{"vulnerability": "CVE-2021-3869", "sightings": [{"uuid": "f95e9558-5c0c-4930-a355-5a90dfdb2636", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38694", "type": "seen", "source": "https://t.me/cibsecurity/35691", "content": "\u203c CVE-2021-38694 \u203c\n\nSoftVibe SARABAN for INFOMA 1.1 allows SQL Injection.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-01-18T16:24:05.000000Z"}, {"uuid": "bf232582-27b0-43e9-a234-a4e45704ee0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38696", "type": "seen", "source": "https://t.me/cibsecurity/35704", "content": "\u203c CVE-2021-38696 \u203c\n\nSoftVibe SARABAN for INFOMA 1.1 has Incorrect Access Control vulnerability, that allows attackers to access signature files on the application without any authentication.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-01-18T18:24:51.000000Z"}, {"uuid": "cb465f14-bd03-45f8-9bc3-63e76d7efa7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38697", "type": "seen", "source": "https://t.me/cibsecurity/35698", "content": "\u203c CVE-2021-38697 \u203c\n\nSoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unrestricted File Upload, that allows attackers to upload files with any file extension which can lead to arbitrary code execution.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-01-18T18:24:43.000000Z"}, {"uuid": "f8c7813e-134d-44d7-9219-5f3081e240b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38695", "type": "seen", "source": "https://t.me/cibsecurity/35697", "content": "\u203c CVE-2021-38695 \u203c\n\nSoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting (XSS) that allows users to store scripts in certain fields (e.g. subject, description) of the document form.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-01-18T18:24:41.000000Z"}, {"uuid": "7e686be9-9a2d-413d-8b6e-14f3de73892c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3869", "type": "seen", "source": "https://t.me/cibsecurity/30754", "content": "\u203c CVE-2021-3869 \u203c\n\ncorenlp is vulnerable to Improper Restriction of XML External Entity Reference\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-19T16:33:15.000000Z"}, {"uuid": "9eb39daf-6f4f-4d85-a2c0-926bf7357029", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38698", "type": "seen", "source": "https://t.me/cibsecurity/28334", "content": "\u203c CVE-2021-38698 \u203c\n\nHashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-07T16:17:18.000000Z"}, {"uuid": "148fcd83-d371-4531-8df4-4c97e3fc51c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38699", "type": "seen", "source": "https://t.me/hacking_Attack/20423", "content": "Exploit Collector\nTastyIgniter 3.0.7 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-zX4owX_f6gA/WWlvEjBsFTI/AAAAAAAAILA/L-jpFLkKi_AyIykovxrESAdO3HPxIIp7QCLcBGAs/s1600/h132.png \nTastyIgniter version 3.0.7 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 60b4b39b8239a5951ee136da0b3b1117\n\nDownload\n# Exploit Title: XSS-Stored on TastyIgniter 3.0.7 Vulnerable parameter\nCustomer[first_name] on /customers/create\n# Author: nu11secur1ty\n# Testing and Debugging: nu11secur1ty\n# Date: 08.13.2021\n# Vendor: https://tastyigniter.com/\n# Link:https://tastyigniter.com/download\n# CVE: CVE-2021-38699\n\n[+] Exploit Source:\n\n# Vulnerability Assessment\nXSS-Stored Allow 48 characters\n\n# Url\nhttp://192.168.1.3/setup-master/admin/customers/create\n\n# Payload\n# Vulnerable parameter\nCustomer[first_name]\n----------------------------------------------------------------------------------------\n\n# Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38699\n# Proof: https://streamable.com/i6lzfc\n# BR nu11secur1ty\n\n-- \nSystem Administrator - Infrastructure Engineer\nPenetration Testing Engineer\nExploit developer at https://www.exploit-db.com/\nhttps://www.nu11secur1ty.com/\nhiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=\nnu11secur1ty <http:\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:28.311978Z"}, {"uuid": "4e1cc122-2f00-4b65-9918-929f86296faa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38699", "type": "seen", "source": "https://t.me/hacking_Attack/20423", "content": "Exploit Collector\nTastyIgniter 3.0.7 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-zX4owX_f6gA/WWlvEjBsFTI/AAAAAAAAILA/L-jpFLkKi_AyIykovxrESAdO3HPxIIp7QCLcBGAs/s1600/h132.png \nTastyIgniter version 3.0.7 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 60b4b39b8239a5951ee136da0b3b1117\n\nDownload\n# Exploit Title: XSS-Stored on TastyIgniter 3.0.7 Vulnerable parameter\nCustomer[first_name] on /customers/create\n# Author: nu11secur1ty\n# Testing and Debugging: nu11secur1ty\n# Date: 08.13.2021\n# Vendor: https://tastyigniter.com/\n# Link:https://tastyigniter.com/download\n# CVE: CVE-2021-38699\n\n[+] Exploit Source:\n\n# Vulnerability Assessment\nXSS-Stored Allow 48 characters\n\n# Url\nhttp://192.168.1.3/setup-master/admin/customers/create\n\n# Payload\n# Vulnerable parameter\nCustomer[first_name]\n----------------------------------------------------------------------------------------\n\n# Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38699\n# Proof: https://streamable.com/i6lzfc\n# BR nu11secur1ty\n\n-- \nSystem Administrator - Infrastructure Engineer\nPenetration Testing Engineer\nExploit developer at https://www.exploit-db.com/\nhttps://www.nu11secur1ty.com/\nhiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=\nnu11secur1ty <http:\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:03:01.630203Z"}, {"uuid": "2c375a28-e8b9-48aa-8a87-52c6beb0c590", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38699", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/20423", "content": "Exploit Collector\nTastyIgniter 3.0.7 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-zX4owX_f6gA/WWlvEjBsFTI/AAAAAAAAILA/L-jpFLkKi_AyIykovxrESAdO3HPxIIp7QCLcBGAs/s1600/h132.png \nTastyIgniter version 3.0.7 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 60b4b39b8239a5951ee136da0b3b1117\n\nDownload\n# Exploit Title: XSS-Stored on TastyIgniter 3.0.7 Vulnerable parameter\nCustomer[first_name] on /customers/create\n# Author: nu11secur1ty\n# Testing and Debugging: nu11secur1ty\n# Date: 08.13.2021\n# Vendor: https://tastyigniter.com/\n# Link:https://tastyigniter.com/download\n# CVE: CVE-2021-38699\n\n[+] Exploit Source:\n\n# Vulnerability Assessment\nXSS-Stored Allow 48 characters\n\n# Url\nhttp://192.168.1.3/setup-master/admin/customers/create\n\n# Payload\n# Vulnerable parameter\nCustomer[first_name]\n----------------------------------------------------------------------------------------\n\n# Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38699\n# Proof: https://streamable.com/i6lzfc\n# BR nu11secur1ty\n\n-- \nSystem Administrator - Infrastructure Engineer\nPenetration Testing Engineer\nExploit developer at https://www.exploit-db.com/\nhttps://www.nu11secur1ty.com/\nhiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=\nnu11secur1ty <http:\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-07T19:00:03.935062Z"}, {"uuid": "9477f490-be49-415e-93e7-c90bde7822cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38699", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/20423", "content": "Exploit Collector\nTastyIgniter 3.0.7 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-zX4owX_f6gA/WWlvEjBsFTI/AAAAAAAAILA/L-jpFLkKi_AyIykovxrESAdO3HPxIIp7QCLcBGAs/s1600/h132.png \nTastyIgniter version 3.0.7 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 60b4b39b8239a5951ee136da0b3b1117\n\nDownload\n# Exploit Title: XSS-Stored on TastyIgniter 3.0.7 Vulnerable parameter\nCustomer[first_name] on /customers/create\n# Author: nu11secur1ty\n# Testing and Debugging: nu11secur1ty\n# Date: 08.13.2021\n# Vendor: https://tastyigniter.com/\n# Link:https://tastyigniter.com/download\n# CVE: CVE-2021-38699\n\n[+] Exploit Source:\n\n# Vulnerability Assessment\nXSS-Stored Allow 48 characters\n\n# Url\nhttp://192.168.1.3/setup-master/admin/customers/create\n\n# Payload\n# Vulnerable parameter\nCustomer[first_name]\n----------------------------------------------------------------------------------------\n\n# Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38699\n# Proof: https://streamable.com/i6lzfc\n# BR nu11secur1ty\n\n-- \nSystem Administrator - Infrastructure Engineer\nPenetration Testing Engineer\nExploit developer at https://www.exploit-db.com/\nhttps://www.nu11secur1ty.com/\nhiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=\nnu11secur1ty <http:\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-08T00:00:27.503614Z"}]}