{"vulnerability": "CVE-2021-44848", "sightings": [{"uuid": "b5bd895c-df83-4057-b31e-1f336747f059", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-44848", "type": "seen", "source": "https://t.me/cibsecurity/33789", "content": "\u203c CVE-2021-44848 \u203c\n\nIn Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-28T18:24:09.000000Z"}, {"uuid": "c93ea8aa-55db-4d83-8044-c50bce3b4c67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-44848", "type": "seen", "source": "https://t.me/hacking_Attack/35278", "content": "Exploit Collector\nCibele Thinfinity VirtualUI 2.5.41.0 User Enumeration\n\nhttps://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png \nCibele Thinfinity VirtualUI version 2.5.41.0 suffers from a user enumeration vulnerability.\n\nMD5 | 075e1c749825a41f790a7703ee3dc388\n\nDownload\n# Exploit Title: Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration\n# Date: 13/12/2021\n# Exploit Author: Daniel Morales, IT Security Team - ARHS Spikeseed\n# Vendor Homepage: https://www.cybelesoft.com\n# Software Link: https://www.cybelesoft.com/thinfinity/virtualui/\n# Version: vulnerable < v3.0\n# Tested on: Microsoft Windows\n# CVE: CVE-2021-44848\n\nHow it works: By accessing the vector, an attacker can determine if a username exists thanks to the message returned; it can be presented in different languages according to the configuration of VirtualUI. Common users are administrator, admin, guest...\nPayload: The vulnerable vector is \"https://example.com/changePassword?username=USERNAME\" where \"USERNAME\" need to be brute-forced.\nReference: https://github.com/cybelesoft/virtualui/issues/1\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:03.850013Z"}, {"uuid": "eb34c2ea-e938-44e6-a515-4046f452a044", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-44848", "type": "seen", "source": "https://t.me/hacking_Attack/35278", "content": "Exploit Collector\nCibele Thinfinity VirtualUI 2.5.41.0 User Enumeration\n\nhttps://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png \nCibele Thinfinity VirtualUI version 2.5.41.0 suffers from a user enumeration vulnerability.\n\nMD5 | 075e1c749825a41f790a7703ee3dc388\n\nDownload\n# Exploit Title: Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration\n# Date: 13/12/2021\n# Exploit Author: Daniel Morales, IT Security Team - ARHS Spikeseed\n# Vendor Homepage: https://www.cybelesoft.com\n# Software Link: https://www.cybelesoft.com/thinfinity/virtualui/\n# Version: vulnerable < v3.0\n# Tested on: Microsoft Windows\n# CVE: CVE-2021-44848\n\nHow it works: By accessing the vector, an attacker can determine if a username exists thanks to the message returned; it can be presented in different languages according to the configuration of VirtualUI. Common users are administrator, admin, guest...\nPayload: The vulnerable vector is \"https://example.com/changePassword?username=USERNAME\" where \"USERNAME\" need to be brute-forced.\nReference: https://github.com/cybelesoft/virtualui/issues/1\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:30.408828Z"}]}