https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 17 Sep 2026 11:05:28 +0000 https://vulnerability.circl.lu/sighting/11a399a2-9a8b-4baa-bb39-31a57c13595f/export {"uuid": "11a399a2-9a8b-4baa-bb39-31a57c13595f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-41115", "type": "seen", "source": "https://t.me/Intel_Encyclopedia/2866", "content": "\u2728 General Cyber News \u2728\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Grafana Enterprise: \u0443\u0433\u0440\u043e\u0437\u0430 \u044d\u0441\u043a\u0430\u043b\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0447\u0435\u0440\u0435\u0437 SCIM\n\n\u2014\n\nSummary:\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Grafana Labs \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 SCIM-\u043f\u0440\u043e\u0432\u0438\u0436\u0435\u043d\u0438\u043d\u0433\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0433\u043b\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438\u043b\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2025-41115 \u0441 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u043c \u0431\u0430\u043b\u043b\u043e\u043c CVSS 10.0, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Grafana Enterprise \u0432\u0435\u0440\u0441\u0438\u0439 \u0441 12.0.0 \u043f\u043e 12.2.1 \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445. \u0414\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0430...\n\n\u2014\n\nSource: SEC-1275-1\nPublished: 2025-11-21 11:55 | Author: Vulner Queen\n\n#enterprise #grafana #general_cyber_news\n\nhttps://1275.ru/vulnerability/kriticheskaya-uyazvimost-v-grafana-enterprise-ugroza-eskalatsii-privilegiy-cherez-scim_16488", "creation_timestamp": "2026-09-10T00:00:46.635417Z"} {"uuid": "11a399a2-9a8b-4baa-bb39-31a57c13595f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-41115", "type": "seen", "source": "https://t.me/Intel_Encyclopedia/2866", "content": "\u2728 General Cyber News \u2728\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Grafana Enterprise: \u0443\u0433\u0440\u043e\u0437\u0430 \u044d\u0441\u043a\u0430\u043b\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0447\u0435\u0440\u0435\u0437 SCIM\n\n\u2014\n\nSummary:\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Grafana Labs \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 SCIM-\u043f\u0440\u043e\u0432\u0438\u0436\u0435\u043d\u0438\u043d\u0433\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0433\u043b\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438\u043b\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2025-41115 \u0441 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u043c \u0431\u0430\u043b\u043b\u043e\u043c CVSS 10.0, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Grafana Enterprise \u0432\u0435\u0440\u0441\u0438\u0439 \u0441 12.0.0 \u043f\u043e 12.2.1 \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445. \u0414\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0430...\n\n\u2014\n\nSource: SEC-1275-1\nPublished: 2025-11-21 11:55 | Author: Vulner Queen\n\n#enterprise #grafana #general_cyber_news\n\nhttps://1275.ru/vulnerability/kriticheskaya-uyazvimost-v-grafana-enterprise-ugroza-eskalatsii-privilegiy-cherez-scim_16488", "creation_timestamp": "2026-09-10T00:00:46.635417Z"} https://vulnerability.circl.lu/sighting/11a399a2-9a8b-4baa-bb39-31a57c13595f/export Thu, 10 Sep 2026 00:00:46 +0000 https://vulnerability.circl.lu/sighting/c770aa23-256d-435c-b581-6b3e65f5ff6c/export {"uuid": "c770aa23-256d-435c-b581-6b3e65f5ff6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-41115", "type": "seen", "source": "https://t.me/Intel_Encyclopedia/2866", "content": "\u2728 General Cyber News \u2728\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Grafana Enterprise: \u0443\u0433\u0440\u043e\u0437\u0430 \u044d\u0441\u043a\u0430\u043b\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0447\u0435\u0440\u0435\u0437 SCIM\n\n\u2014\n\nSummary:\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Grafana Labs \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 SCIM-\u043f\u0440\u043e\u0432\u0438\u0436\u0435\u043d\u0438\u043d\u0433\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0433\u043b\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438\u043b\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2025-41115 \u0441 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u043c \u0431\u0430\u043b\u043b\u043e\u043c CVSS 10.0, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Grafana Enterprise \u0432\u0435\u0440\u0441\u0438\u0439 \u0441 12.0.0 \u043f\u043e 12.2.1 \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445. \u0414\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0430...