{"vulnerability": "CVE-2021-2124", "sightings": [{"uuid": "16f08cc8-4f2f-490d-a66b-fb7f85c4713a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-21240", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "88366a74-90be-4304-8882-e1a1204f067b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21246", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-21246.yaml", "content": "", "creation_timestamp": "2026-01-23T07:58:58.000000Z"}, {"uuid": "8b3e4fdc-843b-4cb4-a28f-3a3c833ad915", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21246", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3md74govqik2k", "content": "", "creation_timestamp": "2026-01-24T21:03:01.452713Z"}, {"uuid": "dda570d6-0374-4550-ad72-a723916d937e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21240", "type": "seen", "source": "https://t.me/cibsecurity/23244", "content": "\u203c CVE-2021-21240 \u203c\n\nhttplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of \"\\xa0\" characters in the \"www-authenticate\" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-08T22:39:42.000000Z"}, {"uuid": "73322c91-210c-4a0e-ad96-21f904131df8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21245", "type": "seen", "source": "https://t.me/cibsecurity/22227", "content": "\u203c CVE-2021-21245 \u203c\n\nOneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader(\"File-Name\")`). This issue may lead to arbitrary file upload which can be used to upload a WebShell to OneDev server. This issue is addressed in 4.0.3 by only allowing uploaded file to be in attachments folder. The webshell issue is not possible as OneDev never executes files in attachments folder.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-16T00:51:19.000000Z"}, {"uuid": "551ffe4f-74e3-48c6-a981-90ca7a690ba7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2124", "type": "seen", "source": "https://t.me/cibsecurity/22365", "content": "\u203c CVE-2021-2124 \u203c\n\nVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-20T18:33:33.000000Z"}, {"uuid": "9e5071a6-2be6-45a9-932c-4dc47414349a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21247", "type": "seen", "source": "https://t.me/cibsecurity/22228", "content": "\u203c CVE-2021-21247 \u203c\n\nOneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the application's BasePage registers an AJAX event listener (`AbstractPostAjaxBehavior`) in all pages other than the login page. This listener decodes and deserializes the `data` query parameter. We can access this listener by submitting a POST request to any page. This issue may lead to `post-auth RCE` This endpoint is subject to authentication and, therefore, requires a valid user to carry on the attack. This issue was addressed in 4.0.3 by encrypting serialization payload with secrets only known to server.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-16T00:51:20.000000Z"}, {"uuid": "b48d94b1-6f35-4fb8-9f2c-139637fe51f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21243", "type": "seen", "source": "https://t.me/cibsecurity/22220", "content": "\u203c CVE-2021-21243 \u203c\n\nOneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from the request body. These endpoints do not enforce any authentication or authorization checks. This issue may lead to pre-auth RCE. This issue was fixed in 4.0.3 by not using deserialization at KubernetesResource side.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-15T22:51:09.000000Z"}, {"uuid": "38a3da70-70f2-4e82-9508-a71c74e2105d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21244", "type": "seen", "source": "https://t.me/cibsecurity/22219", "content": "\u203c CVE-2021-21244 \u203c\n\nOneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by disabling validation interpolation completely.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-15T22:51:09.000000Z"}, {"uuid": "041d2794-e020-4e61-b312-bca4b0713a6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21246", "type": "seen", "source": "https://t.me/cibsecurity/22235", "content": "\u203c CVE-2021-21246 \u203c\n\nOneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/{id}` endpoint there are no security checks enforced so it is possible to retrieve arbitrary user details including their Access Tokens! These access tokens can be used to access the API or clone code in the build spec via the HTTP(S) protocol. It has permissions to all projects accessible by the user account. This issue may lead to `Sensitive data leak` and leak the Access Token which can be used to impersonate the administrator or any other users. This issue was addressed in 4.0.3 by removing user info from restful api.