https://vulnerability.circl.lu/sightings/feed 2026-09-17T10:27:19.462416+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/5d0c4180-b415-4df2-b215-c21f98a11176/export 2026-09-17T10:27:19.484060+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "5d0c4180-b415-4df2-b215-c21f98a11176", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-32746", "type": "seen", "source": "https://bsky.app/profile/hnbot.gsuscs.xyz/post/3mvoponvi622t", "content": "A 32-Year-Old Bug Walks into a Telnet Server\n\nhttps://labs.watchtowr.com/a-32-year-old-bug-walks-into-a-telnet-server-gnu-inetutils-telnetd-cve-2026-32746/", "creation_timestamp": "2026-09-17T03:30:54.501045Z"} 2026-09-17T03:30:54.501045+00:00 https://vulnerability.circl.lu/sighting/16fb0419-a01e-43c1-a1f9-57d6c13d2499/export 2026-09-17T10:27:19.487565+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "16fb0419-a01e-43c1-a1f9-57d6c13d2499", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32207", "type": "seen", "source": "https://t.me/shimiscyberworld/1317", "content": "\ud83d\udee1\ufe0f SCW \u2502 Daily Vulnerability Digest\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83d\udcc5 2026-05-08\n\n\ud83d\udcca 65 vulnerabilities detected today \u2014 16 \ud83d\udd34 Critical, 49 \ud83d\udd34 High\n\n\ud83d\udd34 CRITICAL\n \u2022 CVE-2026-42826 (10) \u2014 Azure DevOps Critical Info Disclosure: CVE-2026-42826\n \u2022 CVE-2026-41070 (10) \u2014 CVE-2026-41070: openvpn-auth-oauth2 Critical Bypass in\u2026\n \u2022 CVE-2026-33109 (9.9) \u2014 CVE-2026-33109: Critical RCE in Azure Managed Instance for\u2026\n \u2022 CVE-2026-41512 (9.9) \u2014 ai-scanner RCE: Critical JavaScript Injection in\u2026\n \u2022 CVE-2026-41500 (9.8) \u2014 electerm CVE-2026-41500: Critical Command Injection in\u2026\n \u2022 CVE-2026-41501 (9.8) \u2014 Electerm Critical Command Injection Flaw Patched\u2026\n \u2022 CVE-2026-8153 (9.8) \u2014 Universal Robots PolyScope Critical OS Command Injection\u2026\n \u2022 CVE-2026-41497 (9.8) \u2014 CVE-2026-41497: PraisonAI Multi-Agent System Critical RCE\n \u2026 and 8 more\n\n\ud83d\udd34 HIGH\n \u2022 CVE-2026-32207 (8.8) \u2014 Azure Machine Learning XSS Exposes Data, Allows Spoofing\n \u2022 CVE-2026-41900 (8.8) \u2014 CVE-2026-41900: OpenLearnX RCE Allows Sandbox Escape and\u2026\n \u2022 CVE-2026-8137 (8.8) \u2014 Totolink X5000R Buffer Overflow (CVE-2026-8137) Exposed\n \u2022 CVE-2026-8138 (8.8) \u2014 Tenda CX12L Stack Buffer Overflow (CVE-2026-8138) Risks\u2026\n \u2022 CVE-2026-5127 (8.8) \u2014 WordPress Plugin Vulnerability: CVE-2026-5127 Allows Code\u2026\n \u2022 CVE-2026-42275 (8.7) \u2014 zrok WebDAV Vulnerability (CVE-2026-42275) Allows Remote\u2026\n \u2022 CVE-2026-41524 (8.7) \u2014 Brave CMS XSS Vulnerability: Editor Role Leads to\u2026\n \u2022 CVE-2026-42047 (8.6) \u2014 CVE-2026-42047: Inngest Exposes Environment Variables via\u2026\n \u2022 CVE-2026-35435 (8.6) \u2014 Azure AI Foundry M365 Flaw Allows Network Privilege\u2026\n \u2022 CVE-2026-44339 (8.6) \u2014 PraisonAI Vulnerability Allows Undeclared Tool Invocation\u2026\n \u2026 and 39 more\n\n\ud83d\udcd6 View all vulnerabilities \u2192\n\n\ud83c\udfaf Need SIEM rules for these threats?