CVE-2021-45092
72Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 40%
from disclosure to weapon67 days
Published on NVDDec 16
1st PoC+67d
VulnCheck+767d
exploitation probability
40%top 2% of all CVEs
observed exploitation
yesVulnCheck
2 public exploit(s)
Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter.
Affected products
n/a · n/apublic PoCs found — 2
exploitdbwww.exploit-db.com/exploits/50770unverifiedcve_referencepacketstormsecurity.com/files/166068/Thinfinity-VirtualUI-2.5.41.0-IFRAME-Injection.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.