https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 17 Sep 2026 11:27:33 +0000 https://vulnerability.circl.lu/sighting/6d5ffccf-4e14-45fb-bd74-260dc7dbe9be/export {"uuid": "6d5ffccf-4e14-45fb-bd74-260dc7dbe9be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-16)", "content": "", "creation_timestamp": "2026-09-17T10:15:07.880923Z"} {"uuid": "6d5ffccf-4e14-45fb-bd74-260dc7dbe9be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-16)", "content": "", "creation_timestamp": "2026-09-17T10:15:07.880923Z"} https://vulnerability.circl.lu/sighting/6d5ffccf-4e14-45fb-bd74-260dc7dbe9be/export Thu, 17 Sep 2026 10:15:07 +0000 https://vulnerability.circl.lu/sighting/50d950f8-e764-42af-933b-eb0b063097cc/export {"uuid": "50d950f8-e764-42af-933b-eb0b063097cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-15)", "content": "", "creation_timestamp": "2026-09-16T10:00:09.528839Z"} {"uuid": "50d950f8-e764-42af-933b-eb0b063097cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-15)", "content": "", "creation_timestamp": "2026-09-16T10:00:09.528839Z"} https://vulnerability.circl.lu/sighting/50d950f8-e764-42af-933b-eb0b063097cc/export Wed, 16 Sep 2026 10:00:09 +0000 https://vulnerability.circl.lu/sighting/e6838c67-3b22-4e37-bf91-68ced65333df/export {"uuid": "e6838c67-3b22-4e37-bf91-68ced65333df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-08)", "content": "", "creation_timestamp": "2026-09-09T10:00:10.147390Z"} {"uuid": "e6838c67-3b22-4e37-bf91-68ced65333df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-08)", "content": "", "creation_timestamp": "2026-09-09T10:00:10.147390Z"} https://vulnerability.circl.lu/sighting/e6838c67-3b22-4e37-bf91-68ced65333df/export Wed, 09 Sep 2026 10:00:10 +0000 https://vulnerability.circl.lu/sighting/c7430db7-b0e2-409a-afe4-9a9c2d46357a/export {"uuid": "c7430db7-b0e2-409a-afe4-9a9c2d46357a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27956", "type": "exploited", "source": "https://t.me/Hackme_news/951", "content": "\ud83d\udea8\u0412\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 #WordPress ! \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 (CVE-2024-27956) \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 WP-Automatic \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f. \n\nhttps://wpscan.com/blog/new-malware-campaign-targets-wp-automatic-plugin/", "creation_timestamp": "2026-09-09T00:00:13.003686Z"} {"uuid": "c7430db7-b0e2-409a-afe4-9a9c2d46357a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27956", "type": "exploited", "source": "https://t.me/Hackme_news/951", "content": "\ud83d\udea8\u0412\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 #WordPress ! \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 (CVE-2024-27956) \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 WP-Automatic \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f. \n\nhttps://wpscan.com/blog/new-malware-campaign-targets-wp-automatic-plugin/", "creation_timestamp": "2026-09-09T00:00:13.003686Z"} https://vulnerability.circl.lu/sighting/c7430db7-b0e2-409a-afe4-9a9c2d46357a/export Wed, 09 Sep 2026 00:00:13 +0000 https://vulnerability.circl.lu/sighting/af71a1c5-078b-4e4e-909b-8dac9ddecd15/export {"uuid": "af71a1c5-078b-4e4e-909b-8dac9ddecd15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27956", "type": "exploited", "source": "https://t.me/Hackme_news/951", "content": "\ud83d\udea8\u0412\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 #WordPress ! \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 (CVE-2024-27956) \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 WP-Automatic \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f. \n\nhttps://wpscan.com/blog/new-malware-campaign-targets-wp-automatic-plugin/", "creation_timestamp": "2026-09-08T22:00:05.161203Z"} {"uuid": "af71a1c5-078b-4e4e-909b-8dac9ddecd15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27956", "type": "exploited", "source": "https://t.me/Hackme_news/951", "content": "\ud83d\udea8\u0412\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 #WordPress ! \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 (CVE-2024-27956) \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 WP-Automatic \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f. \n\nhttps://wpscan.com/blog/new-malware-campaign-targets-wp-automatic-plugin/", "creation_timestamp": "2026-09-08T22:00:05.161203Z"} https://vulnerability.circl.lu/sighting/af71a1c5-078b-4e4e-909b-8dac9ddecd15/export Tue, 08 Sep 2026 22:00:05 +0000 https://vulnerability.circl.lu/sighting/23ee7487-635e-43fe-bd98-8d9bf444dece/export {"uuid": "23ee7487-635e-43fe-bd98-8d9bf444dece", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27822", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/packagekit_zshenv_privesc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Mykola Grymalyuk\", \"h00die\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits CVE-2024-27822, a vulnerability in macOS\\n PackageKit.framework where PKG installer scripts using a ZSH shebang\\n (#!