New assessment for topic: CVE-2025-47176

Topic description: "'.../...//' in Microsoft Office Outlook allows an authorized attacker to execute code locally. ..."

"This proof-of-concept (PoC) demonstrates the CVE-2025-47176 vulnerability simulation ..."

Link: https://attackerkb.com/assessments/3a4dccb4-b3ba-4472-b456-ee48151c7a73

New assessment for topic: CVE-2024-12632

Topic description: "Rejected reason: DO NOT USE THIS CANDIDATE NUMBER ..."

"CVE-2024-12632 was initially assigned to an unauthenticated RCE vuln affecting Cleo Harmony, VLTrader, and LexiCom ..."

Link: https://attackerkb.com/assessments/6622d406-d786-4c93-8b21-e0eb4111928c

New assessment for topic: CVE-2025-47812

Topic description: "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem ..."

"On June 30, 2025 a detailed [technical analysis](https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/) of CVE-2025-47812 was published by the original finders, RCE Security ..."

Link: https://attackerkb.com/assessments/87c68e69-b095-4e8e-be12-22b17a329c9c

New assessment for topic: CVE-2025-32462

Topic description: "Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines. ..."

"A lot of noise for medium local elevation of privilege (LEoP) that will impact very few real-life targets with non-default configurations using host specific rules. ..."

Link: https://attackerkb.com/assessments/4a82b217-70c7-415d-a0d9-fb5a3486d120

New assessment for topic: CVE-2024-51978

Topic description: "An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device ..."

"[Rapid7 disclosed](https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed/) this authentication bypass vulnerability on June 25, 2025 ..."

Link: https://attackerkb.com/assessments/8284a3e4-8c92-4a24-9c5c-e7bf8de063fe

New assessment for topic: CVE-2025-5306

Topic description: "Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection ..."

"In June 2025, PandoraFMS released a fix for the LTS version, which addresses a recent vulnerability, CVE-2025-5306, authenticated command injection in Netflow functionality ..."

Link: https://attackerkb.com/assessments/df7f187c-1624-40cb-bdaa-1c22c2b8d45f

New assessment for topic: CVE-2021-25094

Topic description: "The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory ..."

"Based on [technical analysis](https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/), the `Attacker Value` of the vulnerability is **high** because it's a popular WordPress plugin that has been exploited in the wild ..."

Link: https://attackerkb.com/assessments/d28b05a0-23ee-4941-8c91-824c01b64b44

New assessment for topic: CVE-2025-47165

Topic description: "Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. ..."

"# Titles: Microsoft Excel LTSC Professional Pilus 2021 - Microsoft® Word LTSC MSO (16.0.14334.20090) 64-bit - Remote Code Execution Bypass - ZIP (RCE) ..."

Link: https://attackerkb.com/assessments/1160a1ba-f757-485a-b938-37fc088197ef

New assessment for topic: CVE-2025-47957

Topic description: "Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. ..."

"# Software: https://www.microsoft.com/en/microsoft-365/excel?market=af ..."

Link: https://attackerkb.com/assessments/4f9ad32a-1fc4-440e-b270-9d21cce44bf0

New assessment for topic: CVE-2025-4653

Topic description: "Improper Neutralization of Special Elements in the backup name field may allow OS command injection ..."

"I recently opened another box of Pandora ;-) and found some vulnerabilities. ..."

Link: https://attackerkb.com/assessments/5b2df46c-e99c-4e86-8fe9-22b639c85a47

New assessment for topic: CVE-2025-27751

Topic description: "Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. ..."

"# Software: https://www.microsoft.com/en/microsoft-365/excel?market=af ..."

Link: https://attackerkb.com/assessments/aad43a7e-ca5a-469b-8fa7-b041e4b0861f

New assessment for topic: CVE-2025-33053

Topic description: "External control of file name or path in WebDAV allows an unauthorized attacker to execute code over a network. ..."

"CVE-2025-33053 is a zero-day vulnerability that enables remote code execution (RCE) through abuse of how Windows processes resolve executable paths relative to the working directory ..."

Link: https://attackerkb.com/assessments/31876429-6c7c-4d98-9458-6805bedbbb56

New assessment for topic: CVE-2025-33073

Topic description: "Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network. ..."

"CVE-2025-33073 is a logical flaw in the Windows SMB client that enables authenticated remote attackers to achieve SYSTEM-level command execution by bypassing long-standing NTLM reflection mitigations ..."

Link: https://attackerkb.com/assessments/b38be88a-6d03-4442-8582-8e185caac3a5

New assessment for topic: CVE-2025-41646

Topic description: "An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion ..."

"< if ( (($objLoginData->ownPW == "") && (md5($defaultPW[0]) == $hashcode) ) || ..."

Link: https://attackerkb.com/assessments/ee73eaf9-b173-4c60-8b1b-f0e7d6b22152

New assessment for topic: CVE-2025-48734

Topic description: "Improper Access Control vulnerability in Apache Commons. ..."

"On May 28 2025, Apache posted an [advisory](https://www.openwall.com/lists/oss-security/2025/05/28/6) to the OSS Security mailing list warning that Apache Commons BeanUtils versions 1.x before 1.11.0 and 2.x before 2.0.0-M2 were vulnerable to insecure access to the Java Classloader via exposed enum properties, namely the `declaredClass` property ..."

Link: https://attackerkb.com/assessments/1d98f952-f6f1-475a-8646-74062d040247

New assessment for topic: CVE-2025-41232

Topic description: "Spring Security Aspects may not correctly locate method security annotations on private methods ..."

"On May 19 2025, Spring released an [advisory](https://spring.io/security/cve-2025-41232) warning that Spring Security versions before `6.4.6` were vulnerable to a flaw in how Spring security annotations were identified and processed, that could lead to annotations being ignored on private methods, potentially leading to authorization bypasses on those private methods ..."

Link: https://attackerkb.com/assessments/c3734c78-c018-4e5f-9c70-b5f3c074a411

New Rapid7 Analysis on AttackerKB topic: CVE-2024-58136

"Yii framework is a component-based MVC web application framework, providing developers with the building blocks to create complex web applications including modules for authentication, database access, REST etc ..."

Link: https://attackerkb.com/topics/622fff34-7ccf-4193-8a78-60e6b21d8811

New assessment for topic: CVE-2025-4427

Topic description: "An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API. ..."

"On May 13, 2025, Ivanti [published an advisory](https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM?language=en_US) for [CVE-2025-4427](https://nvd.nist.gov/vuln/detail/CVE-2025-4427), a high severity authentication bypass in Ivanti Endpoint Manager Mobile (EPMM) ..."

Link: https://attackerkb.com/assessments/ef99e5bd-b83c-485a-9841-e0d54a7d4650

New assessment for topic: CVE-2025-4428

Topic description: "Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests. ..."

"On May 13, 2025, Ivanti [published an advisory](https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM?language=en_US) for [CVE-2025-4428](https://nvd.nist.gov/vuln/detail/CVE-2025-4428), a high-privilege expression language server-side template injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM) ..."

Link: https://attackerkb.com/assessments/a8195fc7-566e-4ad2-9926-3101a8e4d0f8

New assessment for topic: CVE-2023-41425

Topic description: "Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component. ..."

"On November 5th, WonderCMS released version 3.4.3, which addresses vulnerability CVE-2023-41425 - a reflected cross-site scripting vulnerability ..."

Link: https://attackerkb.com/assessments/7540246c-ba79-4cb1-8fed-0407049ba2b0