{"vulnerability": "CVE-2025-49132", "sightings": [{"uuid": "e31465f6-3c0a-477e-82fc-5763187fb626", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3lryy2wn5el2q", "content": "", "creation_timestamp": "2025-06-20T02:20:35.305825Z"}, {"uuid": "023206fd-dbc6-4f45-a9f6-f8b00bebe63c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/114774523160573694", "content": "", "creation_timestamp": "2025-06-30T21:50:39.331633Z"}, {"uuid": "4fc82c8a-2eaf-4738-8af3-ecf6e9bfeb15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/114716930881228437", "content": "", "creation_timestamp": "2025-06-20T17:44:10.828750Z"}, {"uuid": "ff2c7736-efa5-4b11-80c2-08ff77b29969", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "seen", "source": "https://bsky.app/profile/nimblenerd.social/post/3lsiewecy5y26", "content": "", "creation_timestamp": "2025-06-26T05:20:36.840545Z"}, {"uuid": "19b04063-3cdf-41a9-a3ce-7708c2fff36b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ls2x4qkoyb2k", "content": "", "creation_timestamp": "2025-06-20T21:09:01.386846Z"}, {"uuid": "99c15072-c534-4d1b-af8e-ab48fb57885a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-49132.yaml", "content": "", "creation_timestamp": "2025-06-21T00:25:48.000000Z"}, {"uuid": "11e3d0e0-162c-4375-861d-fcfecd9ba33b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lsmjzbcxuv24", "content": "", "creation_timestamp": "2025-06-27T21:02:30.338282Z"}, {"uuid": "57840bc8-e0b3-4cdc-9df2-22dce2c2df83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "seen", "source": "https://gist.github.com/Dann0010/e98cde759f5f74b5f8c24599a6001d99", "content": "", "creation_timestamp": "2025-06-21T16:03:53.000000Z"}, {"uuid": "acd67ea5-0fe7-4069-a644-33408062732a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3ls5h7o3ard2h", "content": "", "creation_timestamp": "2025-06-21T21:02:23.728576Z"}, {"uuid": "36c023d5-ac3c-4895-8909-de6d7550200f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3ls5wby6yek25", "content": "", "creation_timestamp": "2025-06-22T01:32:03.538429Z"}, {"uuid": "d15796c5-c1dd-45b6-b742-f088a211703b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lseymlmvmi2h", "content": "", "creation_timestamp": "2025-06-24T21:02:29.053072Z"}, {"uuid": "3337b0c7-1fb5-4623-b944-d627a8a6a2b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "seen", "source": "https://bsky.app/profile/ryan.staticnoi.se/post/3lrxycurark2g", "content": "", "creation_timestamp": "2025-06-19T16:52:25.309418Z"}, {"uuid": "b3b5d85b-2da6-4c15-8568-d4ab03ecdd47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "seen", "source": "https://bsky.app/profile/ryan.staticnoi.se/post/3lrxycwhe7s2g", "content": "", "creation_timestamp": "2025-06-19T16:52:25.858146Z"}, {"uuid": "d9d905a7-2c4f-443e-b99c-2719ea41eb77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "seen", "source": "https://bsky.app/profile/ntkramer.bsky.social/post/3lu4fconj6f25", "content": "", "creation_timestamp": "2025-07-16T21:45:55.973694Z"}, {"uuid": "ee611c67-664c-432e-a539-5026e5c25585", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "seen", "source": "https://bsky.app/profile/ntkramer.bsky.social/post/3lu4fcthb542a", "content": "", "creation_timestamp": "2025-07-16T21:46:01.063824Z"}, {"uuid": "3ca410a4-4a95-4da8-9d76-39491b071c5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "seen", "source": "https://infosec.exchange/users/ntkramer/statuses/114865100482587912", "content": "", "creation_timestamp": "2025-07-16T21:46:49.141184Z"}, {"uuid": "5d61685d-c214-4507-ab75-10f978865282", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/rRcKRxKabz2qESPpdetVuiSVozhY10EMS-voIXs0I8ELfIA", "content": "", "creation_timestamp": "2025-11-30T21:00:05.000000Z"}, {"uuid": "5e4d2c6d-023d-4b96-a5f5-e7059a91fec8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/61217", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aAnalysis and reproduction of