https://vulnerability.circl.lu/sightings/feed 2026-09-17T16:40:41.187227+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/7736268b-d522-4d8f-8568-6a7523f90d42/export 2026-09-17T16:40:41.203344+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "7736268b-d522-4d8f-8568-6a7523f90d42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-44666", "type": "published-proof-of-concept", "source": "https://t.me/cissp/6615", "content": "exploit\n1. CVE-2022-45701:\nArris Router Firmware 9.1.103 - RCE\nhttps://packetstormsecurity.com/files/171001\n\n2. CVE-2022-37955:\nEoP via Arbitrary File Write/Overwite in Group Policy Client \"gpsvc\"\nhttps://decoder.cloud/2023/02/16/eop-via-arbitrary-file-write-overwite-in-group-policy-client-gpsvc-cve-2022-37955\n\n3. CVE-2022-44666:\nMS Windows Contacts (VCF/Contact/LDAP) syslink control href attribute escape vulnerability\nhttps://github.com/j00sean/CVE-2022-44666\n\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.11.28", "creation_timestamp": "2026-09-11T00:00:54.537469Z"} 2026-09-11T00:00:54.537469+00:00 https://vulnerability.circl.lu/sighting/7f46ca12-8a4c-42a2-aaee-45f4dc0802e5/export 2026-09-17T16:40:41.204790+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "7f46ca12-8a4c-42a2-aaee-45f4dc0802e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-44666", "type": "published-proof-of-concept", "source": "https://t.me/cissp/6615", "content": "exploit\n1. CVE-2022-45701:\nArris Router Firmware 9.1.103 - RCE\nhttps://packetstormsecurity.com/files/171001\n\n2. CVE-2022-37955:\nEoP via Arbitrary File Write/Overwite in Group Policy Client \"gpsvc\"\nhttps://decoder.cloud/2023/02/16/eop-via-arbitrary-file-write-overwite-in-group-policy-client-gpsvc-cve-2022-37955\n\n3. CVE-2022-44666:\nMS Windows Contacts (VCF/Contact/LDAP) syslink control href attribute escape vulnerability\nhttps://github.com/j00sean/CVE-2022-44666\n\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.11.28", "creation_timestamp": "2026-09-10T03:00:04.943129Z"} 2026-09-10T03:00:04.943129+00:00 https://vulnerability.circl.lu/sighting/76f8ce78-eb47-4bea-98eb-54333f4cf229/export 2026-09-17T16:40:41.204914+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "76f8ce78-eb47-4bea-98eb-54333f4cf229", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-44384", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/rconfig_vendors_auth_file_upload_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"MURAT \\u015eEKER\", \"VISHWARAJ BHATTRAI\", \"Yann Castel (yann.castel \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module allows an attacker with a privileged rConfig account to start a reverse shell\\n due to an arbitrary file upload vulnerability in `/lib/crud/vendors.crud.php`.\\n Then, the uploaded payload can be triggered by a call to `images/vendor/.php`\", \"disclosure_date\": \"2021-03-17\", \"fullname\": \"exploit/linux/http/rconfig_vendors_auth_file_upload_rce\", \"is_install_path\": true, \"mod_time\": \"2025-10-06 17:15:11 +0000\", \"name\": \"rConfig Vendors Auth File Upload RCE\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/rconfig_vendors_auth_file_upload_rce.rb\", \"platform\": \"PHP\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/rconfig_vendors_auth_file_upload_rce\", \"references\": [\"CVE-2022-44384\", \"EDB-49665\", \"EDB-49783\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"rConfig <= 3.9.6\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:54.306875Z"} 2026-09-08T06:48:54.306875+00:00 https://vulnerability.circl.lu/sighting/d6062973-f115-48fb-a34e-20bfa177ce67/export 2026-09-17T16:40:41.205018+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "d6062973-f115-48fb-a34e-20bfa177ce67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-44877", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/control_web_panel_login_cmd_exec.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"Spencer McIntyre\", \"Numan T\\u00fcrle\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Control Web Panel versions < 0.9.8.1147 are vulnerable to\\n unauthenticated OS command injection. Successful exploitation results\\n in code execution as the root user. The results of the command are not\\n contained within the HTTP response and the request will block while\\n the command is running.