{"metadata": {"vulnerability": "CVE-2026-112352", "count": 17, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-19T14:41:46.702Z", "date_only": false, "value": "2026-10-19T14:41:46.702Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-112352", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-112352", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-27T19:43:34.052Z", "date_only": false, "value": "2026-10-27T19:43:34.052Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-112352", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-27T19:43:34.052Z", "date_only": false, "value": "2026-10-27T19:43:34.052Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-112352", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-27T19:52:33.476Z", "date_only": false, "value": "2026-10-27T19:52:33.476387Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117514617027547195", "record": "CVE-2026-112352", "field": "creation_timestamp", "uuid": "ad4fa1f3-08c0-4f65-adcc-fd725f5bb4de", "content": "CVE-2026-112352 Sunhillo SureLine Authentication Bypass via Session Cookie Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the login check in checkLogin (libwebcmn.so) and networkDiag.cgi, chaining into root command execution.\nhttps://www.cve.org/CVERecord?id=CVE-2026-112352https://www.sunhillo.com/product/sureline/https://www.vulncheck.com/advisories/sunhillo-sureline-authentication-bypass-via-session-cookie#sunhillo #SunhilloCorporation #SureLine#CVE_2026_112352#bot", "url": "https://infosec.exchange/users/cve/statuses/117514617027547195"}, {"timestamp": "2026-10-27T20:17:12Z", "date_only": false, "value": "2026-10-27T20:17:12Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-RVGW-426X-67HR", "record": "GHSA-RVGW-426X-67HR", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-27T20:17:12.997Z", "date_only": false, "value": "2026-10-27T20:17:12.997", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-112352", "record": "FKIE_CVE-2026-112352", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-27T21:30:05.146Z", "date_only": false, "value": "2026-10-27T21:30:05.146832Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3myv6n7o2lm2p", "record": "CVE-2026-112352", "field": "creation_timestamp", "uuid": "02be89fb-bb59-469e-9e3d-6064788d9b04", "content": "CVE-2026-112352\nVersions of Sunhillo SureLine earlier than 9.1.5 can be tricked into accepting a fake login cookie. An attacker on the network could guess common usernames and gain the same access as any logged\u2011in user,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3myv6n7o2lm2p"}, {"timestamp": "2026-10-27T21:33:42Z", "date_only": false, "value": "2026-10-27T21:33:42Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-RVGW-426X-67HR", "record": "GHSA-RVGW-426X-67HR", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-27T21:33:42Z", "date_only": false, "value": "2026-10-27T21:33:42Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-RVGW-426X-67HR", "record": "GHSA-RVGW-426X-67HR", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-27T22:07:51.374Z", "date_only": false, "value": "2026-10-27T22:07:51.374407Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/117515148950478255", "record": "cve-2026-112352", "field": "creation_timestamp", "uuid": "c2b44ca5-d0e6-4562-89cb-11a4f21137b3", "content": "Auth bypasses are so hot right now.\nhttps://nvd.nist.gov/vuln/detail/cve-2026-112352\n\nSunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the login check in checkLogin (libwebcmn.so) and networkDiag.cgi, chaining into root command execution.", "url": "https://infosec.exchange/users/cR0w/statuses/117515148950478255"}, {"timestamp": "2026-10-27T22:08:30.111Z", "date_only": false, "value": "2026-10-27T22:08:30.111732Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3myvarvhxdm2n", "record": "CVE-2026-112352", "field": "creation_timestamp", "uuid": "2c59282b-87ec-42bb-8397-b89ec04cb5f1", "content": "\ud83d\udea8 CVE-2026-112352 \u2014 CVSS 9.1 CRITICAL\n\nSunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticat...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-112352\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3myvarvhxdm2n"}, {"timestamp": "2026-10-28T14:58:19.702Z", "date_only": false, "value": "2026-10-28T14:58:19.702469Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-112352", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-28T14:58:19.702Z", "date_only": false, "value": "2026-10-28T14:58:19.702469Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-112352", "record": "FKIE_CVE-2026-112352", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-10-28T16:13:31.837Z", "date_only": false, "value": "2026-10-28T16:13:31.837Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-112352", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-28T16:13:31.837Z", "date_only": false, "value": "2026-10-28T16:13:31.837Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-112352", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-03T16:21:02.150Z", "date_only": false, "value": "2026-11-03T16:21:02.150", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-112352", "record": "FKIE_CVE-2026-112352", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-03T18:05:05.476Z", "anchors": {"origin": {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-112352", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-112352", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 669905.476209, "hours": 186.0848545025, "days": 7.753535604270833, "min_seconds": 583505.476209, "max_seconds": 669905.476209, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-112352", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-03T18:05:05.476Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}