Update csp-data-scheme-allowed.yaml

Create csp-data-scheme-allowed.yaml
chore: generate new addition list 🤖
2026-11-07 08:36:19 -10:00 · 2025-12-01 13:22:17 +05:30 · 2025-12-01 13:06:26 +05:30 · 2025-12-01 07:31:25 +00:00 · 2025-12-01 07:31:07 +00:00 · 2025-12-01 07:31:04 +00:00
2811 changed files with 17078 additions and 15690 deletions
@@ -14,11 +14,11 @@ Nuclei Templates
 </p>
      
 <p align="center">
-  <a href="https://nuclei.projectdiscovery.io/templating-guide/">Documentation</a> •
+  <a href="https://docs.projectdiscovery.io/templates/introduction">Documentation</a> •
  <a href="#-contributions">Contributions</a> •
  <a href="#-discussion">Discussion</a> •
  <a href="#-community">Community</a> •
-  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">Join Discord</a>
 </p>

@@ -20,11 +20,11 @@ Nuclei 模板
 </p>

 <p align="center">
-  <a href="https://nuclei.projectdiscovery.io/templating-guide/">文档</a> •
+  <a href="https://docs.projectdiscovery.io/templates/introduction">文档</a> •
  <a href="#-贡献">贡献</a> •
  <a href="#-交流">交流</a> •
  <a href="#-社区">社区</a> •
-  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">加入Discord</a>
 </p>

@@ -11,11 +11,11 @@ Nuclei テンプレート
 </p>
      
 <p align="center">
-  <a href="https://nuclei.projectdiscovery.io/templating-guide/">ドキュメント</a> •
+  <a href="https://docs.projectdiscovery.io/templates/introduction">ドキュメント</a> •
  <a href="#-contributions">貢献</a> •
  <a href="#-discussion">ディスカッション</a> •
  <a href="#-community">コミュニティ</a> •
-  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">Discordに参加</a>
 </p>

@@ -14,11 +14,11 @@ Nuclei 템플릿
 </p>
      
 <p align="center">
-  <a href="https://nuclei.projectdiscovery.io/templating-guide/">가이드 문서</a> •
+  <a href="https://docs.projectdiscovery.io/templates/introduction">가이드 문서</a> •
  <a href="#-contributions">기여</a> •
  <a href="#-discussion">논의</a> •
  <a href="#-community">커뮤니티</a> •
-  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">디스코드</a>
 </p>

@@ -1,49 +1,11 @@
-file/malware/shai-hulud-supply-chain.yaml
-headless/cves/2025/CVE-2025-7901.yaml
-http/cves/2017/CVE-2017-14725.yaml
-http/cves/2017/CVE-2017-17092.yaml
-http/cves/2017/CVE-2017-5983.yaml
-http/cves/2018/CVE-2018-13317.yaml
-http/cves/2019/CVE-2019-19822.yaml
-http/cves/2019/CVE-2019-19823.yaml
-http/cves/2019/CVE-2019-19825.yaml
-http/cves/2021/CVE-2021-34427.yaml
-http/cves/2022/CVE-2022-29081.yaml
-http/cves/2023/CVE-2021-4449.yaml
-http/cves/2024/CVE-2024-20404.yaml
-http/cves/2024/CVE-2024-53995.yaml
-http/cves/2025/CVE-2025-11700.yaml
-http/cves/2025/CVE-2025-11833.yaml
-http/cves/2025/CVE-2025-12055.yaml
-http/cves/2025/CVE-2025-27915.yaml
-http/cves/2025/CVE-2025-49706.yaml
-http/cves/2025/CVE-2025-55523.yaml
-http/cves/2025/CVE-2025-61757.yaml
-http/cves/2025/CVE-2025-64525.yaml
-http/cves/2025/CVE-2025-64764.yaml
-http/cves/2025/CVE-2025-9316.yaml
-http/default-logins/traggo-default-login.yaml
-http/default-logins/vtigercrm-default-login.yaml
-http/exposures/files/vtigercrm-data-exposed.yaml
-http/miscellaneous/crypto-address-detect.yaml
-http/misconfiguration/aem/aem-anonymous-write.yaml
-http/misconfiguration/microsoft/sharepoint-layouts-disclosure.yaml
-http/misconfiguration/microsoft/sharepoint-masterpage-disclosure.yaml
-http/misconfiguration/microsoft/sharepoint-site-metadata-disclosure.yaml
-http/misconfiguration/nginx/nginx-status-403-bypass.yaml
-http/misconfiguration/unauth-akhq-dashboard.yaml
-http/misconfiguration/unauth-hawkeye-dashboard.yaml
-http/misconfiguration/unauth-kafka-config-editor.yaml
-http/technologies/agent-zero-detect.yaml
-http/technologies/cisco-finesse-detect.yaml
-http/technologies/microsoft/sharepoint-web-services-discovery.yaml
-http/technologies/nostromo-detect.yaml
-http/technologies/odoo-detect.yaml
-http/technologies/traggo-server-detect.yaml
-http/technologies/vtigercrm-detect.yaml
-http/technologies/winstone-detect.yaml
-http/vulnerabilities/wordpress/wp-security-hidden-login-exposure.yaml
-http/vulnerabilities/wordpress/wp-twenty-theme-fpd.yaml
-http/vulnerabilities/wordpress/wp-twentysixteen-fpd.yaml
-http/vulnerabilities/wordpress/wp-twentytwenty-fpd.yaml
-http/vulnerabilities/yonyou/yonyou-u9-patchfile-upload.yaml
+CVE-2024-47308.yaml
+dast/vulnerabilities/xss/csp-bypass/google-storage-csp-bypass.yaml
+dns/spf-limit-lookup.yaml
+http/cves/2020/CVE-2020-11732.yaml
+http/cves/2021/CVE-2021-36888.yaml
+http/cves/2023/CVE-2023-30869.yaml
+http/cves/2023/CVE-2023-38875.yaml
+http/cves/2024/CVE-2024-9161.yaml
+http/cves/2025/CVE-2025-10211.yaml
+http/default-logins/redis/redis-commander-default-login.yaml
+http/misconfiguration/kafka-api-cluster.yaml
@@ -36,4 +36,5 @@ files:
  - javascript/enumeration/redis/redis-require-auth.yaml
  - dast/vulnerabilities/sqli/time-based-sqli.yaml
  - javascript/enumeration/minecraft-enum.yaml
-  - javascript/enumeration/minecraft-enum.yaml
+  - http/miscellaneous/crypto-address-detect.yaml
+  - http/vulnerabilities/wp-functions-php-disclosure.yaml
@@ -0,0 +1,44 @@
+id: CVE-2024-47308
+
+info:
+  name: Templately <= 3.1.2 - Broken Access Control
+  author: popcorn94
+  severity: medium
+  description: |
+    Templately allow an attacker to logout users who signed in to their templately account, so you can sign in your templately account to exploit this vulnerability. Go to http://IP/wordpress/wp-admin/admin.php?page=templately&path=sign-in to sign in then logout.
+  impact: |
+    Attackers can access restricted functionalities, potentially leading to unauthorized actions or data exposure.
+  remediation: |
+    Update to the latest version of Templately that addresses this issue.
+  reference:
+    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/templately/templately-312-missing-authorization
+    - https://patchstack.com/database/vulnerability/templately/wordpress-templately-plugin-3-1-2-broken-access-control-vulnerability?_s_id=cve
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
+    cvss-score: 6.5
+    cve-id: CVE-2024-47308
+    cwe-id: CWE-862
+    epss-score: 0.00177
+    epss-percentile: 0.39803
+    cpe: cpe:2.3:a:templately:templately:*:*:*:*:*:wordpress:*:*
+  metadata:
+    verified: true
+    vendor: templately
+    product: templately
+    framework: wordpress
+  tags: cve,cve2024,wpscan,wp-plugin,templately,wordpress,kev,vkev
+
+http:
+  - raw:
+      - |
+        POST /wp-json/templately/v1/logout?_locale=user HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains_all(body, "status\":\"success","message\":\"Logged out.")'
+        condition: and
+# digest: 4a0a0047304502206afbeda5178d6a35e70407cf6c3cadafb228ee9a034da8bcba7358ea6eeeb260022100e80b8f3b4116bdb2c3c9252f8476f554023682ffb3d28e9fcda0002c3e823d30:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@

 ### Additional References:

- [Nuclei Template Creation Guideline](https://nuclei.projectdiscovery.io/templating-guide/)
+- [Nuclei Template Creation Guideline](https://docs.projectdiscovery.io/templates/introduction)
 - [Nuclei Template Matcher Guideline](https://github.com/projectdiscovery/nuclei-templates/wiki/Unique-Template-Matchers)
 - [Nuclei Template Contribution Guideline](https://github.com/projectdiscovery/nuclei-templates/blob/master/CONTRIBUTING.md)
 - [PD-Community Discord server](https://discord.gg/projectdiscovery)
@@ -14,11 +14,11 @@ Nuclei Templates
 </p>
      
 <p align="center">
-  <a href="https://nuclei.projectdiscovery.io/templating-guide/">Documentation</a> •
+  <a href="https://docs.projectdiscovery.io/templates/introduction">Documentation</a> •
  <a href="#-contributions">Contributions</a> •
  <a href="#-discussion">Discussion</a> •
  <a href="#-community">Community</a> •
-  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">Join Discord</a>
 </p>

@@ -20,11 +20,11 @@ Nuclei 模板
 </p>

 <p align="center">
-  <a href="https://nuclei.projectdiscovery.io/templating-guide/">文档</a> •
+  <a href="https://docs.projectdiscovery.io/templates/introduction">文档</a> •
  <a href="#-贡献">贡献</a> •
  <a href="#-交流">交流</a> •
  <a href="#-社区">社区</a> •
-  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">加入Discord</a>
 </p>

@@ -11,11 +11,11 @@ Nuclei テンプレート
 </p>
      
 <p align="center">
-  <a href="https://nuclei.projectdiscovery.io/templating-guide/">ドキュメント</a> •
+  <a href="https://docs.projectdiscovery.io/templates/introduction">ドキュメント</a> •
  <a href="#-contributions">貢献</a> •
  <a href="#-discussion">ディスカッション</a> •
  <a href="#-community">コミュニティ</a> •
-  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">Discordに参加</a>
 </p>

@@ -14,11 +14,11 @@ Nuclei 템플릿
 </p>
      
 <p align="center">
-  <a href="https://nuclei.projectdiscovery.io/templating-guide/">가이드 문서</a> •
+  <a href="https://docs.projectdiscovery.io/templates/introduction">가이드 문서</a> •
  <a href="#-contributions">기여</a> •
  <a href="#-discussion">논의</a> •
  <a href="#-community">커뮤니티</a> •
-  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">디스코드</a>
 </p>