\", \"disclosure_date\": \"2023-01-05\", \"fullname\": \"exploit/linux/http/control_web_panel_login_cmd_exec\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"CWP login.php Unauthenticated RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/control_web_panel_login_cmd_exec.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/control_web_panel_login_cmd_exec\", \"references\": [\"CVE-2022-44877\", \"URL-https://github.com/numanturle/CVE-2022-44877\", \"URL-https://control-webpanel.com/changelog#1674073133745-84af1b53-c121\"], \"rport\": 2031, \"session_types\": false, \"targets\": [\"Unix Command\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:28.467413Z"} 2026-09-08T06:48:28.467413+00:00 https://vulnerability.circl.lu/sighting/727dffbb-3202-4ffd-a614-6f781d288445/export 2026-09-17T16:40:41.205111+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "727dffbb-3202-4ffd-a614-6f781d288445", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-44721", "type": "published-proof-of-concept", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "creation_timestamp": "2026-09-07T01:00:25.308107Z"} 2026-09-07T01:00:25.308107+00:00 https://vulnerability.circl.lu/sighting/bca829c6-07ff-48a2-b014-d6affe5e7276/export 2026-09-17T16:40:41.205195+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "bca829c6-07ff-48a2-b014-d6affe5e7276", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-44721", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "creation_timestamp": "2026-09-06T08:00:05.888098Z"} 2026-09-06T08:00:05.888098+00:00 https://vulnerability.circl.lu/sighting/0540d43c-01d0-43cb-8112-561b7cb47e61/export 2026-09-17T16:40:41.205280+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "0540d43c-01d0-43cb-8112-561b7cb47e61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-44268", "type": "published-proof-of-concept", "source": "Telegram/qPB9INxRUn7hqm5tMwZnjzgWjUliqqBv5hnORCgMkrQSFLQ", "content": "", "creation_timestamp": "2026-09-06T00:01:04.250486Z"} 2026-09-06T00:01:04.250486+00:00 https://vulnerability.circl.lu/sighting/7df55688-2d9c-4c40-a134-55d16e54a4b2/export 2026-09-17T16:40:41.205361+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "7df55688-2d9c-4c40-a134-55d16e54a4b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-44698", "type": "exploited", "source": "https://t.me/hacking_Attack/80542", "content": "Black Hat Ethical Hacking\nMicrosoft patches Windows zero-day used to drop ransomware\n\nMicrosoft patches Windows zero-day used to drop ransomwarePost Views: 37 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Microsoft has fixed a security vulnerability used by threat actors to circumvent the Windows SmartScreen security feature and deliver Magniber ransomware and Qbot malware payloads.The attackers used malicious standalone JavaScript files to exploit the CVE-2022-44698\u00a0zero-day to bypass Mark-of-the-Web security warnings displayed by Windows to alert users that files originating from the Internet should be treated with caution.\n\n\u201cAn attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging,\u201d Redmond explained\u00a0on Tuesday.\n\nAccording to Microsoft, this security flaw can only be exploited using three attack vectors:\n\n* In a web-based attack scenario, an attacker could host a malicious website that exploits the security feature bypass.\n* In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted .url file to exploit the bypass.\n* Compromised websites or websites that accept or host user-provided content could contain specially crafted content to exploit the security feature bypass.\n\nHowever, in all these scenarios, the threat actors would have to trick their targets into opening malicious files or accessing attacker-controlled websites with CVE-2022-44698 exploits.\n\nMicrosoft released security updates to address this zero-day during the December 2022 Patch Tuesday after working on a fix for this actively exploited zero-day vulnerability since late October, as the company told BleepingComputer.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course \u200bExploited in malware attacksHP\u2019s threat intelligence team first reported in October that phishing attacks were distributing the Magniber ransomware\u00a0using standalone.JS JavaScript files digitally signed with a malformed as discovered\u00a0by Will Dormann, a senior vulnerability analyst at ANALYGENCE.