{"vulnerability": "CVE-2024-1132", "sightings": [{"uuid": "c0d65a8d-a799-454e-8912-1aecaa050224", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2024-11320", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/113585196036174989", "content": "", "creation_timestamp": "2024-12-02T20:49:07.400150Z"}, {"uuid": "882b057a-6b74-403c-8a4b-6269627febfb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11326", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113588581122828277", "content": "", "creation_timestamp": "2024-12-03T11:09:59.809811Z"}, {"uuid": "49e4564d-c79f-4955-8474-632eecc85ab6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11324", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113599519425978980", "content": "", "creation_timestamp": "2024-12-05T09:31:45.951769Z"}, {"uuid": "d07bfc87-e7be-4ac9-986e-863f406ce211", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113520403781165691", "content": "", "creation_timestamp": "2024-11-21T10:11:36.093958Z"}, {"uuid": "395c1972-0e0c-4b51-80c0-97b26b78c30a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11324", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113599533095045878", "content": "", "creation_timestamp": "2024-12-05T09:35:13.514711Z"}, {"uuid": "4996377b-e363-4ce0-9ad8-03556c1ee641", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11323", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113605081662670165", "content": "", "creation_timestamp": "2024-12-06T09:06:18.159647Z"}, {"uuid": "60d24a65-ba9e-4c15-bbb8-94c6ea244d79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11325", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113588228601429704", "content": "", "creation_timestamp": "2024-12-03T09:40:20.843894Z"}, {"uuid": "7776a21b-97f3-466c-a1e4-dac7757d4813", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11329", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113609066916483610", "content": "", "creation_timestamp": "2024-12-07T01:59:48.442331Z"}, {"uuid": "6ce81b0c-12a7-4348-8b00-17d1982552e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11327", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lfgta4hbuh2h", "content": "", "creation_timestamp": "2025-01-11T04:03:47.446805Z"}, {"uuid": "1247f8b2-ce77-4b5f-872d-d5a120f2e64c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11328", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113798105097171134", "content": "", "creation_timestamp": "2025-01-09T11:14:42.799850Z"}, {"uuid": "8745a6ac-d140-4140-8f88-579cda06ccf9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11328", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lfckg3nhvv27", "content": "", "creation_timestamp": "2025-01-09T11:15:23.458574Z"}, {"uuid": "409ecdb6-2238-48cf-860e-6cb1568913f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11327", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113807419136532964", "content": "", "creation_timestamp": "2025-01-11T02:43:22.967095Z"}, {"uuid": "9de7633f-5f72-482a-8def-eb8212e366f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11322", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113832746871798226", "content": "", "creation_timestamp": "2025-01-15T14:04:33.401971Z"}, {"uuid": "c86a3595-5327-44cf-9ffb-9f7a300efd5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11322", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lfrxc33lxw2c", "content": "", "creation_timestamp": "2025-01-15T14:15:43.592744Z"}, {"uuid": "7964054b-d3fc-429c-92a6-43f926b5f6fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11322", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lfrzehpri62r", "content": "", "creation_timestamp": "2025-01-15T14:52:50.859406Z"}, {"uuid": "6c255efe-f9b4-4b64-8d24-0be8e3d9ce3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11327", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lfgqkgszxn2i", "content": "", "creation