{"vulnerability": "cve-2022-3998", "sightings": [{"uuid": "de0fa623-9088-41e6-b98a-1f9e8d7f3332", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39986", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "b25c25d9-1000-41e5-905b-b621e1f5ccb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39986", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-01-26)", "content": "", "creation_timestamp": "2025-01-26T00:00:00.000000Z"}, {"uuid": "afdf7b7d-e376-44bc-8679-5c547a062ffd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39986", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-02-10)", "content": "", "creation_timestamp": "2025-02-10T00:00:00.000000Z"}, {"uuid": "405020b1-16c6-4a83-9f31-37db9af0a781", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39986", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:48.000000Z"}, {"uuid": "b244a785-c7db-4795-95c1-67fada1d1e68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39986", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-02-22)", "content": "", "creation_timestamp": "2025-02-22T00:00:00.000000Z"}, {"uuid": "d8349a5d-30ec-4fa5-93c7-c1ff8095ce5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39986", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/raspap_rce.rb", "content": "", "creation_timestamp": "2023-08-15T03:51:23.000000Z"}, {"uuid": "552a954c-aea7-4f1d-a5f4-d89c9c5d26f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39986", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-09-19)", "content": "", "creation_timestamp": "2025-09-19T00:00:00.000000Z"}, {"uuid": "6837dae0-eff7-4eb0-852e-af7471c3d8b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39986", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:13:00.000000Z"}, {"uuid": "65af1123-1aad-4759-a8a5-b828d8dc4e77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39986", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-11-09)", "content": "", "creation_timestamp": "2025-11-09T00:00:00.000000Z"}, {"uuid": "761637c5-f33f-4038-9305-9395d82bb3d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39986", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-14)", "content": "", "creation_timestamp": "2026-03-14T00:00:00.000000Z"}, {"uuid": "428ffa78-5665-4708-aad2-6eee74adc92a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39986", "type": "published-proof-of-concept", "source": "https://t.me/dilagrafie/3169", "content": "Hackers Factory \n\nlazy way to create CVE-2023-38831 winrar file for testing\n\nhttps://github.com/BoredHackerBlog/winrar_CVE-2023-38831_lazy_poc\n\nCVE-2022-39986 PoC\n\nhttps://github.com/WhiteOwl-Pub/RaspAP-CVE-2022-39986-PoC\n\nCommunity curated list of nuclei templates for finding \"unknown\" security vulnerabilities.\n\nhttps://github.com/projectdiscovery/fuzzing-templates\n\nHVCI-loldrivers-check\nChecks to see which drivers from loldrivers.io are not blocked by the current HVCI blocklist on the system.\n\nhttps://github.com/trailofbits/HVCI-loldrivers-check\n\nGolang Secure Coding Practices guide\n\nhttps://github.com/OWASP/Go-SCP\n\n#exploit\n1. CVE-2023-36844, CVE-2023-36845,\nCVE-2023-36846, CVE-2023-36847:\nRCE in Juniper JunOS within SRX/EX Series products\n\nhttps://github.com/watchtowrlabs/juniper-rce_cve-2023-36844\n\n2. CVE-2023-41080:\nApache Tomcat FORM Authentication redirect\n\nhttps://github.com/shiomiyan/CVE-2023-41080\n\nEvolutionary encryption framework based on scalable complexity over time.\n\nhttps://github.com/jofpin/temcrypt\n\nSome of my rough notes for Docker threat detection\n\nhttps://github.com/Antonlovesdnb/DockerDetectionNotes\n\nBash Script to extract GNU/Linux forensic artifacts for digital forensic analysis and incident response.\n\nhttps://github.com/ozpingux/BasicLinuxForensicScript\n\nyou want an #investigation on user accounts,  \n\nSnoop, a #cli #python #tool, scans various sites, forums, and social networks for the presence of the username.\n\ngithub.com/snooppr/snoop\n\n#infosec #cybersecurity #hackersfactory\n\nhttps://t.me/dilagrafie", "creation_timestamp": "2023-08-27T17:49:56.000000Z"}, {"uuid": "a3e20fbc-9d18-4343-94e1-2214c9e89519", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39987", "type": "seen", "source": "https://t.me/cibsecurity/67519", "content": "\u203c CVE-2022-39987 \u203c\n\nA Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via the \"entity\" POST parameters in /ajax/networking/get_wgkey.php.