{"vulnerability": "cve-2025-1235", "sightings": [{"uuid": "597d5363-6c21-485e-b037-70385157c679", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1235", "type": "seen", "source": "https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3lqm53qzzeyw2", "content": "", "creation_timestamp": "2025-06-02T06:20:48.054104Z"}, {"uuid": "f1f9a0bc-0e2e-45f8-849b-ee779c80e570", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1235", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lqmfjw7evh2r", "content": "", "creation_timestamp": "2025-06-02T08:51:48.231073Z"}, {"uuid": "d50e92ea-9ce0-4390-bb28-b29b91a1cd0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12357", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3m4j43rhnsb2n", "content": "", "creation_timestamp": "2025-10-31T18:27:10.089428Z"}, {"uuid": "c933c186-f039-4fb4-ab6a-484dff2e767b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12352", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3m4zfhoup262n", "content": "", "creation_timestamp": "2025-11-07T05:57:36.376614Z"}, {"uuid": "1682a804-3fda-4eff-9c74-33461820ee04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12352", "type": "seen", "source": "https://gist.github.com/Darkcrai86/0723a85f7f6920a9dd1111f50280d569", "content": "", "creation_timestamp": "2025-11-07T07:50:31.000000Z"}, {"uuid": "430ee6f5-3667-4e0f-a62e-5ba4f76d44f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12357", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-303-01", "content": "", "creation_timestamp": "2025-10-30T11:00:00.000000Z"}, {"uuid": "254144d2-d7f5-4538-a917-44e5a10b1cba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12352", "type": "seen", "source": "https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3m52mqy3xp6c2", "content": "", "creation_timestamp": "2025-11-07T17:41:15.206275Z"}, {"uuid": "96d74d6d-7bf9-4749-9341-eb1089b8f9e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12351", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/115446907268586041", "content": "", "creation_timestamp": "2025-10-27T15:46:46.561519Z"}, {"uuid": "ee1c3306-222f-4d9c-ab99-f21a7409b720", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12353", "type": "seen", "source": "https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3m53vbopjwcr2", "content": "", "creation_timestamp": "2025-11-08T05:46:00.887970Z"}, {"uuid": "26a23073-b2ec-4272-916b-7bd82a785b2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12353", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3m53xgs4wut2s", "content": "", "creation_timestamp": "2025-11-08T06:24:26.335883Z"}, {"uuid": "a99c238b-ab40-4fe3-833f-13ddd80ab88c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12358", "type": "seen", "source": "https://gist.github.com/Darkcrai86/9826f9448c9eb1deb826741a5a90e5f2", "content": "", "creation_timestamp": "2025-12-03T14:25:59.000000Z"}, {"uuid": "b0404179-b205-402d-9a6f-2e374a32d78a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12358", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3m73wfl2eod2k", "content": "", "creation_timestamp": "2025-12-03T16:56:14.841516Z"}, {"uuid": "657dcaab-12cc-4ce0-8ebf-5d153ed5ea3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12354", "type": "seen", "source": "https://gist.github.com/Darkcrai86/f6ee49ee09d9310418870da8eddb3c43", "content": "", "creation_timestamp": "2025-12-05T12:47:15.000000Z"}, {"uuid": "0ac563d4-147b-4e9f-9c68-e33de8748174", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12357", "type": "seen", "source": "https://bsky.app/profile/fluxius.bsky.social/post/3mfcqjzc4cc25", "content": "", "creation_timestamp": "2026-02-20T18:31:11.574339Z"}, {"uuid": "c078cac5-8715-440f-849b-d53c813046a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12352", "type": "seen", "source": "https://t.me/NinjaSec/299", "content": "Code execution, and bypass vulnerabilities \u2014 for educational purposes only:\n\n\n1. CVE-2025-47241 \u2013 Whitelist bypass in Browser Use tool (CVSS 9.3)\n2. CVE-2025-25014 \u2013 Prototype pollution in Kibana (CVSS 9.1)\n3. CVE-2025-29927 \u2013 Next.js middleware authorization bypass (CVSS 9.1)\n4. CVE-2025-24813 \u2013 Apache Tomcat path traversal RCE (Critical)\n5. CVE-2025-2783 \u2013 Chrome Mojo use-after-free (High)\n6. CVE-2025-2636 \u2013 WordPress InstaWP plugin LFI (High)\n7. CVE-2025-2505 \u2013 WordPress Age Gate plugin LFI (High)\n8. CVE-2025-2746 \u2013 Kentico CMS auth bypass (CVSS 9.8)\n9. CVE-2025-2747 \u2013 Kentico CMS staging sync auth bypass (CVSS 9.8)\n10. CVE-2025-3066 \u2013 Chrome Site Isolation use-after-free (High)\n11. CVE-2025-46728 \u2013 cpp-httplib DoS vulnerability\n12. CVE-2025-12345 \u2013 Buffer overflow in XYZ app (CVSS 9.0)\n13. CVE-2025-12346 \u2013 SQL injection in ABC web app (CVSS 8.5)\n14. CVE-2025-12347 \u2013 XSS in DEF platform (CVSS 7.8)\n15. CVE-2025-12348 \u2013 Auth bypass in GHI system (CVSS 9.2)\n16. CVE-2025-12349 \u2013 RCE in JKL service via crafted packets (CVSS 9.5)\n17. CVE-2025-12350 \u2013 Privilege escalation in MNO app (CVSS 8.7)\n18. CVE-2025-12351 \u2013 Info disclosure in PQR system (CVSS 7.5)\n19. CVE-2025-12352 \u2013 DoS in STU server (CVSS 6.8)\n20. CVE-2025-12353 \u2013 Directory traversal in VWX app (CVSS 8.0)\n21. CVE-2025-12354 \u2013 Command injection in YZA tool (CVSS 9.1)\n22. CVE-2025-12355 \u2013 Insecure deserialization in BCD lib (CVSS 9.3)\n23. CVE-2025-12356 \u2013 CSRF in EFG portal (CVSS 7.2)\n24. CVE-2025-12357 \u2013 Memory corruption in HIJ driver (CVSS 8.9)\n25. CVE-2025-12358 \u2013 Improper auth in KLM API (CVSS 9.0)\n\n#HackersFactory", "creation_timestamp": "2025-05-07T15:48:27.000000Z"}, {"uuid": "3f1cec03-80d7-4659-919a-944ecfa234c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12353", "type": "seen", "source": "https://t.me/NinjaSec/299", "content": "Code execution, and bypass vulnerabilities \u2014 for educational purposes only:\n\n\n1. CVE-2025-47241 \u2013 Whitelist bypass in Browser Use tool (CVSS 9.3)\n2. CVE-2025-25014 \u2013 Prototype pollution in Kibana (CVSS 9.1)\n3. CVE-2025-29927 \u2013 Next.js middleware authorization bypass (CVSS 9.1)\n4. CVE-2025-24813 \u2013 Apache Tomcat path traversal RCE (Critical)\n5. CVE-2025-2783 \u2013 Chrome Mojo use-after-free (High)\n6. CVE-2025-2636 \u2013 WordPress InstaWP plugin LFI (High)\n7. CVE-2025-2505 \u2013 WordPress Age Gate plugin LFI (High)\n8. CVE-2025-2746 \u2013 Kentico CMS auth bypass (CVSS 9.8)\n9. CVE-2025-2747 \u2013 Kentico CMS staging sync auth bypass (CVSS 9.8)\n10. CVE-2025-3066 \u2013 Chrome Site Isolation use-after-free (High)\n11. CVE-2025-46728 \u2013 cpp-httplib DoS vulnerability\n12. CVE-2025-12345 \u2013 Buffer overflow in XYZ app (CVSS 9.0)\n13. CVE-2025-12346 \u2013 SQL injection in ABC web app (CVSS 8.5)\n14. CVE-2025-12347 \u2013 XSS in DEF platform (CVSS 7.8)\n15. CVE-2025-12348 \u2013 Auth bypass in GHI system (CVSS 9.2)\n16. CVE-2025-12349 \u2013 RCE in JKL service via crafted packets (CVSS 9.5)\n17. CVE-2025-12350 \u2013 Privilege escalation in MNO app (CVSS 8.7)\n18. CVE-2025-12351 \u2013 Info disclosure in PQR system (CVSS 7.5)\n19. CVE-2025-12352 \u2013 DoS in STU server (CVSS 6.8)\n20. CVE-2025-12353 \u2013 Directory traversal in VWX app (CVSS 8.0)\n21. CVE-2025-12354 \u2013 Command injection in YZA tool (CVSS 9.1)\n22. CVE-2025-12355 \u2013 Insecure deserialization in BCD lib (CVSS 9.3)\n23. CVE-2025-12356 \u2013 CSRF in EFG portal (CVSS 7.2)\n24. CVE-2025-12357 \u2013 Memory corruption in HIJ driver (CVSS 8.9)\n25. CVE-2025-12358 \u2013 Improper auth in KLM API (CVSS 9.0)\n\n#HackersFactory", "creation_timestamp": "2025-05-07T15:48:27.000000Z"}, {"uuid": "8b1965e1-403e-4b39-9f1f-15029ad314d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12350", "type": "seen", "source": "https://t.me/NinjaSec/299", "content": "Code execution, and bypass vulnerabilities \u2014 for educational purposes only:\n\n\n1. CVE-2025-47241 \u2013 Whitelist bypass in Browser Use tool (CVSS 9.3)\n2. CVE-2025-25014 \u2013 Prototype pollution in Kibana (CVSS 9.1)\n3. CVE-2025-29927 \u2013 Next.js middleware authorization bypass (CVSS 9.1)\n4. CVE-2025-24813 \u2013 Apache Tomcat path traversal RCE (Critical)\n5. CVE-2025-2783 \u2013 Chrome Mojo use-after-free (High)\n6. CVE-2025-2636 \u2013 WordPress InstaWP plugin LFI (High)\n7. CVE-2025-2505 \u2013 WordPress Age Gate plugin LFI (High)\n8. CVE-2025-2746 \u2013 Kentico CMS auth bypass (CVSS 9.8)\n9. CVE-2025-2747 \u2013 Kentico CMS staging sync auth bypass (CVSS 9.8)\n10. CVE-2025-3066 \u2013 Chrome Site Isolation use-after-free (High)\n11. CVE-2025-46728 \u2013 cpp-httplib DoS vulnerability\n12. CVE-2025-12345 \u2013 Buffer overflow in XYZ app (CVSS 9.0)\n13. CVE-2025-12346 \u2013 SQL injection in ABC web app (CVSS 8.5)\n14. CVE-2025-12347 \u2013 XSS in DEF platform (CVSS 7.8)\n15. CVE-2025-12348 \u2013 Auth bypass in GHI system (CVSS 9.2)\n16. CVE-2025-12349 \u2013 RCE in JKL service via crafted packets (CVSS 9.5)\n17. CVE-2025-12350 \u2013 Privilege escalation in MNO app (CVSS 8.7)\n18. CVE-2025-12351 \u2013 Info disclosure in PQR system (CVSS 7.5)\n19. CVE-2025-12352 \u2013 DoS in STU server (CVSS 6.8)\n20. CVE-2025-12353 \u2013 Directory traversal in VWX app (CVSS 8.0)\n21. CVE-2025-12354 \u2013 Command injection in YZA tool (CVSS 9.1)\n22. CVE-2025-12355 \u2013 Insecure deserialization in BCD lib (CVSS 9.3)\n23. CVE-2025-12356 \u2013 CSRF in EFG portal (CVSS 7.2)\n24. CVE-2025-12357 \u2013 Memory corruption in HIJ driver (CVSS 8.9)\n25. CVE-2025-12358 \u2013 Improper auth in KLM API (CVSS 9.0)\n\n#HackersFactory", "creation_timestamp": "2025-05-07T15:48:27.000000Z"}, {"uuid": "8cd9b8f6-8577-4ade-a6a3-16618a410e5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12359", "type": "seen", "source": "https://t.me/NinjaSec/300", "content": "Code execution, bypasses, and exploits \u2014 again, for educational purposes only:\n\n\n26. CVE-2025-12359 \u2013 RCE via unsafe deserialization in REST API (CVSS 9.4)\n27. CVE-2025-12360 \u2013 XSS in Admin Dashboard plugin (CVSS 7.6)\n28. CVE-2025-12361 \u2013 Remote file inclusion in CMS plugin (CVSS 8.9)\n29. CVE-2025-12362 \u2013 Logic flaw in session handler exposes tokens (CVSS 7.5)\n30. CVE-2025-12363 \u2013 RCE in PDF conversion tool via crafted input (CVSS 9.5)\n31. CVE-2025-12364 \u2013 Auth bypass in Single Sign-On service (CVSS 9.1)\n32. CVE-2025-12365 \u2013 LFI in backup module of web control panel (CVSS 8.6)\n33. CVE-2025-12366 \u2013 CSRF on firewall config panel (CVSS 8.0)\n34. CVE-2025-12367 \u2013 SSRF in metadata parser allows internal access (CVSS 9.0)\n35. CVE-2025-12368 \u2013 SQLi in search API of project management tool (CVSS 8.2)\n36. CVE-2025-12369 \u2013 Improper permission checks in job scheduler (CVSS 8.5)\n37. CVE-2025-12370 \u2013 Open redirect leads to phishing vector (CVSS 6.5)\n38. CVE-2025-12371 \u2013 DoS via XML bomb in document parser (CVSS 7.9)\n39. CVE-2025-12372 \u2013 Directory traversal in logs endpoint (CVSS 8.1)\n40. CVE-2025-12373 \u2013 Memory leak in image rendering library (CVSS 6.9)\n41. CVE-2025-12374 \u2013 Hardcoded credentials in IoT config interface (CVSS 9.0)\n42. CVE-2025-12375 \u2013 Insecure update mechanism in desktop agent (CVSS 9.3)\n43. CVE-2025-12376 \u2013 Path traversal in zip archive handler (CVSS 8.7)\n44. CVE-2025-12377 \u2013 Race condition in file uploader logic (CVSS 7.8)\n45. CVE-2025-12378 \u2013 Java deserialization bug in SOAP API (CVSS 9.2)\n46. CVE-2025-12379 \u2013 JWT token forgery via alg=none trick (CVSS 8.8)\n47. CVE-2025-12380 \u2013 CORS misconfig allows cross-origin token theft (CVSS 8.5)\n48. CVE-2025-12381 \u2013 Exploitable crash in media encoder (CVSS 7.0)\n49. CVE-2025-12382 \u2013 Server misconfig allows upload of executables (CVSS 8.6)\n50. CVE-2025-12383 \u2013 LDAP injection in auth form (CVSS 8.9)\n\n#HackersFactory", "creation_timestamp": "2025-05-07T15:48:27.000000Z"}, {"uuid": "7616b376-9017-4307-9004-5a7052c97fa4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12356", "type": "seen", "source": "https://t.me/NinjaSec/299", "content": "Code execution, and bypass vulnerabilities \u2014 for educational purposes only:\n\n\n1. CVE-2025-47241 \u2013 Whitelist bypass in Browser Use tool (CVSS 9.3)\n2. CVE-2025-25014 \u2013 Prototype pollution in Kibana (CVSS 9.1)\n3. CVE-2025-29927 \u2013 Next.js middleware authorization bypass (CVSS 9.1)\n4. CVE-2025-24813 \u2013 Apache Tomcat path traversal RCE (Critical)\n5. CVE-2025-2783 \u2013 Chrome Mojo use-after-free (High)\n6. CVE-2025-2636 \u2013 WordPress InstaWP plugin LFI (High)\n7. CVE-2025-2505 \u2013 WordPress Age Gate plugin LFI (High)\n8. CVE-2025-2746 \u2013 Kentico CMS auth bypass (CVSS 9.8)\n9. CVE-2025-2747 \u2013 Kentico CMS staging sync auth bypass (CVSS 9.8)\n10. CVE-2025-3066 \u2013 Chrome Site Isolation use-after-free (High)\n11. CVE-2025-46728 \u2013 cpp-httplib DoS vulnerability\n12. CVE-2025-12345 \u2013 Buffer overflow in XYZ app (CVSS 9.0)\n13. CVE-2025-12346 \u2013 SQL injection in ABC web app (CVSS 8.5)\n14. CVE-2025-12347 \u2013 XSS in DEF platform (CVSS 7.8)\n15. CVE-2025-12348 \u2013 Auth bypass in GHI system (CVSS 9.2)\n16. CVE-2025-12349 \u2013 RCE in JKL service via crafted packets (CVSS 9.5)\n17. CVE-2025-12350 \u2013 Privilege escalation in MNO app (CVSS 8.7)\n18. CVE-2025-12351 \u2013 Info disclosure in PQR system (CVSS 7.5)\n19. CVE-2025-12352 \u2013 DoS in STU server (CVSS 6.8)\n20. CVE-2025-12353 \u2013 Directory traversal in VWX app (CVSS 8.0)\n21. CVE-2025-12354 \u2013 Command injection in YZA tool (CVSS 9.1)\n22. CVE-2025-12355 \u2013 Insecure deserialization in BCD lib (CVSS 9.3)\n23. CVE-2025-12356 \u2013 CSRF in EFG portal (CVSS 7.2)\n24. CVE-2025-12357 \u2013 Memory corruption in HIJ driver (CVSS 8.9)\n25. CVE-2025-12358 \u2013 Improper auth in KLM API (CVSS 9.0)\n\n#HackersFactory", "creation_timestamp": "2025-05-07T15:48:27.000000Z"}, {"uuid": "36d532ea-352a-4b3f-9e47-5e87c3862a9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12355", "type": "seen", "source": "https://t.me/NinjaSec/299", "content": "Code execution, and bypass vulnerabilities \u2014 for educational purposes only:\n\n\n1. CVE-2025-47241 \u2013 Whitelist bypass in Browser Use tool (CVSS 9.3)\n2. CVE-2025-25014 \u2013 Prototype pollution in Kibana (CVSS 9.1)\n3. CVE-2025-29927 \u2013 Next.js middleware authorization bypass (CVSS 9.1)\n4. CVE-2025-24813 \u2013 Apache Tomcat path traversal RCE (Critical)\n5. CVE-2025-2783 \u2013 Chrome Mojo use-after-free (High)\n6. CVE-2025-2636 \u2013 WordPress InstaWP plugin LFI (High)\n7. CVE-2025-2505 \u2013 WordPress Age Gate plugin LFI (High)\n8. CVE-2025-2746 \u2013 Kentico CMS auth bypass (CVSS 9.8)\n9. CVE-2025-2747 \u2013 Kentico CMS staging sync auth bypass (CVSS 9.8)\n10. CVE-2025-3066 \u2013 Chrome Site Isolation use-after-free (High)\n11. CVE-2025-46728 \u2013 cpp-httplib DoS vulnerability\n12. CVE-2025-12345 \u2013 Buffer overflow in XYZ app (CVSS 9.0)\n13. CVE-2025-12346 \u2013 SQL injection in ABC web app (CVSS 8.5)\n14. CVE-2025-12347 \u2013 XSS in DEF platform (CVSS 7.8)\n15. CVE-2025-12348 \u2013 Auth bypass in GHI system (CVSS 9.2)\n16. CVE-2025-12349 \u2013 RCE in JKL service via crafted packets (CVSS 9.5)\n17. CVE-2025-12350 \u2013 Privilege escalation in MNO app (CVSS 8.7)\n18. CVE-2025-12351 \u2013 Info disclosure in PQR system (CVSS 7.5)\n19. CVE-2025-12352 \u2013 DoS in STU server (CVSS 6.8)\n20. CVE-2025-12353 \u2013 Directory traversal in VWX app (CVSS 8.0)\n21. CVE-2025-12354 \u2013 Command injection in YZA tool (CVSS 9.1)\n22. CVE-2025-12355 \u2013 Insecure deserialization in BCD lib (CVSS 9.3)\n23. CVE-2025-12356 \u2013 CSRF in EFG portal (CVSS 7.2)\n24. CVE-2025-12357 \u2013 Memory corruption in HIJ driver (CVSS 8.9)\n25. CVE-2025-12358 \u2013 Improper auth in KLM API (CVSS 9.0)\n\n#HackersFactory", "creation_timestamp": "2025-05-07T15:48:27.000000Z"}, {"uuid": "19c5c139-f783-4bdb-b1e7-b31cb20ae5c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12351", "type": "seen", "source": "https://t.me/NinjaSec/299", "content": "Code execution, and bypass vulnerabilities \u2014 for educational purposes only:\n\n\n1. CVE-2025-47241 \u2013 Whitelist bypass in Browser Use tool (CVSS 9.3)\n2. CVE-2025-25014 \u2013 Prototype pollution in Kibana (CVSS 9.1)\n3. CVE-2025-29927 \u2013 Next.js middleware authorization bypass (CVSS 9.1)\n4. CVE-2025-24813 \u2013 Apache Tomcat path traversal RCE (Critical)\n5. CVE-2025-2783 \u2013 Chrome Mojo use-after-free (High)\n6. CVE-2025-2636 \u2013 WordPress InstaWP plugin LFI (High)\n7. CVE-2025-2505 \u2013 WordPress Age Gate plugin LFI (High)\n8. CVE-2025-2746 \u2013 Kentico CMS auth bypass (CVSS 9.8)\n9. CVE-2025-2747 \u2013 Kentico CMS staging sync auth bypass (CVSS 9.8)\n10. CVE-2025-3066 \u2013 Chrome Site Isolation use-after-free (High)\n11. CVE-2025-46728 \u2013 cpp-httplib DoS vulnerability\n12. CVE-2025-12345 \u2013 Buffer overflow in XYZ app (CVSS 9.0)\n13. CVE-2025-12346 \u2013 SQL injection in ABC web app (CVSS 8.5)\n14. CVE-2025-12347 \u2013 XSS in DEF platform (CVSS 7.8)\n15. CVE-2025-12348 \u2013 Auth bypass in GHI system (CVSS 9.2)\n16. CVE-2025-12349 \u2013 RCE in JKL service via crafted packets (CVSS 9.5)\n17. CVE-2025-12350 \u2013 Privilege escalation in MNO app (CVSS 8.7)\n18. CVE-2025-12351 \u2013 Info disclosure in PQR system (CVSS 7.5)\n19. CVE-2025-12352 \u2013 DoS in STU server (CVSS 6.8)\n20. CVE-2025-12353 \u2013 Directory traversal in VWX app (CVSS 8.0)\n21. CVE-2025-12354 \u2013 Command injection in YZA tool (CVSS 9.1)\n22. CVE-2025-12355 \u2013 Insecure deserialization in BCD lib (CVSS 9.3)\n23. CVE-2025-12356 \u2013 CSRF in EFG portal (CVSS 7.2)\n24. CVE-2025-12357 \u2013 Memory corruption in HIJ driver (CVSS 8.9)\n25. CVE-2025-12358 \u2013 Improper auth in KLM API (CVSS 9.0)\n\n#HackersFactory", "creation_timestamp": "2025-05-07T15:48:27.000000Z"}, {"uuid": "21286572-b230-4bd5-81f8-4c05385677a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12354", "type": "seen", "source": "https://t.me/NinjaSec/299", "content": "Code execution, and bypass vulnerabilities \u2014 for educational purposes only:\n\n\n1. CVE-2025-47241 \u2013 Whitelist bypass in Browser Use tool (CVSS 9.3)\n2. CVE-2025-25014 \u2013 Prototype pollution in Kibana (CVSS 9.1)\n3. CVE-2025-29927 \u2013 Next.js middleware authorization bypass (CVSS 9.1)\n4. CVE-2025-24813 \u2013 Apache Tomcat path traversal RCE (Critical)\n5. CVE-2025-2783 \u2013 Chrome Mojo use-after-free (High)\n6. CVE-2025-2636 \u2013 WordPress InstaWP plugin LFI (High)\n7. CVE-2025-2505 \u2013 WordPress Age Gate plugin LFI (High)\n8. CVE-2025-2746 \u2013 Kentico CMS auth bypass (CVSS 9.8)\n9. CVE-2025-2747 \u2013 Kentico CMS staging sync auth bypass (CVSS 9.8)\n10. CVE-2025-3066 \u2013 Chrome Site Isolation use-after-free (High)\n11. CVE-2025-46728 \u2013 cpp-httplib DoS vulnerability\n12. CVE-2025-12345 \u2013 Buffer overflow in XYZ app (CVSS 9.0)\n13. CVE-2025-12346 \u2013 SQL injection in ABC web app (CVSS 8.5)\n14. CVE-2025-12347 \u2013 XSS in DEF platform (CVSS 7.8)\n15. CVE-2025-12348 \u2013 Auth bypass in GHI system (CVSS 9.2)\n16. CVE-2025-12349 \u2013 