Instruction: Generate a Nuclei template for: Nocobase - Config

Input:
Title: Nocobase - Config
Summary: Nocobase - Config. The path /api/v1/db/meta/nocodb/info of the NocoBase web application was exposed, revealing internal information. NocoBase was an extensibility-first, open-source no-code/low-code platform for building business applications and enterprise solutions.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: nocobase-config

info:
  name: Nocobase - Config
  author: icarot
  severity: medium
  description: The path /api/v1/db/meta/nocodb/info of the NocoBase web application was exposed, revealing internal information. NocoBase was an extensibility-first, open-source no-code/low-code platform for building business applications and enterprise solutions.
  tags: nocobase,config,exposed,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""authType":"
          - ""env":"
          - ""version":"
          - ""ncSiteUrl":"
          - ""mainSubDomain":"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: aircube-login

info:
  name: airCube Login - Detect
  author: DhiyaneshDk
  severity: info
  description: airCube login panel was detected.
  tags: panel,aircube,ubiquiti,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>airCube</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: ExchangeRate-API API Test

Input:
Title: ExchangeRate-API API Test
Summary: ExchangeRate-API API Test. Free currency conversion
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-exchangerateapi

info:
  name: ExchangeRate-API API Test
  author: daffainfo
  severity: info
  description: Free currency conversion
  tags: token-spray,exchangerateapi

http:
  - method: GET
    path:
      - "https://v6.exchangerate-api.com/v6/{{token}}/latest/USD"
    matchers:
      - type: word
        words:
          - ""time_next_update_utc""
          - ""base_code""
          - ""conversion_rates""
        part: body
        condition: and


Instruction: Generate a Nuclei template for CVE-2022-24112

Input:
Title: Vulnerability (CWE-290) in apache apisix
Summary: An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
Vulnerability Type: Vulnerability (CWE-290)
Severity: critical
Affected Products: apache apisix
Indicators: error, vulnerability detected

Output:
id: CVE-2022-24112

info:
  name: Apache APISIX - Remote Code Execution
  author: Mr-xn
  severity: critical
  description: A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
  tags: cve,cve2022,apache,rce,apisix,oast,kev,intrusive,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""reason":"OK""
          - ""status":200"
        part: body_1
        condition: and
      - type: word
        words:
          - "http"
        part: interactsh_protocol
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: TrueNAS API Key (WebSocket)

Input:
Title: TrueNAS API Key (WebSocket)
Summary: TrueNAS API Key (WebSocket). Tags: truenas, keys, file
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: truenas-api

info:
  name: TrueNAS API Key (WebSocket)
  author: DhiyaneshDK
  severity: info
  description: TrueNAS API Key (WebSocket)
  tags: truenas,keys,file

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: gitea.com Login Check

Input:
Title: gitea.com Login Check
Summary: gitea.com Login Check. Checks for a valid gitea account.
Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: gitea-login-check

info:
  name: gitea.com Login Check
  author: parthmalhotra,pdresearch
  severity: critical
  description: Checks for a valid gitea account.
  tags: cloud,creds-stuffing,login-check,gitea,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Location: /"
        part: header
      - type: status
        status:
          - 303


Instruction: Generate a Nuclei template for: Adobe ColdFusion Security Checks

Input:
Title: Adobe ColdFusion Security Checks
Summary: Adobe ColdFusion Security Checks. A simple workflow that runs all Adobe ColdFusion related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: coldfusion-workflow

info:
  name: Adobe ColdFusion Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all Adobe ColdFusion related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: veeam-backup-azure-panel

info:
  name: Veeam Backup for Microsoft Azure Panel - Detect
  author: dhiyaneshDK
  severity: info
  description: Veeam Backup for Microsoft Azure panel was detected.
  tags: azure,panel,backup,veeam,microsoft,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "<title>Veeam Backup for Microsoft Azure</title>"


Instruction: Generate a Nuclei template for: Deimos C2 - Detect

Input:
Title: Deimos C2 - Detect
Summary: Deimos C2 - Detect. DeimosC2 is a post-exploitation Command & Control (C2) tool that leverages multiple communication methods in order to control machines that have been compromised. DeimosC2 server and agents works on, and has been tested on, Windows, Darwin, and Linux.It is entirely written in Golang with a front end written in Vue.js.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: deimos-c2

info:
  name: Deimos C2 - Detect
  author: pussycat0x
  severity: info
  description: DeimosC2 is a post-exploitation Command & Control (C2) tool that leverages multiple communication methods in order to control machines that have been compromised. DeimosC2 server and agents works on, and has been tested on, Windows, Darwin, and Linux.It is entirely written in Golang with a front end written in Vue.js.
  tags: c2,ir,osint,deimosc2,panel,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/login"
    matchers:
      - type: word
        words:
          - "<title>Deimos C2</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Path Traversal

Input:
Title: Path Traversal (CWE-22)
Summary: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escap
Vulnerability Type: Path Traversal
Severity: high
Indicators: unexpected

Output:
id: vmware-vcenter-lfi

info:
  name: VMware vCenter - Local File Inclusion
  author: dwisiswant0
  severity: high
  description: VMware vCenter is vulnerable to local file inclusion.
  tags: vmware,lfi,vcenter,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Confluence Installation Page - Exposure

Input:
Title: Confluence Installation Page - Exposure
Summary: Confluence Installation Page - Exposure. Confluence is susceptible to the Installation page exposure due to misconfiguration.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: confluence-installer

info:
  name: Confluence Installation Page - Exposure
  author: DhiyaneshDK
  severity: high
  description: Confluence is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,exposure,install,confluence,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/setup/setupcluster-start.action"
    matchers:
      - type: word
        words:
          - "Choose your deployment type - Confluence"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - iTunes

Input:
Title: Content-Security-Policy Bypass - iTunes
Summary: Content-Security-Policy Bypass - iTunes. Tags: xss, csp-bypass, itunes
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: itunes-csp-bypass

info:
  name: Content-Security-Policy Bypass - iTunes
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - iTunes
  tags: xss,csp-bypass,itunes,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "apple.com"
        part: header
        condition: and


Instruction: Generate a Nuclei template for: Kubelet Scan

Input:
Title: Kubelet Scan
Summary: Kubelet Scan. Scans for kubelet pods. Tags: tech, k8s, kubernetes
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: kubelet-pods

info:
  name: Kubelet Scan
  author: sharath
  severity: info
  description: Scans for kubelet pods
  tags: tech,k8s,kubernetes,devops,kubelet,pods,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/pods"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - ""PodList":"
          - ""items":"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: Azure Blob Storage Soft Delete Not Enabled

