{"metadata": {"vulnerability": "CVE-2025-2777", "count": 67, "kinds": {"milestone": 6, "sighting": 34, "kev": 11, "other": 16}}, "data": [{"timestamp": "2025-02-25T15:15:00Z", "date_only": false, "value": "2025-02-25T15:15:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2025-0144", "record": "NCSC-2025-0144", "field": "document.tracking.generator.date"}, {"timestamp": "2025-03-24T21:52:45.584Z", "date_only": false, "value": "2025-03-24T21:52:45.584Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-2777", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-05-07T09:31:00Z", "date_only": false, "value": "2025-05-07T09:31:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2025/05/sysaid-patches-4-critical-flaws.html", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "2295c4fa-cc5d-4dbd-bb01-2bd5c75ef606", "url": "https://thehackernews.com/2025/05/sysaid-patches-4-critical-flaws.html"}, {"timestamp": "2025-05-07T14:15:11.651Z", "date_only": false, "value": "2025-05-07T14:15:11.651271Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/shadowserver/statuses/114466967388160257", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "ed22eb93-e527-452e-8172-d06bdd67fc49", "url": "https://infosec.exchange/users/shadowserver/statuses/114466967388160257"}, {"timestamp": "2025-05-07T14:16:50.714Z", "date_only": false, "value": "2025-05-07T14:16:50.714404Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3lolll3ln2k2p", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "71114729-c3b6-4d28-8e93-0a31c56478aa", "url": "https://bsky.app/profile/shadowserver.bsky.social/post/3lolll3ln2k2p"}, {"timestamp": "2025-05-07T14:16:52.051Z", "date_only": false, "value": "2025-05-07T14:16:52.051852Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3lolll4zukc2p", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "bfaa421b-3028-44a7-a514-8e052ad078ca", "url": "https://bsky.app/profile/shadowserver.bsky.social/post/3lolll4zukc2p"}, {"timestamp": "2025-05-07T14:16:53.387Z", "date_only": false, "value": "2025-05-07T14:16:53.387152Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3lolll4zwis2p", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "b38b8e9b-5b91-4465-9ef3-b41adf938f33", "url": "https://bsky.app/profile/shadowserver.bsky.social/post/3lolll4zwis2p"}, {"timestamp": "2025-05-07T14:53:00.712Z", "date_only": false, "value": "2025-05-07T14:53:00.712Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-2777", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-05-07T15:15:57Z", "date_only": false, "value": "2025-05-07T15:15:57Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-HXV5-FPM3-VHQH", "record": "GHSA-HXV5-FPM3-VHQH", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-05-07T15:15:57.693Z", "date_only": false, "value": "2025-05-07T15:15:57.693", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-2777", "record": "FKIE_CVE-2025-2777", "field": "published"}, {"timestamp": "2025-05-07T15:16:23Z", "date_only": false, "value": "2025-05-07T15:16:23.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/yUbNsI-bWNV2K8tTPh4C-hxM85C-hrLLt_kDH9pSKaydCw", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "8cd198c5-77c1-4533-870a-7cc40de01d01"}, {"timestamp": "2025-05-07T15:21:03Z", "date_only": false, "value": "2025-05-07T15:21:03.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cKure/14634", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "b1ca9a43-b46f-4134-81e0-76fb2b5f9fad", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 Cybersecurity researchers have disclosed multiple security flaw in the on-premise version of SysAid IT support software that could be exploited to achieve pre-authenticated remote code execution with elevated privileges.\n\nThe vulnerabilities, tracked as CVE-2025-2775, CVE-2025-2776, and CVE-2025-2777, have all been described as XML External Entity (XXE) injections, which occur when an attacker is able to successfully interfere with an application's parsing of XML input.\n\nThis, in turn, could permit attackers to inject unsafe XML entities into the web application, allowing them to carry out a Server-Side Request Forgery (SSRF) attack and in worst cases, remote code execution.