https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 17 Sep 2026 09:01:49 +0000 https://vulnerability.circl.lu/sighting/fd5fa95e-8044-47ac-aeef-5cd2a80aaed2/export {"uuid": "fd5fa95e-8044-47ac-aeef-5cd2a80aaed2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9316", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Zach Hanley (Horizon3.ai)\", \"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module scans for vulnerable N-able N-Central instances affected by\\n CVE-2025-9316 (Unauthenticated Session Bypass) and CVE-2025-11700 (XXE).\\n\\n The module attempts to exploit CVE-2025-9316 by sending a sessionHello SOAP\\n request to the ServerMMS endpoint with various appliance IDs to obtain an\\n unauthenticated session. If successful, it then tests for CVE-2025-11700\\n by writing an XXE payload file and triggering it via importServiceTemplateFromFile.\\n\\n Files of interest that can be read via XXE:\\n - /opt/nable/var/ncsai/etc/ncbackup.conf\\n - /var/opt/n-central/tmp/ncbackup/ncbackup.bin (PostgreSQL dump)\\n - /opt/nable/etc/keystore.bcfks (encrypted keystore)\\n - /opt/nable/etc/masterPassword (keystore password)\\n\\n Affected versions: N-Central < 2025.4.0.9\", \"disclosure_date\": \"2025-11-17\", \"fullname\": \"auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"N-able N-Central Authentication Bypass and XXE Scanner\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/nable_ncentral_auth_bypass_xxe\", \"references\": [\"CVE-2025-9316\", \"CVE-2025-11700\", \"URL-https://horizon3.ai/attack-research/attack-blogs/n-able-n-central-from-n-days-to-0-days/\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:37.953066Z"} {"uuid": "fd5fa95e-8044-47ac-aeef-5cd2a80aaed2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9316", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Zach Hanley (Horizon3.ai)\", \"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module scans for vulnerable N-able N-Central instances affected by\\n CVE-2025-9316 (Unauthenticated Session Bypass) and CVE-2025-11700 (XXE).\\n\\n The module attempts to exploit CVE-2025-9316 by sending a sessionHello SOAP\\n request to the ServerMMS endpoint with various appliance IDs to obtain an\\n unauthenticated session. If successful, it then tests for CVE-2025-11700\\n by writing an XXE payload file and triggering it via importServiceTemplateFromFile.\\n\\n Files of interest that can be read via XXE:\\n - /opt/nable/var/ncsai/etc/ncbackup.conf\\n - /var/opt/n-central/tmp/ncbackup/ncbackup.bin (PostgreSQL dump)\\n - /opt/nable/etc/keystore.bcfks (encrypted keystore)\\n - /opt/nable/etc/masterPassword (keystore password)\\n\\n Affected versions: N-Central < 2025.4.0.9\", \"disclosure_date\": \"2025-11-17\", \"fullname\": \"auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"N-able N-Central Authentication Bypass and XXE Scanner\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/nable_ncentral_auth_bypass_xxe\", \"references\": [\"CVE-2025-9316\", \"CVE-2025-11700\", \"URL-https://horizon3.ai/attack-research/attack-blogs/n-able-n-central-from-n-days-to-0-days/\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:37.953066Z"} https://vulnerability.circl.lu/sighting/fd5fa95e-8044-47ac-aeef-5cd2a80aaed2/export Tue, 08 Sep 2026 06:47:37 +0000 https://vulnerability.circl.lu/sighting/96e51f9f-394f-4e86-a949-664fd3ac5b6b/export {"uuid": "96e51f9f-394f-4e86-a949-664fd3ac5b6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9314", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muklil66tu2y", "content": "CVE-2025-9314 - developer tools\nThe WordPress Developer Tools plugin (versions up to 1.1.3) allows anyone on the internet to place files onto your site without logging in, using a built\u2011in upload\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#developertools #unknown #CVE #infosec", "creation_timestamp": "2026-09-02T18:40:05.766392Z"} {"uuid": "96e51f9f-394f-4e86-a949-664fd3ac5b6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9314", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muklil66tu2y", "content": "CVE-2025-9314 - developer tools\nThe WordPress Developer Tools plugin (versions up to 1.1.3) allows anyone on the internet to place files onto your site without logging in, using a built\u2011in upload\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#developertools #unknown #CVE #infosec", "creation_timestamp": "2026-09-02T18:40:05.766392Z"} https://vulnerability.circl.lu/sighting/96e51f9f-394f-4e86-a949-664fd3ac5b6b/export Wed, 02 Sep 2026 18:40:05 +0000 https://vulnerability.circl.lu/sighting/2077226a-7039-4ddf-a685-adb5d3a91801/export {"uuid": "2077226a-7039-4ddf-a685-adb5d3a91801", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9314", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/b6zaly2ekibfq", "content": "CVE-2025-9314 - Developer Tools\nCVE ID : CVE-2025-9314\n \n Published : Sept. 2, 2026, 2:25 p.m. | 50\u00a0minutes ago\n \n Description : The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload componen...", "creation_timestamp": "2026-09-02T16:18:25.568797Z"} {"uuid": "2077226a-7039-4ddf-a685-adb5d3a91801", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9314", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/b6zaly2ekibfq", "content": "CVE-2025-9314 - Developer Tools\nCVE ID : CVE-2025-9314\n \n Published : Sept. 2, 2026, 2:25 p.m. | 50\u00a0minutes ago\n \n Description : The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload componen...", "creation_timestamp": "2026-09-02T16:18:25.568797Z"} https://vulnerability.circl.lu/sighting/2077226a-7039-4ddf-a685-adb5d3a91801/export Wed, 02 Sep 2026 16:18:25 +0000 https://vulnerability.circl.lu/sighting/89fb8845-d623-4de9-bc33-5dde46b16ec8/export {"uuid": "89fb8845-d623-4de9-bc33-5dde46b16ec8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9314", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mukcxpo7ue2v", "content": "\ud83d\udea8 CVE-2025-9314 \u2014 CVSS 9.8 CRITICAL\n\nThe Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulner...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2025-9314\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-02T16:07:28.887035Z"} {"uuid": "89fb8845-d623-4de9-bc33-5dde46b16ec8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9314", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mukcxpo7ue2v", "content": "\ud83d\udea8 CVE-2025-9314 \u2014 CVSS 9.8 CRITICAL\n\nThe Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulner...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2025-9314\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-02T16:07:28.887035Z"} https://vulnerability.circl.lu/sighting/89fb8845-d623-4de9-bc33-5dde46b16ec8/export Wed, 02 Sep 2026 16:07:28 +0000 https://vulnerability.circl.lu/sighting/55b98f0f-3a26-4626-b741-16db0ce9c49c/export {"uuid": "55b98f0f-3a26-4626-b741-16db0ce9c49c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9377", "type": "exploited", "source": "https://t.me/MalaysiaHacktivistz/6874", "content": "CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025-9377 as Actively Exploited \u2013 thehackernews.com\n\nThu, 04 Sep 2025 18:03:00", "creation_timestamp": "2026-07-22T00:00:30.311938Z"} {"uuid": "55b98f0f-3a26-4626-b741-16db0ce9c49c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9377", "type": "exploited", "source": "https://t.me/MalaysiaHacktivistz/6874", "content": "CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025-9377 as Actively Exploited \u2013 thehackernews.com\n\nThu, 04 Sep 2025 18:03:00", "creation_timestamp": "2026-07-22T00:00:30.311938Z"} https://vulnerability.circl.lu/sighting/55b98f0f-3a26-4626-b741-16db0ce9c49c/export Wed, 22 Jul 2026 00:00:30 +0000 https://vulnerability.circl.lu/sighting/4417f012-a101-412e-a3da-739996352fc3/export {"uuid": "4417f012-a101-412e-a3da-739996352fc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9377", "type": "seen", "source": "https://t.me/MalaysiaHacktivistz/6874", "content": "CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025-9377 as Actively Exploited \u2013 thehackernews.com\n\nThu, 04 Sep 2025 18:03:00", "creation_timestamp": "2026-07-21T00:00:23.764631Z"} {"uuid": "4417f012-a101-412e-a3da-739996352fc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9377", "type": "seen", "source": "https://t.me/MalaysiaHacktivistz/6874", "content": "CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025-9377 as Actively Exploited \u2013 thehackernews.com\n\nThu, 04 Sep 2025 18:03:00", "creation_timestamp": "2026-07-21T00:00:23.764631Z"} https://vulnerability.circl.lu/sighting/4417f012-a101-412e-a3da-739996352fc3/export Tue, 21 Jul 2026 00:00:23 +0000 https://vulnerability.circl.lu/sighting/0a085385-39f7-4ad5-b516-cf8b5c4477c3/export {"uuid": "0a085385-39f7-4ad5-b516-cf8b5c4477c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9377", "type": "seen", "source": "https://t.me/MalaysiaHacktivistz/6874", "content": "CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025-9377 as Actively Exploited \u2013 thehackernews.com\n\nThu, 04 Sep 2025 18:03:00", "creation_timestamp": "2026-07-20T19:00:06.161491Z"} {"uuid": "0a085385-39f7-4ad5-b516-cf8b5c4477c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9377", "type": "seen", "source": "https://t.me/MalaysiaHacktivistz/6874", "content": "CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025-9377 as Actively Exploited \u2013 thehackernews.com\n\nThu, 04 Sep 2025 18:03:00", "creation_timestamp": "2026-07-20T19:00:06.161491Z"} https://vulnerability.circl.lu/sighting/0a085385-39f7-4ad5-b516-cf8b5c4477c3/export Mon, 20 Jul 2026 19:00:06 +0000 https://vulnerability.circl.lu/sighting/a68f3c4d-96b1-46cd-a2f6-c0796f9a2085/export {"uuid": "a68f3c4d-96b1-46cd-a2f6-c0796f9a2085", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2025-9316", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/928dc602-8da5-4f9f-a996-376bb7a3552e", "content": "", "creation_timestamp": "2026-06-30T09:23:45.426546Z"} {"uuid": "a68f3c4d-96b1-46cd-a2f6-c0796f9a2085", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2025-9316", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/928dc602-8da5-4f9f-a996-376bb7a3552e", "content": "", "creation_timestamp": "2026-06-30T09:23:45.426546Z"} https://vulnerability.circl.lu/sighting/a68f3c4d-96b1-46cd-a2f6-c0796f9a2085/export Tue, 30 Jun 2026 09:23:45 +0000 https://vulnerability.circl.lu/sighting/8b1bf545-8d81-42f8-9031-d893191bac78/export {"uuid": "8b1bf545-8d81-42f8-9031-d893191bac78", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9377", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4e287e5a-44cf-4636-a1ea-868e12887a0a", "content": "", "creation_timestamp": "2026-06-23T14:03:51.628704Z"} {"uuid": "8b1bf545-8d81-42f8-9031-d893191bac78", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9377", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4e287e5a-44cf-4636-a1ea-868e12887a0a", "content": "", "creation_timestamp": "2026-06-23T14:03:51.628704Z"} https://vulnerability.circl.lu/sighting/8b1bf545-8d81-42f8-9031-d893191bac78/export Tue, 23 Jun 2026 14:03:51 +0000 https://vulnerability.circl.lu/sighting/1fdacbc8-2e46-4881-b2e4-63d782785c5f/export {"uuid": "1fdacbc8-2e46-4881-b2e4-63d782785c5f", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9316", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c19bb73c-eed8-40db-83e1-8e290864eb02", "content": "", "creation_timestamp": "2026-06-23T14:03:01.907729Z"} {"uuid": "1fdacbc8-2e46-4881-b2e4-63d782785c5f", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9316", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c19bb73c-eed8-40db-83e1-8e290864eb02", "content": "", "creation_timestamp": "2026-06-23T14:03:01.907729Z"} https://vulnerability.circl.lu/sighting/1fdacbc8-2e46-4881-b2e4-63d782785c5f/export Tue, 23 Jun 2026 14:03:01 +0000