https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 16 Sep 2026 04:25:32 +0000 https://vulnerability.circl.lu/sighting/7a339ec6-eab5-40c1-9aa9-6cd054470e97/export {"uuid": "7a339ec6-eab5-40c1-9aa9-6cd054470e97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34068", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-10)", "content": "", "creation_timestamp": "2026-09-11T10:00:15.854125Z"} {"uuid": "7a339ec6-eab5-40c1-9aa9-6cd054470e97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34068", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-10)", "content": "", "creation_timestamp": "2026-09-11T10:00:15.854125Z"} https://vulnerability.circl.lu/sighting/7a339ec6-eab5-40c1-9aa9-6cd054470e97/export Fri, 11 Sep 2026 10:00:15 +0000 https://vulnerability.circl.lu/sighting/d1924816-6b60-48ec-8fb7-8ff83a1cd01e/export {"uuid": "d1924816-6b60-48ec-8fb7-8ff83a1cd01e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34061", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpstudy_backdoor_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Dimensional\", \"Airevan\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module can detect and exploit the backdoor of PHPStudy.\", \"disclosure_date\": \"2019-09-20\", \"fullname\": \"exploit/multi/http/phpstudy_backdoor_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:04 +0000\", \"name\": \"PHPStudy Backdoor Remote Code execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/phpstudy_backdoor_rce.rb\", \"platform\": \"PHP\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/phpstudy_backdoor_rce\", \"references\": [\"CVE-2025-34061\", \"URL-https://programmer.group/using-ghidra-to-analyze-the-back-door-of-phpstudy.html\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHPStudy 2016-2018\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:08.956754Z"} {"uuid": "d1924816-6b60-48ec-8fb7-8ff83a1cd01e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34061", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpstudy_backdoor_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Dimensional\", \"Airevan\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module can detect and exploit the backdoor of PHPStudy.\", \"disclosure_date\": \"2019-09-20\", \"fullname\": \"exploit/multi/http/phpstudy_backdoor_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:04 +0000\", \"name\": \"PHPStudy Backdoor Remote Code execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/phpstudy_backdoor_rce.rb\", \"platform\": \"PHP\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/phpstudy_backdoor_rce\", \"references\": [\"CVE-2025-34061\", \"URL-https://programmer.group/using-ghidra-to-analyze-the-back-door-of-phpstudy.html\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHPStudy 2016-2018\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:08.956754Z"} https://vulnerability.circl.lu/sighting/d1924816-6b60-48ec-8fb7-8ff83a1cd01e/export Tue, 08 Sep 2026 06:50:08 +0000 https://vulnerability.circl.lu/sighting/86606b65-6314-40de-82a1-17d842ba69d5/export {"uuid": "86606b65-6314-40de-82a1-17d842ba69d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34068", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-02)", "content": "", "creation_timestamp": "2026-09-03T10:00:09.093606Z"} {"uuid": "86606b65-6314-40de-82a1-17d842ba69d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34068", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-02)", "content": "", "creation_timestamp": "2026-09-03T10:00:09.093606Z"} https://vulnerability.circl.lu/sighting/86606b65-6314-40de-82a1-17d842ba69d5/export Thu, 03 Sep 2026 10:00:09 +0000 https://vulnerability.circl.lu/sighting/1f073d2e-8741-4bc1-bab7-ac3be719cf30/export {"uuid": "1f073d2e-8741-4bc1-bab7-ac3be719cf30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34067", "type": "seen", "source": "https://t.me/CyberDispatch/857", "content": "Hackers Exploit Israel Camera Vulnerabilities to Surveil\n\nMultiple hacking groups have been targeting internet-connected surveillance cameras across Israel and other Middle Eastern countries since the war began on February 28.