{"vulnerability": "cve-2021-4206", "sightings": [{"uuid": "58d16653-1602-454a-ad2e-2e88528d24d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-42063.yaml", "content": "", "creation_timestamp": "2023-04-27T09:58:59.000000Z"}, {"uuid": "d27725db-325d-4030-b5ae-f32faa0155b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/HackingInsights/12514", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026: https://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-27a7aa435fd3?source=rss------bug_bounty-5", "creation_timestamp": "2024-09-09T03:38:14.000000Z"}, {"uuid": "e69b0997-a159-4944-8ec9-0b7976461519", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4206", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/8398", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2021-4206\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.\n\ud83d\udccf Published: 2022-04-29T16:19:09.000Z\n\ud83d\udccf Modified: 2025-03-21T18:03:39.948Z\n\ud83d\udd17 References:\n1. https://bugzilla.redhat.com/show_bug.cgi?id=2036998\n2. https://starlabs.sg/advisories/21-4206/\n3. https://www.debian.org/security/2022/dsa-5133\n4. https://security.gentoo.org/glsa/202208-27\n5. https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html", "creation_timestamp": "2025-03-21T18:20:00.000000Z"}, {"uuid": "eacfd1fd-f3c8-4075-9674-3cdf43e26af6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/HackingInsights/12209", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026: https://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-80bd4ca0f623?source=rss------bug_bounty-5", "creation_timestamp": "2024-09-08T06:15:31.000000Z"}, {"uuid": "0b563a9a-3813-41f9-a48e-3c3a819fc49f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4206", "type": "seen", "source": "https://t.me/arpsyndicate/736", "content": "#ExploitObserverAlert\n\nCVE-2021-4206\n\nDESCRIPTION: Exploit Observer has 8 entries related to CVE-2021-4206. A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.\n\nFIRST-EPSS: 0.000500000\nNVD-IS: 6.0\nNVD-ES: 1.5", "creation_timestamp": "2023-11-29T12:51:56.000000Z"}, {"uuid": "9507277c-86ff-4f73-ae11-26b46a33ed8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/true_secator/4505", "content": "SAP \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u044e\u043d\u044c\u0441\u043a\u0438\u0439 \u043f\u0430\u0442\u0447 \u0434\u043b\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0439 8 \u043d\u043e\u0432\u044b\u0445 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u0435\u0439 \u0438 5 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u043a \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u043c. \n\nSAP\u00a0\u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u043e\u0448\u0438\u0431\u043a\u0443 \u0445\u0440\u0430\u043d\u0438\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0430\u0439\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f (XSS) \u0432 UI5 Variant Management. \n\n\u041e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u0430\u044f \u043a\u0430\u043a CVE-2023-33991 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS 8,2), \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043a \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044e \u0438 \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438.\n\n\u0412\u0442\u043e\u0440\u0430\u044f \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u2014 \u044d\u0442\u043e \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Plant Connectivity and Production Connector \u0434\u043b\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2023-2827 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS 7,9).\n\n\u041e\u0448\u0438\u0431\u043a\u0443 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044e \u0431\u0435\u0437 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u0435\u0431-\u0442\u043e\u043a\u0435\u043d\u0430 JSON (JWT).\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 Onapsis, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043e\u0431\u0430 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b, \u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 JWT \u0434\u043e\u043b\u0436\u043d\u0430 \u0431\u044b\u0442\u044c \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u0430 \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 Cloud Connector.\n\n\u041d\u0430 \u044d\u0442\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 SAP \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0430 \u0434\u0432\u0435 \u0437\u0430\u043c\u0435\u0442\u043a\u0438 \u0434\u043b\u044f \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0432 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u0437\u043d\u0430\u043d\u0438\u0439 (CVE-2021-42063) \u0438 SAPUI5 (CVE-2023-30743).