{"metadata": {"vulnerability": "cve-2025-2749", "count": 41, "kinds": {"milestone": 4, "sighting": 14, "kev": 11, "other": 12}}, "data": [{"timestamp": "2025-03-24T16:39:22.986Z", "date_only": false, "value": "2025-03-24T16:39:22.986Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2025-2749", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-03-24T18:18:07.228Z", "date_only": false, "value": "2025-03-24T18:18:07.228Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-2749", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-03-24T19:15:52Z", "date_only": false, "value": "2025-03-24T19:15:52Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-G53H-CFHR-24HW", "record": "GHSA-G53H-CFHR-24HW", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2025-03-24T19:15:52.400Z", "date_only": false, "value": "2025-03-24T19:15:52.400", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-2749", "record": "FKIE_CVE-2025-2749", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-03-24T19:23:08Z", "date_only": false, "value": "2025-03-24T19:23:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8502", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "cd868ac1-4a5f-4499-a5f8-ec01286bb65c", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-2749\n\ud83d\udd25 CVSS Score: 7.2 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.\n\ud83d\udccf Published: 2025-03-24T18:18:07.228Z\n\ud83d\udccf Modified: 2025-03-24T19:16:31.029Z\n\ud83d\udd17 References:\n1. https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/\n2. https://devnet.kentico.com/download/hotfixes", "url": "https://t.me/DarkWebInformer_CVEAlerts/8502", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-03-24T21:30:33Z", "date_only": false, "value": "2025-03-24T21:30:33Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-G53H-CFHR-24HW", "record": "GHSA-G53H-CFHR-24HW", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-03-24T22:35:06Z", "date_only": false, "value": "2025-03-24T22:35:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/20994", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "558d819a-63bc-49d8-b80d-eb7b3c158375", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-2749 - Kentico Xperience Remote Code Execution Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-2749 \nPublished : March 24, 2025, 7:15 p.m. | 2\u00a0hours, 5\u00a0minutes ago \nDescription : An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178. \nSeverity: 7.2 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"24 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/20994"}, {"timestamp": "2025-03-24T22:39:53.426Z", "date_only": false, "value": "2025-03-24T22:39:53.426136Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ll5t672tjd24", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "21ba7d06-61b7-4c45-878e-108316d2a9a3", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3ll5t672tjd24"}, {"timestamp": "2025-03-28T00:00:00Z", "date_only": true, "value": "2025-03-28", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2026-05137", "record": "CNVD-2026-05137", "field": "submitTime", "linked_record": true}, {"timestamp": "2025-12-17T19:33:42.624Z", "date_only": false, "value": "2025-12-17T19:33:42.624Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "cve-2025-2749", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-01-20T00:00:00Z", "date_only": true, "value": "2026-01-20", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2026-05137", "record": "CNVD-2026-05137", "field": "openTime", "linked_record": true}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2025-2749", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "c18ce586-6a6b-4c0a-b55c-a4611ceefd1a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": true, "value": "2026-04-20", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-2749", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": true, "value": "2026-04-20", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2025-2749", "field": "evidence.0.details.date_added", "uuid": "c18ce586-6a6b-4c0a-b55c-a4611ceefd1a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2025-2749", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "c18ce586-6a6b-4c0a-b55c-a4611ceefd1a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-2749", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-2749", "record": "FKIE_CVE-2025-2749", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2025-2749", "field": "status.status_updated_at", "uuid": "c18ce586-6a6b-4c0a-b55c-a4611ceefd1a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-2749", "field": "containers.adp.0.timeline.0.time", "text": "CVE-2025-2749 added to CISA KEV"}, {"timestamp": "2026-04-20T20:00:03.162Z", "date_only": false, "value": "2026-04-20T20:00:03.162727Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/c18ce586-6a6b-4c0a-b55c-a4611ceefd1a", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "b68957f3-8aef-44b1-bd64-c07699e54894", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/c18ce586-6a6b-4c0a-b55c-a4611ceefd1a", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-04-20T20:00:03.214Z", "date_only": false, "value": "2026-04-20T20:00:03.214968Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/29ff5244-6972-4cce-b522-8472d6bb1fed", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "2e5da773-d29c-40b3-850e-a9a5b03001a2", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/29ff5244-6972-4cce-b522-8472d6bb1fed", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-04-20T21:21:38Z", "date_only": false, "value": "2026-04-20T21:21:38.