{"metadata": {"vulnerability": "CVE-2025-4632", "count": 97, "kinds": {"milestone": 4, "sighting": 69, "kev": 11, "other": 13}, "linked_omitted": 0}, "data": [{"timestamp": "2025-05-13T00:55:41.454Z", "date_only": false, "value": "2025-05-13T00:55:41.454Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-4632", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-05-13T03:00:00Z", "date_only": false, "value": "2025-05-13T03:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / samsung.tv_appliance", "record": "CVE-2025-4632", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-05-13T05:19:19.254Z", "date_only": false, "value": "2025-05-13T05:19:19.254Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-4632", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-05-13T05:19:19.254Z", "date_only": false, "value": "2025-05-13T05:19:19.254Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / samsung.tv_appliance", "record": "CVE-2025-4632", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-05-13T06:15:36Z", "date_only": false, "value": "2025-05-13T06:15:36Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-CMWW-723F-496G", "record": "GHSA-CMWW-723F-496G", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2025-05-13T06:15:36.537Z", "date_only": false, "value": "2025-05-13T06:15:36.537", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-4632", "record": "FKIE_CVE-2025-4632", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-05-13T06:30:12Z", "date_only": false, "value": "2025-05-13T06:30:12.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/16080", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "09b6a14e-74fc-4b6a-b663-f0116979489d", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-4632\n\ud83d\udd25 CVSS Score: 9.8 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.\n\ud83d\udccf Published: 2025-05-13T05:19:19.254Z\n\ud83d\udccf Modified: 2025-05-13T05:19:19.254Z\n\ud83d\udd17 References:\n1. https://security.samsungtv.com/securityUpdates#SVP-MAY-2025", "url": "https://t.me/DarkWebInformer_CVEAlerts/16080"}, {"timestamp": "2025-05-13T06:30:24Z", "date_only": false, "value": "2025-05-13T06:30:24Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-CMWW-723F-496G", "record": "GHSA-CMWW-723F-496G", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-05-13T06:47:26.899Z", "date_only": false, "value": "2025-05-13T06:47:26.899568Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lozvazwfdb2e", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "e09c4427-35d0-46dd-847f-315592b4b1e6", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3lozvazwfdb2e"}, {"timestamp": "2025-05-13T09:41:16Z", "date_only": false, "value": "2025-05-13T09:41:16.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/25168", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "0f04aae4-5d7c-43b4-8bf3-397a86b23b9e", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-4632 - Samsung MagicINFO 9 Server Path Traversal Write Arbitrary File Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-4632 \nPublished : May 13, 2025, 6:15 a.m. | 37\u00a0minutes ago \nDescription : Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority. \nSeverity: 9.8 | CRITICAL \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"13 May 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/25168"}, {"timestamp": "2025-05-13T12:43:21.837Z", "date_only": false, "value": "2025-05-13T12:43:21.837071Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thezero.org/post/3lp2j5kmfyk2c", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "0cf3dea0-780b-4b38-984c-6fb51d9cc6b4", "url": "https://bsky.app/profile/thezero.org/post/3lp2j5kmfyk2c"}, {"timestamp": "2025-05-14T08:13:04.428Z", "date_only": false, "value": "2025-05-14T08:13:04.428384Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shiojiri.com/post/3lp4kj4pqqs24", "record": "cve-2025-4632", "field": "creation_timestamp", "uuid": "9121265e-933e-477c-bc1a-a6829a91c382", "url": "https://bsky.app/profile/shiojiri.com/post/3lp4kj4pqqs24"}, {"timestamp": "2025-05-14T15:57:00Z", "date_only": false, "value": "2025-05-14T15:57:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2025/05/samsung-patches-cve-2025-4632-used-to.html", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "db8f0b2b-c224-44ae-9ca5-7be76fd3c6c1", "url": "https://thehackernews.com/2025/05/samsung-patches-cve-2025-4632-used-to.html"}, {"timestamp": "2025-05-14T18:03:16Z", "date_only": false, "value": "2025-05-14T18:03:16.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/DarkWebInformer_News/4508", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "4f5e57c4-684e-418b-a0d8-20a91882b48b", "content": "\ud83d\udea8 News Alert!\n\nSource: The Hacker News\nTitle: Samsung Patches CVE-2025-4632 Used to Deploy Mirai Botnet via MagicINFO 9 Exploit\nLink: https://thehackernews.com/2025/05/samsung-patches-cve-2025-4632-used-to.html", "url": "https://t.me/DarkWebInformer_News/4508"}, {"timestamp": "2025-05-14T18:09:36Z", "date_only": false, "value": "2025-05-14T18:09:36.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/235334", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "4b755e0b-fff2-4fe4-8532-899a83cdeaaf", "content": "Samsung Patches CVE-2025-4632 Used to Deploy Mirai Botnet via MagicINFO 9 Exploit\nhttps://ift.tt/cgDwhsi", "url": "https://t.me/ctinow/235334", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-05-14T18:22:50.646Z", "date_only": false, "value": "2025-05-14T18:22:50.646315Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lp5mgttbhb42", "record": "cve-2025-4632", "field": "creation_timestamp", "uuid": "ad24056b-46bc-4d88-ab10-fd870f721ed6", "url": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lp5mgttbhb42"}, {"timestamp": "2025-05-14T18:23:50.163Z", "date_only": false, "value": "2025-05-14T18:23:50.163495Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cti-news.bsky.social/post/3lp5mncfasd2n", "record": "cve-2025-4632", "field": "creation_timestamp", "uuid": "8de5ebc9-309f-49cb-b683-75153260c329", "url": "https://bsky.app/profile/cti-news.bsky.social/post/3lp5mncfasd2n"}, {"timestamp": "2025-05-14T18:29:10.380Z", "date_only": false, "value": "2025-05-14T18:29:10.380862Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/nimblenerd.social/post/3lp5mwt6dnf26", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "b3a7878a-29a6-42fb-8201-233a1815f073", "url": "https://bsky.app/profile/nimblenerd.social/post/3lp5mwt6dnf26"}, {"timestamp": "2025-05-14T18:33:00.599Z", "date_only": false, "value": "2025-05-14T18:33:00.599173Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3lp5n5oghh52v", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "587663d6-f77c-4667-9cfb-e970231f08f1", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3lp5n5oghh52v"}, {"timestamp": "2025-05-14T18:41:35.985Z", "date_only": false, "value": "2025-05-14T18:41:35.985873Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3lp5nksh33m42", "record": "cve-2025-4632", "field": "creation_timestamp", "uuid": "a70a356d-03b7-44f6-98a3-57053aeaee09", "url": "https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3lp5nksh33m42"}, {"timestamp": "2025-05-14T18:41:37.805Z", "date_only": false, "value": "2025-05-14T18:41:37.805840Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3lp5nl2wimhz2", "record": "cve-2025-4632", "field": "creation_timestamp", "uuid": "49311b8d-1823-4095-94e1-74b1fe3e9542", "url": "https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3lp5nl2wimhz2"}, {"timestamp": "2025-05-14T18:58:58.835Z", "date_only": false, "value": "2025-05-14T18:58:58.835970Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3lp5og5lkq3z2", "record": "cve-2025-4632", "field": "creation_timestamp", "uuid": "71930287-d6a9-4c97-8ee9-311fbe8e9c4d", "url": "https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3lp5og5lkq3z2"}, {"timestamp": "2025-05-14T19:00:06.343Z", "date_only": false, "value": "2025-05-14T19:00:06.343308Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/techit.bsky.social/post/3lp5oo333432k", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "8abf14a6-73f2-4c3d-8fbb-2c86d582f4ca", "url": "https://bsky.app/profile/techit.bsky.social/post/3lp5oo333432k"}, {"timestamp": "2025-05-14T20:01:26Z", "date_only": false, "value": "2025-05-14T20:01:26.