CVE-2025-22252: Bypass Authentication in FortiOS/FortiProxy, 9.0 rating 🔥
Systems configured to use TACACS+ with ASCII authentication may be affected by a vulnerability that could allow an attacker to bypass authentication and gain administrative privileges.
Search at Netlas.io:
👉 Link: https://nt.ls/JYafs
👉 Dork: http.favicon.hash_sha256:d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f
Vendor's advisory: https://fortiguard.fortinet.com/psirt/FG-IR-24-472
Systems configured to use TACACS+ with ASCII authentication may be affected by a vulnerability that could allow an attacker to bypass authentication and gain administrative privileges.
Search at Netlas.io:
👉 Link: https://nt.ls/JYafs
👉 Dork: http.favicon.hash_sha256:d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f
Vendor's advisory: https://fortiguard.fortinet.com/psirt/FG-IR-24-472
🔥2👾2
CVE-2025-47884, -47885, -47889: Multiple vulnerabilities in Jenkins, 8.8 - 9.8 rating 🔥
Three vulnerabilities in Jenkins that were recently disclosed: Improper Access Control, XSS, Auth Bypass.
Search at Netlas.io:
👉 Link: https://nt.ls/6d5ql
👉 Dork: http.headers.x_jenkins:*
Vendor's advisory: https://www.jenkins.io/security/advisory/2025-05-14/
Three vulnerabilities in Jenkins that were recently disclosed: Improper Access Control, XSS, Auth Bypass.
Search at Netlas.io:
👉 Link: https://nt.ls/6d5ql
👉 Dork: http.headers.x_jenkins:*
Vendor's advisory: https://www.jenkins.io/security/advisory/2025-05-14/
🔥3👾2
Netlas vs. IPinfo: A Comprehensive Analysis 🧮
Our latest article puts Netlas head-to-head with one of its indirect competitors, IPinfo.
Inside, you’ll find:
- Deep dive into each tool’s core features 🔍
- Clear, side-by-side pricing comparison 💸
- Actionable insights on where each platform shines 🤔
👉 Read the article here: https://netlas.io/blog/netlas_vs_ipinfo/
Our latest article puts Netlas head-to-head with one of its indirect competitors, IPinfo.
Inside, you’ll find:
- Deep dive into each tool’s core features 🔍
- Clear, side-by-side pricing comparison 💸
- Actionable insights on where each platform shines 🤔
👉 Read the article here: https://netlas.io/blog/netlas_vs_ipinfo/
netlas.io
Netlas vs IPinfo: Tools Comparison - Netlas Blog
Explore the features, strengths, pricing, and automation options of Netlas and IPinfo to choose the best IP intelligence tool for your cybersecurity or research needs.
👾3🔥2👍1
CVE-2024-57273, -54779, 54780: Multiple vulnerabilities in pfSense, 5.4 - 8.8 rating❗️
The three newly disclosed vulnerabilities include Stored XSS, Command Injection and XML Injection.
Since the details of the vulnerabilities have already been disclosed, we recommend that anyone involved update their software.
Search at Netlas.io:
👉 Link: https://nt.ls/DOmg1
👉 Dork: http.title:"pfSense - Login"
Read more: https://blog.brillantit.com/exploiting-pfsense-xss-command-injection-cloud-hijack/
The three newly disclosed vulnerabilities include Stored XSS, Command Injection and XML Injection.
Since the details of the vulnerabilities have already been disclosed, we recommend that anyone involved update their software.
Search at Netlas.io:
👉 Link: https://nt.ls/DOmg1
👉 Dork: http.title:"pfSense - Login"
Read more: https://blog.brillantit.com/exploiting-pfsense-xss-command-injection-cloud-hijack/
👾4👍2🔥2
CVE-2025-22157: Improper Access Control in Atlassian Jira, 7.2 rating❗️
The vulnerability allows an authenticated attackers to escalate their privileges to administrator level or gain access to restricted workflows in Jira.
Search at Netlas.io:
👉 Link: https://nt.ls/lVuft
👉 Dork: http.meta:"content=\"JIRA\""
Vendor's advisory: https://confluence.atlassian.com/security/security-bulletin-may-20-2025-1561365992.html
The vulnerability allows an authenticated attackers to escalate their privileges to administrator level or gain access to restricted workflows in Jira.
