting to achieve complete code execution ...

Read the full entry: https://isc.sans.edu/diary/Exploit+Against+FreePBX+CVE202557819+with+code+execution/32350/

Quick and Dirty Analysis of Possible Oracle E-Business Suite Exploit Script (CVE-2025-61882) [UPDATED]

Published: 2025-10-06

Last Updated: 2025-10-06 12:36:04 UTC

by Johannes Ullrich (Version: 1)

[Update: I added the server part delivering the payload]

This weekend, Oracle published a surprise security bulletin announcing an exploited vulnerability in Oracle E-Business Suite. As part of the announcement, which also included a patch, Oracle published IoC observed as part of the incident response.

One script I found interesting is what Oracle calls "exp[.]py". Here is a quick analysis of the HTTP requests sent by the script. I only ran it against a simple Python web server, not an actual Oracle E-Business Suite install.

The script takes two parameters: The URL of the target and the IP/port of a config server.

The first request sent by the script ...

Read the full entry: https://isc.sans.edu/diary/Quick+and+Dirty+Analysis+of+Possible+Oracle+EBusiness+Suite+Exploit+Script+CVE202561882+UPDATED/32346/

Polymorphic Python Malware (2025.10.08)

https://isc.sans.edu/diary/Polymorphic+Python+Malware/32354/

More .well-known Scans (2025.10.02)

https://isc.sans.edu/diary/More+wellknown+Scans/32340/

The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.

CVE-2025-61882 - Oracle Concurrent Processing in Oracle E-Business Suite (BI Publisher Integration) versions 12.2.3-12.2.14 is susceptible to an easily exploitable vulnerability that allows an unauthenticated attacker to take over the Oracle Concurrent Processing component.

Product: Oracle Concurrent Processing

CVSS Score: 9.8

** KEV since 2025-10-06 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-61882

ISC Diary: https://isc.sans.edu/diary/32346

ISC Podcast: https://isc.sans.edu/podcastdetail/9642

NVD References:

- https://www.oracle.com/security-alerts/alert-cve-2025-61882.html

- https://blogs.oracle.com/security/post/apply-july-2025-cpu

- https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/

CVE-2025-57819 - FreePBX is vulnerable to unauthenticated access and remote code execution due to insufficient data sanitization, patched in versions 15.0.66, 16.0.89, and 17.0.3.

Product: FreePBX FreePBX 15, 16, and 17

CVSS Score: 0

** KEV since 2025-08-29 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-57819

ISC Diary: https://isc.sans.edu/diary/32350

ISC Podcast: https://isc.sans.edu/podcastdetail/9646

CVE-2025-10035 - Fortra's GoAnywhere MFT is susceptible to a deserialization vulnerability, which enables an actor to inject commands by deserializing an arbitrary object with a forged license response signature.

Product: Fortra GoAnywhere MFT

CVSS Score: 0

** KEV since 2025-09-29 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-10035

ISC Podcast: https://isc.sans.edu/podcastdetail/9644

CVE-2014-6278 - GNU Bash OS Command Injection Vulnerability

Product: Gnu Bash 4.3

CVSS Score: 0

** KEV since 2025-10-02 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2014-6278

CVE-2017-1000353 - Jenkins Remote Code Execution Vulnerability

Product: Jenkins

CVSS Score: 0

** KEV since 2025-10-02 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2017-1000353

NVD References: https://www.jenkins.io/security/advisory/2017-04-26/

CVE-2015-7755 - Juniper ScreenOS Improper Authentication Vulnerability

Product: Juniper ScreenOS 6.3.0

CVSS Score: 0

** KEV since 2025-10-02 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2015-7755

CVE-2025-10725 - Red Hat Openshift AI Service is susceptible to privilege escalation, enabling a low-privileged attacker to become a full cluster administrator and compromise the confidentiality, integrity, and availability of the cluster.

