{"vulnerability": "cve-2021-4355", "sightings": [{"uuid": "1fdb620b-b9e2-4c19-8858-a4508b523e78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "published-proof-of-concept", "source": "https://t.me/cKure/8218", "content": "\u25a0\u25a0\u25a0\u25a1\u25a1 CVE-2021-43557: Apache APISIX: Path traversal in request_uri variable.\n\nhttps://xvnpw.github.io/posts/cve_2021_43557_apache_apisix_path_traversal_in_request_uri_variable/", "creation_timestamp": "2021-11-25T22:41:13.000000Z"}, {"uuid": "4122ffea-ec72-4ccd-8037-1323abf141a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4355", "type": "seen", "source": "https://t.me/arpsyndicate/204", "content": "#ExploitObserverAlert\n\nCVE-2021-4355\n\nDESCRIPTION: Exploit Observer has 2 entries related to CVE-2021-4355. The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the download_orderdetail_list(), change_orderlist(), and download_member_list() functions called via admin_init hooks in versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to download lists of members, products and orders.\n\nFIRST-EPSS: 0.000720000\nNVD-IS: 1.4\nNVD-ES: 3.9", "creation_timestamp": "2023-11-17T05:00:21.000000Z"}, {"uuid": "f150fee4-ef79-44b7-bb88-d4802e45b1e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/483", "content": "#CVE-2021-43557 Apache APISIX Path traversal in request_uri variable\nhttps://xvnpw.github.io/posts/cve_2021_43557_apache_apisix_path_traversal_in_request_uri_variable\n\n#poc for CVE-2021-43557\nhttps://github.com/xvnpw/k8s-CVE-2021-43557-poc", "creation_timestamp": "2021-11-24T08:57:32.000000Z"}, {"uuid": "7d970082-66b8-47fa-ae62-3e44ddf517a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "published-proof-of-concept", "source": "Telegram/7lOg35W8EDhondHOu_l4LlZeIPa0pj8gOC8hBeOw9Gj5jg", "content": "", "creation_timestamp": "2021-11-23T22:38:07.000000Z"}, {"uuid": "4ffe1860-d7c4-4920-b549-968d0409251f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43550", "type": "seen", "source": "https://t.me/cibsecurity/34692", "content": "\u203c CVE-2021-43550 \u203c\n\nThe use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information, which affects the communications between Patient Information Center iX (PIC iX) Versions C.02 and C.03 and Efficia CM Series Revisions A.01 to C.0x and 4.0.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-27T22:23:22.000000Z"}, {"uuid": "35160e49-cc60-4d05-9eb8-8dfe3df4895f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43552", "type": "seen", "source": "https://t.me/cibsecurity/34690", "content": "\u203c CVE-2021-43552 \u203c\n\nThe use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from the Patient Information Center iX (PIC iX) Versions B.02, C.02, and C.03.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-27T22:23:19.000000Z"}, {"uuid": "c7417c46-e44b-4abf-8c14-58f757ff9308", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43559", "type": "seen", "source": "https://t.me/cibsecurity/32788", "content": "\u203c CVE-2021-43559 \u203c\n\nA flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The \"delete related badge\" functionality did not include the necessary token check to prevent a CSRF risk.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-22T18:23:43.000000Z"}, {"uuid": "eb835334-80aa-45ac-89fa-4d964d30e1f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43558", "type": "seen", "source": "https://t.me/cibsecurity/32793", "content": "\u203c CVE-2021-43558 \u203c\n\nA flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-22T18:23:53.000000Z"}, {"uuid": "c94db87d-a6ed-41cd-bfa1-29ca71293d0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43555", "type": "seen", "source": "https://t.me/cibsecurity/32747", "content": "\u203c CVE-2021-43555 \u203c\n\nmySCADA myDESIGNER Versions 8.20.0 and prior fails to properly validate contents of an imported project file, which may make the product vulnerable to a path traversal payload. This vulnerability may allow an attacker to plant files on the file system in arbitrary locations or overwrite existing files, resulting in remote code execution.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-19T22:17:23.000000Z"}, {"uuid": "5f53b46a-d8b1-4464-b1ce-5ab8945168d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43551", "type": "seen", "source": "https://t.me/cibsecurity/32572", "content": "\u203c CVE-2021-43551 \u203c\n\nA remote attacker with write access to PI Vision could inject code into a display. Unauthorized information disclosure, modification, or deletion is possible if a victim views or interacts with the infected display using Microsoft Internet Explorer. The impact affects PI System data and other data accessible with victim\u00e2\u20ac\u2122s user permissions.