{"metadata": {"vulnerability": "CVE-2025-2749", "count": 39, "kinds": {"milestone": 4, "sighting": 12, "kev": 11, "other": 12}}, "data": [{"timestamp": "2025-03-24T16:39:22.986Z", "date_only": false, "value": "2025-03-24T16:39:22.986Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-2749", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-03-24T18:18:07.228Z", "date_only": false, "value": "2025-03-24T18:18:07.228Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-2749", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-03-24T19:15:52Z", "date_only": false, "value": "2025-03-24T19:15:52Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-G53H-CFHR-24HW", "record": "GHSA-G53H-CFHR-24HW", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-03-24T19:15:52.400Z", "date_only": false, "value": "2025-03-24T19:15:52.400", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-2749", "record": "FKIE_CVE-2025-2749", "field": "published"}, {"timestamp": "2025-03-24T19:23:08Z", "date_only": false, "value": "2025-03-24T19:23:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8502", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "cd868ac1-4a5f-4499-a5f8-ec01286bb65c", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-2749\n\ud83d\udd25 CVSS Score: 7.2 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.\n\ud83d\udccf Published: 2025-03-24T18:18:07.228Z\n\ud83d\udccf Modified: 2025-03-24T19:16:31.029Z\n\ud83d\udd17 References:\n1. https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/\n2. https://devnet.kentico.com/download/hotfixes", "url": "https://t.me/DarkWebInformer_CVEAlerts/8502"}, {"timestamp": "2025-03-24T21:30:33Z", "date_only": false, "value": "2025-03-24T21:30:33Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-G53H-CFHR-24HW", "record": "GHSA-G53H-CFHR-24HW", "field": "published"}, {"timestamp": "2025-03-24T22:35:06Z", "date_only": false, "value": "2025-03-24T22:35:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/20994", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "558d819a-63bc-49d8-b80d-eb7b3c158375", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-2749 - Kentico Xperience Remote Code Execution Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-2749 \nPublished : March 24, 2025, 7:15 p.m. | 2\u00a0hours, 5\u00a0minutes ago \nDescription : An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178. \nSeverity: 7.2 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"24 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/20994"}, {"timestamp": "2025-03-24T22:39:53.426Z", "date_only": false, "value": "2025-03-24T22:39:53.426136Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ll5t672tjd24", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "21ba7d06-61b7-4c45-878e-108316d2a9a3", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3ll5t672tjd24"}, {"timestamp": "2025-03-28T00:00:00Z", "date_only": true, "value": "2025-03-28", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2026-05137", "record": "CNVD-2026-05137", "field": "submitTime"}, {"timestamp": "2025-12-17T19:33:42.624Z", "date_only": false, "value": "2025-12-17T19:33:42.624Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2025-2749", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-01-20T00:00:00Z", "date_only": true, "value": "2026-01-20", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2026-05137", "record": "CNVD-2026-05137", "field": "openTime"}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2025-2749", "field": "timestamps.asserted_at", "uuid": "29ff5244-6972-4cce-b522-8472d6bb1fed", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": true, "value": "2026-04-20", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-2749", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": true, "value": "2026-04-20", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2025-2749", "field": "evidence.0.details.date_added", "uuid": "29ff5244-6972-4cce-b522-8472d6bb1fed", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2025-2749", "field": "timestamps.first_seen_at", "uuid": "29ff5244-6972-4cce-b522-8472d6bb1fed", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-2749", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-2749", "record": "FKIE_CVE-2025-2749", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2025-2749", "field": "status.status_updated_at", "uuid": "29ff5244-6972-4cce-b522-8472d6bb1fed", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-2749", "field": "containers.adp.0.timeline.0.time"}, {"timestamp": "2026-04-20T20:00:02Z", "date_only": false, "value": "2026-04-20T20:00:02+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2025-2749", "field": "timestamps.recorded_at", "uuid": "29ff5244-6972-4cce-b522-8472d6bb1fed", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-20T20:00:03.214Z", "date_only": false, "value": "2026-04-20T20:00:03.214968Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/29ff5244-6972-4cce-b522-8472d6bb1fed", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "2e5da773-d29c-40b3-850e-a9a5b03001a2", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/29ff5244-6972-4cce-b522-8472d6bb1fed"}, {"timestamp": "2026-04-20T21:21:38Z", "date_only": false, "value": "2026-04-20T21:21:38.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/4zRGsEPwCWPOVkiJwGYn1R_sXuEnR_EKMT0DdgACfDkyyoA", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "a27fbcb2-e761-4610-8a21-ca4b68efad7e"}, {"timestamp": "2026-04-20T21:31:38Z", "date_only": false, "value": "2026-04-20T21:31:38Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-G53H-CFHR-24HW", "record": "GHSA-G53H-CFHR-24HW", "field": "modified"}, {"timestamp": "2026-04-21T03:55:36.051Z", "date_only": false, "value": "2026-04-21T03:55:36.051Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-2749", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-04-21T03:55:36.051Z", "date_only": false, "value": "2026-04-21T03:55:36.051Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-2749", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-21T05:21:24Z", "date_only": false, "value": "2026-04-21T05:21:24.000000Z", "kind": "sighting", "label": "Seen", "source": "https://ccb.belgium.be/advisories/warning-multiple-critical-high-vulnerabilities-kentico-xperience-can-lead-remote-code", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "c2ab7129-0c75-490c-aa16-ee74c107067d", "url": "https://ccb.belgium.be/advisories/warning-multiple-critical-high-vulnerabilities-kentico-xperience-can-lead-remote-code