{"vulnerability": "cve-2025-54123", "sightings": [{"uuid": "612c0162-d0cf-4c4c-8b35-f1c99c6bbd6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m5ezvqgtqy2a", "content": "", "creation_timestamp": "2025-11-11T21:02:40.958334Z"}, {"uuid": "36c0f515-e892-408d-9d65-213950e827fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-54123", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3lyjgypjbwa2s", "content": "", "creation_timestamp": "2025-09-11T00:01:37.488249Z"}, {"uuid": "379e7f15-7312-4366-95d0-9b3013c0e95b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-54123", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3lyjgyxnwp42q", "content": "", "creation_timestamp": "2025-09-11T00:01:40.904258Z"}, {"uuid": "ee90bd06-53ae-4784-be77-9b6d13f7fac8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-11-11)", "content": "", "creation_timestamp": "2025-11-11T00:00:00.000000Z"}, {"uuid": "f61fea91-5f72-4c64-b682-3aa67211844a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lz5apsr2lf2m", "content": "", "creation_timestamp": "2025-09-18T21:02:29.606477Z"}, {"uuid": "16768d77-a765-47bd-a89d-da5592f50d9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-07)", "content": "", "creation_timestamp": "2026-03-07T00:00:00.000000Z"}, {"uuid": "eb02da16-3610-48de-b04a-4526acf4b3bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-15)", "content": "", "creation_timestamp": "2026-02-15T00:00:00.000000Z"}, {"uuid": "e3395856-859d-4a92-9c2a-a7bf521be904", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-14)", "content": "", "creation_timestamp": "2026-03-14T00:00:00.000000Z"}, {"uuid": "5cffbfe8-739e-4853-b188-26d674062d94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-04-03)", "content": "", "creation_timestamp": "2026-04-03T00:00:00.000000Z"}, {"uuid": "55833c60-ce2d-46b6-9bb4-c30c2d29aa6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "published-proof-of-concept", "source": "Telegram/jW6gAEx0X-7rlKDcpeYmlHPMlF_kfSwPpGXtV0Ykb6N88uc", "content": "", "creation_timestamp": "2026-03-31T03:00:07.000000Z"}, {"uuid": "677ca84c-0ec7-4e53-bcd3-1941c8ff5972", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "published-proof-of-concept", "source": "Telegram/Fln1CDV-IIlp7EGS7hr_JibbBYDcdeDsNTgWenTzMncUGCI", "content": "", "creation_timestamp": "2026-03-29T15:00:08.000000Z"}, {"uuid": "888f8e99-cd37-41c3-bbb3-a6e8042aae08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "published-proof-of-concept", "source": "Telegram/KKi08pVtUDaCAJkb9047w9y4w-ZBtgxVmflDXmeWCTkhF9g", "content": "", "creation_timestamp": "2026-03-29T03:00:06.000000Z"}, {"uuid": "77e3cf04-bc97-4d15-97b3-f92e502f215b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "published-proof-of-concept", "source": "Telegram/Us8JkcdKV6mNpmC49CCSXRO4qTVWF6cCKabwDZ5lsVeRzZU", "content": "", "creation_timestamp": "2026-03-31T15:00:07.000000Z"}, {"uuid": "9a420982-dd8c-4ccc-b774-4809294a380d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-05-05)", "content": "", "creation_timestamp": "2026-05-05T00:00:00.000000Z"}, {"uuid": "5c325cdc-cf09-44c8-b9cf-52caf418dfca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "seen", "source": "https://t.me/bagl3y_notes/282", "content": "\ud83d\udfe2 \u041d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434\u0435\u043e-\u0440\u0430\u0437\u0431\u043e\u0440 \ud83d\udc9a \u0442\u0430\u0447\u043a\u0438 \u043e\u0442 ippsec'a\n\n\n\u2049\ufe0f   \u0410\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u043b\u043e\u0433\u0438\u043d (\u044e\u0437\u0435\u0440 anonymous \u0441 \u043f\u0443\u0441\u0442\u044b\u043c \u043f\u0430\u0440\u043e\u043b\u0435\u043c) \u043d\u0430 FTP,  \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u043c employee-service.jar  \u27a1\ufe0f\u0440\u0435\u0432\u0435\u0440\u0441\u0438\u043c JAR \u0447\u0435\u0440\u0435\u0437 jadx-gui \u27a1\ufe0f\u043d\u0430\u0445\u043e\u0434\u0438\u043c SOAP-\u0441\u0435\u0440\u0432\u0438\u0441 \u043d\u0430 Apache CXF 3.2.14 (\u043f\u043e\u0440\u0442 8080) \u27a1\ufe0f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c CVE-2022-46364 (Apache CXF SSRF/arbitrary file read \u0447\u0435\u0440\u0435\u0437 XOP:Include + MTOM multipart) \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0445\u043e\u0441\u0442\u0430 \u27a1\ufe0f \u0438\u0437 /proc//cmdline \u0438 /etc/systemd/system/hoverfly.service \u0432\u044b\u0442\u0430\u0441\u043a\u0438\u0432\u0430\u0435\u043c \u043a\u0440\u0435\u0434\u044b \u0430\u0434\u043c\u0438\u043d\u0430 Hoverfly \u27a1\ufe0f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c CVE-2025-54123 (Hoverfly command injection \u0432 /api/v2/hoverfly/middleware) \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0448\u0435\u043b\u043b\u0430 \u043f\u043e\u0434 dev_ryan \u27a1\ufe0f \u0447\u0438\u0442\u0430\u0435\u043c \u0441\u0435\u043a\u0440\u0435\u0442 Flask-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f SysWatch \u0438\u0437 world-readable /etc/syswatch.env, \u043f\u043e\u0434\u0434\u0435\u043b\u044b\u0432\u0430\u0435\u043c \u0441\u0435\u0441\u0441\u0438\u043e\u043d\u043d\u0443\u044e \u043a\u0443\u043a\u0443 \u0447\u0435\u0440\u0435\u0437 flask-unsign \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c command injection \u0432 \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u0435 /service-status \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0448\u0435\u043b\u043b\u0430 \u043f\u043e\u0434 syswatch \u27a1\ufe0f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c \u0431\u0430\u0433 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 symlink \u0432 root-\u0441\u043a\u0440\u0438\u043f\u0442\u0435 syswatch.sh \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f /root/.ssh/id_rsa\n\n#\ufe0f\u20e3\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u043e Linux box - DevArea, \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 Medium\n#\ufe0f\u20e3 \u0410 \u0432\u043e\u0442 \u0435\u0449\u0435 \u0440\u0430\u0437\u0431\u043e\u0440 \u043e\u0442 \u043a\u0440\u0443\u0442\u043e\u0433\u043e \u0447\u0435\u043b\u0430 - 0xdf\n\n\n\ud83c\udf39 \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u043e\u0441\u0442\u044b \u043a\u0430\u043d\u0430\u043b\u0430 \n\n#video #HTB #ippsec #0xdf #Walkthroughs", "creation_timestamp": "2026-08-04T13:00:25.194617Z"}, {"uuid": "ca2c5344-2d67-40c8-b7e9-5e6ca8df6d5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "seen", "source": "https://t.me/bagl3y_notes/282", "content": "\ud83d\udfe2 \u041d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434\u0435\u043e-\u0440\u0430\u0437\u0431\u043e\u0440 \ud83d\udc9a \u0442\u0430\u0447\u043a\u0438 \u043e\u0442 ippsec'a\n\n\n\u2049\ufe0f   \u0410\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u043b\u043e\u0433\u0438\u043d (\u044e\u0437\u0435\u0440 anonymous \u0441 \u043f\u0443\u0441\u0442\u044b\u043c \u043f\u0430\u0440\u043e\u043b\u0435\u043c) \u043d\u0430 FTP,  \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u043c employee-service.jar  \u27a1\ufe0f\u0440\u0435\u0432\u0435\u0440\u0441\u0438\u043c JAR \u0447\u0435\u0440\u0435\u0437 jadx-gui \u27a1\ufe0f\u043d\u0430\u0445\u043e\u0434\u0438\u043c SOAP-\u0441\u0435\u0440\u0432\u0438\u0441 \u043d\u0430 Apache CXF 3.2.14 (\u043f\u043e\u0440\u0442 8080) \u27a1\ufe0f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c CVE-2022-46364 (Apache CXF SSRF/arbitrary file read \u0447\u0435\u0440\u0435\u0437 XOP:Include + MTOM multipart) \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0445\u043e\u0441\u0442\u0430 \u27a1\ufe0f \u0438\u0437 /proc//cmdline \u0438 /etc/systemd/system/hoverfly.service \u0432\u044b\u0442\u0430\u0441\u043a\u0438\u0432\u0430\u0435\u043c \u043a\u0440\u0435\u0434\u044b \u0430\u0434\u043c\u0438\u043d\u0430 Hoverfly \u27a1\ufe0f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c CVE-2025-54123 (Hoverfly command injection \u0432 /api/v2/hoverfly/middleware) \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0448\u0435\u043b\u043b\u0430 \u043f\u043e\u0434 dev_ryan \u27a1\ufe0f \u0447\u0438\u0442\u0430\u0435\u043c \u0441\u0435\u043a\u0440\u0435\u0442 Flask-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f SysWatch \u0438\u0437 world-readable /etc/syswatch.env, \u043f\u043e\u0434\u0434\u0435\u043b\u044b\u0432\u0430\u0435\u043c \u0441\u0435\u0441\u0441\u0438\u043e\u043d\u043d\u0443\u044e \u043a\u0443\u043a\u0443 \u0447\u0435\u0440\u0435\u0437 flask-unsign \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c command injection \u0432 \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u0435 /service-status \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0448\u0435\u043b\u043b\u0430 \u043f\u043e\u0434 syswatch \u27a1\ufe0f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c \u0431\u0430\u0433 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 symlink \u0432 root-\u0441\u043a\u0440\u0438\u043f\u0442\u0435 syswatch.sh \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f /root/.ssh/id_rsa\n\n#\ufe0f\u20e3\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u043e Linux box - DevArea, \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 Medium\n#\ufe0f\u20e3 \u0410 \u0432\u043e\u0442 \u0435\u0449\u0435 \u0440\u0430\u0437\u0431\u043e\u0440 \u043e\u0442 \u043a\u0440\u0443\u0442\u043e\u0433\u043e \u0447\u0435\u043b\u0430 - 0xdf\n\n\n\ud83c\udf39 \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u043e\u0441\u0442\u044b \u043a\u0430\u043d\u0430\u043b\u0430 \n\n#video #HTB #ippsec #0xdf #Walkthroughs", "creation_timestamp": "2026-08-05T00:00:40.762725Z"}, {"uuid": "f78b0c60-ed26-4548-8b9a-792fa7b56cfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "seen", "source": "https://t.me/GithubRedTeam/86177", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Hoverfly-1.11.3-RCE-CVE-2025-54123-Exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0x00phantom-hat\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-27 22:55:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-27T23:00:17.000000Z"}, {"uuid": "998e2cdc-73e7-4033-b3e9-27ad7d122e2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-54123", "type": "published-proof-of-concept", "source": "https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-r4h8-hfp2-ggmf", "content": "", "creation_timestamp": "2025-09-10T18:35:23.000000Z"}, {"uuid": "8b584532-e31d-4d23-a504-9b559933d3d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-05-28)", "content": "", "creation_timestamp": "2026-05-28T00:00:00.000000Z"}, {"uuid": "bc3fea95-4da3-4a74-a941-857e38763c59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "published-proof-of-concept", "source": "https://t.me/bagl3y_notes/282", "content": "\ud83d\udfe2 \u041d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434\u0435\u043e-\u0440\u0430\u0437\u0431\u043e\u0440 \ud83d\udc9a \u0442\u0430\u0447\u043a\u0438 \u043e\u0442 ippsec'a\n\n\n\u2049\ufe0f   \u0410\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u043b\u043e\u0433\u0438\u043d (\u044e\u0437\u0435\u0440 anonymous \u0441 \u043f\u0443\u0441\u0442\u044b\u043c \u043f\u0430\u0440\u043e\u043b\u0435\u043c) \u043d\u0430 FTP,  \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u043c employee-service.jar  \u27a1\ufe0f\u0440\u0435\u0432\u0435\u0440\u0441\u0438\u043c JAR \u0447\u0435\u0440\u0435\u0437 jadx-gui \u27a1\ufe0f\u043d\u0430\u0445\u043e\u0434\u0438\u043c SOAP-\u0441\u0435\u0440\u0432\u0438\u0441 \u043d\u0430 Apache CXF 3.2.14 (\u043f\u043e\u0440\u0442 8080) \u27a1\ufe0f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c CVE-2022-46364 (Apache CXF SSRF/arbitrary file read \u0447\u0435\u0440\u0435\u0437 XOP:Include + MTOM multipart) \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0445\u043e\u0441\u0442\u0430 \u27a1\ufe0f \u0438\u0437 /proc//cmdline \u0438 /etc/systemd/system/hoverfly.service \u0432\u044b\u0442\u0430\u0441\u043a\u0438\u0432\u0430\u0435\u043c \u043a\u0440\u0435\u0434\u044b \u0430\u0434\u043c\u0438\u043d\u0430 Hoverfly \u27a1\ufe0f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c CVE-2025-54123 (Hoverfly command injection \u0432 /api/v2/hoverfly/middleware) \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0448\u0435\u043b\u043b\u0430 \u043f\u043e\u0434 dev_ryan \u27a1\ufe0f \u0447\u0438\u0442\u0430\u0435\u043c \u0441\u0435\u043a\u0440\u0435\u0442 Flask-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f SysWatch \u0438\u0437 world-readable /etc/syswatch.env, \u043f\u043e\u0434\u0434\u0435\u043b\u044b\u0432\u0430\u0435\u043c \u0441\u0435\u0441\u0441\u0438\u043e\u043d\u043d\u0443\u044e \u043a\u0443\u043a\u0443 \u0447\u0435\u0440\u0435\u0437 flask-unsign \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c command injection \u0432 \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u0435 /service-status \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0448\u0435\u043b\u043b\u0430 \u043f\u043e\u0434 syswatch \u27a1\ufe0f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c \u0431\u0430\u0433 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 symlink \u0432 root-\u0441\u043a\u0440\u0438\u043f\u0442\u0435 syswatch.sh \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f /root/.ssh/id_rsa\n\n#\ufe0f\u20e3\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u043e