{"vulnerability": "cve-2021-24155", "sightings": [{"uuid": "1e411a12-6864-47b7-8594-dc1910bfebd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24155", "type": "seen", "source": "MISP/8f9fc7df-6300-4659-8c37-be28e3cf9e52", "content": "", "creation_timestamp": "2024-11-14T06:09:52.000000Z"}, {"uuid": "d29112c4-dd74-4a5f-b7fb-6f596f53ac69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24155", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "b82b06c9-3e70-4672-bced-71d754fe62e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24155", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:35.000000Z"}, {"uuid": "cda8b61d-ed0a-4dde-8673-1041f14df59c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24155", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_plugin_backup_guard_rce.rb", "content": "", "creation_timestamp": "2021-07-20T21:02:32.000000Z"}, {"uuid": "6d6e90bd-445a-46de-a25f-3674d7b0a3a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24155", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/210", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aWordPress Backup Guard Authenticated Remote Code Execution Exploit\nURL\uff1ahttps://github.com/0Day-dev/CVE-2021-24155.rb", "creation_timestamp": "2021-07-30T11:38:22.000000Z"}, {"uuid": "a23de5df-b026-462c-8c37-f8d9dfc0dd53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24155", "type": "published-proof-of-concept", "source": "Telegram/iSJ7-GJvpeCmZTZPcxnJiXJW96S2UloBvqL6F7vHjb8i_Q", "content": "", "creation_timestamp": "2022-08-06T05:25:43.000000Z"}, {"uuid": "4e94c0da-748c-4971-af0b-af43422fe039", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24155", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/186", "content": "Latest Vulnerabilities and Exploits\n\nCVE-2021-3449 OpenSSL denial-of-service exploit\nhttps://github.com/terorie/cve-2021-3449\n\nProxyToken\nhttps://github.com/bhdresh/CVE-2021-33766-ProxyToken\n\nCVES Xstream-1.4.17\nhttps://github.com/zwjjustdoit/Xstream-1.4.17\n\nCVE-2021-36934/HiveNightmare/SeriousSAM\nhttps://github.com/cube0x0/CVE-2021-36934\n\nHow to exploit a vulnerable windows driver Exploit for AsrDrv104 sys\nhttps://github.com/stong/CVE-2020-15368\n\nCVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel\nhttps://github.com/0vercl0k/CVE-2021-32537\n\nCVE-2021-28476 a guest-to-host \"Hyper-V Remote Code Execution Vulnerability\" in vmswitch sys\nhttps://github.com/0vercl0k/CVE-2021-28476\n\nCVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit\nhttps://github.com/klezVirus/CVE-2021-40444\n\nExploit Accsess network clients by sending packets in wirless TP-LINK and preparing for a mitm attack\nhttps://github.com/lhashashinl/CVE-2021-37152\n\nProof on Concept Exploit for CVE-2021-38647 (OMIGOD)\nhttps://github.com/horizon3ai/CVE-2021-38647\n\nProof of Concept Exploit for vCenter CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\nProof-of-Concept (PoC) script to exploit Pulse Secure CVE-2021-22893\nhttps://github.com/ZephrFish/CVE-2021-22893\n\nCVE-2021-33766 (ProxyToken)\nhttps://github.com/demossl/CVE-2021-33766-ProxyToken\n\nCVE-2021-2456\nhttps://github.com/peterjson31337/CVE-2021-2456\n\nCVE-2021-38647 POC for RCE\nhttps://github.com/midoxnet/CVE-2021-38647\n\nCVE-2021-26084 (PoC) | Confluence Server Webwork OGNL injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\nhttps://github.com/r0ckysec/CVE-2021-26084_Confluence\nhttps://github.com/march0s1as/CVE-2021-26084\n\n\nCVE-2021-21551 Dell Driver EoP\nhttps://github.com/ihack4falafel/Dell-Driver-EoP-CVE-2021-21551\n\nA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nhttps://github.com/lntrx/CVE-2021-28663\n\nCVE-2021-40353 openSIS 8.0 SQL