{"vulnerability": "CVE-2020-1432", "sightings": [{"uuid": "ea4f4f7f-a1e6-49ba-9ac7-41fdb23c7ffb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14321", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "4cc4887e-3b01-48dd-bff7-b5e042098135", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14321", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:24.000000Z"}, {"uuid": "e84e7f1d-45e7-4cb9-8f70-aec7ed1b7a69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14321", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/moodle_teacher_enrollment_priv_esc_to_rce.rb", "content": "", "creation_timestamp": "2021-10-11T22:36:30.000000Z"}, {"uuid": "67b7bcf3-77d7-41a3-9bf7-005fe9ad8f44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14321", "type": "published-proof-of-concept", "source": "Telegram/BFmqOBhszqMKcQYemdeZaPAwmeKtL9VmRmeXNRw5cKm7Jg", "content": "", "creation_timestamp": "2021-08-05T08:06:07.000000Z"}, {"uuid": "d20eea9c-dd68-4c33-9873-035d59072032", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14321", "type": "published-proof-of-concept", "source": "https://t.me/Teamx1945x/1044", "content": "\ud83d\udd30 \u0623\u0647\u0645 \u0646\u0642\u0627\u0637 \u0627\u0644\u0636\u0639\u0641\u00a0 \u0645\u0639 POC\n\nCVE-2020-17530 |\u00a0 \u0623\u0628\u0627\u062a\u0634\u064a \u0627\u0644\u062f\u0639\u0627\u0645\u0627\u062a RCE\n\nhttps://youtu.be/MUAAwijvAe8\n\n\u0633\u0627\u0644\u062a\u0633\u062a\u0627\u0643 \u0622\u0631 \u0633\u064a \u0625\u064a |\u00a0 CVE-2020-16846\n\nhttps://youtu.be/5cV9wh2w-O8\n\n\u0623\u0628\u0627\u062a\u0634\u064a \u0623\u0648\u0646\u0648\u0645\u064a RCE |\u00a0 CVE-2020-13942\n\nhttps://youtu.be/iz6wjdGnpds\n\n\u0634\u0628\u062d \u0627\u0644\u0642\u0637 |\u00a0 CVE-2020-1938\n\nhttps://youtu.be/3TGIg1x4XwU\n\n\u0623\u0648\u0631\u0627\u0643\u0644 \u0648\u064a\u0628 \u0644\u0648\u062c\u064a\u0643 RCE |\u00a0 CVE-2020-14882\n\nhttps://youtu.be/t-sxvcZNFZo\n\n\u0623\u0628\u0627\u062a\u0634\u064a \u062a\u0648\u0645\u0643\u0627\u062a RCE |\u00a0 CVE-2020-9484\n\nhttps://youtu.be/nF8tfsY74ws\n\n\u0645\u0648\u062f\u0644 \u0622\u0631 \u0633\u064a \u0625\u064a |\u00a0 CVE-2020-14321\n\nhttps://youtu.be/BkEInFI4oIU\n\n\u0633\u064a\u0633\u0643\u0648 CVE-2020-3452 \u0635\n\nhttps://youtu.be/-UldKwwVgHE\n\n\u0627\u0644\u0628\u0631\u0646\u0627\u0645\u062c \u0627\u0644\u0645\u0633\u0627\u0639\u062f \u0644\u0642\u0627\u0639\u062f\u0629 \u0628\u064a\u0627\u0646\u0627\u062a \u0648\u0648\u0631\u062f\u0628\u0631\u064a\u0633 |\u00a0 CVE-2020-7048\n\nhttps://youtu.be/nj_dqcvrwp4\n\nCVE-2020-5902 F5 \u0639\u0646\u0648\u0627\u0646 IP \u0643\u0628\u064a\u0631\n\nhttps://youtu.be/-ppzdYDk-ZM\n\n\u0645\u0642\u0627\u0637\u0639 \u0641\u064a\u062f\u064a\u0648 \u0623\u062e\u0631\u0649 \u062d\u0648\u0644 CVE PoC\n\nhttps://youtube.com/playlist?list=PLiVfOzljj-46iFcif16qMaPP84ZxCZ4Mb\n\n\u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u0649 \u0645\u062e\u062a\u0628\u0631 \u0645\u0643\u0627\u0641\u062d\u0629 \u0627\u0644\u062a\u0637\u0631\u0641 \u0627\u0644\u0639\u0646\u064a\u0641: https://www.vulnmachines.com", "creation_timestamp": "2024-03-29T18:27:13.000000Z"}, {"uuid": "6295571f-7819-4935-826b-03c6bf9cba9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14321", "type": "published-proof-of-concept", "source": "Telegram/k6hHUJVRmEVte2QfNLuU8-v67rBZSq4t8lJINPEEK3muAg", "content": "", "creation_timestamp": "2023-11-22T10:48:36.000000Z"}, {"uuid": "7d1f90b4-ac4c-4b74-81b3-d2e84b321b5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14321", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/868", "content": "CVE-2020-14321 