{"vulnerability": "CVE-2021-4315", "sightings": [{"uuid": "1d0ebc73-d4ba-4de0-a8d0-1db550907110", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4315", "type": "seen", "source": "https://t.me/cibsecurity/57132", "content": "\u203c CVE-2021-4315 \u203c\n\nA vulnerability has been found in NYUCCL psiTurk up to 3.2.0 and classified as critical. This vulnerability affects unknown code of the file psiturk/experiment.py. The manipulation of the argument mode leads to improper neutralization of special elements used in a template engine. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.1 is able to address this issue. The name of the patch is 47787e15cecd66f2aa87687bf852ae0194a4335f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-219676.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-01-29T13:02:17.000000Z"}, {"uuid": "8dafd29e-f0d5-470f-8129-c9e3c1b33250", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43154", "type": "seen", "source": "https://t.me/cibsecurity/40746", "content": "\u203c CVE-2021-43154 \u203c\n\nCross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-04-14T02:18:18.000000Z"}, {"uuid": "94c2f518-6dd6-44d2-b0a5-f91ecbe219f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43158", "type": "seen", "source": "https://t.me/cibsecurity/34515", "content": "\u203c CVE-2021-43158 \u203c\n\nIn ProjectWorlds Online Shopping System PHP 1.0, a CSRF vulnerability in cart_remove.php allows a remote attacker to remove any product in the customer's cart.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-22T20:18:39.000000Z"}, {"uuid": "53f2accc-5447-45d3-8cbb-4267ffb66dc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43156", "type": "seen", "source": "https://t.me/cibsecurity/34514", "content": "\u203c CVE-2021-43156 \u203c\n\nIn ProjectWorlds Online Book Store PHP 1.0 a CSRF vulnerability in admin_delete.php allows a remote attacker to delete any book.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-22T20:18:37.000000Z"}, {"uuid": "f3b87243-1039-4537-9065-3e6891a49536", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43157", "type": "seen", "source": "https://t.me/cibsecurity/34524", "content": "\u203c CVE-2021-43157 \u203c\n\nProjectsworlds Online Shopping System PHP 1.0 is vulnerable to SQL injection via the id parameter in cart_remove.php.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-22T20:19:03.000000Z"}, {"uuid": "d07a942c-23ed-491f-b419-31d1f5b425fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43155", "type": "seen", "source": "https://t.me/cibsecurity/34518", "content": "\u203c CVE-2021-43155 \u203c\n\nProjectsworlds Online Book Store PHP v1.0 is vulnerable to SQL injection via the \"bookisbn\" parameter in cart.php.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-22T20:18:47.000000Z"}, {"uuid": "a4d639f5-312f-4f42-82a7-9bf1b7ad3ceb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43159", "type": "seen", "source": "https://t.me/hacking_Attack/52114", "content": "Exploit Collector\nRuijie RG-EW Remote Code Execution\n\nhttps://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png Ruijie RG-EW series routers suffer from six different remote code execution vulnerabilities. Findings were tested on Ruijie RG-EW1200 and Ruijie RG-EW1200G PRO.\n\nSHA-256 | afc11add2a38d6b294427cd246c931f425417794c6ce79f0f9a682f5ccbf3cd2Download Advisory: Multiple Vulnerabilities in Ruijie RG-EW Series Routers\n\n=======\nSummary\n=======\n\nMultiple vulnerabilities was found in Ruijie RG-EW Series Routers from\nRuijie Networks, including 1 pre-authenticated and 5 post-authenticated\nRemote Code Execution (RCE).