{"vulnerability": "2015-85", "sightings": [{"uuid": "36b5d1c9-0ca6-4ad5-83da-eda20bcb0058", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "seen", "source": "MISP/57344868-a120-4004-90f6-4c49950d210f", "content": "", "creation_timestamp": "2016-05-12T09:12:03.000000Z"}, {"uuid": "61bbf6c5-c890-4b63-861b-49f31f93a474", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "exploited", "source": "https://www.exploit-db.com/exploits/38977", "content": "", "creation_timestamp": "2015-12-15T00:00:00.000000Z"}, {"uuid": "065dd4d3-ba0b-4234-9da4-b19c0f4ab0b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:42.000000Z"}, {"uuid": "85a6bb97-a48d-4780-af7a-f88d71a83e08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:43.000000Z"}, {"uuid": "ae935b4c-5261-42f5-a40a-b1e9704c9529", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/joomla_http_header_rce.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "6b581a7f-eb0d-43c5-a2aa-a6bc0ecb1427", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2015-8553", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "10703002-9aa0-47fb-91eb-d643e03297a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8522", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/80402", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #Remote\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2015-8522.RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a damariion\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-15 10:58:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nTivoli FastBack Server (6.1.4) is vulnerable to a stack-based buffer overflow allowing threat-actors to gain Arbitrary Code Execution (ACE) via a remote TCP-connection. The PoC provided in this repository leverages this vulnerability to establish a reverse-shell.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-15T11:00:41.000000Z"}, {"uuid": "b8a9abb9-da69-4bdc-bebf-27fffa9a3e37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "published-proof-of-concept", "source": "https://github.com/google/tsunami-security-scanner-plugins/tree/master/google/detectors/rce/joomla/cve20158562", "content": "", "creation_timestamp": "2021-02-05T21:43:47.000000Z"}, {"uuid": "966a4ef2-e5af-4fac-bf0a-9e25c0f0ed0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "published-proof-of-concept", "source": "Telegram/5XGpncEfRIuewYJEc34aWTFVRwMO65Yc4SMMQva9F06aJhs", "content": "", "creation_timestamp": "2025-07-13T21:00:04.000000Z"}, {"uuid": "16d0b9f2-512c-43b6-82b8-149ff737ce74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "exploited", "source": "https://t.me/arpsyndicate/1570", "content": "#ExploitObserverAlert\n\nCVE-2015-8562\n\nDESCRIPTION: Exploit Observer has 42 entries related to CVE-2015-8562. Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.\n\nFIRST-EPSS: 0.971900000\nNVD-IS: 6.4\nNVD-ES: 10.0", "creation_timestamp": "2023-12-08T13:45:10.000000Z"}, {"uuid": "427e0d1d-1b5d-4303-a7e9-5c1b5c1772ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8536", "type": "seen", "source": "https://t.me/cibsecurity/10786", "content": "ATENTION\u203c New - CVE-2015-8536\n\nMITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was discovered (fixed and publicly disclosed in 2015) in Lenovo Solution Center (LSC) prior to version 3.3.002 that could allow cross-site request forgery.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-03-27T17:52:10.000000Z"}, {"uuid": "0fa26021-53f7-428e-8fd8-079202cb9a53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8535", "type": "seen", "source": "https://t.me/cibsecurity/10787", "content": "ATENTION\u203c New - CVE-2015-8535\n\nMITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A directory traversal vulnerability was discovered (fixed and publicly disclosed in 2015) in Lenovo Solution Center (LSC) prior to version 3.3.002 that could allow a user to execute arbitrary code with elevated privileges.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-03-27T17:52:10.000000Z"}, {"uuid": "d168bfb5-ff22-4595-bc8f-3dfa1aaa07c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8534", "type": "seen", "source": "https://t.me/cibsecurity/10788", "content": "ATENTION\u203c New - CVE-2015-8534\n\nMITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was discovered (fixed and publicly disclosed in 2015) in Lenovo Solution Center (LSC) prior to version 3.3.002 that could allow a user to execute arbitrary code with elevated privileges.