/bin/zsh) are executed as root while inheriting the installing user's\\n environment. This causes ZSH to load the user's ~/.zshenv with root\\n privileges before the installer script body runs.\\n\\n The module injects a payload into ~/.zshenv that only fires when EUID is 0,\\n uploads a minimal PKG (from data/exploits/CVE-2024-27822/template.pkg) whose\\n install script uses a #!/bin/zsh shebang, and opens it with Installer.app.\\n When the user approves the installation dialog and authenticates, PackageKit\\n runs the install script as root. ZSH sources ~/.zshenv before the script body\\n executes, so the payload fires with root privileges. The original ~/.zshenv\\n content is restored immediately after the payload runs.\\n\\n Affected: macOS 14.4 and earlier, 13.6.6 and earlier, 12.7.4 and earlier,\\n and all macOS 11 and older releases.\\n Fixed in: macOS 14.5, 13.6.7, 12.7.5.\", \"disclosure_date\": \"2024-06-03\", \"fullname\": \"exploit/osx/local/packagekit_zshenv_privesc\", \"is_install_path\": true, \"mod_time\": \"2026-07-03 18:58:13 +0000\", \"name\": \"macOS PackageKit ZSH Environment Privilege Escalation\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"event-dependent\"], \"SideEffects\": [\"artifacts-on-disk\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/osx/local/packagekit_zshenv_privesc.rb\", \"platform\": \"OSX,Unix\", \"post_auth\": false, \"rank\": 0, \"ref_name\": \"osx/local/packagekit_zshenv_privesc\", \"references\": [\"CVE-2024-27822\", \"URL-https://khronokernel.com/macos/2024/06/03/CVE-2024-27822.html\", \"ATT&CK-T1068\", \"ATT&CK-T1546.004\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"macOS\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:31.436705Z"} {"uuid": "23ee7487-635e-43fe-bd98-8d9bf444dece", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27822", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/packagekit_zshenv_privesc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Mykola Grymalyuk\", \"h00die\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits CVE-2024-27822, a vulnerability in macOS\\n PackageKit.framework where PKG installer scripts using a ZSH shebang\\n (#!/bin/zsh) are executed as root while inheriting the installing user's\\n environment. This causes ZSH to load the user's ~/.zshenv with root\\n privileges before the installer script body runs.\\n\\n The module injects a payload into ~/.zshenv that only fires when EUID is 0,\\n uploads a minimal PKG (from data/exploits/CVE-2024-27822/template.pkg) whose\\n install script uses a #!/bin/zsh shebang, and opens it with Installer.app.\\n When the user approves the installation dialog and authenticates, PackageKit\\n runs the install script as root. ZSH sources ~/.zshenv before the script body\\n executes, so the payload fires with root privileges. The original ~/.zshenv\\n content is restored immediately after the payload runs.\\n\\n Affected: macOS 14.4 and earlier, 13.6.6 and earlier, 12.7.4 and earlier,\\n and all macOS 11 and older releases.\\n Fixed in: macOS 14.5, 13.6.7, 12.7.5.\", \"disclosure_date\": \"2024-06-03\", \"fullname\": \"exploit/osx/local/packagekit_zshenv_privesc\", \"is_install_path\": true, \"mod_time\": \"2026-07-03 18:58:13 +0000\", \"name\": \"macOS PackageKit ZSH Environment Privilege Escalation\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"event-dependent\"], \"SideEffects\": [\"artifacts-on-disk\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/osx/local/packagekit_zshenv_privesc.rb\", \"platform\": \"OSX,Unix\", \"post_auth\": false, \"rank\": 0, \"ref_name\": \"osx/local/packagekit_zshenv_privesc\", \"references\": [\"CVE-2024-27822\", \"URL-https://khronokernel.com/macos/2024/06/03/CVE-2024-27822.html\", \"ATT&CK-T1068\", \"ATT&CK-T1546.004\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"macOS\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:31.436705Z"} https://vulnerability.circl.lu/sighting/23ee7487-635e-43fe-bd98-8d9bf444dece/export Tue, 08 Sep 2026 06:50:31 +0000 https://vulnerability.circl.lu/sighting/c7ded93e-3890-4043-9729-57e88f6ed274/export {"uuid": "c7ded93e-3890-4043-9729-57e88f6ed274", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27956", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_automatic_sqli_to_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd\", \"author\": [\"Rafie Muhammad\", \"Valentin Lobstein\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated SQL injection vulnerability in the WordPress wp-automatic plugin (versions < 3.92.1)\\n to achieve remote code execution (RCE). The vulnerability allows the attacker to inject and execute arbitrary SQL commands,\\n which can be used to create a malicious administrator account. The password for the new account is hashed using MD5.\\n Once the administrator account is created, the attacker can upload and execute a malicious plugin, leading to full control\\n over the WordPress site.