Product: Red Hat Openshift AI Service

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-10725

ISC Podcast: https://isc.sans.edu/podcastdetail/9640

CVE-2025-49844 - Redis versions 8.2.1 and below are vulnerable to a use-after-free exploit via specially crafted Lua scripts, potentially allowing for remote code execution.

Product: Redis

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-49844

ISC Podcast: https://isc.sans.edu/podcastdetail/9644

CVE-2024-58040 - Crypt::RandomEncryption for Perl version 0.01 uses insecure rand() function during encryption.

Product: Crypt::RandomEncryption Perl

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-58040

CVE-2025-11148 - Check-branches is vulnerable to command injection due to trusting user input for branch names and concatenating them to spawn git commands.

Product: Npm check-branches

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-11148

CVE-2025-34217 - Vasion Print Virtual Appliance Host and Application have a hardcoded 'printerlogic' user with SSH access, allowing attackers to gain root access with the matching private key.

Product: Vasion Virtual Appliance Application

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-34217

CVE-2025-7493 - FreeIPA has a privilege escalation flaw that allows an attacker to gain domain administrator access and perform administrative tasks over the REALM, potentially leading to sensitive data exfiltration.

Product: FreeIPA

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-7493

CVE-2025-56513 - NiceHash QuickMiner 6.12.0 is vulnerable to supply chain attacks through unvalidated software updates over HTTP, allowing for remote code execution by intercepting or redirecting traffic to the update url.

Product: NiceHash QuickMiner

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-56513

CVE-2025-10659 - The Telenium Online Web Application is vulnerable to remote code execution via crafted HTTP requests due to an insecurely terminated regular expression check in an accessible PHP endpoint.

Product: Telenium Online Web Application

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-10659

NVD References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-01

CVE-2025-61622 - Pyfory versions 0.12.0 through 0.12.2, or legacy pyfury versions from 0.1.0 through 0.10.3, are vulnerable to arbitrary code execution through deserialization of untrusted data.

Product: Pyfory

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-61622

CVE-2025-61044 & CVE-2025-61045 - TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain command injection vulnerabilities.

Product: Totolink X18

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-61044

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-61045

CVE-2025-59735 through CVE-2025-59741 - AndSoft's e-TMS v25.03 operating system command injection vulnerabilities.

Product: AndSoft E-TMS 25.03

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59735

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59736

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59737

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59738

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59739

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59740

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59741

NVD References: https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms

CVE-2025-59742 & CVE-2025-59743 - AndSoft's e-TMS v25.03 SQL injection vulnerabilities.

Product: AndSoft E-TMS 25.03

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59742

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59743

NVD References: https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms

CVE-2025-59407 - The Flock Safety DetectionProcessing application 6.35.33 for Android exposes a Java Keystore (flock_rye.bks) with a hardcoded password (flockhibiki17) containing a private key.

Product: Flock Safety DetectionProcessing com.flocksafety.android.objects

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59407

CVE-2025-61603 & CVE-2025-61605- WeGIA is vulnerable to SQL Injection in versions 3.4.12 and below.

Product: WeGIA

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-61603

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-61605

CVE-2025-59489 - Unity Runtime before 2025-10-02 allows argument injection on Android, Windows, macOS, and Linux, potentially enabling remote code execution and information exfiltration.

Product: Unity Runtime

CVSS Score: 7.4

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59489

ISC Podcast: https://isc.sans.edu/podcastdetail/9642

CVE-2023-49886 - IBM Standards Processing Engine 10.0.1.10 is vulnerable to a remote code execution exploit through unsafe java deserialization.

Product: IBM Standards Processing Engine 10.0.1.10

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-49886

NVD References: https://www.ibm.com/support/pages/node/7247179

CVE-2025-36356 - IBM Security Verify Access and IBM Security Verify Access Docker versions 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 may permit a locally authenticated user to gain root access by leveraging excessive privileges.

Product: IBM Security Verify Access

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-36356

NVD References: https://www.ibm.com/support/pages/node/7247215

CVE-2025-59159 - SillyTavern's web user interface in versions prior to 1.13.4 is vulnerable to DNS rebinding, allowing attackers to perform various malicious actions, but the vulnerability has been patched in version 1.13.4.