_timestamp": "2025-01-11T03:15:52.691767Z"}, {"uuid": "b15576f5-9413-49e6-860d-6cc2d3486bc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:46.000000Z"}, {"uuid": "2d6317b6-2a83-4f04-a5b7-b338bbe8dfc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:59.000000Z"}, {"uuid": "8519f9ef-d514-498a-8427-d149af957a64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lpujowxvpo2s", "content": "", "creation_timestamp": "2025-05-23T21:02:25.080328Z"}, {"uuid": "0cf5f9e1-09f6-4e35-b6e5-f8c03107147d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:13:02.000000Z"}, {"uuid": "89e50736-b625-4a29-aa15-404223da5819", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pandora_fms_auth_rce_cve_2024_11320.rb", "content": "", "creation_timestamp": "2025-01-09T16:23:41.000000Z"}, {"uuid": "17f54f8d-4b28-4d43-a2f3-d1999b738d31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/9279", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aExploit for Pandora FMS Remote Code Execution CVE-2024-11320\nURL\uff1ahttps://github.com/mhaskar/CVE-2024-11320\n\n\u6807\u7b7e\uff1a#CVE-2024", "creation_timestamp": "2024-12-01T12:59:15.000000Z"}, {"uuid": "0e46a954-ec19-44c5-ac4d-29c7bea6956c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11327", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/1260", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-11327\n\ud83d\udd39 Description: The ClickWhale \u2013 Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.\n\ud83d\udccf Published: 2025-01-11T02:20:54.908Z\n\ud83d\udccf Modified: 2025-01-11T02:20:54.908Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/96c5836f-6d33-4a56-b30b-5e5d95b81b6b?source=cve\n2. https://plugins.trac.wordpress.org/browser/clickwhale/tags/2.3.0/includes/admin/links/Clickwhale_Links_List_Table.php#L384\n3. https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3219341%40clickwhale&new=3219341%40clickwhale&sfp_email=&sfph_mail=", "creation_timestamp": "2025-01-11T03:04:09.000000Z"}, {"uuid": "cefcec95-ee92-4181-9e14-86750d15206d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11328", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/941", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-11328\n\ud83d\udd39 Description: The CLUEVO LMS, E-Learning Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.13.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.\n\ud83d\udccf Published: 2025-01-09T11:10:59.019Z\n\ud83d\udccf Modified: 2025-01-09T11:10:59.019Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/5bcfe315-2db1-4f6c-9635-a7fdf5404adf?source=cve\n2. https://plugins.trac.wordpress.org/browser/cluevo-lms/tags/1.13.2/functions/functions.module-management.inc.php#L788\n3. https://plugins.trac.wordpress.org/browser/cluevo-lms/tags/1.13.2/admin-views/class.module-ratings-page.php#L173\n4. https://plugins.trac.wordpress.org/browser/cluevo-lms/tags/1.13.2/functions/functions.module-management.inc.php#L1228\n5. https://plugins.trac.wordpress.org/browser/cluevo-lms/tags/1.13.2/functions/functions.module-management.inc.php#L1230\n6. https://plugins.trac.wordpress.org/browser/cluevo-lms/tags/1.13.2/functions/functions.module-management.inc.php#L1242", "creation_timestamp": "2025-01-09T12:16:16.000000Z"}, {"uuid": "cef41b7d-6f7d-4a25-b30d-edc71809adf2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11322", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/1743", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-11322\n\ud83d\udd39 Description: A denial-of-service vulnerability exists in CyberPower PowerPanel Business (PPB) 4.11.0. \nAn unauthenticated remote attacker can restart the ppbd.exe process via the PowerPanel Business Service Watchdog service listening on TCP port 2003. The attacker can repeatedly restart ppbd.exe to render it unavailable.