Injection\nhttps://github.com/5qu1n7/CVE-2021-40353\n\nCVE-2021-28476 Ubuntu 20.04\nhttps://github.com/sh4m2hwz/CVE-2021-28476-tools-env\n\nmy exp for chrome V8 CVE-2021-30551\nhttps://github.com/xmzyshypnc/CVE-2021-30551\n\nPOC of CVE-2021-2394\nhttps://github.com/lz2y/CVE-2021-2394\n\nWordPress Backup Guard Authenticated Remote Code Execution Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb\n\nExploit code for CVE-2021-33909,Just a dump of removed\nhttps://github.com/bbinfosec43/CVE-2021-33909", "creation_timestamp": "2021-09-18T23:06:09.000000Z"}, {"uuid": "21e850fb-ca40-49a4-adc6-82485a23a5c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24155", "type": "published-proof-of-concept", "source": "Telegram/eMoVbCeI-n-jaFKeB-W9ZjnKBEe6KGFrv-r960DcFriPRg", "content": "", "creation_timestamp": "2021-07-10T16:29:07.000000Z"}, {"uuid": "78e3d539-e554-49b6-a15f-1176931b90a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24155", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3967", "content": "#exploit\nCVE-2021-24155:\nWordPress Backup Guard Authenticated RCE Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb", "creation_timestamp": "2021-08-01T14:31:01.000000Z"}, {"uuid": "c9637933-ddeb-4df5-bc93-869cfb97de2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24155", "type": "published-proof-of-concept", "source": "https://t.me/cyber0iq/19", "content": "Latest Vulnerabilities and Exploits\n\nCVE-2021-3449 OpenSSL denial-of-service exploit\nhttps://github.com/terorie/cve-2021-3449\n\nProxyToken\nhttps://github.com/bhdresh/CVE-2021-33766-ProxyToken\n\nCVES Xstream-1.4.17\nhttps://github.com/zwjjustdoit/Xstream-1.4.17\n\nCVE-2021-36934/HiveNightmare/SeriousSAM\nhttps://github.com/cube0x0/CVE-2021-36934\n\nHow to exploit a vulnerable windows driver Exploit for AsrDrv104 sys\nhttps://github.com/stong/CVE-2020-15368\n\nCVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel\nhttps://github.com/0vercl0k/CVE-2021-32537\n\nCVE-2021-28476 a guest-to-host \"Hyper-V Remote Code Execution Vulnerability\" in vmswitch sys\nhttps://github.com/0vercl0k/CVE-2021-28476\n\nCVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit\nhttps://github.com/klezVirus/CVE-2021-40444\n\nExploit Accsess network clients by sending packets in wirless TP-LINK and preparing for a mitm attack\nhttps://github.com/lhashashinl/CVE-2021-37152\n\nProof on Concept Exploit for CVE-2021-38647 (OMIGOD)\nhttps://github.com/horizon3ai/CVE-2021-38647\n\nProof of Concept Exploit for vCenter CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\nProof-of-Concept (PoC) script to exploit Pulse Secure CVE-2021-22893\nhttps://github.com/ZephrFish/CVE-2021-22893\n\nCVE-2021-33766 (ProxyToken)\nhttps://github.com/demossl/CVE-2021-33766-ProxyToken\n\nCVE-2021-2456\nhttps://github.com/peterjson31337/CVE-2021-2456\n\nCVE-2021-38647 POC for RCE\nhttps://github.com/midoxnet/CVE-2021-38647\n\nCVE-2021-26084 (PoC) | Confluence Server Webwork OGNL injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\nhttps://github.com/r0ckysec/CVE-2021-26084_Confluence\nhttps://github.com/march0s1as/CVE-2021-26084\n\n\nCVE-2021-21551 Dell Driver EoP\nhttps://github.com/ihack4falafel/Dell-Driver-EoP-CVE-2021-21551\n\nA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nhttps://github.com/lntrx/CVE-2021-28663\n\nCVE-2021-40353 openSIS 8.0 SQL Injection\nhttps://github.com/5qu1n7/CVE-2021-40353\n\nCVE-2021-28476 Ubuntu 20.04\nhttps://github.com/sh4m2hwz/CVE-2021-28476-tools-env\n\nmy exp for chrome V8 CVE-2021-30551\nhttps://github.com/xmzyshypnc/CVE-2021-30551\n\nPOC of CVE-2021-2394\nhttps://github.com/lz2y/CVE-2021-2394\n\nWordPress Backup Guard Authenticated Remote Code