{"vulnerability": "CVE-2021-40352", "sightings": [{"uuid": "49b6c259-75df-4c86-81e6-3322a70a4186", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40352", "type": "published-proof-of-concept", "source": "https://t.me/pwnwiki_zhchannel/840", "content": "Fabasoft Cloud Website XSS\u6f0f\u6d1e\nhttps://short.pwnwiki.org/?c=IqMVpN\nTelegram Desktop 2.9.2 \u62d2\u7d55\u670d\u52d9\u6f0f\u6d1e\nhttps://short.pwnwiki.org/?c=oCGAFS\nWordPress Plugin Payments Plugin&GetPaid 2.4.6 HTML\u6ce8\u5165\u6f0f\u6d1e\nhttps://short.pwnwiki.org/?c=nmKPJY\nCVE-2021-40352 OpenEMR 6.0.0 \u4e0d\u5b89\u5168\u7684\u76f4\u63a5\u5c0d\u8c61\u5f15\u7528\nhttps://short.pwnwiki.org/?c=qyNCzS\nCiclope SQL\u6ce8\u5165\u6f0f\u6d1e\nhttps://short.pwnwiki.org/?c=S4atKH\nCREFONO 8 SQL\u6ce8\u5165\u6f0f\u6d1e\nhttps://short.pwnwiki.org/?c=GDFZKn\nBank of Saint Lucia SQL\u6ce8\u5165\u6f0f\u6d1e\nhttps://short.pwnwiki.org/?c=on3IV3\nCVE-2021-39279&CVE-2021-39278&CVE-2015-0235&CVE-2013-1914 Moxa \u547d\u4ee4\u6ce8\u5165&XSS\u6f0f\u6d1e\nhttps://short.pwnwiki.org/?c=g3rHRb\nFillip Technologies SQL\u6ce8\u5165\u6f0f\u6d1e\nhttps://short.pwnwiki.org/?c=fwCNnF", "creation_timestamp": "2021-09-21T04:41:53.000000Z"}, {"uuid": "2e3ba5d9-07ad-44f9-b875-644ed009ef34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40352", "type": "seen", "source": "https://t.me/hacking_Attack/22272", "content": "Exploit Collector\nOpenEMR 6.0.0 Insecure Direct Object Reference\n\nhttps://4.bp.blogspot.com/-gQsa2Au6OFw/WWlvKe9cGFI/AAAAAAAAIME/7MuhuX3Jqy0CeEu0oyVXmXST8BDpKvIGgCLcBGAs/s1600/h15.png \nOpenEMR version 6.0.0 suffers from an insecure direct object reference vulnerability.\n\nMD5 | cfdad061a5f147865a0eb5338656760f\n\nDownload\n# Exploit Title: Openemr 6.0.0 - Insecure direct object references \n# Date: 31/8/2021 \n# Exploit Author: Allen Enosh Upputori \n# Vendor Homepage: https://community.open-emr.org \n# Version: 6.0.0 \n# Tested on: Linux \n# CVE: 2021-40352 \n\nPoC: An attacker who has Physician Access can read messages with were sent to others members including admin messages the vulnerability exits in the print message feature = \"pnotes_print.php?noteid=16\" changing the \"noteid=\" to any other number will reveal the messages of everyone \n\nhttps://github.com/allenenosh/CVE-2021-40352 \n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:25.777997Z"}, {"uuid": "49c79ad1-8f8e-4eec-a272-ad706df3ca55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40352", "type": "seen", "source": "https://t.me/hacking_Attack/22272", "content": "Exploit Collector\nOpenEMR 6.0.0 Insecure Direct Object Reference\n\nhttps://4.bp.blogspot.com/-gQsa2Au6OFw/WWlvKe9cGFI/AAAAAAAAIME/7MuhuX3Jqy0CeEu0oyVXmXST8BDpKvIGgCLcBGAs/s1600/h15.png \nOpenEMR version 6.0.0 suffers from an insecure direct object reference vulnerability.\n\nMD5 | cfdad061a5f147865a0eb5338656760f\n\nDownload\n# Exploit Title: Openemr 6.0.0 - Insecure direct object references \n# Date: 31/8/2021 \n# Exploit Author: Allen Enosh Upputori \n# Vendor Homepage: https://community.open-emr.org \n# Version: 6.0.0 \n# Tested on: Linux \n# CVE: 2021-40352 \n\nPoC: An attacker who has Physician Access can read messages with were sent to others members including admin messages the vulnerability exits in the print message feature = \"pnotes_print.php?noteid=16\" changing the \"noteid=\" to any other number will reveal the messages of everyone \n\nhttps://github.com/allenenosh/CVE-2021-40352 \n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:02:57.779694Z"}]}