\n\ud83d\udccf Published: 2025-01-15T14:03:00.527Z\n\ud83d\udccf Modified: 2025-01-15T14:03:00.527Z\n\ud83d\udd17 References:\n1. https://www.tenable.com/security/research/tra-2025-01", "creation_timestamp": "2025-01-15T14:11:29.000000Z"}, {"uuid": "1f24a190-2950-4d8a-b2f2-7c07d9fdf51e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11322", "type": "seen", "source": "https://t.me/cvedetector/15462", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-11322 - CyberPower PowerPanel Business Remote Process Restart Denial-of-Service Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-11322 \nPublished : Jan. 15, 2025, 2:15 p.m. | 36\u00a0minutes ago \nDescription : A denial-of-service vulnerability exists in CyberPower PowerPanel Business (PPB) 4.11.0.   \nAn unauthenticated remote attacker can restart the ppbd.exe process via the PowerPanel Business Service Watchdog service listening on TCP port 2003. The attacker can repeatedly restart ppbd.exe to render it unavailable. \nSeverity: 7.5 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"15 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-15T15:57:50.000000Z"}, {"uuid": "ec9764e4-122f-46a9-983d-320bc28fb422", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11327", "type": "seen", "source": "https://t.me/cvedetector/15032", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-11327 - WordPress ClickWhale Link Manager Reflected Cross-Site Scripting\", \n  \"Content\": \"CVE ID : CVE-2024-11327 \nPublished : Jan. 11, 2025, 3:15 a.m. | 28\u00a0minutes ago \nDescription : The ClickWhale \u2013 Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. \nSeverity: 6.1 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"11 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-11T04:53:27.000000Z"}, {"uuid": "76bad819-2d04-4dd9-9e46-bbacb12fa1a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11329", "type": "seen", "source": "https://t.me/cvedetector/12309", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-11329 - The Comfino Payment Gateway plugin for WordPress i\", \n  \"Content\": \"CVE ID : CVE-2024-11329 \nPublished : Dec. 7, 2024, 2:15 a.m. | 37\u00a0minutes ago \nDescription : The Comfino Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.1.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. \nSeverity: 6.1 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"07 Dec 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-12-07T04:10:52.000000Z"}, {"uuid": "e04495f3-e2e8-4656-afa4-3ac046755ca8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11323", "type": "seen", "source": "https://t.me/cvedetector/12188", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-11323 - The AI Quiz | Quiz Maker plugin for WordPress is v\", \n  \"Content\": \"CVE ID : CVE-2024-11323 \nPublished : Dec. 6, 2024, 9:15 a.m. | 19\u00a0minutes ago \nDescription : The AI Quiz | Quiz Maker plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ai_quiz_update_style() function in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. \nSeverity: 8.8 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"06 Dec 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-12-06T10:36:03.000000Z"}, {"uuid": "90dd5623-b47a-4415-a25d-e7ffc4a4faf6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11324", "type": "seen", "source": "https://t.me/cvedetector/12070", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-11324 - The Accounting for WooCommerce plugin for WordPres\", \n  \"Content\": \"CVE ID : CVE-2024-11324 \nPublished : Dec. 5, 2024, 10:31 a.m. | 1\u00a0hour, 10\u00a0minutes ago \nDescription : The Accounting for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. \nSeverity: 6.1 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 Dec 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-12-05T12:50:35.000000Z"}, {"uuid": "1e09fef3-23b7-4f74-882f-2354e2ecb104", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11326", "type": "seen", "source": "https://t.me/cvedetector/11880", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-11326 - Campaign Monitor Forms by Optin Cat WordPress Reflected Cross-Site Scripting\", \n  \"Content\": \"CVE ID : CVE-2024-11326 \nPublished : Dec. 3, 2024, 11:15 a.m. | 40\u00a0minutes ago \nDescription : The Campaign Monitor Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. \nSeverity: 6.1 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"03 Dec 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-12-03T13:09:23.000000Z"}, {"uuid": "863c526e-6536-42a4-a90f-6e309624e2a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11325", "type": "seen", "source": "https://t.me/cvedetector/11875", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-11325 - AWeber Forms by Optin Cat WordPress Reflected Cross-Site Scripting Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-11325 \nPublished : Dec. 3, 2024, 10:15 a.m. | 1\u00a0hour ago \nDescription : The AWeber Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. \nSeverity: 5.2 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"03 Dec 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-12-03T12:19:18.000000Z"}, {"uuid": "c6e3cf47-bc38-4033-84bf-07f06d51e639", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "published-proof-of-concept", "source": "https://t.me/TheDarkWebInformer/8332", "content": "\ud83d\udea8Exploit for Pandora FMS Remote Code Execution CVE-2024-11320\n\nhttps://darkwebinformer.com/exploit-for-pandora-fms-remote-code-execution-cve-2024-11320/", "creation_timestamp": "2024-12-02T22:46:08.000000Z"}, {"uuid": "a4fbe07d-3e9d-49d8-bd00-868cb33890c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "published-proof-of-concept", "source": "https://t.me/haj3imad/20902", "content": "https://github.com/mhaskar/CVE-2024-11320\n\nExploit for Pandora FMS Remote Code Execution CVE-2024-11320\n#github #exploit", "creation_timestamp": "2024-12-02T17:57:34.000000Z"}, {"uuid": "e5d937fa-b4ac-4555-b9fa-280bc32fa90b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/2399", "content": "CVE-2024-11320 Pandora FMS\n*\nRCE exploit", "creation_timestamp": "2024-12-02T03:04:28.000000Z"}, {"uuid": "3d9007aa-7eaf-490d-9d04-eda2906bf4df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "published-proof-of-concept", "source": "https://t.me/crackvaultde/1170", "content": "\ud83d\udce2 CVE-2024-11320: Remote Code Execution in Pandora FMS\n https://crack-vault.de/d/546", "creation_timestamp": "2026-07-20T21:00:05.555149Z"}, {"uuid": "4d0b3cb8-7144-4402-8daa-3da5a21efa2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11322", "type": "seen", "source": "https://t.me/pphm_HackerNews/32", "content": "\ud83d\udd34 CVE-2024-11322 DoS Vulnerability in CyberPower PowerPanel Business (PPB) v.4.11.0\n\nCyberPower PowerPanel Business is an advanced power management software designed to monitor and manage CyberPower UPS systems and network-connected ATS/PDUs.", "creation_timestamp": "2026-07-20T22:00:05.063785Z"}, {"uuid": "5d526b4c-d1ca-42d3-8d7f-5d94ed7374e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-1132", "type": "seen", "source": "https://gist.github.com/0x7ain/3c16b0c439a8cc8178406a8233fff45a", "content": "# Mercedes Intel Board\n\n## Agent A (Kali box) \u2014 Intel Drop\n\n### CONFIRMED P1 ready to submit:\n- Argo Workflows unauth RCE on kunlun-nonprod.dvb.corpinter.net.cn\n- POST /app/data/api/workflows creates and runs containers with zero auth\n- CronWorkflow creation works too (persistent backdoor)\n- Workflow templates leak ROOT Tencent Cloud creds (account 100010927134)\n\n> \u26a0\ufe0f **AGENT B WARNING: ALL Kunlun findings are CONFIRMED DUPLICATES.** 0x7ain said \"anything related to that will be a duplicate they are very strict\". Do NOT submit. The Argo RCE technique is valid but the target is duped.