{"vulnerability": "CVE-2025-60787", "sightings": [{"uuid": "eed9e4d3-eac3-450a-be82-8b19d7506f22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-60787", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:13:05.000000Z"}, {"uuid": "1de9d5b7-dcd7-426e-a5cf-a490c5249298", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-60787", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/motioneye_auth_rce_cve_2025_60787.rb", "content": "", "creation_timestamp": "2025-10-09T18:59:02.000000Z"}, {"uuid": "d82103e6-b4e0-43c4-a34a-7b0839ebd93c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-60787", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m2hynlyft32i", "content": "", "creation_timestamp": "2025-10-05T21:02:33.352808Z"}, {"uuid": "8963fe1d-e4a2-464c-9538-d0b7d5928d43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-60787", "type": "seen", "source": "https://sploitus.com/exploit?id=MSF:EXPLOIT-LINUX-HTTP-MOTIONEYE_AUTH_RCE_CVE_2025_60787-&utm_source=rss&utm_medium=rss", "content": "", "creation_timestamp": "2025-10-10T16:57:15.000000Z"}, {"uuid": "24ea3cd5-0947-40e7-afa3-d988d5260c86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-60787", "type": "seen", "source": "https://bsky.app/profile/exploitdb-bot.bsky.social/post/3melaojjh6i2d", "content": "", "creation_timestamp": "2026-02-11T10:16:06.970343Z"}, {"uuid": "297c4e8e-d732-4647-994b-0a98398a347e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-60787", "type": "published-proof-of-concept", "source": "Telegram/kozZaVukchEdgh6BzISTkEDfrxAU0uJUUfnooXfmE11qBvA", "content": "", "creation_timestamp": "2025-10-10T23:00:10.000000Z"}, {"uuid": "8adf3c13-e80f-456e-9d64-0e448943fa49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-60787", "type": "published-proof-of-concept", "source": "Telegram/3mCSMsZQGMPXAfr5RrujxrMVfWBm9IlsPo2sxRdgW_QwV40", "content": "", "creation_timestamp": "2025-10-03T19:00:08.000000Z"}, {"uuid": "d1b7bcf1-ec7e-4612-a6f3-fd17a6cc40eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-60787", "type": "published-proof-of-concept", "source": "Telegram/DUtNDBqzqNg70xYGsq609YoAm75iJpWFmMTQu6qIiePfTzs", "content": "", "creation_timestamp": "2025-10-03T21:00:04.000000Z"}, {"uuid": "5256b3df-5968-424d-8ed5-088c68065bd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-60787", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/54044", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aRCE\n\u63cf\u8ff0\uff1aCVE-2025-60787 Poc - RCE - MotionEye <= 0.43.1b4\nURL\uff1ahttps://github.com/prabhatverma47/CVE-2025-60787\n\n\u6807\u7b7e\uff1a#RCE", "creation_timestamp": "2025-10-03T15:26:53.000000Z"}, {"uuid": "ae83162b-6f1b-4f8b-86b7-52858995f885", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-60787", "type": "seen", "source": "https://t.me/bagl3y_notes/284", "content": "\ud83d\udfe2 \u041d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434\u0435\u043e-\u0440\u0430\u0437\u0431\u043e\u0440 \ud83d\udc9a \u0442\u0430\u0447\u043a\u0438 \u043e\u0442 ippsec'a\n\n\n\u2049\ufe0f   \u041d\u0430 \u0442\u0430\u0447\u043a\u0435 \u043f\u043e\u0434\u043d\u044f\u0442 ZoneMinder 1.37.x - \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c time/boolean-based Blind SQL Injection \u0432 web/ajax/event.php (CVE-2024-51482, CVSS 9.9) \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e sqlmap, \u0434\u0430\u043c\u043f\u0438\u043c \u0442\u0430\u0431\u043b\u0438\u0446\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441 bcrypt-\u0445\u044d\u0448\u0430\u043c\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u27a1\ufe0f \u0431\u0440\u0443\u0442\u0438\u043c \u0445\u044d\u0448, \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c SSH-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0442\u0430\u0447\u043a\u0435 \u27a1\ufe0f \u043d\u0430 localhost \u043a\u0440\u0443\u0442\u0438\u0442\u0441\u044f motionEye (v\u22640.43.1b4) - \u0434\u0435\u043b\u0430\u0435\u043c SSH port-forward \u0438 \u043b\u043e\u0433\u0438\u043d\u0438\u043c\u0441\u044f \u0432 \u0432\u0435\u0431\u043a\u0443 \u27a1\ufe0f \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u043c \u043d\u0430\u0448 payload \u0432 \u043f\u043e\u043b\u0435 Image File Name \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0435 \u043a\u0430\u043c\u0435\u0440\u044b (CVE-2025-60787, OS Command Injection), \u043f\u0440\u0438 \u0440\u0435\u0441\u0442\u0430\u0440\u0442\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 motion \u043d\u0430\u0448 payload \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 root = \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c reverse shell \u0441 \u043f\u043e\u043b\u043d\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u0445\u043e\u0441\u0442\u0443 (PoC, Metasploit)\n\n#\ufe0f\u20e3\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u043e Linux box - CCTV, \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 Easy\n#\ufe0f\u20e3 \u0410 \u0432\u043e\u0442 \u0435\u0449\u0435 \u0440\u0430\u0437\u0431\u043e\u0440 \u043e\u0442 \u043a\u0440\u0443\u0442\u043e\u0433\u043e \u0447\u0435\u043b\u0430 - 0xdf\n\n\n\ud83c\udf39 \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u043e\u0441\u0442\u044b \u043a\u0430\u043d\u0430\u043b\u0430 \n\n#video #HTB #ippsec #0xdf #Walkthroughs", "creation_timestamp": "2026-08-04T13:00:25.246541Z"}, {"uuid": "d7045c4f-b4b5-49e8-a3df-15d7d78b0201", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-60787", "type": "seen", "source": "https://t.me/bagl3y_notes/284", "content": "\ud83d\udfe2 \u041d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434\u0435\u043e-\u0440\u0430\u0437\u0431\u043e\u0440 \ud83d\udc9a \u0442\u0430\u0447\u043a\u0438 \u043e\u0442 ippsec'a\n\n\n\u2049\ufe0f   \u041d\u0430 \u0442\u0430\u0447\u043a\u0435 \u043f\u043e\u0434\u043d\u044f\u0442 ZoneMinder 1.37.x - \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c time/boolean-based Blind SQL Injection \u0432 web/ajax/event.php (CVE-2024-51482, CVSS 9.9) \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e sqlmap, \u0434\u0430\u043c\u043f\u0438\u043c \u0442\u0430\u0431\u043b\u0438\u0446\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441 bcrypt-\u0445\u044d\u0448\u0430\u043c\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u27a1\ufe0f \u0431\u0440\u0443\u0442\u0438\u043c \u0445\u044d\u0448, \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c SSH-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0442\u0430\u0447\u043a\u0435 \u27a1\ufe0f \u043d\u0430 localhost \u043a\u0440\u0443\u0442\u0438\u0442\u0441\u044f motionEye (v\u22640.43.1b4) - \u0434\u0435\u043b\u0430\u0435\u043c SSH port-forward \u0438 \u043b\u043e\u0433\u0438\u043d\u0438\u043c\u0441\u044f \u0432 \u0432\u0435\u0431\u043a\u0443 \u27a1\ufe0f \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u043c \u043d\u0430\u0448 payload \u0432 \u043f\u043e\u043b\u0435 Image File Name \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0435 \u043a\u0430\u043c\u0435\u0440\u044b (CVE-2025-60787, OS Command Injection), \u043f\u0440\u0438 \u0440\u0435\u0441\u0442\u0430\u0440\u0442\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 motion \u043d\u0430\u0448 payload \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 root = \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c reverse shell \u0441 \u043f\u043e\u043b\u043d\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u0445\u043e\u0441\u0442\u0443 (PoC, Metasploit)\n\n#\ufe0f\u20e3\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u043e Linux box - CCTV, \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 Easy\n#\ufe0f\u20e3 \u0410 \u0432\u043e\u0442 \u0435\u0449\u0435 \u0440\u0430\u0437\u0431\u043e\u0440 \u043e\u0442 \u043a\u0440\u0443\u0442\u043e\u0433\u043e \u0447\u0435\u043b\u0430 - 0xdf\n\n\n\ud83c\udf39 \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u043e\u0441\u0442\u044b \u043a\u0430\u043d\u0430\u043b\u0430 \n\n#video #HTB #ippsec #0xdf #Walkthroughs", "creation_timestamp": "2026-08-05T00:00:40.820087Z"}, {"uuid": "ca194d6a-cf13-49d4-a938-80a93cf13805", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-60787", "type": "published-proof-of-concept", "source": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j945-qm58-4gjx", "content": "", "creation_timestamp": "2025-11-01T12:13:17.000000Z"}, {"uuid": "b840f96f-5f6e-4999-8d24-6fb0cccf283e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-60787", "type": "published-proof-of-concept", "source": "https://t.me/bagl3y_notes/284", "content": "\ud83d\udfe2 \u041d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434\u0435\u043e-\u0440\u0430\u0437\u0431\u043e\u0440 \ud83d\udc9a \u0442\u0430\u0447\u043a\u0438 \u043e\u0442 ippsec'a\n\n\n\u2049\ufe0f   \u041d\u0430 \u0442\u0430\u0447\u043a\u0435 \u043f\u043e\u0434\u043d\u044f\u0442 ZoneMinder 1.37.x - \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c time/boolean-based Blind SQL Injection \u0432 web/ajax/event.php (CVE-2024-51482, CVSS 9.9) \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e sqlmap, \u0434\u0430\u043c\u043f\u0438\u043c \u0442\u0430\u0431\u043b\u0438\u0446\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441 bcrypt-\u0445\u044d\u0448\u0430\u043c\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u27a1\ufe0f \u0431\u0440\u0443\u0442\u0438\u043c \u0445\u044d\u0448, \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c SSH-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0442\u0430\u0447\u043a\u0435 \u27a1\ufe0f \u043d\u0430 localhost \u043a\u0440\u0443\u0442\u0438\u0442\u0441\u044f motionEye (v\u22640.43.1b4) - \u0434\u0435\u043b\u0430\u0435\u043c SSH port-forward \u0438 \u043b\u043e\u0433\u0438\u043d\u0438\u043c\u0441\u044f \u0432 \u0432\u0435\u0431\u043a\u0443 \u27a1\ufe0f \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u043c \u043d\u0430\u0448 payload \u0432 \u043f\u043e\u043b\u0435 Image File Name \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0435 \u043a\u0430\u043c\u0435\u0440\u044b (CVE-2025-60787, OS Command Injection), \u043f\u0440\u0438 \u0440\u0435\u0441\u0442\u0430\u0440\u0442\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 motion \u043d\u0430\u0448 payload \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 root = \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c reverse shell \u0441 \u043f\u043e\u043b\u043d\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u0445\u043e\u0441\u0442\u0443 (PoC, Metasploit)\n\n#\ufe0f\u20e3\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u043e Linux box - CCTV, \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 Easy\n#\ufe0f\u20e3 \u0410 \u0432\u043e\u0442 \u0435\u0449\u0435 \u0440\u0430\u0437\u0431\u043e\u0440 \u043e\u0442 \u043a\u0440\u0443\u0442\u043e\u0433\u043e \u0447\u0435\u043b\u0430 - 0xdf\n\n\n\ud83c\udf39 \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u043e\u0441\u0442\u044b \u043a\u0430\u043d\u0430\u043b\u0430 \n\n#video #HTB #ippsec #0xdf #Walkthroughs", "creation_timestamp": "2026-08-06T00:00:41.795649Z"}, {"uuid": "a49530b3-27e4-4d3d-93e3-655748de5751", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-60787", "type": "seen", "source": "https://t.me/GithubRedTeam/92871", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2025-60787\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ozcanpng\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-10 17:41:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2025-60787 motionEye authenticated command injection RCE PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:05.053635Z"}, {"uuid": "df82ec75-660a-4f3d-864a-c57faf3a727d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-60787", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/92871", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2025-60787\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ozcanpng\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-10 17:41:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2025-60787 motionEye authenticated command injection RCE PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:07.816683Z"}, {"uuid": "793a2592-0b48-4e73-bddc-5353ae4ff54d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-60787", "type": "seen", "source": "Telegram/7wZCC-BUXTpDWEW7jClwGONwAUYxvq3XR6pqbqp3HRrJIC0", "content": "", "creation_timestamp": "2026-07-16T19:00:12.977269Z"}, {"uuid": "ec084edc-e85a-48c9-9df6-34ebcd87d41d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-60787", "type": "seen", "source": "Telegram/7wZCC-BUXTpDWEW7jClwGONwAUYxvq3XR6pqbqp3HRrJIC0", "content": "", "creation_timestamp": "2026-07-17T00:00:28.319723Z"}, {"uuid": "d682d93c-8ba2-4b4d-a101-8b688b4806b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-60787", "type": "published-proof-of-concept", "source": "Telegram/7wZCC-BUXTpDWEW7jClwGONwAUYxvq3XR6pqbqp3HRrJIC0", "content": "", "creation_timestamp": "2026-07-18T01:00:28.632839Z"}]}