\n\n\u2014\n\nSource: SEC-1275-1\nPublished: 2025-11-21 11:55 | Author: Vulner Queen\n\n#enterprise #grafana #general_cyber_news\n\nhttps://1275.ru/vulnerability/kriticheskaya-uyazvimost-v-grafana-enterprise-ugroza-eskalatsii-privilegiy-cherez-scim_16488", "creation_timestamp": "2026-09-09T05:00:08.817065Z"} {"uuid": "c770aa23-256d-435c-b581-6b3e65f5ff6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-41115", "type": "seen", "source": "https://t.me/Intel_Encyclopedia/2866", "content": "\u2728 General Cyber News \u2728\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Grafana Enterprise: \u0443\u0433\u0440\u043e\u0437\u0430 \u044d\u0441\u043a\u0430\u043b\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0447\u0435\u0440\u0435\u0437 SCIM\n\n\u2014\n\nSummary:\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Grafana Labs \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 SCIM-\u043f\u0440\u043e\u0432\u0438\u0436\u0435\u043d\u0438\u043d\u0433\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0433\u043b\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438\u043b\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2025-41115 \u0441 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u043c \u0431\u0430\u043b\u043b\u043e\u043c CVSS 10.0, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Grafana Enterprise \u0432\u0435\u0440\u0441\u0438\u0439 \u0441 12.0.0 \u043f\u043e 12.2.1 \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445. \u0414\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0430...\n\n\u2014\n\nSource: SEC-1275-1\nPublished: 2025-11-21 11:55 | Author: Vulner Queen\n\n#enterprise #grafana #general_cyber_news\n\nhttps://1275.ru/vulnerability/kriticheskaya-uyazvimost-v-grafana-enterprise-ugroza-eskalatsii-privilegiy-cherez-scim_16488", "creation_timestamp": "2026-09-09T05:00:08.817065Z"} https://vulnerability.circl.lu/sighting/c770aa23-256d-435c-b581-6b3e65f5ff6c/export Wed, 09 Sep 2026 05:00:08 +0000 https://vulnerability.circl.lu/sighting/921386bc-c099-46ec-b95f-0ff63e96419d/export {"uuid": "921386bc-c099-46ec-b95f-0ff63e96419d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-4123", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/172762", "content": "How I Found \u201cCVE-2025\u20134123\u201d in Grafana Using FOFA (and Got a Bounty\nhttps://medium.com/@a0xtrojan/how-i-found-cve-2025-4123-in-grafana-using-fofa-and-got-a-bounty-a21a00d477a8?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-04T00:01:04.056818Z"} {"uuid": "921386bc-c099-46ec-b95f-0ff63e96419d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-4123", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/172762", "content": "How I Found \u201cCVE-2025\u20134123\u201d in Grafana Using FOFA (and Got a Bounty\nhttps://medium.com/@a0xtrojan/how-i-found-cve-2025-4123-in-grafana-using-fofa-and-got-a-bounty-a21a00d477a8?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-04T00:01:04.056818Z"} https://vulnerability.circl.lu/sighting/921386bc-c099-46ec-b95f-0ff63e96419d/export Fri, 04 Sep 2026 00:01:04 +0000 https://vulnerability.circl.lu/sighting/0a728d49-cab1-4462-bda5-803e3572b9a8/export {"uuid": "0a728d49-cab1-4462-bda5-803e3572b9a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-4123", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/172764", "content": "\u0628\u0633\u0645 \u0627\u0644\u0644\u0647 \u0648\u0627\u0644\u0635\u0644\u0627\u0629 \u0648\u0627\u0644\u0633\u0644\u0627\u0645 \u0639\u0644\u0649 \u0646\u0628\u064a\u0646\u0627 \u0627\u0644\u0645\u062c\u0627\u0647\u062f \u0627\u0644\u0634\u0647\u064a\u062fContinue reading on Medium \u00bb (https://medium.com/@a0xtrojan/how-i-found-cve-2025-4123-in-grafana-using-fofa-and-got-a-bounty-a21a00d477a8?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-04T00:01:03.999703Z"} {"uuid": "0a728d49-cab1-4462-bda5-803e3572b9a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-4123", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/172764", "content": "\u0628\u0633\u0645 \u0627\u0644\u0644\u0647 \u0648\u0627\u0644\u0635\u0644\u0627\u0629 \u0648\u0627\u0644\u0633\u0644\u0627\u0645 \u0639\u0644\u0649 \u0646\u0628\u064a\u0646\u0627 \u0627\u0644\u0645\u062c\u0627\u0647\u062f \u0627\u0644\u0634\u0647\u064a\u062fContinue reading on Medium \u00bb (https://medium.com/@a0xtrojan/how-i-found-cve-2025-4123-in-grafana-using-fofa-and-got-a-bounty-a21a00d477a8?