{"vulnerability": "CVE-2014-1251", "sightings": [{"uuid": "db1f4679-659e-45b2-a770-cb87be9fca50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125122", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:57.000000Z"}, {"uuid": "836709c6-2a53-421c-aa77-12215477edf9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125121", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:57.000000Z"}, {"uuid": "70d608fd-7ceb-4b72-8941-d4e2a4df16a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125123", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:57.000000Z"}, {"uuid": "edaf1b3c-d680-4fd1-8d60-e19c1bb6e9ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125124", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:57.000000Z"}, {"uuid": "05e3d7c2-d6d2-4357-8894-815d2342d09a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125113", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:57.000000Z"}, {"uuid": "8f7e71ac-9ddb-476a-b50f-235b1749ec15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125114", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:57.000000Z"}, {"uuid": "423e8167-12d8-45f7-8cfb-3fa7883ef07e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125115", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:57.000000Z"}, {"uuid": "9251a211-06b0-4799-a9af-68292429a2fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125116", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:57.000000Z"}, {"uuid": "e4e8972d-bbaa-46f6-af29-a3cb41f6dc55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125117", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:57.000000Z"}, {"uuid": "089ba4c7-1971-4419-8f19-0361a3f3611f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125118", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:57.000000Z"}, {"uuid": "3e3fe48e-7b83-486a-9787-d5290dabe8d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125119", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:57.000000Z"}, {"uuid": "881e37d2-e145-4b0b-a1d4-d2f52f3c4057", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125125", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:57.000000Z"}, {"uuid": "7448e088-2159-413f-b0f4-42165751edde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125126", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:57.000000Z"}, {"uuid": "1ba6a763-08e0-4ad7-9157-47657f66df93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125119", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3luvhjy7pt523", "content": "", "creation_timestamp": "2025-07-26T21:02:22.605496Z"}, {"uuid": "1b5f7d6e-0aeb-4144-bc04-aa01af6137a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125121", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lvekdjzy3l2f", "content": "", "creation_timestamp": "2025-08-01T21:02:24.336628Z"}, {"uuid": "10663cdb-caa4-40ec-837e-9d6aae405a7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125123", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lvekdk4pd62h", "content": "", "creation_timestamp": "2025-08-01T21:02:24.964774Z"}, {"uuid": "052432ac-2974-4601-ac13-d82829e551b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125128", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lydb5ohvz32d", "content": "", "creation_timestamp": "2025-09-08T13:00:57.895280Z"}, {"uuid": "b5f62bbd-02ec-4184-8d96-67c217b28133", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125113", "type": "seen", "source": "MISP/af1fbe07-e10c-40c4-844e-d4419bdf6f80", "content": "", "creation_timestamp": "2025-08-22T13:26:18.000000Z"}, {"uuid": "77feb4e8-80ba-4a6b-973c-b07f988f3d3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125122", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/linksys_tmunblock_admin_reset_bof.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "94f0d118-7dd1-46a9-8a14-f5ef07d871a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125125", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/a10networks_ax_directory_traversal.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "7736a140-19b9-46af-8196-944550b29e29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125117", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/dlink_dspw215_info_cgi_bof.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "e83ab654-c590-4f74-a9f7-86a500f09f31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125118", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/antivirus/escan_password_exec.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "431dd614-0bda-49d5-948e-46a92245958a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125124", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pandora_fms_exec.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "88a30ca7-a63e-4c54-8135-c5c9f1d4164f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125126", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/simple_e_document_upload_exec.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "29da5ac6-595a-49ba-a323-75647e758989", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125123", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/kloxo_sqli.