{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1505.003 Web Shell","home_page_url":"https://patchfirst.co/technique/T1505.003/","feed_url":"https://patchfirst.co/feed/technique/T1505.003.json","description":"New and newly exploited CVEs that lead to ATT&CK T1505.003 Web Shell, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2025-52691#kev","url":"https://patchfirst.co/cve/CVE-2025-52691/","title":"[KEV] CVE-2025-52691: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability","content_text":"SmarterTools · SmarterMail. In CISA KEV since 2026-01-26, known ransomware use. ENISA EUVD lists it as exploited. EPSS 85.7% (higher than 99.72% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1505.003 Web Shell. Named in 1 threat report. Priority 88.8 of 100.","summary":"SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability","date_published":"2026-01-26T00:00:00.000Z","date_modified":"2026-10-07T12:10:00.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1505.003"],"_patchfirst":{"reason":"kev","priority":88.8,"kev":{"dateAdded":"2026-01-26","ransomware":true},"epss":{"score":0.85655,"percentile":0.99725},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"SmarterTools","product":"SmarterMail","techniqueIds":["T1190","T1059","T1505.003"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-4063#kev","url":"https://patchfirst.co/cve/CVE-2018-4063/","title":"[KEV] CVE-2018-4063: Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability","content_text":"Sierra Wireless · AirLink ALEOS. In CISA KEV since 2025-12-12. ENISA EUVD lists it as exploited. EPSS 27.3% (higher than 98.1% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell. Priority 73.8 of 100.","summary":"Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability","date_published":"2025-12-12T00:00:00.000Z","date_modified":"2026-06-17T01:58:18.000Z","tags":["kev","public-exploit","T1190","T1505.003"],"_patchfirst":{"reason":"kev","priority":73.8,"kev":{"dateAdded":"2025-12-12","ransomware":false},"epss":{"score":0.2726,"percentile":0.98056},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Sierra Wireless","product":"AirLink ALEOS","techniqueIds":["T1190","T1505.003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-35939#kev","url":"https://patchfirst.co/cve/CVE-2025-35939/","title":"[KEV] CVE-2025-35939: Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability","content_text":"Craft CMS · Craft CMS. In CISA KEV since 2025-06-02. ENISA EUVD lists it as exploited. EPSS 1.3% (higher than 71.5% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell; T1059 Command and Scripting Interpreter. Priority 56.0 of 100.","summary":"Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability","date_published":"2025-06-02T00:00:00.000Z","date_modified":"2026-06-17T09:14:18.000Z","tags":["kev","T1190","T1505.003","T1059"],"_patchfirst":{"reason":"kev","priority":56,"kev":{"dateAdded":"2025-06-02","ransomware":false},"epss":{"score":0.01349,"percentile":0.71458},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Craft CMS","product":"Craft CMS","techniqueIds":["T1190","T1505.003","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-4427#kev","url":"https://patchfirst.co/cve/CVE-2025-4427/","title":"[KEV] CVE-2025-4427: Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability","content_text":"Ivanti · Endpoint Manager Mobile (EPMM). In CISA KEV since 2025-05-19. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1505.003 Web Shell. Priority 68.2 of 100.","summary":"Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability","date_published":"2025-05-19T00:00:00.000Z","date_modified":"2026-06-17T09:33:13.000Z","tags":["kev","public-exploit","T1190","T1059","T1505.003"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2025-05-19","ransomware":false},"epss":{"score":0.99927,"percentile":0.99969},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM)","techniqueIds":["T1190","T1059","T1505.003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-42999#kev","url":"https://patchfirst.co/cve/CVE-2025-42999/","title":"[KEV] CVE-2025-42999: SAP NetWeaver Deserialization Vulnerability","content_text":"SAP · NetWeaver. In CISA KEV since 2025-05-15, known ransomware use. ENISA EUVD lists it as exploited. EPSS 12.9% (higher than 96.3% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1505.003 Web Shell. Priority 78.6 of 100.","summary":"SAP NetWeaver Deserialization Vulnerability","date_published":"2025-05-15T00:00:00.000Z","date_modified":"2026-08-11T04:17:17.