lint - fix

SSH - Detection
2026-11-07 16:39:20 -10:00 · 2025-12-13 16:49:43 +05:30 · 2025-11-06 18:43:32 +05:30
3031 changed files with 10222 additions and 11511 deletions
@@ -1,36 +1,5 @@
-cloud/kubernetes/security-compliance/k8s-controller-manager-bind-address.yaml
-cloud/kubernetes/security-compliance/k8s-scheduler-bind-address.yaml
 code/cves/2024/CVE-2024-47575.yaml
-code/cves/2025/CVE-2025-1550.yaml
-code/macos/audit/auto-login-enabled.yaml
-code/macos/audit/filevault-disabled.yaml
-code/macos/audit/firewall-disabled.yaml
-code/macos/audit/gatekeeper-disabled.yaml
-code/macos/audit/guest-user-enabled.yaml
-code/macos/audit/insecure-cron-jobs.yaml
-code/macos/audit/insecure-etc-exports-permissions.yaml
-code/macos/audit/insecure-etc-fstab-permissions.yaml
-code/macos/audit/insecure-etc-hostconfig-permissions.yaml
-code/macos/audit/insecure-etc-inetd-conf-permissions.yaml
-code/macos/audit/insecure-homebrew-permissions.yaml
-code/macos/audit/insecure-launchd-jobs.yaml
-code/macos/audit/insecure-startup-items.yaml
-code/macos/audit/insecure-sudo-timestamp.yaml
-code/macos/audit/insecure-sudoers-permissions.yaml
-code/macos/audit/insecure-tty-permissions.yaml
-code/macos/audit/insecure-umask.yaml
-code/macos/audit/sip-disabled.yaml
-code/macos/audit/ssh-service-running.yaml
-code/macos/audit/suid-sgid-files.yaml
 code/misconfiguration/dns-axfr-enabled.yaml
-file/android/deep-link-custom-scheme-detect.yaml
-file/android/exported-activities.yaml
-file/android/exported-broadcast-receivers.yaml
-file/android/exported-providers.yaml
-file/android/exported-services.yaml
-file/android/webview-file-access-fromfileurl-java.yaml
-file/android/webview-file-access-java.yaml
-file/android/webview-universal-access-java.yaml
 http/cves/2018/CVE-2018-6882.yaml
 http/cves/2019/CVE-2019-11507.yaml
 http/cves/2021/CVE-2021-41419.yaml
@@ -38,7 +7,6 @@ http/cves/2021/CVE-2021-45467.yaml
 http/cves/2022/CVE-2022-26143.yaml
 http/cves/2023/CVE-2023-2437.yaml
 http/cves/2023/CVE-2023-34048.yaml
-http/cves/2023/CVE-2023-39121.yaml
 http/cves/2024/CVE-2024-0799.yaml
 http/cves/2024/CVE-2024-0801.yaml
 http/cves/2024/CVE-2024-10146.yaml
@@ -46,21 +14,13 @@ http/cves/2024/CVE-2024-11238.yaml
 http/cves/2024/CVE-2024-27443.yaml
 http/cves/2024/CVE-2024-28623.yaml
 http/cves/2024/CVE-2024-4180.yaml
-http/cves/2024/CVE-2024-50857.yaml
-http/cves/2024/CVE-2024-53900.yaml
 http/cves/2024/CVE-2024-6690.yaml
 http/cves/2025/CVE-2025-1023.yaml
-http/cves/2025/CVE-2025-12480.yaml
 http/cves/2025/CVE-2025-1302.yaml
 http/cves/2025/CVE-2025-24354.yaml
-http/cves/2025/CVE-2025-31486.yaml
 http/cves/2025/CVE-2025-32429.yaml
 http/cves/2025/CVE-2025-41243.yaml
-http/cves/2025/CVE-2025-4302.yaml
-http/cves/2025/CVE-2025-44136.yaml
-http/cves/2025/CVE-2025-44137.yaml
 http/cves/2025/CVE-2025-51482.yaml
-http/cves/2025/CVE-2025-51990.yaml
 http/cves/2025/CVE-2025-52472.yaml
 http/cves/2025/CVE-2025-52665.yaml
 http/cves/2025/CVE-2025-54236.yaml
@@ -73,29 +33,16 @@ http/cves/2025/CVE-2025-6174.yaml
 http/cves/2025/CVE-2025-61884.yaml
 http/cves/2025/CVE-2025-6403.yaml
 http/cves/2025/CVE-2025-64095.yaml
-http/cves/2025/CVE-2025-8943.yaml
 http/cves/2025/CVE-2025-9985.yaml
 http/default-logins/churchcrm/churchcrm-default-login.yaml
-http/exposed-panels/cascade-cms-panel.yaml
 http/exposed-panels/churchcrm-panel.yaml
-http/exposed-panels/monsta-ftp-detect.yaml
-http/exposed-panels/unifi-os-panel.yaml
 http/exposures/backups/generic-php-files.yaml
 http/misconfiguration/aem/aem-dispatcher-bypass.yaml
 http/misconfiguration/aem/aem-querybuilder-bypass.yaml
-http/misconfiguration/cockroachdb-information-disclosure.yaml
-http/misconfiguration/cockroachdb-unauth-exposure.yaml
 http/misconfiguration/installer/churchcrm-installer.yaml
-http/misconfiguration/servicenow-stats-page.yaml
-http/misconfiguration/servicenow-threads-page.yaml
 http/misconfiguration/tomcat-snoop-servlet-exposed.yaml
 http/takeovers/mailgun-takeover.yaml
-http/vulnerabilities/bentoml-ssrf.yaml
 http/vulnerabilities/generic/xss-uri-reflected.yaml
-http/vulnerabilities/gradio-image-ssrf.yaml
-http/vulnerabilities/gradio-lfi.yaml
-http/vulnerabilities/smuggling/cl-te-http-smuggling.yaml
-http/vulnerabilities/smuggling/te-cl-http-smuggling.yaml
 http/vulnerabilities/unifi/unifi-create-user.yaml
 http/vulnerabilities/unifi/unifi-nfc-credentials.yaml
 javascript/cves/2019/CVE-2019-6443.yaml
@@ -104,5 +51,4 @@ javascript/misconfiguration/mqtt-uauth-broker.yaml
 javascript/udp/misconfiguration/ntp-enum-variables-enabled.yaml
 network/cves/2020/CVE-2020-14644.yaml
 network/cves/2024/CVE-2024-23108.yaml
-network/detection/adsb-ultrafeeder-detect.yaml
 network/detection/rtl-tcp-server-detect.yaml
@@ -1,4 +1,4 @@
-### PR Information
+### Template / PR Information

 <!-- Explains the information and/or motivation for update or/ creating this templates -->
 <!-- Please include any reference to your template if available -->
@@ -6,17 +6,17 @@
 - Fixed CVE-2020-XXX / Added CVE-2020-XXX / Updated CVE-2020-XXX
 - References:

-### Template validation
+### Template Validation

-<!-- Clarifies if the valdation of the template was done on an actual system for which the template was developed -->
-<!-- If this concerns a vulnerability check, please clarify if validation was done on a known vulnerable system and optionally on a known not vulnerable system to avoid false positives -->
+I've validated this template locally?
+- [ ] YES
+- [ ] NO

- [ ] Validated with a host running a vulnerable version and/or configuration (True Positive)
- [ ] Validated with a host running a patched version and/or configuration (avoid False Positive)

 #### Additional Details (leave it blank if not applicable)

-<!-- Include `nuclei -debug` output along with Shodan / Fofa / Google Query / Docker or screenshots if available -->
+<!-- Include Shodan / Fofa / Google Query / Docker / Screenshots if available -->
+<!-- Include HTTP/TCP/DNS Matched response data snippet if available -->
 <!-- Please do NOT include vulnerable host information in pull requests -->
 <!-- None of the prerequisites are obligatory; they are merely intended to speed the review process. -->

@@ -25,4 +25,4 @@
 - [Nuclei Template Creation Guideline](https://nuclei.projectdiscovery.io/templating-guide/)
 - [Nuclei Template Matcher Guideline](https://github.com/projectdiscovery/nuclei-templates/wiki/Unique-Template-Matchers)
 - [Nuclei Template Contribution Guideline](https://github.com/projectdiscovery/nuclei-templates/blob/master/CONTRIBUTING.md)
- [PD-Community Discord server](https://discord.gg/projectdiscovery)
+- [PD-Community Discord server](https://discord.gg/projectdiscovery)
@@ -1,50 +0,0 @@
-id: k8s-controller-manager-bind-address
-
-info:
-  name: Ensure kube-controller-manager --bind-address is set to localhost
-  author: songyaeji
-  severity: high
-  description: |
-    Ensure kube-controller-manager is bound to localhost (127.0.0.1 or ::1). If --bind-address is missing or
-    set to 0.0.0.0 (::), the controller-manager API may be reachable from all network interfaces, increasing
-    exposure of the control-plane component.
-  impact: |
-    If the kube-controller-manager listens on all interfaces, an attacker with network access may be able to
-    interact with the controller-manager API, causing potential information leakage or enabling further attacks
-    against the cluster.
-  remediation: |
-    Set --bind-address=127.0.0.1 (or ::1) in the kube-controller-manager startup arguments. For example, edit
-    /etc/kubernetes/manifests/kube-controller-manager.yaml and add the argument to the command section.
-  reference:
-    - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/
-    - Cloud Vulnerability Assessment Guide(2024) by KISA
-  tags: cloud,devops,kubernetes,devsecops,kube-controller-manager,bind-address,hardening,k8s,k8s-cluster-security
-
-variables:
-  component: "kube-controller-manager"
-
-self-contained: true
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      kubectl get pods -n kube-system -l component=kube-controller-manager -o jsonpath="{.items[*].spec.containers[*].command}"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - 'kube-controller-manager'
-
-      - type: word
-        words:
-          - "--bind-address=127.0.0.1"
-          - "--bind-address=::1"
-        negative: true
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"kube-controller-manager configuration is missing --bind-address or set to unsafe value (expected: 127.0.0.1 or ::1)"'
-# digest: 490a0046304402202913db41a43350176fa630504391e5399d252294710b1bad1c50cd162a8defcb02205cb4ec1d6e05dd2b5fa493bf0668f0c0bf4fa5f521759e4f84f95927e4e465d9:922c64590222798bb761d5b6d8e72950
@@ -1,49 +0,0 @@
-id: k8s-scheduler-bind-address
-
-info:
-  name: Ensure kube-scheduler --bind-address is set to localhost
-  author: songyaeji
-  severity: high
-  description: |
-    Ensure kube-scheduler is bound to localhost (127.0.0.1 or ::1). If --bind-address is missing or set to
-    0.0.0.0 (::), the scheduler API may be reachable from all network interfaces, increasing exposure of the
-    control-plane component.
-  impact: |
-    If the kube-scheduler listens on all interfaces, an attacker with network access may be able to interact
-    with the scheduler API, causing potential information leakage or enabling further attacks against the cluster.
-  remediation: |
-    Set --bind-address=127.0.0.1 (or ::1) in the kube-scheduler startup arguments. For example, edit
-    /etc/kubernetes/manifests/kube-scheduler.yaml and add the argument to the command section.
