https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 17 Sep 2026 08:48:54 +0000 https://vulnerability.circl.lu/sighting/a7d8747c-5832-4a60-a378-7e57f8c4f68b/export {"uuid": "a7d8747c-5832-4a60-a378-7e57f8c4f68b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-51324", "type": "published-proof-of-concept", "source": "Telegram/cETmR6PmVA-Oz0aW9cR5toB5HzP84uGj8tzgORzgcaHdb5Y", "content": "", "creation_timestamp": "2026-09-15T00:00:23.947665Z"} {"uuid": "a7d8747c-5832-4a60-a378-7e57f8c4f68b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-51324", "type": "published-proof-of-concept", "source": "Telegram/cETmR6PmVA-Oz0aW9cR5toB5HzP84uGj8tzgORzgcaHdb5Y", "content": "", "creation_timestamp": "2026-09-15T00:00:23.947665Z"} https://vulnerability.circl.lu/sighting/a7d8747c-5832-4a60-a378-7e57f8c4f68b/export Tue, 15 Sep 2026 00:00:23 +0000 https://vulnerability.circl.lu/sighting/e6a3df60-9708-459a-8765-17b01e8e6f44/export {"uuid": "e6a3df60-9708-459a-8765-17b01e8e6f44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-51324", "type": "seen", "source": "Telegram/cETmR6PmVA-Oz0aW9cR5toB5HzP84uGj8tzgORzgcaHdb5Y", "content": "", "creation_timestamp": "2026-09-14T10:00:04.592625Z"} {"uuid": "e6a3df60-9708-459a-8765-17b01e8e6f44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-51324", "type": "seen", "source": "Telegram/cETmR6PmVA-Oz0aW9cR5toB5HzP84uGj8tzgORzgcaHdb5Y", "content": "", "creation_timestamp": "2026-09-14T10:00:04.592625Z"} https://vulnerability.circl.lu/sighting/e6a3df60-9708-459a-8765-17b01e8e6f44/export Mon, 14 Sep 2026 10:00:04 +0000 https://vulnerability.circl.lu/sighting/ea984bce-4b9d-43ad-bc38-e091ecfc0a31/export {"uuid": "ea984bce-4b9d-43ad-bc38-e091ecfc0a31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-51482", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102216", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cctv\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ledksv\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-13 13:58:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCCTV \u2014 HackTheBox | CVE-2024-51482 ZoneMinder SQLi, bcrypt crack, CVE-2025-60787 motionEye RCE for root\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-14T00:00:12.287939Z"} {"uuid": "ea984bce-4b9d-43ad-bc38-e091ecfc0a31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-51482", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102216", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cctv\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ledksv\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-13 13:58:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCCTV \u2014 HackTheBox | CVE-2024-51482 ZoneMinder SQLi, bcrypt crack, CVE-2025-60787 motionEye RCE for root\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-14T00:00:12.287939Z"} https://vulnerability.circl.lu/sighting/ea984bce-4b9d-43ad-bc38-e091ecfc0a31/export Mon, 14 Sep 2026 00:00:12 +0000 https://vulnerability.circl.lu/sighting/8e0d624b-dfb9-4136-82e3-a35e0625a738/export {"uuid": "8e0d624b-dfb9-4136-82e3-a35e0625a738", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-51482", "type": "seen", "source": "https://t.me/GithubRedTeam/102216", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cctv\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ledksv\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-13 13:58:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCCTV \u2014 HackTheBox | CVE-2024-51482 ZoneMinder SQLi, bcrypt crack, CVE-2025-60787 motionEye RCE for root\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-13T17:00:04.432209Z"} {"uuid": "8e0d624b-dfb9-4136-82e3-a35e0625a738", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-51482", "type": "seen", "source": "https://t.me/GithubRedTeam/102216", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cctv\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ledksv\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-13 13:58:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCCTV \u2014 HackTheBox | CVE-2024-51482 ZoneMinder SQLi, bcrypt crack, CVE-2025-60787 motionEye RCE for root\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-13T17:00:04.432209Z"} https://vulnerability.circl.lu/sighting/8e0d624b-dfb9-4136-82e3-a35e0625a738/export Sun, 13 Sep 2026 17:00:04 +0000 https://vulnerability.circl.lu/sighting/e04e6f91-6a33-4581-88ff-33960e4f67d2/export {"uuid": "e04e6f91-6a33-4581-88ff-33960e4f67d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-51568", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/cyberpanel_preauth_rce_multi_cve.rb", "content": "{\"actions\": [{\"description\": \"Exploit using CVE-2024-51378\", \"name\": \"CVE-2024-51378\"}, {\"description\": \"Exploit using CVE-2024-51567\", \"name\": \"CVE-2024-51567\"}, {\"description\": \"Exploit using CVE-2024-51568\", \"name\": \"CVE-2024-51568\"}], \"aliases\": [], \"arch\": \"cmd\", \"author\": [\"DreyAnd\", \"Valentin Lobstein\", \"Luka Petrovic (refr4g)\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits three separate unauthenticated Remote Code Execution vulnerabilities in CyberPanel:\\n\\n - CVE-2024-51567: Command injection vulnerability in the \\\"upgrademysqlstatus\\\" endpoint.