\n\n\u0418\u0437 \u0432\u043e\u0441\u044c\u043c\u0438 \u043d\u043e\u0432\u044b\u0445 \u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u043d\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0440\u0435\u0434\u043d\u0435\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u0448\u0435\u0441\u0442\u044c \u043a\u0430\u0441\u0430\u044e\u0442\u0441\u044f \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u043e\u0432 XSS \u0432 NetWeaver, CRM ABAP (Grantor Management), CRM (\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0439 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 WebClient) \u0438 BusinessObjects.\n\n\u0414\u0432\u0435 \u0434\u0440\u0443\u0433\u0438\u0435 \u0437\u0430\u043c\u0435\u0442\u043a\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 S/4HANA \u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f SQL \u0432 Master Data Synchronization.\n\n\u041f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u043d\u0438\u0435 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0438\u0437\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 (DoS) \u0432 NetWeaver (Change and Transport System).", "creation_timestamp": "2023-06-15T16:30:05.000000Z"}, {"uuid": "ef4d296b-0adc-4935-b175-dcb0ac773b25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4206", "type": "seen", "source": "https://t.me/cibsecurity/41677", "content": "\u203c CVE-2021-4206 \u203c\n\nA flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-04-29T20:25:10.000000Z"}, {"uuid": "b3c6d9a5-0bf7-44f2-be11-1bc7c0cc8c77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42060", "type": "seen", "source": "https://t.me/cibsecurity/36737", "content": "\u203c CVE-2021-42060 \u203c\n\nSMM callout vulnerability allowing a possible attacker to hijack execution flow of a code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-02-03T07:29:32.000000Z"}, {"uuid": "2226d351-244c-4db9-8b69-53eb46546f60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42067", "type": "seen", "source": "https://t.me/cibsecurity/35614", "content": "\u203c CVE-2021-42067 \u203c\n\nIn SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker authenticated as a regular user can use the S/4 Hana dashboard to reveal systems and services which they would not normally be allowed to see. No information alteration or denial of service is possible.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-01-14T22:23:59.000000Z"}, {"uuid": "83c7623d-e6ca-4f61-be16-614087bf9a4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42069", "type": "seen", "source": "https://t.me/cibsecurity/33948", "content": "\u203c CVE-2021-42069 \u203c\n\nWhen a user opens manipulated Tagged Image File Format (.tif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-14T18:15:41.000000Z"}, {"uuid": "03abe96d-9c3d-41f1-b278-ec116803f33d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42064", "type": "seen", "source": "https://t.me/cibsecurity/33940", "content": "\u203c CVE-2021-42064 \u203c\n\nIf configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized \"in\" clause, SAP Commerce - versions 1905, 2005, 2105, 2011, allows attacker to execute crafted database queries, exposing backend database. The vulnerability is present if the parameterized \"in\" clause accepts more than 1000 values.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-14T18:15:30.000000Z"}, {"uuid": "41ae8d61-fa4b-4eb9-8660-015175b437aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42066", "type": "seen", "source": "https://t.me/cibsecurity/33931", "content": "\u203c CVE-2021-42066 \u203c\n\nSAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should otherwise be encrypted. For an attacker to discover vulnerable function in-depth application knowledge is required, but once exploited the attacker may be able to completely compromise confidentiality, integrity, and availability of the application.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-14T18:15:16.000000Z"}, {"uuid": "de0ab697-a8ee-4f41-a7a7-c54aaec4cd3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42068", "type": "seen", "source": "https://t.me/cibsecurity/33930", "content": "\u203c CVE-2021-42068 \u203c\n\nWhen a user opens a manipulated GIF (.gif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-14T18:15:13.000000Z"}, {"uuid": "6e854c81-464e-4084-9219-2a6c60453713", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42061", "type": "seen", "source": "https://t.me/cibsecurity/33929", "content": "\u203c CVE-2021-42061 \u203c\n\nSAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This allows a low privileged attacker to retrieve some data from the victim but will never be able to modify the document and publish these modifications to the server. It impacts the \"Quick Prompt\" workflow.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-14T18:15:11.000000Z"}, {"uuid": "761f377e-ac18-4b69-b887-04230d50724e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42062", "type": "seen", "source": "https://t.me/cibsecurity/32161", "content": "\u203c CVE-2021-42062 \u203c\n\nSAP ERP HCM Portugal does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area. Since the affected report only reads the payroll information, the attacker can neither modify any information nor cause availability impacts.