CVE-2025-9501Vulnerability
Reported by 1 independent source · first reported by The DFIR Report · last reported
Last reported 6 months ago
EPSS22.1%
higher than 97% of CVEsFIRST EPSS, as of 23 Oct 2026
higher than 97% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
1 report, newest first · the exact sentence from each-
Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting“The scanner also includes a dedicated WordPress module targeting CVE-2025-9501, an unauthenticated command injection in the W3 Total Cache plugin (versions prior to 2.8.13, CVSS 9.0).”
Indicators reported together
named in the same reports- cs2.ip.thc[.]orgin 1 report
- denemekulubum.com[.]trin 1 report
- wiprz[.]comin 1 report
- hxxps://s3.filebase[.]comin 1 report
- s3.filebase[.]comin 1 report
Copy these 5 indicators · defanged
Also named with it: CVE-2025-55182
Thanks — we review every report.