{"metadata": {"vulnerability": "cve-2021-25003", "count": 58, "kinds": {"milestone": 4, "sighting": 34, "kev": 11, "other": 9}}, "data": [{"timestamp": "2021-01-14T00:00:00Z", "date_only": false, "value": "2021-01-14T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2021-25003", "field": "cveMetadata.dateReserved"}, {"timestamp": "2022-03-14T14:41:11Z", "date_only": false, "value": "2022-03-14T14:41:11.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2021-25003", "field": "cveMetadata.datePublished"}, {"timestamp": "2022-03-14T14:41:11Z", "date_only": false, "value": "2022-03-14T14:41:11.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / WPScan", "record": "cve-2021-25003", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2022-03-14T15:15:00Z", "date_only": false, "value": "2022-03-14T15:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-8PGH-M49H-QPXH", "record": "GHSA-8PGH-M49H-QPXH", "field": "database_specific.nvd_published_at"}, {"timestamp": "2022-03-14T15:15:00Z", "date_only": false, "value": "2022-03-14T15:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2021-25003", "record": "GSD-2021-25003", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2022-03-14T15:15:08.970Z", "date_only": false, "value": "2022-03-14T15:15:08.970", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-25003", "record": "FKIE_CVE-2021-25003", "field": "published"}, {"timestamp": "2022-03-15T00:00:59Z", "date_only": false, "value": "2022-03-15T00:00:59Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8PGH-M49H-QPXH", "record": "GHSA-8PGH-M49H-QPXH", "field": "published"}, {"timestamp": "2022-03-21T00:00:20Z", "date_only": false, "value": "2022-03-21T00:00:20Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8PGH-M49H-QPXH", "record": "GHSA-8PGH-M49H-QPXH", "field": "modified"}, {"timestamp": "2022-06-29T11:03:01Z", "date_only": false, "value": "2022-06-29T11:03:01.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/6293", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "5185d1f3-fd33-4191-a026-b83379ca5964", "content": "#exploit\n1. CVE-2021-25003:\nWordPress Plugin WPCargo < 6.9.0 - Unauthenticated RCE\nhttps://github.com/biulove0x/CVE-2021-25003\n\n2. CVE-2022-0441:\nWordPress Plugin MasterStudy LMS 2.7.5 - Unauthenticated Admin Account Creation\nhttps://github.com/biulove0x/CVE-2022-0441", "url": "https://t.me/CyberSecurityTechnologies/6293"}, {"timestamp": "2022-10-25T13:48:00Z", "date_only": false, "value": "2022-10-25T13:48Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2021-25003", "record": "GSD-2021-25003", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2022-12-08T09:11:43Z", "date_only": false, "value": "2022-12-08T09:11:43.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/poxek/2605", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "7ae5d21a-4341-4510-b5a7-169fd71cdbd8", "content": "CVE-2021-25003\n\nWPCargo < 6.9.0 - Unauthenticated RCE\n\n\u041f\u043b\u0430\u0433\u0438\u043d WPCargo Track & Trace WordPress \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 6.9.0 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0444\u0430\u0439\u043b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c PHP-\u0444\u0430\u0439\u043b \u0432 \u043b\u044e\u0431\u043e\u043c \u043c\u0435\u0441\u0442\u0435 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u0442 \u043a RCE\n\nPOC:\ngit clone https://github.com/biulove0x/CVE-2021-25003.git\ncd CVE-2021-25003/\npython3 -m pip install -r requirements.txt\npython3 WpCargo.py --help\n\n#CVE #POC", "url": "https://t.me/poxek/2605"}, {"timestamp": "2022-12-08T11:09:59Z", "date_only": false, "value": "2022-12-08T11:09:59.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/netrunnerz/359", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "0a699ed4-eb67-4f2e-8e86-e6487580620e", "content": "CVE-2021-25003\n\nWPCargo < 6.9.0 - Unauthenticated RCE\n\n\u041f\u043b\u0430\u0433\u0438\u043d WPCargo Track & Trace WordPress \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 6.9.0 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0444\u0430\u0439\u043b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c PHP-\u0444\u0430\u0439\u043b \u0432 \u043b\u044e\u0431\u043e\u043c \u043c\u0435\u0441\u0442\u0435 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u0442 \u043a RCE\n\nPOC:\ngit clone https://github.com/biulove0x/CVE-2021-25003.git\ncd CVE-2021-25003/\npython3 -m pip install -r