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-10T18:36:27.000000Z"}, {"uuid": "139874ec-741e-49b2-ace2-17e796f05666", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/thebugbountyhunter/9101", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the Tata Play program Part -2 .\n\nhttps://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-27a7aa435fd3", "creation_timestamp": "2024-09-08T14:25:06.000000Z"}, {"uuid": "2d693bde-55d4-4abc-b2f6-e70d284c6e3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/hacking_Attack/142155", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\nhttps://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-27a7aa435fd3?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-01T20:00:30.871829Z"}, {"uuid": "b109c0ed-97ae-4b8e-9a02-eb5f248688b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/hacking_Attack/142157", "content": "If you\u2019re new to this writeup, I suggest you read part 1 where I shared some valuable info about my recon and other processes.Continue reading on Medium \u00bb (https://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-27a7aa435fd3?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-01T20:00:30.926681Z"}, {"uuid": "837bcf25-2c22-48d5-b9ed-718db048d09f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/hacking_Attack/142248", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\n\nMy recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the Tata Play program Part -1 . During one of my bug bounty hunting sessions, I came across an interesting vulnerability: CVE-2021\u201342063. Let me walk you through how I found this bug and explain the steps I followed. To begin, I always rely on a recon tool that I developed called Ghost Recon. This tool helps me with subdomain enumeration and brute-forcing. Of course, you can do the same process without Ghost Recon. If you\u2019re interested in trying it, you can check it out on GitHub: Ghost Recon. For this recon phase, I started by running two tools: subfinder and subsleuth. These help in finding and enumerating subdomains efficiently. The commands I used are:subfinder -d tataplay.com -all -o subfinder.txt subsleuth -d tataplay.com -w wordlist.txt -o output.txt Next, I combined the results, removed duplicates, and performed the process multiple times to ensure I didn\u2019t miss any subdomains. The results were sorted and refined into a file of third-level domains. Here\u2019s how I cleaned up the results:cat * | sort -u | tee -a dup.txt cat dup.txt | rev | cut -d \".\" -f 1,2,3 | sort -u | rev >> 3rdlevel.txt subfinder -dL 3rdlevel.txt -o final.txt subsleuth -l 3rdlevel.txt -w wordlist.txt -o final1.txt cat * | sort -u | tee -a done.txt With the recon process done, it was time to move on to port scanning. I used my custom script and tools like naabu for this. Once the ports were scanned, I fed the results into httpx to identify live hosts:httpx -l ports-withsubs.txt -o live.txt Now, here\u2019s where the magic happens. I installed the CVE-2021\u201342063 tool from pip, which automates the process of detecting the vulnerability:pip install CVE-2021-42063 pip install yaml #if needed CVE-2021-42063 --chatid  CVE-2021-42063 -i urls.txt -o out.txt This tool does all the work for you. It scans the provided URLs for the vulnerability, and if it finds any, you get a notification on Telegram instantly. In this case, it flagged the vulnerable URL on partner.tataplay.com. This vulnerability, CVE-2021\u201342063, was a reflected XSS (R-XSS) in the SAP Knowledge Warehouse component. Exploiting this allowed an attacker to execute scripts in a user\u2019s browser, potentially stealing sensitive information or hijacking the user\u2019s session.Tool POC: In part 2, I will write about the CVE, the core details of the bug, along with POC images. POC by: @karthithehacker Mail: contact@karthithehacker.com Website: https://www.karthithehacker.com/ If you\u2019re interested in our VAPT service, contact us at ceo@cappriciosec.com or contact@cappriciosec.com.Connect with me: Twitter: https://twitter.com/karthithehacker Instagram: https://www.instagram.com/karthithehacker/ LinkedIn: https://www.linkedin.com/in/karthikeyan--v/ Website: https://www.karthithehacker.com/ Github : https://github.com/karthi-the-hacker/ npmjs: https://www.npmjs.com/~karthithehacker Youtube: https://www.youtube.com/@karthi_the_hackerThank you Karthikeyan.V My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.\nRead more...", "creation_timestamp": "2026-09-01T20:00:31.040227Z"}, {"uuid": "a5718296-a562-428e-9104-72c9d9a6db49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/hacking_Attack/142105", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\nhttps://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-80bd4ca0f623?