RCE in JKL service via crafted packets (CVSS 9.5)\n17. CVE-2025-12350 \u2013 Privilege escalation in MNO app (CVSS 8.7)\n18. CVE-2025-12351 \u2013 Info disclosure in PQR system (CVSS 7.5)\n19. CVE-2025-12352 \u2013 DoS in STU server (CVSS 6.8)\n20. CVE-2025-12353 \u2013 Directory traversal in VWX app (CVSS 8.0)\n21. CVE-2025-12354 \u2013 Command injection in YZA tool (CVSS 9.1)\n22. CVE-2025-12355 \u2013 Insecure deserialization in BCD lib (CVSS 9.3)\n23. CVE-2025-12356 \u2013 CSRF in EFG portal (CVSS 7.2)\n24. CVE-2025-12357 \u2013 Memory corruption in HIJ driver (CVSS 8.9)\n25. CVE-2025-12358 \u2013 Improper auth in KLM API (CVSS 9.0)\n\n#HackersFactory", "creation_timestamp": "2025-05-07T15:48:27.000000Z"}, {"uuid": "c15e9269-0f92-44cf-9af3-185663e3eb3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12358", "type": "seen", "source": "https://t.me/NinjaSec/299", "content": "Code execution, and bypass vulnerabilities \u2014 for educational purposes only:\n\n\n1. CVE-2025-47241 \u2013 Whitelist bypass in Browser Use tool (CVSS 9.3)\n2. CVE-2025-25014 \u2013 Prototype pollution in Kibana (CVSS 9.1)\n3. CVE-2025-29927 \u2013 Next.js middleware authorization bypass (CVSS 9.1)\n4. CVE-2025-24813 \u2013 Apache Tomcat path traversal RCE (Critical)\n5. CVE-2025-2783 \u2013 Chrome Mojo use-after-free (High)\n6. CVE-2025-2636 \u2013 WordPress InstaWP plugin LFI (High)\n7. CVE-2025-2505 \u2013 WordPress Age Gate plugin LFI (High)\n8. CVE-2025-2746 \u2013 Kentico CMS auth bypass (CVSS 9.8)\n9. CVE-2025-2747 \u2013 Kentico CMS staging sync auth bypass (CVSS 9.8)\n10. CVE-2025-3066 \u2013 Chrome Site Isolation use-after-free (High)\n11. CVE-2025-46728 \u2013 cpp-httplib DoS vulnerability\n12. CVE-2025-12345 \u2013 Buffer overflow in XYZ app (CVSS 9.0)\n13. CVE-2025-12346 \u2013 SQL injection in ABC web app (CVSS 8.5)\n14. CVE-2025-12347 \u2013 XSS in DEF platform (CVSS 7.8)\n15. CVE-2025-12348 \u2013 Auth bypass in GHI system (CVSS 9.2)\n16. CVE-2025-12349 \u2013 RCE in JKL service via crafted packets (CVSS 9.5)\n17. CVE-2025-12350 \u2013 Privilege escalation in MNO app (CVSS 8.7)\n18. CVE-2025-12351 \u2013 Info disclosure in PQR system (CVSS 7.5)\n19. CVE-2025-12352 \u2013 DoS in STU server (CVSS 6.8)\n20. CVE-2025-12353 \u2013 Directory traversal in VWX app (CVSS 8.0)\n21. CVE-2025-12354 \u2013 Command injection in YZA tool (CVSS 9.1)\n22. CVE-2025-12355 \u2013 Insecure deserialization in BCD lib (CVSS 9.3)\n23. CVE-2025-12356 \u2013 CSRF in EFG portal (CVSS 7.2)\n24. CVE-2025-12357 \u2013 Memory corruption in HIJ driver (CVSS 8.9)\n25. CVE-2025-12358 \u2013 Improper auth in KLM API (CVSS 9.0)\n\n#HackersFactory", "creation_timestamp": "2025-05-07T15:48:27.000000Z"}, {"uuid": "50e7ee18-6c28-4de2-bb47-272522f46f6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12357", "type": "seen", "source": "https://t.me/NinjaSec/299", "content": "Code execution, and bypass vulnerabilities \u2014 for educational purposes only:\n\n\n1. CVE-2025-47241 \u2013 Whitelist bypass in Browser Use tool (CVSS 9.3)\n2. CVE-2025-25014 \u2013 Prototype pollution in Kibana (CVSS 9.1)\n3. CVE-2025-29927 \u2013 Next.js middleware authorization bypass (CVSS 9.1)\n4. CVE-2025-24813 \u2013 Apache Tomcat path traversal RCE (Critical)\n5. CVE-2025-2783 \u2013 Chrome Mojo use-after-free (High)\n6. CVE-2025-2636 \u2013 WordPress InstaWP plugin LFI (High)\n7. CVE-2025-2505 \u2013 WordPress Age Gate plugin LFI (High)\n8. CVE-2025-2746 \u2013 Kentico CMS auth bypass (CVSS 9.8)\n9. CVE-2025-2747 \u2013 Kentico CMS staging sync auth bypass (CVSS 9.8)\n10. CVE-2025-3066 \u2013 Chrome Site Isolation use-after-free (High)\n11. CVE-2025-46728 \u2013 cpp-httplib DoS vulnerability\n12. CVE-2025-12345 \u2013 Buffer overflow in XYZ app (CVSS 9.0)\n13. CVE-2025-12346 \u2013 SQL injection in ABC web app (CVSS 8.5)\n14. CVE-2025-12347 \u2013 XSS in DEF platform (CVSS 7.8)\n15. CVE-2025-12348 \u2013 Auth bypass in GHI system (CVSS 9.2)\n16. CVE-2025-12349 \u2013 RCE in JKL service via crafted packets (CVSS 9.5)\n17. CVE-2025-12350 \u2013 Privilege escalation in MNO app (CVSS 8.7)\n18. CVE-2025-12351 \u2013 Info disclosure in PQR system (CVSS 7.5)\n19. CVE-2025-12352 \u2013 DoS in STU server (CVSS 6.8)\n20. CVE-2025-12353 \u2013 Directory traversal in VWX app (CVSS 8.0)\n21. CVE-2025-12354 \u2013 Command injection in YZA tool (CVSS 9.1)\n22. CVE-2025-12355 \u2013 Insecure deserialization in BCD lib (CVSS 9.3)\n23. CVE-2025-12356 \u2013 CSRF in EFG portal (CVSS 7.2)\n24. CVE-2025-12357 \u2013 Memory corruption in HIJ driver (CVSS 8.9)\n25. CVE-2025-12358 \u2013 Improper auth in KLM API (CVSS 9.0)\n\n#HackersFactory", "creation_timestamp": "2025-05-07T15:48:27.000000Z"}, {"uuid": "ed971045-53a4-48db-a7d8-4f3d4483de2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12352", "type": "published-proof-of-concept", "source": "https://t.me/cyberedrussia/1799", "content": "\ud83d\udee1 \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 WordPress Gravity Forms: \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f\n\nCVE-2025-12352 (CVSS 9.8) \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 WordPress Gravity Forms (\u0432\u0435\u0440\u0441\u0438\u0438 \u2264 2.9.20) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0447\u0435\u0440\u0435\u0437 \u0444\u0443\u043d\u043a\u0446\u0438\u044e Post Image.\n\n\u27a1\ufe0fGravity Forms \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 copy_post_image() \u2014 \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u043a\u043e\u043f\u0438\u0440\u0443\u0435\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0439 URL \u0432 wp-content/uploads \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0442\u0438\u043f\u0430/\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f. \u0415\u0441\u043b\u0438 \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b post-creation + \u043f\u043e\u043b\u0435 Post Image \u0438 \u0432 PHP \u0432\u043a\u043b\u044e\u0447\u0451\u043d allow_url_fopen, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u043e\u0436\u0438\u0442\u044c \u0432 uploads \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u0444\u0430\u0439\u043b (\u0432\u043a\u043b\u044e\u0447\u0430\u044f .php) \u2014 \u0438 \u043f\u0440\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432 uploads \u044d\u0442\u043e \u0434\u0430\u0451\u0442 \u043f\u0443\u0442\u044c \u043a RCE. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u044b\u0441\u0442\u0440\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 2.9.21, \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u0436\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e.\n\n\u26ab\ufe0f\u041a\u043e\u0433\u043e \u043a\u0430\u0441\u0430\u0435\u0442\u0441\u044f?\n\n\u2022 \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 Gravity Forms \u2264 2.9.20\n\u2022 \u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u0444\u043e\u0440\u043c\u044b \u0441 post-creation \u0438 \u043f\u043e\u043b\u0435\u043c Post Image\n\u2022 allow_url_fopen = On \u0432 PHP\n\u2022 \u0421\u0435\u0440\u0432\u0435\u0440 \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438\u0437 wp-content/uploads\n\u0415\u0441\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0443\u043d\u043a\u0442\u043e\u0432 \u043f\u0440\u043e \u0432\u0430\u0441 \u2014 \u0440\u0438\u0441\u043a\u0438 \u0435\u0441\u0442\u044c.\n\n\ud83d\udc49\u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442?\n\n\u0424\u043e\u0440\u043c\u0430 \u0441 Post Image \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 URL \u2192 copy_post_image() \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u0442 \u0440\u0435\u0441\u0443\u0440\u0441 \u0431\u0435\u0437 \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u2192 \u0444\u0430\u0439\u043b \u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0432 uploads \u2192 \u0435\u0441\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u0442 PHP \u0432 uploads \u2014 \u0444\u0430\u0439\u043b \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c RCE. \u042d\u0442\u043e \u043a\u043b\u0430\u0441\u0441\u0438\u043a\u0430 CWE-434: unrestricted upload of dangerous file type.\n\n\ud83d\udca1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e\n\n\u25aa\ufe0f1. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Gravity Forms \u0434\u043e 2.9.21.\n\u25aa\ufe0f2. \u041f\u043e\u043a\u0430 \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0438 \u2014 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0443\u0434\u0430\u043b\u0438\u0442\u044c/\u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c Post Image \u0438 post-creation \u043d\u0430 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u0444\u043e\u0440\u043c\u0430\u0445.\n\u25aa\ufe0f3. \u0420\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c allow_url_fopen = Off \u0432 php.ini (\u043e\u0446\u0435\u043d\u0438\u0442\u044c \u0432\u043b\u0438\u044f\u043d\u0438\u0435 \u043d\u0430 \u0441\u0430\u0439\u0442).\n\u25aa\ufe0f4. \u0417\u0430\u043f\u0440\u0435\u0442\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 PHP \u0432 wp-content/uploads:\nApache:\n\n  php_admin_flag engine off\n\nNginx:\nlocation ~* /wp-content/uploads/.*\\.php$ {\n  deny all;\n}\n\u25aa\ufe0f5. WAF / \u0444\u0430\u0439\u043b\u043e\u0432\u0430\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430: \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443/\u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438 .php, .phtml \u0438 \u0442.\u043f. \u0432 uploads.\n\u25aa\ufe0f6. \u041f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c uploads \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432:\nfind wp-content/uploads -type f -iname \"*.php*\"\n\u25aa\ufe0f7. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438 \u043b\u043e\u0433\u0438 \u0444\u043e\u0440\u043c \u043d\u0430 \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u0435 POST/GET (\u043f\u043e \u0434\u0430\u0442\u0435 \u0438 IP).\n\u25aa\ufe0f8. \u0414\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0442\u0430\u043a\u0438\u0445 \u0444\u043e\u0440\u043c \u0432 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0439 \u0430\u0443\u0434\u0438\u0442 WordPress \u0438 \u0432 CI/CD (\u0441\u0442\u0430\u0442\u0438\u043a/\u0441\u043a\u0440\u0438\u043f\u0442\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438).\n\n\u26a1\ufe0f\u0411\u044b\u0441\u0442\u0440\u044b\u0439 \u0441\u0430\u043c\u043e\u0442\u0435\u0441\u0442\n\n1. \u0415\u0441\u0442\u044c \u043b\u0438 \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 Gravity Forms \u0441 \u043e\u043f\u0446\u0438\u0435\u0439 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u043f\u043e\u0441\u0442\u043e\u0432 \u0438 \u043f\u043e\u043b\u0435\u043c Post Image?\n2. \u0412\u043a\u043b\u044e\u0447\u0451\u043d \u043b\u0438 allow_url_fopen? (\u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430: php -i | grep allow_url_fopen \u0438\u043b\u0438 phpinfo)\n3. \u0415\u0441\u0442\u044c \u043b\u0438 \u0432 wp-content/uploads \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430?\n\u0415\u0441\u043b\u0438 \u0445\u043e\u0442\u044f \u0431\u044b \u0434\u0432\u0430 \u043e\u0442\u0432\u0435\u0442\u0430 \u2014 \u00ab\u0434\u0430\u00bb \u2014 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0439\u0442\u0435 \u0447\u0435\u043a-\u043b\u0438\u0441\u0442 \u0441\u0432\u0435\u0440\u0445\u0443.", "creation_timestamp": "2026-08-01T17:00:04.189391Z"}, {"uuid": "a957b21a-3c96-4a0d-868c-9739f7dac94a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12352", "type": "published-proof-of-concept", "source": "https://t.me/cyberedrussia/1799", "content": "\ud83d\udee1 \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 WordPress Gravity Forms: \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f\n\nCVE-2025-12352 (CVSS 9.8) \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 WordPress Gravity Forms (\u0432\u0435\u0440\u0441\u0438\u0438 \u2264 2.9.20) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0447\u0435\u0440\u0435\u0437 \u0444\u0443\u043d\u043a\u0446\u0438\u044e Post Image.\n\n\u27a1\ufe0fGravity Forms \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 copy_post_image() \u2014 \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u043a\u043e\u043f\u0438\u0440\u0443\u0435\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0439 URL \u0432 wp-content/uploads \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0442\u0438\u043f\u0430/\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f. \u0415\u0441\u043b\u0438 \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b post-creation + \u043f\u043e\u043b\u0435 Post Image \u0438 \u0432 PHP \u0432\u043a\u043b\u044e\u0447\u0451\u043d allow_url_fopen, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u043e\u0436\u0438\u0442\u044c \u0432 uploads \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u0444\u0430\u0439\u043b (\u0432\u043a\u043b\u044e\u0447\u0430\u044f .php) \u2014 \u0438 \u043f\u0440\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432 uploads \u044d\u0442\u043e \u0434\u0430\u0451\u0442 \u043f\u0443\u0442\u044c \u043a RCE. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u044b\u0441\u0442\u0440\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 2.9.21, \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u0436\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e.\n\n\u26ab\ufe0f\u041a\u043e\u0433\u043e \u043a\u0430\u0441\u0430\u0435\u0442\u0441\u044f?\n\n\u2022 \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 Gravity Forms \u2264 2.9.20\n\u2022 \u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u0444\u043e\u0440\u043c\u044b \u0441 post-creation \u0438 \u043f\u043e\u043b\u0435\u043c Post Image\n\u2022 allow_url_fopen = On \u0432 PHP\n\u2022 \u0421\u0435\u0440\u0432\u0435\u0440 \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438\u0437 wp-content/uploads\n\u0415\u0441\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0443\u043d\u043a\u0442\u043e\u0432 \u043f\u0440\u043e \u0432\u0430\u0441 \u2014 \u0440\u0438\u0441\u043a\u0438 \u0435\u0441\u0442\u044c.\n\n\ud83d\udc49\u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442?\n\n\u0424\u043e\u0440\u043c\u0430 \u0441 Post Image \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 URL \u2192 copy_post_image() \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u0442 \u0440\u0435\u0441\u0443\u0440\u0441 \u0431\u0435\u0437 \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u2192 \u0444\u0430\u0439\u043b \u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0432 uploads \u2192 \u0435\u0441\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u0442 PHP \u0432 uploads \u2014 \u0444\u0430\u0439\u043b \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c RCE. \u042d\u0442\u043e \u043a\u043b\u0430\u0441\u0441\u0438\u043a\u0430 CWE-434: unrestricted upload of dangerous file type.\n\n\ud83d\udca1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e\n\n\u25aa\ufe0f1. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Gravity Forms \u0434\u043e 2.9.21.\n\u25aa\ufe0f2. \u041f\u043e\u043a\u0430 \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0438 \u2014 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0443\u0434\u0430\u043b\u0438\u0442\u044c/\u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c Post Image \u0438 post-creation \u043d\u0430 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u0444\u043e\u0440\u043c\u0430\u0445.\n\u25aa\ufe0f3. \u0420\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c allow_url_fopen = Off \u0432 php.ini (\u043e\u0446\u0435\u043d\u0438\u0442\u044c \u0432\u043b\u0438\u044f\u043d\u0438\u0435 \u043d\u0430 \u0441\u0430\u0439\u0442).\n\u25aa\ufe0f4. \u0417\u0430\u043f\u0440\u0435\u0442\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 PHP \u0432 wp-content/uploads:\nApache:\n\n  php_admin_flag engine off\n\nNginx:\nlocation ~* /wp-content/uploads/.*\\.php$ {\n  deny all;\n}\n\u25aa\ufe0f5. WAF / \u0444\u0430\u0439\u043b\u043e\u0432\u0430\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430: \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443/\u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438 .php, .phtml \u0438 \u0442.\u043f. \u0432 uploads.\n\u25aa\ufe0f6. \u041f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c uploads \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432:\nfind wp-content/uploads -type f -iname \"*.php*\"\n\u25aa\ufe0f7. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438 \u043b\u043e\u0433\u0438 \u0444\u043e\u0440\u043c \u043d\u0430 \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u0435 POST/GET (\u043f\u043e \u0434\u0430\u0442\u0435 \u0438 IP).\n\u25aa\ufe0f8. \u0414\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0442\u0430\u043a\u0438\u0445 \u0444\u043e\u0440\u043c \u0432 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0439 \u0430\u0443\u0434\u0438\u0442 WordPress \u0438 \u0432 CI/CD (\u0441\u0442\u0430\u0442\u0438\u043a/\u0441\u043a\u0440\u0438\u043f\u0442\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438).\n\n\u26a1\ufe0f\u0411\u044b\u0441\u0442\u0440\u044b\u0439 \u0441\u0430\u043c\u043e\u0442\u0435\u0441\u0442\n\n1. \u0415\u0441\u0442\u044c \u043b\u0438 \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 Gravity Forms \u0441 \u043e\u043f\u0446\u0438\u0435\u0439 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u043f\u043e\u0441\u0442\u043e\u0432 \u0438 \u043f\u043e\u043b\u0435\u043c Post Image?\n2. \u0412\u043a\u043b\u044e\u0447\u0451\u043d \u043b\u0438 allow_url_fopen? (\u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430: php -i | grep allow_url_fopen \u0438\u043b\u0438 phpinfo)\n3. \u0415\u0441\u0442\u044c \u043b\u0438 \u0432 wp-content/uploads \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430?\n\u0415\u0441\u043b\u0438 \u0445\u043e\u0442\u044f \u0431\u044b \u0434\u0432\u0430 \u043e\u0442\u0432\u0435\u0442\u0430 \u2014 \u00ab\u0434\u0430\u00bb \u2014 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0439\u0442\u0435 \u0447\u0435\u043a-\u043b\u0438\u0441\u0442 \u0441\u0432\u0435\u0440\u0445\u0443.", "creation_timestamp": "2026-08-02T00:00:41.047271Z"}, {"uuid": "b7d2d0d0-9442-4c71-bb3b-faf697fc684c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12352", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3moskqdb4sb2d", "content": "CVE-2025-12352 gravityforms (CVSS Score 9.8) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept", "creation_timestamp": "2026-06-21T14:16:39.153502Z"}, {"uuid": "b073c531-15a2-4034-ad03-a55f15acb116", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12352", "type": "seen", "source": "https://t.me/cyberedrussia/1799", "content": "\ud83d\udee1 \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 WordPress Gravity Forms: \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f\n\nCVE-2025-12352 (CVSS 9.8) \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 WordPress Gravity Forms (\u0432\u0435\u0440\u0441\u0438\u0438 \u2264 2.9.20) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0447\u0435\u0440\u0435\u0437 \u0444\u0443\u043d\u043a\u0446\u0438\u044e Post Image.