{"metadata": {"vulnerability": "cve-2025-0520", "count": 67, "kinds": {"milestone": 4, "sighting": 50, "kev": 5, "other": 8}}, "data": [{"timestamp": "2025-01-16T17:23:23.838Z", "date_only": false, "value": "2025-01-16T17:23:23.838Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2025-0520", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-04-29T19:35:37.829Z", "date_only": false, "value": "2025-04-29T19:35:37.829Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-0520", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-04-29T20:12:44Z", "date_only": false, "value": "2025-04-29T20:12:44.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/13918", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "2317d295-ca55-40c2-a212-b3803e992d53", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-0520\n\ud83d\udd25 CVSS Score: 9.4 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L)\n\ud83d\udd39 Description: An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7.\n\ud83d\udccf Published: 2025-04-29T19:35:37.829Z\n\ud83d\udccf Modified: 2025-04-29T19:49:30.316Z\n\ud83d\udd17 References:\n1. https://github.com/vulhub/vulhub/tree/master/showdoc/CNVD-2020-26585\n2. https://github.com/star7th/showdoc/pull/1059\n3. https://www.cnvd.org.cn/flaw/show/CNVD-2020-26585", "url": "https://t.me/DarkWebInformer_CVEAlerts/13918", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-04-29T20:15:25Z", "date_only": false, "value": "2025-04-29T20:15:25Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-6JMR-R7P6-F5WR", "record": "GHSA-6JMR-R7P6-F5WR", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2025-04-29T20:15:25.230Z", "date_only": false, "value": "2025-04-29T20:15:25.230", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-0520", "record": "FKIE_CVE-2025-0520", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-04-29T20:38:44.727Z", "date_only": false, "value": "2025-04-29T20:38:44.727309Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-0520", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-04-29T20:38:44.727Z", "date_only": false, "value": "2025-04-29T20:38:44.727309Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-0520", "record": "FKIE_CVE-2025-0520", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2025-04-29T20:41:34.177Z", "date_only": false, "value": "2025-04-29T20:41:34.177Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-0520", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-04-29T21:31:55Z", "date_only": false, "value": "2025-04-29T21:31:55Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-6JMR-R7P6-F5WR", "record": "GHSA-6JMR-R7P6-F5WR", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-04-29T23:31:43Z", "date_only": false, "value": "2025-04-29T23:31:43.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/24050", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "6c449e22-f1b9-4c00-b376-ae743a217d8b", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-0520 - ShowDoc Unrestricted File Upload RCE\", \n  \"Content\": \"CVE ID : CVE-2025-0520 \nPublished : April 29, 2025, 8:15 p.m. | 48\u00a0minutes ago \nDescription : An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"29 Apr 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/24050"}, {"timestamp": "2025-04-29T23:50:45.472Z", "date_only": false, "value": "2025-04-29T23:50:45.472377Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lnyhw2jtrf2h", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "ffefb7cb-906a-4a38-8b29-bb013fba4643", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3lnyhw2jtrf2h"}, {"timestamp": "2025-11-05T19:58:02Z", "date_only": false, "value": "2025-11-05T19:58:02Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-6JMR-R7P6-F5WR", "record": "GHSA-6JMR-R7P6-F5WR", "field": "modified", "linked_record": true}, {"timestamp": "2026-04-11T16:03:19.102Z", "date_only": false, "value": "2026-04-11T16:03:19.102002Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mja7lohv7p2h", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "75c66c5a-0728-42e8-9add-d305bd84a99e", "url": "https://bsky.app/profile/infosecbot.bsky.social/post/3mja7lohv7p2h"}, {"timestamp": "2026-04-11T21:03:05.637Z", "date_only": false, "value": "2026-04-11T21:03:05.637360Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mjaqdoqwko23", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "ee9c423d-90a0-4b6a-a05b-c8167e9c46de", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mjaqdoqwko23"}, {"timestamp": "2026-04-14T03:50:00Z", "date_only": false, "value": "2026-04-14T03:50:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/04/showdoc-rce-flaw-cve-2025-0520-actively.html", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "dc55dc3b-ad2e-4fa7-80a9-324a8d97a9fe", "url": "https://thehackernews.com/2026/04/showdoc-rce-flaw-cve-2025-0520-actively.html"}, {"timestamp": "2026-04-14T06:04:36Z", "date_only": false, "value": "2026-04-14T06:04:36.