Input:
Title: Azure Blob Storage Soft Delete Not Enabled
Summary: Azure Blob Storage Soft Delete Not Enabled. Ensure that Soft Delete feature is enabled for all your Microsoft Azure Storage blob objects (blobs and snapshots). Soft Delete enables you to save and recover blob data in case your Azure Storage blobs or blob snapshots are deleted. This extra layer of protection also extends to the Microsoft Azure blob data that is erased as the result of an overwrite operation. With Soft Delete feature enabled, when blob objects are deleted, they are transitioned to
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: azure-blob-soft-delete-disabled

info:
  name: Azure Blob Storage Soft Delete Not Enabled
  author: princechaddha
  severity: medium
  description: Ensure that Soft Delete feature is enabled for all your Microsoft Azure Storage blob objects (blobs and snapshots). Soft Delete enables you to save and recover blob data in case your Azure Storage blobs or blob snapshots are deleted. This extra layer of protection also extends to the Microsoft Azure blob data that is erased as the result of an overwrite operation. With Soft Delete feature enabled, when blob objects are deleted, they are transitioned to a soft deleted state instead of being permanently erased. When blob objects are overwritten, soft deleted snapshots are created to save the state of the overwritten blob data.
  tags: cloud,devops,azure,microsoft,blob-storage,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: adultism

info:
  name: Adultism User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Adultism user name information check was conducted.
  tags: osint,osint-porn,adultism,discovery

http:
  - method: GET
    path:
      - "https://www.adultism.com/profile/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "static/r-1OqQ4o/css/www/main.css"
        part: body


Instruction: Generate a Nuclei template for: Payara Server Default Page

Input:
Title: Payara Server Default Page
Summary: Payara Server Default Page. Tags: tech, payara, discovery
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: default-payara-server-page

info:
  name: Payara Server Default Page
  author: dhiyaneshDk
  severity: info
  description: Payara Server Default Page
  tags: tech,payara,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Payara Server - Server Running</title>"
        part: body


Instruction: Generate a Nuclei template to detect Improper Authentication

Input:
Title: Improper Authentication (CWE-287)
Summary: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Vulnerability Type: Improper Authentication
Severity: high
Indicators: vulnerability detected, error

Output:
id: netgear-wac124-router-auth-bypass

info:
  name: NETGEAR WAC124 - Authentication Bypass
  author: gy741
  severity: high
  description: NETGEAR WAC124 AC2000 routers contain an authentication bypass vulnerability. An attacker can gain access by bypassing proper authentication, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations.
  tags: netgear,auth-bypass,router,iot,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/setup.cgi?next_file=debug.htm&x=currentsetting.htm"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Enable Telnet"


Instruction: Generate a Nuclei template for: Zerobounce API Test

Input:
Title: Zerobounce API Test
Summary: Zerobounce API Test. Tags: token-spray, zerobounce
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-zerobounce

info:
  name: Zerobounce API Test
  author: 0xpugal
  severity: info
  description: Zerobounce API Test
  tags: token-spray,zerobounce

http:
  - method: GET
    path:
      - "https://api.zerobounce.net/v2/getapiusage?api_key={{token}}&start_date=2018-01-01&end_date=2019-12-12"
    matchers:
      - type: word
        words:
          - ""total":"
          - ""start_date":"
          - ""end_date":"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: Load Balancer Creation Not Restricted by Type

Input:
Title: Load Balancer Creation Not Restricted by Type
Summary: Load Balancer Creation Not Restricted by Type. Ensure that only compliant load balancer types can be used to create Google Cloud load balancers for the GCP projects and folders within your organization. The list of allowed load balancer types can only include values from the following list: INTERNAL_TCP_UDP, INTERNAL_HTTP_HTTPS, EXTERNAL_NETWORK_TCP_UDP, EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY, EXTERNAL_HTTP_HTTPS.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: gcloud-org-load-balancer-types

info:
  name: Load Balancer Creation Not Restricted by Type
  author: princechaddha
  severity: medium
  description: Ensure that only compliant load balancer types can be used to create Google Cloud load balancers for the GCP projects and folders within your organization. The list of allowed load balancer types can only include values from the following list: INTERNAL_TCP_UDP, INTERNAL_HTTP_HTTPS, EXTERNAL_NETWORK_TCP_UDP, EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY, EXTERNAL_HTTP_HTTPS.
  tags: cloud,devops,gcp,gcloud,resourcemanager,security,load-balancer,networking,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: booth

info:
  name: Booth User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Booth user name information check was conducted.
  tags: osint,osint-shopping,booth,discovery

http:
  - method: GET
    path:
      - "https://{{user}}.booth.pm/"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "- BOOTH</title>"
        part: body


Instruction: Generate a Nuclei template for: MacGyver.cap Malware - Detect

Input:
Title: MacGyver.cap Malware - Detect
Summary: MacGyver.cap Malware - Detect. Tags: malware, file
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: macgyver-malware

info:
  name: MacGyver.cap Malware - Detect
  author: daffainfo
  severity: info
  description: MacGyver.cap Malware - Detect
  tags: malware,file

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Image Pull Policy set to Always

Input:
Title: Image Pull Policy set to Always
Summary: Image Pull Policy set to Always. Ensures that Kubernetes deployments have the image pull policy set to 'Always', which guarantees the most up-to-date version of the image is used.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: k8s-image-pull-policy-always

info:
  name: Image Pull Policy set to Always
  author: princechaddha
  severity: low
  description: Ensures that Kubernetes deployments have the image pull policy set to 'Always', which guarantees the most up-to-date version of the image is used.
  tags: cloud,devops,kubernetes,k8s,devsecops,deployments,images,docker,k8s-cluster-security

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Node - Privilege Escalation

Input:
Title: Node - Privilege Escalation
Summary: Node - Privilege Escalation. Node.js is a popular open-source, cross-platform JavaScript runtime environment that executes JavaScript code outside of a web browser. It is commonly used for building scalable network applications and is known for its event-driven, non-blocking I/O model. Node.js is widely used for server-side scripting and has a large ecosystem of libraries and frameworks.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: privesc-node

info:
  name: Node - Privilege Escalation
  author: daffainfo
  severity: high
  description: Node.js is a popular open-source, cross-platform JavaScript runtime environment that executes JavaScript code outside of a web browser. It is commonly used for building scalable network applications and is known for its event-driven, non-blocking I/O model. Node.js is widely used for server-side scripting and has a large ecosystem of libraries and frameworks.
  tags: code,linux,node,privesc,local

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-2551

Input:
Title: Vulnerability (CWE-425) in snapcreek duplicator
Summary: The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.
Vulnerability Type: Vulnerability (CWE-425)
Severity: high
Affected Products: snapcreek duplicator
Indicators: error, vulnerability detected