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1505.003"],"_patchfirst":{"reason":"kev","priority":78.6,"kev":{"dateAdded":"2025-05-15","ransomware":true},"epss":{"score":0.12854,"percentile":0.96292},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"SAP","product":"NetWeaver","techniqueIds":["T1190","T1059","T1505.003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-31324#kev","url":"https://patchfirst.co/cve/CVE-2025-31324/","title":"[KEV] CVE-2025-31324: SAP NetWeaver Unrestricted File Upload Vulnerability","content_text":"SAP · NetWeaver. In CISA KEV since 2025-04-29, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1055 Process Injection; T1505.003 Web Shell; T1059 Command and Scripting Interpreter; T1602 Data from Configuration Repository. Named in 1 threat report. Priority 83.7 of 100.","summary":"SAP NetWeaver Unrestricted File Upload Vulnerability","date_published":"2025-04-29T00:00:00.000Z","date_modified":"2026-08-04T05:16:34.000Z","tags":["kev","ransomware","public-exploit","T1055","T1505.003","T1059","T1602"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2025-04-29","ransomware":true},"epss":{"score":0.99486,"percentile":0.99944},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SAP","product":"NetWeaver","techniqueIds":["T1055","T1505.003","T1059","T1602"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-3928#kev","url":"https://patchfirst.co/cve/CVE-2025-3928/","title":"[KEV] CVE-2025-3928: Commvault Web Server Unspecified Vulnerability","content_text":"Commvault · Web Server. In CISA KEV since 2025-04-28. ENISA EUVD lists it as exploited. EPSS 2.5% (higher than 84.9% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1059 Command and Scripting Interpreter; T1505.003 Web Shell. Priority 61.1 of 100.","summary":"Commvault Web Server Unspecified Vulnerability","date_published":"2025-04-28T00:00:00.000Z","date_modified":"2026-10-08T12:54:32.000Z","tags":["kev","T1059","T1505.003"],"_patchfirst":{"reason":"kev","priority":61.1,"kev":{"dateAdded":"2025-04-28","ransomware":false},"epss":{"score":0.02527,"percentile":0.84871},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Commvault","product":"Web Server","techniqueIds":["T1059","T1505.003"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-20118#kev","url":"https://patchfirst.co/cve/CVE-2023-20118/","title":"[KEV] CVE-2023-20118: Cisco Small Business RV Series Routers Command Injection Vulnerability","content_text":"Cisco · Small Business RV Series Routers. In CISA KEV since 2025-03-03. ENISA EUVD lists it as exploited. EPSS 54.1% (higher than 99% of CVEs). CVSS 7.2 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts; T1059 Command and Scripting Interpreter; T1505.003 Web Shell. Priority 62.8 of 100.","summary":"Cisco Small Business RV Series Routers Command Injection Vulnerability","date_published":"2025-03-03T00:00:00.000Z","date_modified":"2026-06-17T05:29:31.000Z","tags":["kev","T1068","T1078","T1059","T1505.003"],"_patchfirst":{"reason":"kev","priority":62.8,"kev":{"dateAdded":"2025-03-03","ransomware":false},"epss":{"score":0.54107,"percentile":0.99005},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Cisco","product":"Small Business RV Series Routers","techniqueIds":["T1068","T1078","T1059","T1505.003"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-11680#kev","url":"https://patchfirst.co/cve/CVE-2024-11680/","title":"[KEV] CVE-2024-11680: ProjectSend Improper Authentication Vulnerability","content_text":"ProjectSend · ProjectSend. In CISA KEV since 2024-12-03. ENISA EUVD lists it as exploited. EPSS 91.8% (higher than 99.82% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1098 Account Manipulation; T1505.003 Web Shell. Priority 69.8 of 100.","summary":"ProjectSend Improper Authentication Vulnerability","date_published":"2024-12-03T00:00:00.000Z","date_modified":"2026-07-14T23:17:13.000Z","tags":["kev","public-exploit","T1190","T1098","T1505.003"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2024-12-03","ransomware":false},"epss":{"score":0.91849,"percentile":0.99816},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ProjectSend","product":"ProjectSend","techniqueIds":["T1190","T1098","T1505.003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-39717#kev","url":"https://patchfirst.co/cve/CVE-2024-39717/","title":"[KEV] CVE-2024-39717: Versa Director Dangerous File Type Upload Vulnerability","content_text":"Versa · Director. In CISA KEV since 2024-08-23. ENISA EUVD lists it as exploited. EPSS 4.0% (higher than 90.5% of CVEs). CVSS 7.2 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell. Priority 61.1 of 100.","summary":"Versa Director Dangerous File Type Upload Vulnerability","date_published":"2024-08-23T00:00:00.000Z","date_modified":"2026-06-17T07:42:31.000Z","tags":["kev","T1190","T1505.003"],"_patchfirst":{"reason":"kev","priority":61.1,"kev":{"dateAdded":"2024-08-23","ransomware":false},"epss":{"score":0.03987,"percentile":0.9049},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Versa","product":"Director","techniqueIds":["T1190","T1505.003"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-21893#kev","url":"https://patchfirst.co/cve/CVE-2024-21893/","title":"[KEV] CVE-2024-21893: Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability","content_text":"Ivanti · Connect Secure, Policy Secure, and Neurons. In CISA KEV since 2024-01-31, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 8.