Moodle Teacher Enrollment Privilege Escalation / Remote Code Execution\nhttps://www.pwnwiki.org/index.php?title=CVE-2020-14321_Moodle_Teacher_Enrollment_Privilege_Escalation_/_Remote_Code_Execution", "creation_timestamp": "2021-10-13T01:56:28.000000Z"}, {"uuid": "06a6b23c-7d05-4e0c-a498-454d6fd127b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14321", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/540", "content": "#exploit\n1. CVE-2020-13390:\nTenda AC6/9/15/18 - DoS\nhttps://joel-malwarebenchmark.github.io/blog/2020/04/28/cve-2020-13390-Tenda-vulnerability\n\n2. CVE-2020-14321:\nImproper Authorization in moodle\nhttps://github.com/f0ns1/CVE-2020-14321-modified-exploit\n\n3. CVE-2019-13139:\nDocker build code execution\nhttps://staaldraad.github.io/post/2019-07-16-cve-2019-13139-docker-build", "creation_timestamp": "2024-10-14T22:35:35.000000Z"}, {"uuid": "65e0f135-4baf-4616-a753-67b482b8577a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14324", "type": "seen", "source": "https://t.me/cibsecurity/14032", "content": "ATENTION\u203c New - CVE-2020-14324\n\nA high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection vulnerability can be exploited by authenticated attacker while setuping conversion host through Infrastructure Migration Solution. This flaw allows attacker to execute arbitrary commands on CloudForms server.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-08-11T18:55:21.000000Z"}, {"uuid": "a4c12134-3793-451c-878f-b89cc12c32a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14325", "type": "seen", "source": "https://t.me/cibsecurity/14023", "content": "ATENTION\u203c New - CVE-2020-14325\n\nRed Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows malicious attacker to create existent and non-existent role-based access control user, with groups and roles. With a selected group of EvmGroup-super_administrator, an attacker can perform any API request as a super administrator.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-08-11T16:55:08.000000Z"}, {"uuid": "a1b57a43-e216-4dc9-8343-5dafb6552bb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14321", "type": "seen", "source": "https://t.me/cissp/2541", "content": "Top vulnerabilities 2020 with POC\n\nCVE-2020-17530 | Apache Struts RCE\nhttps://youtu.be/MUAAwijvAe8\n\nSaltstack RCE | CVE-2020-16846\nhttps://youtu.be/5cV9wh2w-O8\n\nApache Unomi RCE | CVE-2020-13942\nhttps://youtu.be/iz6wjdGnpds\n\nGhost Cat | CVE-2020-1938\nhttps://youtu.be/3TGIg1x4XwU\n\nOracle WebLogic RCE | CVE-2020-14882\nhttps://youtu.be/t-sxvcZNFZo\n\nApache Tomcat RCE | CVE-2020-9484\nhttps://youtu.be/nF8tfsY74ws\n\nMoodle RCE | CVE-2020-14321\nhttps://youtu.be/BkEInFI4oIU\n\nCisco CVE-2020-3452 poc\nhttps://youtu.be/-UldKwwVgHE\n\nWordpress database plugin | CVE-2020-7048\nhttps://youtu.be/nj_dqcvrwp4\n\nCVE-2020-5902 F5 big IP\nhttps://youtu.be/-ppzdYDk-ZM\n\nOther CVE PoC videos\nhttps://youtube.com/playlist?list=PLiVfOzljj-46iFcif16qMaPP84ZxCZ4Mb", "creation_timestamp": "2026-09-01T17:00:59.092648Z"}, {"uuid": "0c79b6fc-681f-41f3-8057-b288177620a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14321", "type": "seen", "source": "https://t.me/hackersmeet0/2406", "content": "\ud83d\udd30 Top vulnerabilities 2020 with POC\n\nCVE-2020-17530 | Apache Struts RCE\n\nhttps://youtu.be/MUAAwijvAe8\n\nSaltstack RCE | CVE-2020-16846\n\nhttps://youtu.be/5cV9wh2w-O8\n\nApache Unomi RCE | CVE-2020-13942\n\nhttps://youtu.be/iz6wjdGnpds\n\nGhost