CVE-2021-3831

MEDIUM NUCLEI

gnuboard5 < 5.4.20 - Cross-Site Scripting

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-3831. PoCs published by aratane. A Nuclei detection template is also available.

AI-analyzed exploit summary This PHP script exploits CVE-2021-3831 by generating MD5 hashes and making HTTP requests to a WordPress site to trigger the vulnerability. It interacts with the Redux Framework to execute the exploit chain.

Description

gnuboard5 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploits (1)

nomisec WORKING POC
by aratane · poc
https://github.com/aratane/CVE-2021-3831

This PHP script exploits CVE-2021-3831 by generating MD5 hashes and making HTTP requests to a WordPress site to trigger the vulnerability. It interacts with the Redux Framework to execute the exploit chain.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: WordPress with Redux Framework
No auth needed
Prerequisites: PHP installed · Target URL with vulnerable WordPress and Redux Framework
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Nuclei Templates (1)

Gnuboard 5 - Cross-Site Scripting
MEDIUMVERIFIEDby arafatansari
Shodan: http.html:"gnuboard5"

References (2)

Core 2
Core References
Exploit, Patch, Third Party Advisory x_refsource_confirm
https://huntr.dev/bounties/25775287-88cd-4f00-b978-692d627dff04

Scores

CVSS v3 6.1
EPSS 0.0181
EPSS Percentile 75.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
gnuboard/gnuboard5 < 5.4.20
Published Dec 14, 2021
Tracked Since Feb 18, 2026