CVE-2025-57833\nURL\uff1ahttps://github.com/f3d0rq/CVE-2025-49132\n\n\u6807\u7b7e\uff1a#CVE-2025", "creation_timestamp": "2025-11-30T16:37:28.000000Z"}, {"uuid": "01ebe1a4-e1d9-4096-9ed6-c66fca813b40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "seen", "source": "Telegram/UQbDwBJf9eGeYIZnvSzMssPCMnZFfaxzqfveo0nsduL7XA", "content": "", "creation_timestamp": "2025-06-30T22:56:48.000000Z"}, {"uuid": "eb0f8ca1-fb81-4097-8736-c185818c42bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/sIxRHxrE63FEI5aN4pmB7Ch2tWWUf2QeGGZaTDv-SjnpCes", "content": "", "creation_timestamp": "2025-06-22T19:00:05.000000Z"}, {"uuid": "57261a36-ee04-4dc1-94bb-ad789c833c0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/jQQxeN2mPQPtfMYo_To2hQ-_smSd26JApgUtHwY05JTWW84", "content": "", "creation_timestamp": "2026-04-08T21:00:04.000000Z"}, {"uuid": "d21f6ad3-a340-4c90-868b-2858839a9a13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/eiq80vTfK0uEvpSaVkLstXl9YEDfyEgGUyA39bKhe3J3sOM", "content": "", "creation_timestamp": "2026-04-24T09:00:04.000000Z"}, {"uuid": "a87df375-b70c-4a21-94f2-7ea90bfe94d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/19004", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-49132\n\ud83d\udd25 CVSS Score: 10 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\n\ud83d\udd39 Description: Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information from the database, access files of servers managed by the panel, etc. This issue has been patched in version 1.11.11. There are no software workarounds for this vulnerability, but use of an external Web Application Firewall (WAF) could help mitigate this attack.\n\ud83d\udccf Published: 2025-06-20T16:56:41.403Z\n\ud83d\udccf Modified: 2025-06-20T17:34:24.439Z\n\ud83d\udd17 References:\n1. https://github.com/pterodactyl/panel/security/advisories/GHSA-24wv-6c99-f843\n2. https://github.com/pterodactyl/panel/commit/24c82b0e335fb5d7a844226b08abf9f176e592f0\n3. https://github.com/pterodactyl/panel/releases/tag/v1.11.11", "creation_timestamp": "2025-06-20T17:46:19.000000Z"}, {"uuid": "d964f68f-1b48-4074-b93b-481faaa62966", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/41879", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aScanner - CVE-2025-49132\nURL\uff1ahttps://github.com/melonlonmeo/CVE-2025-49132\n\n\u6807\u7b7e\uff1a#CVE-2025", "creation_timestamp": "2025-06-25T18:07:01.000000Z"}, {"uuid": "11713365-0038-4110-a3a2-eb57c54421dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/41452", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aA script that gives you the credentials of a Pterodactyl panel vulnerable to CVE-2025-49132\nURL\uff1ahttps://github.com/Zen-kun04/CVE-2025-49132\n\n\u6807\u7b7e\uff1a#CVE-2025", "creation_timestamp": "2025-06-22T13:10:48.000000Z"}, {"uuid": "90547275-d590-4c8c-a6ea-6aa1423740d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/48164", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aThis is an improved version of the CVE-2025-49132 proof of concept exploit.\nURL\uff1ahttps://github.com/GRodolphe/CVE-2025-49132_poc\n\n\u6807\u7b7e\uff1a#CVE-2025", "creation_timestamp": "2025-08-18T12:11:52.000000Z"}, {"uuid": "ab37f6f6-6cb3-4e05-9504-952cc4ee1de7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/53064", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aCVE-2025-49132\nURL\uff1ahttps://github.com/WebSafety-2tina/CVE-2025-49132\n\n\u6807\u7b7e\uff1a#CVE-2025", "creation_timestamp": "2025-09-25T15:58:27.000000Z"}, {"uuid": "0b6c9486-2ddb-4327-84e4-985b85bc5c4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/nSwOy8pXq7qxZ5lkghM_Fx4RBE1W5qtoDb6yqsk5rMk6h6Y", "content": "", "creation_timestamp": "2025-09-25T21:00:06.000000Z"}, {"uuid": "110384d1-cc8f-418c-8338-53b9e1846b4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/rMGPEftinAjzKoR_zE8SBGcQ2vzrHmgR3TCsszmfdrU6i-0", "content": "", "creation_timestamp": "2025-08-18T15:00:06.000000Z"}, {"uuid": "0faeef6b-162e-4a93-8558-9c5f39e44c90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/zgFBnkvVSxRTeAkLtgRFUn68oK3AG1ffjg88xq_I-KMhHIo", "content": "", "creation_timestamp": "2025-08-18T23:00:08.000000Z"}, {"uuid": "847f173c-f3b0-4616-b693-9f1fbcd2a91a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