{"vulnerability": "cve-2021-4374", "sightings": [{"uuid": "4c13621d-1fbc-4f2b-9a20-597cf982b0eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4374", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:59.000000Z"}, {"uuid": "29687541-c2a3-4f1e-8569-c079f0a867a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4374", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/wp_automatic_plugin_privesc.rb", "content": "", "creation_timestamp": "2021-11-05T12:13:45.000000Z"}, {"uuid": "c1f77bca-214e-41f7-8ca5-6072163a58a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4374", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-19)", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "d1c90e04-d5a9-4c3a-9675-284f7ec68339", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4374", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-04-06)", "content": "", "creation_timestamp": "2026-04-06T00:00:00.000000Z"}, {"uuid": "38c2d05c-cbf3-4a19-b6d5-4a61c55176cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4374", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-04-19)", "content": "", "creation_timestamp": "2026-04-19T00:00:00.000000Z"}, {"uuid": "7a16161a-9145-4bc0-8470-b5239f321421", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4374", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-04-25)", "content": "", "creation_timestamp": "2026-04-25T00:00:00.000000Z"}, {"uuid": "decd1ea0-482e-478d-b62a-e4203e2b1f8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4374", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-07-31)", "content": "", "creation_timestamp": "2026-08-01T10:00:06.893362Z"}, {"uuid": "82a7ef75-758b-4fd1-8908-d3af5f840745", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43741", "type": "seen", "source": "https://t.me/cibsecurity/40726", "content": "\u203c CVE-2021-43741 \u203c\n\nCMSimple 5.4 is vulnerable to Directory Traversal. The vulnerability exists when a user changes the file name to malicious file on config.php leading to remote code execution.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-04-13T18:17:58.000000Z"}, {"uuid": "f6e8b336-509c-4b4d-ae67-2fa96eb6ffe0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43742", "type": "seen", "source": "https://t.me/cibsecurity/40717", "content": "\u203c CVE-2021-43742 \u203c\n\nCMSimple 5.4 is vulnerable to Cross Site Scripting (XSS) via the file upload feature.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-04-13T16:23:36.000000Z"}, {"uuid": "c896b2a9-be04-4ff2-9d3c-c2c9f530301f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43745", "type": "seen", "source": "https://t.me/cibsecurity/38068", "content": "\u203c CVE-2021-43745 \u203c\n\nA Denial of Service vulnerabilty exists in Trilium Notes 0.48.6 in the setupPage function\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-02-25T00:20:22.000000Z"}, {"uuid": "d94f786b-89ce-4c6c-8bf6-29ddcb4ae785", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43746", "type": "seen", "source": "https://t.me/cibsecurity/34304", "content": "\u203c CVE-2021-43746 \u203c\n\nAdobe Premiere Rush versions 1.5.16 (and earlier) allows access to an uninitialized pointer vulnerability that allows remote attackers to disclose sensitive information on affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of MP4 files. The issue results from the lack of proper initialization of memory prior to accessing it.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-21T00:11:29.000000Z"}, {"uuid": "e3bd5cd1-1346-4711-871e-4e7459a0265e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43748", "type": "seen", "source": "https://t.me/cibsecurity/34311", "content": "\u203c CVE-2021-43748 \u203c\n\nAdobe Premiere Rush versions 1.5.16 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-21T00:11:39.000000Z"}, {"uuid": "a099d6dd-614c-4336-a789-4ded7d5f7f1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4374", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-11)", "content": "", "creation_timestamp": "2026-08-12T10:00:07.586400Z"}, {"uuid": "e96513ae-000a-4235-b1fd-a8ed4df97d5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4374", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-05-30)", "content": "", "creation_timestamp": "2026-05-30T00:00:00.000000Z"}, {"uuid": "54ab09d0-89f1-4432-82cd-f9dda8f2111b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4374", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-06-03)", "content": "", "creation_timestamp": "2026-06-03T00:00:00.000000Z"}, {"uuid": "209a9956-9642-49b6-9972-741c018ab0ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4374", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-06-05)", "content": "", "creation_timestamp": "2026-06-05T00:00:00.000000Z"}, {"uuid": "0b5bf10f-166d-45fb-87ef-570f1e3809e4", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4374", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/2f01ad63-fb30-4a22-bf3a-ebaa44d1e886", "content": "", "creation_timestamp": "2026-06-19T12:45:34.263188Z"}, {"uuid": "29abdd95-86c0-4c46-9fbe-723718bd5a23", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4374", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d74948dc-ad37-4921-ac5e-5836c634010b", "content": "", "creation_timestamp": "2026-06-23T14:03:04.405297Z"}, {"uuid": "8f424e7a-0840-46fc-afa1-522bcb37556a", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-4374", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e928a464-1133-4acf-a03c-24d692ff496a", "content": "", "creation_timestamp": "2026-06-30T09:23:40.291824Z"}, {"uuid": "0b5aad45-7178-4c37-b259-96e2b853211d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4374", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-21)", "content": "", "creation_timestamp": "2026-08-22T10:00:14.703423Z"}, {"uuid": "32c5aa85-46af-4401-93f7-2af16168ea2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4374", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-07-27)", "content": "", "creation_timestamp": "2026-07-28T10:00:05.142233Z"}, {"uuid": "9e8cbfbe-4027-4c94-b0a6-7f6f70dd30a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4374", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/wp_automatic_plugin_privesc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"php\", \"author\": [\"h00die\", \"Jerome Bruandet\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated arbitrary wordpress options change vulnerability\\n          in the Automatic (wp-automatic) plugin <= 3.53.2. If WPEMAIL is provided, the administrator's email\\n          address will be changed. User registration is\\n          enabled, and default user role is set to administrator. A user is then created with\\n          the USER name set. A valid EMAIL is required to get the registration email (not handled in MSF).\", \"disclosure_date\": \"2021-09-06\", \"fullname\": \"auxiliary/admin/http/wp_automatic_plugin_privesc\", \"is_install_path\": true, \"mod_time\": \"2026-04-15 11:57:01 +0000\", \"name\": \"WordPress Plugin Automatic Config Change to RCE\", \"needs_cleanup\": false, \"notes\": {\"NOCVE\": [\"Patched in 3.53.3 without vendor disclosure\"], \"Reliability\": [], \"SideEffects\": [\"config-changes\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/admin/http/wp_automatic_plugin_privesc.rb\", \"platform\": \"PHP\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"admin/http/wp_automatic_plugin_privesc\", \"references\": [\"CVE-2021-4374\", \"URL-https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-automatic-plugin/\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:51.564781Z"}]}