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-17T22:21:04.000000Z"}, {"uuid": "e6fe8cfc-b2bd-491e-b60a-4d1da28ede97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43553", "type": "seen", "source": "https://t.me/cibsecurity/32545", "content": "\u203c CVE-2021-43553 \u203c\n\nPI Vision could disclose information to a user with insufficient privileges for an AF attribute that is the child of another attribute and is configured as a Limits property.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-17T22:14:50.000000Z"}, {"uuid": "15b5e50e-2481-484d-8b98-f53900835a42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "published-proof-of-concept", "source": "https://t.me/BlueRedTeam/1212", "content": "#exploit\nCVE-2021-43557:\nApache APISIX: Path traversal in request_uri variable\nhttps://xvnpw.github.io/posts/cve_2021_43557_apache_apisix_path_traversal_in_request_uri_variable\n]-> PoC:\nhttps://github.com/xvnpw/k8s-CVE-2021-43557-poc\n\n@BlueRedTeam", "creation_timestamp": "2021-11-24T08:06:07.000000Z"}, {"uuid": "6e957f41-164d-47a8-a085-c698ebba02ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4822", "content": "#exploit\nCVE-2021-43557:\nApache APISIX: Path traversal in request_uri variable\nhttps://xvnpw.github.io/posts/cve_2021_43557_apache_apisix_path_traversal_in_request_uri_variable\n]-> PoC:\nhttps://github.com/xvnpw/k8s-CVE-2021-43557-poc", "creation_timestamp": "2021-11-24T11:03:01.000000Z"}, {"uuid": "a0c0d090-4877-4b52-9611-0b2386c92d7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1851", "content": "CVE-2021-43557: Apache APISIX: Path traversal in request_uri variable https://xvnpw.github.io/posts/cve_2021_43557_apache_apisix_path_traversal_in_request_uri_variable/", "creation_timestamp": "2026-08-03T04:12:55.976655Z"}, {"uuid": "ee55b3bb-201a-4876-af8a-2a01b7534ff9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "seen", "source": "Telegram/IBDLQiEWHO72tUJ2Ylqd3zBHJI3jkAPrj_4aeIoADYB6Hgg", "content": "", "creation_timestamp": "2026-08-27T12:00:10.890802Z"}, {"uuid": "ac507c93-610e-425b-a96f-4a531b05f523", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "published-proof-of-concept", "source": "Telegram/IBDLQiEWHO72tUJ2Ylqd3zBHJI3jkAPrj_4aeIoADYB6Hgg", "content": "", "creation_timestamp": "2026-08-29T00:00:15.686652Z"}, {"uuid": "d0708630-d362-4d02-97d3-82cac95849d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "seen", "source": "https://t.me/reverseame/1851", "content": "CVE-2021-43557: Apache APISIX: Path traversal in request_uri variable https://xvnpw.github.io/posts/cve_2021_43557_apache_apisix_path_traversal_in_request_uri_variable/", "creation_timestamp": "2026-07-29T12:02:51.207204Z"}, {"uuid": "628fd569-9252-4e77-b208-4ba8c3ea5d74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "seen", "source": "https://t.me/cissp/4879", "content": "Offensive_security\nSecurity Testing and Enumeration of WebSockets\nhttps://github.com/PalindromeLabs/STEWS#installation--usage\n\nexploit\nCVE-2021-41379:\nWindows installer LPE 0day\nhttps://github.com/klinix5/InstallerFileTakeOver\n\nThreat_Research\n1. Unauthenticated RCE against CommVault Command Center\nhttps://srcincite.io/blog/2021/11/22/unlocking-the-vault.html\n]-> PoC: https://srcincite.io/pocs/cve-2021-%7B34993,34996%7D.py.txt\n2. A review of Microsoft Azure Sphere vulnerabilities\nhttps://blog.talosintelligence.com/2021/11/a-review-of-azure-sphere.html?m=1\n3. Exploiting the Qualcomm NPU (neural processing unit) kernel driver (CVE-2021-1940, CVE-2021-1968, CVE-2021-1969)\nhttps://securitylab.github.com/research/qualcomm_npu\n\n_security\nPicky PPID Spoofing\nhttps://captmeelo.com/redteam/maldev/2021/11/22/picky-ppid-spoofing.html\n\nexploit\nCVE-2021-43557:\nApache APISIX: Path traversal in request_uri variable\nhttps://xvnpw.github.io/posts/cve_2021_43557_apache_apisix_path_traversal_in_request_uri_variable\n]-> PoC:\nhttps://github.com/xvnpw/k8s-CVE-2021-43557-poc", "creation_timestamp": "2026-09-01T17:00:34.827876Z"}, {"uuid": "74924fac-6be2-47a1-85d5-72d013bee84a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4879", "content": "Offensive_security\nSecurity Testing and Enumeration of WebSockets\nhttps://github.com/PalindromeLabs/STEWS#installation--usage\n\nexploit\nCVE-2021-41379:\nWindows installer LPE 0day\nhttps://github.com/klinix5/InstallerFileTakeOver\n\nThreat_Research\n1. Unauthenticated RCE against CommVault Command Center\nhttps://srcincite.io/blog/2021/11/22/unlocking-the-vault.html\n]-> PoC: https://srcincite.io/pocs/cve-2021-%7B34993,34996%7D.py.txt\n2. A review of Microsoft Azure Sphere vulnerabilities\nhttps://blog.talosintelligence.com/2021/11/a-review-of-azure-sphere.html?m=1\n3. Exploiting the Qualcomm NPU (neural processing unit) kernel driver (CVE-2021-1940, CVE-2021-1968, CVE-2021-1969)\nhttps://securitylab.github.com/research/qualcomm_npu\n\n_security\nPicky