{"vulnerability": "cve-2021-35475", "sightings": [{"uuid": "8b915176-bc4e-42a0-bed4-2ef617ee294f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35475", "type": "seen", "source": "https://t.me/cibsecurity/25700", "content": "\u203c CVE-2021-35475 \u203c\n\nSAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. The XSS will prompt when editing the Configuration Properties.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-06-25T14:19:25.000000Z"}, {"uuid": "ed0cd600-2a1c-48f3-8d00-877e51f213ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35475", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/718", "content": "CVE-2021-35475 SAS Environment Manager 2.5 XSS\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-35475_SAS_Environment_Manager_2.5_XSS%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-09-21T04:42:21.000000Z"}, {"uuid": "7b1b4414-800f-4c10-9097-f67721038ef3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35475", "type": "seen", "source": "https://t.me/hacking_Attack/14596", "content": "Exploit Collector\nSAS Environment Manager 2.5 Cross Site Scripting\n\nhttps://1.bp.blogspot.com/-9u0QXe9ybeo/WWlvU_DnejI/AAAAAAAAIN0/BUl-HrIsuwE3sKywG67Nuv_wLRABID6oQCLcBGAs/s1600/h45.png \nSAS Environment Manager version 2.5 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | a1bca70f9195c84c7ae4745dbcaceb7e\n\nDownload\n# Exploit Title: SAS Environment Manager 2.5 - 'name' Stored Cross-Site Scripting (XSS)\n# Date: 24/06/2021\n# Exploit Author: Luqman Hakim Zahari @ Saitamang\n# Vendor Homepage: https://support.sas.com/en/software/environment-manager-support.html\n# Version: 2.5\n# Tested on: CentOS 7\n# CVE : CVE-2021-35475\n\n# Description #\n\nSAS\u00ae Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. The XSS will prompt when editing the Configuration Properties.\n\n# Proof of Concept(PoC) # https://github.com/saitamang/CVE-2021-35475/blob/main/README.md\n\n*Steps to Reproduce:*\n\n[1.] Login to your system > On \"Resource\" tab > \"Browse\"\"\n[2.] Choose a \"Platform\"\n[3.] Click \"Inventory\" tab > Under \"Servers\" tab click \"New...\"\n[4.] Under \"General Properties\" tab on \"Name\" field , enter the payload(below) > Filled up other information and click \"Ok\" button\n\npayload : \n\nname=XSS\"> click \"Edit\" button\n[7.] Then the payload will be executed\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:34.589969Z"}, {"uuid": "a5016984-b05f-42da-a8bf-ee6d86fa8edb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35475", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/14596", "content": "Exploit Collector\nSAS Environment Manager 2.5 Cross Site Scripting\n\nhttps://1.bp.blogspot.com/-9u0QXe9ybeo/WWlvU_DnejI/AAAAAAAAIN0/BUl-HrIsuwE3sKywG67Nuv_wLRABID6oQCLcBGAs/s1600/h45.png \nSAS Environment Manager version 2.5 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | a1bca70f9195c84c7ae4745dbcaceb7e\n\nDownload\n# Exploit Title: SAS Environment Manager 2.5 - 'name' Stored Cross-Site Scripting (XSS)\n# Date: 24/06/2021\n# Exploit Author: Luqman Hakim Zahari @ Saitamang\n# Vendor Homepage: https://support.sas.com/en/software/environment-manager-support.html\n# Version: 2.5\n# Tested on: CentOS 7\n# CVE : CVE-2021-35475\n\n# Description #\n\nSAS\u00ae Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. The XSS will prompt when editing the Configuration Properties.\n\n# Proof of Concept(PoC) # https://github.com/saitamang/CVE-2021-35475/blob/main/README.md\n\n*Steps to Reproduce:*\n\n[1.] Login to your system > On \"Resource\" tab > \"Browse\"\"\n[2.] Choose a \"Platform\"\n[3.] Click \"Inventory\" tab > Under \"Servers\" tab click \"New...\"\n[4.] Under \"General Properties\" tab on \"Name\" field , enter the payload(below) > Filled up other information and click \"Ok\" button\n\npayload : \n\nname=XSS\"> click \"Edit\" button\n[7.] Then the payload will be executed\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-08T02:00:06.271441Z"}]}