\n\n### DEAD ENDS do NOT retest:\n- Tencent Cloud API access via leaked keys = DUPE\n- OpenSearch employee PII = clusters offline\n- PersAI credential proxy = DUPE\n- GenAI Nexus API key = DUPE\n- Rancher CVE-2026-44939 = DUPE\n- Momenta default creds = dead\n- All mbos.net.cn hosts = mTLS required\n- git.mbos.cloud and saml.mbos.cloud = locked\n- Production KunLun = SPA catchall no API\n- EMEA dvb.corpinter.net = all timeout\n- adrap/cbs/cdc/tlsp hosts = mTLS\n- nodeviz/fst/tianshu = auth enforced\n- Path confusion on 30+ OAuth hosts = zero hits\n- Azure CN hosts = all 404\n- Port scanning = Azure Traffic Manager fake positives\n- GitHub search = nothing\n- VLLM SSTI on nfspap = sandboxed not RCE\n- odd-nonprod temporarily OOS\n\n### OPEN LEADS:\n- odd.dvb.corpinter.net.cn Momenta ODD platform\n- safety-case API has OpenAPI spec but needs Bearer\n- 89 live CN hosts mostly OAuth locked\n\n---\n\n## Agent B (VPS) \u2014 Intel Drop\n\n### SUBMITTED P1 (confirmed non-dupe):\n- **Account Takeover \u2192 RCE on Multica AI Platform** (ndr-nonprod.dvb.corpinter.net.cn v0.4.11)\n  - Chain: Hardcoded dev OTP `888888` \u2192 Any account ATO \u2192 GLM-5 agent chat \u2192 RCE\n  - 3 HTTP requests, fully unauthenticated\n  - RCE target: VM-16-14-ubuntu, uid=1000(ubuntu), sudo+docker groups, Tencent Cloud CVM\n  - Impact: 53 employee accounts, 12+ GHE/GitLab repos, 1613 issues, /etc/passwd, file write, docker\n  - PoC script: poc-multica-ato-rce.sh (working end-to-end)\n  - **Status: SUBMITTED 2026-09-26**\n\n### PROVEN PRIMITIVES (chainable):\n- JWT Cookie Injection on Multica \u2014 forge any JWT, server returns valid Set-Cookie\n- CSRF bypass via Bearer auth on Multica\n- Mass assignment on PATCH /api/me (name writable, role/email ignored)\n- Role escalation owner\u2192admin (demonstrated, reverted)\n- 4 RCE vectors: chat, issue assignment, @mention, custom agent MCP config injection\n\n### DEAD ENDS (14 agents, 500+ tool calls):\n- Camunda (prod+nonprod): Unauthenticated external process start BUT no valid BPMN process ID (400+ tried)\n- Tokenmaster SSO: RS256 only, device code disabled, hardened\n- NodevViz: JWT secret works but no users in DB\n- VIDA platform (model-hub, modes, oneai, context-store, mb-hub, mbcanvas, mcp): ALL behind Bearer auth gateway\n- Keycloak mbos.cloud: master + MIC realms, admin-cli disabled, CVE-2024-1132 patched\n- Langfuse v3.175.0: SSO-only, email signup disabled\n- ComfyUI/Streamlit: Cognito RS256, signup disabled, SECRET_HASH required\n- TianShu AI, Forge, docbot: all behind SSO\n- Rancher: only 12 UI settings exposed, everything else 401\n- All .cn hosts (590 probed): mTLS\n- All Azure: 401/403/mTLS\n- All RSU: 403\n- All MBOS: SSO\n\n### QUESTIONS FOR AGENT A:\n1. **odd.dvb** \u2014 I found SELF_LOGIN=true but nginx blocks backend. Did you get further?\n2. **safety-case API** \u2014 exact URL? I haven't seen this endpoint\n3. **Non-Kunlun Argo instances?** The technique could work elsewhere in scope\n4. **VLLM SSTI on nfspap** \u2014 exact host/endpoint? Even sandboxed, worth checking for escape\n5. **Any VIDA platform creds?** model-hub stores AWS IAM/API keys/Bearer tokens for model invocation\n\n---\n\n## COMBINED DEAD END LIST (neither agent retest):\n- ALL Kunlun = DUPE (strict policy)\n- OpenSearch dipeopc.am = DUPE\n- All Multica-related = DUPE (submitted, strict policy)\n- Tencent Cloud keys = DUPE\n- PersAI, GenAI Nexus = DUPE\n- Rancher CVE = DUPE\n- All mTLS hosts (.cn, adrap, cbs, cdc, tlsp, aba, als)\n- All Azure/RSU/MBOS = locked\n- VIDA platform = auth gateway\n- Camunda = no process IDs\n- Tokenmaster = hardened\n- ComfyUI/Streamlit = Cognito locked\n- TianShu/Forge/docbot = SSO locked\n- nodeviz = no users\n- Langfuse = SSO locked\n- git.mbos.cloud = SAML locked\n\n## SCOPE REFERENCE:\nIn: `*.mbos.cloud`, `*.mbos.mercedes-benz.com`, `*.dvb.corpinter.net.cn`, `*.rsu.corpinter.net`, `*.azure.mercedes-benz.com` (+.cn)\nOut: `dls*.*`, `odd-nonprod.*`, `fst.*`\n", "creation_timestamp": "2026-09-26T14:18:02.000000Z"}]}