cve/2021/CVE-2021-45092.md

CVE-2021-45092

Description

Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter.

POC

Reference

• http://packetstormsecurity.com/files/166068/Thinfinity-VirtualUI-2.5.41.0-IFRAME-Injection.html

Github

• https://github.com/20142995/nuclei-templates
• https://github.com/ARPSyndicate/cvemon
• https://github.com/ARPSyndicate/kenzer-templates
• https://github.com/Enes4xd/Enes4xd
• https://github.com/cr0ss2018/cr0ss2018
• https://github.com/danielmofer/nuclei_templates
• https://github.com/dnlmrls/nuclei_templates
• https://github.com/enesamaafkolan/enesamaafkolan
• https://github.com/ezelnur6327/Enes4xd
• https://github.com/ezelnur6327/enesamaafkolan
• https://github.com/ezelnur6327/ezelnur6327