24h | 7d | 30d

CVE-2025-59287

Overview

  • Microsoft
  • Windows Server 2019
14 Oct 2025
Published
22 Nov 2025
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
60.40%
KEV

Description

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Statistics

  • 8 Posts
  • 8 Interactions
Last activity: 12 hours ago

Fediverse

Profile picture
TechNadu @technadu

Threat actors are actively exploiting CVE-2025-59287 in WSUS to deploy ShadowPad.

ASEC notes the attackers used PowerCat for shell access, then fetched and installed ShadowPad with certutil/curl, executing it through DLL side-loading.

How are you securing WSUS or other update infrastructure in your environment?
💬 Share your insights
⭐ Follow TechNadu for timely threat intel

  • 1
  • 2
  • 0
  • 18h ago
Profile picture
tomcat @tomcat

🚨 Hackers are using a fixed Windows bug (CVE-2025-59287) to spread ShadowPad malware through WSUS servers.

They used normal Windows tools like curl and certutil to install it — a method seen before in Chinese hacking groups.

Systems patched too late may have already been compromised.

Full story ↓ thehackernews.com/2025/11/shad

  • 0
  • 1
  • 0
  • 19h ago
Profile picture
CyberNetsecIO @netsecio

📰 ShadowPad Backdoor Deployed via Critical WSUS Server Vulnerability

🔥 CRITICAL: Chinese APTs are actively exploiting a WSUS RCE vulnerability (CVE-2025-59287) to deploy the ShadowPad backdoor. Attackers gain SYSTEM access for espionage. Patching is urgent! #ThreatIntel #CVE #ShadowPad #CyberAttack

🔗 cyber.netsecops.io/articles/sh

  • 0
  • 0
  • 0
  • 14h ago
Profile picture
Cybersecurity & cyberwarfare @cybersecurity

Microsoft corregge il bug su WSUS, ma gli hacker Cinesi arrivano prima

Una vulnerabilità recentemente corretta nei servizi di aggiornamento di Windows Server di Microsoft ha portato a una serie di attacchi utilizzando uno degli strumenti di spionaggio più noti degli ultimi anni.

Gli incidenti dimostrano la rapidità con cui gli aggressori possono passare dallo studio di un exploit pubblicato allo sfruttamento attivo della vulnerabilità per penetrare nell’infrastruttura.

Secondo l’azienda sudcoreana AhnLab, un gruppo sconosciuto ha ottenuto l’accesso ai server Windows che eseguivano WSUS sfruttando la vulnerabilità CVE-2025-59287. Questa vulnerabilità è stata sfruttata per eseguire utilità di sistema standard, consentendo agli aggressori di contattare un server esterno e scaricare codice dannoso.

Prima di installare lo strumento principale, è stata utilizzata l’utilità PowerCat, che ha fornito agli aggressori un prompt dei comandi remoto. Quindi, utilizzando certutil e curl, è stato installato ShadowPad sul sistema.

Questo programma è considerato uno sviluppo di PlugX ed è da tempo utilizzato da entità collegate alla Cina. La sua architettura è modulare e viene avviato tramite sostituzione di libreria.

Un file DLL, situato in memoria e responsabile dell’esecuzione del contenuto principale, viene caricato nel file legittimo ETDCtrlHelper.exe. Al suo interno viene implementato un modulo che carica componenti aggiuntivi e utilizza meccanismi stealth e di persistenza.

Microsoft ha corretto CVE-2025-59287 un mese fa. Il bug è classificato come critico perché consente l’esecuzione di codice arbitrario con privilegi di sistema. Dopo il rilascio di un exploit dimostrativo, molti gruppi hanno iniziato a scansionare in massa i server WSUS accessibili, ottenendo l’accesso iniziale, effettuando ricognizioni e scaricando sia file dannosi che strumenti di amministrazione legittimi. Secondo AhnLab, è in questo modo che ShadowPad è stato distribuito sui server.

L’incidente ha chiaramente dimostrato che ogni vulnerabilità diventa una minaccia reale se la sua risoluzione viene ritardata. Quanto più rapidamente vengono affrontati i problemi identificati, tanto minore è la probabilità che gli aggressori riescano a infiltrarsi nell’infrastruttura e a trasformare un guasto in una crisi conclamata.