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-08-01T18:38:54.000000Z"}, {"uuid": "d61ae6ea-fba8-4c8a-968d-b4ad032fe324", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39986", "type": "seen", "source": "https://t.me/cibsecurity/67513", "content": "\u203c CVE-2022-39986 \u203c\n\nA Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-08-01T18:38:44.000000Z"}, {"uuid": "3fb623b3-e376-4aa2-a703-64cbba86d0ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39989", "type": "seen", "source": "https://t.me/cibsecurity/62897", "content": "\u203c CVE-2022-39989 \u203c\n\nAn issue was discovered in Fighting Cock Information System 1.0, which uses default credentials, but does not force nor prompt the administrators to change the credentials.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-04-26T18:25:51.000000Z"}, {"uuid": "9503ec0f-ff50-4bdb-8635-38239b7b6b46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39983", "type": "seen", "source": "https://t.me/cibsecurity/58722", "content": "\u203c CVE-2022-39983 \u203c\n\nFile upload vulnerability in Instantdeveloper RD3 22.0.8500, allows attackers to execute arbitrary code.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-02-23T00:52:22.000000Z"}, {"uuid": "66810d25-70c1-4df5-9815-1131efb7d2bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39988", "type": "seen", "source": "https://t.me/cibsecurity/50912", "content": "\u203c CVE-2022-39988 \u203c\n\nA cross-site scripting (XSS) vulnerability in Centreon 22.04.0 allows attackers to execute arbitrary web script or HTML via a crafted payload injected into the Service>Templates service_alias parameter.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-10-06T22:17:04.000000Z"}, {"uuid": "48c72d1a-58ef-4fb2-b159-3f9ce7f2c8ca", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39986", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9e097dc2-1442-4831-999e-36082a9e6dea", "content": "", "creation_timestamp": "2026-06-19T12:45:53.321934Z"}, {"uuid": "993786a7-d9bc-4ff1-bac2-e521093c0acf", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39986", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8cc134a5-8832-4eda-b60e-94d3455778d1", "content": "", "creation_timestamp": "2026-06-23T14:03:18.937597Z"}, {"uuid": "c8abc1a3-20ba-4b52-8abe-6bac9dc7d8b6", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2022-39986", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/cc21926e-2250-4c20-9f6e-6cf1e393553e", "content": "", "creation_timestamp": "2026-06-30T09:23:06.102714Z"}, {"uuid": "7e9e7197-17d4-4d42-b879-bf1c9dc9b061", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39986", "type": "seen", "source": "https://t.me/CVEhub/19176", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2022\nName: *RaspAP-CVE-2022-39986-PoC*\nGithub: https://github.com/WhiteOwl-Pub/RaspAP-CVE-2022-39986-PoC", "creation_timestamp": "2026-07-29T12:00:06.631975Z"}, {"uuid": "3f4c59d7-16a1-4aa6-80f7-53c6ac100ffa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39986", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/19176", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2022\nName: *RaspAP-CVE-2022-39986-PoC*\nGithub: https://github.com/WhiteOwl-Pub/RaspAP-CVE-2022-39986-PoC", "creation_timestamp": "2026-07-30T00:00:25.166387Z"}, {"uuid": "009fb343-abec-400a-96e5-6ee6b227bf06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39988", "type": "seen", "source": "https://t.me/hacking_Attack/71329", "content": "Exploit Collector\nCentreon 22.04.0 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-xJ4j9VfFswY/WWlvOf_vUlI/AAAAAAAAIMo/D1-kp_Mj10E1aNmsGMS5n6nKC28DofOXwCLcBGAs/s1600/h25.png \nCentreon version 22.04.0 suffers from a persistent cross site scripting vulnerability.\n\nSHA-256 | 69cf7baade94fd5e803782c07bbd53d7ff5f985beb2b08f0768155d0e8d0e38f\n\nDownload\n# Exploit Title: Stored XSS in service_alias parameter in Centreon version 22.04.0\n# Date: 1/10/2022\n# Exploit Author: syad\n# Vendor Homepage: Centreon\n# Software Link: https://download.centreon.com/\n# Version: 22.04.0\n# CVE ID : CVE-2022-39988\n# Tested on: Centos 7\nCentreon 22.04.0 is vulnerable to Stored Cross Site Scripting (XSS) from the function Service -> Templates -> by adding a crafted payload\ninto the service_alias parameter.\ngo to this endpoint -> /centreon/main.get.php?p=60206 -> Service -> Templates -> Click Button \"Add\" and put the crafted payload below on section \"Alias\" and save\n\npayload --> test\">\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:21.324503Z"}, {"uuid": "e4137feb-5bec-4f99-9446-1a70a80d8f0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39988", "type": "seen", "source": "https://t.me/hacking_Attack/71329", "content": "Exploit Collector\nCentreon 22.04.0 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-xJ4j9VfFswY/WWlvOf_vUlI/AAAAAAAAIMo/D1-kp_Mj10E1aNmsGMS5n6nKC28DofOXwCLcBGAs/s1600/h25.png \nCentreon version 22.04.0 suffers from a persistent cross site scripting vulnerability.