\n\nhttps://thehackernews.com/2025/05/sysaid-patches-4-critical-flaws.html", "url": "https://t.me/cKure/14634"}, {"timestamp": "2025-05-07T15:31:41Z", "date_only": false, "value": "2025-05-07T15:31:41Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-HXV5-FPM3-VHQH", "record": "GHSA-HXV5-FPM3-VHQH", "field": "published"}, {"timestamp": "2025-05-07T15:31:42Z", "date_only": false, "value": "2025-05-07T15:31:42Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-HXV5-FPM3-VHQH", "record": "GHSA-HXV5-FPM3-VHQH", "field": "modified"}, {"timestamp": "2025-05-07T15:47:36.213Z", "date_only": false, "value": "2025-05-07T15:47:36.213732Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/114467330819942836", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "86422732-ec39-4982-8aaf-35f16f214e7b", "url": "https://infosec.exchange/users/cR0w/statuses/114467330819942836"}, {"timestamp": "2025-05-07T19:55:48.565Z", "date_only": false, "value": "2025-05-07T19:55:48.565467Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/redteamnews.bsky.social/post/3lom6jcwn542q", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "ce9faced-c2a5-4d3e-a0d8-b2b66e4f949c", "url": "https://bsky.app/profile/redteamnews.bsky.social/post/3lom6jcwn542q"}, {"timestamp": "2025-05-07T22:00:00Z", "date_only": false, "value": "2025-05-07T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0981", "record": "WID-SEC-W-2025-0981", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-05-07T22:00:00Z", "date_only": false, "value": "2025-05-07T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0981", "record": "WID-SEC-W-2025-0981", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-05-07T22:00:00Z", "date_only": false, "value": "2025-05-07T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0981", "record": "WID-SEC-W-2025-0981", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2025-05-08T03:56:16.269Z", "date_only": false, "value": "2025-05-08T03:56:16.269269Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-2777", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-05-08T03:56:16.269Z", "date_only": false, "value": "2025-05-08T03:56:16.269269Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-2777", "record": "FKIE_CVE-2025-2777", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-05-08T06:56:21.378Z", "date_only": false, "value": "2025-05-08T06:56:21.378830Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2025-0144", "record": "NCSC-2025-0144", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-05-08T06:56:21.378Z", "date_only": false, "value": "2025-05-08T06:56:21.378830Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2025-0144", "record": "NCSC-2025-0144", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-05-08T06:56:21.378Z", "date_only": false, "value": "2025-05-08T06:56:21.378830Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2025-0144", "record": "NCSC-2025-0144", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-05-08T12:25:23.761Z", "date_only": false, "value": "2025-05-08T12:25:23.761880Z", "kind": "sighting", "label": "Seen", "source": "https://mstdn.ca/users/rfwaveio/statuses/114472197786505302", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "9f650c4e-43f6-4fa2-8b5d-50d40dc5fb13", "url": "https://mstdn.ca/users/rfwaveio/statuses/114472197786505302"}, {"timestamp": "2025-05-09T14:18:17Z", "date_only": false, "value": "2025-05-09T14:18:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/liwaamohammad/1962", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "df2068b2-c4a7-4414-a695-3cd566e14f61", "content": "https://github.com/watchtowrlabs/watchTowr-vs-SysAid-PreAuth-RCE-Chain\n\nPoC for SysAid PreAuth RCE Chain (CVE-2025-2775, CVE-2025-2776, CVE-2025-2777, CVE-2025-2778)\n#github #exploit", "url": "https://t.me/liwaamohammad/1962"}, {"timestamp": "2025-05-10T00:52:20Z", "date_only": false, "value": "2025-05-10T00:52:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/12025", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "46a25fc5-ec5f-4744-a891-653113f06023", "content": "#exploit\nCVE-2025-2775 CVE-2025-2776 CVE-2025-2777 CVE-2025-2778\nSysOwned, Your Friendly Support Ticket - SysAid On-Premise Pre-Auth RCE