https://vulnerability.circl.lu/sightings/feed 2026-09-17T10:59:14.641872+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/02bb60c9-0853-4c20-92b6-f7d95633420a/export 2026-09-17T10:59:14.659057+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "02bb60c9-0853-4c20-92b6-f7d95633420a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-47812", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/ftp/wing_ftp_admin_exec.rb", "content": "{\"aliases\": [], \"arch\": \"x86\", \"author\": [\"Nicholas Nam \", \"Imran E. Dawoodjee \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits the embedded Lua interpreter in the admin web interface for\\n versions 3.0.0 and above. When supplying a specially crafted HTTP POST request\\n an attacker can use os.execute() to execute arbitrary system commands on\\n the target with SYSTEM privileges.\", \"disclosure_date\": \"2014-06-19\", \"fullname\": \"exploit/windows/ftp/wing_ftp_admin_exec\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"Wing FTP Server Authenticated Command Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/ftp/wing_ftp_admin_exec.rb\", \"platform\": \"Windows\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"windows/ftp/wing_ftp_admin_exec\", \"references\": [\"CVE-2025-47812\", \"EDB-52347\", \"URL-http://www.wftpserver.com\", \"URL-https://www.wftpserver.com/help/ftpserver/index.html?administrator_console.htm\"], \"rport\": 5466, \"session_types\": false, \"targets\": [\"Wing FTP Server >= 3.0.0\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:40.679407Z"} 2026-09-08T06:51:40.679407+00:00 https://vulnerability.circl.lu/sighting/5b4f8fe0-4feb-42a1-b348-2966591c4896/export 2026-09-17T10:59:14.661314+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "5b4f8fe0-4feb-42a1-b348-2966591c4896", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-47812", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wingftp_null_byte_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Valentin Lobstein\", \"Julien Ahrens\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Wing FTP Server allows arbitrary Lua code injection via a NULL-byte (%00) truncation bug (CVE-2025-47812).\\n Supplying %00 as the username makes the C++ authentication routine validate only the prefix,\\n while the full string is written unfiltered into the session file and later executed with root/SYSTEM privileges,\\n leading to Remote Code Execution.\", \"disclosure_date\": \"2025-06-30\", \"fullname\": \"exploit/multi/http/wingftp_null_byte_rce\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"Wing FTP Server NULL-byte Authentication Bypass (CVE-2025-47812)\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/wingftp_null_byte_rce.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/wingftp_null_byte_rce\", \"references\": [\"CVE-2025-47812\", \"EDB-52347\", \"URL-https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Unix/Linux Command Shell\", \"Windows Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:20.233597Z"} 2026-09-08T06:50:20.233597+00:00 https://vulnerability.circl.lu/sighting/65722a4c-9d8d-4d09-8c1e-116c657cdec4/export 2026-09-17T10:59:14.661464+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "65722a4c-9d8d-4d09-8c1e-116c657cdec4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-47916", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/invision_customcss_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd\", \"author\": [\"Egidio Romano (EgiX)\", \"Valentin Lobstein\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Invision Community up to and including version 5.0.6 contains a remote code\\n execution vulnerability in the theme editor's customCss endpoint. By crafting\\n a specially formatted `content` parameter with a `{expression=\\\"...\\\"}`\\n construct, arbitrary PHP can be evaluated. This module leverages that flaw\\n to execute payloads or system commands as the webserver user.