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "dbc182d6-4aa4-4d3c-8033-c92bb6adab61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125115", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pandora_fms_sqli.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "afe3eaec-a637-4063-9224-85c972213b26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125113", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/dell_kace_k1000_upload.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "fa30bc14-722e-4ae8-a181-ebd3f328e337", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125121", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "6602447c-5162-4e61-82e0-3714a2a0017b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125116", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/hybridauth_install_php_exec.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "5787c436-7234-4690-a441-f6d9ced55d21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125114", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/iftp_schedule_bof.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "c9380324-44b0-4583-97f3-32738b1627d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125127", "type": "seen", "source": "https://gist.github.com/Darkcrai86/5ebe9611c8a915fc5e5d1c2fe85938f6", "content": "", "creation_timestamp": "2025-09-03T12:15:58.000000Z"}, {"uuid": "17f468d6-b662-4e38-acb0-b4354f816a9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125127", "type": "seen", "source": "https://gist.github.com/Darkcrai86/daf5a651437f49bdf8200ad8c8585dda", "content": "", "creation_timestamp": "2025-09-03T20:32:16.000000Z"}, {"uuid": "cb667dda-6c42-4de5-aed2-e921d8b17d85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125119", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/winrar_name_spoofing.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "ca80322e-903a-46e1-a1df-f91e54e6e131", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125112", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mhwoevnjzw26", "content": "", "creation_timestamp": "2026-03-26T03:36:08.541172Z"}, {"uuid": "6d49233e-fee1-4ce0-85eb-c19130e96f98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125112", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhwx3dacbr2g", "content": "", "creation_timestamp": "2026-03-26T06:11:50.850193Z"}, {"uuid": "6369cf93-1623-4982-a6a3-3a9f1901f402", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125107", "type": "seen", "source": "https://t.me/ctinow/167107", "content": "https://ift.tt/mys3RAL\nCVE-2014-125107 | Corveda PHPSandbox 1.3.4 String protection mechanism", "creation_timestamp": "2024-01-12T07:41:36.000000Z"}, {"uuid": "2f3c0c20-861a-43b0-b392-78ecdfaf30e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125108", "type": "seen", "source": "https://t.me/ctinow/169618", "content": "https://ift.tt/lpuVxOG\nCVE-2014-125108 | w3c online-spellchecker-py up to 20140130 spellchecker cross site scripting", "creation_timestamp": "2024-01-18T09:11:21.000000Z"}, {"uuid": "48656869-4400-452f-8643-0738cf64a1ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125108", "type": "seen", "source": "https://t.me/ctinow/158883", "content": "https://ift.tt/xeAyQmP\nCVE-2014-125108", "creation_timestamp": "2023-12-23T18:32:03.000000Z"}, {"uuid": "b293b6fe-8206-494d-890a-59b50d9ea1bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125109", "type": "seen", "source": "https://t.me/ctinow/159358", "content": "https://ift.tt/MbtN5rd\nCVE-2014-125109", "creation_timestamp": "2023-12-26T16:26:58.000000Z"}, {"uuid": "c772b614-36dc-49fe-9259-001bb83a0066", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125102", "type": "seen", "source": "https://t.me/cibsecurity/64774", "content": "\u203c CVE-2014-125102 \u203c\n\nA vulnerability classified as problematic was found in Bestwebsoft Relevant Plugin up to 1.0.7 on WordPress. Affected by this vulnerability is an unknown functionality of the component Thumbnail Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 1.0.8 is able to address this issue. The name of the patch is 860d1891025548cf0f5f97364c1f51a888f523c3. It is recommended to upgrade the affected component. The identifier VDB-230113 was assigned to this vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-05-30T02:18:07.000000Z"}, {"uuid": "81126cfd-9d55-435a-a3cc-631bae81c081", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125101", "type": "seen", "source": "https://t.me/cibsecurity/64748", "content": "\u203c CVE-2014-125101 \u203c\n\nA vulnerability classified as critical has been found in Portfolio Gallery Plugin up to 1.1.8 on WordPress. This affects an unknown part. The manipulation leads to sql injection. It is possible to initiate the attack remotely. Upgrading to version 1.1.9 is able to address this issue. The name of the patch is 58ed88243e17df766036f4857041edaf358076d3. It is recommended to upgrade the affected component. The identifier VDB-230085 was assigned to this vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-05-28T20:50:10.000000Z"}, {"uuid": "65ab4d4d-6a1f-40ee-b0c3-5b07dc940091", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125100", "type": "seen", "source": "https://t.me/cibsecurity/63147", "content": "\u203c CVE-2014-125100 \u203c\n\nA vulnerability classified as problematic was found in BestWebSoft Job Board Plugin 1.0.0 on WordPress. