{"vulnerability": "CVE-2025-2905", "sightings": [{"uuid": "3093fde8-389a-4d61-923e-5e5b9f99edff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-29058", "type": "seen", "source": "https://mastodon.social/users/CyberSignaler/statuses/114374378450371035", "content": "", "creation_timestamp": "2025-04-21T05:48:35.723524Z"}, {"uuid": "e538a03a-f905-464e-9b8f-727fab6e5921", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2905", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3log5hwunmf2o", "content": "", "creation_timestamp": "2025-05-05T10:21:10.288817Z"}, {"uuid": "f6343ea8-9656-415e-89eb-eb582950b7f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2905", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/114455354241954889", "content": "", "creation_timestamp": "2025-05-05T13:01:47.956626Z"}, {"uuid": "e1e02c4b-24fa-48cc-9155-e52d2dd9d34a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2905", "type": "seen", "source": "https://bsky.app/profile/dinosn.bsky.social/post/3lohtddyivk22", "content": "", "creation_timestamp": "2025-05-06T02:25:02.246698Z"}, {"uuid": "fb2d9922-6071-4486-8c4b-0f1f2b4abe02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2905", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3lohzjokdo42o", "content": "", "creation_timestamp": "2025-05-06T04:15:53.860808Z"}, {"uuid": "5ea9a887-2a33-46a5-b24d-c710a964cf66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2905", "type": "seen", "source": "https://bsky.app/profile/modat-io.bsky.social/post/3loiyn6xhrc2t", "content": "", "creation_timestamp": "2025-05-06T13:32:37.197641Z"}, {"uuid": "259d20e4-46f7-4c9e-b36b-f4d32c48403e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2905", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lomwxmdxk22g", "content": "", "creation_timestamp": "2025-05-08T03:13:18.275555Z"}, {"uuid": "fdeb66fb-0fa5-4a98-a16d-4967320066f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2905", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3m4ak2sfsov2s", "content": "", "creation_timestamp": "2025-10-28T08:43:12.415371Z"}, {"uuid": "66103668-54b3-4348-b353-cf5d5a50b238", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2905", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3m4aljvuylc2l", "content": "", "creation_timestamp": "2025-10-28T09:09:32.922682Z"}, {"uuid": "1e440247-5108-4e91-8ecd-80185c2cc1a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2905", "type": "published-proof-of-concept", "source": "https://t.me/TopCyberTechNews/651", "content": "Top Security News for Today\n\nDeepfake-as-a-Service 2025 \u2013 How Voice Cloning and Synthetic Media Fraud Are Changing Enterprise Defenses  \nhttps://www.darknet.org.uk/2025/10/deepfake-as-a-service-2025-how-voice-cloning-and-synthetic-media-fraud-are-changing-enterprise-defenses/\n\n404 to arbitrary file read in WSO2 API Manager (CVE-2025-2905)  \nhttps://www.reddit.com/r/netsec/comments/1oi416x/404_to_arbitrary_file_read_in_wso2_api_manager/\n\nCrafting self masking functions using LLVM  \nhttps://www.reddit.com/r/netsec/comments/1oi3jnm/crafting_self_masking_functions_using_llvm/\n\nImproving E-commerce Search with Category-Aligned Retrieval  \nhttps://arxiv.org/abs/2510.21710\n\nSocial Engineering People\u2019s Credit Card Details  \nhttps://www.schneier.com/blog/archives/2025/10/social-engineering-peoples-credit-card-details.html\n\nNew Android malware mimics human typing to evade detection, steal money  \nhttps://therecord.media/android-malware-mimics-humans-avoid-detection\n\nFollow Top Cyber News at https://t.me/TopCyberTechNews Feel free to DM me at https://twitter.com/ShayaFeedman", "creation_timestamp": "2025-10-29T09:30:32.000000Z"}, {"uuid": "ad27eb27-e113-4ef9-88e5-3645df9a6267", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-29058", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/12547", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-29058\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: An issue in Qimou CMS v.3.34.0 allows a remote attacker to execute arbitrary code via the upgrade.php component.\n\ud83d\udccf Published: 2025-04-18T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-18T20:14:39.999Z\n\ud83d\udd17 References:\n1. https://cdn.wjlin0.com/halo-img/74CMSv3.34.0%E5%AD%98%E5%9C%A8%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.zip", "creation_timestamp": "2025-04-18T20:59:29.000000Z"}, {"uuid": "c94365d7-0006-45bf-8def-2aa8a97f9cbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2905", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/14842", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-2905\n\ud83d\udd25 CVSS Score: 9.1 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)\n\ud83d\udd39 Description: An XML External Entity (XXE) vulnerability exists in the gateway component of WSO2 API Manager due to insufficient validation of XML input in crafted URL paths. User-supplied XML is parsed without appropriate restrictions, enabling external entity resolution.\n\n\nThis vulnerability can be exploited by an unauthenticated remote attacker to read files from the server\u2019s filesystem or perform denial-of-service (DoS) attacks.\n\n\n\n  *  \nOn systems running JDK 7 or early JDK 8, full file contents may be exposed.\n\n\n\n\n  *  \nOn later versions of JDK 8 and newer, only the first line of a file may be read, due to improvements in XML parser behavior.\n\n\n\n\n  *  \nDoS attacks such as \"Billion Laughs\" payloads can cause service disruption.\n\ud83d\udccf Published: 2025-05-05T09:02:01.489Z\n\ud83d\udccf Modified: 2025-05-05T09:02:01.489Z\n\ud83d\udd17 References:\n1. https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3993/", "creation_timestamp": "2025-05-05T09:18:55.000000Z"}, {"uuid": "d1475f91-da8a-4036-add2-81a004ed7cff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-29058", "type": "seen", "source": "https://t.me/cvedetector/23356", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-29058 - Qimou CMS Remote Code Execution Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-29058 \nPublished : April 18, 2025, 9:15 p.m. | 1\u00a0hour, 30\u00a0minutes ago \nDescription : An issue in Qimou CMS v.3.34.0 allows a remote attacker to execute arbitrary code via the upgrade.php component. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"19 Apr 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-04-19T00:56:39.000000Z"}, {"uuid": "69e21103-5de1-4461-8cbf-9e7b2cdb49fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2905", "type": "seen", "source": "https://t.me/cvedetector/24449", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-2905 - WSO2 API Manager XXE File Disclosure and Denial of Service Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-2905 \nPublished : May 5, 2025, 9:15 a.m. | 2\u00a0hours, 3\u00a0minutes ago \nDescription : An XML External Entity (XXE) vulnerability exists in the gateway component of WSO2 API Manager due to insufficient validation of XML input in crafted URL paths. User-supplied XML is parsed without appropriate restrictions, enabling external entity resolution.  \n  \n  \nThis vulnerability can be exploited by an unauthenticated remote attacker to read files from the server\u2019s filesystem or perform denial-of-service (DoS) attacks.  \n  \n  \n  \n  *    \nOn systems running JDK 7 or early JDK 8, full file contents may be exposed.  \n  \n  \n  \n  \n  *    \nOn later versions of JDK 8 and newer, only the first line of a file may be read, due to improvements in XML parser behavior.  \n  \n  \n  \n  \n  *    \nDoS attacks such as \"Billion Laughs\" payloads can cause service disruption. \nSeverity: 9.1 | CRITICAL \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 May 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-05-05T13:22:06.000000Z"}]}