\n\nSHA-256 | 69cf7baade94fd5e803782c07bbd53d7ff5f985beb2b08f0768155d0e8d0e38f\n\nDownload\n# Exploit Title: Stored XSS in service_alias parameter in Centreon version 22.04.0\n# Date: 1/10/2022\n# Exploit Author: syad\n# Vendor Homepage: Centreon\n# Software Link: https://download.centreon.com/\n# Version: 22.04.0\n# CVE ID : CVE-2022-39988\n# Tested on: Centos 7\nCentreon 22.04.0 is vulnerable to Stored Cross Site Scripting (XSS) from the function Service -> Templates -> by adding a crafted payload\ninto the service_alias parameter.\ngo to this endpoint -> /centreon/main.get.php?p=60206 -> Service -> Templates -> Click Button \"Add\" and put the crafted payload below on section \"Alias\" and save\n\npayload --> test\">\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:36.812307Z"}, {"uuid": "bd56b69b-ee99-48bd-b9d6-e843a811220c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39988", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/71329", "content": "Exploit Collector\nCentreon 22.04.0 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-xJ4j9VfFswY/WWlvOf_vUlI/AAAAAAAAIMo/D1-kp_Mj10E1aNmsGMS5n6nKC28DofOXwCLcBGAs/s1600/h25.png \nCentreon version 22.04.0 suffers from a persistent cross site scripting vulnerability.\n\nSHA-256 | 69cf7baade94fd5e803782c07bbd53d7ff5f985beb2b08f0768155d0e8d0e38f\n\nDownload\n# Exploit Title: Stored XSS in service_alias parameter in Centreon version 22.04.0\n# Date: 1/10/2022\n# Exploit Author: syad\n# Vendor Homepage: Centreon\n# Software Link: https://download.centreon.com/\n# Version: 22.04.0\n# CVE ID : CVE-2022-39988\n# Tested on: Centos 7\nCentreon 22.04.0 is vulnerable to Stored Cross Site Scripting (XSS) from the function Service -> Templates -> by adding a crafted payload\ninto the service_alias parameter.\ngo to this endpoint -> /centreon/main.get.php?p=60206 -> Service -> Templates -> Click Button \"Add\" and put the crafted payload below on section \"Alias\" and save\n\npayload --> test\">\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T07:00:04.943664Z"}, {"uuid": "5115ac67-a608-418e-a157-6401865783e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39988", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/71329", "content": "Exploit Collector\nCentreon 22.04.0 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-xJ4j9VfFswY/WWlvOf_vUlI/AAAAAAAAIMo/D1-kp_Mj10E1aNmsGMS5n6nKC28DofOXwCLcBGAs/s1600/h25.png \nCentreon version 22.04.0 suffers from a persistent cross site scripting vulnerability.\n\nSHA-256 | 69cf7baade94fd5e803782c07bbd53d7ff5f985beb2b08f0768155d0e8d0e38f\n\nDownload\n# Exploit Title: Stored XSS in service_alias parameter in Centreon version 22.04.0\n# Date: 1/10/2022\n# Exploit Author: syad\n# Vendor Homepage: Centreon\n# Software Link: https://download.centreon.com/\n# Version: 22.04.0\n# CVE ID : CVE-2022-39988\n# Tested on: Centos 7\nCentreon 22.04.0 is vulnerable to Stored Cross Site Scripting (XSS) from the function Service -> Templates -> by adding a crafted payload\ninto the service_alias parameter.\ngo to this endpoint -> /centreon/main.get.php?p=60206 -> Service -> Templates -> Click Button \"Add\" and put the crafted payload below on section \"Alias\" and save\n\npayload --> test\">\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:54.984286Z"}, {"uuid": "22f577af-6e00-43bc-995a-7786e7c19e5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39986", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/raspap_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"Ege BALCI \", \"Ismael0x00\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"RaspAP is feature-rich wireless router software that just works\\n          on many popular Debian-based devices, including the Raspberry Pi.\\n          A Command Injection vulnerability in RaspAP versions 2.8.0 thru 2.8.7 allows\\n          unauthenticated attackers to execute arbitrary commands in the context of the user running RaspAP via the cfg_id\\n          parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php.\\n\\n          Successfully tested against RaspAP 2.8.0 and 2.8.7.\", \"disclosure_date\": \"2023-07-31\", \"fullname\": \"exploit/unix/http/raspap_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:59:31 +0000\", \"name\": \"RaspAP Unauthenticated Command Injection\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/unix/http/raspap_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"unix/http/raspap_rce\", \"references\": [\"CVE-2022-39986\", \"URL-https://medium.com/@ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2\", \"GHSA-7c28-wg7r-pg6f\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Unix Command\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:37.519905Z"}]}