@@ -1 +1 @@
-{"tags":[{"name":"vuln","count":6468},{"name":"cve","count":3587},{"name":"discovery","count":3265},{"name":"vkev","count":1394},{"name":"panel","count":1365},{"name":"xss","count":1269},{"name":"wordpress","count":1261},{"name":"exposure","count":1141},{"name":"wp-plugin","count":1103},{"name":"osint","count":848},{"name":"rce","count":834},{"name":"tech","count":821},{"name":"lfi","count":796},{"name":"misconfig","count":784},{"name":"devops","count":742},{"name":"cloud","count":698},{"name":"wp","count":647},{"name":"detect","count":604},{"name":"edb","count":598},{"name":"wpscan","count":570},{"name":"cve2021","count":552},{"name":"packetstorm","count":551},{"name":"cve2022","count":540},{"name":"cve2023","count":516},{"name":"sqli","count":509},{"name":"cve2024","count":501},{"name":"login","count":475},{"name":"unauth","count":469},{"name":"intrusive","count":462},{"name":"authenticated","count":443},{"name":"kev","count":433},{"name":"file","count":379},{"name":"network","count":350},{"name":"cve2020","count":307},{"name":"oast","count":300},{"name":"default-login","count":288},{"name":"config","count":259},{"name":"tcp","count":255},{"name":"apache","count":252},{"name":"token-spray","count":247},{"name":"microsoft","count":244},{"name":"top-200","count":235},{"name":"osint-social","count":232},{"name":"gcp","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"cve2025","count":218},{"name":"auth-bypass","count":213},{"name":"token","count":213},{"name":"malware","count":213},{"name":"azure","count":210},{"name":"","count":206},{"name":"cve2019","count":204},{"name":"cve2018","count":195},{"name":"iot","count":195},{"name":"aws","count":192},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"csp-bypass","count":189},{"name":"code","count":182},{"name":"amazon","count":174},{"name":"install","count":169},{"name":"redirect","count":162},{"name":"ssrf","count":158},{"name":"keys","count":157},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"security","count":141},{"name":"linux","count":137},{"name":"local","count":134},{"name":"router","count":133},{"name":"ftp","count":133},{"name":"cms","count":127},{"name":"files","count":126},{"name":"cve2017","count":123},{"name":"phishing","count":119},{"name":"cve2010","count":115},{"name":"kubernetes","count":113},{"name":"disclosure","count":106},{"name":"audit","count":102},{"name":"tokens","count":102},{"name":"top-100","count":100},{"name":"js","count":96},{"name":"windows-audit","count":90},{"name":"oss","count":87},{"name":"seclists","count":86},{"name":"oracle","count":85},{"name":"privesc","count":85},{"name":"file-upload","count":84},{"name":"takeover","count":82},{"name":"passive","count":79},{"name":"cisco","count":78},{"name":"enum","count":77},{"name":"windows","count":77},{"name":"fileupload","count":76},{"name":"k8s","count":73},{"name":"adobe","count":69},{"name":"cve2015","count":65},{"name":"detection","count":65},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"vmware","count":63},{"name":"cve2016","count":62},{"name":"deserialization","count":62},{"name":"alibaba","count":61},{"name":"c2","count":61},{"name":"google","count":59},{"name":"atlassian","count":59},{"name":"cve2014","count":55},{"name":"php","count":53},{"name":"dast","count":51},{"name":"traversal","count":51},{"name":"misc","count":51},{"name":"logs","count":50},{"name":"ssti","count":49},{"name":"ssh","count":49},{"name":"osint-gaming","count":49},{"name":"tenable","count":48},{"name":"aem","count":48},{"name":"api","count":48},{"name":"plugin","count":48},{"name":"log4j","count":48},{"name":"debug","count":48},{"name":"hackerone","count":48},{"name":"generic","count":47},{"name":"cnvd","count":47},{"name":"vulhub","count":46},{"name":"injection","count":46},{"name":"ibm","count":46},{"name":"aliyun","count":45},{"name":"fortinet","count":45},{"name":"jndi","count":44},{"name":"kisa","count":44},{"name":"info-leak","count":43},{"name":"springboot","count":43},{"name":"miscellaneous","count":43},{"name":"oa","count":43},{"name":"firewall","count":43},{"name":"ssl","count":43},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"listing","count":41},{"name":"tls","count":41},{"name":"wp-theme","count":41},{"name":"sap","count":40},{"name":"postgresql","count":40},{"name":"k8s-cluster-security","count":39},{"name":"dlink","count":39},{"name":"cti","count":38},{"name":"xxe","count":37},{"name":"jira","count":37},{"name":"devsecops","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-coding","count":36},{"name":"graphql","count":35},{"name":"osint-misc","count":35},{"name":"dns","count":34},{"name":"fuzz","count":34},{"name":"networking","count":34},{"name":"oob","count":34},{"name":"gitlab","count":34},{"name":"printer","count":34},{"name":"yonyou","count":33},{"name":"lfr","count":33},{"name":"vpc","count":31},{"name":"presLine truncated
+{"tags":[{"name":"vuln","count":6497},{"name":"cve","count":3669},{"name":"discovery","count":3263},{"name":"vkev","count":1456},{"name":"panel","count":1370},{"name":"xss","count":1285},{"name":"wordpress","count":1279},{"name":"exposure","count":1162},{"name":"wp-plugin","count":1115},{"name":"rce","count":849},{"name":"osint","count":847},{"name":"tech","count":840},{"name":"misconfig","count":806},{"name":"lfi","count":803},{"name":"devops","count":744},{"name":"cloud","count":700},{"name":"wp","count":657},{"name":"detect","count":619},{"name":"edb","count":598},{"name":"wpscan","count":578},{"name":"cve2021","count":558},{"name":"packetstorm","count":551},{"name":"cve2022","count":542},{"name":"cve2023","count":519},{"name":"cve2024","count":516},{"name":"sqli","count":514},{"name":"unauth","count":495},{"name":"login","count":478},{"name":"intrusive","count":475},{"name":"kev","count":453},{"name":"authenticated","count":452},{"name":"file","count":388},{"name":"network","count":355},{"name":"cve2020","count":308},{"name":"oast","count":308},{"name":"default-login","count":294},{"name":"cve2025","count":264},{"name":"config","count":261},{"name":"tcp","count":259},{"name":"apache","count":253},{"name":"microsoft","count":251},{"name":"token-spray","count":247},{"name":"top-200","count":235},{"name":"gcp","count":232},{"name":"osint-social","count":231},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"auth-bypass","count":223},{"name":"malware","count":214},{"name":"token","count":214},{"name":"azure","count":210},{"name":"cve2019","count":209},{"name":"","count":206},{"name":"cve2018","count":197},{"name":"iot","count":195},{"name":"aws","count":192},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"csp-bypass","count":190},{"name":"code","count":184},{"name":"amazon","count":174},{"name":"install","count":169},{"name":"redirect","count":166},{"name":"ssrf","count":163},{"name":"security","count":161},{"name":"keys","count":157},{"name":"local","count":154},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"linux","count":137},{"name":"router","count":134},{"name":"ftp","count":134},{"name":"cms","count":127},{"name":"files","count":126},{"name":"cve2017","count":125},{"name":"audit","count":122},{"name":"phishing","count":119},{"name":"kubernetes","count":116},{"name":"cve2010","count":115},{"name":"disclosure","count":110},{"name":"tokens","count":102},{"name":"js","count":101},{"name":"top-100","count":100},{"name":"file-upload","count":90},{"name":"windows-audit","count":90},{"name":"oss","count":89},{"name":"oracle","count":88},{"name":"seclists","count":86},{"name":"privesc","count":86},{"name":"takeover","count":83},{"name":"passive","count":83},{"name":"cisco","count":80},{"name":"enum","count":79},{"name":"windows","count":78},{"name":"fileupload","count":77},{"name":"k8s","count":75},{"name":"adobe","count":73},{"name":"cve2015","count":65},{"name":"detection","count":65},{"name":"huntr","count":64},{"name":"deserialization","count":64},{"name":"vmware","count":64},{"name":"ir","count":63},{"name":"cve2016","count":62},{"name":"alibaba","count":61},{"name":"c2","count":61},{"name":"google","count":59},{"name":"atlassian","count":59},{"name":"cve2014","count":55},{"name":"traversal","count":53},{"name":"ssh","count":53},{"name":"aem","count":52},{"name":"php","count":52},{"name":"debug","count":51},{"name":"dast","count":51},{"name":"misc","count":51},{"name":"ssti","count":50},{"name":"logs","count":50},{"name":"osint-gaming","count":49},{"name":"log4j","count":48},{"name":"plugin","count":48},{"name":"tenable","count":48},{"name":"api","count":48},{"name":"injection","count":48},{"name":"hackerone","count":48},{"name":"ibm","count":47},{"name":"fortinet","count":47},{"name":"generic","count":47},{"name":"cnvd","count":46},{"name":"vulhub","count":46},{"name":"aliyun","count":45},{"name":"jndi","count":44},{"name":"kisa","count":44},{"name":"info-leak","count":43},{"name":"springboot","count":43},{"name":"oa","count":43},{"name":"miscellaneous","count":43},{"name":"firewall","count":43},{"name":"ssl","count":43},{"name":"osint-hobby","count":42},{"name":"osint-porn","count":42},{"name":"postgresql","count":41},{"name":"wp-theme","count":41},{"name":"k8s-cluster-security","count":41},{"name":"listing","count":41},{"name":"tls","count":41},{"name":"sap","count":40},{"name":"xxe","count":40},{"name":"dlink","count":39},{"name":"oob","count":39},{"name":"cti","count":38},{"name":"jira","count":38},{"name":"dns","count":38},{"name":"devsecops","count":38},{"name":"osint-coding","count":36},{"name":"graphql","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-misc","count":35},{"name":"dashboard","count":35},{"name":"fuzz","count":35},{"name":"yonyou","count":34},{"name":"networking","count":34},{"name":"printer","count":34},{"name":"gitlab","count":34},{"name":"xwiki","count":34},{"naLine truncated
@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| vuln      |  6468 | dhiyaneshdk   |  1894 | http       |  9281 | info     |  4353 | file |   436 |
-| cve       |  3587 | daffainfo     |   905 | cloud      |   659 | high     |  2552 | dns  |    26 |
-| discovery |  3265 | princechaddha |   854 | file       |   436 | medium   |  2457 |      |       |
-| vkev      |  1394 | dwisiswant0   |   805 | network    |   259 | critical |  1555 |      |       |
-| panel     |  1365 | ritikchaddha  |   678 | code       |   251 | low      |   330 |      |       |
-| xss       |  1269 | pussycat0x    |   675 | dast       |   240 | unknown  |    54 |      |       |
-| wordpress |  1261 | pikpikcu      |   353 | workflows  |   205 |          |       |      |       |
-| exposure  |  1141 | pdteam        |   314 | javascript |    92 |          |       |      |       |
-| wp-plugin |  1103 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
-| osint     |   848 | iamnoooob     |   263 | dns        |    23 |          |       |      |       |
+| vuln      |  6497 | dhiyaneshdk   |  1923 | http       |  9423 | info     |  4395 | file |   445 |
+| cve       |  3669 | daffainfo     |   908 | cloud      |   661 | high     |  2602 | dns  |    27 |
+| discovery |  3263 | princechaddha |   857 | file       |   445 | medium   |  2501 |      |       |
+| vkev      |  1456 | dwisiswant0   |   805 | code       |   275 | critical |  1597 |      |       |
+| panel     |  1370 | ritikchaddha  |   691 | network    |   264 | low      |   342 |      |       |
+| xss       |  1285 | pussycat0x    |   688 | dast       |   241 | unknown  |    54 |      |       |
+| wordpress |  1279 | pikpikcu      |   352 | workflows  |   205 |          |       |      |       |
+| exposure  |  1162 | pdteam        |   316 | javascript |    97 |          |       |      |       |
+| wp-plugin |  1115 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
+| rce       |   849 | iamnoooob     |   263 | dns        |    24 |          |       |      |       |
@@ -15,8 +15,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2017-1000353
    cwe-id: CWE-502
-    epss-score: 0.94475
-    epss-percentile: 0.99998
+    epss-score: 0.94508
+    epss-percentile: 1
    cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
  metadata:
    vendor: jenkins
@@ -104,4 +104,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4a0a00473045022100e1496aea12dd7d8360ca428f1b5f8aaac521642504593625cfdd6fdd50554b6302200cc16c1df502a88f9ce58860fc3a8b491e6c9a4ff33b180a61d215280b97e9b9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220013b6879d7764487c8b88f29158a874858c91a913af2263e70b20f6120607c7e022100907a0683448cf78b2c40b409b2ea20a8f53080bc0433c209b1f27d4f11e042ab:922c64590222798bb761d5b6d8e72950
@@ -55,4 +55,4 @@ code:
          - '!contains(code_1_response, "(root)")'
          - 'contains(code_2_response, "(root)")'
        condition: and
-# digest: 4a0a0047304502205661bfabdeec84cdb0d8cd85f400fdde90013e98f28947af2016ba03a7e95e270221008b847b21e9f65244e274e61e784ce5be03d3c313f744589eca2d93de00634b6b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e3e54ab5bfb2f60d03b6a237019b84cfecb2eace4381bb1b959ae0764f1dce8202203f1220006e8e5d19d69b6e74c701295f2d06c2649a269ee45f38e578750b64f9:922c64590222798bb761d5b6d8e72950
@@ -18,7 +18,7 @@ info:
    cve-id: CVE-2023-49105
    cwe-id: CWE-287
    epss-score: 0.86244
-    epss-percentile: 0.99356
+    epss-percentile: 0.99358
    cpe: cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -90,4 +90,4 @@ http:
      - type: dsl
        dsl:
          - '"Username => "+ username'
-# digest: 490a0046304402204f476545141ffc0526b4e3c7c6d59d2ac7b6bd6737263b3e5c43382c39b3488e0220343b85850dbe3d9c50b8b098109edcfa85d2743f605d6aadc13d6e49d0f72ad1:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022064bf6c2ad8842e4748a494ad37fc9c6ed3aa45bbd444c97da0ac04f51707f2250220355a529df61970068793c273c90042cafe7febca869e17552f3b63a081d40c4b:922c64590222798bb761d5b6d8e72950
@@ -18,7 +18,7 @@ info:
    cve-id: CVE-2023-4911
    cwe-id: CWE-787,CWE-122
    epss-score: 0.69791
-    epss-percentile: 0.98589
+    epss-percentile: 0.98588
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -39,4 +39,4 @@ code:
      - type: word
        words:
          - "139"     # Segmentation Fault Exit Code
-# digest: 490a004630440220155082bb6a73ee722b38f8b1f4ac2aaeda267a117bfb52938ee665784a056c1502203d4e1504fa39a81de29581207a6bb7106978be9db76534a48024d146a3bfcffe:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100fda22f2a21abecbfca41220b7ddb098c3d067bf876adaea3299a761bbe415212022031b1d5e567ebd7a2d42de58b8c1ba25e6c8b84075c5a8229b14bb4b064c8ac16:922c64590222798bb761d5b6d8e72950
@@ -18,7 +18,7 @@ info:
    cve-id: CVE-2023-6246
    cwe-id: CWE-787,CWE-122
    epss-score: 0.31786
-    epss-percentile: 0.96608
+    epss-percentile: 0.96613
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -39,4 +39,4 @@ code:
      - type: word
        words:
          - "127"     # Segmentation Fault Exit Code
-# digest: 4a0a00473045022100bbfa15e8bdc2aa5d8a417f4883e5780d372254d1125a52d1ab0a1ce0e5c8c0aa022031ec4301016dbe92d6cead98440bd7d15786aa40f1005a386e0f4337fcd3f8a4:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207e9256ed81891a41d9328732d8201f3e8ee28729a3b2e9d68122cfe4926ee9c8022100b3177873b36efd3050982e1b2991331e79166c4d4a7b5394f9215da725f034f6:922c64590222798bb761d5b6d8e72950
@@ -14,7 +14,7 @@ info:
    cve-id: CVE-2024-10443
    cwe-id: CWE-77
    epss-score: 0.67268
-    epss-percentile: 0.98481
+    epss-percentile: 0.9848
    cpe: cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*
  metadata:
    verified: true
@@ -54,4 +54,4 @@ code:
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "dns"
-# digest: 4a0a00473045022100909ec94556f8b16006475d760a1911e4a59beaec4a369f95fc71646b6c5567ad02205284d000fddabfb0eb4d3e53c789faa351c731ea5b3d2a7cca511d89992eda52:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100bfd8d4c42a16c2a4554e0506c8ab3bce15999e070a5b0fd56828b0aa4cd0120b02200d20888685c4c5a0038114f804afdfd4f7c6aa89195522bf516eb901d5a6e3ed:922c64590222798bb761d5b6d8e72950
@@ -14,7 +14,7 @@ info:
    cve-id: CVE-2024-12356
    cwe-id: CWE-77
    epss-score: 0.93687
-    epss-percentile: 0.99832
+    epss-percentile: 0.99833
    cpe: cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
  metadata:
    vendor: beyondtrust
@@ -37,4 +37,4 @@ code:
        words:
          - "0 success"
          - "1 try again later"
-# digest: 490a0046304402203d3277e020269d68bc7d538db1582bcc38a518efac4aa57697c30a93f828480502201fbb50e3cd29574a62e3d81ce632e07c322ee30feaa1a14eda3a4ec028a4cf53:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022017cc2e6e4c532a648c389e1ff126125e71eb91bea3193a630f18a41b14d88917022100914eed2beb748e3c34d4da893fbe73260ef12989d00344fa1a4899d172edde2c:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2024-22120
    cwe-id: CWE-20
    epss-score: 0.93259
-    epss-percentile: 0.99791
+    epss-percentile: 0.99789
  metadata:
    max-request: 1
    vendor: zabbix
@@ -71,4 +71,4 @@ code:
      - type: word
        words:
          - "Vulnerable to CVE-2024-22120"
-# digest: 4a0a00473045022100f252e3b49ae5db52b7618d5c2654208aae47358ef7dfec34ac50e4281eebd4c60220695276f5ed29947a82f3afa67e1066d5cb2e66272589168d633e2f54898866c5:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210082eedc7d0aa4fdd14e11e9003c72bb4d7841eec631472ced071c1a54207577d2022100d44bda244e66d710a270dd0f873a281fb00a71e0ec183df01a8b9f4c0880ea5f:922c64590222798bb761d5b6d8e72950
@@ -18,7 +18,7 @@ info:
    cve-id: CVE-2024-3094