\nGenerate detection rules for Splunk, Sentinel, QRadar & more \u2014 tailored per breach\nOpen /detect in Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-13T00:00:39.757948Z"} 2026-09-13T00:00:39.757948+00:00 https://vulnerability.circl.lu/sighting/12e9bddf-f446-4810-a0f7-583871ea6212/export 2026-09-17T10:27:19.487970+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "12e9bddf-f446-4810-a0f7-583871ea6212", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32834", "type": "seen", "source": "https://t.me/shimiscyberworld/1197", "content": "\ud83d\udee1\ufe0f SCW \u2502 Daily Vulnerability Digest\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83d\udcc5 2026-05-04\n\n\ud83d\udcca 31 vulnerabilities detected today \u2014 20 \ud83d\udd34 Critical, 11 \ud83d\udd34 High\n\n\ud83d\udd34 CRITICAL\n \u2022 CVE-2026-42809 (9.9) \u2014 CVE-2026-42809: Apache Polaris Critical Credential\u2026\n \u2022 CVE-2026-42810 (9.9) \u2014 CVE-2026-42810: Apache Polaris S3 Wildcard Vulnerability\u2026\n \u2022 CVE-2026-42811 (9.9) \u2014 CVE-2026-42811: Apache Polaris Credential Bypass Exposes\u2026\n \u2022 CVE-2026-42812 (9.9) \u2014 Apache Iceberg CVE-2026-42812 Bypasses Metadata Location\u2026\n \u2022 CVE-2026-24118 (9.8) \u2014 VM2 Sandbox Breakout Vulnerability: Critical Flaw Exposes\u2026\n \u2022 CVE-2026-24120 (9.8) \u2014 CVE-2026-24120: vm2 Sandbox Escape Allows Host Command\u2026\n \u2022 CVE-2026-24781 (9.8) \u2014 VM2 Sandbox Escape Vulnerability (CVE-2026-24781) Exposes\u2026\n \u2022 CVE-2026-26332 (9.8) \u2014 vm2 Sandbox Escape (CVE-2026-26332) Exposes Node.js Apps to\u2026\n \u2026 and 12 more\n\n\ud83d\udd34 HIGH\n \u2022 CVE-2025-58074 (8.8) \u2014 Norton Secure VPN Privilege Escalation via Microsoft Store\u2026\n \u2022 CVE-2026-6266 (8.3) \u2014 CVE-2026-6266: AAP Gateway Email Auto-Link Flaw Allows\u2026\n \u2022 CVE-2026-29004 (8.1) \u2014 BusyBox udhcpc6 Heap Overflow (CVE-2026-29004) Exposes\u2026\n \u2022 CVE-2026-42084 (8.1) \u2014 CVE-2026-42084: OpenC3 COSMOS Allows Password Change\u2026\n \u2022 CVE-2026-32834 (7.5) \u2014 CVE-2026-32834: WordPress Easy PayPal Plugin Authentication\u2026\n \u2022 CVE-2026-41471 (7.5) \u2014 CVE-2026-41471: PayPal Events WordPress Plugin Exposes All\u2026\n \u2022 CVE-2026-25863 (7.5) \u2014 CVE-2026-25863: WordPress Plugin DoS Vulnerability Hits\u2026\n \u2022 CVE-2026-42151 (7.5) \u2014 Prometheus Azure AD OAuth Secret Exposed via Plaintext\u2026\n \u2022 CVE-2026-42154 (7.5) \u2014 Prometheus CVE-2026-42154: Unauthenticated Memory\u2026\n \u2022 CVE-2026-3120 (7.2) \u2014 SambaBox CVE-2026-3120: High-Severity OS Command Injection\n \u2026 and 1 more\n\n\ud83d\udcd6 View all vulnerabilities \u2192\n\n\ud83c\udfaf Need SIEM rules for these threats?