L'articolo Microsoft corregge il bug su WSUS, ma gli hacker Cinesi arrivano prima proviene da Red Hot Cyber.

  • 0
  • 0
  • 0
  • 14h ago

Bluesky

Profile picture
Hackmanac @hackmanac.com
🚨🚨Attackers are exploiting the critical WSUS flaw CVE-2025-59287 to gain SYSTEM-level remote code execution and deploy ShadowPad, a modular backdoor linked to Chinese state-sponsored actors. Source: thehackernews.com/2025/11/shad...
  • 2
  • 2
  • 0
  • 18h ago
Profile picture
matricedigitale.bsky.social @matricedigitale.bsky.social
Analisi dell’attacco ShadowPad via CVE-2025-59287 su WSUS, con installazione tramite curl e certutil e gravi rischi per infrastrutture enterprise. #ahnlab #apt #backdoor #cina #ShadowPad #WSUS www.matricedigitale.it/2025/11/24/a...
  • 0
  • 0
  • 0
  • 18h ago
Profile picture
TechNadu @technadu.com
ShadowPad malware is being deployed via active exploitation of CVE-2025-59287 in WSUS. Attackers gain system access, use PowerCat for shells, and install ShadowPad through certutil/curl with DLL side-loading using legitimate binaries. #cybersecurity #malware #infosec #techsecurity #sysadmin
  • 0
  • 0
  • 0
  • 18h ago
Profile picture
Calimeg @calimegai.bsky.social
Le malware ShadowPad exploite activement une faille WSUS pour un accès complet. Des cybercriminels ciblent les serveurs Windows avec WSUS activé via la vulnérabilité CVE-2025-59287. ⚠️ #CyberSecurity #IAÉthique #InnovationIA https://kntn.ly/7c605edf
  • 0
  • 0
  • 0
  • 12h ago

CVE-2025-61757

Overview

  • Oracle Corporation
  • Identity Manager
21 Oct 2025
Published
22 Nov 2025
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
71.16%
KEV

Description

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Statistics

  • 6 Posts
  • 41 Interactions
Last activity: 1 hour ago

Fediverse

Profile picture
Kevin Beaumont @GossiTheDog

On Thursday, this blog was released about CVE-2025-61757 in Oracle Fusion Middleware - Oracle Identity Manager really

slcyber.io/research-center/bre

Within 24 hours, it was added to CISA KEV as actively exploited 🤔

  • 18
  • 22
  • 0
  • 18h ago
Profile picture
nu11secur1ty @nu11secur1ty

nu11secur1ty.com/2025/11/cve-2

  • 0
  • 0
  • 0
  • 9h ago

Bluesky

Profile picture
セキュリティ対策Lab @securitylab-jp.bsky.social
CISAがOracle Identity Managerの脆弱性「CVE-2025-61757」をKEVに追加 rocket-boys.co.jp/security-mea... #セキュリティ対策Lab #セキュリティ #Security
  • 0
  • 1
  • 0
  • 5h ago
Profile picture
Information Security Briefly @infosecbriefly.bsky.social
CVE-2025-61757 in Oracle Identity Manager enables unauthenticated remote code execution and is actively exploited, requiring immediate patching.
  • 0
  • 0
  • 0
  • 19h ago
Profile picture
キタきつね @kitafox.bsky.social
CISAが既知の脆弱性1件をカタログに追加 CISA Adds One Known Exploited Vulnerability to Catalog #CISA (Nov 21) CVE-2025-61757 Oracle Fusion Middleway の重要な機能に対する認証不足の脆弱性 www.cisa.gov/news-events/...
  • 0
  • 0
  • 0
  • 6h ago
Profile picture
SaveAm. @saveam.bsky.social
CISA Confirms Active Exploitation of Oracle Identity Manager Vulnerability (CVE-2025-61757)
  • 0
  • 0
  • 0
  • 1h ago

CVE-2025-41115

Overview

  • Grafana
  • Grafana Enterprise
21 Nov 2025
Published
24 Nov 2025
Updated
CVSS v3.1
CRITICAL (10.0)
EPSS
0.02%
KEV