\", \"disclosure_date\": \"2024-03-13\", \"fullname\": \"exploit/multi/http/wp_automatic_sqli_to_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:04 +0000\", \"name\": \"WordPress wp-automatic Plugin SQLi Admin Creation\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/wp_automatic_sqli_to_rce.rb\", \"platform\": \"Linux,PHP,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/wp_automatic_sqli_to_rce\", \"references\": [\"CVE-2024-27956\", \"WPVDB-53a51e79-a216-4ca3-ac2d-57098fd2ebb5\", \"URL-https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-automatic/automatic-3920-unauthenticated-sql-injection\", \"URL-https://patchstack.com/articles/critical-vulnerabilities-patched-in-wordpress-automatic-plugin/\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHP In-Memory\", \"Unix/Linux Command Shell\", \"Windows Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:20.686078Z"} {"uuid": "c7ded93e-3890-4043-9729-57e88f6ed274", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27956", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_automatic_sqli_to_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd\", \"author\": [\"Rafie Muhammad\", \"Valentin Lobstein\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated SQL injection vulnerability in the WordPress wp-automatic plugin (versions < 3.92.1)\\n to achieve remote code execution (RCE). The vulnerability allows the attacker to inject and execute arbitrary SQL commands,\\n which can be used to create a malicious administrator account. The password for the new account is hashed using MD5.\\n Once the administrator account is created, the attacker can upload and execute a malicious plugin, leading to full control\\n over the WordPress site.\", \"disclosure_date\": \"2024-03-13\", \"fullname\": \"exploit/multi/http/wp_automatic_sqli_to_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:04 +0000\", \"name\": \"WordPress wp-automatic Plugin SQLi Admin Creation\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/wp_automatic_sqli_to_rce.rb\", \"platform\": \"Linux,PHP,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/wp_automatic_sqli_to_rce\", \"references\": [\"CVE-2024-27956\", \"WPVDB-53a51e79-a216-4ca3-ac2d-57098fd2ebb5\", \"URL-https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-automatic/automatic-3920-unauthenticated-sql-injection\", \"URL-https://patchstack.com/articles/critical-vulnerabilities-patched-in-wordpress-automatic-plugin/\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHP In-Memory\", \"Unix/Linux Command Shell\", \"Windows Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:20.686078Z"} https://vulnerability.circl.lu/sighting/c7ded93e-3890-4043-9729-57e88f6ed274/export Tue, 08 Sep 2026 06:50:20 +0000 https://vulnerability.circl.lu/sighting/4898beef-8c16-46f6-9c5f-840ee7fcd724/export {"uuid": "4898beef-8c16-46f6-9c5f-840ee7fcd724", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2024_27198.rb", "content": "{\"aliases\": [], \"arch\": \"java, cmd\", \"author\": [\"sfewer-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an authentication bypass vulnerability in JetBrains TeamCity. An unauthenticated\\n attacker can leverage this to access the REST API and create a new administrator access token. This token\\n can be used to upload a plugin which contains a Metasploit payload, allowing the attacker to achieve\\n unauthenticated RCE on the target TeamCity server. On older versions of TeamCity, access tokens do not exist\\n so the exploit will instead create a new administrator account before uploading a plugin. Older version of\\n TeamCity have a debug endpoint (/app/rest/debug/process) that allows for arbitrary commands to be executed,\\n however recent version of TeamCity no longer ship this endpoint, hence why a plugin is leveraged for code\\n execution instead, as this is supported on all versions tested.\", \"disclosure_date\": \"2024-03-04\", \"fullname\": \"exploit/multi/http/jetbrains_teamcity_rce_cve_2024_27198\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"JetBrains TeamCity Unauthenticated Remote Code Execution\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2024_27198.rb\", \"platform\": \"Java,Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/jetbrains_teamcity_rce_cve_2024_27198\", \"references\": [\"CVE-2024-27198\", \"EDB-52411\", \"URL-https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/\", \"URL-https://blog.jetbrains.com/teamcity/2024/03/teamcity-2023-11-4-is-out/\"], \"rport\": 8111, \"session_types\": false, \"targets\": [\"Java\", \"Java Server Page\", \"Windows Command\", \"Linux Command\", \"Unix Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:59.718665Z"} {"uuid": "4898beef-8c16-46f6-9c5f-840ee7fcd724", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2024_27198.rb", "content": "{\"aliases\": [], \"arch\": \"java, cmd\", \"author\": [\"sfewer-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an authentication bypass vulnerability in JetBrains TeamCity. An unauthenticated\\n attacker can leverage this to access the REST API and create a new administrator access token. This token\\n can be used to upload a plugin which contains a Metasploit payload, allowing the attacker to achieve\\n unauthenticated RCE on the target TeamCity server. On older versions of TeamCity, access tokens do not exist\\n so the exploit will instead create a new administrator account before uploading a plugin. Older version of\\n TeamCity have a debug endpoint (/app/rest/debug/process) that allows for arbitrary commands to be executed,\\n however recent version of TeamCity no longer ship this endpoint, hence why a plugin is leveraged for code\\n execution instead, as this is supported on all versions tested.