\\n - CVE-2024-51568: Command Injection via the \\\"completePath\\\" parameter in the \\\"outputExecutioner\\\" sink.\\n - CVE-2024-51378: Unauthenticated RCE in \\\"/ftp/getresetstatus\\\" and \\\"/dns/getresetstatus\\\".\\n\\n These vulnerabilities were exploited in ransomware campaigns affecting over 22,000 CyberPanel instances, with the PSAUX ransomware being the primary actor in these attacks.\", \"disclosure_date\": \"2024-10-27\", \"fullname\": \"exploit/unix/webapp/cyberpanel_preauth_rce_multi_cve\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"CyberPanel Multi CVE Pre-auth RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/unix/webapp/cyberpanel_preauth_rce_multi_cve.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"unix/webapp/cyberpanel_preauth_rce_multi_cve\", \"references\": [\"CVE-2024-51567\", \"CVE-2024-51568\", \"CVE-2024-51378\", \"EDB-52172\", \"URL-https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce\", \"URL-https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/\", \"URL-https://github.com/DreyAnd/CyberPanel-RCE\", \"URL-https://github.com/refr4g/CVE-2024-51378\", \"URL-https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/\", \"URL-https://gist.github.com/gboddin/d78823245b518edd54bfc2301c5f8882\"], \"rport\": 8090, \"session_types\": false, \"targets\": [\"Unix/Linux Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:41.459418Z"} {"uuid": "e04e6f91-6a33-4581-88ff-33960e4f67d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-51568", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/cyberpanel_preauth_rce_multi_cve.rb", "content": "{\"actions\": [{\"description\": \"Exploit using CVE-2024-51378\", \"name\": \"CVE-2024-51378\"}, {\"description\": \"Exploit using CVE-2024-51567\", \"name\": \"CVE-2024-51567\"}, {\"description\": \"Exploit using CVE-2024-51568\", \"name\": \"CVE-2024-51568\"}], \"aliases\": [], \"arch\": \"cmd\", \"author\": [\"DreyAnd\", \"Valentin Lobstein\", \"Luka Petrovic (refr4g)\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits three separate unauthenticated Remote Code Execution vulnerabilities in CyberPanel:\\n\\n - CVE-2024-51567: Command injection vulnerability in the \\\"upgrademysqlstatus\\\" endpoint.\\n - CVE-2024-51568: Command Injection via the \\\"completePath\\\" parameter in the \\\"outputExecutioner\\\" sink.\\n - CVE-2024-51378: Unauthenticated RCE in \\\"/ftp/getresetstatus\\\" and \\\"/dns/getresetstatus\\\".\\n\\n These vulnerabilities were exploited in ransomware campaigns affecting over 22,000 CyberPanel instances, with the PSAUX ransomware being the primary actor in these attacks.\", \"disclosure_date\": \"2024-10-27\", \"fullname\": \"exploit/unix/webapp/cyberpanel_preauth_rce_multi_cve\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"CyberPanel Multi CVE Pre-auth RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/unix/webapp/cyberpanel_preauth_rce_multi_cve.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"unix/webapp/cyberpanel_preauth_rce_multi_cve\", \"references\": [\"CVE-2024-51567\", \"CVE-2024-51568\", \"CVE-2024-51378\", \"EDB-52172\", \"URL-https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce\", \"URL-https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/\", \"URL-https://github.com/DreyAnd/CyberPanel-RCE\", \"URL-https://github.com/refr4g/CVE-2024-51378\", \"URL-https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/\", \"URL-https://gist.github.com/gboddin/d78823245b518edd54bfc2301c5f8882\"], \"rport\": 8090, \"session_types\": false, \"targets\": [\"Unix/Linux Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:41.459418Z"} https://vulnerability.circl.lu/sighting/e04e6f91-6a33-4581-88ff-33960e4f67d2/export Tue, 08 Sep 2026 06:50:41 +0000 https://vulnerability.circl.lu/sighting/7b1bcc5a-1436-4ac6-bd21-a9f04ade3ddc/export {"uuid": "7b1bcc5a-1436-4ac6-bd21-a9f04ade3ddc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-51567", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/cyberpanel_preauth_rce_multi_cve.rb", "content": "{\"actions\": [{\"description\": \"Exploit using CVE-2024-51378\", \"name\": \"CVE-2024-51378\"}, {\"description\": \"Exploit using CVE-2024-51567\", \"name\": \"CVE-2024-51567\"}, {\"description\": \"Exploit using CVE-2024-51568\", \"name\": \"CVE-2024-51568\"}], \"aliases\": [], \"arch\": \"cmd\", \"author\": [\"DreyAnd\", \"Valentin Lobstein\", \"Luka Petrovic (refr4g)\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits three separate unauthenticated Remote Code Execution vulnerabilities in CyberPanel:\\n\\n - CVE-2024-51567: Command injection vulnerability in the \\\"upgrademysqlstatus\\\" endpoint.