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-04T00:01:03.999703Z"} https://vulnerability.circl.lu/sighting/0a728d49-cab1-4462-bda5-803e3572b9a8/export Fri, 04 Sep 2026 00:01:03 +0000 https://vulnerability.circl.lu/sighting/d16eeb14-71e6-44d8-9722-03d5a8874559/export {"uuid": "d16eeb14-71e6-44d8-9722-03d5a8874559", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-4123", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/165425", "content": "\u201cHow CVE-2025\u20134123 Turned Grafana Into a Hacker\u2019s Playground\u201d\nhttps://infosecwriteups.com/how-cve-2025-4123-turned-grafana-into-a-hackers-playground-f93a45bde714?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-04T00:00:58.547679Z"} {"uuid": "d16eeb14-71e6-44d8-9722-03d5a8874559", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-4123", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/165425", "content": "\u201cHow CVE-2025\u20134123 Turned Grafana Into a Hacker\u2019s Playground\u201d\nhttps://infosecwriteups.com/how-cve-2025-4123-turned-grafana-into-a-hackers-playground-f93a45bde714?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-04T00:00:58.547679Z"} https://vulnerability.circl.lu/sighting/d16eeb14-71e6-44d8-9722-03d5a8874559/export Fri, 04 Sep 2026 00:00:58 +0000 https://vulnerability.circl.lu/sighting/ce68d616-47f7-4b8c-9d78-20246b38876d/export {"uuid": "ce68d616-47f7-4b8c-9d78-20246b38876d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-4123", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/165427", "content": "What started as a path traversal led to XSS, SSRF, and full account compromise.Continue reading on InfoSec Write-ups \u00bb (https://infosecwriteups.com/how-cve-2025-4123-turned-grafana-into-a-hackers-playground-f93a45bde714?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-04T00:00:58.493048Z"} {"uuid": "ce68d616-47f7-4b8c-9d78-20246b38876d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-4123", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/165427", "content": "What started as a path traversal led to XSS, SSRF, and full account compromise.Continue reading on InfoSec Write-ups \u00bb (https://infosecwriteups.com/how-cve-2025-4123-turned-grafana-into-a-hackers-playground-f93a45bde714?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-04T00:00:58.493048Z"} https://vulnerability.circl.lu/sighting/ce68d616-47f7-4b8c-9d78-20246b38876d/export Fri, 04 Sep 2026 00:00:58 +0000 https://vulnerability.circl.lu/sighting/d388e69d-a225-4d58-8fd6-b37fad878570/export {"uuid": "d388e69d-a225-4d58-8fd6-b37fad878570", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-4123", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/162006", "content": "A Hands-on practical guide to earning rewards.Continue reading on OSINT Team \u00bb (https://osintteam.blog/grafana-cve-2025-4123-open-redirect-xss-ssrf-8fa24bb26d5d?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-04T00:00:54.287947Z"} {"uuid": "d388e69d-a225-4d58-8fd6-b37fad878570", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-4123", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/162006", "content": "A Hands-on practical guide to earning rewards.Continue reading on OSINT Team \u00bb (https://osintteam.blog/grafana-cve-2025-4123-open-redirect-xss-ssrf-8fa24bb26d5d?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-04T00:00:54.287947Z"} https://vulnerability.circl.lu/sighting/d388e69d-a225-4d58-8fd6-b37fad878570/export Fri, 04 Sep 2026 00:00:54 +0000 https://vulnerability.circl.lu/sighting/113cbe6b-7ad8-403a-ac9c-773e1369f7f7/export {"uuid": "113cbe6b-7ad8-403a-ac9c-773e1369f7f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-4123", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/162004", "content": "Grafana CVE-2025\u20134123 | Open Redirect - XSS - SSRF\nhttps://osintteam.blog/grafana-cve-2025-4123-open-redirect-xss-ssrf-8fa24bb26d5d?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-04T00:00:53.913598Z"} {"uuid": "113cbe6b-7ad8-403a-ac9c-773e1369f7f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-4123", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/162004", "content": "Grafana CVE-2025\u20134123 | Open Redirect - XSS - SSRF\nhttps://osintteam.blog/grafana-cve-2025-4123-open-redirect-xss-ssrf-8fa24bb26d5d?