{"vulnerability": "CVE-2025-67888", "sightings": [{"uuid": "ceadd35f-5aae-4f6c-8e2a-6127dea754d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67888", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mciiaduotw22", "content": "", "creation_timestamp": "2026-01-15T21:02:59.021915Z"}, {"uuid": "3b377cc2-6771-4fee-83ea-d735063aa4cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67888", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/control_web_panel_api_cmd_exec.rb", "content": "", "creation_timestamp": "2026-01-14T14:57:39.000000Z"}, {"uuid": "1cf6af6f-f843-4a23-8d38-51ba94c80976", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67888", "type": "published-proof-of-concept", "source": "Telegram/7hKD5YeJK0RQiIJ3OrJi5geFO0owuRt0spxMlfyZ7RMSrKY", "content": "", "creation_timestamp": "2025-12-18T15:00:09.000000Z"}, {"uuid": "633d95e6-5edf-48d2-a7e4-a01cabab2dfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67888", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mldfweesyk2i", "content": "CVE-2025-67888 - Softaculous SitePad OS Command Injection Vulnerability\nCVE ID : CVE-2025-67888\n \n Published : May 8, 2026, 7:16 a.m. | 1\u00a0hour, 9\u00a0minutes ago\n \n Description : An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. User input passed via the \"key\" ...", "creation_timestamp": "2026-05-08T09:25:02.076079Z"}, {"uuid": "bc9aaf15-35f5-4099-a1e1-351d9d5d452b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67888", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/control_web_panel_api_cmd_exec.rb", "content": "{\"aliases\": [], \"arch\": \"x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, tty, java, ruby, dalvik, python, nodejs, firefox, zarch, r, riscv32be, riscv32le, riscv64be, riscv64le, loongarch64\", \"author\": [\"Lukas Johannes M\\u00f6ller\", \"Egidio Romano\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Control Web Panel (CWP) versions <= 0.9.8.1208 are vulnerable to\\n          unauthenticated OS command injection. User input passed via the\\n          \\\"key\\\" GET parameter to /admin/index.php (when the \\\"api\\\" parameter is set)\\n          is not properly sanitized before being used to execute OS commands.\\n          This can be exploited by unauthenticated attackers to inject and execute\\n          arbitrary OS commands with the privileges of the root user on the web server.\\n\\n          Successful exploitation usually requires \\\"Softaculous\\\" and/or \\\"SitePad\\\"\\n          to be installed through the Scripts Manager.\", \"disclosure_date\": \"2025-12-16\", \"fullname\": \"exploit/linux/http/control_web_panel_api_cmd_exec\", \"is_install_path\": true, \"mod_time\": \"2026-01-13 14:24:04 +0000\", \"name\": \"Control Web Panel /admin/index.php Unauthenticated RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/control_web_panel_api_cmd_exec.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/control_web_panel_api_cmd_exec\", \"references\": [\"CVE-2025-67888\", \"URL-https://karmainsecurity.com/KIS-2025-09\", \"URL-https://www.cve.org/CVERecord?id=CVE-2025-67888\", \"URL-https://control-webpanel.com\"], \"rport\": 2031, \"session_types\": false, \"targets\": [\"Unix Command\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:28.342448Z"}]}