Search at Netlas.io:
👉 Link: https://nt.ls/lVuft
👉 Dork: http.meta:"content=\"JIRA\""
Vendor's advisory: https://confluence.atlassian.com/security/security-bulletin-may-20-2025-1561365992.html
👾4👍2
🚧 Planned Maintenance 🚧
The application will be unavailable for a period of time❗️
The maintenance is scheduled to start today at 09:00 UTC ⏰. It is expected to take about ten minutes, but may take up to half an hour. We will do our best to complete it as quickly as possible.
Please remember to save your work before this time.
The application will be unavailable for a period of time❗️
The maintenance is scheduled to start today at 09:00 UTC ⏰. It is expected to take about ten minutes, but may take up to half an hour. We will do our best to complete it as quickly as possible.
Please remember to save your work before this time.
❤2🆒2💊1
💯 Planned Maintenance Completed 💯
Our team apologizes that this process took longer than expected.
Netlas is fully online again, and you can get back to your projects! 👾
Our team apologizes that this process took longer than expected.
Netlas is fully online again, and you can get back to your projects! 👾
👾3👀2😭1
Netlas 1.2.0 is Live! 🚀
What's new:
📑 OpenAPI 3.1 Support
🛠 Docs Portal Rebuild
🔖 Field types added in Mapping View
🕵️♂️ New “Tracker” Node (Google Tags, Facebook Pixels) into Attack Surface Discovery tool
Dive into the full changelog 👉 https://docs.netlas.io/changelog/
What's new:
📑 OpenAPI 3.1 Support
🛠 Docs Portal Rebuild
🔖 Field types added in Mapping View
🕵️♂️ New “Tracker” Node (Google Tags, Facebook Pixels) into Attack Surface Discovery tool
Dive into the full changelog 👉 https://docs.netlas.io/changelog/
docs.netlas.io
Changelog - Netlas Docs
Explore the latest updates, enhancements, and fixes on the Netlas platform. Stay informed with our Changelog for all product and feature developments.
🔥7
CVE-2025-4123: 0-day in Grafana, 7.6 rating❗️
Grafana Labs has released an unscheduled update that fixes an XSS injection vulnerability in all supported versions. This vulnerability does not require privileges and can be executed if anonymous access is present.
Search at Netlas.io:
👉 Link: https://nt.ls/BVyZk
👉 Dork: http.favicon.hash_sha256:80a7f87a79169cf0ac1ed3250d7c509368190a97bc7182cd4705deb8f8c70174 AND http.title:"Grafana"
Vendor's advisory: https://grafana.com/blog/2025/05/21/grafana-security-release-high-severity-security-fix-for-cve-2025-4123/
Grafana Labs has released an unscheduled update that fixes an XSS injection vulnerability in all supported versions. This vulnerability does not require privileges and can be executed if anonymous access is present.
Search at Netlas.io:
👉 Link: https://nt.ls/BVyZk
👉 Dork: http.favicon.hash_sha256:80a7f87a79169cf0ac1ed3250d7c509368190a97bc7182cd4705deb8f8c70174 AND http.title:"Grafana"
Vendor's advisory: https://grafana.com/blog/2025/05/21/grafana-security-release-high-severity-security-fix-for-cve-2025-4123/
🔥2👾2👍1👏1
RCE in vBulletin, 9.5 rating 🔥
vBulletin versions 5.0.0 through 6.0.3 contain an RCE vulnerability in the replaceAdTemplate endpoint that allows attackers to execute arbitrary PHP code on the server.
Search at Netlas.io:
👉 Link: https://nt.ls/42h8I
👉 Dork: http.meta:"vBulletin" AND (http.meta:"5.5.4" OR http.meta:"5.7.0" OR http.meta:"5.7.5" OR http.meta:"5.7.4")
Read more: https://cloud.projectdiscovery.io/library/vbulletin-replacead-rce
vBulletin versions 5.0.0 through 6.0.3 contain an RCE vulnerability in the replaceAdTemplate endpoint that allows attackers to execute arbitrary PHP code on the server.
Search at Netlas.io:
👉 Link: https://nt.ls/42h8I
👉 Dork: http.meta:"vBulletin" AND (http.meta:"5.5.4" OR http.meta:"5.7.0" OR http.meta:"5.7.5" OR http.meta:"5.7.4")
Read more: https://cloud.projectdiscovery.io/library/vbulletin-replacead-rce
👾4🔥3
Authorization Error Fixed 🛠
Over the weekend, some of our users encountered problems with authorization through third-party resources. This issue has now been fixed, and you can return to your projects!