\n\n\u27a1\ufe0fGravity Forms \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 copy_post_image() \u2014 \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u043a\u043e\u043f\u0438\u0440\u0443\u0435\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0439 URL \u0432 wp-content/uploads \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0442\u0438\u043f\u0430/\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f. \u0415\u0441\u043b\u0438 \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b post-creation + \u043f\u043e\u043b\u0435 Post Image \u0438 \u0432 PHP \u0432\u043a\u043b\u044e\u0447\u0451\u043d allow_url_fopen, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u043e\u0436\u0438\u0442\u044c \u0432 uploads \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u0444\u0430\u0439\u043b (\u0432\u043a\u043b\u044e\u0447\u0430\u044f .php) \u2014 \u0438 \u043f\u0440\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432 uploads \u044d\u0442\u043e \u0434\u0430\u0451\u0442 \u043f\u0443\u0442\u044c \u043a RCE. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u044b\u0441\u0442\u0440\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 2.9.21, \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u0436\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e.\n\n\u26ab\ufe0f\u041a\u043e\u0433\u043e \u043a\u0430\u0441\u0430\u0435\u0442\u0441\u044f?\n\n\u2022 \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 Gravity Forms \u2264 2.9.20\n\u2022 \u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u0444\u043e\u0440\u043c\u044b \u0441 post-creation \u0438 \u043f\u043e\u043b\u0435\u043c Post Image\n\u2022 allow_url_fopen = On \u0432 PHP\n\u2022 \u0421\u0435\u0440\u0432\u0435\u0440 \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438\u0437 wp-content/uploads\n\u0415\u0441\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0443\u043d\u043a\u0442\u043e\u0432 \u043f\u0440\u043e \u0432\u0430\u0441 \u2014 \u0440\u0438\u0441\u043a\u0438 \u0435\u0441\u0442\u044c.\n\n\ud83d\udc49\u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442?\n\n\u0424\u043e\u0440\u043c\u0430 \u0441 Post Image \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 URL \u2192 copy_post_image() \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u0442 \u0440\u0435\u0441\u0443\u0440\u0441 \u0431\u0435\u0437 \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u2192 \u0444\u0430\u0439\u043b \u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0432 uploads \u2192 \u0435\u0441\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u0442 PHP \u0432 uploads \u2014 \u0444\u0430\u0439\u043b \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c RCE. \u042d\u0442\u043e \u043a\u043b\u0430\u0441\u0441\u0438\u043a\u0430 CWE-434: unrestricted upload of dangerous file type.\n\n\ud83d\udca1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e\n\n\u25aa\ufe0f1. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Gravity Forms \u0434\u043e 2.9.21.\n\u25aa\ufe0f2. \u041f\u043e\u043a\u0430 \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0438 \u2014 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0443\u0434\u0430\u043b\u0438\u0442\u044c/\u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c Post Image \u0438 post-creation \u043d\u0430 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u0444\u043e\u0440\u043c\u0430\u0445.\n\u25aa\ufe0f3. \u0420\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c allow_url_fopen = Off \u0432 php.ini (\u043e\u0446\u0435\u043d\u0438\u0442\u044c \u0432\u043b\u0438\u044f\u043d\u0438\u0435 \u043d\u0430 \u0441\u0430\u0439\u0442).\n\u25aa\ufe0f4. \u0417\u0430\u043f\u0440\u0435\u0442\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 PHP \u0432 wp-content/uploads:\nApache:\n\n  php_admin_flag engine off\n\nNginx:\nlocation ~* /wp-content/uploads/.*\\.php$ {\n  deny all;\n}\n\u25aa\ufe0f5. WAF / \u0444\u0430\u0439\u043b\u043e\u0432\u0430\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430: \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443/\u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438 .php, .phtml \u0438 \u0442.\u043f. \u0432 uploads.\n\u25aa\ufe0f6. \u041f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c uploads \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432:\nfind wp-content/uploads -type f -iname \"*.php*\"\n\u25aa\ufe0f7. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438 \u043b\u043e\u0433\u0438 \u0444\u043e\u0440\u043c \u043d\u0430 \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u0435 POST/GET (\u043f\u043e \u0434\u0430\u0442\u0435 \u0438 IP).\n\u25aa\ufe0f8. \u0414\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0442\u0430\u043a\u0438\u0445 \u0444\u043e\u0440\u043c \u0432 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0439 \u0430\u0443\u0434\u0438\u0442 WordPress \u0438 \u0432 CI/CD (\u0441\u0442\u0430\u0442\u0438\u043a/\u0441\u043a\u0440\u0438\u043f\u0442\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438).\n\n\u26a1\ufe0f\u0411\u044b\u0441\u0442\u0440\u044b\u0439 \u0441\u0430\u043c\u043e\u0442\u0435\u0441\u0442\n\n1. \u0415\u0441\u0442\u044c \u043b\u0438 \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 Gravity Forms \u0441 \u043e\u043f\u0446\u0438\u0435\u0439 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u043f\u043e\u0441\u0442\u043e\u0432 \u0438 \u043f\u043e\u043b\u0435\u043c Post Image?\n2. \u0412\u043a\u043b\u044e\u0447\u0451\u043d \u043b\u0438 allow_url_fopen? (\u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430: php -i | grep allow_url_fopen \u0438\u043b\u0438 phpinfo)\n3. \u0415\u0441\u0442\u044c \u043b\u0438 \u0432 wp-content/uploads \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430?\n\u0415\u0441\u043b\u0438 \u0445\u043e\u0442\u044f \u0431\u044b \u0434\u0432\u0430 \u043e\u0442\u0432\u0435\u0442\u0430 \u2014 \u00ab\u0434\u0430\u00bb \u2014 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0439\u0442\u0435 \u0447\u0435\u043a-\u043b\u0438\u0441\u0442 \u0441\u0432\u0435\u0440\u0445\u0443.", "creation_timestamp": "2026-07-29T12:01:52.451745Z"}, {"uuid": "0ffc2bf8-d345-47b2-a098-838d16f0435e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12352", "type": "seen", "source": "https://t.me/cyberedrussia/1799", "content": "\ud83d\udee1 \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 WordPress Gravity Forms: \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f\n\nCVE-2025-12352 (CVSS 9.8) \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 WordPress Gravity Forms (\u0432\u0435\u0440\u0441\u0438\u0438 \u2264 2.9.20) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0447\u0435\u0440\u0435\u0437 \u0444\u0443\u043d\u043a\u0446\u0438\u044e Post Image.