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/x1eex3kndcEqy6z661kya4yDXTj4TvSSihGKNCSEdQmepQ", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "93205096-6250-43d2-aae3-38abbb292cc2", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-05-14T20:03:33Z", "date_only": false, "value": "2025-05-14T20:03:33.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/TengkorakCyberCrewzz/2274", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "2c06a643-156d-410f-85b5-955a618a0971", "content": "Samsung Patches CVE-2025-4632 Used to Deploy Mirai Botnet via MagicINFO 9 Exploit \u2013 thehackernews.com\n\nThu, 15 May 2025 01:57:00", "url": "https://t.me/TengkorakCyberCrewzz/2274", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-05-14T20:04:53Z", "date_only": false, "value": "2025-05-14T20:04:53.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/6838", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "9b7f4cd4-2a99-4b95-8380-938ca11075fb", "content": "\ud83d\uded1 Actively Exploited Samsung Flaw Hits Critical Alert!\n\nPoC dropped. Exploits followed fast.\n\nA 9.8 CVSS bug in Samsung\u2019s MagicINFO 9 Server (CVE-2025-4632) is being used in the wild\u2014even to deploy Mirai malware.\n\nRead \u2192 https://thehackernews.com/2025/05/samsung-patches-cve-2025-4632-used-to.html", "url": "https://t.me/thehackernews/6838", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-05-14T20:54:02.147Z", "date_only": false, "value": "2025-05-14T20:54:02.147342Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3lp5uudyycgr2", "record": "cve-2025-4632", "field": "creation_timestamp", "uuid": "931ff940-4769-4d77-9d82-e94de27eec94", "url": "https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3lp5uudyycgr2"}, {"timestamp": "2025-05-14T21:05:52Z", "date_only": false, "value": "2025-05-14T21:05:52.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/cibsecurity/84760", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "49e0288b-278d-4c12-9e8d-c748f49121e6", "content": "\ud83d\udd8b\ufe0f Samsung Patches CVE-2025-4632 Used to Deploy Mirai Botnet via MagicINFO 9 Exploit \ud83d\udd8b\ufe0f\n\nSamsung has released software updates to address a critical security flaw in MagicINFO 9 Server that has been actively exploited in the wild. The vulnerability, tracked as CVE20254632 CVSS score 9.8, has been described as a path traversal flaw. \"Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to.\n\n\ud83d\udcd6 Read more.\n\n\ud83d\udd17 Via \"The Hacker News\"\n\n----------\n\ud83d\udc41\ufe0f Seen on @cibsecurity", "url": "https://t.me/cibsecurity/84760", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-05-14T21:50:49Z", "date_only": false, "value": "2025-05-14T21:50:49.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/cibsecurity/84761", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "37fae475-ea77-40f5-b47b-2d7c450b2dde", "content": "\ud83d\udd8b\ufe0f Samsung Patches CVE-2025-4632 Used to Deploy Mirai Botnet via MagicINFO 9 Exploit \ud83d\udd8b\ufe0f\n\nSamsung has released software updates to address a critical security flaw in MagicINFO 9 Server that has been actively exploited in the wild. The vulnerability, tracked as CVE20254632 CVSS score 9.8, has been described as a path traversal flaw. \"Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to.\n\n\ud83d\udcd6 Read more.\n\n\ud83d\udd17 Via \"The Hacker News\"\n\n----------\n\ud83d\udc41\ufe0f Seen on @cibsecurity", "url": "https://t.me/cibsecurity/84761", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-05-14T21:50:49Z", "date_only": false, "value": "2025-05-14T21:50:49.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/cibsecurity/84762", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "f0cda18d-b9e5-4143-8b9a-f25ef7cea3af", "content": "\ud83d\udd8b\ufe0f Samsung Patches CVE-2025-4632 Used to Deploy Mirai Botnet via MagicINFO 9 Exploit \ud83d\udd8b\ufe0f\n\nSamsung has released software updates to address a critical security flaw in MagicINFO 9 Server that has been actively exploited in the wild. The vulnerability, tracked as CVE20254632 CVSS score 9.8, has been described as a path traversal flaw. \"Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to.\n\n\ud83d\udcd6 Read more.\n\n\ud83d\udd17 Via \"The Hacker News\"\n\n----------\n\ud83d\udc41\ufe0f Seen on @cibsecurity", "url": "https://t.me/cibsecurity/84762", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-05-14T22:03:33Z", "date_only": false, "value": "2025-05-14T22:03:33.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/MalaysiaHacktivistz/12950", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "02522b7b-d69d-45b1-b82d-1a58c639914e", "content": "Samsung Patches CVE-2025-4632 Used to Deploy Mirai Botnet via MagicINFO 9 Exploit \u2013 thehackernews.com\n\nThu, 15 May 2025 01:57:00", "url": "https://t.me/MalaysiaHacktivistz/12950", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-05-14T22:03:33Z", "date_only": false, "value": "2025-05-14T22:03:33.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/MalaysiaHacktivistz/4144", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "e67038d4-c83d-425c-a959-44fc0d1c41b8", "content": "Samsung Patches CVE-2025-4632 Used to Deploy Mirai Botnet via MagicINFO 9 Exploit \u2013 thehackernews.com\n\nThu, 15 May 2025 01:57:00", "url": "https://t.me/MalaysiaHacktivistz/4144", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-05-14T22:03:33Z", "date_only": false, "value": "2025-05-14T22:03:33.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/TengkorakCyberCrewzz/30984", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "48b1034d-d838-48c8-9790-ea198445e494", "content": "Samsung Patches CVE-2025-4632 Used to Deploy Mirai Botnet via MagicINFO 9 Exploit \u2013 thehackernews.com\n\nThu, 15 May 2025 01:57:00", "url": "https://t.me/TengkorakCyberCrewzz/30984", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-05-15T00:56:49.102Z", "date_only": false, "value": "2025-05-15T00:56:49.102534Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ninjaowl.ai/post/3lp6clybmhh2d", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "9503bc6b-9c02-4544-9c56-9c4ba10e15eb", "url": "https://bsky.app/profile/ninjaowl.ai/post/3lp6clybmhh2d"}, {"timestamp": "2025-05-15T05:09:07Z", "date_only": false, "value": "2025-05-15T05:09:07.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/CyberBulletin/3266", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "6c553f47-ebc3-413e-8f0f-0dc14f3f0387", "content": "\u26a1\ufe0fSamsung Patches CVE-2025-4632 Used to Deploy Mirai Botnet via MagicINFO 9 Exploit.\n\n#CyberBulletin", "url": "https://t.me/CyberBulletin/3266", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-05-15T08:12:24.831Z", "date_only": false, "value": "2025-05-15T08:12:24.831319Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shiojiri.com/post/3lp72wvkgvc2k", "record": "cve-2025-4632", "field": "creation_timestamp", "uuid": "ae8d412d-df5e-4354-b770-9d0921f6c3f8", "url": "https://bsky.app/profile/shiojiri.com/post/3lp72wvkgvc2k"}, {"timestamp": "2025-05-15T09:44:25.942Z", "date_only": false, "value": "2025-05-15T09:44:25.942645Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/reconbee.bsky.social/post/3lp7a3dc6dc2j", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "fe62d3ca-9a93-48da-89fc-dcd68b62e50b", "url": "https://bsky.app/profile/reconbee.bsky.social/post/3lp7a3dc6dc2j"}, {"timestamp": "2025-05-15T14:43:02Z", "date_only": false, "value": "2025-05-15T14:43:02.