"}, {"timestamp": "2026-04-26T06:06:44.584Z", "date_only": false, "value": "2026-04-26T06:06:44.584939Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mkevanrdo22s", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "bc6b2fb7-08bc-4065-873a-64e011b76fdf", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mkevanrdo22s"}, {"timestamp": "2026-05-04T00:00:00Z", "date_only": true, "value": "2026-05-04", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2025-2749", "field": "evidence.0.details.due_date", "uuid": "29ff5244-6972-4cce-b522-8472d6bb1fed", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T13:22:22Z", "date_only": false, "value": "2026-06-01T13:22:22+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2025-2749", "field": "timestamps.asserted_at", "uuid": "654d9760-bd9a-434b-afab-166d93ff3a75", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T13:22:22Z", "date_only": false, "value": "2026-06-01T13:22:22+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2025-2749", "field": "timestamps.first_seen_at", "uuid": "654d9760-bd9a-434b-afab-166d93ff3a75", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T13:22:22Z", "date_only": false, "value": "2026-06-01T13:22:22+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2025-2749", "field": "status.status_updated_at", "uuid": "654d9760-bd9a-434b-afab-166d93ff3a75", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T13:22:22.312Z", "date_only": false, "value": "2026-06-01T13:22:22.312Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2025-2749", "field": "evidence.0.details.added_date", "uuid": "654d9760-bd9a-434b-afab-166d93ff3a75", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-17T09:07:33.430Z", "date_only": false, "value": "2026-06-17T09:07:33.430", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-2749", "record": "FKIE_CVE-2025-2749", "field": "lastModified"}, {"timestamp": "2026-06-19T12:45:13.379Z", "date_only": false, "value": "2026-06-19T12:45:13.379569Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/05f8d02e-3bc7-47db-8afd-fd0f119b866d", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "be5877f3-64cd-4e1c-9d82-342418831fb0", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/05f8d02e-3bc7-47db-8afd-fd0f119b866d"}, {"timestamp": "2026-06-23T14:02:37Z", "date_only": false, "value": "2026-06-23T14:02:37+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2025-2749", "field": "timestamps.recorded_at", "uuid": "654d9760-bd9a-434b-afab-166d93ff3a75", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T14:03:39.729Z", "date_only": false, "value": "2026-06-23T14:03:39.729385Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/654d9760-bd9a-434b-afab-166d93ff3a75", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "fb549801-9ee1-4ee6-9c6a-63707e3fc4e3", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/654d9760-bd9a-434b-afab-166d93ff3a75"}, {"timestamp": "2026-08-18T19:00:04.479Z", "date_only": false, "value": "2026-08-18T19:00:04.479505Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/VulnerabilityNews/42060", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "e99f1433-bbac-4e92-915a-8197f6837100", "content": "CISA Adds Eight Known Exploited Vulnerabilities to Catalog\n\nCISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\u00a0\nCVE-2023-27351 PaperCut NG/MF Improper Authentication Vulnerability\nCVE-2024-27199 JetBrains TeamCity Relative Path Traversal Vulnerability\nCVE-2025-2749 Kentico Xperience Path Traversal Vulnerability\nCVE-2025-32975 Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability\nCVE-2025-48700 Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability\nCVE-2026-20122 Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability\nCVE-2026-20128 Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability\nCVE-2026-20133 Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.\u00a0\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.\u00a0\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nhttps://www.cisa.gov/news-events/alerts/2026/04/20/cisa-adds-eight-known-exploited-vulnerabilities-catalog", "url": "https://t.me/VulnerabilityNews/42060"}, {"timestamp": "2026-08-19T00:00:09.429Z", "date_only": false, "value": "2026-08-19T00:00:09.429515Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/42060", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "4c921636-8e30-426a-a459-dac53e00cec6", "content": "CISA Adds Eight Known Exploited Vulnerabilities to Catalog\n\nCISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\u00a0\nCVE-2023-27351 PaperCut NG/MF Improper Authentication Vulnerability\nCVE-2024-27199 JetBrains TeamCity Relative Path Traversal Vulnerability\nCVE-2025-2749 Kentico Xperience Path Traversal Vulnerability\nCVE-2025-32975 Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability\nCVE-2025-48700 Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability\nCVE-2026-20122 Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability\nCVE-2026-20128 Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability\nCVE-2026-20133 Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.\u00a0\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.\u00a0\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nhttps://www.cisa.gov/news-events/alerts/2026/04/20/cisa-adds-eight-known-exploited-vulnerabilities-catalog", "url": "https://t.me/VulnerabilityNews/42060"}, {"timestamp": "2026-08-29T20:00:17.340Z", "date_only": false, "value": "2026-08-29T20:00:17.340666Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberDispatch/1348", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "fd9db878-728b-4bf1-a5a5-cca108fd2493", "content": "CISA Adds 8 Actively Exploited Vulnerabilities to KEV Catalog\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) urgently added eight zero-day vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on April 20, 2026, confirming active exploitation across enterprise tools from Cisco, Quest, PaperCut, TeamCity, Kentico, and Zimbra.\n\nKey flaws include three Cisco SD-WAN vulnerabilities\u2014CVE-2026-20127 (authentication bypass), CVE-2022-20775 (privilege escalation), and CVE-2026-20133 (sensitive info exposure)\u2014plus CVE-2025-32975 (CVSS 10.0) in Quest KACE SMA, enabling full user impersonation without credentials.\n\nOthers: CVE-2023-27351 (PaperCut improper auth, CVSS 8.2); CVE-2024-27199 (TeamCity path traversal, CVSS 7.3); CVE-2025-2749 (Kentico path traversal, CVSS 7.2).", "url": "https://t.me/CyberDispatch/1348"}]}