\\n - CVE-2024-51568: Command Injection via the \\\"completePath\\\" parameter in the \\\"outputExecutioner\\\" sink.\\n - CVE-2024-51378: Unauthenticated RCE in \\\"/ftp/getresetstatus\\\" and \\\"/dns/getresetstatus\\\".\\n\\n These vulnerabilities were exploited in ransomware campaigns affecting over 22,000 CyberPanel instances, with the PSAUX ransomware being the primary actor in these attacks.\", \"disclosure_date\": \"2024-10-27\", \"fullname\": \"exploit/unix/webapp/cyberpanel_preauth_rce_multi_cve\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"CyberPanel Multi CVE Pre-auth RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/unix/webapp/cyberpanel_preauth_rce_multi_cve.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"unix/webapp/cyberpanel_preauth_rce_multi_cve\", \"references\": [\"CVE-2024-51567\", \"CVE-2024-51568\", \"CVE-2024-51378\", \"EDB-52172\", \"URL-https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce\", \"URL-https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/\", \"URL-https://github.com/DreyAnd/CyberPanel-RCE\", \"URL-https://github.com/refr4g/CVE-2024-51378\", \"URL-https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/\", \"URL-https://gist.github.com/gboddin/d78823245b518edd54bfc2301c5f8882\"], \"rport\": 8090, \"session_types\": false, \"targets\": [\"Unix/Linux Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:41.386407Z"} {"uuid": "7b1bcc5a-1436-4ac6-bd21-a9f04ade3ddc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-51567", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/cyberpanel_preauth_rce_multi_cve.rb", "content": "{\"actions\": [{\"description\": \"Exploit using CVE-2024-51378\", \"name\": \"CVE-2024-51378\"}, {\"description\": \"Exploit using CVE-2024-51567\", \"name\": \"CVE-2024-51567\"}, {\"description\": \"Exploit using CVE-2024-51568\", \"name\": \"CVE-2024-51568\"}], \"aliases\": [], \"arch\": \"cmd\", \"author\": [\"DreyAnd\", \"Valentin Lobstein\", \"Luka Petrovic (refr4g)\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits three separate unauthenticated Remote Code Execution vulnerabilities in CyberPanel:\\n\\n - CVE-2024-51567: Command injection vulnerability in the \\\"upgrademysqlstatus\\\" endpoint.\\n - CVE-2024-51568: Command Injection via the \\\"completePath\\\" parameter in the \\\"outputExecutioner\\\" sink.\\n - CVE-2024-51378: Unauthenticated RCE in \\\"/ftp/getresetstatus\\\" and \\\"/dns/getresetstatus\\\".\\n\\n These vulnerabilities were exploited in ransomware campaigns affecting over 22,000 CyberPanel instances, with the PSAUX ransomware being the primary actor in these attacks.\", \"disclosure_date\": \"2024-10-27\", \"fullname\": \"exploit/unix/webapp/cyberpanel_preauth_rce_multi_cve\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"CyberPanel Multi CVE Pre-auth RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/unix/webapp/cyberpanel_preauth_rce_multi_cve.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"unix/webapp/cyberpanel_preauth_rce_multi_cve\", \"references\": [\"CVE-2024-51567\", \"CVE-2024-51568\", \"CVE-2024-51378\", \"EDB-52172\", \"URL-https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce\", \"URL-https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/\", \"URL-https://github.com/DreyAnd/CyberPanel-RCE\", \"URL-https://github.com/refr4g/CVE-2024-51378\", \"URL-https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/\", \"URL-https://gist.github.com/gboddin/d78823245b518edd54bfc2301c5f8882\"], \"rport\": 8090, \"session_types\": false, \"targets\": [\"Unix/Linux Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:41.386407Z"} https://vulnerability.circl.lu/sighting/7b1bcc5a-1436-4ac6-bd21-a9f04ade3ddc/export Tue, 08 Sep 2026 06:50:41 +0000 https://vulnerability.circl.lu/sighting/a1574252-c6c0-43fb-9444-7ab028b226e1/export {"uuid": "a1574252-c6c0-43fb-9444-7ab028b226e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-51378", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/cyberpanel_preauth_rce_multi_cve.rb", "content": "{\"actions\": [{\"description\": \"Exploit using CVE-2024-51378\", \"name\": \"CVE-2024-51378\"}, {\"description\": \"Exploit using CVE-2024-51567\", \"name\": \"CVE-2024-51567\"}, {\"description\": \"Exploit using CVE-2024-51568\", \"name\": \"CVE-2024-51568\"}], \"aliases\": [], \"arch\": \"cmd\", \"author\": [\"DreyAnd\", \"Valentin Lobstein\", \"Luka Petrovic (refr4g)\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits three separate unauthenticated Remote Code Execution vulnerabilities in CyberPanel:\\n\\n - CVE-2024-51567: Command injection vulnerability in the \\\"upgrademysqlstatus\\\" endpoint.