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-04T00:00:53.913598Z"} https://vulnerability.circl.lu/sighting/113cbe6b-7ad8-403a-ac9c-773e1369f7f7/export Fri, 04 Sep 2026 00:00:53 +0000 https://vulnerability.circl.lu/sighting/ab7b3eff-d40b-4eef-91e5-f7933a2f251c/export {"uuid": "ab7b3eff-d40b-4eef-91e5-f7933a2f251c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-4123", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/161216", "content": "My Journey to NASA\u2019s Hall of Fame\n\nHi, I\u2019m Dharineesh, AKA Hack-Bat, and this is the story of how I ended up being listed in the NASA Hall of Fame. It wasn\u2019t a smooth ride. The path was filled with long nights, false hopes, and a lot of second-guessing. But every time I stumbled, I asked myself a simple question: \u201cstay down or get up\u201d \u2014 and I got back up. Here\u2019s how things unfolded.Phase 1: Google Dorking I began with what a lot of bug hunters do: Google Dorking. It\u2019s like looking for needles in a haystack using smart magnets \u2014 crafting specific search queries to find misconfigurations, exposed credentials, and more. I spent days digging through public directories, login portals, and possible leaked documents. Some of it looked promising. But when I submitted those finds, they came back as \u201cNot Applicable\u201d. That happened not once, not twice, but five times in a row. At that point, I was frustrated. But something in me said: You\u2019ve made it this far. Keep going.Phase 2: The Game-Changer \u2014 CVE-2025\u20134123 That\u2019s when I came across a fresh CVE \u2014 CVE-2025\u20134123 \u2014 tied to Grafana, it is an open-source web application used for analytics and interactive data visualization. It\u2019s widely used for monitoring application performance, visualizing metrics, and configuring alerts. The vulnerability allowed attackers to:Redirect users through open redirect flawsPull off SSRF attacks to query internal servicesTrigger account takeover using XSS This was a big deal. Now I just had to find an exposed Grafana instance. Simple in theory, a grind in reality.Phase 3: The Subdomain Hunt This is where things got messy \u2014 in a good way. Finding Grafana meant doing massive subdomain enumeration. I couldn\u2019t rely on just one tool. Here\u2019s the combo that worked:subfinder -d example.com curl -s \"https://crt.sh/?q=%25.example.com\" | grep -oP \"(a-zA-Z0-9_-+\\.)+example\\.com\" | sort -u assetfinder --subs-only example.com findomain -t example.com I extracted the top three-level subdomains using the below command:awk -F. '{n=NF; if(n>=3) print $(n-2)\".\"$(n-1)\".\"$n; else print $0}' subdomain.txt | sort -u > top3_subdomains.txt Then performed subdomain enumeration on each of them using the tools mentioned above. I merged the results and filtered them through httpx to see which ones were alive:cat final_subdomain.txt | httpx -ports 80,443,8080,8000,8888 -threads 200Phase 4: Found It Eventually, I found a couple of suspicious-looking Grafana panels. I took the known payload for CVE-2025\u20134123 and crafted this URL:https://grafana.x.y.example.com/public/..%2F%5cevil.com%2F%3f%2F..%2F.. I opened the link, waited for a second \u2014 and it redirected. This was it. The vulnerability was real, and it was exploitable.What I Learned Some takeaways that might help others:Enumeration is more than just running a tool. Mix and match methods.Fresh CVEs are goldmines \u2014 if you move early.Don\u2019t stop at rejection. Analyze why it failed, adjust, and retry.Always document your process \u2014 clean, reproducible reports are key.Referenceshttps://medium.com/@Nightbloodz/grafana-cve-2025-4123-full-read-ssrf-account-takeover-d12abd13cd53Wrapping Up Bug hunting isn\u2019t about luck. It\u2019s about persistence, timing, and understanding systems deeply. Not everything you find will be useful \u2014 but every failed attempt sharpens your instincts.\u201cDon\u2019t aim for the trophy. Aim for the process. The trophy will follow.\u201d \u2014 Hack-Bat My Journey to NASA\u2019s Hall of Fame was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.\nRead more...", "creation_timestamp": "2026-09-04T00:00:53.860158Z"} {"uuid": "ab7b3eff-d40b-4eef-91e5-f7933a2f251c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-4123", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/161216", "content": "My Journey to NASA\u2019s Hall of Fame\n\nHi, I\u2019m Dharineesh, AKA Hack-Bat, and this is the story of how I ended up being listed in the NASA Hall of Fame. It wasn\u2019t a smooth ride. The path was filled with long nights, false hopes, and a lot of second-guessing. But every time I stumbled, I asked myself a simple question: \u201cstay down or get up\u201d \u2014 and I got back up. Here\u2019s how things unfolded.Phase 1: Google Dorking I began with what