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts; T1505.003 Web Shell; T1555 Credentials from Password Stores. Priority 78.7 of 100.","summary":"Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability","date_published":"2024-01-31T00:00:00.000Z","date_modified":"2026-08-04T05:16:30.000Z","tags":["kev","ransomware","public-exploit","T1190","T1078","T1505.003","T1555"],"_patchfirst":{"reason":"kev","priority":78.7,"kev":{"dateAdded":"2024-01-31","ransomware":true},"epss":{"score":0.99999,"percentile":0.99999},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure, Policy Secure, and Neurons","techniqueIds":["T1190","T1078","T1505.003","T1555"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-21887","url":"https://patchfirst.co/cve/CVE-2024-21887/","title":"CVE-2024-21887: Ivanti Connect Secure and Policy Secure Command Injection Vulnerability","content_text":"Ivanti · Connect Secure and Policy Secure. In CISA KEV since 2024-01-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1505.003 Web Shell; T1552 Unsecured Credentials. Named in 4 threat reports. Priority 88.4 of 100.","summary":"Ivanti Connect Secure and Policy Secure Command Injection Vulnerability","date_published":"2024-01-12T00:00:00.000Z","date_modified":"2026-08-04T05:16:30.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1505.003","T1552"],"_patchfirst":{"reason":"published","priority":88.4,"kev":{"dateAdded":"2024-01-10","ransomware":true},"epss":{"score":0.99999,"percentile":0.99999},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure and Policy Secure","techniqueIds":["T1190","T1059","T1505.003","T1552"],"reportCount":4,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-46805","url":"https://patchfirst.co/cve/CVE-2023-46805/","title":"CVE-2023-46805: Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability","content_text":"Ivanti · Connect Secure and Policy Secure. In CISA KEV since 2024-01-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 8.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts; T1505.003 Web Shell; T1555 Credentials from Password Stores. Named in 4 threat reports. Priority 87.7 of 100.","summary":"Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability","date_published":"2024-01-12T00:00:00.000Z","date_modified":"2026-10-01T21:17:17.000Z","tags":["kev","ransomware","public-exploit","T1190","T1078","T1505.003","T1555"],"_patchfirst":{"reason":"published","priority":87.7,"kev":{"dateAdded":"2024-01-10","ransomware":true},"epss":{"score":0.99984,"percentile":0.99982},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure and Policy Secure","techniqueIds":["T1190","T1078","T1505.003","T1555"],"reportCount":4,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-32315#kev","url":"https://patchfirst.co/cve/CVE-2023-32315/","title":"[KEV] CVE-2023-32315: Ignite Realtime Openfire Path Traversal Vulnerability","content_text":"Ignite Realtime · Openfire. In CISA KEV since 2023-08-24. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1202 Indirect Command Execution; T1505.003 Web Shell; T1087.002 Domain Account; T1496 Resource Hijacking. Named in 1 threat report. Priority 82.1 of 100.","summary":"Ignite Realtime Openfire Path Traversal Vulnerability","date_published":"2023-08-24T00:00:00.000Z","date_modified":"2026-06-17T05:58:33.000Z","tags":["kev","public-exploit","T1202","T1505.003","T1087.002","T1496"],"_patchfirst":{"reason":"kev","priority":82.1,"kev":{"dateAdded":"2023-08-24","ransomware":false},"epss":{"score":0.99999,"percentile":0.99992},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Ignite Realtime","product":"Openfire","techniqueIds":["T1202","T1505.003","T1087.002","T1496"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-26360","url":"https://patchfirst.co/cve/CVE-2023-26360/","title":"CVE-2023-26360: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","content_text":"Adobe · ColdFusion. In CISA KEV since 2023-03-15. ENISA EUVD lists it as exploited. EPSS 97.3% (higher than 99.9% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.007 JavaScript; T1003.001 LSASS Memory; T1036.005 Match Legitimate Resource Name or Location; T1046 Network Service Discovery; T1071.001 Web Protocols; +3 more. Priority 69.0 of 100.","summary":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","date_published":"2023-03-23T00:00:00.000Z","date_modified":"2026-06-17T05:43:10.000Z","tags":["kev","public-exploit","T1190","T1059.007","T1003.001","T1036.005","T1046","T1071.001","T1105","T1484.001","T1505.003"],"_patchfirst":{"reason":"published","priority":69,"kev":{"dateAdded":"2023-03-15","ransomware":false},"epss":{"score":0.97339,"percentile":0.99897},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Adobe","product":"ColdFusion","techniqueIds":["T1190","T1059.007","T1003.001","T1036.005","T1046","T1071.001","T1105","T1484.001","T1505.003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-22952#kev","url":"https://patchfirst.co/cve/CVE-2023-22952/","title":"[KEV] CVE-2023-22952: Multiple SugarCRM Products Remote Code Execution Vulnerability","content_text":"SugarCRM · Multiple Products. In CISA KEV since 2023-02-02. ENISA EUVD lists it as exploited. EPSS 80.1% (higher than 99.62% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1021.001 Remote Desktop Protocol; T1070.004 File Deletion; T1078 Valid Accounts; T1083 File and Directory Discovery; +3 more. Priority 69.1 of 100.","summary":"Multiple SugarCRM Products Remote Code Execution Vulnerability","date_published":"2023-02-02T00:00:00.000Z","date_modified":"2026-06-17T05:36:30.000Z","tags":["kev","public-exploit","T1190","T1059","T1021.001","T1070.004","T1078","T1083","T1482","T1505.003","T1530"],"_patchfirst":{"reason":"kev","priority":69.1,"kev":{"dateAdded":"2023-02-02","ransomware":false},"epss":{"score":0.80139,"percentile":0.99616},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"SugarCRM","product":"Multiple Products","techniqueIds":["T1190","T1059","T1021.001","T1070.004","T1078","T1083","T1482","T1505.003","T1530"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-41352#kev","url":"https://patchfirst.co/cve/CVE-2022-41352/","title":"[KEV] CVE-2022-41352: Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability","content_text":"Synacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2022-10-20, known ransomware use. ENISA EUVD lists it as exploited. EPSS 95.5% (higher than 99.87% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell. Priority 79.8 of 100.","summary":"Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability","date_published":"2022-10-20T00:00:00.000Z","date_modified":"2026-09-10T04:17:37.000Z","tags":["kev","ransomware","public-exploit","T1190","T1505.003"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2022-10-20","ransomware":true},"epss":{"score":0.95478,"percentile":0.99869},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","techniqueIds":["T1190","T1505.003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-41082","url":"https://patchfirst.co/cve/CVE-2022-41082/","title":"CVE-2022-41082: Microsoft Exchange Server Remote Code Execution Vulnerability","content_text":"Microsoft · Exchange Server. In CISA KEV since 2022-09-30, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 8.0 HIGH. Public exploit code exists. ATT&CK: T1059.001 PowerShell; T1078 Valid Accounts; T1087 Account Discovery; T1482 Domain Trust Discovery; T1505.003 Web Shell; T1567 Exfiltration Over Web Service. Priority 78.6 of 100.","summary":"Microsoft Exchange Server Remote Code Execution Vulnerability","date_published":"2022-10-03T00:00:00.000Z","date_modified":"2026-06-17T05:02:33.000Z","tags":["kev","ransomware","public-exploit","T1059.001","T1078","T1087","T1482","T1505.003","T1567"],"_patchfirst":{"reason":"published","priority":78.6,"kev":{"dateAdded":"2022-09-30","ransomware":true},"epss":{"score":0.9997,"percentile":0.99977},"cvss":{"score":8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Exchange Server","techniqueIds":["T1059.001","T1078","T1087","T1482","T1505.003","T1567"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-22963#kev","url":"https://patchfirst.co/cve/CVE-2022-22963/","title":"[KEV] CVE-2022-22963: VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability","content_text":"VMware Tanzu · Spring Cloud. In CISA KEV since 2022-08-25. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.007 JavaScript; T1505.003 Web Shell. Priority 69.9 of 100.","summary":"VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability","date_published":"2022-08-25T00:00:00.000Z","date_modified":"2026-06-17T04:29:15.000Z","tags":["kev","public-exploit","T1190","T1059.007","T1505.003"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2022-08-25","ransomware":false},"epss":{"score":0.99938,"percentile":0.99971},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"VMware Tanzu","product":"Spring Cloud","techniqueIds":["T1190","T1059.007","T1505.003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-22954#kev","url":"https://patchfirst.co/cve/CVE-2022-22954/","title":"[KEV] CVE-2022-22954: VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability","content_text":"VMware · Workspace ONE Access and Identity Manager. In CISA KEV since 2022-04-14, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1505.003 Web Shell. Priority 79.9 of 