{"metadata": {"vulnerability": "CVE-2025-6389", "count": 40, "kinds": {"milestone": 4, "sighting": 27, "kev": 0, "other": 9}}, "data": [{"timestamp": "2025-06-20T02:01:57.382Z", "date_only": false, "value": "2025-06-20T02:01:57.382Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-6389", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-11-24T14:03:11Z", "date_only": false, "value": "2025-11-24T14:03:11.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2025-6389", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2025-11-25T02:26:49.836Z", "date_only": false, "value": "2025-11-25T02:26:49.836Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-6389", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-11-25T02:38:45.293Z", "date_only": false, "value": "2025-11-25T02:38:45.293427Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crowdcyber.bsky.social/post/3m6gcqv3lnn2o", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "7204544b-1edd-495b-8bb4-50b69cd63385", "url": "https://bsky.app/profile/crowdcyber.bsky.social/post/3m6gcqv3lnn2o"}, {"timestamp": "2025-11-25T03:03:15.575Z", "date_only": false, "value": "2025-11-25T03:03:15.575408Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/115608111943275596", "record": "cve-2025-6389", "field": "creation_timestamp", "uuid": "9fff116c-17a3-4288-a1a7-c6eb61c2db54", "url": "https://infosec.exchange/users/offseq/statuses/115608111943275596"}, {"timestamp": "2025-11-25T03:03:16.918Z", "date_only": false, "value": "2025-11-25T03:03:16.918983Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3m6ge4q2quw27", "record": "cve-2025-6389", "field": "creation_timestamp", "uuid": "d670659c-669f-4935-9759-66b2fe3cd768", "url": "https://bsky.app/profile/offseq.bsky.social/post/3m6ge4q2quw27"}, {"timestamp": "2025-11-25T03:15:44Z", "date_only": false, "value": "2025-11-25T03:15:44Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-CPM8-V4GW-HGVH", "record": "GHSA-CPM8-V4GW-HGVH", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-11-25T03:15:44.990Z", "date_only": false, "value": "2025-11-25T03:15:44.990", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-6389", "record": "FKIE_CVE-2025-6389", "field": "published"}, {"timestamp": "2025-11-25T03:30:20Z", "date_only": false, "value": "2025-11-25T03:30:20Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-CPM8-V4GW-HGVH", "record": "GHSA-CPM8-V4GW-HGVH", "field": "published"}, {"timestamp": "2025-11-25T03:30:20Z", "date_only": false, "value": "2025-11-25T03:30:20Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-CPM8-V4GW-HGVH", "record": "GHSA-CPM8-V4GW-HGVH", "field": "modified"}, {"timestamp": "2025-11-25T03:31:23.454Z", "date_only": false, "value": "2025-11-25T03:31:23.454516Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3m6gfoz44zx2q", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "7f07e3d7-de76-404b-b61e-b298cc2f3a1f", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3m6gfoz44zx2q"}, {"timestamp": "2025-11-25T08:18:35Z", "date_only": false, "value": "2025-11-25T08:18:35.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/60728", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "a49265bb-e964-4d37-b16c-0c21d77cc466", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aCVE-2025-6389\nURL\uff1ahttps://github.com/B1ack4sh/Blackash-CVE-2025-6389\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/60728"}, {"timestamp": "2025-11-25T11:18:39.974Z", "date_only": false, "value": "2025-11-25T11:18:39.974187Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3m6h7skr2wq2v", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "b292f91e-6ff8-4add-b370-2f5f5a0e19f3", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3m6h7skr2wq2v"}, {"timestamp": "2025-11-25T14:38:26.219Z", "date_only": false, "value": "2025-11-25T14:38:26.219240Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-6389", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-11-25T14:38:26.219Z", "date_only": false, "value": "2025-11-25T14:38:26.219240Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-6389", "record": "FKIE_CVE-2025-6389", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-11-25T14:39:24.911Z", "date_only": false, "value": "2025-11-25T14:39:24.911Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-6389", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-11-25T15:00:07Z", "date_only": false, "value": "2025-11-25T15:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/PnvX_MFpghLdid04MRKcqtLj_a1c3IhBEpnAhBD6iOR-ULc", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "3b533c95-1dc7-49a7-a1bf-3a07dad0b0e6"}, {"timestamp": "2025-11-26T14:11:36Z", "date_only": false, "value": "2025-11-26T14:11:36.