-  reference:
-    - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/
-    - Cloud Vulnerability Assessment Guide(2024) by KISA
-  tags: cloud,devops,kubernetes,devsecops,kube-scheduler,bind-address,hardening,k8s,k8s-cluster-security
-
-variables:
-  component: "kube-scheduler"
-
-self-contained: true
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      kubectl get pods -n kube-system -l component=kube-scheduler -o jsonpath="{.items[*].spec.containers[*].command}"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - 'kube-scheduler'
-
-      - type: word
-        words:
-          - "--bind-address=127.0.0.1"
-          - "--bind-address=::1"
-        negative: true
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"kube-scheduler configuration is missing --bind-address or set to unsafe value (expected: 127.0.0.1 or ::1)"'
-# digest: 490a00463044022006a49804407d0d9b937760383c56604a16a549d8c45cb57b0ee1f8868b9e80c002204a7fb3c2364c55968c93e78151ce7a23232c10360bd6ffdc4ccd3c0c8aede23e:922c64590222798bb761d5b6d8e72950
@@ -102,4 +102,4 @@ code:
          - 'contains(content_type, "text/xml")'
          - 'status_code == 200'
        condition: and
-# digest: 4a0a00473045022100d8ca91da973cb5641abb7ce0a20ead96c28cf44d21966e52a142e683247b5c78022042c8ea4dc231b868c758f0d0568704d0a7f78400cbab8bb89c95f3733bdd8df3:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009d9bdc3780607102c88f8e2c24b7c11abaa1db7626959bea30844b3becad4398022100f8b42cfb37bdec09e2e983826a04f66fa50937cebe0b05d8b98cea1b558a21a9:922c64590222798bb761d5b6d8e72950
@@ -11,7 +11,7 @@ info:
    cvss-score: 7.5
    cve-id: CVE-2020-13935
    epss-score: 0.92155
-    epss-percentile: 0.99692
+    epss-percentile: 0.99695
  reference:
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
@@ -17,8 +17,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2021-3156
    cwe-id: CWE-193
-    epss-score: 0.92235
-    epss-percentile: 0.99696
+    epss-score: 0.92188
+    epss-percentile: 0.99697
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -40,4 +40,4 @@ code:
          - "malloc(): memory corruption"
          - "Aborted (core dumped)"
        condition: and
-# digest: 490a0046304402205b34c3b4097c941d1d59d6901980633ff6cb46894261a55b1fbd4097800bfc050220712372b631bc6dc75a698501b91379d63b258c18592ab528e60b5280c880ed93:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f71982b68a0941b58c28d66c71e85126c4c968ced5ce8646155128b001dda849022100e1dfe8f43d26c8c72bbdedf39a5ca890a46771c1b941308525a570abd452244c:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2023-2640
    cwe-id: CWE-863
    epss-score: 0.92037
-    epss-percentile: 0.99682
+    epss-percentile: 0.99684
    cpe: cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -55,4 +55,4 @@ code:
          - '!contains(code_1_response, "(root)")'
          - 'contains(code_2_response, "(root)")'
        condition: and
-# digest: 4b0a0048304602210099d9a1dc540c13c2e8c037619c76dc6c98d7cce30fdea4ccaf6b8922a48a6da6022100f0ce9c99c16acf4c3449f6a39113e808456d2a82bf8426ffe79671e21d2c22a0:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220042744883085da6be3360bc592800813b59a32ca3cca5b357679359e6253ba240220221969866987b2d8a715ea12875a3378b4d34a00642ee1940414fb062dbb7ccc:922c64590222798bb761d5b6d8e72950
@@ -16,7 +16,7 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-2986
-    epss-score: 0.91219
+    epss-score: 0.9117
    epss-percentile: 0.99625
    cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*
  metadata:
@@ -626,4 +626,4 @@ http:
      - type: status
        status:
          - 302
-# digest: 490a004630440220659aaf94900d6cbbad408475f84b140f7e8e4dd78ef089e6dacb067a5826601c02201c19f3bd6f5dfff607b7ada3e1dbc9319f41e406426bd3cb44d98983a03bb3c3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e6eab6f55170064a588506282efa987cb311cb8e2f791c1066d1d0d643b71b76022068fc331e222d13fd82f83dea7d76fa1aeb431eea1a0f9f415a3eb6917ef1e6a9:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-4911
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.74187
-    epss-percentile: 0.98768
+    epss-score: 0.78409
+    epss-percentile: 0.98978
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -39,4 +39,4 @@ code:
      - type: word
        words:
          - "139"     # Segmentation Fault Exit Code
-# digest: 4a0a00473045022100ca11c5ad34a538964c410e5b0480ba26634ef6e89e393397aba5a11ab0f288e6022057a320f0e2b52c0b88b6551622c6a3c77dc82613337d0293e8f0ac1b5711d5af:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009b5dc3be045aba05dec88023cb7dddc24188b00eec844cfa3909377e9d6317eb022100e0078981f9b353e41cf8e5e46fe4c1e421ddbbb0038b65ead953e45bb4b81381:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-6246
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.26478
-    epss-percentile: 0.96103
+    epss-score: 0.25078
+    epss-percentile: 0.95931
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -39,4 +39,4 @@ code:
      - type: word
        words:
          - "127"     # Segmentation Fault Exit Code
-# digest: 4b0a00483046022100f626907623a6f27b52de28272de6ae044644136073ab2df6a79810ae18dac74d022100df40e989c0eb752de878e50d91e18f47fb04b5974b3cff4454abb88ab37552eb:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220707af88658762f3e5a34c0b6adc5c8761db5b3a68d793de3ce1583c5e2334dbc022100aa3e773dd28b5a80f46c9e117e3cff530f72279898a97cf61d0f542ddad6451d:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2024-22120
    cwe-id: CWE-20
    epss-score: 0.93259
-    epss-percentile: 0.99791
+    epss-percentile: 0.99793
  metadata:
    max-request: 1
    vendor: zabbix
@@ -71,4 +71,4 @@ code:
      - type: word
        words:
          - "Vulnerable to CVE-2024-22120"
-# digest: 490a004630440220047864db09f4904cb65a5b2c622b08077a62ac84cf4bd421e405148a278cef1402205c7e9c1b705c6f37f181dc0ca48fa6f9b908da0403d5b6f06e5968b5401f9b78:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c29b03d6ec221f62966546d687c9c8c86e41f5d46f37e8896f3473a10d8b08b3022100867de1666d89e4ae22d98a7a0fd65b75a1716a312aaec979b2fabcd6b2ae1cf9:922c64590222798bb761d5b6d8e72950
@@ -59,4 +59,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a00473045022100a0d073e749ca6ad75d73fdd7acdba35bdafbe683161d1048fab8a5c500151d4302201ce17d0b3b3dcc7eec199a9afb9ada9aae868b3b76decbd3e4a9f65e4003d827:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210092d5ac481a41f2bce742d30e9a53e6cfcce47b99b02f4291b382802664d6f8c80220616412b2e3eab8e90f86485850f7ca389e9ac0b0f1a890e827325eb9677048d9:922c64590222798bb761d5b6d8e72950
@@ -11,7 +11,7 @@ info:
    cvss-score: 7.5
    cve-id: CVE-2024-4340
    epss-score: 0.16207
-    epss-percentile: 0.94527
+    epss-percentile: 0.94529
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4340
  tags: cve,cve2024,py,code,dos,python,sqlparse,vuln
@@ -29,4 +29,4 @@ code:
        part: stderr
        words:
          - "RecursionError: maximum recursion depth exceeded"
-# digest: 490a0046304402201ffc6dad4383442ed03f760541c02aea943a23fa3cfb950ff6c9486fd7f704ec02204cab175c9222efa8284603abeed5c005407846a336654517b93fc5f550055dfc:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220549dc564dc5471bdf1dc63334bf0ff6ef0f2c050664a3b06189b22683d31875f02204d49ed2a7bd8a9158503467d45b113fb0e8b20c98a09747235c176e23a8ef696:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2024-45409
    cwe-id: CWE-347
    epss-score: 0.39163
-    epss-percentile: 0.97101
+    epss-percentile: 0.97099
  metadata:
    verified: true
    shodan-query: http.title:"GitLab"
@@ -123,4 +123,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 490a0046304402205a31e24e951a1e137663ba725d0fac8f7c55cd87252fe673e302e88bb189f5c6022009d196dd5bb71d0b0b8d34825c59cae18e42404f09c4559a74c62a2a8a3f34f4:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205e030f7d186f18e2ddf5cd9281a48cb0af2d6ac63498b37cb4a9ce899f84a59e022005a03e6ea351d60b08436740f6db2daf9e303d0323c278f564ab1230e9a678f2:922c64590222798bb761d5b6d8e72950
@@ -18,7 +18,7 @@ info:
    cve-id: CVE-2024-55556
    cwe-id: CWE-502
    epss-score: 0.84379
-    epss-percentile: 0.99269
+    epss-percentile: 0.99271
  metadata:
    verified: true
    max-request: 2
@@ -193,4 +193,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 4a0a0047304502205f83d524f644f832b9287614c5f9ee6d79ae827f75e05c77350134d873792fbb02210084d7aa749f215f928201579dd9700f8d4e96dd20994d54294589f9faff6c1b08:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c33a7e4170efd830fed04dc81dff116c0d6de6a7a04013690afafee5aa4dd7eb022016a273dda70ccb4e18af5f17d14d297c9dbcfbe9981b3789e6ea9b4eafeab7a9:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2024-56331
    cwe-id: CWE-22
    epss-score: 0.41406
-    epss-percentile: 0.97237
+    epss-percentile: 0.97235
  metadata:
    verified: true
    shodan-query: http.title:"Uptime Kuma"
@@ -124,4 +124,4 @@ code:
      - type: word
        words:
          - "/etc/passwd: {'ok': True, 'msg': 'successAdded'"
-# digest: 4b0a00483046022100e044a683fb6c54d04a39e58efdec7c00d61cf3cf6120ffc32da907dba1ebfc13022100be3dc3ddff37383c8de3ba78b1539fc32f6629ba5ef5b62b03bb06929aaf3601:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204c5b24fda7a91e193ed794e32f38673f924ed17e393ebcb8e6e0e9351a6cde85022100860aa6411a18b6baec11fa99823a8fb2c3ed558adab797c067b1fe8ff009577e:922c64590222798bb761d5b6d8e72950
@@ -11,7 +11,7 @@ info:
    - https://github.com/advisories/GHSA-g83h-4727-5rpv
  classification:
    epss-score: 0.36115
-    epss-percentile: 0.96908
+    epss-percentile: 0.96904
  metadata:
    verified: true
    shodan-query: title:"GitHub Enterprise"
@@ -188,4 +188,4 @@ http:
      - type: kval
        kval:
          - user_session
-# digest: 4a0a0047304502203013d57a6a14ab8e9b185fbf331aaea5270990510f297d7d2ac12a078a994bea022100b876f8316e9c64d70f951ca2040468944fa1ef06d7e45e78893d837cd388bd37:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207d41ce6b6af9c3b0133e15c33183fdce00ba09f874633dbea4f3cb29234c64d8022004ad19707190bb70f9ff118286b04f22a704b252594a598f0b96850afa09a55d:922c64590222798bb761d5b6d8e72950
@@ -1,80 +0,0 @@
-id: CVE-2025-1550
-
-info:
-  name: Keras Model.load_model - Arbitrary Code Execution
-  author: nukunga[seunghyeonJeon]
-  severity: critical
-  description: |
-    The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading
-  impact: |
-    Attackers can execute arbitrary code during model loading, potentially leading to remote code execution or system compromise.
-  remediation: |
-    Update to the latest version of Keras where this issue is fixed or apply security patches provided by the developers.
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2025-1550
-    - https://github.com/keras-team/keras/pull/20751
-    - https://towerofhanoi.it/writeups/cve-2025-1550/
-  classification:
-    epss-score: 0.04233
-    epss-percentile: 0.88256
-  metadata:
-    max-request: 1
-  tags: cve,cve2025,code,keras,rce,ml
-
-self-contained: true
-
-code:
-  - engine:
-      - py
-      - python3
-
-    source: |
-      import os
-      import sys
-
-      try:
-          import tensorflow as tf
-          from tensorflow.keras.models import load_model
-          from tensorflow.keras.layers import Lambda, Input
-          from tensorflow.keras.models import Model
-          import numpy as np
-      except ImportError:
-          sys.exit(1)
-
-      def create_malicious_model():
-          def malicious_function(x):
-              result = os.popen("cat /etc/passwd").read()
-              print(result)
-              return x
-
-          input_layer = Input(shape=(1,))
-          lambda_layer = Lambda(malicious_function, name="evil_lambda")(input_layer)
-          model = Model(inputs=input_layer, outputs=lambda_layer)
-          return model
-
-      def exploit_lambda_layer():
-          model_path = "/tmp/malicious_model.keras"
-          try:
-              model = create_malicious_model()
-              model.save(model_path)
-              del model
-
-              loaded_model = load_model(model_path)
-              test_input = np.array([[1.0]])
-              loaded_model.predict(test_input, verbose=0)
-
-              return True
-          except:
-              return False
-          finally:
-              if os.path.exists(model_path):
-                  os.remove(model_path)
-
-      exploit_lambda_layer()
-
-    matchers:
-      - type: regex
-        part: response
-        regex:
-          - "root:.*:0:0:"
-# digest: 4b0a00483046022100c2ed5a1bf83700feef8c25b1f38d5f911a1f935acf9290b7174bf7cf86ca346402210090dedeb5c06ade84565eb90f529cfd1faddcbca92483439d1b2b6a7f01b987df:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2025-22457
    cwe-id: CWE-121,CWE-787
    epss-score: 0.76863
-    epss-percentile: 0.98893
+    epss-percentile: 0.98898
    cpe: cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*
  metadata:
    vendor: ivanti
@@ -128,4 +128,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 4b0a00483046022100ac97e58f4ae673ed53008d5c5eca271f6ee34cbeedbc34f2fa9d8ee20f61e7210221008cdc6bc9a90371b887776a517a00f85ad36b5a0e2e953e1a59cffd0ca5e98c50:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203f75dbfaad4ad6b004f89a6abe6b8ff05ec8c740385c91234058adab770eb6ea022100d31419b68e13b98dbfdede575d41d57e7b949ade2001446d470aa73c3a7f4bb4:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2025-25291
    cwe-id: CWE-347
    epss-score: 0.17247
-    epss-percentile: 0.94743
+    epss-percentile: 0.94744
  metadata:
    verified: true
    vendor: gitlab
@@ -78,4 +78,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 4b0a00483046022100a12f792e79bba670a8b33f0b5921d59e234a014802417890d44fb437f5d4e092022100e83e8e06ebce37034625d27db6838a0db4b9747ea2c302b775306b6586f24d91:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202d4a3417e1248c02987e65aaa3859a0691580be5c5e6841ef09e1546d4f6ce770220709dc70e279c9f4aa652e8391870e72f9f0ed9badcc811469e6425b2882cd484:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 10
    cve-id: CVE-2025-32433
    cwe-id: CWE-306
-    epss-score: 0.50575
-    epss-percentile: 0.97701
+    epss-score: 0.53778
+    epss-percentile: 0.97866
  metadata:
    verified: true
    max-request: 1
@@ -172,4 +172,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4a0a00473045022033e64d2a58e722f4f0750e436c188927451c02c24028fecdee547446490c7e85022100845d0a09ab6df5f48bb758c0fdcf52726d99327bfc31745f2480a834eb0253c4:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a836215ff57c937a4e67f2d0356c07465020153450ad01d5d8fb3ee70ea58c7d022074f5c22f26df10c73b3c23b69fccd923b643dd8de88c214cfed73f65fc67f2a5:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-54309
-    epss-score: 0.50718
-    epss-percentile: 0.9771
+    epss-score: 0.56973
+    epss-percentile: 0.98016
    cwe-id: CWE-287,CWE-362
    cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*
  metadata:
@@ -200,4 +200,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 4a0a00473045022100ffbcd13f7427b6f12a31b4d20248b5d4744346de8ff026238f3f04272d061e3002206f702ad7082789428b35f22c51c2ff8dd9a522fad2edf58b18f6655d5416f01b:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009e096641682d45560e5ef9e35a24ef1d999c1237e1c7300af90e97c940eda5a1022100af9eb03cc7d7732a901c609bef6ca34d6632f0827751b77c4338a9f26eee5e2c:922c64590222798bb761d5b6d8e72950
@@ -16,7 +16,7 @@ info:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6216
  classification:
    epss-score: 0.28615
-    epss-percentile: 0.96312
+    epss-percentile: 0.96307
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-6216
@@ -115,4 +115,4 @@ code:
      - type: dsl  # type of the extractor
        dsl:
          - '"Reset URL: " + code_response'
-# digest: 4b0a00483046022100ce8ab105a6b859fa6e62a622217262146f9873680b146aae08555124932c526a022100abec4c6bdd7cbd82a2b98f57b8fee3a1fa4bc97428775312b7d62af7c4e39992:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204e15f75d847313a94159ce612853e8d43c07acd7907aaa6116166434ed694ca6022100b51bf8064525483171bb588675b324c60cbe3f8a3987f86db575d2baeaa20225:922c64590222798bb761d5b6d8e72950
@@ -552,4 +552,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a0047304502210090a75ef7534aaebf09065b9beef5ebae6c6b8a70f8baca4dc25c97715e71314e02203728247aaefbe162f30ff4e5fa8476fb03ba2f59b429c589cd2cafa942eac50c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100dcff8d2117d05c7f29608fb37b2e2c96880d295642afaa19a7b9fd87fbbe7189022015423b37441c71e3f9b33c8cd1635fd58e97b63018684175eecad56ee9676538:922c64590222798bb761d5b6d8e72950
@@ -1,34 +0,0 @@
-id: auto-login-enabled
-
-info:
-  name: macOS Automatic Login Enabled
-  author: geeknik
-  severity: high
-  description: |
-    Checks if automatic login is enabled on macOS, allowing users to log in to the system without entering a password upon startup.