Execution Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb\n\nExploit code for CVE-2021-33909,Just a dump of removed\nhttps://github.com/bbinfosec43/CVE-2021-33909", "creation_timestamp": "2021-09-25T02:15:23.000000Z"}, {"uuid": "c97f23f7-1c07-453d-a773-12517b587ee6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24155", "type": "seen", "source": "https://t.me/cissp/3933", "content": "Blue Team Techniques\n1. Ghidra script to decrypt a string array in XOR DDoS\nhttps://maxkersten.nl/binary-analysis-course/analysis-scripts/ghidra-script-to-decrypt-a-string-array-in-xor-ddos\n2. One-stop TLS traffic inspection and manipulation using dynamic instrumentation\nhttps://blog.syss.com/posts/hallucinate\n\nOffensive security\n1. SSRF in Dependabot\nhttps://blog.tyage.net/posts/2021-06-27-dependabot-rce\n\nMalware analysis\nReverse engineer the malware Cryptowall to replicate the PE injection technique\nhttps://malwareunicorn.org/workshops/peinjection.html#0\n]-> https://github.com/malware-unicorn/GoPEInjection\n\nRed Team Tactics\n1. HTTP Server serving obfuscated Powershell Scripts/Payloads\nhttps://github.com/WazeHell/LightMe\n2. Native payload generation and shellcode injection tool that provides support for common platforms and architectures\nhttps://github.com/EntySec/HatVenom\n\nRoot Cause Analysis of a Printer\u2019s Drivers Vulnerability CVE-2021-3438\nhttps://voidsec.com/root-cause-analysis-of-cve-2021-3438\n\nexploit\nCVE-2021-24155:\nWordPress Backup Guard Authenticated RCE Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb", "creation_timestamp": "2026-09-01T17:00:44.194429Z"}, {"uuid": "1e74c5c6-ad3e-45d7-96ea-1401d485b19f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24155", "type": "seen", "source": "https://t.me/cissp/3933", "content": "Blue Team Techniques\n1. Ghidra script to decrypt a string array in XOR DDoS\nhttps://maxkersten.nl/binary-analysis-course/analysis-scripts/ghidra-script-to-decrypt-a-string-array-in-xor-ddos\n2. One-stop TLS traffic inspection and manipulation using dynamic instrumentation\nhttps://blog.syss.com/posts/hallucinate\n\nOffensive security\n1. SSRF in Dependabot\nhttps://blog.tyage.net/posts/2021-06-27-dependabot-rce\n\nMalware analysis\nReverse engineer the malware Cryptowall to replicate the PE injection technique\nhttps://malwareunicorn.org/workshops/peinjection.html#0\n]-> https://github.com/malware-unicorn/GoPEInjection\n\nRed Team Tactics\n1. HTTP Server serving obfuscated Powershell Scripts/Payloads\nhttps://github.com/WazeHell/LightMe\n2. Native payload generation and shellcode injection tool that provides support for common platforms and architectures\nhttps://github.com/EntySec/HatVenom\n\nRoot Cause Analysis of a Printer\u2019s Drivers Vulnerability CVE-2021-3438\nhttps://voidsec.com/root-cause-analysis-of-cve-2021-3438\n\nexploit\nCVE-2021-24155:\nWordPress Backup Guard Authenticated RCE Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb", "creation_timestamp": "2026-09-02T01:04:30.844670Z"}, {"uuid": "8663416e-37e3-4274-92ae-9da5f2b738a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24155", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_plugin_backup_guard_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Nguyen Van Khanh\", \"Ron Jost\", \"Yann Castel (yann.castel \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module allows an attacker with a privileged Wordpress account to launch a reverse shell\\n          due to an arbitrary file upload vulnerability in Wordpress plugin Backup Guard < 1.6.0.\\n          This is due to an incorrect check of the uploaded file extension which should be of SGBP type.