\n\n\u27a1\ufe0fGravity Forms \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 copy_post_image() \u2014 \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u043a\u043e\u043f\u0438\u0440\u0443\u0435\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0439 URL \u0432 wp-content/uploads \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0442\u0438\u043f\u0430/\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f. \u0415\u0441\u043b\u0438 \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b post-creation + \u043f\u043e\u043b\u0435 Post Image \u0438 \u0432 PHP \u0432\u043a\u043b\u044e\u0447\u0451\u043d allow_url_fopen, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u043e\u0436\u0438\u0442\u044c \u0432 uploads \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u0444\u0430\u0439\u043b (\u0432\u043a\u043b\u044e\u0447\u0430\u044f .php) \u2014 \u0438 \u043f\u0440\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432 uploads \u044d\u0442\u043e \u0434\u0430\u0451\u0442 \u043f\u0443\u0442\u044c \u043a RCE. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u044b\u0441\u0442\u0440\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 2.9.21, \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u0436\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e.\n\n\u26ab\ufe0f\u041a\u043e\u0433\u043e \u043a\u0430\u0441\u0430\u0435\u0442\u0441\u044f?\n\n\u2022 \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 Gravity Forms \u2264 2.9.20\n\u2022 \u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u0444\u043e\u0440\u043c\u044b \u0441 post-creation \u0438 \u043f\u043e\u043b\u0435\u043c Post Image\n\u2022 allow_url_fopen = On \u0432 PHP\n\u2022 \u0421\u0435\u0440\u0432\u0435\u0440 \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438\u0437 wp-content/uploads\n\u0415\u0441\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0443\u043d\u043a\u0442\u043e\u0432 \u043f\u0440\u043e \u0432\u0430\u0441 \u2014 \u0440\u0438\u0441\u043a\u0438 \u0435\u0441\u0442\u044c.\n\n\ud83d\udc49\u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442?\n\n\u0424\u043e\u0440\u043c\u0430 \u0441 Post Image \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 URL \u2192 copy_post_image() \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u0442 \u0440\u0435\u0441\u0443\u0440\u0441 \u0431\u0435\u0437 \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u2192 \u0444\u0430\u0439\u043b \u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0432 uploads \u2192 \u0435\u0441\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u0442 PHP \u0432 uploads \u2014 \u0444\u0430\u0439\u043b \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c RCE. \u042d\u0442\u043e \u043a\u043b\u0430\u0441\u0441\u0438\u043a\u0430 CWE-434: unrestricted upload of dangerous file type.\n\n\ud83d\udca1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e\n\n\u25aa\ufe0f1. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Gravity Forms \u0434\u043e 2.9.21.\n\u25aa\ufe0f2. \u041f\u043e\u043a\u0430 \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0438 \u2014 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0443\u0434\u0430\u043b\u0438\u0442\u044c/\u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c Post Image \u0438 post-creation \u043d\u0430 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u0444\u043e\u0440\u043c\u0430\u0445.\n\u25aa\ufe0f3. \u0420\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c allow_url_fopen = Off \u0432 php.ini (\u043e\u0446\u0435\u043d\u0438\u0442\u044c \u0432\u043b\u0438\u044f\u043d\u0438\u0435 \u043d\u0430 \u0441\u0430\u0439\u0442).\n\u25aa\ufe0f4. \u0417\u0430\u043f\u0440\u0435\u0442\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 PHP \u0432 wp-content/uploads:\nApache:\n\n  php_admin_flag engine off\n\nNginx:\nlocation ~* /wp-content/uploads/.*\\.php$ {\n  deny all;\n}\n\u25aa\ufe0f5. WAF / \u0444\u0430\u0439\u043b\u043e\u0432\u0430\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430: \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443/\u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438 .php, .phtml \u0438 \u0442.\u043f. \u0432 uploads.\n\u25aa\ufe0f6. \u041f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c uploads \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432:\nfind wp-content/uploads -type f -iname \"*.php*\"\n\u25aa\ufe0f7. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438 \u043b\u043e\u0433\u0438 \u0444\u043e\u0440\u043c \u043d\u0430 \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u0435 POST/GET (\u043f\u043e \u0434\u0430\u0442\u0435 \u0438 IP).\n\u25aa\ufe0f8. \u0414\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0442\u0430\u043a\u0438\u0445 \u0444\u043e\u0440\u043c \u0432 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0439 \u0430\u0443\u0434\u0438\u0442 WordPress \u0438 \u0432 CI/CD (\u0441\u0442\u0430\u0442\u0438\u043a/\u0441\u043a\u0440\u0438\u043f\u0442\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438).\n\n\u26a1\ufe0f\u0411\u044b\u0441\u0442\u0440\u044b\u0439 \u0441\u0430\u043c\u043e\u0442\u0435\u0441\u0442\n\n1. \u0415\u0441\u0442\u044c \u043b\u0438 \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 Gravity Forms \u0441 \u043e\u043f\u0446\u0438\u0435\u0439 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u043f\u043e\u0441\u0442\u043e\u0432 \u0438 \u043f\u043e\u043b\u0435\u043c Post Image?\n2. \u0412\u043a\u043b\u044e\u0447\u0451\u043d \u043b\u0438 allow_url_fopen? (\u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430: php -i | grep allow_url_fopen \u0438\u043b\u0438 phpinfo)\n3. \u0415\u0441\u0442\u044c \u043b\u0438 \u0432 wp-content/uploads \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430?\n\u0415\u0441\u043b\u0438 \u0445\u043e\u0442\u044f \u0431\u044b \u0434\u0432\u0430 \u043e\u0442\u0432\u0435\u0442\u0430 \u2014 \u00ab\u0434\u0430\u00bb \u2014 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0439\u0442\u0435 \u0447\u0435\u043a-\u043b\u0438\u0441\u0442 \u0441\u0432\u0435\u0440\u0445\u0443.", "creation_timestamp": "2026-07-30T00:02:04.522996Z"}]}