100.","summary":"VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability","date_published":"2022-04-14T00:00:00.000Z","date_modified":"2026-06-17T04:29:14.000Z","tags":["kev","ransomware","public-exploit","T1505.003"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2022-04-14","ransomware":true},"epss":{"score":0.99998,"percentile":0.99989},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"VMware","product":"Workspace ONE Access and Identity Manager","techniqueIds":["T1505.003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-12615#kev","url":"https://patchfirst.co/cve/CVE-2017-12615/","title":"[KEV] CVE-2017-12615: Apache Tomcat on Windows Remote Code Execution Vulnerability","content_text":"Apache · Tomcat. In CISA KEV since 2022-03-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell. Priority 78.7 of 100.","summary":"Apache Tomcat on Windows Remote Code Execution Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-08-06T05:16:34.000Z","tags":["kev","ransomware","public-exploit","T1190","T1505.003"],"_patchfirst":{"reason":"kev","priority":78.7,"kev":{"dateAdded":"2022-03-25","ransomware":true},"epss":{"score":0.99707,"percentile":0.99952},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Apache","product":"Tomcat","techniqueIds":["T1190","T1505.003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-12617#kev","url":"https://patchfirst.co/cve/CVE-2017-12617/","title":"[KEV] CVE-2017-12617: Apache Tomcat Remote Code Execution Vulnerability","content_text":"Apache · Tomcat. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1505.003 Web Shell. Named in 1 threat report. Priority 72.5 of 100.","summary":"Apache Tomcat Remote Code Execution Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-08-25T16:28:27.000Z","tags":["kev","public-exploit","T1190","T1059","T1505.003"],"_patchfirst":{"reason":"kev","priority":72.5,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.99968,"percentile":0.99977},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Apache","product":"Tomcat","techniqueIds":["T1190","T1059","T1505.003"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-27860#kev","url":"https://patchfirst.co/cve/CVE-2021-27860/","title":"[KEV] CVE-2021-27860: FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit","content_text":"FatPipe · WARP, IPVPN, and MPVPN software. In CISA KEV since 2022-01-10. ENISA EUVD lists it as exploited. EPSS 39.7% (higher than 98.6% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1505.003 Web Shell. Named in 1 threat report. Priority 72.8 of 100.","summary":"FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit","date_published":"2022-01-10T00:00:00.000Z","date_modified":"2026-06-17T03:45:32.000Z","tags":["kev","public-exploit","T1505.003"],"_patchfirst":{"reason":"kev","priority":72.8,"kev":{"dateAdded":"2022-01-10","ransomware":false},"epss":{"score":0.3968,"percentile":0.98617},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"FatPipe","product":"WARP, IPVPN, and MPVPN software","techniqueIds":["T1505.003"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-44228#kev","url":"https://patchfirst.co/cve/CVE-2021-44228/","title":"[KEV] CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability","content_text":"Apache · Log4j2. In CISA KEV since 2021-12-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1486 Data Encrypted for Impact; T1496 Resource Hijacking; T1505.003 Web Shell; T1608.001 Upload Malware. Named in 10 threat reports. Priority 90.0 of 100.","summary":"Apache Log4j2 Remote Code Execution Vulnerability","date_published":"2021-12-10T00:00:00.000Z","date_modified":"2026-08-11T19:33:44.000Z","tags":["kev","ransomware","public-exploit","T1190","T1486","T1496","T1505.003","T1608.001"],"_patchfirst":{"reason":"kev","priority":90,"kev":{"dateAdded":"2021-12-10","ransomware":true},"epss":{"score":0.99999,"percentile":1},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Apache","product":"Log4j2","techniqueIds":["T1190","T1486","T1496","T1505.003","T1608.001"],"reportCount":10,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-44077#kev","url":"https://patchfirst.co/cve/CVE-2021-44077/","title":"[KEV] CVE-2021-44077: Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability","content_text":"Zoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus. In CISA KEV since 2021-12-01. ENISA EUVD lists it as exploited. EPSS 93.3% (higher than 99.84% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell; T1003 OS Credential Dumping; T1003.003 NTDS; T1027 Obfuscated Files or Information; T1047 Windows Management Instrumentation; +7 more. Priority 69.8 of 100.","summary":"Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability","date_published":"2021-12-01T00:00:00.000Z","date_modified":"2026-06-17T04:11:52.000Z","tags":["kev","public-exploit","T1190","T1505.003","T1003","T1003.003","T1027","T1047","T1070.004","T1087.002","T1136","T1140","T1218","T1560.001","T1573.001"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2021-12-01","ransomware":false},"epss":{"score":0.93298,"percentile":0.99836},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zoho","product":"ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus","techniqueIds":["T1190","T1505.003","T1003","T1003.003","T1027","T1047","T1070.004","T1087.002","T1136","T1140","T1218","T1560.001","T1573.