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/7034", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "f1591dd9-3f64-42ab-9585-adf1c87721fc", "content": "Samsung \u043f\u043e\u0444\u0438\u043a\u0441\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 MagicINFO 9 Server, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2025-4632 (CVSS: 9,8) \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0431\u0445\u043e\u0434\u043e\u043c \u043f\u0443\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044f \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0434\u043e 21.1052 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0421\u0442\u043e\u0438\u0442 \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e CVE-2025-4632 - \u044d\u0442\u043e \u043e\u0431\u0445\u043e\u0434\u043d\u043e\u0439 \u043f\u0430\u0442\u0447 \u0434\u043b\u044f CVE-2024-7399, \u0434\u0440\u0443\u0433\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0443\u0442\u0438 \u0432 \u0442\u043e\u043c \u0436\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0435, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 Samsung \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u0435 2024 \u0433\u043e\u0434\u0430.\n\n\u041f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 30 \u0430\u043f\u0440\u0435\u043b\u044f 2025 \u0433\u043e\u0434\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 SSD Disclosure \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f\u0430 PoC CVE-2025-4632 \u0441\u0442\u0430\u043b\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f\u00a0\u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445, \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445 \u0434\u0430\u0436\u0435 \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0431\u043e\u0442\u043d\u0435\u0442\u0430 Mirai.\n\n\u041f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u0430\u0442\u0430\u043a\u0438 \u0431\u044b\u043b\u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2024-7399.\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 Huntress \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043f\u0435\u0440\u0432\u043e\u043f\u0440\u0438\u0447\u0438\u043d\u0443 \u0438 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0438 \u0435\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0430 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u0430\u0445 MagicINFO 9 Server, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 21.1050.\n\n\u0412 \u0441\u0432\u043e\u0435\u043c \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c \u043e\u0442\u0447\u0435\u0442\u0435 \u043e\u0442 9 \u043c\u0430\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Huntress \u0443\u043f\u043e\u043c\u044f\u043d\u0443\u043b\u0438\u00a0\u043e \u0442\u0440\u0435\u0445 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u0445, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 CVE-2025-4632.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u043d\u0435\u043e\u043f\u043e\u0437\u043d\u0430\u043d\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0447\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 \u043a\u043e\u043c\u0430\u043d\u0434 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u043d\u0430\u0433\u0440\u0443\u0437\u043e\u043a srvany.exe \u0438 services.exe \u043d\u0430 \u0434\u0432\u0443\u0445 \u0445\u043e\u0441\u0442\u0430\u0445 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u043b\u0438 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0443 \u043d\u0430 \u0442\u0440\u0435\u0442\u044c\u0435\u043c.\n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Samsung MagicINFO 9 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u0434\u0430\u0431\u044b \u043d\u0435 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0442\u044c \u043f\u043e\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0441\u043f\u0438\u0441\u043e\u043a \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b\u0445 \u043d\u0430 \u0442\u0435\u043a\u0443\u0449\u0438\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0436\u0435\u0440\u0442\u0432.", "url": "https://t.me/true_secator/7034", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-05-15T14:50:38.172Z", "date_only": false, "value": "2025-05-15T14:50:38.172762Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3lp7r6xmfmb27", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "b1c848cd-3c67-4aa1-bd4e-d9f1145ae6f4", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3lp7r6xmfmb27"}, {"timestamp": "2025-05-15T17:10:38Z", "date_only": false, "value": "2025-05-15T17:10:38.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.darkreading.com/endpoint-security/attackers-target-samsung-magicinfo-server-bug", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "3325a456-09c4-4ada-98dc-226a827f6e0d", "url": "https://www.darkreading.com/endpoint-security/attackers-target-samsung-magicinfo-server-bug"}, {"timestamp": "2025-05-15T18:50:52.248Z", "date_only": false, "value": "2025-05-15T18:50:52.248183Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3lpa6mjxqas2c", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "58a6da55-9a8e-4eed-8a4c-c2645b3d570a", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3lpa6mjxqas2c"}, {"timestamp": "2025-05-15T21:02:32.933Z", "date_only": false, "value": "2025-05-15T21:02:32.933881Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lpafxu3rvj2c", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "c2b81a27-16fb-49c2-9dfd-40f47e0b1113", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lpafxu3rvj2c"}, {"timestamp": "2025-05-16T05:16:07Z", "date_only": false, "value": "2025-05-16T05:16:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/samsung-rilevato-sfruttamento-in-rete-della-cve-2025-4632-relativa-a-magicinfo", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "3bc8a5a7-dca6-4aab-b5d3-933736715325", "url": "https://www.acn.gov.it/portale/w/samsung-rilevato-sfruttamento-in-rete-della-cve-2025-4632-relativa-a-magicinfo"}, {"timestamp": "2025-05-16T12:29:27.495Z", "date_only": false, "value": "2025-05-16T12:29:27.495750Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/jbhall56/statuses/114517512490374930", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "bfc495cc-f56a-4aca-ac51-7c134abdf611", "url": "https://infosec.exchange/users/jbhall56/statuses/114517512490374930"}, {"timestamp": "2025-05-16T12:29:35.762Z", "date_only": false, "value": "2025-05-16T12:29:35.762417Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jbhall56.bsky.social/post/3lpbzrnyqfk25", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "e19df3be-1548-4092-ad81-eb6737666a20", "url": "https://bsky.app/profile/jbhall56.bsky.social/post/3lpbzrnyqfk25"}, {"timestamp": "2025-05-22T00:00:00Z", "date_only": false, "value": "2025-05-22T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2025-4632", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "19c7bf81-024f-40ee-8fb8-6d02010e2383", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-05-22T00:00:00Z", "date_only": true, "value": "2025-05-22", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-4632", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2025-05-22T00:00:00Z", "date_only": true, "value": "2025-05-22", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2025-4632", "field": "evidence.0.details.date_added", "uuid": "19c7bf81-024f-40ee-8fb8-6d02010e2383", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-05-22T00:00:00Z", "date_only": false, "value": "2025-05-22T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2025-4632", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "19c7bf81-024f-40ee-8fb8-6d02010e2383", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-05-22T00:00:00Z", "date_only": false, "value": "2025-05-22T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2025-4632", "field": "status.status_updated_at", "uuid": "19c7bf81-024f-40ee-8fb8-6d02010e2383", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-05-22T00:00:00Z", "date_only": false, "value": "2025-05-22T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-4632", "field": "containers.adp.0.timeline.0.time", "text": "CVE-2025-4632 