\n\nThis would cause SmartCheck to error out and allow the malicious files to execute without throwing any security warnings and install the Magniber ransomware, even though it got tagged with a MoTW flag.\nhttps://www.bleepstatic.com/images/news/u/1220909/Diagrams/magniber-chain(1).png \n<figcaptionMagniber\u2019s JS infection chain (BleepingComputer) \nLast month, the same Windows zero-day vulnerability was also abused in phishing attacks to drop the Qbot malware\u00a0without displaying MOTW security warnings.\n\nAs security researcher ProxyLife found, threat actors behind this recent QBot phishing campaign switched to the Windows Mark of the Web zero-day by distributing JS files signed with the same malformed key used in the Magniber ransomware attacks.\n\nQBot (aka Qakbot) is a Windows banking trojan that has evolved into a malware dropper that will steal emails for use in subsequent phishing attacks or deliver additional payloads such as Brute Ratel, Cobalt Strike, and other malware.\nTrending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt The Egregor, Prolock, and Black Basta\u00a0ransomware operations are also known to have partnered with QBot to gain access to victims\u2019 corporate networks.\n\nDuring the December 2022\u00a0Patch Tuesday, Microsoft also fixed a publicly disclosed zero-day (CVE-2022-44710) that would allow attackers to gain SYSTEM privileges on unpatc[...]", "creation_timestamp": "2026-09-06T00:01:01.092312Z"} 2026-09-06T00:01:01.092312+00:00 https://vulnerability.circl.lu/sighting/1a7b188b-b007-4308-a51f-a5cd34961ba8/export 2026-09-17T16:40:41.205468+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "1a7b188b-b007-4308-a51f-a5cd34961ba8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-44710", "type": "exploited", "source": "https://t.me/hacking_Attack/80542", "content": "Black Hat Ethical Hacking\nMicrosoft patches Windows zero-day used to drop ransomware\n\nMicrosoft patches Windows zero-day used to drop ransomwarePost Views: 37 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Microsoft has fixed a security vulnerability used by threat actors to circumvent the Windows SmartScreen security feature and deliver Magniber ransomware and Qbot malware payloads.The attackers used malicious standalone JavaScript files to exploit the CVE-2022-44698\u00a0zero-day to bypass Mark-of-the-Web security warnings displayed by Windows to alert users that files originating from the Internet should be treated with caution.\n\n\u201cAn attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging,\u201d Redmond explained\u00a0on Tuesday.\n\nAccording to Microsoft, this security flaw can only be exploited using three attack vectors:\n\n* In a web-based attack scenario, an attacker could host a malicious website that exploits the security feature bypass.\n* In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted .url file to exploit the bypass.\n* Compromised websites or websites that accept or host user-provided content could contain specially crafted content to exploit the security feature bypass.\n\nHowever, in all these scenarios, the threat actors would have to trick their targets into opening malicious files or accessing attacker-controlled websites with CVE-2022-44698 exploits.\n\nMicrosoft released security updates to address this zero-day during the December 2022 Patch Tuesday after working on a fix for this actively exploited zero-day vulnerability since late October, as the company told BleepingComputer.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course \u200bExploited in malware attacksHP\u2019s threat intelligence team first reported in October that phishing attacks were distributing the Magniber ransomware\u00a0using standalone.JS JavaScript files digitally signed with a malformed as discovered\u00a0by Will Dormann, a senior vulnerability analyst at ANALYGENCE.\n\nThis would cause SmartCheck to error out and allow the malicious files to execute without throwing any security warnings and install the Magniber ransomware, even though it got tagged with a MoTW flag.