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-03-27T17:52:12.000000Z"}, {"uuid": "810fc0f7-9ac6-446c-8bfe-d08e2731ff3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8546", "type": "seen", "source": "https://t.me/cibsecurity/11169", "content": "ATENTION\u203c New - CVE-2015-8546\n\nAn issue was discovered on Samsung mobile devices with software through 2015-11-12, affecting the Galaxy S6/S6 Edge, Galaxy S6 Edge+, and Galaxy Note5 with the Shannon333 chipset. There is a stack-based buffer overflow in the baseband process that is exploitable for remote code execution via a fake base station. The Samsung ID is SVE-2015-5123 (December 2015).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-04-10T22:43:11.000000Z"}, {"uuid": "31e81e26-5f30-4697-95c3-77e796cbe85c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-08)", "content": "", "creation_timestamp": "2026-08-09T11:43:04.990316Z"}, {"uuid": "e2bb6347-abc0-4aa0-a4da-d66a21afb573", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ef8abf2b-68d3-4fc7-ad1f-6ec995305355", "content": "", "creation_timestamp": "2026-06-19T16:45:34.698694Z"}, {"uuid": "73972342-401e-4d73-9641-297b2db98c7a", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/da7b4e3b-1802-41d3-8dd8-2deeda750be4", "content": "", "creation_timestamp": "2026-06-23T14:04:06.768872Z"}, {"uuid": "08ee5c98-f7d3-4d74-8ad7-5ed09dafe1ff", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2015-8562", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/da9dfb3d-1712-4941-8114-ffd60a28f73c", "content": "", "creation_timestamp": "2026-06-30T12:40:26.737232Z"}, {"uuid": "3d4f9888-59aa-4fff-ab88-3fe5055cfd21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-27)", "content": "", "creation_timestamp": "2026-07-28T10:15:24.042359Z"}, {"uuid": "d2e4d1fc-c952-4880-bb3b-50ce96177d5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "published-proof-of-concept", "source": "Telegram/gaBdUAEEWVgUcYnHku1FjILsSJN1BtvDBCiJZ9Y-qG01X4M", "content": "", "creation_timestamp": "2026-09-02T01:00:04.236223Z"}, {"uuid": "88957155-c62f-446a-be5a-82fd36478689", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "published-proof-of-concept", "source": "Telegram/gaBdUAEEWVgUcYnHku1FjILsSJN1BtvDBCiJZ9Y-qG01X4M", "content": "", "creation_timestamp": "2026-09-03T00:00:59.806806Z"}, {"uuid": "5f6c90ac-2e3e-47b0-9aec-697e333e738d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-8562", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/joomla_http_header_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Marc-Alexandre Montpas\", \"Christian Mehlmauer \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Joomla suffers from an unauthenticated remote code execution that affects all versions from 1.5.0 to 3.4.5.\\n          By storing user supplied headers in the databases session table it's possible to truncate the input\\n          by sending an UTF-8 character. The custom created payload is then executed once the session is read\\n          from the database. You also need to have a PHP version before 5.4.45 (including 5.3.x), 5.5.29 or 5.6.13.\\n          In later versions the deserialisation of invalid session data stops on the first error and the\\n          exploit will not work. The PHP Patch was included in Ubuntu versions 5.5.9+dfsg-1ubuntu4.13 and\\n          5.3.10-1ubuntu3.20 and in Debian in version 5.4.45-0+deb7u1.\", \"disclosure_date\": \"2015-12-14\", \"fullname\": \"exploit/multi/http/joomla_http_header_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:57:58 +0000\", \"name\": \"Joomla HTTP Header Unauthenticated Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/multi/http/joomla_http_header_rce.rb\", \"platform\": \"PHP\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/joomla_http_header_rce\", \"references\": [\"CVE-2015-8562\", \"EDB-38977\", \"EDB-39033\", \"URL-http://web.archive.org/web/20250117165939/https://blog.sucuri.net/2015/12/joomla-remote-code-execution-the-details.html\", \"URL-http://web.archive.org/web/20250220041731/https://blog.sucuri.net/2015/12/remote-command-execution-vulnerability-in-joomla.html\", \"URL-https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html\", \"URL-https://blog.patrolserver.com/2015/12/17/in-depth-analyses-of-the-joomla-0-day-user-agent-exploit/\", \"URL-https://translate.google.com/translate?hl=en&sl=auto&tl=en&u=http%3A%2F%2Fdrops.wooyun.org%2Fpapers%2F11330\", \"URL-https://translate.google.com/translate?hl=en&sl=auto&tl=en&u=http%3A%2F%2Fwww.freebuf.com%2Fvuls%2F89754.html\", \"URL-https://bugs.php.net/bug.php?id=70219\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Joomla 1.5.0 - 3.4.5\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:00.061016Z"}]}