Linux box - DevArea, \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 Medium\n#\ufe0f\u20e3 \u0410 \u0432\u043e\u0442 \u0435\u0449\u0435 \u0440\u0430\u0437\u0431\u043e\u0440 \u043e\u0442 \u043a\u0440\u0443\u0442\u043e\u0433\u043e \u0447\u0435\u043b\u0430 - 0xdf\n\n\n\ud83c\udf39 \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u043e\u0441\u0442\u044b \u043a\u0430\u043d\u0430\u043b\u0430 \n\n#video #HTB #ippsec #0xdf #Walkthroughs", "creation_timestamp": "2026-08-06T00:00:42.158752Z"}, {"uuid": "4d375078-deee-40e5-8fdd-ddb256cdc942", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1e48a797-3e42-4f31-8be0-f778bce44482", "content": "", "creation_timestamp": "2026-06-19T12:45:47.112737Z"}, {"uuid": "692690a9-2c50-47af-b913-680cdc034de0", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/aecd3544-8674-448b-8441-ab0ea3e357db", "content": "", "creation_timestamp": "2026-06-23T14:03:14.957834Z"}, {"uuid": "8481ea54-082a-4cc3-9538-d33e703dbf78", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2025-54123", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/66fc5325-f457-4c0c-a69f-42193a4e2803", "content": "", "creation_timestamp": "2026-06-30T09:23:51.265632Z"}, {"uuid": "c2138be4-a8c2-40a7-8656-92701af785e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-07-14)", "content": "", "creation_timestamp": "2026-07-15T10:00:16.776352Z"}, {"uuid": "cf944a37-f5dc-408a-86ff-9703da97ff9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "seen", "source": "https://t.me/cve0day/330", "content": "CVE-2025-54123\n\nHoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at /api/v2/hoverfly/middleware endpoint due to insufficient validation and sanitization in user input. The vulnerability exists in the middleware management API endpoint /api/v2/hoverfly/middleware. This issue is born due to combination of three code level flaws: Insufficient Input Validation in middleware.go line 94-96; Unsafe Command Execution in localmiddleware.go line 14-19; and Immediate Execution During Testing in hoverflyservice.go line 173. This allows an attacker to gain remote code execution (RCE) on any system running the vulnerable Hoverfly service. Since the input is directly passed to system commands without proper checks, an attacker can upload a malicious payload or directly exe...", "creation_timestamp": "2026-08-28T00:00:39.755039Z"}, {"uuid": "8b5af5e0-9d22-4ecd-bb92-c35f6671fe6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "seen", "source": "https://t.me/cve0day/330", "content": "CVE-2025-54123\n\nHoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at /api/v2/hoverfly/middleware endpoint due to insufficient validation and sanitization in user input. The vulnerability exists in the middleware management API endpoint /api/v2/hoverfly/middleware. This issue is born due to combination of three code level flaws: Insufficient Input Validation in middleware.go line 94-96; Unsafe Command Execution in localmiddleware.go line 14-19; and Immediate Execution During Testing in hoverflyservice.go line 173. This allows an attacker to gain remote code execution (RCE) on any system running the vulnerable Hoverfly service. Since the input is directly passed to system commands without proper checks, an attacker can upload a malicious payload or directly exe...", "creation_timestamp": "2026-08-27T15:00:11.230060Z"}, {"uuid": "21c5b2af-de8e-4374-b849-a7622b1a6eed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54123", "type": "published-proof-of-concept", "source": "https://t.me/cve0day/330", "content": "CVE-2025-54123\n\nHoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at /api/v2/hoverfly/middleware endpoint due to insufficient validation and sanitization in user input. The vulnerability exists in the middleware management API endpoint /api/v2/hoverfly/middleware. This issue is born due to combination of three code level flaws: Insufficient Input Validation in middleware.go line 94-96; Unsafe Command Execution in localmiddleware.go line 14-19; and Immediate Execution During Testing in hoverflyservice.go line 173. This allows an attacker to gain remote code execution (RCE) on any system running the vulnerable Hoverfly service. Since the input is directly passed to system commands without proper checks, an attacker can upload a malicious payload or directly exe...", "creation_timestamp": "2026-08-29T00:00:31.411116Z"}]}