-  impact: |
-    Enabling automatic login can lead to unauthorized access to the user's account and data if the device is physically accessed.
-  remediation: |
-    Disable automatic login to require a password at startup and enhance physical security.
-  tags: macos,audit,local,security
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      defaults read /Library/Preferences/com.apple.loginwindow autoLoginUser 2>&1
-
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 0
-
-      - type: word
-        words:
-          - "does not exist"
-        negative: true
-# digest: 4a0a0047304502206e4abbed2d196fdcfbec430b63cb79ec4c970a766ae1dfa5699ed88c1df29841022100be4e6fe238b571547044d2a5d05526f69078c3f5536e4702b018e13149db8a7a:922c64590222798bb761d5b6d8e72950
@@ -1,27 +0,0 @@
-id: filevault-disabled
-
-info:
-  name: macOS FileVault Disabled
-  author: geeknik
-  severity: high
-  description: |
-    Identifies if FileVault full-disk encryption is disabled on macOS, leaving data unprotected from unauthorized access.
-  impact: |
-    Disabling FileVault leaves the data on the disk unencrypted and vulnerable to theft or unauthorized access if the device is lost or stolen.
-  remediation: |
-    Enable FileVault to encrypt the entire disk and protect the data at rest.
-  tags: macos,audit,local,security
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      fdesetup status
-    matchers:
-      - type: word
-        words:
-          - "FileVault is Off."
-# digest: 4b0a00483046022100dbeda953db252023089741b1ebc7bfe9469e933be51e45c78375eb388a18e01d022100b08c18ef3cbd1adefb1455ae1b792c1647dba4be6856925de6508a35c4066c05:922c64590222798bb761d5b6d8e72950
@@ -1,27 +0,0 @@
-id: firewall-disabled
-
-info:
-  name: macOS Application Firewall Disabled
-  author: geeknik
-  severity: medium
-  description: |
-    Verifies if the macOS application firewall is disabled, removing protection against unauthorized network access by applications.
-  impact: |
-    Disabling the firewall can allow malicious applications to make outbound connections and expose the system to network-based attacks.
-  remediation: |
-    Enable the macOS application firewall to control network access for applications.
-  tags: macos,audit,local,security
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
-    matchers:
-      - type: word
-        words:
-          - "Firewall is disabled. (State = 0)"
-# digest: 4b0a00483046022100fec597c208922cff8c5bf96d23a75c06d1192ecc31c5f257bd72cda4b05c3678022100b2899ee2431e105ca31f924e76bc446fa025a9c64b0f62c5268e06af0859be81:922c64590222798bb761d5b6d8e72950
@@ -1,27 +0,0 @@
-id: gatekeeper-disabled
-
-info:
-  name: macOS Gatekeeper Disabled
-  author: geeknik
-  severity: high
-  description: |
-    Checks if Gatekeeper is disabled on macOS, removing verification that downloaded applications are from identified developers.
-  impact: |
-    Disabling Gatekeeper allows the execution of applications from unverified sources, increasing the risk of malware infection.
-  remediation: |
-    Enable Gatekeeper to ensure that only applications from identified developers can be run.
-  tags: macos,audit,local,security
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      spctl --status
-    matchers:
-      - type: word
-        words:
-          - "assessments disabled"
-# digest: 4b0a00483046022100c13d86b99f8f878a28f12b93336ffc8b2041992d8469e55e5f4253fe313aaf920221009d4860d4ef526c896fd5ca9018bfec060b55f363a0e8efe3bdbe53c6673bc5ec:922c64590222798bb761d5b6d8e72950
@@ -1,31 +0,0 @@
-id: guest-user-enabled
-
-info:
-  name: macOS Guest User Enabled
-  author: geeknik
-  severity: medium
-  description: |
-    Identifies if the guest user account is enabled on macOS, allowing anyone to use the computer without authentication.
-  impact: |
-    Enabling the guest user account can allow unauthorized users to access the system with limited, but potentially risky, privileges.
-  remediation: |
-    Disable the guest user account to reduce the risk of unauthorized access.
-  tags: macos,audit,local,security
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      defaults read /Library/Preferences/com.apple.loginwindow GuestEnabled 2>&1
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 0
-      - type: regex
-        regex:
-          - "^1$"
-# digest: 4a0a00473045022100b56ce36c9516138969ae1baa1b6472abc91525849b6ebf9b1fcfed3a5921a45c0220475f29d019df5ace5aca8e06548449de2807ecdf682073423a0e4c7f4763db8d:922c64590222798bb761d5b6d8e72950
@@ -1,27 +0,0 @@
-id: insecure-cron-jobs
-
-info:
-  name: macOS World-Writable Cron Jobs
-  author: geeknik
-  severity: medium
-  description: |
-    Finds world-writable cron job files on macOS that can be modified by any user on the system.
-  impact: |
-    World-writable cron job files can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
-  remediation: |
-    Review and correct the permissions of world-writable cron job files.
-  tags: macos,audit,local,security,cron
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      find /etc/crontab /var/at/tabs/ -perm -o+w -type f -ls 2>/dev/null
-    matchers:
-      - type: regex
-        regex:
-          - "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
-# digest: 490a00463044022075a77d80b297101e767baa7a3df6a47b36d346be38b58abdd7ea504b7f8b49cb022079d8770c2062a09b57c244e78b22dab6f546cf4d9274013e66ee3dc2baef18b0:922c64590222798bb761d5b6d8e72950
@@ -1,32 +0,0 @@
-id: insecure-etc-exports-permissions
-
-info:
-  name: macOS Insecure /etc/exports Permissions
-  author: geeknik
-  severity: high
-  description: |
-    Identifies insecure permissions on the /etc/exports file used to configure NFS exports on macOS.
-  impact: |
-    Insecure permissions on /etc/exports could allow unauthorized users to modify the file and gain access to exported filesystems.
-  remediation: |
-    Ensure that the /etc/exports file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0644 or more restrictive.
-  tags: macos,audit,local,security,nfs
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      ls -l /etc/exports 2>&1
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 0
-      - type: regex
-        regex:
-          - "^-rw-r--r--\\s+\\d+\\s+root\\s+\\w+"
-        negative: true
-# digest: 4a0a00473045022100f0a90c14abd2b8151c008c14b461df041bd982ed2afe14cdb307fafb20f8934e0220363866f2cc52ca7b8ac63e881c4352af6b44aadf4571832c3cac632cf8a3fbdb:922c64590222798bb761d5b6d8e72950
@@ -1,32 +0,0 @@
-id: insecure-etc-fstab-permissions
-
-info:
-  name: macOS Insecure /etc/fstab Permissions
-  author: geeknik
-  severity: high
-  description: |
-    Validates permissions on the /etc/fstab file that defines how disk partitions and filesystems are mounted on macOS.
-  impact: |
-    Insecure permissions on /etc/fstab could allow unauthorized users to modify the file and mount malicious filesystems.
-  remediation: |
-    Ensure that the /etc/fstab file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0644 or more restrictive.
-  tags: macos,audit,local,security
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      ls -l /etc/fstab 2>&1
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 0
-      - type: regex
-        regex:
-          - "^-rw-r--r--\\s+\\d+\\s+root\\s+\\w+"
-        negative: true
-# digest: 4a0a00473045022100f63b670201e473559afe079d0f0944bd69bb9c3e624727ade721819c25bef59402205cfe065102455e15e4e85727ea9d8d59c11730662b81b8706d5e4cfd710db02f:922c64590222798bb761d5b6d8e72950
@@ -1,32 +0,0 @@
-id: insecure-etc-hostconfig-permissions
-
-info:
-  name: macOS Insecure /etc/hostconfig Permissions
-  author: geeknik
-  severity: high
-  description: |
-    Evaluates permissions on the /etc/hostconfig file used to configure system services on macOS.
-  impact: |
-    Insecure permissions on /etc/hostconfig could allow unauthorized users to modify the file and reconfigure system services.
-  remediation: |
-    Ensure that the /etc/hostconfig file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0644 or more restrictive.
-  tags: macos,audit,local,security
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      ls -l /etc/hostconfig 2>&1
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 0
-      - type: regex
-        regex:
-          - "^-rw-r--r--\\s+\\d+\\s+root\\s+\\w+"
-        negative: true
-# digest: 4b0a00483046022100d47f5829d759ebef3fbef226cb5a917a07bfff78791407217fd529a265a81876022100cb5bff86e6fa1eaf80f0f189250c9e59236c5c3f074d0499c96d642e6be6e1eb:922c64590222798bb761d5b6d8e72950
@@ -1,32 +0,0 @@
-id: insecure-etc-inetd-conf-permissions
-
-info:
-  name: macOS Insecure /etc/inetd.conf Permissions
-  author: geeknik
-  severity: high
-  description: |
-    Verifies permissions on the /etc/inetd.conf file used to configure the inetd daemon on macOS.
-  impact: |
-    Insecure permissions on /etc/inetd.conf could allow unauthorized users to modify the file and enable or disable network services.
-  remediation: |
-    Ensure that the /etc/inetd.conf file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0644 or more restrictive.
-  tags: macos,audit,local,security
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      ls -l /etc/inetd.conf 2>&1
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 0
-      - type: regex
-        regex:
-          - "^-rw-r--r--\\s+\\d+\\s+root\\s+\\w+"
-        negative: true
-# digest: 490a0046304402203a17f921ddd73a973258b7a7fe563d18218462436e060a5b6d27111c18f26f46022035c897ff32e61af7c5bf2dfd63b3c5c318182e88ce292d46962b404675dd93cc:922c64590222798bb761d5b6d8e72950
@@ -1,27 +0,0 @@
-id: insecure-homebrew-permissions
-
-info:
-  name: macOS World-Writable Homebrew Files
-  author: geeknik
-  severity: medium
-  description: |
-    Scans for world-writable files in the Homebrew directory that could be exploited for privilege escalation.
-  impact: |
-    World-writable files in the Homebrew directory can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
-  remediation: |
-    Review and correct the permissions of world-writable files in the Homebrew directory.
-  tags: macos,audit,local,security,homebrew
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      find $(brew --prefix)/ -perm -o+w -type f -ls 2>/dev/null
-    matchers:
-      - type: regex
-        regex:
-          - "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
-# digest: 4a0a0047304502201b6cc3d198cfe7d9f9285a73a3b9fcc416e015ee4418aa7dd46510903c057e68022100800ba72c60fd91ae271f6c627f2c147ff7082f01cde9ef3725453ceb802c1219:922c64590222798bb761d5b6d8e72950
@@ -1,27 +0,0 @@
-id: insecure-launchd-jobs
-
-info:
-  name: macOS World-Writable Launchd Jobs
-  author: geeknik
-  severity: medium
-  description: |
-    Searches for world-writable launchd job files on macOS that allow modification by any user.
-  impact: |
-    World-writable launchd job files can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
-  remediation: |
-    Review and correct the permissions of world-writable launchd job files.
-  tags: macos,audit,local,security,launchd
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      find /System/Library/LaunchDaemons/ /System/Library/LaunchAgents/ /Library/LaunchDaemons/ /Library/LaunchAgents/ ~/Library/LaunchAgents/ -perm -o+w -type f -ls 2>/dev/null
-    matchers:
-      - type: regex
-        regex:
-          - "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
-# digest: 4a0a00473045022100d79cf12bf41b029f55016ee394b8bbe07438a24579d556e97b47fb4cf336c2f102204ddd8161cde0e4501b0af970e45f01dd08aa1146117665257d4e8afd6d2ba8fc:922c64590222798bb761d5b6d8e72950
@@ -1,27 +0,0 @@
-id: insecure-startup-items
-
-info:
-  name: macOS World-Writable Startup Items
-  author: geeknik
-  severity: medium
-  description: |
-    Identifies world-writable startup items on macOS that can be tampered with by unprivileged users.
-  impact: |
-    World-writable startup items can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
-  remediation: |
-    Review and correct the permissions of world-writable startup items.
-  tags: macos,audit,local,security,startup
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      find /System/Library/StartupItems/ /Library/StartupItems/ -perm -o+w -type f -ls 2>/dev/null
-    matchers:
-      - type: regex
-        regex:
-          - "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
-# digest: 4a0a00473045022100cdffabfeaa894e26f8e25b8f0e6f3eb621ef7ba02088001a384c45791c7a3be002206670aa650962df9af70ced787fa9058d9e6a5c2573bf3aca920e4eb466b3741d:922c64590222798bb761d5b6d8e72950
@@ -1,27 +0,0 @@
-id: insecure-sudo-timestamp
-
-info:
-  name: macOS Excessive Sudo Timestamp Timeout
-  author: geeknik
-  severity: medium
-  description: |
-    Checks if the sudo timestamp timeout is configured to an excessively long duration (100+ minutes).
