https://vulnerability.circl.lu/sightings/feed 2026-05-10T05:42:32.366901+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/fa0cdf82-953f-4262-a2bd-f6755c5de275/export 2026-05-10T05:42:32.772359+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "fa0cdf82-953f-4262-a2bd-f6755c5de275", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-25358", "type": "seen", "source": "https://t.me/cibsecurity/37795", "content": "\u203c CVE-2022-25358 \u203c\n\nA ..%2F path traversal vulnerability exists in the path handler of awful-salmonella-tar before 0.0.4. Attackers can only list directories (not read files). This occurs because the safe-path? Scheme predicate is not used for directories.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-02-19T00:38:34.000000Z"} 2022-02-19T00:38:34+00:00 https://vulnerability.circl.lu/sighting/7a737f84-154f-4a3e-a2de-c0c20df4ce29/export 2026-05-10T05:42:32.772276+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "7a737f84-154f-4a3e-a2de-c0c20df4ce29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-25355", "type": "seen", "source": "https://t.me/cibsecurity/37996", "content": "\u203c CVE-2022-25355 \u203c\n\nEC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-02-24T18:14:48.000000Z"} 2022-02-24T18:14:48+00:00 https://vulnerability.circl.lu/sighting/e88366bf-7c71-4466-8c2f-12fb240594c5/export 2026-05-10T05:42:32.772185+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "e88366bf-7c71-4466-8c2f-12fb240594c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-25352", "type": "seen", "source": "https://t.me/cibsecurity/39135", "content": "\u203c CVE-2022-25352 \u203c\n\nThe package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incomplete fix for [CVE-2020-28283](https://security.snyk.io/vuln/SNYK-JS-LIBNESTED-1054930)\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-17T15:21:36.000000Z"} 2022-03-17T15:21:36+00:00 https://vulnerability.circl.lu/sighting/3c6fdf8e-03a2-492d-b507-0e179eb9cacc/export 2026-05-10T05:42:32.772091+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "3c6fdf8e-03a2-492d-b507-0e179eb9cacc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-25354", "type": "seen", "source": "https://t.me/cibsecurity/39142", "content": "\u203c CVE-2022-25354 \u203c\n\nThe package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/vuln/SNYK-JS-SETIN-1048049)\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-17T15:21:44.000000Z"} 2022-03-17T15:21:44+00:00 https://vulnerability.circl.lu/sighting/0c853266-8523-4197-a2f3-2ed036d58611/export 2026-05-10T05:42:32.771980+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "0c853266-8523-4197-a2f3-2ed036d58611", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-2535", "type": "seen", "source": "https://t.me/cibsecurity/48142", "content": "\u203c CVE-2022-2535 \u203c\n\nThe SearchWP Live Ajax Search WordPress plugin before 1.6.2 does not ensure that users making a live search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-15T14:37:57.000000Z"} 2022-08-15T14:37:57+00:00 https://vulnerability.circl.lu/sighting/d211fbe3-3e5c-4b6b-b7ab-f9174f6d262d/export 2026-05-10T05:42:32.771846+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "d211fbe3-3e5c-4b6b-b7ab-f9174f6d262d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-25350", "type": "seen", "source": "https://t.me/cibsecurity/56939", "content": "\u203c CVE-2022-25350 \u203c\n\nAll versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-01-27T00:33:50.000000Z"} 2023-01-27T00:33:50+00:00 https://vulnerability.circl.lu/sighting/8fc38536-adf7-4c26-84aa-181b56fb1ef7/export 2026-05-10T05:42:32.769969+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "8fc38536-adf7-4c26-84aa-181b56fb1ef7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-25350", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/9915", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-25350\n\ud83d\udd25 CVSS Score: 7.4 (cvssV3_1, Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P)\n\ud83d\udd39 Description: All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization.\n\ud83d\udccf Published: 2023-01-24T05:00:01.270Z\n\ud83d\udccf Modified: 2025-04-01T15:30:49.697Z\n\ud83d\udd17 References:\n1. https://security.snyk.io/vuln/SNYK-JS-PUPPETFACTER-3175616\n2. https://github.com/olindata/node-puppet-facter/blob/f34bcc754325d71bb3b1b534804e53d6170f15f5/index.js%23L10", "creation_timestamp": "2025-04-01T15:32:29.000000Z"} 2025-04-01T15:32:29+00:00