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/248724", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "8ed7cdbf-fe53-4401-b82d-c82be2e91196", "content": "ShowDoc RCE Flaw CVE-2025-0520 Actively Exploited on Unpatched Servers\nhttps://ift.tt/MIUWctp", "url": "https://t.me/ctinow/248724", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-04-14T06:06:13.706Z", "date_only": false, "value": "2026-04-14T06:06:13.706008Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ninjaowl.ai/post/3mjgpmr5in42l", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "aaa54cef-517d-4362-9108-7d0331bdd162", "url": "https://bsky.app/profile/ninjaowl.ai/post/3mjgpmr5in42l"}, {"timestamp": "2026-04-14T06:12:53.083Z", "date_only": false, "value": "2026-04-14T06:12:53.083376Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mjgpynlvy62t", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "bae5596f-01b6-4eee-beaa-0b8f72bd67b2", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mjgpynlvy62t"}, {"timestamp": "2026-04-14T06:18:36Z", "date_only": false, "value": "2026-04-14T06:18:36.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/8793", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "859d7f99-a723-49fd-8ff8-0bf4cd33ed2b", "content": "\ud83d\udea8 A ShowDoc flaw (CVSS 9.4) is now under active exploitation.\n\nCVE-2025-0520 lets attackers upload web shells via unauthenticated file upload \u2192 full server control. First attacks seen via a U.S. honeypot; ~2,000 instances remain exposed, mostly in China.\n\n\ud83d\udd17 Details \u2192 https://thehackernews.com/2026/04/showdoc-rce-flaw-cve-2025-0520-actively.html", "url": "https://t.me/thehackernews/8793", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-04-14T06:20:54.741Z", "date_only": false, "value": "2026-04-14T06:20:54.741180Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mjgqgzd5c42d", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "b6e7f1c4-338b-4526-a5d1-0b9d8e845df2", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mjgqgzd5c42d"}, {"timestamp": "2026-04-14T06:28:55.903Z", "date_only": false, "value": "2026-04-14T06:28:55.903735Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mjgqvdy6k62p", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "58a053e5-997e-4040-b4aa-a96d2cacff53", "url": "https://bsky.app/profile/undercode.bsky.social/post/3mjgqvdy6k62p"}, {"timestamp": "2026-04-14T07:00:23.136Z", "date_only": false, "value": "2026-04-14T07:00:23.136186Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mjgsnlak4d2j", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "4d3c14e1-2889-4dc2-b966-6defb346706d", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mjgsnlak4d2j"}, {"timestamp": "2026-04-14T07:09:19.070Z", "date_only": false, "value": "2026-04-14T07:09:19.070396Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybersecurity0001.bsky.social/post/3mjgt5kqayw2m", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "871ae5bb-bc5c-445d-9b54-ea623de45257", "url": "https://bsky.app/profile/cybersecurity0001.bsky.social/post/3mjgt5kqayw2m"}, {"timestamp": "2026-04-14T08:03:53Z", "date_only": false, "value": "2026-04-14T08:03:53.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/TengkorakCyberCrewzz/39596", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "f7d494a6-f506-4749-bea5-15c472989e15", "content": "ShowDoc RCE Flaw CVE-2025-0520 Actively Exploited on Unpatched Servers \u2013 thehackernews.com\n\nTue, 14 Apr 2026 13:50:00", "url": "https://t.me/TengkorakCyberCrewzz/39596", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-04-14T08:03:53Z", "date_only": false, "value": "2026-04-14T08:03:53.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/TengkorakCyberCrewzz/9694", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "2ec618ff-6674-4a4d-974e-fb91b932ff64", "content": "ShowDoc RCE Flaw CVE-2025-0520 Actively Exploited on Unpatched Servers \u2013 thehackernews.com\n\nTue, 14 Apr 2026 13:50:00", "url": "https://t.me/TengkorakCyberCrewzz/9694", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-04-14T09:59:36Z", "date_only": false, "value": "2026-04-14T09:59:36.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/248730", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "be684932-f4e5-4700-9c47-7f015fd16999", "content": "Attackers target unpatched ShowDoc servers via CVE-2025-0520\nhttps://ift.tt/2lSq3NW", "url": "https://t.me/ctinow/248730", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-04-14T10:10:05Z", "date_only": false, "value": "2026-04-14T10:10:05.