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is dbb71deee071422ce3e663fbcdce3ad24886f940. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227764.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-05-02T07:29:53.000000Z"}, {"uuid": "b120762b-508d-4335-958a-1a0bb0a1e56b", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125123", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/66c6ae5f-39cd-4104-a8a8-c42d4e07d5f8", "content": "", "creation_timestamp": "2026-06-19T12:45:27.822846Z"}, {"uuid": "b4fb0b96-c9b4-47cb-a7d8-a8ca1cec974a", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125123", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e6e1798f-3c1d-4253-8d17-d554e77234d9", "content": "", "creation_timestamp": "2026-06-23T14:03:53.028585Z"}, {"uuid": "088a0af6-7ea5-48ad-8a9d-dffc9504cf23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125122", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/linksys_tmunblock_admin_reset_bof.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Craig Heffner\", \"Michael Messner \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a stack-based buffer overflow vulnerability in the WRT120N Linksys router\\n          to reset the password of the management interface temporarily to an empty value.\\n          This module has been tested successfully on a WRT120N device with firmware version\\n          1.0.07.\", \"disclosure_date\": \"2014-02-19\", \"fullname\": \"auxiliary/admin/http/linksys_tmunblock_admin_reset_bof\", \"is_install_path\": true, \"mod_time\": \"2025-10-06 17:15:11 +0000\", \"name\": \"Linksys WRT120N tmUnblock Stack Buffer Overflow\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/admin/http/linksys_tmunblock_admin_reset_bof.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"admin/http/linksys_tmunblock_admin_reset_bof\", \"references\": [\"CVE-2014-125122\", \"EDB-31758\", \"OSVDB-103521\", \"URL-https://web.archive.org/web/20210424073058/http://www.devttys0.com/2014/02/wrt120n-fprintf-stack-overflow/\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:47.287447Z"}, {"uuid": "2a905874-4a44-4842-8a2b-0a0a64bbac7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125125", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/a10networks_ax_directory_traversal.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"xistence\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a directory traversal flaw found in A10 Networks\\n          (Soft) AX Loadbalancer version 2.6.1-GR1-P5/2.7.0 or less.  When\\n          handling a file download request, the xml/downloads class fails to\\n          properly check the 'filename' parameter, which can be abused to read\\n          any file outside the virtual directory. Important files include SSL\\n          certificates. This module works on both the hardware devices and the\\n          Virtual Machine appliances. IMPORTANT NOTE: This module will also delete the\\n          file on the device after downloading it. Because of this, the CONFIRM_DELETE\\n          option must be set to 'true' either manually or by script.\", \"disclosure_date\": \"2014-01-28\", \"fullname\": \"auxiliary/scanner/http/a10networks_ax_directory_traversal\", \"is_install_path\": true, \"mod_time\": \"2025-10-06 17:15:11 +0000\", \"name\": \"A10 Networks AX Loadbalancer Directory Traversal\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/auxiliary/scanner/http/a10networks_ax_directory_traversal.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/a10networks_ax_directory_traversal\", \"references\": [\"CVE-2014-125125\", \"OSVDB-102657\", \"BID-65206\", \"EDB-31261\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:26.428885Z"}, {"uuid": "1508a000-6fd8-4ef9-959a-fdd6e52452b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125117", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/dlink_dspw215_info_cgi_bof.rb", "content": "{\"aliases\": [], \"arch\": \"mipsbe\", \"author\": [\"Craig Heffner\", \"Michael Messner \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an anonymous remote code execution vulnerability on different D-Link\\n          devices. The vulnerability is a stack based buffer overflow in the my_cgi.cgi component,\\n          when handling specially crafted POST HTTP requests addresses to the /common/info.cgi\\n          handler. This module has been successfully tested on D-Link DSP-W215 in an emulated\\n          environment.\", \"disclosure_date\": \"2014-05-22\", \"fullname\": \"exploit/linux/http/dlink_dspw215_info_cgi_bof\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:54:55 +0000\", \"name\": \"D-Link info.cgi POST Request Buffer Overflow\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/linux/http/dlink_dspw215_info_cgi_bof.