Cat | CVE-2020-1938\n\nhttps://youtu.be/3TGIg1x4XwU\n\nOracle WebLogic RCE | CVE-2020-14882\n\nhttps://youtu.be/t-sxvcZNFZo\n\nApache Tomcat RCE | CVE-2020-9484\n\nhttps://youtu.be/nF8tfsY74ws\n\nMoodle RCE | CVE-2020-14321\n\nhttps://youtu.be/BkEInFI4oIU\n\nCisco CVE-2020-3452 poc\n\nhttps://youtu.be/-UldKwwVgHE\n\nWordpress database plugin | CVE-2020-7048\n\nhttps://youtu.be/nj_dqcvrwp4\n\nCVE-2020-5902 F5 big IP\n\nhttps://youtu.be/-ppzdYDk-ZM\n\nOther CVE PoC videos\n\nhttps://youtube.com/playlist?list=PLiVfOzljj-46iFcif16qMaPP84ZxCZ4Mb\n\nCVE Lab Access : https://www.vulnmachines.com", "creation_timestamp": "2026-09-01T18:00:05.369129Z"}, {"uuid": "6ad3b9d2-8785-438c-93ad-4f5db01959dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14321", "type": "seen", "source": "https://t.me/hackersmeet0/2406", "content": "\ud83d\udd30 Top vulnerabilities 2020 with POC\n\nCVE-2020-17530 | Apache Struts RCE\n\nhttps://youtu.be/MUAAwijvAe8\n\nSaltstack RCE | CVE-2020-16846\n\nhttps://youtu.be/5cV9wh2w-O8\n\nApache Unomi RCE | CVE-2020-13942\n\nhttps://youtu.be/iz6wjdGnpds\n\nGhost Cat | CVE-2020-1938\n\nhttps://youtu.be/3TGIg1x4XwU\n\nOracle WebLogic RCE | CVE-2020-14882\n\nhttps://youtu.be/t-sxvcZNFZo\n\nApache Tomcat RCE | CVE-2020-9484\n\nhttps://youtu.be/nF8tfsY74ws\n\nMoodle RCE | CVE-2020-14321\n\nhttps://youtu.be/BkEInFI4oIU\n\nCisco CVE-2020-3452 poc\n\nhttps://youtu.be/-UldKwwVgHE\n\nWordpress database plugin | CVE-2020-7048\n\nhttps://youtu.be/nj_dqcvrwp4\n\nCVE-2020-5902 F5 big IP\n\nhttps://youtu.be/-ppzdYDk-ZM\n\nOther CVE PoC videos\n\nhttps://youtube.com/playlist?list=PLiVfOzljj-46iFcif16qMaPP84ZxCZ4Mb\n\nCVE Lab Access : https://www.vulnmachines.com", "creation_timestamp": "2026-09-02T01:03:30.843007Z"}, {"uuid": "0c585cd5-40f7-4eec-bf93-292a36b23a2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14321", "type": "seen", "source": "https://t.me/cissp/2541", "content": "Top vulnerabilities 2020 with POC\n\nCVE-2020-17530 | Apache Struts RCE\nhttps://youtu.be/MUAAwijvAe8\n\nSaltstack RCE | CVE-2020-16846\nhttps://youtu.be/5cV9wh2w-O8\n\nApache Unomi RCE | CVE-2020-13942\nhttps://youtu.be/iz6wjdGnpds\n\nGhost Cat | CVE-2020-1938\nhttps://youtu.be/3TGIg1x4XwU\n\nOracle WebLogic RCE | CVE-2020-14882\nhttps://youtu.be/t-sxvcZNFZo\n\nApache Tomcat RCE | CVE-2020-9484\nhttps://youtu.be/nF8tfsY74ws\n\nMoodle RCE | CVE-2020-14321\nhttps://youtu.be/BkEInFI4oIU\n\nCisco CVE-2020-3452 poc\nhttps://youtu.be/-UldKwwVgHE\n\nWordpress database plugin | CVE-2020-7048\nhttps://youtu.be/nj_dqcvrwp4\n\nCVE-2020-5902 F5 big IP\nhttps://youtu.be/-ppzdYDk-ZM\n\nOther CVE PoC videos\nhttps://youtube.com/playlist?list=PLiVfOzljj-46iFcif16qMaPP84ZxCZ4Mb", "creation_timestamp": "2026-09-02T01:04:49.897872Z"}, {"uuid": "52e0a626-9e17-44b8-8943-c4dee7ad120c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14321", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/moodle_teacher_enrollment_priv_esc_to_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"HoangKien1020\", \"lanz\", \"h00die\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Moodle version 3.9, 3.8 to 3.8.3, 3.7 to 3.7.6, 3.5 to 3.5.12 and earlier unsupported versions\\n          allow for a teacher to exploit chain to RCE.  A bug in the privileges system allows a teacher\\n          to add themselves as a manager to their own class. They can then add any other users, and thus\\n          look to add someone with manager privileges on the system (not just the class).  