added to CISA KEV"}, {"timestamp": "2025-05-22T17:15:15.641Z", "date_only": false, "value": "2025-05-22T17:15:15.641577Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3lprmjzxrss2n", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "ab2d8340-c016-4134-a0d0-dfe537104e26", "url": "https://bsky.app/profile/cyberalerts.bsky.social/post/3lprmjzxrss2n"}, {"timestamp": "2025-05-22T18:26:12.282Z", "date_only": false, "value": "2025-05-22T18:26:12.282528Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/4064350", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "b6c6557d-e467-4fd0-ae3c-3e504c867ba6", "url": "https://feedsin.space/feed/CISAKevBot/items/4064350"}, {"timestamp": "2025-05-22T19:06:35.185Z", "date_only": false, "value": "2025-05-22T19:06:35.185115Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/nimblenerd.social/post/3lprsr3o6fc2f", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "9e1be2f8-3f31-4d58-a971-d676412fc519", "url": "https://bsky.app/profile/nimblenerd.social/post/3lprsr3o6fc2f"}, {"timestamp": "2025-05-22T21:51:20.791Z", "date_only": false, "value": "2025-05-22T21:51:20.791596Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lps3xo6ksc2d", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "c4b155b0-727f-4f97-8f51-027335a0a9d7", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lps3xo6ksc2d"}, {"timestamp": "2025-05-23T00:30:06.276Z", "date_only": false, "value": "2025-05-23T00:30:06.276828Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3lpsetlwmjv2y", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "5de9a596-1520-4238-a415-d7ce6b4f2346", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3lpsetlwmjv2y"}, {"timestamp": "2025-05-23T14:52:26.430Z", "date_only": false, "value": "2025-05-23T14:52:26.430223Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3lptuzh7r3c2u", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "6ea357a0-6c55-4e7c-aa67-2954a0f5839d", "url": "https://bsky.app/profile/basefortify.bsky.social/post/3lptuzh7r3c2u"}, {"timestamp": "2025-05-23T18:37:39.108Z", "date_only": false, "value": "2025-05-23T18:37:39.108755Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pigondrugs.bsky.social/post/3lpubmc54732w", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "ea4e415a-66a1-4d9f-8811-728567ad23cd", "url": "https://bsky.app/profile/pigondrugs.bsky.social/post/3lpubmc54732w"}, {"timestamp": "2025-05-23T21:02:30.293Z", "date_only": false, "value": "2025-05-23T21:02:30.293007Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lpujoxojec2u", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "5e425b0e-9904-419b-811a-388822218657", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lpujoxojec2u"}, {"timestamp": "2025-05-24T14:04:31.345Z", "date_only": false, "value": "2025-05-24T14:04:31.345801Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lpwcspxg2k2l", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "9a6981e9-1ac8-4da0-b8e0-6fad0550806e", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lpwcspxg2k2l"}, {"timestamp": "2025-05-24T14:07:32.463Z", "date_only": false, "value": "2025-05-24T14:07:32.463384Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lpwcy6ehsk2l", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "92a4dc6a-06af-427c-8bf3-6618682aa5b4", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lpwcy6ehsk2l"}, {"timestamp": "2025-05-26T08:13:40.829Z", "date_only": false, "value": "2025-05-26T08:13:40.829405Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/keiwork35.bsky.social/post/3lq2q5bmsr32d", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "fe879566-99ac-48c7-bb81-45934126149c", "url": "https://bsky.app/profile/keiwork35.bsky.social/post/3lq2q5bmsr32d"}, {"timestamp": "2025-05-28T00:00:00Z", "date_only": true, "value": "2025-05-28", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2025-12760", "record": "CNVD-2025-12760", "field": "submitTime", "linked_record": true}, {"timestamp": "2025-06-12T00:00:00Z", "date_only": true, "value": "2025-06-12", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2025-4632", "field": "evidence.0.details.due_date", "uuid": "19c7bf81-024f-40ee-8fb8-6d02010e2383", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-06-17T00:00:00Z", "date_only": true, "value": "2025-06-17", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2025-12760", "record": "CNVD-2025-12760", "field": "openTime", "linked_record": true}, {"timestamp": "2025-06-23T03:06:17.403Z", "date_only": false, "value": "2025-06-23T03:06:17.403896Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/dasgeldco.bsky.social/post/3lsalzfkqoz2l", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "3635cec7-d6ec-4980-bd78-c7c9b86215c5", "url": "https://bsky.app/profile/dasgeldco.bsky.social/post/3lsalzfkqoz2l"}, {"timestamp": "2025-08-20T03:56:08.237Z", "date_only": false, "value": "2025-08-20T03:56:08.237171Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-4632", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-08-20T03:56:08.237Z", "date_only": false, "value": "2025-08-20T03:56:08.237171Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-4632", "record": "FKIE_CVE-2025-4632", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2025-08-22T20:40:04Z", "date_only": false, "value": "2025-08-22T20:40:04.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-4632.yaml", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "ab249fe9-cbc4-4853-9421-b4764a56810d", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-4632.yaml"}, {"timestamp": "2025-08-23T21:02:31.148Z", "date_only": false, "value": "2025-08-23T21:02:31.148315Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lx3ulrn2f726", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "d9b5af56-6007-43ae-8edf-ea570a4ad084", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lx3ulrn2f726"}, {"timestamp": "2025-09-28T08:23:31Z", "date_only": false, "value": "2025-09-28T08:23:31.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "0e1acaef-2f03-472f-8f13-a778aea82139"}, {"timestamp": "2025-09-29T03:12:18Z", "date_only": false, "value": "2025-09-29T03:12:18.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "28d6bb91-0c9b-4acd-900c-eebb94e35d70"}, {"timestamp": "2025-10-22T00:33:18Z", "date_only": false, "value": "2025-10-22T00:33:18Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-CMWW-723F-496G", "record": "GHSA-CMWW-723F-496G", "field": "modified", "linked_record": true}, {"timestamp": "2026-02-02T12:26:00.337Z", "date_only": false, "value": "2026-02-02T12:26:00.337293Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/19c7bf81-024f-40ee-8fb8-6d02010e2383", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "fd037114-03ac-47e6-b408-b55e9894f9a9", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/19c7bf81-024f-40ee-8fb8-6d02010e2383", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-02-26T18:28:36.767Z", "date_only": false, "value": "2026-02-26T18:28:36.767Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-4632", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-02-26T18:28:36.767Z", "date_only": false, "value": "2026-02-26T18:28:36.767Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-4632", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-05-07T03:00:06Z", "date_only": false, "value": "2026-05-07T03:00:06.