{"metadata": {"vulnerability": "CVE-2025-29969", "count": 46, "kinds": {"milestone": 8, "sighting": 15, "kev": 0, "other": 23}}, "data": [{"timestamp": "2025-02-25T15:15:00Z", "date_only": false, "value": "2025-02-25T15:15:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2025-0159", "record": "NCSC-2025-0159", "field": "document.tracking.generator.date"}, {"timestamp": "2025-03-12T17:54:45.709Z", "date_only": false, "value": "2025-03-12T17:54:45.709Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-29969", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-05-13T00:00:00Z", "date_only": true, "value": "2025-05-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0405", "record": "CERTFR-2025-AVI-0405", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2025-05-13T07:00:00Z", "date_only": false, "value": "2025-05-13T07:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-29969", "record": "MSRC_CVE-2025-29969", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-05-13T07:00:00Z", "date_only": false, "value": "2025-05-13T07:00:00.000Z", "kind": "other", "label": "Date", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-29969", "record": "MSRC_CVE-2025-29969", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2025-05-13T07:00:00Z", "date_only": false, "value": "2025-05-13T07:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2025-29969", "field": "containers.cna.datePublic"}, {"timestamp": "2025-05-13T07:00:00Z", "date_only": false, "value": "2025-05-13T07:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-29969", "record": "MSRC_CVE-2025-29969", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-05-13T07:00:00Z", "date_only": false, "value": "2025-05-13T07:00:00.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-29969", "record": "MSRC_CVE-2025-29969", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-05-13T16:27:02Z", "date_only": false, "value": "2025-05-13T16:27:02.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.thezdi.com/blog/2025/5/13/the-may-2025-security-update-review", "record": "CVE-2025-29969", "field": "creation_timestamp", "uuid": "2d76b1de-a867-480f-be78-ad878ab5d88c", "url": "https://www.thezdi.com/blog/2025/5/13/the-may-2025-security-update-review"}, {"timestamp": "2025-05-13T16:58:33.147Z", "date_only": false, "value": "2025-05-13T16:58:33.147Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-29969", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-05-13T17:15:57Z", "date_only": false, "value": "2025-05-13T17:15:57Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-FPJQ-79P8-3P6W", "record": "GHSA-FPJQ-79P8-3P6W", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-05-13T17:15:57.660Z", "date_only": false, "value": "2025-05-13T17:15:57.660", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-29969", "record": "FKIE_CVE-2025-29969", "field": "published"}, {"timestamp": "2025-05-13T18:30:55Z", "date_only": false, "value": "2025-05-13T18:30:55Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-FPJQ-79P8-3P6W", "record": "GHSA-FPJQ-79P8-3P6W", "field": "published"}, {"timestamp": "2025-05-13T18:30:55Z", "date_only": false, "value": "2025-05-13T18:30:55Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-FPJQ-79P8-3P6W", "record": "GHSA-FPJQ-79P8-3P6W", "field": "modified"}, {"timestamp": "2025-05-13T19:47:12.555Z", "date_only": false, "value": "2025-05-13T19:47:12.555983Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2025-0159", "record": "NCSC-2025-0159", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-05-13T19:47:12.555Z", "date_only": false, "value": "2025-05-13T19:47:12.555983Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2025-0159", "record": "NCSC-2025-0159", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-05-13T19:47:12.555Z", "date_only": false, "value": "2025-05-13T19:47:12.555983Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2025-0159", "record": "NCSC-2025-0159", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-05-13T22:00:00Z", "date_only": false, "value": "2025-05-13T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-1050", "record": "WID-SEC-W-2025-1050", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-05-13T22:00:00Z", "date_only": false, "value": "2025-05-13T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-1050", "record": "WID-SEC-W-2025-1050", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-05-13T22:00:00Z", "date_only": false, "value": "2025-05-13T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-1050", "record": "WID-SEC-W-2025-1050", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2025-05-14T00:00:00Z", "date_only": false, "value": "2025-05-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0405", "record": "CERTFR-2025-AVI-0405", "field": "revisions.0.revision_date"}, {"timestamp": "2025-05-14T04:00:55.385Z", "date_only": false, "value": "2025-05-14T04:00:55.385142Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-29969", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-05-14T04:00:55.385Z", "date_only": false, "value": "2025-05-14T04:00:55.385142Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-29969", "record": "FKIE_CVE-2025-29969", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-05-14T04:31:56Z", "date_only": false, "value": "2025-05-14T04:31:56.