Output:
id: CVE-2022-2551

info:
  name: WordPress Duplicator <1.4.7 - Authentication Bypass
  author: LRTK-CODER
  severity: high
  description: WordPress Duplicator plugin before 1.4.7 is susceptible to authentication bypass. The plugin discloses the URL of the backup to unauthenticated visitors accessing the main installer endpoint. If the installer script has been run once by an administrator, this allows download of the full site backup without proper authentication.
  tags: cve2022,cve,wordpress,wp,wp-plugin,duplicator,wpscan,snapcreek,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/backups-dup-lite/dup-installer/main.installer.php?is_daws=1"
      - "{{BaseURL}}/wp-content/dup-installer/main.installer.php?is_daws=1"
    matchers:
      - type: word
        words:
          - "restart this install process"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-48954

Input:
Title: Cross-Site Scripting (XSS) in discourse discourse
Summary: Discourse is an open-source discussion platform. Versions prior to 3.5.0.beta6 are vulnerable to cross-site scripting when the content security policy isn't enabled when using social logins. Version 3.5.0.beta6 patches the issue. As a workaround, have the content security policy enabled.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: high
Affected Products: discourse discourse
Indicators: error, vulnerability detected

Output:
id: CVE-2025-48954

info:
  name: Discourse OAuth Social Login - Cross-site Scripting
  author: ferreiraklet,DhiyaneshDK,pdresearch
  severity: high
  description: Discourse versions prior to 3.5.0.beta6 contain a stored Cross-Site Scripting (XSS) vulnerability in the OAuth/social login functionality. The vulnerability is caused by lack of proper content security policy enforcement when processing social login failures,allowing remote attackers to inject and execute malicious scripts in users' browsers.
  tags: cve,cve2025,discourse,xss,oauth,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/auth/failure?provider={{redirect_payload}}"
      - "{{BaseURL}}/auth/failure?provider={{basic_xss}}"
    matchers:
      - type: dsl
        condition: and
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-38035

Input:
Title: Vulnerability (CWE-863) in ivanti mobileiron_sentry
Summary: A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
Vulnerability Type: Vulnerability (CWE-863)
Severity: critical
Affected Products: ivanti mobileiron_sentry
Indicators: error, vulnerability detected

Output:
id: CVE-2023-38035

info:
  name: Ivanti Sentry - Authentication Bypass
  author: DhiyaneshDk,iamnoooob,rootxharsh
  severity: critical
  description: A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
  tags: cve2023,cve,packetstorm,ivanti,mobileiron,sentry,kev,rce,auth-bypass,oast,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Airtable API Test

Input:
Title: Airtable API Test
Summary: Airtable API Test. Integrate with Airtable. Tags: token-spray, airtable
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-airtable

info:
  name: Airtable API Test
  author: daffainfo
  severity: info
  description: Integrate with Airtable
  tags: token-spray,airtable

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""bases""
          - ""id""
          - ""name""
        part: body
        condition: and


Instruction: Generate a Nuclei template for: TIBCO Spotfire Statistics Services - Detect

Input:
Title: TIBCO Spotfire Statistics Services - Detect
Summary: TIBCO Spotfire Statistics Services - Detect. TIBCO Spotfire Statistics Services was detected.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: tibco-spotfire-services-detect

info:
  name: TIBCO Spotfire Statistics Services - Detect
  author: righettod
  severity: info
  description: TIBCO Spotfire Statistics Services was detected.
  tags: tech,tibco,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/SplusServer/"
      - "{{BaseURL}}/RServer/"
      - "{{BaseURL}}/TERR/"
      - "{{BaseURL}}"
    matchers:
      - type: dsl
        condition: or


Instruction: Generate a Nuclei template for: AEM Secrets - Sensitive Information Disclosure

Input:
Title: AEM Secrets - Sensitive Information Disclosure
Summary: AEM Secrets - Sensitive Information Disclosure. Possible Juicy Files can be discovered at this endpoint. Search / Grep for secrets like hashed passwords ( SHA ) , internal email disclosure etc.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: aem-secrets

info:
  name: AEM Secrets - Sensitive Information Disclosure
  author: boobooHQ,j3ssie
  severity: high
  description: Possible Juicy Files can be discovered at this endpoint. Search / Grep for secrets like hashed passwords ( SHA ) , internal email disclosure etc.
  tags: aem,adobe,misconfig,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}//content/dam/formsanddocuments.form.validator.html/home/....children.tidy...infinity..json"
      - "{{BaseURL}}/..;//content/dam/formsanddocuments.form.validator.html/home/....children.tidy...infinity..json"
    matchers:
      - type: word
        words:
          - ""jcr:uuid""
          - ""jcr:createdBy""
          - ""uri""
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Insecure cross-domain.xml file

Input:
Title: Insecure cross-domain.xml file
Summary: Insecure cross-domain.xml file. Tags: exposure, generic, files
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: insecure-crossdomain

info:
  name: Insecure cross-domain.xml file
  author: Borna Nematzadeh,nadino
  severity: info
  description: Insecure cross-domain.xml file
  tags: exposure,generic,files,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/crossdomain.xml"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "<allow-access-from domain="*"/>"
        part: body


Instruction: Generate a Nuclei template for: rConfig Security Checks

Input:
Title: rConfig Security Checks
Summary: rConfig Security Checks. A simple workflow that runs all rConfig related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: rconfig-workflow

info:
  name: rConfig Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all rConfig related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: GeoVision Geowebserver <= 5.3.3 - Local File Inclusion / Cross-Site Scripting

Input:
Title: GeoVision Geowebserver <= 5.3.3 - Local File Inclusion / Cross-Site Scripting
Summary: GeoVision Geowebserver <= 5.3.3 - Local File Inclusion / Cross-Site Scripting. GEOVISION GEOWEBSERVER <= 5.3.3 is vulnerable to several XSS, HTML Injection, and Local File Include (LFI) vectors. The application fails to properly sanitize user requests, allowing injection of HTML code and XSS, as well as client-side exploitation, including session theft.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: geovision-geowebserver-lfi-xss

info:
  name: GeoVision Geowebserver <= 5.3.3 - Local File Inclusion / Cross-Site Scripting
  author: shamo0
  severity: high
  description: GEOVISION GEOWEBSERVER <= 5.3.3 is vulnerable to several XSS, HTML Injection, and Local File Include (LFI) vectors. The application fails to properly sanitize user requests, allowing injection of HTML code and XSS, as well as client-side exploitation, including session theft.
  tags: geovision,geowebserver,lfi,xss,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Cross-site Scripting

Input:
Title: Cross-site Scripting (CWE-79)
Summary: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. There are many variants of cross-site scripting, characterized by a variety of terms or involving different attack topologies. However, they all indicate the same fundamental weakness: improper neutralization of dangerous input between the adversary and a victim.
Vulnerability Type: Cross-site Scripting
Severity: high
Indicators: vulnerability detected, error

Output:
id: wp-knews-xss

info:
  name: WordPress Knews Multilingual Newsletters 1.1.0 - Cross-Site Scripting
  author: daffainfo
  severity: high
  description: WordPress Knews Multilingual Newsletters 1.1.0 plugin contains a cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  tags: wordpress,xss,wp-plugin,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Knews Multilingual Newsletters"
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/knews/wysiwyg/fontpicker/?ff=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "</script><script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Zen Cart Installer