-  impact: |
-    A long sudo timestamp can allow a user to execute commands with root privileges for an extended period of time without re-entering their password.
-  remediation: |
-    Set the sudo timestamp to a reasonable value to reduce the risk of unauthorized access.
-  tags: macos,audit,local,security,sudo
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      grep -E "^Defaults.*timestamp_timeout=" /etc/sudoers
-    matchers:
-      - type: regex
-        regex:
-          - "timestamp_timeout=([1-9][0-9]{2,})"
-# digest: 4a0a00473045022056c70c9e83ca5b06dfd2d6f37d3fac472448c1684e5513de20f012e1c6d79207022100fa6c9d279661d23106d9c0c878ae249adb35cd312d45c18c3f9a6f098d8bf186:922c64590222798bb761d5b6d8e72950
@@ -1,32 +0,0 @@
-id: insecure-sudoers-permissions
-
-info:
-  name: macOS Insecure /etc/sudoers Permissions
-  author: geeknik
-  severity: high
-  description: |
-    Audits permissions on the /etc/sudoers file that defines which users can run commands with root privileges on macOS.
-  impact: |
-    Insecure permissions on /etc/sudoers could allow unauthorized users to modify the file and grant themselves root privileges.
-  remediation: |
-    Ensure that the /etc/sudoers file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0440 or more restrictive.
-  tags: macos,audit,local,security,sudo
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      ls -l /etc/sudoers 2>&1
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 0
-      - type: regex
-        regex:
-          - "^-r--r-----\\s+\\d+\\s+root\\s+\\w+"
-        negative: true
-# digest: 4b0a0048304602210097a287244d9ed09ffb331116f32802392d11aaa8fb0213fc39c35c24166d8beb022100bd0f5ae8e37b1081db8f56616615959457283c1558406ddcb720f041b2aaa582:922c64590222798bb761d5b6d8e72950
@@ -1,27 +0,0 @@
-id: insecure-tty-permissions
-
-info:
-  name: macOS World-Readable TTY Devices
-  author: geeknik
-  severity: medium
-  description: |
-    Checks if TTY devices are readable by all users, potentially allowing session snooping.
-  impact: |
-    If TTYs are readable by all users, it may be possible for an attacker to sniff sensitive information from other users' sessions.
-  remediation: |
-    Ensure that TTYs are not readable by all users.
-  tags: macos,audit,local,security,tty
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      ls -l /dev/tty*
-    matchers:
-      - type: regex
-        regex:
-          - "crw-rw-rw-.*"
-# digest: 4a0a00473045022100e4abc01b85856b24dcdfa381e0bd89e145134b9bc22ca800b319461178c681740220239dac32ccb77f5a93dacc9aade8a0607f2f3fe0817dd862557c49551ef40cea:922c64590222798bb761d5b6d8e72950
@@ -1,28 +0,0 @@
-id: insecure-umask
-
-info:
-  name: macOS Permissive Umask Configuration
-  author: geeknik
-  severity: medium
-  description: |
-    Verifies if the umask is configured with overly permissive values that create insecurely accessible files.
-  impact: |
-    A permissive umask can result in new files being created with world-writable permissions, which can be a security risk.
-  remediation: |
-    Set the umask to a more restrictive value to ensure that new files are created with secure permissions.
-  tags: macos,audit,local,security,umask
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      umask
-    matchers:
-      - type: regex
-        regex:
-          - "^0?0[0-2][0-7]$"
-        negative: true
-# digest: 4b0a00483046022100c69d262b8d1b34e76e3555fcdba1fae77480c154bd0e30ba8b0acb7e0ed03e3b022100d2c19fc4e134aa384f4498467fe35d921684fe767e0d2948c4f4066cc8491723:922c64590222798bb761d5b6d8e72950
@@ -1,27 +0,0 @@
-id: sip-disabled
-
-info:
-  name: macOS System Integrity Protection (SIP) Disabled
-  author: geeknik
-  severity: high
-  description: |
-    Validates whether System Integrity Protection (SIP) is disabled, removing critical restrictions on system modifications.
-  impact: |
-    Disabling SIP significantly weakens the security of the system, making it more vulnerable to malware and unauthorized modifications.
-  remediation: |
-    Enable System Integrity Protection (SIP) to protect the system from unauthorized modifications.
-  tags: macos,audit,local,security
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      csrutil status
-    matchers:
-      - type: word
-        words:
-          - "System Integrity Protection status: disabled."
-# digest: 4b0a00483046022100a9c95ce47a76fc6365a0b50b12e67d6d2da2a2faecd59065b1b0ded05df9ebc9022100a6877fd0ebd4f9c2a736f424a6a383ce72760683f1fd31826405e1f05e945676:922c64590222798bb761d5b6d8e72950
@@ -1,32 +0,0 @@
-id: ssh-service-running
-
-info:
-  name: macOS SSH Service Running
-  author: geeknik
-  severity: info
-  description: |
-    Checks if the SSH service (Remote Login) is running on the macOS system.
-  impact: |
-    While not a vulnerability in itself, a running SSH service can be a potential attack vector if not properly configured and secured.
-  remediation: |
-    Disable the SSH service if it is not needed. If it is required, ensure that it is properly configured with strong passwords and key-based authentication.
-  tags: macos,audit,local,security,ssh
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      launchctl print system/com.openssh.sshd 2>&1
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 0
-      - type: word
-        words:
-          - "state = running"
-          - "com.openssh.sshd"
-# digest: 4a0a00473045022053ce4877c2b6dd468f675d1170e575f39b925e2aa4deeeec03b1a0ed80e322cc022100de4617540a86bac57c234caa4f163cb06390cd4e5915dd8b8bbb7c835b10d873:922c64590222798bb761d5b6d8e72950
@@ -1,28 +0,0 @@
-id: suid-sgid-files
-
-info:
-  name: macOS SUID/SGID Files Detection
-  author: geeknik
-  severity: high
-  description: |
-    Discovers files with SUID or SGID permissions in user-writable directories (/usr/local, /opt, /Applications) that could be exploited for privilege escalation if misconfigured or vulnerable.
-  impact: |
-    Misconfigured SUID/SGID executables in user-writable directories can be exploited by local users to gain elevated privileges.
-  remediation: |
-    Review the list of SUID/SGID files and remove the permissions if they are not necessary.
-  tags: macos,audit,local,security,privesc
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      find /usr/local /opt /Applications -perm -4000 -o -perm -2000 -type f -ls 2>/dev/null
-    matchers:
-      - type: regex
-        regex:
-          - "^-rws.*"
-          - "^-..s.*"
-# digest: 4b0a00483046022100dd30985f866765efba07fa5b717ba0293926c4eac8375acdb63235ac56712901022100f2217c9a5f0f16219fe49d888b8195944c5095e3680dd822cbb3dbe840d9a3f0:922c64590222798bb761d5b6d8e72950
@@ -1,5 +1,5 @@
 {"ID":"CVE-2000-0114","Info":{"Name":"Microsoft FrontPage Extensions - Information Disclosure","Severity":"medium","Description":"Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /_vti_bin/ virtual directory.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2000/CVE-2000-0114.yaml"}
-{"ID":"CVE-2000-0760","Info":{"Name":"Jakarta Tomcat 3.1 and 3.0 - Information Disclosure","Severity":"medium","Description":"Jakarta Tomcat 3.1 and 3.0 under Apache contain a vulnerability in the Snoop servlet that reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension, exploit requires remote access.\n","Classification":{"CVSSScore":"6.4"}},"file_path":"http/cves/2000/CVE-2000-0760.yaml"}
+{"ID":"CVE-2000-0760","Info":{"Name":"Jakarta Tomcat 3.1 and 3.0 - Exposure","Severity":"low","Description":"The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2000/CVE-2000-0760.yaml"}
 {"ID":"CVE-2001-0537","Info":{"Name":"Cisco IOS HTTP Configuration - Authentication Bypass","Severity":"critical","Description":"HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2001/CVE-2001-0537.yaml"}
 {"ID":"CVE-2002-1131","Info":{"Name":"SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting","Severity":"high","Description":"The Virtual Keyboard plugin for SquirrelMail 1.2.6/1.2.7 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2002/CVE-2002-1131.yaml"}
 {"ID":"CVE-2004-0519","Info":{"Name":"SquirrelMail 1.4.x - Folder Name Cross-Site Scripting","Severity":"medium","Description":"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2004/CVE-2004-0519.yaml"}
@@ -2553,7 +2553,6 @@
 {"ID":"CVE-2023-39109","Info":{"Name":"rConfig 3.9.4 - Server-Side Request Forgery","Severity":"high","Description":"rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2023/CVE-2023-39109.yaml"}
 {"ID":"CVE-2023-39110","Info":{"Name":"rConfig 3.9.4 - Server-Side Request Forgery","Severity":"high","Description":"rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2023/CVE-2023-39110.yaml"}
 {"ID":"CVE-2023-39120","Info":{"Name":"Nodogsplash - Directory Traversal","Severity":"high","Description":"Nodogsplash product was affected by a directory traversal vulnerability that also impacted the OpenWrt product. This vulnerability was addressed in Nodogsplash version 5.0.1. Exploiting this vulnerability, remote attackers could read arbitrary files from the target system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-39120.yaml"}
-{"ID":"CVE-2023-39121","Info":{"Name":"Emlog 2.1.9 - SQL Injection","Severity":"high","Description":"emlog v2.1.9 contains a SQL injection caused by unsanitized input in the data backup/restore functionality, allowing attackers to execute arbitrary SQL commands through crafted backup files.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2023/CVE-2023-39121.yaml"}
 {"ID":"CVE-2023-39141","Info":{"Name":"Aria2 WebUI - Path traversal","Severity":"high","Description":"webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-39141.yaml"}
 {"ID":"CVE-2023-39143","Info":{"Name":"PaperCut \u003c 22.1.3 - Path Traversal","Severity":"critical","Description":"PaperCut NG and PaperCut MF before 22.1.3 are vulnerable to path traversal which enables attackers to read, delete, and upload arbitrary files.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-39143.yaml"}
 {"ID":"CVE-2023-3936","Info":{"Name":"Blog2Social \u003c 7.2.1 - Cross-Site Scripting","Severity":"medium","Description":"The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-3936.yaml"}
@@ -3086,7 +3085,6 @@
 {"ID":"CVE-2024-50623","Info":{"Name":"Cleo Harmony \u003c 5.8.0.21 - Arbitary File Read","Severity":"high","Description":"In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2024/CVE-2024-50623.yaml"}
 {"ID":"CVE-2024-5082","Info":{"Name":"Nexus Repository 2 - Remote Code Execution","Severity":"high","Description":"A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2.This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-5082.yaml"}
 {"ID":"CVE-2024-5084","Info":{"Name":"Hash Form \u003c= 1.1.0 - Arbitrary File Upload","Severity":"critical","Description":"The Hash Form Drag \u0026 Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_action' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-5084.yaml"}
-{"ID":"CVE-2024-50857","Info":{"Name":"GestioIP - Reflected Cross-Site Scripting","Severity":"medium","Description":"GestioIP v3.5.7 contains a reflected cross-site scripting caused by unsanitized input in the ip_do_job request, letting attackers execute scripts in the victim's browser, exploit requires specific user permissions.\n","Classification":{"CVSSScore":"4.8"}},"file_path":"http/cves/2024/CVE-2024-50857.yaml"}
 {"ID":"CVE-2024-50967","Info":{"Name":"DATAGERRY - Improper Access Control","Severity":"high","Description":"The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability. An attacker can remotely access this endpoint without authentication, leading to unauthorized disclosure of sensitive information.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-50967.yaml"}
 {"ID":"CVE-2024-51211","Info":{"Name":"openSIS Classic v9.1 - SQL Injection","Severity":"critical","Description":"SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input validation of the $username_stn_id parameter, which can be manipulated by an attacker to inject arbitrary SQL commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-51211.yaml"}
 {"ID":"CVE-2024-51228","Info":{"Name":"TOTOLINK CX-A3002RU - Remote Code Execution","Severity":"medium","Description":"An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1420 and TOTOLINK-CX-N300RT V2.1.8-B20171113.1408 and TOTOLINK-CX-N300RT V2.1.8-B20191010.1107 and TOTOLINK-CX-N302RE V2.0.2-B20170511.1523 allows a remote attacker to execute arbitrary code via the /boafrm/formSysCmd component.\n","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2024/CVE-2024-51228.yaml"}
@@ -3108,7 +3106,6 @@
 {"ID":"CVE-2024-5315","Info":{"Name":"Dolibarr ERP CMS `list.php` - SQL Injection","Severity":"critical","Description":"Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-5315.yaml"}
 {"ID":"CVE-2024-5334","Info":{"Name":"Devika - Local File Inclusion","Severity":"high","Description":"A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshot_path' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with a malicious 'snapshot_path' parameter, leading to arbitrary file read from the system. This issue impacts the security of the application by allowing unauthorized access to sensitive files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-5334.yaml"}
 {"ID":"CVE-2024-53704","Info":{"Name":"SSL VPN Session Hijacking","Severity":"critical","Description":"An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-53704.yaml"}
-{"ID":"CVE-2024-53900","Info":{"Name":"Mongoose \u003c 8.8.3 - Remote Code Execution","Severity":"critical","Description":"Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-53900.yaml"}
 {"ID":"CVE-2024-53991","Info":{"Name":"Discourse Backup File Disclosure Via Default Nginx Configuration","Severity":"high","Description":"Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use `FileStore--LocalStore` which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick nginx into sending the Discourse backup file with a well crafted request.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-53991.yaml"}
 {"ID":"CVE-2024-5420","Info":{"Name":"SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting","Severity":"high","Description":"A vulnerability was found in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, affecting the device description parameter in the web interface. This flaw allows stored cross-site scripting (XSS), enabling attackers to inject JavaScript code. The attack can be executed remotely by tricking victims into visiting a malicious website, potentially leading to session hijacking. This vulnerability is publicly disclosed and identified as CVE-2024-5420.\n","Classification":{"CVSSScore":"8.3"}},"file_path":"http/cves/2024/CVE-2024-5420.yaml"}
 {"ID":"CVE-2024-5421","Info":{"Name":"SEH utnserver Pro/ProMAX/INU-100 20.1.22 - File Exposure","Severity":"high","Description":"A vulnerability was identified in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, impacting the file handling functions. This flaw results in authenticated file disclosure, granting unauthorized access to sensitive files and directories. Although authentication is required, the vulnerability poses a significant risk of data exposure. This vulnerability is publicly disclosed and identified as CVE-2024-5421.\n","Classification":{"CVSSScore":"8.7"}},"file_path":"http/cves/2024/CVE-2024-5421.yaml"}
@@ -3247,7 +3244,6 @@
 {"ID":"CVE-2025-1098","Info":{"Name":"Ingress-Nginx Controller - Configuration Injection via Unsanitized Mirror Annotations","Severity":"high","Description":"A security issue was discovered in  ingress-nginx https-//github.com/kubernetes/ingress-nginx  where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-1098.yaml"}
