{"vulnerability": "CVE-2021-2429", "sightings": [{"uuid": "ac5fa144-7a29-4dfc-8674-091d851cc2d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24291", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-24291.yaml", "content": "", "creation_timestamp": "2023-04-27T09:58:59.000000Z"}, {"uuid": "e13d1a0e-85a9-40b1-a8a9-471266d314a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24295", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/passive/cves/2022/CVE-2021-24295.yaml", "content": "", "creation_timestamp": "2025-09-24T08:26:44.000000Z"}, {"uuid": "43afae07-729c-47be-bd1f-6ecd7e46b30d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2429", "type": "seen", "source": "https://t.me/cibsecurity/26314", "content": "\u203c CVE-2021-2429 \u203c\n\nVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-07-21T18:34:34.000000Z"}, {"uuid": "de75a9ad-a6cf-476b-afc6-bee42d086649", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2429", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4216", "content": "#exploit \nCVE-2021-2429:\nA HEAP-BASED BUFFER OVERFLOW BUG IN THE MYSQL INNODB MEMCACHED PLUGIN\nhttps://www.zerodayinitiative.com/blog/2021/9/2/cve-2021-2429-a-heap-based-buffer-overflow-bug-in-the-mysql-innodb-memcached-plugin", "creation_timestamp": "2021-09-03T12:00:11.000000Z"}, {"uuid": "59901173-5714-4245-ba6d-327b3073edfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2429", "type": "seen", "source": "https://t.me/cissp/4267", "content": "exploit \nCVE-2021-2429:\nA HEAP-BASED BUFFER OVERFLOW BUG IN THE MYSQL INNODB MEMCACHED PLUGIN\nhttps://www.zerodayinitiative.com/blog/2021/9/2/cve-2021-2429-a-heap-based-buffer-overflow-bug-in-the-mysql-innodb-memcached-plugin\n\nRedTeam Tactics\nPlay the music and bypass TCC aka CVE-2020-29621 (PoC)\nhttps://wojciechregula.blog/post/play-the-music-and-bypass-tcc-aka-cve-2020-29621\n\nOffensive security\nLiquidSnake is a tool that allows operators to perform fileless lateral movement using WMI Event \ud83d\ude42Subscriptions and GadgetToJScript\nhttps://github.com/RiccardoAncarani/LiquidSnake\n\nThreat Research\n1. Unknown Actor Using CLFS Log Files for Stealth\nhttps://www.fireeye.com/blog/threat-research/2021/09/unknown-actor-using-clfs-log-files-for-stealth.html\n2. OpenSSL Vulnerability Analysis (CVE-2021-3711)\ud83d\ude0e\nhttps://mp.weixin.qq.com/s/P2aduaUS3s8K7I-cDVJNgA\n3. Now Patched Vulnerability in WhatsApp could have led to data exposure of users\nhttps://research.checkpoint.com/2021/now-patched-vulnerability-in-whatsapp-could-have-led-to-data-exposure-of-users", "creation_timestamp": "2026-09-01T17:00:41.458854Z"}, {"uuid": "d90eacb6-0080-4f13-920f-051a65f7b1b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24299", "type": "seen", "source": "https://t.me/hacking_Attack/9959", "content": "Exploit Collector\nWordPress ReDi Restaurant Reservation 21.0307 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-SxgEc7szt9w/WWlva1nZfUI/AAAAAAAAIPE/UrvwYC_4YmMlGypxS9ASHy318XWSifzEQCLcBGAs/s1600/h71.png \nWordPress ReDi Restaurant Reservation plugin version 21.0307 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 97371d46e078284e75d608dc3d9438a0\n\nDownload\n# Exploit Title: WordPress Plugin ReDi Restaurant Reservation 21.0307 - 'Comment' Stored Cross-Site Scripting (XSS)\n# Date: 2021-05-10\n# Exploit Author: Bastijn Ouwendijk\n# Vendor Homepage: https://reservationdiary.eu/\n# Software Link: https://wordpress.org/plugins/redi-restaurant-reservation/\n# Version: 21.0307 and earlier\n# Tested on: Windows 10\n# CVE : CVE-2021-24299\n# Proof: https://bastijnouwendijk.com/cve-2021-24299/\n\nSteps to