Chain\n]-> https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/\n\n]-> https://github.com/watchtowrlabs/watchTowr-vs-SysAid-PreAuth-RCE-Chain", "url": "https://t.me/CyberSecurityTechnologies/12025"}, {"timestamp": "2025-05-10T02:44:20Z", "date_only": false, "value": "2025-05-10T02:44:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ton618cyber/3785", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "23f087ad-a2bd-4d18-b8af-798eb92fe276", "content": "#exploit\nCVE-2025-2775 CVE-2025-2776 CVE-2025-2777 CVE-2025-2778\nSysOwned, Your Friendly Support Ticket - SysAid On-Premise Pre-Auth RCE Chain\n]-> https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/\n\n]-> https://github.com/watchtowrlabs/watchTowr-vs-SysAid-PreAuth-RCE-Chain", "url": "https://t.me/ton618cyber/3785"}, {"timestamp": "2025-05-10T02:44:20Z", "date_only": false, "value": "2025-05-10T02:44:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ton618cyber/9219", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "0c13a08f-8179-4fbc-8f15-4cde921313e6", "content": "#exploit\nCVE-2025-2775 CVE-2025-2776 CVE-2025-2777 CVE-2025-2778\nSysOwned, Your Friendly Support Ticket - SysAid On-Premise Pre-Auth RCE Chain\n]-> https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/\n\n]-> https://github.com/watchtowrlabs/watchTowr-vs-SysAid-PreAuth-RCE-Chain", "url": "https://t.me/ton618cyber/9219"}, {"timestamp": "2025-05-10T14:15:02Z", "date_only": false, "value": "2025-05-10T14:15:02.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-2777.yaml", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "b0aab9e6-7a0a-4698-9cb1-f4cbe038415b", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-2777.yaml"}, {"timestamp": "2025-05-11T14:06:16Z", "date_only": false, "value": "2025-05-11T14:06:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cybersecplayground/198", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "a0a20a59-8345-4452-85ea-b48c4b84acd1", "content": "\ud83d\udd34 CVE-2025-2777 \u2014 SysAid On-Prem \u2264 23.3.40 - XXE Vulnerability\n\ud83e\udde8 Critical Impact \u2014 CVSS 9.3\n\ud83d\udcc5 Published: May 10, 2025\n\n\ud83d\udea8 A severe unauthenticated XML External Entity (XXE) vulnerability has been discovered in SysAid On-Prem (\u2264 v23.3.40), specifically within its lshw hardware info parsing functionality.\n\n\ud83e\ude78 Vulnerability Summary\nAttackers can abuse this XXE flaw to:\n\n- Read arbitrary files on the filesystem\n- Extract sensitive data (e.g., configuration files)\n- Potentially escalate privileges or gain admin access on the server\n\nThe vulnerability requires no authentication, making it a high-priority threat to exposed instances.\n\n\ud83d\udee0 Affected Product\nSysAid On-Prem versions \u2264 23.3.40\n\n\ud83d\udd27 Patched Version\nUpgrade to the latest release from:\n\ud83d\udd17 SysAid Docs - Version Info\n\n\ud83d\udca5 Real-World Exploitation Example \n\u26a1\ufe0f Proof-of-concept exploitation (from WatchTowr Labs):\n\u26a1\ufe0f A crafted XML payload submitted to the lshw endpoint can leak /etc/passwd or internal credentials.\n\u26a1\ufe0fUsed as a pivot to gain admin session access.\n\n\ud83d\udd0d Read full technical write-up:\n\ud83d\udd17 https://labs.watchtowr.com\n\n\ud83d\udd0e Detection Tip\nSearch for exposed SysAid panels:\n\nintitle:\"SysAid\" && \"helpdesk\"\nUse network scanners to monitor outbound XML-related traffic or unusual DNS queries triggered by XXE payloads.\n\n\u26a0\ufe0f Mitigation\n\ud83d\udd38 Patch immediately\n\ud83d\udd38 Restrict external access to the SysAid panel\n\ud83d\udd38Monitor for unusual HTTP POSTs to /lshw or similar paths\n\n\ud83d\udd10 Stay ahead with real-time CVE alerts and PoCs.\nJoin us at @cybersecplayground for more vulnerability posts, scanners, and defense tactics.\n\n\ud83e\udde0 Like + Share to raise awareness.\n\n#CVE2025_2777 #SysAid #XXE #RCE #Exploit #infosec #CyberSecurity #ZeroDay #CVE #cybersecplayground", "url": "https://t.me/cybersecplayground/198"}, {"timestamp": "2025-05-11T14:07:50Z", "date_only": false, "value": "2025-05-11T14:07:50.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cybersecplayground/199", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "4fd58a50-2549-4bff-b451-bb7543304f01", "content": "Nuclei Template : \nhttps://cloud.projectdiscovery.io/library/CVE-2025-2777", "url": "https://t.me/cybersecplayground/199"}, {"timestamp": "2025-05-11T21:02:20.695Z", "date_only": false, "value": "2025-05-11T21:02:20.695579Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lowe3uhbet2r", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "9cc53bc9-40d9-402e-8018-a26b132b4311", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lowe3uhbet2r"}, {"timestamp": "2025-05-12T17:15:08Z", "date_only": false, "value": "2025-05-12T17:15:08.