\", \"disclosure_date\": \"2025-05-16\", \"fullname\": \"exploit/multi/http/invision_customcss_rce\", \"is_install_path\": true, \"mod_time\": \"2026-06-05 12:12:10 +0000\", \"name\": \"Invision Community 5.0.6 customCss RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/invision_customcss_rce.rb\", \"platform\": \"Linux,PHP,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/invision_customcss_rce\", \"references\": [\"CVE-2025-47916\", \"EDB-52294\", \"URL-https://karmainsecurity.com/KIS-2025-02\", \"URL-https://invisioncommunity.com\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHP In-Memory\", \"Unix/Linux Command Shell\", \"Windows Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:50.527526Z"} 2026-09-08T06:49:50.527526+00:00 https://vulnerability.circl.lu/sighting/d67beee9-fe3a-49d9-95de-563abdbe8fe6/export 2026-09-17T10:59:14.661589+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "d67beee9-fe3a-49d9-95de-563abdbe8fe6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-47608", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wp_abandoned_cart_sqli.rb", "content": "{\"actions\": [{\"description\": \"Queries username, password hash for COUNT users\", \"name\": \"List Users\"}], \"aliases\": [], \"arch\": \"\", \"author\": [\"h00die\", \"WPDeeply\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"Abandoned Cart, a plugin for WordPress which extends the WooCommerce plugin,\\n prior to 5.8.2 is affected by an unauthenticated SQL injection via the\\n billing_first_name parameter of the save_data AJAX call. A valid\\n wp_woocommerce_session cookie is required, which has at least one item in the\\n cart.\", \"disclosure_date\": \"2020-11-05\", \"fullname\": \"auxiliary/scanner/http/wp_abandoned_cart_sqli\", \"is_install_path\": true, \"mod_time\": \"2025-10-06 17:15:11 +0000\", \"name\": \"Abandoned Cart for WooCommerce SQLi Scanner\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/scanner/http/wp_abandoned_cart_sqli.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/wp_abandoned_cart_sqli\", \"references\": [\"CVE-2025-47608\", \"WPVDB-10461\", \"URL-https://wpdeeply.com/woocommerce-abandoned-cart-before-5-8-2-sql-injection/\", \"URL-https://plugins.trac.wordpress.org/changeset/2413885\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:56.316617Z"} 2026-09-08T06:47:56.316617+00:00 https://vulnerability.circl.lu/sighting/c2eaedb2-1461-416e-9b8d-06763aa90790/export 2026-09-17T10:59:14.661705+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "c2eaedb2-1461-416e-9b8d-06763aa90790", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-47812", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-03)", "content": "", "creation_timestamp": "2026-09-04T10:00:13.838652Z"} 2026-09-04T10:00:13.838652+00:00 https://vulnerability.circl.lu/sighting/6d15ab3b-5974-496e-8027-ea78a8e0389a/export 2026-09-17T10:59:14.661804+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "6d15ab3b-5974-496e-8027-ea78a8e0389a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-47241", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/160357", "content": "More than 1,500 AI projects are now vulnerable to a silent exploit\nhttps://www.reddit.com/r/redteamsec/comments/1krhn92/more_than_1500_ai_projects_are_now_vulnerable_to/\n\nAccording to the latest research by ARIMLABS[.]AI, a critical security vulnerability (CVE-2025-47241) has been discovered in the widely used Browser Use framework \u2014 a dependency leveraged by more than 1,500 AI projects. The issue enables zero-click agent hijacking, meaning an attacker can take control of an LLM-powered browsing agent simply by getting it to visit a malicious page \u2014 no user interaction required. This raises serious concerns about the current state of security in autonomous AI agents, especially those that interact with the web. What\u2019s the community\u2019s take on this? Is AI agent security getting the attention it deserves? (all links in the comments) submitted by /u/0xm3k (https://www.reddit.com/user/0xm3k) \n [link] (https://arimlabs.ai/news/the-hidden-dangers-of-browsing-ai-agents) [comments] (https://www.reddit.com/r/redteamsec/comments/1krhn92/more_than_1500_ai_projects_are_now_vulnerable_to/)", "creation_timestamp": "2026-09-04T00:00:53.133124Z"} 2026-09-04T00:00:53.133124+00:00 https://vulnerability.circl.lu/sighting/f7a49248-a93d-4c58-bcf2-3db25435a9e1/export 