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-01T20:00:31.188879Z"}, {"uuid": "23e8623e-b667-4510-85b8-75c5014f54e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/hacking_Attack/142107", "content": "During one of my bug bounty hunting sessions, I came across an interesting vulnerability: CVE-2021\u201342063. Let me walk you through how I\u2026Continue reading on Medium \u00bb (https://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-80bd4ca0f623?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-01T20:00:31.231744Z"}, {"uuid": "9cf97219-07e4-43f7-8a27-a60e4569e44c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/hacking_Attack/142107", "content": "During one of my bug bounty hunting sessions, I came across an interesting vulnerability: CVE-2021\u201342063. Let me walk you through how I\u2026Continue reading on Medium \u00bb (https://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-80bd4ca0f623?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-02T01:00:49.231526Z"}, {"uuid": "cdbb29bb-ec28-4287-9544-2f93dc24f489", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/hacking_Attack/142248", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\n\nMy recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the Tata Play program Part -1 . During one of my bug bounty hunting sessions, I came across an interesting vulnerability: CVE-2021\u201342063. Let me walk you through how I found this bug and explain the steps I followed. To begin, I always rely on a recon tool that I developed called Ghost Recon. This tool helps me with subdomain enumeration and brute-forcing. Of course, you can do the same process without Ghost Recon. If you\u2019re interested in trying it, you can check it out on GitHub: Ghost Recon. For this recon phase, I started by running two tools: subfinder and subsleuth. These help in finding and enumerating subdomains efficiently. The commands I used are:subfinder -d tataplay.com -all -o subfinder.txt subsleuth -d tataplay.com -w wordlist.txt -o output.txt Next, I combined the results, removed duplicates, and performed the process multiple times to ensure I didn\u2019t miss any subdomains. The results were sorted and refined into a file of third-level domains. Here\u2019s how I cleaned up the results:cat * | sort -u | tee -a dup.txt cat dup.txt | rev | cut -d \".\" -f 1,2,3 | sort -u | rev >> 3rdlevel.txt subfinder -dL 3rdlevel.txt -o final.txt subsleuth -l 3rdlevel.txt -w wordlist.txt -o final1.txt cat * | sort -u | tee -a done.txt With the recon process done, it was time to move on to port scanning. I used my custom script and tools like naabu for this. Once the ports were scanned, I fed the results into httpx to identify live hosts:httpx -l ports-withsubs.txt -o live.txt Now, here\u2019s where the magic happens. I installed the CVE-2021\u201342063 tool from pip, which automates the process of detecting the vulnerability:pip install CVE-2021-42063 pip install yaml #if needed CVE-2021-42063 --chatid  CVE-2021-42063 -i urls.txt -o out.txt This tool does all the work for you. It scans the provided URLs for the vulnerability, and if it finds any, you get a notification on Telegram instantly. In this case, it flagged the vulnerable URL on partner.tataplay.com. This vulnerability, CVE-2021\u201342063, was a reflected XSS (R-XSS) in the SAP Knowledge Warehouse component. Exploiting this allowed an attacker to execute scripts in a user\u2019s browser, potentially stealing sensitive information or hijacking the user\u2019s session.Tool POC: In part 2, I will write about the CVE, the core details of the bug, along with POC images. POC by: @karthithehacker Mail: contact@karthithehacker.com Website: https://www.karthithehacker.com/ If you\u2019re interested in our VAPT service, contact us at ceo@cappriciosec.com or contact@cappriciosec.com.Connect with me: Twitter: https://twitter.com/karthithehacker Instagram: https://www.instagram.com/karthithehacker/ LinkedIn: https://www.linkedin.com/in/karthikeyan--v/ Website: https://www.karthithehacker.com/ Github : https://github.com/karthi-the-hacker/ npmjs: https://www.npmjs.com/~karthithehacker Youtube: https://www.youtube.com/@karthi_the_hackerThank you Karthikeyan.V My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.\nRead more...", "creation_timestamp": "2026-09-02T01:00:48.977476Z"}, {"uuid": "5740f1d8-0d58-4b63-9a0a-e8d582106d7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/hacking_Attack/142105", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\nhttps://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-80bd4ca0f623?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-02T01:00:49.158862Z"}, {"uuid": "3a5d8ff9-5c44-495b-b66f-4faaa8be395c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/hacking_Attack/142155", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\nhttps://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-27a7aa435fd3?