After\\n          adding a system manager, a 'loginas' feature is used to access their account.  Next the system\\n          is reconfigured to allow for all users to install an addon/plugin.  Then a malicious theme\\n          is uploaded and creates an RCE.\\n\\n          If all of that is a success, we revert permissions for managers to system default and\\n          remove our malicoius theme.  Manual cleanup to remove students from the class is required.\\n\\n          This module was tested against Moodle version 3.9\", \"disclosure_date\": \"2020-07-20\", \"fullname\": \"exploit/multi/http/moodle_teacher_enrollment_priv_esc_to_rce\", \"is_install_path\": true, \"mod_time\": \"2021-10-11 16:23:09 +0000\", \"name\": \"Moodle Teacher Enrollment Privilege Escalation to RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"config-changes\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/moodle_teacher_enrollment_priv_esc_to_rce.rb\", \"platform\": \"PHP\", \"post_auth\": true, \"rank\": 400, \"ref_name\": \"multi/http/moodle_teacher_enrollment_priv_esc_to_rce\", \"references\": [\"CVE-2020-14321\", \"URL-https://moodle.org/mod/forum/discuss.php?d=407393\", \"URL-https://github.com/HoangKien1020/CVE-2020-14321\", \"EDB-50180\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:03.755879Z"}, {"uuid": "11bc7878-37b2-4588-88cd-5e765c5d7329", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14321", "type": "published-proof-of-concept", "source": "https://t.me/hackersmeet0/2406", "content": "\ud83d\udd30 Top vulnerabilities 2020 with POC\n\nCVE-2020-17530 | Apache Struts RCE\n\nhttps://youtu.be/MUAAwijvAe8\n\nSaltstack RCE | CVE-2020-16846\n\nhttps://youtu.be/5cV9wh2w-O8\n\nApache Unomi RCE | CVE-2020-13942\n\nhttps://youtu.be/iz6wjdGnpds\n\nGhost Cat | CVE-2020-1938\n\nhttps://youtu.be/3TGIg1x4XwU\n\nOracle WebLogic RCE | CVE-2020-14882\n\nhttps://youtu.be/t-sxvcZNFZo\n\nApache Tomcat RCE | CVE-2020-9484\n\nhttps://youtu.be/nF8tfsY74ws\n\nMoodle RCE | CVE-2020-14321\n\nhttps://youtu.be/BkEInFI4oIU\n\nCisco CVE-2020-3452 poc\n\nhttps://youtu.be/-UldKwwVgHE\n\nWordpress database plugin | CVE-2020-7048\n\nhttps://youtu.be/nj_dqcvrwp4\n\nCVE-2020-5902 F5 big IP\n\nhttps://youtu.be/-ppzdYDk-ZM\n\nOther CVE PoC videos\n\nhttps://youtube.com/playlist?list=PLiVfOzljj-46iFcif16qMaPP84ZxCZ4Mb\n\nCVE Lab Access : https://www.vulnmachines.com", "creation_timestamp": "2026-09-08T21:00:03.829423Z"}, {"uuid": "d6de6af4-a5e2-4658-9cb7-e0d235e57d76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14321", "type": "published-proof-of-concept", "source": "https://t.me/hackersmeet0/2406", "content": "\ud83d\udd30 Top vulnerabilities 2020 with POC\n\nCVE-2020-17530 | Apache Struts RCE\n\nhttps://youtu.be/MUAAwijvAe8\n\nSaltstack RCE | CVE-2020-16846\n\nhttps://youtu.be/5cV9wh2w-O8\n\nApache Unomi RCE | CVE-2020-13942\n\nhttps://youtu.be/iz6wjdGnpds\n\nGhost Cat | CVE-2020-1938\n\nhttps://youtu.be/3TGIg1x4XwU\n\nOracle WebLogic RCE | CVE-2020-14882\n\nhttps://youtu.be/t-sxvcZNFZo\n\nApache Tomcat RCE | CVE-2020-9484\n\nhttps://youtu.be/nF8tfsY74ws\n\nMoodle RCE | CVE-2020-14321\n\nhttps://youtu.be/BkEInFI4oIU\n\nCisco CVE-2020-3452 poc\n\nhttps://youtu.be/-UldKwwVgHE\n\nWordpress database plugin | CVE-2020-7048\n\nhttps://youtu.be/nj_dqcvrwp4\n\nCVE-2020-5902 F5 big IP\n\nhttps://youtu.be/-ppzdYDk-ZM\n\nOther CVE PoC videos\n\nhttps://youtube.com/playlist?list=PLiVfOzljj-46iFcif16qMaPP84ZxCZ4Mb\n\nCVE Lab Access : https://www.vulnmachines.com", "creation_timestamp": "2026-09-09T00:00:13.699357Z"}]}