requirements.txt\npython3 WpCargo.py --help\n\n#CVE #POC", "url": "https://t.me/netrunnerz/359"}, {"timestamp": "2023-04-27T09:45:08Z", "date_only": false, "value": "2023-04-27T09:45:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/leakes4/9532", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "0d281514-639f-4109-b28c-9c17adfc954e", "content": "[ Wordpress exploit ]\n==========================\n\nkids hungry for money are selling this as priv8 exploit \n\nCVE-2021-25003\nWPCargo < 6.9.0 - Unauthenticated RCE \n\nCVE-2022-1903\nARMember < 3.4.8 - Unauthenticated Admin Account Takeover \n\nCVE-2022-0441\nWordPress Plugin MasterStudy LMS 2.7.5 - Unauthenticated Admin Account Creation \n===========\n\n\nPosted on vip free \n\nJoin vip now @leak1239", "url": "https://t.me/leakes4/9532"}, {"timestamp": "2023-04-27T09:58:59Z", "date_only": false, "value": "2023-04-27T09:58:59.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-25003.yaml", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "90d6f72d-2578-4f8e-b817-5cc1257b2067", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-25003.yaml"}, {"timestamp": "2023-10-14T14:57:29Z", "date_only": false, "value": "2023-10-14T14:57:29+00:00", "kind": "kev", "label": "Asserted", "source": "shadowserver", "record": "CVE-2021-25003", "field": "timestamps.asserted_at", "uuid": "7dcae628-4945-472d-8b35-85af61ae5fd5", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2023-10-14T14:57:29Z", "date_only": false, "value": "2023-10-14T14:57:29+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2021-25003", "field": "timestamps.first_seen_at", "uuid": "7dcae628-4945-472d-8b35-85af61ae5fd5", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2023-12-13T01:23:21.480Z", "date_only": false, "value": "2023-12-13T01:23:21.480829Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-25003", "record": "GSD-2021-25003", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-08-03T19:49:14.534Z", "date_only": false, "value": "2024-08-03T19:49:14.534Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2021-25003", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-08-03T19:49:14.534Z", "date_only": false, "value": "2024-08-03T19:49:14.534Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "cve-2021-25003", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-01-26T00:00:00Z", "date_only": false, "value": "2025-01-26T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-01-26)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "b1c79b59-b28d-4dd9-a10c-3134eb2a6b82"}, {"timestamp": "2025-03-03T00:00:00Z", "date_only": false, "value": "2025-03-03T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-03-03)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "f641b736-a072-415f-becf-4d90b055d70b"}, {"timestamp": "2025-04-28T00:00:00Z", "date_only": false, "value": "2025-04-28T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2021-25003", "field": "timestamps.asserted_at", "uuid": "74abbcb1-a57a-4b07-9290-d8b93df5c22b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-04-28T00:00:00Z", "date_only": false, "value": "2025-04-28T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2021-25003", "field": "evidence.0.details.added_date", "uuid": "74abbcb1-a57a-4b07-9290-d8b93df5c22b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-04-28T00:00:00Z", "date_only": false, "value": "2025-04-28T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-28)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "96d4120b-b25f-491a-b8fb-73c920c5f9f6"}, {"timestamp": "2025-04-28T00:00:00Z", "date_only": false, "value": "2025-04-28T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2021-25003", "field": "timestamps.first_seen_at", "uuid": "74abbcb1-a57a-4b07-9290-d8b93df5c22b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-04-28T00:00:00Z", "date_only": false, "value": "2025-04-28T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2021-25003", "field": "status.status_updated_at", "uuid": "74abbcb1-a57a-4b07-9290-d8b93df5c22b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-05-16T00:00:00Z", "date_only": false, "value": "2025-05-16T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-16)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "30fbc95f-2fc7-42a2-bd48-6bd8178391d4"}, {"timestamp": "2025-06-23T00:00:00Z", "date_only": false, "value": "2025-06-23T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-23)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "cac8248e-fbc2-486c-b748-f9d450cf1f35"}, {"timestamp": "2025-08-21T00:00:00Z", "date_only": false, "value": "2025-08-21T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-08-21)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "26a60f17-5432-4502-b752-0a6d8a9aa441"}, {"timestamp": "2025-09-18T00:00:00Z", "date_only": false, "value": "2025-09-18T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-09-18)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "a50e7c34-fd5c-4e84-a91f-e80fd0c15a35"}, {"timestamp": "2025-10-04T00:00:00Z", "date_only": false, "value": "2025-10-04T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-10-04)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "10a69e0c-48fd-42a2-a526-58d8e8e8aa77"}, {"timestamp": "2025-10-24T00:00:00Z", "date_only": false, "value": "2025-10-24T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-10-24)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "26a15c21-6f80-4218-823e-cbd823bd0ea1"}, {"timestamp": "2025-11-08T00:00:00Z", "date_only": false, "value": "2025-11-08T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-11-08)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "410eff8a-377f-4186-bf2f-7d9319daf0db"}, {"timestamp": "2025-11-27T00:00:00Z", "date_only": false, "value": "2025-11-27T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-11-27)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "ff8c4f1a-0cd4-4b75-ab4a-63fca9d2428c"}, {"timestamp": "2025-11-28T00:00:00Z", "date_only": false, "value": "2025-11-28T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-11-28)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "47f30007-6390-4b51-9846-af7f15cc78dc"}, {"timestamp": "2025-12-11T00:00:00Z", "date_only": false, "value": "2025-12-11T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-12-11)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "8350ac7d-994a-492b-8668-68fe33cf80f4"}, {"timestamp": "2025-12-13T00:00:00Z", "date_only": false, "value": "2025-12-13T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-13)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "8b09419c-5acf-4e47-af89-8dae7ac951cb"}, {"timestamp": "2026-01-04T00:00:00Z", "date_only": false, "value": "2026-01-04T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-01-04)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "831a7d88-418f-4174-b17c-818ef54507a2"}, {"timestamp": "2026-02-13T00:00:00Z", "date_only": false, "value": "2026-02-13T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-13)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "8c48b2e7-74ae-49fe-b33e-c68c9dbbae05"}, {"timestamp": "2026-02-23T00:00:00Z", "date_only": false, "value": "2026-02-23T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-23)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "18f99cca-dc48-485f-8f4d-84f435411dbb"}, {"timestamp": "2026-04-05T00:00:00Z", "date_only": false, "value": "2026-04-05T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-04-05)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "9382aeb8-a3da-4b80-ae6e-a5ad518a3a54"}, {"timestamp": "2026-04-06T00:00:00Z", "date_only": false, "value": "2026-04-06T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-04-06)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "f671f456-5ca0-4fd4-8cc0-51d25177c55c"}, {"timestamp": "2026-06-04T00:00:00Z", "date_only": false, "value": "2026-06-04T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-04)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "5b509b53-d7e6-4974-a4e1-a990861af185"}, {"timestamp": "2026-06-13T00:00:00Z", "date_only": false, "value": "2026-06-13T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-13)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "ae0b25d9-fc07-4d43-8151-02d3797834b7"}, {"timestamp": "2026-06-17T03:41:17.747Z", "date_only": false, "value": "2026-06-17T03:41:17.747", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-25003", "record": "FKIE_CVE-2021-25003", "field": "lastModified"}, {"timestamp": "2026-06-19T12:46:17.957Z", "date_only": false, "value": "2026-06-19T12:46:17.957934Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/25c1628a-6daa-40be-80c5-29ce41294f87", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "5bf1fc2a-0250-4eaf-855c-5c0cd514f495", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/25c1628a-6daa-40be-80c5-29ce41294f87"}, {"timestamp": "2026-06-23T00:00:00Z", "date_only": false, "value": "2026-06-23T