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/1h0cC9JPsgPxITKzbA2fcC4iLuBPdkdhH7xs0c3ijg6Lyg", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "1aa8a102-3056-4535-956b-7023601af452"}, {"timestamp": "2025-11-26T21:02:28.363Z", "date_only": false, "value": "2025-11-26T21:02:28.363325Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m6kqvelp2m2b", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "17ee485d-63a3-441d-9fda-6ba591073fd7", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m6kqvelp2m2b"}, {"timestamp": "2025-12-04T06:35:41.924Z", "date_only": false, "value": "2025-12-04T06:35:41.924922Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3m75e6uedrt27", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "3cdefe21-e027-46df-85f2-f7cf8fb25b71", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3m75e6uedrt27"}, {"timestamp": "2025-12-08T08:15:00Z", "date_only": false, "value": "2025-12-08T08:15:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2025/12/sneeit-wordpress-rce-exploited-in-wild.html", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "42cb4fcc-34b5-4fe5-af9c-31fe7af0aaba", "url": "https://thehackernews.com/2025/12/sneeit-wordpress-rce-exploited-in-wild.html"}, {"timestamp": "2025-12-08T10:38:47.958Z", "date_only": false, "value": "2025-12-08T10:38:47.958536Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3m7htnacfgl2v", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "f6295f1e-3250-4dc4-9e3a-9b0e283ed493", "url": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3m7htnacfgl2v"}, {"timestamp": "2025-12-08T11:01:08.385Z", "date_only": false, "value": "2025-12-08T11:01:08.385232Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/calimegai.bsky.social/post/3m7huv5i2zg24", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "8f85bd43-3202-46c9-b2aa-9e178dd32c1a", "url": "https://bsky.app/profile/calimegai.bsky.social/post/3m7huv5i2zg24"}, {"timestamp": "2025-12-08T12:34:51Z", "date_only": false, "value": "2025-12-08T12:34:51.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/UQzaGXLcI2ob2rvTczgW4ngJ7r-iPVwZiBYBDYSBh_w8FA", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "85288337-e90d-40f7-996e-76085e1d2c9a"}, {"timestamp": "2025-12-08T17:48:59.217Z", "date_only": false, "value": "2025-12-08T17:48:59.217143Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3m7ilohnfu22y", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "44917237-c846-47b3-9a69-1849560f28ef", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3m7ilohnfu22y"}, {"timestamp": "2025-12-08T18:30:23.949Z", "date_only": false, "value": "2025-12-08T18:30:23.949590Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/guardian360.bsky.social/post/3m7inyjednj2r", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "13cc81f0-4f85-4134-bed0-2bc1b9b2f40d", "url": "https://bsky.app/profile/guardian360.bsky.social/post/3m7inyjednj2r"}, {"timestamp": "2025-12-10T21:00:05Z", "date_only": false, "value": "2025-12-10T21:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/HZ3ZJRsPXN2xbtsA1DCWruuU-3EwXxx0KgUeziJX8Cuevwg", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "269069ef-4c2a-4344-98e5-6729aee18299"}, {"timestamp": "2026-01-06T19:51:13.825Z", "date_only": false, "value": "2026-01-06T19:51:13.825275Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/115849892455619756", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "0eae21d3-4654-45ad-9a9a-028369c26f05", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/115849892455619756"}, {"timestamp": "2026-01-06T20:08:34Z", "date_only": false, "value": "2026-01-06T20:08:34.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/DarkWebInformer_News/12101", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "0c72a9e7-44d0-439e-b957-4ddc83bde3ea", "content": "\ud83d\udea8 News Alert!