CVE-2025-22609, -22611, -22612: Multiple vulnerabilities in Coolify, 10.0 rating 🔥🔥🔥

Three vulnerabilities of highest severity in Coolify allow for RCE, privilege escalation, and authentication bypass.

Search at Netlas.io:
👉 Link: https://nt.ls/vUWWf
👉 Dork: http.favicon.hash_sha256:eaf648b6000a49599ed58bda49e576d0f981e535a8075d524a4be890edcf96d0 AND uri:*login*

Vendor's advisory: https://github.com/coollabsio/coolify/security/advisories/GHSA-3w2c-jfr2-9pg9

💡Snov finds email addresses on any website. #OSINT

snov.io/email-finder

💡Blackbird is a powerful OSINT tool designed for fast and efficient searches of user accounts by username or email across multiple platforms, streamlining digital investigations.

https://github.com/p1ngul1n0/blackbird

Ninjasworkout:-- Vulnerable NodeJS Web Application.

ADDED BUGS:-
Prototype Pollution ✅1
No SQL Injection ✅2
Cross site Scripting ✅3
Broken Access Control ✅4
Broken Session Management ✅5
Weak Regex Implementation ✅ 6
Race Condition ✅7
CSRF -Cross Site Request Forgery ✅8
Weak Bruteforce Protection ✅9
User Enumeration ✅10
Reset Password token leaking in Referrer ✅11
Reset Password bugs ✅12
Sensitive Data Exposure ✅13
Unicode Case Mapping Collision ✅14
File Upload ✅ 15
SSRF ✅ 16
XXE
Open Redirection ✅ 17
Directory Traversal ✅ 18
Insecure Deserilization => Remote Code Execution ✅ 19


https://github.com/effortlessdevsec/ninjasworkout

Github subdomain takeover
Reward: $200
Program: Public
dev[.]to: https://dev.to/c4ng4c31r0/github-subdomain-takeover-3j6k