tonyharris.io

PoC Week 2025-12-22

Posted on Dec 22, 2025

The most featured CVEs in this week’s security newsletters, with public Proof-of-Concepts, ordered by mention count.

For the most up-to-date and accurate info, visit the NIST links. Always audit PoCs thoroughly before running them. Follow links with caution.

CVE-2025-59718

  • Severity: 9.8 CRITICAL
  • Impacted Products: Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiSwitchManager
  • Description: Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an improper verification of cryptographic signature vulnerability that allows an unauthenticated attacker to bypass FortiCloud SSO login authentication. This flaw can be exploited by sending a specially crafted SAML response message.
  • Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
  • More Info: NVD - CVE-2025-59718
  • PoC:

CVE-2025-55182

CVE-2018-4063

CVE-2025-67506

  • Severity: 9.8 CRITICAL
  • Impacted Products: PipesHub 0.1.0-beta
  • Description: PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation. Versions prior to 0.1.0-beta expose POST /api/v1/record/buffer/convert through missing authentication. The endpoint accepts a file upload and converts it to PDF via LibreOffice by uploading payload to os.path.join(tmpdir, file.filename) without normalizing the filename.
  • Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
  • More Info: NVD - CVE-2025-67506
  • PoC:

CVE-2025-67494

  • Severity: 9.3 CRITICAL
  • Impacted Products: ZITADEL 4.7.0 and below
  • Description: ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, including self-hosted instances. This allows an unauthenticated attacker to force the server to make HTTP requests to arbitrary domains, such as internal addresses, and read the responses, enabling data exfiltration etc.
  • Remediation:
  • More Info: NVD - CVE-2025-67494
  • PoC:

CVE-2025-67489

  • Severity: 9.8 CRITICAL
  • Impacted Products: @vitejs/plugin-rs 0.5.5 and below
  • Description: @vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the development server through unsafe dynamic imports in server function APIs (loadServerAction, decodeReply, decodeAction) when integrated into RSC applications that expose server function endpoints. Attackers with network access to the development server can read/modify files, exfiltrate sensitive data and so on.
  • Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
  • More Info: NVD - CVE-2025-67489
  • PoC:

CVE-2025-66438

  • Severity: 9.8 CRITICAL
  • Impacted Products: Frappe ERPNext through 15.89.0
  • Description: A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism. Specifically, the API frappe.www.printview.get_html_and_style() triggers the rendering of the html field inside a Print Format document using frappe.render_template(template, doc) via the get_rendered_template() call chain.
  • Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
  • More Info: NVD - CVE-2025-66438
  • PoC:

CVE-2025-66434

  • Severity: 8.8 HIGH
  • Impacted Products: Frappe ERPNext through 15.89.0
  • Description: An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (body_text) using frappe.render_template() with a user-supplied context (doc).
  • Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
  • More Info: NVD - CVE-2025-66434
  • PoC:

CVE-2025-65741

  • Severity: 9.8 CRITICAL
  • Impacted Products: Sublime Text 3 Build 3208 or prior
  • Description: Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection. An attacker could compile a .dylib file and force the execution of this library in the context of the Sublime Text application.
  • Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
  • More Info: NVD - CVE-2025-65741
  • PoC:

CVE-2025-14709

  • Severity: 9.8 CRITICAL
  • Impacted Products: Shiguangwu sgwbox N3 2.0.25
  • Description: A security vulnerability has been detected in Shiguangwu sgwbox N3 2.0.25. Affected by this issue is some unknown functionality of the file /usr/sbin/http_eshell_server of the component WIRELESSCFGGET Interface. The manipulation of the argument params leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
  • Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
  • More Info: NVD - CVE-2025-14709
  • PoC:

CVE-2025-14708

  • Severity: 9.8 CRITICAL
  • Impacted Products: Shiguangwu sgwbox N3 2.0.25
  • Description: A weakness has been identified in Shiguangwu sgwbox N3 2.0.25. Affected by this vulnerability is an unknown functionality of the file /usr/sbin/http_eshell_server of the component WIREDCFGGET Interface. Executing manipulation of the argument params can lead to buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
  • Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
  • More Info: NVD - CVE-2025-14708
  • PoC:

CVE-2025-14707

  • Severity: 9.8 CRITICAL
  • Impacted Products: Shiguangwu sgwbox N3 2.0.25
  • Description: A security flaw has been discovered in Shiguangwu sgwbox N3 2.0.25. Affected is an unknown function of the file /usr/sbin/http_eshell_server of the component DOCKER Feature. Performing manipulation of the argument params results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
  • Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
  • More Info: NVD - CVE-2025-14707
  • PoC:

CVE-2025-14705

  • Severity: 9.8 CRITICAL
  • Impacted Products: Shiguangwu sgwbox N3 2.0.25
  • Description: A vulnerability was determined in Shiguangwu sgwbox N3 2.0.25. This affects an unknown function of the component SHARESERVER Feature. This manipulation of the argument params causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
  • Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
  • More Info: NVD - CVE-2025-14705
  • PoC:

CVE-2025-13780

CVE-2025-61757

CVE-2025-20393

  • Severity: 10.0 CRITICAL
  • Impacted Products: Cisco AsyncOS Software for Cisco Secure Email Gateway, Cisco AsyncOS Software for Cisco Secure Email and Web Manager
  • Description: Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager contains an improper input validation vulnerability that allows remote attackers to execute arbitrary commands with root privileges on the underlying operating system. This flaw requires the Spam Quarantine feature to be enabled and reachable from the internet.
  • Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
  • More Info: NVD - CVE-2025-20393
  • PoC:

CVE-2025-14706

  • Severity: 9.8 CRITICAL
  • Impacted Products: Shiguangwu sgwbox N3 2.0.25
  • Description: A vulnerability was identified in Shiguangwu sgwbox N3 2.0.25. This impacts an unknown function of the file /usr/sbin/http_eshell_server of the component NETREBOOT Interface. Such manipulation leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
  • Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
  • More Info: NVD - CVE-2025-14706
  • PoC:

References

This list was scraped from the quite amazing and highly recommended newsletters below:

Thanks for reading! For corrections, omissions (e.g. newsletter recs) feel free to get in touch.