\n\nThe countries targeted in these digital intrusions\u2014Israel, Qatar, Bahrain, Kuwait, the UAE, Cyprus, and Lebanon\u2014are the same ones that have witnessed significant missile activity linked to hackers as part of an ongoing operation targeting Israel.\n\nCompromised servers contained live CCTV feeds from Jerusalem, allowing the groups to surveil Tel Aviv, Haifa, and Jerusalem.\n\nThis recent camera targeting by several hackers serves as an early indicator of potential follow-on\n\nThe exploited vulnerabilities include:\n\n\u00b7 An improper authentication vulnerability in Hikvision IP camera firmware (CVE-2017-7921)\n\u00b7 A command injection vulnerability in the Hikvision web server component (CVE-2021-36260)\n\u00b7 An OS command injection vulnerability in the Hikvision Intercom Broadcasting System (CVE-2023-6895)\n\u00b7 An unauthenticated remote code execution vulnerability in the Hikvision Integrated Security Management Platform (CVE-2025-34067)\n\u00b7 An authentication bypass vulnerability in multiple Dahua products (CVE-2021-33044)\n\n@TheGhostITM", "creation_timestamp": "2026-08-31T00:00:23.514313Z"} {"uuid": "1f073d2e-8741-4bc1-bab7-ac3be719cf30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34067", "type": "seen", "source": "https://t.me/CyberDispatch/857", "content": "Hackers Exploit Israel Camera Vulnerabilities to Surveil\n\nMultiple hacking groups have been targeting internet-connected surveillance cameras across Israel and other Middle Eastern countries since the war began on February 28.\n\nThe countries targeted in these digital intrusions\u2014Israel, Qatar, Bahrain, Kuwait, the UAE, Cyprus, and Lebanon\u2014are the same ones that have witnessed significant missile activity linked to hackers as part of an ongoing operation targeting Israel.\n\nCompromised servers contained live CCTV feeds from Jerusalem, allowing the groups to surveil Tel Aviv, Haifa, and Jerusalem.\n\nThis recent camera targeting by several hackers serves as an early indicator of potential follow-on\n\nThe exploited vulnerabilities include:\n\n\u00b7 An improper authentication vulnerability in Hikvision IP camera firmware (CVE-2017-7921)\n\u00b7 A command injection vulnerability in the Hikvision web server component (CVE-2021-36260)\n\u00b7 An OS command injection vulnerability in the Hikvision Intercom Broadcasting System (CVE-2023-6895)\n\u00b7 An unauthenticated remote code execution vulnerability in the Hikvision Integrated Security Management Platform (CVE-2025-34067)\n\u00b7 An authentication bypass vulnerability in multiple Dahua products (CVE-2021-33044)\n\n@TheGhostITM", "creation_timestamp": "2026-08-31T00:00:23.514313Z"} https://vulnerability.circl.lu/sighting/1f073d2e-8741-4bc1-bab7-ac3be719cf30/export Mon, 31 Aug 2026 00:00:23 +0000 https://vulnerability.circl.lu/sighting/b27fffac-0074-4651-b9ed-a478763d14a1/export {"uuid": "b27fffac-0074-4651-b9ed-a478763d14a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34067", "type": "seen", "source": "https://t.me/CyberDispatch/857", "content": "Hackers Exploit Israel Camera Vulnerabilities to Surveil\n\nMultiple hacking groups have been targeting internet-connected surveillance cameras across Israel and other Middle Eastern countries since the war began on February 28.\n\nThe countries targeted in these digital intrusions\u2014Israel, Qatar, Bahrain, Kuwait, the UAE, Cyprus, and Lebanon\u2014are the same ones that have witnessed significant missile activity linked to hackers as part of an ongoing operation targeting Israel.\n\nCompromised servers contained live CCTV feeds from Jerusalem, allowing the groups to surveil Tel Aviv, Haifa, and Jerusalem.