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/0Pfw-V_CPPKPcXzRUSXBCsxXTLIiF67eKNofG27Ayc871Gk5", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "e6fc456a-6e89-4353-b560-5589fefe832b"}, {"timestamp": "2026-04-14T10:12:09.337Z", "date_only": false, "value": "2026-04-14T10:12:09.337690Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mjh5ejlrv42c", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "d76af2fd-9514-408f-b1e2-18ac622c62e0", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mjh5ejlrv42c"}, {"timestamp": "2026-04-14T12:32:38.623Z", "date_only": false, "value": "2026-04-14T12:32:38.623010Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mjhf7llf54e2", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "6b3502e1-5430-4e8c-8f6a-a28be65fb310", "url": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mjhf7llf54e2"}, {"timestamp": "2026-04-14T12:35:07.166Z", "date_only": false, "value": "2026-04-14T12:35:07.166471Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mjhfe5bnee2v", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "819790f0-e430-441d-ba19-630c9b8f11d1", "url": "https://bsky.app/profile/undercodenews.bsky.social/post/3mjhfe5bnee2v"}, {"timestamp": "2026-04-14T12:37:51.365Z", "date_only": false, "value": "2026-04-14T12:37:51.365150Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/techsentiments.com/post/3mjhfj2o2r724", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "b8f1e630-0d02-4cb5-b9f5-bd8f0a6a5baf", "url": "https://bsky.app/profile/techsentiments.com/post/3mjhfj2o2r724"}, {"timestamp": "2026-04-14T13:06:31Z", "date_only": false, "value": "2026-04-14T13:06:31.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/7ABa_p0fT08CbnPfOL1dxOupUD_4oilaNZ-m5GgtIRrGfw", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "fefc9bd5-82c3-472f-9f06-181860f25cc0", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-04-14T23:48:00.355Z", "date_only": false, "value": "2026-04-14T23:48:00.355686Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mjikxenmbl2b", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "feff74da-aa4a-48c9-9fa6-893f1bc534c4", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mjikxenmbl2b"}, {"timestamp": "2026-04-14T23:49:52.602Z", "date_only": false, "value": "2026-04-14T23:49:52.602490Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mjil2pxnwd2b", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "894f5e06-8d61-49b2-bda0-0a1a2e090d91", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mjil2pxnwd2b"}, {"timestamp": "2026-04-15T02:32:00.599Z", "date_only": false, "value": "2026-04-15T02:32:00.599030Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mjiu4mxcjc2q", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "5def88ff-ec0a-4093-a2f4-ada79ab84a48", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mjiu4mxcjc2q"}, {"timestamp": "2026-04-15T03:45:23.801Z", "date_only": false, "value": "2026-04-15T03:45:23.801805Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mjiy7uhy3k2q", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "aad116aa-3711-415a-9cc8-6378ef2d1e8f", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mjiy7uhy3k2q"}, {"timestamp": "2026-04-15T07:12:01.384Z", "date_only": false, "value": "2026-04-15T07:12:01.384621Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/patrickcmiller/statuses/116407475944405057", "record": "cve-2025-0520", "field": "creation_timestamp", "uuid": "9e67a6d8-37a8-483f-9f82-9c6e7b6b58c5", "url": "https://infosec.exchange/users/patrickcmiller/statuses/116407475944405057"}, {"timestamp": "2026-04-15T07:42:05.923Z", "date_only": false, "value": "2026-04-15T07:42:05.923215Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/patrickcmiller.bsky.social/post/3mjjfgyybzj2v", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "7b03f2be-48e7-4275-9f41-a00c86726954", "url": "https://bsky.app/profile/patrickcmiller.bsky.social/post/3mjjfgyybzj2v"}, {"timestamp": "2026-04-15T12:07:03.774Z", "date_only": false, "value": "2026-04-15T12:07:03.774212Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cwealthsentinel.bsky.social/post/3mjjuaveecf24", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "a6c7c582-2dbd-4e4a-a65a-23e10844d44a", "url": "https://bsky.app/profile/cwealthsentinel.bsky.social/post/3mjjuaveecf24"}, {"timestamp": "2026-04-15T23:51:46.719Z", "date_only": false, "value": "2026-04-15T23:51:46.719818Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