Product: SillyTavern

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59159

CVE-2025-57247 - The BATBToken smart contract contains incorrect access control implementation in whitelist management functions, allowing unauthorized users to bypass transfer restrictions and manipulate special address settings.

Product: BATBToken smart contract

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-57247

CVE-2025-60957, CVE-2025-60964, & CVE-2025-60965 - EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 OS Command Injection vulnerabbilities.

Product: EndRun Technologies Sonoma D12 Network Time Server

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-60957

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-60964

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-60965

CVE-2025-61777 - Flag Forge's `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints allowed unauthorized access, potentially leading to data exposure and abuse of the badge system, prior to version 2.3.2.

Product: Flag Forge Capture The Flag (CTF) platform

CVSS Score: 9.4

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-61777

CVE-2025-57515 - Uniclare Student Portal v2 is vulnerable to SQL injection, allowing remote attackers to execute time-delayed functions by injecting malicious SQL commands through input fields.

Product: Uniclare Student Portal

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-57515

CVE-2025-0603 - Callvision Emergency Code before V3.0 is vulnerable to SQL Injection and Blind SQL Injection.

Product: Callvision Healthcare Callvision Emergency Code

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0603

CVE-2025-25009 - Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.

Product: Kibana

CVSS Score: 8.7

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-25009

ISC Podcast: https://isc.sans.edu/podcastdetail/9646

CVE-2025-3450 - Improper Resource Locking vulnerability in B&R Industrial Automation Automation Runtime. This issue affects Automation Runtime: from 6.0 before 6.3, before Q4.93.

Product: B&R Industrial Automation Automation Runtime

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-3450

CVE-2025-44823 - Nagios Log Server allows authenticated users to retrieve cleartext administrative API keys via a specific API call, GL:NLS#475.

Product: Nagios Log Server

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-44823

CVE-2025-11418 - Tenda CH22 up to 1.0.0.1 is vulnerable to a remote stack-based buffer overflow in function formWrlsafeset of the HTTP Request Handler component.

Product: Tenda CH22

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-11418

CVE-2025-11423 - Tenda CH22 1.0.0.1 is vulnerable to remote memory corruption due to improper handling of user input in the formSafeEmailFilter function within the /goform/SafeEmailFilter file.

Product: Tenda CH22

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-11423

CVE-2025-10728 - The vulnerability in the module leads to a stack overflow DoS when rendering a Svg file containing a <pattern> element.

Product: Nozavicka SVG Component

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-10728

ISC Podcast: https://isc.sans.edu/podcastdetail/9646

CVE-2025-10729 - Module X allows for parsing a <pattern> node outside of a structural node, resulting in potential use after free vulnerability.

Product: Linux

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-10729

ISC Podcast: https://isc.sans.edu/podcastdetail/9646

NVD References: https://codereview.qt-project.org/c/qt/qtsvg/+/676473

CVE-2025-30247 - Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms is vulnerable to OS command injection, allowing remote attackers to execute arbitrary system commands via a specially crafted HTTP POST.

Product: Western Digital My Cloud

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-30247

ISC Podcast: https://isc.sans.edu/podcastdetail/9636

CVE-2025-8625 - The Copypress Rest API plugin for WordPress is vulnerable to Remote Code Execution through its copyreap_handle_image() Function in versions 1.1 to 1.2.

Product: Copypress Rest API plugin for WordPress

Active Installations: This plugin has been closed as of September 26, 2025 and is not available for download. This closure is temporary, pending a full review.

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-8625

NVD References: https://www.wordfence.com/threat-intel/vulnerabilities/id/3045c9e5-4095-48e5-8d9d-16a091e69d54?source=cve

CVE-2025-9762 - The Post By Email plugin for WordPress is vulnerable to arbitrary file uploads, allowing unauthenticated attackers to potentially achieve remote code execution.

Product: WordPress Post By Email plugin

Active Installations: This plugin has been closed as of September 26, 2025 and is not available for download. This closure is temporary, pending a full review.

