https://vulnerability.circl.lu/sightings/feed 2026-09-17T09:13:21.036925+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/926a39c6-8fd2-4e46-8156-09b44f58dee1/export 2026-09-17T09:13:21.053320+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "926a39c6-8fd2-4e46-8156-09b44f58dee1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-25852", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-11)", "content": "", "creation_timestamp": "2026-09-12T10:00:16.536732Z"} 2026-09-12T10:00:16.536732+00:00 https://vulnerability.circl.lu/sighting/8a9a7652-5cfa-4a42-91cd-ce47c9453968/export 2026-09-17T09:13:21.055081+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "8a9a7652-5cfa-4a42-91cd-ce47c9453968", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-25852", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-10)", "content": "", "creation_timestamp": "2026-09-11T10:00:15.685064Z"} 2026-09-11T10:00:15.685064+00:00 https://vulnerability.circl.lu/sighting/4a342195-b8a4-46d1-8cb1-93a96a55e324/export 2026-09-17T09:13:21.055199+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "4a342195-b8a4-46d1-8cb1-93a96a55e324", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-25600", "type": "published-proof-of-concept", "source": "https://t.me/Hackme_news/928", "content": "\u26a0\ufe0f\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CVE-2024-25600) \u0432 \u0442\u0435\u043c\u0435 Bricks \u0434\u043b\u044f #WordPress (\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 25 000 \u0441\u0430\u0439\u0442\u043e\u0432) \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e PHP-\u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445. \nhttps://snicco.io/vulnerability-disclosure/bricks/unauthenticated-rce-in-bricks-1-9-6", "creation_timestamp": "2026-09-09T00:00:12.875028Z"} 2026-09-09T00:00:12.875028+00:00 https://vulnerability.circl.lu/sighting/d31976cb-7292-4b33-9b51-3a4e65a20deb/export 2026-09-17T09:13:21.055291+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "d31976cb-7292-4b33-9b51-3a4e65a20deb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-25600", "type": "published-proof-of-concept", "source": "https://t.me/Hackme_news/928", "content": "\u26a0\ufe0f\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CVE-2024-25600) \u0432 \u0442\u0435\u043c\u0435 Bricks \u0434\u043b\u044f #WordPress (\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 25 000 \u0441\u0430\u0439\u0442\u043e\u0432) \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e PHP-\u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445. \nhttps://snicco.io/vulnerability-disclosure/bricks/unauthenticated-rce-in-bricks-1-9-6", "creation_timestamp": "2026-09-08T22:00:05.082210Z"} 2026-09-08T22:00:05.082210+00:00 https://vulnerability.circl.lu/sighting/00fa0227-64df-4e00-b6af-5835cf271eae/export 2026-09-17T09:13:21.055374+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "00fa0227-64df-4e00-b6af-5835cf271eae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-25600", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_bricks_builder_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd\", \"author\": [\"Calvin Alkan\", \"Valentin Lobstein\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated remote code execution vulnerability in the\\n Bricks Builder Theme versions <= 1.9.6 for WordPress. The vulnerability allows attackers\\n to execute arbitrary PHP code by leveraging a nonce leakage to bypass authentication and\\n exploit the eval() function usage within the theme. Successful exploitation allows for full\\n control of the affected WordPress site. It is recommended to upgrade to version 1.9.6.1 or higher.\", \"disclosure_date\": \"2024-02-19\", \"fullname\": \"exploit/multi/http/wp_bricks_builder_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:04 +0000\", \"name\": \"Unauthenticated RCE in Bricks Builder Theme\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/wp_bricks_builder_rce.rb\", \"platform\": \"Linux,PHP,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/wp_bricks_builder_rce\", \"references\": [\"CVE-2024-25600\", \"URL-https://github.com/Chocapikk/CVE-2024-25600\", \"URL-https://snicco.io/vulnerability-disclosure/bricks/unauthenticated-rce-in-bricks-1-9-6\", \"WPVDB-afea4f8c-4d45-4cc0-8eb7-6fa6748158bd\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic\", \"PHP