exploit this vulnerability:\n\n1. Go to the page where [redirestaurant] is embed to make a restaurant reservation by filling in the requested information\n2. In the 'Comment' field of the restaurant reservation form put the payload: ``\n3. Submit the form\n4. While being logged into WordPress as administrator go to ReDi Reservations > Upcoming (Tablet PC)\n5. Click on 'View upcoming reservations'\n6. Select for 'Show reservations for': 'This week'\n7. The reservations are loaded and two alerts are shown with text 'XSS'\n\nSource:packetstormsecurity.com\n\u2796 Sent by @TheFeedReaderBot \u2796", "creation_timestamp": "2026-09-01T20:02:41.294745Z"}, {"uuid": "0e91f288-dfee-4386-b176-890d5e2ec211", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24299", "type": "seen", "source": "https://t.me/hacking_Attack/9959", "content": "Exploit Collector\nWordPress ReDi Restaurant Reservation 21.0307 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-SxgEc7szt9w/WWlva1nZfUI/AAAAAAAAIPE/UrvwYC_4YmMlGypxS9ASHy318XWSifzEQCLcBGAs/s1600/h71.png \nWordPress ReDi Restaurant Reservation plugin version 21.0307 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 97371d46e078284e75d608dc3d9438a0\n\nDownload\n# Exploit Title: WordPress Plugin ReDi Restaurant Reservation 21.0307 - 'Comment' Stored Cross-Site Scripting (XSS)\n# Date: 2021-05-10\n# Exploit Author: Bastijn Ouwendijk\n# Vendor Homepage: https://reservationdiary.eu/\n# Software Link: https://wordpress.org/plugins/redi-restaurant-reservation/\n# Version: 21.0307 and earlier\n# Tested on: Windows 10\n# CVE : CVE-2021-24299\n# Proof: https://bastijnouwendijk.com/cve-2021-24299/\n\nSteps to exploit this vulnerability:\n\n1. Go to the page where [redirestaurant] is embed to make a restaurant reservation by filling in the requested information\n2. In the 'Comment' field of the restaurant reservation form put the payload: ``\n3. Submit the form\n4. While being logged into WordPress as administrator go to ReDi Reservations > Upcoming (Tablet PC)\n5. Click on 'View upcoming reservations'\n6. Select for 'Show reservations for': 'This week'\n7. The reservations are loaded and two alerts are shown with text 'XSS'\n\nSource:packetstormsecurity.com\n\u2796 Sent by @TheFeedReaderBot \u2796", "creation_timestamp": "2026-09-02T01:03:17.823638Z"}, {"uuid": "afb26f23-1bd4-4f6a-ae22-3c099e8ae0b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2429", "type": "seen", "source": "https://t.me/cissp/4267", "content": "exploit \nCVE-2021-2429:\nA HEAP-BASED BUFFER OVERFLOW BUG IN THE MYSQL INNODB MEMCACHED PLUGIN\nhttps://www.zerodayinitiative.com/blog/2021/9/2/cve-2021-2429-a-heap-based-buffer-overflow-bug-in-the-mysql-innodb-memcached-plugin\n\nRedTeam Tactics\nPlay the music and bypass TCC aka CVE-2020-29621 (PoC)\nhttps://wojciechregula.blog/post/play-the-music-and-bypass-tcc-aka-cve-2020-29621\n\nOffensive security\nLiquidSnake is a tool that allows operators to perform fileless lateral movement using WMI Event \ud83d\ude42Subscriptions and GadgetToJScript\nhttps://github.com/RiccardoAncarani/LiquidSnake\n\nThreat Research\n1. Unknown Actor Using CLFS Log Files for Stealth\nhttps://www.fireeye.com/blog/threat-research/2021/09/unknown-actor-using-clfs-log-files-for-stealth.html\n2. OpenSSL Vulnerability Analysis (CVE-2021-3711)\ud83d\ude0e\nhttps://mp.weixin.qq.com/s/P2aduaUS3s8K7I-cDVJNgA\n3. Now Patched Vulnerability in WhatsApp could have led to data exposure of users\nhttps://research.checkpoint.com/2021/now-patched-vulnerability-in-whatsapp-could-have-led-to-data-exposure-of-users", "creation_timestamp": "2026-09-02T01:04:27.471419Z"}]}