The Netlas team apologizes for the inconvenience.
Over the weekend, some of our users encountered problems with authorization through third-party resources. This issue has now been fixed, and you can return to your projects!
The Netlas team apologizes for the inconvenience.
🥰3👍2❤1👀1
Account Takeover in Grafana – PoC by Chirag Artani 🔥
Our friend’s channel has posted a new video dedicated to exploiting a recent vulnerability. The guide includes finding targets in Netlas, as well as further exploitation. Don’t miss it!
We also recommend checking out Chirag Artani’s website and Twitter for more cybersecurity insights:
👉 Website: 3rag.com
👉 Twitter: x.com/Chirag99Artani
Our friend’s channel has posted a new video dedicated to exploiting a recent vulnerability. The guide includes finding targets in Netlas, as well as further exploitation. Don’t miss it!
We also recommend checking out Chirag Artani’s website and Twitter for more cybersecurity insights:
👉 Website: 3rag.com
👉 Twitter: x.com/Chirag99Artani
YouTube
Grafana CVE-2025-4123 Exploit Demo Open Redirect | XSS + SSRF + Account Takeover | Security POC
Description:
⚠️ HIGH SEVERITY ALERT ⚠️
One-click Grafana scanner: https://nt.ls/T5Akf (Netlas.io) 40000+ targets
In this video, I demonstrate the exploitation of CVE-2025-4123, a critical security vulnerability in Grafana with a CVSS score of 7.6. This…
⚠️ HIGH SEVERITY ALERT ⚠️
One-click Grafana scanner: https://nt.ls/T5Akf (Netlas.io) 40000+ targets
In this video, I demonstrate the exploitation of CVE-2025-4123, a critical security vulnerability in Grafana with a CVSS score of 7.6. This…
🔥7👍4
CVE-2025-47577: Unrestricted Upload of File with Dangerous Type in TI WooCommerce Wishlist Plugin, 10.0 rating 🔥🔥🔥
Failure to check the types of uploaded files allows attackers to upload a web shell to the server and perform RCE.
Search at Netlas.io:
👉 Link: https://nt.ls/jYyss
👉 Dork: http.body:"plugins/ti-woocommerce-wishlist"
Read more: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ti-woocommerce-wishlist/ti-woocommerce-wishlist-292-unauthenticated-arbitrary-file-upload
Failure to check the types of uploaded files allows attackers to upload a web shell to the server and perform RCE.
Search at Netlas.io:
👉 Link: https://nt.ls/jYyss
👉 Dork: http.body:"plugins/ti-woocommerce-wishlist"
Read more: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ti-woocommerce-wishlist/ti-woocommerce-wishlist-292-unauthenticated-arbitrary-file-upload
👍3🔥3❤2👾1
Track Adversary Infrastructure Challenge Recap 🏆
Last week, a major event concluded: the Track Adversary Infrastructure Challenge, which we held together with our colleagues from RST Cloud. Participants gained practical experience, and we were able to draw many conclusions regarding Netlas’s functionality and the improvements needed.
Thank you all for participating, and special congratulations to the winners:
🥇 1st Place (tie): Daisuke Arai
🥇 1st Place (tie): Marc Nebout
🥈 2nd Place: Kishan Lal
🥉 3rd Place: Koushik Pal
👉 You can read a more detailed report on our blog: https://netlas.io/blog/track_advisory_infrastructure_challenge/
Last week, a major event concluded: the Track Adversary Infrastructure Challenge, which we held together with our colleagues from RST Cloud. Participants gained practical experience, and we were able to draw many conclusions regarding Netlas’s functionality and the improvements needed.
Thank you all for participating, and special congratulations to the winners:
🥇 1st Place (tie): Daisuke Arai
🥇 1st Place (tie): Marc Nebout
🥈 2nd Place: Kishan Lal
🥉 3rd Place: Koushik Pal
👉 You can read a more detailed report on our blog: https://netlas.io/blog/track_advisory_infrastructure_challenge/
🔥5🎉2👏1
CVE-2025-49113: RCE in Roundcube Webmail, 9.9 rating 🔥
A vulnerability in Roundcube allows attackers to perform RCE due to the lack of validation of the _from parameter, which leads to PHP objects deserialization.
