{"vulnerability": "CVE-2025-2292", "sightings": [{"uuid": "d8f67fa5-3575-4cd6-bfaf-0c38431ea57b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22921", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3liibxgq7fq2o", "content": "", "creation_timestamp": "2025-02-18T22:15:34.752334Z"}, {"uuid": "5f22c62a-b297-4b40-b0bc-e225801708a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22920", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3liifepx2tz2p", "content": "", "creation_timestamp": "2025-02-18T23:16:41.852834Z"}, {"uuid": "7fe041a8-82c6-45e7-97f7-4439acfcbe3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22925", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lluikuclpm2y", "content": "", "creation_timestamp": "2025-04-02T23:01:21.754648Z"}, {"uuid": "c6093f1b-59e4-4d13-b31a-d22d3cd19411", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22923", "type": "seen", "source": "https://mastodon.social/users/CyberSignaler/statuses/114275287206653348", "content": "", "creation_timestamp": "2025-04-03T17:48:23.215641Z"}, {"uuid": "91a56b52-abf9-4b96-a7cd-6f00e49a82eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22923", "type": "seen", "source": "https://mastodon.social/users/CyberSignaler/statuses/114275287206653348", "content": "", "creation_timestamp": "2025-04-03T17:48:23.217087Z"}, {"uuid": "9d750a28-f53c-4c7b-a232-c153a5c5394a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22924", "type": "seen", "source": "https://mastodon.social/users/CyberSignaler/statuses/114275287243204828", "content": "", "creation_timestamp": "2025-04-03T17:48:24.036827Z"}, {"uuid": "be5a82d5-89bf-4ae2-a076-bc88b6a515d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22924", "type": "seen", "source": "https://mastodon.social/users/CyberSignaler/statuses/114275287243204828", "content": "", "creation_timestamp": "2025-04-03T17:48:24.038247Z"}, {"uuid": "bbf465f4-3bdd-420a-84d4-43c497fc3424", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22921", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3loh4vfryw227", "content": "", "creation_timestamp": "2025-05-05T19:43:29.911484Z"}, {"uuid": "bceead9c-edab-4003-be15-1b5ef510ea82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2292", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lunw55pyjh2w", "content": "", "creation_timestamp": "2025-07-23T21:02:28.052494Z"}, {"uuid": "93ec44f4-e695-4983-94f9-57b6f52664ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2292", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:13:04.000000Z"}, {"uuid": "3cb4ae73-a736-44c9-b409-f9aea9a86073", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2292", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/xorcom_completepbx_file_disclosure.rb", "content": "", "creation_timestamp": "2025-07-22T15:27:53.000000Z"}, {"uuid": "2085ec0e-d101-44de-bb23-50218f7636dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22921", "type": "seen", "source": "https://gist.github.com/cjatherton/4dcf832b7224fb4ce3050f751162915d", "content": "", "creation_timestamp": "2025-09-03T16:52:34.000000Z"}, {"uuid": "b08e05fe-1c68-473a-8f24-4fe6984f87b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22921", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mc5l7dnxi22q", "content": "", "creation_timestamp": "2026-01-11T12:56:54.174730Z"}, {"uuid": "9dedc310-037a-4149-bd5e-ead5ec774d53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22920", "type": "seen", "source": "https://t.me/cvedetector/18380", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-22920 - FFmpeg Heap Buffer Overflow Denial of Service\", \n  \"Content\": \"CVE ID : CVE-2025-22920 \nPublished : Feb. 18, 2025, 11:15 p.m. | 51\u00a0minutes ago \nDescription : A heap buffer overflow vulnerability in FFmpeg before commit 4bf784c allows attackers to trigger a memory corruption via supplying a crafted media file in avformat when processing tile grid group streams. This can lead to a Denial of Service (DoS). \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"19 Feb 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-02-19T01:10:53.000000Z"}, {"uuid": "f28036bf-d870-4dd7-bea5-a3c7cfaec0a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2292", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/9718", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-2292\n\ud83d\udd25 CVSS Score: 4.9 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)\n\ud83d\udd39 Description: Xorcom CompletePBX is vulnerable to an authenticated path traversal, allowing for arbitrary file reads via the Backup and Restore functionality.This issue affects CompletePBX: through 5.2.35.\n\ud83d\udccf Published: 2025-03-31T16:38:05.888Z\n\ud83d\udccf Modified: 2025-03-31T16:38:05.888Z\n\ud83d\udd17 References:\n1. https://vulncheck.com/advisories/completepbx-file-disclosure\n2. https://www.xorcom.com/new-completepbx-release-5-2-36-1/", "creation_timestamp": "2025-03-31T17:31:13.000000Z"}, {"uuid": "ee3318c0-fe0f-4ccf-81d8-f3146089f7c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22929", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/10212", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-22929\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filter_id parameter at /students/StudentFilters.php.\n\ud83d\udccf Published: 2025-04-03T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-03T13:17:16.017Z\n\ud83d\udd17 References:\n1. https://github.com/OS4ED/openSIS-Classic\n2. https://github.com/esusalla/vulnerability-research/tree/main/CVE-2025-22929", "creation_timestamp": "2025-04-03T13:35:03.000000Z"}, {"uuid": "b8fed2dc-c773-403f-845b-0d460d88f0d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22924", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/10255", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-22924\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: OS4ED openSIS v7.0 through v9.1 contains a SQL injection vulnerability via the stu_id parameter at /modules/students/Student.php.