    cwe-id: CWE-506
    epss-score: 0.85778
-    epss-percentile: 0.99331
+    epss-percentile: 0.99333
    cpe: cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -59,4 +59,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a00473045022100c10d938a67c70489ce2f679b3c1edca76f59c9b76b8a14973cbcae39272043880220412432fb30cc1ab6715bbd68ddd11c36c56c55e2ad736a047b6c25ea8368eeef:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206c7ef128750bf6a5412284de66a754a5c4d158a6ed4f453de6914a6243b8870c022100eee9b5fd6f45de2fba79e41726e78806e9929b1bac7dc008569a5e9261b1f37b:922c64590222798bb761d5b6d8e72950
@@ -10,8 +10,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2024-4340
-    epss-score: 0.16207
-    epss-percentile: 0.94547
+    epss-score: 0.15162
+    epss-percentile: 0.94328
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4340
  tags: cve,cve2024,py,code,dos,python,sqlparse,vuln
@@ -29,4 +29,4 @@ code:
        part: stderr
        words:
          - "RecursionError: maximum recursion depth exceeded"
-# digest: 4b0a00483046022100c7f17dda36dcd616b5419e65c76face4811aeaabe0f0c266184084bf4f740213022100c459e7c71c25eaa6857cdb4049688a744fb1bea9c6a1ce5d606876a43856b116:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100cdf5c5c5211bb98f06c7f15aa03d473a766be1c49fe62f7243a4a58e0e950402022100cb8bb7b0cf8c9ef3cdfe02e16dab8dd7f5e3a5fed638c060c160c87d64aed2a0:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2024-45409
    cwe-id: CWE-347
    epss-score: 0.39163
-    epss-percentile: 0.97104
+    epss-percentile: 0.97102
  metadata:
    verified: true
    shodan-query: http.title:"GitLab"
@@ -123,4 +123,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 490a0046304402206573dca524aa5cb319dd62380214248d589aa9ea1c2d02f5083ca86e42f3c1160220179f3510f9283e936ad657ac7fe721c1529a1ccf0837bcaca791b576ba073a05:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201f33a302949c7efab4a4fed18d9e8643dc5a51cd79e402b53c441c2e51679eba02201c7112d40761953ff1b5b774a1889534612bda6e4b83583ff29d393d472b6412:922c64590222798bb761d5b6d8e72950
@@ -17,7 +17,7 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-47575
    cwe-id: CWE-306
-    epss-score: 0.93865
+    epss-score: 0.9386
    epss-percentile: 0.99858
    cpe: cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*
  tags: cve,cve2024,fortinet,fortimanager,kev,rce,vkev
@@ -145,4 +145,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a00473045022100c88f6d837fa2686dde19f9b77dab6f5c8a5825c0f1d153e6208f489eca85fee002205b6c68ad4e1dc544604ef0122e9575e3dead2b352d5be36d0eb4ebb3a5b87fb2:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008411e919db94c5087e38b8fc6d6165fd37111b0a9285f1a7bbee58070989e8790221008d8d6623ed0d390724765f65b702777b1cb1585a06d9b183218b412d02c6cd22:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-55556
    cwe-id: CWE-502
-    epss-score: 0.85568
-    epss-percentile: 0.99322
+    epss-score: 0.8111
+    epss-percentile: 0.99106
  metadata:
    verified: true
    max-request: 2
@@ -193,4 +193,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 4a0a00473045022100b6fcc8dbe04df0c042479292d3bdbb04fa90fbd39956165c29588bfdf9f5fbfe0220042629ab78737bbceb9076d29e82159d1a14929893815826330324270a98465b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202c698cf765d4a181bbe9ad719f715db924dfe58f7f90d2bc3aeb42cc300f842f022100994fcf3e4898d95172f1378082c38c856532814691cd3acc23074203c7a5866a:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2024-56331
    cwe-id: CWE-22
    epss-score: 0.41406
-    epss-percentile: 0.97243
+    epss-percentile: 0.9724
  metadata:
    verified: true
    shodan-query: http.title:"Uptime Kuma"
@@ -124,4 +124,4 @@ code:
      - type: word
        words:
          - "/etc/passwd: {'ok': True, 'msg': 'successAdded'"
-# digest: 4a0a0047304502203f480171de008180e091e1c69fb2006c3434e7b60a3094b4caab19c092ba9f2a022100ecc347483a547ca12e83b2813917e34d1d09c2932f96950dbb0d9d29dc19bc19:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a6569df4ef03064dd79062f2f1367dfdf3425f50f6b7904db21edd02bc0700c4022100cfe4adacad47e5f759e6c68e891251888c4ab3d35b253dacd7802cef6af00495:922c64590222798bb761d5b6d8e72950
@@ -10,8 +10,8 @@ info:
    - https://projectdiscovery.io/blog/github-enterprise-saml-authentication-bypass
    - https://github.com/advisories/GHSA-g83h-4727-5rpv
  classification:
-    epss-score: 0.53044
-    epss-percentile: 0.97826
+    epss-score: 0.57271
+    epss-percentile: 0.98025
  metadata:
    verified: true
    shodan-query: title:"GitHub Enterprise"
@@ -188,4 +188,4 @@ http:
      - type: kval
        kval:
          - user_session
-# digest: 4a0a00473045022100aa88f44216574d162c09bcff77b81c0b203d0041324899f1c8d066c81032e45d0220049e79aa14c431d3b4afe4ebcf56cd327f3949c8183bb31b921f0ce9a4026b30:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202bc3c84a22d3d80ac6513d92ecb15b8264fe193f53219f31ab8ebf9ce10e954f022029157c7aeacbc531024feeee39549d65175851df057713d1808757ac7c70284c:922c64590222798bb761d5b6d8e72950
@@ -16,7 +16,7 @@ info:
    - https://towerofhanoi.it/writeups/cve-2025-1550/
  classification:
    epss-score: 0.04785
-    epss-percentile: 0.88996
+    epss-percentile: 0.89055
  metadata:
    max-request: 1
  tags: cve,cve2025,code,keras,rce,ml
@@ -77,4 +77,4 @@ code:
        part: response
        regex:
          - "root:.*:0:0:"
-# digest: 490a0046304402202702fa4fb794de06a6a7fb798def00e5e59d05c49c4465820eb9696ce1d7035d022055d99fa4c72b348988ffa7363abadee5549d20fb36240cf9b6ac322211652178:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100804e0cb99a2b56419d5adc8f8b68ea74f46bd4dc521e81fca6e7b1efe43ae1e90220585d02e2cffd2183f96f46d3d1fdcc5bb23517e119655ea925c9b47ae2021005:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.0
    cve-id: CVE-2025-22457
    cwe-id: CWE-121,CWE-787
-    epss-score: 0.76863
-    epss-percentile: 0.98895
+    epss-score: 0.73531
+    epss-percentile: 0.98743
    cpe: cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*
  metadata:
    vendor: ivanti
@@ -128,4 +128,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 490a0046304402202c5cae79496de4e30915b77c571fa5839b41e803432ca3890748d12311562a0a02206abec4b11a87a39174bfe2672f6fce818e87cc0ef263513d55dee76ebb646a60:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ec9c867b3ff7b861066adcced1fe7de0d1f5ff812ccf5603681b68bebf830884022100b484462113de4ed76f3b3aa286afcefc14b4792924f39c31ef340333b1cc7dd6:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2025-25291
    cwe-id: CWE-347
    epss-score: 0.17247
-    epss-percentile: 0.9476
+    epss-percentile: 0.94763
  metadata:
    verified: true
    vendor: gitlab
@@ -78,4 +78,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 4a0a00473045022100d02dbf992fe6c05fc7cf15e6f638957a05b46bdc14421e9a73a277315636e46202206cf9c278e3e4483d0380149c1cd27f04c6fe03d2766f96a6472b7bc2a5a6525f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200901cd20df7ff672ebbd195dd6d96bed4330f547a1b43d0a7dd2aec5da0f2ba7022100eee044540fed4f6ced1495c8da89cd1f376d94a82c436521d7942b80046a8dc5:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2025-32433
    cwe-id: CWE-306
    epss-score: 0.41165
-    epss-percentile: 0.97228
+    epss-percentile: 0.97225
  metadata:
    verified: true
    max-request: 1
@@ -172,4 +172,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4b0a0048304602210089db0a1b82c25420d5775a0b8983ab84d65a12197d4a55d699699e6a05981174022100e479f8d8134ea9933fa0d0e6d4da76bd50b2063e65dc7000b468b988e841e42a:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022067b736c01047d95898eb434f4fe6301ab456c504aee040aa6342dd2e933e24a302206426b50e203ef2496dd0dde000e4a1be964723bbf79da56b6048404756fd2f35:922c64590222798bb761d5b6d8e72950
@@ -18,7 +18,7 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2025-54309
    epss-score: 0.49642
-    epss-percentile: 0.97665
+    epss-percentile: 0.97664
    cwe-id: CWE-287,CWE-362
    cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*
  metadata:
@@ -200,4 +200,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 4a0a0047304502206f8a0decbbd1459c672aa1bb7894d90045fc531da688cee0129b76714fcb72fa022100e3ef9478a6a4129252b8d7232284f9982ea667e6a19e4752529259b47bd482f5:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008a8dd55bf66f637ca027a8855f2f5818b2b61941d47c02cc4a0de9e64a3217b6022041cd67ffdfe401811fd58f5f98edfb5986e0cda3f5c9a3868e1fb3d62aad110e:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6216
  classification:
-    epss-score: 0.23131
-    epss-percentile: 0.95705
+    epss-score: 0.17485
+    epss-percentile: 0.94809
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-6216
@@ -115,4 +115,4 @@ code:
      - type: dsl  # type of the extractor
        dsl:
          - '"Reset URL: " + code_response'
-# digest: 4b0a00483046022100c6bece7478ac45f88871c6cd3f14651af44d06e06535d8508463675cc7866b31022100b19320a88d18c8d48a7ba4b3a4cc01b24c7dda839140e4c790864b4ca94f0a0e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221009a1eddc925259d2025899fb7729810007d261c5f89abe2e476e444820606fd5a02200365abe621b86062cdd70349c3efd4539973856e988019044f3ac734a63cfaae:922c64590222798bb761d5b6d8e72950
@@ -19,7 +19,7 @@ info:
    cve-id: CVE-2025-9242
    cwe-id: CWE-787,CWE-362
    epss-score: 0.7437
-    epss-percentile: 0.98776
+    epss-percentile: 0.98777
    cpe: cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -552,4 +552,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 490a0046304402200b20b5e843543b5c93b206a8371f1e4ba414338ffba73b9802ce6f607c792a1c022011bdd0baafcaafea5825557eb2878d8301fd5618033a17af7f28316310629452:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c233c6c94743a7d3b12ad897deafc5b3d6b991238260e216746f4b85a8f3757802210094bfa8e92a0793f96f7816e8c93847bebb126dc3a846724a931af80b109f6f2d:922c64590222798bb761d5b6d8e72950
@@ -934,6 +934,7 @@
 {"ID":"CVE-2020-11546","Info":{"Name":"SuperWebmailer 7.21.0.01526 - Remote Code Execution","Severity":"critical","Description":"SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-11546.yaml"}
 {"ID":"CVE-2020-11547","Info":{"Name":"PRTG Network Monitor \u003c20.1.57.1745 - Information Disclosure","Severity":"medium","Description":"PRTG Network Monitor before 20.1.57.1745 is susceptible to information disclosure. An attacker can obtain information about probes running or the server itself via an HTTP request, thus potentially being able to modify data and/or execute unauthorized administrative operations in the context of the affected site.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2020/CVE-2020-11547.yaml"}
 {"ID":"CVE-2020-11710","Info":{"Name":"Kong Admin \u003c=2.03 - Admin API Access","Severity":"critical","Description":"Kong Admin through 2.0.3 contains an issue via docker-kong which makes the admin API port accessible on interfaces other than 127.0.0.1.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-11710.yaml"}
+{"ID":"CVE-2020-11732","Info":{"Name":"Media Library Assistant \u003c 2.82 - Unauthenticated Limited Local File Inclusion","Severity":"high","Description":"Media Library Assistant plugin for WordPress before 2.82 contains a local file inclusion caused by unsanitized mla_gallery link parameter, letting attackers include arbitrary local files, exploit requires access to the vulnerable link.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-11732.yaml"}
 {"ID":"CVE-2020-11738","Info":{"Name":"WordPress Duplicator 1.3.24 \u0026 1.3.26 - Local File Inclusion","Severity":"high","Description":"WordPress Duplicator 1.3.24 \u0026 1.3.26 are vulnerable to local file inclusion vulnerabilities that could allow attackers to download arbitrary files, such as the wp-config.php file. According to the vendor, the vulnerability was only in two\nversions v1.3.24 and v1.3.26, the vulnerability wasn't\npresent in versions 1.3.22 and before.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-11738.yaml"}
 {"ID":"CVE-2020-11798","Info":{"Name":"Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal","Severity":"medium","Description":"A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit could allow an attacker to access sensitive information from the restricted directories.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2020/CVE-2020-11798.yaml"}
 {"ID":"CVE-2020-11853","Info":{"Name":"Micro Focus Operations Bridge Manager \u003c=2020.05 - Remote Code Execution","Severity":"high","Description":"Micro Focus Operations Bridge Manager in versions 2020.05 and below is vulnerable to remote code execution via UCMDB. The vulnerability allows remote attackers to execute arbitrary code on affected installations of Data Center Automation. An attack requires network access and authentication as a valid application user. Originated from Metasploit module (#14654).\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2020/CVE-2020-11853.yaml"}
@@ -1549,6 +1550,7 @@
 {"ID":"CVE-2021-36748","Info":{"Name":"PrestaHome Blog for PrestaShop \u003c1.7.8 - SQL Injection","Severity":"high","Description":"PrestaHome Blog for PrestaShop prior to version 1.7.8 is vulnerable to a SQL injection (blind) via the sb_category parameter.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-36748.yaml"}
 {"ID":"CVE-2021-36749","Info":{"Name":"Apache Druid - Local File Inclusion","Severity":"medium","Description":"Apache Druid ingestion system is vulnerable to local file inclusion. The InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource. This issue was previously mentioned as being fixed in 0.21.0 as per CVE-2021-26920 but was not fixed in 0.21.0 or 0.21.1.","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2021/CVE-2021-36749.yaml"}
 {"ID":"CVE-2021-36873","Info":{"Name":"WordPress iQ Block Country \u003c=1.2.11 - Cross-Site Scripting","Severity":"medium","Description":"WordPress iQ Block Country plugin 1.2.11 and prior contains a cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2021/CVE-2021-36873.yaml"}
+{"ID":"CVE-2021-36888","Info":{"Name":"WordPress Image Hover Ultimate - Unauthenticated Settings Update","Severity":"critical","Description":"Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions \u003c= 9.6.1) WordPress plugin.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-36888.yaml"}
 {"ID":"CVE-2021-37216","Info":{"Name":"QSAN Storage Manager \u003c3.3.3 - Cross-Site Scripting","Severity":"medium","Description":"QSAN Storage Manager before 3.3.3 contains a reflected cross-site scripting vulnerability.  Header page parameters do not filter special characters. Remote attackers can inject JavaScript to access and modify specific data.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-37216.yaml"}
 {"ID":"CVE-2021-37291","Info":{"Name":"KevinLAB BEMS 1.0 - SQL Injection","Severity":"critical","Description":"KevinLAB BEMS 1.0 contains a SQL injection vulnerability. Input passed through input_id POST parameter in /http/index.php is not properly sanitized before being returned to the user or used in SQL queries. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-37291.yaml"}
 {"ID":"CVE-2021-37292","Info":{"Name":"KevinLAB BEMS (Building Energy Management System) - Backdoor Account","Severity":"high","Description":"KevinLAB BEMS has an undocumented backdoor account, and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution through the RMI. An attacker could exploit this vulnerability by logging in using the backdoor account with highest privileges for administration and gain full system control. The backdoor user cannot be seen in the users settings in the admin panel, and it also uses an undocumented privilege level (admin_pk=1) which allows full availability of the features that the BEMS is offering remotely.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2021/CVE-2021-37292.yaml"}
@@ -1679,6 +1681,7 @@
 {"ID":"CVE-2021-44515","Info":{"Name":"Zoho ManageEngine Desktop Central - Remote Code Execution","Severity":"critical","Description":"Zoho ManageEngine Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-44515.yaml"}
 {"ID":"CVE-2021-44528","Info":{"Name":"Open Redirect in Host Authorization Middleware","Severity":"medium","Description":"Specially crafted \"X-Forwarded-Host\" headers in combination with certain \"allowed host\" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-44528.yaml"}
 {"ID":"CVE-2021-44529","Info":{"Name":"Ivanti EPM Cloud Services Appliance Code Injection","Severity":"critical","Description":"Ivanti EPM Cloud Services Appliance (CSA) before version 4.6.0-512 is susceptible to a code injection vulnerability because it allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-44529.yaml"}
+{"ID":"CVE-2021-4462","Info":{"Name":"Employee Records System 1.0 - Unauthenticated File Upload RCE","Severity":"critical","Description":"Employee Records System version 1.0 contains an unrestricted file upload vulnerability in uploadID.php that allows remote unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-4462.yaml"}
 {"ID":"CVE-2021-44848","Info":{"Name":"Thinfinity VirtualUI User Enumeration","Severity":"medium","Description":"Thinfinity VirtualUI (before v3.0), /changePassword returns different responses for requests depending on whether the username exists. It may enumerate OS users (Administrator, Guest, etc.)","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2021/CVE-2021-44848.yaml"}