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"linux/http/dlink_dspw215_info_cgi_bof\", \"references\": [\"CVE-2014-125117\", \"OSVDB-108249\", \"URL-http://www.devttys0.com/2014/05/hacking-the-dspw215-again/\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic Targeting\", \"D-Link DSP-W215 - v1.02\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:30.797924Z"}, {"uuid": "3a8fd7fd-315a-41c6-906c-d69249062b41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125118", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/antivirus/escan_password_exec.rb", "content": "{\"aliases\": [], \"arch\": \"x86\", \"author\": [\"Joxean Koret\", \"juan vazquez \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a command injection vulnerability found in the eScan Web Management\\n          Console. The vulnerability exists while processing CheckPass login requests. An attacker\\n          with a valid username can use a malformed password to execute arbitrary commands. With\\n          mwconf privileges, the runasroot utility can be abused to get root privileges. This module\\n          has been tested successfully on eScan 5.5-2 on Ubuntu 12.04.\", \"disclosure_date\": \"2014-04-04\", \"fullname\": \"exploit/linux/antivirus/escan_password_exec\", \"is_install_path\": true, \"mod_time\": \"2026-05-14 11:43:36 +0000\", \"name\": \"eScan Web Management Console Command Injection\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/antivirus/escan_password_exec.rb\", \"platform\": \"Linux\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/antivirus/escan_password_exec\", \"references\": [\"CVE-2014-125118\", \"URL-http://www.joxeankoret.com/download/breaking_av_software-pdf.tar.gz\"], \"rport\": 10080, \"session_types\": false, \"targets\": [\"eScan 5.5-2 / Linux\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:19.709904Z"}, {"uuid": "2b1796f8-30e9-4475-9643-5f4cb02212cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125123", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/kloxo_sqli.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Unknown\", \"juan vazquez \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated SQL injection vulnerability affecting Kloxo, as\\n          exploited in the wild on January 2014. The SQL injection issue can be abused in order to\\n          retrieve the Kloxo admin cleartext password from the database. With admin access to the\\n          web control panel, remote PHP code execution can be achieved by abusing the Command Center\\n          function. The module tries to find the first server in the tree view, unless the server\\n          information is provided, in which case it executes the payload there.\", \"disclosure_date\": \"2014-01-28\", \"fullname\": \"exploit/linux/http/kloxo_sqli\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:54:55 +0000\", \"name\": \"Kloxo SQL Injection and Remote Code Execution\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/linux/http/kloxo_sqli.rb\", \"platform\": \"Unix\", \"post_auth\": false, \"rank\": 0, \"ref_name\": \"linux/http/kloxo_sqli\", \"references\": [\"CVE-2014-125123\", \"URL-https://vpsboard.com/topic/3384-kloxo-installations-compromised/\", \"URL-http://www.webhostingtalk.com/showthread.php?p=8996984\", \"URL-http://forum.lxcenter.org/index.php?t=msg&th=19215&goto=102646\"], \"rport\": 7778, \"session_types\": false, \"targets\": [\"Kloxo / CentOS\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:42.399155Z"}, {"uuid": "b01c4711-907a-4f53-ba98-6c1fd6eb5e21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125124", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pandora_fms_exec.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"xistence \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerability found in Pandora FMS 5.0RC1 and lower.\\n          It will leverage an unauthenticated command injection in the Anyterm service on\\n          port 8023/TCP. Commands are executed as the user \\\"pandora\\\". In Pandora FMS 4.1 and 5.0RC1\\n          the user \\\"artica\\\" is not assigned a password by default, which makes it possible to su\\n          to this user from the \\\"pandora\\\" user. The \\\"artica\\\" user has access to sudo without a\\n          password, which makes it possible to escalate privileges to root. However, Pandora FMS 4.0\\n          and lower force a password for the \\\"artica\\\" user during installation.\", \"disclosure_date\": \"2014-01-29\", \"fullname\": \"exploit/linux/http/pandora_fms_exec\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:55:15 +0000\", \"name\": \"Pandora FMS Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/linux/http/pandora_fms_exec.rb\", \"platform\": \"Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/pandora_fms_exec\", \"references\": [\"CVE-2014-125124\"], \"rport\": 8023, \"session_types\": false, \"targets\": [\"Pandora 5.0RC1\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:50.686071Z"}, {"uuid": "55ee25a3-10aa-4863-bbac-e24adb098a73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125115", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pandora_fms_sqli.