{"uuid": "eb34c2ea-e938-44e6-a515-4046f452a044", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-44848", "type": "seen", "source": "https://t.me/hacking_Attack/35278", "content": "Exploit Collector\nCibele Thinfinity VirtualUI 2.5.41.0 User Enumeration\n\nhttps://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png \nCibele Thinfinity VirtualUI version 2.5.41.0 suffers from a user enumeration vulnerability.\n\nMD5 | 075e1c749825a41f790a7703ee3dc388\n\nDownload\n# Exploit Title: Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration\n# Date: 13/12/2021\n# Exploit Author: Daniel Morales, IT Security Team - ARHS Spikeseed\n# Vendor Homepage: https://www.cybelesoft.com\n# Software Link: https://www.cybelesoft.com/thinfinity/virtualui/\n# Version: vulnerable < v3.0\n# Tested on: Microsoft Windows\n# CVE: CVE-2021-44848\n\nHow it works: By accessing the vector, an attacker can determine if a username exists thanks to the message returned; it can be presented in different languages according to the configuration of VirtualUI. Common users are administrator, admin, guest...\nPayload: The vulnerable vector is \"https://example.com/changePassword?username=USERNAME\" where \"USERNAME\" need to be brute-forced.\nReference: https://github.com/cybelesoft/virtualui/issues/1\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:30.408828Z"}