 {"ID":"CVE-2025-11371","Info":{"Name":"Gladinet CentreStack \u0026 TrioFox - Local File Inclusion","Severity":"medium","Description":"In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.  This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560\n","Classification":{"CVSSScore":"6.2"}},"file_path":"http/cves/2025/CVE-2025-11371.yaml"}
 {"ID":"CVE-2025-11750","Info":{"Name":"Dify - User Enumeration via \"Account not found\" Message","Severity":"medium","Description":"A user enumeration vulnerability exists in langgenius/dify, where the login API leaks information about whether a user account exists or not. When an invalid/non-existent email is used during login, the API returns a distinct error message such as \"account_not_found\" or \"Account not found.\", allowing attackers to identify valid accounts.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-11750.yaml"}
-{"ID":"CVE-2025-12480","Info":{"Name":"Triofox - Improper Access Control","Severity":"critical","Description":"The Gladinet Triofox solution before 12.91.1126.65588 and CentreStack before 12.10.595.65696 allow unauthenticated access to the /management/admindatabase.aspx endpoint, exposing sensitive database management functionality to anyone with network access. An unauthenticated attacker can remotely access, view, and potentially interact with the database management interface, risking data disclosure or system compromise.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-12480.yaml"}
 {"ID":"CVE-2025-1302","Info":{"Name":"JSONPath Plus \u003c 10.3.0 - Remote Code Execution","Severity":"critical","Description":"Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** This is caused by an incomplete fix for [CVE-2024-21534]\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1302.yaml"}
 {"ID":"CVE-2025-1323","Info":{"Name":"WP-Recall – Plugin \u003c= 16.26.10 - Unauthenticated SQL Injection","Severity":"high","Description":"The WP-Recall – Registration, Profile, Commerce \u0026 More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-1323.yaml"}
 {"ID":"CVE-2025-1562","Info":{"Name":"Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control","Severity":"critical","Description":"The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_or_activate_addon_plugins() function and a weak nonce hash in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to install arbitrary plugins on the site that can be leveraged to further infect a vulnerable site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1562.yaml"}
@@ -3323,7 +3319,6 @@
 {"ID":"CVE-2025-31131","Info":{"Name":"Yeswiki \u003c 4.5.2 - Unauthenticated Path Traversal","Severity":"high","Description":"YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-31131.yaml"}
 {"ID":"CVE-2025-31161","Info":{"Name":"CrushFTP - Authentication Bypass","Severity":"critical","Description":"CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability that may result in unauthenticated access. Remote and unauthenticated HTTP requests to CrushFTP may allow attackers to gain unauthorized access.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-31161.yaml"}
 {"ID":"CVE-2025-31324","Info":{"Name":"SAP NetWeaver Visual Composer Metadata Uploader - Deserialization","Severity":"critical","Description":"SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-31324.yaml"}
-{"ID":"CVE-2025-31486","Info":{"Name":"Vite server.fs.deny Bypass - Local File Inclusion","Severity":"medium","Description":"Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest- script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default- 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-31486.yaml"}
 {"ID":"CVE-2025-31489","Info":{"Name":"MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads","Severity":"high","Description":"MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access\nto - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-31489.yaml"}
 {"ID":"CVE-2025-32101","Info":{"Name":"UNA CMS \u003c= 14.0.0-RC4 - PHP Object Injection","Severity":"critical","Description":"The vulnerability is located in the /template/scripts/BxBaseMenuSetAclLevel.php script. Specifically, within the BxBaseMenuSetAclLevel::getCode() method. When calling this method, user input passed through the \"profile_id\" POST parameter is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by remote, unauthenticated attackers to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as writing and executing arbitrary PHP code.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-32101.yaml"}
 {"ID":"CVE-2025-32429","Info":{"Name":"XWiki Platform - SQL Injection","Severity":"critical","Description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-32429.yaml"}
@@ -3364,14 +3359,11 @@
 {"ID":"CVE-2025-41243","Info":{"Name":"Spring Cloud Gateway Server Webflux - Broken Access Control","Severity":"critical","Description":"Spring Cloud Gateway Server Webflux contains a vulnerability caused by unsecured and exposed actuator endpoints allowing modification of Spring Environment properties, letting attackers modify configuration, exploit requires unsecured actuator endpoints exposure.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-41243.yaml"}
 {"ID":"CVE-2025-41393","Info":{"Name":"Ricoh Web Image Monitor - Reflected XSS","Severity":"medium","Description":"A reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-41393.yaml"}
 {"ID":"CVE-2025-41646","Info":{"Name":"RevPi Webstatus \u003c= v2.4.5 - Authentication Bypass","Severity":"critical","Description":"An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-41646.yaml"}
-{"ID":"CVE-2025-4302","Info":{"Name":"Stop User Enumeration WordPress plugin - Authentication Bypass","Severity":"medium","Description":"Stop User Enumeration WordPress plugin \u003c 1.7.3 contains an authentication bypass caused by URL-encoding the REST API path /wp-json/wp/v2/users/, letting attackers bypass user enumeration restrictions, exploit requires crafted URL encoding.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-4302.yaml"}
 {"ID":"CVE-2025-4322","Info":{"Name":"Motors \u003c= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover","Severity":"critical","Description":"The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4322.yaml"}
 {"ID":"CVE-2025-4334","Info":{"Name":"Simple User Registration \u003c= 6.3 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"The Simple User Registration plugin ≤ 6.3 is vulnerable to privilege escalation. It lacks proper restrictions on user meta values during registration. Unauthenticated attackers can exploit this to register as administrators.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4334.yaml"}
 {"ID":"CVE-2025-4380","Info":{"Name":"Ads Pro Plugin \u003c= 4.89 - Local File Inclusion","Severity":"critical","Description":"The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4380.yaml"}
 {"ID":"CVE-2025-4388","Info":{"Name":"Liferay Portal - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-4388.yaml"}
 {"ID":"CVE-2025-4396","Info":{"Name":"Relevanssi \u003c= 4.24.4 (Free) - Unauthenticated SQL Injection","Severity":"high","Description":"The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and \u003c= 2.27.4 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-4396.yaml"}
-{"ID":"CVE-2025-44136","Info":{"Name":"MapTiler Tileserver-php v2.0 - Unauthenticated XSS","Severity":"medium","Description":"MapTiler Tileserver-php v2.0 contains a reflected XSS caused by unencoded reflection of the GET parameter \\\"layer\\\" in an error message, letting unauthenticated attackers execute arbitrary script on victim browsers.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-44136.yaml"}
-{"ID":"CVE-2025-44137","Info":{"Name":"MapTiler Tileserver-php v2.0 - Unauthenticated File Read","Severity":"high","Description":"MapTiler Tileserver-php v2.0 contains a directory traversal caused by improper sanitization of GET parameters in renderTile function, letting attackers read arbitrary files on the server, exploit requires crafted web requests\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-44137.yaml"}
 {"ID":"CVE-2025-44148","Info":{"Name":"MailEnable Mail Service \u003c v10 - Cross-Site Scripting","Severity":"medium","Description":"Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-44148.yaml"}
 {"ID":"CVE-2025-44177","Info":{"Name":"White Star Software ProTop - Directory Traversal","Severity":"high","Description":"A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2025/CVE-2025-44177.yaml"}
 {"ID":"CVE-2025-4427","Info":{"Name":"Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution","Severity":"critical","Description":"An authentication bypass in Ivanti Endpoint Manager Mobile allowing attackers to access protected resources without proper credentials. This leads to unauthenticated Remote Code Execution via unsafe userinput in one of the bean validators which is sink for Server-Side Template Injection.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-4427.yaml"}
@@ -3401,7 +3393,6 @@
 {"ID":"CVE-2025-51482","Info":{"Name":"Letta Letta 0.7.12 - Remote Code Execution","Severity":"high","Description":"Letta 0.7.12 is vulnerable to remote code execution via POST /v1/tools/run in letta.server.rest_api.routers.v1.tools.run_tool_from_source, allowing attackers to execute arbitrary Python and OS commands via crafted tool source code.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-51482.yaml"}
 {"ID":"CVE-2025-51501","Info":{"Name":"Microweber CMS2.0 - Cross-Site Scripting","Severity":"medium","Description":"Reflected Cross-Site Scripting (XSS) in the `id` parameter of the `live_edit.module_settings` API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-51501.yaml"}
 {"ID":"CVE-2025-51502","Info":{"Name":"Microweber CMS 2.0 - Reflected XSS in Admin Page Creation","Severity":"medium","Description":"Reflected Cross-Site Scripting (XSS) exists in Microweber CMS 2.0 through the layout parameter on the /admin/page/create page. It allows arbitrary JavaScript to execute in the context of authenticated admin users.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-51502.yaml"}
-{"ID":"CVE-2025-51990","Info":{"Name":"XWiki – Stored Cross-Site Scripting (XSS)","Severity":"medium","Description":"XWiki through version 17.3.0 contains stored cross-site scripting caused by improper sanitization of inputs in the Administration interface's Presentation section, letting authenticated administrators inject JavaScript that executes in visitors' browsers, exploit requires administrator authentication.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-51990.yaml"}
 {"ID":"CVE-2025-52207","Info":{"Name":"MikoPBX - Unrestricted File Upload","Severity":"critical","Description":"MikoPBX through 2024.1.114 contains an authenticated unrestricted file upload vulnerability caused by allowing PHP script uploads in PBXCoreREST/Controllers/Files/PostController.php.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-52207.yaml"}
 {"ID":"CVE-2025-52472","Info":{"Name":"XWiki - HQL Injection","Severity":"high","Description":"XWiki is vulnerable to Hibernate Query Language (HQL) injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potentially leading to data extraction, authentication bypass, or remote code execution depending on database backend and configuration.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-52472.yaml"}
 {"ID":"CVE-2025-52488","Info":{"Name":"DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure","Severity":"high","Description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-52488.yaml"}
@@ -3461,7 +3452,6 @@
 {"ID":"CVE-2025-7160","Info":{"Name":"Zoo Management System 1.0 - SQL Injection","Severity":"critical","Description":"Zoo Management System 1.0 contains a SQL injection vulnerability via the username parameter on the login page. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-7160.yaml"}
 {"ID":"CVE-2025-8085","Info":{"Name":"Ditty \u003c 3.1.58 - Server-Side Request Forgery","Severity":"high","Description":"The plugin lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs. v3.1.57 attempted to fix the issue with a nonce check, however any authenticated users, such as subscriber can retrieve it.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-8085.yaml"}
 {"ID":"CVE-2025-8868","Info":{"Name":"Chef Automate \u003c 4.13.295 — SQL Injection","Severity":"critical","Description":"In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-8868.yaml"}
-{"ID":"CVE-2025-8943","Info":{"Name":"Flowise \u003c 3.0.1 - Remote Command Execution","Severity":"critical","Description":"The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-8943.yaml"}
 {"ID":"CVE-2025-9196","Info":{"Name":"Trinity Audio \u003c= 5.21.0 - Information Exposure","Severity":"medium","Description":"The Trinity Audio Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the ~/admin/inc/phpinfo.php file that gets created on install. This makes it possible for unauthenticated attackers to extract sensitive data including configuration data.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-9196.yaml"}
 {"ID":"CVE-2025-9744","Info":{"Name":"Loan Management System 1.0 - SQL Injection","Severity":"critical","Description":"Loan Management System 1.0 contains a SQL injection vulnerability via the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-9744.yaml"}
 {"ID":"CVE-2025-9985","Info":{"Name":"Featured Image from URL (FIFU) \u003c= 5.2.7 - Unauthenticated Information Exposure via Log File","Severity":"medium","Description":"The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-9985.yaml"}
@@ -1 +1 @@
-35212ff030079a7d48b00b4664af5ad8
+04825279d81a90757969be8bbeccd5b4
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2022-34265
    cwe-id: CWE-89
    epss-score: 0.92734
-    epss-percentile: 0.99741
+    epss-percentile: 0.99742
  tags: sqli,dast,vulhub,cve,cve2022,django,vuln

 variables:
@@ -46,4 +46,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 4b0a00483046022100c31b6bc5376da19a42aa36e741b844530ce5c65cc85896f55c4506874cb9f5cd022100fdb40f6e92d4ae905c638a29a2be365acfe399b0ff4a3b9b6f769f0d395af3af:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220313f97ef1ed9ca9259404dcc6b2a3d20024e5d93c5e240fc3691a60445b3521b02202dc02c16af44d82d9a1c893c9c85690e677e801a7bd2759dad7b66a31591b236:922c64590222798bb761d5b6d8e72950
@@ -18,8 +18,8 @@ info:
    cvss-score: 7.3
    cve-id: CVE-2024-2961
    cwe-id: CWE-787
-    epss-score: 0.92804
-    epss-percentile: 0.99749
+    epss-score: 0.9261
+    epss-percentile: 0.9973
  tags: cve,cve2024,php,iconv,glibc,lfr,rce,dast,vkev,vuln

 flow: http(1) && http(2)
@@ -57,4 +57,4 @@ http:
      - type: regex
        regex:
          - "root:x:0:0"
-# digest: 4b0a00483046022100e5910a619fd348f3c2f3e7f0d0eb1275f5776c0e6445753f518041dd4b315679022100edfd692e1a01565b402daa00596daf23db80076d623a9b9a0db06d1909e3a879:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100aa92d96d35809e43ff9944ae82a2d175820a83937e0f8e01f7e7f4bcf976deb9022100db0273ebd16109f8dcc5b9bc3f0cba9388e844a71558447228205f8f635d7b06:922c64590222798bb761d5b6d8e72950
@@ -1,28 +0,0 @@
-id: deep-link-custom-scheme-detect
-
-info:
-  name: Android Deep Link - Detect Custom Schemes
-  author: 7h3b4dger
-  severity: info
-  description: Detects custom URI schemes (non-http/https) declared in Deep Link intent filters.