Input:
Title: Zen Cart Installer
Summary: Zen Cart Installer. Zen Cart is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: zencart-installer

info:
  name: Zen Cart Installer
  author: DhiyaneshDk
  severity: high
  description: Zen Cart is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,zencart,install,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/zc_install/index.php"
    matchers:
      - type: word
        words:
          - "<title>Zen Cart® Installer</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Default VPC Network In Use

Input:
Title: Default VPC Network In Use
Summary: Default VPC Network In Use. Ensure that your Google Cloud Platform (GCP) projects are not using the default Virtual Private Cloud (VPC) network. Using the default VPC network does not adhere to security best practices and may not meet specific networking requirements.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: gcloud-default-vpc-in-use

info:
  name: Default VPC Network In Use
  author: princechaddha
  severity: medium
  description: Ensure that your Google Cloud Platform (GCP) projects are not using the default Virtual Private Cloud (VPC) network. Using the default VPC network does not adhere to security best practices and may not meet specific networking requirements.
  tags: cloud,devops,gcp,gcloud,google-cloud-vpc,networking,security,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: openam-panel

info:
  name: OpenAM Login Panel - Detect
  author: philippedelteil
  severity: info
  description: OpenAM login panel was detected.
  tags: panel,openam,opensso,login,forgerock,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}{{paths}}"
    matchers:
      - type: word
        words:
          - "urlArgs: "v="
          - "Sign in to OpenAM"
          - "ForgeRock"
          - "forgerock"
          - "FRForgotUsername"
          - "successfulUserRegistrationDestination"
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-1208

Input:
Title: Unknown Vulnerability in learndash learndash
Summary: The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it possible for unauthenticated attackers to obtain access to quiz questions.
Vulnerability Type: Unknown Vulnerability
Severity: medium
Affected Products: learndash learndash
Indicators: error, vulnerability detected

Output:
id: CVE-2024-1208

info:
  name: LearnDash LMS < 4.10.3 - Sensitive Information Exposure
  author: ritikchaddha
  severity: medium
  description: The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it possible for unauthenticated attackers to obtain access to quiz questions.
  tags: cve,cve2024,wp,wp-plugin,wordpress,exposure,learndash,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/wp/v2/sfwd-question"
    matchers:
      - type: word
        words:
          - ""id":"
          - ""question_type":"
          - ""points_total":"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect SQL Injection

Input:
Title: SQL Injection (CWE-89)
Summary: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Vulnerability Type: SQL Injection
Severity: critical
Indicators: vulnerability detected, error

Output:
id: duomicms-sql-injection

info:
  name: Duomi CMS - SQL Injection
  author: pikpikcu
  severity: critical
  description: Duomi CMS contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
  tags: duomicms,sqli,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/duomiphp/ajax.php?action=addfav&id=1&uid=1%20and%20extractvalue(1,concat_ws(1,1,md5({{num}})))"
    matchers:
      - type: word
        words:
          - "{{md5({{num}})}}"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-23697

Input:
Title: Cross-Site Scripting (XSS) in monstra monstra_cms
Summary: Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: monstra monstra_cms
Indicators: error, vulnerability detected

Output:
id: CVE-2020-23697

info:
  name: Monstra CMS 3.0.4 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: Monstra CMS 3.0.4 contains a cross-site scripting vulnerability via the page feature in admin/index.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  tags: cve,cve2020,xss,mostra,mostracms,cms,authenticated,monstra,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-39109

Input:
Title: Vulnerability (CWE-918) in rconfig rconfig
Summary: rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
Vulnerability Type: Vulnerability (CWE-918)
Severity: high
Affected Products: rconfig rconfig
Indicators: error, vulnerability detected

Output:
id: CVE-2023-39109

info:
  name: rConfig 3.9.4 - Server-Side Request Forgery
  author: theamanrawat
  severity: high
  description: rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
  tags: cve2023,cve,rconfig,authenticated,ssrf,lfi,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "rConfig"
        part: body_1
      - type: regex
        part: body_3
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-25231

Input:
Title: Path Traversal in CVE-2025-25231
Summary: Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET requests (read-only) to restricted API endpoints.
Vulnerability Type: Path Traversal
Severity: high
Indicators: error, vulnerability detected

Output:
id: CVE-2025-25231

info:
  name: Omnissa Workspace ONE UEM - Path Traversal
  author: DhiyaneshDK,slcyber
  severity: high
  description: Omnissa Workspace ONE UEM contains a path traversal caused by crafted GET requests to restricted API endpoints, letting malicious actors access sensitive information, exploit requires sending crafted requests.
  tags: cve,cve2025,omnissa,workspace,airwatch,traversal,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Veracore Login - Detect

Input:
Title: Veracore Login - Detect
Summary: Veracore Login - Detect. A veracore login panel was detected.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: veracore-panel

info:
  name: Veracore Login - Detect
  author: rxerium
  severity: info
  description: A veracore login panel was detected.
  tags: panel,veracore,login,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/veracore/Home/#systems"
    matchers:
      - type: word
        words:
          - "VeraCore"
          - "/veracore/img/LoginLogo.png"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Gespage Security Checks

Input:
Title: Gespage Security Checks
Summary: Gespage Security Checks. A simple workflow that runs all Gespage related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: gespage-workflow

info:
  name: Gespage Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all Gespage related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: unauthenticated-frp

info:
  name: FRPS Dashboard - Detect
  author: pikpikcu
  severity: info
  description: FRPS Dashboard panel was detected.
  tags: frp,unauth,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/static/"
    matchers:
      - type: word
        words:
          - "<title>frps dashboard</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Frameio API Token

Input:
Title: Frameio API Token
Summary: Frameio API Token. Tags: frameio, exposure, tokens
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: frameio-token

info:
  name: Frameio API Token
  author: DhiyaneshDK
  severity: info
  description: Frameio API Token
  tags: frameio,exposure,tokens,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-25078

Input:
Title: Cross-Site Scripting (XSS) in wpaffiliatemanager affiliates_manager
Summary: The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: wpaffiliatemanager affiliates_manager
Indicators: error, vulnerability detected

Output:
id: CVE-2021-25078

info:
  name: Affiliates Manager < 2.9.0 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: The plugin does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.
  tags: cve2021,cve,wp,wordpress,authenticated,affiliates-manager,wp-plugin,xss,wpscan,wpaffiliatemanager,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Microsoft Exchange Server Detect