\nhttps://www.bleepstatic.com/images/news/u/1220909/Diagrams/magniber-chain(1).png \n<figcaptionMagniber\u2019s JS infection chain (BleepingComputer) \nLast month, the same Windows zero-day vulnerability was also abused in phishing attacks to drop the Qbot malware\u00a0without displaying MOTW security warnings.\n\nAs security researcher ProxyLife found, threat actors behind this recent QBot phishing campaign switched to the Windows Mark of the Web zero-day by distributing JS files signed with the same malformed key used in the Magniber ransomware attacks.\n\nQBot (aka Qakbot) is a Windows banking trojan that has evolved into a malware dropper that will steal emails for use in subsequent phishing attacks or deliver additional payloads such as Brute Ratel, Cobalt Strike, and other malware.\nTrending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt The Egregor, Prolock, and Black Basta\u00a0ransomware operations are also known to have partnered with QBot to gain access to victims\u2019 corporate networks.\n\nDuring the December 2022\u00a0Patch Tuesday, Microsoft also fixed a publicly disclosed zero-day (CVE-2022-44710) that would allow attackers to gain SYSTEM privileges on unpatc[...]", "creation_timestamp": "2026-09-06T00:01:01.041588Z"} 2026-09-06T00:01:01.041588+00:00 https://vulnerability.circl.lu/sighting/55c57923-7dda-4932-860c-65f156181786/export 2026-09-17T16:40:41.205575+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "55c57923-7dda-4932-860c-65f156181786", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-44900", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/79365", "content": "Exploit Collector\npy7zr 0.20.0 Directory Traversal\n\nhttps://2.bp.blogspot.com/-8IZk1MGzGDs/WWlvRc2I8KI/AAAAAAAAINM/SaF41lFV3n4aBJrQBjJ2SaVGr7WaiJo3gCLcBGAs/s1600/h34.png \nA directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr versions 0.20.0 and earlier allows attackers to read arbitrary files on the local machine via a malicious 7z file extraction.\n\nSHA-256 | 7aa7ca72652dab91234127d8332a19316f0f61be17e1c626e65aae18d9435347\n\nDownload\nCVE-2022-44900: path traversal vulnerability in py7zr\n\nDirectory traversal vulnerability in SevenZipFile.extractall() function of\nthe python library py7zr version 0.20.0 and earlier allow attackers to read\narbitrary files on the local machine via malicious 7z file extraction.\n\nCVE-2022-44900 <https:\nvulnerability allows attackers to achieve arbitrary file read and arbitrary\nfile write. To do so, an attacker needs to create a malicious 7z archive\ncontaining a symlink to achieve an arbitrary file read and a file with a\npath traversal payload as name to achieve an arbitrary file write.\nExploiting\n\nThe script used for tests is the following:\n\nimport py7zr\nimport click\n\n@click.command()\n@click.argument(\"filename\")\n\ndef main_procedure(filename):\nwith py7zr.SevenZipFile(filename, 'r') as archive:\narchive.extractall()\n\nmain_procedure()\n\nThe vulnerabile function targeted is py7zr.SevenZipFile.extractall().\n\nA lab setup has been built to test for vulnerabilities. Directories\nstructured as follow were used:\n\n\u251c\u2500\u2500 start_point\n\u2502 \u251c\u2500\u2500 archive.7z\n\u2502 \u2514\u2500\u2500 py7zr_test.py\n\u2514\u2500\u2500 target\n\u251c\u2500\u2500 write\n\u2514\u2500\u2500 read\n\nThe start_point directory contains the script used for tests and the\nmalicious archive containing the path traversal payload in the form of the\nfilename of an archived file.\n\nTo achieve an arbitrary file read, one of the files in the archives needs\nto have ../target/write set as name. The content of the file will be\nwritten into target/write.\n\nIn a similar way, to achieve an arbitrary file read, a symlink pointing to\n../target/read needs to be present in the archive. When extracted the\nsymlink will consist of the content of target/read.\nDisclosure timeline\n\n29/10/2022 - Maintainer was notified privately of the vulnerabilities\n30/10/2022 - Response from maintainer\n01/11/2022 - Release of patched version 0.20.1\n01/11/2022 - CVE ID request\n06/12/2022 - CVE ID obtained\n06/12/2022 - Public disclosure\n------------------------------\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-06T00:00:59.329027Z"} 2026-09-06T00:00:59.329027+00:00