{"vulnerability": "cve-2021-39165", "sightings": [{"uuid": "facc145c-175e-48ee-ab13-537c1a72d5f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-39165", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-39165.yaml", "content": "", "creation_timestamp": "2023-05-26T10:28:54.000000Z"}, {"uuid": "4be34e68-0fb0-407e-8474-bcca6c1ba707", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-39165", "type": "published-proof-of-concept", "source": "https://t.me/cKure/9068", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 This Python script allows to exploit CVE-2021-39165 in Cachet prior to and including 2.3.18 automatically.\n\nhttps://github.com/W0rty/CVE-2021-39165", "creation_timestamp": "2022-03-18T06:41:26.000000Z"}, {"uuid": "bb1f7cce-8d96-410a-9cb9-824e432e84a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-39165", "type": "seen", "source": "https://t.me/cibsecurity/27932", "content": "\u203c CVE-2021-39165 \u203c\n\nCachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session. The original repository of Cachet  is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-27T00:27:08.000000Z"}, {"uuid": "4a5cee53-b96c-4194-9154-ed85f0cf2e51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-39165", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/4194", "content": "#Offensive_security\n1. From Stranger to DA:\nUsing PetitPotam to NTLM relay to Domain Administrator\nhttps://blog.truesec.com/2021/08/05/from-stranger-to-da-using-petitpotam-to-ntlm-relay-to-active-directory\n2. CVE-2021-39165:\nA Bug Bounty Journey from a Laravel SQL Injection Vulnerability\nhttps://www.leavesongs.com/PENETRATION/cachet-from-laravel-sqli-to-bug-bounty.html", "creation_timestamp": "2021-08-31T13:10:52.000000Z"}, {"uuid": "bc2d4bc6-879b-4a48-baa8-ed4b822b4889", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-39165", "type": "seen", "source": "https://t.me/cissp/4226", "content": "Offensive security\n1. From Stranger to DA:\nUsing PetitPotam to NTLM relay to Domain Administrator\ud83e\uddd0\nhttps://blog.truesec.com/2021/08/05/from-stranger-to-da-using-petitpotam-to-ntlm-relay-to-active-directory\n2. CVE-2021-39165:\nA Bug Bounty Journey from a Laravel SQL Injection Vulnerability\ud83e\udd13\nhttps://www.leavesongs.com/PENETRATION/cachet-from-laravel-sqli-to-bug-bounty.html\n\nWLAN Security\nThe ABCs of NFC chip security\nhttps://research.nccgroup.com/2021/08/30/the-abcs-of-nfc-chip-security\n\nThreat Research\n1. New Annke Vulnerability Shows Risks of IoT Security Camera Systems\ud83d\ude05\nhttps://www.nozominetworks.com/blog/new-annke-vulnerability-shows-risks-of-iot-security-camera-systems\n2. PROXYTOKEN: AN AUTHENTICATION BYPASS IN MICROSOFT EXCHANGE SERVER\ud83d\ude0a\nhttps://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server", "creation_timestamp": "2026-09-01T17:00:41.871595Z"}, {"uuid": "1de39366-39a4-4244-baa2-85d1f07eb59c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-39165", "type": "seen", "source": "https://t.me/cissp/4226", "content": "Offensive security\n1. From Stranger to DA:\nUsing PetitPotam to NTLM relay to Domain Administrator\ud83e\uddd0\nhttps://blog.truesec.com/2021/08/05/from-stranger-to-da-using-petitpotam-to-ntlm-relay-to-active-directory\n2. CVE-2021-39165:\nA Bug Bounty Journey from a Laravel SQL Injection Vulnerability\ud83e\udd13\nhttps://www.leavesongs.com/PENETRATION/cachet-from-laravel-sqli-to-bug-bounty.html\n\nWLAN Security\nThe ABCs of NFC chip security\nhttps://research.nccgroup.com/2021/08/30/the-abcs-of-nfc-chip-security\n\nThreat Research\n1. New Annke Vulnerability Shows Risks of IoT Security Camera Systems\ud83d\ude05\nhttps://www.nozominetworks.com/blog/new-annke-vulnerability-shows-risks-of-iot-security-camera-systems\n2. PROXYTOKEN: AN AUTHENTICATION BYPASS IN MICROSOFT EXCHANGE SERVER\ud83d\ude0a\nhttps://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server", "creation_timestamp": "2026-09-02T01:04:28.369473Z"}, {"uuid": "9de0a8d0-6d51-4f5a-8df8-a840b0882f61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-39165", "type": "seen", "source": "https://t.me/cissp/4226", "content": "Offensive security\n1. From Stranger to DA:\nUsing PetitPotam to NTLM relay to Domain Administrator\ud83e\uddd0\nhttps://blog.truesec.com/2021/08/05/from-stranger-to-da-using-petitpotam-to-ntlm-relay-to-active-directory\n2. CVE-2021-39165:\nA Bug Bounty Journey from a Laravel SQL Injection Vulnerability\ud83e\udd13\nhttps://www.leavesongs.com/PENETRATION/cachet-from-laravel-sqli-to-bug-bounty.html\n\nWLAN Security\nThe ABCs of NFC chip security\nhttps://research.nccgroup.com/2021/08/30/the-abcs-of-nfc-chip-security\n\nThreat Research\n1. New Annke Vulnerability Shows Risks of IoT Security Camera Systems\ud83d\ude05\nhttps://www.nozominetworks.com/blog/new-annke-vulnerability-shows-risks-of-iot-security-camera-systems\n2. PROXYTOKEN: AN AUTHENTICATION BYPASS IN MICROSOFT EXCHANGE SERVER\ud83d\ude0a\nhttps://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server", "creation_timestamp": "2026-09-10T21:00:04.529195Z"}, {"uuid": "84595974-c3b0-4bc5-a688-cd7f41213657", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-39165", "type": "seen", "source": "https://t.me/cissp/4226", "content": "Offensive security\n1. From Stranger to DA:\nUsing PetitPotam to NTLM relay to Domain Administrator\ud83e\uddd0\nhttps://blog.truesec.com/2021/08/05/from-stranger-to-da-using-petitpotam-to-ntlm-relay-to-active-directory\n2. CVE-2021-39165:\nA Bug Bounty Journey from a Laravel SQL Injection Vulnerability\ud83e\udd13\nhttps://www.leavesongs.com/PENETRATION/cachet-from-laravel-sqli-to-bug-bounty.html\n\nWLAN Security\nThe ABCs of NFC chip security\nhttps://research.nccgroup.com/2021/08/30/the-abcs-of-nfc-chip-security\n\nThreat Research\n1. New Annke Vulnerability Shows Risks of IoT Security Camera Systems\ud83d\ude05\nhttps://www.nozominetworks.com/blog/new-annke-vulnerability-shows-risks-of-iot-security-camera-systems\n2. PROXYTOKEN: AN AUTHENTICATION BYPASS IN MICROSOFT EXCHANGE SERVER\ud83d\ude0a\nhttps://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server", "creation_timestamp": "2026-09-11T00:00:11.855349Z"}]}