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-16T00:51:29.000000Z"}, {"uuid": "81d709dd-ef12-4c29-bd57-1c59c5bd0656", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21248", "type": "published-proof-of-concept", "source": "https://t.me/cibsecurity/22234", "content": "\u203c CVE-2021-21248 \u203c\n\nOneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job parameters can run arbitrary code on OneDev's server by injecting arbitrary Groovy code. The ultimate result is in the injection of a static constructor that will run arbitrary code. For a full example refer to the referenced GHSA. This issue was addressed in 4.0.3 by escaping special characters such as quote from user input.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-16T00:51:29.000000Z"}, {"uuid": "241567ee-61aa-47bb-83ff-f46d3ab27885", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21242", "type": "seen", "source": "https://t.me/cibsecurity/22233", "content": "\u203c CVE-2021-21242 \u203c\n\nOneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or authorization checks. This issue may lead to pre-auth remote code execution. This issue was fixed in 4.0.3 by removing AttachmentUploadServlet and not using deserialization\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-16T00:51:28.000000Z"}, {"uuid": "99c8b023-ecd9-4aa2-8836-6fe88aa7fef5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21249", "type": "published-proof-of-concept", "source": "https://t.me/cibsecurity/22232", "content": "\u203c CVE-2021-21249 \u203c\n\nOneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execution. In order to parse and process YAML files, OneDev uses SnakeYaml which by default (when not using `SafeConstructor`) allows the instantiation of arbitrary classes. We can leverage that to run arbitrary code by instantiating classes such as `javax.script.ScriptEngineManager` and using `URLClassLoader` to load the script engine provider, resulting in the instantiation of a user controlled class. For a full example refer to the referenced GHSA. This issue was addressed in 4.0.3 by only allowing certain known classes to be deserialized\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-16T00:51:27.000000Z"}, {"uuid": "f4d495d5-4fbf-4cf7-8664-740f40e177c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21240", "type": "seen", "source": "https://t.me/hacking_Attack/17172", "content": "regexploit-py \"my-project/**/*.py\" --glob  \nJavascript / Typescript\n  This will use the bundled NodeJS package in regexploit/bin/javascript which parses your JavaScript as an AST with eslint (https://github.com/typescript-eslint/typescript-eslint/tree/master/packages/parser) and prints out all regexes.  Those regexes are fed into the python ReDoS finder.  regexploit-js my-module/my-file.js another/file.js some/folder/\nregexploit-js \"my-project/node_modules/**/*.js\" --glob  N.B. there are differences between javascript and python regex parsing so there may be some errors. I'm not sure I want (https://hackernoon.com/the-madness-of-parsing-real-world-javascript-regexps-d9ee336df983) to write a JS regex AST!  \nPython imports\n  Search for regexes in all the python modules currently installed in your path / env. This means you can pip install whatever modules you are interested in and they will be analysed. Cpython code is included.  regexploit-python-env  N.B. this doesn't parse the python code to an AST and will only find regexes compiled automatically on module import. Modules are actually imported, so code in the modules will be executed. This is helpful for finding regexes which are built up from smaller strings on load e.g. CVE-2021-25292 in Pillow (https://github.com/python-pillow/Pillow/commit/3bce145966374dd39ce58a6fc0083f8d1890719c)  \nJSON / YAML\n  Yaml support requires pyyaml, which can be installed with pip install regexploit[yaml].  regexploit-json *.json\nregexploit-yaml *.yaml  \nC# (.NET)\n  regexploit-csharp something.cs  \nBugs reported    CVE-2020-5243: uap-core (https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p) affecting uap-python, uap-ruby (https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw), etc. (User-Agent header parsing)  CVE-2020-8492: cpython's urllib.request (https://github.com/python/cpython/commit/0b297d4ff1c0e4480ad33acae793fbaf4bf015b4) (WWW-Authenticate header parsing)  CVE-2021-21236: CairoSVG (https://github.com/advisories/GHSA-hq37-853p-g5cf) (SVG parsing)  CVE-2021-21240: httplib2 (https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m) (WWW-Authenticate header parsing)  CVE-2021-25292: python-pillow (https://github.com/python-pillow/Pillow/commit/3bce145966374dd39ce58a6fc0083f8d1890719c) (PDF parsing)  CVE-2021-26813: python-markdown2 (https://github.com/trentm/python-markdown2/pull/387) (Markdown parsing)  CVE-2021-27290: npm/ssri (https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf) (SRI parsing)  CVE-2021-27291: pygments (https://github.com/pygments/pygments/commit/2e7e8c4a7b318f4032493773732754e418279a14) lexers for ADL, CADL, Ceylon, Evoque, Factor, Logos, Matlab, Octave, ODIN, Scilab & Varnish VCL (Syntax highlighting)  CVE-2021-27292: ua-parser-js (https://github.com/faisalman/ua-parser-js/commit/809439e20e273ce0d25c1d04e111dcf6011eb566) (User-Agent header parsing)  CVE-2021-27293: RestSharp (https://github.com/restsharp/RestSharp/issues/1556) (JSON deserialisation in a .NET C# package)  bpo-38804: cpython's http.cookiejar (https://github.com/python/cpython/pull/17157) (Set-Cookie header parsing)  SimpleCrawler (archived) (https://doyensec.com/resources/Doyensec_Advisory_simplecrawler_redos.pdf) (HTML parsing)  CVE-2021-28092: is-svg (https://github.com/sindresorhus/is-svg/commit/01f8a087fab8a69c3ac9085fbb16035907ab6a5b) (SVG parsing)  nuget.org, NuGetGallery (https://github.com/NuGet/NuGetGallery/commit/25d2d3b32b2d9f0b1ca6e0a105b0210c2c4820f4) and NuGet.Client (https://github.com/NuGet/NuGet.Client/commit/a0671e946ce71dc59def5cc8a67c6457d66f33bf) (Parsing NuGet package IDs)  markdown (python) (https://github.com/Python-Markdown/markdown/pull/1130) (Markdown parsing)  ansi-html (nodejs) (https://github.com/Tjatse/ansi-html/issues/19) (ANSI parsing)  Plus unpublished bugs in a handful of pypi, npm, ruby and nuget packages    \nCredits\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:32.312045Z"}, {"uuid": "a1fd07dc-79d7-497b-a746-0402beed3988", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21240", "type": "seen", "source": "https://t.me/hacking_Attack/17160", "content": "and browsing a website using an old version of ua-parser may cause the server to take a long time to process your request, probably ending in status 502. InstallationPython 3.8+ is required. To extract regexes from JavaScript / TypeScript code, NodeJS 12+ is also required.\n\nOptionally make a virtual environment python3 -m venv .env\nsource .env/bin/activateNow actually install with pip pip install regexploit UsageRegexploit with a list of regexesEnter regular expressions via stdin (one per line) into regexploit. regexploitor via a file cat myregexes.txt | regexploitExtract regexes automaticallyThere is built-in support for parsing regexes out of Python, JavaScript, TypeScript, C#, YAML and JSON. Python codeParses Python code (without executing it) via the AST to find regexes. The regexes are then analysed for ReDoS. regexploit-py my-project/\nregexploit-py \"my-project/**/*.py\" --globJavascript / TypescriptThis will use the bundled NodeJS package in regexploit/bin/javascriptwhich parses your JavaScript as an AST with eslint and prints out all regexes.\n\nThose regexes are fed into the python ReDoS finder. regexploit-js my-module/my-file.js another/file.js some/folder/\nregexploit-js \"my-project/node_modules/**/*.js\" --globN.B. there are differences between javascript and python regex parsing so there may be some errors. I'm not sure I want to write a JS regex AST! Python importsSearch for regexes in all the python modules currently installed in your path / env. This means you can pip installwhatever modules you are interested in and they will be analysed. Cpython code is included. regexploit-python-envN.B. this doesn't parse the python code to an AST and will only find regexes compiled automatically on module import. Modules are actually imported, so code in the modules will be executed. This is helpful for finding regexes which are built up from smaller strings on load e.g. CVE-2021-25292 in Pillow JSON / YAMLYaml support requires pyyaml, which can be installed with pip install regexploit[yaml]. regexploit-json *.json\nregexploit-yaml *.yamlC# (.NET)regexploit-csharp something.csBugs reported* CVE-2020-5243: uap-core affecting uap-python, uap-ruby, etc. (User-Agent header parsing)\n* CVE-2020-8492: cpython's urllib.request (WWW-Authenticate header parsing)\n* CVE-2021-21236: CairoSVG (SVG parsing)\n* CVE-2021-21240: httplib2 (WWW-Authenticate header parsing)\n* CVE-2021-25292: python-pillow (PDF parsing)\n* CVE-2021-26813: python-markdown2 (Markdown parsing)\n* CVE-2021-27290: npm/ssri (SRI parsing)\n* CVE-2021-27291: pygments lexers for ADL, CADL, Ceylon, Evoque, Factor, Logos, Matlab, Octave, ODIN, Scilab & Varnish VCL (Syntax highlighting)\n* CVE-2021-27292: ua-parser-js (User-Agent header parsing)\n* CVE-2021-27293: RestSharp (JSON deserialisation in a .NET C# package)\n* bpo-38804: cpython's http.cookiejar (Set-Cookie header parsing)\n* SimpleCrawler (archived) (HTML parsing)\n* CVE-2021-28092: is-svg (SVG parsing)\n* nuget.org, NuGetGallery and NuGet.Client (Parsing NuGet package IDs)\n* markdown (python) (Markdown parsing)\n* ansi-html (nodejs) (ANSI parsing)\n* Plus unpublished bugs in a handful of pypi, npm, ruby and nuget packages CreditsThis