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Lincoln \", \"Jason Kratzer \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module attempts to exploit multiple issues in order to gain remote\\n          code execution under Pandora FMS version <= 5.0 SP2.  First, an attempt\\n          to authenticate using default credentials is performed.  If this method\\n          fails, a SQL injection vulnerability is leveraged in order to extract\\n          the \\\"Auto Login\\\" password hash.  If this value is not set, the module\\n          will then extract the administrator account's MD5 password hash.\", \"disclosure_date\": \"2014-02-01\", \"fullname\": \"exploit/linux/http/pandora_fms_sqli\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 13:20:20 +0000\", \"name\": \"Pandora FMS Default Credential / SQLi Remote Code Execution\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/linux/http/pandora_fms_sqli.rb\", \"platform\": \"PHP\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/pandora_fms_sqli\", \"references\": [\"CVE-2014-125115\", \"URL-http://pandorafms.com/downloads/whats_new_5-SP3.pdf\", \"URL-http://blog.pandorafms.org/?p=2041\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Pandora FMS version <= 5.0 SP2\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:50.765983Z"}, {"uuid": "6a5bc805-050e-4922-a226-3ef7c3a50c20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125121", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"xistence \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a default hardcoded private SSH key or default hardcoded\\n          login and password in the vAPV 8.3.2.17 and vxAG 9.2.0.34 appliances made\\n          by Array Networks. After logged in as the unprivileged user, it's possible to modify\\n          the world-writable file /ca/bin/monitor.sh with attacker-supplied arbitrary code.\\n          Execution is possible by using the backend tool, running setuid, to turn the debug\\n          monitoring on. This makes it possible to trigger a payload with root privileges.\", \"disclosure_date\": \"2014-02-03\", \"fullname\": \"exploit/unix/ssh/array_vxag_vapv_privkey_privesc\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"Array Networks vAPV and vxAG Private Key Privilege Escalation Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb\", \"platform\": \"Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"unix/ssh/array_vxag_vapv_privkey_privesc\", \"references\": [\"CVE-2014-125121\", \"OSVDB-104652\", \"OSVDB-104653\", \"OSVDB-104654\", \"PACKETSTORM-125761\"], \"rport\": 22, \"session_types\": false, \"targets\": [\"vAPV 8.3.2.17 / vxAG 9.2.0.34\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:39.789193Z"}, {"uuid": "d9026c23-25f1-4454-9a11-f362f1e4d30c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125113", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/dell_kace_k1000_upload.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Bradley Austin (steponequit)\", \"bcoles \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a file upload vulnerability in Kace K1000\\n          versions 5.0 to 5.3, 5.4 prior to 5.4.76849 and 5.5 prior to 5.5.90547\\n          which allows unauthenticated users to execute arbitrary commands\\n          under the context of the 'www' user.\\n\\n          This module also abuses the 'KSudoClient::RunCommandWait' function\\n          to gain root privileges.\\n\\n          This module has been tested successfully with Dell KACE K1000\\n          version 5.3.\", \"disclosure_date\": \"2014-03-07\", \"fullname\": \"exploit/unix/http/dell_kace_k1000_upload\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:59:31 +0000\", \"name\": \"Dell KACE K1000 File Upload\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/unix/http/dell_kace_k1000_upload.rb\", \"platform\": \"Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"unix/http/dell_kace_k1000_upload\", \"references\": [\"CVE-2014-125113\", \"URL-http://console-cowboys.blogspot.com/2014/03/the-curious-case-of-ninjamonkeypiratela.html\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic Targeting\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:35.350995Z"}, {"uuid": "1db8d564-2fa4-42df-a3d3-650b387ba4ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125116", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/hybridauth_install_php_exec.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Pichaya Morimoto\", \"bcoles \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a PHP code execution vulnerability in\\n          HybridAuth versions 2.0.9 to 2.2.2. The install file 'install.php'\\n          is not removed after installation allowing unauthenticated users to\\n          write PHP code to the application configuration file 'config.php'.