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/16283", "record": "CVE-2025-29969", "field": "creation_timestamp", "uuid": "56ce4a72-e168-483b-ab0a-e44e478b6e8a", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-29969\n\ud83d\udd25 CVSS Score: 7.5 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)\n\ud83d\udd39 Description: Time-of-check time-of-use (toctou) race condition in Windows Fundamentals allows an authorized attacker to execute code over a network.\n\ud83d\udccf Published: 2025-05-13T16:58:33.147Z\n\ud83d\udccf Modified: 2025-05-14T04:00:54.248Z\n\ud83d\udd17 References:\n1. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29969", "url": "https://t.me/DarkWebInformer_CVEAlerts/16283"}, {"timestamp": "2025-06-22T22:00:00Z", "date_only": false, "value": "2025-06-22T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-1050", "record": "WID-SEC-W-2025-1050", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2025-09-10T00:09:05.346Z", "date_only": false, "value": "2025-09-10T00:09:05.346Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-29969", "record": "MSRC_CVE-2025-29969", "field": "document.tracking.generator.date"}, {"timestamp": "2026-02-13T19:20:54.154Z", "date_only": false, "value": "2026-02-13T19:20:54.154Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / microsoft", "record": "CVE-2025-29969", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-02-19T19:51:32.419Z", "date_only": false, "value": "2026-02-19T19:51:32.419494Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/threatcodex/statuses/116099035255751023", "record": "CVE-2025-29969", "field": "creation_timestamp", "uuid": "0eb76c04-6151-42d5-b801-df74ffc35e35", "url": "https://infosec.exchange/users/threatcodex/statuses/116099035255751023"}, {"timestamp": "2026-02-19T22:25:49.464Z", "date_only": false, "value": "2026-02-19T22:25:49.464149Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/warthogtk.bsky.social/post/3mfan6p2bg52y", "record": "CVE-2025-29969", "field": "creation_timestamp", "uuid": "8d4187c4-0201-4b30-a554-6e7328f24d03", "url": "https://bsky.app/profile/warthogtk.bsky.social/post/3mfan6p2bg52y"}, {"timestamp": "2026-02-20T05:39:27.352Z", "date_only": false, "value": "2026-02-20T05:39:27.352473Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mfbfg3ridy2a", "record": "CVE-2025-29969", "field": "creation_timestamp", "uuid": "2f1316bc-e34e-47ab-856e-7760aef8b55b", "url": "https://bsky.app/profile/opsmatters.com/post/3mfbfg3ridy2a"}, {"timestamp": "2026-02-20T05:54:57.431Z", "date_only": false, "value": "2026-02-20T05:54:57.431940Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mfbgbrtltf2d", "record": "CVE-2025-29969", "field": "creation_timestamp", "uuid": "18de3c78-fbb4-4317-8286-b889cfa4f691", "url": "https://bsky.app/profile/undercode.bsky.social/post/3mfbgbrtltf2d"}, {"timestamp": "2026-02-20T12:13:09.384Z", "date_only": false, "value": "2026-02-20T12:13:09.384991Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mfc3g3kpxa2d", "record": "CVE-2025-29969", "field": "creation_timestamp", "uuid": "7dd03465-543e-4804-bf60-235cac78306d", "url": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mfc3g3kpxa2d"}, {"timestamp": "2026-02-20T18:46:20.733Z", "date_only": false, "value": "2026-02-20T18:46:20.733827Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/buherator.bsky.social/post/3mfcrf5y5wp2i", "record": "CVE-2025-29969", "field": "creation_timestamp", "uuid": "9744854a-d782-4025-bedf-a5c69a9843eb", "url": "https://bsky.app/profile/buherator.bsky.social/post/3mfcrf5y5wp2i"}, {"timestamp": "2026-02-21T07:24:32.936Z", "date_only": false, "value": "2026-02-21T07:24:32.936562Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mfe3qx5q5x2c", "record": "CVE-2025-29969", "field": "creation_timestamp", "uuid": "736bc051-fdc1-4b9e-aac9-f26829be53c5", "url": "https://bsky.app/profile/r-netsec.bsky.social/post/3mfe3qx5q5x2c"}, {"timestamp": "2026-02-21T13:23:42.693Z", "date_only": false, "value": "2026-02-21T13:23:42.693743Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/co11ateral.bsky.social/post/3mfepsfvh622s", "record": "CVE-2025-29969", "field": "creation_timestamp", "uuid": "efe515b5-3dfa-4670-ae23-2891cb4c7e3b", "url": "https://bsky.app/profile/co11ateral.bsky.social