tool has been created by Ben Caller of Doyensec LLC during research time. https://camo.githubusercontent.com/604dfb1a1bfac98d0048f363e0e6d65bd88b4fdbd57f5b001a8f76ea580c1097/68747470733a2f2f646f79656e7365632e636f6d2f696d616765732f6c6f676f2e737667 Download Regexploit\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:32.851259Z"}, {"uuid": "1fcbbb35-d9f7-4396-8561-1406d784b3a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21240", "type": "seen", "source": "https://t.me/hacking_Attack/17160", "content": "and browsing a website using an old version of ua-parser may cause the server to take a long time to process your request, probably ending in status 502. InstallationPython 3.8+ is required. To extract regexes from JavaScript / TypeScript code, NodeJS 12+ is also required.\n\nOptionally make a virtual environment python3 -m venv .env\nsource .env/bin/activateNow actually install with pip pip install regexploit UsageRegexploit with a list of regexesEnter regular expressions via stdin (one per line) into regexploit. regexploitor via a file cat myregexes.txt | regexploitExtract regexes automaticallyThere is built-in support for parsing regexes out of Python, JavaScript, TypeScript, C#, YAML and JSON. Python codeParses Python code (without executing it) via the AST to find regexes. The regexes are then analysed for ReDoS. regexploit-py my-project/\nregexploit-py \"my-project/**/*.py\" --globJavascript / TypescriptThis will use the bundled NodeJS package in regexploit/bin/javascriptwhich parses your JavaScript as an AST with eslint and prints out all regexes.\n\nThose regexes are fed into the python ReDoS finder. regexploit-js my-module/my-file.js another/file.js some/folder/\nregexploit-js \"my-project/node_modules/**/*.js\" --globN.B. there are differences between javascript and python regex parsing so there may be some errors. I'm not sure I want to write a JS regex AST! Python importsSearch for regexes in all the python modules currently installed in your path / env. This means you can pip installwhatever modules you are interested in and they will be analysed. Cpython code is included. regexploit-python-envN.B. this doesn't parse the python code to an AST and will only find regexes compiled automatically on module import. Modules are actually imported, so code in the modules will be executed. This is helpful for finding regexes which are built up from smaller strings on load e.g. CVE-2021-25292 in Pillow JSON / YAMLYaml support requires pyyaml, which can be installed with pip install regexploit[yaml]. regexploit-json *.json\nregexploit-yaml *.yamlC# (.NET)regexploit-csharp something.csBugs reported* CVE-2020-5243: uap-core affecting uap-python, uap-ruby, etc. (User-Agent header parsing)\n* CVE-2020-8492: cpython's urllib.request (WWW-Authenticate header parsing)\n* CVE-2021-21236: CairoSVG (SVG parsing)\n* CVE-2021-21240: httplib2 (WWW-Authenticate header parsing)\n* CVE-2021-25292: python-pillow (PDF parsing)\n* CVE-2021-26813: python-markdown2 (Markdown parsing)\n* CVE-2021-27290: npm/ssri (SRI parsing)\n* CVE-2021-27291: pygments lexers for ADL, CADL, Ceylon, Evoque, Factor, Logos, Matlab, Octave, ODIN, Scilab & Varnish VCL (Syntax highlighting)\n* CVE-2021-27292: ua-parser-js (User-Agent header parsing)\n* CVE-2021-27293: RestSharp (JSON deserialisation in a .NET C# package)\n* bpo-38804: cpython's http.cookiejar (Set-Cookie header parsing)\n* SimpleCrawler (archived) (HTML parsing)\n* CVE-2021-28092: is-svg (SVG parsing)\n* nuget.org, NuGetGallery and NuGet.Client (Parsing NuGet package IDs)\n* markdown (python) (Markdown parsing)\n* ansi-html (nodejs) (ANSI parsing)\n* Plus unpublished bugs in a handful of pypi, npm, ruby and nuget packages CreditsThis tool has been created by Ben Caller of Doyensec LLC during research time. https://camo.githubusercontent.com/604dfb1a1bfac98d0048f363e0e6d65bd88b4fdbd57f5b001a8f76ea580c1097/68747470733a2f2f646f79656e7365632e636f6d2f696d616765732f6c6f676f2e737667 Download Regexploit\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:06.926883Z"}, {"uuid": "60760d18-efbb-452f-9a48-a284e0053e3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21240", "type": "seen", "source": "https://t.me/hacking_Attack/17172", "content": "regexploit-py \"my-project/**/*.py\" --glob  \nJavascript / Typescript\n  This will use the bundled NodeJS package in regexploit/bin/javascript which parses your JavaScript as an AST with eslint (https://github.com/typescript-eslint/typescript-eslint/tree/master/packages/parser) and prints out all regexes.  Those regexes are fed into the python ReDoS finder.  