2026-09-17T10:59:14.661912+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "f7a49248-a93d-4c58-bcf2-3db25435a9e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-47241", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/160357", "content": "More than 1,500 AI projects are now vulnerable to a silent exploit\nhttps://www.reddit.com/r/redteamsec/comments/1krhn92/more_than_1500_ai_projects_are_now_vulnerable_to/\n\nAccording to the latest research by ARIMLABS[.]AI, a critical security vulnerability (CVE-2025-47241) has been discovered in the widely used Browser Use framework \u2014 a dependency leveraged by more than 1,500 AI projects. The issue enables zero-click agent hijacking, meaning an attacker can take control of an LLM-powered browsing agent simply by getting it to visit a malicious page \u2014 no user interaction required. This raises serious concerns about the current state of security in autonomous AI agents, especially those that interact with the web. What\u2019s the community\u2019s take on this? Is AI agent security getting the attention it deserves? (all links in the comments) submitted by /u/0xm3k (https://www.reddit.com/user/0xm3k) \n [link] (https://arimlabs.ai/news/the-hidden-dangers-of-browsing-ai-agents) [comments] (https://www.reddit.com/r/redteamsec/comments/1krhn92/more_than_1500_ai_projects_are_now_vulnerable_to/)", "creation_timestamp": "2026-09-03T10:00:03.875014Z"} 2026-09-03T10:00:03.875014+00:00 https://vulnerability.circl.lu/sighting/59d4cfd3-f706-410a-ade1-a2a494012e0c/export 2026-09-17T10:59:14.662018+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "59d4cfd3-f706-410a-ade1-a2a494012e0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-47812", "type": "published-proof-of-concept", "source": "https://t.me/HackingTeamGrupoOfficial/45517", "content": "Exploit_CVE-2025-47812 #exploit\nUnauthenticatedRCE.CVE-2025-47812\n\nhttps://github.com/H3XploR/ExploitCVE-2025-47812", "creation_timestamp": "2026-09-03T00:00:47.561881Z"} 2026-09-03T00:00:47.561881+00:00 https://vulnerability.circl.lu/sighting/b22c1fba-3c72-4d95-9834-3fedcc114b70/export 2026-09-17T10:59:14.662117+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "b22c1fba-3c72-4d95-9834-3fedcc114b70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-47812", "type": "seen", "source": "https://t.me/HackingTeamGrupoOfficial/45517", "content": "Exploit_CVE-2025-47812 #exploit\nUnauthenticatedRCE.CVE-2025-47812\n\nhttps://github.com/H3XploR/ExploitCVE-2025-47812", "creation_timestamp": "2026-09-02T06:00:14.668608Z"} 2026-09-02T06:00:14.668608+00:00 https://vulnerability.circl.lu/sighting/54193c42-e697-4259-a712-e2680399fcb3/export 2026-09-17T10:59:14.662226+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "54193c42-e697-4259-a712-e2680399fcb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-47241", "type": "seen", "source": "https://t.me/hacking_Attack/160357", "content": "More than 1,500 AI projects are now vulnerable to a silent exploit\nhttps://www.reddit.com/r/redteamsec/comments/1krhn92/more_than_1500_ai_projects_are_now_vulnerable_to/\n\nAccording to the latest research by ARIMLABS[.]AI, a critical security vulnerability (CVE-2025-47241) has been discovered in the widely used Browser Use framework \u2014 a dependency leveraged by more than 1,500 AI projects. The issue enables zero-click agent hijacking, meaning an attacker can take control of an LLM-powered browsing agent simply by getting it to visit a malicious page \u2014 no user interaction required. This raises serious concerns about the current state of security in autonomous AI agents, especially those that interact with the web. What\u2019s the community\u2019s take on this? Is AI agent security getting the attention it deserves? (all links in the comments) submitted by /u/0xm3k (https://www.reddit.com/user/0xm3k) \n [link] (https://arimlabs.ai/news/the-hidden-dangers-of-browsing-ai-agents) [comments] (https://www.reddit.com/r/redteamsec/comments/1krhn92/more_than_1500_ai_projects_are_now_vulnerable_to/)", "creation_timestamp": "2026-09-02T01:00:40.711583Z"} 2026-09-02T01:00:40.711583+00:00