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-9762

NVD References: https://www.wordfence.com/threat-intel/vulnerabilities/id/885eb923-8e69-416b-8494-a42a9465cfe0?source=cve

CVE-2020-36852 - The Custom Searchable Data Entry System plugin for WordPress up to version 1.7.1 is vulnerable to unauthenticated database wiping, allowing attackers to erase tables like wp_users.

Product: WordPress Custom Searchable Data Entry System plugin

Active Installations: This plugin has been closed as of March 12, 2020 and is not available for download. This closure is permanent. Reason: Author Request.

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-36852

NVD References: https://www.wordfence.com/threat-intel/vulnerabilities/id/245d89e5-52cc-44b1-a858-0ca0aacb4e26?source=cve

CVE-2025-9697 - The Ajax WooSearch WordPress plugin allows unauthenticated users to perform SQL injection attacks due to inadequate sanitisation of user input.

Product: Ajax WooSearch WordPress plugin

Active Installations: Unknown

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-9697

NVD References: https://wpscan.com/vulnerability/38939152-e54e-4f8f-996b-592de195570d/

CVE-2025-6388 - The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions, allowing unauthenticated attackers to log in as any user, including administrators.

Product: WordPress Spirit Framework plugin

Active Installations: Unknown

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-6388

NVD References: https://www.wordfence.com/threat-intel/vulnerabilities/id/a4cbc0e7-4328-451f-a595-1ce17e9d0031?source=cve

CVE-2025-10726 - The WPRecovery plugin for WordPress is vulnerable to SQL Injection which allows unauthenticated attackers to extract sensitive information and delete arbitrary files on the server.

Product: WPScan WPRecovery plugin

Active Installations: This plugin has been closed as of October 1, 2025 and is not available for download. This closure is temporary, pending a full review.

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-10726

NVD References: https://www.wordfence.com/threat-intel/vulnerabilities/id/15880d3b-87de-4b59-878c-e36e73c45e8a?source=cve

CVE-2025-7721 - The JoomSport plugin for WordPress is vulnerable to Local File Inclusion up to version 5.7.3, allowing unauthenticated attackers to execute arbitrary .php files on the server and potentially bypass access controls or obtain sensitive data.

Product: JoomSport for Sports: Team & League, Football, Hockey & more plugin for WordPress

Active Installations: 1,000+

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-7721

NVD References: https://www.wordfence.com/threat-intel/vulnerabilities/id/4f3900c7-2acb-4031-9854-b0b13e172e1f?source=cve

CVE-2025-9209 - RestroPress - Online Food Ordering System plugin for WordPress allows unauthenticated attackers to forge JWT tokens for other users via the /wp-json/wp/v2/users endpoint, leading to Authentication Bypass.

Product: RestroPress Online Food Ordering System plugin for WordPress

Active Installations: This plugin has been closed as of September 30, 2025 and is not available for download. This closure is temporary, pending a full review.

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-9209

NVD References: https://www.wordfence.com/threat-intel/vulnerabilities/id/359833dd-de3c-48ea-8eef-06588a590da2?source=cve

CVE-2025-9286 - The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation through missing authorization in the reset_user_password() REST handler.

Product: Appy Pie Connect for WooCommerce plugin

This plugin has been closed as of October 1, 2025 and is not available for download. This closure is temporary, pending a full review.

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-9286

NVD References: https://www.wordfence.com/threat-intel/vulnerabilities/id/36fb5b8d-1ea4-45c2-8639-b229efdb57db?source=cve

CVE-2025-9485 - The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to improper verification of cryptographic signatures, allowing unauthenticated attackers to gain access to user accounts or create new accounts.

Product: WordPress OAuth Single Sign On – SSO (OAuth Client) plugin

Active Installations: 6,000+

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-9485

NVD References: https://www.wordfence.com/threat-intel/vulnerabilities/id/d2448afc-70d1-4dd5-b73b-62d182ee9a8a?source=cve