\\n - CVE-2024-51568: Command Injection via the \\\"completePath\\\" parameter in the \\\"outputExecutioner\\\" sink.\\n - CVE-2024-51378: Unauthenticated RCE in \\\"/ftp/getresetstatus\\\" and \\\"/dns/getresetstatus\\\".\\n\\n These vulnerabilities were exploited in ransomware campaigns affecting over 22,000 CyberPanel instances, with the PSAUX ransomware being the primary actor in these attacks.\", \"disclosure_date\": \"2024-10-27\", \"fullname\": \"exploit/unix/webapp/cyberpanel_preauth_rce_multi_cve\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"CyberPanel Multi CVE Pre-auth RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/unix/webapp/cyberpanel_preauth_rce_multi_cve.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"unix/webapp/cyberpanel_preauth_rce_multi_cve\", \"references\": [\"CVE-2024-51567\", \"CVE-2024-51568\", \"CVE-2024-51378\", \"EDB-52172\", \"URL-https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce\", \"URL-https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/\", \"URL-https://github.com/DreyAnd/CyberPanel-RCE\", \"URL-https://github.com/refr4g/CVE-2024-51378\", \"URL-https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/\", \"URL-https://gist.github.com/gboddin/d78823245b518edd54bfc2301c5f8882\"], \"rport\": 8090, \"session_types\": false, \"targets\": [\"Unix/Linux Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:41.316762Z"} {"uuid": "a1574252-c6c0-43fb-9444-7ab028b226e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-51378", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/cyberpanel_preauth_rce_multi_cve.rb", "content": "{\"actions\": [{\"description\": \"Exploit using CVE-2024-51378\", \"name\": \"CVE-2024-51378\"}, {\"description\": \"Exploit using CVE-2024-51567\", \"name\": \"CVE-2024-51567\"}, {\"description\": \"Exploit using CVE-2024-51568\", \"name\": \"CVE-2024-51568\"}], \"aliases\": [], \"arch\": \"cmd\", \"author\": [\"DreyAnd\", \"Valentin Lobstein\", \"Luka Petrovic (refr4g)\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits three separate unauthenticated Remote Code Execution vulnerabilities in CyberPanel:\\n\\n - CVE-2024-51567: Command injection vulnerability in the \\\"upgrademysqlstatus\\\" endpoint.\\n - CVE-2024-51568: Command Injection via the \\\"completePath\\\" parameter in the \\\"outputExecutioner\\\" sink.\\n - CVE-2024-51378: Unauthenticated RCE in \\\"/ftp/getresetstatus\\\" and \\\"/dns/getresetstatus\\\".\\n\\n These vulnerabilities were exploited in ransomware campaigns affecting over 22,000 CyberPanel instances, with the PSAUX ransomware being the primary actor in these attacks.\", \"disclosure_date\": \"2024-10-27\", \"fullname\": \"exploit/unix/webapp/cyberpanel_preauth_rce_multi_cve\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"CyberPanel Multi CVE Pre-auth RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/unix/webapp/cyberpanel_preauth_rce_multi_cve.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"unix/webapp/cyberpanel_preauth_rce_multi_cve\", \"references\": [\"CVE-2024-51567\", \"CVE-2024-51568\", \"CVE-2024-51378\", \"EDB-52172\", \"URL-https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce\", \"URL-https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/\", \"URL-https://github.com/DreyAnd/CyberPanel-RCE\", \"URL-https://github.com/refr4g/CVE-2024-51378\", \"URL-https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/\", \"URL-https://gist.github.com/gboddin/d78823245b518edd54bfc2301c5f8882\"], \"rport\": 8090, \"session_types\": false, \"targets\": [\"Unix/Linux Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:41.316762Z"} https://vulnerability.circl.lu/sighting/a1574252-c6c0-43fb-9444-7ab028b226e1/export Tue, 08 Sep 2026 06:50:41 +0000 https://vulnerability.circl.lu/sighting/b997fd14-5d40-4cec-b609-5eb7a5e8fc69/export {"uuid": "b997fd14-5d40-4cec-b609-5eb7a5e8fc69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-51092", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/librenms_authenticated_rce_cve_2024_51092.