tonyharris.io

PoC Week 2025-06-23

Posted on Jun 23, 2025

The most featured CVEs in this week’s security newsletters, with public Proof-of-Concepts, ordered by mention count. Older CVEs, trivially exploitable vulnerabilities (such as using hard-coded credentials) and those affecting open source projects with very small userbases aren’t listed.

For the most up-to-date and accurate info, visit the NIST links. Always audit PoCs thoroughly before running them.

CVE-2025-2783

  • Severity: 8.3 HIGH
  • Impacted Products: Google Chrome on Windows prior to 134.0.6998.177
  • Description: Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file.
  • Remediation: Follow developer advice.
  • More Info: NVD - CVE-2025-2783
  • PoC: https://github.com/byteReaper77/CVE-2025-2783

CVE-2025-33073

CVE-2025-33053

CVE-2025-6179

  • Severity: 4.4 MEDIUM
  • Impacted Products: Google ChromeOS 16181.27.0
  • Description: Permissions Bypass in Extension Management in Google ChromeOS 16181.27.0 on managed Chrome devices allows a local attacker to disable extensions and access Developer Mode, including loading additional extensions via exploiting vulnerabilities using the ExtHang3r and ExtPrint3r tools.
  • Remediation: Follow developer advice.
  • More Info: NVD - CVE-2025-6179
  • PoC: https://github.com/Blobby-Boi/ExtPrint3r

CVE-2025-6065

CVE-2025-6018 & CVE-2025-6019

  • Severity: 7 HIGH
  • Impacted Products: libblockdev
  • Description: A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the “allow_active” setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an “allow_active” user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.
  • Remediation: Follow developer advice.
  • More Info: NVD - CVE-2025-6018 & NVD - CVE-2025-6019
  • PoC: https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt

CVE-2025-5288

  • Severity: 9.1 CRITICAL
  • Impacted Products: REST API | Custom API Generator For Cross Platform And Import Export In WP plugin v1.0.0 to 2.0.3
  • Description: The REST API | Custom API Generator For Cross Platform And Import Export In WP plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the process_handler() function in versions 1.0.0 to 2.0.3. This makes it possible for unauthenticated attackers to POST an arbitrary import_api URL, import specially crafted JSON, and thereby create a new user with full Administrator privileges.
  • Remediation: Follow developer advice.
  • More Info: NVD - CVE-2025-5288
  • PoC: https://github.com/Nxploited/CVE-2025-5288

CVE-2025-45988

CVE-2025-45984

CVE-2025-4123

  • Severity: 7.6 HIGH
  • Impacted Products: Grafana 11.2, Grafana 11.3, Grafana 11.4, Grafana 11.5, Grafana 11.6, Grafana 12.0
  • Description: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF. The default Content-Security-Policy (CSP) in Grafana will block the XSS though the connect-src directive.
  • Remediation: Follow developer advice.
  • More Info: NVD - CVE-2025-4123
  • PoC: https://github.com/B1ack4sh/Blackash-CVE-2025-4123

CVE-2025-29927

  • Severity: 9.1 CRITICAL
  • Impacted Products: Next.js
  • Description: Next.js uses an internal header x-middleware-subrequest to prevent recursive requests from triggering infinite loops. The security report showed it was possible to skip running Middleware, which could allow requests to skip critical checks—such as authorization cookie validation—before reaching routes.
  • Remediation: Follow developer advice.
  • More Info: NVD - CVE-2025-29927
  • PoC: https://github.com/KamalideenAK/poc-cve-2025-29927

References

This list was scraped from the quite amazing and highly recommended newsletters below:

Thanks for reading! For corrections, omissions (e.g. newsletter recs) feel free to get in touch.