regexploit-js my-module/my-file.js another/file.js some/folder/\nregexploit-js \"my-project/node_modules/**/*.js\" --glob  N.B. there are differences between javascript and python regex parsing so there may be some errors. I'm not sure I want (https://hackernoon.com/the-madness-of-parsing-real-world-javascript-regexps-d9ee336df983) to write a JS regex AST!  \nPython imports\n  Search for regexes in all the python modules currently installed in your path / env. This means you can pip install whatever modules you are interested in and they will be analysed. Cpython code is included.  regexploit-python-env  N.B. this doesn't parse the python code to an AST and will only find regexes compiled automatically on module import. Modules are actually imported, so code in the modules will be executed. This is helpful for finding regexes which are built up from smaller strings on load e.g. CVE-2021-25292 in Pillow (https://github.com/python-pillow/Pillow/commit/3bce145966374dd39ce58a6fc0083f8d1890719c)  \nJSON / YAML\n  Yaml support requires pyyaml, which can be installed with pip install regexploit[yaml].  regexploit-json *.json\nregexploit-yaml *.yaml  \nC# (.NET)\n  regexploit-csharp something.cs  \nBugs reported    CVE-2020-5243: uap-core (https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p) affecting uap-python, uap-ruby (https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw), etc. (User-Agent header parsing)  CVE-2020-8492: cpython's urllib.request (https://github.com/python/cpython/commit/0b297d4ff1c0e4480ad33acae793fbaf4bf015b4) (WWW-Authenticate header parsing)  CVE-2021-21236: CairoSVG (https://github.com/advisories/GHSA-hq37-853p-g5cf) (SVG parsing)  CVE-2021-21240: httplib2 (https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m) (WWW-Authenticate header parsing)  CVE-2021-25292: python-pillow (https://github.com/python-pillow/Pillow/commit/3bce145966374dd39ce58a6fc0083f8d1890719c) (PDF parsing)  CVE-2021-26813: python-markdown2 (https://github.com/trentm/python-markdown2/pull/387) (Markdown parsing)  CVE-2021-27290: npm/ssri (https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf) (SRI parsing)  CVE-2021-27291: pygments (https://github.com/pygments/pygments/commit/2e7e8c4a7b318f4032493773732754e418279a14) lexers for ADL, CADL, Ceylon, Evoque, Factor, Logos, Matlab, Octave, ODIN, Scilab & Varnish VCL (Syntax highlighting)  CVE-2021-27292: ua-parser-js (https://github.com/faisalman/ua-parser-js/commit/809439e20e273ce0d25c1d04e111dcf6011eb566) (User-Agent header parsing)  CVE-2021-27293: RestSharp (https://github.com/restsharp/RestSharp/issues/1556) (JSON deserialisation in a .NET C# package)  bpo-38804: cpython's http.cookiejar (https://github.com/python/cpython/pull/17157) (Set-Cookie header parsing)  SimpleCrawler (archived) (https://doyensec.com/resources/Doyensec_Advisory_simplecrawler_redos.pdf) (HTML parsing)  CVE-2021-28092: is-svg (https://github.com/sindresorhus/is-svg/commit/01f8a087fab8a69c3ac9085fbb16035907ab6a5b) (SVG parsing)  nuget.org, NuGetGallery (https://github.com/NuGet/NuGetGallery/commit/25d2d3b32b2d9f0b1ca6e0a105b0210c2c4820f4) and NuGet.Client (https://github.com/NuGet/NuGet.Client/commit/a0671e946ce71dc59def5cc8a67c6457d66f33bf) (Parsing NuGet package IDs)  markdown (python) (https://github.com/Python-Markdown/markdown/pull/1130) (Markdown parsing)  ansi-html (nodejs) (https://github.com/Tjatse/ansi-html/issues/19) (ANSI parsing)  Plus unpublished bugs in a handful of pypi, npm, ruby and nuget packages    \nCredits\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:06.373603Z"}, {"uuid": "ce66ae39-0251-4d49-b78e-38c02f2f1cd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21240", "type": "seen", "source": "https://t.me/hacking_Attack/17172", "content": "regexploit-py \"my-project/**/*.py\" --glob  \nJavascript / Typescript\n  This will use the bundled NodeJS package in regexploit/bin/javascript which parses your JavaScript as an AST with eslint (https://github.com/typescript-eslint/typescript-eslint/tree/master/packages/parser) and prints out all regexes.  Those regexes are fed into the python ReDoS finder.  regexploit-js my-module/my-file.js another/file.js some/folder/\nregexploit-js \"my-project/node_modules/**/*.js\" --glob  N.B. there are differences between javascript and python regex parsing so there may be some errors. I'm not sure I want (https://hackernoon.com/the-madness-of-parsing-real-world-javascript-regexps-d9ee336df983) to write a JS regex AST!  \nPython imports\n  Search for regexes in all the python modules currently installed in your path / env. This means you can pip install whatever modules you are interested in and they will be analysed. Cpython code is included.  