https://vulnerability.circl.lu/sightings/feed 2026-05-31T05:58:26.460411+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/e3bedef6-0b97-4e64-baa1-d4d2f3300237/export 2026-05-31T05:58:26.802633+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "e3bedef6-0b97-4e64-baa1-d4d2f3300237", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-52922", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/19196", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-52922\n\ud83d\udd25 CVSS Score: 7.4 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L)\n\ud83d\udd39 Description: Innoshop through 0.4.1 allows directory traversal via FileManager API endpoints. An authenticated attacker with access to the admin panel could abuse this to: (1) fully map the filesystem structure via the /api/file_manager/files?base_folder= endpoint, (2) create arbitrary directories on the server via the /api/file_manager/directories endpoint, (3) read arbitrary files from the server by copying the file to a readable location within the application via the /api/file_manager/copy_files endpoint, {4) delete arbitrary files from the server via a DELETE request to /api/file_manager/files, or (5) create arbitrary files on the server by uploading them and then leveraging the /api/file_manager/move_files endpoint to move them anywhere in the filesystem.\n\ud83d\udccf Published: 2025-06-23T00:00:00.000Z\n\ud83d\udccf Modified: 2025-06-23T11:54:25.537Z\n\ud83d\udd17 References:\n1. https://github.com/innocommerce/innoshop\n2. https://medium.com/@The_Hiker/how-i-found-multiple-cves-in-innoshop-0-4-1-12c8f84ad87f", "creation_timestamp": "2025-06-23T12:47:49.000000Z"} 2025-06-23T12:47:49+00:00