\\n          Then, the uploaded payload can be triggered by a call to `/wp-content/uploads/backup-guard/.php`\", \"disclosure_date\": \"2021-05-04\", \"fullname\": \"exploit/multi/http/wp_plugin_backup_guard_rce\", \"is_install_path\": true, \"mod_time\": \"2021-08-27 17:15:33 +0000\", \"name\": \"Wordpress Plugin Backup Guard - Authenticated Remote Code Execution\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/wp_plugin_backup_guard_rce.rb\", \"platform\": \"PHP\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/wp_plugin_backup_guard_rce\", \"references\": [\"EDB-50093\", \"CVE-2021-24155\", \"CWE-434\", \"WPVDB-d442acac-4394-45e4-b6bb-adf4a40960fb\", \"URL-https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2473510%40backup&old=2472212%40backup&sfp_email=&sfph_mail=\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Wordpress Backup Guard < 1.6.0\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:22.006384Z"}, {"uuid": "6b447712-9dc5-47aa-b476-b66c55508208", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24155", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3933", "content": "Blue Team Techniques\n1. Ghidra script to decrypt a string array in XOR DDoS\nhttps://maxkersten.nl/binary-analysis-course/analysis-scripts/ghidra-script-to-decrypt-a-string-array-in-xor-ddos\n2. One-stop TLS traffic inspection and manipulation using dynamic instrumentation\nhttps://blog.syss.com/posts/hallucinate\n\nOffensive security\n1. SSRF in Dependabot\nhttps://blog.tyage.net/posts/2021-06-27-dependabot-rce\n\nMalware analysis\nReverse engineer the malware Cryptowall to replicate the PE injection technique\nhttps://malwareunicorn.org/workshops/peinjection.html#0\n]-> https://github.com/malware-unicorn/GoPEInjection\n\nRed Team Tactics\n1. HTTP Server serving obfuscated Powershell Scripts/Payloads\nhttps://github.com/WazeHell/LightMe\n2. Native payload generation and shellcode injection tool that provides support for common platforms and architectures\nhttps://github.com/EntySec/HatVenom\n\nRoot Cause Analysis of a Printer\u2019s Drivers Vulnerability CVE-2021-3438\nhttps://voidsec.com/root-cause-analysis-of-cve-2021-3438\n\nexploit\nCVE-2021-24155:\nWordPress Backup Guard Authenticated RCE Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb", "creation_timestamp": "2026-09-10T23:00:04.654160Z"}, {"uuid": "65380f18-2459-41c3-a0dc-1494f8c643d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24155", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3933", "content": "Blue Team Techniques\n1. Ghidra script to decrypt a string array in XOR DDoS\nhttps://maxkersten.nl/binary-analysis-course/analysis-scripts/ghidra-script-to-decrypt-a-string-array-in-xor-ddos\n2. One-stop TLS traffic inspection and manipulation using dynamic instrumentation\nhttps://blog.syss.com/posts/hallucinate\n\nOffensive security\n1. SSRF in Dependabot\nhttps://blog.tyage.net/posts/2021-06-27-dependabot-rce\n\nMalware analysis\nReverse engineer the malware Cryptowall to replicate the PE injection technique\nhttps://malwareunicorn.org/workshops/peinjection.html#0\n]-> https://github.com/malware-unicorn/GoPEInjection\n\nRed Team Tactics\n1. HTTP Server serving obfuscated Powershell Scripts/Payloads\nhttps://github.com/WazeHell/LightMe\n2. Native payload generation and shellcode injection tool that provides support for common platforms and architectures\nhttps://github.com/EntySec/HatVenom\n\nRoot Cause Analysis of a Printer\u2019s Drivers Vulnerability CVE-2021-3438\nhttps://voidsec.com/root-cause-analysis-of-cve-2021-3438\n\nexploit\nCVE-2021-24155:\nWordPress Backup Guard Authenticated RCE Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb", "creation_timestamp": "2026-09-11T00:00:09.242092Z"}]}