-  tags: android,file,deeplink
-
-file:
-  - extensions:
-      - xml
-
-    matchers:
-      - type: xpath
-        part: body
-        xpath:
-          - "//activity/intent-filter/action[@android:name='android.intent.action.VIEW']"
-          - "//activity/intent-filter/category[@android:name='android.intent.category.BROWSABLE']"
-        condition: and
-
-    extractors:
-      - type: xpath
-        part: body
-        attribute: android:scheme
-        xpath:
-          - "/manifest/application/activity/intent-filter/data[@android:scheme!='http' and @android:scheme!='https']"
-# digest: 4b0a00483046022100dfee623cb783925f2b89ea83c79151915f4162f43ea65bbefc3f722abef572bd022100b858c523655c14169534615ca34ad18ccdae8f6e8f6bdae088ada1b8c25ec943:922c64590222798bb761d5b6d8e72950
@@ -1,28 +0,0 @@
-id: exported-activities
-
-info:
-  name: Android Exported Activities - Detect
-  author: 7h3b4dger
-  severity: info
-  description: Detect exported (android:exported="true") activities in AndroidManifest.xml, excluding launcher activities and common Google/Jetpack libraries.
-  tags: android,file,exportedcomponents
-
-file:
-  - extensions:
-      - xml
-
-    matchers:
-      - type: xpath
-        part: body
-        xpath:
-          - "//activity[@android:exported='true']"
-          - "//activity/intent-filter/action[@android:name!='android.intent.category.LAUNCHER']"
-        condition: and
-
-    extractors:
-      - type: xpath
-        part: body
-        attribute: android:name
-        xpath:
-          - "//activity[@android:exported='true'and not(contains(@android:name, 'androidx')) and not(contains(@android:name, 'google'))]"
-# digest: 490a004630440220457f58399dc08789899303ee923debaeabb34e6378d3cf92a8990917197c49a6022024f33e09d43b6ec9eb9a496ae9902d84a51e6ab5705a83bf695423d5a7143a89:922c64590222798bb761d5b6d8e72950
@@ -1,28 +0,0 @@
-id: exported-broadcast-receivers
-
-info:
-  name: Android Exported Broadcast Receivers in AndroidManifest.xml - Detect
-  author: 7h3b4dger
-  severity: info
-  description: Detect exported Broadcast Receivers in AndroidManifest.xml (excluding disabled receivers and Google/Jetpack libraries)
-  tags: android,file,exportedcomponents
-
-file:
-  - extensions:
-      - xml
-
-    matchers:
-      - type: xpath
-        part: body
-        xpath:
-          - "//receiver[@android:exported='true']"
-          - "//receiver[@android:enabled!='false']"
-        condition: and
-
-    extractors:
-      - type: xpath
-        part: body
-        attribute: android:name
-        xpath:
-          - "//receiver[@android:exported='true'and not(contains(@android:name, 'androidx')) and not(contains(@android:name, 'google'))]"
-# digest: 4b0a00483046022100ea0a6074ea4f80d449daef641113ac85735df72bc419255d35f14c94c24ed1d6022100a063cee8432cd71af136b73f1f6cb7e4f1f8121f9699358d61dec8e3c0a76c3e:922c64590222798bb761d5b6d8e72950
@@ -1,26 +0,0 @@
-id: exported-providers
-
-info:
-  name: Android Exported Providers - Detect
-  author: 7h3b4dger
-  severity: info
-  description: Detects exported content providers declared in the app’s AndroidManifest.xml, excluding those added by dependency libraries.
-  tags: android,file,exportedcomponents
-
-file:
-  - extensions:
-      - xml
-
-    matchers:
-      - type: xpath
-        part: body
-        xpath:
-          - "//provider[@android:exported='true']"
-
-    extractors:
-      - type: xpath
-        part: body
-        attribute: android:name
-        xpath:
-          - "//provider[@android:exported='true' and not(contains(@android:name, 'androidx')) and not(contains(@android:name, 'google'))]"
-# digest: 4b0a00483046022100ae19fefa832a8fe0477ab132a4199f1736357246d1481d4ee01922e00b7efba7022100dd90c806e248816f43a478d6bbdf9e16a08975a3bb154c1f88e9a882e8fbfaa7:922c64590222798bb761d5b6d8e72950
@@ -1,26 +0,0 @@
-id: exported-services
-
-info:
-  name: Android Exported Services - Detect
-  author: 7h3b4dger
-  severity: info
-  description: Detect exported services in AndroidManifest.xml, excluding disabled and common Google/Jetpack library services.
-  tags: android,file,exportedcomponents
-
-file:
-  - extensions:
-      - xml
-
-    matchers:
-      - type: xpath
-        part: body
-        xpath:
-          - "//service[@android:exported='true']"
-
-    extractors:
-      - type: xpath
-        part: body
-        attribute: android:name
-        xpath:
-          - "//service[@android:exported='true' and not(contains(@android:name, 'androidx')) and not(contains(@android:name, 'google'))]"
-# digest: 4b0a004830460221009100a81cea6ccb3105977ace3ad5131a1a677f7f332e6192c1dcbb5a24705025022100ce7022ee4b51071412405072a5899d71af706efe2c9f965dff02f3d434d6f63e:922c64590222798bb761d5b6d8e72950
@@ -1,32 +0,0 @@
-id: webview-file-access-fromfileurl-java
-
-info:
-  name: Android WebView File Access from file URLs - Detect in Java sources
-  author: 7h3b4dger
-  severity: info
-  description: Android WebView File Access from file URLs enabling was detected - Java source version.
-  tags: android,file,webview
-
-file:
-  - extensions:
-      - java
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "setAllowFileAccessFromFileURLs(true)"
-
-      - type: regex
-        part: body
-        regex:
-          - package\s+(?:.*)
-
-    extractors:
-      - type: regex
-        part: body
-        name: package
-        group: 1
-        regex:
-          - (?m)^\s*package\s+([A-Za-z_][A-Za-z0-9_\.]*)\s*;
-# digest: 490a00463044022034c6c89c765c2dc11e557c4b752bd3c7391a8e514f74343f057b87e1a54856b5022062707c1122b2429879a1b3a5bfb6db32bd202a823b826a099335d5fc9cda48ec:922c64590222798bb761d5b6d8e72950
@@ -1,32 +0,0 @@
-id: webview-file-access-java
-
-info:
-  name: Android File Access - Detect in Java sources
-  author: 7h3b4dger
-  severity: info
-  description: Android WebView File Access enabling was detected - Java source version.
-  tags: android,file,webview
-
-file:
-  - extensions:
-      - java
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "setAllowFileAccess(true)"
-
-      - type: regex
-        part: body
-        regex:
-          - package\s+(?:.*)
-
-    extractors:
-      - type: regex
-        part: body
-        name: package
-        group: 1
-        regex:
-          - (?m)^\s*package\s+([A-Za-z_][A-Za-z0-9_\.]*)\s*;
-# digest: 4a0a00473045022028b71ccf953d918f4232cb0c9e4cd8774b3f37f0ed64e7b0c69333893236ea21022100854a654d966c122e26ea8c2220c8d62d2259e173fd6b3a87e80b04b157c9c2ec:922c64590222798bb761d5b6d8e72950
@@ -1,32 +0,0 @@
-id: webview-universal-access-java
-
-info:
-  name: Android WebView Universal Access - Detect in Java sources
-  author: 7h3b4dger
-  severity: info
-  description: Android WebView Universal Access enabling was detected - Java source version.
-  tags: android,file,webview
-
-file:
-  - extensions:
-      - java
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "setAllowUniversalAccessFromFileURLs(true)"
-
-      - type: regex
-        part: body
-        regex:
-          - package\s+(?:.*)
-
-    extractors:
-      - type: regex
-        part: body
-        name: package
-        group: 1
-        regex:
-          - (?m)^\s*package\s+([A-Za-z_][A-Za-z0-9_\.]*)\s*;
-# digest: 4a0a00473045022100b4ab25d9af5156ca830d2354c2ae9495d6e3b2e012187e4f9b48716025f3466102202a72c3a24c91d16dc9e8cb1673ed0ae719718a2ef199d50bc9cec8a35d85cf90:922c64590222798bb761d5b6d8e72950
@@ -22,4 +22,4 @@ file:
          - 'InvalidOperationException'
          - 'UnauthorizedAccessException'
          - 'NotFound'
-# digest: 4a0a004730450220690f7528e0f9521c29ca52c77d928843698618b55228b93722c04581fb5c8172022100ac26c769a81c97300fbf19827f4bb5416c0a75b88841fce197b52f51b5cffb44:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022001a28cfdfeefcf2533646ec4e84101d825e19d420db7d5d7909b43b437bc547e022060002c6ac0078d9aeed09ea81c2e819a74549e623eec8134a59bfecf0e6055dd:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ file:
          - 'BadRequestError'
          - 'MongoError'
          - 'SequelizeDatabaseError'
-# digest: 490a00463044022015c959e567489b137b641b8d898d7ab67323f4c7416816c334c356bf2d3212340220419f288228c23298a87a3b84faca254b02dfe2b7dbe9f291cc4a8b767458c8e3:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ba8e6c12e8ec5e4ae3e0801b7390b711631dfb574d037999d5c90c8eced666fc022100e66a617a1ec1e10cec9119814077b2b790c3dba13e2a9264c4cf9500d2db53f8:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2018-25031
    cwe-id: CWE-20
    epss-score: 0.82992
-    epss-percentile: 0.99203
+    epss-percentile: 0.99204
    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -54,4 +54,4 @@ headless:
        words:
          - "swagger"
        case-insensitive: true
-# digest: 4a0a00473045022100e838c11ab4d38f85dc795f245b45151fbcab155ad748926cc60883b5f542b0f1022044d4ced13c64fb425eb86be2d4acf008265caeb42eb95f91f975ffbce486774f:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210092addecbe0999e8ac7566a8b688cfbd6a662f6480b8b8aab4c4dc0b19656a67e022100d627e696252fbcffe4f777cb7bcb58f4a7b501b34222468a4025204389672d21:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2022-29455
    cwe-id: CWE-79
    epss-score: 0.69544
-    epss-percentile: 0.98577
+    epss-percentile: 0.98579
    cpe: cpe:2.3:a:elementor:website_builder:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
@@ -52,4 +52,4 @@ headless:
        words:
          - "elementor"
        case-insensitive: true
-# digest: 4a0a0047304502203dd0b2c9701288467d94a362390f2cb1a005536efaaa0cccb531a0926a850134022100ca5a8aef4c3b209423883567ed873f02394c90a4df5006f9fe3c559c9254b56f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022034041612068bb6cc23a19b360e6acbd244a6a4058cf1d36cd8222f5a2f1b503f02210080b9f278c949817375c1590c7732a2e556d93e25ea1090cd9a519b1c90a90a62:922c64590222798bb761d5b6d8e72950
@@ -15,7 +15,7 @@ info:
    cve-id: CVE-2024-29882
    cwe-id: CWE-79
    epss-score: 0.02716
-    epss-percentile: 0.85411
+    epss-percentile: 0.85401
  metadata:
    verified: true
    max-request: 1
@@ -46,4 +46,4 @@ headless:
          - "ConnectSRS</a>"
        condition: or
        case-insensitive: true
-# digest: 4a0a0047304502200b0144fed543fbeec15bd38f12e99fca7b18659f5ac656c9cd21233a88761c5d0221008b6f0e7c3856eff15e67b3d7dac58f90c0eddd0672bf8584a269af3bf839a4f1:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220558a089dc181f6ec5760dd0ce307114bfa92ee5a5c1016d5bee66631a891b03402203e32c3102bf24d9b61500ae2f19afe47da572f008de06db6a8a6a53e462a9703:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cvss-score: 7.2
    cve-id: CVE-2024-38526
    epss-score: 0.79167
-    epss-percentile: 0.99013
+    epss-percentile: 0.99018
  tags: cve,cve2024,supply-chain,polyfill,vkev,vuln
 headless:
  - steps:
@@ -60,4 +60,4 @@ headless:
          - "union.macoms.la"
          - "newcrbpc.com"
        part: urls
-# digest: 490a0046304402203dba0b13c409226c564b46a63a5196413b2e7b5ce6a91e92122792343f74c54f0220344dd7af2907be636b1679e766698ce3af873584b0f890406a6af2afc1e90228:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b931374196adc17b46064f13d99af21f0b4d196d6d98ef8a0f6399a13814b18a02200e531edd5973acf6e0487bf3875e44a0680ca471226aed577a872ea97374088f:922c64590222798bb761d5b6d8e72950
@@ -11,8 +11,8 @@ info:
    - https://patchstack.com/articles/reflected-xss-patched-in-essential-addons-for-elementor-affecting-2-million-sites/
    - https://github.com/Sachinart/essential-addons-for-elementor-xss-poc/blob/main/poc.py
  classification:
-    epss-score: 0.03281
-    epss-percentile: 0.8669
+    epss-score: 0.03198
+    epss-percentile: 0.86487
  metadata:
    verified: true
    max-request: 1
@@ -42,4 +42,4 @@ headless:
        words:
          - "{{random_int}}"
        case-insensitive: true
-# digest: 4b0a00483046022100da5bbcb4549f13fc31969ab23c892267432839b73de45f4d56ca9ff4f3b94dde02210096981bd99f94ed68af0aede919fd5af76839a845baf0c3f2d583ecc74a85bd38:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220620f3dc941df3e688c304ad234066a1d8a87fc2b1fa1a04ef9850f24e613510e022100b00c68736b6f7bac99a0677c564247d90e688024cc08909d957a4fc6c55309c1:922c64590222798bb761d5b6d8e72950
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2025-25062
    cwe-id: CWE-79