Description

SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation. This vulnerability applies only if all of the following conditions are met: - `enableSCIM` feature flag set to true - `user_sync_enabled` config option in the `[auth.scim]` block set to true

Statistics

  • 3 Posts
  • 2 Interactions
Last activity: 17 hours ago

Fediverse

Profile picture
benzogaga33 :verified: @benzogaga33

Grafana : une faille dans SCIM permet d’élever ses privilèges et de devenir admin ! it-connect.fr/grafana-scim-cve #ActuCybersécurité #Cybersécurité #Vulnérabilité

  • 0
  • 0
  • 0
  • 19h ago

Bluesky

Profile picture
SSuite Office Software @ssuitesoftware.bsky.social
Grafana warns of max severity admin spoofing vulnerability 🔥🕵️‍♂️ #Grafana Labs is warning of a maximum severity vulnerability (CVE-2025-41115) in its #Enterprise product that can be exploited to treat new #users as #administrators or for privilege escalation! www.bleepingcomputer.com/news/securit...
  • 0
  • 2
  • 0
  • 19h ago
Profile picture
fetchfeeds.com @fetchfeeds.bsky.social
Graafana Labs uuest eesmeres võti CVE-2025-41115, mis kasutades saab kasutajad loob administraatorina või teha arendusrida. #GrafanaLabs https://fefd.link/IownY
  • 0
  • 0
  • 0
  • 17h ago

CVE-2025-11001

Overview

  • 7-Zip
  • 7-Zip
19 Nov 2025
Published
21 Nov 2025
Updated
CVSS v3.0
HIGH (7.0)
EPSS
0.31%
KEV

Description

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26753.

Statistics

  • 3 Posts
  • 6 Interactions
Last activity: 14 hours ago

Fediverse

Profile picture
Patrick C Miller :donor: @patrickcmiller

7-Zip RCE flaw (CVE-2025-11001) actively exploited in attacks in the wild securityaffairs.com/184850/sec

  • 3
  • 3
  • 1
  • 23h ago

Bluesky

Profile picture
CyberHub @cyberhub.blog
📌 Critical 7-Zip Vulnerability (CVE-2025-11001) with Public Exploit Requires Immediate Manual Update to Version 25.01 https://www.cyberhub.blog/article/15948-critical-7-zip-vulnerability-cve-2025-11001-with-public-exploit-requires-immediate-manual-update-to-version-2501
  • 0
  • 0
  • 0
  • 14h ago

CVE-2025-40780

Overview

  • ISC
  • BIND 9
22 Oct 2025
Published
04 Nov 2025
Updated
CVSS v3.1
HIGH (8.6)
EPSS
0.03%
KEV

Description

In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.

Statistics

  • 1 Post
  • 19 Interactions
Last activity: 12 hours ago

Fediverse

Profile picture
:cascadia: cR0w :gayint: @cR0w

Oh look, another "We're not fixing this vuln so the only real mitigation we can offer is to disable the service" from a security vendor. The service this time is BIND. In F5 BIG-IP DNS. No I'm not joking.

my.f5.com/manage/s/article/K00

This is for CVE-2025-40780 which was published over a month ago.

cve.org/CVERecord?id=CVE-2025-

  • 11
  • 8
  • 0
  • 12h ago

CVE-2025-7402

Overview

  • scripteo
  • Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
24 Nov 2025
Published
24 Nov 2025
Updated
CVSS v3.1
HIGH (7.5)
EPSS
0.06%
KEV

Description

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘site_id’ parameter in all versions up to, and including, 4.95 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Statistics

  • 2 Posts
  • 1 Interaction
Last activity: 19 hours ago

Fediverse

Profile picture
Offensive Sequence @offseq

⚠️ CVE-2025-7402: HIGH severity SQL Injection in Ads Pro Plugin (≤4.95) for WordPress. Unauthenticated attackers can leak DB data via 'site_id'—patch unavailable. Deploy WAF & monitor activity! radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 23h ago

Bluesky

Profile picture
BaseFortify.eu @basefortify.bsky.social
🚨 CVE-2025-7402 — Ads Pro Plugin (WordPress) Time-based SQL injection via ‘site_id’ lets attackers extract sensitive DB data remotely. Patch ASAP to stay safe! 🔐 basefortify.eu/cve_reports/... #CVE #WordPress #SQLi #CyberSecurity #PatchNow
  • 0
  • 1
  • 0
  • 19h ago

CVE-2025-6389

Overview

  • Sneeit
  • Sneeit Framework
25 Nov 2025
Published
25 Nov 2025
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
Pending
KEV

Description

The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the sneeit_articles_pagination_callback() function. This is due to the function accepting user input and then passing that through call_user_func(). This makes it possible for unauthenticated attackers to execute code on the server which can be leveraged to inject backdoors or, for example, create new administrative user accounts.

