Welcome to the CrowdSec VulnTracking Report. In these monthly reports, we explore key insights on emerging vulnerabilities and CVE exploitation trends, as spotted by the CrowdSec Network.
In June 2025, we added detection for 46 vulnerabilities and/or exploits to our database, translating them into scenarios for the CrowdSec Security Engine, AppSec rules for the CrowdSec WAF, and updated entries in our CTI.
The Speed of Exploitation: Old vs. New Vulnerabilities
Much light has recently been shed on “how fast can the bad guys weaponize vulnerabilities” and “how fast can the good guys patch said vulnerabilities”. However, as we highlighted in our recent analysis, many legitimate “attack surface management” (or continuous vulnerability scanning for those who missed the hype train) rely on the availability of publicly available exploits, and so do (most of) the bad guys.
However, examining on a large scale (around 20 million daily attacks reported from more than a hundred thousand distinct setups in over 150 countries), we observe that much of the exploitation focuses on older and lower-profile vulnerabilities. Vulnerabilities can regain relevance when a specific actor exploits them or when they receive significant attention (e.g., public exploit release, CVE attribution, etc.).
The Atlantic Council recently released a report called “Crash (exploit) and burn: Securing the offensive cyber supply chain to counter China in cyberspace”. While the article frames the discussion largely through a competitive U.S.-China lens and is worth reading, it highlights several compelling points. Most relevant to our current discussion is China’s proficiency in maintaining functional exploits for older vulnerabilities (n-days) over extended periods.
This directly echoes some of the topics we covered in our recent posts. We regularly see active exploitation campaigns focused on older or less-marketed vulnerabilities. Those vulnerabilities sometimes do not get the deserved attention in monitoring or detection, while being very practical and much more common.
On the other hand, let’s not fool ourselves: high-profile vulnerabilities, typically targeting enterprise software, repeatedly get exploited in the wild within less than 24 hours. This month was no exception, with vulnerabilities targeting enterprise CMS SiteCore (CVE-2025-34509, CVE-2025-34510, and CVE-2025-34511) exploited within 12 hours of the report by WatchtTowr.
Vulnerability signatures added to the CrowdSec database in June 2025
- CVE-2023-29298: ColdFusion – Authentication Bypass
- CVE-2020-2096: Jenkins Gitlab Hook Plugin – XSS
- CVE-2024-0692: SolarWinds Security Event Manager – RCE
- CVE-2025-27007: SureTriggers – Privilege Escalation
- CVE-2022-1391: Cab fare calculator – Path Traversal
- CVE-2017-12149: JbossAS – RCE
- CVE-2024-7399: MagicINFO 9 Server – Path Traversal
- CVE-2025-5086: DELMIA Apriso – RCE
- CVE-2020-28188: TerraMaster TOS – RCE
- CVE-2023-39780: RT-AX55 – RCE
- CVE-2025-4009: 3080ipx-10G – RCE
- CVE-2025-20188: Cisco IOS XE Software – Hardcoded Credentials
- CVE-2019-9632: ESAFENET – Arbitrary File Download
- CVE-2024-48914: Vendure – Path Traversal
- CVE-2025-2775: SysAid On-Prem – XXE
- CVE-2021-40856: Auerswald COMfortel – Path Traversal
- CVE-2023-3836: Smart Park Management – RCE
- CVE-2023-22893: Strapi – Authentication Bypass
- CVE-2024-10443: BeePhotos – RCE
- CVE-2025-34509: Sitecore – Authentication Bypass
- CVE-2025-2636: InstaWP Connect – Path Traversal
- CVE-2009-1558: Cisco Linksys – Path Traversal
- CVE-2023-5074: D-View 8 – Authentication Bypass
- CVE-2023-38950: ZKBio Time – Path Traversal
- CVE-2025-34510: Sitecore – Path Traversal
- CVE-2023-34990: FortiWLM – Path Traversal
- CVE-2025-49113: RoundCube Webmail – RCE
- (Generic) PHP Info Detection
- (Generic) HTTP SAP Interface Probing
- (Generic) Protect WordPress uploads directory from listing files
- CVE-2021-22005: VMware vCenter Server – Arbitrary File Upload
- CVE-2025-34511: Sitecore – Arbitrary File Upload
- CVE-2019-19781: Citrix ADC – Path Traversal
- CVE-2018-16670: CIRCONTROL CirCarLife – Information Disclosure
- CVE-2025-0107: Cloud NGFW – RCE
- CVE-2023-35885: CloudPanel – RCE
- CVE-2024-12987: Vigor2960 – RCE
- CVE-2025-2776: SysAid On-Prem – XXE
- CVE-2023-2059: DedeCMS – Path Traversal
- CVE-2025-30406: CentreStack – RCE
- CVE-2022-39952: FortiNAC – RCE
- CVE-2023-22463: KubePi – Authentication Bypass
- CVE-2025-26793: Enterphone MESH – Hardcoded Credentials
- CVE-2024-29855: Recovery Orchestrator – Authentication Bypass
- CVE-2021-24227: Patreon WordPress – Path Traversal
- CVE-2025-4322: Motors Theme – Authentication Bypass