\n\nSource: Dark Web Informer\nTitle: [Video] CVE-2025-6389: WordPress Sneeit Framework plugin vulnerability currently under active exploitation\nLink: https://darkwebinformer.com/video-cve-2025-6389-wordpress-sneeit-framework-plugin-vulnerability-currently-under-active-exploitation/", "url": "https://t.me/DarkWebInformer_News/12101"}, {"timestamp": "2026-01-24T23:04:24Z", "date_only": false, "value": "2026-01-24T23:04:24.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/Ayoub-The-Founder/4421879dd47103e04ead8dfc666cba85", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "938e31ee-7331-4423-af8a-16d3ed8d8420", "url": "https://gist.github.com/Ayoub-The-Founder/4421879dd47103e04ead8dfc666cba85"}, {"timestamp": "2026-02-17T15:25:49Z", "date_only": false, "value": "2026-02-17T15:25:49.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cmsbotinfo/58", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "638a032c-6604-4a9e-8767-a3f595fac4a6", "content": "Update Modules:\nBOT & WEB\n\nmodules /cve:\n\nCVE-2026-24061\nCVE-2021-26084\nCVE-2024-36401\nCVE-2014-6271\n\nmodules /wp:\n\nCVE-2026-0920\nCVE-2025-6934\nCVE-2025-29009\nCVE-2025-6389\nCVE-2025-14998\nCVE-2024-56043\n\nI know there are the old CVE, but trust me, it's still working in the real target..\ne.g: CVE-2014-6271\n\nif you have the request CVE to added to bot , just chat @CMSAssistant_bot\nit's support for any language espesially english.\n\nI will update the more CVE ( at the moment i will add more modules for wordpress and other general CVE) \ud83d\ude01", "url": "https://t.me/cmsbotinfo/58"}, {"timestamp": "2026-04-08T17:17:17.744Z", "date_only": false, "value": "2026-04-08T17:17:17.744Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-6389", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-04-08T17:17:17.744Z", "date_only": false, "value": "2026-04-08T17:17:17.744Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2025-6389", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-18T23:00:13Z", "date_only": false, "value": "2026-04-18T23:00:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/J1TSaArQ0ScFY239N-pEajUhnEKmxSQcewj6uEimw6KDWT0", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "1cd12890-1e18-4717-90f1-fac6eae74cf4"}, {"timestamp": "2026-04-19T03:00:05Z", "date_only": false, "value": "2026-04-19T03:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/fUN7x3zhWJI41Y9qvAix9-DSu_CPZFxW-u6Jn34L6Wbqg7U", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "e65db29e-d3a5-41f4-b231-c97f686a9d75"}, {"timestamp": "2026-06-17T10:01:47.043Z", "date_only": false, "value": "2026-06-17T10:01:47.043", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-6389", "record": "FKIE_CVE-2025-6389", "field": "lastModified"}, {"timestamp": "2026-06-19T12:45:44.851Z", "date_only": false, "value": "2026-06-19T12:45:44.851845Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/fe1456bf-b365-433a-85d5-95397c3e2d45", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "f46e72c7-b5ec-476b-9078-3147fdc13b82", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/fe1456bf-b365-433a-85d5-95397c3e2d45"}, {"timestamp": "2026-07-20T19:00:09.128Z", "date_only": false, "value": "2026-07-20T19:00:09.128848Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/proxy_bar/2888", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "92d3ab51-62e4-4491-bb6f-c2ce25c11f18", "content": "CVE-2025-6389 \nis a Critical (CVSS 9.8) vulnerability \nin the Sneeit Framework WordPress plugin (\u2264 8.3)\nexploit\n\n#wordpress", "url": "https://t.me/proxy_bar/2888"}, {"timestamp": "2026-08-03T06:00:05.001Z", "date_only": false, "value": "2026-08-03T06:00:05.001688Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-6389.yaml", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "0e7f20dd-09ba-48bc-b91b-399f98a77d5c", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-6389.yaml"}, {"timestamp": "2026-08-19T21:00:05.501Z", "date_only": false, "value": "2026-08-19T21:00:05.501875Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/CyberDispatch/194", "record": "CVE-2025-6389", "field": "creation_timestamp", "uuid": "7a29ae38-a84f-43b0-8356-204741b8d07d", "content": "Hackers are exploiting a bug in the Sneeit Framework plugin (CVE-2025-6389) to run code on servers and create admin accounts on WordPress sites.\n\nSeparately, a flaw in ICTBroadcast (CVE-2025-2611) lets attackers use the BROADCAST cookie for unauthenticated remote shell access on exposed hosts.", "url": "https://t.me/CyberDispatch/194"}]}