\n\ud83d\udccf Published: 2025-04-02T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-03T15:19:21.237Z\n\ud83d\udd17 References:\n1. https://github.com/OS4ED/openSIS-Classic\n2. https://github.com/esusalla/vulnerability-research/tree/main/CVE-2025-22924", "creation_timestamp": "2025-04-03T15:35:12.000000Z"}, {"uuid": "5a6b9dee-7928-47d7-bb64-6ac9bbea1eaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22923", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/10251", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-22923\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.php?modname=users/Staff.php&removefile.\n\ud83d\udccf Published: 2025-04-02T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-03T15:20:57.438Z\n\ud83d\udd17 References:\n1. https://github.com/OS4ED/openSIS-Classic\n2. https://github.com/esusalla/vulnerability-research/tree/main/CVE-2025-22923", "creation_timestamp": "2025-04-03T15:35:05.000000Z"}, {"uuid": "0d81fba8-3e04-48a0-8570-e356cb59104e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22926", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/11338", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-22926\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename.\n\ud83d\udccf Published: 2025-04-03T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-10T20:38:57.028Z\n\ud83d\udd17 References:\n1. https://github.com/OS4ED/openSIS-Classic\n2. https://github.com/esusalla/vulnerability-research/tree/main/CVE-2025-22926", "creation_timestamp": "2025-04-10T20:49:34.000000Z"}, {"uuid": "87e337fc-98ba-4b8c-a22b-bf59d2ea21e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22928", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/12743", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-22928\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cp_id parameter at /modules/messages/Inbox.php.\n\ud83d\udccf Published: 2025-04-03T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-21T18:33:52.217Z\n\ud83d\udd17 References:\n1. https://github.com/OS4ED/openSIS-Classic\n2. https://github.com/esusalla/vulnerability-research/tree/main/CVE-2025-22928", "creation_timestamp": "2025-04-21T19:02:27.000000Z"}, {"uuid": "efea227a-f1ef-425a-a70f-cb2a60f47e71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22924", "type": "seen", "source": "https://t.me/cvedetector/21927", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-22924 - OS4ED openSIS SQL Injection Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-22924 \nPublished : April 2, 2025, 9:15 p.m. | 1\u00a0hour, 19\u00a0minutes ago \nDescription : OS4ED openSIS v7.0 through v9.1 contains a SQL injection vulnerability via the stu_id parameter at /modules/students/Student.php. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"03 Apr 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-04-03T01:01:37.000000Z"}, {"uuid": "c8d5656c-00e2-4801-a314-a445e5c9d8f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22925", "type": "seen", "source": "https://t.me/cvedetector/21926", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-22925 - OS4ED openSIS SQL Injection\", \n  \"Content\": \"CVE ID : CVE-2025-22925 \nPublished : April 2, 2025, 9:15 p.m. | 1\u00a0hour, 19\u00a0minutes ago \nDescription : OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the table parameter at /attendance/AttendanceCodes.php. The remote, authenticated attacker requires the admin role to successfully exploit this vulnerability. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"03 Apr 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-04-03T01:01:36.000000Z"}, {"uuid": "d5395cce-8182-4573-afc0-c895466b62b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-22923", "type": "seen", "source": "https://t.me/cvedetector/21925", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-22923 - OS4ED openSIS File Deletion Directory Traversal\", \n  \"Content\": \"CVE ID : CVE-2025-22923 \nPublished : April 2, 2025, 9:15 p.m. | 1\u00a0hour, 19\u00a0minutes ago \nDescription : An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.php?modname=users/Staff.php&removefile. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"03 Apr 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-04-03T01:01:32.000000Z"}, {"uuid": "92437b85-c702-4760-94c7-02914889915e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2292", "type": "seen", "source": "https://t.me/cvedetector/21646", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-2292 - Xorcom CompletePBX Path Traversal Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-2292 \nPublished : March 31, 2025, 5:15 p.m. | 1\u00a0hour, 48\u00a0minutes ago \nDescription : Xorcom CompletePBX is vulnerable to an authenticated path traversal, allowing for arbitrary file reads via the Backup and Restore functionality.This issue affects CompletePBX: through 5.2.35. \nSeverity: 4.9 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"31 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-31T21:43:32.000000Z"}, {"uuid": "5969bb20-c61a-4ddf-b937-72276ee5cfd2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2292", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/xorcom_completepbx_file_disclosure.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Valentin Lobstein\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an authenticated file disclosure vulnerability in CompletePBX <= 5.2.35.\\n          The issue resides in the backup download function, where user input is not properly validated,\\n          allowing an attacker to access arbitrary files on the system as root.\\n\\n          The vulnerability is triggered by setting the `backup` parameter to a Base64-encoded\\n          absolute file path, prefixed by a comma `,`. This results in the server exposing the\\n          file contents directly.\", \"disclosure_date\": \"2025-03-02\", \"fullname\": \"auxiliary/scanner/http/xorcom_completepbx_file_disclosure\", \"is_install_path\": true, \"mod_time\": \"2025-11-23 00:36:21 +0000\", \"name\": \"Xorcom CompletePBX Authenticated File Disclosure via Backup Download\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/scanner/http/xorcom_completepbx_file_disclosure.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"scanner/http/xorcom_completepbx_file_disclosure\", \"references\": [\"CVE-2025-2292\", \"URL-https://xorcom.com/new-completepbx-release-5-2-36-1/\", \"URL-https://chocapikk.com/posts/2025/completepbx/\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:59.406224Z"}]}