 {"ID":"CVE-2021-44910","Info":{"Name":"SpringBlade - Information Leakage","Severity":"high","Description":"SpringBlade is a comprehensive project upgraded and optimized from a commercial-grade project, featuring both a SpringCloud distributed microservice architecture and a SpringBoot monolithic microservice architecture. The SpringBlade framework has a default SIGN_KEY, which can be exploited by attackers to obtain sensitive information such as user account password logs.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2021/CVE-2021-44910.yaml"}
 {"ID":"CVE-2021-45027","Info":{"Name":"Oliver 5 Library Server \u003c8.00.008.053 - Local File Inclusion","Severity":"high","Description":"Oliver 5 Library Server versions prior to 8.00.008.053 are vulnerable to local file inclusion via the FileServlet function.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-45027.yaml"}
@@ -2440,6 +2443,7 @@
 {"ID":"CVE-2023-3077","Info":{"Name":"MStore API \u003c 3.9.8 - SQL Injection","Severity":"critical","Description":"The MStore API WordPress plugin before 3.9.8 is vulnerable to Blind SQL injection via the product_id parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-3077.yaml"}
 {"ID":"CVE-2023-30777","Info":{"Name":"Advanced Custom Fields \u003c 6.1.6 - Cross-Site Scripting","Severity":"medium","Description":"Advanced Custom Fields beofre 6.1.6 is susceptible to cross-site scripting via the post_status parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-30777.yaml"}
 {"ID":"CVE-2023-30868","Info":{"Name":"Tree Page View Plugin \u003c 1.6.7 - Cross-Site Scripting","Severity":"medium","Description":"The CMS Tree Page View plugin for WordPress has a Reflected Cross-Site Scripting vulnerability up to version 1.6.7. This is due to the post_type parameter not properly escaping user input. As a result, users with administrator privileges or higher can inject JavaScript code that will execute whenever accessed.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-30868.yaml"}
+{"ID":"CVE-2023-30869","Info":{"Name":"Easy Digital Downloads - Privilege Escalation","Severity":"critical","Description":"Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-30869.yaml"}
 {"ID":"CVE-2023-30943","Info":{"Name":"Moodle - Cross-Site Scripting/Remote Code Execution","Severity":"medium","Description":"The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system. Moodle versions 4.1.x before 4.1.3 and 4.2.x before 4.2.0 are susceptible to an unauthenticated arbitrary folder creation, tracked as CVE-2023-30943. An attacker can leverage the creation of arbitrary folders to carry out a Stored Cross-Site Scripting (XSS) attack on the administration panel, resulting in arbitrary code execution on the server as soon as an administrator visits the panel.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2023/CVE-2023-30943.yaml"}
 {"ID":"CVE-2023-31059","Info":{"Name":"Repetier Server - Directory Traversal","Severity":"high","Description":"Repetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstrated by connectionLost.php.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-31059.yaml"}
 {"ID":"CVE-2023-3139","Info":{"Name":"Protect WP Admin \u003c 4.0 - Unauthenticated Protection Bypass","Severity":"medium","Description":"The Protect WP Admin WordPress plugin before version 4.0 disclosed the URL of the admin panel through the redirection of a crafted URL, bypassing the protection offered.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-3139.yaml"}
@@ -2551,6 +2555,7 @@
 {"ID":"CVE-2023-3849","Info":{"Name":"mooDating 1.2 - Cross-site scripting","Severity":"medium","Description":"A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /find-a-match of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-3849.yaml"}
 {"ID":"CVE-2023-38501","Info":{"Name":"CopyParty v1.8.6 - Cross Site Scripting","Severity":"medium","Description":"Copyparty is a portable file server. Versions prior to 1.8.6 are subject to a reflected cross-site scripting (XSS) Attack.Vulnerability that exists in the web interface of the application could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-38501.yaml"}
 {"ID":"CVE-2023-38646","Info":{"Name":"Metabase \u003c 0.46.6.1 - Remote Code Execution","Severity":"critical","Description":"Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-38646.yaml"}
+{"ID":"CVE-2023-38875","Info":{"Name":"PHP Login System 2.0.1 - Cross-Site Scripting","Severity":"medium","Description":"msaad1999's PHP-Login-System 2.0.1 contains a reflected cross-site scripting caused by unsanitized input in 'validator' parameter in /reset-password, letting remote attackers execute arbitrary JavaScript in a user's browser, exploit requires attacker to craft malicious URL\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-38875.yaml"}
 {"ID":"CVE-2023-38879","Info":{"Name":"openSIS v9.0 - Path Traversal","Severity":"high","Description":"A path traversal vulnerability exists in openSIS Classic Community Edition v9.0 via the 'filename' parameter in DownloadWindow.php. An unauthenticated remote attacker can exploit this to read arbitrary files on the server by manipulating file paths.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-38879.yaml"}
 {"ID":"CVE-2023-38950","Info":{"Name":"ZKTeco BioTime v8.5.5 - Path Traversal","Severity":"high","Description":"A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-38950.yaml"}
 {"ID":"CVE-2023-38964","Info":{"Name":"Academy LMS 6.0 - Cross-Site Scripting","Severity":"medium","Description":"Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability through `query` parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-38964.yaml"}
@@ -3231,6 +3236,7 @@
 {"ID":"CVE-2024-9014","Info":{"Name":"pgAdmin 4 - Authentication Bypass","Severity":"critical","Description":"pgAdmin 4 versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2024/CVE-2024-9014.yaml"}
 {"ID":"CVE-2024-9047","Info":{"Name":"WordPress File Upload \u003c= 4.24.11 - Arbitrary File Read","Severity":"critical","Description":"The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-9047.yaml"}
 {"ID":"CVE-2024-9061","Info":{"Name":"WP Popup Builder Popup Forms and Marketing Lead Generation \u003c= 1.3.5 - Arbitrary Shortcode Execution","Severity":"high","Description":"The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2024/CVE-2024-9061.yaml"}
+{"ID":"CVE-2024-9161","Info":{"Name":"Rank Math SEO \u003c 1.0.229 - Unauthenticated User and Term Metadata Insert/Update/Deletion","Severity":"medium","Description":"Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress contains a missing capability check on 'update_metadata' in all versions up to 1.0.228, letting unauthenticated attackers insert, update, or delete metadata, including user and term metadata, potentially causing loss of access to the admin dashboard.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2024/CVE-2024-9161.yaml"}
 {"ID":"CVE-2024-9166","Info":{"Name":"TitanNit Web Control 2.01/Atemio 7600 - Remote Code Execution","Severity":"critical","Description":"The device contains a command injection caused by the 'getcommand' query in the application, letting unauthorized attackers execute system commands with root privileges, exploit requires attacker to send crafted requests.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-9166.yaml"}
 {"ID":"CVE-2024-9186","Info":{"Name":"Automation By Autonami \u003c 3.3.0 - SQL Injection","Severity":"high","Description":"The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id  parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-9186.yaml"}
 {"ID":"CVE-2024-9193","Info":{"Name":"WHMpress \u003c= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update","Severity":"critical","Description":"The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.3-revision-0 via the whmpress_domain_search_ajax_extended_results() function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. Utilizing the /admin/services.php file, this can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-9193.yaml"}
@@ -3254,6 +3260,8 @@
 {"ID":"CVE-2025-0674","Info":{"Name":"Elber ESE DVB-S/S2 - Authentication Bypass","Severity":"critical","Description":"Multiple Elber products are affected by an authentication bypass vulnerability which allows unauthorized access to the password management functionality. Attackers can exploit this issue by manipulating the endpoint to overwrite any user's password within the system.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-0674.yaml"}
 {"ID":"CVE-2025-0868","Info":{"Name":"DocsGPT - Unauthenticated Remote Code Execution","Severity":"critical","Description":"A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint.This issue affects DocsGPT- from 0.8.1 through 0.12.0.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-0868.yaml"}
 {"ID":"CVE-2025-10035","Info":{"Name":"GoAnywhere - Authentication Bypass","Severity":"critical","Description":"Fortra GoAnywhere MFT contains an insecure deserialization vulnerability in the License Servlet caused by deserializing attacker-controlled objects with a valid forged license response signature, letting attackers perform command injection, exploit requires valid forged license signature.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-10035.yaml"}
+{"ID":"CVE-2025-10204","Info":{"Name":"AC Smart II - Authentication Bypass","Severity":"high","Description":"AC Smart II contains an authentication bypass caused by a hidden password reset form that can be manipulated to change the administrator password without verifying login or permissions, letting attackers change admin passwords without authorization.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-10204.yaml"}
+{"ID":"CVE-2025-10211","Info":{"Name":"ChanCMS \u003c= 3.3.0 - Server-Side Request Forgery","Severity":"medium","Description":"yanyutao0402 ChanCMS 3.3.0 contains a server-side request forgery caused by manipulation of the \"taskUrl\" argument in /cms/collect/getArticle, letting remote attackers make arbitrary requests, exploit requires no special privileges.\n","Classification":{"CVSSScore":"6.3"}},"file_path":"http/cves/2025/CVE-2025-10211.yaml"}
 {"ID":"CVE-2025-1023","Info":{"Name":"ChurchCRM - SQL Injection","Severity":"critical","Description":"A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1023.yaml"}
 {"ID":"CVE-2025-1025","Info":{"Name":"Cockpit \u003c 2.4.1 - Arbitrary File Upload","Severity":"high","Description":"Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extensions to bypass the upload filter.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-1025.yaml"}
 {"ID":"CVE-2025-1035","Info":{"Name":"KLog Server - Path Traversal","Severity":"medium","Description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Komtera Technolgies KLog Server allows Manipulating Web Input to File System Calls.This issue affects KLog Server: before 3.1.1.\n","Classification":{"CVSSScore":"5.7"}},"file_path":"http/cves/2025/CVE-2025-1035.yaml"}
@@ -3268,6 +3276,7 @@
 {"ID":"CVE-2025-12480","Info":{"Name":"Triofox - Improper Access Control","Severity":"critical","Description":"The Gladinet Triofox solution before 12.91.1126.65588 and CentreStack before 12.10.595.65696 allow unauthenticated access to the /management/admindatabase.aspx endpoint, exposing sensitive database management functionality to anyone with network access. An unauthenticated attacker can remotely access, view, and potentially interact with the database management interface, risking data disclosure or system compromise.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-12480.yaml"}
 {"ID":"CVE-2025-1302","Info":{"Name":"JSONPath Plus \u003c 10.3.0 - Remote Code Execution","Severity":"critical","Description":"Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** This is caused by an incomplete fix for [CVE-2024-21534]\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1302.yaml"}
 {"ID":"CVE-2025-1323","Info":{"Name":"WP-Recall – Plugin \u003c= 16.26.10 - Unauthenticated SQL Injection","Severity":"high","Description":"The WP-Recall – Registration, Profile, Commerce \u0026 More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-1323.yaml"}
+{"ID":"CVE-2025-13315","Info":{"Name":"Twonky Server 8.5.2 on Linux and Windows - Log File Exposure","Severity":"critical","Description":"Twonky Server 8.5.2 contains a broken access control vulnerability caused by bypassing web service API authentication, letting unauthenticated attackers read log files with administrator credentials, exploit requires no authentication\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-13315.yaml"}
 {"ID":"CVE-2025-1562","Info":{"Name":"Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control","Severity":"critical","Description":"The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_or_activate_addon_plugins() function and a weak nonce hash in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to install arbitrary plugins on the site that can be leveraged to further infect a vulnerable site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1562.yaml"}
 {"ID":"CVE-2025-1595","Info":{"Name":"EasyCVR \u003c=2.1.2 - Information Disclosure","Severity":"medium","Description":"A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-1595.yaml"}
 {"ID":"CVE-2025-1661","Info":{"Name":"HUSKY – Products Filter Professional for WooCommerce \u003c= 1.3.6.5 - Unauthenticated Local File Inclusion","Severity":"critical","Description":"The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1661.yaml"}
@@ -3460,6 +3469,7 @@
 {"ID":"CVE-2025-57819","Info":{"Name":"FreePBX - Remote Code Execution","Severity":"critical","Description":"FreePBX 15, 16, and 17 contain a remote code execution caused by insufficiently sanitized user-supplied data in endpoints, letting unauthenticated attackers manipulate the database and execute code remotely, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-57819.yaml"}
 {"ID":"CVE-2025-57822","Info":{"Name":"Next.js Middleware - Server-Side Request Forgery","Severity":"medium","Description":"In Next.js prior to versions 14.2.32 and 15.4.7, when request headerswere insecurely passed to NextResponse.next(), an attacker could exploit this behavior to perform Server-Side Request Forgery (SSRF) attacks.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-57822.yaml"}
 {"ID":"CVE-2025-58179","Info":{"Name":"Astro Cloudflare Adapter - Server Side Request Forgery","Severity":"high","Description":"Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URLs it receives, allowing content from unauthorized third-party domains to be served. a A bug in impacted versions of the @astrojs/cloudflare adapter for deployment on Cloudflare’s infrastructure, allows an attacker to bypass the third-party domain restrictions and serve any content from the vulnerable origin.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2025/CVE-2025-58179.yaml"}
+{"ID":"CVE-2025-58360","Info":{"Name":"GeoServer - XML External Entity Injection","Severity":"high","Description":"GeoServer 2.26.0 to 2.26.2 and 2.25.6 contains an XML External Entity (XXE) injection caused by insufficient sanitization of XML input in /geoserver/wms GetMap operation, letting attackers disclose files or cause DoS, exploit requires crafted XML input.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2025/CVE-2025-58360.yaml"}
 {"ID":"CVE-2025-58434","Info":{"Name":"Flowise \u003c= 3.0.5 - Account Takeover","Severity":"critical","Description":"Flowise versions 3.0.5 and earlier had a vulnerability in the forgot-password endpoint, which returned valid reset tokens without authentication—allowing attackers to reset passwords and take over accounts.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-58434.yaml"}
 {"ID":"CVE-2025-58443","Info":{"Name":"FOGProject \u003c= 1.5.10.1673 - Authentication Bypass","Severity":"critical","Description":"FOGProject version 1.5.10.1673 suffers from an authentication bypass vulnerability that allows unauthenticated users to access the management interface without proper authentication. This can lead to unauthorized access to system configuration, host management, and potentially database information.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-58443.yaml"}
 {"ID":"CVE-2025-58751","Info":{"Name":"Vite Dev Server - Path Traversal","Severity":"low","Description":"Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-58751.yaml"}
@@ -1 +1 @@
-a8f8707a5ba704eb87ed0af91bf14b37
+8b6cad70d79d609c964acf8f2bfa0f31
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2018-19518
    cwe-id: CWE-88
    epss-score: 0.93956
-    epss-percentile: 0.99874
+    epss-percentile: 0.99872
  metadata:
    max-request: 1
    confidence: tenative
@@ -49,4 +49,4 @@ http:
        part: interactsh_request
        words:
          - "User-Agent: curl"
-# digest: 490a0046304402204e9b66a3a556a2fac28555598e7ea9413334f57583a53647c662b5c884832f510220431fac3b010ac8412da175dfcead47a45728278d21066570301b5610c64ea2e1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202d0a2da844b9e56ff138dbe16f6cf4df328781f5ecf354df0a6be7e2d6191ccd0221008a6a8b7fe9950843d7bbf8e9c003626dd3de90488f4fb9f1738e3c96fcfbe1f7:922c64590222798bb761d5b6d8e72950
@@ -18,8 +18,8 @@ info:
    cvss-score: 7.3
    cve-id: CVE-2024-2961
    cwe-id: CWE-787
-    epss-score: 0.92923
-    epss-percentile: 0.9976
+    epss-score: 0.92795
+    epss-percentile: 0.9975
  tags: cve,cve2024,php,iconv,glibc,lfr,rce,dast,vkev,vuln