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/N1Jo8qZWaWReiL_t-N5l6uzcgIVKcO6O8PdoiYgN9aP0HPY", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "3a45e166-5bd2-4580-a629-8c2d40514887"}, {"timestamp": "2026-06-01T10:37:52Z", "date_only": false, "value": "2026-06-01T10:37:52+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2025-4632", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "f8d27ec3-cb8a-4f14-9ed4-af94c82cca74", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T10:37:52Z", "date_only": false, "value": "2026-06-01T10:37:52+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2025-4632", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "f8d27ec3-cb8a-4f14-9ed4-af94c82cca74", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T10:37:52Z", "date_only": false, "value": "2026-06-01T10:37:52+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2025-4632", "field": "status.status_updated_at", "uuid": "f8d27ec3-cb8a-4f14-9ed4-af94c82cca74", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T10:37:52.172Z", "date_only": false, "value": "2026-06-01T10:37:52.172Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2025-4632", "field": "evidence.0.details.added_date", "uuid": "f8d27ec3-cb8a-4f14-9ed4-af94c82cca74", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-17T09:33:39.023Z", "date_only": false, "value": "2026-06-17T09:33:39.023", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-4632", "record": "FKIE_CVE-2025-4632", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-06-19T12:45:27.957Z", "date_only": false, "value": "2026-06-19T12:45:27.957284Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/61444ce0-5e5a-4abb-84dd-5f0f7a3cfdde", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "7e02cca1-6421-4dfc-9571-6972e6ba7fa0", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/61444ce0-5e5a-4abb-84dd-5f0f7a3cfdde", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-23T14:02:37Z", "date_only": false, "value": "2026-06-23T14:02:37+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2025-4632", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "f8d27ec3-cb8a-4f14-9ed4-af94c82cca74", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T14:03:53.180Z", "date_only": false, "value": "2026-06-23T14:03:53.180965Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f8d27ec3-cb8a-4f14-9ed4-af94c82cca74", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "a8a77ac4-5966-43d0-acc0-af6a69a5532a", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f8d27ec3-cb8a-4f14-9ed4-af94c82cca74", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-14T16:00:15.798Z", "date_only": false, "value": "2026-08-14T16:00:15.798738Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/purp_sec/623", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "becc5f89-a760-4028-8839-11bc1f699270", "content": "\u0421\u043e\u0431\u0440\u0430\u043b \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e CVE, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435.\n\n\ud83d\udd35 CVE-2025-27920 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0439 \u0432 Output Messenger. \u041f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \"../\" \u0432 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u0430\u043c \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0438.\n\n\ud83d\udd35 CVE-2025-4647 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 Centreon. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043c\u043e\u0436\u0435\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438, \u043f\u043e\u0434\u043c\u0435\u043d\u044f\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0433\u043e SVG-\u0444\u0430\u0439\u043b\u0430, \u0430 \u043f\u043e\u0441\u043b\u0435 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u0441\u044f \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b.\n\n\ud83d\udd35 CVE-2025-42999 \u2014 \u0431\u0430\u0433 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Metadata Uploader \u0432 SAP NetWeaver Visual Composer. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u043f\u043e\u043b\u0443\u0447\u0438\u0432 \u043d\u0443\u0436\u043d\u044b\u0435 \u043f\u0440\u0430\u0432\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0444\u0430\u0439\u043b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\ud83d\udd35 CVE-2025-4632 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Samsung MagicINFO 9, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435\u043c \u043f\u0443\u0442\u0438 \u043a \u0444\u0430\u0439\u043b\u0430\u043c. \u041f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0447\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u0443 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\ud83d\udd35 CVE-2025-22249 \u2014 DOM-based XSS \u0432 VMware Aria Automation. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0445\u0438\u0442\u0438\u0442\u044c \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0443 \u0432\u043e\u0448\u0435\u0434\u0448\u0438\u0445 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043f\u043e\u0431\u0443\u0434\u0438\u0432 \u0438\u0445 \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u043f\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0441\u0441\u044b\u043b\u043a\u0435. \u041f\u043e\u0441\u043b\u0435 \u043a\u043b\u0438\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0441\u043a\u0440\u0438\u043f\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435, \u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0441\u0441\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n#blue_team #CVE_\u0434\u043d\u044f", "url": "https://t.me/purp_sec/623"}, {"timestamp": "2026-08-27T20:00:07.772Z", "date_only": false, "value": "2026-08-27T20:00:07.772187Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberSecurityExploit/17062", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "3796bcd4-0ece-47d7-b352-a5f04956d66c", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today)\nBelow are several recent CVE vulnerabilities with public Proof-of-Concept repositories on GitHub, useful for vulnerability research and exploit analysis.\n\n1\ufe0f\u20e3 CVE-2025-4632\n\ud83c\udfaf Grafana Path Traversal Vulnerability\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/Chocapikk/CVE-2025-4632\n\n\ud83e\udde0 Overview\nA path traversal vulnerability in Grafana allows attackers to access sensitive files on the server by manipulating request paths.\nThe vulnerability can expose configuration files, credentials, or other sensitive data stored on the system.\n\n\u2699\ufe0f Impact\n\u2022 Sensitive file disclosure\n\u2022 Configuration leakage\n\u2022 Potential lateral movement\n\n\u2796\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2025-49144\n\ud83c\udfaf Roundcube Webmail \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/numanturle/CVE-2025-49144\n\n\ud83e\udde0 Overview\nA vulnerability in Roundcube Webmail allows attackers to achieve remote code execution through crafted input handling in specific components of the application.\n\n\u2699\ufe0f Impact\n\u2022 Remote command execution\n\u2022 Webmail server compromise\n\u2022 Potential mail system takeover\n\n\u2796\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2025-34028\n\ud83c\udfaf GLPI IT Asset Management \u2013 Arbitrary File Upload\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/h4x0r-dz/CVE-2025-34028\n\n\ud83e\udde0 Overview\nA file upload vulnerability affecting GLPI IT management platform allows attackers to upload malicious files that can lead to remote code execution.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Server compromise\n\n\u2796\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2025-30208\n\ud83c\udfaf Next.js Middleware Security Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/chebuya/CVE-2025-30208\n\n\ud83e\udde0 Overview\nA vulnerability in Next.js middleware handling allows attackers to bypass certain security checks due to improper request validation.