a lot of bug hunters do: Google Dorking. It\u2019s like looking for needles in a haystack using smart magnets \u2014 crafting specific search queries to find misconfigurations, exposed credentials, and more. I spent days digging through public directories, login portals, and possible leaked documents. Some of it looked promising. But when I submitted those finds, they came back as \u201cNot Applicable\u201d. That happened not once, not twice, but five times in a row. At that point, I was frustrated. But something in me said: You\u2019ve made it this far. Keep going.Phase 2: The Game-Changer \u2014 CVE-2025\u20134123 That\u2019s when I came across a fresh CVE \u2014 CVE-2025\u20134123 \u2014 tied to Grafana, it is an open-source web application used for analytics and interactive data visualization. It\u2019s widely used for monitoring application performance, visualizing metrics, and configuring alerts. The vulnerability allowed attackers to:Redirect users through open redirect flawsPull off SSRF attacks to query internal servicesTrigger account takeover using XSS This was a big deal. Now I just had to find an exposed Grafana instance. Simple in theory, a grind in reality.Phase 3: The Subdomain Hunt This is where things got messy \u2014 in a good way. Finding Grafana meant doing massive subdomain enumeration. I couldn\u2019t rely on just one tool. Here\u2019s the combo that worked:subfinder -d example.com curl -s \"https://crt.sh/?q=%25.example.com\" | grep -oP \"(a-zA-Z0-9_-+\\.)+example\\.com\" | sort -u assetfinder --subs-only example.com findomain -t example.com I extracted the top three-level subdomains using the below command:awk -F. '{n=NF; if(n>=3) print $(n-2)\".\"$(n-1)\".\"$n; else print $0}' subdomain.txt | sort -u > top3_subdomains.txt Then performed subdomain enumeration on each of them using the tools mentioned above. I merged the results and filtered them through httpx to see which ones were alive:cat final_subdomain.txt | httpx -ports 80,443,8080,8000,8888 -threads 200Phase 4: Found It Eventually, I found a couple of suspicious-looking Grafana panels. I took the known payload for CVE-2025\u20134123 and crafted this URL:https://grafana.x.y.example.com/public/..%2F%5cevil.com%2F%3f%2F..%2F.. I opened the link, waited for a second \u2014 and it redirected. This was it. The vulnerability was real, and it was exploitable.What I Learned Some takeaways that might help others:Enumeration is more than just running a tool. Mix and match methods.Fresh CVEs are goldmines \u2014 if you move early.Don\u2019t stop at rejection. Analyze why it failed, adjust, and retry.Always document your process \u2014 clean, reproducible reports are key.Referenceshttps://medium.com/@Nightbloodz/grafana-cve-2025-4123-full-read-ssrf-account-takeover-d12abd13cd53Wrapping Up Bug hunting isn\u2019t about luck. It\u2019s about persistence, timing, and understanding systems deeply. Not everything you find will be useful \u2014 but every failed attempt sharpens your instincts.\u201cDon\u2019t aim for the trophy. Aim for the process. The trophy will follow.\u201d \u2014 Hack-Bat My Journey to NASA\u2019s Hall of Fame was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.\nRead more...", "creation_timestamp": "2026-09-04T00:00:53.860158Z"} https://vulnerability.circl.lu/sighting/ab7b3eff-d40b-4eef-91e5-f7933a2f251c/export Fri, 04 Sep 2026 00:00:53 +0000 https://vulnerability.circl.lu/sighting/b8ef8ad3-a039-4fb1-a0ac-b2cb8e946061/export {"uuid": "b8ef8ad3-a039-4fb1-a0ac-b2cb8e946061", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-4123", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/161473", "content": "How One Path Traversal in Grafana Unleashed XSS, Open Redirect and SSRF (CVE-2025\u20134123)\nhttps://infosecwriteups.com/how-one-path-traversal-in-grafana-unleashed-xss-open-redirect-and-ssrf-cve-2025-4123-b35245dccaab?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-04T00:00:53.806546Z"} {"uuid": "b8ef8ad3-a039-4fb1-a0ac-b2cb8e946061", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-4123", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/161473", "content": "How One Path Traversal in Grafana Unleashed XSS, Open Redirect and SSRF (CVE-2025\u20134123)\nhttps://infosecwriteups.com/how-one-path-traversal-in-grafana-unleashed-xss-open-redirect-and-ssrf-cve-2025-4123-b35245dccaab?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-04T00:00:53.806546Z"} https://vulnerability.circl.lu/sighting/b8ef8ad3-a039-4fb1-a0ac-b2cb8e946061/export Fri, 04 Sep 2026 00:00:53 +0000