 flow: http(1) && http(2)
@@ -57,4 +57,4 @@ http:
      - type: regex
        regex:
          - "root:x:0:0"
-# digest: 4a0a004730450220048615c2e468bd5e0fbe2e0768cf0f3d80a696628addf9008f4b205e19a465a4022100876603cc4c40fb8f5ccc7574dcc322da4b0b611d34ce18aa84f817776e192406:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ddc9c7ef993ada47ff689a5a1b19964a4ff1390311e521efc3a9232ecdce008b0221009a8d22154bb5a44c90e74f32d20c003737214701a5f517a555ac492a8fab27fe:922c64590222798bb761d5b6d8e72950
@@ -44,8 +44,8 @@ http:
      - type: regex
        regex:
          # MySQL
-          - "SQL syntax.*?MySQL"
-          - "Warning.*?\\Wmysqli?_"
+          - "SQL syntax.{0,500}?MySQL"
+          - "Warning.{0,500}?\\Wmysqli?_"
          - "MySQLSyntaxErrorException"
          - "valid MySQL result"
          - "check the manual that (corresponds to|fits) your MySQL server version"
@@ -65,8 +65,8 @@ http:
          - "is not supported by MemSQL"
          - "unsupported nested scalar subselect"
          # PostgreSQL
-          - "PostgreSQL.*?ERROR"
-          - "Warning.*?\\Wpg_"
+          - "PostgreSQL.{0,500}?ERROR"
+          - "Warning.{0,500}?\\Wpg_"
          - "valid PostgreSQL result"
          - "Npgsql\\."
          - "PG::SyntaxError:"
@@ -78,13 +78,13 @@ http:
          - "Pdo[./_\\\\]Pgsql"
          - "PSQLException"
          # Microsoft SQL Server
-          - "Driver.*? SQL[\\-\\_\\ ]*Server"
-          - "OLE DB.*? SQL Server"
+          - "Driver.{0,500}? SQL[\\-\\_\\ ]*Server"
+          - "OLE DB.{0,500}? SQL Server"
          - "\\bSQL Server[^&lt;&quot;]+Driver"
-          - "Warning.*?\\W(mssql|sqlsrv)_"
+          - "Warning.{0,500}?\\W(mssql|sqlsrv)_"
          - "\\bSQL Server[^&lt;&quot;]+[0-9a-fA-F]{8}"
          - "System\\.Data\\.SqlClient\\.SqlException\\.(SqlException|SqlConnection\\.OnError)"
-          - "(?s)Exception.*?\\bRoadhouse\\.Cms\\."
+          - "(?s)Exception.{0,500}?\\bRoadhouse\\.Cms\\."
          - "Microsoft SQL Native Client error '[0-9a-fA-F]{8}"
          - "\\[SQL Server\\]"
          - "ODBC SQL Server Driver"
@@ -106,8 +106,8 @@ http:
          # Oracle
          - "\\bORA-\\d{5}"
          - "Oracle error"
-          - "Oracle.*?Driver"
-          - "Warning.*?\\W(oci|ora)_"
+          - "Oracle.{0,500}?Driver"
+          - "Warning.{0,500}?\\W(oci|ora)_"
          - "quoted string not properly terminated"
          - "SQL command not properly ended"
          - "macromedia\\.jdbc\\.oracle"
@@ -116,7 +116,7 @@ http:
          - "Pdo[./_\\\\](Oracle|OCI)"
          - "OracleException"
          # IBM DB2
-          - "CLI Driver.*?DB2"
+          - "CLI Driver.{0,500}?DB2"
          - "DB2 SQL error"
          - "\\bdb2_\\w+\\("
          - "SQLCODE[=:\\d, -]+SQLSTATE"
@@ -126,8 +126,8 @@ http:
          - "DB2Exception"
          - "ibm_db_dbi\\.ProgrammingError"
          # Informix
-          - "Warning.*?\\Wifx_"
-          - "Exception.*?Informix"
+          - "Warning.{0,500}?\\Wifx_"
+          - "Exception.{0,500}?Informix"
          - "Informix ODBC Driver"
          - "ODBC Informix driver"
          - "com\\.informix\\.jdbc"
@@ -136,14 +136,14 @@ http:
          - "IfxException"
          # Firebird
          - "Dynamic SQL Error"
-          - "Warning.*?\\Wibase_"
+          - "Warning.{0,500}?\\Wibase_"
          - "org\\.firebirdsql\\.jdbc"
          - "Pdo[./_\\\\]Firebird"
          # SQLite
          - "SQLite/JDBCDriver"
          - "SQLite\\.Exception"
          - "(Microsoft|System)\\.Data\\.SQLite\\.SQLiteException"
-          - "Warning.*?\\W(sqlite_|SQLite3::)"
+          - "Warning.{0,500}?\\W(sqlite_|SQLite3::)"
          - "SQLITE_ERROR"
          - "SQLite error \\d+:"
          - "sqlite3.OperationalError:"
@@ -152,23 +152,23 @@ http:
          - "Pdo[./_\\\\]Sqlite"
          - "SQLiteException"
          # SAP MaxDB
-          - "SQL error.*?POS([0-9]+)"
-          - "Warning.*?\\Wmaxdb_"
+          - "SQL error.{0,500}?POS([0-9]+)"
+          - "Warning.{0,500}?\\Wmaxdb_"
          - "DriverSapDB"
-          - "-3014.*?Invalid end of SQL statement"
+          - "-3014.{0,500}?Invalid end of SQL statement"
          - "com\\.sap\\.dbtech\\.jdbc"
-          - "\\[-3008\\].*?: Invalid keyword or missing delimiter"
+          - "\\[-3008\\].{0,500}?: Invalid keyword or missing delimiter"
          # Sybase
-          - "Warning.*?\\Wsybase_"
+          - "Warning.{0,500}?\\Wsybase_"
          - "Sybase message"
-          - "Sybase.*?Server message"
+          - "Sybase.{0,500}?Server message"
          - "SybSQLException"
          - "Sybase\\.Data\\.AseClient"
          - "com\\.sybase\\.jdbc"
          # Ingres
-          - "Warning.*?\\Wingres_"
+          - "Warning.{0,500}?\\Wingres_"
          - "Ingres SQLSTATE"
-          - "Ingres\\W.*?Driver"
+          - "Ingres\\W.{0,500}?Driver"
          - "com\\.ingres\\.gcf\\.jdbc"
          # FrontBase
          - "Exception (condition )?\\d+\\. Transaction rollback"
@@ -177,7 +177,7 @@ http:
          - "(Semantic|Syntax) error [1-4]\\d{2}\\."
          # HSQLDB
          - "Unexpected end of command in statement \\["
-          - "Unexpected token.*?in statement \\["
+          - "Unexpected token.{0,500}?in statement \\["
          - "org\\.hsqldb\\.jdbc"
          # H2
          - "org\\.h2\\.jdbc"
@@ -230,8 +230,8 @@ http:
      - type: regex
        name: mysql
        regex:
-          - "SQL syntax.*?MySQL"
-          - "Warning.*?\\Wmysqli?_"
+          - "SQL syntax.{0,500}?MySQL"
+          - "Warning.{0,500}?\\Wmysqli?_"
          - "MySQLSyntaxErrorException"
          - "valid MySQL result"
          - "check the manual that (corresponds to|fits) your MySQL server version"
@@ -263,8 +263,8 @@ http:
      - type: regex
        name: postgresql
        regex:
-          - "PostgreSQL.*?ERROR"
-          - "Warning.*?\\Wpg_"
+          - "PostgreSQL.{0,500}?ERROR"
+          - "Warning.{0,500}?\\Wpg_"
          - "valid PostgreSQL result"
          - "Npgsql\\."
          - "PG::SyntaxError:"
@@ -279,13 +279,13 @@ http:
      - type: regex
        name: microsoftsqlserver
        regex:
-          - "Driver.*? SQL[\\-\\_\\ ]*Server"
-          - "OLE DB.*? SQL Server"
+          - "Driver.{0,500}? SQL[\\-\\_\\ ]*Server"
+          - "OLE DB.{0,500}? SQL Server"
          - "\\bSQL Server[^&lt;&quot;]+Driver"
-          - "Warning.*?\\W(mssql|sqlsrv)_"
+          - "Warning.{0,500}?\\W(mssql|sqlsrv)_"
          - "\\bSQL Server[^&lt;&quot;]+[0-9a-fA-F]{8}"
          - "System\\.Data\\.SqlClient\\.SqlException\\.(SqlException|SqlConnection\\.OnError)"
-          - "(?s)Exception.*?\\bRoadhouse\\.Cms\\."
+          - "(?s)Exception.{0,500}?\\bRoadhouse\\.Cms\\."
          - "Microsoft SQL Native Client error '[0-9a-fA-F]{8}"
          - "\\[SQL Server\\]"
          - "ODBC SQL Server Driver"
@@ -313,8 +313,8 @@ http:
        regex:
          - "\\bORA-\\d{5}"
          - "Oracle error"
-          - "Oracle.*?Driver"
-          - "Warning.*?\\W(oci|ora)_"
+          - "Oracle.{0,500}?Driver"
+          - "Warning.{0,500}?\\W(oci|ora)_"
          - "quoted string not properly terminated"
          - "SQL command not properly ended"
          - "macromedia\\.jdbc\\.oracle"
@@ -326,7 +326,7 @@ http:
      - type: regex
        name: ibmdb2
        regex:
-          - "CLI Driver.*?DB2"
+          - "CLI Driver.{0,500}?DB2"
          - "DB2 SQL error"
          - "\\bdb2_\\w+\\("
          - "SQLCODE[=:\\d, -]+SQLSTATE"
@@ -339,8 +339,8 @@ http:
      - type: regex
        name: informix
        regex:
-          - "Warning.*?\\Wifx_"
-          - "Exception.*?Informix"
+          - "Warning.{0,500}?\\Wifx_"
+          - "Exception.{0,500}?Informix"
          - "Informix ODBC Driver"
          - "ODBC Informix driver"
          - "com\\.informix\\.jdbc"
@@ -352,7 +352,7 @@ http:
        name: firebird
        regex:
          - "Dynamic SQL Error"
-          - "Warning.*?\\Wibase_"
+          - "Warning.{0,500}?\\Wibase_"
          - "org\\.firebirdsql\\.jdbc"
          - "Pdo[./_\\\\]Firebird"