\n\n==============\nCVE-2021-43159\n==============\n\n## Description\n\nA Remote Code Execution (RCE) vulnerability exists in Ruijie Networks\nRuijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55\nvia the setSessionTime function in /cgi-bin/luci/api/common.\n\n## Details\n\n- Type: Post-authenticated RCE / Command Injection\n- Discoverer: Minh Khoa of VSEC\n- Affected Component:\nFile: /usr/lib/lua/luci/modules/common.lua\nFunction: setSessionTime\n- Tested on: Ruijie RG-EW1200, Ruijie RG-EW1200G PRO\n\n==============\nCVE-2021-43160\n==============\n\n## Description\n\nA Remote Code Execution (RCE) vulnerability exists in Ruijie Networks\nRuijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55\nvia the switchFastDhcp function in /cgi-bin/luci/api/diagnose.\n\n## Details\n\n- Type: Post-authenticated RCE / Command Injection\n- Discoverer: Minh Khoa of VSEC\n- Affected Component:\nFile: /usr/lib/lua/luci/modules/diagnose.lua\nFunction: switchFastDhcp\n- Tested on: Ruijie RG-EW1200, Ruijie RG-EW1200G PRO\n\n==============\nCVE-2021-43161\n==============\n\n## Description\n\nA Remote Code Execution (RCE) vulnerability exists in Ruijie Networks\nRuijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55\nvia the doSwitchApi function in /cgi-bin/luci/api/switch.\n\n## Details\n- Type: Post-authenticated RCE / Command Injection\n- Discoverer: Minh Khoa of VSEC\n- Affected Component:\nFile: /usr/lib/lua/luci/modules/switch.lua\nFunction: doSwitchApi\n- Tested on: Ruijie RG-EW1200, Ruijie RG-EW1200G PRO\n\n==============\nCVE-2021-43162\n==============\n\n## Description\n\nA Remote Code Execution (RCE) vulnerability exists in Ruijie Networks\nRuijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55\nvia the runPackDiagnose function in /cgi-bin/luci/api/diagnose.\n\n## Details\n\n- Type: Post-authenticated RCE / Command Injection\n- Discoverer: Minh Khoa of VSEC\n- Affected Component:\nFile: /usr/lib/lua/luci/modules/diagnose.lua\nFunction: runPackDiagnose\n- Tested on: Ruijie RG-EW1200, Ruijie RG-EW1200G PRO\n\n==============\nCVE-2021-43163\n==============\n\n## Description\n\nA Remote Code Execution (RCE) vulnerability exists in Ruijie Networks\nRuijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55\nvia the checkNet function in /cgi-bin/luci/api/auth.\n\n## Details\n\n- Type: Pre-authenticated RCE / Command Injection\n- Discoverer: Minh Khoa of VSEC\n- Affected Component:\nFile: /usr/lib/lua/luci/modules/noauth.lua\nFunction: checkNet\n- Tested on: Ruijie RG-EW1200, Ruijie RG-EW1200G PRO\n\n==============\nCVE-2021-43164\n==============\n\n## Description\n\nA Remote Code Execution (RCE) vulnerability exists in Ruijie Networks\nRuijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55\nvia the updateVersion function in /cgi-bin/luci/api/wireless.\n\n## Details\n\n- Type: Post-authenticated RCE / Command Injection\n- Discoverer: Minh Khoa of VSEC\n- Affected Component:\nFile: /usr/lib/lua/luci/modules/wireless.lua\nFunction: updateVersion\n- Tested on: Ruijie RG-EW1200, Ruijie RG-EW1200G PRO\n\n-- \nKhoa Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:42.577885Z"}, {"uuid": "e2f38261-2773-4ba3-9c67-cc82658639b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43159", "type": "seen", "source": "https://t.me/hacking_Attack/52114", "content": "Exploit Collector\nRuijie RG-EW Remote Code Execution\n\nhttps://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png Ruijie RG-EW series routers suffer from six different remote code execution vulnerabilities. Findings were tested on Ruijie RG-EW1200 and Ruijie RG-EW1200G PRO.