Input:
Title: Microsoft Exchange Server Detect
Summary: Microsoft Exchange Server Detect. Check for presence of Exchange Server using Outlook Web App path data.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: ms-exchange-server

info:
  name: Microsoft Exchange Server Detect
  author: pikpikcu,dhiyaneshDK
  severity: info
  description: Check for presence of Exchange Server using Outlook Web App path data.
  tags: microsoft,exchange,tech,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/owa/auth/logon.aspx"
    matchers:
      - type: regex
        part: header
      - type: regex
        part: body
      - type: word
        words:
          - "<title>Exchange Log In</title>"
          - "<title>Microsoft Exchange - Outlook Web Access</title>"


Instruction: Generate a Nuclei template for CVE-2025-29925

Input:
Title: Vulnerability (CWE-402) in xwiki xwiki
Summary: XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with "Prevent unregistered user to view pages": the endpoint would still list the pages of the wiki, though only for the main wiki. The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights.
Vulnerability Type: Vulnerability (CWE-402)
Severity: medium
Affected Products: xwiki xwiki
Indicators: error, vulnerability detected

Output:
id: CVE-2025-29925

info:
  name: XWiki REST API - Private Pages Disclosure
  author: ritikchaddha
  severity: high
  description: A vulnerability in XWiki's REST API allows unauthenticated users to access information about private pages through the pages endpoint. This could lead to disclosure of sensitive information and page metadata.
  tags: cve,cve2025,xwiki,rest-api,exposure,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/{{path}}"
    matchers:
      - type: word
        words:
          - "<pageSummary"
          - "<pages"
          - "<xwikiRelativeUr"
        part: body
        condition: and
      - type: word
        words:
          - "text/xml"
          - "text/javascript"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-40630

Input:
Title: Vulnerability (CWE-601) in icewarp mail_server
Summary: Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to redirect a user to any domain by sending a malicious URL to the victim, for example “ https://icewarp.domain.com//<MALICIOUS_DOMAIN>/%2e%2e” https://icewarp.domain.com///%2e%2e” . This vulnerability has been tested in Firefox.
Vulnerability Type: Vulnerability (CWE-601)
Severity: medium
Affected Products: icewarp mail_server
Indicators: error, vulnerability detected

Output:
id: CVE-2025-40630

info:
  name: IceWarp Mail Server ≤11.4.0 - Open Redirect
  author: DhiyaneshDK
  severity: medium
  description: IceWarp Mail Server version 11.4.0 and below contains an open redirect vulnerability that allows attackers to redirect users to arbitrary external domains through malicious URLs.
  tags: cve,cve2025,icewarp,redirect,open-redirect,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/%2f%5c%2foast.pro%2f.."
    matchers:
      - type: regex
        part: header
      - type: status
        status:
          - 302


Instruction: Generate a Nuclei template for: Docker Daemon Exposed

Input:
Title: Docker Daemon Exposed
Summary: Docker Daemon Exposed. Docker Daemon exposed on the network map can help remote attacker to gain access to the Docker containers and potentially the host system.

Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: docker-daemon-exposed

info:
  name: Docker Daemon Exposed
  author: Arm!tage
  severity: critical
  description: Docker Daemon exposed on the network map can help remote attacker to gain access to the Docker containers and potentially the host system.
  tags: docker,exposure,misconfig,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Insufficiently Protected Credentials

Input:
Title: Insufficiently Protected Credentials (CWE-522)
Summary: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Vulnerability Type: Insufficiently Protected Credentials
Severity: medium
Indicators: unauthorized

Output:
id: huawei-HG532e-default-login

info:
  name: Huawei HG532e Default Credential
  author: pussycat0x
  severity: high
  description: Huawei HG532e default admin credentials were discovered.
  tags: default-login,huawei,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Set-Cookie: SessionID"
        part: header
      - type: word
        words:
          - "<title>replace</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Service Account Creation Not Disabled

Input:
Title: Service Account Creation Not Disabled
Summary: Service Account Creation Not Disabled. Ensure that the creation of Cloud IAM service accounts is prevented within your Google Cloud organization through the "Disable Service Account Creation" organization policy. This allows you to easily centralize the management of your service accounts while not restricting the other permissions that your developers and administrators have on the projects within the organization.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: gcloud-org-service-account-creation

info:
  name: Service Account Creation Not Disabled
  author: princechaddha
  severity: medium
  description: Ensure that the creation of Cloud IAM service accounts is prevented within your Google Cloud organization through the "Disable Service Account Creation" organization policy. This allows you to easily centralize the management of your service accounts while not restricting the other permissions that your developers and administrators have on the projects within the organization.
  tags: cloud,devops,gcp,gcloud,resourcemanager,security,iam,service-account,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Booked < 2.2.6 - Broken Authentication

Input:
Title: Booked < 2.2.6 - Broken Authentication
Summary: Booked < 2.2.6 - Broken Authentication. The Booked plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions hooked via AJAX actions in versions up to, and including, 2.2.5. This makes it possible for authenticated attackers with subscriber-level permissions and above to execute several unauthorized actions.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: booked-export-csv

info:
  name: Booked < 2.2.6 - Broken Authentication
  author: random-robbie
  severity: high
  description: The Booked plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions hooked via AJAX actions in versions up to, and including, 2.2.5. This makes it possible for authenticated attackers with subscriber-level permissions and above to execute several unauthorized actions.
  tags: wordpress,wpscan,wp-plugin,wp,booked,bypass,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "End Time"
          - "Start Time"
          - "Calendar"
        part: body
        condition: and
      - type: word
        words:
          - "text/csv"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Authentik Panel - Detect

Input:
Title: Authentik Panel - Detect
Summary: Authentik Panel - Detect. An Authentik search engine was detected.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: authentik-panel

info:
  name: Authentik Panel - Detect
  author: rxerium
  severity: info
  description: An Authentik search engine was detected.
  tags: authentik,sso,mfa,panel,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/static/dist/assets/icons/icon.png"
    matchers:
      - type: word
        words:
          - "<title>authentik</title>"
          - "window.authentik"
          - "authentik.css"
        part: body
        condition: or
      - type: dsl


Instruction: Generate a Nuclei template for CVE-2023-48777

Input:
Title: Unrestricted File Upload in elementor website_builder
Summary: Unrestricted Upload of File with Dangerous Type vulnerability in Elementor.Com Elementor Website Builder.This issue affects Elementor Website Builder: from 3.3.0 through 3.18.1.