\\n\\n          Note: This exploit will overwrite the application configuration file\\n          rendering the application unusable.\", \"disclosure_date\": \"2014-08-04\", \"fullname\": \"exploit/unix/webapp/hybridauth_install_php_exec\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:59:12 +0000\", \"name\": \"HybridAuth install.php PHP Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/unix/webapp/hybridauth_install_php_exec.rb\", \"platform\": \"PHP\", \"post_auth\": false, \"rank\": 0, \"ref_name\": \"unix/webapp/hybridauth_install_php_exec\", \"references\": [\"CVE-2014-125116\", \"EDB-34273\", \"OSVDB-109838\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"HybridAuth version 2.0.9 to 2.2.2 (PHP Payload)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:42.990650Z"}, {"uuid": "9d90b43b-be82-411c-bb9d-741a8d81b1f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125126", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/simple_e_document_upload_exec.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"vinicius777 \", \"bcoles \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a file upload vulnerability found in Simple\\n          E-Document versions 3.0 to 3.1. Attackers can bypass authentication and\\n          abuse the upload feature in order to upload malicious PHP files which\\n          results in arbitrary remote code execution as the web server user. File\\n          uploads are disabled by default.\", \"disclosure_date\": \"2014-01-23\", \"fullname\": \"exploit/unix/webapp/simple_e_document_upload_exec\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:59:12 +0000\", \"name\": \"Simple E-Document Arbitrary File Upload\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/unix/webapp/simple_e_document_upload_exec.rb\", \"platform\": \"PHP\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"unix/webapp/simple_e_document_upload_exec\", \"references\": [\"CVE-2014-125126\", \"EDB-31142\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Generic (PHP Payload)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:47.207523Z"}, {"uuid": "7d6d84f9-b5f2-4fc3-98ac-54958da84e84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125114", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/iftp_schedule_bof.rb", "content": "{\"aliases\": [], \"arch\": \"\", \"author\": [\"metacom\", \"Gabor Seljan\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a stack-based buffer overflow vulnerability in\\n          i-Ftp v2.20, caused by a long time value set for scheduled download.\\n\\n          By persuading the victim to place a specially-crafted Schedule.xml file\\n          in the i-FTP folder, a remote attacker could execute arbitrary code on\\n          the system or cause the application to crash. This module has been\\n          tested successfully on Windows XP SP3.\", \"disclosure_date\": \"2014-11-06\", \"fullname\": \"exploit/windows/fileformat/iftp_schedule_bof\", \"is_install_path\": true, \"mod_time\": \"2025-10-06 17:15:11 +0000\", \"name\": \"i-FTP Schedule Buffer Overflow\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/fileformat/iftp_schedule_bof.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"windows/fileformat/iftp_schedule_bof\", \"references\": [\"CVE-2014-125114\", \"EDB-35177\", \"OSVDB-114279\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Windows XP SP3\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:25.970649Z"}, {"uuid": "74d058d5-a0de-49a3-845e-2a6682cb90e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-125119", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/winrar_name_spoofing.rb", "content": "{\"aliases\": [], \"arch\": \"\", \"author\": [\"chr1x\", \"juan vazquez \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module abuses a filename spoofing vulnerability in WinRAR. The vulnerability exists\\n          when opening ZIP files. The file names showed in WinRAR when opening a ZIP file come from\\n          the central directory, but the file names used to extract and open contents come from the\\n          Local File Header. This inconsistency allows to spoof file names when opening ZIP files\\n          with WinRAR, which can be abused to execute arbitrary code, as exploited in the wild in\\n          March 2014\", \"disclosure_date\": \"2009-09-28\", \"fullname\": \"exploit/windows/fileformat/winrar_name_spoofing\", \"is_install_path\": true, \"mod_time\": \"2025-10-06 17:15:11 +0000\", \"name\": \"WinRAR Filename Spoofing\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/fileformat/winrar_name_spoofing.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/fileformat/winrar_name_spoofing\", \"references\": [\"CVE-2014-125119\", \"OSVDB-62610\", \"BID-66383\", \"URL-http://securityaffairs.co/wordpress/23623/hacking/winrar-zero-day.html\", \"URL-http://an7isec.blogspot.co.il/\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Windows Universal\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:34.054389Z"}]}