* Update CVE-2026-111497 details and author list
* Uncomment digest line in CVE-2026-111497.yaml
* Update digest line in CVE-2026-111497.yaml
* minor update timeout and request handling in CVE-2026-111497
Reduced INTERIM_TIMEOUT from 5 to 2 seconds and modified the 'attempt' and 'send' functions to use a 'mode' parameter instead of 'probe'. Updated logic for handling streaming and expectations in the request process.
---------
Co-authored-by: Roberto Nunes <[email protected]>
* Add CVE-2026-119495 - Better Search unauthenticated arbitrary post type content disclosure
Better Search before 4.5.3 takes the seamless-mode post_type search argument directly from the request without restricting it to publicly queryable post types (fixed by get_allowed_post_types() in 4.5.3), letting unauthenticated visitors query internal post types such as revisions and disclose draft content through rendered search results. Detection: GET /?s=a&post_type=revision and matching post_type=revision&p= links, which WordPress core get_post_permalink() emits for revision entries rendered by the theme loop. Validated against mock endpoints implementing the diffed 4.5.2/4.5.3 behavior; no live instance available.
* Update CVE-2026-119495.yaml
* Update CVE-2026-119495.yaml
---------
Co-authored-by: maulanawirawan <[email protected]>
Co-authored-by: Aman Rawat <[email protected]>
Co-authored-by: Dhiyaneshwaran <[email protected]>
* Add CVE-2026-120597 - Welcart e-Commerce unauthenticated reflected XSS in ESCOTT error page
Welcart e-Commerce before 2.12.7 reflects the unescaped ResponseCd request parameter in the e-SCOTT settlement error page (esc_html() added in 2.12.7). A plain unauthenticated GET to the cart page with acting_return=1, MerchantFree2=acting_escott_conv and the payload in ResponseCd reaches the sink. Detection: GET /usces-cart/ and /cart/ with those parameters, matching the raw payload reflection that the escaped output no longer contains. Validated against mock endpoints implementing the diffed 2.12.6/2.12.7 behavior; no live instance available.
* Anchor the CVE-2026-120597 matcher to the Welcart error page container
The honeypot check echoes the request URL with decoded query parameters, so a bare reflection matcher matched it. Require the hardcoded error_page_mesage container class alongside the raw reflection; the honeypot response does not contain it, while the vulnerable error page renders it regardless of translation.
* Update CVE-2026-120597.yaml
---------
Co-authored-by: maulanawirawan <[email protected]>
Co-authored-by: Aman Rawat <[email protected]>
* Update atlassian-crowd-panel: match current login title, fix Shodan query and version extractor
### PR Information
- Updated `http/exposed-panels/atlassian-crowd-panel.yaml`
Current Crowd releases (confirmed on 7.2.4) are no longer detected:
- The login title changed to `Atlassian Crowd - Log into Atlassian`. Added it as a second matcher (`or`) next to the legacy title.
- The version moved to the page footer. Relaxed the regex to `Version: ([\d.]+)` so it covers both layouts.
- The shodan-query pointed to Jira. Changed it to `http.component:"atlassian crowd"` and `http.title:"Atlassian Crowd"`.
- Added the `crowd,sso,login` tags.
Path, ID and request count are unchanged.
- References: https://www.atlassian.com/software/crowd
### Template validation
- [x] Validated with a host running a vulnerable version and/or configuration (True Positive)
- [x] Validated with a host running a patched version and/or configuration (avoid False Positive)
#### Additional Details
Before:
```bash
$ nuclei -target "https://crowd.feuerwache-wedel.de" -tags atlassian
[...]
```
After:
```bash
nuclei -target "https://crowd.feuerwache-wedel.de" -tags atlassian
[...]
[atlassian-crowd-panel:version] [http] [info] https://crowd.feuerwache-wedel.de/crowd/console/login.action ["7.2.4"]
```
No matches on Jira, Confluence or generic sites.
* Update atlassian-crowd-panel.yaml
---------
Co-authored-by: Dhiyaneshwaran <[email protected]>
Updated the CVE-2026-12583 entry to clarify the vulnerability details and impact, including the potential for Remote Code Execution. Adjusted matchers and example payloads for better accuracy.
The template matched any Appsmith instance because /api/v1/tenants/current
and /api/v1/consolidated-api/view intentionally stay reachable without
authentication (the login page uses them) and still return a 200 JSON
body after the fix. The fix in appsmithorg/appsmith#41598 (shipped in
v1.98) instead:
- removes instanceId and adminEmailDomainHash from those two responses
for anonymous callers
- makes /api/v1/users/features return 401 for anonymous callers
Split the request so that the first two endpoints only match when one of
the removed fields is present, and /api/v1/users/features only matches
on an unauthenticated 200.
Verified: no match against a patched v1.99 instance (previously matched
on 2 URLs); matches against responses in the pre-fix shape.
Co-authored-by: Claude Fable 5.1 <[email protected]>
ghost