regexploit-python-env  N.B. this doesn't parse the python code to an AST and will only find regexes compiled automatically on module import. Modules are actually imported, so code in the modules will be executed. This is helpful for finding regexes which are built up from smaller strings on load e.g. CVE-2021-25292 in Pillow (https://github.com/python-pillow/Pillow/commit/3bce145966374dd39ce58a6fc0083f8d1890719c)  \nJSON / YAML\n  Yaml support requires pyyaml, which can be installed with pip install regexploit[yaml].  regexploit-json *.json\nregexploit-yaml *.yaml  \nC# (.NET)\n  regexploit-csharp something.cs  \nBugs reported    CVE-2020-5243: uap-core (https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p) affecting uap-python, uap-ruby (https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw), etc. (User-Agent header parsing)  CVE-2020-8492: cpython's urllib.request (https://github.com/python/cpython/commit/0b297d4ff1c0e4480ad33acae793fbaf4bf015b4) (WWW-Authenticate header parsing)  CVE-2021-21236: CairoSVG (https://github.com/advisories/GHSA-hq37-853p-g5cf) (SVG parsing)  CVE-2021-21240: httplib2 (https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m) (WWW-Authenticate header parsing)  CVE-2021-25292: python-pillow (https://github.com/python-pillow/Pillow/commit/3bce145966374dd39ce58a6fc0083f8d1890719c) (PDF parsing)  CVE-2021-26813: python-markdown2 (https://github.com/trentm/python-markdown2/pull/387) (Markdown parsing)  CVE-2021-27290: npm/ssri (https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf) (SRI parsing)  CVE-2021-27291: pygments (https://github.com/pygments/pygments/commit/2e7e8c4a7b318f4032493773732754e418279a14) lexers for ADL, CADL, Ceylon, Evoque, Factor, Logos, Matlab, Octave, ODIN, Scilab & Varnish VCL (Syntax highlighting)  CVE-2021-27292: ua-parser-js (https://github.com/faisalman/ua-parser-js/commit/809439e20e273ce0d25c1d04e111dcf6011eb566) (User-Agent header parsing)  CVE-2021-27293: RestSharp (https://github.com/restsharp/RestSharp/issues/1556) (JSON deserialisation in a .NET C# package)  bpo-38804: cpython's http.cookiejar (https://github.com/python/cpython/pull/17157) (Set-Cookie header parsing)  SimpleCrawler (archived) (https://doyensec.com/resources/Doyensec_Advisory_simplecrawler_redos.pdf) (HTML parsing)  CVE-2021-28092: is-svg (https://github.com/sindresorhus/is-svg/commit/01f8a087fab8a69c3ac9085fbb16035907ab6a5b) (SVG parsing)  nuget.org, NuGetGallery (https://github.com/NuGet/NuGetGallery/commit/25d2d3b32b2d9f0b1ca6e0a105b0210c2c4820f4) and NuGet.Client (https://github.com/NuGet/NuGet.Client/commit/a0671e946ce71dc59def5cc8a67c6457d66f33bf) (Parsing NuGet package IDs)  markdown (python) (https://github.com/Python-Markdown/markdown/pull/1130) (Markdown parsing)  ansi-html (nodejs) (https://github.com/Tjatse/ansi-html/issues/19) (ANSI parsing)  Plus unpublished bugs in a handful of pypi, npm, ruby and nuget packages    \nCredits\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T22:00:05.416946Z"}, {"uuid": "0f0509dd-5d7d-4f07-addd-12a9d705215c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21240", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/17160", "content": "and browsing a website using an old version of ua-parser may cause the server to take a long time to process your request, probably ending in status 502. InstallationPython 3.8+ is required. To extract regexes from JavaScript / TypeScript code, NodeJS 12+ is also required.\n\nOptionally make a virtual environment python3 -m venv .env\nsource .env/bin/activateNow actually install with pip pip install regexploit UsageRegexploit with a list of regexesEnter regular expressions via stdin (one per line) into regexploit. regexploitor via a file cat myregexes.txt | regexploitExtract regexes automaticallyThere is built-in support for parsing regexes out of Python, JavaScript, TypeScript, C#, YAML and JSON. Python codeParses Python code (without executing it) via the AST to find regexes. The regexes are then analysed for ReDoS. regexploit-py my-project/\nregexploit-py \"my-project/**/*.py\" --globJavascript / TypescriptThis will use the bundled NodeJS package in regexploit/bin/javascriptwhich parses your JavaScript as an AST with eslint and prints out all regexes.\n\nThose regexes are fed into the python ReDoS finder. regexploit-js my-module/my-file.js another/file.js some/folder/\nregexploit-js \"my-project/node_modules/**/*.js\" --globN.B. there are differences between javascript and python regex parsing so there may be some errors. I'm not sure I want to write a JS regex AST! Python importsSearch for regexes in all the python modules currently installed in your path / env. This means you can pip installwhatever modules you are interested in and they will be analysed. Cpython code is included. regexploit-python-envN.B. this doesn't parse the python code to an AST and will only find regexes compiled automatically on module import. Modules are actually imported, so code in the modules will be executed. This is helpful for