Vulnerability Type: Unrestricted File Upload
Severity: critical
Affected Products: elementor website_builder
Indicators: error, vulnerability detected

Output:
id: CVE-2023-48777

info:
  name: WordPress Elementor 3.18.1 - File Upload/Remote Code Execution
  author: DhiyaneshDK
  severity: critical
  description: The plugin is vulnerable to Remote Code Execution via file upload via the template import functionality, allowing authenticated attackers, with contributor-level access and above, to upload files and execute code on the server.
  tags: cve,cve2023,elementor,file-upload,intrusive,rce,wpscan,wordpress,wp-plugin,authenticated,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2021-41293

Input:
Title: Path Traversal in ecoa ecs_router_controller-ecs_firmware and others
Summary: ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attackers can remotely disclose arbitrary files on the affected device and disclose sensitive and system information.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: ecoa ecs_router_controller-ecs_firmware, ecoa riskbuster_firmware, ecoa riskterminator
Indicators: error, vulnerability detected

Output:
id: CVE-2021-41293

info:
  name: ECOA Building Automation System - Arbitrary File Retrieval
  author: 0x_Akoko
  severity: high
  description: The ECOA BAS controller suffers from an arbitrary file disclosure vulnerability. Using the 'fname' POST parameter in viewlog.jsp, attackers can disclose arbitrary files on the affected device and disclose sensitive and system information.
  tags: cve2021,cve,ecoa,lfi,disclosure,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2019-17231

Input:
Title: Cross-Site Scripting (XSS) in mageewp onetone
Summary: includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: mageewp onetone
Indicators: error, vulnerability detected

Output:
id: CVE-2019-17231

info:
  name: WordPress OneTone theme <= 3.0.6 – Unauthenticated Stored XSS
  author: daffainfo
  severity: medium
  description: includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.
  tags: cve,cve2019,wordpress,wp-theme,wp,onetone,xss,intrusive,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: public

info:
  name: Public User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Public user name information check was conducted.
  tags: osint,osint-finance,public,discovery

http:
  - method: GET
    path:
      - "https://public.com/@{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - ") Investment Portfolio on Public"
        part: body


Instruction: Generate a Nuclei template for: Backwash Malware Hash - Detect

Input:
Title: Backwash Malware Hash - Detect
Summary: Backwash Malware Hash - Detect. CPP loader for the Backwash malware.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: backwash-malware-hash

info:
  name: Backwash Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: CPP loader for the Backwash malware.
  tags: malware,xegroup

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-24275

Input:
Title: Cross-Site Scripting (XSS) in supsystic popup
Summary: The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: supsystic popup
Indicators: error, vulnerability detected

Output:
id: CVE-2021-24275

info:
  name: Popup by Supsystic <1.10.5 - Cross-Site scripting
  author: dhiyaneshDK
  severity: medium
  description: WordPress Popup by Supsystic before 1.10.5 did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected cross-site scripting issue.
  tags: cve2021,cve,wpscan,packetstorm,wordpress,wp-plugin,supsystic,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/admin.php?page=popup-wp-supsystic&tab=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "</script><script>alert(document.domain)</script>"
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Path Traversal

Input:
Title: Path Traversal (CWE-22)
Summary: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escap
Vulnerability Type: Path Traversal
Severity: high
Indicators: unexpected

Output:
id: wp-tinymce-lfi

info:
  name: Tinymce Thumbnail Gallery <=1.0.7 - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: Tinymce Thumbnail Gallery 1.0.7 and before are vulnerable to local file inclusion via download-image.php.
  tags: wpscan,wordpress,wp-theme,lfi,tinymce,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/tinymce-thumbnail-gallery/php/download-image.php?href=../../../../wp-config.php"
    matchers:
      - type: word
        words:
          - "DB_NAME"
          - "DB_PASSWORD"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: fortinet-fortios-management-panel

info:
  name: Fortinet FortiOS Management Interface Panel - Detect
  author: mbmy
  severity: info
  description: Fortinet FortiOS Management interface panel was detected.
  tags: panel,fortinet,fortios,fortigate,fortiproxy,fortiap,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login?redir=/ng"
    matchers:
      - type: word
        words:
          - "<html class="main-app">"
          - "<f-icon class="fa-warning"
          - "</f-icon>"
        condition: and
      - type: word
        words:
          - "APSCOOKIE_"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-28976

Input:
Title: Vulnerability (CWE-918) in canto canto
Summary: The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain=SSRF.
Vulnerability Type: Vulnerability (CWE-918)
Severity: medium
Affected Products: canto canto
Indicators: error, vulnerability detected

Output:
id: CVE-2020-28976

info:
  name: WordPress Canto 1.3.0 - Blind Server-Side Request Forgery
  author: LogicalHunter
  severity: medium
  description: WordPress Canto plugin 1.3.0 is susceptible to blind server-side request forgery. An attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  tags: cve2020,cve,packetstorm,ssrf,wordpress,wp-plugin,oast,edb,canto,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Canto"
          - "Tested up to:"
        condition: and
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/canto/includes/lib/detail.php?subdomain={{interactsh-url}}"
      - "{{BaseURL}}/wp-content/plugins/canto/includes/lib/get.php?subdomain={{interactsh-url}}"
      - "{{BaseURL}}/wp-content/plugins/canto/includes/lib/tree.php?subdomain={{interactsh-url}}"
    matchers:
      - type: word
        words:
          - "http"
        part: interactsh_protocol
      - type: word
        words:
          - "null"
        part: body
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2005-3344

Input:
Title: Unknown Vulnerability in horde horde
Summary: The default installation of Horde 3.0.4 contains an administrative account with a blank password, which allows remote attackers to gain access.
Vulnerability Type: Unknown Vulnerability
Severity: high
Affected Products: horde horde
Indicators: error, vulnerability detected

Output:
id: CVE-2005-3344

info:
  name: Horde Groupware Unauthenticated Admin Access
  author: pikpikcu
  severity: critical
  description: Horde Groupware contains an administrative account with a blank password, which allows remote attackers to gain access.
  tags: cve2005,cve,horde,unauth,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/horde/admin/user.php"
      - "{{BaseURL}}/admin/user.php"
    matchers:
      - type: word
        words:
          - "<title>Horde :: User Administration</title>"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: SPNEGO - Detect

Input:
Title: SPNEGO - Detect
Summary: SPNEGO - Detect. SPNEGO stands for Simple and Protected GSSAPI Negotiation Mechanism. It is a protocol used for secure authentication and negotiation between client and server applications in a network environment. SPNEGO is based on the Generic Security Services Application Programming Interface (GSSAPI) framework.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: spnego-detect

info:
  name: SPNEGO - Detect
  author: lady_bug,ruppde
  severity: info
  description: SPNEGO stands for Simple and Protected GSSAPI Negotiation Mechanism. It is a protocol used for secure authentication and negotiation between client and server applications in a network environment. SPNEGO is based on the Generic Security Services Application Programming Interface (GSSAPI) framework.
  tags: miscellaneous,misc,windows,spnego,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl


Instruction: Generate a Nuclei template for: Alibaba Mongoshake Unauth

Input:
Title: Alibaba Mongoshake Unauth
Summary: Alibaba Mongoshake Unauth. Tags: mongoshake, unauth, alibaba
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: alibaba-mongoshake-unauth

info:
  name: Alibaba Mongoshake Unauth
  author: pikpikcu
  severity: info
  description: Alibaba Mongoshake Unauth
  tags: mongoshake,unauth,alibaba,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers:
      - type: word
        words:
          - "{"Uri":"/worker","Method":"GET"}"
      - type: word
        words:
          - "text/plain"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: geocaching

info:
  name: Geocaching User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Geocaching user name information check was conducted.
  tags: osint,osint-social,geocaching,discovery

http:
  - method: GET
    path:
      - "https://www.geocaching.com/p/?u={{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Groundspeak - User Profile"
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: furaffinity

info:
  name: FurAffinity User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: FurAffinity user name information check was conducted.
  tags: osint,osint-images,furaffinity,discovery

http:
  - method: GET
    path:
      - "https://www.furaffinity.net/user/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "<title>Userpage of"
        part: body


Instruction: Generate a Nuclei template for CVE-2023-2256

Input:
Title: Cross-Site Scripting (XSS) in themeisle product_addons_\&_fields_for_woocommerce
Summary: The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: themeisle product_addons_\&_fields_for_woocommerce
Indicators: error, vulnerability detected

Output:
id: CVE-2023-2256

info:
  name: WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting
  author: ritikchaddha
  severity: high
  description: The Product Addons & Fields for WooCommerce WordPress plugin before version 32.0.7 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape some URL parameters in the admin panel, which could allow attackers to execute arbitrary JavaScript code in an administrator's browser context.
  tags: cve,cve2023,wp,wordpress,wp-plugin,xss,woocommerce,woocommerce-product-addon,authenticated,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "woocommerce-product-addon"
          - "woocommerce"
        part: body
        condition: and
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""><script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: itchio

info:
  name: Itch.io User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Itch.io user name information check was conducted.
  tags: osint,osint-gaming,itchio,discovery

http:
  - method: GET
    path:
      - "https://itch.io/profile/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "A member registered"
        part: body


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - Firebaseio Rentokil

Input:
Title: Content-Security-Policy Bypass - Firebaseio Rentokil
Summary: Content-Security-Policy Bypass - Firebaseio Rentokil
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: firebaseio-rentokil-csp-bypass

info:
  name: Content-Security-Policy Bypass - Firebaseio Rentokil
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - Firebaseio Rentokil
  tags: xss,csp-bypass,firebaseio-rentokil,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "firebaseio.com"
        part: header
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: fark

info:
  name: Fark User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Fark user name information check was conducted.
  tags: osint,osint-social,fark,discovery

http:
  - method: GET
    path:
      - "https://www.fark.com/users/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Fark account number"
        part: body


Instruction: Generate a Nuclei template to detect Path Traversal

Input:
Title: Path Traversal (CWE-22)
Summary: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escap
Vulnerability Type: Path Traversal
Severity: high
Indicators: unexpected

Output:
id: cherry-file-download

info:
  name: Cherry Plugin < 1.2.7 - Arbitrary File Retrieval and File Upload
  author: 0x_Akoko
  severity: high
  description: WordPress plugin Cherry < 1.2.7 contains an unauthenticated file upload and download vulnerability, allowing attackers to upload and download arbitrary files. This could result in attacker uploading backdoor shell scripts or downloading the wp-config.php file.
  tags: wordpress,wp-plugin,lfi,wpscan,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/cherry-plugin/admin/import-export/download-content.php?file=../../../../../wp-config.php"
    matchers:
      - type: word
        words:
          - "DB_NAME"
          - "DB_PASSWORD"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: kafka-consumer-monitor

info:
  name: Apache Kafka Consumer Offset Monitor Panel - Detect
  author: dhiyaneshDK
  severity: info
  description: Apache Kafka Consumer Offset Monitor panel was detected.
  tags: panel,kafka,apache,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Kafka Consumer Offset Monitor</title>"


Instruction: Generate a Nuclei template for CVE-2022-34093

Input:
Title: Cross-Site Scripting (XSS) in softwarepublico i3geo
Summary: Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via access_token.php.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: softwarepublico i3geo
Indicators: error, vulnerability detected

Output:
id: CVE-2022-34093

info:
  name: Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via access_token.php.
  tags: cve,cve2022,i3geo,xss,softwarepublico,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/i3geo/pacotes/linkedinoauth/example/access_token.php?=%3Cscript%3Ealert(document.domain)%3C/script%3E"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Security Onion Panel - Detect

Input:
Title: Security Onion Panel - Detect
Summary: Security Onion Panel - Detect. Security Onion is a free and open source Linux distribution for intrusion detection, security monitoring, and log management. It includes CyberChef, NetworkMiner, and many other security tools.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: security-onion-panel

info:
  name: Security Onion Panel - Detect
  author: rxerium
  severity: info
  description: Security Onion is a free and open source Linux distribution for intrusion detection, security monitoring, and log management. It includes CyberChef, NetworkMiner, and many other security tools.
  tags: panel,security,onion,detect,securityonionsolutions,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/login/"
    matchers:
      - type: word
        words:
          - "<title>Security Onion"
          - "Login to Security Onion"
          - "Security Onion Solutions"
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Blazor WebAssembly - Detect

Input:
Title: Blazor WebAssembly - Detect
Summary: Blazor WebAssembly - Detect. Blazor WebAssembly application was detected.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: blazor-webassembly-detect

info:
  name: Blazor WebAssembly - Detect
  author: righettod
  severity: info
  description: Blazor WebAssembly application was detected.
  tags: blazor,webassembly,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/_framework/blazor.boot.json"
    matchers:
      - type: word
        words:
          - "dotnet.wasm"
          - ""entryAssembly""
          - ""Microsoft.JSInterop.WebAssembly.dll""
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2019-20085

Input:
Title: Path Traversal in tvt nvms-1000_firmware
Summary: TVT NVMS-1000 devices allow GET /.. Directory Traversal
Vulnerability Type: Path Traversal
Severity: high
Affected Products: tvt nvms-1000_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2019-20085

info:
  name: TVT NVMS 1000 - Local File Inclusion
  author: daffainfo
  severity: high
  description: TVT NVMS-1000 devices allow GET /.. local file inclusion attacks.
  tags: cve,cve2019,iot,lfi,kev,edb,packetstorm,tvt,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fwindows%2Fwin.ini"
    matchers:
      - type: regex
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2015-4063

Input:
Title: Cross-Site Scripting (XSS) in newstatpress_project newstatpress
Summary: Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the where1 parameter in the nsp_search page to wp-admin/admin.php.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: low
Affected Products: newstatpress_project newstatpress
Indicators: error, vulnerability detected

Output:
id: CVE-2015-4063

info:
  name: NewStatPress <0.9.9 - Cross-Site Scripting
  author: r3Y3r53
  severity: low
  description: WordPress NewStatPress plugin before 0.9.9 contains a cross-site scripting vulnerability in includes/nsp_search.php. The plugin allows remote authenticated users to inject arbitrary web script or HTML via the where1 parameter in the nsp_search page to wp-admin/admin.php.
  tags: cve2015,cve,xss,wordpress,wp-plugin,wp,newstatpress,packetstorm,newstatpress_project,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-26843