\nGenerate detection rules for Splunk, Sentinel, QRadar & more \u2014 tailored per breach\nOpen /detect in Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-13T00:00:10.646483Z"} 2026-09-13T00:00:10.646483+00:00 https://vulnerability.circl.lu/sighting/d6828707-a7b9-42d7-9a1f-64ae9c87bb4c/export 2026-09-17T10:27:19.488183+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "d6828707-a7b9-42d7-9a1f-64ae9c87bb4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32834", "type": "seen", "source": "https://t.me/shimiscyberworld/1197", "content": "\ud83d\udee1\ufe0f SCW \u2502 Daily Vulnerability Digest\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83d\udcc5 2026-05-04\n\n\ud83d\udcca 31 vulnerabilities detected today \u2014 20 \ud83d\udd34 Critical, 11 \ud83d\udd34 High\n\n\ud83d\udd34 CRITICAL\n \u2022 CVE-2026-42809 (9.9) \u2014 CVE-2026-42809: Apache Polaris Critical Credential\u2026\n \u2022 CVE-2026-42810 (9.9) \u2014 CVE-2026-42810: Apache Polaris S3 Wildcard Vulnerability\u2026\n \u2022 CVE-2026-42811 (9.9) \u2014 CVE-2026-42811: Apache Polaris Credential Bypass Exposes\u2026\n \u2022 CVE-2026-42812 (9.9) \u2014 Apache Iceberg CVE-2026-42812 Bypasses Metadata Location\u2026\n \u2022 CVE-2026-24118 (9.8) \u2014 VM2 Sandbox Breakout Vulnerability: Critical Flaw Exposes\u2026\n \u2022 CVE-2026-24120 (9.8) \u2014 CVE-2026-24120: vm2 Sandbox Escape Allows Host Command\u2026\n \u2022 CVE-2026-24781 (9.8) \u2014 VM2 Sandbox Escape Vulnerability (CVE-2026-24781) Exposes\u2026\n \u2022 CVE-2026-26332 (9.8) \u2014 vm2 Sandbox Escape (CVE-2026-26332) Exposes Node.js Apps to\u2026\n \u2026 and 12 more\n\n\ud83d\udd34 HIGH\n \u2022 CVE-2025-58074 (8.8) \u2014 Norton Secure VPN Privilege Escalation via Microsoft Store\u2026\n \u2022 CVE-2026-6266 (8.3) \u2014 CVE-2026-6266: AAP Gateway Email Auto-Link Flaw Allows\u2026\n \u2022 CVE-2026-29004 (8.1) \u2014 BusyBox udhcpc6 Heap Overflow (CVE-2026-29004) Exposes\u2026\n \u2022 CVE-2026-42084 (8.1) \u2014 CVE-2026-42084: OpenC3 COSMOS Allows Password Change\u2026\n \u2022 CVE-2026-32834 (7.5) \u2014 CVE-2026-32834: WordPress Easy PayPal Plugin Authentication\u2026\n \u2022 CVE-2026-41471 (7.5) \u2014 CVE-2026-41471: PayPal Events WordPress Plugin Exposes All\u2026\n \u2022 CVE-2026-25863 (7.5) \u2014 CVE-2026-25863: WordPress Plugin DoS Vulnerability Hits\u2026\n \u2022 CVE-2026-42151 (7.5) \u2014 Prometheus Azure AD OAuth Secret Exposed via Plaintext\u2026\n \u2022 CVE-2026-42154 (7.5) \u2014 Prometheus CVE-2026-42154: Unauthenticated Memory\u2026\n \u2022 CVE-2026-3120 (7.2) \u2014 SambaBox CVE-2026-3120: High-Severity OS Command Injection\n \u2026 and 1 more\n\n\ud83d\udcd6 View all vulnerabilities \u2192\n\n\ud83c\udfaf Need SIEM rules for these threats?\nGenerate detection rules for Splunk, Sentinel, QRadar & more \u2014 tailored per breach\nOpen /detect in Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:17.289091Z"} 2026-09-12T10:00:17.289091+00:00 https://vulnerability.circl.lu/sighting/f2b3b045-5e1b-4c12-a1f8-9bc4689067cd/export 2026-09-17T10:27:19.488307+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "f2b3b045-5e1b-4c12-a1f8-9bc4689067cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32207", "type": "seen", "source": "https://t.me/shimiscyberworld/1317", "content": "\ud83d\udee1\ufe0f SCW \u2502 Daily Vulnerability Digest\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83d\udcc5 2026-05-08\n\n\ud83d\udcca 65 vulnerabilities detected today \u2014 16 \ud83d\udd34 Critical, 49 \ud83d\udd34 High\n\n\ud83d\udd34 CRITICAL\n \u2022 CVE-2026-42826 (10) \u2014 Azure DevOps Critical Info Disclosure: CVE-2026-42826\n \u2022 CVE-2026-41070 (10) \u2014 CVE-2026-41070: openvpn-auth-oauth2 Critical Bypass in\u2026\n \u2022 CVE-2026-33109 (9.9) \u2014 CVE-2026-33109: Critical RCE in Azure Managed Instance for\u2026\n \u2022 CVE-2026-41512 (9.9) \u2014 ai-scanner RCE: Critical JavaScript Injection in\u2026\n \u2022 CVE-2026-41500 (9.8) \u2014 electerm CVE-2026-41500: Critical Command Injection in\u2026\n \u2022 CVE-2026-41501 (9.8) \u2014 Electerm Critical Command Injection Flaw Patched\u2026\n \u2022 CVE-2026-8153 (9.8) \u2014 Universal Robots PolyScope Critical OS Command Injection\u2026\n \u2022 CVE-2026-41497 (9.8) \u2014 CVE-2026-41497: PraisonAI Multi-Agent System Critical RCE\n \u2026 and 8 more\n\n\ud83d\udd34 HIGH\n \u2022 CVE-2026-32207 (8.8) \u2014 Azure Machine Learning XSS Exposes Data, Allows Spoofing\n \u2022 CVE-2026-41900 (8.8) \u2014 CVE-2026-41900: OpenLearnX RCE Allows Sandbox Escape and\u2026\n \u2022 CVE-2026-8137 (8.8) \u2014 Totolink X5000R Buffer Overflow (CVE-2026-8137) Exposed\n \u2022 CVE-2026-8138 (8.8) \u2014 Tenda CX12L Stack Buffer Overflow (CVE-2026-8138) Risks\u2026\n \u2022 CVE-2026-5127 (8.8) \u2014 WordPress Plugin Vulnerability: CVE-2026-5127 Allows Code\u2026\n \u2022 CVE-2026-42275 (8.7) \u2014 zrok WebDAV Vulnerability (CVE-2026-42275) Allows Remote\u2026\n \u2022 CVE-2026-41524 (8.7) \u2014 Brave CMS XSS Vulnerability: Editor Role Leads to\u2026\n \u2022 CVE-2026-42047 (8.6) \u2014 CVE-2026-42047: Inngest Exposes Environment Variables via\u2026\n \u2022 CVE-2026-35435 (8.6) \u2014 Azure AI Foundry M365 Flaw Allows Network Privilege\u2026\n \u2022 CVE-2026-44339 (8.6) \u2014 PraisonAI Vulnerability Allows Undeclared Tool Invocation\u2026\n \u2026 and 39 more\n\n\ud83d\udcd6 View all vulnerabilities \u2192\n\n\ud83c\udfaf Need SIEM rules for these threats?\nGenerate detection rules for Splunk, Sentinel, QRadar & more \u2014 tailored per breach\nOpen /detect in Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:12.199852Z"} 2026-09-12T10:00:12.199852+00:00 https://vulnerability.circl.lu/sighting/fdb4dbcf-6ee0-41a2-b4be-ee960a6f5f38/export 2026-09-17T10:27:19.488422+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "fdb4dbcf-6ee0-41a2-b4be-ee960a6f5f38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32247", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101574", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-32247\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a romain-deperne\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-07 17:44:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCypher injection in Graphiti via unsanitized node_labels \u2014 CVE-2026-32247 / CVSS 8.1\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-10T00:00:50.383350Z"} 2026-09-10T00:00:50.383350+00:00 https://vulnerability.circl.lu/sighting/eded528b-4f38-42ab-9fb1-84ada9c59770/export 2026-09-17T10:27:19.488520+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "eded528b-4f38-42ab-9fb1-84ada9c59770", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32247", "type": "seen", "source": "https://t.me/GithubRedTeam/101574", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-32247\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a