\n\n\u2699\ufe0f Impact\n\u2022 Security control bypass\n\u2022 Authentication logic manipulation\n\u2022 Potential access control issues\n\n\u2796\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2025-24054\n\ud83c\udfaf Windows NTLM Relay Attack\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/fortra/impacket\n\n\ud83e\udde0 Overview\nA vulnerability related to NTLM authentication relay attacks in Windows environments allows attackers to relay authentication attempts and gain unauthorized access to services.\n\n\u2699\ufe0f Impact\n\u2022 Credential relay attack\n\u2022 Unauthorized authentication\n\u2022 Lateral movement in networks\n\n\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\nThese PoC repositories can be useful for:\n\u2022 Vulnerability research\n\u2022 Exploit development study\n\u2022 Patch diff analysis\n\u2022 Red team / blue team exercises\n\n\u26a0\ufe0f Ethical Notice\nThis information is shared for cybersecurity research and defensive analysis only.\nDo not use vulnerability research for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "url": "https://t.me/CyberSecurityExploit/17062"}, {"timestamp": "2026-08-28T00:00:08.466Z", "date_only": false, "value": "2026-08-28T00:00:08.466127Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityExploit/17062", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "21c0bfcd-5cf4-4a55-8fe0-a2face220e23", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today)\nBelow are several recent CVE vulnerabilities with public Proof-of-Concept repositories on GitHub, useful for vulnerability research and exploit analysis.\n\n1\ufe0f\u20e3 CVE-2025-4632\n\ud83c\udfaf Grafana Path Traversal Vulnerability\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/Chocapikk/CVE-2025-4632\n\n\ud83e\udde0 Overview\nA path traversal vulnerability in Grafana allows attackers to access sensitive files on the server by manipulating request paths.\nThe vulnerability can expose configuration files, credentials, or other sensitive data stored on the system.\n\n\u2699\ufe0f Impact\n\u2022 Sensitive file disclosure\n\u2022 Configuration leakage\n\u2022 Potential lateral movement\n\n\u2796\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2025-49144\n\ud83c\udfaf Roundcube Webmail \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/numanturle/CVE-2025-49144\n\n\ud83e\udde0 Overview\nA vulnerability in Roundcube Webmail allows attackers to achieve remote code execution through crafted input handling in specific components of the application.\n\n\u2699\ufe0f Impact\n\u2022 Remote command execution\n\u2022 Webmail server compromise\n\u2022 Potential mail system takeover\n\n\u2796\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2025-34028\n\ud83c\udfaf GLPI IT Asset Management \u2013 Arbitrary File Upload\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/h4x0r-dz/CVE-2025-34028\n\n\ud83e\udde0 Overview\nA file upload vulnerability affecting GLPI IT management platform allows attackers to upload malicious files that can lead to remote code execution.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Server compromise\n\n\u2796\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2025-30208\n\ud83c\udfaf Next.js Middleware Security Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/chebuya/CVE-2025-30208\n\n\ud83e\udde0 Overview\nA vulnerability in Next.js middleware handling allows attackers to bypass certain security checks due to improper request validation.\n\n\u2699\ufe0f Impact\n\u2022 Security control bypass\n\u2022 Authentication logic manipulation\n\u2022 Potential access control issues\n\n\u2796\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2025-24054\n\ud83c\udfaf Windows NTLM Relay Attack\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/fortra/impacket\n\n\ud83e\udde0 Overview\nA vulnerability related to NTLM authentication relay attacks in Windows environments allows attackers to relay authentication attempts and gain unauthorized access to services.\n\n\u2699\ufe0f Impact\n\u2022 Credential relay attack\n\u2022 Unauthorized authentication\n\u2022 Lateral movement in networks\n\n\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\nThese PoC repositories can be useful for:\n\u2022 Vulnerability research\n\u2022 Exploit development study\n\u2022 Patch diff analysis\n\u2022 Red team / blue team exercises\n\n\u26a0\ufe0f Ethical Notice\nThis information is shared for cybersecurity research and defensive analysis only.\nDo not use vulnerability research for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "url": "https://t.me/CyberSecurityExploit/17062", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-04T05:00:05.221Z", "date_only": false, "value": "2026-09-04T05:00:05.221999Z", "kind": "sighting", "label": "Seen", "source": "Telegram/PY8bWpO043D-Z_8Y-HNjpKbgrcjpV_8amEBJErFv8jCkTtc", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "b5dc9569-fb90-42c6-8010-9276bcb2da6a"}, {"timestamp": "2026-09-05T01:00:37.893Z", "date_only": false, "value": "2026-09-05T01:00:37.893687Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/PY8bWpO043D-Z_8Y-HNjpKbgrcjpV_8amEBJErFv8jCkTtc", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "a1bc0984-6351-415d-85f5-3371ebe65374", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-24T16:21:00.724Z", "date_only": false, "value": "2026-09-24T16:21:00.724981Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwbny56sch2z", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "796fa534-c40b-4832-a6bf-7138230cb4fa", "content": "@huntress.com\nAttackers exploited Samsung MagicINFO, installed AnyDesk, disabled Defender, and compiled a Monero miner.\n-\nIOCs: 194[.]87[.]89[.]30, auto[.]c3pool[.]org, oldadministrator\n-\n#CVE-2025-4632 #Cryptominer #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwbny56sch2z"}, {"timestamp": "2026-09-24T19:45:33.713Z", "date_only": false, "value": "2026-09-24T19:45:33.713812Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwbzfw76ki2t", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "9d957d47-26ea-4473-a8ab-8836e8a76ab9", "content": "Huntress found an intrusion via Samsung MagicINFO CVE-2025-4632, followed by repeated AnyDesk installs, Defender tampering, and a SilentXMRMiner-based Monero miner compiled on the endpoint and tied to C3Pool. #MagicINFO #AnyDesk #C3Pool", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwbzfw76ki2t"}, {"timestamp": "2026-09-26T10:39:59.920Z", "date_only": false, "value": "2026-09-26T10:39:59.920963Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mwg3u7tli423", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "77fa3045-3cb6-43f4-b8fc-5126f20cb14d", "content": "Samsung signage turns into a Monero furnace while defenders read the memo\nPANIC 58% | Lag 0.0h | CVE-2025-4632 is being exploited in Samsung MagicINFO to run Monero mining on Windows systems. GrayZ\n#AfterShockIndex\nREAD MORE", "url": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mwg3u7tli423"}, {"timestamp": "2026-10-25T19:00:19Z", "date_only": false, "value": "2026-10-25T19:00:19.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/4eyM5E8Z25RiAND2ALeSHzIw0AMZWc--rFse8QLXJvCfd0c", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "c9fca8a0-da10-46f5-9f09-042ca131a170", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-25T19:00:19Z", "date_only": false, "value": "2026-10-25T19:00:19.