mjl3mzgqr62s", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "95124e83-3d21-4ea0-8f44-a4a8dae99b82", "url": "https://bsky.app/profile/undercode.bsky.social/post/3mjl3mzgqr62s"}, {"timestamp": "2026-04-16T05:42:01.562Z", "date_only": false, "value": "2026-04-16T05:42:01.562721Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/patrickcmiller/statuses/116412784367923222", "record": "cve-2025-0520", "field": "creation_timestamp", "uuid": "6c64d076-0fd7-4bec-bf58-d7e371cca021", "url": "https://infosec.exchange/users/patrickcmiller/statuses/116412784367923222"}, {"timestamp": "2026-04-16T17:12:06.796Z", "date_only": false, "value": "2026-04-16T17:12:06.796004Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/patrickcmiller.bsky.social/post/3mjmvr6kp5k2d", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "67c732d3-0730-436a-891e-47691dc9f4c3", "url": "https://bsky.app/profile/patrickcmiller.bsky.social/post/3mjmvr6kp5k2d"}, {"timestamp": "2026-04-16T18:40:07Z", "date_only": false, "value": "2026-04-16T18:40:07+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2025-0520", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "03837f21-b7e2-46b3-b3d6-80868f23654f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-16T18:40:07Z", "date_only": false, "value": "2026-04-16T18:40:07.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2025-0520", "field": "evidence.0.details.added_date", "uuid": "03837f21-b7e2-46b3-b3d6-80868f23654f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-16T18:40:07Z", "date_only": false, "value": "2026-04-16T18:40:07.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/8112", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "871d80a5-e3b9-40bd-8af1-89c7c852c364", "content": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u00a0ShowDoc \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438 \u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b, \u0442\u0435\u043f\u0435\u0440\u044c \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043a\u0438\u0431\u0435\u0440\u043f\u043e\u0434\u043f\u043e\u043b\u044c\u0435\u043c.\n\n\u0420\u0435\u0447\u044c \u0438\u0434\u0451\u0442 \u043e CVE-2025-0520 (CNVD-2020-26585) \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 CVSS 9,4 \u0438\u0437 10,0.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u043e\u0439 \u0444\u0430\u0439\u043b\u043e\u0432, \u043e\u0431\u0443\u0441\u043b\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u0430, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 PHP-\u0444\u0430\u0439\u043b\u044b \u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Vulhub, \u0432\u043e \u0432\u0441\u0435\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 ShowDoc \u0434\u043e 2.8.7 \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441 \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u043e\u0439 \u0438 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u043e\u0439 \u0444\u0430\u0439\u043b\u043e\u0432, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0447\u0435\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 ShowDoc 2.8.7, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u0432 \u043e\u043a\u0442\u044f\u0431\u0440\u0435 2020 \u0433\u043e\u0434\u0430. \u0422\u0435\u043a\u0443\u0449\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f - 3.8.1.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e\u00a0\u043d\u043e\u0432\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c VulnCheck, CVE-2025-0520 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u0431\u044b\u043b\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438. \u0412 \u0441\u0435\u0442\u0438 \u043f\u043e\u0434 \u043f\u0440\u0438\u0446\u0435\u043b\u043e\u043c \u043c\u043e\u0436\u0435\u0442 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u044c\u0441\u044f \u0431\u043e\u043b\u0435\u0435 2000 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 ShowDoc.\n\n\u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u043c\u043e\u0436\u043d\u043e \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0442\u044c CVE-2025-0520 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043d\u0430\u0433\u043b\u044f\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043c\u0435\u0440\u0430 \u0432\u0441\u0435 \u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u0438\u0431\u0435\u0440\u043f\u043e\u0434\u043f\u043e\u043b\u044c\u0435\u043c N-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c ShowDoc \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u0434\u043b\u044f \u043e\u043f\u0442\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b.", "url": "https://t.me/true_secator/8112", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-04-16T18:40:07Z", "date_only": false, "value": "2026-04-16T18:40:07+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2025-0520", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "03837f21-b7e2-46b3-b3d6-80868f23654f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-16T18:40:07Z", "date_only": false, "value": "2026-04-16T18:40:07+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2025-0520", "field": "status.status_updated_at", "uuid": "03837f21-b7e2-46b3-b3d6-80868f23654f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-19T02:29:35.564Z", "date_only": false, "value": "2026-04-19T02:29:35.564063Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mjsvtyenpn2x", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "8075e340-bf18-4ad1-ad7a-705845e8075b", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mjsvtyenpn2x"}, {"timestamp": "2026-04-19T21:11:16.789Z", "date_only": false, "value": "2026-04-19T21:11:16.789770Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mjuujpkni22d", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "176209c2-d14f-4697-89c1-fd59ff337237", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mjuujpkni22d"}, {"timestamp": "2026-06-19T12:41:46Z", "date_only": false, "value": "2026-06-19T12:41:46+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2025-0520", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "03837f21-b7e2-46b3-b3d6-80868f23654f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-19T12:42:23.140Z", "date_only": false, "value": "2026-06-19T12:42:23.140987Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/03837f21-b7e2-46b3-b3d6-80868f23654f", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "8625a4d7-bb12-435a-8491-f0e20cb0c62b", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/03837f21-b7e2-46b3-b3d6-80868f23654f", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-19T12:45:34.988Z", "date_only": false, "value": "2026-06-19T12:45:34.988112Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ee47d071-aa17-4daa-8a76-6bb24deb1e0b", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "29633f60-3113-4ef5-bc72-cbe29937e6f1", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ee47d071-aa17-4daa-8a76-6bb24deb1e0b", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-19T16:00:06.131Z", "date_only": false, "value": "2026-07-19T16:00:06.131149Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/MalaysiaHacktivistz/20858", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "0cdbc8f0-011b-4c3c-9831-adb76e3befe5", "url": "https://t.me/MalaysiaHacktivistz/20858"}, {"timestamp": "2026-07-19T16:00:10.031Z", "date_only": false, "value": "2026-07-19T16:00:10.031619Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/critical_bug/1727", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "43d0113c-9144-4d1b-991a-355f2cb338db", "url": "https://t.me/critical_bug/1727"}, {"timestamp": "2026-07-19T16:00:10.072Z", "date_only": false, "value": "2026-07-19T16:00:10.072193Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/critical_bug/1728", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "43862db0-4c8a-42fb-8c12-2db67513b3b0", "url": "https://t.me/critical_bug/1728"}, {"timestamp": "2026-07-20T00:00:07.503Z", "date_only": false, "value": "2026-07-20T00:00:07.503002Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/critical_bug/1728", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "2e0d828b-b7ef-4529-9e8f-947d15588ac5", "url": "https://t.me/critical_bug/1728", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-20T00:00:07.548Z", "date_only": false, "value": "2026-07-20T00:00:07.548928Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/critical_bug/1727", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "23ba9946-f7a2-45ed-8359-e8833ca18855", "url": "https://t.me/critical_bug/1727", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-20T00:00:21.167Z", "date_only": false, "value": "2026-07-20T00:00:21.167209Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/MalaysiaHacktivistz/20858", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "fbfed21c-91a1-4803-9152-8011c8d93587", "url": "https://t.me/MalaysiaHacktivistz/20858", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-17T06:00:09.729Z", "date_only": false, "value": "2026-08-17T06:00:09.729526Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-0520.yaml", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "7f707b4d-282f-40c7-a83a-9e9810501906", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-0520.yaml"}, {"timestamp": "2026-08-18T19:00:04.905Z", "date_only": false, "value": "2026-08-18T19:00:04.905791Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/VulnerabilityNews/41921", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "5f11e0d4-af39-48ca-a986-f4cae7a77261", "url": "https://t.me/VulnerabilityNews/41921"}, {"timestamp": "2026-08-19T00:00:08.971Z", "date_only": false, "value": "2026-08-19T00:00:08.971550Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/41921", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "b33fb52d-d7c4-4a3f-854a-18fb03fefc3b", "url": "https://t.me/VulnerabilityNews/41921", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-20T20:21:42.214Z", "date_only": false, "value": "2026-08-20T20:21:42.214098Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/giuliosistilli.bsky.social/post/3mtk34d77ot2s", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "be910a4f-9694-48a9-8169-588ad130e613", "url": "https://bsky.app/profile/giuliosistilli.bsky.social/post/3mtk34d77ot2s"}, {"timestamp": "2026-08-29T20:00:17.834Z", "date_only": false, "value": "2026-08-29T20:00:17.834379Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberDispatch/1288", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "317ac804-2fac-4a62-9113-fc3cb2318e04", "url": "https://t.me/CyberDispatch/1288"}, {"timestamp": "2026-08-31T00:00:26.641Z", "date_only": false, "value": "2026-08-31T00:00:26.641925Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/CyberDispatch/1288", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "e0407f36-6b58-46fe-9e62-e96674d658e0", "url": "https://t.me/CyberDispatch/1288", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-08T16:16:50.227Z", "date_only": false, "value": "2026-10-08T16:16:50.227", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-0520", "record": "FKIE_CVE-2025-0520", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-08T14:00:06.959Z", "date_only": false, "value": "2026-11-08T14:00:06.959Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2025-0520", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-08T14:00:06.959Z", "date_only": false, "value": "2026-11-08T14:00:06.959Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "cve-2025-0520", "field": "containers.cna.providerMetadata.dateUpdated"}], "metrics": {"as_of": "2026-11-14T05:35:00.889Z", "anchors": {"origin": {"timestamp": "2025-04-29T19:35:37.829Z", "date_only": false, "value": "2025-04-29T19:35:37.829Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-0520", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2025-04-29T19:35:37.829Z", "date_only": false, "value": "2025-04-29T19:35:37.829Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-0520", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2025-04-29T20:12:44Z", "date_only": false, "value": "2025-04-29T20:12:44.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/13918", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "2317d295-ca55-40c2-a212-b3803e992d53", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-0520\n\ud83d\udd25 CVSS Score: 9.4 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L)\n\ud83d\udd39 Description: An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7.\n\ud83d\udccf Published: 2025-04-29T19:35:37.829Z\n\ud83d\udccf Modified: 2025-04-29T19:49:30.316Z\n\ud83d\udd17 References:\n1. https://github.com/vulhub/vulhub/tree/master/showdoc/CNVD-2020-26585\n2. https://github.com/star7th/showdoc/pull/1059\n3. https://www.cnvd.org.cn/flaw/show/CNVD-2020-26585", "url": "https://t.me/DarkWebInformer_CVEAlerts/13918", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2026-04-14T06:04:36Z", "date_only": false, "value": "2026-04-14T06:04:36.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/248724", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "8ed7cdbf-fe53-4401-b82d-c82be2e91196", "content": "ShowDoc RCE Flaw CVE-2025-0520 Actively Exploited on Unpatched Servers\nhttps://ift.tt/MIUWctp", "url": "https://t.me/ctinow/248724", "metric_role": "exploitation", "metric_basis": "sighting_report"}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 30191338.171, "hours": 8386.482825277777, "days": 349.43678438657406, "min_seconds": 30191338.171, "max_seconds": 30191338.171, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-04-29T19:35:37.829Z", "date_only": false, "value": "2025-04-29T19:35:37.829Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-0520", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-04-14T06:04:36Z", "date_only": false, "value": "2026-04-14T06:04:36.