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"murrant (Tony Murray)\", \"Takahiro Yokoyama\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"An authenticated attacker can create dangerous directory names on the system and\\n alter sensitive configuration parameters through the web portal.\\n Those two defects combined then allows to inject arbitrary OS commands inside shell_exec() calls,\\n thus achieving arbitrary code execution.\", \"disclosure_date\": \"2024-11-15\", \"fullname\": \"exploit/linux/http/librenms_authenticated_rce_cve_2024_51092\", \"is_install_path\": true, \"mod_time\": \"2026-02-09 15:17:23 +0000\", \"name\": \"LibreNMS Authenticated RCE (CVE-2024-51092)\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/librenms_authenticated_rce_cve_2024_51092.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/librenms_authenticated_rce_cve_2024_51092\", \"references\": [\"GHSA-x645-6pf9-xwxw\", \"CVE-2024-51092\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Linux Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:42.823352Z"} {"uuid": "b997fd14-5d40-4cec-b609-5eb7a5e8fc69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-51092", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/librenms_authenticated_rce_cve_2024_51092.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"murrant (Tony Murray)\", \"Takahiro Yokoyama\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"An authenticated attacker can create dangerous directory names on the system and\\n alter sensitive configuration parameters through the web portal.\\n Those two defects combined then allows to inject arbitrary OS commands inside shell_exec() calls,\\n thus achieving arbitrary code execution.\", \"disclosure_date\": \"2024-11-15\", \"fullname\": \"exploit/linux/http/librenms_authenticated_rce_cve_2024_51092\", \"is_install_path\": true, \"mod_time\": \"2026-02-09 15:17:23 +0000\", \"name\": \"LibreNMS Authenticated RCE (CVE-2024-51092)\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/librenms_authenticated_rce_cve_2024_51092.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/librenms_authenticated_rce_cve_2024_51092\", \"references\": [\"GHSA-x645-6pf9-xwxw\", \"CVE-2024-51092\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Linux Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:42.823352Z"} https://vulnerability.circl.lu/sighting/b997fd14-5d40-4cec-b609-5eb7a5e8fc69/export Tue, 08 Sep 2026 06:48:42 +0000 https://vulnerability.circl.lu/sighting/5162acfc-9e41-4493-9e06-133cc5464c1b/export {"uuid": "5162acfc-9e41-4493-9e06-133cc5464c1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-51978", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/misc/brother_default_admin_auth_bypass_cve_2024_51978.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"sfewer-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"By leaking a target devices serial number, a remote attacker can generate the target devices default\\n administrator password. The target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP,\\n SNMP, or PJL requests.\", \"disclosure_date\": \"2025-06-25\", \"fullname\": \"auxiliary/admin/misc/brother_default_admin_auth_bypass_cve_2024_51978\", \"is_install_path\": true, \"mod_time\": \"2025-07-09 14:59:54 +0000\", \"name\": \"Multiple Brother devices authentication bypass via default administrator password generation\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/admin/misc/brother_default_admin_auth_bypass_cve_2024_51978.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"admin/misc/brother_default_admin_auth_bypass_cve_2024_51978\", \"references\": [\"CVE-2024-51977\", \"CVE-2024-51978\", \"URL-https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100846_000\", \"URL-https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100848_000\", \"URL-https://support.brother.com/g/b/link.aspx?prod=lmgroup1&faqid=faqp00100620_000\", \"URL-https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed\", \"URL-https://github.com/sfewer-r7/BrotherVulnerabilities\"], \"rport\": 443, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:52.755433Z"} {"uuid": "5162acfc-9e41-4493-9e06-133cc5464c1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-51978", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/misc/brother_default_admin_auth_bypass_cve_2024_51978.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"sfewer-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"By leaking a target devices serial number, a remote attacker can generate the target devices default\\n administrator password. The target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP,\\n SNMP, or PJL requests.