/89WmP_gC2SHosMsiUrRK7pT8KuQvaqUcBa2DausPuvIklXc", "content": "", "creation_timestamp": "2025-07-04T15:00:11.000000Z"}, {"uuid": "f4cdbf95-aaab-4bfc-8509-cbd8e8b1baf3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/zjpS5O5pgCt8maWAaOuHWxccKj7wUs1tT4M9oy_Y1o38DLE", "content": "", "creation_timestamp": "2025-07-04T09:00:05.000000Z"}, {"uuid": "06ff52d3-f931-45c4-b8f4-1dc4f55b10bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/-VwGhvHbAqGxMoIqAuNl2S-GtS9GOszjSHCSlHw-Z7vkd70", "content": "", "creation_timestamp": "2025-06-26T15:00:10.000000Z"}, {"uuid": "7d69869e-e342-4d87-b5bd-ad483023a931", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/sIKwSeNUpe7JNZeJNh_vlAgf4HoS_EvEcDsmJEUgRhpauHM", "content": "", "creation_timestamp": "2025-06-25T07:00:06.000000Z"}, {"uuid": "1aa0ba40-0603-417c-bb5f-3985bbf768c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/pUfnhaLV4iQSz5wNjxln12A4BK4d06xT0RCTqD4hn9oNJp0", "content": "", "creation_timestamp": "2025-06-25T03:00:05.000000Z"}, {"uuid": "6ecf7840-72ee-454d-8474-30a372e7ee18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/INbhvu6suw58y9HrUal3G_Q-Sx3WcR9t4iYviK9OyeuUsQE", "content": "", "creation_timestamp": "2025-06-25T21:00:04.000000Z"}, {"uuid": "de3e86ff-098f-45a2-a4b3-4059a2efc89c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/19EMVZIHpcnMlAoFeCqFg_0vg5TINRuzyp1l3_kYKW1wZpE", "content": "", "creation_timestamp": "2025-06-22T21:00:05.000000Z"}, {"uuid": "6e601a63-6162-41c3-831e-865d572311b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/X5o6JxwVyT7kcEs2WJ4q2ZFDLNC-MBNLMsHZTgnAYZthkfU", "content": "", "creation_timestamp": "2025-06-24T03:00:07.000000Z"}, {"uuid": "ed85d7e1-ac6a-447e-abb0-4a1cc0c5ca4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/j3gTMMDHI3yNpDteSce5I1RswvqpujBgNmLdEQTPSBddd3I", "content": "", "creation_timestamp": "2025-06-24T03:00:05.000000Z"}, {"uuid": "35a059c3-c272-4523-bb5e-5cbf7b882996", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/CcyjHkNjVgkEwMecQxDV2tqoHdYRDeP6dqEdCkr6R7KZfXo", "content": "", "creation_timestamp": "2025-06-23T03:00:06.000000Z"}, {"uuid": "3096b497-fd3f-4297-81e0-327419a5176d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/sDe_NvnZzosyJDQL5AFCzTRjhrPu0XzfD6ayEIcobXB5NsE", "content": "", "creation_timestamp": "2025-06-23T09:00:05.000000Z"}, {"uuid": "a3d7b6f7-1f4f-426a-8fb9-b00199dfdb6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "seen", "source": "https://t.me/bagl3y_notes/265", "content": "\ud83c\udd95 \u041d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434\u0435\u043e-\u0440\u0430\u0437\u0431\u043e\u0440 \u0442\u0430\u0447\u043a\u0438 \ud83d\udc9a (HackTheBox) \u043e\u0442 ippsec'a\n\n\n\u2049\ufe0f   Pterodactyl - \u0441\u0430\u0439\u0442 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430 Minecraft, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0430\u043d\u0435\u043b\u044c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0433\u0440\u043e\u0432\u044b\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c panel.pterodactyl.htb (\u043f\u043e\u0441\u043b\u0435 \u0444\u0430\u0437\u0437\u0438\u043d\u0433\u0430 VHosts) \u27a1\ufe0f \u041e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u043c \u0442\u043e\u0447\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u043f\u0430\u043d\u0435\u043b\u0438 \u043f\u043e \u0431\u0430\u043d\u0434\u043b\u0430\u043c JS/CSS \u0438 release\u2011\u043d\u043e\u0442\u0430\u043c (\u0432\u0435\u0440\u0441\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u0430 \u043a CVE-2025-49132\u00a0- LFI \u0431\u0430\u0433\u0430 \u0432 locale\u2011\u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u0435: curl 'http://panel.pterodactyl.htb/locales/locale.json?locale=../../config&namespace=database' -s | jq .) \u27a1\ufe0f \u0427\u0435\u0439\u043d\u0438\u043c LFI \u0441 \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u043c PEAR (pearcmd.php) \u0442\u0440\u044e\u043a\u043e\u043c \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0432\u0435\u0431\u2011\u0448\u0435\u043b\u043b\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f