@@ -362,7 +362,7 @@ http:
          - "SQLite/JDBCDriver"
          - "SQLite\\.Exception"
          - "(Microsoft|System)\\.Data\\.SQLite\\.SQLiteException"
-          - "Warning.*?\\W(sqlite_|SQLite3::)"
+          - "Warning.{0,500}?\\W(sqlite_|SQLite3::)"
          - "SQLITE_ERROR"
          - "SQLite error \\d+:"
          - "sqlite3.OperationalError:"
@@ -374,19 +374,19 @@ http:
      - type: regex
        name: sapmaxdb
        regex:
-          - "SQL error.*?POS([0-9]+)"
-          - "Warning.*?\\Wmaxdb_"
+          - "SQL error.{0,500}?POS([0-9]+)"
+          - "Warning.{0,500}?\\Wmaxdb_"
          - "DriverSapDB"
-          - "-3014.*?Invalid end of SQL statement"
+          - "-3014.{0,500}?Invalid end of SQL statement"
          - "com\\.sap\\.dbtech\\.jdbc"
-          - "\\[-3008\\].*?: Invalid keyword or missing delimiter"
+          - "\\[-3008\\].{0,500}?: Invalid keyword or missing delimiter"

      - type: regex
        name: sybase
        regex:
-          - "Warning.*?\\Wsybase_"
+          - "Warning.{0,500}?\\Wsybase_"
          - "Sybase message"
-          - "Sybase.*?Server message"
+          - "Sybase.{0,500}?Server message"
          - "SybSQLException"
          - "Sybase\\.Data\\.AseClient"
          - "com\\.sybase\\.jdbc"
@@ -394,9 +394,9 @@ http:
      - type: regex
        name: ingres
        regex:
-          - "Warning.*?\\Wingres_"
+          - "Warning.{0,500}?\\Wingres_"
          - "Ingres SQLSTATE"
-          - "Ingres\\W.*?Driver"
+          - "Ingres\\W.{0,500}?Driver"
          - "com\\.ingres\\.gcf\\.jdbc"

