{"vulnerability": "CVE-2021-24604", "sightings": [{"uuid": "fcfb08c4-33cf-4e7a-bc09-84364a514238", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24604", "type": "seen", "source": "https://t.me/cibsecurity/29085", "content": "\u203c CVE-2021-24604 \u203c\n\nThe Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-20T14:26:47.000000Z"}, {"uuid": "52a493b6-3372-4eb6-aec6-b244e0b00acb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24604", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4427", "content": "#exploit\nCVE-2021-24604 :\nThe Availability Calendar WordPress plugin <1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed\nhttps://github.com/AlAIAL90/CVE-2021-24604", "creation_timestamp": "2021-10-02T16:33:39.000000Z"}, {"uuid": "f68458a2-75a7-484a-b017-574041cfe4cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24604", "type": "seen", "source": "https://t.me/cissp/4519", "content": "Malware analysis\n1. GriftHorse Android Trojan\nhttps://blog.zimperium.com/grifthorse-android-trojan-steals-millions-from-over-10-million-victims-globally\n2. GhostEmperor: From ProxyLogon to kernel mode\nhttps://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407\n\nThreat Research\nCisco Hyperflex:\nRCE Through Login Form and Other Findings (CVE-2021-1497, CVE-2021-1498, CVE-2021-1499)\nhttps://swarm.ptsecurity.com/cisco-hyperflex-how-we-got-rce-through-login-form-and-other-findings\n\nRed Team Tactics\n1. Determine if the WebClient Service (WebDAV) is running on a remote system\nhttps://github.com/xforcered/GetWebDAVStatus\n2. Invoke-DLLClone - Koppeling x Metatwin x LazySign\nhttps://redteamer.tips/appdata-is-a-mistake-introducing-invoke-dllclone\n]-> https://github.com/jfmaes/Invoke-DLLClone\n\nexploit\nCVE-2021-24604 :\nThe Availability Calendar WordPress plugin <1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed\nhttps://github.com/AlAIAL90/CVE-2021-24604\n\n\n\u200e", "creation_timestamp": "2026-09-01T17:00:39.237755Z"}, {"uuid": "60074ff4-43c4-4944-ba44-b001448c0994", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24604", "type": "seen", "source": "https://t.me/cissp/4519", "content": "Malware analysis\n1. GriftHorse Android Trojan\nhttps://blog.zimperium.com/grifthorse-android-trojan-steals-millions-from-over-10-million-victims-globally\n2. GhostEmperor: From ProxyLogon to kernel mode\nhttps://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407\n\nThreat Research\nCisco Hyperflex:\nRCE Through Login Form and Other Findings (CVE-2021-1497, CVE-2021-1498, CVE-2021-1499)\nhttps://swarm.ptsecurity.com/cisco-hyperflex-how-we-got-rce-through-login-form-and-other-findings\n\nRed Team Tactics\n1. Determine if the WebClient Service (WebDAV) is running on a remote system\nhttps://github.com/xforcered/GetWebDAVStatus\n2. Invoke-DLLClone - Koppeling x Metatwin x LazySign\nhttps://redteamer.tips/appdata-is-a-mistake-introducing-invoke-dllclone\n]-> https://github.com/jfmaes/Invoke-DLLClone\n\nexploit\nCVE-2021-24604 :\nThe Availability Calendar WordPress plugin <1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed\nhttps://github.com/AlAIAL90/CVE-2021-24604\n\n\n\u200e", "creation_timestamp": "2026-09-02T01:04:24.453766Z"}, {"uuid": "80e6916f-03b4-4f1b-b65d-8dc63f579551", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24604", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4519", "content": "Malware analysis\n1. GriftHorse Android Trojan\nhttps://blog.zimperium.com/grifthorse-android-trojan-steals-millions-from-over-10-million-victims-globally\n2. GhostEmperor: From ProxyLogon to kernel mode\nhttps://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407\n\nThreat Research\nCisco Hyperflex:\nRCE Through Login Form and Other Findings (CVE-2021-1497, CVE-2021-1498, CVE-2021-1499)\nhttps://swarm.ptsecurity.com/cisco-hyperflex-how-we-got-rce-through-login-form-and-other-findings\n\nRed Team Tactics\n1. Determine if the WebClient Service (WebDAV) is running on a remote system\nhttps://github.com/xforcered/GetWebDAVStatus\n2. Invoke-DLLClone - Koppeling x Metatwin x LazySign\nhttps://redteamer.tips/appdata-is-a-mistake-introducing-invoke-dllclone\n]-> https://github.com/jfmaes/Invoke-DLLClone\n\nexploit\nCVE-2021-24604 :\nThe Availability Calendar WordPress plugin <1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed\nhttps://github.com/AlAIAL90/CVE-2021-24604\n\n\n\u200e", "creation_timestamp": "2026-09-10T18:00:05.065673Z"}, {"uuid": "0219c42d-0cfb-43b8-a3fe-317313c3c8ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24604", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4519", "content": "Malware analysis\n1. GriftHorse Android Trojan\nhttps://blog.zimperium.com/grifthorse-android-trojan-steals-millions-from-over-10-million-victims-globally\n2. GhostEmperor: From ProxyLogon to kernel mode\nhttps://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407\n\nThreat Research\nCisco Hyperflex:\nRCE Through Login Form and Other Findings (CVE-2021-1497, CVE-2021-1498, CVE-2021-1499)\nhttps://swarm.ptsecurity.com/cisco-hyperflex-how-we-got-rce-through-login-form-and-other-findings\n\nRed Team Tactics\n1. Determine if the WebClient Service (WebDAV) is running on a remote system\nhttps://github.com/xforcered/GetWebDAVStatus\n2. Invoke-DLLClone - Koppeling x Metatwin x LazySign\nhttps://redteamer.tips/appdata-is-a-mistake-introducing-invoke-dllclone\n]-> https://github.com/jfmaes/Invoke-DLLClone\n\nexploit\nCVE-2021-24604 :\nThe Availability Calendar WordPress plugin <1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed\nhttps://github.com/AlAIAL90/CVE-2021-24604\n\n\n\u200e", "creation_timestamp": "2026-09-11T00:00:31.054316Z"}]}