\n\nThis recent camera targeting by several hackers serves as an early indicator of potential follow-on\n\nThe exploited vulnerabilities include:\n\n\u00b7 An improper authentication vulnerability in Hikvision IP camera firmware (CVE-2017-7921)\n\u00b7 A command injection vulnerability in the Hikvision web server component (CVE-2021-36260)\n\u00b7 An OS command injection vulnerability in the Hikvision Intercom Broadcasting System (CVE-2023-6895)\n\u00b7 An unauthenticated remote code execution vulnerability in the Hikvision Integrated Security Management Platform (CVE-2025-34067)\n\u00b7 An authentication bypass vulnerability in multiple Dahua products (CVE-2021-33044)\n\n@TheGhostITM", "creation_timestamp": "2026-08-30T00:00:45.863326Z"} {"uuid": "b27fffac-0074-4651-b9ed-a478763d14a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34067", "type": "seen", "source": "https://t.me/CyberDispatch/857", "content": "Hackers Exploit Israel Camera Vulnerabilities to Surveil\n\nMultiple hacking groups have been targeting internet-connected surveillance cameras across Israel and other Middle Eastern countries since the war began on February 28.\n\nThe countries targeted in these digital intrusions\u2014Israel, Qatar, Bahrain, Kuwait, the UAE, Cyprus, and Lebanon\u2014are the same ones that have witnessed significant missile activity linked to hackers as part of an ongoing operation targeting Israel.\n\nCompromised servers contained live CCTV feeds from Jerusalem, allowing the groups to surveil Tel Aviv, Haifa, and Jerusalem.\n\nThis recent camera targeting by several hackers serves as an early indicator of potential follow-on\n\nThe exploited vulnerabilities include:\n\n\u00b7 An improper authentication vulnerability in Hikvision IP camera firmware (CVE-2017-7921)\n\u00b7 A command injection vulnerability in the Hikvision web server component (CVE-2021-36260)\n\u00b7 An OS command injection vulnerability in the Hikvision Intercom Broadcasting System (CVE-2023-6895)\n\u00b7 An unauthenticated remote code execution vulnerability in the Hikvision Integrated Security Management Platform (CVE-2025-34067)\n\u00b7 An authentication bypass vulnerability in multiple Dahua products (CVE-2021-33044)\n\n@TheGhostITM", "creation_timestamp": "2026-08-30T00:00:45.863326Z"} https://vulnerability.circl.lu/sighting/b27fffac-0074-4651-b9ed-a478763d14a1/export Sun, 30 Aug 2026 00:00:45 +0000 https://vulnerability.circl.lu/sighting/5e032a96-fee1-4ae2-aa88-d0bc28a75bac/export {"uuid": "5e032a96-fee1-4ae2-aa88-d0bc28a75bac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34067", "type": "seen", "source": "https://t.me/CyberDispatch/857", "content": "Hackers Exploit Israel Camera Vulnerabilities to Surveil\n\nMultiple hacking groups have been targeting internet-connected surveillance cameras across Israel and other Middle Eastern countries since the war began on February 28.\n\nThe countries targeted in these digital intrusions\u2014Israel, Qatar, Bahrain, Kuwait, the UAE, Cyprus, and Lebanon\u2014are the same ones that have witnessed significant missile activity linked to hackers as part of an ongoing operation targeting Israel.\n\nCompromised servers contained live CCTV feeds from Jerusalem, allowing the groups to surveil Tel Aviv, Haifa, and Jerusalem.\n\nThis recent camera targeting by several hackers serves as an early indicator of potential follow-on\n\nThe exploited vulnerabilities include:\n\n\u00b7 An improper authentication vulnerability in Hikvision IP camera firmware (CVE-2017-7921)\n\u00b7 A command injection vulnerability in the Hikvision web server component (CVE-2021-36260)\n\u00b7 An OS command injection vulnerability in the Hikvision Intercom Broadcasting System (CVE-2023-6895)\n\u00b7 An unauthenticated remote code execution vulnerability in the Hikvision Integrated Security Management Platform (CVE-2025-34067)\n\u00b7 An authentication bypass vulnerability in multiple Dahua products (CVE-2021-33044)\n\n@TheGhostITM", "creation_timestamp": "2026-08-29T20:00:20.888104Z"} {"uuid": "5e032a96-fee1-4ae2-aa88-d0bc28a75bac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34067", "type": "seen", "source": "https://t.me/CyberDispatch/857", "content": "Hackers Exploit Israel Camera Vulnerabilities to Surveil\n\nMultiple hacking groups have been targeting internet-connected surveillance cameras across Israel and other Middle Eastern countries since the war began on February 28.