{"vulnerability": "cve-2025-7084", "sightings": [{"uuid": "0a07a82c-dbfa-4d11-92e0-9f2b6a0e1cb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-7084", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ltcrzc25pf2a", "content": "", "creation_timestamp": "2025-07-06T17:24:06.912261Z"}, {"uuid": "fac64a53-ab37-4b3e-bbf0-d0a49e5ce43b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-70841", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mdxyafvo3o25", "content": "", "creation_timestamp": "2026-02-03T18:24:28.782025Z"}, {"uuid": "3457227c-2b0e-42d6-90d3-f2b0233c13fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-70849", "type": "published-proof-of-concept", "source": "https://t.me/realcodeb0ss/325", "content": "https://nvd.nist.gov/vuln/detail/CVE-2025-70849\n\n\nFofa : \"Podinfo\" or title=\"Podinfo\"\n\nEnjoy;", "creation_timestamp": "2026-02-15T20:28:15.000000Z"}, {"uuid": "4ace5c3e-424e-4089-99ab-603078875c30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-70841", "type": "seen", "source": "https://t.me/CyberDispatch/657", "content": "CVE-2025-70841 \n\nDokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configuration data via direct request to /script/.env file.", "creation_timestamp": "2026-08-30T00:00:48.209735Z"}, {"uuid": "51eb7d3b-bfd9-48ec-bdab-e5988fd6c149", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-70849", "type": "published-proof-of-concept", "source": "Telegram/qFnncewX_FdOxDivGoEqJX19AvA6N2dSwzORt9UZIQWFUQU", "content": "", "creation_timestamp": "2026-05-17T02:07:47.000000Z"}, {"uuid": "4a425fa1-342d-41a6-a87c-674bdb173284", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-70841", "type": "seen", "source": "https://t.me/CyberDispatch/657", "content": "CVE-2025-70841 \n\nDokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configuration data via direct request to /script/.env file.", "creation_timestamp": "2026-08-29T20:00:22.407781Z"}, {"uuid": "a332ee43-4922-430c-b106-fe88f7d32e37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-70849", "type": "seen", "source": "Telegram/ewCNvksQ23LcKFOZP4S7JiAV_BKfvwBJJ-Max0Hr7r6pTH0", "content": "", "creation_timestamp": "2026-06-02T09:00:04.000000Z"}, {"uuid": "4de91db2-a02a-4666-8ecb-4d406c8a336e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-70849", "type": "published-proof-of-concept", "source": "https://t.me/cve0day/400", "content": "CVE-2025-70849\n\nArbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy (CSP) or adequate Content-Type validation, leading to Stored Cross-Site Scripting (XSS).", "creation_timestamp": "2026-08-28T00:00:32.159623Z"}, {"uuid": "6ec980c8-9d98-4587-9eca-e479058117ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-70849", "type": "seen", "source": "https://t.me/cve0day/400", "content": "CVE-2025-70849\n\nArbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy (CSP) or adequate Content-Type validation, leading to Stored Cross-Site Scripting (XSS).", "creation_timestamp": "2026-08-27T15:00:07.935931Z"}, {"uuid": "3857d0c2-e38c-4ed7-bd34-20b7db728e79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-70841", "type": "seen", "source": "https://t.me/CyberDispatch/657", "content": "CVE-2025-70841 \n\nDokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configuration data via direct request to /script/.env file.", "creation_timestamp": "2026-08-31T00:00:12.162047Z"}]}