      - type: regex
@@ -411,7 +411,7 @@ http:
        name: hsqldb
        regex:
          - "Unexpected end of command in statement \\["
-          - "Unexpected token.*?in statement \\["
+          - "Unexpected token.{0,500}?in statement \\["
          - "org\\.hsqldb\\.jdbc"

      - type: regex
@@ -494,4 +494,4 @@ http:
          - "SQ200: No table "
          - "Virtuoso S0002 Error"
          - "\\[(Virtuoso Driver|Virtuoso iODBC Driver)\\]\\[Virtuoso Server\\]"
-# digest: 4b0a00483046022100fc7880d1ba52b68e380ae499d88bfb728689d1f8cf19a0b3614da15cff736951022100b90853b96511c04b6ca8fd4ebeaa539b9a100804e46acb3f5beb203f2ff7e575:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b3102693f70190b12ccb6f15140a61b65dd91c218b1e3ea99ea59e75ad8f03170220211591503e0603405ab968f481fb3f615c7c3deb8f5849ac281640b5011fcb30:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,67 @@
+id: google-storage-csp-bypass
+
+info:
+  name: Content-Security-Policy Bypass - Google Storage
+  author: 0x_Akoko
+  severity: medium
+  description: |
+    CSP policy allows Google Storage (storage.googleapis.com) enabling malicious JavaScript execution by loading attacker-controlled files from whitelisted domain.
+  reference:
+    - https://0xn3va.gitbook.io/cheat-sheets/web-application/content-security-policy
+    - https://huntr.com/bounties/6cea89d1-39dc-4023-82fa-821f566b841a
+  metadata:
+    verified: true
+    max-request: 2
+  classification:
+    cwe-id: CWE-79
+  tags: xss,csp-bypass,google-storage,vuln
+
+flow: http(1) && headless(1)
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "Content-Security-Policy"
+          - "storage.googleapis.com"
+        condition: and
+        internal: true
+
+headless:
+  - steps:
+      - action: navigate
+        args:
+          url: "{{BaseURL}}"
+
+      - action: waitdialog
+        name: google_storage_csp_xss
+        args:
+          max-duration: 5s
+
+    payloads:
+      injection:
+        - "<script>alert(document.domain)</script>"
+
+    fuzzing:
+      - part: query
+        type: replace
+        mode: single
+        fuzz:
+          - "{{url_encode(injection)}}"
+
+      - part: path
+        type: replace
+        mode: single
+        fuzz:
+          - "{{url_encode(injection)}}"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "google_storage_csp_xss == true"
+# digest: 490a00463044021f428bef4f94cbadd2d77a3c70e4546b48614d439ba6e919cfb805fc6198b025022100e8b1f79129ce7d5385fa5c255f133de86982b698d5c085eb4e3d602bc59388a4:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,63 @@
+id: jquery-cdn-csp-bypass
+
+info:
+  name: Content-Security-Policy Bypass - jQuery CDN
+  author: 0x_Akoko
+  severity: medium
+  description: |
+    CSP policy allows jQuery CDN which enables arbitrary JavaScript execution through vulnerable jQuery versions using parseHTML or $.get functions.
+  reference:
+    - https://www.doyler.net/security-not-included/csp-bypass-via-jquery
+    - https://github.com/jquery/jquery/issues/2432
+    - https://bugs.jquery.com/ticket/11974
+  metadata:
+    verified: true
+    max-request: 2
+  classification:
+    cwe-id: CWE-79
+  tags: xss,csp-bypass,jquery,vuln
+
+flow: http(1) && headless(1)
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "Content-Security-Policy"
+          - "code.jquery.com"
+        condition: and
+        internal: true
+
+headless:
+  - steps:
+      - action: navigate
+        args:
+          url: "{{BaseURL}}"
+
+      - action: waitdialog
+        name: jquery_csp_xss
+        args:
+          max-duration: 5s
+
+    payloads:
+      injection:
+        - '<script src="https://code.jquery.com/jquery-2.2.4.min.js"></script><script>$.get("data:text/javascript,alert(document.domain)")</script>'
+        - '<script src="https://code.jquery.com/jquery-1.12.4.min.js"></script><div id="x"></div><script>$("#x").html("<img src=x onerror=alert(document.domain)>")</script>'
+
+    fuzzing:
+      - part: query
+        type: replace
+        mode: single
+        fuzz:
+          - "{{url_encode(injection)}}"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "jquery_csp_xss == true"
+# digest: 490a0046304402204dfeb2253ed0a5f3116c1a890920e318b7cca28ac18dd4f56d191f812f2c8f4d022060844041558f1c64441b60814f110186e2c16d65f9778c121aaed40e886e5eda:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,35 @@
+id: spf-limit-lookup
+
+info:
+  name: SPF record DNS lookup limit
+  author: theamanrawat
+  severity: info
+  description: |
+    SPF (Sender Policy Framework) records that exceed the 10 DNS lookup limit was detected. SPF records with more than 10 DNS-based mechanisms may cause SPF authentication failures, leading to potential email delivery issues and spoofing risks.
+  referance:
+    - https://dmarcly.com/blog/spf-permerror-too-many-dns-lookups-when-spf-record-exceeds-10-dns-lookup-limit
+  tags: dns,spf,discovery
+
+dns:
+  - name: "{{FQDN}}"
+    type: TXT
+
+    extractors:
+      - type: regex
+        name: spf_record
+        regex:
+          - 'v=spf1[^\"]*'
+        internal: true
+
+      - type: regex
+        name: spf_record_limit
+        part: spf_record
+        regex:
+          - '(?i)(include|all):?[^ ]*?'
+        internal: true
+
+    matchers:
+      - type: dsl
+        dsl:
+          - len(spf_record_limit)>10
+# digest: 4a0a0047304502203079819041b7312ed0d5b4473d23316e146a94ca65a41d87c9337a1a1dc26b98022100d71dd110e6d4908635e1fb2fe7f090f03892f24115bcebafc4e1b36b04ee0b19:922c64590222798bb761d5b6d8e72950
@@ -22,4 +22,4 @@ file:
          - 'InvalidOperationException'
          - 'UnauthorizedAccessException'
          - 'NotFound'
-# digest: 4b0a00483046022100b332ec49f605b04235b7cf00bc178f319fa3be48be5948859a2650f7d29d96dc022100ac4c8a87b626ab4c11277ab77e45b01f9a7189560af8dda5445cf4d23a84002b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220393cd146a322b1661a5044ca3fd65ef0d208397b29fed65f16877426eaa3c76f022100da126db9a4c1aa4fa69fa3d39cc464a0b372d66cf5e56f70e7e7f8c21ec407c1:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ file:
          - 'BadRequestError'
          - 'MongoError'
          - 'SequelizeDatabaseError'
-# digest: 4a0a0047304502204464c3ceb0c50ca91c6a6bab0329e6c4339af74c41aa1f89e5b05302051c5cb8022100b63e1a4451e430e345b3d7f8430814203d4308fa5fcd5101efd923b01ae17836:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207a3b8cf714f8467d9aeae7694568cea5b09795b2b6c1d1a808b8db1d9abd79500221009fa252b02dd3a95a2d0fcedcf405bf35528fdf1e5d5c5f9712743d1f86fc4098:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2018-25031
    cwe-id: CWE-20
    epss-score: 0.81926
-    epss-percentile: 0.99152
+    epss-percentile: 0.99153
    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -54,4 +54,4 @@ headless:
        words:
          - "swagger"
        case-insensitive: true
-# digest: 4a0a00473045022022a57d7477272f68e9cad11e228f2a6d288e7d908585d2bd85d8d0d1529587d8022100ec7054fc59ba0a78cf90d79644e12939e34556c20b90544b428f86b1df47eca6:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c58a2db5549b42e824f47f6fd010205d520bca965d7a51d61885cc1ab366a550022100db7f453b735cd3ff2911a39652d1d34e88d1375aaea41875cf19e85abd105db6:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2022-29455
    cwe-id: CWE-79
    epss-score: 0.69544
-    epss-percentile: 0.98579
+    epss-percentile: 0.98578
    cpe: cpe:2.3:a:elementor:website_builder:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
@@ -52,4 +52,4 @@ headless:
        words:
          - "elementor"
        case-insensitive: true
-# digest: 4a0a0047304502201904d130bbb1704cfcf458d96c6a9112a4dc3abf1c28e7174d45071b7251c0a7022100c9d288afc522a30d898fae9e1d9e63f20414e89e6a21bb0e338cb5037591e79f:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200330e1b603723e1ced01756776d9b3303c76406fba99423d674a769fc8072e63022004a7e293bc99f12255da4c98daf10c53ff95b0d692ba858af16bdcba57f536c7:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,8 @@ info:
    cvss-score: 7.2
    cve-id: CVE-2024-29882
    cwe-id: CWE-79
-    epss-score: 0.03413
-    epss-percentile: 0.86951
+    epss-score: 0.02542
+    epss-percentile: 0.84972
  metadata:
    verified: true
    max-request: 1
@@ -46,4 +46,4 @@ headless:
          - "ConnectSRS</a>"
        condition: or
        case-insensitive: true
-# digest: 4b0a00483046022100f0ba0b9e4d341022a8a20383260c7cbdf454afc728ab843c304d92cf1eb8bf4802210083d7cddcfaff30b8b5e708171f1e1bff900d0bd997d56a2597ad67845328db12:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210095c6e0e330c40bc8f218d4b7c6aa0b4f793475590c7b15bcfa10a1c286f819390220060ab6972324239af6a1b52bb1dc46a4ceaf664dce52b15cad2c71067492a653:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cvss-score: 7.2
    cve-id: CVE-2024-38526
    epss-score: 0.82064
-    epss-percentile: 0.99159
+    epss-percentile: 0.9916
  tags: cve,cve2024,supply-chain,polyfill,vkev,vuln
 headless:
  - steps:
@@ -60,4 +60,4 @@ headless:
          - "union.macoms.la"
          - "newcrbpc.com"
        part: urls
-# digest: 4a0a00473045022100bf526411eb2ed63b0ee0e8edb373d3929b735c8c7d7ca6f46b84d1981e78e6b2022034381b6f4144eb2611aa00e964d60d9762c0f65c1c6ba20472c4e465898d0ebe:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402203c7db50c71ce0bebfd969223f1334215867ed9d82b28e7c3bbe2bd3653ee9f95022052a1c2ed23d0e26b3ffd2d2ed3aef8491be0af8f6525b6e05216c4751d6c8d83:922c64590222798bb761d5b6d8e72950
@@ -12,7 +12,7 @@ info:
    - https://github.com/Sachinart/essential-addons-for-elementor-xss-poc/blob/main/poc.py
  classification:
    epss-score: 0.03281
-    epss-percentile: 0.86694
+    epss-percentile: 0.86753
  metadata:
    verified: true
    max-request: 1
@@ -42,4 +42,4 @@ headless:
        words:
          - "{{random_int}}"
        case-insensitive: true
-# digest: 490a004630440220192f5825043f682402fddb3fa5f1563cc25be22d92e61af31e9e7faa742ea8550220489cd46e33d480cf5c127ae75034c411f1982da3eac5b4a716beb8d9febdcfa4:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502205795d88a66ca1909064927e6070071070f1dfb80d559ea365e296eb2c671fa6a022100f2d2fbc376df8faf3a28de59397aab648f787953758a58b67694c2343c030309:922c64590222798bb761d5b6d8e72950
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2025-25062
    cwe-id: CWE-79
    epss-score: 0.34064
-    epss-percentile: 0.96787
+    epss-percentile: 0.9679
    cpe: cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*
  metadata:
    max-request: 7
@@ -186,4 +186,4 @@ headless:
        dsl:
          - reflected_text_xss_type
          - reflected_text_xss_message
-# digest: 490a0046304402201a50308fdfe283666031e32a399c2dc0b75543904c9eb4b6b2f96a054c05ec0602200ae4426ed4ebfac2aea5dcee0f2c0a718feae3a8c6b1970f80d21953d410e2ab:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201dad0ea7ed2ee749a02f5cfd382513313e5331ea76f50566c6d7853e07e74c01022100904986a898eacd7c4a392cd6484a90f7e35770ff1b6ad86f8436cf137b2631e1:922c64590222798bb761d5b6d8e72950
@@ -15,7 +15,7 @@ info:
    cve-id: CVE-2025-8191
    cwe-id: CWE-79
    epss-score: 0.01236
-    epss-percentile: 0.78605
+    epss-percentile: 0.7861
    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -65,4 +65,4 @@ headless:
        words:
          - "swagger"
        case-insensitive: true
-# digest: 4b0a00483046022100a72a51f95669d2d3d9bbf9049f8a7b16de946e8db37707c62c59e9dfa8bfa22b022100f5d2abb657c63d1434b85f9acdad8c21855471d2944a6785ca99c639281fb81a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f521fae6d57626767f4dcfaab8c87e6722259ee1cc349842df9acdd97437471202204978b9f443bf9b501514434e4f29633a6ce6c0fbde19b94e726f52ff632d580d:922c64590222798bb761d5b6d8e72950
@@ -69,4 +69,4 @@ Help us improve the credential stuffing templates by contributing new templates,

 Fix issues, add new templates, and update existing ones by submitting a pull request. Always adhere to the best practices for YAML syntax and ensure that your template is tested before submitting.