    epss-score: 0.34064
-    epss-percentile: 0.96772
+    epss-percentile: 0.96767
    cpe: cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*
  metadata:
    max-request: 7
@@ -186,4 +186,4 @@ headless:
        dsl:
          - reflected_text_xss_type
          - reflected_text_xss_message
-# digest: 490a00463044022012e69de0da1cc20f3fa44826668f66027ac6df5b93db3a1d0199d623570cfff40220674c35f925bf640e3f0cadf3da54932308ec587ff8d15fc53be3afd231fe5983:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a17efb62fee55c45342f1aca08abe8984f346f12eae5f7bf59b14f8a31240df0022006f396de2e67edbc06c2fcbbd24ba3de7ad0df3e39ea1e26656466e8717c348d:922c64590222798bb761d5b6d8e72950
@@ -16,7 +16,7 @@ info:
    cve-id: CVE-2025-29927
    cwe-id: CWE-285
    epss-score: 0.9253
-    epss-percentile: 0.9972
+    epss-percentile: 0.99722
  metadata:
    vendor: vercel
    product: Next.js
@@ -55,4 +55,4 @@ headless:
          - "compare_versions(nextjs_version, '> 14.0.0', '< 14.2.25')"
          - "compare_versions(nextjs_version, '> 15.0.0', '< 15.2.3')"
        condition: or
-# digest: 490a0046304402204f815d2bf457a60bb3f54fa62333cb13ad61d17b56d942f9c5c875cf9bfe2a48022055a57f29f390a528c42a38d03de5496ccc916adc67e19cfc6a7b1627ec0e3071:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100af9785bc77b70ef5e8fe304f65b6827a469b6897d09860a8cbafe4ef5b4098ab02204b88dc3575deadacfc2e3f730e88fc5cd6f6286be4be01bdaedeafafa4d21b23:922c64590222798bb761d5b6d8e72950
@@ -15,7 +15,7 @@ info:
    cve-id: CVE-2025-8191
    cwe-id: CWE-79
    epss-score: 0.0123
-    epss-percentile: 0.78507
+    epss-percentile: 0.78509
    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -65,4 +65,4 @@ headless:
        words:
          - "swagger"
        case-insensitive: true
-# digest: 4a0a0047304502201656ac1cee054333eab2079f458aac67d16df1a5bf051a3bf554a9b468c12cf9022100968bfd3ca11c0008b15af7a7676e5f47af285673b73dac61323985566da3415d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100bf467b92bb54a513c07a7dd2aa60c60f41c1addbed2fc05dca493900e01bcaed02202a8a76331e4af40e5f08916dbd0bb736cade93edc26639886155adeb880bf8b9:922c64590222798bb761d5b6d8e72950
@@ -59,4 +59,4 @@ http:
        group: 1
        regex:
          - 'version:([0-9.]+)'
-# digest: 4b0a0048304602210098a5c9afc4d83b12aa11df7d0c8c0e3e10c1b38c9f3469e8c3d22fd463721d7e022100e4b63c812bd570064551303069651b9fdfb3dc8d113e204d63ad4144d90a282d:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205332a03942b696ffdaf4514030f433335731ac7445fcfa0a9131c17cb83b687202207e6fc2c1d794e984243e5f602ea871821d372de93b4374a49b3b3a80ae77428b:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N
    cvss-score: 6.4
    cve-id: CVE-2000-0760
-    epss-score: 0.33581
-    epss-percentile: 0.96733
+    epss-score: 0.65623
+    epss-percentile: 0.98413
    cpe: cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -55,4 +55,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100d52c4d588c2a01af9b3ce9004fe9aada42e7c1c8d4d636997aebd98e1c637af50220146b811ae42eb4dd8469e72b8e2d6c3dd8a3908e11c70f58257bba810f25199a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502205ce0b599e4c517935b356826b8b065ac225bdde1d74ff84196e6f529739a4292022100aa157c5a6531f56de77d8a205e3fce64dd0c3e50bc42f6b93daee89acab80545:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2002-1131
    cwe-id: CWE-80
    epss-score: 0.03877
-    epss-percentile: 0.87732
+    epss-percentile: 0.87736
    cpe: cpe:2.3:a:squirrelmail:squirrelmail:*:*:*:*:*:*:*:*
  metadata:
    max-request: 5
@@ -60,4 +60,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a00463044022002c97511d1ebf220531eaed350b68c98f29ba29bad1e97f6b4f301f36cf438340220383ae1526b62ea0412ece506b8b8c58ac11075b9d3f6c9afe4ad87af56dea4e1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221009dafa7d7a8dffea049773b86bb1bbab11544ca0004bcb9b849683c76c8e2485a02200b0f46c61ce9c0cb51b9c95b6df330fc5ce87295ad1df784bc9f4235474320ac:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2004-0519
    cwe-id: NVD-CWE-Other
    epss-score: 0.00124
-    epss-percentile: 0.32307
+    epss-percentile: 0.32339
    cpe: cpe:2.3:a:sgi:propack:3.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -48,4 +48,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502203008aaf6bbe4ade4a1903439a637f426a574d02a274119a6e6ee65ce72a32866022100c47db39c2b6b2e2f36d7b505c3216848997f50046dfae20efdf79016965a9f14:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220482f005db704fd496f0e04fdc5d6a657b64028a787c62478aab7bd17dda4d0ec022100a9f5e846faf7569e3b54f6039cf126a36df1bb35625535b66ec3afb5617340c5:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2004-1965
    cwe-id: NVD-CWE-Other
    epss-score: 0.00265
-    epss-percentile: 0.49812
+    epss-percentile: 0.49806
    cpe: cpe:2.3:a:openbb:openbb:1.0.0_beta1:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -40,4 +40,4 @@ http:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$'
-# digest: 490a00463044022060699800a696b7e0f8d5b4d2b083c9e9af27a608e9c0cedd72243b4a459bee0202200f479615aeb892c750a538803612b26d9cc9f0a1418a5e9b378e3452690e8474:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206c46055e57092ee031148672031d0e22b49272e5a0857ad53ad2e466153ad9950220799ce49158105f62ff4e3014ebde77ffd93d2e6f867c026fc1374b547807da6a:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 5
    cve-id: CVE-2005-2428
    cwe-id: CWE-200
-    epss-score: 0.08605
-    epss-percentile: 0.92033
+    epss-score: 0.06321
+    epss-percentile: 0.90538
    cpe: cpe:2.3:a:ibm:lotus_domino:5.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -44,4 +44,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022041ad41d9936332aa799b544199be5b20807b0d4d25666b722b8357fa8fe63b25022100f66e45422f74e5cbe64ea68690f48521fc40dabbbc865ed460fe08ba1aa0ae6b:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e27b5564c1ce0432367fef28996116fdfed26910e63a54119ca94bc05da9d5820221008de003eec4ec0a8dd72263eaf0baba52b74b655528d8970c724fad9ac84af23b:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
    cvss-score: 5.4
    cve-id: CVE-2005-3128
    epss-score: 0.01733
-    epss-percentile: 0.81851
+    epss-percentile: 0.81832
    cwe-id: CWE-80
  metadata:
    max-request: 1
@@ -40,4 +40,4 @@ http:
        part: header
        words:
          - "text/html"
-# digest: 490a00463044022005b2cdca03f47904cfd4c555464b28b7b5b86bc6017b45792953cfb2b8eb5812022040a26de2e7f871715d464a6aa15f05b8034a31a8e6275b8773f6a64312b4fbde:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502205afe95746bc2a44a6192867c14a26fa883d19454a3323a564477a56ecd6e309f022100c6dad1a5f54df0f542edae68dd1a3d64a4075360fb0ba50c49078aa5a931ae66:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2005-3344
    cwe-id: NVD-CWE-Other
    epss-score: 0.1015
-    epss-percentile: 0.92786
+    epss-percentile: 0.92777
    cpe: cpe:2.3:a:horde:horde:3.0.4:*:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -47,4 +47,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100b9b369bd98be9b4b905ce274aef81d505ce7956bd1b016266a52cc27610b78c0022100ac78a148ec64701f2abf636d2c47003a1aa185eb7bffe368743d30fd6c55ceb8:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022069103c3ec6f0b5a4782b752580b541c494e6b687ccd290707d59cf3fd8506466022100953d7f3ec676dfcbb248c252e23aeb7ba6a4e0cee7f7b364ecde1719f69e7d51:922c64590222798bb761d5b6d8e72950
@@ -23,7 +23,7 @@ info:
    cve-id: CVE-2005-3634
    cwe-id: NVD-CWE-Other
    epss-score: 0.01653
-    epss-percentile: 0.81421
+    epss-percentile: 0.81406
    cpe: cpe:2.3:a:sap:sap_web_application_server:6.10:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -45,4 +45,4 @@ http:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$'
-# digest: 4a0a0047304502207221d48b29ea77ded5f91997fa3ab6f32d4ac7de08b881339da0319e8e88fee202210089bc311cdc992e3d2cf014717ce9e2e34e3f2e97847f863e37df1ddb810e5abb:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207726228cd9e49dd00ff836be3fa993d42520855df4c6f681ea14de91dae929fd02207519f13c615ae1b06c303012ad6a9870ac907371e261fd0c50d088a9830f76f2:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2005-4385
    cwe-id: NVD-CWE-Other
    epss-score: 0.00373
-    epss-percentile: 0.58264
+    epss-percentile: 0.58266
    cpe: cpe:2.3:a:cofax:cofax:1.9.9c:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -43,4 +43,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100a3e690080bc745e4f428894ed34c866d05ece72367c52b071f9d445ec4ece163022100abbb4b0cc54c51ebf056a73309aa0da41bbaa2088db0631e1328d4cbdd3b38ee:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f86f9b46831b1c7f323168fda14e3907af8e723ea601697be19dd06af30a740902200104575dbb4b8138f97e00a0228ffd9a3b66efaccdba58c87a89256d55bafcd9:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2006-1681
    cwe-id: NVD-CWE-Other
    epss-score: 0.00299
-    epss-percentile: 0.52782
+    epss-percentile: 0.52759
    cpe: cpe:2.3:a:cherokee:cherokee_httpd:0.1:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -62,4 +62,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a00463044022068b8aaadbd8be86362ee29616a946dbdcbfb300687e0d0d8a57619a5f757daff0220740ebe1e2dc4de0b9490a7a756c013b1a57dd069dff9ecb9288f24db68b59e06:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220062e8d719f08e84a250949357d925976fe5b07e77eacf1573945d251933effe90221008b1630fc674b9060b4fcf210f55349c253d1df35de9a83a31c3247257bcf21ca:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2006-2842
    cwe-id: CWE-22
    epss-score: 0.0094
-    epss-percentile: 0.75458
+    epss-percentile: 0.7546
    cpe: cpe:2.3:a:squirrelmail:squirrelmail:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -48,4 +48,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a004830460221008dc5a1de2289390caff89cb914ad3aa0ba688248c5ff696adc591696e5e43166022100b13a37cd23698b0e7c129e2bf649fe9f3fbeaec2b70034fa65634a03249e6adf:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c2256d78915d25d4df1e0d25e028d15520fe12f70247fa5b1d4e9042b77f43c0022100a96fd7c141b6a40abaeb7a77962424e653b9c4c1e3760d3adabed6209e3b04af:922c64590222798bb761d5b6d8e72950
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2007-0885
    cwe-id: NVD-CWE-Other
    epss-score: 0.02133
-    epss-percentile: 0.83607
+    epss-percentile: 0.83599
    cpe: cpe:2.3:a:rainbow_portal:rainbow.zen:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -44,4 +44,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a0046304402204ea488deba2531677c9ffdd244466af6669aa033e96bf48f22c60427930973ee02203d5fcb05288e261b2e57441b63ba137428804b665a51302f199bcbbc1217f4a5:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100eda14ccf8eeaaaf8029c97bf324dca7df1aa289f71825ee667a5e4508f98e3af0220546cbe42bab6ab502d562e0fb84906334df35aca519cfb9e0da612e58f684709:922c64590222798bb761d5b6d8e72950
@@ -14,7 +14,7 @@ info:
    cvss-score: 7.2
    cwe-id: CWE-79
    epss-score: 0.82646
-    epss-percentile: 0.99184
+    epss-percentile: 0.99186
  metadata:
    max-request: 1
    verified: true
@@ -43,4 +43,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a00463044022034911a6e934ba7bca94b5503e4846d9c12b618bcbc10c5b1ba4c023dae965c84022013d64fa600e7599a220a03d549b7c44dd109fdc0ccd82494e01f73d539bd8064:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d49e6b4103625a0f23f4aa0615bc422dc87fdcb9f3b6c09b6c2b38d7a00b3461022100bc4a6c1947a3935fc76fd745e7d1ed1f1cc1a4f27c7dc12159b9dcc336a65a7e:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 5
    cve-id: CVE-2007-4504
    cwe-id: CWE-22
-    epss-score: 0.00177
-    epss-percentile: 0.39599
+    epss-score: 0.0006
+    epss-percentile: 0.18655
    cpe: cpe:2.3:a:joomla:rsfiles:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -42,4 +42,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022051fba17a1923ae424e62377810bb1561b09e0083aad894c131f90d362c22e5770221009c58a4362512328579af380e6b7971a83f5d9551fe1e4e5eeb80fa573fac9915:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a632fbd89ee7d7168b84c7a8351cb260c3be99daa440dca4d93607d2e2e92682022010d8370dadd0bedd78f49f13c84874587afe8e1191cecfe5d3952b173de2df09:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2007-4556
    cwe-id: NVD-CWE-Other
    epss-score: 0.02359
-    epss-percentile: 0.84388
+    epss-percentile: 0.84375