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/4eyM5E8Z25RiAND2ALeSHzIw0AMZWc--rFse8QLXJvCfd0c", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "344292b3-3598-4650-8e52-b440d5575577"}, {"timestamp": "2026-10-29T01:50:18.430Z", "date_only": false, "value": "2026-10-29T01:50:18.430351Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sysadmin.co.in/post/3myy5ngasff23", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "ddfb737d-b1b9-4ae4-8f78-ea4f50b55a34", "content": "Random-named .jsp files on your Samsung MagicInfo server? It may be a web shell from CVE-2024-7399 / CVE-2025-4632. Here is how to check, clean up and patch.", "url": "https://bsky.app/profile/sysadmin.co.in/post/3myy5ngasff23"}, {"timestamp": "2026-11-04T13:31:51Z", "date_only": false, "value": "2026-11-04T13:31:51+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2025-4632", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "19c7bf81-024f-40ee-8fb8-6d02010e2383", "status": {"status_reason": "confirmed", "exploited": true}}], "metrics": {"as_of": "2026-11-11T05:37:24.545Z", "anchors": {"origin": {"timestamp": "2025-05-13T03:00:00Z", "date_only": false, "value": "2025-05-13T03:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / samsung.tv_appliance", "record": "CVE-2025-4632", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2025-05-13T03:00:00Z", "date_only": false, "value": "2025-05-13T03:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / samsung.tv_appliance", "record": "CVE-2025-4632", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-08-28T00:00:08.466Z", "date_only": false, "value": "2026-08-28T00:00:08.466127Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityExploit/17062", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "21c0bfcd-5cf4-4a55-8fe0-a2face220e23", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today)\nBelow are several recent CVE vulnerabilities with public Proof-of-Concept repositories on GitHub, useful for vulnerability research and exploit analysis.\n\n1\ufe0f\u20e3 CVE-2025-4632\n\ud83c\udfaf Grafana Path Traversal Vulnerability\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/Chocapikk/CVE-2025-4632\n\n\ud83e\udde0 Overview\nA path traversal vulnerability in Grafana allows attackers to access sensitive files on the server by manipulating request paths.\nThe vulnerability can expose configuration files, credentials, or other sensitive data stored on the system.\n\n\u2699\ufe0f Impact\n\u2022 Sensitive file disclosure\n\u2022 Configuration leakage\n\u2022 Potential lateral movement\n\n\u2796\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2025-49144\n\ud83c\udfaf Roundcube Webmail \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/numanturle/CVE-2025-49144\n\n\ud83e\udde0 Overview\nA vulnerability in Roundcube Webmail allows attackers to achieve remote code execution through crafted input handling in specific components of the application.\n\n\u2699\ufe0f Impact\n\u2022 Remote command execution\n\u2022 Webmail server compromise\n\u2022 Potential mail system takeover\n\n\u2796\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2025-34028\n\ud83c\udfaf GLPI IT Asset Management \u2013 Arbitrary File Upload\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/h4x0r-dz/CVE-2025-34028\n\n\ud83e\udde0 Overview\nA file upload vulnerability affecting GLPI IT management platform allows attackers to upload malicious files that can lead to remote code execution.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Server compromise\n\n\u2796\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2025-30208\n\ud83c\udfaf Next.js Middleware Security Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/chebuya/CVE-2025-30208\n\n\ud83e\udde0 Overview\nA vulnerability in Next.js middleware handling allows attackers to bypass certain security checks due to improper request validation.\n\n\u2699\ufe0f Impact\n\u2022 Security control bypass\n\u2022 Authentication logic manipulation\n\u2022 Potential access control issues\n\n\u2796\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2025-24054\n\ud83c\udfaf Windows NTLM Relay Attack\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/fortra/impacket\n\n\ud83e\udde0 Overview\nA vulnerability related to NTLM authentication relay attacks in Windows environments allows attackers to relay authentication attempts and gain unauthorized access to services.\n\n\u2699\ufe0f Impact\n\u2022 Credential relay attack\n\u2022 Unauthorized authentication\n\u2022 Lateral movement in networks\n\n\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\nThese PoC repositories can be useful for:\n\u2022 Vulnerability research\n\u2022 Exploit development study\n\u2022 Patch diff analysis\n\u2022 Red team / blue team exercises\n\n\u26a0\ufe0f Ethical Notice\nThis information is shared for cybersecurity research and defensive analysis only.\nDo not use vulnerability research for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "url": "https://t.me/CyberSecurityExploit/17062", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2025-05-14T18:09:36Z", "date_only": false, "value": "2025-05-14T18:09:36.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/235334", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "4b755e0b-fff2-4fe4-8532-899a83cdeaaf", "content": "Samsung Patches CVE-2025-4632 Used to Deploy Mirai Botnet via MagicINFO 9 Exploit\nhttps://ift.tt/cgDwhsi", "url": "https://t.me/ctinow/235334", "metric_role": "exploitation", "metric_basis": "sighting_report"}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 140976.0, "hours": 39.16, "days": 1.6316666666666666, "min_seconds": 140976.0, "max_seconds": 140976.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-05-13T03:00:00Z", "date_only": false, "value": "2025-05-13T03:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / samsung.tv_appliance", "record": "CVE-2025-4632", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2025-05-14T18:09:36Z", "date_only": false, "value": "2025-05-14T18:09:36.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/235334", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "4b755e0b-fff2-4fe4-8532-899a83cdeaaf", "content": "Samsung Patches CVE-2025-4632 Used to Deploy Mirai Botnet via MagicINFO 9 Exploit\nhttps://ift.tt/cgDwhsi", "url": "https://t.me/ctinow/235334", "metric_role": "exploitation", "metric_basis": "sighting_report"}}, "disclosure_to_exploit": {"available": true, "seconds": 140976.0, "hours": 39.16, "days": 1.6316666666666666, "min_seconds": 140976.0, "max_seconds": 140976.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-05-13T03:00:00Z", "date_only": false, "value": "2025-05-13T03:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / samsung.tv_appliance", "record": "CVE-2025-4632", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2025-05-14T18:09:36Z", "date_only": false, "value": "2025-05-14T18:09:36.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/235334", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "4b755e0b-fff2-4fe4-8532-899a83cdeaaf", "content": "Samsung Patches CVE-2025-4632 Used to Deploy Mirai Botnet via MagicINFO 9 Exploit\nhttps://ift.tt/cgDwhsi", "url": "https://t.me/ctinow/235334", "metric_role": "exploitation", "metric_basis": "sighting_report"}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 40770008.466, "hours": 11325.002351666666, "days": 471.8750979861111, "min_seconds": 40770008.466, "max_seconds": 40770008.466, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-05-13T03:00:00Z", "date_only": false, "value": "2025-05-13T03:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / samsung.tv_appliance", "record": "CVE-2025-4632", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-08-28T00:00:08.466Z", "date_only": false, "value": "2026-08-28T00:00:08.466127Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityExploit/17062", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "21c0bfcd-5cf4-4a55-8fe0-a2face220e23", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today)\nBelow are several recent CVE vulnerabilities with public Proof-of-Concept repositories on GitHub, useful for vulnerability research and exploit analysis.\n\n1\ufe0f\u20e3 CVE-2025-4632\n\ud83c\udfaf Grafana Path Traversal Vulnerability\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/Chocapikk/CVE-2025-4632\n\n\ud83e\udde0 Overview\nA path traversal vulnerability in Grafana allows attackers to access sensitive files on the server by manipulating request paths.