RCE (PayloadsAllTheThings \u0432 \u043f\u043e\u043c\u043e\u0449\u044c) \u27a1\ufe0f \u0414\u043b\u044f root'\u0430 \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c CopyFail\u00a0\u0438\u043b\u0438\u00a0DirtyFrag, \u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c Fragnesia? (\u0447\u0435\u0433\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0435 \u043d\u0430\u0448\u043b\u0438 \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f); \u041d\u043e \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 - \u0441\u0432\u044f\u0437\u043a\u0430 udisksd + libblockdev \u0441\u00a0allow_active\u00a0\u0438 XFS\u2011\u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0441 SUID\u2011\u0448\u0435\u043b\u043b\u043e\u043c\u00a0(CVE-2025-6018 - \u0431\u0430\u0433 \u0432 \u0442\u043e\u043c, \u043a\u0430\u043a polkit / PAM / allow_active \u0442\u0440\u0430\u043a\u0442\u0443\u044e\u0442 \u00abactive user\u00bb \u0434\u043b\u044f udisksd, CVE-2025-6019 - \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0447\u0435\u0440\u0435\u0437 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043a\u0440\u0430\u0444\u0447\u0435\u043d\u043d\u044b\u0439 XFS\u2011\u043e\u0431\u0440\u0430\u0437 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u0435\u0437\u00a0nosuid); \u0442\u0443\u0442 \u043d\u0435\u043f\u043b\u043e\u0445\u043e\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u044d\u0442\u043e\u0433\u043e LPE\n\n\n#\ufe0f\u20e3\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u043e Linux box - Pterodactyl, \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 Medium\n#\ufe0f\u20e3 \u0410 \u0432\u043e\u0442 \u0435\u0449\u0435 \u0440\u0430\u0437\u0431\u043e\u0440 \u043e\u0442 \u043a\u0440\u0443\u0442\u043e\u0433\u043e \u0447\u0435\u043b\u0430 - 0xdf\n\n\n\ud83c\udf39 \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u043e\u0441\u0442\u044b \u043a\u0430\u043d\u0430\u043b\u0430 \n\n#video #HTB #ippsec #0xdf #Walkthroughs", "creation_timestamp": "2026-08-04T13:00:25.552912Z"}, {"uuid": "593e0bfe-a0d8-4691-857b-2b7bd916cab5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "seen", "source": "https://t.me/bagl3y_notes/265", "content": "\ud83c\udd95 \u041d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434\u0435\u043e-\u0440\u0430\u0437\u0431\u043e\u0440 \u0442\u0430\u0447\u043a\u0438 \ud83d\udc9a (HackTheBox) \u043e\u0442 ippsec'a\n\n\n\u2049\ufe0f   Pterodactyl - \u0441\u0430\u0439\u0442 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430 Minecraft, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0430\u043d\u0435\u043b\u044c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0433\u0440\u043e\u0432\u044b\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c panel.pterodactyl.htb (\u043f\u043e\u0441\u043b\u0435 \u0444\u0430\u0437\u0437\u0438\u043d\u0433\u0430 VHosts) \u27a1\ufe0f \u041e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u043c \u0442\u043e\u0447\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u043f\u0430\u043d\u0435\u043b\u0438 \u043f\u043e \u0431\u0430\u043d\u0434\u043b\u0430\u043c JS/CSS \u0438 release\u2011\u043d\u043e\u0442\u0430\u043c (\u0432\u0435\u0440\u0441\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u0430 \u043a CVE-2025-49132\u00a0- LFI \u0431\u0430\u0433\u0430 \u0432 locale\u2011\u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u0435: curl 'http://panel.pterodactyl.htb/locales/locale.json?locale=../../config&namespace=database' -s | jq .) \u27a1\ufe0f \u0427\u0435\u0439\u043d\u0438\u043c LFI \u0441 \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u043c PEAR (pearcmd.php) \u0442\u0440\u044e\u043a\u043e\u043c \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0432\u0435\u0431\u2011\u0448\u0435\u043b\u043b\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f RCE (PayloadsAllTheThings \u0432 \u043f\u043e\u043c\u043e\u0449\u044c) \u27a1\ufe0f \u0414\u043b\u044f root'\u0430 \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c CopyFail\u00a0\u0438\u043b\u0438\u00a0DirtyFrag, \u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c