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/248724", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "8ed7cdbf-fe53-4401-b82d-c82be2e91196", "content": "ShowDoc RCE Flaw CVE-2025-0520 Actively Exploited on Unpatched Servers\nhttps://ift.tt/MIUWctp", "url": "https://t.me/ctinow/248724", "metric_role": "exploitation", "metric_basis": "sighting_report"}}, "disclosure_to_exploit": {"available": true, "seconds": 30191338.171, "hours": 8386.482825277777, "days": 349.43678438657406, "min_seconds": 30191338.171, "max_seconds": 30191338.171, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-04-29T19:35:37.829Z", "date_only": false, "value": "2025-04-29T19:35:37.829Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-0520", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-04-14T06:04:36Z", "date_only": false, "value": "2026-04-14T06:04:36.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/248724", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "8ed7cdbf-fe53-4401-b82d-c82be2e91196", "content": "ShowDoc RCE Flaw CVE-2025-0520 Actively Exploited on Unpatched Servers\nhttps://ift.tt/MIUWctp", "url": "https://t.me/ctinow/248724", "metric_role": "exploitation", "metric_basis": "sighting_report"}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 2226.171, "hours": 0.6183808333333333, "days": 0.025765868055555554, "min_seconds": 2226.171, "max_seconds": 2226.171, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-04-29T19:35:37.829Z", "date_only": false, "value": "2025-04-29T19:35:37.829Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-0520", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2025-04-29T20:12:44Z", "date_only": false, "value": "2025-04-29T20:12:44.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/13918", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "2317d295-ca55-40c2-a212-b3803e992d53", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-0520\n\ud83d\udd25 CVSS Score: 9.4 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L)\n\ud83d\udd39 Description: An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7.\n\ud83d\udccf Published: 2025-04-29T19:35:37.829Z\n\ud83d\udccf Modified: 2025-04-29T19:49:30.316Z\n\ud83d\udd17 References:\n1. https://github.com/vulhub/vulhub/tree/master/showdoc/CNVD-2020-26585\n2. https://github.com/star7th/showdoc/pull/1059\n3. https://www.cnvd.org.cn/flaw/show/CNVD-2020-26585", "url": "https://t.me/DarkWebInformer_CVEAlerts/13918", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 48679163.06085, "hours": 13521.989739125, "days": 563.4162391302084, "min_seconds": 48679163.06085, "max_seconds": 48679163.06085, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-04-29T19:35:37.829Z", "date_only": false, "value": "2025-04-29T19:35:37.829Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-0520", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T05:35:00.889Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 18487824.88985, "hours": 5135.506913847223, "days": 213.97945474363428, "min_seconds": 18487824.88985, "max_seconds": 18487824.88985, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-04-14T06:04:36Z", "date_only": false, "value": "2026-04-14T06:04:36.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/248724", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "8ed7cdbf-fe53-4401-b82d-c82be2e91196", "content": "ShowDoc RCE Flaw CVE-2025-0520 Actively Exploited on Unpatched Servers\nhttps://ift.tt/MIUWctp", "url": "https://t.me/ctinow/248724", "metric_role": "exploitation", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-14T05:35:00.889Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 48676936.88985, "hours": 13521.371358291666, "days": 563.3904732621528, "min_seconds": 48676936.88985, "max_seconds": 48676936.88985, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-04-29T20:12:44Z", "date_only": false, "value": "2025-04-29T20:12:44.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/13918", "record": "CVE-2025-0520", "field": "creation_timestamp", "uuid": "2317d295-ca55-40c2-a212-b3803e992d53", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-0520\n\ud83d\udd25 CVSS Score: 9.4 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L)\n\ud83d\udd39 Description: An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7.\n\ud83d\udccf Published: 2025-04-29T19:35:37.829Z\n\ud83d\udccf Modified: 2025-04-29T19:49:30.316Z\n\ud83d\udd17 References:\n1. https://github.com/vulhub/vulhub/tree/master/showdoc/CNVD-2020-26585\n2. https://github.com/star7th/showdoc/pull/1059\n3. https://www.cnvd.org.cn/flaw/show/CNVD-2020-26585", "url": "https://t.me/DarkWebInformer_CVEAlerts/13918", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-14T05:35:00.889Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}