\n\nSHA-256 | afc11add2a38d6b294427cd246c931f425417794c6ce79f0f9a682f5ccbf3cd2Download Advisory: Multiple Vulnerabilities in Ruijie RG-EW Series Routers\n\n=======\nSummary\n=======\n\nMultiple vulnerabilities was found in Ruijie RG-EW Series Routers from\nRuijie Networks, including 1 pre-authenticated and 5 post-authenticated\nRemote Code Execution (RCE).\n\n==============\nCVE-2021-43159\n==============\n\n## Description\n\nA Remote Code Execution (RCE) vulnerability exists in Ruijie Networks\nRuijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55\nvia the setSessionTime function in /cgi-bin/luci/api/common.\n\n## Details\n\n- Type: Post-authenticated RCE / Command Injection\n- Discoverer: Minh Khoa of VSEC\n- Affected Component:\nFile: /usr/lib/lua/luci/modules/common.lua\nFunction: setSessionTime\n- Tested on: Ruijie RG-EW1200, Ruijie RG-EW1200G PRO\n\n==============\nCVE-2021-43160\n==============\n\n## Description\n\nA Remote Code Execution (RCE) vulnerability exists in Ruijie Networks\nRuijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55\nvia the switchFastDhcp function in /cgi-bin/luci/api/diagnose.\n\n## Details\n\n- Type: Post-authenticated RCE / Command Injection\n- Discoverer: Minh Khoa of VSEC\n- Affected Component:\nFile: /usr/lib/lua/luci/modules/diagnose.lua\nFunction: switchFastDhcp\n- Tested on: Ruijie RG-EW1200, Ruijie RG-EW1200G PRO\n\n==============\nCVE-2021-43161\n==============\n\n## Description\n\nA Remote Code Execution (RCE) vulnerability exists in Ruijie Networks\nRuijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55\nvia the doSwitchApi function in /cgi-bin/luci/api/switch.\n\n## Details\n- Type: Post-authenticated RCE / Command Injection\n- Discoverer: Minh Khoa of VSEC\n- Affected Component:\nFile: /usr/lib/lua/luci/modules/switch.lua\nFunction: doSwitchApi\n- Tested on: Ruijie RG-EW1200, Ruijie RG-EW1200G PRO\n\n==============\nCVE-2021-43162\n==============\n\n## Description\n\nA Remote Code Execution (RCE) vulnerability exists in Ruijie Networks\nRuijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55\nvia the runPackDiagnose function in /cgi-bin/luci/api/diagnose.\n\n## Details\n\n- Type: Post-authenticated RCE / Command Injection\n- Discoverer: Minh Khoa of VSEC\n- Affected Component:\nFile: /usr/lib/lua/luci/modules/diagnose.lua\nFunction: runPackDiagnose\n- Tested on: Ruijie RG-EW1200, Ruijie RG-EW1200G PRO\n\n==============\nCVE-2021-43163\n==============\n\n## Description\n\nA Remote Code Execution (RCE) vulnerability exists in Ruijie Networks\nRuijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55\nvia the checkNet function in /cgi-bin/luci/api/auth.\n\n## Details\n\n- Type: Pre-authenticated RCE / Command Injection\n- Discoverer: Minh Khoa of VSEC\n- Affected Component:\nFile: /usr/lib/lua/luci/modules/noauth.lua\nFunction: checkNet\n- Tested on: Ruijie RG-EW1200, Ruijie RG-EW1200G PRO\n\n==============\nCVE-2021-43164\n==============\n\n## Description\n\nA Remote Code Execution (RCE) vulnerability exists in Ruijie Networks\nRuijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55\nvia the updateVersion function in /cgi-bin/luci/api/wireless.\n\n## Details\n\n- Type: Post-authenticated RCE / Command Injection\n- Discoverer: Minh Khoa of VSEC\n- Affected Component:\nFile: /usr/lib/lua/luci/modules/wireless.lua\nFunction: updateVersion\n- Tested on: Ruijie RG-EW1200, Ruijie RG-EW1200G PRO\n\n-- \nKhoa Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:54.557863Z"}]}