\", \"disclosure_date\": \"2024-03-04\", \"fullname\": \"exploit/multi/http/jetbrains_teamcity_rce_cve_2024_27198\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"JetBrains TeamCity Unauthenticated Remote Code Execution\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2024_27198.rb\", \"platform\": \"Java,Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/jetbrains_teamcity_rce_cve_2024_27198\", \"references\": [\"CVE-2024-27198\", \"EDB-52411\", \"URL-https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/\", \"URL-https://blog.jetbrains.com/teamcity/2024/03/teamcity-2023-11-4-is-out/\"], \"rport\": 8111, \"session_types\": false, \"targets\": [\"Java\", \"Java Server Page\", \"Windows Command\", \"Linux Command\", \"Unix Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:59.718665Z"} https://vulnerability.circl.lu/sighting/4898beef-8c16-46f6-9c5f-840ee7fcd724/export Tue, 08 Sep 2026 06:49:59 +0000 https://vulnerability.circl.lu/sighting/c82918ff-08db-4b82-8a36-fb13f60a7f0a/export {"uuid": "c82918ff-08db-4b82-8a36-fb13f60a7f0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27348", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_hugegraph_gremlin_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"6right\", \"jheysel-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits CVE-2024-27348 which is a Remote Code Execution (RCE) vulnerability that exists in\\n Apache HugeGraph Server in versions before 1.3.0. An attacker can bypass the sandbox restrictions and achieve\\n RCE through Gremlin, resulting in complete control over the server\", \"disclosure_date\": \"2024-04-22\", \"fullname\": \"exploit/linux/http/apache_hugegraph_gremlin_rce\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"Apache HugeGraph Gremlin RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/apache_hugegraph_gremlin_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/apache_hugegraph_gremlin_rce\", \"references\": [\"URL-https://blog.securelayer7.net/remote-code-execution-in-apache-hugegraph/\", \"CVE-2024-27348\", \"EDB-52149\"], \"rport\": 8080, \"session_types\": false, \"targets\": [\"Automatic Target\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:21.591584Z"} {"uuid": "c82918ff-08db-4b82-8a36-fb13f60a7f0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27348", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_hugegraph_gremlin_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"6right\", \"jheysel-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits CVE-2024-27348 which is a Remote Code Execution (RCE) vulnerability that exists in\\n Apache HugeGraph Server in versions before 1.3.0. An attacker can bypass the sandbox restrictions and achieve\\n RCE through Gremlin, resulting in complete control over the server\", \"disclosure_date\": \"2024-04-22\", \"fullname\": \"exploit/linux/http/apache_hugegraph_gremlin_rce\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"Apache HugeGraph Gremlin RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/apache_hugegraph_gremlin_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/apache_hugegraph_gremlin_rce\", \"references\": [\"URL-https://blog.securelayer7.net/remote-code-execution-in-apache-hugegraph/\", \"CVE-2024-27348\", \"EDB-52149\"], \"rport\": 8080, \"session_types\": false, \"targets\": [\"Automatic Target\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:21.591584Z"} https://vulnerability.circl.lu/sighting/c82918ff-08db-4b82-8a36-fb13f60a7f0a/export Tue, 08 Sep 2026 06:48:21 +0000 https://vulnerability.circl.lu/sighting/e4bc3522-fc7f-4b99-b6b5-d6aacd31955a/export {"uuid": "e4bc3522-fc7f-4b99-b6b5-d6aacd31955a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27564", "type": "published-proof-of-concept", "source": "Telegram/43D4qhGTDojIu_KxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag", "content": "", "creation_timestamp": "2026-09-07T01:00:11.705798Z"} {"uuid": "e4bc3522-fc7f-4b99-b6b5-d6aacd31955a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27564", "type": "published-proof-of-concept", "source": "Telegram/43D4qhGTDojIu_KxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag", "content": "", "creation_timestamp": "2026-09-07T01:00:11.705798Z"} https://vulnerability.circl.lu/sighting/e4bc3522-fc7f-4b99-b6b5-d6aacd31955a/export Mon, 07 Sep 2026 01:00:11 +0000