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/7023", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "9545de1e-e189-4b74-a27f-06df5d9a6ff0", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 WatchTowr Labs \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0442\u0440\u0438 \u043e\u0448\u0438\u0431\u043a\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u041f\u041e \u0418\u0422-\u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 SysAid.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a CVE-2025-2775 \u0438 CVE-2025-2776 (\u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 XXE \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0435 /mdm/checkin), CVE-2025-2777 (\u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 XXE \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0435 /lshw).\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c watchTowr Labs, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043b\u0435\u0433\u043a\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0433\u043e HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u0430 POST \u043a \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u043c \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u043c \u0442\u043e\u0447\u043a\u0430\u043c.\n\n\u0423\u0441\u043f\u0435\u0448\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u0430\u043c \u0441 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439, \u0432\u043a\u043b\u044e\u0447\u0430\u044f InitAccount.cmd, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0438 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u044b\u0439 \u043f\u0430\u0440\u043e\u043b\u044c.\n\n\u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0434\u043e\u0441\u0442\u0443\u043f, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0431\u0435\u0437 \u0442\u0440\u0443\u0434\u0430 \u043c\u043e\u0436\u0435\u0442 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a SysAid.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c XXE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441 \u0434\u0440\u0443\u0433\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u041e\u0421, \u043e\u0442\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 CVE-2025-2778, \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\n\n\u0412\u0441\u0435 \u0447\u0435\u0442\u044b\u0440\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b SysAid \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u043c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 24.4.60 b16 \u0432 \u043d\u0430\u0447\u0430\u043b\u0435 \u043c\u0430\u0440\u0442\u0430 2025 \u0433\u043e\u0434\u0430.\n\n\u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u0434\u0430\u0432\u043d\u044e\u044e \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0443 \u043d\u0430\u0446\u0435\u043b\u0438\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 SysAid\u00a0\u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0431\u0430\u043d\u0434 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 (\u0432 \u0447\u0438\u0441\u043b\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0438\u0441\u044c Cl0p) \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 PoC, \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u044e\u0449\u0435\u0433\u043e \u0432\u0441\u0435 \u0447\u0435\u0442\u044b\u0440\u0435\u00a0\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043d\u0430\u043a\u0430\u0442\u0438\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.", "url": "https://t.me/true_secator/7023"}, {"timestamp": "2025-05-14T16:37:25Z", "date_only": false, "value": "2025-05-14T16:37:25+00:00", "kind": "kev", "label": "Asserted", "source": "shadowserver", "record": "CVE-2025-2777", "field": "timestamps.asserted_at", "uuid": "ea43ec5c-a238-4020-859f-089feae97239", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-05-14T16:37:25Z", "date_only": false, "value": "2025-05-14T16:37:25+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2025-2777", "field": "timestamps.