PPID Spoofing\nhttps://captmeelo.com/redteam/maldev/2021/11/22/picky-ppid-spoofing.html\n\nexploit\nCVE-2021-43557:\nApache APISIX: Path traversal in request_uri variable\nhttps://xvnpw.github.io/posts/cve_2021_43557_apache_apisix_path_traversal_in_request_uri_variable\n]-> PoC:\nhttps://github.com/xvnpw/k8s-CVE-2021-43557-poc", "creation_timestamp": "2026-09-10T14:00:06.275858Z"}, {"uuid": "1fe74b30-4a5c-4e7e-a07b-44be5cc7ad57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "seen", "source": "https://t.me/timcore_hacking/2786", "content": "#hackthebox\n#htb\n#hacking\n\nHackTheBox - Pikatwoo\n\n00:00 - Introduction\n01:00 - Start of nmap\n03:15 - Identifying all the technologies used in the box\n10:45 - Looking at OpenStack Keystone Authentication and discovering CVE-2021-38155\n12:15 - Pulling up API DOCS to see how to login to Keystone, then testing lockout\n14:00 - Taking the Burpsuite Request, sending it to FFUF and using a trick to try each password multiple times\n25:30 - Attempting to access Swift as a vendor to bypass auth, using GoBuster and discovering an Android directory with Pokatmon app in it\n35:10 - Start of analyzing the Pokatmon App, examining DNS, setting up a MITM with Burpsuite and Socat\n40:15 - Using Frida to disable TLS Certificate Pinning on Flutter\n45:20 - Discovering the App Signs every request, grabbing the certificate out of the app, and signing our own request\n49:20 - Performing an SQL Injection, getting an email address then looking for vulnerabilities in Forgot Password on the main website\n58:48 - Discovering CVE-2021-43557 in APISIX, which gives us an idea to URLEncode Paths to bypass blacklists and gaining access to the /private/ directory which has a /forgot-password we can use to reset Roger's password\n1:04:45 - Logging into the docs, gaining access to the API and finding an LFI\n1:09:45 - Looking into CVE-2021-35368, which is a ModSecurity Bypass that allows us to abuse the LFI\n1:18:10 - Using NGINX's temporary files with our PHP LFI to gain code execution\n1:27:55 - Shell returned on Pokatdex-API, exporting Kubernetes secrets\n1:34:20 - Discovering an APISIX admin key and exploiting this service by creating a route that executes code\n1:59:20 - Shell returned on the APISIX box, discovering credentials we can SSH with\n2:11:10 - Explioting the CRI-O with Kubernetes to set a kernel param to execute a script when a core dump is created (CVE-2022-0811)\n\n\nhttps://www.youtube.com/watch?v=gRj9Uz8_EOY", "creation_timestamp": "2023-09-14T12:26:19.000000Z"}, {"uuid": "cd059960-cc2c-417e-a240-a2eef1324f9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "published-proof-of-concept", "source": "https://t.me/timcore_hacking/2786", "content": "#hackthebox\n#htb\n#hacking\n\nHackTheBox - Pikatwoo\n\n00:00 - Introduction\n01:00 - Start of nmap\n03:15 - Identifying all the technologies used in the box\n10:45 - Looking at OpenStack Keystone Authentication and discovering CVE-2021-38155\n12:15 - Pulling up API DOCS to see how to login to Keystone, then testing lockout\n14:00 - Taking the Burpsuite Request, sending it to FFUF and using a trick to try each password multiple times\n25:30 - Attempting to access Swift as a vendor to bypass auth, using GoBuster and discovering an Android directory with Pokatmon app in it\n35:10 - Start of analyzing the Pokatmon App, examining DNS, setting up a MITM with Burpsuite and Socat\n40:15 - Using Frida to disable TLS Certificate Pinning on Flutter\n45:20 - Discovering the App Signs every request, grabbing the certificate out of the app, and signing our own request\n49:20 - Performing an SQL Injection, getting an email address then looking for vulnerabilities in Forgot Password on the main website\n58:48 - Discovering CVE-2021-43557 in APISIX, which gives us an idea to URLEncode Paths to bypass blacklists and gaining access to the /private/ directory which has a /forgot-password we can use to reset Roger's password\n1:04:45 - Logging into the docs, gaining access to the API and finding an LFI\n1:09:45 - Looking into CVE-2021-35368, which is a ModSecurity Bypass that allows us to abuse the LFI\n1:18:10 - Using NGINX's temporary files with our PHP LFI to gain code execution\n1:27:55 - Shell returned on Pokatdex-API, exporting Kubernetes secrets\n1:34:20 - Discovering an APISIX admin key and exploiting this service by creating a route that executes code\n1:59:20 - Shell returned on the APISIX box, discovering credentials we can SSH with\n2:11:10 - Explioting the CRI-O with Kubernetes to set a kernel param to execute a script when a core dump is created (CVE-2022-0811)\n\n\nhttps://www.youtube.com/watch?v=gRj9Uz8_EOY", "creation_timestamp": "2023-09-14T12:26:19.000000Z"}]}