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-26855#kev","url":"https://patchfirst.co/cve/CVE-2021-26855/","title":"[KEV] CVE-2021-26855: Microsoft Exchange Server Remote Code Execution Vulnerability","content_text":"Microsoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1090 Proxy; T1005 Data from Local System; T1505.003 Web Shell. Named in 5 threat reports. Priority 89.4 of 100.","summary":"Microsoft Exchange Server Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-19T19:22:24.000Z","tags":["kev","ransomware","public-exploit","T1133","T1090","T1005","T1505.003"],"_patchfirst":{"reason":"kev","priority":89.4,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99996,"percentile":0.99988},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Microsoft","product":"Exchange Server","techniqueIds":["T1133","T1090","T1005","T1505.003"],"reportCount":5,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-0604#kev","url":"https://patchfirst.co/cve/CVE-2019-0604/","title":"[KEV] CVE-2019-0604: Microsoft SharePoint Remote Code Execution Vulnerability","content_text":"Microsoft · SharePoint. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1041 Exfiltration Over C2 Channel; T1505.003 Web Shell; T1608.001 Upload Malware; T1003 OS Credential Dumping. Named in 4 threat reports. Priority 88.8 of 100.","summary":"Microsoft SharePoint Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:08:31.000Z","tags":["kev","ransomware","public-exploit","T1190","T1041","T1505.003","T1608.001","T1003"],"_patchfirst":{"reason":"kev","priority":88.8,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99913,"percentile":0.99968},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Microsoft","product":"SharePoint","techniqueIds":["T1190","T1041","T1505.003","T1608.001","T1003"],"reportCount":4,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-27065#kev","url":"https://patchfirst.co/cve/CVE-2021-27065/","title":"[KEV] CVE-2021-27065: Microsoft Exchange Server Remote Code Execution Vulnerability","content_text":"Microsoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.96% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1505.003 Web Shell. Named in 4 threat reports. Priority 87.4 of 100.","summary":"Microsoft Exchange Server Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-10-01T21:17:17.000Z","tags":["kev","ransomware","public-exploit","T1505.003"],"_patchfirst":{"reason":"kev","priority":87.4,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99876,"percentile":0.99964},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Exchange Server","techniqueIds":["T1505.003"],"reportCount":4,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-0688#kev","url":"https://patchfirst.co/cve/CVE-2020-0688/","title":"[KEV] CVE-2020-0688: Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability","content_text":"Microsoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.97% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1110 Brute Force; T1114 Email Collection; T1505.003 Web Shell. Named in 3 threat reports. Priority 86.9 of 100.","summary":"Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:46:21.000Z","tags":["kev","ransomware","public-exploit","T1190","T1110","T1114","T1505.003"],"_patchfirst":{"reason":"kev","priority":86.9,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99955,"percentile":0.99974},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Exchange Server","techniqueIds":["T1190","T1110","T1114","T1505.003"],"reportCount":3,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-26857#kev","url":"https://patchfirst.co/cve/CVE-2021-26857/","title":"[KEV] CVE-2021-26857: Microsoft Exchange Server Remote Code Execution Vulnerability","content_text":"Microsoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 95.8% (higher than 99.87% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1505.003 Web Shell. Named in 3 threat reports. Priority 86.2 of 100.","summary":"Microsoft Exchange Server Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-19T19:22:27.000Z","tags":["kev","ransomware","public-exploit","T1505.003"],"_patchfirst":{"reason":"kev","priority":86.2,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.95762,"percentile":0.99871},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Exchange Server","techniqueIds":["T1505.003"],"reportCount":3,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-18935#kev","url":"https://patchfirst.co/cve/CVE-2019-18935/","title":"[KEV] CVE-2019-18935: Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability","content_text":"Progress · Telerik UI for ASP.NET AJAX. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1041 Exfiltration Over C2 Channel; T1496 Resource Hijacking; T1505.003 Web Shell. Named in 1 threat report. Priority 83.7 of 100.","summary":"Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:25:36.000Z","tags":["kev","ransomware","public-exploit","T1190","T1041","T1496","T1505.003"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99737,"percentile":0.99954},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Progress","product":"Telerik UI for ASP.NET AJAX","techniqueIds":["T1190","T1041","T1496","T1505.003"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-40539#kev","url":"https://patchfirst.co/cve/CVE-2021-40539/","title":"[KEV] CVE-2021-40539: Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability","content_text":"Zoho · ManageEngine. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.0% (higher than 99.93% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell; T1003 OS Credential Dumping; T1003.003 NTDS; T1027 Obfuscated Files or Information; T1047 Windows Management Instrumentation; +7 more. Named in 1 threat report. Priority 83.7 of 100.","summary":"Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T04:07:06.000Z","tags":["kev","ransomware","public-exploit","T1190","T1505.003","T1003","T1003.003","T1027","T1047","T1070.004","T1087.002","T1136","T1140","T1218","T1560.001","T1573.001"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.9896,"percentile":0.99929},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Zoho","product":"ManageEngine","techniqueIds":["T1190","T1505.003","T1003","T1003.003","T1027","T1047","T1070.004","T1087.002","T1136","T1140","T1218","T1560.001","T1573.001"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-26858#kev","url":"https://patchfirst.co/cve/CVE-2021-26858/","title":"[KEV] CVE-2021-26858: Microsoft Exchange Server Remote Code Execution Vulnerability","content_text":"Microsoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 93.7% (higher than 99.84% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1505.003 Web Shell. Named in 3 threat reports. Priority 81.2 of 100.","summary":"Microsoft Exchange Server Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-10-01T21:17:16.000Z","tags":["kev","ransomware","T1505.003"],"_patchfirst":{"reason":"kev","priority":81.2,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.93651,"percentile":0.99843},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Exchange Server","techniqueIds":["T1505.003"],"reportCount":3,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2019-8394#kev","url":"https://patchfirst.co/cve/CVE-2019-8394/","title":"[KEV] CVE-2019-8394: Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability","content_text":"Zoho · ManageEngine. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 63.3% (higher than 99.21% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell. Priority 67.4 of 100.","summary":"Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:41:56.000Z","tags":["kev","public-exploit","T1190","T1505.003"],"_patchfirst":{"reason":"kev","priority":67.4,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.63336,"percentile":0.99206},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Zoho","product":"ManageEngine","techniqueIds":["T1190","T1505.003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-36741#kev","url":"https://patchfirst.co/cve/CVE-2021-36741/","title":"[KEV] CVE-2021-36741: Trend Micro Multiple Products Improper Input Validation Vulnerability","content_text":"Trend Micro · Apex One, Apex One as a Service, and Worry-Free Business Security. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 5.0% (higher than 92.2% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell. Priority 62.6 of 100.","summary":"Trend Micro Multiple Products Improper Input Validation Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:59:05.000Z","tags":["kev","T1190","T1505.003"],"_patchfirst":{"reason":"kev","priority":62.6,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.04951,"percentile":0.92159},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Trend Micro","product":"Apex One, Apex One as a Service, and Worry-Free Business Security","techniqueIds":["T1190","T1505.003"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2020-15189","url":"https://patchfirst.co/cve/CVE-2020-15189/","title":"CVE-2020-15189: Remote Code Execution in SOY CMS","content_text":"inunosinsi · soycms. Not in CISA KEV. EPSS 2.8% (higher than 86.5% of CVEs). CVSS 6.8 MEDIUM. ATT&CK: T1505.003 Web Shell; T1059 Command and Scripting Interpreter. Priority 22.1 of 100.","summary":"Remote Code Execution in SOY