Input:
Title: Cross-Site Scripting (XSS) in churchcrm churchcrm
Summary: A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: churchcrm churchcrm
Indicators: error, vulnerability detected

Output:
id: CVE-2023-26843

info:
  name: ChurchCRM 4.5.3 - Cross-Site Scripting
  author: Harsh
  severity: medium
  description: A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php.
  tags: cve2023,cve,churchcrm,stored-xss,xss,authenticated,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Selea Targa IP OCR-ANPR Camera - Unauthenticated SSRF

Input:
Title: Selea Targa IP OCR-ANPR Camera - Unauthenticated SSRF
Summary: Selea Targa IP OCR-ANPR Camera - Unauthenticated SSRF. Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the Selea ANPR camera within several functionalities. The application parses user supplied data in the POST JSON parameters 'ipnotify_address' and 'url' to construct an image request or check DNS for IP notification. Since no validation is carried out on the parameters, an attacker can specify an external domain and force the application to make an HTTP request to an
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: targa-camera-ssrf

info:
  name: Selea Targa IP OCR-ANPR Camera - Unauthenticated SSRF
  author: gy741
  severity: high
  description: Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the Selea ANPR camera within several functionalities. The application parses user supplied data in the POST JSON parameters 'ipnotify_address' and 'url' to construct an image request or check DNS for IP notification. Since no validation is carried out on the parameters, an attacker can specify an external domain and force the application to make an HTTP request to an arbitrary destination host. This can be used by an external attacker for example to bypass firewalls and initiate a service and network enumeration on the internal network through the affected application.
  tags: targa,ssrf,oast,iot,camera,selea,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "http"
        part: interactsh_protocol


Instruction: Generate a Nuclei template for: vsFTPd Service - Detect

Input:
Title: vsFTPd Service - Detect
Summary: vsFTPd Service - Detect. vsFTPd FTP service was detected.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: vsftpd-detect

info:
  name: vsFTPd Service - Detect
  author: pussycat0x
  severity: info
  description: vsFTPd FTP service was detected.
  tags: network,ftp,vsftpd,detect,tcp,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-40879

Input:
Title: Cross-Site Scripting (XSS) in keking kkfileview
Summary: kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.'
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: keking kkfileview
Indicators: error

Output:
id: CVE-2022-40879

info:
  name: kkFileView 4.1.0 - Cross-Site Scripting
  author: arafatansari,co5mos
  severity: medium
  description: kkFileView 4.1.0 contains multiple cross-site scripting vulnerabilities via the errorMsg parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  tags: cve,cve2022,kkFileView,xss,keking,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/onlinePreview?url=aHR0cHM6Ly93d3cuZ29vZ2xlLjxpbWcgc3JjPTEgb25lcnJvcj1hbGVydChkb2N1bWVudC5kb21haW4pPj1QUQ=="
    matchers:
      - type: word
        words:
          - "<img src=1 onerror=alert(document.domain)>=PQ</p>"
          - "该文件不"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Dangling DNS Records Check

Input:
Title: Dangling DNS Records Check
Summary: Dangling DNS Records Check. Ensure that dangling DNS records are removed from your public Cloud DNS zones in order to maintain the integrity and authenticity of your domains/subdomains and to protect against domain hijacking.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: gcloud-dns-dangling-records

info:
  name: Dangling DNS Records Check
  author: princechaddha
  severity: high
  description: Ensure that dangling DNS records are removed from your public Cloud DNS zones in order to maintain the integrity and authenticity of your domains/subdomains and to protect against domain hijacking.
  tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Hanta Internet Behavior Management System - Remote Code Execution

Input:
Title: Hanta Internet Behavior Management System - Remote Code Execution
Summary: Hanta Internet Behavior Management System - Remote Code Execution. Hanta Internet Behavior Management System is vulnerable to RCE.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: hanta-rce

info:
  name: Hanta Internet Behavior Management System - Remote Code Execution
  author: momika233
  severity: high
  description: Hanta Internet Behavior Management System is vulnerable to RCE.
  tags: hanta,rce,unauth,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/dgn/dgn_tools/ping.php?ipdm=2;id;"
    matchers:
      - type: regex
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2017-1000486

Input:
Title: Vulnerability (CWE-326) in primetek primefaces
Summary: Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
Vulnerability Type: Vulnerability (CWE-326)
Severity: critical
Affected Products: primetek primefaces
Indicators: error, vulnerability detected

Output:
id: CVE-2017-1000486

info:
  name: Primetek Primefaces 5.x - Remote Code Execution
  author: Moritz Nentwig
  severity: critical
  description: Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution.
  tags: cve2017,cve,primetek,rce,injection,kev,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Mogwailabs: CHECKCHECK"
        part: header


Instruction: Generate a Nuclei template for CVE-2023-40504

Input:
Title: OS Command Injection in lg simple_editor
Summary: LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the readVideoInfo method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
. Was ZDI-CAN-19953.
Vulnerability Type: OS Command Injection
Severity: critical
Affected Products: lg simple_editor
Indicators: error, vulnerability detected

Output:
id: CVE-2023-40504

info:
  name: LG Simple Editor <= v3.21.0 - Command Injection
  author: s4e-io
  severity: critical
  description: LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the readVideoInfo method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
  tags: cve,cve2023,lg,simple-editor,intrusive,rce,file-upload,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2011-4618

Input:
Title: Cross-Site Scripting (XSS) in simplerealtytheme advanced_text_widget_plugin
Summary: Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: simplerealtytheme advanced_text_widget_plugin
Indicators: error, vulnerability detected

Output:
id: CVE-2011-4618

info:
  name: Advanced Text Widget < 2.0.2 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
  tags: cve2011,cve,wordpress,xss,wp-plugin,simplerealtytheme,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Use of Hard-coded Credentials

Input:
Title: Use of Hard-coded Credentials (CWE-798)
Summary: The product contains hard-coded credentials, such as a password or cryptographic key. There are two main variations:
		    Inbound: the product contains an authentication mechanism that checks the input credentials against a hard-coded set of credentials. In this variant, a default administration account is created, and a simple password is hard-coded into the product and associated with that account. This hard-coded password is the same for each installation of the product, and it usually cann
Vulnerability Type: Use of Hard-coded Credentials
Severity: high
Indicators: vulnerability detected, error

Output:
id: dell-idrac9-default-login

info:
  name: DELL iDRAC9 - Default Login
  author: kophjager007,milo2012
  severity: high
  description: DELL iDRAC9 default login credentials was discovered.
  tags: dell,idrac,default-login,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
      - type: status
        status:
          - 201


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: ixcache-panel

info:
  name: iXCache Login Panel - Detect
  author: ffffffff0x
  severity: info
  description: iXCache login panel was detected.
  tags: ixcache,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>iXCache</title>"
        part: body
      - type: status
        status:
          - 302