Fragnesia? (\u0447\u0435\u0433\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0435 \u043d\u0430\u0448\u043b\u0438 \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f); \u041d\u043e \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 - \u0441\u0432\u044f\u0437\u043a\u0430 udisksd + libblockdev \u0441\u00a0allow_active\u00a0\u0438 XFS\u2011\u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0441 SUID\u2011\u0448\u0435\u043b\u043b\u043e\u043c\u00a0(CVE-2025-6018 - \u0431\u0430\u0433 \u0432 \u0442\u043e\u043c, \u043a\u0430\u043a polkit / PAM / allow_active \u0442\u0440\u0430\u043a\u0442\u0443\u044e\u0442 \u00abactive user\u00bb \u0434\u043b\u044f udisksd, CVE-2025-6019 - \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0447\u0435\u0440\u0435\u0437 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043a\u0440\u0430\u0444\u0447\u0435\u043d\u043d\u044b\u0439 XFS\u2011\u043e\u0431\u0440\u0430\u0437 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u0435\u0437\u00a0nosuid); \u0442\u0443\u0442 \u043d\u0435\u043f\u043b\u043e\u0445\u043e\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u044d\u0442\u043e\u0433\u043e LPE\n\n\n#\ufe0f\u20e3\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u043e Linux box - Pterodactyl, \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 Medium\n#\ufe0f\u20e3 \u0410 \u0432\u043e\u0442 \u0435\u0449\u0435 \u0440\u0430\u0437\u0431\u043e\u0440 \u043e\u0442 \u043a\u0440\u0443\u0442\u043e\u0433\u043e \u0447\u0435\u043b\u0430 - 0xdf\n\n\n\ud83c\udf39 \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u043e\u0441\u0442\u044b \u043a\u0430\u043d\u0430\u043b\u0430 \n\n#video #HTB #ippsec #0xdf #Walkthroughs", "creation_timestamp": "2026-08-05T00:00:41.185772Z"}, {"uuid": "c26b8361-ac9f-47c9-8044-4b11e8c7f8ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "https://t.me/bagl3y_notes/265", "content": "\ud83c\udd95 \u041d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434\u0435\u043e-\u0440\u0430\u0437\u0431\u043e\u0440 \u0442\u0430\u0447\u043a\u0438 \ud83d\udc9a (HackTheBox) \u043e\u0442 ippsec'a\n\n\n\u2049\ufe0f   Pterodactyl - \u0441\u0430\u0439\u0442 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430 Minecraft, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0430\u043d\u0435\u043b\u044c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0433\u0440\u043e\u0432\u044b\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c panel.pterodactyl.htb (\u043f\u043e\u0441\u043b\u0435 \u0444\u0430\u0437\u0437\u0438\u043d\u0433\u0430 VHosts) \u27a1\ufe0f \u041e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u043c \u0442\u043e\u0447\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u043f\u0430\u043d\u0435\u043b\u0438 \u043f\u043e \u0431\u0430\u043d\u0434\u043b\u0430\u043c JS/CSS \u0438 release\u2011\u043d\u043e\u0442\u0430\u043c (\u0432\u0435\u0440\u0441\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u0430 \u043a CVE-2025-49132\u00a0- LFI \u0431\u0430\u0433\u0430 \u0432 locale\u2011\u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u0435: curl 'http://panel.pterodactyl.htb/locales/locale.json?locale=../../config&namespace=database' -s | jq .) \u27a1\ufe0f \u0427\u0435\u0439\u043d\u0438\u043c LFI \u0441 \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u043c PEAR (pearcmd.php) \u0442\u0440\u044e\u043a\u043e\u043c \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0432\u0435\u0431\u2011\u0448\u0435\u043b\u043b\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f RCE (PayloadsAllTheThings \u0432 \u043f\u043e\u043c\u043e\u0449\u044c) \u27a1\ufe0f \u0414\u043b\u044f root'\u0430 \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c CopyFail\u00a0\u0438\u043b\u0438\u00a0DirtyFrag, \u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c Fragnesia? (\u0447\u0435\u0433\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0435 \u043d\u0430\u0448\u043b\u0438 \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f); \u041d\u043e \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 - \u0441\u0432\u044f\u0437\u043a\u0430 udisksd + libblockdev \u0441\u00a0allow_active\u00a0\u0438 XFS\u2011\u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0441 SUID\u2011\u0448\u0435\u043b\u043b\u043e\u043c\u00a0(CVE-2025-6018 - \u0431\u0430\u0433 \u0432 \u0442\u043e\u043c, \u043a\u0430\u043a polkit / PAM / allow_active \u0442\u0440\u0430\u043a\u0442\u0443\u044e\u0442 \u00abactive user\u00bb \u0434\u043b\u044f udisksd, CVE-2025-6019 - \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0447\u0435\u0440\u0435\u0437 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043a\u0440\u0430\u0444\u0447\u0435\u043d\u043d\u044b\u0439 XFS\u2011\u043e\u0431\u0440\u0430\u0437 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u0435\u0437\u00a0nosuid); \u0442\u0443\u0442 \u043d\u0435\u043f\u043b\u043e\u0445\u043e\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u044d\u0442\u043e\u0433\u043e LPE\n\n\n#\ufe0f\u20e3\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u043e Linux box - Pterodactyl, \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 Medium\n#\ufe0f\u20e3 \u0410 \u0432\u043e\u0442 \u0435\u0449\u0435 \u0440\u0430\u0437\u0431\u043e\u0440 \u043e\u0442 \u043a\u0440\u0443\u0442\u043e\u0433\u043e \u0447\u0435\u043b\u0430 - 0xdf\n\n\n\ud83c\udf39 \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u043e\u0441\u0442\u044b \u043a\u0430\u043d\u0430\u043b\u0430 \n\n#video #HTB #ippsec #0xdf #Walkthroughs", "creation_timestamp": "2026-08-06T00:00:40.546662Z"}, {"uuid": "5048edf5-1afa-45a3-ac3e-b979a6b95991", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/I55EnFdJmYEBchmRtkjPCUSn7qv5UvMe7YwNG8H83xOzV0w", "content": "", "creation_timestamp": "2026-06-05T15:00:18.000000Z"}, {"uuid": "cf4d3284-ba56-49c7-a5ec-6fa3c33ea88a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/tYXjtXGvZOcVL05bpL_3O2jX-Uki9x_dAhf7v1swcwhwyfI", "content": "", "creation_timestamp": "2026-08-28T00:00:31.291426Z"}, {"uuid": "08e30de6-e1ac-459d-92e6-c2478708fe90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "seen", "source": "https://t.me/cve0day/238", "content": "CVE-2025-49132\n\nPterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information from the database, access files of servers managed by the panel, etc. This issue has been patched in version 1.11.11. There are no software workarounds for this vulnerability, but use of an external Web Application Firewall (WAF) could help mitigate this attack.\n\nGitHub Link:\nhttps://github.com/popyue/CVE-2025-49132", "creation_timestamp": "2026-08-28T00:00:42.068029Z"}, {"uuid": "fc917146-3ea3-4e86-88a5-dd324dca73c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "seen", "source": "https://t.me/cve0day/238", "content": "CVE-2025-49132\n\nPterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information from the database, access files of servers managed by the panel, etc. This issue has been patched in version 1.11.11. There are no software workarounds for this vulnerability, but use of an external Web Application Firewall (WAF) could help mitigate this attack.\n\nGitHub Link:\nhttps://github.com/popyue/CVE-2025-49132", "creation_timestamp": "2026-08-27T15:00:13.088177Z"}, {"uuid": "f91d1885-71dc-4fa6-9215-2973c48bfb5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "Telegram/tYXjtXGvZOcVL05bpL_3O2jX-Uki9x_dAhf7v1swcwhwyfI", "content": "", "creation_timestamp": "2026-08-27T20:00:11.878594Z"}, {"uuid": "b976d3f6-b033-4aa5-870d-4f5a00640959", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49132", "type": "published-proof-of-concept", "source": "https://t.me/cve0day/238", "content": "CVE-2025-49132\n\nPterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information from the database, access files of servers managed by the panel, etc. This issue has been patched in version 1.11.11. There are no software workarounds for this vulnerability, but use of an external Web Application Firewall (WAF) could help mitigate this attack.\n\nGitHub Link:\nhttps://github.com/popyue/CVE-2025-49132", "creation_timestamp": "2026-08-29T00:00:29.994169Z"}]}