CMS","date_published":"2020-09-18T00:00:00.000Z","date_modified":"2024-08-04T13:08:22.000Z","tags":["T1505.003","T1059"],"_patchfirst":{"reason":"published","priority":22.1,"kev":null,"epss":{"score":0.02807,"percentile":0.8648},"cvss":{"score":6.8,"severity":"MEDIUM","version":"3.1"},"vendor":"inunosinsi","product":"soycms","techniqueIds":["T1505.003","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-12029","url":"https://patchfirst.co/cve/CVE-2020-12029/","title":"CVE-2020-12029: Rockwell Automation FactoryTalk View SE","content_text":"Rockwell Automation · FactoryTalk View SE. Not in CISA KEV. EPSS 47.0% (higher than 98.8% of CVEs). CVSS 9.0 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1505.003 Web Shell; T1059 Command and Scripting Interpreter. Priority 31.1 of 100.","summary":"Rockwell Automation FactoryTalk View SE","date_published":"2020-07-20T00:00:00.000Z","date_modified":"2024-09-16T22:02:56.000Z","tags":["public-exploit","T1133","T1505.003","T1059"],"_patchfirst":{"reason":"published","priority":31.1,"kev":null,"epss":{"score":0.46968,"percentile":0.98829},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1"},"vendor":"Rockwell Automation","product":"FactoryTalk View SE","techniqueIds":["T1133","T1505.003","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2020-5297","url":"https://patchfirst.co/cve/CVE-2020-5297/","title":"CVE-2020-5297: Upload whitelisted files to any directory in OctoberCMS","content_text":"octobercms · october. Not in CISA KEV. EPSS 1.2% (higher than 67.7% of CVEs). CVSS 3.4 LOW. Public exploit code exists. ATT&CK: T1505.003 Web Shell; T1059 Command and Scripting Interpreter. Priority 20.9 of 100.","summary":"Upload whitelisted files to any directory in OctoberCMS","date_published":"2020-06-03T00:00:00.000Z","date_modified":"2024-08-04T08:22:09.000Z","tags":["public-exploit","T1505.003","T1059"],"_patchfirst":{"reason":"published","priority":20.9,"kev":null,"epss":{"score":0.0118,"percentile":0.67685},"cvss":{"score":3.4,"severity":"LOW","version":"3.1"},"vendor":"octobercms","product":"october","techniqueIds":["T1505.003","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2020-11010","url":"https://patchfirst.co/cve/CVE-2020-11010/","title":"CVE-2020-11010: SQL injection in Tortoise ORM","content_text":"tortoise · tortoise-orm. Not in CISA KEV. EPSS 1.0% (higher than 64.2% of CVEs). CVSS 6.3 MEDIUM. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1136 Create Account; T1190 Exploit Public-Facing Application; T1505.003 Web Shell; +1 more. Priority 17.2 of 100.","summary":"SQL injection in Tortoise ORM","date_published":"2020-04-20T00:00:00.000Z","date_modified":"2024-08-04T11:21:14.000Z","tags":["T1133","T1059","T1005","T1136","T1190","T1505.003","T1565.001"],"_patchfirst":{"reason":"published","priority":17.2,"kev":null,"epss":{"score":0.01047,"percentile":0.64169},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1"},"vendor":"tortoise","product":"tortoise-orm","techniqueIds":["T1133","T1059","T1005","T1136","T1190","T1505.003","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-3240","url":"https://patchfirst.co/cve/CVE-2020-3240/","title":"CVE-2020-3240: Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data","content_text":"Cisco · Cisco UCS Director. Not in CISA KEV. EPSS 38.7% (higher than 98.6% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1133 External Remote Services; T1005 Data from Local System; T1505.003 Web Shell; T1003.008 /etc/passwd and /etc/shadow; T1059 Command and Scripting Interpreter; T1552.001 Credentials In Files. Priority 26.6 of 100.","summary":"Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data","date_published":"2020-04-15T00:00:00.000Z","date_modified":"2024-11-15T17:30:58.000Z","tags":["T1133","T1005","T1505.003","T1003.008","T1059","T1552.001"],"_patchfirst":{"reason":"published","priority":26.6,"kev":null,"epss":{"score":0.38693,"percentile":0.98578},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.0"},"vendor":"Cisco","product":"Cisco UCS Director","techniqueIds":["T1133","T1005","T1505.003","T1003.008","T1059","T1552.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-18234","url":"https://patchfirst.co/cve/CVE-2019-18234/","title":"CVE-2019-18234: Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely…","content_text":"Not in CISA KEV. EPSS 1.9% (higher than 79.5% of CVEs). ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1136 Create Account; T1190 Exploit Public-Facing Application; T1505.003 Web Shell; +1 more. Priority 15.9 of 100.","summary":"Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely…","date_published":"2019-12-23T00:00:00.000Z","date_modified":"2024-08-05T01:47:14.000Z","tags":["T1133","T1059","T1005","T1136","T1190","T1505.003","T1565.001"],"_patchfirst":{"reason":"published","priority":15.9,"kev":null,"epss":{"score":0.01889,"percentile":0.79525},"cvss":null,"vendor":null,"product":null,"techniqueIds":["T1133","T1059","T1005","T1136","T1190","T1505.003","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}