In-Memory\", \"Unix In-Memory\", \"Windows In-Memory\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:20.992125Z"} 2026-09-08T06:50:20.992125+00:00 https://vulnerability.circl.lu/sighting/33561b23-4eef-4a49-bf33-0236258bd1d0/export 2026-09-17T09:13:21.055492+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "33561b23-4eef-4a49-bf33-0236258bd1d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-25641", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_package_import_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd\", \"author\": [\"Egidio Romano\", \"Christophe De La Fuente\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This exploit module leverages an arbitrary file write vulnerability\\n (CVE-2024-25641) in Cacti versions prior to 1.2.27 to achieve RCE. It\\n abuses the `Import Packages` feature to upload a specially crafted\\n package that embeds a PHP file. Cacti will extract this file to an\\n accessible location. The module finally triggers the payload to execute\\n arbitrary PHP code in the context of the user running the web server.\\n\\n Authentication is needed and the account must have access to the\\n `Import Packages` feature. This is granted by setting the `Import\\n Templates` permission in the `Template Editor` section.\", \"disclosure_date\": \"2024-05-12\", \"fullname\": \"exploit/multi/http/cacti_package_import_rce\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"Cacti Import Packages RCE\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/cacti_package_import_rce.rb\", \"platform\": \"Linux,PHP,Unix,Windows\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/cacti_package_import_rce\", \"references\": [\"URL-https://karmainsecurity.com/KIS-2024-04\", \"GHSA-7cmj-g5qc-pj88\", \"CVE-2024-25641\", \"EDB-52225\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHP\", \"Linux Command\", \"Windows Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:43.136217Z"} 2026-09-08T06:49:43.136217+00:00 https://vulnerability.circl.lu/sighting/a4297efe-0689-414e-b045-548f37d369ae/export 2026-09-17T09:13:21.055598+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a4297efe-0689-414e-b045-548f37d369ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-25852", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-04)", "content": "", "creation_timestamp": "2026-09-05T10:00:14.304512Z"} 2026-09-05T10:00:14.304512+00:00 https://vulnerability.circl.lu/sighting/a846b716-9956-4305-8c8f-63f071248634/export 2026-09-17T09:13:21.055687+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a846b716-9956-4305-8c8f-63f071248634", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-25600", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/144022", "content": "CVE-2024\u201325600: WordPress Bricks Builder Remote Code Execution Vulnerability -$$$$ BOUNTY\nhttps://infosecwriteups.com/cve-2024-25600-wordpress-bricks-builder-remote-code-execution-vulnerability-bounty-997d488fd54e?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-04T00:00:43.360484Z"} 2026-09-04T00:00:43.360484+00:00 https://vulnerability.circl.lu/sighting/06745eaa-1783-477d-a780-4484259eb892/export 2026-09-17T09:13:21.055763+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "06745eaa-1783-477d-a780-4484259eb892", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-25600", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/144024", "content": "Overview:Continue reading on InfoSec Write-ups \u00bb (https://infosecwriteups.com/cve-2024-25600-wordpress-bricks-builder-remote-code-execution-vulnerability-bounty-997d488fd54e?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-04T00:00:43.303249Z"} 2026-09-04T00:00:43.303249+00:00 https://vulnerability.circl.lu/sighting/ac84b280-8e7c-4ce1-8af8-6e579f61cb44/export 2026-09-17T09:13:21.055848+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ac84b280-8e7c-4ce1-8af8-6e579f61cb44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-25128", "type": "seen", "source": "https://t.me/hacking_Attack/132131", "content": "Critical vulnerability in Flask AppBuilder\u200a\u2014\u200aCVE-2024\u201325128\nhttps://systemweakness.com/critical-vulnerability-in-flask-appbuilder-cve-2024-25128-a8693fb31d86?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-04T00:00:10.862833Z"} 2026-09-04T00:00:10.862833+00:00