romain-deperne\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-07 17:44:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCypher injection in Graphiti via unsanitized node_labels \u2014 CVE-2026-32247 / CVSS 8.1\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-09T05:00:05.803640Z"} 2026-09-09T05:00:05.803640+00:00 https://vulnerability.circl.lu/sighting/6abb78a4-b5f9-4241-90a5-7c92eda64551/export 2026-09-17T10:27:19.488624+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "6abb78a4-b5f9-4241-90a5-7c92eda64551", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32475", "type": "published-proof-of-concept", "source": "https://t.me/LearnExploit/10381", "content": "\ud83d\udd25Elementor Pro Unauthenticated Arbitrary File Upload to RCE \nCVE-2026-32475\n\n\ud83d\udd17 https://github.com/4minx/CVE-2026-32475", "creation_timestamp": "2026-09-09T00:00:31.589624Z"} 2026-09-09T00:00:31.589624+00:00 https://vulnerability.circl.lu/sighting/516251e5-dbcb-44a1-bb87-cd5fea90396e/export 2026-09-17T10:27:19.488718+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "516251e5-dbcb-44a1-bb87-cd5fea90396e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32475", "type": "seen", "source": "https://t.me/LearnExploit/10381", "content": "\ud83d\udd25Elementor Pro Unauthenticated Arbitrary File Upload to RCE \nCVE-2026-32475\n\n\ud83d\udd17 https://github.com/4minx/CVE-2026-32475", "creation_timestamp": "2026-09-08T11:00:04.847598Z"} 2026-09-08T11:00:04.847598+00:00 https://vulnerability.circl.lu/sighting/309c9946-1722-4dcb-b632-9cd7af89a382/export 2026-09-17T10:27:19.488816+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "309c9946-1722-4dcb-b632-9cd7af89a382", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32985", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/xerte_unauthenticated_template_import_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Brandon Lester\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an authentication bypass allowing arbitrary\\n file upload in versions 3.14 and earlier to upload and execute a shell.\\n Specifically, this targets /website_code/php/import/import.php\\n\\n OPSEC\\n This module results in directories being created and database entries which can\\n not easily be cleaned up automatically.\", \"disclosure_date\": \"2025-08-04\", \"fullname\": \"exploit/multi/http/xerte_unauthenticated_template_import_rce\", \"is_install_path\": true, \"mod_time\": \"2026-05-26 13:05:42 +0000\", \"name\": \"Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Template Import\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/xerte_unauthenticated_template_import_rce.rb\", \"platform\": \"PHP\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/xerte_unauthenticated_template_import_rce\", \"references\": [\"CVE-2026-32985\", \"URL-https://blog.haicen.me/posts/xerte-online-toolkits/\", \"URL-https://www.xerte.org.uk/index.php/en/news/blog/80-news/357-xerte-3-13-en-3-14-important-security-update-now-available\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHP\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:23.982133Z"} 2026-09-08T06:50:23.982133+00:00