first_seen_at", "uuid": "ea43ec5c-a238-4020-859f-089feae97239", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-05-16T21:02:22.106Z", "date_only": false, "value": "2025-05-16T21:02:22.106658Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lpcwgj63762n", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "e2607926-618c-43c7-9425-db60db863d47", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lpcwgj63762n"}, {"timestamp": "2025-06-24T00:00:00Z", "date_only": false, "value": "2025-06-24T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2025-2777", "field": "timestamps.asserted_at", "uuid": "9d356c94-f5a5-408c-a45d-de8d5f099701", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-06-24T00:00:00Z", "date_only": false, "value": "2025-06-24T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2025-2777", "field": "evidence.0.details.added_date", "uuid": "9d356c94-f5a5-408c-a45d-de8d5f099701", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-06-24T00:00:00Z", "date_only": false, "value": "2025-06-24T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-24)", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "bf699492-133e-4d61-a1eb-7f8bd15c4fc3"}, {"timestamp": "2025-06-24T00:00:00Z", "date_only": false, "value": "2025-06-24T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2025-2777", "field": "timestamps.first_seen_at", "uuid": "9d356c94-f5a5-408c-a45d-de8d5f099701", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-06-24T00:00:00Z", "date_only": false, "value": "2025-06-24T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2025-2777", "field": "status.status_updated_at", "uuid": "9d356c94-f5a5-408c-a45d-de8d5f099701", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-07-22T22:00:00Z", "date_only": false, "value": "2025-07-22T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0981", "record": "WID-SEC-W-2025-0981", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2025-07-22T22:00:00Z", "date_only": false, "value": "2025-07-22T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0981", "record": "WID-SEC-W-2025-0981", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-07-23T04:51:55.669Z", "date_only": false, "value": "2025-07-23T04:51:55.669+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0981", "record": "WID-SEC-W-2025-0981", "field": "document.tracking.generator.date"}, {"timestamp": "2025-09-09T20:51:36Z", "date_only": false, "value": "2025-09-09T20:51:36.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/e0a0042d-e47b-4875-b781-99d4428af3c2", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "26feaef9-d12e-4032-b18e-23cd727368c7"}, {"timestamp": "2025-10-23T17:37:45.837Z", "date_only": false, "value": "2025-10-23T17:37:45.837502Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/115424694369254779", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "c9533b1e-10c7-4eb4-8bf4-dd8dd97a055a", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/115424694369254779"}, {"timestamp": "2025-10-26T04:57:32Z", "date_only": false, "value": "2025-10-26T04:57:32.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/WuywlTA2prep3738D0ZdlY2l1dxkLscKbaCFO22me4a6aig", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "bb09b51b-e1fd-4520-99ac-6c3c1ca4b166"}, {"timestamp": "2025-10-26T04:57:35Z", "date_only": false, "value": "2025-10-26T04:57:35.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/DKd2Gqws_szvlbVH567RCL0Q0RIZDQSoU0Q0rK7xOEDSxsg", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "8eb83d2c-82c9-4efd-b217-fe32d1dc8dde"}, {"timestamp": "2025-11-19T18:32:45.643Z", "date_only": false, "value": "2025-11-19T18:32:45.643Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2025-2777", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-02-26T18:28:50.535Z", "date_only": false, "value": "2026-02-26T18:28:50.535Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-2777", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-02-26T18:28:50.535Z", "date_only": false, "value": "2026-02-26T18:28:50.535Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-2777", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-29T00:00:00Z", "date_only": false, "value": "2026-04-29T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-04-29)", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "c99a