\n\nThe countries targeted in these digital intrusions\u2014Israel, Qatar, Bahrain, Kuwait, the UAE, Cyprus, and Lebanon\u2014are the same ones that have witnessed significant missile activity linked to hackers as part of an ongoing operation targeting Israel.\n\nCompromised servers contained live CCTV feeds from Jerusalem, allowing the groups to surveil Tel Aviv, Haifa, and Jerusalem.\n\nThis recent camera targeting by several hackers serves as an early indicator of potential follow-on\n\nThe exploited vulnerabilities include:\n\n\u00b7 An improper authentication vulnerability in Hikvision IP camera firmware (CVE-2017-7921)\n\u00b7 A command injection vulnerability in the Hikvision web server component (CVE-2021-36260)\n\u00b7 An OS command injection vulnerability in the Hikvision Intercom Broadcasting System (CVE-2023-6895)\n\u00b7 An unauthenticated remote code execution vulnerability in the Hikvision Integrated Security Management Platform (CVE-2025-34067)\n\u00b7 An authentication bypass vulnerability in multiple Dahua products (CVE-2021-33044)\n\n@TheGhostITM", "creation_timestamp": "2026-08-29T20:00:20.888104Z"} https://vulnerability.circl.lu/sighting/5e032a96-fee1-4ae2-aa88-d0bc28a75bac/export Sat, 29 Aug 2026 20:00:20 +0000 https://vulnerability.circl.lu/sighting/f4df9e21-eba9-4fac-b5a5-8156670ab95e/export {"uuid": "f4df9e21-eba9-4fac-b5a5-8156670ab95e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34068", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-26)", "content": "", "creation_timestamp": "2026-08-27T10:00:39.506063Z"} {"uuid": "f4df9e21-eba9-4fac-b5a5-8156670ab95e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34068", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-26)", "content": "", "creation_timestamp": "2026-08-27T10:00:39.506063Z"} https://vulnerability.circl.lu/sighting/f4df9e21-eba9-4fac-b5a5-8156670ab95e/export Thu, 27 Aug 2026 10:00:39 +0000 https://vulnerability.circl.lu/sighting/842e1b6c-12b2-4d21-96f7-ad2570590b4f/export {"uuid": "842e1b6c-12b2-4d21-96f7-ad2570590b4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34068", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-25)", "content": "", "creation_timestamp": "2026-08-26T10:00:12.261303Z"} {"uuid": "842e1b6c-12b2-4d21-96f7-ad2570590b4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34068", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-25)", "content": "", "creation_timestamp": "2026-08-26T10:00:12.261303Z"} https://vulnerability.circl.lu/sighting/842e1b6c-12b2-4d21-96f7-ad2570590b4f/export Wed, 26 Aug 2026 10:00:12 +0000 https://vulnerability.circl.lu/sighting/71e975ae-8484-40e0-a9f1-e35dee72adf9/export {"uuid": "71e975ae-8484-40e0-a9f1-e35dee72adf9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34068", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-17)", "content": "", "creation_timestamp": "2026-08-18T10:00:07.697782Z"} {"uuid": "71e975ae-8484-40e0-a9f1-e35dee72adf9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34068", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-17)", "content": "", "creation_timestamp": "2026-08-18T10:00:07.697782Z"} https://vulnerability.circl.lu/sighting/71e975ae-8484-40e0-a9f1-e35dee72adf9/export Tue, 18 Aug 2026 10:00:07 +0000 https://vulnerability.circl.lu/sighting/93adfa4c-d358-4ba6-b325-b5e8806c0188/export {"uuid": "93adfa4c-d358-4ba6-b325-b5e8806c0188", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34068", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-11)", "content": "", "creation_timestamp": "2026-08-12T10:00:05.330900Z"} {"uuid": "93adfa4c-d358-4ba6-b325-b5e8806c0188", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34068", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-11)", "content": "", "creation_timestamp": "2026-08-12T10:00:05.330900Z"} https://vulnerability.circl.lu/sighting/93adfa4c-d358-4ba6-b325-b5e8806c0188/export Wed, 12 Aug 2026 10:00:05 +0000