    cpe: cpe:2.3:a:opensymphony:xwork:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -51,4 +51,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a0046304402201544841fd58b7d38e75459a1eae4b0ad802efdabf312360b59c5b124c7f67aa502202dc593fa2f9314e5e1e5e849e3fa2536aed12503fc25260403a2a27dc231e7bc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220681e3e030dae241ae87fc985bcbbc0bda37e25945ee039dce2932c0279e9ae6902210093d3e554bbe06521fabf8cc5cefb9e8bb6644fc79769a5cb835fad89a8348e15:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2007-5728
    cwe-id: CWE-79
    epss-score: 0.00488
-    epss-percentile: 0.64601
+    epss-percentile: 0.64598
    cpe: cpe:2.3:a:phppgadmin:phppgadmin:3.5:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -57,4 +57,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a0046304402202e1173971ababbc8a4247d4681db8efb09d725226a96203f1fbb0ee811ef59a002203c87d5e996d6de57b711e40941acfe3b832c6494f39e092f5efa56a9100455ce:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100be9d734739e44ad53d0b091b97e512e640fda1e67c535820f98f8723a21e6f6302206bd8b0cdd90a0807cd8e869f2192e57a6d6a70d126f59ca474a1c0e7b0c00eed:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2008-1059
    cwe-id: CWE-94
    epss-score: 0.00265
-    epss-percentile: 0.49835
+    epss-percentile: 0.49829
    cpe: cpe:2.3:a:wordpress:sniplets_plugin:1.1.2:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -47,4 +47,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022023eaa01ed9e7f89e4097d767b5368274d0f90ab508ae8cb8930e589248638f17022100a34adc409c725568676504db0b8153e6615b0756e2cfcf1c55eed61b0ef819a2:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d0caca73172cb00699df02ab0255d6bb20bb48cf44e51006f86ff2440523f783022100dbfe50ad7ad767fcf4ec516ba133fbe911f95a4e6f568389c3ed2499a3734ea7:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2008-1061
    cwe-id: CWE-79
    epss-score: 0.00155
-    epss-percentile: 0.36781
+    epss-percentile: 0.36788
    cpe: cpe:2.3:a:wordpress:sniplets_plugin:1.1.2:*:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -62,4 +62,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100afdc9c7d136cbf9723318de12171af171aafb7708be0db2081eca4a808dcf7330221009ae3ad1810a556b9416b1a76f96cc6c4a1ba8a0386a35f1f5eb2d3d4ff29d71b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202d74bbb178b65b8d4d1c670fdb6ccb0368f61303f47995ecc3317e2cad75316b022100eb29d9070b1a7e33dd63756ff0a3fc4f88d7cd434da57289b9b9860b3af1a748:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2008-1547
    cwe-id: CWE-601
    epss-score: 0.65006
-    epss-percentile: 0.98379
+    epss-percentile: 0.98381
    cpe: cpe:2.3:a:microsoft:exchange_server:2003:sp2:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -51,4 +51,4 @@ http:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
-# digest: 490a0046304402202f5c9d9a4323d4d4043ec1e7964803006f95bf6c2be141d57fd21ad8e8a3a30f02206c8b34b098ff8e7226797e74fe7e2caf2748c3cf05d919f645f24e4fe938271a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502205f796732a5355990b3abba6f7d86afd5da7b38c87e122344e56f3df1ea81d3ff022100d06446bd84b9a9875c9a043e5b9bdb7d7f18e936eb082127fe58209450dd621f:922c64590222798bb761d5b6d8e72950
@@ -19,7 +19,7 @@ info:
    cve-id: CVE-2008-2398
    cwe-id: CWE-79
    epss-score: 0.00437
-    epss-percentile: 0.62273
+    epss-percentile: 0.62251
    cpe: cpe:2.3:a:appserv_open_project:appserv:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -47,4 +47,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a004630440220236a7879c4f9aa170f81cb4eb64b10eda266b4abc31b79951bfe7640c832ff9202205e19a39e0502dc543403b4fe41004d6b77f12973f843501320430acfba829f76:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100dbb4edac2211a6f44c91611514b36fd0c8a5cd62275248b63ac032f941586a0e022100ecad4b52469a21900bb07fd05e241016c9a309b50000c842e50380ad4bebc920:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2008-2650
    cwe-id: CWE-22
    epss-score: 0.01643
-    epss-percentile: 0.81358
+    epss-percentile: 0.81341
    cpe: cpe:2.3:a:cmsimple:cmsimple:3.1:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -48,4 +48,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022009374f5de78831d34d2fee96e02cecf4af4fb73fd8a97a8ff0d63fbe0a6e684d022100a5b4a54e1fd713ff1f8f81a5ae224dc0c45355b7e0cfe9f4815a8606e0267e53:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100cec0e71f86555acb50c217e41def09899827c0f6864abac2fcfb1dcd6f1c84e9022100f91a1a004065ef2b4309bc9fd8ae4b6ceae074c508e1f352ea0de141deab0c25:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2008-4668
    cwe-id: CWE-22
    epss-score: 0.00268
-    epss-percentile: 0.50097
+    epss-percentile: 0.50093
    cpe: cpe:2.3:a:joomla:com_imagebrowser:0.1.5:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -43,4 +43,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a0046304402202be20813f968fe3da3c1a32ff70ea125a2824f7502597ff01d4e650b33b95c0b022072d2c142b9ee53a84048a756e5b0d80bf7dcef3db1cc33fc3349a9cd35573c6c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100eadba1af98a8c502efd2b328b97649670174156ebdb235ea47da9439f75e2ca2022100e2ab130c92dd67485449eabf269398cd9e8560c4fdd31cbf252aebc8fdbeef63:922c64590222798bb761d5b6d8e72950
@@ -18,7 +18,7 @@ info:
    cve-id: CVE-2008-4764
    cwe-id: CWE-22
    epss-score: 0.01921
-    epss-percentile: 0.82777
+    epss-percentile: 0.82759
    cpe: cpe:2.3:a:extplorer:com_extplorer:*:rc2:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -40,4 +40,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a0046304402204437710409d6b2167dce0c4fe086b178817a9189dd8f32f9a93aec31f6474bc50220303f045b437552d7a2e5dba47cf801f5e93eb21dc67755470c1a016114dd8be6:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022021a79bd295e6fd6b0fede95d696b48cbcce7a2e5e9b02d688c7d4d69a4147d72022025de58100c84a3578d39444afcc4f40a5b1a5a2c5614c723be801cc6278ee2c4:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2008-5587
    cwe-id: CWE-22
    epss-score: 0.01986
-    epss-percentile: 0.83015
+    epss-percentile: 0.83
    cpe: cpe:2.3:a:phppgadmin:phppgadmin:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -49,4 +49,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100b85a544e01868fd305bcb0211d75b2aff989bee44ffd6dd04dfbc6c77af0e8b402204c11d465bbd557cbe9457d681124b3fcd32812daebde4d6fd24479b30fa8bd2d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f9a7dc14da2d0497c06b87f8d20553cdbb032bd812ef52cfa4bb6266fad045c70220054cdfd3aced4268ac1b90ad4f6c4b6909e1138a5e91e35e702d5a4cb31f0005:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2008-6080
    cwe-id: CWE-22
    epss-score: 0.063
-    epss-percentile: 0.90531
+    epss-percentile: 0.90524
    cpe: cpe:2.3:a:codecall:com_ionfiles:4.4.2:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -42,4 +42,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100cd06a823d7557315549f794cec76fe2d84d78584177c4d07a320849258bc9f7a022004b369c92b899740f67405abf5712ad45c6dfebc58c26b7e2d81c06487117963:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205ffc8f2f0d134563344a20994f84be19bc8d3ab9f2e187602e54cb420ebe6044022031c2b187dfd17883a1c9bc6fad0c4b74b632d063a2ab4fc9d40d08947b41d3b0:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2008-6172
    cwe-id: CWE-22
    epss-score: 0.07294
-    epss-percentile: 0.91253
+    epss-percentile: 0.91242
    cpe: cpe:2.3:a:weberr:rwcards:3.0.11:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -42,4 +42,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100ed88288b10f2ab02155e209c31fea6a3ead673ba155eb8afc725474399c6e957022027baefedb3cae0b99a707026ae0d7725ba38ad808cdeaf934ec2cad2aea41677:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d0f3de31f714d4fae5dc9bc4a27f0859c1e87e2ed1907a88e450963d713d29e10221009b22df03a24b19daf97a19f3e0de2817402656fbe1f99887001fb9eddd55db98:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2008-6222
    cwe-id: CWE-22
    epss-score: 0.01649
-    epss-percentile: 0.81398
+    epss-percentile: 0.81383
    cpe: cpe:2.3:a:joomlashowroom:pro_desk_support_center:1.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -42,4 +42,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100867f8c1bf2c51be3ff37a2d5767a2fda892c42f7ef57acba6fa96791a8aebbcc02203778dfb52ba2e491785d6640882b28722e4b393ccdfd2ef443b81096d1d34dfa:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200a229a693b9dbe066bb2ed32a1ab6b9e57f73a79dd9bc75ea031ebdcff68fd6d02210092e285fb42e8ad23105647ae3f4fe013a42107a1c8b8e25e8f34c91caa568c3e:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2008-6465
    cwe-id: CWE-79
    epss-score: 0.01157
-    epss-percentile: 0.77882
+    epss-percentile: 0.77881
    cpe: cpe:2.3:a:parallels:h-sphere:3.0.0:p9:*:*:*:*:*:*
  metadata:
    verified: true
@@ -63,4 +63,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502202631f891313e8cb0aba1002553415d097170545c75743a6dcef16aad01cce8e5022100cf53439f519d14b8b55464bdd7f126f61a729d5bbf36f121208e7c3ed2e1cc1b:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ed4c2fcbcd3d631b0d91ef04752e2d73305a6542080b775f8476468db672b7e80221009c80fa6bb7f1126bac87d3c52e1e2d5c5cec31eae8092d102bde74ca946c77be:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,7 @@ info:
    cve-id: CVE-2008-6668
    cwe-id: CWE-22
    epss-score: 0.01077
-    epss-percentile: 0.77109
+    epss-percentile: 0.77107
    cpe: cpe:2.3:a:dirk_bartley:nweb2fax:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -45,4 +45,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100f195e91dd2f035f528a52b82cad0a26199a5ee2a12d686612fb03d11eb6822c5022100ba88f4fe124fc166ee758dfa26de0af128987f44734eb7ded86973c5d06d59ab:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100fad404533668ec9446f59658b59a65e3a0e382786d50ebc1ad33086351f458610220079f45cba82719e58f0ffe6a60df506a2231b25d10c88cd795bfb3b8ac2e8ebf:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2008-6982
    cwe-id: CWE-79
    epss-score: 0.08587
-    epss-percentile: 0.92025
+    epss-percentile: 0.92017
    cpe: cpe:2.3:a:devalcms:devalcms:1.4a:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -51,4 +51,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 4a0a00473045022100e03d6a08d340bfc31e4b3135fdca64308d208e1434bcc0e235e7b446d7ec246002200825de3c550297f763f576c6993926ecd5f4392c9369a0081273f8b9c7136d28:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210095abf9858d1995714056c15b0f767110876f0cce8312a63775da93c4201d49310220358c793e386f9f7db123af2a23322c71cb81cf8dca011b10b3289ca9ceeb85de:922c64590222798bb761d5b6d8e72950
@@ -18,7 +18,7 @@ info:
    cve-id: CVE-2008-7269
    cwe-id: CWE-20
    epss-score: 0.00653
-    epss-percentile: 0.70084
+    epss-percentile: 0.70083
    cpe: cpe:2.3:a:boka:siteengine:5.0:*:*:*:*:*:*:*
  metadata:
    verified: "true"
@@ -41,4 +41,4 @@ http:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:http?://|//)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
-# digest: 490a0046304402204b158b8a7a949d9a81ab3270bb35787fdcac419dbae5cab3086059a5344d3fdb022043293985cccf3c5b03501f7450c5a56d68e8b9d1d6cc669604e089410602b1d8:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008f4efaf8be4e2884ef06a78fc6d21bd0b9234647d377c0b33deb0086d4e46d660220151a81309f2e4007b3b05fd1c0ecab5eee0e875830ddcd9c87bcc631cfb2511d:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2009-0347
    cwe-id: CWE-59
    epss-score: 0.03639
-    epss-percentile: 0.87342
+    epss-percentile: 0.87334
    cpe: cpe:2.3:a:autonomy:ultraseek:_nil_:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -40,4 +40,4 @@ http:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:http?://|//)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
-# digest: 4a0a00473045022100fd3a9a239f8b98ebb27c6dd4e7f149a8af03abef34ebc6a2c338b6f4cef78cfc02202c40007cb25007dde9869bed6dd2326aa91b3feecfa86ab9ac63e344676391b5:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502205f9b463cd06f54364d3a10e8694205ac9a67530a30fb21404a8afce42555ea7e022100cf8c3e7c768d201fce4be03382f832e58a939d013002ed9e1fa92ff9fc4512b3:922c64590222798bb761d5b6d8e72950
Author	SHA1	Message	Date
pussycat0x	a0fd48aab8	lint - fix	2025-12-13 16:49:43 +05:30
pussycat0x	7593a6ff73	SSH - Detection	2025-11-06 18:43:32 +05:30