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/4zRGsEPwCWPOVkiJwGYn1R_sXuEnR_EKMT0DdgACfDkyyoA", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "a27fbcb2-e761-4610-8a21-ca4b68efad7e"}, {"timestamp": "2026-04-20T21:31:38Z", "date_only": false, "value": "2026-04-20T21:31:38Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-G53H-CFHR-24HW", "record": "GHSA-G53H-CFHR-24HW", "field": "modified", "linked_record": true}, {"timestamp": "2026-04-21T03:55:36.051Z", "date_only": false, "value": "2026-04-21T03:55:36.051Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2025-2749", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-04-21T03:55:36.051Z", "date_only": false, "value": "2026-04-21T03:55:36.051Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-2749", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-21T05:21:24Z", "date_only": false, "value": "2026-04-21T05:21:24.000000Z", "kind": "sighting", "label": "Seen", "source": "https://ccb.belgium.be/advisories/warning-multiple-critical-high-vulnerabilities-kentico-xperience-can-lead-remote-code", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "c2ab7129-0c75-490c-aa16-ee74c107067d", "url": "https://ccb.belgium.be/advisories/warning-multiple-critical-high-vulnerabilities-kentico-xperience-can-lead-remote-code"}, {"timestamp": "2026-04-26T06:06:44.584Z", "date_only": false, "value": "2026-04-26T06:06:44.584939Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mkevanrdo22s", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "bc6b2fb7-08bc-4065-873a-64e011b76fdf", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mkevanrdo22s"}, {"timestamp": "2026-05-04T00:00:00Z", "date_only": true, "value": "2026-05-04", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2025-2749", "field": "evidence.0.details.due_date", "uuid": "c18ce586-6a6b-4c0a-b55c-a4611ceefd1a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T13:22:22Z", "date_only": false, "value": "2026-06-01T13:22:22+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2025-2749", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "4568d7fe-6470-4495-ba88-0e73d52c031c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T13:22:22Z", "date_only": false, "value": "2026-06-01T13:22:22+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2025-2749", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "4568d7fe-6470-4495-ba88-0e73d52c031c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T13:22:22Z", "date_only": false, "value": "2026-06-01T13:22:22+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2025-2749", "field": "status.status_updated_at", "uuid": "4568d7fe-6470-4495-ba88-0e73d52c031c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T13:22:22.312Z", "date_only": false, "value": "2026-06-01T13:22:22.312Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2025-2749", "field": "evidence.0.details.added_date", "uuid": "4568d7fe-6470-4495-ba88-0e73d52c031c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-17T09:07:33.430Z", "date_only": false, "value": "2026-06-17T09:07:33.430", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-2749", "record": "FKIE_CVE-2025-2749", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-06-19T12:41:46Z", "date_only": false, "value": "2026-06-19T12:41:46+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2025-2749", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "4568d7fe-6470-4495-ba88-0e73d52c031c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-19T12:42:06.281Z", "date_only": false, "value": "2026-06-19T12:42:06.281439Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/4568d7fe-6470-4495-ba88-0e73d52c031c", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "1caab19c-1dfe-4e1f-8c3e-72067fa6b5a3", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/4568d7fe-6470-4495-ba88-0e73d52c031c", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-19T12:45:13.379Z", "date_only": false, "value": "2026-06-19T12:45:13.379569Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/05f8d02e-3bc7-47db-8afd-fd0f119b866d", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "be5877f3-64cd-4e1c-9d82-342418831fb0", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/05f8d02e-3bc7-47db-8afd-fd0f119b866d", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-23T14:03:39.729Z", "date_only": false, "value": "2026-06-23T14:03:39.729385Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/654d9760-bd9a-434b-afab-166d93ff3a75", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "fb549801-9ee1-4ee6-9c6a-63707e3fc4e3", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/654d9760-bd9a-434b-afab-166d93ff3a75", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-18T19:00:04.479Z", "date_only": false, "value": "2026-08-18T19:00:04.479505Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/VulnerabilityNews/42060", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "e99f1433-bbac-4e92-915a-8197f6837100", "url": "https://t.me/VulnerabilityNews/42060"}, {"timestamp": "2026-08-19T00:00:09.429Z", "date_only": false, "value": "2026-08-19T00:00:09.429515Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/42060", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "4c921636-8e30-426a-a459-dac53e00cec6", "url": "https://t.me/VulnerabilityNews/42060", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-29T20:00:17.340Z", "date_only": false, "value": "2026-08-29T20:00:17.340666Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberDispatch/1348", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "fd9db878-728b-4bf1-a5a5-cca108fd2493", "url": "https://t.me/CyberDispatch/1348"}, {"timestamp": "2026-11-04T13:00:01Z", "date_only": false, "value": "2026-11-04T13:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2025-2749", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "c18ce586-6a6b-4c0a-b55c-a4611ceefd1a", "status": {"status_reason": "confirmed", "exploited": true}}], "metrics": {"as_of": "2026-11-12T13:31:59.933Z", "anchors": {"origin": {"timestamp": "2025-03-24T18:18:07.228Z", "date_only": false, "value": "2025-03-24T18:18:07.228Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-2749", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2025-03-24T18:18:07.228Z", "date_only": false, "value": "2025-03-24T18:18:07.228Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-2749", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2025-03-24T19:23:08Z", "date_only": false, "value": "2025-03-24T19:23:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8502", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "cd868ac1-4a5f-4499-a5f8-ec01286bb65c", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-2749\n\ud83d\udd25 CVSS Score: 7.2 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.\n\ud83d\udccf Published: 2025-03-24T18:18:07.228Z\n\ud83d\udccf Modified: 2025-03-24T19:16:31.029Z\n\ud83d\udd17 References:\n1. https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/\n2. https://devnet.kentico.com/download/hotfixes", "url": "https://t.me/DarkWebInformer_CVEAlerts/8502", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2025-2749", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "c18ce586-6a6b-4c0a-b55c-a4611ceefd1a", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 33802912.772, "hours": 9389.697992222222, "days": 391.2374163425926, "min_seconds": 33802912.772, "max_seconds": 33889312.772, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-03-24T18:18:07.228Z", "date_only": false, "value": "2025-03-24T18:18:07.228Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-2749", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2025-2749", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "c18ce586-6a6b-4c0a-b55c-a4611ceefd1a", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": 33802912.772, "hours": 9389.697992222222, "days": 391.2374163425926, "min_seconds": 33802912.772, "max_seconds": 33889312.772, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-03-24T18:18:07.228Z", "date_only": false, "value": "2025-03-24T18:18:07.228Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-2749", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2025-2749", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "c18ce586-6a6b-4c0a-b55c-a4611ceefd1a", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 3900.772, "hours": 1.0835477777777778, "days": 0.045147824074074076, "min_seconds": 3900.772, "max_seconds": 3900.772, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-03-24T18:18:07.228Z", "date_only": false, "value": "2025-03-24T18:18:07.228Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-2749", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2025-03-24T19:23:08Z", "date_only": false, "value": "2025-03-24T19:23:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8502", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "cd868ac1-4a5f-4499-a5f8-ec01286bb65c", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-2749\n\ud83d\udd25 CVSS Score: 7.2 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.\n\ud83d\udccf Published: 2025-03-24T18:18:07.228Z\n\ud83d\udccf Modified: 2025-03-24T19:16:31.029Z\n\ud83d\udd17 References:\n1. https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/\n2. https://devnet.kentico.com/download/hotfixes", "url": "https://t.me/DarkWebInformer_CVEAlerts/8502", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 51650032.7056, "hours": 14347.231307111111, "days": 597.801304462963, "min_seconds": 51650032.7056, "max_seconds": 51650032.7056, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-03-24T18:18:07.228Z", "date_only": false, "value": "2025-03-24T18:18:07.228Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-2749", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-12T13:31:59.933Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 17847119.9336, "hours": 4957.533314888889, "days": 206.5638881203704, "min_seconds": 17760719.9336, "max_seconds": 17847119.9336, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2025-2749", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "c18ce586-6a6b-4c0a-b55c-a4611ceefd1a", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-11-12T13:31:59.933Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 51646131.9336, "hours": 14346.147759333333, "days": 597.7561566388889, "min_seconds": 51646131.9336, "max_seconds": 51646131.9336, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-03-24T19:23:08Z", "date_only": false, "value": "2025-03-24T19:23:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8502", "record": "CVE-2025-2749", "field": "creation_timestamp", "uuid": "cd868ac1-4a5f-4499-a5f8-ec01286bb65c", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-2749\n\ud83d\udd25 CVSS Score: 7.2 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.\n\ud83d\udccf Published: 2025-03-24T18:18:07.228Z\n\ud83d\udccf Modified: 2025-03-24T19:16:31.029Z\n\ud83d\udd17 References:\n1. https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/\n2. https://devnet.kentico.com/download/hotfixes", "url": "https://t.me/DarkWebInformer_CVEAlerts/8502", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-12T13:31:59.933Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}