/post/3mfepsfvh622s"}, {"timestamp": "2026-02-26T18:28:34.379Z", "date_only": false, "value": "2026-02-26T18:28:34.379Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-29969", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-02-26T18:28:34.379Z", "date_only": false, "value": "2026-02-26T18:28:34.379Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-29969", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-03-15T23:00:00Z", "date_only": false, "value": "2026-03-15T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-1050", "record": "WID-SEC-W-2025-1050", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-03-15T23:00:00Z", "date_only": false, "value": "2026-03-15T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-1050", "record": "WID-SEC-W-2025-1050", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-03-16T10:13:00.643Z", "date_only": false, "value": "2026-03-16T10:13:00.643+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-1050", "record": "WID-SEC-W-2025-1050", "field": "document.tracking.generator.date"}, {"timestamp": "2026-06-17T09:05:59.740Z", "date_only": false, "value": "2026-06-17T09:05:59.740", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-29969", "record": "FKIE_CVE-2025-29969", "field": "lastModified"}, {"timestamp": "2026-07-20T16:00:05.285Z", "date_only": false, "value": "2026-07-20T16:00:05.285357Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/pPAZ8wXA8vH6MRSBmBOnia7CtKIzDGIvt__8Gq7G6sfmpzwm", "record": "CVE-2025-29969", "field": "creation_timestamp", "uuid": "002b8727-17c4-4272-8175-41c0d2e20223"}, {"timestamp": "2026-07-20T19:00:07.885Z", "date_only": false, "value": "2026-07-20T19:00:07.885895Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/proxy_bar/3157", "record": "CVE-2025-29969", "field": "creation_timestamp", "uuid": "18954d59-223f-487d-8e14-7db281abdaf6", "content": "CVE-2025-29969 EventLogin\n*\n\u0414\u044b\u0440\u043a\u0430 \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 MS-EVEN.\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441 \u043d\u0438\u0437\u043a\u0438\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u043c\u043e\u0433\u0443\u0442 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043d\u0430 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u0443\u044e \u043c\u0430\u0448\u0438\u043d\u0443, \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0431\u0445\u043e\u0434\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438.\n\nExploitation", "url": "https://t.me/proxy_bar/3157"}, {"timestamp": "2026-07-30T16:22:15.682Z", "date_only": false, "value": "2026-07-30T16:22:15.682646Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mrutwtkftv2i", "record": "CVE-2025-29969", "field": "creation_timestamp", "uuid": "ef184441-e013-4e9a-89f6-177322bdd856", "content": "When I saw the CVE-2025-29969 fix (by \n@safebreach\n), I knew there was more to it. It's not as critical as it seems, but it was fun trying to find a way to still exploit this EventLog RPC endpoint\n\n\ud83d\udd01 RT @HackAndDo | reposted by @HackingLZ\nhttps://x.com/HackAndDo/status/2082839830707269811", "url": "https://bsky.app/profile/infosecbot.bsky.social/post/3mrutwtkftv2i"}, {"timestamp": "2026-09-02T06:00:15.771Z", "date_only": false, "value": "2026-09-02T06:00:15.771896Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/HackingTeamGrupoOfficial/43502", "record": "CVE-2025-29969", "field": "creation_timestamp", "uuid": "192df7fc-bccb-4c52-b72c-49e4c1a0f662", "content": "EventLogin \u2014 CVE-2025-29969\n\nA flaw in the MS-EVEN protocol. Low-privileged users can write arbitrary files to a remote machine, effectively bypassing the need for an administrator account for remote file writes\n\n\ud83d\udd17 Source: \nhttps://github.com/SafeBreach-Labs/EventLogin-CVE-2025-29969\n\n\ud83d\udd17 Research:\nhttps://www.safebreach.com/blog/safebreach_labs_discovers_cve-2025-29969/\n\n#ad #windows #eventlog #rpc", "url": "https://t.me/HackingTeamGrupoOfficial/43502"}, {"timestamp": "2026-09-03T00:00:46.899Z", "date_only": false, "value": "2026-09-03T00:00:46.899590Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/HackingTeamGrupoOfficial/43502", "record": "CVE-2025-29969", "field": "creation_timestamp", "uuid": "3836521a-1757-42f8-a6f5-ac35595a48e0", "content": "EventLogin \u2014 CVE-2025-29969\n\nA flaw in the MS-EVEN protocol. Low-privileged users can write arbitrary files to a remote machine, effectively bypassing the need for an administrator account for remote file writes\n\n\ud83d\udd17 Source: \nhttps://github.com/SafeBreach-Labs/EventLogin-CVE-2025-29969\n\n\ud83d\udd17 Research:\nhttps://www.safebreach.com/blog/safebreach_labs_discovers_cve-2025-29969/\n\n#ad #windows #eventlog #rpc", "url": "https://t.me/HackingTeamGrupoOfficial/43502"}]}