-Please refer to the template documentation to learn more about writing and submitting new templates to this repository: https://nuclei.projectdiscovery.io/templating-guide/
+Please refer to the template documentation to learn more about writing and submitting new templates to this repository: https://docs.projectdiscovery.io/templates/introduction
@@ -16,7 +16,7 @@ info:
    cvss-score: 5.3
    cve-id: CVE-2000-0114
    epss-score: 0.05458
-    epss-percentile: 0.89763
+    epss-percentile: 0.89819
    cpe: cpe:2.3:a:microsoft:internet_information_server:3.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -59,4 +59,4 @@ http:
        group: 1
        regex:
          - 'version:([0-9.]+)'
-# digest: 4b0a00483046022100f22c77a68f70bef8ea54e891cccac67ec3b836cd88a188f06a7ef0913090c6a1022100b10462741abdb4ffaf924586a4a8df69c1a04f3d9facc96796a7d2375139582e:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e2e09ad459d163b3a06decd8a5dfc4e57edf6fe523578129320ae782bbf6f50c022100d8c7aa43ddcee6a71c3fbc4eb26e6b9c22040c50545b6d83bb0084168a18e842:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N
    cvss-score: 6.4
    cve-id: CVE-2000-0760
-    epss-score: 0.33581
-    epss-percentile: 0.96746
+    epss-score: 0.33099
+    epss-percentile: 0.96711
    cpe: cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -55,4 +55,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100ee147459e569e7326a90299a5191f522252c657a3a1a8c1cc9ec2d5e2005958102206e62605d31c1449561c7e8da5234913a4177e8840cba078ea40c9083c12736e8:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f9281b48fd6b2a460ade1601046afc98345ffedd75571515cb8007cf942b22ab02207825e8150c15714cf489487d6949c52fc7971e2cf20e3e2a07515cee22df0de3:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2002-1131
    cwe-id: CWE-80
    epss-score: 0.03877
-    epss-percentile: 0.87753
+    epss-percentile: 0.87815
    cpe: cpe:2.3:a:squirrelmail:squirrelmail:*:*:*:*:*:*:*:*
  metadata:
    max-request: 5
@@ -60,4 +60,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502201f949ea4bcd01aa8f0a31fe33bb8b9d71f9b18e87606b2f46979cc928e2f5fbe022100b0f080452994d6869f7a3c910450f2252374f9740975e784f6382e90587d2fd1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502205c4b1b39215419cbd6e55b409e29a0d65d5ed017dac6d9e05fa8814e8a6c8643022100c7d4e4147983ecc872e076c947a1ac93d7c7637598fa53a387ec95641a84028b:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2004-0519
    cwe-id: NVD-CWE-Other
    epss-score: 0.00124
-    epss-percentile: 0.32297
+    epss-percentile: 0.32249
    cpe: cpe:2.3:a:sgi:propack:3.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -48,4 +48,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a0046304402202ecbc7256f11908e72c652ec1e3e7d6a68f03e0aa6348941e06ba56714858265022072a6fdb99da647b63d2f3d71b2886bb1db6ee65f33d0c382084898b02703ab0e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202164c6bfbfed6f192ebaf0fecf0f422fc533d8d3710e5adb8dc9181579b1fc38022100c879c8d4b94e9d79f087a6f9ea6a35cd438f9b47be48ac214c8488e22d41aebb:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2004-1965
    cwe-id: NVD-CWE-Other
    epss-score: 0.00265
-    epss-percentile: 0.49765
+    epss-percentile: 0.49697
    cpe: cpe:2.3:a:openbb:openbb:1.0.0_beta1:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -40,4 +40,4 @@ http:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$'
-# digest: 4a0a0047304502203fbdc8b9537943c34a13862071586343d3abd71a48713761c6d1c20054460dfb022100d2c7c6dc2db2bfb5ea131af1f196d8a5e9db2eb9c67f29cdd557b6caa5af13d0:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210084e70edcd03e5308e76a46886cc932d2b520add470a388472ffacac4e6a8b2a5022100c97c8eea3152c8af1bac9aa6ba40c9d38e09ba896684eed2707940f1cfbd2462:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2005-2428
    cwe-id: CWE-200
    epss-score: 0.08605
-    epss-percentile: 0.92065
+    epss-percentile: 0.92077
    cpe: cpe:2.3:a:ibm:lotus_domino:5.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -44,4 +44,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a004730450220022062fafffe1c0dae81442f53887bca863acf193fd8edc72d935dd05bd96fb0022100b67a5fd7d6ded66e7de588b29cda8d7cf8b629a9cb92c3f873287b57c1d28eab:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201656e1c2adb8ef3e62da085b91635659f9913163488f856862099818210b834d022100f1fce53b2113ac49717381a7644b782e6b4dd136fc94602b960f4914128c5d46:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
    cvss-score: 5.4
    cve-id: CVE-2005-3128
    epss-score: 0.01733
-    epss-percentile: 0.81879
+    epss-percentile: 0.81889
    cwe-id: CWE-80
  metadata:
    max-request: 1
@@ -40,4 +40,4 @@ http:
        part: header
        words:
          - "text/html"
-# digest: 490a00463044022042e3bdd031eb59b17e521b46fdb83277eaeff9f7c2b05bea365263c2fe6d07f7022011a3ed8a153d381598d3353404f4e0380f007ced30a16b42737ed49b77eab24f:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100fe2f1038f82e8f8fb91d3cbb3330c7588f57fc980c79db56f550a870bcdd6619022100ac45a783f8e3193777611a33b98e6aad2d581934a149333945f0f4a75584b654:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2005-3344
    cwe-id: NVD-CWE-Other
    epss-score: 0.1015
-    epss-percentile: 0.92816
+    epss-percentile: 0.92823
    cpe: cpe:2.3:a:horde:horde:3.0.4:*:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -47,4 +47,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a004630440220079a0eee39c82e1fc39a498a9cf1b7d876a0c19f5d8b7438b7e96022773e43080220601c2f800eb5c0072b4c8d7aa8b5ae63732d213f8da9e1a8cbe7c8e9c0118e4f:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ba28b6da5b69dcffc1b44a0e75851103b3b5f0f838d92c53ac67ca878586d555022100cfb02f83cb61122bb5f1ac9fc09ec34b831a414e7e352dc3af4c2d25c17c7277:922c64590222798bb761d5b6d8e72950
@@ -23,7 +23,7 @@ info:
    cve-id: CVE-2005-3634
    cwe-id: NVD-CWE-Other
    epss-score: 0.01653
-    epss-percentile: 0.81452
+    epss-percentile: 0.81463
    cpe: cpe:2.3:a:sap:sap_web_application_server:6.10:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -45,4 +45,4 @@ http:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$'
-# digest: 4a0a0047304502210093d32e1dd9de106a0df772255d6e80663e639d67f7f16ceddf0dd8bda32ca6b8022017e055d2c695a53257e7bfab6eebe5d0aa8a61da5653394052eca3f24c5b81a6:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022045aac974798fddaf16263bde2da5ae02b662f9e04c55c8232117eaaff980faf0022019fcc4114eeb7273fb7c765b41f4775c29b81aba65a5a310a7509a030870762b:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2005-4385
    cwe-id: NVD-CWE-Other
    epss-score: 0.00373
-    epss-percentile: 0.58258
+    epss-percentile: 0.58215
    cpe: cpe:2.3:a:cofax:cofax:1.9.9c:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -43,4 +43,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502204e71542f69d8e756162b715dec7f13867b621bc31eb11e144c41bbe592fcd227022100d1f947310f58875b09c6351cb456042a917f03341d58ede67a3b013f56c684f8:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201e455228df7794886a9284373e25fbd5e4a0b602890ec488c3739e0031508778022100e1043450b4f99ad598396d0362dcdc0cb7ad3ed9db4c4a84aaa632046bbbe2b7:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2006-1681
    cwe-id: NVD-CWE-Other
    epss-score: 0.00299
-    epss-percentile: 0.5275
+    epss-percentile: 0.52701
    cpe: cpe:2.3:a:cherokee:cherokee_httpd:0.1:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -62,4 +62,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a00463044022000a1ad51521fc497890c4553e7e2908df5c98a5d2f7eb11171f56dc137277e8a022056cb1a77a7526f84bb56a1e86b3809131ed989a7428313826ac0d34113c20478:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220736e932c9d2f7fcc96542e264ee1e431bbd3ee7caf6e12ff6fd91032cbe4a12502207e0d7c85b4a882aea087885e83f6c5a799afa368b12f9547cbbdf27b43fa04ec:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2006-2842
    cwe-id: CWE-22
    epss-score: 0.0094
-    epss-percentile: 0.75494
+    epss-percentile: 0.75491
    cpe: cpe:2.3:a:squirrelmail:squirrelmail:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -48,4 +48,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502210098efab8714fc275c410546d16ada96c15685a671595b8fbeb8a4acd85562b63802206097871749cfe368f4c713a49bc033b174829fbdb5b853d3be478e63c832780e:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220039f86461e130b8f2c306ead8f9a79bf8e51d0d8b81039b89f39547439116a2502202da2ee1c791cac521943ffa4680390b0ef7af509782354ee684f17d621259575:922c64590222798bb761d5b6d8e72950
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2007-0885
    cwe-id: NVD-CWE-Other
    epss-score: 0.02133
-    epss-percentile: 0.83615
+    epss-percentile: 0.83628
    cpe: cpe:2.3:a:rainbow_portal:rainbow.zen:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -44,4 +44,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a004730450221009ae4b05dfaf8ef0e137f5d31cbfd508cb147b4c918adff7beed0f8f44be7e82d02204d5596d447b62d56c598294b98f7f5a8b226e04a5b715367dfc39a7de94cc18f:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202ccc3d7e4b9194ff2c8a11b8588ea5a0baef377fa72016d0b7949ef12bb68cca02201d0f9c72708380908d31f589b40a44265b8c9d4031f2f69dd0b9016318310131:922c64590222798bb761d5b6d8e72950
@@ -14,7 +14,7 @@ info:
    cvss-score: 7.2
    cwe-id: CWE-79
    epss-score: 0.82646
-    epss-percentile: 0.99185
+    epss-percentile: 0.99187
  metadata:
    max-request: 1
    verified: true
@@ -43,4 +43,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022048c0995c6ea32b2b116f060a6a5b4a54e227c9b9146b8a81217d34f3b1ce6b40022100e3eb4262299a8aee6068b43cce8cc9750d97cd324927a7534e1a613fad911fba:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022013395ca8e005c3af19e52902290e4e3838c6e1c2d426c93123c23eb226bead7702201b33239a28438c31e358cc083b3ca08c97250f9d4ca91d3d86ecab1612bde94e:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2007-4504
    cwe-id: CWE-22
    epss-score: 0.00177
-    epss-percentile: 0.39576
+    epss-percentile: 0.39507
    cpe: cpe:2.3:a:joomla:rsfiles:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -42,4 +42,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a004630440220359e339a299e1466f1de478e54be6b7a8dafa0c16ead24e6bb69000dfbbcdede0220427bd2dc30b5817865da42d4de8646294abfe9db3c33d6ddd72e48aa5dd73cf1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b161b5e3eedfbc22770692baad197934ebb51b2ee7a62331e979c01c95697de5022100c0411f0a36a55b11af10f77b15b0d58dc3bbbffa7d3379231815abf0c13f636b:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2007-4556
    cwe-id: NVD-CWE-Other
    epss-score: 0.02359
-    epss-percentile: 0.84385
+    epss-percentile: 0.84404
    cpe: cpe:2.3:a:opensymphony:xwork:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -51,4 +51,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a004630440220416bc017754b296cd9236b2996fd9b6b9ddb09662d5746ccbf651cce98120f9c022014060ad34e89955f2c4cd645f12e5dfd36022c2eb7854874fe8fd300a77f9eec:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022055432a45cb006dcd5f05564236129aade3eec79098a010b45b149ffa51b5540c02206b45922a69913815947c94b0bfbe470ef08f4d722cb82de5e8660b21a4501f8b:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2007-5728
    cwe-id: CWE-79
    epss-score: 0.00523
-    epss-percentile: 0.66057
+    epss-percentile: 0.66032
    cpe: cpe:2.3:a:phppgadmin:phppgadmin:3.5:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -57,4 +57,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100ec26c83f65a5de7cba1fda662e97c899bffd5bcca254bd27797836425526fa7a022100e482289dd78f282124a366e29a96513dfe8a441db5d0e130b744083a4d3c74d1:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201bf87865fa8ef7e5c8c98b51b068cbee81eede98df1fc8fd74268c98c9e4127602201e111e44f888b781c1389086c86eced564af91a67fdd8b9e469b4a129fb180e3:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2008-1059
    cwe-id: CWE-94
    epss-score: 0.00265
-    epss-percentile: 0.49787
+    epss-percentile: 0.49719
    cpe: cpe:2.3:a:wordpress:sniplets_plugin:1.1.2:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -47,4 +47,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a00463044022064799422910598421f9e507de9b03dff9dc2a88564b81371bb8edd70b8d9328602205857a577dd022a801520bb18db410d39b7e8c38fa57e9b8335cf3bff78503f34:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022009f2c018847568730f4642d3c63d66a7a143376cd642fa1a5361978bcb961b5a022065e2f8d40df3e0f87090107f901545b07c973da5e9fd1af84d6d68613155e552:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 4.3
    cve-id: CVE-2008-1061
    cwe-id: CWE-79
-    epss-score: 0.00155
-    epss-percentile: 0.36753
+    epss-score: 0.00158
+    epss-percentile: 0.37084
    cpe: cpe:2.3:a:wordpress:sniplets_plugin:1.1.2:*:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -62,4 +62,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100c754aea52cb4bacdcaab6819922c663a7c1741c1ee6ed74c918d428a74327d1b022100ab40e48ab367e474b97bc1b71d0aa6cb7bf8e5cd7592daa42a7410ba0979b724:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d457504b3c40a4ab566d0022678a2337fe66d88cae00096d03bfaf241ec7a295022100c9b5f5d8f057354e5ca550ce679a892871f40db8e9c940650458850fa8ff175a:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2008-1547
    cwe-id: CWE-601
    epss-score: 0.65006
-    epss-percentile: 0.98377
+    epss-percentile: 0.98376
    cpe: cpe:2.3:a:microsoft:exchange_server:2003:sp2:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -51,4 +51,4 @@ http:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
-# digest: 4b0a00483046022100a413f0cedbf963231ea0d73117fff517cd57e54303cd703ab01dfdc6d9fd7f31022100c0086853c3833512f8ff16f3f5bbd1ea4a5a7a18ae6cb8a1f290838367622b8f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d6847987b1591e470fc01a73265ff6d795fcc05d65f29cb92cbb77b4136bcc4302204d248c2aa38316b90fd4fb4bb5b19bda47b494432fd1d8dd7a4fce54e4e38d08:922c64590222798bb761d5b6d8e72950
@@ -19,7 +19,7 @@ info:
    cve-id: CVE-2008-2398
    cwe-id: CWE-79
    epss-score: 0.00437
-    epss-percentile: 0.62292
+    epss-percentile: 0.6225
    cpe: cpe:2.3:a:appserv_open_project:appserv:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -47,4 +47,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a0046304402204a6bffd7d5e1ddc0e4b4b1a669d4ab879335968443389b93ea8539ce95f2129d0220185bb2da9e87ab6f58954212a91289f50f7010a7f4db3d935a524c2bb7b6c2c3:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022069be1ca29cfc9eb8c7353a2c586eae57a1fb97503045b011158ecab2b4a8228b02200cc0ade2fe8a688d3d629a9bb34466afda8b907bf245eadad05fdaea122559b9:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2008-2650
    cwe-id: CWE-22
    epss-score: 0.01643
-    epss-percentile: 0.81391
+    epss-percentile: 0.814
    cpe: cpe:2.3:a:cmsimple:cmsimple:3.1:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -48,4 +48,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a0046304402201ad06c997be82763e75fdf225b18b063fad5f8a584ffd5ad9abc4052e0af36e9022001c8787354f7ddf33f4aa9a4904010fe2a75e1e8a2012cad6dc0f52d0cc0fd0e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100bb799eb421bbcc6d39326fc8bcbcf49937366f17c4deadf497076820b227e1730220772649177530ce7d04d4946ee22de80bf82ef35639414c56f4d4b523387d08c8:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2008-4668
    cwe-id: CWE-22
    epss-score: 0.00268
-    epss-percentile: 0.50048
+    epss-percentile: 0.49979
    cpe: cpe:2.3:a:joomla:com_imagebrowser:0.1.5:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -43,4 +43,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a00463044022045299341b276f369afab958d4bb4446351965b6d12e05d51a2fcdb73734987b8022070be80ab407ad3caac02d63ae499ba7aa9b24eec9cb093966329a4793605a30c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502205d0e8535044b0d95537a5e249193892a28ef650499bfb853e5e6bc7bda21a4e602210093d5de4ecd3b21fcbc8034b26cc762466b1ab1a9bad7946e705ad70b0fb69914:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 5
    cve-id: CVE-2008-4764
    cwe-id: CWE-22
-    epss-score: 0.01921
-    epss-percentile: 0.82795
+    epss-score: 0.01041
+    epss-percentile: 0.76778
    cpe: cpe:2.3:a:extplorer:com_extplorer:*:rc2:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -40,4 +40,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100f6797411b1276563f8a0b46b738440b4dfd5930ea42e16900138ec03f2ab9b1f022100fcc60c7b639bb48b7209b3131494beb799450f3e6a58e8e2620558cb0bb4e03c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d429d43d1ddc95908911bd78e005fc320c29614afbc1de774eb3971ab2472f6f022044b1846543a4eea200d821b95acb87a3d5bdf0f55db2a64c434df9c587decfd0:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2008-5587
    cwe-id: CWE-22
    epss-score: 0.01986
-    epss-percentile: 0.83037
+    epss-percentile: 0.83044
    cpe: cpe:2.3:a:phppgadmin:phppgadmin:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -49,4 +49,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100ec3ebe851f50cdb529ac949425288bffb761578294ff1c3213e3aab7d75c477802206d5362d2d31b71509bb57d76b89ef47c2e208d8255ae061299d9f8a1253d893c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204ced44d98f15b41833c32a555eb6bced0378736c0792975ba67c1435ee223d32022100fb91879035e2cf6ae92634a5ea4066112fcf34d22d942e46e64e7e8d317eb493:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2008-6080
    cwe-id: CWE-22
    epss-score: 0.063
-    epss-percentile: 0.90551
+    epss-percentile: 0.90574
    cpe: cpe:2.3:a:codecall:com_ionfiles:4.4.2:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -42,4 +42,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a0046304402207705346b6810c36784b71ce839f969d3304ca910a23fb07abd9a09a6db58d6820220672e2eb02e78a748a544157ee0fa733d7bd9ccb5c1bee227b948e9cc54926df3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e8d34c540ad40c87b383768352c4cecdfc82cf5b4fee9205c44029e0f323ab45022041275a84f616845ede9e551bd1f876910bbedc8122d1a28ab731d155f71d6718:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2008-6172
    cwe-id: CWE-22
    epss-score: 0.07294
-    epss-percentile: 0.91285
+    epss-percentile: 0.91305
    cpe: cpe:2.3:a:weberr:rwcards:3.0.11:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -42,4 +42,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100ef614108534b5eedbdc6185f68080c1442c1da532eee68259515a62bb4329fee02210095694c906eb97f93961d21a690d038074dba78e726a1b072c48c83943563dc06:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402203c6efe9b2e50083b851de69ecad772055a1da106c12c24cd16c703ea8018d6e202200b7c9fd68083a1f48472b3af86f5088322c3abb20906e4dd8384d81fdbe77c9c:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2008-6222
    cwe-id: CWE-22
    epss-score: 0.01649
-    epss-percentile: 0.8143
+    epss-percentile: 0.8144
    cpe: cpe:2.3:a:joomlashowroom:pro_desk_support_center:1.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -42,4 +42,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100f0161b7a93014ddd32d498a88aab85bb8e9d6c4ab4a900926e910f28e8aa26ec0221009895e395447871ead53827c2a642d7709ec6a7c9a238c09dd44c8090acb763b6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502205260f11c6d47ba807642cccbfbdecae9585bdb8199176796f461867694c46e11022100a14ef0eea3887840801114f3df73742d1a5eebc4e9e79b2c257ac942e4519f23:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2008-6465
    cwe-id: CWE-79
    epss-score: 0.01157
-    epss-percentile: 0.77929
+    epss-percentile: 0.77936
    cpe: cpe:2.3:a:parallels:h-sphere:3.0.0:p9:*:*:*:*:*:*
  metadata:
    verified: true
@@ -63,4 +63,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100c7d78546064710358fda0ddbf774c1a5b863d6997e7c85f220eb59c2a70d7511022100c0cf46c7c3a4783373d731d613bb76eb0df36d3c95f54f5be2dc316a4970346f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e06e0f0ed32f9c48f0912b2d90a6ae65eb8077d8e68420c1dc7bb6254e3009ea0220517f9b956040aca430ca30e6166a620b15e9c1278d4498b58416a13ac7e9cc42:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2008-6668
    cwe-id: CWE-22
    epss-score: 0.01077
-    epss-percentile: 0.7715
+    epss-percentile: 0.77155
    cpe: cpe:2.3:a:dirk_bartley:nweb2fax:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -45,4 +45,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502201c466cae8ff26d99bd132bea702c53ee2d605c30a2f11b2a5040bb986ff2b07b02210094a703cae3c322aac2c0299fafa838f393ae32315a840e59bad915ecd6fd6064:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d3155d40608d7365afcc393ba10ae76d6448fc4582db38984a816b1861a5065602203705cce51984fbcb7e4f71cb3e852321d738d72a6b199d6ed33b4d8694cbb23e:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 4.3
    cve-id: CVE-2008-6982
    cwe-id: CWE-79
-    epss-score: 0.08587
-    epss-percentile: 0.92054
+    epss-score: 0.03858
+    epss-percentile: 0.87784
    cpe: cpe:2.3:a:devalcms:devalcms:1.4a:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -51,4 +51,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 4a0a00473045022074d8b74d83102cb8267dd27098cdbd4344c04195812acf5bc945ce2d0b4320c0022100fe8015660a737b543edf577eb9757fdab1d8e816e854bca84e0957096fe61fa3:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c294252ce2110e82d09a238085cd311a46fda41ca583264009d4870d675658b002210093ac62414776364e23bc2ebfaacb6f99267810dbb43a25e98d4d270bb11c3a31:922c64590222798bb761d5b6d8e72950
@@ -18,7 +18,7 @@ info:
    cve-id: CVE-2008-7269
    cwe-id: CWE-20
    epss-score: 0.00653
-    epss-percentile: 0.70101
+    epss-percentile: 0.70078
    cpe: cpe:2.3:a:boka:siteengine:5.0:*:*:*:*:*:*:*
  metadata:
    verified: "true"
@@ -41,4 +41,4 @@ http:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:http?://|//)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
-# digest: 490a0046304402200793b0cd1ea46303ce5f41c43ac7ac582d293eb4c6585906bec43c8bf6bbe87c02200abf49dcdca25584ce00caf68e0c9f47472b36ee012a81379d43481286df693c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100af4e24b7cf8038c94b48dc6e62272eba761c1124c970a511ec4d4e490674a025022032d413fab68ce5e2f9e5af63f24f4c7b9f73410c2d1618fc8fa3d76007b9f285:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2009-0347
    cwe-id: CWE-59
    epss-score: 0.03639
-    epss-percentile: 0.87353
+    epss-percentile: 0.87413
    cpe: cpe:2.3:a:autonomy:ultraseek:_nil_:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -40,4 +40,4 @@ http:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:http?://|//)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
-# digest: 4a0a0047304502205f34e534f7132758cf6c241fab7753a5775aeada15bfb730cb8c21b461631d01022100901ad57143203fdc89571eec376c26a11e87416c59eb73c38ae4cf33e4a29da9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206a89e40ace7a8bd1f39447d22885303cd5e88f7297ad001cc134efbb0877f785022100a09261230728434f057781ea314d1fb366cb19cbec24476297d065163e4d7705:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2009-0932
    cwe-id: CWE-22
    epss-score: 0.05612
-    epss-percentile: 0.89915
+    epss-percentile: 0.89969
    cpe: cpe:2.3:a:debian:horde:3.2:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -43,4 +43,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100977361fd96bf993196bc37fbe4237e35b91ad31ecc313134d9e8b2e4d9dc3b86022054dd2f05241c839505ae15b7623dfa4319900696b1e162ad15b373b4ab685327:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100926c764dce1e5b6b7eba8b40f9bd2e64fff8b205a2ff215a7455631146dc4e65022100d616cb2c7e2a32934a286d80027bfa73c640d452d019667c4c11553dc118f1e9:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2009-1151
    cwe-id: CWE-94
    epss-score: 0.93032
-    epss-percentile: 0.99768
+    epss-percentile: 0.99767
    cpe: cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -58,4 +58,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a004730450220050e650a1739d1ffec219cdb0ee1f50410320f321ea90d5253656ce892d9d78c022100b84a91803030f091403cf8b0236378668737ac6fe9b7ab31e2074525e6e732af:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206e4ff2860b3f054dd2b23bbd9d01cfe48dadb208bb3736b62b46e8ec9199ce94022100aad92825bfb8baa69f7b63bd818e63f844d7402da3d1fd486c011e1db2309e65:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2009-1496
    cwe-id: CWE-22
    epss-score: 0.01473
-    epss-percentile: 0.80349
+    epss-percentile: 0.80354
    cpe: cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -42,4 +42,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100e85ab418b3429c42fb75d9b8f4d97123ef22422e7034fcba41ce4aeec9bfc2d8022063d12736e1e5a8321f98a2e69b38ad1101fcb31fb73a4c015d52bec2892dd797:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009ad038cac668ff35c04dde712283c980082b1388fd0d381a4c4773af28417e0a022100e8fab78edcd3677bd42aa451f84e9eb75cf8dcda9efbb99edb7a050a5aca47bb:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2009-1558
    cwe-id: CWE-22
    epss-score: 0.10881
-    epss-percentile: 0.93093
+    epss-percentile: 0.93092
    cpe: cpe:2.3:h:cisco:wvc54gca:1.00r22:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -43,4 +43,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502210080b03d7686e9150707297c99e85aa415e41e89b59708979834f40c999e5b34ff0220728979b5de3a217aaaa7a7c00ba235f52be1331ea68483f2a386a22a40bbfd48:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206dde91bec4715847cf0d73479a901fb7957f41782a68289eb94e45181364010202203f3716af84e63f06e069083aefd869bc688dc0ce1ac320410eb9080ab6319993:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2009-1872
    cwe-id: CWE-79
    epss-score: 0.08673
-    epss-percentile: 0.92103
+    epss-percentile: 0.92111
    cpe: cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -59,4 +59,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a0048304602210098174cb1b84edc23cd48487c86e65de4a536883dd0335237905a11ed6829b5fa022100ff989f73df0fc66aa78a019d2d6449cdc52ebf505a46663c1a468c9131652ccb:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201a2b5f3d819b1d51343888f7a9a24503a89c87317401ae1550f43055b7c6155302210082cf8bb6a086238fa5ac8de65dd684727d93208e86905c1abc53ad912618261c:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2009-2015
    cwe-id: CWE-22
    epss-score: 0.01674
-    epss-percentile: 0.81565
+    epss-percentile: 0.81577
    cpe: cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -42,4 +42,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022018b111ad09aed614c4ad3e13db0a69622f0ebe66e07bf49c50699c11adf927cb022100c9e6fd82e3c968b2f9ea40b581d07b84351303363990c00290d428d79473bbdd:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100fd16999adc457cdb20f5f68863e56da69913902f636e777257392db7cf8be4020221009a895083d1e7798f3b0efb346833338309cd6325cf0c89790c644dc5117e2820:922c64590222798bb761d5b6d8e72950
@@ -19,7 +19,7 @@ info:
    cve-id: CVE-2009-2100
    cwe-id: CWE-22
    epss-score: 0.01877
-    epss-percentile: 0.82565
+    epss-percentile: 0.82563
    cpe: cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -41,4 +41,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100eff75cd96576d3738af4d650f9a1e798d9b2740b34d8869c6b4833995e5ff9440220653c1d2d811f90a029a8052087dbd595934d4cf42a471f81ca59220185863ac6:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009050ec3ca28b2860541a969184e5ef2bf8b0db3b7e3b884618f34ce18bfbd228022100ad197b9ac6d6a9c60c1c42f4574f5547c5395100f3912bf4416cb987d13e8bf0:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2009-3053
    cwe-id: CWE-22
    epss-score: 0.01573
-    epss-percentile: 0.80966
+    epss-percentile: 0.80972
    cpe: cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -43,4 +43,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100d1761bb0ac2756f287e763fc3c201fffeb5ea7ce0164463be12af42cd266ce60022100cf68ad52f4ef64a98f3c1342a8ebcb5ea331ea2b08a07eb080c3519d0e0449e4:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220534f535b3e0b68d2353c276ad0d863867b3052a33772b054941021c4c3c07bf102200f889fcc53e91334fde8e038025a31eabd75c0990ebef3f84f1b3dce18f046ac:922c64590222798bb761d5b6d8e72950
@@ -42,4 +42,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a004730450220440454aaef806216718fe0f25a25da4d5d5ecfd270bc4699c4be15e22809daae0221008a586d06e5ebf166ac6ee75ac1bed84719adb81cd4e4296c684ab8f741c89f80:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b1d7334098960a3d26dd8d3b50aca04f831ebfe55a9152c6e6f398f4d16462de022100e8037c6546a41b9a4cb8975554bc7de133e4259d9b73caf03b263140a6398e42:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2009-4202
    cwe-id: CWE-22
    epss-score: 0.02099
-    epss-percentile: 0.83502
+    epss-percentile: 0.83507
    cpe: cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -48,4 +48,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a0048304602210092a4d08099c010a7e636d97109f178a04c57573baa153b808297d669fb7643e002210095aafc1f93ed8410f5d8020d87948044119cccdb8d718e027a5cdc7c23128507:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ddb7c0db0db9e0174c6ad1208fdb80a5c2fc716cbfa601306c9506e063c4dc1902200a1db77ce86181c32a77eae8e1a005514b729d1c62da1d336eb145048fcbc1b6:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2009-4223
    cwe-id: CWE-94
    epss-score: 0.04261
-    epss-percentile: 0.88314
+    epss-percentile: 0.88378
    cpe: cpe:2.3:a:gianni_tommasi:kr-php_web_content_server:*:beta_2:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -44,4 +44,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502206550e882f10ad40259f277775faf10710a756325bcb159cda1f51de0e1bf494f022100c1518eab52cd35f5b61ed0df7324e47790232bc1d7406c06a2dab2fb4616a25f:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022066cdfc3f2a02aff7b42e0b11c36bdf4451f3d6fac2e5567e7d47724c22827a5302206ae9fcccdfaf47b0e8666a4be08941274fb7598aed207d60819cf69e078f401d:922c64590222798bb761d5b6d8e72950
@@ -43,4 +43,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100f3c6c71906a54d80a2c35de27939ed9da9fe17d2866db510a8c7f8b36ca95ae0022100b010406ddff4b3cf678e31d32b7724f4d664f2b8e230ef36c86af4ffeba23a0b:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220245e6283c8c35946c6b33c5ff022a2930e5048e11081aae515f26c059ebe673902204f1f0d71909fb2e196a63d9a2d39b795241e3274b17501866836b742f90e88fc:922c64590222798bb761d5b6d8e72950