\nThe vulnerability can expose configuration files, credentials, or other sensitive data stored on the system.\n\n\u2699\ufe0f Impact\n\u2022 Sensitive file disclosure\n\u2022 Configuration leakage\n\u2022 Potential lateral movement\n\n\u2796\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2025-49144\n\ud83c\udfaf Roundcube Webmail \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/numanturle/CVE-2025-49144\n\n\ud83e\udde0 Overview\nA vulnerability in Roundcube Webmail allows attackers to achieve remote code execution through crafted input handling in specific components of the application.\n\n\u2699\ufe0f Impact\n\u2022 Remote command execution\n\u2022 Webmail server compromise\n\u2022 Potential mail system takeover\n\n\u2796\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2025-34028\n\ud83c\udfaf GLPI IT Asset Management \u2013 Arbitrary File Upload\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/h4x0r-dz/CVE-2025-34028\n\n\ud83e\udde0 Overview\nA file upload vulnerability affecting GLPI IT management platform allows attackers to upload malicious files that can lead to remote code execution.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Server compromise\n\n\u2796\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2025-30208\n\ud83c\udfaf Next.js Middleware Security Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/chebuya/CVE-2025-30208\n\n\ud83e\udde0 Overview\nA vulnerability in Next.js middleware handling allows attackers to bypass certain security checks due to improper request validation.\n\n\u2699\ufe0f Impact\n\u2022 Security control bypass\n\u2022 Authentication logic manipulation\n\u2022 Potential access control issues\n\n\u2796\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2025-24054\n\ud83c\udfaf Windows NTLM Relay Attack\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/fortra/impacket\n\n\ud83e\udde0 Overview\nA vulnerability related to NTLM authentication relay attacks in Windows environments allows attackers to relay authentication attempts and gain unauthorized access to services.\n\n\u2699\ufe0f Impact\n\u2022 Credential relay attack\n\u2022 Unauthorized authentication\n\u2022 Lateral movement in networks\n\n\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\nThese PoC repositories can be useful for:\n\u2022 Vulnerability research\n\u2022 Exploit development study\n\u2022 Patch diff analysis\n\u2022 Red team / blue team exercises\n\n\u26a0\ufe0f Ethical Notice\nThis information is shared for cybersecurity research and defensive analysis only.\nDo not use vulnerability research for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "url": "https://t.me/CyberSecurityExploit/17062", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 47270244.545708, "hours": 13130.62348491889, "days": 547.1093118716204, "min_seconds": 47270244.545708, "max_seconds": 47270244.545708, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-05-13T03:00:00Z", "date_only": false, "value": "2025-05-13T03:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / samsung.tv_appliance", "record": "CVE-2025-4632", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T05:37:24.545Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 47129268.545708, "hours": 13091.46348491889, "days": 545.4776452049537, "min_seconds": 47129268.545708, "max_seconds": 47129268.545708, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-05-14T18:09:36Z", "date_only": false, "value": "2025-05-14T18:09:36.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/235334", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "4b755e0b-fff2-4fe4-8532-899a83cdeaaf", "content": "Samsung Patches CVE-2025-4632 Used to Deploy Mirai Botnet via MagicINFO 9 Exploit\nhttps://ift.tt/cgDwhsi", "url": "https://t.me/ctinow/235334", "metric_role": "exploitation", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-11T05:37:24.545Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 6500236.079708, "hours": 1805.621133252222, "days": 75.23421388550926, "min_seconds": 6500236.079708, "max_seconds": 6500236.079708, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-28T00:00:08.466Z", "date_only": false, "value": "2026-08-28T00:00:08.466127Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityExploit/17062", "record": "CVE-2025-4632", "field": "creation_timestamp", "uuid": "21c0bfcd-5cf4-4a55-8fe0-a2face220e23", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today)\nBelow are several recent CVE vulnerabilities with public Proof-of-Concept repositories on GitHub, useful for vulnerability research and exploit analysis.\n\n1\ufe0f\u20e3 CVE-2025-4632\n\ud83c\udfaf Grafana Path Traversal Vulnerability\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/Chocapikk/CVE-2025-4632\n\n\ud83e\udde0 Overview\nA path traversal vulnerability in Grafana allows attackers to access sensitive files on the server by manipulating request paths.\nThe vulnerability can expose configuration files, credentials, or other sensitive data stored on the system.\n\n\u2699\ufe0f Impact\n\u2022 Sensitive file disclosure\n\u2022 Configuration leakage\n\u2022 Potential lateral movement\n\n\u2796\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2025-49144\n\ud83c\udfaf Roundcube Webmail \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/numanturle/CVE-2025-49144\n\n\ud83e\udde0 Overview\nA vulnerability in Roundcube Webmail allows attackers to achieve remote code execution through crafted input handling in specific components of the application.\n\n\u2699\ufe0f Impact\n\u2022 Remote command execution\n\u2022 Webmail server compromise\n\u2022 Potential mail system takeover\n\n\u2796\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2025-34028\n\ud83c\udfaf GLPI IT Asset Management \u2013 Arbitrary File Upload\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/h4x0r-dz/CVE-2025-34028\n\n\ud83e\udde0 Overview\nA file upload vulnerability affecting GLPI IT management platform allows attackers to upload malicious files that can lead to remote code execution.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Server compromise\n\n\u2796\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2025-30208\n\ud83c\udfaf Next.js Middleware Security Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/chebuya/CVE-2025-30208\n\n\ud83e\udde0 Overview\nA vulnerability in Next.js middleware handling allows attackers to bypass certain security checks due to improper request validation.\n\n\u2699\ufe0f Impact\n\u2022 Security control bypass\n\u2022 Authentication logic manipulation\n\u2022 Potential access control issues\n\n\u2796\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2025-24054\n\ud83c\udfaf Windows NTLM Relay Attack\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/fortra/impacket\n\n\ud83e\udde0 Overview\nA vulnerability related to NTLM authentication relay attacks in Windows environments allows attackers to relay authentication attempts and gain unauthorized access to services.\n\n\u2699\ufe0f Impact\n\u2022 Credential relay attack\n\u2022 Unauthorized authentication\n\u2022 Lateral movement in networks\n\n\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\nThese PoC repositories can be useful for:\n\u2022 Vulnerability research\n\u2022 Exploit development study\n\u2022 Patch diff analysis\n\u2022 Red team / blue team exercises\n\n\u26a0\ufe0f Ethical Notice\nThis information is shared for cybersecurity research and defensive analysis only.\nDo not use vulnerability research for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "url": "https://t.me/CyberSecurityExploit/17062", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-11T05:37:24.545Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}