3d7b-d1a0-4e3c-92d6-19c0c2b7495c"}, {"timestamp": "2026-05-09T00:00:00Z", "date_only": false, "value": "2026-05-09T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-05-09)", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "dcd8b911-fc5c-434e-b195-0ff4672e8c26"}, {"timestamp": "2026-06-17T09:07:36.473Z", "date_only": false, "value": "2026-06-17T09:07:36.473", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-2777", "record": "FKIE_CVE-2025-2777", "field": "lastModified"}, {"timestamp": "2026-06-19T12:46:08.105Z", "date_only": false, "value": "2026-06-19T12:46:08.105600Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/164e199f-51c2-4892-a5a9-20532dbc00e0", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "a0166026-b4ef-4317-a90e-e2f9550da7d6", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/164e199f-51c2-4892-a5a9-20532dbc00e0"}, {"timestamp": "2026-06-23T11:11:17Z", "date_only": false, "value": "2026-06-23T11:11:17+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2025-2777", "field": "timestamps.recorded_at", "uuid": "9d356c94-f5a5-408c-a45d-de8d5f099701", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T11:12:12.531Z", "date_only": false, "value": "2026-06-23T11:12:12.531698Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/9d356c94-f5a5-408c-a45d-de8d5f099701", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "4d12b279-81cf-4fbf-af69-4d7e48e0a04b", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/9d356c94-f5a5-408c-a45d-de8d5f099701"}, {"timestamp": "2026-06-23T14:03:28.554Z", "date_only": false, "value": "2026-06-23T14:03:28.554758Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ed15f212-67a8-440f-b85f-2e2844c859cb", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "2b048ff8-c855-41c0-8921-8db813a32f59", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ed15f212-67a8-440f-b85f-2e2844c859cb"}, {"timestamp": "2026-06-30T09:23:53.074Z", "date_only": false, "value": "2026-06-30T09:23:53.074180Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a670988d-9a6b-440f-a985-598498923f6f", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "d51086b0-c0f0-4022-9515-2b49b4ece1bd", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a670988d-9a6b-440f-a985-598498923f6f"}, {"timestamp": "2026-07-01T07:18:02.976Z", "date_only": false, "value": "2026-07-01T07:18:02.976971Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/ea43ec5c-a238-4020-859f-089feae97239", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "6cf634ea-86df-4add-82f2-999525eb6a45", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/ea43ec5c-a238-4020-859f-089feae97239"}, {"timestamp": "2026-07-26T02:00:12.909Z", "date_only": false, "value": "2026-07-26T02:00:12.909041Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberwarehouse/812", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "287702d5-3a2f-4bb5-8ff3-100fb0b30971", "url": "https://t.me/cyberwarehouse/812"}, {"timestamp": "2026-07-27T00:00:29.787Z", "date_only": false, "value": "2026-07-27T00:00:29.787111Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cyberwarehouse/812", "record": "CVE-2025-2777", "field": "creation_timestamp", "uuid": "1af62226-9c76-470d-8a28-b5e76b6bbd92", "url": "https://t.me/cyberwarehouse/812"}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00+00:00", "kind": "kev", "label": "Last seen", "source": "shadowserver", "record": "CVE-2025-2777", "field": "timestamps.last_seen_at", "uuid": "ea43ec5c-a238-4020-859f-089feae97239", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": true, "value": "2026-10-20", "kind": "kev", "label": "Observation date", "source": "shadowserver", "record": "CVE-2025-2777", "field": "evidence.0.details.observation_date", "uuid": "ea43ec5c-a238-4020-859f-089feae97239", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "shadowserver", "record": "CVE-2025-2777", "field": "status.status_updated_at", "uuid": "ea43ec5c-a238-4020-859f-089feae97239", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-22T01:00:02Z", "date_only": false, "value": "2026-10-22T01:00:02+00:00", "kind": "kev", "label": "Recorded", "source": "shadowserver", "record": "CVE-2025-2777", "field": "timestamps.recorded_at", "uuid": "ea43ec5c-a238-4020-859f-089feae97239", "status": {"status_reason": "confirmed", "exploited": true}}]}