finding regexes which are built up from smaller strings on load e.g. CVE-2021-25292 in Pillow JSON / YAMLYaml support requires pyyaml, which can be installed with pip install regexploit[yaml]. regexploit-json *.json\nregexploit-yaml *.yamlC# (.NET)regexploit-csharp something.csBugs reported* CVE-2020-5243: uap-core affecting uap-python, uap-ruby, etc. (User-Agent header parsing)\n* CVE-2020-8492: cpython's urllib.request (WWW-Authenticate header parsing)\n* CVE-2021-21236: CairoSVG (SVG parsing)\n* CVE-2021-21240: httplib2 (WWW-Authenticate header parsing)\n* CVE-2021-25292: python-pillow (PDF parsing)\n* CVE-2021-26813: python-markdown2 (Markdown parsing)\n* CVE-2021-27290: npm/ssri (SRI parsing)\n* CVE-2021-27291: pygments lexers for ADL, CADL, Ceylon, Evoque, Factor, Logos, Matlab, Octave, ODIN, Scilab & Varnish VCL (Syntax highlighting)\n* CVE-2021-27292: ua-parser-js (User-Agent header parsing)\n* CVE-2021-27293: RestSharp (JSON deserialisation in a .NET C# package)\n* bpo-38804: cpython's http.cookiejar (Set-Cookie header parsing)\n* SimpleCrawler (archived) (HTML parsing)\n* CVE-2021-28092: is-svg (SVG parsing)\n* nuget.org, NuGetGallery and NuGet.Client (Parsing NuGet package IDs)\n* markdown (python) (Markdown parsing)\n* ansi-html (nodejs) (ANSI parsing)\n* Plus unpublished bugs in a handful of pypi, npm, ruby and nuget packages CreditsThis tool has been created by Ben Caller of Doyensec LLC during research time. https://camo.githubusercontent.com/604dfb1a1bfac98d0048f363e0e6d65bd88b4fdbd57f5b001a8f76ea580c1097/68747470733a2f2f646f79656e7365632e636f6d2f696d616765732f6c6f676f2e737667 Download Regexploit\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T23:00:04.761122Z"}, {"uuid": "69f0c41b-4d25-4218-91fe-d637c8b8d745", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21240", "type": "seen", "source": "https://t.me/hacking_Attack/17172", "content": "regexploit-py \"my-project/**/*.py\" --glob  \nJavascript / Typescript\n  This will use the bundled NodeJS package in regexploit/bin/javascript which parses your JavaScript as an AST with eslint (https://github.com/typescript-eslint/typescript-eslint/tree/master/packages/parser) and prints out all regexes.  Those regexes are fed into the python ReDoS finder.  regexploit-js my-module/my-file.js another/file.js some/folder/\nregexploit-js \"my-project/node_modules/**/*.js\" --glob  N.B. there are differences between javascript and python regex parsing so there may be some errors. I'm not sure I want (https://hackernoon.com/the-madness-of-parsing-real-world-javascript-regexps-d9ee336df983) to write a JS regex AST!  \nPython imports\n  Search for regexes in all the python modules currently installed in your path / env. This means you can pip install whatever modules you are interested in and they will be analysed. Cpython code is included.  regexploit-python-env  N.B. this doesn't parse the python code to an AST and will only find regexes compiled automatically on module import. Modules are actually imported, so code in the modules will be executed. This is helpful for finding regexes which are built up from smaller strings on load e.g. CVE-2021-25292 in Pillow (https://github.com/python-pillow/Pillow/commit/3bce145966374dd39ce58a6fc0083f8d1890719c)  \nJSON / YAML\n  Yaml support requires pyyaml, which can be installed with pip install regexploit[yaml].  regexploit-json *.json\nregexploit-yaml *.yaml  \nC# (.NET)\n  regexploit-csharp something.cs  \nBugs reported    CVE-2020-5243: uap-core (https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p) affecting uap-python, uap-ruby (https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw), etc. (User-Agent header parsing)  CVE-2020-8492: cpython's urllib.request (https://github.com/python/cpython/commit/0b297d4ff1c0e4480ad33acae793fbaf4bf015b4) (WWW-Authenticate header parsing)  CVE-2021-21236: CairoSVG (https://github.com/advisories/GHSA-hq37-853p-g5cf) (SVG parsing)  CVE-2021-21240: httplib2 (https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m) (WWW-Authenticate header parsing)  CVE-2021-25292: python-pillow (https://github.com/python-pillow/Pillow/commit/3bce145966374dd39ce58a6fc0083f8d1890719c) (PDF parsing)  CVE-2021-26813: python-markdown2 (https://github.com/trentm/python-markdown2/pull/387) (Markdown parsing)  CVE-2021-27290: npm/ssri (https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf) (SRI parsing)  CVE-2021-27291: pygments (https://github.com/pygments/pygments/commit/2e7e8c4a7b318f4032493773732754e418279a14) lexers for ADL, CADL, Ceylon, Evoque, Factor, Logos, Matlab, Octave, ODIN, Scilab & Varnish VCL (Syntax highlighting)  CVE-2021-27292: ua-parser-js (https://github.com/faisalman/ua-parser-js/commit/809439e20e273ce0d25c1d04e111dcf6011eb566) (User-Agent header