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-02T01:00:48.826063Z"}, {"uuid": "da461cbf-d290-4838-a9ec-69dc0c30d76b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/hacking_Attack/142157", "content": "If you\u2019re new to this writeup, I suggest you read part 1 where I shared some valuable info about my recon and other processes.Continue reading on Medium \u00bb (https://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-27a7aa435fd3?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-02T01:00:48.877578Z"}, {"uuid": "f5f19f42-5f55-46d8-8d52-77eb95acf22a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142107", "content": "During one of my bug bounty hunting sessions, I came across an interesting vulnerability: CVE-2021\u201342063. Let me walk you through how I\u2026Continue reading on Medium \u00bb (https://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-80bd4ca0f623?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-03T17:00:05.123414Z"}, {"uuid": "a184938a-eaf5-4461-a6b4-fc9c585ead20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142105", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\nhttps://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-80bd4ca0f623?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-03T17:00:05.176384Z"}, {"uuid": "11deabf9-5063-4b0b-bc81-75474a0b7762", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142248", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\n\nMy recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the Tata Play program Part -1 . During one of my bug bounty hunting sessions, I came across an interesting vulnerability: CVE-2021\u201342063. Let me walk you through how I found this bug and explain the steps I followed. To begin, I always rely on a recon tool that I developed called Ghost Recon. This tool helps me with subdomain enumeration and brute-forcing. Of course, you can do the same process without Ghost Recon. If you\u2019re interested in trying it, you can check it out on GitHub: Ghost Recon. For this recon phase, I started by running two tools: subfinder and subsleuth. These help in finding and enumerating subdomains efficiently. The commands I used are:subfinder -d tataplay.com -all -o subfinder.txt subsleuth -d tataplay.com -w wordlist.txt -o output.txt Next, I combined the results, removed duplicates, and performed the process multiple times to ensure I didn\u2019t miss any subdomains. The results were sorted and refined into a file of third-level domains. Here\u2019s how I cleaned up the results:cat * | sort -u | tee -a dup.txt cat dup.txt | rev | cut -d \".\" -f 1,2,3 | sort -u | rev >> 3rdlevel.txt subfinder -dL 3rdlevel.txt -o final.txt subsleuth -l 3rdlevel.txt -w wordlist.txt -o final1.txt cat * | sort -u | tee -a done.txt With the recon process done, it was time to move on to port scanning. I used my custom script and tools like naabu for this. Once the ports were scanned, I fed the results into httpx to identify live hosts:httpx -l ports-withsubs.txt -o live.txt Now, here\u2019s where the magic happens. I installed the CVE-2021\u201342063 tool from pip, which automates the process of detecting the vulnerability:pip install CVE-2021-42063 pip install yaml #if needed CVE-2021-42063 --chatid  CVE-2021-42063 -i urls.txt -o out.txt This tool does all the work for you. It scans the provided URLs for the vulnerability, and if it finds any, you get a notification on Telegram instantly. In this case, it flagged the vulnerable URL on partner.tataplay.com. This vulnerability, CVE-2021\u201342063, was a reflected XSS (R-XSS) in the SAP Knowledge Warehouse component. Exploiting this allowed an attacker to execute scripts in a user\u2019s browser, potentially stealing sensitive information or hijacking the user\u2019s session.Tool POC: In part 2, I will write about the CVE, the core details of the bug, along with POC images. POC by: @karthithehacker Mail: contact@karthithehacker.com Website: https://www.karthithehacker.com/ If you\u2019re interested in our VAPT service, contact us at ceo@cappriciosec.com or contact@cappriciosec.com.Connect with me: Twitter: https://twitter.com/karthithehacker Instagram: https://www.instagram.com/karthithehacker/ LinkedIn: https://www.linkedin.com/in/karthikeyan--v/ Website: https://www.karthithehacker.com/ Github : https://github.com/karthi-the-hacker/ npmjs: https://www.npmjs.com/~karthithehacker Youtube: https://www.youtube.com/@karthi_the_hackerThank you Karthikeyan.V My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.\nRead more...", "creation_timestamp": "2026-09-03T17:00:05.334544Z"}, {"uuid": "0e5bbf33-d87a-4558-bb4f-8c1b0a8e05a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142157", "content": "If you\u2019re new to this writeup, I suggest you read part 1 where I shared some valuable info about my recon and other processes.Continue reading on Medium \u00bb (https://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-27a7aa435fd3?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-03T17:00:05.438131Z"}, {"uuid": "c4524059-8dab-4382-a32c-be2998b396a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142155", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\nhttps://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-27a7aa435fd3?