Statistics

  • 2 Posts
Last activity: 2 hours ago

Fediverse

Profile picture
Offensive Sequence @offseq

⚠️ CVE-2025-6389 (CRITICAL, CVSS 9.8): All versions of Sneeit Framework for WordPress are vulnerable to unauth RCE via sneeit_articles_pagination_callback(). Disable plugin & monitor for compromise. radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 2h ago

Bluesky

Profile picture
CrowdCyber @crowdcyber.bsky.social
Critical WordPress Flaw (CVE-2025-6389, CVSS 9.8) Under Active Exploitation Allows Unauthenticated RCE
  • 0
  • 0
  • 0
  • 3h ago

CVE-2025-13562

Overview

  • D-Link
  • DIR-852
23 Nov 2025
Published
24 Nov 2025
Updated
CVSS v4.0
MEDIUM (6.9)
EPSS
0.82%
KEV

Description

A vulnerability was identified in D-Link DIR-852 1.00. This issue affects some unknown processing of the file /gena.cgi. Such manipulation of the argument service leads to command injection. The attack can be executed remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.

Statistics

  • 2 Posts
  • 6 Interactions
Last activity: 14 hours ago

Fediverse

Profile picture
:cascadia: cR0w :gayint: @cR0w

D-Link

cve.org/CVERecord?id=CVE-2025-

Davantis

cve.org/CVERecord?id=CVE-2025-

cve.org/CVERecord?id=CVE-2025-

cc: @Dio9sys @da_667

  • 3
  • 3
  • 0
  • 14h ago

Bluesky

Profile picture
BaseFortify.eu @basefortify.bsky.social
🚨 CVE-2025-13562 — D-Link DIR-852 Command injection via ‘service’ parameter in /gena.cgi allows remote attackers to run system commands. Device is EoL—mitigate at the network level! ⚠️🔧 basefortify.eu/cve_reports/... #CVE #DLink #Router #Infosec
  • 0
  • 0
  • 0
  • 19h ago

CVE-2025-63958

Overview

  • Pending
24 Nov 2025
Published
24 Nov 2025
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint (/MILLENSYS/settings) that is accessible without authentication. This page leaks plaintext database credentials, file share paths, internal license server configuration, and software update parameters. An unauthenticated attacker can retrieve this information by accessing the endpoint directly, potentially leading to full system compromise. The vulnerability is due to missing access controls on a privileged administrative function.

Statistics

  • 1 Post
  • 8 Interactions
Last activity: 12 hours ago

Fediverse

Profile picture
:cascadia: cR0w :gayint: @cR0w

This feels like a pretty good summary of the state of things in tech.

ozex.gitlab.io/tricks_hacks/20

MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint (/MILLENSYS/settings) that is accessible without authentication. This page leaks plaintext database credentials, file share paths, internal license server configuration, and software update parameters. An unauthenticated attacker can retrieve this information by accessing the endpoint directly, potentially leading to full system compromise. The vulnerability is due to missing access controls on a privileged administrative function.

  • 3
  • 5
  • 0
  • 12h ago

CVE-2025-13609

Overview

  • Red Hat
  • Red Hat Enterprise Linux 10
  • keylime
24 Nov 2025
Published
24 Nov 2025
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.

Statistics

  • 1 Post
  • 6 Interactions
Last activity: 10 hours ago

Fediverse

Profile picture
:cascadia: cR0w :gayint: @cR0w

That seems like it could be a problem.

access.redhat.com/security/cve

A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.

  • 2
  • 4
  • 0
  • 10h ago
Showing 1 to 10 of 50 CVEs