parsing)  CVE-2021-27293: RestSharp (https://github.com/restsharp/RestSharp/issues/1556) (JSON deserialisation in a .NET C# package)  bpo-38804: cpython's http.cookiejar (https://github.com/python/cpython/pull/17157) (Set-Cookie header parsing)  SimpleCrawler (archived) (https://doyensec.com/resources/Doyensec_Advisory_simplecrawler_redos.pdf) (HTML parsing)  CVE-2021-28092: is-svg (https://github.com/sindresorhus/is-svg/commit/01f8a087fab8a69c3ac9085fbb16035907ab6a5b) (SVG parsing)  nuget.org, NuGetGallery (https://github.com/NuGet/NuGetGallery/commit/25d2d3b32b2d9f0b1ca6e0a105b0210c2c4820f4) and NuGet.Client (https://github.com/NuGet/NuGet.Client/commit/a0671e946ce71dc59def5cc8a67c6457d66f33bf) (Parsing NuGet package IDs)  markdown (python) (https://github.com/Python-Markdown/markdown/pull/1130) (Markdown parsing)  ansi-html (nodejs) (https://github.com/Tjatse/ansi-html/issues/19) (ANSI parsing)  Plus unpublished bugs in a handful of pypi, npm, ruby and nuget packages    \nCredits\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:10.316053Z"}, {"uuid": "a66392fb-c3cf-441e-8e6e-6a45ecac17fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21240", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/17160", "content": "and browsing a website using an old version of ua-parser may cause the server to take a long time to process your request, probably ending in status 502. InstallationPython 3.8+ is required. To extract regexes from JavaScript / TypeScript code, NodeJS 12+ is also required.\n\nOptionally make a virtual environment python3 -m venv .env\nsource .env/bin/activateNow actually install with pip pip install regexploit UsageRegexploit with a list of regexesEnter regular expressions via stdin (one per line) into regexploit. regexploitor via a file cat myregexes.txt | regexploitExtract regexes automaticallyThere is built-in support for parsing regexes out of Python, JavaScript, TypeScript, C#, YAML and JSON. Python codeParses Python code (without executing it) via the AST to find regexes. The regexes are then analysed for ReDoS. regexploit-py my-project/\nregexploit-py \"my-project/**/*.py\" --globJavascript / TypescriptThis will use the bundled NodeJS package in regexploit/bin/javascriptwhich parses your JavaScript as an AST with eslint and prints out all regexes.\n\nThose regexes are fed into the python ReDoS finder. regexploit-js my-module/my-file.js another/file.js some/folder/\nregexploit-js \"my-project/node_modules/**/*.js\" --globN.B. there are differences between javascript and python regex parsing so there may be some errors. I'm not sure I want to write a JS regex AST! Python importsSearch for regexes in all the python modules currently installed in your path / env. This means you can pip installwhatever modules you are interested in and they will be analysed. Cpython code is included. regexploit-python-envN.B. this doesn't parse the python code to an AST and will only find regexes compiled automatically on module import. Modules are actually imported, so code in the modules will be executed. This is helpful for finding regexes which are built up from smaller strings on load e.g. CVE-2021-25292 in Pillow JSON / YAMLYaml support requires pyyaml, which can be installed with pip install regexploit[yaml]. regexploit-json *.json\nregexploit-yaml *.yamlC# (.NET)regexploit-csharp something.csBugs reported* CVE-2020-5243: uap-core affecting uap-python, uap-ruby, etc. (User-Agent header parsing)\n* CVE-2020-8492: cpython's urllib.request (WWW-Authenticate header parsing)\n* CVE-2021-21236: CairoSVG (SVG parsing)\n* CVE-2021-21240: httplib2 (WWW-Authenticate header parsing)\n* CVE-2021-25292: python-pillow (PDF parsing)\n* CVE-2021-26813: python-markdown2 (Markdown parsing)\n* CVE-2021-27290: npm/ssri (SRI parsing)\n* CVE-2021-27291: pygments lexers for ADL, CADL, Ceylon, Evoque, Factor, Logos, Matlab, Octave, ODIN, Scilab & Varnish VCL (Syntax highlighting)\n* CVE-2021-27292: ua-parser-js (User-Agent header parsing)\n* CVE-2021-27293: RestSharp (JSON deserialisation in a .NET C# package)\n* bpo-38804: cpython's http.cookiejar (Set-Cookie header parsing)\n* SimpleCrawler (archived) (HTML parsing)\n* CVE-2021-28092: is-svg (SVG parsing)\n* nuget.org, NuGetGallery and NuGet.Client (Parsing NuGet package IDs)\n* markdown (python) (Markdown parsing)\n* ansi-html (nodejs) (ANSI parsing)\n* Plus unpublished bugs in a handful of pypi, npm, ruby and nuget packages CreditsThis tool has been created by Ben Caller of Doyensec LLC during research time. https://camo.githubusercontent.com/604dfb1a1bfac98d0048f363e0e6d65bd88b4fdbd57f5b001a8f76ea580c1097/68747470733a2f2f646f79656e7365632e636f6d2f696d616765732f6c6f676f2e737667 Download Regexploit\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:08.900009Z"}]}