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-03T17:00:05.488480Z"}, {"uuid": "f619c4a0-cbfb-42f5-bf00-d1bfdde938b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142248", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\n\nMy recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the Tata Play program Part -1 . During one of my bug bounty hunting sessions, I came across an interesting vulnerability: CVE-2021\u201342063. Let me walk you through how I found this bug and explain the steps I followed. To begin, I always rely on a recon tool that I developed called Ghost Recon. This tool helps me with subdomain enumeration and brute-forcing. Of course, you can do the same process without Ghost Recon. If you\u2019re interested in trying it, you can check it out on GitHub: Ghost Recon. For this recon phase, I started by running two tools: subfinder and subsleuth. These help in finding and enumerating subdomains efficiently. The commands I used are:subfinder -d tataplay.com -all -o subfinder.txt subsleuth -d tataplay.com -w wordlist.txt -o output.txt Next, I combined the results, removed duplicates, and performed the process multiple times to ensure I didn\u2019t miss any subdomains. The results were sorted and refined into a file of third-level domains. Here\u2019s how I cleaned up the results:cat * | sort -u | tee -a dup.txt cat dup.txt | rev | cut -d \".\" -f 1,2,3 | sort -u | rev >> 3rdlevel.txt subfinder -dL 3rdlevel.txt -o final.txt subsleuth -l 3rdlevel.txt -w wordlist.txt -o final1.txt cat * | sort -u | tee -a done.txt With the recon process done, it was time to move on to port scanning. I used my custom script and tools like naabu for this. Once the ports were scanned, I fed the results into httpx to identify live hosts:httpx -l ports-withsubs.txt -o live.txt Now, here\u2019s where the magic happens. I installed the CVE-2021\u201342063 tool from pip, which automates the process of detecting the vulnerability:pip install CVE-2021-42063 pip install yaml #if needed CVE-2021-42063 --chatid  CVE-2021-42063 -i urls.txt -o out.txt This tool does all the work for you. It scans the provided URLs for the vulnerability, and if it finds any, you get a notification on Telegram instantly. In this case, it flagged the vulnerable URL on partner.tataplay.com. This vulnerability, CVE-2021\u201342063, was a reflected XSS (R-XSS) in the SAP Knowledge Warehouse component. Exploiting this allowed an attacker to execute scripts in a user\u2019s browser, potentially stealing sensitive information or hijacking the user\u2019s session.Tool POC: In part 2, I will write about the CVE, the core details of the bug, along with POC images. POC by: @karthithehacker Mail: contact@karthithehacker.com Website: https://www.karthithehacker.com/ If you\u2019re interested in our VAPT service, contact us at ceo@cappriciosec.com or contact@cappriciosec.com.Connect with me: Twitter: https://twitter.com/karthithehacker Instagram: https://www.instagram.com/karthithehacker/ LinkedIn: https://www.linkedin.com/in/karthikeyan--v/ Website: https://www.karthithehacker.com/ Github : https://github.com/karthi-the-hacker/ npmjs: https://www.npmjs.com/~karthithehacker Youtube: https://www.youtube.com/@karthi_the_hackerThank you Karthikeyan.V My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.\nRead more...", "creation_timestamp": "2026-09-04T00:00:41.896424Z"}, {"uuid": "a09d0dd1-bfeb-4a0b-994b-6a35e8b4420f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142107", "content": "During one of my bug bounty hunting sessions, I came across an interesting vulnerability: CVE-2021\u201342063. Let me walk you through how I\u2026Continue reading on Medium \u00bb (https://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-80bd4ca0f623?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-04T00:00:41.689979Z"}, {"uuid": "7a98c6e6-3e01-4ee6-bb98-2d11605a60ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142105", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\nhttps://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-80bd4ca0f623?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-04T00:00:41.745751Z"}, {"uuid": "ddcec112-8a41-4023-8b7d-1d3f1145f4cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142157", "content": "If you\u2019re new to this writeup, I suggest you read part 1 where I shared some valuable info about my recon and other processes.Continue reading on Medium \u00bb (https://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-27a7aa435fd3?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-04T00:00:42.003280Z"}, {"uuid": "f5f93bc6-05d2-4451-8079-22114a65c5fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142155", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\nhttps://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-27a7aa435fd3?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-04T00:00:42.111122Z"}]}