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-23)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "3741a300-3997-44a6-bea1-5716ef636351"}, {"timestamp": "2026-06-23T14:02:37Z", "date_only": false, "value": "2026-06-23T14:02:37+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2021-25003", "field": "timestamps.recorded_at", "uuid": "74abbcb1-a57a-4b07-9290-d8b93df5c22b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T14:04:25.499Z", "date_only": false, "value": "2026-06-23T14:04:25.499716Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/74abbcb1-a57a-4b07-9290-d8b93df5c22b", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "25888e28-4a58-4b32-bfec-a4333e64a8f4", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/74abbcb1-a57a-4b07-9290-d8b93df5c22b"}, {"timestamp": "2026-06-26T10:15:13.638Z", "date_only": false, "value": "2026-06-26T10:15:13.638777Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-25)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "2aa3b7ed-4e27-4499-8a67-cc8123994a34"}, {"timestamp": "2026-06-30T09:22:48.133Z", "date_only": false, "value": "2026-06-30T09:22:48.133271Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7dcae628-4945-472d-8b35-85af61ae5fd5", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "0e4d5443-7d67-40ff-b514-d6d102dfc91c", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7dcae628-4945-472d-8b35-85af61ae5fd5"}, {"timestamp": "2026-07-19T00:00:00Z", "date_only": false, "value": "2026-07-19T00:00:00+00:00", "kind": "kev", "label": "Last seen", "source": "shadowserver", "record": "CVE-2021-25003", "field": "timestamps.last_seen_at", "uuid": "7dcae628-4945-472d-8b35-85af61ae5fd5", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-19T00:00:00Z", "date_only": true, "value": "2026-07-19", "kind": "kev", "label": "Observation date", "source": "shadowserver", "record": "CVE-2021-25003", "field": "evidence.0.details.observation_date", "uuid": "7dcae628-4945-472d-8b35-85af61ae5fd5", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-19T00:00:00Z", "date_only": false, "value": "2026-07-19T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "shadowserver", "record": "CVE-2021-25003", "field": "status.status_updated_at", "uuid": "7dcae628-4945-472d-8b35-85af61ae5fd5", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-21T01:00:01Z", "date_only": false, "value": "2026-07-21T01:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "shadowserver", "record": "CVE-2021-25003", "field": "timestamps.recorded_at", "uuid": "7dcae628-4945-472d-8b35-85af61ae5fd5", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-09T11:21:08.965Z", "date_only": false, "value": "2026-08-09T11:21:08.965709Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-08)", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "e7416b47-3a3f-4e63-9f4e-87905905ddfa"}, {"timestamp": "2026-09-01T17:00:28.284Z", "date_only": false, "value": "2026-09-01T17:00:28.284632Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/5960", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "7626b4fe-3aa5-43df-aa08-363025803c0d", "content": "exploit\n1. CVE-2021-25003:\nWordPress Plugin WPCargo < 6.9.0 - Unauthenticated RCE\nhttps://github.com/biulove0x/CVE-2021-25003\n\n2. CVE-2022-0441:\nWordPress Plugin MasterStudy LMS 2.7.5 - Unauthenticated Admin Account Creation\nhttps://github.com/biulove0x/CVE-2022-0441\n\n3. Bypassing .NET Serialization Binders:\nCase studies for DevExpress (CVE-2022-28684) and Microsoft Exchange (CVE-2022-23277)\nhttps://codewhitesec.blogspot.com/2022/06/bypassing-dotnet-serialization-binders.html", "url": "https://t.me/cissp/5960"}, {"timestamp": "2026-09-10T08:00:05.851Z", "date_only": false, "value": "2026-09-10T08:00:05.851539Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cissp/5960", "record": "CVE-2021-25003", "field": "creation_timestamp", "uuid": "6c45fa22-698d-46bd-b6c4-adc1f623cce7", "content": "exploit\n1. CVE-2021-25003:\nWordPress Plugin WPCargo < 6.9.0 - Unauthenticated RCE\nhttps://github.com/biulove0x/CVE-2021-25003\n\n2. CVE-2022-0441:\nWordPress Plugin MasterStudy LMS 2.7.5 - Unauthenticated Admin Account Creation\nhttps://github.com/biulove0x/CVE-2022-0441\n\n3. Bypassing .NET Serialization Binders:\nCase studies for DevExpress (CVE-2022-28684) and Microsoft Exchange (CVE-2022-23277)\nhttps://codewhitesec.blogspot.com/2022/06/bypassing-dotnet-serialization-binders.html", "url": "https://t.me/cissp/5960"}]}