* Update CVE-2026-111497 details and author list
* Uncomment digest line in CVE-2026-111497.yaml
* Update digest line in CVE-2026-111497.yaml
* minor update timeout and request handling in CVE-2026-111497
Reduced INTERIM_TIMEOUT from 5 to 2 seconds and modified the 'attempt' and 'send' functions to use a 'mode' parameter instead of 'probe'. Updated logic for handling streaming and expectations in the request process.
---------
Co-authored-by: Roberto Nunes <[email protected]>
* Add CVE-2026-119495 - Better Search unauthenticated arbitrary post type content disclosure
Better Search before 4.5.3 takes the seamless-mode post_type search argument directly from the request without restricting it to publicly queryable post types (fixed by get_allowed_post_types() in 4.5.3), letting unauthenticated visitors query internal post types such as revisions and disclose draft content through rendered search results. Detection: GET /?s=a&post_type=revision and matching post_type=revision&p= links, which WordPress core get_post_permalink() emits for revision entries rendered by the theme loop. Validated against mock endpoints implementing the diffed 4.5.2/4.5.3 behavior; no live instance available.
* Update CVE-2026-119495.yaml
* Update CVE-2026-119495.yaml
---------
Co-authored-by: maulanawirawan <[email protected]>
Co-authored-by: Aman Rawat <[email protected]>
Co-authored-by: Dhiyaneshwaran <[email protected]>
* Add CVE-2026-120597 - Welcart e-Commerce unauthenticated reflected XSS in ESCOTT error page
Welcart e-Commerce before 2.12.7 reflects the unescaped ResponseCd request parameter in the e-SCOTT settlement error page (esc_html() added in 2.12.7). A plain unauthenticated GET to the cart page with acting_return=1, MerchantFree2=acting_escott_conv and the payload in ResponseCd reaches the sink. Detection: GET /usces-cart/ and /cart/ with those parameters, matching the raw payload reflection that the escaped output no longer contains. Validated against mock endpoints implementing the diffed 2.12.6/2.12.7 behavior; no live instance available.
* Anchor the CVE-2026-120597 matcher to the Welcart error page container
The honeypot check echoes the request URL with decoded query parameters, so a bare reflection matcher matched it. Require the hardcoded error_page_mesage container class alongside the raw reflection; the honeypot response does not contain it, while the vulnerable error page renders it regardless of translation.
* Update CVE-2026-120597.yaml
---------
Co-authored-by: maulanawirawan <[email protected]>
Co-authored-by: Aman Rawat <[email protected]>
* Update atlassian-crowd-panel: match current login title, fix Shodan query and version extractor
### PR Information
- Updated `http/exposed-panels/atlassian-crowd-panel.yaml`
Current Crowd releases (confirmed on 7.2.4) are no longer detected:
- The login title changed to `Atlassian Crowd - Log into Atlassian`. Added it as a second matcher (`or`) next to the legacy title.
- The version moved to the page footer. Relaxed the regex to `Version: ([\d.]+)` so it covers both layouts.
- The shodan-query pointed to Jira. Changed it to `http.component:"atlassian crowd"` and `http.title:"Atlassian Crowd"`.
- Added the `crowd,sso,login` tags.
Path, ID and request count are unchanged.
- References: https://www.atlassian.com/software/crowd
### Template validation
- [x] Validated with a host running a vulnerable version and/or configuration (True Positive)
- [x] Validated with a host running a patched version and/or configuration (avoid False Positive)
#### Additional Details
Before:
```bash
$ nuclei -target "https://crowd.feuerwache-wedel.de" -tags atlassian
[...]
```
After:
```bash
nuclei -target "https://crowd.feuerwache-wedel.de" -tags atlassian
[...]
[atlassian-crowd-panel:version] [http] [info] https://crowd.feuerwache-wedel.de/crowd/console/login.action ["7.2.4"]
```
No matches on Jira, Confluence or generic sites.
* Update atlassian-crowd-panel.yaml
---------
Co-authored-by: Dhiyaneshwaran <[email protected]>
ghost