\", \"disclosure_date\": \"2025-06-25\", \"fullname\": \"auxiliary/admin/misc/brother_default_admin_auth_bypass_cve_2024_51978\", \"is_install_path\": true, \"mod_time\": \"2025-07-09 14:59:54 +0000\", \"name\": \"Multiple Brother devices authentication bypass via default administrator password generation\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/admin/misc/brother_default_admin_auth_bypass_cve_2024_51978.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"admin/misc/brother_default_admin_auth_bypass_cve_2024_51978\", \"references\": [\"CVE-2024-51977\", \"CVE-2024-51978\", \"URL-https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100846_000\", \"URL-https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100848_000\", \"URL-https://support.brother.com/g/b/link.aspx?prod=lmgroup1&faqid=faqp00100620_000\", \"URL-https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed\", \"URL-https://github.com/sfewer-r7/BrotherVulnerabilities\"], \"rport\": 443, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:52.755433Z"} https://vulnerability.circl.lu/sighting/5162acfc-9e41-4493-9e06-133cc5464c1b/export Tue, 08 Sep 2026 06:46:52 +0000 https://vulnerability.circl.lu/sighting/8424ec49-55eb-4e0a-b325-d1174f580458/export {"uuid": "8424ec49-55eb-4e0a-b325-d1174f580458", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-51977", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/misc/brother_default_admin_auth_bypass_cve_2024_51978.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"sfewer-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"By leaking a target devices serial number, a remote attacker can generate the target devices default\\n administrator password. The target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP,\\n SNMP, or PJL requests.\", \"disclosure_date\": \"2025-06-25\", \"fullname\": \"auxiliary/admin/misc/brother_default_admin_auth_bypass_cve_2024_51978\", \"is_install_path\": true, \"mod_time\": \"2025-07-09 14:59:54 +0000\", \"name\": \"Multiple Brother devices authentication bypass via default administrator password generation\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/admin/misc/brother_default_admin_auth_bypass_cve_2024_51978.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"admin/misc/brother_default_admin_auth_bypass_cve_2024_51978\", \"references\": [\"CVE-2024-51977\", \"CVE-2024-51978\", \"URL-https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100846_000\", \"URL-https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100848_000\", \"URL-https://support.brother.com/g/b/link.aspx?prod=lmgroup1&faqid=faqp00100620_000\", \"URL-https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed\", \"URL-https://github.com/sfewer-r7/BrotherVulnerabilities\"], \"rport\": 443, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:52.643664Z"} {"uuid": "8424ec49-55eb-4e0a-b325-d1174f580458", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-51977", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/misc/brother_default_admin_auth_bypass_cve_2024_51978.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"sfewer-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"By leaking a target devices serial number, a remote attacker can generate the target devices default\\n administrator password. The target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP,\\n SNMP, or PJL requests.\", \"disclosure_date\": \"2025-06-25\", \"fullname\": \"auxiliary/admin/misc/brother_default_admin_auth_bypass_cve_2024_51978\", \"is_install_path\": true, \"mod_time\": \"2025-07-09 14:59:54 +0000\", \"name\": \"Multiple Brother devices authentication bypass via default administrator password generation\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/admin/misc/brother_default_admin_auth_bypass_cve_2024_51978.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"admin/misc/brother_default_admin_auth_bypass_cve_2024_51978\", \"references\": [\"CVE-2024-51977\", \"CVE-2024-51978\", \"URL-https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100846_000\", \"URL-https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100848_000\", \"URL-https://support.brother.com/g/b/link.aspx?prod=lmgroup1&faqid=faqp00100620_000\", \"URL-https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed\", \"URL-https://github.com/sfewer-r7/BrotherVulnerabilities\"], \"rport\": 443, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:52.643664Z"} https://vulnerability.circl.lu/sighting/8424ec49-55eb-4e0a-b325-d1174f580458/export Tue, 08 Sep 2026 06:46:52 +0000