Search at Netlas.io:
👉 Link: https://nt.ls/9M4Rh
👉 Dork: http.headers.set_cookie:"roundcube_sessid"
Read more: https://fearsoff.org/research/roundcube
A vulnerability in Roundcube allows attackers to perform RCE due to the lack of validation of the _from parameter, which leads to PHP objects deserialization.
Search at Netlas.io:
👉 Link: https://nt.ls/9M4Rh
👉 Dork: http.headers.set_cookie:"roundcube_sessid"
Read more: https://fearsoff.org/research/roundcube
👾3🔥2
🚧 Planned Maintenance 🚧
The application may be unavailable for a period of time❗️
On the weekend of June 7–8, 2025, we will carry out work aimed at improving server stability and quality of service. In case of problems, the application may be unavailable for up to two days. Our team will do everything possible to prevent this.
Please remember to save your work before this time.
The application may be unavailable for a period of time❗️
On the weekend of June 7–8, 2025, we will carry out work aimed at improving server stability and quality of service. In case of problems, the application may be unavailable for up to two days. Our team will do everything possible to prevent this.
Please remember to save your work before this time.
👍2👨💻2👌1
Netlas vs. Urlscan: In-Depth Comparison 🧮
In our new blog post, we stack Netlas against Urlscan to finally answer the question: are these tools similar?
Inside, you’ll discover:
- An in-depth look at each platform’s standout capabilities 🔍
- Similarities and differences between applications ⚖️
- Practical recommendations on when to choose one over the other 🤔
👉 Check it out here: https://netlas.io/blog/netlas_vs_urlscan/
In our new blog post, we stack Netlas against Urlscan to finally answer the question: are these tools similar?
Inside, you’ll discover:
- An in-depth look at each platform’s standout capabilities 🔍
- Similarities and differences between applications ⚖️
- Practical recommendations on when to choose one over the other 🤔
👉 Check it out here: https://netlas.io/blog/netlas_vs_urlscan/
netlas.io
Netlas vs Urlscan: Tools Comparison - Netlas Blog
At first glance, Netlas and Urlscan seem similar, but their core functions and use cases differ greatly. Discover which tool fits your needs.
🔥3👾3
CVE-2025-32756: Buffer Overflow in Fortinet products, 9.8 rating 🔥
Some Fortinet products, including FortiMail, FortiRecorder, and FortiVoice, are vulnerable to a buffer overflow that could allow a remote, unauthenticated attacker to execute arbitrary code or commands.
The vulnerability is not new, but a PoC was recently released!
Search at Netlas.io:
👉 Link: https://nt.ls/nmu5K
👉 Dork: certificate.subject.common_name:"FortiMail" OR certificate.subject.common_name:"FortiRecorder" OR certificate.subject.common_name:"FortiVoice"
Vendor's advisory: https://fortiguard.fortinet.com/psirt/FG-IR-25-254
Some Fortinet products, including FortiMail, FortiRecorder, and FortiVoice, are vulnerable to a buffer overflow that could allow a remote, unauthenticated attacker to execute arbitrary code or commands.
The vulnerability is not new, but a PoC was recently released!
Search at Netlas.io:
👉 Link: https://nt.ls/nmu5K
👉 Dork: certificate.subject.common_name:"FortiMail" OR certificate.subject.common_name:"FortiRecorder" OR certificate.subject.common_name:"FortiVoice"
Vendor's advisory: https://fortiguard.fortinet.com/psirt/FG-IR-25-254
🔥5☃2👾2
CVE-2025-42989: Missing Authorization in SAP NetWeaver, 9.6 rating 🔥
One of the vulnerabilities disclosed in a recent patch allows an authenticated user to escalate their privileges, which could critically impact the integrity and availability of the system.
Search at Netlas.io:
👉 Link: https://nt.ls/lB0fI
👉 Dork: http.body:"This error page was generated by SAP Web Dispatcher!"
Vendor's advisory: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2025.html
One of the vulnerabilities disclosed in a recent patch allows an authenticated user to escalate their privileges, which could critically impact the integrity and availability of the system.
Search at Netlas.io:
👉 Link: https://nt.ls/lB0fI
👉 Dork: http.body:"This error page was generated by SAP Web Dispatcher!"
Vendor's advisory: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2025.html
🔥3👾2